diff --git a/doc/release-notes/rl-2605.section.md b/doc/release-notes/rl-2605.section.md
index 85d3d5b20186..40254a7b143d 100644
--- a/doc/release-notes/rl-2605.section.md
+++ b/doc/release-notes/rl-2605.section.md
@@ -339,6 +339,8 @@ gnuradioMinimal.override {
 
 - The `neovim` package and module now disable by default the `python3` and `ruby` providers, unused by most users and reducing closure size from 365MiB to 240MiB. Host provider executables are not exposed anymore along with the neovim wrapper. You can still refer to those using the neovim provider variables (e.g., `python3_host_prog`).
 
+- `canokey-qemu` support for `qemu` was restored (although disabled by default), after being marked as broken since nixpkgs 25.11. Please note that the format of canokey files has changed, and that some data created with older canokey-qemu release cannot be read by the current version. See the [documentation](https://github.com/canokeys/canokey-qemu/tree/v1?tab=readme-ov-file#compatibility-warning) for details.
+
 ### Deprecations {#sec-nixpkgs-release-26.05-lib-deprecations}
 
 - `mpv-unwrapped.scripts` and `mpv-unwrapped.wrapper` have been removed. Please use `mpvScripts` and `mpv.override` accordingly.
diff --git a/lib/modules.nix b/lib/modules.nix
index 9bf1ac9b4d73..7d91d4b10ce3 100644
--- a/lib/modules.nix
+++ b/lib/modules.nix
@@ -1223,10 +1223,33 @@ let
           else
             defsFiltered.values;
       in
-      {
-        values = defsSorted;
-        inherit (defsFiltered) highestPrio;
-      };
+      # Fast path: the overwhelming majority of options have exactly one
+      # definition whose value carries no property wrapper
+      # (mkIf/mkMerge/mkOverride/mkOrder/definition). In that case the
+      # discharge/filter/sort pipeline above is a no-op but still allocates
+      # several intermediate lists and closures. Detect it up front and hand
+      # the original singleton straight to the type merge. The let-bindings
+      # above are lazy and thus never forced on this branch.
+      if
+        length defs == 1
+        && (
+          let
+            d = head defs;
+          in
+          addErrorContext "while evaluating definitions from `${d.file}':" (
+            !(isAttrs d.value && d.value ? _type)
+          )
+        )
+      then
+        {
+          values = defs;
+          highestPrio = defaultOverridePriority;
+        }
+      else
+        {
+          values = defsSorted;
+          inherit (defsFiltered) highestPrio;
+        };
     defsFinal = defsFinal'.values;
 
     # Type-check the remaining definitions, and merge them. Or throw if no definitions.
diff --git a/lib/tests/modules.sh b/lib/tests/modules.sh
index fbbf95e7c30f..765ca31a48e7 100755
--- a/lib/tests/modules.sh
+++ b/lib/tests/modules.sh
@@ -734,6 +734,8 @@ checkConfigOutput 'ok' config.freeformItems.foo.bar ./adhoc-freeformType-survive
 # Test that specifying both functor.wrapped and functor.payload isn't allowed
 checkConfigError 'Type foo defines both `functor.payload` and `functor.wrapped` at the same time, which is not supported.' config.result ./default-type-merge-both.nix
 
+# Test that not including functor.wrapped is allowed
+checkConfigOutput 'ok' config.result ./default-type-merge-payload.nix
 
 # Anonymous submodules don't get nixed by import resolution/deduplication
 # because of an `extendModules` bug, issue 168767.
diff --git a/lib/tests/modules/default-type-merge-payload.nix b/lib/tests/modules/default-type-merge-payload.nix
new file mode 100644
index 000000000000..d6cdc5906074
--- /dev/null
+++ b/lib/tests/modules/default-type-merge-payload.nix
@@ -0,0 +1,32 @@
+{ lib, options, ... }:
+let
+  fooOf =
+    elemType:
+    lib.mkOptionType {
+      name = "foo";
+      functor = {
+        name = "foo";
+        type = payload: fooOf payload.elemType;
+        binOp = a: _b: a;
+        payload.elemType = elemType;
+      };
+    };
+in
+{
+  imports = [
+    {
+      options.foo = lib.mkOption {
+        type = fooOf lib.types.int;
+      };
+    }
+    {
+      options.foo = lib.mkOption {
+        type = fooOf lib.types.int;
+      };
+    }
+  ];
+
+  options.result = lib.mkOption {
+    default = builtins.seq options.foo "ok";
+  };
+}
diff --git a/lib/types.nix b/lib/types.nix
index b3c40208c2c9..9fb99b9cc66e 100644
--- a/lib/types.nix
+++ b/lib/types.nix
@@ -158,8 +158,11 @@ rec {
         assert (f'.payload != null) == (f.payload != null);
         f.payload != null;
       hasWrapped =
-        assert (f'.wrapped != null) == (f.wrapped != null);
-        f.wrapped != null;
+        let
+          hasWrappedNonNull = set: set ? "wrapped" && set.wrapped != null;
+        in
+        assert (hasWrappedNonNull f') == (hasWrappedNonNull f);
+        hasWrappedNonNull f;
 
       typeFromPayload = if mergedPayload == null then null else f.type mergedPayload;
       typeFromWrapped = if mergedWrapped == null then null else f.type mergedWrapped;
diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
index e7c7d13e1c0a..1f9e5f780491 100644
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -124,6 +124,8 @@
 
 - [whois](https://packages.qa.debian.org/w/whois.html), an intelligent WHOIS client. Available as `programs.whois`.
 
+- [porxie](https://codeberg.org/Blooym/porxie), a correct and efficient ATProto blob proxy for secure content delivery. Available as [services.porxie](#opt-services.porxie.enable).
+
 ## Backward Incompatibilities {#sec-release-26.05-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -361,6 +363,12 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.
 
 - `services.slurm` now supports slurmrestd usage through the `services.slurm.rest` NixOS options.
 
+- The `networking.firewall.logRefusedConnections` option now defaults to
+  `false`.  Logging of refused or dropped incoming connections can generate a
+  very high volume of kernel log messages on internet-facing systems, causing
+  the kernel ring buffer (dmesg) to rotate quickly and potentially discard more
+  relevant diagnostic information.
+
 - The `services.calibre-web` systemd service has been hardened with additional sandboxing restrictions.
 
 - `services.kanidm` options for server, client and unix were moved under dedicated namespaces.
diff --git a/nixos/modules/installer/tools/nix-fallback-paths.nix b/nixos/modules/installer/tools/nix-fallback-paths.nix
index 98bd3cec0de2..7a74c45432ca 100644
--- a/nixos/modules/installer/tools/nix-fallback-paths.nix
+++ b/nixos/modules/installer/tools/nix-fallback-paths.nix
@@ -1,8 +1,8 @@
 {
-  x86_64-linux = "/nix/store/vals1fs2rl6yn5f8gbqj9mvly4r27shs-nix-2.31.4";
-  i686-linux = "/nix/store/fyrlz8cdzvf5csdh5885wifpxc8ywdii-nix-2.31.4";
-  aarch64-linux = "/nix/store/19p3nc892m7idfg2ngd1614660xqbhnm-nix-2.31.4";
-  riscv64-linux = "/nix/store/x1isvq0xnyrg0l29qk2xlp929cgjsmqy-nix-riscv64-unknown-linux-gnu-2.31.4";
-  x86_64-darwin = "/nix/store/4gqxzd5zkxcq271wi5saml4zd92rdkws-nix-2.31.4";
-  aarch64-darwin = "/nix/store/r3gz609kdqchxcmil7dhbravbq8kwm93-nix-2.31.4";
+  x86_64-linux = "/nix/store/q7f0d4m54yj98fcjmbkscw83j82fypnd-nix-2.34.6";
+  i686-linux = "/nix/store/mlv349bmjjx34p50idp54rg0wsm44hws-nix-2.34.6";
+  aarch64-linux = "/nix/store/wlcv2ymswfgwv1cj1q29p26rh26xj3nd-nix-2.34.6";
+  riscv64-linux = "/nix/store/000b0vjlhw359rl82p8pld00g6363c78-nix-riscv64-unknown-linux-gnu-2.34.6";
+  x86_64-darwin = "/nix/store/mqvv503c5l9kgjvc7vyxj3rdx5a71c11-nix-2.34.6";
+  aarch64-darwin = "/nix/store/hcgga2smfm8lqirshrbfpk5j1my1wh4j-nix-2.34.6";
 }
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 1c066b30f915..ce93b9560173 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1345,6 +1345,7 @@
   ./services/networking/pihole-ftl.nix
   ./services/networking/pixiecore.nix
   ./services/networking/pleroma.nix
+  ./services/networking/porxie.nix
   ./services/networking/powerdns.nix
   ./services/networking/pppd.nix
   ./services/networking/pptpd.nix
diff --git a/nixos/modules/services/monitoring/librenms.nix b/nixos/modules/services/monitoring/librenms.nix
index 497cd38a4b09..db45fea66d86 100644
--- a/nixos/modules/services/monitoring/librenms.nix
+++ b/nixos/modules/services/monitoring/librenms.nix
@@ -705,7 +705,7 @@ in
           # convert rrd files when the oneMinutePolling option is changed
           OLD_ENABLED=$(cat ${cfg.dataDir}/one_minute_enabled)
           if [[ $OLD_ENABLED != "${lib.boolToString cfg.enableOneMinutePolling}" ]]; then
-            ${package}/scripts/rrdstep.php -h all
+            ${artisanWrapper}/bin/librenms-artisan maintenance:rrd-step all
             echo "${lib.boolToString cfg.enableOneMinutePolling}" > ${cfg.dataDir}/one_minute_enabled
           fi
 
diff --git a/nixos/modules/services/networking/firewall.nix b/nixos/modules/services/networking/firewall.nix
index 95308c2a9cfc..2e3d1250ef2c 100644
--- a/nixos/modules/services/networking/firewall.nix
+++ b/nixos/modules/services/networking/firewall.nix
@@ -118,7 +118,7 @@ in
 
       logRefusedConnections = lib.mkOption {
         type = lib.types.bool;
-        default = true;
+        default = false;
         description = ''
           Whether to log rejected or dropped incoming connections.
           Note: The logs are found in the kernel logs, i.e. dmesg
diff --git a/nixos/modules/services/networking/porxie.nix b/nixos/modules/services/networking/porxie.nix
new file mode 100644
index 000000000000..54c55230d3a7
--- /dev/null
+++ b/nixos/modules/services/networking/porxie.nix
@@ -0,0 +1,314 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.porxie;
+in
+{
+  options.services.porxie = {
+    enable = lib.mkEnableOption "Porxie, an ATProto blob proxy for secure content delivery";
+
+    package = lib.mkPackageOption pkgs "porxie" { };
+
+    environmentFiles = lib.mkOption {
+      type = lib.types.listOf lib.types.path;
+      default = [ ];
+      description = ''
+        Files to load environment variables from. Use for secrets such as
+        {env}`PORXIE_SERVER_AUTH_TOKEN` and {env}`PORXIE_POLICY_REQUEST_HEADERS`.
+      '';
+    };
+
+    settings = lib.mkOption {
+      default = { };
+      description = ''
+        Configuration for Porxie as environment variables. See the
+        [README](https://codeberg.org/Blooym/porxie/src/branch/main/README.md)
+        for detailed information about application configuration.
+
+        Secrets such as {option}`settings.PORXIE_SERVER_AUTH_TOKEN` should be set via
+        {option}`environmentFiles` rather than here, as values set here will
+        be readable in the Nix store.
+      '';
+      type = lib.types.submodule {
+        freeformType = lib.types.attrsOf (
+          lib.types.nullOr (
+            lib.types.oneOf [
+              lib.types.str
+              lib.types.bool
+              lib.types.int
+            ]
+          )
+        );
+
+        options = {
+          # Server.
+          PORXIE_SERVER_ADDRESS = lib.mkOption {
+            type = lib.types.str;
+            default = "ip:127.0.0.1:6314";
+            description = ''
+              Address to bind the server to.
+
+              Use the `ip:` prefix for an IP address (e.g. `ip:127.0.0.1:6314`), or on UNIX
+              systems, the `unix:` prefix for a UNIX socket path (e.g. `unix:/run/porxie/porxie.sock`).
+            '';
+          };
+          PORXIE_SERVER_AUTH_TOKEN = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = ''
+              Bearer token for authenticating admin requests.
+
+              When unset, all authenticated endpoints will reject requests with HTTP 401.
+
+              Should be set via {option}`environmentFiles` rather than directly.
+            '';
+          };
+
+          # Blobs.
+          PORXIE_BLOB_ALLOWED_MIMETYPES = lib.mkOption {
+            type = lib.types.nullOr (lib.types.listOf lib.types.str);
+            default = null;
+            apply = v: if v != null then lib.concatStringsSep "," v else null;
+            description = ''
+              Blob MIME types that can be served.
+
+              Validation is done loosely via content inference. Further validation can be done by
+              a layer above this proxy, such as an image transformation service. When inference
+              fails, the blob's type falls back to `application/octet-stream`. When that type is
+              allowed, blobs failing inference can still be served.
+            '';
+          };
+          PORXIE_BLOB_MAX_SIZE = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = ''
+              Maximum blob size that can be fetched and served.
+
+              Blobs that exceed this limit will return HTTP 413. Setting this too high can
+              exhaust process or system memory. The minimum value is 512kb and the maximum is
+              the system's total memory.
+            '';
+          };
+          PORXIE_BLOB_CACHE_HEADER = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = ''
+              The `Cache-Control` header value to send alongside blob responses.
+
+              This does not affect internal cache lifetimes, only how downstream clients such as
+              CDNs and browsers are instructed to cache responses. Intermediary caches may need
+              to be cleared manually for changes to take effect quickly.
+            '';
+          };
+          PORXIE_BLOB_PROCESSING_TIMEOUT = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = "Maximum duration a blob can be processed by this server before aborting.";
+          };
+          PORXIE_BLOB_HTTP_TIMEOUT = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = "Maximum duration before blob fetch requests are timed out.";
+          };
+          PORXIE_BLOB_HTTP_CONNECT_TIMEOUT = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = ''
+              Maximum duration before an attempted connection to a blob upstream is aborted.
+
+              This value should be lower than {option}`settings.PORXIE_BLOB_HTTP_TIMEOUT`.
+            '';
+          };
+
+          # Identity.
+          PORXIE_IDENTITY_PLC_URL = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = ''
+              URL of the PLC instance used for `did:plc` lookups.
+
+              Can typically be left as default unless using a custom or local development setup.
+            '';
+          };
+          PORXIE_IDENTITY_HTTP_TIMEOUT = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = "Maximum duration before identity resolution requests are timed out.";
+          };
+          PORXIE_IDENTITY_HTTP_CONNECT_TIMEOUT = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = ''
+              Maximum duration before a connection attempt to an identity upstream is aborted.
+
+              This value should be lower than {option}`settings.PORXIE_IDENTITY_HTTP_TIMEOUT`.
+            '';
+          };
+
+          # Cache.
+          PORXIE_CACHE_ALLOCATION = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = ''
+              Total memory allocation for the internal cache.
+
+              Blobs are cached using an LFU policy. The most frequently requested blobs are kept
+              longest when the cache approaches its limit.
+
+              For production deployments, a CDN or caching layer in front of this server is
+              recommended for lower latency and better global availability.
+
+              Setting this too high can exhaust process or system memory. The minimum value is
+              8mb and the maximum is the system's total memory.
+            '';
+          };
+          PORXIE_CACHE_BLOB_TTI = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = "How long blobs can be idle in the cache before expiring.";
+          };
+          PORXIE_CACHE_OWNERSHIP_TTL = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = "How long blob ownership can be cached before expiring.";
+          };
+          PORXIE_CACHE_POLICY_TTL = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = "How long policy decisions can be cached before expiring.";
+          };
+          PORXIE_CACHE_IDENTITY_TTL = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = "How long identity lookups (DID resolution, etc.) can be cached before expiring.";
+          };
+
+          # Policy.
+          PORXIE_POLICY_URL = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = ''
+              Policy service URL that DID+CID pairs will be checked against.
+
+              Requests are sent as HTTP GET `<url>/<did>/<cid>`. The service is expected to
+              return HTTP 200 (OK) if permitted or HTTP 410 (GONE) if restricted.
+            '';
+          };
+          PORXIE_POLICY_REQUEST_HEADERS = lib.mkOption {
+            type = lib.types.nullOr (lib.types.listOf lib.types.str);
+            default = null;
+            apply = v: if v != null then lib.concatStringsSep "|" v else null;
+            description = ''
+              Headers sent alongside all requests to the policy service.
+              Each header must be in the format `Name: value`.
+
+              Should be set via {option}`environmentFiles` for sensitive values such as API keys.
+            '';
+          };
+          PORXIE_POLICY_FAIL_OPEN = lib.mkOption {
+            type = lib.types.nullOr lib.types.bool;
+            default = null;
+            apply = v: if v != null then lib.boolToString v else null;
+            description = ''
+              Allow requests to proceed if the policy service is unavailable or returns an
+              unexpected status code.
+
+              Warning: enabling this means restricted blobs may be served when the policy
+              service is unreachable.
+            '';
+          };
+          PORXIE_POLICY_HTTP_TIMEOUT = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = "Maximum duration before policy service requests are timed out.";
+          };
+          PORXIE_POLICY_HTTP_CONNECT_TIMEOUT = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = ''
+              Maximum duration before an attempted connection to the policy service is aborted.
+
+              This value should be lower than {option}`settings.PORXIE_POLICY_HTTP_TIMEOUT`.
+            '';
+          };
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion =
+          (cfg.settings.PORXIE_POLICY_REQUEST_HEADERS != null || cfg.settings.PORXIE_POLICY_FAIL_OPEN != null)
+          -> cfg.settings.PORXIE_POLICY_URL != null;
+        message = "services.porxie: PORXIE_POLICY_URL must be set when using any other policy options";
+      }
+    ];
+
+    systemd.services.porxie = {
+      description = "Porxie - ATProto blob proxy";
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        User = "porxie";
+        DynamicUser = true;
+
+        ExecStart = lib.getExe cfg.package;
+        Environment = lib.mapAttrsToList (k: v: "${k}=${lib.escapeShellArg (toString v)}") (
+          lib.filterAttrs (_: v: v != null) cfg.settings
+        );
+        EnvironmentFile = cfg.environmentFiles;
+        Restart = "on-failure";
+        RestartSec = 5;
+        RuntimeDirectory = "porxie";
+        RuntimeDirectoryMode = "0750";
+
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProcSubset = "all";
+        ProtectSystem = "strict";
+
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+
+        MemoryDenyWriteExecute = true;
+        LockPersonality = true;
+        NoNewPrivileges = true;
+        AmbientCapabilities = "";
+        RemoveIPC = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+        UMask = "0077";
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ blooym ];
+}
diff --git a/nixos/modules/services/networking/shairport-sync.nix b/nixos/modules/services/networking/shairport-sync.nix
index ca2aa156b773..f4296396967c 100644
--- a/nixos/modules/services/networking/shairport-sync.nix
+++ b/nixos/modules/services/networking/shairport-sync.nix
@@ -38,13 +38,13 @@ in
       settings = mkOption {
         type = configFormat.type;
         default = {
-          general.output_backend = "pa";
+          general.output_backend = "pulseaudio";
           diagnostics.log_verbosity = 1;
         };
         example = {
           general = {
             name = "NixOS Shairport";
-            output_backend = "pw";
+            output_backend = "pipewire";
           };
           metadata = {
             enabled = "yes";
@@ -112,13 +112,23 @@ in
   ###### implementation
 
   config = mkIf config.services.shairport-sync.enable {
+    assertions = [
+      {
+        assertion = config.services.shairport-sync.settings.general.output_backend or null != "pw";
+        message = "shairport-sync 5.0 renamed the pipewire backend from 'pw' to 'pipewire'";
+      }
+      {
+        assertion = config.services.shairport-sync.settings.general.output_backend or null != "pa";
+        message = "shairport-sync 5.0 renamed the pulseaudio backend from 'pa' to 'pulseaudio'";
+      }
+    ];
 
     services.avahi.enable = true;
     services.avahi.publish.enable = true;
     services.avahi.publish.userServices = true;
 
     services.shairport-sync.settings = {
-      general.output_backend = lib.mkDefault "pa";
+      general.output_backend = lib.mkDefault "pulseaudio";
       diagnostics.log_verbosity = lib.mkDefault 1;
     };
 
diff --git a/nixos/modules/services/torrent/flood.nix b/nixos/modules/services/torrent/flood.nix
index 658ce55939f6..ed99e3a16cf8 100644
--- a/nixos/modules/services/torrent/flood.nix
+++ b/nixos/modules/services/torrent/flood.nix
@@ -80,6 +80,7 @@ in
           "AF_UNIX"
           "AF_INET"
           "AF_INET6"
+          "AF_NETLINK"
         ];
         RestrictNamespaces = true;
         RestrictRealtime = true;
diff --git a/nixos/modules/services/web-apps/hedgedoc.nix b/nixos/modules/services/web-apps/hedgedoc.nix
index 61ad0a3a1a05..646eb1f79d09 100644
--- a/nixos/modules/services/web-apps/hedgedoc.nix
+++ b/nixos/modules/services/web-apps/hedgedoc.nix
@@ -229,20 +229,16 @@ in
         Nix store, by specifying placeholder variables as the option value in Nix and
         setting these variables accordingly in the environment file.
 
+
+        Snippet of HedgeDoc config containing a secret:
         ```
-          # snippet of HedgeDoc-related config
-          services.hedgedoc.settings.dbURL = "postgres://hedgedoc:\''${DB_PASSWORD}@db-host:5432/hedgedocdb";
-          services.hedgedoc.settings.minio.secretKey = "$MINIO_SECRET_KEY";
+        services.hedgedoc.settings.dbURL = "postgres://hedgedoc:\''${DB_PASSWORD}@db-host:5432/hedgedocdb";
         ```
 
-        ```
-          # content of the environment file
+        and the content of this environment file:
+        ````
           DB_PASSWORD=verysecretdbpassword
-          MINIO_SECRET_KEY=verysecretminiokey
         ```
-
-        Note that this file needs to be available on the host on which
-        `HedgeDoc` is running.
       '';
     };
   };
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 9a059c30563c..b6512c99ca01 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1303,6 +1303,7 @@ in
   polaris = runTest ./polaris.nix;
   pomerium = handleTestOn [ "x86_64-linux" ] ./pomerium.nix { };
   portunus = runTest ./portunus.nix;
+  porxie = runTest ./porxie.nix;
   postfix = handleTest ./postfix.nix { };
   postfix-raise-smtpd-tls-security-level =
     handleTest ./postfix-raise-smtpd-tls-security-level.nix
diff --git a/nixos/tests/gitlab/runner/podman-runner/default.nix b/nixos/tests/gitlab/runner/podman-runner/default.nix
index 0bdccfaeed3a..885f0d191ae2 100644
--- a/nixos/tests/gitlab/runner/podman-runner/default.nix
+++ b/nixos/tests/gitlab/runner/podman-runner/default.nix
@@ -104,31 +104,41 @@ let
         + "/docker.nix"
       );
 
-  nixImageBase = pkgs.callPackage nixImageBaseFn {
-    name = "local/nix-base";
-    tag = "latest";
+  nixImageBase =
+    nixConf:
+    pkgs.callPackage nixImageBaseFn {
+      name = "local/nix-base";
+      tag = "latest";
 
-    bundleNixpkgs = false;
-    maxLayers = 2;
+      bundleNixpkgs = false;
+      maxLayers = 2;
 
-    # You can add here a user with uid,gid,uname,gname etc.
-    # We are using root.
+      # You can add here a user with uid,gid,uname,gname etc.
+      # We are using root.
 
-    extraPkgs = nixStorePkgs;
+      extraPkgs = nixStorePkgs;
 
-    nixConf = {
-      cores = "0";
-      experimental-features = [
-        "nix-command"
-        "flakes"
-      ];
+      nixConf = {
+        cores = "0";
+        experimental-features = [
+          "nix-command"
+          "flakes"
+        ];
+      }
+      // nixConf;
     };
-  };
 
   # This is the daemon image which provides the store
   # as volumes.
   nixDaemonImage = pkgs.dockerTools.buildLayeredImage {
-    fromImage = nixImageBase;
+    fromImage = nixImageBase {
+      min-free = "1G"; # Triggers garbage collection.
+      max-free = "10G"; # Stops garbage collection at 10G free space.
+
+      # Reduce disk usage by discarding old derivations/outputs
+      keep-derivations = false;
+      keep-outputs = false;
+    };
     name = "local/nix-daemon";
     tag = "latest";
 
diff --git a/nixos/tests/porxie.nix b/nixos/tests/porxie.nix
new file mode 100644
index 000000000000..7f14509a6ba6
--- /dev/null
+++ b/nixos/tests/porxie.nix
@@ -0,0 +1,23 @@
+{ lib, ... }:
+{
+  name = "porxie";
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.porxie = {
+        enable = true;
+        settings = {
+          PORXIE_SERVER_ADDRESS = "ip:127.0.0.1:6453";
+        };
+      };
+    };
+
+  testScript = ''
+    machine.wait_for_unit("porxie.service")
+    machine.wait_for_open_port(6453)
+    machine.succeed("curl --fail http://localhost:6453")
+  '';
+
+  meta.maintainers = [ lib.maintainers.blooym ];
+}
diff --git a/nixos/tests/systemd-initrd-luks-fido2.nix b/nixos/tests/systemd-initrd-luks-fido2.nix
index 002281585064..a38c97e8b0dd 100644
--- a/nixos/tests/systemd-initrd-luks-fido2.nix
+++ b/nixos/tests/systemd-initrd-luks-fido2.nix
@@ -1,11 +1,13 @@
-{ lib, pkgs, ... }:
+{
+  lib,
+  pkgs,
+  hostPkgs,
+  ...
+}:
 {
   name = "systemd-initrd-luks-fido2";
 
-  meta = {
-    # `canokey-qemu` is marked broken.
-    broken = true;
-  };
+  qemu.package = hostPkgs.qemu_test.override { canokeySupport = true; };
 
   nodes.machine =
     { pkgs, config, ... }:
@@ -22,6 +24,7 @@
           "-device canokey,bus=usb-bus.0,file=/tmp/canokey-file"
         ];
       };
+
       boot.loader.systemd-boot.enable = true;
 
       boot.initrd.systemd.enable = true;
diff --git a/pkgs/applications/emulators/libretro/cores/snes9x2010.nix b/pkgs/applications/emulators/libretro/cores/snes9x2010.nix
index 64d38695d142..70391d943e7a 100644
--- a/pkgs/applications/emulators/libretro/cores/snes9x2010.nix
+++ b/pkgs/applications/emulators/libretro/cores/snes9x2010.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore rec {
   core = "snes9x2010";
-  version = "0-unstable-2026-03-31";
+  version = "0-unstable-2026-04-09";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "snes9x2010";
-    rev = "693c0dd2a3004a6332a076a08d14c78086f26bc1";
-    hash = "sha256-/+VdaLY6JycN2o1/LOPFIOmcp6ZVAqpX1MVuHN3B/Nc=";
+    rev = "a7a4bfaed4c6408908c76af20ad625e1645c3d11";
+    hash = "sha256-mtTgh/koM7jS7/cH7qRgTa+xJXBBJSdxHHbhOd/q4i4=";
   };
 
   makeFlags = [ "GIT_VERSION=${builtins.substring 0 7 src.rev}" ];
diff --git a/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix b/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
index 48920c478bff..6864ad465b89 100644
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
@@ -10,11 +10,11 @@
 buildMozillaMach rec {
   pname = "firefox-beta";
   binaryName = "firefox-beta";
-  version = "150.0b5";
+  version = "150.0b9";
   applicationName = "Firefox Beta";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "6ae09ae8a73865a4d9cdfd389f0cfec667fc717e13127ae9927b6fc3bd5e7cf49a83dd5dbbed8bae9b72dddd24e6156bdc483fcb3ccb726b46070d25fd02f86f";
+    sha512 = "5afa7b27ee38e809717ca02fede9aa5ebe27f9aeb78d7953e7b0790e30edb663bf0053335e42e258b7bf01b8859e6b0a10c23851cf8b495217f954ac41a386d4";
   };
 
   meta = {
diff --git a/pkgs/applications/networking/browsers/firefox/packages/firefox-esr-140.nix b/pkgs/applications/networking/browsers/firefox/packages/firefox-esr-140.nix
index c920d47bb04c..76661f7d88d8 100644
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-esr-140.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-esr-140.nix
@@ -9,11 +9,11 @@
 
 buildMozillaMach rec {
   pname = "firefox";
-  version = "140.9.0esr";
+  version = "140.9.1esr";
   applicationName = "Firefox ESR";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "bc03fd2a73d00a88bd0a3c9eeaefe618ffb34226fb7bc2fac4a02246ff29fe038423bf77538273ee6fac25fb1e3e4fa98bb522026ae3427a0ad5f41d2ec6ba98";
+    sha512 = "119a4e4e536fd4534adcc4a546a988e553285f9326bf16e9771854ec2dc7d039a729aedc5925623e172260a5e154172c56a011f131068736eb2a89a8de611840";
   };
 
   meta = {
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 8778068f12ba..be318d742194 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -346,11 +346,11 @@
     "vendorHash": null
   },
   "dopplerhq_doppler": {
-    "hash": "sha256-ZqlakWqu9gOMxVLAFUzmho3hl+wbwPA5AXX8Z7XRsCc=",
+    "hash": "sha256-43NFvuKJ2QlCLoEq9N1RSv4BtF4s/GFzzakeIxw6V4Q=",
     "homepage": "https://registry.terraform.io/providers/DopplerHQ/doppler",
     "owner": "DopplerHQ",
     "repo": "terraform-provider-doppler",
-    "rev": "v1.21.1",
+    "rev": "v1.21.2",
     "spdx": "Apache-2.0",
     "vendorHash": "sha256-B8mYLd4VdADWoQLWiCM85VQrBfDdlYQ0wkCp9eUBQ4U="
   },
@@ -1031,13 +1031,13 @@
     "vendorHash": "sha256-ofzbDmivXgH1i1Gjhpyp0bk3FDs5SnxwoRuNAWyMqyI="
   },
   "opentelekomcloud_opentelekomcloud": {
-    "hash": "sha256-JSVznbwVTc9/c1q16hv76qJuOI8eRPzsEo0ozRR6oxw=",
+    "hash": "sha256-F8V/eLkKJCC5zPfNh0NC6Z6c3aZjnEoXXa+po3I1NDw=",
     "homepage": "https://registry.terraform.io/providers/opentelekomcloud/opentelekomcloud",
     "owner": "opentelekomcloud",
     "repo": "terraform-provider-opentelekomcloud",
-    "rev": "v1.36.62",
+    "rev": "v1.36.63",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-QFC9oFQ6NiQZiJCltMrwX8p9shm6vEfVnRpJBAtnPW4="
+    "vendorHash": "sha256-qtH6jjhzGRGaHYKjpJLPWjwRL5PQIyOPvI33BVf4cO4="
   },
   "opsgenie_opsgenie": {
     "hash": "sha256-Y67kcg/ovvZc22l1CBz0Mqu7DAIit5F0jQNfQrl2EGI=",
diff --git a/pkgs/by-name/ca/canokey-qemu/canokey-qemu-memcpy.patch b/pkgs/by-name/ca/canokey-qemu/canokey-qemu-memcpy.patch
deleted file mode 100644
index 578c687f54cf..000000000000
--- a/pkgs/by-name/ca/canokey-qemu/canokey-qemu-memcpy.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From 9e59480d941c40b868ebafa5138bbc71ca87f08e Mon Sep 17 00:00:00 2001
-From: Alyssa Ross <hi@alyssa.is>
-Date: Sat, 18 May 2024 09:55:17 +0200
-Subject: [PATCH] Fix build where memcpy is a macro
-
-I got the following compiler error with Clang 16 building for
-x86_64-apple-darwin:
-
-	/tmp/nix-build-canokey-qemu-0-unstable-2023-06-06.drv-0/source/canokey-core/applets/oath/oath.c:44:50: error: too many arguments provided to function-like macro invocation
-	  memcpy(RDATA, (uint8_t[]){OATH_TAG_VERSION, 3, 0x05, 0x05, 0x05, OATH_TAG_NAME, HANDLE_LEN}, 7);
-	                                                 ^
-	/nix/store/vw8y07yai2pjv02s1piw3r5cyhmjbddf-Libsystem-1238.60.2/include/secure/_string.h:64:9: note: macro 'memcpy' defined here
-	#define memcpy(dest, src, len)                                  \
-	        ^
-	/tmp/nix-build-canokey-qemu-0-unstable-2023-06-06.drv-0/source/canokey-core/applets/oath/oath.c:44:3: note: parentheses are required around macro argument containing braced initializer list
-	  memcpy(RDATA, (uint8_t[]){OATH_TAG_VERSION, 3, 0x05, 0x05, 0x05, OATH_TAG_NAME, HANDLE_LEN}, 7);
-	  ^
-	                (                                                                            )
-	1 error generated.
-
-Link: https://github.com/canokeys/canokey-core/pull/85
----
- canokey-core/applets/oath/oath.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/canokey-core/applets/oath/oath.c b/canokey-core/applets/oath/oath.c
-index bd8361a..2d2c0ef 100644
---- a/canokey-core/applets/oath/oath.c
-+++ b/canokey-core/applets/oath/oath.c
-@@ -41,7 +41,7 @@ int oath_install(uint8_t reset) {
- static int oath_select(const CAPDU *capdu, RAPDU *rapdu) {
-   if (P2 != 0x00) EXCEPT(SW_WRONG_P1P2);
- 
--  memcpy(RDATA, (uint8_t[]){OATH_TAG_VERSION, 3, 0x05, 0x05, 0x05, OATH_TAG_NAME, HANDLE_LEN}, 7);
-+  memcpy(RDATA, ((uint8_t[]){OATH_TAG_VERSION, 3, 0x05, 0x05, 0x05, OATH_TAG_NAME, HANDLE_LEN}), 7);
-   if (read_attr(OATH_FILE, ATTR_HANDLE, RDATA + 7, HANDLE_LEN) < 0) return -1;
-   LL = 7 + HANDLE_LEN;
- 
--- 
-2.44.0
-
diff --git a/pkgs/by-name/ca/canokey-qemu/package.nix b/pkgs/by-name/ca/canokey-qemu/package.nix
index be8235b8dda4..78030234fc0c 100644
--- a/pkgs/by-name/ca/canokey-qemu/package.nix
+++ b/pkgs/by-name/ca/canokey-qemu/package.nix
@@ -3,29 +3,30 @@
   stdenv,
   fetchFromGitHub,
   cmake,
+  python3Packages,
   unstableGitUpdater,
 }:
 stdenv.mkDerivation rec {
   pname = "canokey-qemu";
-  version = "0-unstable-2023-06-06";
-  rev = "151568c34f5e92b086b7a3a62a11c43dd39f628b";
+  version = "0-unstable-2026-03-24";
+  rev = "41044ec17ddb835b3e5acb385a2e429aa74af627";
 
   src = fetchFromGitHub {
     owner = "canokeys";
     repo = "canokey-qemu";
     inherit rev;
     fetchSubmodules = true;
-    hash = "sha256-4V/2UOgGWgL+tFJO/k90bCDjWSVyIpxw3nYi9NU/OxA=";
+    hash = "sha256-eunhMRp3HJ80kCCZbiMGNjA9b0uUMzOsSeNh61d1iJU=";
   };
 
-  patches = [
-    ./canokey-qemu-memcpy.patch
-  ];
-
   postPatch = ''
     substituteInPlace canokey-core/CMakeLists.txt \
-      --replace "COMMAND git describe --always --tags --long --abbrev=8 --dirty >>" "COMMAND echo '$rev' >>"
-  '';
+      --replace-fail "git describe --always --tags --long --abbrev=8 --dirty >>" "echo '$rev' >>"
+  ''
+  + (lib.optionalString stdenv.hostPlatform.isStatic ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "add_library(canokey-qemu SHARED" "add_library(canokey-qemu STATIC"
+  '');
 
   preConfigure = ''
     cmakeFlagsArray+=(
@@ -38,6 +39,24 @@ stdenv.mkDerivation rec {
           ++ lib.optionals stdenv.cc.isClang [
             "-Wno-error=documentation"
           ]
+          ++ lib.optionals stdenv.cc.isGNU [
+            # canokey-qemu contains a vendored copy of mbedtls, and
+            # mbedtls widely uses a pattern of starting unions with an
+            # unsigned int dummy member, and then initializing those unions to
+            # { 0 }.  The problem with this is that it only initializes that
+            # first union member, so in the common case where the non-dummy
+            # members are larger than the dummy member, they will only be
+            # partially initialized since GCC 15[1].  Upstream has added
+            # ad-hoc memset calls to mitigate this issue, but initializers are
+            # also still widely used.  To avoid the risk of using
+            # uninitialized memory, force the compiler to zero all bits of
+            # unions, not just the first element, until upstream has a
+            # systemic fix in place[2].
+            #
+            # [1]: https://gcc.gnu.org/gcc-15/changes.html
+            # [2]: https://github.com/Mbed-TLS/mbedtls/issues/9885
+            "-fzero-init-padding-bits=unions"
+          ]
         )
       }
     )
@@ -48,19 +67,19 @@ stdenv.mkDerivation rec {
     "dev"
   ];
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [
+    cmake
+    python3Packages.jsonschema
+    python3Packages.jinja2
+  ];
 
   passthru.updateScript = unstableGitUpdater { };
 
   meta = {
     homepage = "https://github.com/canokeys/canokey-qemu";
-    description = "CanoKey QEMU Virt Card";
+    description = "CanoKey QEMU Virtual Card";
+    longDescription = "A virtual OPENPGP and FIDO2 card. Only for testing purpose. There is no warranty on security.";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ oxalica ];
-    # Uses a four‐year‐old patched vendored version of Mbed TLS for
-    # cryptography that doesn’t build with CMake 4. Doesn’t build with
-    # gurrent versions of `canokey-core`, either. No upstream
-    # development since 2023.
-    broken = true;
+    maintainers = with lib.maintainers; [ symphorien ];
   };
 }
diff --git a/pkgs/by-name/ch/checkov/package.nix b/pkgs/by-name/ch/checkov/package.nix
index d38e7c7c9d9c..b1e76369c259 100644
--- a/pkgs/by-name/ch/checkov/package.nix
+++ b/pkgs/by-name/ch/checkov/package.nix
@@ -35,14 +35,14 @@ let
 in
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "checkov";
-  version = "3.2.513";
+  version = "3.2.521";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     tag = finalAttrs.version;
-    hash = "sha256-diPsVe8fhWKHMn02qKK91MwPqXNVFpmE8n5e9JJsDCM=";
+    hash = "sha256-xRVA5VPDevdq4LIcJRl/fbCn9iZA+pnw2hvDfHi0MIo=";
   };
 
   pythonRelaxDeps = [
@@ -106,6 +106,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     networkx
     openai
     packaging
+    platformdirs
     policyuniverse
     prettytable
     pycep-parser
@@ -158,6 +159,8 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     "test_sast_js_filtered_files_by_ts"
     # Timing sensitive
     "test_non_multiline_pair_time_limit_creating_report"
+    # Tests want to run bash script
+    "test_entrypoint"
   ];
 
   disabledTestPaths = [
diff --git a/pkgs/by-name/dn/dnsight/package.nix b/pkgs/by-name/dn/dnsight/package.nix
new file mode 100644
index 000000000000..73f35e491ff1
--- /dev/null
+++ b/pkgs/by-name/dn/dnsight/package.nix
@@ -0,0 +1,5 @@
+{ python3Packages }:
+
+(python3Packages.toPythonApplication python3Packages.dnsight).overrideAttrs {
+  __structuredAttrs = true;
+}
diff --git a/pkgs/by-name/dp/dprint/plugins/dprint-plugin-biome.nix b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-biome.nix
index dc75ae854562..1eb892d89f2f 100644
--- a/pkgs/by-name/dp/dprint/plugins/dprint-plugin-biome.nix
+++ b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-biome.nix
@@ -1,7 +1,7 @@
 { mkDprintPlugin }:
 mkDprintPlugin {
   description = "Biome (JS/TS/JSON) wrapper plugin";
-  hash = "sha256-KwmgD5VzU9m7jELeFAkSjS53B0fGVxZp8YvOG1nc8gM=";
+  hash = "sha256-OCnhTv0UfRX4ntmkhNlswfhHbxVFiGu8ovYagEITlI8=";
   initConfig = {
     configExcludes = [ "**/node_modules" ];
     configKey = "biome";
@@ -17,6 +17,6 @@ mkDprintPlugin {
   };
   pname = "dprint-plugin-biome";
   updateUrl = "https://plugins.dprint.dev/dprint/biome/latest.json";
-  url = "https://plugins.dprint.dev/biome-0.12.6.wasm";
-  version = "0.12.6";
+  url = "https://plugins.dprint.dev/biome-0.12.7.wasm";
+  version = "0.12.7";
 }
diff --git a/pkgs/by-name/du/duckdb/package.nix b/pkgs/by-name/du/duckdb/package.nix
index 905eab0038ee..401df7d6762b 100644
--- a/pkgs/by-name/du/duckdb/package.nix
+++ b/pkgs/by-name/du/duckdb/package.nix
@@ -123,8 +123,11 @@ stdenv.mkDerivation (finalAttrs: {
           "test/sql/aggregate/aggregates/histogram_table_function.test"
         ]
         ++ lib.optionals stdenv.hostPlatform.isDarwin [
-          # SIGTRAP during iejoin tests on aarch64-darwin (with and without sandbox)
-          # iejoin implementation rewritten in 1.5.x with new parallel task scheduling
+          # UB in PhysicalRangeJoin (shared by IEJoin and PiecewiseMergeJoin) causes
+          # Apple Clang at -O3 to emit brk trap instructions on aarch64-darwin.
+          # Affects any test routing through PhysicalIEJoin (2+ inequality conditions,
+          # cardinality >= merge_join_threshold) or forcing IEJoin via debug_asof_iejoin.
+          "test/sql/join/iejoin/iejoin_issue_6314.test_slow"
           "test/sql/join/iejoin/iejoin_issue_6861.test"
           "test/sql/join/iejoin/iejoin_issue_7278.test"
           "test/sql/join/iejoin/iejoin_projection_maps.test"
@@ -138,7 +141,13 @@ stdenv.mkDerivation (finalAttrs: {
           "test/sql/join/iejoin/test_iejoin_null_keys.test"
           "test/sql/join/iejoin/test_iejoin_overlaps.test"
           "test/sql/join/iejoin/test_iejoin_predicate.test"
+          "test/sql/join/iejoin/test_iejoin_sort_tasks.test_slow"
           "test/sql/join/iejoin/test_iesemijoin.test"
+          # asof tests that loop debug_asof_iejoin=True, forcing the IEJoin path
+          "test/sql/join/asof/test_asof_join_inequalities.test"
+          "test/sql/join/asof/test_asof_join_missing.test_slow"
+          # 10240-row inequality join routing to IEJoin via plan_comparison_join.cpp
+          "test/sql/join/test_complex_range_join.test"
         ]
       );
       LD_LIBRARY_PATH = lib.optionalString stdenv.hostPlatform.isDarwin "DY" + "LD_LIBRARY_PATH";
diff --git a/pkgs/by-name/fe/fence/package.nix b/pkgs/by-name/fe/fence/package.nix
index a5be31cc803f..3ce2c5b7cbd7 100644
--- a/pkgs/by-name/fe/fence/package.nix
+++ b/pkgs/by-name/fe/fence/package.nix
@@ -14,13 +14,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "fence";
-  version = "0.1.42";
+  version = "0.1.46";
 
   src = fetchFromGitHub {
     owner = "Use-Tusk";
     repo = "fence";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TxSUgU32Y+IScFtAgWnB32OgyLaC7kWRVmYiM986nVo=";
+    hash = "sha256-IoWnA7gUfp6wyVBkqtH0How6DqHnaO78GlxknA5Y8+w=";
   };
 
   vendorHash = "sha256-P30NCXYX27R7F/dNhWSwiLg8T2f6J0/hlu6G3wlENFI=";
diff --git a/pkgs/by-name/fl/fluent-reader/package.nix b/pkgs/by-name/fl/fluent-reader/package.nix
index b2a3e3e9cdec..282835570157 100644
--- a/pkgs/by-name/fl/fluent-reader/package.nix
+++ b/pkgs/by-name/fl/fluent-reader/package.nix
@@ -6,11 +6,11 @@
 
 let
   pname = "fluent-reader";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchurl {
     url = "https://github.com/yang991178/fluent-reader/releases/download/v${version}/Fluent.Reader.${version}.AppImage";
-    hash = "sha256-v9sj0xy6YalPZ49z8E6bczgzu9XmBuA1JK7/leKnvV4=";
+    hash = "sha256-83bqDyiPcAKIEejIPLSVLb8hxAtNogF98nYbOCjZtsg=";
   };
 
   appimageContents = appimageTools.extractType2 { inherit pname version src; };
diff --git a/pkgs/by-name/ht/htop/package.nix b/pkgs/by-name/ht/htop/package.nix
index c0f3deb92df4..a159d4b3dce0 100644
--- a/pkgs/by-name/ht/htop/package.nix
+++ b/pkgs/by-name/ht/htop/package.nix
@@ -19,13 +19,13 @@ assert systemdSupport -> stdenv.hostPlatform.isLinux;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "htop" + lib.optionalString withVimKeys "-vim";
-  version = "3.4.1";
+  version = "3.5.0";
 
   src = fetchFromGitHub {
     owner = "htop-dev";
     repo = "htop";
     tag = finalAttrs.version;
-    hash = "sha256-fVqQwXbJus2IVE1Bzf3yJJpKK4qcZN/SCTX1XYkiHhU=";
+    hash = "sha256-RVJH7osffP3vU74A3e2mjGBAB0ZPMBisBL8n2kDMB+Q=";
   };
 
   patches = lib.optional withVimKeys (fetchpatch2 {
diff --git a/pkgs/by-name/li/lisette/package.nix b/pkgs/by-name/li/lisette/package.nix
index 8c2b1ffb00ab..f1831e26b189 100644
--- a/pkgs/by-name/li/lisette/package.nix
+++ b/pkgs/by-name/li/lisette/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lisette";
-  version = "0.1.3";
+  version = "0.1.9";
 
   src = fetchFromGitHub {
     owner = "ivov";
     repo = "lisette";
     tag = "lisette-v${finalAttrs.version}";
-    hash = "sha256-vepiowHDu0l7BCT42ceIEOVaoUd9ttrE21N6D9+zPgo=";
+    hash = "sha256-9fjnYYoW3wwoJ+YV89dThSlWljNG6Jaa51PMc5DqtFI=";
   };
 
-  cargoHash = "sha256-N7Y0BHaVcF8ejKnFrci0KHoy0SLuiTmJpgAPOV8hkAg=";
+  cargoHash = "sha256-XOMr8oDV82BgXfLc8oHqm8WAvmEHJjFGVmprxvso1cE=";
 
   preCheck = ''
     export NO_COLOR=true
diff --git a/pkgs/by-name/lu/lua-language-server/package.nix b/pkgs/by-name/lu/lua-language-server/package.nix
index 0ab2225a577e..b964eaa18cff 100644
--- a/pkgs/by-name/lu/lua-language-server/package.nix
+++ b/pkgs/by-name/lu/lua-language-server/package.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lua-language-server";
-  version = "3.18.0";
+  version = "3.18.1";
 
   src = fetchFromGitHub {
     owner = "luals";
     repo = "lua-language-server";
     tag = finalAttrs.version;
-    hash = "sha256-5N27/bGMEQDXUD9amXgGVO8dtiV/7c/8sfSPEhit8gc=";
+    hash = "sha256-fD7qFY2xL86x/Ac03HkusvNh9Tn4LiqkJGGXNO0bPO8=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/ly/lycheeslicer/package.nix b/pkgs/by-name/ly/lycheeslicer/package.nix
index 6eadd39f0e07..884e988fd4d6 100644
--- a/pkgs/by-name/ly/lycheeslicer/package.nix
+++ b/pkgs/by-name/ly/lycheeslicer/package.nix
@@ -9,11 +9,11 @@
 }:
 let
   pname = "lycheeslicer";
-  version = "7.6.3";
+  version = "7.6.4";
 
   src = fetchurl {
     url = "https://mango-lychee.nyc3.cdn.digitaloceanspaces.com/LycheeSlicer-${version}.AppImage";
-    hash = "sha256-lRG7uTMhKS5zIAI2WRan5ZxbVLIw1l2F3/aD/gee9OA=";
+    hash = "sha256-lLE40ByNdfK7GkLjfbEEX0nmhL0+E51qPDe+whIJqEM=";
   };
 
   desktopItem = makeDesktopItem {
diff --git a/pkgs/by-name/ma/mangareader/package.nix b/pkgs/by-name/ma/mangareader/package.nix
index debf400bfec0..f2982b668642 100644
--- a/pkgs/by-name/ma/mangareader/package.nix
+++ b/pkgs/by-name/ma/mangareader/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mangareader";
-  version = "2.3.0";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "g-fb";
     repo = "mangareader";
     rev = finalAttrs.version;
-    hash = "sha256-G/X8iJxEMNCSI0whxIpmzFh/Y/Hbr9vvzcGsbb8arig=";
+    hash = "sha256-l1rFyOXgBYPiDfAcGR3uGNJ2iHpFmVkfCacckulkkMM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pa/parted/package.nix b/pkgs/by-name/pa/parted/package.nix
index 60584013714f..97c63b66c930 100644
--- a/pkgs/by-name/pa/parted/package.nix
+++ b/pkgs/by-name/pa/parted/package.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchurl,
-  fetchpatch,
+  pkg-config,
   lvm2,
   libuuid,
   gettext,
@@ -18,22 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "parted";
-  version = "3.6";
+  version = "3.7";
 
   src = fetchurl {
     url = "mirror://gnu/parted/parted-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-O0Pb4zzKD5oYYB66tWt4UrEo7Bo986mzDM3l5zNZ5hI=";
+    sha256 = "sha256-AI3ldWGk88JaBkjmbtEeezC+STiJtkM0ptcPLBlR73s=";
   };
 
-  patches = [
-    # Fix the build against C23 compilers (like gcc-15):
-    (fetchpatch {
-      name = "c23.patch";
-      url = "https://git.savannah.gnu.org/gitweb/?p=parted.git;a=patch;h=16343bda6ce0d41edf43f8dac368db3bbb63d271";
-      hash = "sha256-8FgnwMrzMHPZNU+b/mRHCSu8sn6H7GhVLIhMUel40Hk=";
-    })
-  ];
-
   outputs = [
     "out"
     "dev"
@@ -52,6 +43,9 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optional (gettext != null) gettext
   ++ lib.optional (lvm2 != null) lvm2;
 
+  nativeBuildInputs = [
+    pkg-config
+  ];
   configureFlags =
     (if (readline != null) then [ "--with-readline" ] else [ "--without-readline" ])
     ++ lib.optional (lvm2 == null) "--disable-device-mapper"
@@ -87,8 +81,8 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://www.gnu.org/software/parted/";
     license = lib.licenses.gpl3Plus;
 
-    maintainers = [
-      # Add your name here!
+    maintainers = with lib.maintainers; [
+      kybe236
     ];
 
     # GNU Parted requires libuuid, which is part of util-linux-ng.
diff --git a/pkgs/by-name/pi/piliplus/git-hashes.json b/pkgs/by-name/pi/piliplus/git-hashes.json
index 92047d1acb9f..d164ae8fdddc 100644
--- a/pkgs/by-name/pi/piliplus/git-hashes.json
+++ b/pkgs/by-name/pi/piliplus/git-hashes.json
@@ -1,9 +1,8 @@
 {
-  "auto_orientation": "sha256-0QOEW8+0PpBIELmzilZ8+z7ozNRxKgI0BzuBS8c1Fng=",
   "canvas_danmaku": "sha256-XbOYi66WU6hV6Q2FnMC8HxFcY1MxAhyyJr4K+gCPEX4=",
   "chat_bottom_container": "sha256-+R1MiDMO4onCMXiJ7MJtJVAwyEJcikTyONwp+HibqA0=",
   "extended_nested_scroll_view": "sha256-ocjIy7gpCikoqRMqY4oGw/p9YaQ2v2clhon2pIzTXk4=",
-  "file_picker": "sha256-vBTRs/YlzmiPfcxStNWE1HdhbkIFQZMY7zEOKkd20oI=",
+  "file_picker": "sha256-4zwyrsyXb6KnCzSRGBLgypH79ifKVji8Y8lIb5AIc58=",
   "floating": "sha256-0Xd9dsXJCQ/r/8Nb16oM+M8Jdw+r4QzGmU++HpqF/v0=",
   "flutter_smart_dialog": "sha256-sehrQraEWmYvUd9pdG4l3edbtR4yTcJOqPbuhzIrih4=",
   "flutter_sortable_wrap": "sha256-Qj9Lzh+pJy+vHznGt5M3xwoJtaVtt00fxm4JJXL4bFI=",
@@ -17,6 +16,7 @@
   "media_kit_libs_windows_video": "sha256-tly3av5ojuasf+bXkOzLImcEm9oP25Y2flQDMV21T1s=",
   "media_kit_native_event_loop": "sha256-tly3av5ojuasf+bXkOzLImcEm9oP25Y2flQDMV21T1s=",
   "media_kit_video": "sha256-tly3av5ojuasf+bXkOzLImcEm9oP25Y2flQDMV21T1s=",
+  "native_device_orientation": "sha256-uJ/sGUeEDv+3PTfMBCiNsE3WlkUiNwtwjJREUZTv94I=",
   "super_sliver_list": "sha256-G24uRql1aIc1TDJwKqwQ72Pi4YbJybMn6lxOUySSDwk=",
   "webdav_client": "sha256-euNF7HdDtZ68BqSEq9BvO10BK09MxX2wWGoElFS0yeE=",
   "window_manager": "sha256-UAN3uOXKMfWk+G9GTHyhD2dGDojKA76mGbUR+EFc2Qo="
diff --git a/pkgs/by-name/pi/piliplus/package.nix b/pkgs/by-name/pi/piliplus/package.nix
index 73bfd5235ece..a88da3e6e004 100644
--- a/pkgs/by-name/pi/piliplus/package.nix
+++ b/pkgs/by-name/pi/piliplus/package.nix
@@ -13,7 +13,7 @@
 let
   srcInfo = lib.importJSON ./src-info.json;
   description = "Third-party Bilibili client developed in Flutter";
-  version = "2.0.2";
+  version = "2.0.4";
 in
 flutter341.buildFlutterApplication {
   pname = "piliplus";
diff --git a/pkgs/by-name/pi/piliplus/pubspec.lock.json b/pkgs/by-name/pi/piliplus/pubspec.lock.json
index 271274301a7a..9ef18ac26b27 100644
--- a/pkgs/by-name/pi/piliplus/pubspec.lock.json
+++ b/pkgs/by-name/pi/piliplus/pubspec.lock.json
@@ -150,17 +150,6 @@
       "source": "hosted",
       "version": "0.2.3"
     },
-    "auto_orientation": {
-      "dependency": "direct main",
-      "description": {
-        "path": ".",
-        "ref": "master",
-        "resolved-ref": "ca2bb137bd0e4b221df3bc5ba1492d2902c78624",
-        "url": "https://github.com/bggRGjQaUbCoE/auto_orientation.git"
-      },
-      "source": "git",
-      "version": "2.3.1"
-    },
     "battery_plus": {
       "dependency": "direct main",
       "description": {
@@ -306,11 +295,11 @@
       "dependency": "direct main",
       "description": {
         "name": "catcher_2",
-        "sha256": "3c9bc7435d250c1a958bbc7beb2f1d960ffb6c2658f2a5afd8d8e6db15cf8708",
+        "sha256": "ac9dd03230fa4058d14d46450335ca3c40564f734d793e52f81053f3cbf95009",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.1.8"
+      "version": "2.1.9"
     },
     "characters": {
       "dependency": "direct main",
@@ -397,11 +386,11 @@
       "dependency": "direct main",
       "description": {
         "name": "connectivity_plus",
-        "sha256": "b8fe52979ff12432ecf8f0abf6ff70410b1bb734be1c9e4f2f86807ad7166c79",
+        "sha256": "62ffa266d9a23b79fb3fcbc206afc00bb979417ba57b1324c546b5aab95ba057",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "7.1.0"
+      "version": "7.1.1"
     },
     "connectivity_plus_platform_interface": {
       "dependency": "transitive",
@@ -659,11 +648,11 @@
       "description": {
         "path": ".",
         "ref": "mod",
-        "resolved-ref": "8ba6a6a73691262bd006deec247311d136596032",
+        "resolved-ref": "d1dde80df07a6ec46d9291cfeba6c01de53b5305",
         "url": "https://github.com/bggRGjQaUbCoE/flutter_file_picker.git"
       },
       "source": "git",
-      "version": "11.0.0"
+      "version": "11.0.2"
     },
     "file_selector_linux": {
       "dependency": "transitive",
@@ -1127,11 +1116,11 @@
       "dependency": "direct main",
       "description": {
         "name": "image_cropper",
-        "sha256": "d2555be1ec4b7b12fc502ede481c846ad44578fbb0748debd4c648b25ca07cad",
+        "sha256": "e2c8da14ecb4c6ead02b8e1265f966ce72b43ff930da66eef3833e622185dec7",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "12.1.1"
+      "version": "12.2.0"
     },
     "image_cropper_for_web": {
       "dependency": "transitive",
@@ -1167,11 +1156,11 @@
       "dependency": "transitive",
       "description": {
         "name": "image_picker_android",
-        "sha256": "9eae0cbd672549dacc18df855c2a23782afe4854ada5190b7d63b30ee0b0d3fd",
+        "sha256": "66810af8e99b2657ee98e5c6f02064f69bb63f7a70e343937f70946c5f8c6622",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.8.13+15"
+      "version": "0.8.13+16"
     },
     "image_picker_for_web": {
       "dependency": "transitive",
@@ -1263,6 +1252,26 @@
       "source": "hosted",
       "version": "0.6.1"
     },
+    "jni": {
+      "dependency": "transitive",
+      "description": {
+        "name": "jni",
+        "sha256": "c2230682d5bc2362c1c9e8d3c7f406d9cbba23ab3f2e203a025dd47e0fb2e68f",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.0.0"
+    },
+    "jni_flutter": {
+      "dependency": "transitive",
+      "description": {
+        "name": "jni_flutter",
+        "sha256": "8b59e590786050b1cd866677dddaf76b1ade5e7bc751abe04b86e84d379d3ba6",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.0.1"
+    },
     "js": {
       "dependency": "transitive",
       "description": {
@@ -1542,6 +1551,17 @@
       "source": "hosted",
       "version": "2.0.0"
     },
+    "native_device_orientation": {
+      "dependency": "direct main",
+      "description": {
+        "path": ".",
+        "ref": "master",
+        "resolved-ref": "240534adb4b4b5c2c7e6c4578b1fc052ce98d7fd",
+        "url": "https://github.com/bggRGjQaUbCoE/flutter_native_device_orientation.git"
+      },
+      "source": "git",
+      "version": "2.0.5"
+    },
     "native_toolchain_c": {
       "dependency": "transitive",
       "description": {
@@ -1646,11 +1666,11 @@
       "dependency": "transitive",
       "description": {
         "name": "path_provider_android",
-        "sha256": "149441ca6e4f38193b2e004c0ca6376a3d11f51fa5a77552d8bd4d2b0c0912ba",
+        "sha256": "69cbd515a62b94d32a7944f086b2f82b4ac40a1d45bebfc00813a430ab2dabcd",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.2.23"
+      "version": "2.3.1"
     },
     "path_provider_foundation": {
       "dependency": "transitive",
@@ -1866,11 +1886,11 @@
       "dependency": "direct main",
       "description": {
         "name": "saver_gallery",
-        "sha256": "1d942bd7f4fedc162d9a751e156ebac592e4b81fc2e757af82de9077f3437003",
+        "sha256": "3f983d4be63aff52523c3e097a9b00ce9ab8444f9a982c878cde9d0359f4681d",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.1.0"
+      "version": "4.1.1"
     },
     "screen_brightness_android": {
       "dependency": "direct overridden",
@@ -1956,11 +1976,11 @@
       "dependency": "transitive",
       "description": {
         "name": "sentry",
-        "sha256": "288aee3d35f252ac0dc3a4b0accbbe7212fa2867604027f2cc5bc65334afd743",
+        "sha256": "682360642a7b14b36daef3b5574b7269164e7763512ac92cdafd55b695bd2183",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "9.16.0"
+      "version": "9.16.1"
     },
     "share_plus": {
       "dependency": "direct main",
@@ -2433,11 +2453,11 @@
       "dependency": "direct main",
       "description": {
         "name": "wakelock_plus",
-        "sha256": "8b12256f616346910c519a35606fb69b1fe0737c06b6a447c6df43888b097f39",
+        "sha256": "ddf3db70eaa10c37558ff817519b85d527dbd21034fd5d8e1c2e85f31588f1c1",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.5.1"
+      "version": "1.5.2"
     },
     "wakelock_plus_platform_interface": {
       "dependency": "transitive",
diff --git a/pkgs/by-name/pi/piliplus/src-info.json b/pkgs/by-name/pi/piliplus/src-info.json
index f526955f25ae..3d0033b44ad3 100644
--- a/pkgs/by-name/pi/piliplus/src-info.json
+++ b/pkgs/by-name/pi/piliplus/src-info.json
@@ -1,6 +1,6 @@
 {
-  "rev": "8ad130567e0f4b1d1be400281c49964e67193c2c",
-  "revCount": 4814,
-  "commitDate": 1774952739,
-  "hash": "sha256-6rQSNOryhFLeNeypWKNazOUQOev1BXf4nCea6+2nUwc="
+  "rev": "0b4ed25891e9567c8e4d386ae72e39c677db2187",
+  "revCount": 4848,
+  "commitDate": 1776146399,
+  "hash": "sha256-e/chUgvE7oJPdVZ4tmgIYxfLD2R2Fs57Uo2xmn4hNTk="
 }
diff --git a/pkgs/by-name/po/porxie/package.nix b/pkgs/by-name/po/porxie/package.nix
new file mode 100644
index 000000000000..9920eaf7e84b
--- /dev/null
+++ b/pkgs/by-name/po/porxie/package.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  fetchFromCodeberg,
+  rustPlatform,
+  nixosTests,
+  stdenvNoCC,
+  nix-update-script,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  __structuredAttrs = true;
+
+  pname = "porxie";
+  version = "0.1.0";
+
+  src = fetchFromCodeberg {
+    owner = "Blooym";
+    repo = "porxie";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-TxN9BA/o9BI9yF7k3wpJae78hIcCAhB/ggXVQlt4oP0=";
+  };
+  cargoHash = "sha256-a0Ps8SvheQoX+Ai8EYgEpyTFwNvB7E3J6MfGiyEvMzM=";
+
+  passthru = {
+    updateScript = nix-update-script { };
+    tests = lib.optionalAttrs stdenvNoCC.hostPlatform.isLinux {
+      porxie = nixosTests.porxie;
+    };
+  };
+
+  meta = {
+    description = "Porxie, an ATProto blob proxy for secure content delivery";
+    homepage = "https://codeberg.org/Blooym/porxie";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ blooym ];
+    mainProgram = "porxie";
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/pr/prek/package.nix b/pkgs/by-name/pr/prek/package.nix
index a469f12b7f8e..40e728c575dc 100644
--- a/pkgs/by-name/pr/prek/package.nix
+++ b/pkgs/by-name/pr/prek/package.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "prek";
-  version = "0.3.8";
+  version = "0.3.9";
 
   src = fetchFromGitHub {
     owner = "j178";
     repo = "prek";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0mddrCEGQHFm4zW5nQ7HHFK826XcYSymr9AfVd5P+eg=";
+    hash = "sha256-gfWaJxcT44+yEkZtDSQwKP1oILMUsF4apYeety+XESM=";
   };
 
-  cargoHash = "sha256-YZqIx6P2nkaKaJUW6IPboiHVDlaDvPCpLMlX0swJYyU=";
+  cargoHash = "sha256-dKSsH4IUWLdlthvAmS+MmuAVicCCKefy1D4YleRO0fI=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/re/remnote/package.nix b/pkgs/by-name/re/remnote/package.nix
index cb437e5ef216..3a6c7ebe1ef0 100644
--- a/pkgs/by-name/re/remnote/package.nix
+++ b/pkgs/by-name/re/remnote/package.nix
@@ -6,10 +6,10 @@
 }:
 let
   pname = "remnote";
-  version = "1.25.0";
+  version = "1.25.7";
   src = fetchurl {
     url = "https://download2.remnote.io/remnote-desktop2/RemNote-${version}.AppImage";
-    hash = "sha256-epaGP+rTg2as121mmx2KjmivAqDSzDh3eqnTGYmB++w=";
+    hash = "sha256-ckigM+kXV8W5iI42SGSyFd1//e5ghqiV/b6Ja5at7Do=";
   };
   appimageContents = appimageTools.extractType2 { inherit pname version src; };
 in
diff --git a/pkgs/by-name/sa/sandbox-runtime/package.nix b/pkgs/by-name/sa/sandbox-runtime/package.nix
index c5455d952375..a3491cfb2029 100644
--- a/pkgs/by-name/sa/sandbox-runtime/package.nix
+++ b/pkgs/by-name/sa/sandbox-runtime/package.nix
@@ -50,7 +50,7 @@ buildNpmPackage (finalAttrs: {
     in
     ''
       wrapProgram $out/bin/srt \
-        --prefix PATH ${lib.makeBinPath runtimeDeps}
+        --prefix PATH : ${lib.makeBinPath runtimeDeps}
     '';
 
   nativeInstallCheckInputs = [
diff --git a/pkgs/by-name/sh/shairport-sync/package.nix b/pkgs/by-name/sh/shairport-sync/package.nix
index 6039d6409450..be279d8affd2 100644
--- a/pkgs/by-name/sh/shairport-sync/package.nix
+++ b/pkgs/by-name/sh/shairport-sync/package.nix
@@ -119,8 +119,8 @@ stdenv.mkDerivation (finalAttrs: {
     "--with-ssl=openssl"
   ]
   ++ optional enableAvahi "--with-avahi"
-  ++ optional enablePulse "--with-pa"
-  ++ optional enablePipewire "--with-pw"
+  ++ optional enablePulse "--with-pulseaudio"
+  ++ optional enablePipewire "--with-pipewire"
   ++ optional enableAlsa "--with-alsa"
   ++ optional enableSndio "--with-sndio"
   ++ optional enableAo "--with-ao"
diff --git a/pkgs/by-name/si/sigma-cli/package.nix b/pkgs/by-name/si/sigma-cli/package.nix
index 4b197c6ff833..12dcdb26e283 100644
--- a/pkgs/by-name/si/sigma-cli/package.nix
+++ b/pkgs/by-name/si/sigma-cli/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "sigma-cli";
-  version = "2.0.2";
+  version = "3.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "SigmaHQ";
     repo = "sigma-cli";
     tag = "v${version}";
-    hash = "sha256-Gd41uNARH9RbyRkTDiXmP9gWTMpS9zlkb4rPF3ikRc8=";
+    hash = "sha256-eRPOGI/mK1jFAs56MJ+VSuce95gMKEffba3cR9Sl8k0=";
   };
 
   pythonRelaxDeps = [ "click" ];
diff --git a/pkgs/by-name/si/signal-desktop/package.nix b/pkgs/by-name/si/signal-desktop/package.nix
index 5bda913e7a00..48454e6de50a 100644
--- a/pkgs/by-name/si/signal-desktop/package.nix
+++ b/pkgs/by-name/si/signal-desktop/package.nix
@@ -58,13 +58,13 @@ let
     '';
   });
 
-  version = "8.6.0";
+  version = "8.6.1";
 
   src = fetchFromGitHub {
     owner = "signalapp";
     repo = "Signal-Desktop";
     tag = "v${version}";
-    hash = "sha256-K6mufC7LFGWeCkIkrsYPO2n/0L1b6yBqiLcv7w7e57g=";
+    hash = "sha256-UeCjj3txcBQxfvEJOuCKka3VVfd4OY/4wXoQ4lq4NiE=";
   };
 
   sticker-creator = stdenv.mkDerivation (finalAttrs: {
@@ -185,7 +185,7 @@ stdenv.mkDerivation (finalAttrs: {
   env = {
     ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
     SIGNAL_ENV = "production";
-    SOURCE_DATE_EPOCH = 1775687068;
+    SOURCE_DATE_EPOCH = 1776101010;
   }
   // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
     # Disable code signing during local macOS builds.
diff --git a/pkgs/by-name/sq/sqlit-tui/package.nix b/pkgs/by-name/sq/sqlit-tui/package.nix
index 2ea96f3c04ac..9d11745d6850 100644
--- a/pkgs/by-name/sq/sqlit-tui/package.nix
+++ b/pkgs/by-name/sq/sqlit-tui/package.nix
@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "sqlit-tui";
-  version = "1.3.1";
+  version = "1.3.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Maxteabag";
     repo = "sqlit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+7mv5aNJuNEudFARSZdB9/yedvqk6UHbfGku8J7Ye1g=";
+    hash = "sha256-MG5ZhYrEdOVngDkFVU8gWx9Kpfn+UFcxkdimqv7lAVE=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/vi/vivaldi/package.nix b/pkgs/by-name/vi/vivaldi/package.nix
index 60055705301e..7ac2b8481fe5 100644
--- a/pkgs/by-name/vi/vivaldi/package.nix
+++ b/pkgs/by-name/vi/vivaldi/package.nix
@@ -47,6 +47,7 @@
   libdrm,
   libgbm,
   vulkan-loader,
+  addDriverRunpath,
   nss,
   nspr,
   patchelf,
@@ -66,7 +67,7 @@
 
 stdenv.mkDerivation rec {
   pname = "vivaldi";
-  version = "7.9.3970.47";
+  version = "7.9.3970.50";
 
   suffix =
     {
@@ -79,8 +80,8 @@ stdenv.mkDerivation rec {
     url = "https://downloads.vivaldi.com/stable/vivaldi-stable_${version}-1_${suffix}.deb";
     hash =
       {
-        aarch64-linux = "sha256-08KlF8JJlZqAZeSFAqaNzMPfHp95GddRScnLnkQ2PF8=";
-        x86_64-linux = "sha256-Dc1VyxB60WsrynOT5r85+Xljx8mU7IKodnIIeGZ/u+M=";
+        aarch64-linux = "sha256-DIaBjUPs9bgpzwxT20cwdOJzo8kCO1chmudo4wqWSeU=";
+        x86_64-linux = "sha256-9fX0xnIZeu7hTYyKvSQrJj3mQkTPGg8S3IjEjh/84g0=";
       }
       .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
@@ -208,9 +209,13 @@ stdenv.mkDerivation rec {
         "$out"/opt/vivaldi/product_logo_''${d}.png \
         "$out"/share/icons/hicolor/''${d}x''${d}/apps/vivaldi.png
     done
+    # replace bundled vulkan-loader with the NixOS-patched one to enable Vulkan ICD discovery
+    rm $out/opt/vivaldi/libvulkan.so.1
+    ln -s "${lib.getLib vulkan-loader}/lib/libvulkan.so.1" $out/opt/vivaldi/libvulkan.so.1
+
     wrapProgram "$out/bin/vivaldi" \
       --add-flags ${lib.escapeShellArg commandLineArgs} \
-      --prefix XDG_DATA_DIRS : ${gtk3}/share/gsettings-schemas/${gtk3.name}/ \
+      --prefix XDG_DATA_DIRS : "${addDriverRunpath.driverLink}/share:${gtk3}/share/gsettings-schemas/${gtk3.name}" \
       --prefix LD_LIBRARY_PATH : ${libPath} \
       --prefix PATH : ${coreutils}/bin \
       ''${qtWrapperArgs[@]}
diff --git a/pkgs/by-name/wa/walker/package.nix b/pkgs/by-name/wa/walker/package.nix
index a34d6019e43b..17409408b212 100644
--- a/pkgs/by-name/wa/walker/package.nix
+++ b/pkgs/by-name/wa/walker/package.nix
@@ -20,13 +20,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "walker";
-  version = "2.15.2";
+  version = "2.16.0";
 
   src = fetchFromGitHub {
     owner = "abenz1267";
     repo = "walker";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-jYvDe44MLx444BfiO1EtCKgHoKfXeIG1DvAw7P2qCrY=";
+    hash = "sha256-ugacgbPxYM68pAcQRceuSlCWtUEuddltMUzAWrnWlHA=";
   };
 
   cargoHash = "sha256-MPjMB5TsrJd28QuEoIDRJjM+SE0cTNCO5PRW+I+/CHE=";
diff --git a/pkgs/by-name/wo/wolfssl/package.nix b/pkgs/by-name/wo/wolfssl/package.nix
index 6df1a958ebcf..6cde924b81f7 100644
--- a/pkgs/by-name/wo/wolfssl/package.nix
+++ b/pkgs/by-name/wo/wolfssl/package.nix
@@ -18,13 +18,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "wolfssl-${variant}";
-  version = "5.9.0";
+  version = "5.9.1";
 
   src = fetchFromGitHub {
     owner = "wolfSSL";
     repo = "wolfssl";
     tag = "v${finalAttrs.version}-stable";
-    hash = "sha256-Ov59Zt0UskADQThdzr9wni2junSpy3jiABWpiGr8xtg=";
+    hash = "sha256-FyEb94hsO2BaTEi1CJRfCsUiT1xyWCzu7Uys81g2CBE=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/wp/wpprobe/package.nix b/pkgs/by-name/wp/wpprobe/package.nix
index 5973aea6cdee..4e57a5145ad5 100644
--- a/pkgs/by-name/wp/wpprobe/package.nix
+++ b/pkgs/by-name/wp/wpprobe/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "wpprobe";
-  version = "0.11.4";
+  version = "0.11.8";
 
   src = fetchFromGitHub {
     owner = "Chocapikk";
     repo = "wpprobe";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-uJ/88Uw9w9I4fnIgmRcOG4l5pFd/MhCczO4vyo/ERTc=";
+    hash = "sha256-OJDiTAsSqYOAzYIwYCosrGbPdrbGdldPt2I3FwSdLXE=";
   };
 
   vendorHash = "sha256-pAKFrdja+rH0kiJH6hToZwLjE8lLBHFAUCjnCLbgxVo=";
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index e9aa59d1a0aa..7a6e7bbe923d 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -358,13 +358,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "boto3-stubs";
-  version = "1.42.88";
+  version = "1.42.89";
   pyproject = true;
 
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit (finalAttrs) version;
-    hash = "sha256-hSFftJOKlNHPg82GMvRq53KLXsiBh9g0aPOTu+ZCNtY=";
+    hash = "sha256-27xP0meM+yHam6sbXjC6lRhSMi0FUEWsEgQro00EWXo=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/django-dbbackup/default.nix b/pkgs/development/python-modules/django-dbbackup/default.nix
index 323bd5b93f02..710fd7befcdb 100644
--- a/pkgs/development/python-modules/django-dbbackup/default.nix
+++ b/pkgs/development/python-modules/django-dbbackup/default.nix
@@ -14,14 +14,14 @@
 }:
 buildPythonPackage (finalAttrs: {
   pname = "django-dbbackup";
-  version = "5.2.0";
+  version = "5.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Archmonger";
     repo = "django-dbbackup";
     tag = finalAttrs.version;
-    hash = "sha256-fl4ezDLHO6KwLfX5KMK9uMonONJCCDLyZUj9KMRZsGc=";
+    hash = "sha256-vSBZmYMcrpJQEhVVqKgn35vaI5TvMBbdwGXZOFjXQbw=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/dnsight/default.nix b/pkgs/development/python-modules/dnsight/default.nix
new file mode 100644
index 000000000000..b62625bad763
--- /dev/null
+++ b/pkgs/development/python-modules/dnsight/default.nix
@@ -0,0 +1,93 @@
+{
+  lib,
+  stdenv,
+  buildPythonPackage,
+  cryptography,
+  dnspython,
+  fetchFromGitHub,
+  hatch-vcs,
+  hatchling,
+  httpx,
+  hypothesis,
+  iana-etc,
+  libredirect,
+  pydantic,
+  pytest-asyncio,
+  pytest-cov-stub,
+  pytestCheckHook,
+  pyyaml,
+  rich,
+  typer,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "dnsight";
+  version = "1.0.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "dnsight";
+    repo = "dnsight";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-WoYLAqNTbMVe+kd/cG1MPRSlYMMYPWP8wm96qr3IdY8=";
+  };
+
+  pythonRelaxDeps = [ "typer" ];
+
+  build-system = [
+    hatch-vcs
+    hatchling
+  ];
+
+  dependencies = [
+    cryptography
+    dnspython
+    httpx
+    pydantic
+    pyyaml
+    rich
+    typer
+  ];
+
+  nativeCheckInputs = [
+    hypothesis
+    pytest-asyncio
+    pytest-cov-stub
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "dnsight" ];
+
+  preCheck = lib.optionalString stdenv.hostPlatform.isLinux ''
+    echo "nameserver 127.0.0.1" > resolv.conf
+    export NIX_REDIRECTS=/etc/protocols=${iana-etc}/etc/protocols:/etc/resolv.conf=$(realpath resolv.conf)
+    export LD_PRELOAD=${libredirect}/lib/libredirect.so
+  '';
+
+  postCheck = ''
+    unset NIX_REDIRECTS LD_PRELOAD
+  '';
+
+  disabledTests = [
+    # AssertionError
+    "test_audit_explicit_domains_honour_global_config_path"
+    "test_audit_manifest_runs_only_configured_checks"
+    # AssertionError: assert (None is not None)
+    "test_check_dmarc_async_config_slice_overrides_config"
+    "test_check_dmarc_sync_config_slice_overrides_config"
+    "test_check_spf_sync_with_mgr"
+    "test_run_check_for_target_matches_run_zone"
+    "test_run_check_sync_dmarc"
+    "test_run_check_sync_programmatic_config_no_file"
+    "test_run_check_sync_yaml_plus_overlay_merge"
+  ];
+
+  meta = {
+    description = "SDK and CLI tool for DNS, email and web security hygiene";
+    homepage = "https://github.com/dnsight/dnsight";
+    changelog = "https://github.com/dnsight/dnsight/releases/tag/v${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "dnsight";
+  };
+})
diff --git a/pkgs/development/python-modules/dtfabric/default.nix b/pkgs/development/python-modules/dtfabric/default.nix
index 4f15cd1db584..e66403b6ca36 100644
--- a/pkgs/development/python-modules/dtfabric/default.nix
+++ b/pkgs/development/python-modules/dtfabric/default.nix
@@ -6,38 +6,39 @@
   pyyaml,
   setuptools,
 }:
-buildPythonPackage rec {
+
+buildPythonPackage (finalAttrs: {
   pname = "dtfabric";
-  version = "20251118";
+  version = "20260411";
   pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-v2qsZtqGb40p5/Q1IGhI+prMCkuruxFB0BTMORKzmX4=";
+    inherit (finalAttrs) pname version;
+    hash = "sha256-0hnJJ76wpINsNXecrGCQILqixo4xUhH8dW6djq9/vH4=";
   };
 
+  pythonRemoveDeps = [ "pip" ];
+
   build-system = [ setuptools ];
 
-  dependencies = [
-    pyyaml
-  ];
-
-  pythonRemoveDeps = [
-    "pip"
-  ];
+  dependencies = [ pyyaml ];
 
   checkPhase = ''
     runHook preCheck
+
     ${python.interpreter} run_tests.py
+
     runHook postCheck
   '';
 
+  pythonImportsCheck = [ "dtfabric" ];
+
   meta = {
-    changelog = "https://github.com/libyal/dtfabric/releases/tag/${version}";
     description = "Project to manage data types and structures, as used in the libyal projects";
+    changelog = "https://github.com/libyal/dtfabric/releases/tag/${finalAttrs.version}";
     downloadPage = "https://github.com/libyal/dtfabric/releases";
     homepage = "https://github.com/libyal/dtfabric";
     license = lib.licenses.asl20;
-    maintainers = [ lib.maintainers.jayrovacsek ];
+    maintainers = with lib.maintainers; [ jayrovacsek ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index e3dbdda8e4a5..90d210c2827c 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202604131";
+  version = "0.1.202604141";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NFEhmbq0vAn0mZtdVnzyU8TWz3FaYbodFz6wMKOdjTk=";
+    hash = "sha256-0eCvRqYAiG0+zlJy37Z/28JhzsIyWGhLLSs6Xj8wWfQ=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 82c5150b2b9b..b0ba9533364e 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -363,8 +363,8 @@ in
       "sha256-SAgpP1O6oGP8QIp6qoG4bu/axKZyVWgbdt8ZmZkrezY=";
 
   mypy-boto3-customer-profiles =
-    buildMypyBoto3Package "customer-profiles" "1.42.66"
-      "sha256-q+QcH2dYyQ4jf9CWfNG6hT+qZPFQ1mJCwPxzFVC3sCc=";
+    buildMypyBoto3Package "customer-profiles" "1.42.89"
+      "sha256-5Y2OYBWdbtFa2AnnlFQ5AaVuGi3IGqPSimFC/Izx7Og=";
 
   mypy-boto3-databrew =
     buildMypyBoto3Package "databrew" "1.42.3"
@@ -571,8 +571,8 @@ in
       "sha256-N0kQ7Fc44SFKXhl4V+oAclPNlWhluOs53NDokiXcSNM=";
 
   mypy-boto3-glue =
-    buildMypyBoto3Package "glue" "1.42.70"
-      "sha256-1LdCLIL9olH9DiZFsWulOaFqc8UE9tK/+cDiCXohYFQ=";
+    buildMypyBoto3Package "glue" "1.42.89"
+      "sha256-U+NzY02OyhR/GbZy+2Ye3+FgAVzF/UTNhUH3fy9SmMc=";
   mypy-boto3-grafana =
     buildMypyBoto3Package "grafana" "1.42.51"
       "sha256-QHAuRJrioMD7ASgV1Wobm81Gb+Z87c78yBs9X1+Kz+E=";
@@ -830,8 +830,8 @@ in
       "sha256-mERVlNSjfxNqfyGRlNgfP1MrzhGrMYgIuZ0pZLPrfBQ=";
 
   mypy-boto3-macie2 =
-    buildMypyBoto3Package "macie2" "1.42.3"
-      "sha256-fzZHKPUXOh/tLGCx6xAHJd4jefApYtEwbt6BSakOLXA=";
+    buildMypyBoto3Package "macie2" "1.42.89"
+      "sha256-Y19V3g8CM4L2L5dWPjpokPNj6iX39OPxUP+H1blFaH0=";
 
   mypy-boto3-managedblockchain =
     buildMypyBoto3Package "managedblockchain" "1.42.3"
@@ -1218,8 +1218,8 @@ in
       "sha256-WrQvNc6TJ2XrsWhBRvR4qHzEuDvvlQ/Rqg4mi4jVnIE=";
 
   mypy-boto3-securityhub =
-    buildMypyBoto3Package "securityhub" "1.42.58"
-      "sha256-svAuxOrTZz/fludiFZFolRVMQmS2qdaJBrfTlynb8oA=";
+    buildMypyBoto3Package "securityhub" "1.42.89"
+      "sha256-cXpUTYf1lt0Wtu39NzdaKjgJRyRsIOpJ+GJPvO7Iu/Y=";
 
   mypy-boto3-securitylake =
     buildMypyBoto3Package "securitylake" "1.42.3"
diff --git a/pkgs/development/python-modules/netutils/default.nix b/pkgs/development/python-modules/netutils/default.nix
index 55d002fe2012..3edba52dd173 100644
--- a/pkgs/development/python-modules/netutils/default.nix
+++ b/pkgs/development/python-modules/netutils/default.nix
@@ -11,16 +11,16 @@
   toml,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "netutils";
-  version = "1.17.1";
+  version = "1.17.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "networktocode";
     repo = "netutils";
-    tag = "v${version}";
-    hash = "sha256-LdLNDzO5ANpTqpcemgyNoZxm6LDYRonS5o8mMmdg4vM=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-DHftRRqbuUa74ATfh8MHxINwNkpz9lo/drwOmeo0itE=";
   };
 
   build-system = [ poetry-core ];
@@ -59,8 +59,8 @@ buildPythonPackage rec {
   meta = {
     description = "Library that is a collection of objects for common network automation tasks";
     homepage = "https://github.com/networktocode/netutils";
-    changelog = "https://github.com/networktocode/netutils/releases/tag/${src.tag}";
+    changelog = "https://github.com/networktocode/netutils/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/py-unifi-access/default.nix b/pkgs/development/python-modules/py-unifi-access/default.nix
index c4eef261fbfa..d31c917b2838 100644
--- a/pkgs/development/python-modules/py-unifi-access/default.nix
+++ b/pkgs/development/python-modules/py-unifi-access/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "py-unifi-access";
-  version = "1.1.4";
+  version = "1.1.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "imhotep";
     repo = "py-unifi-access";
     tag = finalAttrs.version;
-    hash = "sha256-oh8Y1hfr+mJL5gz2P4uaZ68TtSCG0CgcrKgnhuEgfQc=";
+    hash = "sha256-TGAZpvqX5H+kaSJb3rraDfXnekPGCMb092NF2ilNdHM=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pysigma-backend-qradar/default.nix b/pkgs/development/python-modules/pysigma-backend-qradar/default.nix
index 558003b6192a..11c598ef6ab8 100644
--- a/pkgs/development/python-modules/pysigma-backend-qradar/default.nix
+++ b/pkgs/development/python-modules/pysigma-backend-qradar/default.nix
@@ -8,7 +8,7 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pysigma-backend-qradar";
   version = "0.3.3";
   pyproject = true;
@@ -16,7 +16,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "nNipsx-Sec";
     repo = "pySigma-backend-qradar";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-VymaxX+iqrRlf+WEt4xqEvNt5kg8xI5O/MoYahayu0o=";
   };
 
@@ -33,11 +33,16 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "sigma.backends.qradar" ];
 
+  disabledTests = [
+    # Output format unknown
+    "test_qradar_extension_output"
+  ];
+
   meta = {
     description = "Library to support Qradar for pySigma";
     homepage = "https://github.com/nNipsx-Sec/pySigma-backend-qradar";
-    changelog = "https://github.com/nNipsx-Sec/pySigma-backend-qradar/releases/tag/${src.tag}";
+    changelog = "https://github.com/nNipsx-Sec/pySigma-backend-qradar/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.lgpl21Only;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/pysigma/default.nix b/pkgs/development/python-modules/pysigma/default.nix
index f76528153620..d9f1ee33e782 100644
--- a/pkgs/development/python-modules/pysigma/default.nix
+++ b/pkgs/development/python-modules/pysigma/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pysigma";
-  version = "1.2.0";
+  version = "1.3.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "SigmaHQ";
     repo = "pySigma";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QPGpmEWfgea420y8mmUF+CHV3xslr39TvxPxAjhI8d4=";
+    hash = "sha256-gMRcrP9ZVCi3QD0W5RlbCNIuZT/oTDpB0WqTKiwKcfU=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/python-discovery/default.nix b/pkgs/development/python-modules/python-discovery/default.nix
index eeda7554f9ad..52f1d8119f4e 100644
--- a/pkgs/development/python-modules/python-discovery/default.nix
+++ b/pkgs/development/python-modules/python-discovery/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "python-discovery";
-  version = "1.2.1";
+  version = "1.2.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tox-dev";
     repo = "python-discovery";
     tag = finalAttrs.version;
-    hash = "sha256-96o8qGe38fifkA5zaBJ7jXgkJzm/gP3W/wUClFVUUH8=";
+    hash = "sha256-udyPGZ3vz+1nld2m3igLNZ+i1pnutkLeXFpHn738KRQ=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/python-qube-heatpump/default.nix b/pkgs/development/python-modules/python-qube-heatpump/default.nix
index 050488398b91..5b07d81563d5 100644
--- a/pkgs/development/python-modules/python-qube-heatpump/default.nix
+++ b/pkgs/development/python-modules/python-qube-heatpump/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "python-qube-heatpump";
-  version = "1.8.0";
+  version = "1.9.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "MattieGit";
     repo = "python-qube-heatpump";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-p+g/70W09QymkFcjYLhxzYXBQCcPHzUX/hOqAL7/aas=";
+    hash = "sha256-E3JVk3eYJhesPMu0eFqxPu1HTyLWtKc8rV9z1E5IwJs=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/smbus2/default.nix b/pkgs/development/python-modules/smbus2/default.nix
index 71e1dcadf18a..72037e135dd0 100644
--- a/pkgs/development/python-modules/smbus2/default.nix
+++ b/pkgs/development/python-modules/smbus2/default.nix
@@ -6,16 +6,16 @@
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "smbus2";
-  version = "0.6.0";
+  version = "0.6.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kplindegaard";
     repo = "smbus2";
-    tag = version;
-    hash = "sha256-GoXSDUmMnrJAfQ8EfCP5bdkq5g0nKLRHcvou5c6vZGU=";
+    tag = finalAttrs.version;
+    hash = "sha256-CWcRlbZTLiB45DaV6rbhvlk8cTaEJgPAq/JDmbxD7H4=";
   };
 
   build-system = [ setuptools ];
@@ -27,8 +27,8 @@ buildPythonPackage rec {
   meta = {
     description = "Drop-in replacement for smbus-cffi/smbus-python";
     homepage = "https://smbus2.readthedocs.io/";
-    changelog = "https://github.com/kplindegaard/smbus2/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/kplindegaard/smbus2/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/switchbot-api/default.nix b/pkgs/development/python-modules/switchbot-api/default.nix
index bf9a58c97ca9..9839f490ee1c 100644
--- a/pkgs/development/python-modules/switchbot-api/default.nix
+++ b/pkgs/development/python-modules/switchbot-api/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "switchbot-api";
-  version = "2.11.0";
+  version = "2.11.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "SeraphicCorp";
     repo = "py-switchbot-api";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-n2KAKILbywObqxG/lDNHkXWVCcrEJAaqv6xBDH8ed/Q=";
+    hash = "sha256-xgfFpylMS8Xs3erM7vuJKun6fYOtJ6kfXgBVSkejbJI=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index a15d64ebe8ee..e5c80cf60c7f 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "tencentcloud-sdk-python";
-  version = "3.1.76";
+  version = "3.1.77";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = finalAttrs.version;
-    hash = "sha256-21BXGAPXCyRHTqPSUjvWWbrEbxAqqeSZavqIZ6sax3Q=";
+    hash = "sha256-pLkHUcy8CbEz6f3bNHx+ynJg9snxRphCoKldO//4PmM=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index 78cbbd8541bf..de0556356e53 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -230,7 +230,7 @@ lib.makeExtensible (
       latest = self.nix_2_34;
 
       # Read ./README.md before bumping a major release
-      stable = addFallbackPathsCheck self.nix_2_31;
+      stable = addFallbackPathsCheck self.nix_2_34;
     }
     // lib.optionalAttrs config.allowAliases (
       lib.listToAttrs (
diff --git a/pkgs/tools/package-management/nix/modular/src/libstore-tests/package.nix b/pkgs/tools/package-management/nix/modular/src/libstore-tests/package.nix
index e31044270a76..b7eebc6f53ca 100644
--- a/pkgs/tools/package-management/nix/modular/src/libstore-tests/package.nix
+++ b/pkgs/tools/package-management/nix/modular/src/libstore-tests/package.nix
@@ -62,10 +62,10 @@ mkMesonExecutable (finalAttrs: {
         runCommand "${finalAttrs.pname}-run"
           {
             meta.broken = !stdenv.hostPlatform.emulatorAvailable buildPackages;
-            buildInputs = [
+            nativeBuildInputs = [
               writableTmpDirAsHomeHook
             ]
-            ++ lib.optional (lib.versionAtLeast version "2.34pre") openssl;
+            ++ lib.optional (lib.versionAtLeast version "2.34pre") (lib.getBin openssl);
           }
           ''
             export _NIX_TEST_UNIT_DATA=${data + "/src/libstore-tests/data"}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index f542f09055c5..da35e79f2895 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4537,6 +4537,8 @@ self: super: with self; {
 
   dns-lexicon = callPackage ../development/python-modules/dns-lexicon { };
 
+  dnsight = callPackage ../development/python-modules/dnsight { };
+
   dnslib = callPackage ../development/python-modules/dnslib { };
 
   dnspython = callPackage ../development/python-modules/dnspython { };