diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 23ad08728f6e..ff8ee5068117 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -62,7 +62,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@2126ae7fc54c9df00dd18f7f18754393182c73cd # v31.9.1
+      - uses: cachix/install-nix-action@1ca7d21a94afc7c957383a2d217460d980de4934 # v31.10.1
         with:
           # Sandbox is disabled on MacOS by default.
           extra_nix_config: sandbox = true
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 292e47fbcf23..5162580ed80b 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -85,7 +85,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@2126ae7fc54c9df00dd18f7f18754393182c73cd # v31.9.1
+      - uses: cachix/install-nix-action@1ca7d21a94afc7c957383a2d217460d980de4934 # v31.10.1
 
       - uses: cachix/cachix-action@3ba601ff5bbb07c7220846facfa2cd81eeee15a1 # v16
         continue-on-error: true
diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml
index 69780b53957c..4db9079e186f 100644
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -132,7 +132,7 @@ jobs:
             core.info(`Found pinned.json commit: ${ciPinBumpCommit}`)
 
       - name: Install Nix
-        uses: cachix/install-nix-action@2126ae7fc54c9df00dd18f7f18754393182c73cd # v31.9.1
+        uses: cachix/install-nix-action@1ca7d21a94afc7c957383a2d217460d980de4934 # v31.10.1
 
       - name: Load supported versions
         id: versions
@@ -180,7 +180,7 @@ jobs:
           target-as-trusted-at: ${{ inputs.targetSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@2126ae7fc54c9df00dd18f7f18754393182c73cd # v31.9.1
+        uses: cachix/install-nix-action@1ca7d21a94afc7c957383a2d217460d980de4934 # v31.10.1
 
       - uses: cachix/cachix-action@3ba601ff5bbb07c7220846facfa2cd81eeee15a1 # v16
         continue-on-error: true
@@ -270,7 +270,7 @@ jobs:
           merge-multiple: true
 
       - name: Install Nix
-        uses: cachix/install-nix-action@2126ae7fc54c9df00dd18f7f18754393182c73cd # v31.9.1
+        uses: cachix/install-nix-action@1ca7d21a94afc7c957383a2d217460d980de4934 # v31.10.1
 
       - name: Combine all output paths and eval stats
         run: |
@@ -451,7 +451,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@2126ae7fc54c9df00dd18f7f18754393182c73cd # v31.9.1
+        uses: cachix/install-nix-action@1ca7d21a94afc7c957383a2d217460d980de4934 # v31.10.1
 
       - name: Ensure flake outputs on all systems still evaluate
         run: nix flake check --all-systems --no-build './nixpkgs/untrusted?shallow=1'
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index fee21209f727..860e4538b484 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -35,7 +35,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@2126ae7fc54c9df00dd18f7f18754393182c73cd # v31.9.1
+      - uses: cachix/install-nix-action@1ca7d21a94afc7c957383a2d217460d980de4934 # v31.10.1
 
       # TODO: Figure out how to best enable caching for the treefmt job. Cachix won't work well,
       # because the cache would be invalidated on every commit - treefmt checks every file.
@@ -70,7 +70,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@2126ae7fc54c9df00dd18f7f18754393182c73cd # v31.9.1
+      - uses: cachix/install-nix-action@1ca7d21a94afc7c957383a2d217460d980de4934 # v31.10.1
 
       - uses: cachix/cachix-action@3ba601ff5bbb07c7220846facfa2cd81eeee15a1 # v16
         continue-on-error: true
@@ -100,7 +100,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@2126ae7fc54c9df00dd18f7f18754393182c73cd # v31.9.1
+      - uses: cachix/install-nix-action@1ca7d21a94afc7c957383a2d217460d980de4934 # v31.10.1
 
       - uses: cachix/cachix-action@3ba601ff5bbb07c7220846facfa2cd81eeee15a1 # v16
         continue-on-error: true
diff --git a/nixos/tests/opencloud.nix b/nixos/tests/opencloud.nix
index 1fdac34b6ccd..919ed99f4b5d 100644
--- a/nixos/tests/opencloud.nix
+++ b/nixos/tests/opencloud.nix
@@ -41,7 +41,7 @@ let
         driver.find_element(By.ID, 'oc-login-password').send_keys(password)
         wait.until(EC.visibility_of_element_located((By.XPATH, '//button[@type="submit"]')))
         driver.find_element(By.XPATH, '//button[@type="submit"]').click()
-        wait.until(EC.visibility_of_element_located((By.ID, 'new-file-menu-btn')))
+        wait.until(EC.visibility_of_element_located((By.ID, 'app-floating-action-button-com-github-opencloud-eu-web-files-floating-action-button')))
         wait.until(EC.title_contains("Personal"))
       '';
 in
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 0788779e1d90..515ec8db3c43 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -526,11 +526,11 @@
     "vendorHash": null
   },
   "hashicorp_azurerm": {
-    "hash": "sha256-sg6CJVQJybbYghcp8dBhm2B7xvmsuUS7Je2jmGZHwZE=",
+    "hash": "sha256-6SzcMWDKloX8qmBW8sGKOAKVxFVegaSYSm7xSZBS3p4=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/azurerm",
     "owner": "hashicorp",
     "repo": "terraform-provider-azurerm",
-    "rev": "v4.63.0",
+    "rev": "v4.64.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1409,11 +1409,11 @@
     "vendorHash": "sha256-OVdhM8Zqnm1J8KducnkNkroBoSLER3fHfZBjyp7kBu8="
   },
   "ucloud_ucloud": {
-    "hash": "sha256-UOVnfWYhntmRHMApQgemjUBsyUIz0bexsc1gwDGGee4=",
+    "hash": "sha256-lDLYp0ApFCV6XYCxCunkpFwEXpACoChQWLx2bHTjeQs=",
     "homepage": "https://registry.terraform.io/providers/ucloud/ucloud",
     "owner": "ucloud",
     "repo": "terraform-provider-ucloud",
-    "rev": "v1.39.2",
+    "rev": "v1.39.3",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
diff --git a/pkgs/by-name/an/annotator/package.nix b/pkgs/by-name/an/annotator/package.nix
index 554d2dad4c29..17d1935b7f6e 100644
--- a/pkgs/by-name/an/annotator/package.nix
+++ b/pkgs/by-name/an/annotator/package.nix
@@ -8,30 +8,26 @@
   vala,
   wrapGAppsHook4,
   desktop-file-utils,
-  gtk3,
+  shared-mime-info,
+  libarchive,
   libgee,
   pantheon,
   libxml2,
-  libhandy,
   libportal-gtk4,
+  libwebp,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "annotator";
-  version = "2.0.0";
+  version = "2.0.2";
 
   src = fetchFromGitHub {
     owner = "phase1geo";
     repo = "annotator";
     tag = finalAttrs.version;
-    hash = "sha256-mv3fMlYB4XcAWI6O6wN8ujNRDLZlX3ef/gKdOMYEHq0=";
+    hash = "sha256-nJxms/df5OnASbdj4a2IjHyRT5PA2EaKHkBoQsyv8T8=";
   };
 
-  postPatch = ''
-    substituteInPlace src/Application.vala \
-      --replace-fail 'Environment.set_variable( "GDK_BACKEND", "x11", true );' ""
-  '';
-
   nativeBuildInputs = [
     pkg-config
     meson
@@ -39,15 +35,16 @@ stdenv.mkDerivation (finalAttrs: {
     vala
     wrapGAppsHook4
     desktop-file-utils
+    shared-mime-info
   ];
 
   buildInputs = [
+    libarchive
     libgee
     pantheon.granite7
     libportal-gtk4
     libxml2
-    libhandy
-    gtk3
+    libwebp
   ];
 
   meta = {
diff --git a/pkgs/by-name/bc/bcachefs-tools/package.nix b/pkgs/by-name/bc/bcachefs-tools/package.nix
index cd0e5ccdf6c0..ae7d54d1fb08 100644
--- a/pkgs/by-name/bc/bcachefs-tools/package.nix
+++ b/pkgs/by-name/bc/bcachefs-tools/package.nix
@@ -29,18 +29,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bcachefs-tools";
-  version = "1.37.1";
+  version = "1.37.2";
 
   src = fetchFromGitHub {
     owner = "koverstreet";
     repo = "bcachefs-tools";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6w7Ig6wJKmWxkS730CZKFkEqefIQDJI+OJHPPJ3aPEk=";
+    hash = "sha256-q0/WRO52KZr/7ogZ+xb3UxpBB3Y63Ti1mwkDwypP2iw=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src;
-    hash = "sha256-mNexPIDeUwJYKsM8Hzeh5opfLk9Wf4bHRlwUZLnLAKo=";
+    hash = "sha256-UqpznSuuSXCzoNovOrLhWcuiOtkyY9iM2Uu0g9J7ZZE=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/be/beekeeper-studio/package.nix b/pkgs/by-name/be/beekeeper-studio/package.nix
index 1bc44c76b8df..b0d95f2f9955 100644
--- a/pkgs/by-name/be/beekeeper-studio/package.nix
+++ b/pkgs/by-name/be/beekeeper-studio/package.nix
@@ -39,7 +39,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "beekeeper-studio";
-  version = "5.6.0";
+  version = "5.6.2";
 
   src =
     let
@@ -54,10 +54,10 @@ stdenv.mkDerivation (finalAttrs: {
     fetchurl {
       url = "https://github.com/beekeeper-studio/beekeeper-studio/releases/download/v${finalAttrs.version}/${asset}";
       hash = selectSystem {
-        x86_64-linux = "sha256-dqwB1kCUL3DetfFCsBVh3xq3fNKSOMabJepDV7DpLGA=";
-        aarch64-linux = "sha256-dv321Lszm+xJiXK4Hfi0ij7TvkuJx8o8mepWjGnGBD8=";
-        x86_64-darwin = "sha256-AQb+HcLP+7e+SuqKWxHH+O2O6/Daf14CuTQj90T2yoo=";
-        aarch64-darwin = "sha256-tJ2N3KtdC4VNXe0lKSb9cD3YF61GRc5/kpSZw9TNkb4=";
+        x86_64-linux = "sha256-s1Smb8du7pZjcVMnLsJ39P28erApDLnf5lqO9rO7asw=";
+        aarch64-linux = "sha256-ZHFiIJ6zYYXjbEGGttvcNxnnKz+/4j8oQ1PsXAdeAUM=";
+        x86_64-darwin = "sha256-NasWIn1OA4LvewLbNzyMXuPXFvbvl41tpEN1xEC6jSk=";
+        aarch64-darwin = "sha256-DZUm7/3/wvyZDV3/HrK1glNo4pMWyt16z5B3FfSYdqw=";
       };
     };
 
diff --git a/pkgs/by-name/ca/cargo-tauri/hook.nix b/pkgs/by-name/ca/cargo-tauri/hook.nix
index 3b2f72f76be6..cb829f9a96a5 100644
--- a/pkgs/by-name/ca/cargo-tauri/hook.nix
+++ b/pkgs/by-name/ca/cargo-tauri/hook.nix
@@ -48,8 +48,18 @@ makeSetupHook {
     installScript =
       {
         darwin = ''
-          mkdir -p $out
-          mv "$targetDir"/bundle/macos $out/Applications
+          mkdir -p "$out/Applications"
+
+          shopt -s nullglob
+          appBundles=("$targetDir"/bundle/macos/*.app)
+          shopt -u nullglob
+
+          if [ "''${#appBundles[@]}" -eq 0 ]; then
+            echo "cargo-tauri.hook: no .app bundles found in $targetDir/bundle/macos" >&2
+            exit 1
+          fi
+
+          mv -- "''${appBundles[@]}" "$out/Applications/"
         '';
 
         linux = ''
diff --git a/pkgs/by-name/ca/cargo-tauri/test-app.nix b/pkgs/by-name/ca/cargo-tauri/test-app.nix
index 6a24f890a129..d2f442755197 100644
--- a/pkgs/by-name/ca/cargo-tauri/test-app.nix
+++ b/pkgs/by-name/ca/cargo-tauri/test-app.nix
@@ -64,10 +64,40 @@ stdenv.mkDerivation (finalAttrs: {
   preBuild = ''
     pnpm --filter '@tauri-apps/api' build
   '';
+  postBuild = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    bundleDir="target/${stdenv.hostPlatform.rust.cargoShortTarget}/''${cargoBuildType:-release}/bundle/macos"
+    touch "$bundleDir/.test-hidden-entry"
+    touch "$bundleDir/test-visible-entry"
+  '';
 
   # No one should be actually running this, so lets save some time
   buildType = "debug";
   doCheck = false;
+  doInstallCheck = stdenv.hostPlatform.isDarwin;
+  installCheckPhase = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    runHook preInstallCheck
+
+    test -d "$out/Applications"
+
+    shopt -s nullglob dotglob
+    appBundles=("$out"/Applications/*.app)
+    nonAppEntries=("$out"/Applications/*)
+    shopt -u nullglob dotglob
+
+    test "''${#appBundles[@]}" -gt 0
+
+    for entry in "''${nonAppEntries[@]}"; do
+      case "$entry" in
+        *.app) ;;
+        *)
+          echo "unexpected non-.app entry in Applications: $entry" >&2
+          exit 1
+          ;;
+      esac
+    done
+
+    runHook postInstallCheck
+  '';
 
   meta = {
     inherit (cargo-tauri.hook.meta) platforms;
diff --git a/pkgs/by-name/di/difftastic/package.nix b/pkgs/by-name/di/difftastic/package.nix
index 92895f658894..b53c44e0784c 100644
--- a/pkgs/by-name/di/difftastic/package.nix
+++ b/pkgs/by-name/di/difftastic/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "difftastic";
-  version = "0.67.0";
+  version = "0.68.0";
 
   src = fetchFromGitHub {
     owner = "wilfred";
     repo = "difftastic";
     tag = finalAttrs.version;
-    hash = "sha256-AgY/v1z4ETHawT+yEwTEaPOLC9GmhR8bGUUBKHY/meQ=";
+    hash = "sha256-4CkAifz48qLegXTBmXqJe3+LAE1uCUUb28ZgXTVggOk=";
   };
 
-  cargoHash = "sha256-TTg5Cky1exlvJokIw1IFGbPq4eJe2xSAPsGgI7BU+Jw=";
+  cargoHash = "sha256-MwoRr8aQAT5plkfapAY2oPrSYYmHGeqxOhCpOMEtUoc=";
 
   buildInputs = [ rust-jemalloc-sys ];
 
diff --git a/pkgs/by-name/fa/fairywren/package.nix b/pkgs/by-name/fa/fairywren/package.nix
index 784e24f91d0c..f4f088297df6 100644
--- a/pkgs/by-name/fa/fairywren/package.nix
+++ b/pkgs/by-name/fa/fairywren/package.nix
@@ -22,13 +22,13 @@ lib.checkListOfEnum "${pname}: colorVariants" colorVariantList colorVariants
   stdenvNoCC.mkDerivation
   {
     inherit pname;
-    version = "0-unstable-2026-03-08";
+    version = "0-unstable-2026-03-16";
 
     src = fetchFromGitLab {
       owner = "aiyahm";
       repo = "FairyWren-Icons";
-      rev = "07bcdd4e83c4d46a698a4af60b9b8acc422af39f";
-      hash = "sha256-Gzr3AiVD+IFnJa3X3wp8CAFl6SL/gD3dCrFGMDHDMos=";
+      rev = "612fd0b98b1b566d772f8e1ecfe60ae2b4f281ce";
+      hash = "sha256-D/iR0+fO/j3e4mdyDs/qrUQMlzatICnoUcTAwOLRfxs=";
     };
 
     propagatedBuildInputs = [
diff --git a/pkgs/by-name/fe/feishu-cli/package.nix b/pkgs/by-name/fe/feishu-cli/package.nix
index 84de18f5ca5f..30383ea0a68e 100644
--- a/pkgs/by-name/fe/feishu-cli/package.nix
+++ b/pkgs/by-name/fe/feishu-cli/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "feishu-cli";
-  version = "1.8.0";
+  version = "1.9.0";
 
   src = fetchFromGitHub {
     owner = "riba2534";
     repo = "feishu-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7o5WMUhmA9BEjmz55E90DS6BKHKZhNfo1WV0jdJVrkw=";
+    hash = "sha256-yawSIznUCu0rTs4CcVEbPf8jubgLNIO0hCUwmAFukgk=";
   };
 
   vendorHash = "sha256-MZv772U+3+Fcanaiuhz+OCqfIsYyCG7B4iZOnEftbi8=";
diff --git a/pkgs/by-name/ga/gamescope/package.nix b/pkgs/by-name/ga/gamescope/package.nix
index 0627d0b65bc5..84e5a55e8b4f 100644
--- a/pkgs/by-name/ga/gamescope/package.nix
+++ b/pkgs/by-name/ga/gamescope/package.nix
@@ -62,14 +62,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gamescope";
-  version = "3.16.20";
+  version = "3.16.22";
 
   src = fetchFromGitHub {
     owner = "ValveSoftware";
     repo = "gamescope";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-o/mzamXrKxhxlGlYy9zW2VfVh4gHL/eNw4PuK138WYc=";
+    hash = "sha256-FuQkKguW00yI2w5nCctcxz7e1ZUKSWJOCIS1UMJzsMA=";
   };
 
   patches = [
diff --git a/pkgs/by-name/jj/jjui/package.nix b/pkgs/by-name/jj/jjui/package.nix
index b729e600c38b..da5ad2fd5f72 100644
--- a/pkgs/by-name/jj/jjui/package.nix
+++ b/pkgs/by-name/jj/jjui/package.nix
@@ -8,13 +8,13 @@
 }:
 buildGo125Module (finalAttrs: {
   pname = "jjui";
-  version = "0.10.1";
+  version = "0.10.2";
 
   src = fetchFromGitHub {
     owner = "idursun";
     repo = "jjui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-o648hMSoEa21GqK4VGSa4hf5KP5FVu80Ea5NB2QwII0=";
+    hash = "sha256-VTaOd5LSBxo6EhTyjoyAqX+wTEcm88qIgUCcd+TRYY4=";
   };
 
   vendorHash = "sha256-GDYgZI6X7UwnyKXOJVmqXXtm4ulA10uuX5MeqKVTheA=";
diff --git a/pkgs/by-name/mo/mongodb-tools/package.nix b/pkgs/by-name/mo/mongodb-tools/package.nix
index 5cfc8988eea5..e761483f9c97 100644
--- a/pkgs/by-name/mo/mongodb-tools/package.nix
+++ b/pkgs/by-name/mo/mongodb-tools/package.nix
@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "mongo-tools";
-  version = "100.14.1";
+  version = "100.15.0";
 
   src = fetchFromGitHub {
     owner = "mongodb";
     repo = "mongo-tools";
     tag = finalAttrs.version;
-    hash = "sha256-+3Cmaa0913TKj/nMmTxXQeegPEZ1NUdusTbKZ86LqLY=";
+    hash = "sha256-BiiqCVuwXLpLO2nksYBzJwDnJYk3vMVwVgldEdvxq78=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/ne/nextvi/package.nix b/pkgs/by-name/ne/nextvi/package.nix
index e02da16e332b..301af9eba50e 100644
--- a/pkgs/by-name/ne/nextvi/package.nix
+++ b/pkgs/by-name/ne/nextvi/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nextvi";
-  version = "4.0";
+  version = "4.1";
 
   src = fetchFromGitHub {
     owner = "kyx0r";
     repo = "nextvi";
     tag = finalAttrs.version;
-    hash = "sha256-zX4m4y/y9kt/9dfEauLry+LdgcvSs+3s1OVPL52Ecok=";
+    hash = "sha256-sk4vqMfRDP0H3DESZj57jGVo6Vf2hd9f9OaePFEtdfE=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/by-name/op/opencloud/idp-web.nix b/pkgs/by-name/op/opencloud/idp-web.nix
index 8cb818fe0ad5..523ef84ebbff 100644
--- a/pkgs/by-name/op/opencloud/idp-web.nix
+++ b/pkgs/by-name/op/opencloud/idp-web.nix
@@ -2,9 +2,7 @@
   stdenvNoCC,
   lib,
   opencloud,
-  applyPatches,
-  fetchpatch,
-  pnpm_10,
+  pnpm_9,
   fetchPnpmDeps,
   pnpmConfigHook,
   nodejs,
@@ -12,33 +10,22 @@
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "opencloud-idp-web";
 
-  inherit (opencloud) version;
-
-  src = applyPatches {
-    src = opencloud.src;
-    patches = [
-      # Fixes broken kopano tarball, remove in next version
-      (fetchpatch {
-        url = "https://github.com/opencloud-eu/opencloud/commit/212846f2f4e23e89ed675e5a689d87ba1de55b70.patch";
-        hash = "sha256-i+fkWTY4nrZ5fVGlQhhamxy9yrBL9OtDdm7CfV13oak=";
-      })
-    ];
-  };
+  inherit (opencloud) src version;
 
   pnpmRoot = "services/idp";
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
-    pnpm = pnpm_10;
+    pnpm = pnpm_9;
     sourceRoot = "${finalAttrs.src.name}/${finalAttrs.pnpmRoot}";
     fetcherVersion = 3;
-    hash = "sha256-W5odz//dONpBg4eRQQoVrBMVsEQVkkP89hzMdIXxG7w=";
+    hash = "sha256-AAAzo//YG5X2531C3vEhsLHRYJilRcomT5uTBSmzNmQ=";
   };
 
   nativeBuildInputs = [
     nodejs
     pnpmConfigHook
-    pnpm_10
+    pnpm_9
   ];
 
   buildPhase = ''
diff --git a/pkgs/by-name/op/opencloud/package.nix b/pkgs/by-name/op/opencloud/package.nix
index 56b42254e725..63bd38b4a70c 100644
--- a/pkgs/by-name/op/opencloud/package.nix
+++ b/pkgs/by-name/op/opencloud/package.nix
@@ -28,13 +28,13 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "opencloud";
-  version = "5.1.0";
+  version = "5.2.0";
 
   src = fetchFromGitHub {
     owner = "opencloud-eu";
     repo = "opencloud";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LZoQKXHDHHNLmu7FflQMCFUPlGS8eG7kZr8dmFku8Sk=";
+    hash = "sha256-lycqekiYAkNABl8144W8ZdUjAruc5OKp6c3FUSrLvOw=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/op/opencloud/web.nix b/pkgs/by-name/op/opencloud/web.nix
index 4cefe40349a0..c9e47597e9a7 100644
--- a/pkgs/by-name/op/opencloud/web.nix
+++ b/pkgs/by-name/op/opencloud/web.nix
@@ -10,20 +10,20 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "opencloud-web";
-  version = "5.1.0";
+  version = "6.0.0";
 
   src = fetchFromGitHub {
     owner = "opencloud-eu";
     repo = "web";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Xx/uDn4m7Uu+4GMNB9vqsT+CozXhEo+2YGRMaMrjldM=";
+    hash = "sha256-eHu12DcP2LFJaRBX6WEieucS0HkSi231ZtUSZlunCuo=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_10;
     fetcherVersion = 3;
-    hash = "sha256-tPU16r0hc0DYwGnvnukivUz3a+Bz6urUZPtokN/lbuA=";
+    hash = "sha256-YOu0a/mR4PiRQx03BkPQbZgGQzgqXHy9DDihm8aD3wc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ox/oxfmt/package.nix b/pkgs/by-name/ox/oxfmt/package.nix
index b4bc90854a61..ac3a4efa04b8 100644
--- a/pkgs/by-name/ox/oxfmt/package.nix
+++ b/pkgs/by-name/ox/oxfmt/package.nix
@@ -21,33 +21,25 @@
 # A pure Rust build would lack the Prettier plugin functionality.
 stdenv.mkDerivation (finalAttrs: {
   pname = "oxfmt";
-  version = "0.27.0";
+  version = "0.40.0";
 
   src = fetchFromGitHub {
     owner = "oxc-project";
     repo = "oxc";
     tag = "oxfmt_v${finalAttrs.version}";
-    hash = "sha256-EAM1DxA/TqnIRN5Tlvg5/jvbyOUtSuwQ4RCBeO9esCw=";
+    hash = "sha256-A2cq1WgZg8csNGB3yFNo21450f46n4ZVblke1yqlBCc=";
   };
 
-  # Remove patchedDependencies from both workspace and lockfile
-  # to avoid LOCKFILE_CONFIG_MISMATCH error
-  postPatch = ''
-    substituteInPlace pnpm-workspace.yaml pnpm-lock.yaml \
-      --replace-fail "patchedDependencies:" "_patchedDependencies:"
-  '';
-
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-okwkhcT6mekIvo52T8eSrXUcp/LQhcEYvHyIc5CLdrE=";
+    hash = "sha256-Oz9u2+5lq+z9A81BEn2T4jvVMqf1uNXip+OH4AxiTG0=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_10;
     fetcherVersion = 2;
-    hash = "sha256-GOsSTfM93VgGhVlgzXhJIJG9MSf306cEnRru/aTA+oY=";
-    prePnpmInstall = finalAttrs.postPatch;
+    hash = "sha256-iO1MRUTO8Ce1YGH/qDWQmdfvTfvsmgwGBaybWw3wiu0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/rt/rtk/package.nix b/pkgs/by-name/rt/rtk/package.nix
index 38000f7873b6..66c6628858b6 100644
--- a/pkgs/by-name/rt/rtk/package.nix
+++ b/pkgs/by-name/rt/rtk/package.nix
@@ -2,28 +2,31 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
+  makeWrapper,
   pkg-config,
   sqlite,
+  gitMinimal,
   writableTmpDirAsHomeHook,
   versionCheckHook,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rtk";
-  version = "0.29.0";
+  version = "0.30.0";
 
   src = fetchFromGitHub {
     owner = "rtk-ai";
     repo = "rtk";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QGHCa8rO4YBFXdrz78FhWKFxY7DmRxCXM8iYQv4yTYE=";
+    hash = "sha256-aB9SWF9jYHeH3Apz5v4mQptLa6tS9cIfyfo6rHqsD8w=";
   };
 
   strictDeps = true;
 
-  cargoHash = "sha256-gNJjtQah7NFSgFVYJftK19dECzDvLCi2E33na2PtKmc=";
+  cargoHash = "sha256-0dpZRBPubzd2GuK02/jbNBWOR/TpFM5lVMucEii/JxM=";
 
   nativeBuildInputs = [
+    makeWrapper
     pkg-config
   ];
 
@@ -31,7 +34,17 @@ rustPlatform.buildRustPackage (finalAttrs: {
     sqlite
   ];
 
+  postInstall = ''
+    wrapProgram $out/bin/rtk \
+      --prefix PATH : ${
+        lib.makeBinPath [
+          gitMinimal
+        ]
+      }
+  '';
+
   nativeCheckInputs = [
+    gitMinimal
     writableTmpDirAsHomeHook
   ];
 
diff --git a/pkgs/by-name/su/supertux/package.nix b/pkgs/by-name/su/supertux/package.nix
index 49d2eee58529..57db6eef0b59 100644
--- a/pkgs/by-name/su/supertux/package.nix
+++ b/pkgs/by-name/su/supertux/package.nix
@@ -19,48 +19,19 @@
   openal,
   libogg,
   libvorbis,
+  physfs,
+  fmt,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "supertux";
-  version = "0.6.3";
+  version = "0.7.0";
 
   src = fetchurl {
     url = "https://github.com/SuperTux/supertux/releases/download/v${finalAttrs.version}/SuperTux-v${finalAttrs.version}-Source.tar.gz";
-    sha256 = "1xkr3ka2sxp5s0spp84iv294i29s1vxqzazb6kmjc0n415h0x57p";
+    hash = "sha256-MvxbmbmZTtWOWDQdbyHekldks4ElbhCFkRNt5TvDHaU=";
   };
 
-  postPatch = ''
-    sed '1i#include <memory>' -i external/partio_zip/zip_manager.hpp # gcc12
-    # Fix build with cmake 4. Remove for version >= 0.6.4.
-    # See <https://github.com/SuperTux/supertux/pull/3093>
-    substituteInPlace CMakeLists.txt --replace-fail \
-      'cmake_minimum_required(VERSION 3.1)' \
-      'cmake_minimum_required(VERSION 4.0)'
-    substituteInPlace external/physfs/CMakeLists.txt --replace-fail \
-      'cmake_minimum_required(VERSION 2.8.12)' \
-      'cmake_minimum_required(VERSION 4.0)'
-    substituteInPlace external/sexp-cpp/CMakeLists.txt --replace-fail \
-      'cmake_minimum_required(VERSION 3.0)' \
-      'cmake_minimum_required(VERSION 4.0)'
-    substituteInPlace external/squirrel/CMakeLists.txt --replace-fail \
-      'cmake_minimum_required(VERSION 2.8)' \
-      'cmake_minimum_required(VERSION 4.0)'
-    substituteInPlace external/tinygettext/CMakeLists.txt --replace-fail \
-      'cmake_minimum_required(VERSION 2.4)' \
-      'cmake_minimum_required(VERSION 4.0)'
-    substituteInPlace external/SDL_ttf/CMakeLists.txt --replace-fail \
-      'cmake_minimum_required(VERSION 3.0)' \
-      'cmake_minimum_required(VERSION 4.0)'
-    substituteInPlace external/discord-sdk/CMakeLists.txt --replace-fail \
-      'cmake_minimum_required (VERSION 3.2.0)' \
-      'cmake_minimum_required (VERSION 4.0)'
-    # Fix build with boost 1.89.
-    substituteInPlace CMakeLists.txt --replace-fail \
-      'find_package(Boost REQUIRED COMPONENTS filesystem system date_time locale)' \
-      'find_package(Boost REQUIRED COMPONENTS filesystem date_time locale)'
-  '';
-
   nativeBuildInputs = [
     pkg-config
     cmake
@@ -82,6 +53,8 @@ stdenv.mkDerivation (finalAttrs: {
     openal
     libogg
     libvorbis
+    physfs
+    fmt
   ];
 
   cmakeFlags = [ "-DENABLE_BOOST_STATIC_LIBS=OFF" ];
diff --git a/pkgs/by-name/ve/venera/git-hashes.json b/pkgs/by-name/ve/venera/git-hashes.json
index 87616e3a449d..a0160184f002 100644
--- a/pkgs/by-name/ve/venera/git-hashes.json
+++ b/pkgs/by-name/ve/venera/git-hashes.json
@@ -13,7 +13,6 @@
   "flutter_to_debian": "sha256-YapWHABZSRh33Do2jKaeOshFHe83Tq4dsGGdOiB7REg=",
   "lodepng_flutter": "sha256-fOOhjoo3dzNNZI04Ie7GHLTfVlD5X+5IONpg8+RlmsE=",
   "photo_view": "sha256-zRc/WCbVybWkF52KDZZXgvKA8bbXASI7Yj2RFzLhXUk=",
-  "rhttp": "sha256-6AH7A+CJg60Vk0ph3cJwj29GkmJEezI/VuZvRqqmOYs=",
   "scrollable_positioned_list": "sha256-6XmBlNxE7DEqY2LsEFtVrshn2Xt55XnmaiTq+tiPInA=",
   "webdav_client": "sha256-euNF7HdDtZ68BqSEq9BvO10BK09MxX2wWGoElFS0yeE="
 }
diff --git a/pkgs/by-name/ve/venera/package.nix b/pkgs/by-name/ve/venera/package.nix
index af12c0dea5eb..60b873425482 100644
--- a/pkgs/by-name/ve/venera/package.nix
+++ b/pkgs/by-name/ve/venera/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  flutter338,
+  flutter341,
   fetchFromGitHub,
   webkitgtk_4_1,
   copyDesktopItems,
@@ -12,19 +12,16 @@
   dart,
 }:
 
-let
-  version = "1.6.2";
+flutter341.buildFlutterApplication (finalAttrs: {
+  pname = "venera";
+  version = "1.6.3";
 
   src = fetchFromGitHub {
     owner = "venera-app";
     repo = "venera";
-    tag = "v${version}";
-    hash = "sha256-hqpWkYXWM/kZU2kVAP2ak2TDZt3m4j4809rGhX68dek=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-UgQej91SsqyZzJaN3kQDHqJI3686W451wBTeTACXrV8=";
   };
-in
-flutter338.buildFlutterApplication {
-  pname = "venera";
-  inherit version src;
 
   pubspecLock = lib.importJSON ./pubspec.lock.json;
 
@@ -64,7 +61,7 @@ flutter338.buildFlutterApplication {
     pubspecSource =
       runCommand "pubspec.lock.json"
         {
-          inherit src;
+          inherit (finalAttrs) src;
           nativeBuildInputs = [ yq-go ];
         }
         ''
@@ -99,4 +96,4 @@ flutter338.buildFlutterApplication {
     maintainers = [ ];
     platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/by-name/ve/venera/pubspec.lock.json b/pkgs/by-name/ve/venera/pubspec.lock.json
index 01201f23a85a..c95039abb77c 100644
--- a/pkgs/by-name/ve/venera/pubspec.lock.json
+++ b/pkgs/by-name/ve/venera/pubspec.lock.json
@@ -4,11 +4,11 @@
       "dependency": "direct main",
       "description": {
         "name": "app_links",
-        "sha256": "85ed8fc1d25a76475914fff28cc994653bd900bc2c26e4b57a49e097febb54ba",
+        "sha256": "3462d9defc61565fde4944858b59bec5be2b9d5b05f20aed190adb3ad08a7abc",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.4.0"
+      "version": "7.0.0"
     },
     "app_links_linux": {
       "dependency": "transitive",
@@ -74,11 +74,11 @@
       "dependency": "direct main",
       "description": {
         "name": "battery_plus",
-        "sha256": "a0409fe7d21905987eb1348ad57c634f913166f14f0c8936b73d3f5940fac551",
+        "sha256": "ad16fcb55b7384be6b4bbc763d5e2031ac7ea62b2d9b6b661490c7b9741155bf",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.2.1"
+      "version": "7.0.0"
     },
     "battery_plus_platform_interface": {
       "dependency": "transitive",
@@ -114,11 +114,11 @@
       "dependency": "transitive",
       "description": {
         "name": "characters",
-        "sha256": "f71061c654a3380576a52b451dd5532377954cf9dbd272a78fc8479606670803",
+        "sha256": "faf38497bda5ead2a8c7615f4f7939df04333478bf32e4173fcb06d428b5716b",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.4.0"
+      "version": "1.4.1"
     },
     "clock": {
       "dependency": "transitive",
@@ -196,7 +196,7 @@
         "path": "packages/desktop_webview_window",
         "ref": "7801fc582ecf5a7351632887891ecf309a7b2583",
         "resolved-ref": "7801fc582ecf5a7351632887891ecf309a7b2583",
-        "url": "https://github.com/wgh136/flutter_desktop_webview"
+        "url": "https://github.com/venera-app/flutter_desktop_webview"
       },
       "source": "git",
       "version": "0.2.4"
@@ -205,11 +205,11 @@
       "dependency": "direct main",
       "description": {
         "name": "dio",
-        "sha256": "253a18bbd4851fecba42f7343a1df3a9a4c1d31a2c1b37e221086b4fa8c8dbc9",
+        "sha256": "aff32c08f92787a557dd5c0145ac91536481831a01b4648136373cddb0e64f8c",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "5.8.0+1"
+      "version": "5.9.2"
     },
     "dio_web_adapter": {
       "dependency": "transitive",
@@ -235,11 +235,11 @@
       "dependency": "direct main",
       "description": {
         "name": "dynamic_color",
-        "sha256": "eae98052fa6e2826bdac3dd2e921c6ce2903be15c6b7f8b6d8a5d49b5086298d",
+        "sha256": "43a5a6679649a7731ab860334a5812f2067c2d9ce6452cf069c5e0c25336c17c",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.7.0"
+      "version": "1.8.1"
     },
     "enough_convert": {
       "dependency": "direct main",
@@ -285,11 +285,11 @@
       "dependency": "direct main",
       "description": {
         "name": "file_selector",
-        "sha256": "5019692b593455127794d5718304ff1ae15447dea286cdda9f0db2a796a1b828",
+        "sha256": "bd15e43e9268db636b53eeaca9f56324d1622af30e5c34d6e267649758c84d9a",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.0.3"
+      "version": "1.1.0"
     },
     "file_selector_android": {
       "dependency": "transitive",
@@ -315,31 +315,31 @@
       "dependency": "transitive",
       "description": {
         "name": "file_selector_linux",
-        "sha256": "54cbbd957e1156d29548c7d9b9ec0c0ebb6de0a90452198683a7d23aed617a33",
+        "sha256": "2567f398e06ac72dcf2e98a0c95df2a9edd03c2c2e0cacd4780f20cdf56263a0",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.9.3+2"
+      "version": "0.9.4"
     },
     "file_selector_macos": {
       "dependency": "transitive",
       "description": {
         "name": "file_selector_macos",
-        "sha256": "271ab9986df0c135d45c3cdb6bd0faa5db6f4976d3e4b437cf7d0f258d941bfc",
+        "sha256": "5e0bbe9c312416f1787a68259ea1505b52f258c587f12920422671807c4d618a",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.9.4+2"
+      "version": "0.9.5"
     },
     "file_selector_platform_interface": {
       "dependency": "transitive",
       "description": {
         "name": "file_selector_platform_interface",
-        "sha256": "a3994c26f10378a039faa11de174d7b78eb8f79e4dd0af2a451410c1a5c3f66b",
+        "sha256": "35e0bd61ebcdb91a3505813b055b09b79dfdc7d0aee9c09a7ba59ae4bb13dc85",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.6.2"
+      "version": "2.7.0"
     },
     "file_selector_web": {
       "dependency": "transitive",
@@ -375,11 +375,11 @@
       "dependency": "direct main",
       "description": {
         "name": "flex_seed_scheme",
-        "sha256": "d3ba3c5c92d2d79d45e94b4c6c71d01fac3c15017da1545880c53864da5dfeb0",
+        "sha256": "a3183753bbcfc3af106224bff3ab3e1844b73f58062136b7499919f49f3667e7",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.5.0"
+      "version": "4.0.1"
     },
     "flutter": {
       "dependency": "direct main",
@@ -393,7 +393,7 @@
         "path": ".",
         "ref": "b33344797f1d2469339e0e1b75f5f954f1da224c",
         "resolved-ref": "b33344797f1d2469339e0e1b75f5f954f1da224c",
-        "url": "https://github.com/wgh136/flutter_7zip"
+        "url": "https://github.com/venera-app/flutter_7zip"
       },
       "source": "git",
       "version": "0.0.1"
@@ -402,11 +402,11 @@
       "dependency": "direct main",
       "description": {
         "name": "flutter_file_dialog",
-        "sha256": "9344b8f07be6a1b6f9854b723fb0cf84a8094ba94761af1d213589d3cb087488",
+        "sha256": "ec904d15e7da3691bb60442a762b0a09afa37ded7265b9fc2088ec202b7d844f",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.0.2"
+      "version": "3.0.3"
     },
     "flutter_inappwebview": {
       "dependency": "direct main",
@@ -537,7 +537,7 @@
         "path": ".",
         "ref": "8feae95df7fb00455df129ad7a0dfec1d0e8d8e4",
         "resolved-ref": "8feae95df7fb00455df129ad7a0dfec1d0e8d8e4",
-        "url": "https://github.com/wgh136/flutter_qjs"
+        "url": "https://github.com/venera-app/flutter_qjs"
       },
       "source": "git",
       "version": "0.3.7"
@@ -556,11 +556,11 @@
       "dependency": "transitive",
       "description": {
         "name": "flutter_rust_bridge",
-        "sha256": "b416ff56002789e636244fb4cc449f587656eff995e5a7169457eb0593fcaddb",
+        "sha256": "37ef40bc6f863652e865f0b2563ea07f0d3c58d8efad803cc01933a4b2ee067e",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.10.0"
+      "version": "2.11.1"
     },
     "flutter_saf": {
       "dependency": "direct main",
@@ -620,11 +620,11 @@
       "dependency": "transitive",
       "description": {
         "name": "freezed_annotation",
-        "sha256": "c2e2d632dd9b8a2b7751117abcfc2b4888ecfe181bd9fca7170d9ef02e595fe2",
+        "sha256": "7294967ff0a6d98638e7acb774aac3af2550777accd8149c90af5b014e6d44d8",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.4.4"
+      "version": "3.1.0"
     },
     "gtk": {
       "dependency": "transitive",
@@ -640,21 +640,21 @@
       "dependency": "direct main",
       "description": {
         "name": "html",
-        "sha256": "1fc58edeaec4307368c60d59b7e15b9d658b57d7f3125098b6294153c75337ec",
+        "sha256": "6d1264f2dffa1b1101c25a91dff0dc2daee4c18e87cd8538729773c073dbf602",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.15.5"
+      "version": "0.15.6"
     },
     "http": {
       "dependency": "transitive",
       "description": {
         "name": "http",
-        "sha256": "fe7ab022b76f3034adc518fb6ea04a82387620e19977665ea18d30a1cf43442f",
+        "sha256": "87721a4a50b19c7f1d49001e51409bddc46303966ce89a65af4f4e6004896412",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.3.0"
+      "version": "1.6.0"
     },
     "http_parser": {
       "dependency": "transitive",
@@ -750,51 +750,51 @@
       "dependency": "direct main",
       "description": {
         "name": "local_auth",
-        "sha256": "434d854cf478f17f12ab29a76a02b3067f86a63a6d6c4eb8fbfdcfe4879c1b7b",
+        "sha256": "ae6f382f638108c6becd134318d7c3f0a93875383a54010f61d7c97ac05d5137",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.3.0"
+      "version": "3.0.1"
     },
     "local_auth_android": {
       "dependency": "transitive",
       "description": {
         "name": "local_auth_android",
-        "sha256": "0abe4e72f55c785b28900de52a2522c86baba0988838b5dc22241b072ecccd74",
+        "sha256": "dc9663a7bc8ac33d7d988e63901974f63d527ebef260eabd19c479447cc9c911",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.0.48"
+      "version": "2.0.5"
     },
     "local_auth_darwin": {
       "dependency": "transitive",
       "description": {
         "name": "local_auth_darwin",
-        "sha256": "630996cd7b7f28f5ab92432c4b35d055dd03a747bc319e5ffbb3c4806a3e50d2",
+        "sha256": "a8c3d4e17454111f7fd31ff72a31222359f6059f7fe956c2dcfe0f88f49826d4",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.4.3"
+      "version": "2.0.3"
     },
     "local_auth_platform_interface": {
       "dependency": "transitive",
       "description": {
         "name": "local_auth_platform_interface",
-        "sha256": "1b842ff177a7068442eae093b64abe3592f816afd2a533c0ebcdbe40f9d2075a",
+        "sha256": "f98b8e388588583d3f781f6806e4f4c9f9e189d898d27f0c249b93a1973dd122",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.0.10"
+      "version": "1.1.0"
     },
     "local_auth_windows": {
       "dependency": "transitive",
       "description": {
         "name": "local_auth_windows",
-        "sha256": "bc4e66a29b0fdf751aafbec923b5bed7ad6ed3614875d8151afe2578520b2ab5",
+        "sha256": "be12c5b8ba5e64896983123655c5f67d2484ecfcc95e367952ad6e3bff94cb16",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.0.11"
+      "version": "2.0.1"
     },
     "lodepng_flutter": {
       "dependency": "direct main",
@@ -811,21 +811,21 @@
       "dependency": "transitive",
       "description": {
         "name": "matcher",
-        "sha256": "dc58c723c3c24bf8d3e2d3ad3f2f9d7bd9cf43ec6feaa64181775e60190153f2",
+        "sha256": "dc0b7dc7651697ea4ff3e69ef44b0407ea32c487a39fff6a4004fa585e901861",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.12.17"
+      "version": "0.12.19"
     },
     "material_color_utilities": {
       "dependency": "transitive",
       "description": {
         "name": "material_color_utilities",
-        "sha256": "f7142bb1154231d7ea5f96bc7bde4bda2a0945d2806bb11670e30b850d56bdec",
+        "sha256": "9c337007e82b1889149c82ed242ed1cb24a66044e30979c44912381e9be4c48b",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.11.1"
+      "version": "0.13.0"
     },
     "meta": {
       "dependency": "transitive",
@@ -943,7 +943,7 @@
         "path": ".",
         "ref": "a1255d1b5945aad4b7323303ec2ecdf0c90ffc4c",
         "resolved-ref": "a1255d1b5945aad4b7323303ec2ecdf0c90ffc4c",
-        "url": "https://github.com/wgh136/photo_view"
+        "url": "https://github.com/venera-app/photo_view"
       },
       "source": "git",
       "version": "0.14.0"
@@ -991,13 +991,12 @@
     "rhttp": {
       "dependency": "direct main",
       "description": {
-        "path": "rhttp",
-        "ref": "1f0ff50336062c5f809c256726dc55cd30b9ce59",
-        "resolved-ref": "1f0ff50336062c5f809c256726dc55cd30b9ce59",
-        "url": "https://github.com/wgh136/rhttp"
+        "name": "rhttp",
+        "sha256": "b111638045b730f825a85cb045017b5bd3dfb47b38e98eb293b0519ee6050f2e",
+        "url": "https://pub.dev"
       },
-      "source": "git",
-      "version": "0.12.0"
+      "source": "hosted",
+      "version": "0.15.1"
     },
     "screen_retriever": {
       "dependency": "transitive",
@@ -1064,21 +1063,21 @@
       "dependency": "direct main",
       "description": {
         "name": "share_plus",
-        "sha256": "fce43200aa03ea87b91ce4c3ac79f0cecd52e2a7a56c7a4185023c271fbfa6da",
+        "sha256": "14c8860d4de93d3a7e53af51bff479598c4e999605290756bbbe45cf65b37840",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "10.1.4"
+      "version": "12.0.1"
     },
     "share_plus_platform_interface": {
       "dependency": "transitive",
       "description": {
         "name": "share_plus_platform_interface",
-        "sha256": "cc012a23fc2d479854e6c80150696c4a5f5bb62cb89af4de1c505cf78d0a5d0b",
+        "sha256": "88023e53a13429bd65d8e85e11a9b484f49d4c190abbd96c7932b74d6927cc9a",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "5.0.2"
+      "version": "6.1.0"
     },
     "shimmer_animation": {
       "dependency": "direct main",
@@ -1200,11 +1199,11 @@
       "dependency": "transitive",
       "description": {
         "name": "test_api",
-        "sha256": "ab2726c1a94d3176a45960b6234466ec367179b87dd74f1611adb1f3b5fb9d55",
+        "sha256": "8161c84903fd860b26bfdefb7963b3f0b68fee7adea0f59ef805ecca346f0c7a",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.7.7"
+      "version": "0.7.10"
     },
     "typed_data": {
       "dependency": "transitive",
@@ -1230,11 +1229,11 @@
       "dependency": "direct main",
       "description": {
         "name": "url_launcher",
-        "sha256": "9d06212b1362abc2f0f0d78e6f09f726608c74e3b9462e8368bb03314aa8d603",
+        "sha256": "f6a7e5c4835bb4e3026a04793a4199ca2d14c739ec378fdfe23fc8075d0439f8",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.3.1"
+      "version": "6.3.2"
     },
     "url_launcher_android": {
       "dependency": "transitive",
@@ -1352,7 +1351,7 @@
         "path": ".",
         "ref": "2f669c98fb81cff1c64fee93466a1475c77e4273",
         "resolved-ref": "2f669c98fb81cff1c64fee93466a1475c77e4273",
-        "url": "https://github.com/wgh136/webdav_client"
+        "url": "https://github.com/venera-app/webdav_client"
       },
       "source": "git",
       "version": "1.2.2"
@@ -1371,11 +1370,11 @@
       "dependency": "direct main",
       "description": {
         "name": "window_manager",
-        "sha256": "732896e1416297c63c9e3fb95aea72d0355f61390263982a47fd519169dc5059",
+        "sha256": "7eb6d6c4164ec08e1bf978d6e733f3cebe792e2a23fb07cbca25c2872bfdbdcd",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.4.3"
+      "version": "0.5.1"
     },
     "xdg_directories": {
       "dependency": "transitive",
@@ -1419,7 +1418,7 @@
     }
   },
   "sdks": {
-    "dart": ">=3.8.0 <4.0.0",
-    "flutter": ">=3.38.5"
+    "dart": ">=3.10.0 <4.0.0",
+    "flutter": ">=3.41.4"
   }
 }
diff --git a/pkgs/by-name/vi/vicinae/package.nix b/pkgs/by-name/vi/vicinae/package.nix
index 03fed25c866e..8fc16180de49 100644
--- a/pkgs/by-name/vi/vicinae/package.nix
+++ b/pkgs/by-name/vi/vicinae/package.nix
@@ -23,13 +23,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "vicinae";
-  version = "0.20.5";
+  version = "0.20.7";
 
   src = fetchFromGitHub {
     owner = "vicinaehq";
     repo = "vicinae";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-k3rmWZlUYLMOT33AvwZ56eZfjNc6KXH2AN5Fe8LDKFM=";
+    hash = "sha256-tfx8byB4/LaNA7dsR4zIMtZHSBX8mvYK6jCvQlfVx0E=";
   };
 
   apiDeps = fetchNpmDeps {
@@ -84,6 +84,10 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   postPatch = ''
+    # Toggle telemetry from opt-out to opt-in
+    substituteInPlace extra/config.jsonc \
+      --replace-fail '"system_info": true' '"system_info": false'
+
     local postPatchHooks=()
     source ${npmHooks.npmConfigHook}/nix-support/setup-hook
     npmRoot=src/typescript/api npmDeps=${finalAttrs.apiDeps} npmConfigHook
diff --git a/pkgs/by-name/we/websurfx/package.nix b/pkgs/by-name/we/websurfx/package.nix
index e4c87df7c08b..8121883ff62b 100644
--- a/pkgs/by-name/we/websurfx/package.nix
+++ b/pkgs/by-name/we/websurfx/package.nix
@@ -6,7 +6,7 @@
   pkg-config,
 }:
 let
-  version = "1.24.51";
+  version = "1.24.56";
 in
 rustPlatform.buildRustPackage {
   pname = "websurfx";
@@ -16,7 +16,7 @@ rustPlatform.buildRustPackage {
     owner = "neon-mmd";
     repo = "websurfx";
     tag = "v${version}";
-    hash = "sha256-uIEYc5cP7LcqyubLhLXsGr8nhIzJrwzw1rKXF6KJMw8=";
+    hash = "sha256-Efv8eykAPy2nR0cK92q3nSCIykwimaDIwZYy1M93kUE=";
   };
 
   nativeBuildInputs = [
@@ -27,7 +27,7 @@ rustPlatform.buildRustPackage {
     openssl
   ];
 
-  cargoHash = "sha256-4rdYL84feUo/xeOMot58Jw8/wWnOtNXqDEQ/mOXhrRs=";
+  cargoHash = "sha256-Nb2DV1zf3EMdVaU397y5wNZksNzUdf3YvtoNrgUQB+w=";
 
   postPatch = ''
     substituteInPlace src/handler.rs \
diff --git a/pkgs/by-name/yu/yubihsm-shell/package.nix b/pkgs/by-name/yu/yubihsm-shell/package.nix
index 3cec92b5d7b7..f9214e5c4231 100644
--- a/pkgs/by-name/yu/yubihsm-shell/package.nix
+++ b/pkgs/by-name/yu/yubihsm-shell/package.nix
@@ -94,6 +94,12 @@ stdenv.mkDerivation (finalAttrs: {
     # so we expect a failure here, but it should at least try to connect
     yubihsm-connector -d </dev/null 1>&2 2>connector.log &
     yubihsm_pid=$!
+    idx=0
+    while ! grep takeoff connector.log >/dev/null && [ $idx -lt 10 ]; do
+      idx=$((idx+1))
+      echo "Waiting for yubihsm-connector startup (try: $idx)" >&2
+      sleep 1
+    done
     $out/bin/yubihsm-shell -Pv1 </dev/null || true
     kill -INT "$yubihsm_pid" && { wait "$yubihsm_pid" || true; }
     cat connector.log >&2
diff --git a/pkgs/development/compilers/dart/package-source-builders/rhttp/default.nix b/pkgs/development/compilers/dart/package-source-builders/rhttp/default.nix
index 675a6fb06df7..6c175bd82577 100644
--- a/pkgs/development/compilers/dart/package-source-builders/rhttp/default.nix
+++ b/pkgs/development/compilers/dart/package-source-builders/rhttp/default.nix
@@ -35,6 +35,7 @@ let
         _0_10_0 = "sha256-2SpAj53XvZXKRpMzFXJGcx7E2TlMUD+ooHkFwg/9fe4=";
         _0_11_0 = "sha256-sngh5k9GoCZhnIFTpnAVHZjxTcOv+Ui6pJ2cFyriL84=";
         _0_12_0 = "sha256-W2DcBy1n73nR2oZIQcFt6A+NElQWtfEtKB1YIweQUVo=";
+        _0_15_1 = "sha256-Dsw5KbOLkmaOq8ESk1NzprMT/PTWLnHTQVii5gpNVPc=";
       }
       .${"_" + (lib.replaceStrings [ "." ] [ "_" ] version)} or (throw ''
         Unsupported version of pub 'rhttp': '${version}'
diff --git a/pkgs/development/python-modules/langchain-anthropic/default.nix b/pkgs/development/python-modules/langchain-anthropic/default.nix
index 3ca06b41a74d..42c6413cec48 100644
--- a/pkgs/development/python-modules/langchain-anthropic/default.nix
+++ b/pkgs/development/python-modules/langchain-anthropic/default.nix
@@ -24,14 +24,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langchain-anthropic";
-  version = "1.3.4";
+  version = "1.3.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
     tag = "langchain-anthropic==${finalAttrs.version}";
-    hash = "sha256-8dGP26N2aheMTtI2wYMBVitlzrTsJZa5Zt5xVl+vqI4=";
+    hash = "sha256-R4X2WEU1I9HuuA9k4/6NrRMYuLjS6DQHQeP3xzp+Uso=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/libs/partners/anthropic";
diff --git a/pkgs/development/python-modules/langchain-aws/default.nix b/pkgs/development/python-modules/langchain-aws/default.nix
index a1b15105683a..8234d482ebdf 100644
--- a/pkgs/development/python-modules/langchain-aws/default.nix
+++ b/pkgs/development/python-modules/langchain-aws/default.nix
@@ -8,13 +8,14 @@
 
   # dependencies
   boto3,
+  langchain,
   langchain-core,
   numpy,
   pydantic,
 
   # optional-dependencies
-  langchain-anthropic,
   anthropic,
+  langchain-anthropic,
 
   # tests
   langchain-tests,
@@ -28,14 +29,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langchain-aws";
-  version = "1.3.1";
+  version = "1.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain-aws";
     tag = "langchain-aws==${finalAttrs.version}";
-    hash = "sha256-hKMTzN2NVMSMCVsFroFFUM0embz8KHbDnmunwOb9ofw=";
+    hash = "sha256-1zeZsLff0dcn9rJZu6zR6l/oXvXPXNTqKo0Ma+cXafo=";
   };
 
   postPatch = ''
@@ -49,6 +50,7 @@ buildPythonPackage (finalAttrs: {
 
   dependencies = [
     boto3
+    langchain
     langchain-core
     numpy
     pydantic
diff --git a/pkgs/development/python-modules/langchain-classic/default.nix b/pkgs/development/python-modules/langchain-classic/default.nix
index 4484a351fae5..a61b7276651f 100644
--- a/pkgs/development/python-modules/langchain-classic/default.nix
+++ b/pkgs/development/python-modules/langchain-classic/default.nix
@@ -42,14 +42,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langchain-classic";
-  version = "1.0.2";
+  version = "1.0.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
     tag = "langchain-classic==${finalAttrs.version}";
-    hash = "sha256-NH2l2Htt5nAzzvwKUgQNwvQBLxZKhOLxnxthvK/Yh4I=";
+    hash = "sha256-vCYdBBN9vU8gWedCxKXnzLzZ5C7pYl3KyECBNAQggto=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/libs/langchain";
diff --git a/pkgs/development/python-modules/langchain-core/default.nix b/pkgs/development/python-modules/langchain-core/default.nix
index 581186b0d709..3f538f26f267 100644
--- a/pkgs/development/python-modules/langchain-core/default.nix
+++ b/pkgs/development/python-modules/langchain-core/default.nix
@@ -36,14 +36,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langchain-core";
-  version = "1.2.18";
+  version = "1.2.19";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
     tag = "langchain-core==${finalAttrs.version}";
-    hash = "sha256-Mk9Kr12wclBw2Q1YeJMg1MBe5XD0q09P2fgKZam/cK0=";
+    hash = "sha256-qQ0bCg+ghb84tafyahMzA4GroLz8smGfwIUg2bHmY0w=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/libs/core";
diff --git a/pkgs/development/python-modules/langchain-mistralai/default.nix b/pkgs/development/python-modules/langchain-mistralai/default.nix
index b3e10c40b27d..0f33d0972672 100644
--- a/pkgs/development/python-modules/langchain-mistralai/default.nix
+++ b/pkgs/development/python-modules/langchain-mistralai/default.nix
@@ -24,14 +24,14 @@
 
 buildPythonPackage rec {
   pname = "langchain-mistralai";
-  version = "1.1.1";
+  version = "1.1.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
     tag = "langchain-mistralai==${version}";
-    hash = "sha256-cdUl6LusttH6c0tBvaxQR5UGHjwyubKELCDv61VQ6Qo=";
+    hash = "sha256-vCYdBBN9vU8gWedCxKXnzLzZ5C7pYl3KyECBNAQggto=";
   };
 
   sourceRoot = "${src.name}/libs/partners/mistralai";
diff --git a/pkgs/development/python-modules/langchain/default.nix b/pkgs/development/python-modules/langchain/default.nix
index cb439c307d79..c8443c4360ef 100644
--- a/pkgs/development/python-modules/langchain/default.nix
+++ b/pkgs/development/python-modules/langchain/default.nix
@@ -46,14 +46,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langchain";
-  version = "1.2.10";
+  version = "1.2.12";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
     tag = "langchain==${finalAttrs.version}";
-    hash = "sha256-Icgka7z1wLuxEjUO5baxMya7KfltYsK8TXtCMg73E1Q=";
+    hash = "sha256-Z0noVsSu0OZchynlJSkIe0p076/0nay+1uS2ZXnztns=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/libs/langchain_v1";
diff --git a/pkgs/development/python-modules/langgraph-cli/default.nix b/pkgs/development/python-modules/langgraph-cli/default.nix
index ddadf90eabea..8953df9a1a9f 100644
--- a/pkgs/development/python-modules/langgraph-cli/default.nix
+++ b/pkgs/development/python-modules/langgraph-cli/default.nix
@@ -24,14 +24,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langgraph-cli";
-  version = "0.4.17";
+  version = "0.4.18";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langgraph";
     tag = "cli==${finalAttrs.version}";
-    hash = "sha256-liyQPt0S2zfRSDZ0LYn1QmNrqyEUYiF6LL2pPt210j8=";
+    hash = "sha256-KhDvdy7iZtaSLRNdmdObv3KbUiOMkcHtCRZ3/13AQak=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/libs/cli";
diff --git a/pkgs/development/python-modules/langgraph/default.nix b/pkgs/development/python-modules/langgraph/default.nix
index 5ddb1f1e17c3..d74488efb3a9 100644
--- a/pkgs/development/python-modules/langgraph/default.nix
+++ b/pkgs/development/python-modules/langgraph/default.nix
@@ -41,14 +41,14 @@
 }:
 buildPythonPackage (finalAttrs: {
   pname = "langgraph";
-  version = "1.0.10";
+  version = "1.1.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langgraph";
     tag = finalAttrs.version;
-    hash = "sha256-NJSmpVshj/x6ws+jFYXGarNKNztbk5OIIMA1neFOyIY=";
+    hash = "sha256-Dbzyp9Tl6VaLoWDnLk5UCiYnWFcZM3kljv8EdB1IEAI=";
   };
 
   postgresqlTestSetupPost = ''
@@ -135,6 +135,8 @@ buildPythonPackage (finalAttrs: {
     "tests/test_pregel_async.py"
     "tests/test_subgraph_persistence.py"
     "tests/test_subgraph_persistence_async.py"
+    "tests/test_time_travel.py"
+    "tests/test_time_travel_async.py"
   ];
 
   # Since `langgraph` is the only unprefixed package, we have to use an explicit match
diff --git a/pkgs/development/python-modules/langsmith/default.nix b/pkgs/development/python-modules/langsmith/default.nix
index 4cc538825f26..14d61d68dbab 100644
--- a/pkgs/development/python-modules/langsmith/default.nix
+++ b/pkgs/development/python-modules/langsmith/default.nix
@@ -31,14 +31,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langsmith";
-  version = "0.7.14";
+  version = "0.7.18";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langsmith-sdk";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-uoWevYxIjslOKzsbVaYc3KZjpG9703S/ucVaCK85R5M=";
+    hash = "sha256-praKCpNzZ8e+QEU9Ji9ryspzIiF9X98rUOvMbwjMZho=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/python";
@@ -93,9 +93,7 @@ buildPythonPackage (finalAttrs: {
     # due to circular import
     "tests/unit_tests/test_client.py"
     "tests/unit_tests/evaluation/test_runner.py"
-    # flaky time comparisons
-    # https://github.com/langchain-ai/langsmith-sdk/issues/2245
-    "tests/unit_tests/test_uuid_v7.py"
+
     # google-adk isn't packaged (and has an enormous number of dependencies)
     "tests/unit_tests/wrappers/test_google_adk.py"
   ];
diff --git a/pkgs/development/python-modules/marimo/default.nix b/pkgs/development/python-modules/marimo/default.nix
index 5bf6d0d03f74..849164d58884 100644
--- a/pkgs/development/python-modules/marimo/default.nix
+++ b/pkgs/development/python-modules/marimo/default.nix
@@ -31,13 +31,13 @@
 }:
 buildPythonPackage rec {
   pname = "marimo";
-  version = "0.20.4";
+  version = "0.21.0";
   pyproject = true;
 
   # The github archive does not include the static assets
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-f0bOg3lTcXUEZz4z5H+0KmGb9fnSAA0aOjsWY6R8VJg=";
+    hash = "sha256-tNUVhY7e1raiW1jOlx/WIIDLuJc4pzqvbCnDTaSJ1Hs=";
   };
 
   build-system = [ uv-build ];
diff --git a/pkgs/kde/misc/glaxnimate/default.nix b/pkgs/kde/misc/glaxnimate/default.nix
index 310d9d9d4185..130589b0f34f 100644
--- a/pkgs/kde/misc/glaxnimate/default.nix
+++ b/pkgs/kde/misc/glaxnimate/default.nix
@@ -14,7 +14,7 @@
 
 mkKdeDerivation rec {
   pname = "glaxnimate";
-  version = "0.5.80";
+  version = "0.6.0";
 
   src = fetchFromGitLab {
     domain = "invent.kde.org";
@@ -22,7 +22,7 @@ mkKdeDerivation rec {
     repo = "glaxnimate";
     tag = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-+4vvp9nxtpKUOojgQL9T5Eyv9eMCGGwmDAex91XPwyA=";
+    hash = "sha256-hHAe/xF6QDjiC2JqCUB1FngLsMSelMqEdHjXJwjTVjk=";
   };
 
   extraBuildInputs = [
diff --git a/pkgs/shells/fish/plugins/fzf-fish.nix b/pkgs/shells/fish/plugins/fzf-fish.nix
index d4104c22a69e..4036c1601c84 100644
--- a/pkgs/shells/fish/plugins/fzf-fish.nix
+++ b/pkgs/shells/fish/plugins/fzf-fish.nix
@@ -16,13 +16,13 @@ let
 in
 buildFishPlugin rec {
   pname = "fzf.fish";
-  version = "10.3";
+  version = "11.0";
 
   src = fetchFromGitHub {
     owner = "PatrickF1";
     repo = "fzf.fish";
     rev = "v${version}";
-    hash = "sha256-T8KYLA/r/gOKvAivKRoeqIwE2pINlxFQtZJHpOy9GMM=";
+    hash = "sha256-H7HgYT+okuVXo2SinrSs+hxAKCn4Q4su7oMbebKd/7s=";
   };
 
   nativeCheckInputs = [