diff --git a/doc/stdenv/meta.chapter.md b/doc/stdenv/meta.chapter.md
index 1e1e190b3eda..1fac5244af66 100644
--- a/doc/stdenv/meta.chapter.md
+++ b/doc/stdenv/meta.chapter.md
@@ -291,14 +291,17 @@ Some of them are as follows:
 * *vendor* - can point to the source of the package, or to Nixpkgs itself
 * *product* - name of the package
 * *version* - version of the package
-* *update* - name of the latest update, can be a patch version for semantically versioned packages
-* *edition* - any additional specification about the version
+* *update* - vendor-specific string part of the version string of the latest update (e.g. `rc1`, `beta`, etc...)
+* *edition* - deprecated and should be set to `*`
 
 You can find information about all of these attributes in the [official specification](https://csrc.nist.gov/projects/security-content-automation-protocol/specifications/cpe/naming) (heading 5.3.3, pages 11-13).
 
-Any fields that don't have a value are set to either `-` if the value is not available or `*` when the field can match any value.
+Any fields that don't have a value are set to either:
 
-For example, for glibc 2.40.1 CPE would be `cpe:2.3:a:gnu:glibc:2.40:1:*:*:*:*:*:*`.
+* `*` (ANY) when the field can match any value
+* `-` (NA) when the value is not meaningful or not used in the description
+
+For example, for glibc 2.40.1 CPE would be `cpe:2.3:a:gnu:glibc:2.40.1:*:*:*:*:*:*:*`.
 
 #### `meta.identifiers.cpeParts` {#var-meta-identifiers-cpeParts}
 
@@ -314,14 +317,13 @@ It is up to the package author to make sure all parts are correct and match expe
 Following functions help with filling out `version` and `update` fields:
 
 * [`lib.meta.cpeFullVersionWithVendor`](#function-library-lib.meta.cpeFullVersionWithVendor)
-* [`lib.meta.cpePatchVersionInUpdateWithVendor`](#function-library-lib.meta.cpePatchVersionInUpdateWithVendor)
 
 For many packages to make CPE available it should be enough to specify only:
 
 ```nix
 {
   # ...
-  meta.identifiers.cpeParts = lib.meta.cpePatchVersionInUpdateWithVendor vendor version;
+  meta.identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor vendor version;
 }
 ```
 
diff --git a/lib/meta.nix b/lib/meta.nix
index 1a1676f56aff..3341caf0e0fb 100644
--- a/lib/meta.nix
+++ b/lib/meta.nix
@@ -633,132 +633,4 @@ rec {
     update = "*";
   };
 
-  /**
-    Alternate version of [`lib.meta.cpePatchVersionInUpdateWithVendor`](#function-library-lib.meta.cpePatchVersionInUpdateWithVendor).
-    If `cpePatchVersionInUpdateWithVendor` succeeds, returns an attribute set with `success` set to `true` and `value` set to the result.
-    Otherwise, `success` is set to `false` and `error` is set to the string representation of the error.
-
-    # Inputs
-
-    `vendor`
-
-    : package's vendor
-
-    `version`
-
-    : package's version
-
-    # Type
-
-    ```
-    tryCPEPatchVersionInUpdateWithVendor :: String -> String -> ({ success = true; value :: { update :: String; vendor :: String; version :: String; }; } | { success = false; error :: String; })
-    ```
-
-    # Examples
-    :::{.example}
-    ## `lib.meta.tryCPEPatchVersionInUpdateWithVendor` usage example
-
-    ```nix
-    lib.meta.tryCPEPatchVersionInUpdateWithVendor "gnu" "1.2.3"
-    => {
-      success = true;
-      value = {
-        vendor = "gnu";
-        version = "1.2";
-        update = "3";
-      };
-    }
-    ```
-
-    :::
-    :::{.example}
-    ## `lib.meta.cpePatchVersionInUpdateWithVendor` error example
-
-    ```nix
-    lib.meta.tryCPEPatchVersionInUpdateWithVendor "gnu" "5.3p0"
-    => {
-      success = false;
-      error = "version 5.3p0 doesn't match regex `([0-9]+\\.[0-9]+)\\.([0-9]+)`";
-    }
-    ```
-
-    :::
-  */
-  tryCPEPatchVersionInUpdateWithVendor =
-    vendor: version:
-    let
-      regex = "([0-9]+\\.[0-9]+)\\.([0-9]+)";
-      # we have to call toString here in case version is an attrset with __toString attribute
-      versionMatch = builtins.match regex (toString version);
-    in
-    if versionMatch == null then
-      {
-        success = false;
-        error = "version ${version} doesn't match regex `${regex}`";
-      }
-    else
-      {
-        success = true;
-        value = {
-          inherit vendor;
-          version = elemAt versionMatch 0;
-          update = elemAt versionMatch 1;
-        };
-      };
-
-  /**
-    Generate [CPE parts](#var-meta-identifiers-cpeParts) from inputs. Copies `vendor` to the result. When `version` matches `X.Y.Z` where all parts are numerical, sets `version` and `update` fields to `X.Y` and `Z`. Throws an error if the version doesn't match the expected template.
-
-    # Inputs
-
-    `vendor`
-
-    : package's vendor
-
-    `version`
-
-    : package's version
-
-    # Type
-
-    ```
-    cpePatchVersionInUpdateWithVendor :: String -> String -> { update :: String; vendor :: String; version :: String; }
-    ```
-
-    # Examples
-    :::{.example}
-    ## `lib.meta.cpePatchVersionInUpdateWithVendor` usage example
-
-    ```nix
-    lib.meta.cpePatchVersionInUpdateWithVendor "gnu" "1.2.3"
-    => {
-      vendor = "gnu";
-      version = "1.2";
-      update = "3";
-    }
-    ```
-
-    :::
-    :::{.example}
-    ## `lib.meta.cpePatchVersionInUpdateWithVendor` usage in derivations
-
-    ```nix
-    mkDerivation rec {
-      version = "1.2.3";
-      # ...
-      meta = {
-        # ...
-        identifiers.cpeParts = lib.meta.cpePatchVersionInUpdateWithVendor "gnu" version;
-      };
-    }
-    ```
-
-    :::
-  */
-  cpePatchVersionInUpdateWithVendor =
-    vendor: version:
-    let
-      result = tryCPEPatchVersionInUpdateWithVendor vendor version;
-    in
-    if result.success then result.value else throw result.error;
 }
diff --git a/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix b/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
index 2bc41cb0536b..ebb4ea03ae4f 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
@@ -1401,6 +1401,33 @@ let
 
           leaf-defaults = ignoreCompilationError super.leaf-defaults; # elisp error
 
+          liberime = super.liberime.overrideAttrs (
+            let
+              libExt = pkgs.stdenv.hostPlatform.extensions.sharedLibrary;
+            in
+            prevAttrs: {
+              buildInputs = prevAttrs.buildInputs ++ [
+                pkgs.librime
+              ];
+              nativeBuildInputs = prevAttrs.nativeBuildInputs ++ [
+                pkgs.which
+              ];
+              postBuild =
+                prevAttrs.postBuild or ""
+                + "\n"
+                + ''
+                  make CC=$CC SUFFIX=${libExt}
+                '';
+              postInstall =
+                prevAttrs.postInstall or ""
+                + "\n"
+                + ''
+                  rm -rv $out/share/emacs/site-lisp/elpa/liberime-*/{src,emacs-module,Makefile}
+                  install src/liberime-core${libExt} $out/share/emacs/site-lisp/elpa/liberime-*
+                '';
+            }
+          );
+
           # https://github.com/abo-abo/lispy/pull/683
           # missing optional dependencies
           lispy = addPackageRequires (mkHome super.lispy) [ self.indium ];
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 580980abb969..b9c42144edbb 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1004,13 +1004,13 @@
     "vendorHash": "sha256-ucXmHK7jrahc78nE2cf5p5PPCSNV5DAQ53KM2SfJnjo="
   },
   "okta_okta": {
-    "hash": "sha256-sr3Q39Lx47+OT4alUEic7PBvtZKTwQ9Do15YfbVn9b4=",
+    "hash": "sha256-Ub41ML88NKsMC6q1C67DCBTrG9qD0cBhAkizZdIRRBc=",
     "homepage": "https://registry.terraform.io/providers/okta/okta",
     "owner": "okta",
     "repo": "terraform-provider-okta",
-    "rev": "v6.6.1",
+    "rev": "v6.9.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-EqXLfVayaOG/G3c6EkgQoPGNwnG2qKSlDo2ai/onmQE="
+    "vendorHash": "sha256-0NaqVCibwiK7WY6hIFGd2kB/okyh6ZsZ+BAe5mGP38A="
   },
   "oktadeveloper_oktaasa": {
     "hash": "sha256-2LhxgowqKvDDDOwdznusL52p2DKP+UiXALHcs9ZQd0U=",
diff --git a/pkgs/by-name/ch/check-sieve/package.nix b/pkgs/by-name/ch/check-sieve/package.nix
index e07ce964f47d..3148570e1a73 100644
--- a/pkgs/by-name/ch/check-sieve/package.nix
+++ b/pkgs/by-name/ch/check-sieve/package.nix
@@ -10,13 +10,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "check-sieve";
-  version = "0.11";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "dburkart";
     repo = "check-sieve";
-    tag = "check-sieve-${finalAttrs.version}";
-    hash = "sha256-vmfHXjcZ5J/+kO3/a0p8krLOuC67+q8SxcPJgW+UaTw=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-dElVfLSVtlELleuxCScR6BGuLsJ+KRqcNA8y0lgrBfI=";
   };
 
   nativeBuildInputs = [
@@ -28,8 +28,6 @@ stdenv.mkDerivation (finalAttrs: {
     (python3.withPackages (p: [ p.setuptools ]))
   ];
 
-  # https://github.com/dburkart/check-sieve/issues/67
-  # Remove after the next (>0.10) release
   env.NIX_CFLAGS_COMPILE = "-Wno-error=unused-result";
 
   installPhase = ''
@@ -39,17 +37,14 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   preCheck = ''
-    substituteInPlace test/AST/util.py \
+    substituteInPlace test/{AST,simulate}/util.py \
       --replace-fail "/usr/bin/diff" "${diffutils}/bin/diff"
-    # Disable flaky tests: https://github.com/dburkart/check-sieve/issues/68
-    # Remove after the next (>0.10) release
-    rm -rf test/{6785,7352}
   '';
 
   doCheck = true;
 
   passthru.updateScript = nix-update-script {
-    extraArgs = [ "--version-regex=check-sieve-(.*)" ];
+    extraArgs = [ "--version-regex=v(.*)" ];
   };
 
   meta = {
diff --git a/pkgs/by-name/dp/dprint/package.nix b/pkgs/by-name/dp/dprint/package.nix
index dd755de16e2c..d8aca72dd913 100644
--- a/pkgs/by-name/dp/dprint/package.nix
+++ b/pkgs/by-name/dp/dprint/package.nix
@@ -12,7 +12,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "dprint";
-  version = "0.53.2";
+  version = "0.54.0";
 
   # Prefer repository rather than crate here
   #   - They have Cargo.lock in the repository
@@ -21,10 +21,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "dprint";
     repo = "dprint";
     tag = finalAttrs.version;
-    hash = "sha256-n2nb8+Iplm9AMlyxCfRjGmuES1FvYIVgcilSg7LcjiM=";
+    hash = "sha256-dNs2LQeEndeXS8xR9SXVFWT9PS+haB9SDZ+3PUPkFjg=";
   };
 
-  cargoHash = "sha256-FTD8rCdMC1W+1SE5ezAz3rLNc6UErGbN0/5uiPCABuk=";
+  cargoHash = "sha256-fmbO14eTObK1cZu9gDls25KRmzAJPGiqQ8uURGD2vV0=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/du/duckdb/package.nix b/pkgs/by-name/du/duckdb/package.nix
index 9849e2f7e01b..905eab0038ee 100644
--- a/pkgs/by-name/du/duckdb/package.nix
+++ b/pkgs/by-name/du/duckdb/package.nix
@@ -122,6 +122,24 @@ stdenv.mkDerivation (finalAttrs: {
           "test/sql/function/list/aggregates/skewness.test"
           "test/sql/aggregate/aggregates/histogram_table_function.test"
         ]
+        ++ lib.optionals stdenv.hostPlatform.isDarwin [
+          # SIGTRAP during iejoin tests on aarch64-darwin (with and without sandbox)
+          # iejoin implementation rewritten in 1.5.x with new parallel task scheduling
+          "test/sql/join/iejoin/iejoin_issue_6861.test"
+          "test/sql/join/iejoin/iejoin_issue_7278.test"
+          "test/sql/join/iejoin/iejoin_projection_maps.test"
+          "test/sql/join/iejoin/merge_join_switch.test"
+          "test/sql/join/iejoin/predicate_expressions.test"
+          "test/sql/join/iejoin/test_countzeros.test"
+          "test/sql/join/iejoin/test_ieantijoin.test"
+          "test/sql/join/iejoin/test_iejoin.test"
+          "test/sql/join/iejoin/test_iejoin_east_west.test"
+          "test/sql/join/iejoin/test_iejoin_events.test"
+          "test/sql/join/iejoin/test_iejoin_null_keys.test"
+          "test/sql/join/iejoin/test_iejoin_overlaps.test"
+          "test/sql/join/iejoin/test_iejoin_predicate.test"
+          "test/sql/join/iejoin/test_iesemijoin.test"
+        ]
       );
       LD_LIBRARY_PATH = lib.optionalString stdenv.hostPlatform.isDarwin "DY" + "LD_LIBRARY_PATH";
     in
@@ -144,6 +162,7 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.mit;
     mainProgram = "duckdb";
     maintainers = with lib.maintainers; [
+      cameronraysmith
       costrouc
       cpcloud
     ];
diff --git a/pkgs/by-name/du/duckdb/versions.json b/pkgs/by-name/du/duckdb/versions.json
index c570a27d61ca..14c629fe5313 100644
--- a/pkgs/by-name/du/duckdb/versions.json
+++ b/pkgs/by-name/du/duckdb/versions.json
@@ -1,6 +1,6 @@
 {
-  "version": "1.4.4",
-  "rev": "6ddac802ffa9bcfbcc3f5f0d71de5dff9b0bc250",
-  "hash": "sha256-h9Mldv29u47DnFOCN28HBHWz8daFGE/Nj1JcnNhhQ5Q=",
-  "python_hash": "sha256-860KbaM7Ojp4Qwm5x5WPQg176XKOYayk8pLVaUAuC4M="
+  "version": "1.5.1",
+  "rev": "7dbb2e646fea939a89f10a55aa98c474cbb0c098",
+  "hash": "sha256-FygBpfhvezvUbI969Dta+vZOPt6BnSW2d5gO4I4oB2A=",
+  "python_hash": "sha256-ZB+Zcxg5VjBzfTkQk7TxoP9pw+hvOXpB2qqnqqmjhxM="
 }
diff --git a/pkgs/by-name/mi/mirrord/manifest.json b/pkgs/by-name/mi/mirrord/manifest.json
index 0a2526fa0b65..d672715115f8 100644
--- a/pkgs/by-name/mi/mirrord/manifest.json
+++ b/pkgs/by-name/mi/mirrord/manifest.json
@@ -1,21 +1,21 @@
 {
-  "version": "3.198.0",
+  "version": "3.201.0",
   "assets": {
     "x86_64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.198.0/mirrord_linux_x86_64",
-      "hash": "sha256-JrfS4KGARmNGAWDLzmCkafjyPgk3NHIALEWMpoBmbWc="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.201.0/mirrord_linux_x86_64",
+      "hash": "sha256-R5wiIpOA/9mkYjDmAYKOfDjpffV1Wm/GOLfzyi8dNVE="
     },
     "aarch64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.198.0/mirrord_linux_aarch64",
-      "hash": "sha256-As0ybf+UQ4+q0lCkpM+6VkvTWMt8mtfMKmrPm3eZIcY="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.201.0/mirrord_linux_aarch64",
+      "hash": "sha256-U8DTLhl/LfC7xf9yx4iHQx0WF1xI/d36ikiqWX+pFkk="
     },
     "aarch64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.198.0/mirrord_mac_universal",
-      "hash": "sha256-uvAvNF1KKIfvjzgwmwVacXA/bEwHolCCqFoou5L8pXw="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.201.0/mirrord_mac_universal",
+      "hash": "sha256-n98D4F6XamC1BkB8VDGW/xEgVlejW/HLhcxrk+pkAHQ="
     },
     "x86_64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.198.0/mirrord_mac_universal",
-      "hash": "sha256-uvAvNF1KKIfvjzgwmwVacXA/bEwHolCCqFoou5L8pXw="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.201.0/mirrord_mac_universal",
+      "hash": "sha256-n98D4F6XamC1BkB8VDGW/xEgVlejW/HLhcxrk+pkAHQ="
     }
   }
 }
diff --git a/pkgs/by-name/mo/mojoshader/package.nix b/pkgs/by-name/mo/mojoshader/package.nix
new file mode 100644
index 000000000000..ecf3dd311254
--- /dev/null
+++ b/pkgs/by-name/mo/mojoshader/package.nix
@@ -0,0 +1,80 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  writeScript,
+  writeShellScriptBin,
+  cmake,
+  SDL2,
+  dxvk_2,
+}:
+
+let
+  fakeGit = writeShellScriptBin "git" ''
+    if [[ "$1" = "rev-parse" ]]; then
+      echo $out
+    elif [[ "$1" = "rev-list" ]]; then
+      cat $src/.gitrev
+    else
+      echo "fakeGit: unexpected git command: $@" >&2
+      exit 1
+    fi
+  '';
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "mojoshader";
+  version = "0-unstable-2026-02-10";
+
+  src = fetchFromGitHub {
+    owner = "icculus";
+    repo = "mojoshader";
+    rev = "abdc80360c1d4560ab8f356035dcd53ae6e9b87f";
+    postCheckout = "git -C $out rev-parse HEAD > $out/.gitrev";
+    hash = "sha256-NWXJfi12zLDDg8jvC+G/Dxf2CZPWtSjYFSo/6EV6qxY=";
+  };
+
+  buildInputs = [ SDL2 ];
+
+  nativeBuildInputs = [
+    cmake
+    fakeGit # https://github.com/icculus/mojoshader/blob/abdc80360c1d4560ab8f356035dcd53ae6e9b87f/CMakeLists.txt#L41-L68
+  ];
+
+  NIX_CFLAGS_COMPILE = lib.optionalString (!stdenv.hostPlatform.isDarwin) "-I${dxvk_2}/include/dxvk";
+
+  cmakeFlags = [
+    (lib.cmakeBool "BUILD_SHARED_LIBS" (!stdenv.hostPlatform.isStatic))
+    (lib.cmakeBool "FLIP_VIEWPORT" true)
+    (lib.cmakeBool "DEPTH_CLIPPING" true)
+    (lib.cmakeBool "XNA4_VERTEXTEXTURE" true)
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib
+    install -Dm644 libmojoshader.* -t $out/lib
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = writeScript "update.sh" ''
+    #!/usr/bin/env nix-shell
+    #!nix-shell -i bash -p curl jq common-updater-scripts
+
+    set -euo pipefail
+
+    response=$(curl ''${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} -sL "https://api.github.com/repos/${finalAttrs.src.owner}/${finalAttrs.src.repo}/commits?per_page=1")
+    rev=$(echo "$response" | jq -r '.[0].sha')
+    date=$(echo "$response" | jq -r '.[0].commit.committer.date' | cut -c1-10)
+    update-source-version mojoshader 0-unstable-$date --rev=$rev
+  '';
+
+  meta = {
+    description = "Library to work with Direct3D shaders on alternate 3D APIs and non-Windows platforms";
+    homepage = "https://icculus.org/mojoshader";
+    license = lib.licenses.zlib;
+    maintainers = with lib.maintainers; [ ulysseszhan ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/ol/ollama/package.nix b/pkgs/by-name/ol/ollama/package.nix
index f5a8bb751000..b526cc61d335 100644
--- a/pkgs/by-name/ol/ollama/package.nix
+++ b/pkgs/by-name/ol/ollama/package.nix
@@ -94,7 +94,7 @@ let
 
   cudaToolkit = buildEnv {
     # ollama hardcodes the major version in the Makefile to support different variants.
-    # - https://github.com/ollama/ollama/blob/v0.20.4/CMakePresets.json#L21-L47
+    # - https://github.com/ollama/ollama/blob/v0.20.5/CMakePresets.json#L21-L47
     name = "cuda-merged-${cudaMajorVersion}";
     paths = map lib.getLib cudaLibs ++ [
       (lib.getOutput "static" cudaPackages.cuda_cudart)
@@ -140,13 +140,13 @@ let
 in
 goBuild (finalAttrs: {
   pname = "ollama";
-  version = "0.20.4";
+  version = "0.20.5";
 
   src = fetchFromGitHub {
     owner = "ollama";
     repo = "ollama";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8TbZvxxaUdROpe3gnBx0XzX62tbQ9QeJP3Yp7XXJoTQ=";
+    hash = "sha256-/H4DZ/aRB04lKSke9XsK+vb76pcy940scoTunXO4pf4=";
   };
 
   vendorHash = "sha256-Lc1Ktdqtv2VhJQssk8K1UOimeEjVNvDWePE9WkamCos=";
@@ -232,7 +232,7 @@ goBuild (finalAttrs: {
     '';
 
   # ollama looks for acceleration libs in ../lib/ollama/ (now also for CPU-only with arch specific optimizations)
-  # https://github.com/ollama/ollama/blob/v0.20.4/docs/development.md#library-detection
+  # https://github.com/ollama/ollama/blob/v0.20.5/docs/development.md#library-detection
   postInstall = ''
     mkdir -p $out/lib
     cp -r build/lib/ollama $out/lib/
@@ -263,6 +263,8 @@ goBuild (finalAttrs: {
       skippedTests = [
         "TestPushHandler/unauthorized_push" # Writes to $HOME, see https://github.com/ollama/ollama/pull/12307#pullrequestreview-3249128660
         "TestPiRun_InstallAndWebSearchLifecycle" # Requires network access to install npm packages
+        "TestOpenclawRun_ChannelSetupHappensBeforeGatewayRestart" # /bin/mkdir and /bin/cat are unavailable on NixOS
+        "TestOpenclawChannelSetupPreflight" # /bin/mkdir and /bin/cat are unavailable on NixOS
       ];
     in
     [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
diff --git a/pkgs/by-name/op/openclaw/package.nix b/pkgs/by-name/op/openclaw/package.nix
index 0f86c4ec9fb5..420867cd233b 100644
--- a/pkgs/by-name/op/openclaw/package.nix
+++ b/pkgs/by-name/op/openclaw/package.nix
@@ -11,7 +11,7 @@
   versionCheckHook,
   rolldown,
   installShellFiles,
-  version ? "2026.4.2",
+  version ? "2026.4.9",
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "openclaw";
@@ -21,10 +21,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     owner = "openclaw";
     repo = "openclaw";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wVS2OuBNrF1yWjmINxde0kC5mvY2QUUtwYpYrZcARkI=";
+    hash = "sha256-wqvLBe+cEoo0x096fK6qKR8bDs4QHPTlxK5e64K4yls=";
   };
 
-  pnpmDepsHash = "sha256-aHepSWiQ4+UyjPHBF+4+M9/nFrgfCw422q671saJM+U=";
+  pnpmDepsHash = "sha256-mdppNeJVf0Def0GohiKks6W3uzsaoJUYJo/ggGmypKQ=";
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
@@ -58,10 +58,27 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     chmod -R u+w node_modules/rolldown node_modules/@rolldown/pluginutils \
       node_modules/.pnpm/node_modules/rolldown node_modules/.pnpm/node_modules/@rolldown/pluginutils
 
-    # In Nix sandbox, npm install has no network access. Patch the staging
-    # script to accept version-mismatched deps from root node_modules
-    # instead of falling back to npm install.
-    sed -i 's/if (installedVersion === null || !dependencyVersionSatisfied(spec, installedVersion)) {/if (installedVersion === null) {/' scripts/stage-bundled-plugin-runtime-deps.mjs
+    # In Nix sandbox, npm install has no network access.
+    # 1) Skip missing/mismatched deps in closure walk instead of aborting.
+    # 2) Never fall through to the npm-install path.
+    substituteInPlace scripts/stage-bundled-plugin-runtime-deps.mjs \
+      --replace-fail \
+        'if (installedVersion === null || !dependencyVersionSatisfied(spec, installedVersion)) {
+          return null;
+        }' \
+        'if (installedVersion === null || !dependencyVersionSatisfied(spec, installedVersion)) {
+          continue;
+        }' \
+      --replace-fail \
+        'stageInstalledRootRuntimeDeps({ fingerprint, packageJson, pluginDir, repoRoot })
+      ) {
+        return;
+      }' \
+        'stageInstalledRootRuntimeDeps({ fingerprint, packageJson, pluginDir, repoRoot })
+      ) {
+        return;
+      }
+      return; // nix: sandbox has no npm'
     pnpm build
     pnpm ui:build
 
@@ -76,7 +93,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
 
     cp --reflink=auto -r package.json dist node_modules $libdir/
-    cp --reflink=auto -r assets docs skills patches extensions $libdir/
+    cp --reflink=auto -r assets docs skills patches extensions qa $libdir/
 
     rm -f $libdir/node_modules/.pnpm/node_modules/clawdbot \
       $libdir/node_modules/.pnpm/node_modules/moltbot \
@@ -84,6 +101,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
     # Remove broken symlinks created by pnpm workspace linking in extensions
     find $libdir/extensions -xtype l -delete
+    # Remove symlinks pointing back to the build sandbox
+    find $libdir/dist/extensions -type l -lname "$NIX_BUILD_TOP/*" -delete
 
     makeWrapper ${lib.getExe nodejs_22} $out/bin/openclaw \
       --add-flags "$libdir/dist/index.js" \
diff --git a/pkgs/by-name/po/poco/disable-flaky-tests.patch b/pkgs/by-name/po/poco/disable-flaky-tests.patch
deleted file mode 100644
index 4f3b6ca5833e..000000000000
--- a/pkgs/by-name/po/poco/disable-flaky-tests.patch
+++ /dev/null
@@ -1,18 +0,0 @@
-diff --git a/Foundation/testsuite/src/ExpireLRUCacheTest.cpp b/Foundation/testsuite/src/ExpireLRUCacheTest.cpp
---- a/Foundation/testsuite/src/ExpireLRUCacheTest.cpp
-+++ b/Foundation/testsuite/src/ExpireLRUCacheTest.cpp
-@@ -336 +336 @@
--	CppUnit_addTest(pSuite, ExpireLRUCacheTest, testExpireN);
-+	// CppUnit_addTest(pSuite, ExpireLRUCacheTest, testExpireN);
-diff --git a/Foundation/testsuite/src/TimestampTest.cpp b/Foundation/testsuite/src/TimestampTest.cpp
---- a/Foundation/testsuite/src/TimestampTest.cpp
-+++ b/Foundation/testsuite/src/TimestampTest.cpp
-@@ -97 +97 @@
--	CppUnit_addTest(pSuite, TimestampTest, testTimestamp);
-+	// CppUnit_addTest(pSuite, TimestampTest, testTimestamp);
-diff --git a/Foundation/testsuite/src/UniqueExpireCacheTest.cpp b/Foundation/testsuite/src/UniqueExpireCacheTest.cpp
---- a/Foundation/testsuite/src/UniqueExpireCacheTest.cpp
-+++ b/Foundation/testsuite/src/UniqueExpireCacheTest.cpp
-@@ -248 +248 @@
--	CppUnit_addTest(pSuite, UniqueExpireCacheTest, testExpireN);
-+	// CppUnit_addTest(pSuite, UniqueExpireCacheTest, testExpireN);
diff --git a/pkgs/by-name/po/poco/package.nix b/pkgs/by-name/po/poco/package.nix
index 9475a681a1d0..22a783f84e61 100644
--- a/pkgs/by-name/po/poco/package.nix
+++ b/pkgs/by-name/po/poco/package.nix
@@ -2,8 +2,8 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   cmake,
+  nix-update-script,
   pkg-config,
   zlib,
   pcre2,
@@ -13,19 +13,20 @@
   openssl,
   unixodbc,
   libmysqlclient,
+  libpng,
   writableTmpDirAsHomeHook,
 }:
 
 stdenv.mkDerivation rec {
   pname = "poco";
 
-  version = "1.14.2";
+  version = "1.15.1";
 
   src = fetchFromGitHub {
     owner = "pocoproject";
     repo = "poco";
-    hash = "sha256-koREkrfAHWfpqITN5afiXwZg37Wve2Ftx8sr8t2bSV4=";
-    rev = "poco-${version}-release";
+    hash = "sha256-JyjEs5aecKSdrNEaSs4Dzs3mAu2rhhBNAG93VLHdU3E=";
+    tag = "poco-${version}-release";
   };
 
   nativeBuildInputs = [
@@ -36,6 +37,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     unixodbc
     libmysqlclient
+    libpng
   ];
 
   propagatedBuildInputs = [
@@ -78,23 +80,13 @@ stdenv.mkDerivation rec {
       (lib.cmakeFeature "CMAKE_CTEST_ARGUMENTS" "--exclude-regex;'${excludeTestsRegex}'")
     ];
 
-  patches = [
-    # Remove on next release
-    (fetchpatch {
-      name = "disable-included-pcre-if-pcre-is-linked-staticly";
-      # this happens when building pkgsStatic.poco
-      url = "https://patch-diff.githubusercontent.com/raw/pocoproject/poco/pull/4879.patch";
-      hash = "sha256-VFWuRuf0GPYFp43WKI8utl+agP+7a5biLg7m64EMnVo=";
-    })
-    # https://github.com/pocoproject/poco/issues/4977
-    ./disable-flaky-tests.patch
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    ./disable-broken-tests-darwin.patch
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isLinux [
-    ./disable-broken-tests-linux.patch
-  ];
+  patches =
+    lib.optionals stdenv.hostPlatform.isDarwin [
+      ./disable-broken-tests-darwin.patch
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      ./disable-broken-tests-linux.patch
+    ];
 
   doCheck = true;
   nativeCheckInputs = [
@@ -109,11 +101,16 @@ stdenv.mkDerivation rec {
     done
   '';
 
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version-regex=poco-(.*)-release" ];
+  };
+
   meta = {
     homepage = "https://pocoproject.org/";
     description = "Cross-platform C++ libraries with a network/internet focus";
     license = lib.licenses.boost;
     maintainers = with lib.maintainers; [
+      hythera
       tomodachi94
     ];
     platforms = lib.platforms.unix;
diff --git a/pkgs/by-name/se/searxng/package.nix b/pkgs/by-name/se/searxng/package.nix
index b7c9743af3d5..867d9dd1379d 100644
--- a/pkgs/by-name/se/searxng/package.nix
+++ b/pkgs/by-name/se/searxng/package.nix
@@ -13,14 +13,14 @@ in
 python.pkgs.toPythonModule (
   python.pkgs.buildPythonApplication rec {
     pname = "searxng";
-    version = "0-unstable-2026-03-27";
+    version = "0-unstable-2026-04-05";
     pyproject = true;
 
     src = fetchFromGitHub {
       owner = "searxng";
       repo = "searxng";
-      rev = "265858ee2bd983ac3872303e5c55d2cdda5e500a";
-      hash = "sha256-G71XX6TAxeUk1Uw9HeeqK82wejnAE45qnWdQh117PDU=";
+      rev = "474b0a55b0cb09a3bb6e18d5579836058b075584";
+      hash = "sha256-xRI9JpF/Kx0DNZeGS1CW25j7DVq0fs6tlrGSjcl6k1Y=";
     };
 
     nativeBuildInputs = with python.pkgs; [ pythonRelaxDepsHook ];
diff --git a/pkgs/by-name/ts/tscli/package.nix b/pkgs/by-name/ts/tscli/package.nix
index 39b25169a38d..f4a475155e76 100644
--- a/pkgs/by-name/ts/tscli/package.nix
+++ b/pkgs/by-name/ts/tscli/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "tscli";
-  version = "0.2.0";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "jaxxstorm";
     repo = "tscli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zOl+AXVEUPJtEcptT1ApIs+3Fq19XZGY3JFVUAGciEg=";
+    hash = "sha256-vCRRPVQIMpVZr45dwKNCcA53j5lkGY8FvfXLmy/H5G8=";
   };
 
-  vendorHash = "sha256-bH8jYaA/54s2q9KgqEBHaPPwXJg/ch1ksKRvyEiMMmA=";
+  vendorHash = "sha256-sVpwrdA30QklyFVdg+F1k27fbJFWIVCAJi+NN0XVQOw=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/tu/turbo-unwrapped/package.nix b/pkgs/by-name/tu/turbo-unwrapped/package.nix
index 51e16fd96468..43eb7004e36b 100644
--- a/pkgs/by-name/tu/turbo-unwrapped/package.nix
+++ b/pkgs/by-name/tu/turbo-unwrapped/package.nix
@@ -18,16 +18,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "turbo-unwrapped";
-  version = "2.8.15";
+  version = "2.9.6";
 
   src = fetchFromGitHub {
     owner = "vercel";
     repo = "turborepo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yUNUo+CAtUzeu4k4NLwz5xmZJsP4siwXKcN4xLa6nfI=";
+    hash = "sha256-baERDG5/r64Tn1Ay6ikFJfZLeR//88Fl42TPbLj6IrQ=";
   };
 
-  cargoHash = "sha256-9SjOB7G59oN2HCYohc1+IMINjy19aXSe+TdfNLo77Tk=";
+  cargoHash = "sha256-+ptA25gdZfZwr8+6qUSzYvc66WyaBwvXFRlhUiYSNVA=";
 
   nativeBuildInputs = [
     capnproto
@@ -69,8 +69,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   passthru = {
     updateScript = nix-update-script {
       extraArgs = [
-        "--version-regex"
-        "v(\\d+\\.\\d+\\.\\d+)$"
+        "--use-github-releases"
       ];
     };
   };
diff --git a/pkgs/development/compilers/go/1.25.nix b/pkgs/development/compilers/go/1.25.nix
index b76dda4db3ca..1227b0fe85d8 100644
--- a/pkgs/development/compilers/go/1.25.nix
+++ b/pkgs/development/compilers/go/1.25.nix
@@ -25,11 +25,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
-  version = "1.25.8";
+  version = "1.25.9";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-6YjUokRqx/4/baoImljpk2pSo4E1Wt7ByJgyMKjWxZ4=";
+    hash = "sha256-DsnvjrzqCXqsN97K6fCachi0Uc2Wvn1u1RPY5Lz5Cc8=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/python-modules/deep-gemm/default.nix b/pkgs/development/python-modules/deep-gemm/default.nix
new file mode 100644
index 000000000000..6c873f09ea20
--- /dev/null
+++ b/pkgs/development/python-modules/deep-gemm/default.nix
@@ -0,0 +1,110 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  setuptools,
+  torch,
+
+  # buildInputs
+  fmt,
+  pybind11,
+
+  # nativeBuildInputs
+  autoAddDriverRunpath,
+
+  # tests
+  pytestCheckHook,
+  writableTmpDirAsHomeHook,
+
+  # passthru
+  deep-gemm,
+
+  config,
+  cudaPackages,
+  cudaSupport ? config.cudaSupport,
+}:
+
+let
+  inherit (lib)
+    getBin
+    optionalAttrs
+    optionals
+    ;
+in
+buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
+  pname = "deep-gemm";
+  version = "2.1.1.post3";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "deepseek-ai";
+    repo = "DeepGEMM";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-2yEHiuTaNUodWlZk7waqBsVMip2qiVJPgQHwsY0I63k=";
+  };
+
+  patches = [
+    ./use-system-libraries.patch
+  ];
+
+  env = optionalAttrs cudaSupport {
+    CUDA_HOME = (getBin cudaPackages.cuda_nvcc).outPath;
+
+    LDFLAGS = toString [
+      # Fake libcuda.so (the real one is deployed impurely)
+      "-L${lib.getOutput "stubs" cudaPackages.cuda_cudart}/lib/stubs"
+    ];
+  };
+
+  build-system = [
+    setuptools
+    torch
+  ];
+
+  nativeBuildInputs = [
+    autoAddDriverRunpath
+  ];
+
+  buildInputs = [
+    fmt
+    pybind11
+  ]
+  ++ optionals cudaSupport (
+    with cudaPackages;
+    [
+      cuda_cudart # cuda_runtime_api.h
+      cuda_nvrtc # nvrtc.h
+      cutlass # cute/arch/mma_sm100_desc.hpp
+      libcublas # cublas_v2.h
+      libcusolver # cusolverDn.h
+      libcusparse # cusparse.h
+    ]
+  );
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    writableTmpDirAsHomeHook
+  ];
+
+  # Tests require GPU access
+  doCheck = false;
+
+  passthru.gpuCheck = deep-gemm.overridePythonAttrs {
+    requiredSystemFeatures = [ "cuda" ];
+
+    # dlopens libcuda.so at import time
+    pythonImportsCheck = [ "deep_gemm" ];
+
+    doCheck = true;
+  };
+
+  meta = {
+    description = "Clean and efficient FP8 GEMM kernels with fine-grained scaling";
+    homepage = "https://github.com/deepseek-ai/DeepGEMM";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+    broken = !cudaSupport;
+  };
+})
diff --git a/pkgs/development/python-modules/deep-gemm/use-system-libraries.patch b/pkgs/development/python-modules/deep-gemm/use-system-libraries.patch
new file mode 100644
index 000000000000..c65daa26fd6b
--- /dev/null
+++ b/pkgs/development/python-modules/deep-gemm/use-system-libraries.patch
@@ -0,0 +1,54 @@
+diff --git a/setup.py b/setup.py
+index 38e891c..e846847 100644
+--- a/setup.py
++++ b/setup.py
+@@ -14,7 +14,7 @@ from setuptools import find_packages
+ from setuptools.command.build_py import build_py
+ from packaging.version import parse
+ from pathlib import Path
+-from torch.utils.cpp_extension import CUDAExtension, CUDA_HOME
++from torch.utils.cpp_extension import CUDAExtension
+ from wheel.bdist_wheel import bdist_wheel as _bdist_wheel
+ 
+ 
+@@ -33,20 +33,10 @@ if DG_JIT_USE_RUNTIME_API:
+ current_dir = os.path.dirname(os.path.realpath(__file__))
+ sources = ['csrc/python_api.cpp']
+ build_include_dirs = [
+-    f'{CUDA_HOME}/include',
+-    f'{CUDA_HOME}/include/cccl',
+     'deep_gemm/include',
+-    'third-party/cutlass/include',
+-    'third-party/fmt/include',
+ ]
+ build_libraries = ['cuda', 'cudart', 'nvrtc']
+ build_library_dirs = [
+-    f'{CUDA_HOME}/lib64',
+-    f'{CUDA_HOME}/lib64/stubs'
+-]
+-third_party_include_dirs = [
+-    'third-party/cutlass/include/cute',
+-    'third-party/cutlass/include/cutlass',
+ ]
+ 
+ # Release
+@@ -142,19 +132,6 @@ class CustomBuildPy(build_py):
+         build_include_dir = os.path.join(self.build_lib, 'deep_gemm/include')
+         os.makedirs(build_include_dir, exist_ok=True)
+ 
+-        # Copy third-party includes to the build directory
+-        for d in third_party_include_dirs:
+-            dirname = d.split('/')[-1]
+-            src_dir = os.path.join(current_dir, d)
+-            dst_dir = os.path.join(build_include_dir, dirname)
+-
+-            # Remove existing directory if it exists
+-            if os.path.exists(dst_dir):
+-                shutil.rmtree(dst_dir)
+-
+-            # Copy the directory
+-            shutil.copytree(src_dir, dst_dir)
+-
+ 
+ class CachedWheelsCommand(_bdist_wheel):
+     def run(self):
diff --git a/pkgs/development/python-modules/duckdb/default.nix b/pkgs/development/python-modules/duckdb/default.nix
index 2f9287fd4b35..9736c5eeae5f 100644
--- a/pkgs/development/python-modules/duckdb/default.nix
+++ b/pkgs/development/python-modules/duckdb/default.nix
@@ -145,6 +145,9 @@ buildPythonPackage rec {
     description = "Python binding for DuckDB";
     homepage = "https://duckdb.org/";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ cpcloud ];
+    maintainers = with lib.maintainers; [
+      cameronraysmith
+      cpcloud
+    ];
   };
 }
diff --git a/pkgs/misc/uboot/default.nix b/pkgs/misc/uboot/default.nix
index d58772e6463f..aee66f2f36e0 100644
--- a/pkgs/misc/uboot/default.nix
+++ b/pkgs/misc/uboot/default.nix
@@ -34,10 +34,10 @@
 }@pkgs:
 
 let
-  defaultVersion = "2025.10";
+  defaultVersion = "2026.01";
   defaultSrc = fetchurl {
     url = "https://ftp.denx.de/pub/u-boot/u-boot-${defaultVersion}.tar.bz2";
-    hash = "sha256-tPAyhI5WzI8hOtWfkTLAhNu7YyvCkXbQJOWCIODv30o=";
+    hash = "sha256-tg1YZc79vHXajaQVbFbEWOAN51pJuAwaLlipbjCtDVQ=";
   };
 
   # Dependencies for the tools need to be included as either native or cross,
diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix
index 79f1bf5f1d09..fbf72005f92d 100644
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@@ -39,7 +39,6 @@ let
   inherit (lib.meta)
     availableOn
     cpeFullVersionWithVendor
-    tryCPEPatchVersionInUpdateWithVendor
     ;
 
   inherit (lib.generators)
@@ -491,7 +490,6 @@ let
       success = true;
       value = cpeFullVersionWithVendor vendor version;
     })
-    tryCPEPatchVersionInUpdateWithVendor
   ];
 
   # The meta attribute is passed in the resulting attribute set,
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index e21a14733ed8..91208e3b4e53 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3748,6 +3748,8 @@ self: super: with self; {
 
   deep-ep = callPackage ../development/python-modules/deep-ep { };
 
+  deep-gemm = callPackage ../development/python-modules/deep-gemm { };
+
   deep-translator = callPackage ../development/python-modules/deep-translator { };
 
   deepdiff = callPackage ../development/python-modules/deepdiff { };