diff --git a/doc/stdenv/cross-compilation.chapter.md b/doc/stdenv/cross-compilation.chapter.md
index 26630b78fd73..04159d93c57f 100644
--- a/doc/stdenv/cross-compilation.chapter.md
+++ b/doc/stdenv/cross-compilation.chapter.md
@@ -235,13 +235,24 @@ One would think that `localSystem` and `crossSystem` overlap horribly with the t
 
 ### Implementation of dependencies {#ssec-cross-dependency-implementation}
 
-The categories of dependencies developed in [](#ssec-cross-dependency-categorization) are specified as lists of derivations given to `mkDerivation`, as documented in [](#ssec-stdenv-dependencies). In short, each list of dependencies for `host → target` is called `deps<host><target>` (where `host`, and `target` values are either `build`, `host`, or `target`), with exceptions for backwards compatibility that `depsBuildHost` is instead called `nativeBuildInputs` and `depsHostTarget` is instead called `buildInputs`. Nixpkgs is now structured so that each `deps<host><target>` is automatically taken from `pkgs<host><target>`. (These `pkgs<host><target>`s are quite new, so there is no special case for `nativeBuildInputs` and `buildInputs`.) For example, `pkgsBuildHost.gcc` should be used at build-time, while `pkgsHostTarget.gcc` should be used at run-time.
+The categories of dependencies developed in [](#ssec-cross-dependency-categorization) are specified as lists of derivations given to `mkDerivation`, as documented in [](#ssec-stdenv-dependencies). In short, each list of dependencies for `host → target` is called `deps<theirHost><theirTarget>` (where `theirHost`, and `theirTarget` values are either `build`, `host`, or `target`), with exceptions for backwards compatibility that `depsBuildHost` is instead called `nativeBuildInputs` and `depsHostTarget` is instead called `buildInputs`. Nixpkgs is now structured so that each `deps<theirHost><theirTarget>` is automatically taken from `pkgs<theirHost><theirTarget>`. (These `pkgs<theirHost><theirTarget>`s are quite new, so there is no special case for `nativeBuildInputs` and `buildInputs`.) For example, `pkgsBuildHost.gcc` should be used at build-time, while `pkgsHostTarget.openssl` should be used at run-time.
 
-Now, for most of Nixpkgs's history, there were no `pkgs<host><target>` attributes, and most packages have not been refactored to use it explicitly. Prior to those, there were just `buildPackages`, `pkgs`, and `targetPackages`. Those are now redefined as aliases to `pkgsBuildHost`, `pkgsHostTarget`, and `pkgsTargetTarget`. It is acceptable, even recommended, to use them for libraries to show that the host platform is irrelevant.
+Adjacent package sets are defined as `pkgs<theirHost><theirTarget>` attributes, where "their" represents the new attribute set, and "our" represents the "current" package set. Below is a table of adjacent stages and their aliases. See [](#variables-specifying-dependencies) for usage examples.
 
-But before that, there was just `pkgs`, even though both `buildInputs` and `nativeBuildInputs` existed. \[Cross barely worked, and those were implemented with some hacks on `mkDerivation` to override dependencies.\] What this means is the vast majority of packages do not use any explicit package set to populate their dependencies, just using whatever `callPackage` gives them even if they do correctly sort their dependencies into the multiple lists described above. And indeed, asking that users both sort their dependencies, _and_ take them from the right attribute set, is both too onerous and redundant, so the recommended approach (for now) is to continue just categorizing by list and not using an explicit package set.
+| Adjacent package set                   | Their host platform | Their target platform |
+|----------------------------------------|---------------------|-----------------------|
+| `pkgsBuildBuild`                       | Our build platform  | Our build platform    |
+| `pkgsBuildHost` or `buildPackages`     | Our build platform  | Our host platform     |
+| `pkgsBuildTarget`                      | Our build platform  | Our target platform   |
+| `pkgsHostHost`                         | Our host platform   | Our host platform     |
+| `pkgsHostTarget` or `pkgs`             | Our host platform   | Our target platform   |
+| `pkgsTargetTarget` or `targetPackages` | Our target platform | Our target platform   |
 
-To make this work, we "splice" together the six `pkgsFooBar` package sets and have `callPackage` actually take its arguments from that. This is currently implemented in `pkgs/top-level/splice.nix`. `mkDerivation` then, for each dependency attribute, pulls the right derivation out from the splice. This splicing can be skipped when not cross-compiling as the package sets are the same, but still is a bit slow for cross-compiling. We'd like to do something better, but haven't come up with anything yet.
+Now, for most of Nixpkgs's history, there were no `pkgs<theirHost><theirTarget>` attributes, and most packages have not been refactored to use it explicitly. Prior to those, there were just `buildPackages`, `pkgs`, and `targetPackages`. Those are now redefined as aliases to `pkgsBuildHost`, `pkgsHostTarget`, and `pkgsTargetTarget`. It is acceptable, even recommended, to use them to show that only their host platform matters. That is, use `buildPackages` where any of `pkgsBuild*` would do, and `targetPackages` when any of `pkgsTarget*` would do (if we had more than just `pkgsTargetTarget`).
+
+But before that, there was just `pkgs`, even though both `buildInputs` and `nativeBuildInputs` existed. (Cross barely worked, and those were implemented with some hacks on `mkDerivation` to override dependencies.) What this means is the vast majority of packages do not use any explicit package set to populate their dependencies, just using whatever `callPackage` gives them even if they do correctly sort their dependencies into the multiple lists described above. And indeed, asking that users both sort their dependencies, _and_ take them from the right attribute set, is both too onerous and redundant, so the recommended approach (for now) is to continue just categorizing by list and not using an explicit package set.
+
+To make this work, we "splice" together the six `pkgs<theirHost><theirTarget>` package sets and have `callPackage` actually take its arguments from that. This is currently implemented in `pkgs/top-level/splice.nix`. `mkDerivation` then, for each dependency attribute, pulls the right derivation out from the splice. This splicing can be skipped when not cross-compiling as the package sets are the same, but still is a bit slow for cross-compiling. We'd like to do something better, but haven't come up with anything yet.
 
 ### Bootstrapping {#ssec-bootstrapping}
 
diff --git a/doc/stdenv/stdenv.chapter.md b/doc/stdenv/stdenv.chapter.md
index 2caa4a8ef910..6cce806b5c8c 100644
--- a/doc/stdenv/stdenv.chapter.md
+++ b/doc/stdenv/stdenv.chapter.md
@@ -431,7 +431,7 @@ Overall, the unifying theme here is that propagation shouldn’t be introducing
 
 ##### `depsBuildBuild` {#var-stdenv-depsBuildBuild}
 
-A list of dependencies whose host and target platforms are the new derivation’s build platform. These are programs and libraries used at build time that produce programs and libraries also used at build time. If the dependency doesn’t care about the target platform (i.e. isn’t a compiler or similar tool), put it in `nativeBuildInputs` instead. The most common use of this `buildPackages.stdenv.cc`, the default C compiler for this role. That example crops up more than one might think in old commonly used C libraries.
+A list of dependencies whose host and target platforms are the new derivation’s build platform. These are programs and libraries used at build time that produce programs and libraries also used at build time. If the dependency doesn’t care about the target platform (i.e. isn’t a compiler or similar tool), put it in `nativeBuildInputs` instead. The most common use of this `buildPackages.stdenv.cc` (the compiler for `buildPackages`, which means that it's from the package set `buildPackages.buildPackages = pkgsBuildBuild`), the default C compiler for this role. That example crops up more than one might think in old commonly used C libraries.
 
 Since these packages are able to be run at build-time, they are always added to the `PATH`, as described above. But since these packages are only guaranteed to be able to run then, they shouldn’t persist as run-time dependencies. This isn’t currently enforced, but could be in the future.
 
diff --git a/lib/systems/default.nix b/lib/systems/default.nix
index bc1efee548bb..eb06f12f25a0 100644
--- a/lib/systems/default.nix
+++ b/lib/systems/default.nix
@@ -3,11 +3,11 @@
 let
   inherit (lib)
     any
-    filterAttrs
+    attrNames
+    filter
     foldl
     hasInfix
     isAttrs
-    isFunction
     isList
     mapAttrs
     optional
@@ -43,9 +43,8 @@ let
   */
   equals =
     let
-      # perf: avoid lib.isFunction because system attrs are never __functor-style attrsets.
-      removeFunctions =
-        a: removeAttrs a (builtins.filter (n: builtins.isFunction a.${n}) (builtins.attrNames a));
+      # System attrs are never __functor-style attrsets, so builtins.isFunction suffices.
+      removeFunctions = a: removeAttrs a (filter (n: builtins.isFunction a.${n}) (attrNames a));
     in
     a: b: removeFunctions a == removeFunctions b;
 
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 8b9628de8597..75ea35fce6b0 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -2985,6 +2985,12 @@
     githubId = 127523;
     name = "Herman Fries";
   };
+  barrettruth = {
+    email = "br@barrettruth.com";
+    github = "barrettruth";
+    githubId = 62671086;
+    name = "Barrett Ruth";
+  };
   BarrOff = {
     name = "BarrOff";
     github = "BarrOff";
@@ -29229,6 +29235,12 @@
     githubId = 42300264;
     name = "wishfort36";
   };
+  wishstudio = {
+    email = "wishstudio@gmail.com";
+    github = "wishstudio";
+    githubId = 946459;
+    name = "Xiangyan Sun";
+  };
   witchof0x20 = {
     name = "Jade";
     email = "jade@witchof.space";
diff --git a/nixos/modules/services/cluster/rancher/default.nix b/nixos/modules/services/cluster/rancher/default.nix
index c511da5a62f5..a1b59366fabd 100644
--- a/nixos/modules/services/cluster/rancher/default.nix
+++ b/nixos/modules/services/cluster/rancher/default.nix
@@ -518,6 +518,12 @@ let
           default = null;
         };
 
+        nodeExternalIP = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
+          description = "IPv4/IPv6 external addresses to advertise for node.";
+          default = null;
+        };
+
         selinux = lib.mkOption {
           type = lib.types.bool;
           description = "Enable SELinux in containerd.";
@@ -826,8 +832,8 @@ let
             "${name}: token, tokenFile or configPath (with 'token' or 'token-file' keys) should be set if role is 'agent'"
           )
           ++ (lib.optional (
-            cfg.role == "agent" && !(cfg.agentTokenFile != null || cfg.agentToken != "")
-          ) "${name}: agentToken and agentToken should not be set if role is 'agent'");
+            cfg.role == "agent" && (cfg.agentTokenFile != null || cfg.agentToken != "")
+          ) "${name}: agentToken and agentTokenFile should not be set if role is 'agent'");
 
         environment.systemPackages = [ config.services.${name}.package ];
 
@@ -936,6 +942,7 @@ let
                 ++ (lib.optionals (cfg.nodeLabel != [ ]) (map (l: "--node-label=${l}") cfg.nodeLabel))
                 ++ (lib.optionals (cfg.nodeTaint != [ ]) (map (t: "--node-taint=${t}") cfg.nodeTaint))
                 ++ (lib.optional (cfg.nodeIP != null) "--node-ip=${cfg.nodeIP}")
+                ++ (lib.optional (cfg.nodeExternalIP != null) "--node-external-ip=${cfg.nodeExternalIP}")
                 ++ (lib.optional cfg.selinux "--selinux")
                 ++ (lib.optional (kubeletParams != { }) "--kubelet-arg=config=${kubeletConfig}")
                 ++ (lib.optional (cfg.extraKubeProxyConfig != { }) "--kube-proxy-arg=config=${kubeProxyConfig}")
diff --git a/nixos/modules/services/cluster/rancher/k3s.nix b/nixos/modules/services/cluster/rancher/k3s.nix
index 0a8a1fc2be7b..7a509d4edd08 100644
--- a/nixos/modules/services/cluster/rancher/k3s.nix
+++ b/nixos/modules/services/cluster/rancher/k3s.nix
@@ -115,23 +115,24 @@ in
   # implementation
 
   config = lib.mkIf cfg.enable (
-    lib.recursiveUpdate baseModule.config {
-      warnings = (
-        lib.optional (
-          cfg.disableAgent && cfg.images != [ ]
-        ) "k3s: Images are only imported on nodes with an enabled agent, they will be ignored by this node."
-      );
+    lib.mkMerge [
+      baseModule.config
+      {
+        warnings =
+          lib.optional (cfg.disableAgent && cfg.images != [ ])
+            "k3s: Images are only imported on nodes with an enabled agent, they will be ignored by this node.";
 
-      assertions = [
-        {
-          assertion = cfg.role == "agent" -> !cfg.disableAgent;
-          message = "k3s: disableAgent must be false if role is 'agent'";
-        }
-        {
-          assertion = cfg.role == "agent" -> !cfg.clusterInit;
-          message = "k3s: clusterInit must be false if role is 'agent'";
-        }
-      ];
-    }
+        assertions = [
+          {
+            assertion = cfg.role == "agent" -> !cfg.disableAgent;
+            message = "k3s: disableAgent must be false if role is 'agent'";
+          }
+          {
+            assertion = cfg.role == "agent" -> !cfg.clusterInit;
+            message = "k3s: clusterInit must be false if role is 'agent'";
+          }
+        ];
+      }
+    ]
   );
 }
diff --git a/nixos/modules/services/cluster/rancher/rke2.nix b/nixos/modules/services/cluster/rancher/rke2.nix
index d1cd0b4630e7..6467a7de7646 100644
--- a/nixos/modules/services/cluster/rancher/rke2.nix
+++ b/nixos/modules/services/cluster/rancher/rke2.nix
@@ -121,40 +121,41 @@ in
   # implementation
 
   config = lib.mkIf cfg.enable (
-    lib.recursiveUpdate baseModule.config {
-      warnings = (
-        lib.optional (
+    lib.mkMerge [
+      baseModule.config
+      {
+        warnings = lib.optional (
           cfg.role == "agent" && cfg.cni != null
-        ) "rke2: cni should not be set if role is 'agent'"
-      );
+        ) "rke2: cni should not be set if role is 'agent'";
 
-      # Configure NetworkManager to ignore CNI network interfaces.
-      # See: https://docs.rke2.io/known_issues#networkmanager
-      environment.etc."NetworkManager/conf.d/rke2-canal.conf" = {
-        enable = config.networking.networkmanager.enable;
-        text = ''
-          [keyfile]
-          unmanaged-devices=interface-name:flannel*;interface-name:cali*;interface-name:tunl*;interface-name:vxlan.calico;interface-name:vxlan-v6.calico;interface-name:wireguard.cali;interface-name:wg-v6.cali
-        '';
-      };
-
-      # CIS hardening
-      # https://docs.rke2.io/security/hardening_guide#kernel-parameters
-      # https://github.com/rancher/rke2/blob/ef0fc7aa9d3bbaa95ce9b1895972488cbd92e302/bundle/share/rke2/rke2-cis-sysctl.conf
-      boot.kernel.sysctl = {
-        "vm.panic_on_oom" = 0;
-        "vm.overcommit_memory" = 1;
-        "kernel.panic" = 10;
-        "kernel.panic_on_oops" = 1;
-      };
-      # https://docs.rke2.io/security/hardening_guide#etcd-is-configured-properly
-      users = lib.mkIf cfg.cisHardening {
-        users.etcd = {
-          isSystemUser = true;
-          group = "etcd";
+        # Configure NetworkManager to ignore CNI network interfaces.
+        # See: https://docs.rke2.io/known_issues#networkmanager
+        environment.etc."NetworkManager/conf.d/rke2-canal.conf" = {
+          enable = config.networking.networkmanager.enable;
+          text = ''
+            [keyfile]
+            unmanaged-devices=interface-name:flannel*;interface-name:cali*;interface-name:tunl*;interface-name:vxlan.calico;interface-name:vxlan-v6.calico;interface-name:wireguard.cali;interface-name:wg-v6.cali
+          '';
         };
-        groups.etcd = { };
-      };
-    }
+
+        # CIS hardening
+        # https://docs.rke2.io/security/hardening_guide#kernel-parameters
+        # https://github.com/rancher/rke2/blob/ef0fc7aa9d3bbaa95ce9b1895972488cbd92e302/bundle/share/rke2/rke2-cis-sysctl.conf
+        boot.kernel.sysctl = {
+          "vm.panic_on_oom" = 0;
+          "vm.overcommit_memory" = 1;
+          "kernel.panic" = 10;
+          "kernel.panic_on_oops" = 1;
+        };
+        # https://docs.rke2.io/security/hardening_guide#etcd-is-configured-properly
+        users = lib.mkIf cfg.cisHardening {
+          users.etcd = {
+            isSystemUser = true;
+            group = "etcd";
+          };
+          groups.etcd = { };
+        };
+      }
+    ]
   );
 }
diff --git a/nixos/modules/services/networking/cgit.nix b/nixos/modules/services/networking/cgit.nix
index 49cbbfe2c9c8..47ddbc2f9772 100644
--- a/nixos/modules/services/networking/cgit.nix
+++ b/nixos/modules/services/networking/cgit.nix
@@ -300,7 +300,7 @@ in
       lib.mapAttrsToList (name: cfg: {
         ${cfg.nginx.virtualHost} = {
           locations =
-            (genAttrs' [ "cgit.css" "cgit.png" "favicon.ico" "robots.txt" ] (
+            (genAttrs' [ "cgit.css" "cgit.js" "cgit.png" "favicon.ico" "robots.txt" ] (
               fileName:
               lib.nameValuePair "= ${stripLocation cfg}/${fileName}" {
                 alias = lib.mkDefault "${cfg.package}/cgit/${fileName}";
diff --git a/nixos/modules/services/web-servers/lighttpd/cgit.nix b/nixos/modules/services/web-servers/lighttpd/cgit.nix
index ebd4c219222f..d8db6cf54968 100644
--- a/nixos/modules/services/web-servers/lighttpd/cgit.nix
+++ b/nixos/modules/services/web-servers/lighttpd/cgit.nix
@@ -13,6 +13,7 @@ let
   configFile = pkgs.writeText "cgitrc" ''
     # default paths to static assets
     css=${pathPrefix}/cgit.css
+    js=${pathPrefix}/cgit.js
     logo=${pathPrefix}/cgit.png
     favicon=${pathPrefix}/favicon.ico
 
@@ -82,6 +83,7 @@ in
           )
           alias.url = (
               "${pathPrefix}/cgit.css" => "${pkgs.cgit}/cgit/cgit.css",
+              "${pathPrefix}/cgit.js" => "${pkgs.cgit}/cgit/cgit.js",
               "${pathPrefix}/cgit.png" => "${pkgs.cgit}/cgit/cgit.png",
               "${pathPrefix}"          => "${pkgs.cgit}/cgit/cgit.cgi"
           )
diff --git a/nixos/tests/litestream.nix b/nixos/tests/litestream.nix
index f5a1668c30f2..f879226e6f56 100644
--- a/nixos/tests/litestream.nix
+++ b/nixos/tests/litestream.nix
@@ -1,4 +1,8 @@
-{ pkgs, ... }:
+{ pkgs, lib, ... }:
+let
+  dbPath = "/var/lib/grafana/data/grafana.db";
+  socketPath = "/run/litestream/litestream.sock";
+in
 {
   name = "litestream";
   meta = with pkgs.lib.maintainers; {
@@ -11,38 +15,53 @@
       services.litestream = {
         enable = true;
         settings = {
+          socket = {
+            enabled = true;
+            path = socketPath;
+          };
           dbs = [
             {
-              path = "/var/lib/grafana/data/grafana.db";
+              path = dbPath;
               replicas = [
                 {
                   url = "sftp://foo:bar@127.0.0.1:22/home/foo/grafana";
+                  auto-recover = true;
                 }
               ];
             }
           ];
         };
       };
-      systemd.services.grafana.serviceConfig.ExecStartPost =
-        "+"
-        + pkgs.writeShellScript "grant-grafana-permissions" ''
-          timeout=10
-
-          while [ ! -f /var/lib/grafana/data/grafana.db ];
-          do
-            if [ "$timeout" == 0 ]; then
-              echo "ERROR: Timeout while waiting for /var/lib/grafana/data/grafana.db."
-              exit 1
-            fi
-
-            sleep 1
-
-            ((timeout--))
-          done
-
-          find /var/lib/grafana -type d -exec chmod -v 775 {} \;
-          find /var/lib/grafana -type f -exec chmod -v 660 {} \;
-        '';
+      # Litestream 0.5.x writes to the database (_litestream_seq table),
+      # so grafana's data directory must be group-writable.
+      systemd.tmpfiles.settings."10-litestream" = {
+        "/var/lib/grafana".d = {
+          mode = "0750";
+          user = "grafana";
+          group = "grafana";
+        };
+        "/var/lib/grafana/data".d = {
+          mode = "2770";
+          user = "grafana";
+          group = "grafana";
+        };
+      };
+      systemd.services.grafana.serviceConfig = {
+        ExecStartPre = lib.mkAfter "+${pkgs.sqlite}/bin/sqlite3 ${dbPath} 'PRAGMA journal_mode=WAL;'";
+        UMask = lib.mkForce "0007";
+      };
+      systemd.services.litestream = {
+        after = [
+          "grafana.service"
+          "sshd.service"
+        ];
+        requires = [ "grafana.service" ];
+        wants = [ "sshd.service" ];
+        serviceConfig = {
+          RuntimeDirectory = "litestream";
+          ExecStartPre = "+/bin/sh -c 'chmod g+rw ${dbPath}*'";
+        };
+      };
       services.openssh = {
         enable = true;
         allowSFTP = true;
@@ -59,6 +78,7 @@
           security = {
             admin_user = "admin";
             admin_password = "admin";
+            secret_key = "SW2YcwTIb9zpOOhoPsMm";
           };
 
           server = {
@@ -68,7 +88,7 @@
 
           database = {
             type = "sqlite3";
-            path = "/var/lib/grafana/data/grafana.db";
+            path = dbPath;
             wal = true;
           };
         };
@@ -78,35 +98,44 @@
         password = "bar";
       };
       users.users.litestream.extraGroups = [ "grafana" ];
+      environment.systemPackages = [ pkgs.sqlite ];
     };
 
   testScript = ''
     start_all()
-    machine.wait_until_succeeds("test -d /home/foo/grafana")
     machine.wait_for_open_port(3000)
-    machine.succeed("""
-        curl -sSfN -X PUT -H "Content-Type: application/json" -d '{
-          "oldPassword": "admin",
-          "newPassword": "newpass",
-          "confirmNew": "newpass"
-        }' http://admin:admin@127.0.0.1:3000/api/user/password
-    """)
-    # https://litestream.io/guides/systemd/#simulating-a-disaster
-    machine.systemctl("stop litestream.service")
-    machine.succeed(
-        "rm -f /var/lib/grafana/data/grafana.db "
-        "/var/lib/grafana/data/grafana.db-shm "
-        "/var/lib/grafana/data/grafana.db-wal"
-    )
-    machine.succeed(
-        "litestream restore /var/lib/grafana/data/grafana.db "
-        "&& chown grafana:grafana /var/lib/grafana/data/grafana.db "
-        "&& chmod 660 /var/lib/grafana/data/grafana.db"
-    )
-    machine.systemctl("restart grafana.service")
-    machine.wait_for_open_port(3000)
-    machine.succeed(
-        "curl -sSfN -u admin:newpass http://127.0.0.1:3000/api/org/users | grep admin\@localhost"
-    )
+    with subtest("Verify litestream replicates changes"):
+        machine.succeed("""
+            curl -sSfN -X PUT --json '{
+              "name": "LitestreamTest",
+              "login": "admin",
+              "email": "admin@localhost"
+            }' http://admin:admin@127.0.0.1:3000/api/user
+        """)
+        machine.succeed("litestream sync -wait -socket ${socketPath} ${dbPath}")
+        machine.succeed(
+            "litestream restore -o /tmp/restored.db ${dbPath} && "
+            "sqlite3 /tmp/restored.db '.dump' | grep -q LitestreamTest"
+        )
+
+    with subtest("Simulate disaster recovery"):
+        # https://litestream.io/guides/systemd/#simulating-a-disaster
+        machine.systemctl("stop litestream.service grafana.service")
+        machine.succeed(
+            "rm -f ${dbPath} "
+            "${dbPath}-shm "
+            "${dbPath}-wal"
+        )
+        machine.succeed(
+            "litestream restore ${dbPath} "
+            "&& chown grafana:grafana ${dbPath} "
+            "&& chmod 660 ${dbPath}"
+        )
+        machine.systemctl("restart grafana.service litestream.service")
+        machine.wait_for_open_port(3000)
+        machine.wait_for_unit("litestream.service")
+        machine.succeed(
+            "curl -sSfN -u admin:admin http://127.0.0.1:3000/api/user | grep LitestreamTest"
+        )
   '';
 }
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index 762a54b2f36b..c79da53f66fe 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -378,6 +378,10 @@ assertNoAdditions {
       "catppuccin.groups.integrations.noice"
       "catppuccin.groups.integrations.feline"
       "catppuccin.lib.vim.init"
+
+      # TODO(@mrcjkb): re-enable when https://github.com/catppuccin/nvim/pull/995
+      # has been merged and released.
+      "catppuccin.lib.detect_integrations"
     ];
   };
 
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 3c7ea7eece08..a99ab5aac52d 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -4458,8 +4458,8 @@ let
         mktplcRef = {
           name = "vscode-stylelint";
           publisher = "stylelint";
-          version = "2.2.0";
-          hash = "sha256-N23nzAI0cBNeX7txsgxKXhSUrcOGM9rjnMIJNK4OYFY=";
+          version = "2.2.1";
+          hash = "sha256-VnJ2OZe2KPo/QfZquxDZ3SMQncRWnAHBTTtfdJVBlpo=";
         };
         meta = {
           description = "Official Stylelint extension for Visual Studio Code";
diff --git a/pkgs/applications/emulators/libretro/cores/fbneo.nix b/pkgs/applications/emulators/libretro/cores/fbneo.nix
index 8d59e491020d..60dcc1e0b3bb 100644
--- a/pkgs/applications/emulators/libretro/cores/fbneo.nix
+++ b/pkgs/applications/emulators/libretro/cores/fbneo.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "fbneo";
-  version = "0-unstable-2026-03-28";
+  version = "0-unstable-2026-04-06";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "fbneo";
-    rev = "7290e95232faacb0c31b0b12cb0884bb9f6e8cfc";
-    hash = "sha256-vYryEUrYauVGGjmePCUnGdCpOGKUFxSI4tkFCt7wKs8=";
+    rev = "f659af2c3bec122d3e628e1e1634e746e67005e4";
+    hash = "sha256-cK2c611fBEDcRK1I7VMLL+Ih76FMWlEGhmhg53KampU=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/emulators/libretro/cores/hatari.nix b/pkgs/applications/emulators/libretro/cores/hatari.nix
index 0daef12b19dd..56f9c0969af3 100644
--- a/pkgs/applications/emulators/libretro/cores/hatari.nix
+++ b/pkgs/applications/emulators/libretro/cores/hatari.nix
@@ -6,13 +6,13 @@
 }:
 mkLibretroCore {
   core = "hatari";
-  version = "0-unstable-2024-10-21";
+  version = "0-unstable-2026-03-31";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "hatari";
-    rev = "7008194d3f951a157997f67a820578f56f7feee0";
-    hash = "sha256-ZPzwUBaxs2ivE9n9cb5XB5mhixY9b6qIlq7OiVSLbqg=";
+    rev = "00af13a379e7839399ff2939807f050b7fc49a0e";
+    hash = "sha256-mPe9+RX9DsrJkmydXqEBrR7EMwijhjj/yJPB2QlK3/U=";
   };
 
   extraNativeBuildInputs = [ which ];
diff --git a/pkgs/applications/emulators/libretro/cores/mame.nix b/pkgs/applications/emulators/libretro/cores/mame.nix
index ab6b47b712f2..7028b41a63b7 100644
--- a/pkgs/applications/emulators/libretro/cores/mame.nix
+++ b/pkgs/applications/emulators/libretro/cores/mame.nix
@@ -9,13 +9,13 @@
 }:
 mkLibretroCore {
   core = "mame";
-  version = "0-unstable-2026-03-26";
+  version = "0-unstable-2026-04-06";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "mame";
-    rev = "a10380b436c2103cad06826d64e10ca90692a08b";
-    hash = "sha256-M9/GTOiXcZc5J2SxSDzDEYDMBC1zMR/zAhvbgZEwBlk=";
+    rev = "4162ead798f816b4f08b1af9eafefe3d022331bf";
+    hash = "sha256-doujon1GCXrmgYRWf3aGIpOFyOtj2U1DoaClGpaS1L0=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/emulators/libretro/cores/meteor.nix b/pkgs/applications/emulators/libretro/cores/meteor.nix
index f1e5b1c55121..8dfadaf04525 100644
--- a/pkgs/applications/emulators/libretro/cores/meteor.nix
+++ b/pkgs/applications/emulators/libretro/cores/meteor.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "meteor";
-  version = "0-unstable-2020-12-28";
+  version = "0-unstable-2026-03-31";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "meteor-libretro";
-    rev = "e533d300d0561564451bde55a2b73119c768453c";
-    hash = "sha256-zMkgzUz2rk0SD5ojY4AqaDlNM4k4QxuUxVBRBcn6TqQ=";
+    rev = "13ac21ccdb81c8a99fddebf5b29482f19194ec88";
+    hash = "sha256-AUn8gTtlFaosKTlcmJCmwdDeEvXwRjkkvht+JXkM36U=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/emulators/libretro/cores/neocd.nix b/pkgs/applications/emulators/libretro/cores/neocd.nix
index 55fce9c5e269..fef03cb990f8 100644
--- a/pkgs/applications/emulators/libretro/cores/neocd.nix
+++ b/pkgs/applications/emulators/libretro/cores/neocd.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "neocd";
-  version = "0-unstable-2024-10-21";
+  version = "0-unstable-2026-03-31";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "neocd_libretro";
-    rev = "5eca2c8fd567b5261251c65ecafa8cf5b179d1d2";
-    hash = "sha256-72tmPCb7AXsamaQsMAPiYpgDR8DER2GTz4hcbN8wy7g=";
+    rev = "9216ca226f24e01e77fc2670035e97da154f3de4";
+    hash = "sha256-Mq9UOuPwmG2Di68jWUgCbBvG3jUCEMON8Kfly/aCdH4=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 808c5ea7d08a..7203f11c96dc 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -959,13 +959,13 @@
     "vendorHash": "sha256-OAd8SeTqTrH0kMoM2LsK3vM2PI23b3gl57FaJYM9hM0="
   },
   "newrelic_newrelic": {
-    "hash": "sha256-ZBxkDXXeYgvoOzDqJH6iy/yz7lXDt8fEsvEMnU+EgkQ=",
+    "hash": "sha256-W5eEK39KkKOTfZb6KOOTwvRD1nrZkY4FuZt+9Imu9nw=",
     "homepage": "https://registry.terraform.io/providers/newrelic/newrelic",
     "owner": "newrelic",
     "repo": "terraform-provider-newrelic",
-    "rev": "v3.82.0",
+    "rev": "v3.84.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-BjBzWdCU/gNZOsh5gp76LuGUgwiUc/TlOTJ6vjP8tyI="
+    "vendorHash": "sha256-CQVlU/V25pDz5shBpCztA3w/FVfGjLjLDHf7ky9LQHc="
   },
   "ns1-terraform_ns1": {
     "hash": "sha256-MX/Wd9Lztjn7uwDzJjs4bsSSp0PFzUgsu4jXke9jHL8=",
diff --git a/pkgs/applications/version-management/cgit/default.nix b/pkgs/applications/version-management/cgit/default.nix
index 4ff7ca269e82..f2c1c3a12266 100644
--- a/pkgs/applications/version-management/cgit/default.nix
+++ b/pkgs/applications/version-management/cgit/default.nix
@@ -25,19 +25,19 @@
 
 stdenv.mkDerivation {
   pname = "cgit";
-  version = "1.2.3";
+  version = "1.3";
 
   src = fetchurl {
-    url = "https://git.zx2c4.com/cgit/snapshot/cgit-1.2.3.tar.xz";
-    sha256 = "193d990ym10qlslk0p8mjwp2j6rhqa7fq0y1iff65lvbyv914pss";
+    url = "https://git.zx2c4.com/cgit/snapshot/cgit-1.3.tar.xz";
+    sha256 = "836b6edbc7f99e11037a8b928d609ce346ed77a55545e17fff8cea59b5b7aa42";
   };
 
   # cgit is tightly coupled with git and needs a git source tree to build.
   # IMPORTANT: Remember to check which git version cgit needs on every version
   # bump (look for "GIT_VER" in the top-level Makefile).
   gitSrc = fetchurl {
-    url = "mirror://kernel/software/scm/git/git-2.25.1.tar.xz";
-    sha256 = "09lzwa183nblr6l8ib35g2xrjf9wm9yhk3szfvyzkwivdv69c9r2";
+    url = "mirror://kernel/software/scm/git/git-2.53.0.tar.xz";
+    hash = "sha256-WBi9fYCwYbu9/sikM9YJ3IgYoFmR9zH/xKVh4soYxlM=";
   };
 
   separateDebugInfo = true;
@@ -92,15 +92,9 @@ stdenv.mkDerivation {
     "AR=${stdenv.cc.targetPrefix}ar"
   ];
 
-  # Install manpage.
   postInstall = ''
-    # xmllint fails:
-    #make install-man
-
-    # bypassing xmllint works:
-    a2x --no-xmllint -f manpage cgitrc.5.txt
-    mkdir -p "$out/share/man/man5"
-    cp cgitrc.5 "$out/share/man/man5"
+    # Install manpage.
+    make install-man $makeFlags
 
     wrapPythonProgramsIn "$out/lib/cgit/filters" "$out ''${pythonPath[*]}"
 
diff --git a/pkgs/applications/video/kodi/addons/youtube/default.nix b/pkgs/applications/video/kodi/addons/youtube/default.nix
index 80b90dec3224..0651eb6a9428 100644
--- a/pkgs/applications/video/kodi/addons/youtube/default.nix
+++ b/pkgs/applications/video/kodi/addons/youtube/default.nix
@@ -10,13 +10,13 @@
 buildKodiAddon rec {
   pname = "youtube";
   namespace = "plugin.video.youtube";
-  version = "7.4.1.1";
+  version = "7.4.2";
 
   src = fetchFromGitHub {
     owner = "anxdpanic";
     repo = "plugin.video.youtube";
     rev = "v${version}";
-    hash = "sha256-fut9FTs87/EXpZ2PjIvhHL4001k3+i519m9ccMR1o+I=";
+    hash = "sha256-o+HaYVUvulHzthnP/PUJ0qTe0e901djw3l9sVpUcD08=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/by-name/al/aliyun-cli/package.nix b/pkgs/by-name/al/aliyun-cli/package.nix
index 880c138d21c5..506a242f6284 100644
--- a/pkgs/by-name/al/aliyun-cli/package.nix
+++ b/pkgs/by-name/al/aliyun-cli/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "aliyun-cli";
-  version = "3.3.3";
+  version = "3.3.4";
 
   src = fetchFromGitHub {
     owner = "aliyun";
     repo = "aliyun-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-v44QWIpFTfUD7gOaQGwJ12MvtO4rMS69rCZr4Hv/e3k=";
+    hash = "sha256-Ykq7UkpGy9w3VQ2LcGsdREN0na0F7Mj9RxVu8iLr96s=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/an/anytone-emu/package.nix b/pkgs/by-name/an/anytone-emu/package.nix
index b1fe8f96df18..91099171ca78 100644
--- a/pkgs/by-name/an/anytone-emu/package.nix
+++ b/pkgs/by-name/an/anytone-emu/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "anytone-emu";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "dmr-tools";
     repo = "anytone-emu";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kaXD4mIoEikl9HoS/FfIX0oRAKkZHiwIfNWj0CLazPc=";
+    hash = "sha256-RTYLtVCKP2TW7Ery51POEZuCtyRhkgKhoDhJPe18y80=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ar/argonaut/package.nix b/pkgs/by-name/ar/argonaut/package.nix
index b9ab3c821b17..a591f8eada59 100644
--- a/pkgs/by-name/ar/argonaut/package.nix
+++ b/pkgs/by-name/ar/argonaut/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "argonaut";
-  version = "2.15.0";
+  version = "2.16.0";
 
   src = fetchFromGitHub {
     owner = "darksworm";
     repo = "argonaut";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LDw2/8l/jipCVIMYeco08LukIfx3Kk1ROXkvU69SK5g=";
+    hash = "sha256-F67DyH0aJ4SmlCIj1i65yB5rFXZB0j5BREssS3V3WZQ=";
   };
 
-  vendorHash = "sha256-xln/WmZbi0+rHqMMHRgt0ar/EaBDNscCsd/NckJZnMw=";
+  vendorHash = "sha256-4AmciHL4CGtEwDAs7eAtjfWlzjoCLXAN2HEatev8gZg=";
   proxyVendor = true;
   subPackages = [ "cmd/app" ];
   ldflags = [
diff --git a/pkgs/by-name/at/atlauncher/package.nix b/pkgs/by-name/at/atlauncher/package.nix
index 118041f76ed9..89e037f04f70 100644
--- a/pkgs/by-name/at/atlauncher/package.nix
+++ b/pkgs/by-name/at/atlauncher/package.nix
@@ -27,13 +27,13 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "atlauncher";
-  version = "3.4.40.3";
+  version = "3.4.40.4";
 
   src = fetchFromGitHub {
     owner = "ATLauncher";
     repo = "ATLauncher";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-QFPdEH3V9Krwy/cWCbY+IMtW0ydVCqKr/OZfttZGCss=";
+    hash = "sha256-pRYXzFUbVXYwD7edhBoVcVo/QDo6QSJJQd58Hf3rBGo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/au/automatic-timezoned/package.nix b/pkgs/by-name/au/automatic-timezoned/package.nix
index f1d7fc6f9d77..72942ef3ebcd 100644
--- a/pkgs/by-name/au/automatic-timezoned/package.nix
+++ b/pkgs/by-name/au/automatic-timezoned/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "automatic-timezoned";
-  version = "2.0.124";
+  version = "2.0.125";
 
   src = fetchFromGitHub {
     owner = "maxbrunet";
     repo = "automatic-timezoned";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-B7cfrO3Kz1xS9htjZXXLQaFvbc0g4fowParTVvXdqA8=";
+    sha256 = "sha256-YYI0ISLaOcKZu2AFf08DmriApTLKdUUgLF5AhEhGf04=";
   };
 
-  cargoHash = "sha256-YQV5e9/iTvx76ch6D/iNGgWJaa3rAr6dN8mlEXtatDs=";
+  cargoHash = "sha256-jhsW33xDTDBDi2ySSwePjjNmIFKKm6ZnP5xklvB4+Iw=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
 
diff --git a/pkgs/by-name/aw/aw-watcher-window-wayland/package.nix b/pkgs/by-name/aw/aw-watcher-window-wayland/package.nix
index d2a8f886240c..c36e4dc538ce 100644
--- a/pkgs/by-name/aw/aw-watcher-window-wayland/package.nix
+++ b/pkgs/by-name/aw/aw-watcher-window-wayland/package.nix
@@ -9,13 +9,13 @@
 }:
 rustPlatform.buildRustPackage {
   pname = "aw-watcher-window-wayland";
-  version = "0-unstable-2025-12-31";
+  version = "0-unstable-2026-03-31";
 
   src = fetchFromGitHub {
     owner = "ActivityWatch";
     repo = "aw-watcher-window-wayland";
-    rev = "aea9aca029bd33d373bf53946a16dc05ef81e0b3";
-    hash = "sha256-3o3IVf2YeZ1qGokezPvuLnUaqiA/uzm4wCXvgNHIMW4=";
+    rev = "c14e6fbaf1b811a46ec6b5c27d8656f0976a1850";
+    hash = "sha256-U1tFdglzO5YcGPfzVAprol8bdQ1mO7OP1Q6gShG/fbk=";
   };
 
   cargoHash = "sha256-WWT8tOrHPf5x3bXsVPt32VKut4qK+K8gickBfEc0zmk=";
diff --git a/pkgs/by-name/aw/aws-lambda-rie/package.nix b/pkgs/by-name/aw/aws-lambda-rie/package.nix
index 78fc8ae6893d..b41e18ec91a8 100644
--- a/pkgs/by-name/aw/aws-lambda-rie/package.nix
+++ b/pkgs/by-name/aw/aws-lambda-rie/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "aws-lambda-runtime-interface-emulator";
-  version = "1.33";
+  version = "1.35";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-lambda-runtime-interface-emulator";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-p3Tw5wpMiFL46FyX6NKaKv47jjFnlS27/Q4pc2nzdzs=";
+    sha256 = "sha256-tO7ru3sdCWbdALcOmxQny7ak96utgABUvIaGThZRedw=";
   };
 
   vendorHash = "sha256-+7BuDaN1ns63cQOMKuRMjBo9GnLrmsubx/KppUsyheY=";
diff --git a/pkgs/by-name/ba/bazel-watcher/package.nix b/pkgs/by-name/ba/bazel-watcher/package.nix
index 70b750242073..3017531eecb0 100644
--- a/pkgs/by-name/ba/bazel-watcher/package.nix
+++ b/pkgs/by-name/ba/bazel-watcher/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "bazel-watcher";
-  version = "0.28.1";
+  version = "0.29.0";
 
   src = fetchFromGitHub {
     owner = "bazelbuild";
     repo = "bazel-watcher";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-4pM7z1GAhLxvCLwtHBcteRMQwtdvOFtRu8eF+H6UJBE=";
+    hash = "sha256-ssG2BFd2utB9xu9zYdcvZYLq+XF9ZOctxNGtpbrhLG8=";
   };
 
   vendorHash = "sha256-u1Zg/M9DSkwscy49qtPQygk1gyxKaPbhlFDYNtBQ9NY=";
diff --git a/pkgs/by-name/ca/cargo-diet/package.nix b/pkgs/by-name/ca/cargo-diet/package.nix
index 1c3449667365..fc5f821f6f60 100644
--- a/pkgs/by-name/ca/cargo-diet/package.nix
+++ b/pkgs/by-name/ca/cargo-diet/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-diet";
-  version = "1.2.7";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "the-lean-crate";
     repo = "cargo-diet";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-SuJ1H/2YfSVVigdgLUd9veMClI7ZT7xkkyQ4PfXoQdQ=";
+    hash = "sha256-YjUO8UUXWZvZZZ2Y0py5LQdVBpq8jjwvGimVAWC8Gr8=";
   };
 
-  cargoHash = "sha256-crdRRlRi3H8j/ojGH+oqmaeSS8ee8dUALorZPWE/j1Y=";
+  cargoHash = "sha256-CnaeS7mh+QDPcQgeKzNV5Vey3zsiD10NdlfdQ1kcDB8=";
 
   meta = {
     description = "Help computing optimal include directives for your Cargo.toml manifest";
diff --git a/pkgs/by-name/ca/cargo-vet/package.nix b/pkgs/by-name/ca/cargo-vet/package.nix
index a5361f65fbb5..16ddfa5dcf9f 100644
--- a/pkgs/by-name/ca/cargo-vet/package.nix
+++ b/pkgs/by-name/ca/cargo-vet/package.nix
@@ -2,26 +2,30 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
+  nix-update-script,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-vet";
-  version = "0.10.1";
+  version = "0.10.2";
 
   src = fetchFromGitHub {
     owner = "mozilla";
     repo = "cargo-vet";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HSEhFCcdC79OA8MP73De+iLIjcr1XMHxfJ9a1Q3JJYI=";
+    hash = "sha256-sdjvCMLM8ThWXbotjRIsbLYucDzGvFOktqo6OKB//RI=";
   };
 
-  cargoHash = "sha256-+X6DLxWPWMcGzJMVZAj3C5P5MyywIb4ml0Jsyo9/uAE=";
+  cargoHash = "sha256-3pfOq2VfHbtohdgv73TT480bjCjdNKPJE+m4SHeXfGA=";
 
   # the test_project tests require internet access
   checkFlags = [ "--skip=test_project" ];
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Tool to help projects ensure that third-party Rust dependencies have been audited by a trusted source";
+    changelog = "https://github.com/mozilla/cargo-vet/releases/tag/v${finalAttrs.version}";
     mainProgram = "cargo-vet";
     homepage = "https://mozilla.github.io/cargo-vet";
     license = with lib.licenses; [
@@ -31,6 +35,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     maintainers = with lib.maintainers; [
       jk
       matthiasbeyer
+      ilkecan
     ];
   };
 })
diff --git a/pkgs/by-name/co/coc-markdownlint/package.nix b/pkgs/by-name/co/coc-markdownlint/package.nix
index 9303d23be8da..d06840f9562c 100644
--- a/pkgs/by-name/co/coc-markdownlint/package.nix
+++ b/pkgs/by-name/co/coc-markdownlint/package.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage {
   pname = "coc-markdownlint";
-  version = "0-unstable-2026-03-04";
+  version = "0-unstable-2026-04-01";
 
   src = fetchFromGitHub {
     owner = "fannheyward";
     repo = "coc-markdownlint";
-    rev = "4f3410753308b8bf5c45518b6f39aee6d29a8bbd";
-    hash = "sha256-9S3mXE70PqBJIaRRycluwQ8rdQ+9KMUfY10170ek//w=";
+    rev = "9a92eef6adbd6ba7b1afe50bd9a3c82b94902c51";
+    hash = "sha256-5pfsaZFA1OYwREB3FqyUQY4D47dKH22pQV8dBgPiipo=";
   };
 
-  npmDepsHash = "sha256-XXOW5gekzDOl02JNuIQD71Ufm9W+zOIeUO1IrJ7fx5Y=";
+  npmDepsHash = "sha256-J6gYA3eP2PWK3kesJDL5tqHOY/j2PoC+uhVxpeYVnsk=";
 
   passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
 
diff --git a/pkgs/by-name/co/coc-rust-analyzer/package.nix b/pkgs/by-name/co/coc-rust-analyzer/package.nix
index 9d7d5bcb0860..d704fcd754d8 100644
--- a/pkgs/by-name/co/coc-rust-analyzer/package.nix
+++ b/pkgs/by-name/co/coc-rust-analyzer/package.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage {
   pname = "coc-rust-analyzer";
-  version = "0-unstable-2026-03-01";
+  version = "0-unstable-2026-04-01";
 
   src = fetchFromGitHub {
     owner = "fannheyward";
     repo = "coc-rust-analyzer";
-    rev = "6086cb2075cf0c95fe41f225231b0d6e10bdeab7";
-    hash = "sha256-o3skzvjnAjdd7uS1UboLbZBXY7qgrwr7XYnVlf+PUpc=";
+    rev = "569c6c56e815ae29ad7873b472ebb750c19d0d38";
+    hash = "sha256-4IZhCQl+iKChGaT0ghn5MnB+h6U5DJSa7YgPDoObiBg=";
   };
 
-  npmDepsHash = "sha256-39pOjwZuos4yfOrTZjGyKgB6pTJXO/Oi5jTJzXs0xKg=";
+  npmDepsHash = "sha256-B/EBAhwEEqLgGshK3Fw7nG7Mv9kk0v4ClLglLhooYBM=";
 
   passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
 
diff --git a/pkgs/by-name/co/codeql/package.nix b/pkgs/by-name/co/codeql/package.nix
index e974cb84aadd..2407f181ae61 100644
--- a/pkgs/by-name/co/codeql/package.nix
+++ b/pkgs/by-name/co/codeql/package.nix
@@ -15,7 +15,7 @@
 
 stdenv.mkDerivation rec {
   pname = "codeql";
-  version = "2.24.3";
+  version = "2.25.1";
 
   dontConfigure = true;
   dontBuild = true;
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
 
   src = fetchzip {
     url = "https://github.com/github/codeql-cli-binaries/releases/download/v${version}/codeql.zip";
-    hash = "sha256-Em/KkKUMq9IDZR/g6DTD8TZTZ70FBon4ZXCeQp6BAPg=";
+    hash = "sha256-obChRLyt6gZDVkuNgeJFRIpNGdHeaKC/6a0oVku9EZI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/co/coloquinte/package.nix b/pkgs/by-name/co/coloquinte/package.nix
index a4fa5e081480..d1bd2d02b9f3 100644
--- a/pkgs/by-name/co/coloquinte/package.nix
+++ b/pkgs/by-name/co/coloquinte/package.nix
@@ -19,6 +19,13 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-BQg2rVYe1wJOX7YnvgDVpmN6hwBJZKH0fxm+8HC8bvY=";
   };
 
+  # boost 1.89 removed the boost_system stub library
+  postPatch = ''
+    substituteInPlace CMakeLists.txt --replace-fail \
+      'FIND_PACKAGE(Boost REQUIRED COMPONENTS system filesystem iostreams program_options unit_test_framework)' \
+      'FIND_PACKAGE(Boost REQUIRED COMPONENTS filesystem iostreams program_options unit_test_framework)'
+  '';
+
   nativeBuildInputs = [
     cmake
   ];
diff --git a/pkgs/by-name/co/copybara/package.nix b/pkgs/by-name/co/copybara/package.nix
index 47b88eb5739a..8ab7bb4e4d40 100644
--- a/pkgs/by-name/co/copybara/package.nix
+++ b/pkgs/by-name/co/copybara/package.nix
@@ -13,11 +13,11 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "copybara";
-  version = "20260323";
+  version = "20260330";
 
   src = fetchurl {
     url = "https://github.com/google/copybara/releases/download/v${finalAttrs.version}/copybara_deploy.jar";
-    hash = "sha256-FkJZm0MgN/HRfomjvFXq2M8FICHk7Uo1cI3C6WcZC8o=";
+    hash = "sha256-O/H5eeais4xKAWshC8nZfLqeIYdjVxLVZ5d1sUFnF1w=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/co/coroot-node-agent/package.nix b/pkgs/by-name/co/coroot-node-agent/package.nix
index 9016be5bf2b2..351f8577ac63 100644
--- a/pkgs/by-name/co/coroot-node-agent/package.nix
+++ b/pkgs/by-name/co/coroot-node-agent/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "coroot-node-agent";
-  version = "1.30.0";
+  version = "1.31.0";
 
   src = fetchFromGitHub {
     owner = "coroot";
     repo = "coroot-node-agent";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-vuUVRGehkzJEwQzvEOI/hNnEG1Wk8UqkTCMY47mY3BI=";
+    hash = "sha256-vS1nf20G++VKA/2WBhXvWjyGyVMPhshw+jUcPRxPcIw=";
   };
 
-  vendorHash = "sha256-OOd3OctfklHzpMVDCnnb8HYPYqWQgBe+8HfbSm7dXzg=";
+  vendorHash = "sha256-5+PwysNT3ZZ6epFDrH6BhIn0ERaxntO+ekqaBxc+qkA=";
 
   buildInputs = [ systemdLibs ];
 
diff --git a/pkgs/by-name/cp/cpp-hocon/package.nix b/pkgs/by-name/cp/cpp-hocon/package.nix
index 1cc2417bf594..84af9dee0eab 100644
--- a/pkgs/by-name/cp/cpp-hocon/package.nix
+++ b/pkgs/by-name/cp/cpp-hocon/package.nix
@@ -27,6 +27,11 @@ stdenv.mkDerivation (finalAttrs: {
     substituteInPlace CMakeLists.txt --replace-fail \
       "cmake_minimum_required(VERSION 3.2.2)" \
       "cmake_minimum_required(VERSION 3.10)"
+
+    # boost 1.89 removed the boost_system stub library
+    substituteInPlace CMakeLists.txt --replace-fail \
+      'list(APPEND BOOST_COMPONENTS thread date_time chrono filesystem system program_options)' \
+      'list(APPEND BOOST_COMPONENTS thread date_time chrono filesystem program_options)'
   '';
 
   env.NIX_CFLAGS_COMPILE = "-Wno-error";
diff --git a/pkgs/by-name/cw/cwltool/package.nix b/pkgs/by-name/cw/cwltool/package.nix
index 7fb80d9a0cb1..0c583225f398 100644
--- a/pkgs/by-name/cw/cwltool/package.nix
+++ b/pkgs/by-name/cw/cwltool/package.nix
@@ -7,23 +7,28 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "cwltool";
-  version = "3.1.20251031082601";
+  version = "3.1.20260315121657";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "common-workflow-language";
     repo = "cwltool";
     tag = finalAttrs.version;
-    hash = "sha256-avRNOdL4Ig2cYQWh8SqX/KWfgXyVg0TVfVFrlqzUCLA=";
+    hash = "sha256-0cd64fkaCMX+eaZ4maZW8sE+ZX7bTFy1DDY5leqf9B0=";
   };
 
   postPatch = ''
     substituteInPlace setup.py \
       --replace-fail "PYTEST_RUNNER + " ""
     substituteInPlace pyproject.toml \
-      --replace-fail "mypy==1.18.2" "mypy"
+      --replace-fail "mypy==1.19.1" "mypy"
   '';
 
+  pythonRelaxDeps = [
+    "prov"
+    "rdflib"
+  ];
+
   build-system = with python3Packages; [
     setuptools
     setuptools-scm
@@ -60,11 +65,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
     pytestCheckHook
   ];
 
-  pythonRelaxDeps = [
-    "prov"
-    "rdflib"
-  ];
-
   disabledTests = [
     "test_content_types"
     "test_env_filtering"
@@ -75,6 +75,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
   disabledTestPaths = [
     "tests/test_udocker.py"
     "tests/test_provenance.py"
+    "tests/test_examples.py"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/by-name/cy/cyme/package.nix b/pkgs/by-name/cy/cyme/package.nix
index 6c545e85f647..201e1e3b6d6f 100644
--- a/pkgs/by-name/cy/cyme/package.nix
+++ b/pkgs/by-name/cy/cyme/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cyme";
-  version = "2.2.11";
+  version = "2.3.0";
 
   src = fetchFromGitHub {
     owner = "tuna-f1sh";
     repo = "cyme";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-DRlK7QsZvydC05kHIWLR1a01/Cc+9TZN0Z4hUCfShjQ=";
+    hash = "sha256-Jgm/IIrtsoUQQ6WmS3Ol20rc+oQJsfpOyHqP06jcPfM=";
   };
 
-  cargoHash = "sha256-vh7VUTI+FKWtwYmcpEeADq/OF69M38yekPySXkFJ5ZA=";
+  cargoHash = "sha256-0CeyrHoqKdt5cy9F+LpZAsCR2nXMtXvyk1Dr+f9SS44=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/dd/ddns-go/package.nix b/pkgs/by-name/dd/ddns-go/package.nix
index 0ca1696ff1bb..e140563ba963 100644
--- a/pkgs/by-name/dd/ddns-go/package.nix
+++ b/pkgs/by-name/dd/ddns-go/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "ddns-go";
-  version = "6.16.2";
+  version = "6.16.4";
 
   src = fetchFromGitHub {
     owner = "jeessy2";
     repo = "ddns-go";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-a4Dtdw7MPFQaFB5QYGFAZt2GGCHR6SlRem7ZXUmdhAo=";
+    hash = "sha256-0Fcm1KC6hFjjXGdoiFMm19M8Uc7et0F3LeD7pxFQM4s=";
   };
 
-  vendorHash = "sha256-oOhqr0D/K9FITCbz2jt+We6gyv85ipL3enbr8YDDSIg=";
+  vendorHash = "sha256-phMBGjXARuY6qreNy5o06unouyew1Rbj4zo3nK4Xvnw=";
 
   ldflags = [
     "-X main.version=${finalAttrs.version}"
diff --git a/pkgs/by-name/do/doc2go/package.nix b/pkgs/by-name/do/doc2go/package.nix
index 9adfd79706b4..4e7797cf4dd7 100644
--- a/pkgs/by-name/do/doc2go/package.nix
+++ b/pkgs/by-name/do/doc2go/package.nix
@@ -6,15 +6,15 @@
 
 buildGoModule (finalAttrs: {
   pname = "doc2go";
-  version = "0.12.0";
+  version = "0.12.1";
 
   src = fetchFromGitHub {
     owner = "abhinav";
     repo = "doc2go";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-gJQ0cs8R1fbGpFd9k2L53khnQ9M5U18DOtS2bn0lGig=";
+    hash = "sha256-q3er94/WLCqXIOQaj7Kdty7yIuaLO7qXt6GiGxIxrPQ=";
   };
-  vendorHash = "sha256-lMoEbNeSQFrMG8hCMaFRvyzt6kaPVP7Kse0i7NJY10I=";
+  vendorHash = "sha256-4s9gVjx+qiBRmL4abBN3FPuH4iMUapIQr1nwN40VmRQ=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/do/doctl/package.nix b/pkgs/by-name/do/doctl/package.nix
index 68efe3ac2e77..4ebcb48e8f4d 100644
--- a/pkgs/by-name/do/doctl/package.nix
+++ b/pkgs/by-name/do/doctl/package.nix
@@ -9,7 +9,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "doctl";
-  version = "1.153.0";
+  version = "1.154.0";
 
   vendorHash = null;
 
@@ -42,7 +42,7 @@ buildGoModule (finalAttrs: {
     owner = "digitalocean";
     repo = "doctl";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Oc0TIuOCXef45j2SSIeCvvJkie8VcH4B8W7Cd/ux618=";
+    hash = "sha256-+CqkkWpy1bzMBgjml4Tztyz2t/fUFkyYVNh4gXpJjiw=";
   };
 
   meta = {
diff --git a/pkgs/by-name/do/dolibarr/package.nix b/pkgs/by-name/do/dolibarr/package.nix
index f588c32daf1e..f0416673de8f 100644
--- a/pkgs/by-name/do/dolibarr/package.nix
+++ b/pkgs/by-name/do/dolibarr/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dolibarr";
-  version = "23.0.0";
+  version = "23.0.2";
 
   src = fetchFromGitHub {
     owner = "Dolibarr";
     repo = "dolibarr";
     tag = finalAttrs.version;
-    hash = "sha256-oAzmp6tWUPvLC2AJz/A56p/njunZMTmkZVYaydTL/Ks=";
+    hash = "sha256-WfMMikTmC+13HxI0YCKwJTrn57CJreU3GsEyrOjr/hg=";
   };
 
   dontBuild = true;
diff --git a/pkgs/by-name/eq/equicord/package.nix b/pkgs/by-name/eq/equicord/package.nix
index 8dc26771a971..1bd53a12a68c 100644
--- a/pkgs/by-name/eq/equicord/package.nix
+++ b/pkgs/by-name/eq/equicord/package.nix
@@ -20,20 +20,20 @@ stdenv.mkDerivation (finalAttrs: {
   # the Equicord repository. Dates as tags (and automatic releases) were the compromise
   # we came to with upstream. Please do not change the version schema (e.g., to semver)
   # unless upstream changes the tag schema from dates.
-  version = "2026-03-11";
+  version = "2026-04-06";
 
   src = fetchFromGitHub {
     owner = "Equicord";
     repo = "Equicord";
     tag = finalAttrs.version;
-    hash = "sha256-bx0zXbkXBzxB56yvR9Svuwm0Ci8NBdT+7kS5idOD4E4=";
+    hash = "sha256-3wFmi+SzInP+1PH3pwBquTrU757I8z6PmvPxuyygIwU=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_10;
     fetcherVersion = 3;
-    hash = "sha256-jG9A/nIU8pU8c5JT/fLJn3M6EJf2vB+pm5LdrvAr22M=";
+    hash = "sha256-9DNn38JdFQMQh48UEJo5d6CUMbjlzs5LEma6095o508=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/f3/f3d/package.nix b/pkgs/by-name/f3/f3d/package.nix
index 600548ae87c1..a88437a7e22a 100644
--- a/pkgs/by-name/f3/f3d/package.nix
+++ b/pkgs/by-name/f3/f3d/package.nix
@@ -22,7 +22,7 @@
 
 stdenv.mkDerivation rec {
   pname = "f3d";
-  version = "3.4.1";
+  version = "3.5.0";
 
   outputs = [ "out" ] ++ lib.optionals withManual [ "man" ];
 
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     owner = "f3d-app";
     repo = "f3d";
     tag = "v${version}";
-    hash = "sha256-2Kcy9CF0K9jBfVc944i289jbMQdQWXW+gOiaHHchF6U=";
+    hash = "sha256-j8OSG3MNWAlCIZcjhWCMeskbcv+4pTn4ktRZXKYmBkc=";
     fetchLFS = true;
   };
 
diff --git a/pkgs/by-name/fe/feishin/package.nix b/pkgs/by-name/fe/feishin/package.nix
index f6e064bf4597..ac59899b00f2 100644
--- a/pkgs/by-name/fe/feishin/package.nix
+++ b/pkgs/by-name/fe/feishin/package.nix
@@ -16,13 +16,13 @@
 }:
 let
   pname = "feishin";
-  version = "1.9.0";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "jeffvli";
     repo = "feishin";
     tag = "v${version}";
-    hash = "sha256-LcSe7aEtTDs4JIk50zI0IFgN4ZCSJ6NClfk02uO2Sg8=";
+    hash = "sha256-pQCcj0YBytmDQnOxWpErU8xApE0hGQA39G5XivR82Co=";
   };
 
   electron = electron_39;
@@ -43,7 +43,7 @@ buildNpmPackage {
       ;
     pnpm = pnpm_10_29_2;
     fetcherVersion = 3;
-    hash = "sha256-XhBcZRa66QdkjXxbefzsBUdvPIEshorq1uqzoWMXuTc=";
+    hash = "sha256-2fLqqCbbCIPoW/wGzsZOpZd5tnvyrLYlrVhbFWixlDM=";
   };
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
diff --git a/pkgs/by-name/fi/fileshelter/package.nix b/pkgs/by-name/fi/fileshelter/package.nix
index f14f43ec3f30..b56c99aaa2dd 100644
--- a/pkgs/by-name/fi/fileshelter/package.nix
+++ b/pkgs/by-name/fi/fileshelter/package.nix
@@ -24,6 +24,11 @@ stdenv.mkDerivation (finalAttrs: {
 
   postPatch = ''
     sed -i '1i #include <algorithm>' src/fileshelter/ui/ShareCreateFormView.cpp
+
+    # boost 1.89 removed the boost_system stub library
+    substituteInPlace CMakeLists.txt --replace-fail \
+      'find_package(Boost REQUIRED COMPONENTS system program_options)' \
+      'find_package(Boost REQUIRED COMPONENTS program_options)'
   '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/gc/gcfflasher/package.nix b/pkgs/by-name/gc/gcfflasher/package.nix
index 977642d6d138..79c70c15b5cb 100644
--- a/pkgs/by-name/gc/gcfflasher/package.nix
+++ b/pkgs/by-name/gc/gcfflasher/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gcfflasher";
-  version = "4.12.0";
+  version = "4.12.1";
 
   src = fetchFromGitHub {
     owner = "dresden-elektronik";
     repo = "gcfflasher";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wuIyvyRVXhp9SGRybfgaouij2UrPNDD7Oy+ODNTCFRY=";
+    hash = "sha256-L0BelCcwYmPDfWPCjXQQ0Lmk/C1BHuQKk3dLRfo2OMc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gi/gibo/package.nix b/pkgs/by-name/gi/gibo/package.nix
index e5d70a050f4e..323066d83856 100644
--- a/pkgs/by-name/gi/gibo/package.nix
+++ b/pkgs/by-name/gi/gibo/package.nix
@@ -11,16 +11,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "gibo";
-  version = "3.0.17";
+  version = "3.0.20";
 
   src = fetchFromGitHub {
     owner = "simonwhitaker";
     repo = "gibo";
     tag = "v${finalAttrs.version}";
-    sha256 = "sha256-sjfG1oQLik5rTgiqGI0MUuoajay6wSqF+6gTQoplGrY=";
+    sha256 = "sha256-u2e0YwtK3MnzIYvXNVc2a4zsoxISAcS3U+6WpgBsYUM=";
   };
 
-  vendorHash = "sha256-DnOAVZYFXX8982HvQmNpYrvDHfrNvJu+ner5YRfx754=";
+  vendorHash = "sha256-YVs6S3x0u2dypb5h+pNCUkmfVK+0erzoGZzONipL49o=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/gi/git-cola/package.nix b/pkgs/by-name/gi/git-cola/package.nix
index 3bf0ed31669a..56aa8e1369b9 100644
--- a/pkgs/by-name/gi/git-cola/package.nix
+++ b/pkgs/by-name/gi/git-cola/package.nix
@@ -14,14 +14,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "git-cola";
-  version = "4.17.1";
+  version = "4.18.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "git-cola";
     repo = "git-cola";
     tag = "v${version}";
-    hash = "sha256-aBVtyPgkmSYCDlPcmJKFKqUwKMbxVVy8AVsKBdPNkXI=";
+    hash = "sha256-oUh9XVj2FGRow3l5wBUGW+BN01ykLvsQH0uC/No22Do=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/gi/gitnr/package.nix b/pkgs/by-name/gi/gitnr/package.nix
index d96df6c35124..168f56a42d7b 100644
--- a/pkgs/by-name/gi/gitnr/package.nix
+++ b/pkgs/by-name/gi/gitnr/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "gitnr";
-  version = "0.2.2";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "reemus-dev";
     repo = "gitnr";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-9vx+bGfYuJuafZUY2ZT4SAgrNcSXuMe1kHH/lrpItvM=";
+    hash = "sha256-rt82Pb//OAM20BtaT/n1grL4GTTsW2iBziSVn/OI78c=";
   };
 
-  cargoHash = "sha256-DlYV92ZbkeUieVmyaxVuCslkwAgWrULu4HerLFXZZtE=";
+  cargoHash = "sha256-ej5lFiTkynW9ZXRkZtnKqWxaqHETHtYfbLi1L1I4KiM=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/go/go-containerregistry/package.nix b/pkgs/by-name/go/go-containerregistry/package.nix
index b75fcb4f6989..09c2d7631eab 100644
--- a/pkgs/by-name/go/go-containerregistry/package.nix
+++ b/pkgs/by-name/go/go-containerregistry/package.nix
@@ -15,13 +15,13 @@ in
 
 buildGoModule (finalAttrs: {
   pname = "go-containerregistry";
-  version = "0.21.3";
+  version = "0.21.4";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "go-containerregistry";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-BfKiBjfL5th1TPpw6hpno04MffLnXmOVq7BsGUCkPT0=";
+    sha256 = "sha256-TODosgMYXR1StkRC/h5rn84I2R+e0dHnGJxmCisYDNk=";
   };
   vendorHash = null;
 
diff --git a/pkgs/by-name/go/go-ios/package.nix b/pkgs/by-name/go/go-ios/package.nix
index 6ed1c5ee6e33..919fb3ecfb2e 100644
--- a/pkgs/by-name/go/go-ios/package.nix
+++ b/pkgs/by-name/go/go-ios/package.nix
@@ -12,13 +12,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "go-ios";
-  version = "1.0.204";
+  version = "1.0.206";
 
   src = fetchFromGitHub {
     owner = "danielpaulus";
     repo = "go-ios";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-G/CFG+glZ5DGIux3FJSe2wdfRl++GFr3JB8bHLOq+KY=";
+    sha256 = "sha256-/dQknNs+fLBJvfiDOaGc26a+bRo8NdhT1B/QPxJmmro=";
   };
 
   proxyVendor = true;
diff --git a/pkgs/by-name/gr/grip-search/package.nix b/pkgs/by-name/gr/grip-search/package.nix
index feae85beb34c..eded3219e89e 100644
--- a/pkgs/by-name/gr/grip-search/package.nix
+++ b/pkgs/by-name/gr/grip-search/package.nix
@@ -44,6 +44,14 @@ stdenv.mkDerivation (finalAttrs: {
 
     substituteInPlace CMakeLists.txt \
       --replace-fail "cmake_minimum_required (VERSION 3.1)" "cmake_minimum_required(VERSION 3.10)"
+
+    # boost 1.89 removed the boost_system stub library
+    substituteInPlace \
+      src/general/CMakeLists.txt \
+      src/test/CMakeLists.txt \
+      src/gripgen/CMakeLists.txt \
+      src/grip/CMakeLists.txt \
+      --replace-fail ' system' ""
   '';
 
   meta = {
diff --git a/pkgs/by-name/gr/grive2/package.nix b/pkgs/by-name/gr/grive2/package.nix
index 8c2c7260d9e1..a229eae30de3 100644
--- a/pkgs/by-name/gr/grive2/package.nix
+++ b/pkgs/by-name/gr/grive2/package.nix
@@ -37,6 +37,11 @@ stdenv.mkDerivation (finalAttrs: {
   postPatch = ''
     substituteInPlace CMakeLists.txt \
       --replace-fail 'cmake_minimum_required(VERSION 2.8)' 'cmake_minimum_required(VERSION 3.10)'
+
+    # boost 1.89 removed the boost_system stub library
+    substituteInPlace libgrive/CMakeLists.txt --replace-fail \
+      'find_package(Boost 1.40.0 COMPONENTS program_options filesystem unit_test_framework regex system REQUIRED)' \
+      'find_package(Boost 1.40.0 COMPONENTS program_options filesystem unit_test_framework regex REQUIRED)'
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ha/hacompanion/package.nix b/pkgs/by-name/ha/hacompanion/package.nix
index 7eec471b5d8a..607a337a1de0 100644
--- a/pkgs/by-name/ha/hacompanion/package.nix
+++ b/pkgs/by-name/ha/hacompanion/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "hacompanion";
-  version = "1.0.25";
+  version = "1.0.26";
 
   src = fetchFromGitHub {
     owner = "tobias-kuendig";
     repo = "hacompanion";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-CkJ648rYlSzWH0K7vGcxYKiVEsVj+y+p+2bsV7VOi6I=";
+    hash = "sha256-gpBu7HsohL8/Rfy3uWtYF7llX59nJXDDR//YE3MYje8=";
   };
 
   vendorHash = "sha256-y2eSuMCDZTGdCs70zYdA8NKbuPPN5xmnRfMNK+AE/q8=";
diff --git a/pkgs/by-name/hc/hcdiag/package.nix b/pkgs/by-name/hc/hcdiag/package.nix
index 2e6a761a305c..c9c4925dfdb6 100644
--- a/pkgs/by-name/hc/hcdiag/package.nix
+++ b/pkgs/by-name/hc/hcdiag/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "hcdiag";
-  version = "0.5.11";
+  version = "0.5.12";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "hcdiag";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vfW1HXhSK3B6MCkypzUXOBBLLA8uqBw9ipTnW5duhoQ=";
+    hash = "sha256-SXP5Poa4mjlvp4AQzSekHBCc07+a3bWVOPJWxfOuB/Q=";
   };
 
   vendorHash = "sha256-mUqXnUAnN052RMsMtiUpOTlDVb59Xh3+++E/BtEEQGk=";
diff --git a/pkgs/by-name/he/heptabase/package.nix b/pkgs/by-name/he/heptabase/package.nix
index 7724a3e3e863..62519c6e81ca 100644
--- a/pkgs/by-name/he/heptabase/package.nix
+++ b/pkgs/by-name/he/heptabase/package.nix
@@ -5,10 +5,10 @@
 }:
 let
   pname = "heptabase";
-  version = "1.85.1";
+  version = "1.87.2";
   src = fetchurl {
     url = "https://github.com/heptameta/project-meta/releases/download/v${version}/Heptabase-${version}.AppImage";
-    hash = "sha256-GdX38JTFn3p2rqDygulYut2mCYZY41xm0q2n2/EIiOw=";
+    hash = "sha256-6O6ksa0mCUoAfXW8jzh1n7zAfLZTA45va9o6J2ghKgU=";
   };
 
   appimageContents = appimageTools.extractType2 { inherit pname version src; };
diff --git a/pkgs/by-name/he/hextazy/package.nix b/pkgs/by-name/he/hextazy/package.nix
index 2ecee14a4e74..66cada69c47c 100644
--- a/pkgs/by-name/he/hextazy/package.nix
+++ b/pkgs/by-name/he/hextazy/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "hextazy";
-  version = "0.8.5";
+  version = "0.8.6";
 
   src = fetchFromGitHub {
     owner = "0xfalafel";
     repo = "hextazy";
     tag = finalAttrs.version;
-    hash = "sha256-Q7gTupoyxioxMibiqhhgnvy38EgnAw+ceSuXzElyga8=";
+    hash = "sha256-pQhSel/DgdosvH2H90PIc51GEYhWx31WWkvOPKcUp1I=";
   };
 
-  cargoHash = "sha256-MzshiOBMi5eJiRogfwygybQc6MEW58ZMpKAinmpBp1E=";
+  cargoHash = "sha256-0uEiL85ypKr/9r0okrm4pqLRZOYDIUFxmobqK7Jm1Jw=";
 
   meta = {
     description = "TUI hexeditor in Rust with colored bytes";
diff --git a/pkgs/by-name/hy/hysteria/package.nix b/pkgs/by-name/hy/hysteria/package.nix
index 9f020bcd8367..8469069a1a98 100644
--- a/pkgs/by-name/hy/hysteria/package.nix
+++ b/pkgs/by-name/hy/hysteria/package.nix
@@ -6,16 +6,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "hysteria";
-  version = "2.7.1";
+  version = "2.8.1";
 
   src = fetchFromGitHub {
     owner = "apernet";
     repo = "hysteria";
     rev = "app/v${finalAttrs.version}";
-    hash = "sha256-EqDwCb8hd0bRTCqG762DZvSw7PGCD13SXxW/W5f6HVs=";
+    hash = "sha256-KxCf9btvEbwP+oWL6A6rWpQsRJPifohFLDIdr+0XwzM=";
   };
 
-  vendorHash = "sha256-CeAbWgDwGMKtqYXwXe1SDwDT+VY+2U6fztNHqUk4i84=";
+  vendorHash = "sha256-NXBxrKptXTZzEXZ5hYHtC3wbFIYgL9avJay6DJHRMLU=";
   proxyVendor = true;
 
   ldflags =
diff --git a/pkgs/by-name/ip/ipsw/package.nix b/pkgs/by-name/ip/ipsw/package.nix
index 27ac7c6ad37b..35287121835e 100644
--- a/pkgs/by-name/ip/ipsw/package.nix
+++ b/pkgs/by-name/ip/ipsw/package.nix
@@ -6,17 +6,17 @@
 }:
 
 buildGo126Module (finalAttrs: {
-  version = "3.1.665";
+  version = "3.1.668";
   pname = "ipsw";
 
   src = fetchFromGitHub {
     owner = "blacktop";
     repo = "ipsw";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Oxf+hpNo/Li/S0kVjekp2RArGrYQP7voNBSTz3/Gr+Q=";
+    hash = "sha256-SsFj5/a9Xk7I4H07kdfVnbIF6sTE61ztqYMSFt5tpPY=";
   };
 
-  vendorHash = "sha256-rzOw51n8G9H5Sxr2rCevrmG6z2SqKZOjluYwJzYiY70=";
+  vendorHash = "sha256-jvZSO3aLRI+7Nl/U4dmyhKrXkRV97tmkkU+uSHR8+Co=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ja/jawiki-all-titles-in-ns0/package.nix b/pkgs/by-name/ja/jawiki-all-titles-in-ns0/package.nix
index c7c1f93d799c..339428889c1d 100644
--- a/pkgs/by-name/ja/jawiki-all-titles-in-ns0/package.nix
+++ b/pkgs/by-name/ja/jawiki-all-titles-in-ns0/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "jawiki-all-titles-in-ns0";
-  version = "0-unstable-2026-03-01";
+  version = "0-unstable-2026-04-01";
 
   src = fetchFromGitHub {
     owner = "musjj";
     repo = "jawiki-archive";
-    rev = "f653315af9ae4f25ea5020f4fc6a8b5f311cbbf5";
-    hash = "sha256-aLmGHTOkRCHr+vwQYLYm3qKCONUBpdMsZadTNmHwOGA=";
+    rev = "d8dff4562d79e33fbd1292cb4f5a857402735d21";
+    hash = "sha256-/0D0+txyR6wTJjW9xLevKUReM8y1bhUAJSdgkLMVjYI=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/jp/jp-zip-codes/package.nix b/pkgs/by-name/jp/jp-zip-codes/package.nix
index 852358eae5c5..73f7efaef7bb 100644
--- a/pkgs/by-name/jp/jp-zip-codes/package.nix
+++ b/pkgs/by-name/jp/jp-zip-codes/package.nix
@@ -7,15 +7,15 @@
 
 stdenvNoCC.mkDerivation {
   pname = "jp-zip-code";
-  version = "0-unstable-2026-03-01";
+  version = "0-unstable-2026-04-01";
 
   # This package uses a mirror as the source because the
   # original provider uses the same URL for updated content.
   src = fetchFromGitHub {
     owner = "musjj";
     repo = "jp-zip-codes";
-    rev = "ac744cf265a65b8568636ad3456d79abfa607549";
-    hash = "sha256-afs8SEn575lspvKZSxh4hNZ/5+OpeFCYY5E2jyY8hDY=";
+    rev = "5404779eb05849c61c70c4489d117bcb36ea19ab";
+    hash = "sha256-pysW1hAj8acTFOytYw/ZXknUlRP+JUvh4Ia2I2CwA6A=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/ka/kaminpar/package.nix b/pkgs/by-name/ka/kaminpar/package.nix
index 1a7cfeef3a90..ffb82e4b7235 100644
--- a/pkgs/by-name/ka/kaminpar/package.nix
+++ b/pkgs/by-name/ka/kaminpar/package.nix
@@ -14,13 +14,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "kaminpar";
-  version = "3.7.2";
+  version = "3.7.3";
 
   src = fetchFromGitHub {
     owner = "KaHIP";
     repo = "KaMinPar";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yuceZE3o5dvK7Q8y8nbq7DLMx51GLk2lRh2hMTLdbRc=";
+    hash = "sha256-YjETyYnVcWzZqEv3z4xaBcdlWhSmsKC4PyFvUOZFBYA=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/ku/kubevela/package.nix b/pkgs/by-name/ku/kubevela/package.nix
index ab541b411451..24719b283605 100644
--- a/pkgs/by-name/ku/kubevela/package.nix
+++ b/pkgs/by-name/ku/kubevela/package.nix
@@ -14,13 +14,13 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "kubevela";
-  version = "1.10.7";
+  version = "1.10.8";
 
   src = fetchFromGitHub {
     owner = "kubevela";
     repo = "kubevela";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-JjogTZShCTeFWyhrT9qWDGB0zk+mU6op1oC2Z50OF3c=";
+    hash = "sha256-RD3EOlVTXMY+FLs7U5jEE3w6Wzs026ohu3LZ3oHgcvg=";
   };
 
   vendorHash = "sha256-MUfULgycZn8hFfWmtNeoFf21+g3gGpeKoBvL8qB/m80=";
diff --git a/pkgs/by-name/ku/kurve/package.nix b/pkgs/by-name/ku/kurve/package.nix
index b5476ae59c9a..36af7658bd19 100644
--- a/pkgs/by-name/ku/kurve/package.nix
+++ b/pkgs/by-name/ku/kurve/package.nix
@@ -13,14 +13,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "kurve";
-  version = "3.5.0";
+  version = "3.5.1";
   dontWrapQtApps = true;
 
   src = fetchFromGitHub {
     owner = "luisbocanegra";
     repo = "kurve";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gzL99vDDEbs37uNW4Z1fUTwmq7UqwZsxYk6wljNt8G0=";
+    hash = "sha256-EEOKf/0Ti/PyhxUs4n56jRvDFBLVwsZx2icO5PzBIrQ=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/la/lacy/package.nix b/pkgs/by-name/la/lacy/package.nix
index e968d3069dbf..b7ad8f50d379 100644
--- a/pkgs/by-name/la/lacy/package.nix
+++ b/pkgs/by-name/la/lacy/package.nix
@@ -6,18 +6,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lacy";
-  version = "0.6.1";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "timothebot";
     repo = "lacy";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3LFJpzuL2ULnStFwW165gH/S8Hjh49QE4R6c0NyKRSI=";
+    hash = "sha256-YX/iXlQ3uhmxNr4fpPtxIPhFwXGUJZF8rYe9mU+9Hos=";
   };
 
   passthru.updateScript = nix-update-script { };
 
-  cargoHash = "sha256-OJW29CopdO7lbkr0F2KVnfbRGEGIf8J8Vu8YChjeElY=";
+  cargoHash = "sha256-3K8g/AGpSXFUhgEBg/AzUYsH3vOvsRzAYnrOAZNVS4g=";
 
   meta = {
     description = "Fast magical cd alternative for lacy terminal navigators";
diff --git a/pkgs/by-name/la/ladybugdb/package.nix b/pkgs/by-name/la/ladybugdb/package.nix
index 161550cd1f1a..f32280ea3c77 100644
--- a/pkgs/by-name/la/ladybugdb/package.nix
+++ b/pkgs/by-name/la/ladybugdb/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ladybugdb";
-  version = "0.15.1";
+  version = "0.15.3";
 
   src = fetchFromGitHub {
     owner = "LadybugDB";
     repo = "ladybug";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wqvX6yPhh1CbviPgcRW4XOmNjLe5s9FaqHYDFs7GQOg=";
+    hash = "sha256-Hf0oLaAQzvYQ6CrSzvsD7V1SA2oGGiIqIhrcjpRevAc=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/le/leatherman/package.nix b/pkgs/by-name/le/leatherman/package.nix
index 00498584b6ad..c0e55cb81ee4 100644
--- a/pkgs/by-name/le/leatherman/package.nix
+++ b/pkgs/by-name/le/leatherman/package.nix
@@ -27,6 +27,20 @@ stdenv.mkDerivation (finalAttrs: {
     substituteInPlace CMakeLists.txt --replace-fail \
       "cmake_minimum_required(VERSION 3.2.2)" \
       "cmake_minimum_required(VERSION 3.10)"
+
+    # boost 1.89 removed the boost_system stub library
+    substituteInPlace \
+      curl/CMakeLists.txt \
+      dynamic_library/CMakeLists.txt \
+      execution/CMakeLists.txt \
+      file_util/CMakeLists.txt \
+      locale/CMakeLists.txt \
+      logging/CMakeLists.txt \
+      ruby/CMakeLists.txt \
+      util/CMakeLists.txt \
+      windows/CMakeLists.txt \
+      --replace-fail ' system' ""
+    substituteInPlace tests/CMakeLists.txt --replace-fail 'system ' ""
   '';
 
   env.NIX_CFLAGS_COMPILE = "-Wno-error";
diff --git a/pkgs/by-name/li/libwhereami/package.nix b/pkgs/by-name/li/libwhereami/package.nix
index 995736bcfa41..e77179f3066d 100644
--- a/pkgs/by-name/li/libwhereami/package.nix
+++ b/pkgs/by-name/li/libwhereami/package.nix
@@ -25,6 +25,11 @@ stdenv.mkDerivation (finalAttrs: {
     substituteInPlace CMakeLists.txt --replace-fail \
       "cmake_minimum_required(VERSION 3.2.2)" \
       "cmake_minimum_required(VERSION 3.10)"
+
+    # boost 1.89 removed the boost_system stub library
+    substituteInPlace CMakeLists.txt --replace-fail \
+      'list(APPEND BOOST_COMPONENTS filesystem regex system thread)' \
+      'list(APPEND BOOST_COMPONENTS filesystem regex thread)'
   '';
 
   env.NIX_CFLAGS_COMPILE = "-Wno-error";
diff --git a/pkgs/by-name/li/lilex/package.nix b/pkgs/by-name/li/lilex/package.nix
index 8dc12d069a66..138d5e591d54 100644
--- a/pkgs/by-name/li/lilex/package.nix
+++ b/pkgs/by-name/li/lilex/package.nix
@@ -6,11 +6,11 @@
 }:
 stdenvNoCC.mkDerivation rec {
   pname = "lilex";
-  version = "2.621";
+  version = "2.700";
 
   src = fetchurl {
     url = "https://github.com/mishamyrt/Lilex/releases/download/${version}/Lilex.zip";
-    hash = "sha256-TsLJ96SZpokW3354/yt0Re4ZtFXqYK/46iyZXdPKhoE=";
+    hash = "sha256-NDEO20unSfdy1CuI4+7EpjGFJ+dc7qqWz8VW7jU2b7w=";
   };
 
   nativeBuildInputs = [ unzip ];
diff --git a/pkgs/by-name/li/lisette/package.nix b/pkgs/by-name/li/lisette/package.nix
index 7f88c219c2d8..8c2b1ffb00ab 100644
--- a/pkgs/by-name/li/lisette/package.nix
+++ b/pkgs/by-name/li/lisette/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lisette";
-  version = "0.1.2";
+  version = "0.1.3";
 
   src = fetchFromGitHub {
     owner = "ivov";
     repo = "lisette";
     tag = "lisette-v${finalAttrs.version}";
-    hash = "sha256-wUd4LjwbsW5hS2VAbzzq9oDDPLbdXie6JmkuOEBsjmA=";
+    hash = "sha256-vepiowHDu0l7BCT42ceIEOVaoUd9ttrE21N6D9+zPgo=";
   };
 
-  cargoHash = "sha256-E+8eFfftyrIGNfddQqDmmfPpv1FyYg2u00+KKru+B0Y=";
+  cargoHash = "sha256-N7Y0BHaVcF8ejKnFrci0KHoy0SLuiTmJpgAPOV8hkAg=";
 
   preCheck = ''
     export NO_COLOR=true
diff --git a/pkgs/by-name/li/litestream/fix-cve-2024-41254.patch b/pkgs/by-name/li/litestream/fix-cve-2024-41254.patch
deleted file mode 100644
index 8fd06b712a24..000000000000
--- a/pkgs/by-name/li/litestream/fix-cve-2024-41254.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-diff --git a/cmd/litestream/main.go b/cmd/litestream/main.go
-index 1234567..abcdefg 100644
---- a/cmd/litestream/main.go
-+++ b/cmd/litestream/main.go
-@@ -362,6 +362,7 @@ type ReplicaConfig struct {
- 	Host     string `yaml:"host"`
- 	User     string `yaml:"user"`
- 	Password string `yaml:"password"`
- 	KeyPath  string `yaml:"key-path"`
-+	HostKeyPath string `yaml:"host-key-path"`
- 
- 	// Encryption identities and recipients
-@@ -664,6 +665,7 @@ func NewReplicaFromConfig(c *ReplicaConfig, dbc *DBConfig) (_ litestream.Replic
- 	client.Password = password
- 	client.Path = path
- 	client.KeyPath = c.KeyPath
-+	client.HostKeyPath = c.HostKeyPath
- 	return client, nil
- }
- 
-diff --git a/sftp/replica_client.go b/sftp/replica_client.go
-index 30d8fa87..8b651e97 100644
---- a/sftp/replica_client.go
-+++ b/sftp/replica_client.go
-@@ -41,6 +41,7 @@ type ReplicaClient struct {
- 	Password    string
- 	Path        string
- 	KeyPath     string
-+	HostKeyPath string
- 	DialTimeout time.Duration
- }
- 
-@@ -71,14 +72,28 @@ func (c *ReplicaClient) Init(ctx context.Context) (_ *sftp.Client, err error) {
- 
- 	// Build SSH configuration & auth methods
- 	config := &ssh.ClientConfig{
--		User:            c.User,
--		HostKeyCallback: ssh.InsecureIgnoreHostKey(),
--		BannerCallback:  ssh.BannerDisplayStderr(),
-+		User:           c.User,
-+		BannerCallback: ssh.BannerDisplayStderr(),
- 	}
- 	if c.Password != "" {
- 		config.Auth = append(config.Auth, ssh.Password(c.Password))
- 	}
- 
-+	if c.HostKeyPath == "" {
-+		config.HostKeyCallback = ssh.InsecureIgnoreHostKey()
-+	} else {
-+		buf, err := os.ReadFile(c.HostKeyPath)
-+		if err != nil {
-+			return nil, fmt.Errorf("cannot read sftp host key path: %w", err)
-+		}
-+
-+		key, _, _, _, err := ssh.ParseAuthorizedKey(buf)
-+		if err != nil {
-+			return nil, fmt.Errorf("cannot parse sftp host key path: path=%s len=%d err=%w", c.HostKeyPath, len(buf), err)
-+		}
-+		config.HostKeyCallback = ssh.FixedHostKey(key)
-+	}
-+
- 	if c.KeyPath != "" {
- 		buf, err := os.ReadFile(c.KeyPath)
- 		if err != nil {
\ No newline at end of file
diff --git a/pkgs/by-name/li/litestream/package.nix b/pkgs/by-name/li/litestream/package.nix
index f5d68da741a8..fad210501e68 100644
--- a/pkgs/by-name/li/litestream/package.nix
+++ b/pkgs/by-name/li/litestream/package.nix
@@ -6,13 +6,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "litestream";
-  version = "0.3.14";
+  version = "0.5.10";
 
   src = fetchFromGitHub {
     owner = "benbjohnson";
     repo = "litestream";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-rTPw1BnZPtcWzhwR9mCzoE4LXdlaFfRCIDMHlN/SRzk=";
+    hash = "sha256-xp1Ic7sF3yzpR4FgMOfx/uRp/jv/qzTgSlItOIrl2pI=";
   };
 
   ldflags = [
@@ -21,9 +21,7 @@ buildGoModule (finalAttrs: {
     "-X main.Version=${finalAttrs.version}"
   ];
 
-  vendorHash = "sha256-sYIY3Z3VrCqbjEbQtEY7q6Jljg8jMoa2qWEB/IkDjzM=";
-
-  patches = [ ./fix-cve-2024-41254.patch ];
+  vendorHash = "sha256-e2fsgK/fZNIos5W/Gc3u72uzoT2igs6BgzYtz1PyI10=";
 
   passthru.tests = { inherit (nixosTests) litestream; };
 
diff --git a/pkgs/by-name/ll/llrCUDA/package.nix b/pkgs/by-name/ll/llrCUDA/package.nix
new file mode 100644
index 000000000000..1630f0d3e126
--- /dev/null
+++ b/pkgs/by-name/ll/llrCUDA/package.nix
@@ -0,0 +1,78 @@
+{
+  fetchzip,
+  lib,
+  gmp,
+  cudaPackages,
+  autoPatchelfHook,
+}:
+let
+  inherit (cudaPackages) backendStdenv;
+in
+backendStdenv.mkDerivation (finalAttrs: {
+  pname = "llrCUDA";
+  version = "4.0.0";
+
+  src = fetchzip {
+    url = "http://jpenne.free.fr/llr4/llrcuda${
+      builtins.replaceStrings [ "." ] [ "" ] finalAttrs.version
+    }srcgpu12.zip";
+    hash = "sha256-/v89jsTKCpkmCMKp9nUf7VAnSobE8pDdwLw5n3Hz9dw=";
+  };
+
+  enableParallelBuilding = true;
+
+  # Disable _chdir in lprime.cu to prevent segmentation fault when fopen returns NULL
+  postPatch = ''
+    substituteInPlace lprime.cu \
+      --replace-fail "_chdir (buf)" "0/* _chdir (buf) */"
+
+    substituteInPlace Makefile \
+      --replace-fail "/usr/local/cuda" "${cudaPackages.cuda_nvcc}"
+  '';
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    cudaPackages.cuda_nvcc
+  ];
+
+  buildInputs = [
+    gmp
+    cudaPackages.cuda_cudart
+    cudaPackages.libcufft
+    cudaPackages.cuda_cccl
+  ];
+
+  env = {
+    NIX_LDFLAGS = lib.concatStringsSep " " [
+      "-L${lib.getLib gmp}/lib"
+      "-L${lib.getLib cudaPackages.cuda_cudart}/lib"
+    ];
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 dllrCUDA $out/bin/llrCUDA
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "GPU version of the LLR program";
+    longDescription = ''
+      Primality proving program for numbers of the form N = k*b^n +/- 1, (k < b^n),
+      or numbers which can be rewritten in this form, like
+      Gaussian-Mersenne norms or b^n-b^m +/- 1 with n>m (new feature).
+      The identity Phi(3,-X) = X^2-X+1 is now used with X=b^n to search for
+      Generalized Unique Primes.
+    '';
+    homepage = "http://jpenne.free.fr/index2.html";
+    maintainers = with lib.maintainers; [ dstremur ];
+    license = lib.licenses.unfree;
+    # Restricted by GWNUM terms and CUDA dependencies.
+    # Its CUDA code is based on GWNUM.
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+    platforms = [ "x86_64-linux" ];
+    mainProgram = "llrCUDA";
+  };
+})
diff --git a/pkgs/by-name/lo/localproxy/package.nix b/pkgs/by-name/lo/localproxy/package.nix
index 89c8e45be70a..bcc43899c26c 100644
--- a/pkgs/by-name/lo/localproxy/package.nix
+++ b/pkgs/by-name/lo/localproxy/package.nix
@@ -54,6 +54,9 @@ stdenv.mkDerivation (finalAttrs: {
     substituteInPlace ./CMakeLists.txt --replace-fail \
       "cmake_minimum_required(VERSION 3.2 FATAL_ERROR)" \
       "cmake_minimum_required(VERSION 4.0)"
+
+    # boost 1.89 removed the boost_system stub library
+    substituteInPlace CMakeLists.txt --replace-fail ' system' ""
   '';
 
   # causes redefinition of _FORTIFY_SOURCE
diff --git a/pkgs/by-name/ma/mailpit/source.nix b/pkgs/by-name/ma/mailpit/source.nix
index 9b9745deff96..47e513398a1f 100644
--- a/pkgs/by-name/ma/mailpit/source.nix
+++ b/pkgs/by-name/ma/mailpit/source.nix
@@ -1,6 +1,6 @@
 {
-  version = "1.29.4";
-  hash = "sha256-QNTXl49WgmixaWGHhjVcMJwj/AA3agwqlPRC3/Nnfsg=";
-  npmDepsHash = "sha256-lVbNT2CEEMS2DpJhUMd/ID8yu8PuRbWrciJ/h391czs=";
-  vendorHash = "sha256-ypFnKykiDFs8JxMkOnQYwJU5FfFhRrCSrhEgsfN1TVc=";
+  version = "1.29.6";
+  hash = "sha256-jkWrh2pQ4LBQMTb3r1kgbSmYRBCWPXIVC8ywM5yYnQg=";
+  npmDepsHash = "sha256-vt28b02zDkrNWR4nTD2IH87gqGlhxxaF7L0N5jSS76k=";
+  vendorHash = "sha256-k07JTSQ67ZVOiCUkRRW9u6V+E75gtfKpZ6zNa4eHH/Y=";
 }
diff --git a/pkgs/by-name/ma/mas/package.nix b/pkgs/by-name/ma/mas/package.nix
index d4893a424c0b..cd9a73a192be 100644
--- a/pkgs/by-name/ma/mas/package.nix
+++ b/pkgs/by-name/ma/mas/package.nix
@@ -10,7 +10,7 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "mas";
-  version = "5.1.0";
+  version = "6.0.1";
 
   src =
     let
@@ -19,11 +19,11 @@ stdenvNoCC.mkDerivation (finalAttrs: {
         {
           x86_64-darwin = {
             arch = "x86_64";
-            hash = "sha256-G7o0nHsf6Ay2k3quMs45KH9h4yEpbvyGPm/u86naWcM=";
+            hash = "sha256-7+iDBr4GG5bdTuAlAmMQkEkIzVgLo2+DEdravClaLtQ=";
           };
           aarch64-darwin = {
             arch = "arm64";
-            hash = "sha256-XZM0YeFLHYhoEqQLaG1Jz3OWcT9DILqFEcgqI3yvDk8=";
+            hash = "sha256-BZ9UE8H28kjqiMNdLDUUyC9madR4rBV1mLUGyj6ol3Y=";
           };
         }
         .${stdenvNoCC.hostPlatform.system}
diff --git a/pkgs/by-name/ma/matrix-alertmanager-receiver/package.nix b/pkgs/by-name/ma/matrix-alertmanager-receiver/package.nix
index 91eb926a1e31..1b4541236405 100644
--- a/pkgs/by-name/ma/matrix-alertmanager-receiver/package.nix
+++ b/pkgs/by-name/ma/matrix-alertmanager-receiver/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "matrix-alertmanager-receiver";
-  version = "2026.3.25";
+  version = "2026.4.1";
 
   src = fetchFromGitHub {
     owner = "metio";
     repo = "matrix-alertmanager-receiver";
     tag = finalAttrs.version;
-    hash = "sha256-jb15SstA+5WeQe6QiKuNX/HHCuKAs38TTrjM85UQxyQ=";
+    hash = "sha256-2ULM0hjKWbFaZvVgkAST4+EvGF4U/xUbJf03NwFs34s=";
   };
 
-  vendorHash = "sha256-szUkKri3Rx1i3681r85xrOLqXV5u7s9DUemQHeh+qJw=";
+  vendorHash = "sha256-Cw6zU+jwHNPpDenP/KxEdMuLYempyc6mUJ5nmV728DU=";
 
   env.CGO_ENABLED = "0";
 
diff --git a/pkgs/by-name/me/meshoptimizer/package.nix b/pkgs/by-name/me/meshoptimizer/package.nix
index d1004795b763..3a9e85d1ebe5 100644
--- a/pkgs/by-name/me/meshoptimizer/package.nix
+++ b/pkgs/by-name/me/meshoptimizer/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   fetchFromGitHub,
   cmake,
+  libwebp,
   nix-update-script,
 }:
 
@@ -10,18 +11,18 @@ let
   basis_universal = fetchFromGitHub {
     owner = "zeux";
     repo = "basis_universal";
-    rev = "8903f6d69849fd782b72a551a4dd04a264434e20";
-    hash = "sha256-o3dCxAAkpMoNkvkM7qD75cPn/obDc/fJ8u7KLPm1G6g=";
+    rev = "88e813c46b3ff42e56ef947b3fa11eeee7a504b0";
+    hash = "sha256-8SQhORPPLBeynlRWjpkXxleo5pgkNmEIjcXbptuo8es=";
   };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "meshoptimizer";
-  version = "1.0.1";
+  version = "1.1";
   src = fetchFromGitHub {
     owner = "zeux";
     repo = "meshoptimizer";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-t5cWeGf9YI9oG919c6mdXE+qnK2rkTLW0GJ52vw/HrI=";
+    hash = "sha256-tvVMg3RO1T1/Ub/uue1UQwYeSwqq9OQ1F3PKlF3YOrk=";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -34,7 +35,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   cmakeFlags = [
     "-DMESHOPT_BUILD_GLTFPACK=ON"
-    "-DMESHOPT_BASISU_PATH=${basis_universal}"
+    "-DMESHOPT_GLTFPACK_BASISU_PATH=${basis_universal}"
+    "-DMESHOPT_GLTFPACK_LIBWEBP_PATH=${libwebp.src}"
   ]
   ++ lib.optional (!stdenv.hostPlatform.isStatic) "-DMESHOPT_BUILD_SHARED_LIBS:BOOL=ON";
 
diff --git a/pkgs/by-name/mi/millisecond/package.nix b/pkgs/by-name/mi/millisecond/package.nix
index 1ea56431c645..201d9f274435 100644
--- a/pkgs/by-name/mi/millisecond/package.nix
+++ b/pkgs/by-name/mi/millisecond/package.nix
@@ -23,13 +23,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "millisecond";
-  version = "0.2.0";
+  version = "0.2.1";
 
   src = fetchFromGitHub {
     owner = "gaheldev";
     repo = "Millisecond";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-SMGcSlbOfBX5gAwB7CaHRthf9EN5QWAN9ZzrcbQXtm8=";
+    hash = "sha256-2jGmL/bNta84x7/U5iX+sIlZyzqlcT62oLmfu4f8fiA=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/mp/mpls/package.nix b/pkgs/by-name/mp/mpls/package.nix
index 75cc947b89d4..da512c422dfd 100644
--- a/pkgs/by-name/mp/mpls/package.nix
+++ b/pkgs/by-name/mp/mpls/package.nix
@@ -7,16 +7,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "mpls";
-  version = "0.20.1";
+  version = "0.21.0";
 
   src = fetchFromGitHub {
     owner = "mhersson";
     repo = "mpls";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-SdCWtz/BmuOBLuwQiif5YnnNctaOQpb6iHqDT6j35ZM=";
+    hash = "sha256-mhQuycz+8UfZwsc2/gRuK6X26PxedcqlFyUM0IxqQJs=";
   };
 
-  vendorHash = "sha256-pi7KBA/313cG0AYWM/mUDng2M9L2tMLkonY4LI5XiW0=";
+  vendorHash = "sha256-w0YBeIaARC16BFp4uxJO8X8b1ozTbWFNUg7VQQa5iFw=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/mq/mqtt-randompub/package.nix b/pkgs/by-name/mq/mqtt-randompub/package.nix
index a7e48863c47e..d94dbb90c937 100644
--- a/pkgs/by-name/mq/mqtt-randompub/package.nix
+++ b/pkgs/by-name/mq/mqtt-randompub/package.nix
@@ -6,17 +6,17 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "mqtt-randompub";
-  version = "0.3.0";
+  version = "0.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "fabaff";
     repo = "mqtt-randompub";
     tag = finalAttrs.version;
-    hash = "sha256-X9gITmzyUNtYW8IMTcBiubPscBEO5OGjdxot9wRD/BY=";
+    hash = "sha256-6R40dEJSi3i2UxJNXLk+GWA/iykzbGVLFccF8ncymKw=";
   };
 
-  build-system = with python3.pkgs; [ setuptools ];
+  build-system = with python3.pkgs; [ hatchling ];
 
   dependencies = with python3.pkgs; [ paho-mqtt ];
 
diff --git a/pkgs/by-name/na/namespace-cli/package.nix b/pkgs/by-name/na/namespace-cli/package.nix
index 71e8df2aeae5..36424b3c7471 100644
--- a/pkgs/by-name/na/namespace-cli/package.nix
+++ b/pkgs/by-name/na/namespace-cli/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "namespace-cli";
-  version = "0.0.491";
+  version = "0.0.493";
 
   src = fetchFromGitHub {
     owner = "namespacelabs";
     repo = "foundation";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-hNxfWsWs3WVQoworX58qOd7l6Jy/f1qyGZeqQMsBIxU=";
+    hash = "sha256-PMF4bpJ5+XtJrhQMsr33wdEDuufn2d+xcGddWzAR/bs=";
   };
 
-  vendorHash = "sha256-yn/oeWUERZvNaChFWvtzvp29AcI5dBu7OkACvFPKD+U=";
+  vendorHash = "sha256-03QhO7oIUB9zoL5bfzWezkJ0zDY4buuXWLYhwxvnoig=";
 
   subPackages = [
     "cmd/nsc"
diff --git a/pkgs/by-name/ne/nexa/package.nix b/pkgs/by-name/ne/nexa/package.nix
index 19fdc47c4ca5..d18777cfcb1b 100644
--- a/pkgs/by-name/ne/nexa/package.nix
+++ b/pkgs/by-name/ne/nexa/package.nix
@@ -1,24 +1,22 @@
 {
+  config,
   lib,
-  buildGoModule,
+  buildGo125Module,
   fetchFromGitHub,
   fetchurl,
   autoPatchelfHook,
   unzip,
-  go_1_25,
   stdenv,
   vulkan-loader,
   zlib,
 
   # Feature flags (all enabled by default, set slim = true to disable all optional deps)
   slim ? false,
-  enableCuda ? !slim && stdenv.hostPlatform.isLinux,
-  enableFfmpeg ? !slim && stdenv.hostPlatform.isLinux,
+  enableCuda ? !slim && stdenv.hostPlatform.isLinux && config.cudaSupport,
   enableVulkan ? !slim && stdenv.hostPlatform.isLinux,
 
   # Optional dependencies
   cudaPackages,
-  ffmpeg_4,
   gfortran,
   pcre2,
   darwinMinVersionHook,
@@ -30,7 +28,7 @@
 }:
 
 let
-  bridgeVersion = "v1.0.45-rc1";
+  bridgeVersion = "1.0.45-rc1";
 
   bridge = fetchurl {
     url =
@@ -41,19 +39,19 @@ let
             aarch64-linux = "linux_arm64";
             aarch64-darwin = "macos_arm64";
           }
-          .${stdenv.hostPlatform.system};
+          .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
       in
-      "https://nexa-model-hub-bucket.s3.us-west-1.amazonaws.com/public/nexasdk/${bridgeVersion}/${platformDir}/nexasdk-bridge.zip";
+      "https://nexa-model-hub-bucket.s3.us-west-1.amazonaws.com/public/nexasdk/v${bridgeVersion}/${platformDir}/nexasdk-bridge.zip";
     hash =
       {
         x86_64-linux = "sha256-bvULCeGXNd8Alu7V32M5Me23Rh6of6L7hdPYrkOlxB0=";
         aarch64-linux = "sha256-KaHNmq776FtE4tF8jROV43QIyUNaYz/V1kkgMwwjcBo=";
         aarch64-darwin = "sha256-QVh5HutaB/BfCYRgwXdtMVWtDcYzfL9N9qW2GhcK2aY=";
       }
-      .${stdenv.hostPlatform.system};
+      .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
 in
-(buildGoModule.override { go = go_1_25; }) (finalAttrs: {
+buildGo125Module (finalAttrs: {
   pname = "nexa";
   version = "0.2.73";
 
@@ -88,9 +86,6 @@ in
     ++ lib.optionals enableVulkan [
       vulkan-loader
     ]
-    ++ lib.optionals enableFfmpeg [
-      ffmpeg_4.lib
-    ]
     ++ lib.optionals enableCuda [
       cudaPackages.cuda_cudart
       cudaPackages.libcublas
@@ -106,7 +101,7 @@ in
       "libcublas.so.12"
       "libcublasLt.so.12"
     ]
-    ++ lib.optionals (!enableFfmpeg) [
+    ++ [
       "libavformat.so.58"
       "libavfilter.so.7"
       "libavcodec.so.58"
diff --git a/pkgs/by-name/op/opengamepadui/package.nix b/pkgs/by-name/op/opengamepadui/package.nix
index 9d2adbe40ac6..3c3b4df8e31c 100644
--- a/pkgs/by-name/op/opengamepadui/package.nix
+++ b/pkgs/by-name/op/opengamepadui/package.nix
@@ -22,7 +22,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "opengamepadui";
-  version = "0.44.3";
+  version = "0.45.0";
 
   buildType = if withDebug then "debug" else "release";
 
@@ -30,12 +30,12 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "ShadowBlip";
     repo = "OpenGamepadUI";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pjg5zIgytS7YxNWAJg46aOYhRG88TbK1906UK5fM3pM=";
+    hash = "sha256-B3s9fJzOUNKqvdz1CuJQKJTcQKBUsn8cEV0F6e9Pjr0=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src cargoRoot;
-    hash = "sha256-ZccqPWyyhVMenF8tLXQlwC5uKg5o66E5qkeNGAbSs1w=";
+    hash = "sha256-aykBD6cyhLL3I2oCrxXEFotmULrhOlte9zNON9liQx4=";
   };
   cargoRoot = "extensions";
 
diff --git a/pkgs/by-name/op/openmpi/package.nix b/pkgs/by-name/op/openmpi/package.nix
index 67a0d62ef13b..287fc4667dad 100644
--- a/pkgs/by-name/op/openmpi/package.nix
+++ b/pkgs/by-name/op/openmpi/package.nix
@@ -114,6 +114,8 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.enableFeature cudaSupport "mca-dso")
     (lib.enableFeature fortranSupport "mpi-fortran")
     (lib.withFeatureAs stdenv.hostPlatform.isLinux "libnl" (lib.getDev libnl))
+    # From some reason, without this the darwin build fails with cyclic
+    # references between $dev and $out
     "--with-pmix=${lib.getDev pmix}"
     "--with-pmix-libdir=${lib.getLib pmix}/lib"
     # Puts a "default OMPI_PRTERUN" value to mpirun / mpiexec executables
diff --git a/pkgs/by-name/op/openrw/package.nix b/pkgs/by-name/op/openrw/package.nix
index 70ad5386fb75..8efbb13b15ab 100644
--- a/pkgs/by-name/op/openrw/package.nix
+++ b/pkgs/by-name/op/openrw/package.nix
@@ -34,10 +34,17 @@ stdenv.mkDerivation {
     hash = "sha256-2fQQL0JoV8YukU+VW2iWS4DpBi1j361SfiXRHRmocRg=";
   };
 
-  postPatch = lib.optional (stdenv.cc.isClang && (lib.versionAtLeast stdenv.cc.version "9")) ''
-    substituteInPlace cmake_configure.cmake \
-      --replace-fail 'target_link_libraries(rw_interface INTERFACE "stdc++fs")' ""
-  '';
+  postPatch =
+    lib.optionalString (stdenv.cc.isClang && (lib.versionAtLeast stdenv.cc.version "9")) ''
+      substituteInPlace cmake_configure.cmake \
+        --replace-fail 'target_link_libraries(rw_interface INTERFACE "stdc++fs")' ""
+    ''
+    + ''
+      # boost 1.89 removed the boost_system stub library
+      substituteInPlace CMakeLists.txt --replace-fail \
+        'find_package(Boost COMPONENTS program_options system REQUIRED)' \
+        'find_package(Boost COMPONENTS program_options REQUIRED)'
+    '';
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/by-name/op/openshell/package.nix b/pkgs/by-name/op/openshell/package.nix
new file mode 100644
index 000000000000..5d9c6d2aee2a
--- /dev/null
+++ b/pkgs/by-name/op/openshell/package.nix
@@ -0,0 +1,64 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  rustPlatform,
+  versionCheckHook,
+  cacert,
+  gitMinimal,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "openshell";
+  version = "0.0.22";
+
+  src = fetchFromGitHub {
+    owner = "NVIDIA";
+    repo = "OpenShell";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-98wmBhj1Bqkod9DWh4qhkT3287c56ZKRDf/Z3QCYf4Q=";
+  };
+
+  cargoHash = "sha256-lzS8V8e+wMX8KUfgrftNLdbyivoj0wtRWOThBRS1IdM=";
+
+  nativeCheckInputs = [
+    cacert
+    gitMinimal
+  ];
+
+  postPatch = ''
+    # fill in package version to Cargo
+    substituteInPlace Cargo.toml \
+      --replace-fail 'version = "0.0.0"' 'version = "${finalAttrs.version}"'
+    # only build openshell-cli crate
+    substituteInPlace Cargo.toml \
+      --replace-fail 'members = ["crates/*"]' 'members = ["crates/openshell-cli"]'
+  '';
+
+  env = {
+    # docker image tag baked in at compile time, must match binary version
+    OPENSHELL_IMAGE_TAG = finalAttrs.version;
+  };
+
+  doCheck = !stdenv.hostPlatform.isDarwin;
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  meta = {
+    changelog = "https://github.com/NVIDIA/OpenShell/releases/tag/v${finalAttrs.version}";
+    description = "The safe, private runtime for autonomous AI agents.";
+    homepage = "https://docs.nvidia.com/openshell/index.html";
+    license = lib.licenses.asl20;
+    longDescription = ''
+      NVIDIA OpenShell is an open source runtime to build and deploy autonomous,
+      self-evolving agents more safely. OpenShell sits between your agent and
+      your infrastructure to govern how the agent executes, what the agent can
+      see and do, and where inference goes. It enables claws to run in isolated
+      sandboxes, with fine-grained control over privacy and security.
+    '';
+    maintainers = with lib.maintainers; [ wishstudio ];
+    mainProgram = "openshell";
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/by-name/op/opnborg/package.nix b/pkgs/by-name/op/opnborg/package.nix
index d6235fa0ad52..e5cd567ccd5c 100644
--- a/pkgs/by-name/op/opnborg/package.nix
+++ b/pkgs/by-name/op/opnborg/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "opnborg";
-  version = "0.1.80";
+  version = "0.1.81";
 
   src = fetchFromGitHub {
     owner = "paepckehh";
     repo = "opnborg";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DpGwCcBbm3tfKOlxb7qiPJhRTLo36wMXS0QabqWEfes=";
+    hash = "sha256-lPPOGvWoeMkA5B488saJWFU7yG/RcjJ+e1p1O/ssW00=";
   };
 
-  vendorHash = "sha256-uSdMb4uTF9YV77bAz4sRJT3ApIeYtlxa4ba7X+Lg7pw=";
+  vendorHash = "sha256-B1fZsgb2h3Po4Zy9jUD6OOFAGr+Yw6vNBK+IurjzMSo=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/os/oscar64/package.nix b/pkgs/by-name/os/oscar64/package.nix
index 7e76207bf779..dfa3c434b94a 100644
--- a/pkgs/by-name/os/oscar64/package.nix
+++ b/pkgs/by-name/os/oscar64/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "oscar64";
-  version = "1.32.268";
+  version = "1.32.270";
 
   src = fetchFromGitHub {
     owner = "drmortalwombat";
     repo = "oscar64";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ZpXC8G7PUWCW5m9JnEuq2jt2YeMK/t9XzWqjZAjOqqc=";
+    hash = "sha256-KOXX+utLRhU9Zls28uXdbmBRMJ3AVM1sjyLq+wLrls8=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/os/ossia-score/package.nix b/pkgs/by-name/os/ossia-score/package.nix
index 1df1e32fe333..406f508a7cae 100644
--- a/pkgs/by-name/os/ossia-score/package.nix
+++ b/pkgs/by-name/os/ossia-score/package.nix
@@ -44,13 +44,13 @@
 
 clangStdenv.mkDerivation (finalAttrs: {
   pname = "ossia-score";
-  version = "3.8.1";
+  version = "3.8.2";
 
   src = fetchFromGitHub {
     owner = "ossia";
     repo = "score";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-fwJXXkIOQNeImYP0H73x4GRlwFxzogdGh+OAn/LVS/8=";
+    hash = "sha256-9G7B8soBYoGA3vjSgaCIGT3qbzeDlqTouOsYEkxNqG0=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/ow/owocr/package.nix b/pkgs/by-name/ow/owocr/package.nix
index 782c77fca9eb..999f542a8a82 100644
--- a/pkgs/by-name/ow/owocr/package.nix
+++ b/pkgs/by-name/ow/owocr/package.nix
@@ -5,14 +5,14 @@
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "owocr";
-  version = "1.26.7";
+  version = "1.26.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "AuroraWright";
     repo = "owocr";
     tag = finalAttrs.version;
-    hash = "sha256-OdGYxyJiIfkDxz6RyR9IrdO8ILCNHqb8CjSaUylauZA=";
+    hash = "sha256-bdkhuEH2OJspJ9gBmQQAzCimN1Iuj5D6Cdzr0dO0HEc=";
   };
 
   # we use pystray directly to avoid making a new package
diff --git a/pkgs/by-name/pa/paperless-ngx/package.nix b/pkgs/by-name/pa/paperless-ngx/package.nix
index 1212cd2f8271..b10e93e142a9 100644
--- a/pkgs/by-name/pa/paperless-ngx/package.nix
+++ b/pkgs/by-name/pa/paperless-ngx/package.nix
@@ -179,6 +179,7 @@ python.pkgs.buildPythonApplication rec {
     "gotenberg-client"
     "redis"
     "scikit-learn"
+    "tika-client"
     # requested by maintainer
     "ocrmypdf"
   ];
diff --git a/pkgs/by-name/pa/past-time/package.nix b/pkgs/by-name/pa/past-time/package.nix
index fa8cf108477d..1441882d7f7e 100644
--- a/pkgs/by-name/pa/past-time/package.nix
+++ b/pkgs/by-name/pa/past-time/package.nix
@@ -6,22 +6,20 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "past-time";
-  version = "0.3.1";
+  version = "0.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "fabaff";
     repo = "past-time";
     tag = finalAttrs.version;
-    hash = "sha256-NSuU33vuHbgJ+cG0FrGYLizIrG7jSz+veptt3D4UegY=";
+    hash = "sha256-1t43GAcA3Dd5F2xO0JMmq8f5cbmmcO2I7TIGaVa1ebw=";
   };
 
-  nativeBuildInputs = with python3.pkgs; [
-    poetry-core
-  ];
+  build-system = with python3.pkgs; [ poetry-core ];
 
-  propagatedBuildInputs = with python3.pkgs; [
-    click
+  dependencies = with python3.pkgs; [
+    cyclopts
     tqdm
   ];
 
@@ -30,15 +28,13 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     pytestCheckHook
   ];
 
-  pythonImportsCheck = [
-    "past_time"
-  ];
+  pythonImportsCheck = [ "past_time" ];
 
   meta = {
     description = "Tool to visualize the progress of the year based on the past days";
     homepage = "https://github.com/fabaff/past-time";
     changelog = "https://github.com/fabaff/past-time/releases/tag/${finalAttrs.version}";
-    license = with lib.licenses; [ asl20 ];
+    license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "past-time";
   };
diff --git a/pkgs/by-name/pe/pencil2d/package.nix b/pkgs/by-name/pe/pencil2d/package.nix
index 7e9016a63a63..454ec3999e09 100644
--- a/pkgs/by-name/pe/pencil2d/package.nix
+++ b/pkgs/by-name/pe/pencil2d/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pencil2d";
-  version = "0.7.1";
+  version = "0.7.2";
 
   src = fetchFromGitHub {
     owner = "pencil2d";
     repo = "pencil";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rgoi7WvE2lnGeHA2DzROREDa0iAI4nj9VTRlSmFuh4E=";
+    hash = "sha256-OZlDx+L3kIIp9c2iXvfxLKEJntOA6sji5ugwZXnUqRA=";
     leaveDotGit = true;
     postFetch = ''
       # Obtain the last commit ID and its timestamp, then zap .git for reproducibility
diff --git a/pkgs/by-name/pi/pineapple-pictures/package.nix b/pkgs/by-name/pi/pineapple-pictures/package.nix
index 6ff8994dd0b1..081107098eb5 100644
--- a/pkgs/by-name/pi/pineapple-pictures/package.nix
+++ b/pkgs/by-name/pi/pineapple-pictures/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pineapple-pictures";
-  version = "1.4.0";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     owner = "BLumia";
     repo = "pineapple-pictures";
     rev = finalAttrs.version;
-    hash = "sha256-Eiljopa2DF8KIzekGlwMF+MzJboo7E/BjJ0/KFEyOYc=";
+    hash = "sha256-4vxD4UN5/MwIzmmQZOj7nmDwbIeGTuj+fLPgCEPLzrw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/po/poutine/package.nix b/pkgs/by-name/po/poutine/package.nix
index bee4b7c7eb86..92f49f283b30 100644
--- a/pkgs/by-name/po/poutine/package.nix
+++ b/pkgs/by-name/po/poutine/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "poutine";
-  version = "1.0.8";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "boostsecurityio";
     repo = "poutine";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YctbFSFSbq/LZiS5WDv7a0NYRjDU/He0OMRG6h1gaqE=";
+    hash = "sha256-DyxV8GlNbU/g6GMdOEt++oXFDq7+K4FeWTVJPUAFKk8=";
   };
 
-  vendorHash = "sha256-qp3Ko+01kk9AH0oCT2Si/si+74gT5KFtPFslwih/IBE=";
+  vendorHash = "sha256-Ktsk01YqBHVZDOu+Xp1p3sVDwqozl35iLYbVavpiWq0=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/pr/prometheus-zfs-exporter/package.nix b/pkgs/by-name/pr/prometheus-zfs-exporter/package.nix
index 616f99920d25..3d7672b1b840 100644
--- a/pkgs/by-name/pr/prometheus-zfs-exporter/package.nix
+++ b/pkgs/by-name/pr/prometheus-zfs-exporter/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "zfs_exporter";
-  version = "2.3.11";
+  version = "2.3.12";
 
   src = fetchFromGitHub {
     owner = "pdf";
     repo = pname;
     rev = "v" + version;
-    hash = "sha256-aFieYRF81NUOgfxwR8ifX0sInDH6iM+FXuv0Oe4nzBY=";
+    hash = "sha256-4nuZhPqBqGOR5zM1yyxPD0M4bVZNaIm72uSus6CvCrU=";
   };
 
   vendorHash = "sha256-8AUo6sfdKME5x89CvabMDxBOzq3f/+//du/+N+cvpWA=";
diff --git a/pkgs/by-name/py/pyroscope/package.nix b/pkgs/by-name/py/pyroscope/package.nix
index 181ff06ec0b9..7b7f766e2dd6 100644
--- a/pkgs/by-name/py/pyroscope/package.nix
+++ b/pkgs/by-name/py/pyroscope/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "pyroscope";
-  version = "pyroscope-1.18.1";
+  version = "1.19.1";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "pyroscope";
-    rev = "v1.18.0";
-    hash = "sha256-f+C9kXAbJIAw/6rKdBtdZy9H0dmEQnHM3VEx70i5XnE=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-UPxGimkzXLFACqmAM1hNQIoNjN6OquVibwVmNvP00+s=";
   };
 
-  vendorHash = "sha256-gRuo2xKRC6iiX8wbI1B3rQtk4xJBq3eLM/H49DTtt3U=";
+  vendorHash = "sha256-O8ZKIl5d2gvmtCqJOJJ5SU+qhNRyWj2kH0xHZzfLN5Y=";
   proxyVendor = true;
 
   subPackages = [
diff --git a/pkgs/by-name/ra/railway-wallet/package.nix b/pkgs/by-name/ra/railway-wallet/package.nix
index c1df803e7887..0cf4239785f0 100644
--- a/pkgs/by-name/ra/railway-wallet/package.nix
+++ b/pkgs/by-name/ra/railway-wallet/package.nix
@@ -5,11 +5,11 @@
 }:
 appimageTools.wrapType2 rec {
   pname = "railway-wallet";
-  version = "5.24.16";
+  version = "5.24.18";
 
   src = fetchurl {
     url = "https://github.com/Railway-Wallet/Railway-Wallet/releases/download/v${version}/Railway.linux.x86_64.AppImage";
-    hash = "sha256-D0lrLFLY2v92DXblGMk644He6kKFrJ8HFVFRxYTsdBM=";
+    hash = "sha256-MpM7PtuxjJeUYtdBFRie/KmUqv+za5Acnx9k82PtxaM=";
   };
 
   meta = {
diff --git a/pkgs/by-name/re/refurb/package.nix b/pkgs/by-name/re/refurb/package.nix
index 0ba3c77539dd..d695676dbe8c 100644
--- a/pkgs/by-name/re/refurb/package.nix
+++ b/pkgs/by-name/re/refurb/package.nix
@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "refurb";
-  version = "2.3.0";
+  version = "2.3.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "dosisod";
     repo = "refurb";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gFN3+buXHYPF8lM1HVnNKk2BnVbDLHvMcHMlibifYqE=";
+    hash = "sha256-e1+q3jpJsyGwInFPrgKmXJ68aYr08H18ciYMi9KcxoY=";
   };
 
   nativeBuildInputs = with python3Packages; [
diff --git a/pkgs/by-name/re/remnote/package.nix b/pkgs/by-name/re/remnote/package.nix
index 620cd4ba1b9e..cb437e5ef216 100644
--- a/pkgs/by-name/re/remnote/package.nix
+++ b/pkgs/by-name/re/remnote/package.nix
@@ -6,10 +6,10 @@
 }:
 let
   pname = "remnote";
-  version = "1.24.12";
+  version = "1.25.0";
   src = fetchurl {
     url = "https://download2.remnote.io/remnote-desktop2/RemNote-${version}.AppImage";
-    hash = "sha256-XnF9fUuY73OCf06SLxJeYvabxKA/y0R7o+cxmaXL4aM=";
+    hash = "sha256-epaGP+rTg2as121mmx2KjmivAqDSzDh3eqnTGYmB++w=";
   };
   appimageContents = appimageTools.extractType2 { inherit pname version src; };
 in
diff --git a/pkgs/by-name/ri/rio/package.nix b/pkgs/by-name/ri/rio/package.nix
index d0c44fffec29..d1ffe646e6c0 100644
--- a/pkgs/by-name/ri/rio/package.nix
+++ b/pkgs/by-name/ri/rio/package.nix
@@ -50,16 +50,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rio";
-  version = "0.2.37";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "raphamorim";
     repo = "rio";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5otVXZf8C1yGpfJ8EC5cs8a97KB3+EOI8ulnCI1dspU=";
+    hash = "sha256-RJRWcwqrmlK398lAh8LIkUj595ESKEyNwkC+V2hoKAE=";
   };
 
-  cargoHash = "sha256-MGCH3l37ldBYygRv7IMDV5Coy1kjMi1a7ihjRS63ESA=";
+  cargoHash = "sha256-gqUWK97xPrPpKkRsPA6oaZVJWKiq+l1I8WsHufVSjbo=";
 
   nativeBuildInputs = [
     rustPlatform.bindgenHook
diff --git a/pkgs/by-name/ro/routedns/package.nix b/pkgs/by-name/ro/routedns/package.nix
index 6501c5a1ea83..ec746108ffa5 100644
--- a/pkgs/by-name/ro/routedns/package.nix
+++ b/pkgs/by-name/ro/routedns/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "routedns";
-  version = "0.1.153";
+  version = "0.1.154";
 
   src = fetchFromGitHub {
     owner = "folbricht";
     repo = "routedns";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-EkYhZ4c1eTslubEYXA6mV+bV+s2+jQ3alLy1nXq29/o=";
+    hash = "sha256-qTI9x3Axql6BmM0D1dU1bMspB+N+4MHIeQX6WZAcs/Q=";
   };
 
   vendorHash = "sha256-a4KcKb75yWv7+1vIYCypS9nnrFJ3zogXIPzUVVA7AXs=";
diff --git a/pkgs/by-name/rs/rs-tftpd/package.nix b/pkgs/by-name/rs/rs-tftpd/package.nix
index 81f0fc142a38..bbd967855152 100644
--- a/pkgs/by-name/rs/rs-tftpd/package.nix
+++ b/pkgs/by-name/rs/rs-tftpd/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rs-tftpd";
-  version = "0.5.2";
+  version = "0.5.3";
 
   src = fetchFromGitHub {
     owner = "altugbakan";
     repo = "rs-tftpd";
     tag = finalAttrs.version;
-    hash = "sha256-ozp/PAc5rFexr81Sx0MPaBLIyggttjImdt+Vs7BDnfc=";
+    hash = "sha256-Q4WeRX0rGlsyp5riy16X5WXMWmWRZABEhCPz+HAiPuo=";
   };
 
-  cargoHash = "sha256-mu7o0vqI12bR0z9YaBa36JNgVbLVGZfpQpnsCqhckeU=";
+  cargoHash = "sha256-VloKNrje6nmiHZmyO5IGRGIHRc/VfldgYsG5kpmrvyw=";
 
   buildFeatures = [ "client" ];
 
diff --git a/pkgs/by-name/sa/sandhole/package.nix b/pkgs/by-name/sa/sandhole/package.nix
index b39d574c64b3..0f18d8eab76a 100644
--- a/pkgs/by-name/sa/sandhole/package.nix
+++ b/pkgs/by-name/sa/sandhole/package.nix
@@ -8,16 +8,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "sandhole";
-  version = "0.9.2";
+  version = "0.9.3";
 
   src = fetchFromGitHub {
     owner = "EpicEric";
     repo = "sandhole";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-v0wfdVhAOVCkxI59M7x7MneQrEK+Rfua4PcAcBq71Ho=";
+    hash = "sha256-NyRj00+2RjfcwAPD4h34bWy5g+GnWYkkNQ936mKZzw0=";
   };
 
-  cargoHash = "sha256-WD2f9P42mGN3l111Cr3m75EppAWxsmFFsVSt8dc+RdQ=";
+  cargoHash = "sha256-rNLtRNVL6JLoUUZTev4Mktha8nAgIgTYl+0k44J3hPg=";
 
   # All integration tests require networking.
   postPatch = ''
diff --git a/pkgs/by-name/se/serie/package.nix b/pkgs/by-name/se/serie/package.nix
index 9c94811f00d7..03c133028e14 100644
--- a/pkgs/by-name/se/serie/package.nix
+++ b/pkgs/by-name/se/serie/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "serie";
-  version = "0.7.0";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "lusingander";
     repo = "serie";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-J84xop9QGRa9pgHGF8ioLwmnXu1t5iO9ZLV2MoYRdEI=";
+    hash = "sha256-tNMNbxPuWNXfBdQglq6PekJV93AdhO+zqAA+dyNqdcQ=";
   };
 
-  cargoHash = "sha256-B9Fn4okfS/OwhR34YwyjhPvpK6DLFuVY0BRubj4Y4MA=";
+  cargoHash = "sha256-UWrnhczknl/F5gSA9S4W+Ub5zzB7XuQ358d7XVXRjjQ=";
 
   nativeCheckInputs = [ gitMinimal ];
 
diff --git a/pkgs/by-name/se/serigy/package.nix b/pkgs/by-name/se/serigy/package.nix
index 097533459782..4c0a9e645b35 100644
--- a/pkgs/by-name/se/serigy/package.nix
+++ b/pkgs/by-name/se/serigy/package.nix
@@ -14,14 +14,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "serigy";
-  version = "2.0.0";
+  version = "2.1.1";
   pyproject = false; # uses meson
 
   src = fetchFromGitHub {
     owner = "CleoMenezesJr";
     repo = "Serigy";
     tag = finalAttrs.version;
-    hash = "sha256-0Dc/Y0GYXMNFQ1rWCQaCZzN1Z8lMwdj0wO47pLUV5mM=";
+    hash = "sha256-WOourIlF2Z1YP34d9VCuX7kysJxeMBz2enOaGu73r8o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sf/sfcgal/package.nix b/pkgs/by-name/sf/sfcgal/package.nix
index c9a2fc9c0321..4445a09f1765 100644
--- a/pkgs/by-name/sf/sfcgal/package.nix
+++ b/pkgs/by-name/sf/sfcgal/package.nix
@@ -20,6 +20,13 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-9caucSIEAjzc4cWShuwbBC+BLs5a3e3y58aT4aLzN5E=";
   };
 
+  # boost 1.89 removed the boost_system stub library
+  postPatch = ''
+    substituteInPlace CMakeLists.txt --replace-fail \
+      'set( SFCGAL_Boost_COMPONENTS thread system serialization )' \
+      'set( SFCGAL_Boost_COMPONENTS thread serialization )'
+  '';
+
   buildInputs = [
     cgal
     boost
diff --git a/pkgs/by-name/sh/shrinkray/package.nix b/pkgs/by-name/sh/shrinkray/package.nix
index 6793df62d72f..9d108cab79ec 100644
--- a/pkgs/by-name/sh/shrinkray/package.nix
+++ b/pkgs/by-name/sh/shrinkray/package.nix
@@ -38,6 +38,10 @@ python3.pkgs.buildPythonApplication rec {
       --replace-fail 'which("clang-format")' '"${lib.getExe' clang-tools "clang-format"}"'
     substituteInPlace src/shrinkray/passes/clangdelta.py \
       --replace-fail 'which("clang_delta")' '"${cvise}/libexec/cvise/clang_delta"'
+    substituteInPlace src/shrinkray/subprocess/client.py \
+      --replace-fail 'sys.executable,
+                "-m",
+                "shrinkray.subprocess.worker"' "\"$out/bin/shrinkray-worker\""
   '';
 
   build-system = [ python3.pkgs.setuptools ];
@@ -77,6 +81,8 @@ python3.pkgs.buildPythonApplication rec {
     "tests/test_clang_delta.py::test_find_clang_delta_when_found_in_path"
     "tests/test_clang_delta.py::test_find_clang_delta_when_not_found_anywhere"
     "tests/test_formatting.py::test_default_formatter_python_files_without_black"
+    # This test is too timing sensitive
+    "tests/test_validation.py::test_validation_output_streams_immediately"
   ];
 
   meta = {
diff --git a/pkgs/by-name/sm/smeagol/package.nix b/pkgs/by-name/sm/smeagol/package.nix
index b886431d0caa..e8c93e73ad73 100644
--- a/pkgs/by-name/sm/smeagol/package.nix
+++ b/pkgs/by-name/sm/smeagol/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "smeagol";
-  version = "0.5.0";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = "AustinWise";
     repo = "smeagol";
     tag = finalAttrs.version;
-    hash = "sha256-ILZ4TRL5yRGZuyyNPIpMgnlBGQAwbtTFlTaN3UYb5ls=";
+    hash = "sha256-9TjYiVqz+Lxp0VaeQB3p/wpeRWbMFCJLGnQPMGafSyc=";
   };
 
-  cargoHash = "sha256-5OSrxm+NpuimE8Jwl5/VScKjuYNROX50KNiyBMZqCOw=";
+  cargoHash = "sha256-cd8PotJPNdwpXKpuHbMQ4aJeNewDhyRvctAHimVdLS8=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/by-name/sm/smtprelay/package.nix b/pkgs/by-name/sm/smtprelay/package.nix
index e1e1aef2f319..d0ef7fc9beb9 100644
--- a/pkgs/by-name/sm/smtprelay/package.nix
+++ b/pkgs/by-name/sm/smtprelay/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "smtprelay";
-  version = "1.13.1";
+  version = "1.13.2";
 
   src = fetchFromGitHub {
     owner = "decke";
     repo = "smtprelay";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vuK+05+xCO5Bkfs+21a+oqLFHehj1qUvh16ggZQdnrI=";
+    hash = "sha256-CKE0KYzLBp3nS4gIUqQ1jyu9c4uBi3x9WcLA1zxTemY=";
   };
 
-  vendorHash = "sha256-jriQMYFczhJNbufazWAUFFOrHRnLbo9zzpIrnI0zBkA=";
+  vendorHash = "sha256-kiFPTm46Ws3orwmm/pIz8amcYOq7038exLQ5fU9QqI8=";
 
   subPackages = [
     "."
diff --git a/pkgs/by-name/sp/sptlrx/package.nix b/pkgs/by-name/sp/sptlrx/package.nix
index 83face673d49..bda99f002fb7 100644
--- a/pkgs/by-name/sp/sptlrx/package.nix
+++ b/pkgs/by-name/sp/sptlrx/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "sptlrx";
-  version = "1.2.2";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "raitonoberu";
     repo = "sptlrx";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-b8ALhEjolH0RH+I9HVQeOagPBi2isLNUxqKdj5u2O9s=";
+    hash = "sha256-X1nDvhW8F4UDWIeP0W6EtwB+0Ytf/d76oB/SJV9/neg=";
   };
 
-  vendorHash = "sha256-pExSQcYjqliZZg/91t52yk6UJ4QCbpToMpONIFUNkwc=";
+  vendorHash = "sha256-2QbGrQwFA+YeoVt4se2silLYbg7cQGY/fCTQb2bXWAM=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/sr/srsran/package.nix b/pkgs/by-name/sr/srsran/package.nix
index 96e805a122a2..a49abe56173f 100644
--- a/pkgs/by-name/sr/srsran/package.nix
+++ b/pkgs/by-name/sr/srsran/package.nix
@@ -55,6 +55,17 @@ stdenv.mkDerivation (finalAttrs: {
     zeromq
   ];
 
+  # boost 1.89 removed the boost_system stub library
+  postPatch = ''
+    substituteInPlace cmake/modules/FindUHD.cmake --replace-fail \
+      'set(CMAKE_REQUIRED_LIBRARIES uhd boost_program_options boost_system)' \
+      'set(CMAKE_REQUIRED_LIBRARIES uhd boost_program_options)'
+    substituteInPlace lib/src/phy/rf/CMakeLists.txt --replace-fail \
+      '/usr/lib/x86_64-linux-gnu/libboost_system.so' ""
+    substituteInPlace CMakeLists.txt --replace-fail \
+      'list(APPEND BOOST_REQUIRED_COMPONENTS "system")' ""
+  '';
+
   cmakeFlags = [
     "-DENABLE_WERROR=OFF"
     (lib.cmakeBool "ENABLE_LTE_RATES" enableLteRates)
diff --git a/pkgs/by-name/su/super-productivity/package.nix b/pkgs/by-name/su/super-productivity/package.nix
index 867eb2fc2e5f..6c9841634d46 100644
--- a/pkgs/by-name/su/super-productivity/package.nix
+++ b/pkgs/by-name/su/super-productivity/package.nix
@@ -18,7 +18,7 @@ let
 in
 buildNpmPackage rec {
   pname = "super-productivity";
-  version = "18.1.0";
+  version = "18.1.3";
 
   inherit nodejs;
 
@@ -26,7 +26,7 @@ buildNpmPackage rec {
     owner = "johannesjo";
     repo = "super-productivity";
     tag = "v${version}";
-    hash = "sha256-gIRnc+UqrDBcYxq0BXxS8rrOOVylTwH2WYne7h2A5fk=";
+    hash = "sha256-2NEhLYC13OYZqaLLLLyQHn5uDIDh40DVtUSuUAjCxgQ=";
 
     postFetch = ''
       find $out -name package-lock.json -exec ${lib.getExe npm-lockfile-fix} -r {} \;
@@ -69,7 +69,7 @@ buildNpmPackage rec {
       dontInstall = true;
 
       outputHashMode = "recursive";
-      hash = "sha256-/D6pI8Kbih+bQalyE7Jb42OhYesneKsXPC2ghdMumRQ=";
+      hash = "sha256-AnAiPjxl5MbQchCPPHmtRFEojClseHFul+w5FEEUdwY=";
     }
   );
 
diff --git a/pkgs/by-name/sw/switchres/package.nix b/pkgs/by-name/sw/switchres/package.nix
index fa276b63eab2..464fad23eb10 100644
--- a/pkgs/by-name/sw/switchres/package.nix
+++ b/pkgs/by-name/sw/switchres/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "switchres";
-  version = "2.2.1";
+  version = "2.2.2";
 
   src = fetchFromGitHub {
     owner = "antonioginer";
     repo = "switchres";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/21RcpumWYNBPck7gpH6krwC3Thz/rKDPgeJblN2BDA=";
+    hash = "sha256-s4OTnq46lvYoxB5Q2CkYNcMbsNdy7kg4rbovbVXJUMs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sy/syncyomi/package.nix b/pkgs/by-name/sy/syncyomi/package.nix
index 6f15c2c4eb80..656edd499d13 100644
--- a/pkgs/by-name/sy/syncyomi/package.nix
+++ b/pkgs/by-name/sy/syncyomi/package.nix
@@ -2,22 +2,25 @@
   lib,
   stdenvNoCC,
   fetchFromGitHub,
+  iana-etc,
+  libredirect,
   buildGoModule,
   nodejs,
   pnpm_9,
   fetchPnpmDeps,
   pnpmConfigHook,
   esbuild,
+  nix-update-script,
 }:
 let
   lockedEsbuild = esbuild.overrideAttrs (
     finalAttrs: prevAttrs: {
-      version = "0.19.11";
+      version = "0.21.5";
       src = fetchFromGitHub {
         owner = "evanw";
         repo = "esbuild";
-        rev = "v${finalAttrs.version}";
-        hash = "sha256-NUwjzOpHA0Ijuh0E69KXx8YVS5GTnKmob9HepqugbIU=";
+        tag = "v${finalAttrs.version}";
+        hash = "sha256-FpvXWIlt67G8w3pBKZo/mcp57LunxDmRUaCU/Ne89B8=";
       };
       vendorHash = "sha256-+BfxCyg0KkDQpHt/wycy/8CTG6YBA/VJvJFhhzUnSiQ=";
     }
@@ -25,16 +28,16 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "syncyomi";
-  version = "1.1.4";
+  version = "1.1.7";
 
   src = fetchFromGitHub {
     owner = "SyncYomi";
     repo = "SyncYomi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pU3zxzixKoYnJsGpfvC/SVWIu0adsaiiVcLn0IZe64w=";
+    hash = "sha256-ot8c7+a/YLhjt9HkcI8QZ2ICgtBj3VGJhxtnhWC0f+0=";
   };
 
-  vendorHash = "sha256-fzPEljXFskr1/qzTsnASFNNc+8vA7kqO21mhMqwT44w=";
+  vendorHash = "sha256-7AySGQBQHaTp2M1uj5581ZqcpzgexI1KvanWMOc6rx0=";
 
   web = stdenvNoCC.mkDerivation (webFinalAttrs: {
     pname = "${finalAttrs.pname}-web";
@@ -50,7 +53,7 @@ buildGoModule (finalAttrs: {
         ;
       pnpm = pnpm_9;
       fetcherVersion = 3;
-      hash = "sha256-hRMHvfzfjOzvcCHFhDLxuq2qZ3mi4/333nEcQANbJ/o=";
+      hash = "sha256-paCYfh7tjDuPm8JCpzhCNjL1ZsyQTNxofW8UNIKjqmE=";
     };
 
     nativeBuildInputs = [
@@ -78,6 +81,12 @@ buildGoModule (finalAttrs: {
     cp -r $web/* web/dist
   '';
 
+  nativeCheckInputs = lib.optionals stdenvNoCC.hostPlatform.isDarwin [ libredirect.hook ];
+
+  preCheck = lib.optionalString stdenvNoCC.hostPlatform.isDarwin ''
+    export NIX_REDIRECTS=/etc/protocols=${iana-etc}/etc/protocols:/etc/services=${iana-etc}/etc/services
+  '';
+
   ldflags = [
     "-s"
     "-w"
@@ -88,12 +97,17 @@ buildGoModule (finalAttrs: {
     mv $out/bin/SyncYomi $out/bin/syncyomi
   '';
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Open-source project to synchronize Tachiyomi manga reading progress and library across multiple devices";
     homepage = "https://github.com/SyncYomi/SyncYomi";
     changelog = "https://github.com/SyncYomi/SyncYomi/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.gpl2Only;
-    maintainers = with lib.maintainers; [ eriedaberrie ];
+    maintainers = with lib.maintainers; [
+      eriedaberrie
+      miniharinn
+    ];
     mainProgram = "syncyomi";
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
   };
diff --git a/pkgs/by-name/ta/tagref/package.nix b/pkgs/by-name/ta/tagref/package.nix
index 02b0e8437d2f..d4165f220a2d 100644
--- a/pkgs/by-name/ta/tagref/package.nix
+++ b/pkgs/by-name/ta/tagref/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tagref";
-  version = "1.10.0";
+  version = "1.11.0";
 
   src = fetchFromGitHub {
     owner = "stepchowfun";
     repo = "tagref";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-ANQxW5Qznu2JbiazFElB1sxpX4BwPgk6SVGgYpJ6DUw=";
+    sha256 = "sha256-DjxRK3Ih58vzxvPM0YmRkFU4fogiFsI/WrdHyAonQ7A=";
   };
 
-  cargoHash = "sha256-XQ0/J8o9yqEGWH1Cy5VDkpsK60SS6JhYxMNsI08uI6U=";
+  cargoHash = "sha256-Pj86GQoIAf20F7z18Er7frX0aRacGNDQpeyUdr5kwz4=";
 
   meta = {
     description = "Manage cross-references in your code";
diff --git a/pkgs/by-name/te/telepresence2/package.nix b/pkgs/by-name/te/telepresence2/package.nix
index 94a0c74c007b..1c0664b41f4b 100644
--- a/pkgs/by-name/te/telepresence2/package.nix
+++ b/pkgs/by-name/te/telepresence2/package.nix
@@ -12,7 +12,7 @@
 }:
 
 let
-  fuseftpVersion = "0.6.9";
+  fuseftpVersion = "1.0.1";
   fuseftp = buildGoModule rec {
     pname = "go-fuseftp";
     version = fuseftpVersion;
@@ -20,11 +20,11 @@ let
     src = fetchFromGitHub {
       owner = "datawire";
       repo = "go-fuseftp";
-      rev = "v${version}";
-      hash = "sha256-iJTVcOsaDICQWqIsMTHWg/MDb++ZIfKnnAPrcumcRWk=";
+      tag = "v${version}";
+      hash = "sha256-ojue7mNu5pujM9Nnc/7bL7kWzQSwa8lnnUSWS2rWuHM=";
     };
 
-    vendorHash = "sha256-ZQUlgrC80gwIGTepNXI67Y9SYtarey3Y63eCqZAXXao=";
+    vendorHash = "sha256-C1E/ai82FTjWZmDXEeKN9GxCh+KtzIKPtx5BAWIuQr4=";
 
     buildInputs = [ fuse ];
 
@@ -44,13 +44,13 @@ let
 in
 buildGoModule rec {
   pname = "telepresence2";
-  version = "2.26.0";
+  version = "2.27.3";
 
   src = fetchFromGitHub {
     owner = "telepresenceio";
     repo = "telepresence";
     rev = "v${version}";
-    hash = "sha256-/WFTOFThqnUDCTkTTTj9Y6x5iaucH1H5/10mZGcyvQM=";
+    hash = "sha256-cN3zuS4OEllGP6e0PqntLbE5OaVgmH7ccOfLq+WC6Wk=";
   };
 
   propagatedBuildInputs = [
@@ -72,7 +72,7 @@ buildGoModule rec {
     export CGO_ENABLED=0
   '';
 
-  vendorHash = "sha256-t7gQhMcB2T/hL6m+nH7G2ePiAUPCTtpKScfjB44QQCQ=";
+  vendorHash = "sha256-wOadx4iUgh56FLB6BDSZdAUPV+G7Ld8K+CDGYnUsDG0=";
 
   # ldflags copied from Makefile
   # ref: https://github.com/telepresenceio/telepresence/blob/7a2b9f553fb51ef252df957916c7b831bd65c1ce/build-aux/main.mk#L250-L251
diff --git a/pkgs/by-name/ti/tinyssh/package.nix b/pkgs/by-name/ti/tinyssh/package.nix
index f7715c5f2e5c..359553ff482f 100644
--- a/pkgs/by-name/ti/tinyssh/package.nix
+++ b/pkgs/by-name/ti/tinyssh/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tinyssh";
-  version = "20260301";
+  version = "20260401";
 
   src = fetchFromGitHub {
     owner = "janmojzis";
     repo = "tinyssh";
     tag = finalAttrs.version;
-    hash = "sha256-tg4Qi+0yQ0aObqDb1e/hFyJdvtsnW9pC3CYJ9vzZ8aY=";
+    hash = "sha256-ux3QTYYmgFOOKxgm+5lbLaS3YXv8BOxr3Kp0uYvIdck=";
   };
 
   env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=implicit-function-declaration";
diff --git a/pkgs/by-name/to/toast/package.nix b/pkgs/by-name/to/toast/package.nix
index 78f26f610511..9a636960ce5b 100644
--- a/pkgs/by-name/to/toast/package.nix
+++ b/pkgs/by-name/to/toast/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "toast";
-  version = "0.47.7";
+  version = "0.48.0";
 
   src = fetchFromGitHub {
     owner = "stepchowfun";
     repo = "toast";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-vp70jv4F0VKd/OZHVRDcIJlKLwK9w+cV28lh0C7ESqg=";
+    sha256 = "sha256-bhKIJ1x4WQAPAMEyw12NmmDbnDYbucIz0U3/MdTfmP0=";
   };
 
-  cargoHash = "sha256-3sBb6etSicYvEOIuLARUxo21ulVQ5qVsz65lAtuG+B4=";
+  cargoHash = "sha256-zo+KTtCJkCjG9j/VgUcnTZfRyJLj0C3BvKRREAjyeb8=";
 
   checkFlags = [ "--skip=format::tests::code_str_display" ]; # fails
 
diff --git a/pkgs/by-name/tu/tunnelgraf/package.nix b/pkgs/by-name/tu/tunnelgraf/package.nix
index 254bffb5859d..3f08a1565e1f 100644
--- a/pkgs/by-name/tu/tunnelgraf/package.nix
+++ b/pkgs/by-name/tu/tunnelgraf/package.nix
@@ -22,7 +22,7 @@ let
     };
   };
 in
-py.pkgs.buildPythonApplication rec {
+py.pkgs.buildPythonApplication (finalAttrs: {
   pname = "tunnelgraf";
   version = "1.0.6";
   pyproject = true;
@@ -30,7 +30,7 @@ py.pkgs.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "denniswalker";
     repo = "tunnelgraf";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-6t/rUdz0RyxWxZM0QO1ynRTNQq4GZMIAxMYBB2lfA54=";
   };
 
@@ -40,6 +40,7 @@ py.pkgs.buildPythonApplication rec {
     "psutil"
     "pydantic"
     "python-hosts"
+    "wcwidth"
   ];
 
   build-system = with py.pkgs; [ hatchling ];
@@ -64,9 +65,9 @@ py.pkgs.buildPythonApplication rec {
   meta = {
     description = "Tool to manage SSH tunnel hops to many endpoints";
     homepage = "https://github.com/denniswalker/tunnelgraf";
-    changelog = "https://github.com/denniswalker/tunnelgraf/releases/tag/${src.tag}";
+    changelog = "https://github.com/denniswalker/tunnelgraf/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "tunnelgraf";
   };
-}
+})
diff --git a/pkgs/by-name/ua/uacme/package.nix b/pkgs/by-name/ua/uacme/package.nix
index 1edb6d030bb4..f18e3a91f4a5 100644
--- a/pkgs/by-name/ua/uacme/package.nix
+++ b/pkgs/by-name/ua/uacme/package.nix
@@ -11,13 +11,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "uacme";
-  version = "1.8.0";
+  version = "1.8.1";
 
   src = fetchFromGitHub {
     owner = "ndilieto";
     repo = "uacme";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-d5qOvL4v6SmdZEMk9BMdhfpRjZ1fVbR1V+l6JzNu8co=";
+    hash = "sha256-TiijVeY7MXNaFE+ZYg8G6yYjafTwRA+y6zlwUNnPR48=";
   };
 
   configureFlags = [ "--with-openssl" ];
diff --git a/pkgs/by-name/um/umka-lang/package.nix b/pkgs/by-name/um/umka-lang/package.nix
index e4a1a2960d42..431f3f5dda46 100644
--- a/pkgs/by-name/um/umka-lang/package.nix
+++ b/pkgs/by-name/um/umka-lang/package.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "umka-lang";
-  version = "1.5.5";
+  version = "1.5.6";
 
   src = fetchFromGitHub {
     owner = "vtereshkov";
     repo = "umka-lang";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+jt44mbV2gr7BuciCeT/YkAhJqZtzbuBpYGqfMpQsCQ=";
+    hash = "sha256-wEgybH1L69iOGuwctaeQSigB4+LeTEBtpPWeqR5aT68=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/uu/uutils-coreutils/package.nix b/pkgs/by-name/uu/uutils-coreutils/package.nix
index 4cb084c17172..3a77aad6cd87 100644
--- a/pkgs/by-name/uu/uutils-coreutils/package.nix
+++ b/pkgs/by-name/uu/uutils-coreutils/package.nix
@@ -21,13 +21,13 @@ assert selinuxSupport -> lib.meta.availableOn stdenv.hostPlatform libselinux;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "uutils-coreutils";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "uutils";
     repo = "coreutils";
     tag = finalAttrs.version;
-    hash = "sha256-mS1KjnMUQzRqsmy1GCLDlDh2kOSfPhc59RnR9abqtu4=";
+    hash = "sha256-nH0WtsVP1uwPvimpGnmWx5v0VButIFJu9K5wXsiC4cA=";
   };
 
   # error: linker `aarch64-linux-gnu-gcc` not found
@@ -37,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname src version;
-    hash = "sha256-jNFZEafyW0DGpG0tPiI3lzANBiAXYxoOnTsKoGjeOK0=";
+    hash = "sha256-FMTzMgXcAg9dk7dfYG7lTOHYJxN3YHjf0R96LS7W3FI=";
   };
 
   buildInputs =
@@ -77,14 +77,18 @@ stdenv.mkDerivation (finalAttrs: {
     }"
     "SKIP_UTILS=${lib.optionalString stdenv.hostPlatform.isStatic "stdbuf"}"
   ]
-  ++ lib.optionals (prefix != null) [ "PROG_PREFIX=${prefix}" ]
-  ++ lib.optionals buildMulticallBinary [ "MULTICALL=y" ];
+  ++ lib.optionals (prefix != null) [
+    "PROG_PREFIX=${prefix}"
+  ]
+  ++ lib.optionals buildMulticallBinary [
+    "MULTICALL=y"
+  ];
 
   env = {
     CARGO_BUILD_TARGET = stdenv.hostPlatform.rust.rustcTargetSpec;
   }
   // lib.optionalAttrs selinuxSupport {
-    SELINUX_INCLUDE_DIR = "${libselinux.dev}/include";
+    SELINUX_INCLUDE_DIR = "${lib.getInclude libselinux}/include";
     SELINUX_LIB_DIR = lib.makeLibraryPath [
       libselinux
     ];
diff --git a/pkgs/by-name/ve/verilator/package.nix b/pkgs/by-name/ve/verilator/package.nix
index 8d572f3cce97..cc08aaf1d85c 100644
--- a/pkgs/by-name/ve/verilator/package.nix
+++ b/pkgs/by-name/ve/verilator/package.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "verilator";
-  version = "5.044";
+  version = "5.046";
 
   src = fetchFromGitHub {
     owner = "verilator";
     repo = "verilator";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-z3jYNzhnZ+OocDAbmsRBWHNNPXLLvExKK1TLDi9JzPQ=";
+    hash = "sha256-dfZzbQrw/14dFvWnkmCDElwsGm6GdFstNAURujvEIb8=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/vi/vimdoc-language-server/package.nix b/pkgs/by-name/vi/vimdoc-language-server/package.nix
new file mode 100644
index 000000000000..696dba96ebd7
--- /dev/null
+++ b/pkgs/by-name/vi/vimdoc-language-server/package.nix
@@ -0,0 +1,34 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+  versionCheckHook,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "vimdoc-language-server";
+  version = "0.1.2";
+
+  src = fetchFromGitHub {
+    owner = "barrettruth";
+    repo = "vimdoc-language-server";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-4Uy9RUauRf9IjfykjrLRviKaMNX2fpmSdA/bvkYqgQY=";
+  };
+
+  cargoHash = "sha256-319K2fD8ae+MWgvNhmhgrD6syCDkO2FMgXr8z45CMr4=";
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Language server for vim help files";
+    homepage = "https://github.com/barrettruth/vimdoc-language-server";
+    changelog = "https://github.com/barrettruth/vimdoc-language-server/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ barrettruth ];
+    mainProgram = "vimdoc-language-server";
+  };
+})
diff --git a/pkgs/by-name/wh/whosthere/package.nix b/pkgs/by-name/wh/whosthere/package.nix
index 988693b372f1..821630d4e830 100644
--- a/pkgs/by-name/wh/whosthere/package.nix
+++ b/pkgs/by-name/wh/whosthere/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "whosthere";
-  version = "0.7.0";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "ramonvermeulen";
     repo = "whosthere";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jJYjnpHt9Sk58WCmMU51RWFqwRrwCinMwbKaUajacKw=";
+    hash = "sha256-+cG9iJhIkIQ3yakx/DYGKqd+pX/AaqnCgDdC/3Spvws=";
   };
 
   vendorHash = "sha256-sNx1Ej8vh/Lw4wpitWQdLZ2LM8K6JgM/snSZRw9RN94=";
diff --git a/pkgs/by-name/wi/wipeout-rewrite/package.nix b/pkgs/by-name/wi/wipeout-rewrite/package.nix
index 9d364f7f1737..a06d40a08bc7 100644
--- a/pkgs/by-name/wi/wipeout-rewrite/package.nix
+++ b/pkgs/by-name/wi/wipeout-rewrite/package.nix
@@ -25,13 +25,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "wipeout-rewrite";
-  version = "0-unstable-2026-03-21";
+  version = "0-unstable-2026-03-31";
 
   src = fetchFromGitHub {
     owner = "phoboslab";
     repo = "wipeout-rewrite";
-    rev = "ac9d0aca74fbe62e3f5cdddd91863754c5379a0b";
-    hash = "sha256-35+P37pLIa2rx5Q4bJAdZR4LAYUhewcxZ9xtdj77t0Y=";
+    rev = "836619aaad75a5881ce7552a33093996eb932dcd";
+    hash = "sha256-pGrX/jGYw+er9mbSO/N4Urxte9j1StI/7op7E0ZlMPs=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/wp/wpprobe/package.nix b/pkgs/by-name/wp/wpprobe/package.nix
index 6087db7e8901..5973aea6cdee 100644
--- a/pkgs/by-name/wp/wpprobe/package.nix
+++ b/pkgs/by-name/wp/wpprobe/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "wpprobe";
-  version = "0.11.3";
+  version = "0.11.4";
 
   src = fetchFromGitHub {
     owner = "Chocapikk";
     repo = "wpprobe";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ZPivKTcbJub3uUBvTMnfFflra+RKQQUsvpAdfOjWHnI=";
+    hash = "sha256-uJ/88Uw9w9I4fnIgmRcOG4l5pFd/MhCczO4vyo/ERTc=";
   };
 
   vendorHash = "sha256-pAKFrdja+rH0kiJH6hToZwLjE8lLBHFAUCjnCLbgxVo=";
diff --git a/pkgs/by-name/xo/xonsh/unwrapped.nix b/pkgs/by-name/xo/xonsh/unwrapped.nix
index e9f16502d6e3..60307957c04d 100644
--- a/pkgs/by-name/xo/xonsh/unwrapped.nix
+++ b/pkgs/by-name/xo/xonsh/unwrapped.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
 
@@ -19,6 +20,9 @@
   pytestCheckHook,
   requests,
 
+  man,
+  util-linux,
+
   coreutils,
 
   nix-update-script,
@@ -60,48 +64,54 @@ buildPythonPackage rec {
     pytest-subprocess
     pytestCheckHook
     requests
+  ]
+  ++ lib.optionals (!stdenv.isDarwin) [
+    # required by test_man_completion
+    man
+    util-linux
   ];
 
   disabledTests = [
     # fails on sandbox
-    "test_bsd_man_page_completions"
     "test_colorize_file"
-    "test_loading_correctly"
-    "test_no_command_path_completion"
     "test_xonsh_activator"
 
-    # fails on non-interactive shells
-    "test_bash_and_is_alias_is_only_functional_alias"
-    "test_capture_always"
-    "test_casting"
-    "test_command_pipeline_capture"
-    "test_dirty_working_directory"
-    "test_man_completion"
-    "test_vc_get_branch"
-
-    # flaky tests
-    "test_alias_stability"
-    "test_alias_stability_exception"
-    "test_complete_import"
+    # flaky tests in test_integrations.py
     "test_script"
+    "test_catching_system_exit"
+    "test_catching_exit_signal"
+    "test_alias_stability"
+    "test_captured_subproc_is_not_affected_next_command"
+    "test_spec_decorator_alias"
+    "test_alias_stability_exception"
+
+    # flaky tests in test_python.py
+    "test_complete_import"
+
+    # flaky tests in test_pipelines.py
+    "test_command_pipeline_capture"
+    "test_remove_hide_escape"
+
+    # flaky tests in test_specs.py
+    "test_capture_always"
+    "test_callias_captured_redirect"
+    "test_interrupted_process_returncode"
+    "test_proc_raise_subproc_error"
+    "test_specs_with_suspended_captured_process_pipeline"
     "test_subproc_output_format"
 
-    # broken tests
-    "test_repath_backslash"
-
-    # https://github.com/xonsh/xonsh/issues/5569
-    "test_spec_decorator_alias_output_format"
-    "test_trace_in_script"
-  ];
-
-  disabledTestPaths = [
-    # fails on sandbox
-    "tests/completers/test_command_completers.py"
-    "tests/shell/test_ptk_highlight.py"
-
-    # fails on non-interactive shells
-    "tests/prompt/test_gitstatus.py"
-    "tests/completers/test_bash_completer.py"
+    # flaky tests in test_vc.py
+    "test_vc_get_branch"
+    "test_dirty_working_directory"
+  ]
+  ++ lib.optionals stdenv.isDarwin [
+    # fails on Darwin
+    "test_bash_and_is_alias_is_only_functional_alias"
+    "test_complete_command"
+    "test_man_completion"
+    "test_on_command_not_found_replacement"
+    "test_skipper_command"
+    "test_xonsh_lexer_no_win"
   ];
 
   # https://github.com/NixOS/nixpkgs/issues/248978
diff --git a/pkgs/by-name/ze/zerofs/package.nix b/pkgs/by-name/ze/zerofs/package.nix
index 93d144ae850d..818f6359f4f1 100644
--- a/pkgs/by-name/ze/zerofs/package.nix
+++ b/pkgs/by-name/ze/zerofs/package.nix
@@ -10,18 +10,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zerofs";
-  version = "1.0.6";
+  version = "1.0.8";
 
   src = fetchFromGitHub {
     owner = "Barre";
     repo = "ZeroFS";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-A2Mb4CTjAkPQrckhJghRyIObjNQ1A1AEylIGOhN5sOo=";
+    hash = "sha256-iMLms2UY4Ko2JMgkYEF8SlES4wYSWBiRQtKXUzi9iiQ=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/zerofs";
 
-  cargoHash = "sha256-cinRkFRAV3TOWCXT7Ud7/P/oQDWBYOLb0DL6Ifmh5GA=";
+  cargoHash = "sha256-9rR3Za3pnlh/t/5tBbIbhwSGvPpQ9VA4Z0vG7HNIPu8=";
 
   nativeBuildInputs = [ cmake ];
 
diff --git a/pkgs/development/lua-modules/overrides.nix b/pkgs/development/lua-modules/overrides.nix
index 42b5073f727c..be5a0eed1001 100644
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -238,7 +238,12 @@ in
     checkPhase = ''
       runHook preCheck
       # feel free to disable/adjust the tests
-      rm tests/base/test_apply.lua tests/base/test_vimscript_interpreter.lua
+      rm \
+        tests/base/test_apply.lua \
+        tests/base/test_vimscript_interpreter.lua \
+        # screenshot tests are brittle, as they are meant to be run against very
+        # specific Neovim/ripgrep/ast-grep versions.
+        tests/screenshot/*
 
       # Dependencies needed in special location
       mkdir -p deps/{ripgrep,astgrep}
diff --git a/pkgs/development/python-modules/aiocurrencylayer/default.nix b/pkgs/development/python-modules/aiocurrencylayer/default.nix
index 4ff82362cf5a..43ae079db5bf 100644
--- a/pkgs/development/python-modules/aiocurrencylayer/default.nix
+++ b/pkgs/development/python-modules/aiocurrencylayer/default.nix
@@ -9,16 +9,16 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "aiocurrencylayer";
-  version = "1.0.6";
+  version = "1.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "home-assistant-ecosystem";
     repo = "aiocurrencylayer";
-    tag = version;
-    hash = "sha256-VOzgWN+dDPaGEcahFPSWjBR989b9eNkx4zcnI9o2Xiw=";
+    tag = finalAttrs.version;
+    hash = "sha256-l9M9ejcaXLkIFtD3Qz3dkTR4xDIZuT94OT4yg/6ipYA=";
   };
 
   nativeBuildInputs = [ poetry-core ];
@@ -36,8 +36,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python API for interacting with currencylayer";
     homepage = "https://github.com/home-assistant-ecosystem/aiocurrencylayer";
-    changelog = "https://github.com/home-assistant-ecosystem/aiocurrencylayer/releases/tag/${version}";
+    changelog = "https://github.com/home-assistant-ecosystem/aiocurrencylayer/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/aiogram/default.nix b/pkgs/development/python-modules/aiogram/default.nix
index df6844e81a02..6202c02c770b 100644
--- a/pkgs/development/python-modules/aiogram/default.nix
+++ b/pkgs/development/python-modules/aiogram/default.nix
@@ -28,14 +28,14 @@
 
 buildPythonPackage rec {
   pname = "aiogram";
-  version = "3.26.0";
+  version = "3.27.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aiogram";
     repo = "aiogram";
     tag = "v${version}";
-    hash = "sha256-zhI84vLvL9enC5SGeK5u7OnFDxvlZDNkZ3MyVMFZTSU=";
+    hash = "sha256-asMTUfC2hRL8vSmv+q86kKzVNFrT5Nk9pGkSjrFsMuo=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/azure-mgmt-datafactory/default.nix b/pkgs/development/python-modules/azure-mgmt-datafactory/default.nix
index 3570f5416a8e..329caa7c4065 100644
--- a/pkgs/development/python-modules/azure-mgmt-datafactory/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-datafactory/default.nix
@@ -10,13 +10,13 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-datafactory";
-  version = "9.2.0";
+  version = "9.3.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "azure_mgmt_datafactory";
     inherit version;
-    hash = "sha256-UTLpwkxEGsIl8qYCJZJLqlUHnKge/325mnDWYdZLsNc=";
+    hash = "sha256-9f3VzUFvDtcd/t8F3HZ3uPDlLzQo/VsXsEySAN2NNrM=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/chess-com-api/default.nix b/pkgs/development/python-modules/chess-com-api/default.nix
new file mode 100644
index 000000000000..94be25991aaf
--- /dev/null
+++ b/pkgs/development/python-modules/chess-com-api/default.nix
@@ -0,0 +1,51 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  hatchling,
+  aiohttp,
+  pytestCheckHook,
+  pytest-asyncio,
+  pytest-cov-stub,
+  pytest-mock,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "chess-com-api";
+  version = "1.1.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "Stupidoodle";
+    repo = "chess-com-api";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-/84rDQwD1Qxl1x7AOF6KFTYqYOdqQyzuhgiz5gArMmo=";
+  };
+
+  build-system = [ hatchling ];
+
+  dependencies = [ aiohttp ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-asyncio
+    pytest-cov-stub
+    pytest-mock
+  ];
+
+  disabledTestPaths = [
+    # require network access
+    "tests/test_client.py"
+    "tests/test_integration.py"
+  ];
+
+  pythonImportsCheck = [ "chess_com_api" ];
+
+  meta = {
+    description = "An async Python wrapper for the Chess.com API";
+    homepage = "https://github.com/Stupidoodle/chess-com-api";
+    changelog = "https://github.com/Stupidoodle/chess-com-api/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.jamiemagee ];
+  };
+})
diff --git a/pkgs/development/python-modules/crewai/default.nix b/pkgs/development/python-modules/crewai/default.nix
index 52031bac1414..53030b0495cc 100644
--- a/pkgs/development/python-modules/crewai/default.nix
+++ b/pkgs/development/python-modules/crewai/default.nix
@@ -54,14 +54,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "crewai";
-  version = "1.11.0";
+  version = "1.13.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "crewAIInc";
     repo = "crewAI";
     tag = finalAttrs.version;
-    hash = "sha256-i2UBgni0XRRBijidLVvSDUljnXwgGy52L8bc5WJkV64=";
+    hash = "sha256-IKtfwM9xOMNs993ggT1EejjWKixWEjDMFUuq+RXXvfQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/cwl-upgrader/default.nix b/pkgs/development/python-modules/cwl-upgrader/default.nix
index 6dccb78314b6..bf378e69b529 100644
--- a/pkgs/development/python-modules/cwl-upgrader/default.nix
+++ b/pkgs/development/python-modules/cwl-upgrader/default.nix
@@ -10,16 +10,16 @@
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "cwl-upgrader";
-  version = "1.2.14";
+  version = "1.2.15";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "common-workflow-language";
     repo = "cwl-upgrader";
-    tag = "v${version}";
-    hash = "sha256-bkICax7HIEo8ypttXgDmCl82JfVkV2T11fLRK1/0hz8=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-7gmwz3a3IYky/Eof4fnSp3P5oSAko91drcX7i9CwZUY=";
   };
 
   postPatch = ''
@@ -46,9 +46,9 @@ buildPythonPackage rec {
   meta = {
     description = "Library to upgrade CWL syntax to a newer version";
     homepage = "https://github.com/common-workflow-language/cwl-upgrader";
-    changelog = "https://github.com/common-workflow-language/cwl-upgrader/releases/tag/${src.tag}";
+    changelog = "https://github.com/common-workflow-language/cwl-upgrader/releases/tag/v${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "cwl-upgrader";
   };
-}
+})
diff --git a/pkgs/development/python-modules/cwl-utils/default.nix b/pkgs/development/python-modules/cwl-utils/default.nix
index 66334e24b503..e91507d1815b 100644
--- a/pkgs/development/python-modules/cwl-utils/default.nix
+++ b/pkgs/development/python-modules/cwl-utils/default.nix
@@ -4,6 +4,7 @@
   cwl-upgrader,
   cwlformat,
   fetchFromGitHub,
+  hatchling,
   jsonschema,
   packaging,
   pytest-mock,
@@ -13,22 +14,21 @@
   requests,
   ruamel-yaml,
   schema-salad,
-  setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "cwl-utils";
-  version = "0.40";
+  version = "0.41";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "common-workflow-language";
     repo = "cwl-utils";
-    tag = "v${version}";
-    hash = "sha256-A9+JvtSTPfXK/FGJ8pplT06kkuatZu1fgjjmg74oTvE=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-78Kx+LCEcPE7qsV6MFtfSY6tVj5KZhifFOib7beCU2c=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [ hatchling ];
 
   dependencies = [
     cwl-upgrader
@@ -62,20 +62,11 @@ buildPythonPackage rec {
     "test_cwl_inputs_to_jsonschema"
   ];
 
-  disabledTestPaths = [
-    # Tests require podman
-    "tests/test_docker_extract.py"
-    # Tests requires singularity
-    "tests/test_js_sandbox.py"
-    # Circular dependencies
-    "tests/test_graph_split.py"
-  ];
-
   meta = {
     description = "Utilities for CWL";
     homepage = "https://github.com/common-workflow-language/cwl-utils";
-    changelog = "https://github.com/common-workflow-language/cwl-utils/releases/tag/v${version}";
+    changelog = "https://github.com/common-workflow-language/cwl-utils/releases/tag/v${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/cyvest/default.nix b/pkgs/development/python-modules/cyvest/default.nix
index 16dec35d6a08..fd739f0700cc 100644
--- a/pkgs/development/python-modules/cyvest/default.nix
+++ b/pkgs/development/python-modules/cyvest/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "cyvest";
-  version = "5.3.3";
+  version = "5.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "PakitoSec";
     repo = "cyvest";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4vNfv5dIoeRhnTXNFgqvtxBaCONceXnJhF9RsLD1CIA=";
+    hash = "sha256-ap4QsUw+WX6bFF4ggbt9h2U7qXUgYRi8XNB1k17vJsM=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/datamodel-code-generator/default.nix b/pkgs/development/python-modules/datamodel-code-generator/default.nix
index 1db26a8fd023..03a7611f9453 100644
--- a/pkgs/development/python-modules/datamodel-code-generator/default.nix
+++ b/pkgs/development/python-modules/datamodel-code-generator/default.nix
@@ -28,14 +28,14 @@
 
 buildPythonPackage rec {
   pname = "datamodel-code-generator";
-  version = "0.53.0";
+  version = "0.55.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "koxudaxi";
     repo = "datamodel-code-generator";
     tag = version;
-    hash = "sha256-9UXlqVikxaO3IaGwcaJYV3HY2YqlgY0zVfb0EI1bFvY=";
+    hash = "sha256-zsLJv7gKhmnEIS/AUvnBzm+07QFQoMdiFo/PkfRyHek=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/dbt-protos/default.nix b/pkgs/development/python-modules/dbt-protos/default.nix
index 0de364210386..b9b37721e264 100644
--- a/pkgs/development/python-modules/dbt-protos/default.nix
+++ b/pkgs/development/python-modules/dbt-protos/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "dbt-protos";
-  version = "1.0.434";
+  version = "1.0.455";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "dbt-labs";
     repo = "proto-python-public";
     tag = "v${version}";
-    hash = "sha256-sKPPiGL836YB2hIbcmqEC7LXAqYzvXO2a+1dFDVIm0w=";
+    hash = "sha256-o0H5sGXVxiZgc9Vdwgd5IUlzqHRqSuYbkwI/R9M8uY8=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/django-allauth/default.nix b/pkgs/development/python-modules/django-allauth/default.nix
index 89cd09f6543a..72fbe2e260df 100644
--- a/pkgs/development/python-modules/django-allauth/default.nix
+++ b/pkgs/development/python-modules/django-allauth/default.nix
@@ -41,14 +41,14 @@
 
 buildPythonPackage rec {
   pname = "django-allauth";
-  version = "65.14.3";
+  version = "65.15.0";
   pyproject = true;
 
   src = fetchFromCodeberg {
     owner = "allauth";
     repo = "django-allauth";
     tag = version;
-    hash = "sha256-Kr6iYN+qM1ZdtQAJ9Ks+zC70AiiUi2IY2O/G9S+tTmI=";
+    hash = "sha256-SInfSvo1/EyvOf28hYxO0WcBC+c5hfjjSStCaTcV+io=";
   };
 
   nativeBuildInputs = [ gettext ];
diff --git a/pkgs/development/python-modules/docx2python/default.nix b/pkgs/development/python-modules/docx2python/default.nix
index 08dbbdc24756..948b363ae038 100644
--- a/pkgs/development/python-modules/docx2python/default.nix
+++ b/pkgs/development/python-modules/docx2python/default.nix
@@ -7,19 +7,20 @@
   setuptools,
   setuptools-scm,
   pytestCheckHook,
+  types-lxml,
   typing-extensions,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "docx2python";
-  version = "4.0.0";
+  version = "3.6.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ShayHill";
     repo = "docx2python";
-    tag = version;
-    hash = "sha256-seOm5u5PDqDaPytQ8kfVr0CJV/Uv4NtWhmANWcSLp/M=";
+    tag = finalAttrs.version;
+    hash = "sha256-1/v8slL7EYwXM8ybcJKIdjLBKNBxHgdF4gQHDYyJg6w=";
   };
 
   build-system = [
@@ -30,6 +31,7 @@ buildPythonPackage rec {
   dependencies = [
     lxml
     paragraphs
+    types-lxml
     typing-extensions
   ];
 
@@ -40,8 +42,8 @@ buildPythonPackage rec {
   meta = {
     description = "Extract docx headers, footers, (formatted) text, footnotes, endnotes, properties, and images";
     homepage = "https://github.com/ShayHill/docx2python";
-    changelog = "https://github.com/ShayHill/docx2python/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/ShayHill/docx2python/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/edk2-pytool-library/default.nix b/pkgs/development/python-modules/edk2-pytool-library/default.nix
index c1bfb86ef178..b433505cda2a 100644
--- a/pkgs/development/python-modules/edk2-pytool-library/default.nix
+++ b/pkgs/development/python-modules/edk2-pytool-library/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "edk2-pytool-library";
-  version = "0.23.11";
+  version = "0.23.12";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tianocore";
     repo = "edk2-pytool-library";
     tag = "v${version}";
-    hash = "sha256-bKyNB2vWhOV6X0BUtoLVaYxAl91UpiRSRPcRywuhkQY=";
+    hash = "sha256-31gDJKiNJ6CGIJYItMj8VzQkHQdmWFiDrpiC1ntIrVE=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/executorch/default.nix b/pkgs/development/python-modules/executorch/default.nix
index bc2daeadad6b..c8e393dc4166 100644
--- a/pkgs/development/python-modules/executorch/default.nix
+++ b/pkgs/development/python-modules/executorch/default.nix
@@ -49,7 +49,7 @@
 }:
 buildPythonPackage (finalAttrs: {
   pname = "executorch";
-  version = "1.0.1";
+  version = "1.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -62,7 +62,7 @@ buildPythonPackage (finalAttrs: {
     name = "executorch";
 
     fetchSubmodules = true;
-    hash = "sha256-h+nmipFDO/cdPTQXrjM5EkH//wHKBAvlDIp6SBbGN/8=";
+    hash = "sha256-Rkw6+keOygQaf6iOCpGoW9JgXiCimgx8gsxLEH3bxME=";
   };
 
   postPatch =
@@ -77,7 +77,7 @@ buildPythonPackage (finalAttrs: {
     + ''
       substituteInPlace pyproject.toml \
         --replace-fail '"pip>=23",' "" \
-        --replace-fail "cmake>=3.29,<4.0.0" "cmake"
+        --replace-fail "cmake>=3.24,<4.0.0" "cmake"
     ''
     # CMake 4 dropped support of versions lower than 3.5, versions lower than 3.10 are deprecated.
     # https://github.com/NixOS/nixpkgs/issues/445447
@@ -95,10 +95,19 @@ buildPythonPackage (finalAttrs: {
           'static char hexdigits[17] = "0123456789ABCDEF";'
 
       sed -i "1i #include <cstdint>" backends/apple/coreml/runtime/inmemoryfs/memory_buffer.hpp
+      sed -i "1i #include <cstdint>" extension/llm/tokenizers/third-party/sentencepiece/src/sentencepiece_processor.h
     '';
 
   env = {
     BUILD_VERSION = finalAttrs.version;
+
+    # Can't use cmakeFlags since we do not control invocation of cmake.
+    # But the build script is sensitive to this env variable.
+    # Fixes:
+    #  Some binaries contain forbidden references to /build/. Check the error above!
+    CMAKE_ARGS = lib.concatStringsSep " " [
+      (lib.cmakeBool "CMAKE_SKIP_BUILD_RPATH" true)
+    ];
   };
 
   build-system = [
@@ -186,6 +195,7 @@ buildPythonPackage (finalAttrs: {
     # AssertionError (Numerical comparison fails)
     "test_sdpa_with_cache_seq_len_13"
     "test_sdpa_with_custom_quantized_seq_len_130_gqa"
+    "test_within_transformer"
 
     # Try to download models from the internet
     "test_all_models_with_recipes"
@@ -199,6 +209,9 @@ buildPythonPackage (finalAttrs: {
     "test_resnet18_export_to_executorch"
     "test_resnet50_export_to_executorch"
     "test_vit_export_to_executorch"
+
+    # RuntimeError: Failed to compile /build/tmplb6i266d/data.json to /build/tmplb6i266d/data.pte
+    "test_flatbuffer_paths_match"
   ]
   ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isx86_64) [
     # RuntimeError: Error in dlopen:
diff --git a/pkgs/development/python-modules/fastparquet/default.nix b/pkgs/development/python-modules/fastparquet/default.nix
index 45932a9181b2..9972e87a5c65 100644
--- a/pkgs/development/python-modules/fastparquet/default.nix
+++ b/pkgs/development/python-modules/fastparquet/default.nix
@@ -28,14 +28,14 @@
 
 buildPythonPackage rec {
   pname = "fastparquet";
-  version = "2025.12.0";
+  version = "2026.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "dask";
     repo = "fastparquet";
     tag = version;
-    hash = "sha256-cebu3E2sbVWRUYbSeuslCZhaF+zWV7E56iSwB7Ms3ts=";
+    hash = "sha256-lf3GBfusZ1dhQ6wdHmfegqSlwG4Gm5Bi4+nof9yCg/o=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/fastremap/default.nix b/pkgs/development/python-modules/fastremap/default.nix
index be5c58e18792..04aeb227fa5e 100644
--- a/pkgs/development/python-modules/fastremap/default.nix
+++ b/pkgs/development/python-modules/fastremap/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "fastremap";
-  version = "1.17.7";
+  version = "1.18.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "seung-lab";
     repo = "fastremap";
     tag = version;
-    hash = "sha256-k3MneLLpClx0hkOqm+botD/LozyoUJW89qf0VJ3P05M=";
+    hash = "sha256-nVnOdxDSVM7Qe/peALgV035OknOUm0B1dzpTIq3HEMs=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/flask-compress/default.nix b/pkgs/development/python-modules/flask-compress/default.nix
index d59f01611bb0..ab775cdd5dbc 100644
--- a/pkgs/development/python-modules/flask-compress/default.nix
+++ b/pkgs/development/python-modules/flask-compress/default.nix
@@ -15,7 +15,7 @@
 }:
 
 buildPythonPackage rec {
-  version = "1.23";
+  version = "1.24";
   pname = "flask-compress";
   pyproject = true;
 
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "colour-science";
     repo = "flask-compress";
     tag = "v${version}";
-    hash = "sha256-iKZfwSFvNrG/ApbqBuDgoUHz296nr+ZMrAX97pMgNTQ=";
+    hash = "sha256-JbPBu8FWp/HnYbA2vTKiy2gopS5U0JNDV7ucTAYrLVY=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/fluss-api/default.nix b/pkgs/development/python-modules/fluss-api/default.nix
index 4187db636445..44e2c522a44f 100644
--- a/pkgs/development/python-modules/fluss-api/default.nix
+++ b/pkgs/development/python-modules/fluss-api/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "fluss-api";
-  version = "0.1.9.20";
+  version = "0.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "fluss";
     repo = "Fluss_Python_Library";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-g5LZWlz8QZWUb6UFyY1wQIHqC2lCTpCsaWgrkPCoDOw=";
+    hash = "sha256-LD+boeDNWOm3KXZFIkLPvzIyngmFd6lOtIFsrn478wA=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/glances-api/default.nix b/pkgs/development/python-modules/glances-api/default.nix
index f63a3b036fe3..3e386596155d 100644
--- a/pkgs/development/python-modules/glances-api/default.nix
+++ b/pkgs/development/python-modules/glances-api/default.nix
@@ -9,16 +9,16 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "glances-api";
-  version = "0.9.0";
+  version = "0.9.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "home-assistant-ecosystem";
     repo = "python-glances-api";
-    tag = version;
-    hash = "sha256-VLsNMFFt+kMxNw/81OMX4Fg/xCbQloCURmV0OxvClq8=";
+    tag = finalAttrs.version;
+    hash = "sha256-Hi9MvqxrqYB9MbTtm8XWJ1U4KpO9aB2lAIdZbrvNEdY=";
   };
 
   build-system = [ poetry-core ];
@@ -36,8 +36,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python API for interacting with Glances";
     homepage = "https://github.com/home-assistant-ecosystem/python-glances-api";
-    changelog = "https://github.com/home-assistant-ecosystem/python-glances-api/releases/tag/${version}";
+    changelog = "https://github.com/home-assistant-ecosystem/python-glances-api/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/google-cloud-netapp/default.nix b/pkgs/development/python-modules/google-cloud-netapp/default.nix
index 2c642a01f9df..8f35f586eab6 100644
--- a/pkgs/development/python-modules/google-cloud-netapp/default.nix
+++ b/pkgs/development/python-modules/google-cloud-netapp/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "google-cloud-netapp";
-  version = "0.8.0";
+  version = "0.9.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "google-cloud-python";
     tag = "google-cloud-netapp-v${finalAttrs.version}";
-    hash = "sha256-uUBId7RxVfOPtemZYUqJXd4hw2/CU2cogZL39MrKehk=";
+    hash = "sha256-17v13PN6BxY99wPCMxEupLgPxit0ssE4fwGINL0bUME=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/packages/google-cloud-netapp";
diff --git a/pkgs/development/python-modules/gotenberg-client/default.nix b/pkgs/development/python-modules/gotenberg-client/default.nix
index 1570fd1e254a..36cc2a81e674 100644
--- a/pkgs/development/python-modules/gotenberg-client/default.nix
+++ b/pkgs/development/python-modules/gotenberg-client/default.nix
@@ -7,14 +7,14 @@
 }:
 buildPythonPackage rec {
   pname = "gotenberg-client";
-  version = "0.13.1";
+  version = "0.14.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "stumpylog";
     repo = "gotenberg-client";
     tag = version;
-    hash = "sha256-JYb0+Dj4QowcN+I6MMoWlv+Q5YoK4nfzYB/UNwhnRu8=";
+    hash = "sha256-BS/QGapok9iaFNfI3G55F0H4CKHPHS85Qs4G6nt043s=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/helion/default.nix b/pkgs/development/python-modules/helion/default.nix
index 2e26a9c30b78..9da96d721d41 100644
--- a/pkgs/development/python-modules/helion/default.nix
+++ b/pkgs/development/python-modules/helion/default.nix
@@ -10,13 +10,12 @@
 
   # dependencies
   filecheck,
+  numpy,
   psutil,
   rich,
   scikit-learn,
-  torch,
-  tqdm,
-  triton,
   typing-extensions,
+  torch,
 
   # tests
   pytestCheckHook,
@@ -26,14 +25,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "helion";
-  version = "0.3.2";
+  version = "1.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pytorch";
     repo = "helion";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-MR8fo6MhMSAXlBsx//ODIprXPXFhMy6K5Mno9BnZGHc=";
+    hash = "sha256-3Iam+1FUg9I9kKmkQBZp9/FTZpEjf4Ba+cKRo5eLEzw=";
   };
 
   build-system = [
@@ -43,13 +42,15 @@ buildPythonPackage (finalAttrs: {
 
   dependencies = [
     filecheck
+    numpy
     psutil
     rich
     scikit-learn
-    torch
-    tqdm
-    triton
     typing-extensions
+
+    # torch is not listed as a dependency, but is actually required at import time
+    # https://github.com/pytorch/helion/blob/v1.0.0/helion/_compat.py#L13
+    torch
   ];
 
   pythonImportsCheck = [ "helion" ];
@@ -67,11 +68,9 @@ buildPythonPackage (finalAttrs: {
 
   # Tests require GPU access
   doCheck = false;
-  passthru.gpuChecks = {
-    pytest = helion.overridePythonAttrs {
-      doCheck = true;
-      requiredSystemFeatures = [ "cuda" ];
-    };
+  passthru.gpuCheck = helion.overridePythonAttrs {
+    doCheck = true;
+    requiredSystemFeatures = [ "cuda" ];
   };
 
   meta = {
diff --git a/pkgs/development/python-modules/hiredis/default.nix b/pkgs/development/python-modules/hiredis/default.nix
index b1a2735d55b6..9f202d21f02c 100644
--- a/pkgs/development/python-modules/hiredis/default.nix
+++ b/pkgs/development/python-modules/hiredis/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "hiredis";
-  version = "3.3.0";
+  version = "3.3.1";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     repo = "hiredis-py";
     tag = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-9KIbXmEk4K2xdGM7SUV64mcSEPGQdDez9mAb/920gZs=";
+    hash = "sha256-HqQICYjHpUX7/OsaWXJRFeeZDxKKuGJ1x5JiJ9eLmdw=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/holidays/default.nix b/pkgs/development/python-modules/holidays/default.nix
index 9a62135a5f16..5588552b1cb1 100644
--- a/pkgs/development/python-modules/holidays/default.nix
+++ b/pkgs/development/python-modules/holidays/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "holidays";
-  version = "0.93";
+  version = "0.94";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "vacanza";
     repo = "python-holidays";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6WgwDkgd6Wn67gNcOw/H2fg55OHcOP7h+76HrML6p80=";
+    hash = "sha256-PJV1hIrj8Lblmzzqob3pmNpfkvl/9kwvc4od5rxZbk0=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/homekit-audio-proxy/default.nix b/pkgs/development/python-modules/homekit-audio-proxy/default.nix
new file mode 100644
index 000000000000..412e2005d446
--- /dev/null
+++ b/pkgs/development/python-modules/homekit-audio-proxy/default.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  cryptography,
+  pytest-asyncio,
+  pytest-cov-stub,
+  pytest-timeout,
+  pytestCheckHook,
+  sybil,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "homekit-audio-proxy";
+  version = "1.2.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "bdraco";
+    repo = "homekit-audio-proxy";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-9vC6atYdHvJ/Pkq8n4Amh557GRWLvPofhgnfQJPSBx0=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ cryptography ];
+
+  nativeCheckInputs = [
+    pytest-asyncio
+    pytest-cov-stub
+    pytest-timeout
+    pytestCheckHook
+    sybil
+  ];
+
+  pythonImportsCheck = [ "homekit_audio_proxy" ];
+
+  meta = {
+    description = "SRTP audio proxy for HomeKit camera streaming";
+    homepage = "https://github.com/bdraco/homekit-audio-proxy";
+    changelog = "https://github.com/bdraco/homekit-audio-proxy/blob/main/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.jamiemagee ];
+  };
+})
diff --git a/pkgs/development/python-modules/indexed-zstd/default.nix b/pkgs/development/python-modules/indexed-zstd/default.nix
index 59bbfba05a73..896237f98d75 100644
--- a/pkgs/development/python-modules/indexed-zstd/default.nix
+++ b/pkgs/development/python-modules/indexed-zstd/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "indexed_zstd";
-  version = "1.6.1";
+  version = "1.7.1";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-i3Q3j5Rh/OqxdSFbZeHEiYZN2zS9gWBYk2pifwzKOos=";
+    hash = "sha256-DspqT15rkF6qGs09l7Gt40B4qClIOkODn1zy7+lxUPQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/ipyparallel/default.nix b/pkgs/development/python-modules/ipyparallel/default.nix
index 23c79b1faa3b..37c7fe71ed9d 100644
--- a/pkgs/development/python-modules/ipyparallel/default.nix
+++ b/pkgs/development/python-modules/ipyparallel/default.nix
@@ -17,12 +17,12 @@
 
 buildPythonPackage rec {
   pname = "ipyparallel";
-  version = "9.0.2";
+  version = "9.1.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-2ZLt1pipnUXy2QWa8cmujwhtGu7bPoBDYCmi8o0Gn4M=";
+    hash = "sha256-7MgaG/0mgetXHjYYOdXe/L7sWDrj7gUDvIOwZhBriM0=";
   };
 
   # We do not need the jupyterlab build dependency, because we do not need to
diff --git a/pkgs/development/python-modules/jug/default.nix b/pkgs/development/python-modules/jug/default.nix
index 63359f40c83f..88fd98e418a0 100644
--- a/pkgs/development/python-modules/jug/default.nix
+++ b/pkgs/development/python-modules/jug/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "jug";
-  version = "2.4.0";
+  version = "2.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "luispedro";
     repo = "jug";
     tag = "v${version}";
-    hash = "sha256-zERCY9JxceBmhJbytfsm/6rDwipqQ1XjzY/2QFsEEEg=";
+    hash = "sha256-YjBhA+yEdMQ/4yYf25kkXwbvw+ta9Nb4CX8Rnr0du6k=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/langgraph/default.nix b/pkgs/development/python-modules/langgraph/default.nix
index c362b90cdf0f..42ca6a2feedb 100644
--- a/pkgs/development/python-modules/langgraph/default.nix
+++ b/pkgs/development/python-modules/langgraph/default.nix
@@ -41,14 +41,14 @@
 }:
 buildPythonPackage (finalAttrs: {
   pname = "langgraph";
-  version = "1.1.3";
+  version = "1.1.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langgraph";
     tag = finalAttrs.version;
-    hash = "sha256-J8QqbzJe5tW11Nuio2uFAJk2EZIL1LNGIbJn7TZvlaA=";
+    hash = "sha256-7wFomrg5w4KTEprx9b93zQaeAbD5s1TPo97WZ/2R0S4=";
   };
 
   postgresqlTestSetupPost = ''
diff --git a/pkgs/development/python-modules/language-tool-python/default.nix b/pkgs/development/python-modules/language-tool-python/default.nix
index bd15b69a9844..aff9aeb684a2 100644
--- a/pkgs/development/python-modules/language-tool-python/default.nix
+++ b/pkgs/development/python-modules/language-tool-python/default.nix
@@ -11,7 +11,7 @@
 }:
 buildPythonPackage rec {
   pname = "language-tool-python";
-  version = "3.2.2";
+  version = "3.3.0";
 
   pyproject = true;
 
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "jxmorris12";
     repo = "language_tool_python";
     tag = version;
-    hash = "sha256-GhFAX0x17EveJPUT8b98zAB4w9+wkVAO8EQHdtWoIv8=";
+    hash = "sha256-7Hzz7VqQvtz7EisGhmb4GXWynAEQ1CmfPZAiqLNmCPs=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/llama-cloud/default.nix b/pkgs/development/python-modules/llama-cloud/default.nix
index 36d6f9150c96..8fbf6235953d 100644
--- a/pkgs/development/python-modules/llama-cloud/default.nix
+++ b/pkgs/development/python-modules/llama-cloud/default.nix
@@ -25,13 +25,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "llama-cloud";
-  version = "1.6.0";
+  version = "2.2.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "llama_cloud";
     inherit (finalAttrs) version;
-    hash = "sha256-sAx133a1m+zKcvJix1WllSnwwJ8M2nnghu7e/GLVmsg=";
+    hash = "sha256-Z9f4q6S75SLLr7jigE3jheQWOJ9eL6mN3Tce17c4lEk=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/llama-index-readers-file/default.nix b/pkgs/development/python-modules/llama-index-readers-file/default.nix
index 9738fd1c4fac..f6c6ca85a6ca 100644
--- a/pkgs/development/python-modules/llama-index-readers-file/default.nix
+++ b/pkgs/development/python-modules/llama-index-readers-file/default.nix
@@ -13,13 +13,13 @@
 
 buildPythonPackage rec {
   pname = "llama-index-readers-file";
-  version = "0.5.6";
+  version = "0.6.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "llama_index_readers_file";
     inherit version;
-    hash = "sha256-HAixT6zC3+kzYiqqJtx9KnpgI8QtPbiWoslIeJ7a8eo=";
+    hash = "sha256-/zZtb/XstxGSdayFkxDYtnLYtrMmGvrgL0CE/OkHa9A=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/llama-index-readers-s3/default.nix b/pkgs/development/python-modules/llama-index-readers-s3/default.nix
index 31be800e447f..0bb70b56c861 100644
--- a/pkgs/development/python-modules/llama-index-readers-s3/default.nix
+++ b/pkgs/development/python-modules/llama-index-readers-s3/default.nix
@@ -3,6 +3,7 @@
   buildPythonPackage,
   fetchPypi,
   llama-index-core,
+  llama-index-embeddings-openai,
   llama-index-readers-file,
   hatchling,
   s3fs,
@@ -10,19 +11,20 @@
 
 buildPythonPackage rec {
   pname = "llama-index-readers-s3";
-  version = "0.5.1";
+  version = "0.6.1";
   pyproject = true;
 
   src = fetchPypi {
     pname = "llama_index_readers_s3";
     inherit version;
-    hash = "sha256-Ye+B4lcwdeaAisaIZH98X2n7FA7n9/gkVVNRN1uihys=";
+    hash = "sha256-cK5XmH4F0TZt6IMJvAnmEs7UWkekrrbEAIvd/CE33xw=";
   };
 
   build-system = [ hatchling ];
 
   dependencies = [
     llama-index-core
+    llama-index-embeddings-openai
     llama-index-readers-file
     s3fs
   ];
diff --git a/pkgs/development/python-modules/llama-index-readers-twitter/default.nix b/pkgs/development/python-modules/llama-index-readers-twitter/default.nix
index 36c83e596f49..e60b16d08b61 100644
--- a/pkgs/development/python-modules/llama-index-readers-twitter/default.nix
+++ b/pkgs/development/python-modules/llama-index-readers-twitter/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "llama-index-readers-twitter";
-  version = "0.4.1";
+  version = "0.5.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "llama_index_readers_twitter";
     inherit version;
-    hash = "sha256-e4zYwopM7b1WiNINHU3DhnY1DPo7nMcIM/BymS1j0qQ=";
+    hash = "sha256-ws26RKK4xVT2388oFmRgtMq6VXwCc5kLOr7toEZFEyQ=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/logboth/default.nix b/pkgs/development/python-modules/logboth/default.nix
index 3bb9a7552a16..dcb60fb8f4be 100644
--- a/pkgs/development/python-modules/logboth/default.nix
+++ b/pkgs/development/python-modules/logboth/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "logboth";
-  version = "0.2.0";
+  version = "0.3.0";
   pyproject = true;
 
   src = fetchFromGitLab {
     owner = "zehkira";
     repo = "logboth";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-R4FrZK8yxCZ5BFBFp/Fj/WyWa6+rIM6GHl3HZGgp5TI=";
+    hash = "sha256-sPt0Xdh2i71riP3L2knXvL25Q08vtnhfzGnDrKqdXtQ=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/logurich/default.nix b/pkgs/development/python-modules/logurich/default.nix
index d5797f8bd0ae..0e65d7f47acc 100644
--- a/pkgs/development/python-modules/logurich/default.nix
+++ b/pkgs/development/python-modules/logurich/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "logurich";
-  version = "0.7.1";
+  version = "0.9.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "PakitoSec";
     repo = "logurich";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+Ez1tS/kDguq8mQImiu2/h64YsBCTVv4b4sT/tJaD7E=";
+    hash = "sha256-rQuASijZnIPM5+00U7n4+rTBiUILCcCH+UW56NCTr2k=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/mediafile/default.nix b/pkgs/development/python-modules/mediafile/default.nix
index ceef20eb37f0..480141933fc0 100644
--- a/pkgs/development/python-modules/mediafile/default.nix
+++ b/pkgs/development/python-modules/mediafile/default.nix
@@ -8,16 +8,16 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "mediafile";
-  version = "0.14.0";
+  version = "0.16.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "beetbox";
     repo = "mediafile";
-    tag = "v${version}";
-    hash = "sha256-D5LRGncdeGcmJkrHVvI2cevov4SFO0wuhLxMqP+Ryb8=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-GKEm2LKR3F9uy3FdhvpLPE9Auca8+40Zp53yaLk45XE=";
   };
 
   build-system = [ poetry-core ];
@@ -34,8 +34,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python interface to the metadata tags for many audio file formats";
     homepage = "https://github.com/beetbox/mediafile";
-    changelog = "https://github.com/beetbox/mediafile/releases/tag/${src.tag}";
+    changelog = "https://github.com/beetbox/mediafile/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ lovesegfault ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/metakernel/default.nix b/pkgs/development/python-modules/metakernel/default.nix
index 77065feb0f5e..feb40b6ef8f9 100644
--- a/pkgs/development/python-modules/metakernel/default.nix
+++ b/pkgs/development/python-modules/metakernel/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "metakernel";
-  version = "0.30.4";
+  version = "0.32.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-SIWPiGMNsEcPIkcT0HY4/9QRt1wxPwYxZGLUOjywgug=";
+    hash = "sha256-AxmEtMBinBKchhYtJ72N8mTWmTv5Ya7HMP23H6zv3bw=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/milc/default.nix b/pkgs/development/python-modules/milc/default.nix
index 7fc9d4afc1c4..6fc0129008ad 100644
--- a/pkgs/development/python-modules/milc/default.nix
+++ b/pkgs/development/python-modules/milc/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "milc";
-  version = "1.9.1";
+  version = "1.10.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "clueboard";
     repo = "milc";
     tag = version;
-    hash = "sha256-byj2mcDxLl7rZEFjAt/g1kHllnVxiTIQaTMG24GeSVc=";
+    hash = "sha256-zy62VjtoNhl5hXywJO1p9rO19YAJeKOg+NkfCfgn1Xs=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/mkdocs-include-markdown-plugin/default.nix b/pkgs/development/python-modules/mkdocs-include-markdown-plugin/default.nix
index ee462a8776e7..9d0f41163128 100644
--- a/pkgs/development/python-modules/mkdocs-include-markdown-plugin/default.nix
+++ b/pkgs/development/python-modules/mkdocs-include-markdown-plugin/default.nix
@@ -10,13 +10,13 @@
 
 buildPythonPackage rec {
   pname = "mkdocs-include-markdown-plugin";
-  version = "7.2.1";
+  version = "7.2.2";
   pyproject = true;
 
   src = fetchPypi {
     pname = "mkdocs_include_markdown_plugin";
     inherit version;
-    hash = "sha256-XZTbh7Bs0wNhnbrrul9/Q6Pe1/13CUUdJvCMF2N2/+w=";
+    hash = "sha256-8FLMt0Hsz0mBFrgmwdeKLXYcVnRzcllHCUQc7glj+8k=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/netbox-attachments/default.nix b/pkgs/development/python-modules/netbox-attachments/default.nix
index b36c70ad8dfe..78ec7c0b97bd 100644
--- a/pkgs/development/python-modules/netbox-attachments/default.nix
+++ b/pkgs/development/python-modules/netbox-attachments/default.nix
@@ -10,7 +10,7 @@
 }:
 buildPythonPackage rec {
   pname = "netbox-attachments";
-  version = "11.0.0b2";
+  version = "11.0.1";
   pyproject = true;
 
   disabled = python.pythonVersion != netbox.python.pythonVersion;
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "Kani999";
     repo = "netbox-attachments";
     tag = "v${version}";
-    hash = "sha256-TaEzYUhuBBXYoCmB6bY/1n8KzyaXNbOMRGiDbMDroLw=";
+    hash = "sha256-8wZeHLt8Hx8hghsliKtKxCI/2dQh/EQitZ4YXPSj/Qs=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/ocrmypdf/default.nix b/pkgs/development/python-modules/ocrmypdf/default.nix
index d9bcd518205e..fd3f0d8c0986 100644
--- a/pkgs/development/python-modules/ocrmypdf/default.nix
+++ b/pkgs/development/python-modules/ocrmypdf/default.nix
@@ -45,7 +45,7 @@ buildPythonPackage rec {
     postFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    hash = "sha256-2gghArOylldrCcTrOi1XtfdIwRw7AUpf0PQ6hvKInMk=";
+    hash = "sha256-H/XuMQu52b6dOEUK2zGZWaEVVws80NTCuZQSR4euM7E=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/oras/default.nix b/pkgs/development/python-modules/oras/default.nix
index 52f8e066141b..4a6f9427e777 100644
--- a/pkgs/development/python-modules/oras/default.nix
+++ b/pkgs/development/python-modules/oras/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "oras";
-  version = "0.2.41";
+  version = "0.2.42";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "oras-project";
     repo = "oras-py";
     tag = finalAttrs.version;
-    hash = "sha256-2gGqZ5LLzrpiV7LIZUJMeJfs3ePik0yUls+GNK+2pnM=";
+    hash = "sha256-fuDvhz7dTsPM1AZkPUUgalXUnslAKqTXplslbOUjS/I=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pglast/default.nix b/pkgs/development/python-modules/pglast/default.nix
index d1048ca94524..86c292f293e8 100644
--- a/pkgs/development/python-modules/pglast/default.nix
+++ b/pkgs/development/python-modules/pglast/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pglast";
-  version = "7.11";
+  version = "7.13";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     repo = "pglast";
     tag = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-b8NrgfPhneERu3kXrrLmhGUSmcnz44SUuv3tBvZ55rE=";
+    hash = "sha256-q5QiP8UPQQnG2Ehgj9hngXnhCKvZyCy8mKA0rzWM7EY=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/postgrest/default.nix b/pkgs/development/python-modules/postgrest/default.nix
index 89a92b980ce5..c43e09d93f3b 100644
--- a/pkgs/development/python-modules/postgrest/default.nix
+++ b/pkgs/development/python-modules/postgrest/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "postgrest";
-  version = "2.28.0";
+  version = "2.28.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "supabase";
     repo = "supabase-py";
     tag = "v${version}";
-    hash = "sha256-nK+IZRrKjNy84EC8krBvAZll5E0+jV3bLJh8qIVRElI=";
+    hash = "sha256-Ra7Ig9IMWouMIadx6mg/pe8GlgLCavR6OsPjqgySTCw=";
   };
 
   sourceRoot = "${src.name}/src/postgrest";
diff --git a/pkgs/development/python-modules/prana-api-client/default.nix b/pkgs/development/python-modules/prana-api-client/default.nix
new file mode 100644
index 000000000000..8c3523ba975d
--- /dev/null
+++ b/pkgs/development/python-modules/prana-api-client/default.nix
@@ -0,0 +1,35 @@
+{
+  lib,
+  aiohttp,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "prana-api-client";
+  version = "0.12.0";
+  pyproject = true;
+
+  src = fetchPypi {
+    pname = "prana_api_client";
+    inherit (finalAttrs) version;
+    hash = "sha256-woERY0H9s8P6z375axzPz2k5VWb0xRJtWcAuWtLFtJU=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ aiohttp ];
+
+  # upstream has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "prana_local_api_client" ];
+
+  meta = {
+    description = "Async API client for Prana heat recovery ventilator";
+    homepage = "https://pypi.org/project/prana-api-client/";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.jamiemagee ];
+  };
+})
diff --git a/pkgs/development/python-modules/proton-vpn-daemon/default.nix b/pkgs/development/python-modules/proton-vpn-daemon/default.nix
index 0e122ce9fa0d..eeee850659eb 100644
--- a/pkgs/development/python-modules/proton-vpn-daemon/default.nix
+++ b/pkgs/development/python-modules/proton-vpn-daemon/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "proton-vpn-daemon";
-  version = "0.13.5";
+  version = "0.13.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ProtonVPN";
     repo = "proton-vpn-daemon";
     tag = "v${version}";
-    hash = "sha256-pLLMXRMzPyfEA3YVNRHfhQAbK4YdwTWbVpeVkSeqAiI=";
+    hash = "sha256-HlRxTBLiuboKvMTL3NgX7i/fMBvJqIB4O12tJX1Lv9U=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pulumi-aws/default.nix b/pkgs/development/python-modules/pulumi-aws/default.nix
index 10ef7ee2f108..77af4f6fe5be 100644
--- a/pkgs/development/python-modules/pulumi-aws/default.nix
+++ b/pkgs/development/python-modules/pulumi-aws/default.nix
@@ -11,14 +11,14 @@
 buildPythonPackage rec {
   pname = "pulumi-aws";
   # Version is independent of pulumi's.
-  version = "7.23.0";
+  version = "7.24.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pulumi";
     repo = "pulumi-aws";
     tag = "v${version}";
-    hash = "sha256-yD6VJ51AWJk4jlHJUtoHXGPtQvAyS0EuItbS1Obq6lc=";
+    hash = "sha256-PADClQ8ct9w0igKxQNoW4Act0n0vx1HiD7ysH4PwgFU=";
   };
 
   sourceRoot = "${src.name}/sdk/python";
diff --git a/pkgs/development/python-modules/pyexploitdb/default.nix b/pkgs/development/python-modules/pyexploitdb/default.nix
index a461f7ea4211..8baed9d6cc0e 100644
--- a/pkgs/development/python-modules/pyexploitdb/default.nix
+++ b/pkgs/development/python-modules/pyexploitdb/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pyexploitdb";
-  version = "0.3.20";
+  version = "0.3.21";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-rz+juMgqJJ9PaJVfg79+j26MSV2enG3dH5fOJrU1g+E=";
+    hash = "sha256-j9STueuKwRqbq0zS+xxE8I7EDR4s+Cq1evCtP0h3WX4=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pyfreshr/default.nix b/pkgs/development/python-modules/pyfreshr/default.nix
new file mode 100644
index 000000000000..355042617106
--- /dev/null
+++ b/pkgs/development/python-modules/pyfreshr/default.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  setuptools-scm,
+  aiohttp,
+  pytestCheckHook,
+  pytest-asyncio,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "pyfreshr";
+  version = "1.2.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "SierraNL";
+    repo = "pyfreshr";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-YErjzr9etWaETR4mXJaY33LRVXH4KxTErlB0AIOPmNk=";
+  };
+
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
+
+  dependencies = [ aiohttp ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-asyncio
+  ];
+
+  pythonImportsCheck = [ "pyfreshr" ];
+
+  meta = {
+    description = "Async Python client for the Fresh-r / bw-log.com API";
+    homepage = "https://github.com/SierraNL/pyfreshr";
+    changelog = "https://github.com/SierraNL/pyfreshr/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.jamiemagee ];
+  };
+})
diff --git a/pkgs/development/python-modules/pykka/default.nix b/pkgs/development/python-modules/pykka/default.nix
index 35954461182e..96b37163576f 100644
--- a/pkgs/development/python-modules/pykka/default.nix
+++ b/pkgs/development/python-modules/pykka/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pykka";
-  version = "4.4.1";
+  version = "4.4.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jodal";
     repo = "pykka";
     tag = "v${version}";
-    hash = "sha256-61Dr8V2LILGNveVi6eD0OODXF/a8m8I5/H9MfyIr9Dg=";
+    hash = "sha256-ij5djc+6CjIC9HLxOJorMFdNRnxOoS37+oAmI8Lo5pc=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/pyngrok/default.nix b/pkgs/development/python-modules/pyngrok/default.nix
index f8b50210ec1c..7c813d019225 100644
--- a/pkgs/development/python-modules/pyngrok/default.nix
+++ b/pkgs/development/python-modules/pyngrok/default.nix
@@ -6,31 +6,27 @@
   pyyaml,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pyngrok";
-  version = "7.5.1";
+  version = "8.0.0";
   pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-k07IqJms6Oxhw5EgonqCEq60ApPK0vT/yKPRpLtqjWw=";
+    inherit (finalAttrs) pname version;
+    hash = "sha256-bnqvkLQwhq0lUIoRIkI2CAA/cS2ZiDGd33vlBDECgQE=";
   };
 
-  build-system = [
-    setuptools
-  ];
+  build-system = [ setuptools ];
 
-  dependencies = [
-    pyyaml
-  ];
+  dependencies = [ pyyaml ];
 
   pythonImportsCheck = [ "pyngrok" ];
 
   meta = {
     description = "Python wrapper for ngrok";
     homepage = "https://github.com/alexdlaird/pyngrok";
-    changelog = "https://github.com/alexdlaird/pyngrok/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/alexdlaird/pyngrok/blob/${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ wegank ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/pynitrokey/default.nix b/pkgs/development/python-modules/pynitrokey/default.nix
index 93f6df23fedf..732fc9b0f928 100644
--- a/pkgs/development/python-modules/pynitrokey/default.nix
+++ b/pkgs/development/python-modules/pynitrokey/default.nix
@@ -25,7 +25,7 @@
 
 let
   pname = "pynitrokey";
-  version = "0.11.3";
+  version = "0.11.4";
   mainProgram = "nitropy";
 in
 
@@ -35,7 +35,7 @@ buildPythonPackage {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-b1Npw+FBG8Ti5VjfipgjeZ5pcufm+7K6qdhFBnmTeFs=";
+    hash = "sha256-MSqWgYuuU7uuYasxTTLRbrrAWQAwE4qQlEZIHiYB/78=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/development/python-modules/pytest-celery/default.nix b/pkgs/development/python-modules/pytest-celery/default.nix
index f5d33616cc64..8c6677329249 100644
--- a/pkgs/development/python-modules/pytest-celery/default.nix
+++ b/pkgs/development/python-modules/pytest-celery/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "pytest-celery";
-  version = "1.2.1";
+  version = "1.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "celery";
     repo = "pytest-celery";
     tag = "v${version}";
-    hash = "sha256-E8GO/00IC9kUvQLZmTFaK4FFQ7d+/tw/kVTQbAqRRRM=";
+    hash = "sha256-8qDnyMv0NxMFWGRbJ63Ye/dSRr8A6Azh2J5gkiwYYzI=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/python-gvm/default.nix b/pkgs/development/python-modules/python-gvm/default.nix
index 0c81c7ae004f..a678ab70d65f 100644
--- a/pkgs/development/python-modules/python-gvm/default.nix
+++ b/pkgs/development/python-modules/python-gvm/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "python-gvm";
-  version = "26.10.1";
+  version = "26.11.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "greenbone";
     repo = "python-gvm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-eGpu4OIhWB41eYOZjST2TNYpRTO8sdTQvRJIcEgSQTc=";
+    hash = "sha256-NTUDFZnDavHhl5AELMNj8AkwwVtY+96cMB9uhm4veQg=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/python-ly/default.nix b/pkgs/development/python-modules/python-ly/default.nix
index 9ba70ff6d9e9..8db4aa8b47d5 100644
--- a/pkgs/development/python-modules/python-ly/default.nix
+++ b/pkgs/development/python-modules/python-ly/default.nix
@@ -10,22 +10,20 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "python-ly";
-  version = "0.9.9";
+  version = "0.9.10";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "frescobaldi";
     repo = "python-ly";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CMMssU+qoHbhdny0sgpoYQas4ySPVHnu7GPnSthuMuE=";
+    hash = "sha256-diLg1rU+SmCutW1WJQtMJvpipU+k8GluvAqFfcv1GS4=";
   };
 
   pythonImportsCheck = [ "ly" ];
 
   build-system = [ hatchling ];
 
-  # Tests seem to be broken ATM: https://github.com/wbsoft/python-ly/issues/70
-  doCheck = false;
   nativeCheckInputs = [
     lxml
     pytestCheckHook
@@ -48,7 +46,7 @@ buildPythonPackage (finalAttrs: {
       the GNU music typesetter [LilyPond](https://lilypond.org).
     '';
     homepage = "https://pypi.org/project/python-ly";
-    license = lib.licenses.gpl2Plus;
+    license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [ yiyu ];
     mainProgram = "ly";
   };
diff --git a/pkgs/development/python-modules/qpsolvers/default.nix b/pkgs/development/python-modules/qpsolvers/default.nix
index 07dfc0b6a997..9c49a2f07e07 100644
--- a/pkgs/development/python-modules/qpsolvers/default.nix
+++ b/pkgs/development/python-modules/qpsolvers/default.nix
@@ -23,14 +23,14 @@
 }:
 buildPythonPackage rec {
   pname = "qpsolvers";
-  version = "4.8.2";
+  version = "4.11.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "qpsolvers";
     repo = "qpsolvers";
     tag = "v${version}";
-    hash = "sha256-+W8UJ5oXFw4V+gY/ofzjmO1DwZrZjcycaZH+WKC/9CI=";
+    hash = "sha256-j4GHlRXtNJxcM8xuSz+a8NwhNPg4wEyMyvhyb40QEZs=";
   };
 
   build-system = [ flit-core ];
diff --git a/pkgs/development/python-modules/realtime/default.nix b/pkgs/development/python-modules/realtime/default.nix
index ab3354b2f0d5..9b4a95b66703 100644
--- a/pkgs/development/python-modules/realtime/default.nix
+++ b/pkgs/development/python-modules/realtime/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "realtime";
-  version = "2.28.0";
+  version = "2.28.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "supabase";
     repo = "supabase-py";
     tag = "v${version}";
-    hash = "sha256-nK+IZRrKjNy84EC8krBvAZll5E0+jV3bLJh8qIVRElI=";
+    hash = "sha256-Ra7Ig9IMWouMIadx6mg/pe8GlgLCavR6OsPjqgySTCw=";
   };
 
   sourceRoot = "${src.name}/src/realtime";
diff --git a/pkgs/development/python-modules/schema-salad/default.nix b/pkgs/development/python-modules/schema-salad/default.nix
index 17de4fa288ea..214389029d5a 100644
--- a/pkgs/development/python-modules/schema-salad/default.nix
+++ b/pkgs/development/python-modules/schema-salad/default.nix
@@ -5,11 +5,12 @@
   cachecontrol,
   fetchFromGitHub,
   mistune,
-  mypy,
   mypy-extensions,
+  mypy,
   pytestCheckHook,
   rdflib,
   requests,
+  rich-argparse,
   ruamel-yaml,
   setuptools-scm,
   types-dataclasses,
@@ -19,24 +20,24 @@
 
 buildPythonPackage rec {
   pname = "schema-salad";
-  version = "8.9.20251102115403";
+  version = "8.9.20260327095315";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "common-workflow-language";
     repo = "schema_salad";
     tag = version;
-    hash = "sha256-3axwM3fSxDIG1P0CvcqzqwpdDkhg/5pY7AmjUpU3mEk=";
+    hash = "sha256-j3jevOMsNHT9+HI/8MD4MUwj+IHUisKMs/OA5wpweao=";
   };
 
   pythonRelaxDeps = [ "mistune" ];
 
   postPatch = ''
     substituteInPlace setup.py \
-      --replace-fail 'pytest_runner + ["setuptools_scm>=8.0.4,<9"]' '["setuptools_scm"]'
+      --replace-fail 'pytest_runner + ["setuptools_scm>=8.0.4,<11"]' '["setuptools_scm"]'
     substituteInPlace pyproject.toml \
-      --replace-fail '"setuptools_scm[toml]>=8.0.4,<9"' '"setuptools_scm[toml]"' \
-      --replace-fail "mypy[mypyc]==1.17.0" "mypy"
+      --replace-fail '"setuptools_scm[toml]>=8.0.4,<11"' '"setuptools_scm[toml]"' \
+      --replace-fail "mypy[mypyc]==1.19.1" "mypy"
     sed -i "/black>=/d" pyproject.toml
   '';
 
@@ -49,6 +50,7 @@ buildPythonPackage rec {
     mypy-extensions
     rdflib
     requests
+    rich-argparse
     ruamel-yaml
     types-dataclasses
     types-requests
@@ -83,7 +85,7 @@ buildPythonPackage rec {
     description = "Semantic Annotations for Linked Avro Data";
     homepage = "https://github.com/common-workflow-language/schema_salad";
     changelog = "https://github.com/common-workflow-language/schema_salad/releases/tag/${src.tag}";
-    license = with lib.licenses; [ asl20 ];
+    license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ veprbl ];
   };
 }
diff --git a/pkgs/development/python-modules/smbprotocol/default.nix b/pkgs/development/python-modules/smbprotocol/default.nix
index 52a9c6c6ad5b..c2bcc5332c21 100644
--- a/pkgs/development/python-modules/smbprotocol/default.nix
+++ b/pkgs/development/python-modules/smbprotocol/default.nix
@@ -7,21 +7,24 @@
   pyspnego,
   pytest-mock,
   pytestCheckHook,
+  setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "smbprotocol";
-  version = "1.16.0";
-  format = "setuptools";
+  version = "1.16.1";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jborean93";
     repo = "smbprotocol";
-    tag = "v${version}";
-    hash = "sha256-OZedYBOMBO/EegSvg7aq5lIOWdxSOHh+yHDFZ7bwLec=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Mxsvfn0O4f+SnofBVxKgmJ/e0iM7c/XjONDEtMVHvkc=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     cryptography
     pyspnego
   ];
@@ -46,8 +49,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python SMBv2 and v3 Client";
     homepage = "https://github.com/jborean93/smbprotocol";
-    changelog = "https://github.com/jborean93/smbprotocol/releases/tag/${src.tag}";
-    license = with lib.licenses; [ mit ];
+    changelog = "https://github.com/jborean93/smbprotocol/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/snakemake-interface-executor-plugins/default.nix b/pkgs/development/python-modules/snakemake-interface-executor-plugins/default.nix
index e901c2080007..6200948df93a 100644
--- a/pkgs/development/python-modules/snakemake-interface-executor-plugins/default.nix
+++ b/pkgs/development/python-modules/snakemake-interface-executor-plugins/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "snakemake-interface-executor-plugins";
-  version = "9.3.9";
+  version = "9.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "snakemake";
     repo = "snakemake-interface-executor-plugins";
     tag = "v${version}";
-    hash = "sha256-NiOVUHB9UU1ZqNAVomZmpzyzDwtbLCd+2MaIvpo5G7k=";
+    hash = "sha256-ePbdHMYB2LfCOglz87ZnsUkJH7B97hhSmNBGzwtl5OM=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/spdx-tools/default.nix b/pkgs/development/python-modules/spdx-tools/default.nix
index b3dfe906c11f..e7eea7643260 100644
--- a/pkgs/development/python-modules/spdx-tools/default.nix
+++ b/pkgs/development/python-modules/spdx-tools/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "spdx-tools";
-  version = "0.8.4";
+  version = "0.8.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "spdx";
     repo = "tools-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-loD+YXRCEYRynOKf7Da43SA7JQVYP1IzJe2f7ssJTtI=";
+    hash = "sha256-dHR5Lx8KDmfQLS4I+6oO5kucEUXsFhAaHSPpxJbxlu4=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/sphinx-togglebutton/default.nix b/pkgs/development/python-modules/sphinx-togglebutton/default.nix
index 99f177604e85..3cf340e92dd3 100644
--- a/pkgs/development/python-modules/sphinx-togglebutton/default.nix
+++ b/pkgs/development/python-modules/sphinx-togglebutton/default.nix
@@ -10,13 +10,13 @@
 
 buildPythonPackage rec {
   pname = "sphinx-togglebutton";
-  version = "0.4.4";
+  version = "0.4.5";
   pyproject = true;
 
   src = fetchPypi {
     inherit version;
     pname = "sphinx_togglebutton";
-    hash = "sha256-BMMyaS/V9TY60CoAHmkzaXZ9bB8OWCeXcKKutXG0cqE=";
+    hash = "sha256-yHDfvTvG4Rm1D/mjemT4mRkCJp6FZyiTHH2Jh36NSz0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/sphinxcontrib-youtube/default.nix b/pkgs/development/python-modules/sphinxcontrib-youtube/default.nix
index 4faa9897d285..483039242df6 100644
--- a/pkgs/development/python-modules/sphinxcontrib-youtube/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-youtube/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "sphinxcontrib-youtube";
-  version = "1.4.1";
+  version = "1.5.0";
   pyproject = true;
 
   nativeBuildInputs = [ flit-core ];
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "sphinx-contrib";
     repo = "youtube";
     tag = "v${version}";
-    hash = "sha256-XuOfZ77tg9akmgTuMQN20OhgkFbn/6YzT46vpTsXxC8=";
+    hash = "sha256-vzF1SC4fUIeR0OYesOq60eWjlX+N+YYA/h7mNfxWEtk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/storage3/default.nix b/pkgs/development/python-modules/storage3/default.nix
index caf58fab05d3..dd96780cbed3 100644
--- a/pkgs/development/python-modules/storage3/default.nix
+++ b/pkgs/development/python-modules/storage3/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "storage3";
-  version = "2.28.0";
+  version = "2.28.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "supabase";
     repo = "supabase-py";
     tag = "v${version}";
-    hash = "sha256-nK+IZRrKjNy84EC8krBvAZll5E0+jV3bLJh8qIVRElI=";
+    hash = "sha256-Ra7Ig9IMWouMIadx6mg/pe8GlgLCavR6OsPjqgySTCw=";
   };
 
   sourceRoot = "${src.name}/src/storage";
diff --git a/pkgs/development/python-modules/stripe/default.nix b/pkgs/development/python-modules/stripe/default.nix
index 1ae5b95510ed..f206d8c4de12 100644
--- a/pkgs/development/python-modules/stripe/default.nix
+++ b/pkgs/development/python-modules/stripe/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "stripe";
-  version = "14.4.1";
+  version = "15.0.1";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-4+7PszaBkybNKrmpP5jrAbScTU2TydFnpSpoq5nBmog=";
+    hash = "sha256-PATozJ7I2VQvndmY4qQ2Hb49C2FQyhfT81JUbPIsVWU=";
   };
 
   build-system = [ flit-core ];
diff --git a/pkgs/development/python-modules/supabase-auth/default.nix b/pkgs/development/python-modules/supabase-auth/default.nix
index 013e4711eecb..3e0334be50c6 100644
--- a/pkgs/development/python-modules/supabase-auth/default.nix
+++ b/pkgs/development/python-modules/supabase-auth/default.nix
@@ -14,14 +14,14 @@
 }:
 buildPythonPackage rec {
   pname = "supabase-auth";
-  version = "2.28.0";
+  version = "2.28.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "supabase";
     repo = "supabase-py";
     tag = "v${version}";
-    hash = "sha256-nK+IZRrKjNy84EC8krBvAZll5E0+jV3bLJh8qIVRElI=";
+    hash = "sha256-Ra7Ig9IMWouMIadx6mg/pe8GlgLCavR6OsPjqgySTCw=";
   };
 
   sourceRoot = "${src.name}/src/auth";
diff --git a/pkgs/development/python-modules/supabase-functions/default.nix b/pkgs/development/python-modules/supabase-functions/default.nix
index b80b56c3fd65..4ce9853c9419 100644
--- a/pkgs/development/python-modules/supabase-functions/default.nix
+++ b/pkgs/development/python-modules/supabase-functions/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "supabase-functions";
-  version = "2.28.0";
+  version = "2.28.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "supabase";
     repo = "supabase-py";
     tag = "v${version}";
-    hash = "sha256-nK+IZRrKjNy84EC8krBvAZll5E0+jV3bLJh8qIVRElI=";
+    hash = "sha256-Ra7Ig9IMWouMIadx6mg/pe8GlgLCavR6OsPjqgySTCw=";
   };
 
   sourceRoot = "${src.name}/src/functions";
diff --git a/pkgs/development/python-modules/supabase/default.nix b/pkgs/development/python-modules/supabase/default.nix
index 685a72ccbb20..22ba8f3fa260 100644
--- a/pkgs/development/python-modules/supabase/default.nix
+++ b/pkgs/development/python-modules/supabase/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "supabase";
-  version = "2.28.0";
+  version = "2.28.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "supabase";
     repo = "supabase-py";
     tag = "v${version}";
-    hash = "sha256-nK+IZRrKjNy84EC8krBvAZll5E0+jV3bLJh8qIVRElI=";
+    hash = "sha256-Ra7Ig9IMWouMIadx6mg/pe8GlgLCavR6OsPjqgySTCw=";
   };
 
   sourceRoot = "${src.name}/src/supabase";
diff --git a/pkgs/development/python-modules/tika-client/default.nix b/pkgs/development/python-modules/tika-client/default.nix
index 0cf177137a81..704dddf4a74f 100644
--- a/pkgs/development/python-modules/tika-client/default.nix
+++ b/pkgs/development/python-modules/tika-client/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "tika-client";
-  version = "0.10.0";
+  version = "0.11.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "stumpylog";
     repo = "tika-client";
     tag = version;
-    hash = "sha256-XYyMp+02lWzE+3Txr+shVGVwalLEJHvoy988tA7SWgY=";
+    hash = "sha256-vVS+1RmJVURz25jlABsJBqL02GgAY18AeWag0GUmRWQ=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/torchao/default.nix b/pkgs/development/python-modules/torchao/default.nix
index 75fec3ec39b2..3edd4c19fe7e 100644
--- a/pkgs/development/python-modules/torchao/default.nix
+++ b/pkgs/development/python-modules/torchao/default.nix
@@ -27,27 +27,37 @@
   pytestCheckHook,
   parameterized,
   tabulate,
+  torchvision,
   transformers,
   unittest-xml-reporting,
 }:
-
+let
+  inherit (stdenv.hostPlatform)
+    isDarwin
+    isLinux
+    isAarch64
+    isx86_64
+    ;
+  isAarch64Darwin = isDarwin && isAarch64;
+  isAarch64Linux = isLinux && isAarch64;
+in
 buildPythonPackage (finalAttrs: {
   pname = "torchao";
-  version = "0.16.0";
+  version = "0.17.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pytorch";
     repo = "ao";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-FyBsIVb3zdKtA8Vqjt301bRrGIoyeqiOUADVFGxiRPY=";
+    hash = "sha256-Mry6jsZKkoC8dq3fYNsRyGbL4+S8ZYuHpkETNDy5qsg=";
   };
 
   # AttributeError: 'typing.Union' object has no attribute '__module__' and no __dict__ for setting
   # new attributes. Did you mean: '__reduce__'?
   disabled = pythonAtLeast "3.14";
 
-  patches = lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
+  patches = lib.optionals isAarch64Darwin [
     ./use-system-cpuinfo.patch
     (replaceVars ./use-llvm-openmp.patch {
       inherit (llvmPackages) openmp;
@@ -58,16 +68,16 @@ buildPythonPackage (finalAttrs: {
     setuptools
   ];
 
-  nativeBuildInputs = lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
+  nativeBuildInputs = lib.optionals isAarch64Darwin [
     cmake
   ];
   dontUseCmakeConfigure = true;
 
-  buildInputs = lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
+  buildInputs = lib.optionals isAarch64Darwin [
     cpuinfo
   ];
 
-  propagatedBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
+  propagatedBuildInputs = lib.optionals isDarwin [
     # Otherwise, torch will fail to include `omp.h`:
     # torch._inductor.exc.InductorError: CppCompileError: C++ compile error
     # OpenMP support not found.
@@ -97,6 +107,7 @@ buildPythonPackage (finalAttrs: {
     pytest-xdist
     pytestCheckHook
     tabulate
+    torchvision
     transformers
     unittest-xml-reporting
   ];
@@ -160,7 +171,7 @@ buildPythonPackage (finalAttrs: {
     # execnet.gateway_base.DumpError: can't serialize <class 'torch.dtype'>
     "test_numerical_consistency_per_tensor"
   ]
-  ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
+  ++ lib.optionals isAarch64Linux [
     # AssertionError: tensor(False) is not true
     "test_quantize_per_token_cpu"
 
@@ -177,7 +188,7 @@ buildPythonPackage (finalAttrs: {
     "test_save_load_int8woqtensors_0_cpu"
     "test_save_load_int8woqtensors_1_cpu"
   ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+  ++ lib.optionals isDarwin [
     # AssertionError: Scalars are not equal!
     "test_comm"
     "test_fsdp2"
@@ -237,6 +248,13 @@ buildPythonPackage (finalAttrs: {
     "test_optim_smoke_optim_name_AdamFp8_float32_device_mps"
     "test_subclass_slice_subclass0_shape1_device_mps"
 
+    # RuntimeError: Expected to find "triton_per_fused" but did not find it
+    "test_available_gpu_kernels_device_mps"
+
+    # RuntimeError: quantized engine NoQEngine is not supported
+    "test_qat_mobilenet_v2"
+    "test_qat_resnet18"
+
     # Crash (Trace/BPT trap: 5)
     "test_copy__mismatch_metadata_apply_quant0"
     "test_copy__mismatch_metadata_apply_quant1"
@@ -278,7 +296,7 @@ buildPythonPackage (finalAttrs: {
     "test_workflow_e2e_numerics_config4"
     "test_workflow_e2e_numerics_config5"
   ]
-  ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
+  ++ lib.optionals (isDarwin && isx86_64) [
     # Flaky: [gw0] node down: keyboard-interrupt
     "test_int8_weight_only_quant_with_freeze_0_cpu"
     "test_int8_weight_only_quant_with_freeze_1_cpu"
@@ -296,7 +314,7 @@ buildPythonPackage (finalAttrs: {
     # ImportError: cannot import name 'fp8_blockwise_weight_dequant' from 'torchao.kernel.blockwise_quantization'
     "test/kernel/test_blockwise_triton.py"
   ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+  ++ lib.optionals isDarwin [
     # Require unpackaged 'coremltools'
     "test/prototype/test_groupwise_lowbit_weight_lut_quantizer.py"
 
@@ -316,6 +334,8 @@ buildPythonPackage (finalAttrs: {
     "test/test_low_bit_optim.py::TestQuantize::test_bf16_stochastic_round_dtensor_device_mps_compile_True"
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   meta = {
     description = "PyTorch native quantization and sparsity for training and inference";
     homepage = "https://github.com/pytorch/ao";
@@ -325,5 +345,9 @@ buildPythonPackage (finalAttrs: {
       GaetanLepage
       sarahec
     ];
+    badPlatforms = [
+      # Many tests failing and hanging indefinitely
+      "aarch64-linux"
+    ];
   };
 })
diff --git a/pkgs/development/python-modules/torchao/use-llvm-openmp.patch b/pkgs/development/python-modules/torchao/use-llvm-openmp.patch
index b399b347da39..5d655a8f2202 100644
--- a/pkgs/development/python-modules/torchao/use-llvm-openmp.patch
+++ b/pkgs/development/python-modules/torchao/use-llvm-openmp.patch
@@ -1,13 +1,17 @@
 diff --git a/torchao/csrc/cpu/shared_kernels/Utils.cmake b/torchao/csrc/cpu/shared_kernels/Utils.cmake
-index be7004784..0e1a2ed0e 100644
+index 3ff024538..0763cab67 100644
 --- a/torchao/csrc/cpu/shared_kernels/Utils.cmake
 +++ b/torchao/csrc/cpu/shared_kernels/Utils.cmake
-@@ -21,7 +21,7 @@ function(target_link_torchao_parallel_backend target_name torchao_parallel_backe
-         target_link_libraries(${target_name} PRIVATE "${TORCH_LIBRARIES}")
- 
-         target_compile_definitions(${target_name} PRIVATE TORCHAO_PARALLEL_ATEN=1 AT_PARALLEL_OPENMP=1 INTRA_OP_PARALLEL=1)
--        target_link_libraries(${target_name} PRIVATE ${TORCH_INSTALL_PREFIX}/lib/libomp${CMAKE_SHARED_LIBRARY_SUFFIX})
-+        target_link_libraries(${target_name} PRIVATE @openmp@/lib/libomp${CMAKE_SHARED_LIBRARY_SUFFIX})
+@@ -30,10 +30,10 @@ function(target_link_torchao_parallel_backend target_name torchao_parallel_backe
+             if(_TORCH_OMP_RUNTIME)
+                 target_link_libraries(${target_name} PRIVATE "${_TORCH_OMP_RUNTIME}")
+             else()
+-                target_link_libraries(${target_name} PRIVATE ${TORCH_INSTALL_PREFIX}/lib/libomp${CMAKE_SHARED_LIBRARY_SUFFIX})
++                target_link_libraries(${target_name} PRIVATE @openmp@/lib/libomp${CMAKE_SHARED_LIBRARY_SUFFIX})
+             endif()
+         else()
+-            target_link_libraries(${target_name} PRIVATE ${TORCH_INSTALL_PREFIX}/lib/libomp${CMAKE_SHARED_LIBRARY_SUFFIX})
++            target_link_libraries(${target_name} PRIVATE @openmp@/lib/libomp${CMAKE_SHARED_LIBRARY_SUFFIX})
+         endif()
  
      elseif(TORCHAO_PARALLEL_BACKEND_TOUPPER STREQUAL "EXECUTORCH")
-         message(STATUS "Building with TORCHAO_PARALLEL_BACKEND=TORCHAO_PARALLEL_EXECUTORCH")
diff --git a/pkgs/development/python-modules/transformer-engine/cuda-libs-paths.patch b/pkgs/development/python-modules/transformer-engine/cuda-libs-paths.patch
new file mode 100644
index 000000000000..bdf80680acbb
--- /dev/null
+++ b/pkgs/development/python-modules/transformer-engine/cuda-libs-paths.patch
@@ -0,0 +1,145 @@
+diff --git a/transformer_engine/common/__init__.py b/transformer_engine/common/__init__.py
+index 02388d2e..f2eb337c 100644
+--- a/transformer_engine/common/__init__.py
++++ b/transformer_engine/common/__init__.py
+@@ -239,117 +239,7 @@ def _get_sys_extension() -> str:
+ def _nvidia_cudart_include_dir() -> str:
+     """Returns the include directory for cuda_runtime.h if exists in python environment."""
+ 
+-    try:
+-        import nvidia
+-    except ModuleNotFoundError:
+-        return ""
+-
+-    # Installing some nvidia-* packages, like nvshmem, create nvidia name, so "import nvidia"
+-    # above doesn't through. However, they don't set "__file__" attribute.
+-    if nvidia.__file__ is None:
+-        return ""
+-
+-    include_dir = Path(nvidia.__file__).parent / "cuda_runtime"
+-    return str(include_dir) if include_dir.exists() else ""
+-
+-
+-@functools.lru_cache(maxsize=None)
+-def _load_cuda_library_from_python(lib_name: str, strict: bool = False):
+-    """
+-    Attempts to load shared object file installed via python packages.
+-
+-    `lib_name` : Name of package as found in the `nvidia` dir in python environment.
+-    `strict` : If set to `True`, throw an error if lib is not found.
+-    """
+-
+-    ext = _get_sys_extension()
+-    nvidia_dir = os.path.join(sysconfig.get_path("purelib"), "nvidia")
+-
+-    # PyPI packages provided by nvidia libs exist
+-    # in 4 possible locations inside `nvidia`.
+-    # Check by order of priority.
+-    path_found = False
+-    if os.path.isdir(os.path.join(nvidia_dir, "cu13", lib_name)):
+-        so_paths = glob.glob(os.path.join(nvidia_dir, "cu13", lib_name, f"lib/lib*{ext}.*[0-9]"))
+-        path_found = len(so_paths) > 0
+-
+-    if not path_found and os.path.isdir(os.path.join(nvidia_dir, "cu13")):
+-        so_paths = glob.glob(os.path.join(nvidia_dir, "cu13", f"lib/lib{lib_name}*{ext}.*[0-9]"))
+-        path_found = len(so_paths) > 0
+-
+-    if not path_found and os.path.isdir(os.path.join(nvidia_dir, lib_name)):
+-        so_paths = glob.glob(os.path.join(nvidia_dir, lib_name, f"lib/lib*{ext}.*[0-9]"))
+-        path_found = len(so_paths) > 0
+-
+-    if not path_found:
+-        so_paths = glob.glob(os.path.join(nvidia_dir, f"cuda_{lib_name}", f"lib/lib*{ext}.*[0-9]"))
+-        path_found = len(so_paths) > 0
+-
+-    ctypes_handles = []
+-
+-    if path_found:
+-        for so_path in so_paths:
+-            ctypes_handles.append(ctypes.CDLL(so_path, mode=ctypes.RTLD_GLOBAL))
+-
+-    if strict and not path_found:
+-        raise RuntimeError(f"{lib_name} shared object not found.")
+-
+-    return path_found, ctypes_handles
+-
+-
+-@functools.lru_cache(maxsize=None)
+-def _load_cuda_library_from_system(lib_name: str):
+-    """
+-    Attempts to load shared object file installed via system/cuda-toolkit.
+-
+-    `lib_name`: Name of library to load without extension or `lib` prefix.
+-    """
+-
+-    # Where to look for the shared lib in decreasing order of preference.
+-    paths = (
+-        os.environ.get(f"{lib_name.upper()}_HOME"),
+-        os.environ.get(f"{lib_name.upper()}_PATH"),
+-        os.environ.get("CUDA_HOME"),
+-        os.environ.get("CUDA_PATH"),
+-        "/usr/local/cuda",
+-    )
+-
+-    for path in paths:
+-        if path is None:
+-            continue
+-        libs = glob.glob(f"{path}/**/lib{lib_name}{_get_sys_extension()}*", recursive=True)
+-        libs = [lib for lib in libs if "stub" not in lib]
+-        libs.sort(reverse=True, key=os.path.basename)
+-        if libs:
+-            return True, ctypes.CDLL(libs[0], mode=ctypes.RTLD_GLOBAL)
+-
+-    # Search in LD_LIBRARY_PATH.
+-    try:
+-        _lib_handle = ctypes.CDLL(f"lib{lib_name}{_get_sys_extension()}", mode=ctypes.RTLD_GLOBAL)
+-        return True, _lib_handle
+-    except OSError:
+-        return False, None
+-
+-
+-@functools.lru_cache(maxsize=None)
+-def _load_cuda_library(lib_name: str):
+-    """
+-    Load given shared library.
+-    Prioritize loading from system/toolkit
+-    before checking python packages.
+-    """
+-
+-    # Attempt to locate library in system.
+-    found, handle = _load_cuda_library_from_system(lib_name)
+-    if found:
+-        return True, handle
+-
+-    # Attempt to locate library in Python dist-packages.
+-    found, handle = _load_cuda_library_from_python(lib_name)
+-    if found:
+-        return False, handle
+-
+-    raise RuntimeError(f"{lib_name} shared object not found.")
++    return "@cudart_include_dir@"
+ 
+ 
+ @functools.lru_cache(maxsize=None)
+@@ -364,18 +254,9 @@ if "NVTE_PROJECT_BUILDING" not in os.environ or bool(int(os.getenv("NVTE_RELEASE
+     # `_load_cuda_library` is used for packages that must be loaded
+     # during runtime. Both system and pypi packages are searched
+     # and an error is thrown if not found.
+-    _, _CUDNN_LIB_CTYPES = _load_cuda_library("cudnn")
+-    system_nvrtc, _NVRTC_LIB_CTYPES = _load_cuda_library("nvrtc")
+-    system_curand, _CURAND_LIB_CTYPES = _load_cuda_library("curand")
+-
+-    # This additional step is necessary to be able to install TE wheels
+-    # and import TE (without any guards) in an environment where the cuda
+-    # toolkit might be absent without being guarded
+-    load_libs_for_no_ctk = not system_nvrtc and not system_curand
+-    if load_libs_for_no_ctk:
+-        _CUBLAS_LIB_CTYPES = _load_cuda_library_from_python("cublas", strict=True)
+-        _CUDART_LIB_CTYPES = _load_cuda_library_from_python("cudart", strict=True)
+-        _CUDNN_ALL_LIB_CTYPES = _load_cuda_library_from_python("cudnn", strict=True)
++    _CUDNN_LIB_CTYPES = ctypes.CDLL("@libcudnn_so@", mode=ctypes.RTLD_GLOBAL)
++    _NVRTC_LIB_CTYPES = ctypes.CDLL("@libnvrtc_so@", mode=ctypes.RTLD_GLOBAL)
++    _CURAND_LIB_CTYPES = ctypes.CDLL("@libcurand_so@", mode=ctypes.RTLD_GLOBAL)
+ 
+     _TE_LIB_CTYPES = _load_core_library()
+ 
diff --git a/pkgs/development/python-modules/transformer-engine/default.nix b/pkgs/development/python-modules/transformer-engine/default.nix
new file mode 100644
index 000000000000..9a29b6b75e4b
--- /dev/null
+++ b/pkgs/development/python-modules/transformer-engine/default.nix
@@ -0,0 +1,273 @@
+{
+  lib,
+  config,
+  buildPythonPackage,
+  fetchFromGitHub,
+  replaceVars,
+  fetchpatch,
+  python,
+  cudaPackages,
+
+  # nativeBuildInputs
+  autoAddDriverRunpath,
+  autoPatchelfHook,
+  mpi,
+
+  # build-system
+  cmake,
+  ninja,
+  pybind11,
+  setuptools,
+  # jax-only
+  flax,
+  jax,
+  # pytorch-only:
+  torch,
+
+  # dependencies
+  importlib-metadata,
+  packaging,
+  pydantic,
+  # pytorch-only:
+  einops,
+  nvdlfw-inspect,
+  onnx,
+  onnxscript,
+
+  cudaSupport ? config.cudaSupport,
+  cudaCapabilities ?
+    if withPytorch then torch.cudaCapabilities else cudaPackages.flags.cudaCapabilities,
+  withMpi ? false,
+  withPytorch ? true,
+  withJax ? true,
+  withNvshmem ? false,
+}:
+
+let
+  inherit (lib)
+    cmakeFeature
+    concatStringsSep
+    getInclude
+    getLib
+    optional
+    optionalString
+    optionals
+    strings
+    subtractLists
+    ;
+  inherit (cudaPackages) backendStdenv flags;
+
+  frameworks =
+    if (withJax || withPytorch) then
+      concatStringsSep "," (optional withJax "jax" ++ optional withPytorch "pytorch")
+    else
+      "none";
+
+  cudaCapabilities' = subtractLists [
+    # Compilation will fail when providing those architectures:
+    #   error: static assertion failed with "Compiled for the generic architecture, while utilizing
+    #   family-specific features.
+    #   Please compile for smXXXf architecture instead of smXXX architecture."
+    # Providing 10.0 and 12.0 respectively is enough as the CMake file will automatically add the
+    # correct compilation flags for supporting those architectures.
+    "10.3"
+    "12.1"
+  ] cudaCapabilities;
+
+in
+buildPythonPackage.override { stdenv = backendStdenv; } (finalAttrs: {
+  pname = "transformer-engine";
+  version = "2.12";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "NVIDIA";
+    repo = "TransformerEngine";
+    tag = "v${finalAttrs.version}";
+    # Their CMakeLists.txt does not easily let us inject dependencies
+    fetchSubmodules = true;
+    hash = "sha256-/e11kacSYPKdjVEKAo3x/CarzKhO3tiTsMjYWLzHbls=";
+  };
+
+  patches =
+    optionals cudaSupport [
+      (replaceVars ./cuda-libs-paths.patch {
+        libcudnn_so = "${getLib cudaPackages.cudnn}/lib/libcudnn.so";
+        libnvrtc_so = "${getLib cudaPackages.cuda_nvrtc}/lib/libnvrtc.so";
+        libcurand_so = "${getLib cudaPackages.libcurand}/lib/libcurand.so";
+
+        cudart_include_dir = "${getInclude cudaPackages.cuda_cudart}/include";
+      })
+
+      # https://github.com/NVIDIA/TransformerEngine/pull/2832
+      (fetchpatch {
+        name = "fix-cuda-arch-cmake-logic";
+        url = "https://github.com/GaetanLepage/TransformerEngine/commit/a3cf63e0d03dd9af1d494854949387f1ae677bf0.patch";
+        hash = "sha256-g2aIF0fROsExEjuNiyI62/rrCOXYyOjyQIOn6rCrUyI=";
+      })
+    ]
+    ++ optionals withNvshmem [
+      # https://github.com/NVIDIA/TransformerEngine/pull/2815
+      (fetchpatch {
+        name = "fix-nvshmem-build";
+        url = "https://github.com/NVIDIA/TransformerEngine/commit/e83c09742166dfef3f871cfa1407605feafb3afe.patch";
+        hash = "sha256-5pf0Dg1XL7oAQjR1JZcdgbeaGj9qw9G5+i9Ac0iff64=";
+      })
+    ]
+    ++ optionals (withMpi && withJax) [
+      # https://github.com/NVIDIA/TransformerEngine/pull/2835
+      (fetchpatch {
+        name = "fix-jax-extension-build-with-mpi";
+        url = "https://github.com/GaetanLepage/TransformerEngine/commit/f68cd3cab34972a899ad0069e2c4ee806e8bc6fb.patch";
+        hash = "sha256-u0ljg1FwY0QjR+ETswpzWV+Sbv00JHI5CSrNQ/9zsuA=";
+      })
+    ];
+
+  postPatch =
+    # Patch build-system requirements:
+    # - pybind11[global] doesn't exist in nixpkgs, just use regular pybind11
+    # - pip is not required for building this package
+    # - torch, jax and flax should not been unconditionally required, but depending on the selected
+    #   'frameworks'
+    ''
+      substituteInPlace pyproject.toml \
+        --replace-fail "pybind11[global]" "pybind11" \
+        --replace-fail '"pip", "torch>=2.1", "jax>=0.5.0", "flax>=0.7.1"' ""
+    ''
+    # Harcode the path to the output store path that transformer_engine will use to import
+    # - libtransformer_engine.so
+    # - transformer_engine_jax.cpython-313-x86_64-linux-gnu.so
+    # - transformer_engine_torch.cpython-313-x86_64-linux-gnu.so
+    # This skips their impure find logic.
+    + ''
+      substituteInPlace transformer_engine/common/__init__.py \
+        --replace-fail \
+          'te_path = Path(importlib.util.find_spec("transformer_engine").origin).parent.parent' \
+          'te_path = Path("${placeholder "out"}/${python.sitePackages}")'
+    '';
+
+  # https://github.com/NVIDIA/TransformerEngine/blob/main/docs/envvars.rst
+  env = {
+    NVTE_RELEASE_BUILD = 0;
+
+    # Do not include the git commit hash in the version string
+    NVTE_NO_LOCAL_VERSION = 1;
+
+    # Use the nixpkgs triton package
+    NVTE_USE_PYTORCH_TRITON = 0;
+
+    NVTE_FRAMEWORK = frameworks;
+
+    NVTE_CUDA_ARCHS = strings.concatMapStringsSep ";" flags.dropDots cudaCapabilities';
+
+    NVTE_CMAKE_EXTRA_ARGS = toString [
+      (cmakeFeature "CUDNN_FRONTEND_INCLUDE_DIR" "${getInclude cudaPackages.cudnn-frontend}/include")
+    ];
+
+    NVTE_UB_WITH_MPI = if withMpi then 1 else 0;
+    # NOTE: Make sure to use mpi from buildPackages to match the spliced version created through nativeBuildInputs.
+    MPI_HOME = optionalString withMpi (getLib mpi).outPath;
+
+    NVTE_ENABLE_NVSHMEM = if withNvshmem then 1 else 0;
+    NVSHMEM_HOME = optionalString withNvshmem cudaPackages.libnvshmem.outPath;
+  };
+
+  build-system = [
+    cmake
+    ninja
+    pybind11
+    setuptools
+  ]
+  ++ optionals withJax [
+    flax
+    jax
+  ]
+  ++ optionals withPytorch [
+    # Required to build extensions
+    torch
+  ];
+  dontUseCmakeConfigure = true;
+
+  nativeBuildInputs = [
+    autoAddDriverRunpath
+    autoPatchelfHook
+    cudaPackages.cuda_nvcc
+  ]
+  ++ optionals withMpi [
+    # NOTE: mpi is in nativeBuildInputs because it contains compilers and is only discoverable by
+    # CMake when a nativeBuildInput.
+    mpi
+  ];
+
+  buildInputs = [
+    cudaPackages.cuda_cudart # cuda_runtime.h
+    cudaPackages.cuda_nvml_dev # nvml.h
+    cudaPackages.cuda_nvrtc # nvrtc.h
+    cudaPackages.cuda_nvtx # nvToolsExt.h
+    cudaPackages.cuda_profiler_api # cuda_profiler_api.h
+    cudaPackages.cudnn # cudnn.h
+    cudaPackages.libcublas
+    cudaPackages.libcurand # curand.h
+    cudaPackages.libcusolver # cusolverDn.h
+    cudaPackages.libcusparse # cusparse.h
+    cudaPackages.nccl # nccl.h
+    pybind11 # pybind11/pybind11.h
+  ]
+  ++ optionals withMpi [
+    mpi # mpi.h
+  ];
+
+  runtimeDependencies = optionals withNvshmem [
+    # libnvshmem is already provided at build time by `$NVSHMEM_HOME`
+    # We add it here so that it gets picked up by autoPatchelfHook
+    (getLib cudaPackages.libnvshmem)
+  ];
+
+  preBuild = ''
+    export NVTE_BUILD_MAX_JOBS=$NIX_BUILD_CORES
+  '';
+
+  dependencies = [
+    importlib-metadata
+    packaging
+    pydantic
+  ]
+  ++ optionals withJax [
+    flax
+    jax
+  ]
+  ++ optionals withPytorch [
+    einops
+    nvdlfw-inspect
+    onnx
+    onnxscript
+    torch
+  ];
+
+  # When built with nvshmem support `dlopen`ing libtransformer_engine.so `dlopen`s
+  # libnvidia-ml.so.1 which is provided by the GPU driver at run time:
+  # OSError: libnvidia-ml.so.1: cannot open shared object file: No such file or directory
+  pythonImportsCheck = optionals (!withNvshmem) (
+    [
+      "transformer_engine"
+    ]
+    ++ optionals withJax [
+      "transformer_engine_jax"
+    ]
+    ++ optionals withPytorch [
+      "transformer_engine_torch"
+    ]
+  );
+
+  # Almost all tests require GPU access
+  doCheck = false;
+
+  meta = {
+    description = "Library for accelerating Transformer models on NVIDIA GPUs";
+    homepage = "https://github.com/NVIDIA/TransformerEngine";
+    changelog = "https://github.com/NVIDIA/TransformerEngine/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+    broken = !cudaSupport;
+  };
+})
diff --git a/pkgs/development/python-modules/trl/default.nix b/pkgs/development/python-modules/trl/default.nix
index 3a9e73c30233..8ab0fb06b06a 100644
--- a/pkgs/development/python-modules/trl/default.nix
+++ b/pkgs/development/python-modules/trl/default.nix
@@ -5,35 +5,33 @@
 
   # build-system
   setuptools,
-  setuptools-scm,
 
   # dependencies
   accelerate,
   datasets,
+  packaging,
   rich,
   transformers,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "trl";
-  version = "0.27.0";
+  version = "0.24.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "huggingface";
     repo = "trl";
-    tag = "v${version}";
-    hash = "sha256-NEvIWrirHqcLJpyA894NgNFPn/Svg+ND/xDMIRHW8d0=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-t0wOuEKlcZzFlQeS4PYHykFsz+43hYc0gJ9u4emr8HI=";
   };
 
-  build-system = [
-    setuptools
-    setuptools-scm
-  ];
+  build-system = [ setuptools ];
 
   dependencies = [
     accelerate
     datasets
+    packaging
     rich
     transformers
   ];
@@ -46,8 +44,8 @@ buildPythonPackage rec {
   meta = {
     description = "Train transformer language models with reinforcement learning";
     homepage = "https://github.com/huggingface/trl";
-    changelog = "https://github.com/huggingface/trl/releases/tag/${src.tag}";
+    changelog = "https://github.com/huggingface/trl/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ hoh ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/tyro/default.nix b/pkgs/development/python-modules/tyro/default.nix
index 1a50bfdaf78c..2bc2053f8e7a 100644
--- a/pkgs/development/python-modules/tyro/default.nix
+++ b/pkgs/development/python-modules/tyro/default.nix
@@ -9,71 +9,72 @@
 
   # dependencies
   docstring-parser,
-  rich,
-  shtab,
   typeguard,
   typing-extensions,
 
   # tests
   attrs,
-  flax,
-  jax,
   ml-collections,
   msgspec,
   omegaconf,
   pydantic,
   pytestCheckHook,
-  torch,
+  shtab,
   universal-pathlib,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "tyro";
-  version = "1.0.10";
+  version = "1.0.12";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "brentyi";
     repo = "tyro";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-k8f0eSeBBCROSsf7WooapDIFoy1G4Guxpbb7eNbj6ps=";
+    hash = "sha256-e4LIJzZ7lIkvhqbOz/EGHgPo9ri1HNiMp0j+I1S0/J4=";
   };
 
   build-system = [ hatchling ];
 
   dependencies = [
     docstring-parser
-    rich
-    shtab
     typeguard
     typing-extensions
   ];
 
+  # Upstream's neural-network integration tests are optional and skipped when
+  # flax/torch are unavailable, so keep the lightweight dev extras only.
   nativeCheckInputs = [
     attrs
-    flax
-    jax
     ml-collections
     msgspec
     omegaconf
     pydantic
     pytestCheckHook
-    torch
+    shtab
     universal-pathlib
   ];
 
-  disabledTests = lib.optionals (pythonAtLeast "3.13") [
-    # Bash path completion relies on the programmable-completion builtin `compgen`,
-    # which is unavailable in the stdenv build shell.
-    "test_bash_path_completion_marker"
+  disabledTests =
+    lib.optionals (pythonAtLeast "3.13") [
+      # The bash path-completion functional test still returns no file
+      # completions in the Nix build environment.
+      "test_bash_path_completion_marker"
+    ]
+    ++ lib.optionals (pythonAtLeast "3.14") [
+      # Upstream checks that the literal substring `bc` never appears in the
+      # help text, but under Nix the `python -m pytest` runner path can include
+      # that substring in the store hash used for `sys.argv[0]`.
+      "test_suppress_subcommand"
+    ];
 
-    # In Nix builds, the long `python -m pytest` argv[0] path gets line-wrapped in
-    # argparse error output, splitting `class-b` and `)` so this literal-match fails.
-    "test_similar_arguments_subcommands_multiple_contains_match"
-
-    # Same wrapped-output literal-match issue as above for the cascading-args variant.
-    "test_similar_arguments_subcommands_multiple_contains_match_cascading"
-  ];
+  # Keep argparse help output on a single line where possible so the
+  # literal-output tests do not fail due to terminal line wrapping.
+  preCheck = ''
+    export COLUMNS=200
+    export LINES=200
+  '';
 
   pythonImportsCheck = [ "tyro" ];
 
diff --git a/pkgs/development/python-modules/unsloth-zoo/default.nix b/pkgs/development/python-modules/unsloth-zoo/default.nix
index ef2be47691bf..810628911f66 100644
--- a/pkgs/development/python-modules/unsloth-zoo/default.nix
+++ b/pkgs/development/python-modules/unsloth-zoo/default.nix
@@ -11,30 +11,42 @@
   accelerate,
   cut-cross-entropy,
   datasets,
+  filelock,
   hf-transfer,
   huggingface-hub,
   msgspec,
+  numpy,
   packaging,
   peft,
+  pillow,
+  protobuf,
   psutil,
+  regex,
   sentencepiece,
   torch,
+  torchao,
+  triton,
   tqdm,
   transformers,
   trl,
   tyro,
+  typing-extensions,
+
+  # tests
+  cudaPackages,
+  python,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "unsloth-zoo";
-  version = "2026.3.4";
+  version = "2026.4.2";
   pyproject = true;
 
   # no tags on GitHub
   src = fetchPypi {
     pname = "unsloth_zoo";
     inherit (finalAttrs) version;
-    hash = "sha256-24w8UV5cLG5XWrU73xfmg+Jk32zl+QSPdqXLzMtmP1E=";
+    hash = "sha256-l0OTaZjPrNnrxVYIfZcf6pYr1tJS9EGj+iguU6S+D28=";
   };
 
   postPatch = ''
@@ -47,14 +59,11 @@ buildPythonPackage (finalAttrs: {
         "setuptools-scm"
   '';
 
-  # pyproject.toml requires an obsolete version of protobuf,
-  # but it is not used.
-  # Upstream issue: https://github.com/unslothai/unsloth-zoo/pull/68
+  # Upstream constrains datasets/torch more tightly than the versions
+  # currently shipped in nixpkgs, but the package still builds and works with
+  # the newer dependency set here.
   pythonRelaxDeps = [
     "datasets"
-    "protobuf"
-    "transformers"
-    "trl"
     "torch"
   ];
 
@@ -72,29 +81,59 @@ buildPythonPackage (finalAttrs: {
     accelerate
     cut-cross-entropy
     datasets
+    filelock
     hf-transfer
     huggingface-hub
     msgspec
+    numpy
     packaging
     peft
+    pillow
+    protobuf
     psutil
+    regex
     sentencepiece
     torch
+    torchao
+    triton
     tqdm
     transformers
     trl
     tyro
+    typing-extensions
   ];
 
   # No tests
   doCheck = false;
 
-  pythonImportsCheck = [ "unsloth_zoo" ];
+  # Importing touches torch.cuda at module import time and queries GPU memory.
+  dontUsePythonImportsCheck = true;
+
+  # Cover the import path on GPU-enabled runners instead of pure builders.
+  passthru.gpuCheck =
+    (cudaPackages.writeGpuTestPython.override { python3Packages = python.pkgs; }
+      {
+        libraries = ps: [ ps.unsloth-zoo ];
+      }
+      ''
+        import torch
+
+        assert torch.cuda.is_available(), "CUDA is not available"
+        assert torch.ones(1, device="cuda").is_cuda
+
+        import unsloth_zoo  # noqa: F401
+        from unsloth_zoo.device_type import DEVICE_COUNT, DEVICE_TYPE
+
+        assert DEVICE_TYPE == "cuda", DEVICE_TYPE
+        assert DEVICE_COUNT > 0, DEVICE_COUNT
+        print(f"Unsloth Zoo detected {DEVICE_COUNT} CUDA device(s)")
+      ''
+    ).gpuCheck;
 
   meta = {
     description = "Utils for Unsloth";
     homepage = "https://github.com/unslothai/unsloth_zoo";
-    license = lib.licenses.mit;
+    license = lib.licenses.lgpl3Plus;
     maintainers = with lib.maintainers; [ hoh ];
   };
 })
diff --git a/pkgs/development/python-modules/unsloth-zoo/dont-require-unsloth.patch b/pkgs/development/python-modules/unsloth-zoo/dont-require-unsloth.patch
index b5f7c9d8ddd7..7716354de65f 100644
--- a/pkgs/development/python-modules/unsloth-zoo/dont-require-unsloth.patch
+++ b/pkgs/development/python-modules/unsloth-zoo/dont-require-unsloth.patch
@@ -21,17 +21,3 @@ index 8c4404c..dc1666f 100644
  try:
      print("🦥 Unsloth: Will patch your computer to enable 2x faster free finetuning.")
  except:
-diff --git a/unsloth_zoo/device_type.py b/unsloth_zoo/device_type.py
-index 11136fb..8f8dafc 100644
---- a/unsloth_zoo/device_type.py
-+++ b/unsloth_zoo/device_type.py
-@@ -209,6 +209,9 @@ def get_device_type():
-         return "cuda"
-     elif hasattr(torch, "xpu") and torch.xpu.is_available():
-         return "xpu"
-+    else:
-+        # Allow import during tests
-+        return None
-     # Check torch.accelerator
-     if hasattr(torch, "accelerator"):
-         if not torch.accelerator.is_available():
diff --git a/pkgs/development/python-modules/unsloth/default.nix b/pkgs/development/python-modules/unsloth/default.nix
index 657f2bbf1a20..07447392d21f 100644
--- a/pkgs/development/python-modules/unsloth/default.nix
+++ b/pkgs/development/python-modules/unsloth/default.nix
@@ -11,6 +11,7 @@
   bitsandbytes,
   numpy,
   packaging,
+  psutil,
   torch,
   unsloth-zoo,
   xformers,
@@ -53,16 +54,40 @@ in
 
 buildPythonPackage (finalAttrs: {
   pname = "unsloth";
-  version = "2026.3.8";
+  version = "2026.4.1";
   pyproject = true;
 
   # Tags on the GitHub repo don't match
   src = fetchPypi {
     pname = "unsloth";
     inherit (finalAttrs) version;
-    hash = "sha256-2HXsaYhsMxNEm6ctKDZDrA9MY/fUKhAo0EPYC5RwBNc=";
+    hash = "sha256-RGpVxrcFzKbHxV7o0/OYaADo/Pqxx/c+FaxcV05gHGU=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail 'requires = ["setuptools==80.9.0", "setuptools-scm==9.2.0"]' \
+                     'requires = ["setuptools", "setuptools-scm"]'
+
+    # Upstream's datasets guard says only 4.4.0 and 4.4.1 recurse, but the
+    # current check blocks the whole 4.4.0 .. 4.5.0 range. Narrow it to the
+    # versions the upstream comment actually calls out.
+    substituteInPlace unsloth/import_fixes.py \
+      --replace-fail 'if (datasets_version <= Version("4.5.0")) and (' \
+                     'if (datasets_version <= Version("4.4.1")) and ('
+
+    # Strip AGPL-licensed CLI, Studio, and grouped-GEMM sources from the
+    # Apache-licensed Python package.
+    rm -rf \
+      unsloth_cli \
+      studio \
+      unsloth/kernels/moe \
+      COPYING
+
+    # Drop the entry point after removing the CLI package above.
+    sed -i '/^\[project\.scripts\]/,/^$/d' pyproject.toml
+  '';
+
   build-system = [
     setuptools
     setuptools-scm
@@ -72,6 +97,7 @@ buildPythonPackage (finalAttrs: {
     bitsandbytes
     numpy
     packaging
+    psutil
     torch
     unsloth-zoo
     xformers
@@ -90,8 +116,7 @@ buildPythonPackage (finalAttrs: {
     torchvision
   ];
 
-  # pyproject.toml requires an obsolete version of protobuf,
-  # but it is not used.
+  # pyproject.toml pins obsolete versions for several runtime deps.
   # Upstream issue: https://github.com/unslothai/unsloth-zoo/pull/68
   pythonRelaxDeps = [
     "datasets"
@@ -100,6 +125,17 @@ buildPythonPackage (finalAttrs: {
     "torch"
   ];
 
+  # Upstream currently lists CLI/studio dependencies as runtime requirements,
+  # but they are not part of the packaged library here.
+  pythonRemoveDeps = [
+    "tyro"
+    "wheel"
+    "typer"
+    "pydantic"
+    "pyyaml"
+    "nest-asyncio"
+  ];
+
   # The source repository contains no test
   doCheck = false;
 
@@ -107,8 +143,8 @@ buildPythonPackage (finalAttrs: {
   # NotImplementedError: Unsloth: No NVIDIA GPU found? Unsloth currently only supports GPUs!
   dontUsePythonImportsCheck = true;
 
-  passthru.tests = {
-    qlora-train-and-merge =
+  passthru.tests = rec {
+    cuda =
       # FIXME: Replace python3.pkgs with python3Packages once possible, as to unbeak splicing.
       # Cf. https://github.com/NixOS/nixpkgs/pull/394838#issuecomment-3319287038
       cudaPackages.writeGpuTestPython.override { python3Packages = python.pkgs; }
@@ -135,6 +171,8 @@ buildPythonPackage (finalAttrs: {
               run_name="__main__"
           )
         '';
+
+    qlora-train-and-merge = cuda;
   };
 
   meta = {
diff --git a/pkgs/development/python-modules/vivisect/default.nix b/pkgs/development/python-modules/vivisect/default.nix
index b229576a0a7c..2402baf230f9 100644
--- a/pkgs/development/python-modules/vivisect/default.nix
+++ b/pkgs/development/python-modules/vivisect/default.nix
@@ -16,12 +16,12 @@
 
 buildPythonPackage rec {
   pname = "vivisect";
-  version = "1.3.0";
+  version = "1.3.2";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-sI/xlbodbud5GJ3s9atmDS1KOD7VYs7B3OdYCx1NgE4=";
+    hash = "sha256-UQryZ4aGVEr5vRLElmTwRNtgi3h6CPzzq5n+E58tuo8=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix b/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
index 75a74bbf40f4..f1d822c347c8 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
@@ -2561,9 +2561,9 @@
   };
 
   t32 = {
-    version = "7.2.5";
+    version = "7.2.6";
     url = "github:xasc/tree-sitter-t32";
-    hash = "sha256-ysdKgzF5VFV0BeeXlV8gZ5pW7WzYJtYnyBE+MaxG3Jo=";
+    hash = "sha256-r89C29D8N8E+MJi+RUxTE0+Y/e4ykLzIDaw/AQHegLc=";
     meta = {
       maintainers = with lib.maintainers; [
         aciceri
diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index ac5ed40f5f32..709f3d838af5 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -107,11 +107,11 @@ rec {
   # Vulkan developer beta driver
   # See here for more information: https://developer.nvidia.com/vulkan-driver
   vulkan_beta = generic rec {
-    version = "595.44.03";
+    version = "595.44.05";
     persistencedVersion = "595.45.04";
     settingsVersion = "595.45.04";
-    sha256_64bit = "sha256-hKRUCKRnBlydG5Qe9pYjSCKWvSc8cb5K8L2tiup3Q+0=";
-    openSha256 = "sha256-zSnUuqxsFGLzDLC5BLKr1zljfbDiOqc/K5MusBeoP54=";
+    sha256_64bit = "sha256-fOUoqTUFXYQyDxj67egK3o4O0Z6hbfNypnSehW24K8Y=";
+    openSha256 = "sha256-jSJqpWMdITf8jdxTSGQHC9jlNbhffAdY8N+Zd7sTHqQ=";
     settingsSha256 = "sha256-Y45pryyM+6ZTJyRaRF3LMKaiIWxB5gF5gGEEcQVr9nA=";
     persistencedSha256 = "sha256-5FoeUaRRMBIPEWGy4Uo0Aho39KXmjzQsuAD9m/XkNpA=";
     url = "https://developer.nvidia.com/downloads/vulkan-beta-${lib.concatStrings (lib.splitVersion version)}-linux";
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 38ce2a96e8ba..c3268e5a62ce 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -950,7 +950,8 @@
       ];
     "chess_com" =
       ps: with ps; [
-      ]; # missing inputs: chess-com-api
+        chess-com-api
+      ];
     "cisco_ios" =
       ps: with ps; [
         pexpect
@@ -1975,7 +1976,8 @@
       ];
     "freshr" =
       ps: with ps; [
-      ]; # missing inputs: pyfreshr
+        pyfreshr
+      ];
     "fressnapf_tracker" =
       ps: with ps; [
         fressnapftracker
@@ -2528,11 +2530,12 @@
         fnv-hash-fast
         ha-ffmpeg
         hap-python
+        homekit-audio-proxy
         ifaddr
         pyqrcode
         pyturbojpeg
         zeroconf
-      ]; # missing inputs: homekit-audio-proxy
+      ];
     "homekit_controller" =
       ps: with ps; [
         aioesphomeapi
@@ -4911,7 +4914,8 @@
       ];
     "prana" =
       ps: with ps; [
-      ]; # missing inputs: prana-api-client
+        prana-api-client
+      ];
     "private_ble_device" =
       ps: with ps; [
         aioesphomeapi
@@ -7497,6 +7501,7 @@
     "ccm15"
     "cert_expiry"
     "chacon_dio"
+    "chess_com"
     "clicksend_tts"
     "climate"
     "cloud"
@@ -7652,6 +7657,7 @@
     "freebox"
     "freedns"
     "freedompro"
+    "freshr"
     "fressnapf_tracker"
     "fritz"
     "fritzbox"
@@ -7743,6 +7749,7 @@
     "homeassistant_sky_connect"
     "homeassistant_yellow"
     "homee"
+    "homekit"
     "homekit_controller"
     "homematic"
     "homematicip_cloud"
@@ -8086,6 +8093,7 @@
     "powerfox"
     "powerfox_local"
     "powerwall"
+    "prana"
     "private_ble_device"
     "probe_plus"
     "profiler"
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index dc6568ece2b0..8a21ae262dab 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2693,6 +2693,8 @@ self: super: with self; {
 
   chess = callPackage ../development/python-modules/chess { };
 
+  chess-com-api = callPackage ../development/python-modules/chess-com-api { };
+
   chevron = callPackage ../development/python-modules/chevron { };
 
   chex = callPackage ../development/python-modules/chex { };
@@ -7112,6 +7114,8 @@ self: super: with self; {
 
   homeconnect = callPackage ../development/python-modules/homeconnect { };
 
+  homekit-audio-proxy = callPackage ../development/python-modules/homekit-audio-proxy { };
+
   homelink-integration-api = callPackage ../development/python-modules/homelink-integration-api { };
 
   homematicip = callPackage ../development/python-modules/homematicip { };
@@ -12773,6 +12777,8 @@ self: super: with self; {
 
   pq = callPackage ../development/python-modules/pq { };
 
+  prana-api-client = callPackage ../development/python-modules/prana-api-client { };
+
   prance = callPackage ../development/python-modules/prance { };
 
   praw = callPackage ../development/python-modules/praw { };
@@ -13778,6 +13784,8 @@ self: super: with self; {
 
   pyfreedompro = callPackage ../development/python-modules/pyfreedompro { };
 
+  pyfreshr = callPackage ../development/python-modules/pyfreshr { };
+
   pyfribidi = callPackage ../development/python-modules/pyfribidi { };
 
   pyfritzhome = callPackage ../development/python-modules/pyfritzhome { };
@@ -19598,6 +19606,18 @@ self: super: with self; {
 
   transaction = callPackage ../development/python-modules/transaction { };
 
+  transformer-engine = callPackage ../development/python-modules/transformer-engine { };
+
+  transformer-engine-jax = transformer-engine.override {
+    withJax = true;
+    withPytorch = false;
+  };
+
+  transformer-engine-pytorch = transformer-engine.override {
+    withJax = false;
+    withPytorch = true;
+  };
+
   transformers = callPackage ../development/python-modules/transformers { };
 
   transformers_4 = callPackage ../development/python-modules/transformers/4.nix { };