diff --git a/pkgs/applications/gis/qgis/unwrapped-ltr.nix b/pkgs/applications/gis/qgis/unwrapped-ltr.nix
index 77e6837da3a3..ee4d1b5a6364 100644
--- a/pkgs/applications/gis/qgis/unwrapped-ltr.nix
+++ b/pkgs/applications/gis/qgis/unwrapped-ltr.nix
@@ -85,7 +85,7 @@ let
   ];
 in
 mkDerivation rec {
-  version = "3.44.9";
+  version = "3.44.10";
   pname = "qgis-ltr-unwrapped";
   outputs = [ "out" ] ++ lib.optional (!stdenv.hostPlatform.isDarwin) "man";
 
@@ -93,7 +93,7 @@ mkDerivation rec {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-aeTWjzYRCKcgdB9sknrcqO5oWEuwU7OuvrvAi8W4bWE=";
+    hash = "sha256-wWLbnZpLIchm0NXuU7jEXCBctrI6G1z8iqf9R2YhS8Y=";
   };
 
   passthru = {
diff --git a/pkgs/applications/gis/qgis/unwrapped.nix b/pkgs/applications/gis/qgis/unwrapped.nix
index bd844a062ed4..7c8a276675c3 100644
--- a/pkgs/applications/gis/qgis/unwrapped.nix
+++ b/pkgs/applications/gis/qgis/unwrapped.nix
@@ -89,14 +89,14 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "qgis-unwrapped";
-  version = "4.0.1";
+  version = "4.0.2";
   outputs = [ "out" ] ++ lib.optional (!stdenv.hostPlatform.isDarwin) "man";
 
   src = fetchFromGitHub {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-pH48EhH2kmlscFPYiLStGIqXrmO9zgpidtkWVf1K5Mo=";
+    hash = "sha256-4tQ7Jv03/S6+xt3NU7jZLsZk3rQyaj+XsVnpCWW1uqg=";
   };
 
   passthru = {
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 389ef1411c15..2e8a4cbd64b6 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -643,13 +643,13 @@
     "vendorHash": "sha256-ssmAveYUVI8z/1UWNeaMX0qdUewowCHNufJIFMirdVg="
   },
   "hashicorp_random": {
-    "hash": "sha256-BKQifHycSujVAzARmNNRdI3Dsg35bmB8Kz9GL/KbSQA=",
+    "hash": "sha256-Y5p9/H3g85AYr/FVWO6zLaeHIGo7iGvMV6eHTGO0ehI=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/random",
     "owner": "hashicorp",
     "repo": "terraform-provider-random",
-    "rev": "v3.8.1",
+    "rev": "v3.9.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-GlkqFg9Bgs+Hi59PYAxqq3YW9ji1qeuX4vz59wQ4pRw="
+    "vendorHash": "sha256-CwTlb0QTq0lpZK90IL6mBLoarFYFLsjiLYauGEaR1Rk="
   },
   "hashicorp_tfe": {
     "hash": "sha256-/vEbhPKNhKUIlChGYuMNR5Ulbk9gG4171vZ6pvoTdcM=",
diff --git a/pkgs/build-support/buildenv/default.nix b/pkgs/build-support/buildenv/default.nix
index a645224ffa54..13ab910ab6b8 100644
--- a/pkgs/build-support/buildenv/default.nix
+++ b/pkgs/build-support/buildenv/default.nix
@@ -13,6 +13,7 @@ let
   builder = replaceVars ./builder.pl {
     inherit (builtins) storeDir;
   };
+  inherit (lib) concatMap;
 in
 
 # Backward compatibility for deprecated custom overrider <env-pkg>.override
@@ -127,22 +128,17 @@ lib.makeOverridable (
                 [ drv ]
             )
             # Add any extra outputs specified by the caller of `buildEnv`.
-            ++ lib.filter (p: p != null) (
-              map (outName: drv.${outName} or null) finalAttrs.extraOutputsToInstall
-            );
+            ++ concatMap (
+              outName: if drv ? ${outName} then [ drv.${outName} ] else [ ]
+            ) finalAttrs.extraOutputsToInstall;
           priority = drv.meta.priority or lib.meta.defaultPriority;
           # Silently use the original `paths` if `passthru.paths` is missing.
         }) finalAttrs.passthru.paths or paths;
 
         extraPathsFrom = lib.optionalString finalAttrs.includeClosures (
-          let
-            pathsForClosure = lib.pipe finalAttrs.chosenOutputs [
-              (map (p: p.paths))
-              lib.flatten
-              (lib.remove null)
-            ];
-          in
-          writeClosure pathsForClosure
+          # filter all null elements and concatenate the output paths together
+          # in the final closure
+          writeClosure (lib.concatMap (p: if p == null then [ ] else p.paths) finalAttrs.chosenOutputs)
         );
 
         preferLocalBuild = derivationArgs.preferLocalBuild or true;
diff --git a/pkgs/by-name/cd/cdist/package.nix b/pkgs/by-name/cd/cdist/package.nix
index b466d4cd01ac..b877f383572e 100644
--- a/pkgs/by-name/cd/cdist/package.nix
+++ b/pkgs/by-name/cd/cdist/package.nix
@@ -7,7 +7,8 @@
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "cdist";
   version = "7.0.0";
-  format = "setuptools";
+  pyproject = true;
+
   outputs = [
     "out"
     "man"
@@ -22,6 +23,8 @@ python3Packages.buildPythonApplication (finalAttrs: {
     hash = "sha256-lIx0RtGQJdY2e00azI9yS6TV+5pCegpKOOD0dQmgMqA=";
   };
 
+  build-system = with python3Packages; [ setuptools ];
+
   nativeBuildInputs = with python3Packages; [
     six
     sphinxHook
diff --git a/pkgs/by-name/ex/exploitdb/package.nix b/pkgs/by-name/ex/exploitdb/package.nix
index 5a36a41abc88..28b993b717d9 100644
--- a/pkgs/by-name/ex/exploitdb/package.nix
+++ b/pkgs/by-name/ex/exploitdb/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "exploitdb";
-  version = "2026-05-08";
+  version = "2026-05-14";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = "exploitdb";
     tag = finalAttrs.version;
-    hash = "sha256-fTO/85TOpDeyJG8qaaM6YTBYel7Jpycphrs7hs8S7Hs=";
+    hash = "sha256-1Dg2SNdg6gQyacSC6a1Nr8y3VnV8HcQ2Nu6eiYEh3/s=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/hy/hyprgraphics/package.nix b/pkgs/by-name/hy/hyprgraphics/package.nix
index 91a62ae11e99..3ef60dbbd679 100644
--- a/pkgs/by-name/hy/hyprgraphics/package.nix
+++ b/pkgs/by-name/hy/hyprgraphics/package.nix
@@ -65,6 +65,7 @@ gcc15Stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://github.com/hyprwm/hyprgraphics";
+    changelog = "https://github.com/hyprwm/hyprgraphics/releases/tag/${finalAttrs.src.tag}";
     description = "Cpp graphics library for Hypr* ecosystem";
     license = lib.licenses.bsd3;
     platforms = lib.platforms.linux ++ lib.platforms.freebsd;
diff --git a/pkgs/by-name/hy/hypridle/package.nix b/pkgs/by-name/hy/hypridle/package.nix
index 0791f1389ba7..d09e81d9aac4 100644
--- a/pkgs/by-name/hy/hypridle/package.nix
+++ b/pkgs/by-name/hy/hypridle/package.nix
@@ -23,7 +23,7 @@ gcc15Stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "hypridle";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-YzRWE3rCnsY0WDRJcn4KvyWUoe+5zdkUYNIaHGP9BZ4=";
   };
 
@@ -52,6 +52,7 @@ gcc15Stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Hyprland's idle daemon";
     homepage = "https://github.com/hyprwm/hypridle";
+    changelog = "https://github.com/hyprwm/hypridle/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.bsd3;
     teams = [ lib.teams.hyprland ];
     mainProgram = "hypridle";
diff --git a/pkgs/by-name/hy/hyprland/package.nix b/pkgs/by-name/hy/hyprland/package.nix
index 829058ef1eab..4923531518e5 100644
--- a/pkgs/by-name/hy/hyprland/package.nix
+++ b/pkgs/by-name/hy/hyprland/package.nix
@@ -217,6 +217,7 @@ customStdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://github.com/hyprwm/Hyprland";
+    changelog = "https://github.com/hyprwm/Hyprland/releases/tag/${finalAttrs.src.tag}";
     description = "Dynamic tiling Wayland compositor that doesn't sacrifice on its looks";
     license = lib.licenses.bsd3;
     teams = [ lib.teams.hyprland ];
diff --git a/pkgs/by-name/hy/hyprlock/package.nix b/pkgs/by-name/hy/hyprlock/package.nix
index ffe0dcaf6d75..a61f6f439476 100644
--- a/pkgs/by-name/hy/hyprlock/package.nix
+++ b/pkgs/by-name/hy/hyprlock/package.nix
@@ -33,7 +33,7 @@ gcc15Stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "hyprlock";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-VFlM1cN4jmUAbfmZbeg7vL+AN9miXEUqqpk5EkHNq2c=";
   };
 
@@ -77,6 +77,7 @@ gcc15Stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Hyprland's GPU-accelerated screen locking utility";
     homepage = "https://github.com/hyprwm/hyprlock";
+    changelog = "https://github.com/hyprwm/hyprlock/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [
       iynaix
diff --git a/pkgs/by-name/hy/hyprpicker/package.nix b/pkgs/by-name/hy/hyprpicker/package.nix
index 1202cd4a9c4f..006aa5d9472b 100644
--- a/pkgs/by-name/hy/hyprpicker/package.nix
+++ b/pkgs/by-name/hy/hyprpicker/package.nix
@@ -25,7 +25,7 @@ gcc15Stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "hyprpicker";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-ABumeksE8Bvtdb6g4vJ2jA9BLlYHnXU86VAuKJhBPoY=";
   };
 
@@ -60,6 +60,7 @@ gcc15Stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Wlroots-compatible Wayland color picker that does not suck";
     homepage = "https://github.com/hyprwm/hyprpicker";
+    changelog = "https://github.com/hyprwm/hyprpicker/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.bsd3;
     teams = [ lib.teams.hyprland ];
     platforms = wayland.meta.platforms;
diff --git a/pkgs/by-name/hy/hyprshutdown/package.nix b/pkgs/by-name/hy/hyprshutdown/package.nix
index b2fcc788c7a3..37d2a123203e 100644
--- a/pkgs/by-name/hy/hyprshutdown/package.nix
+++ b/pkgs/by-name/hy/hyprshutdown/package.nix
@@ -54,6 +54,7 @@ gcc15Stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "A graceful shutdown utility for Hyprland";
     homepage = "https://github.com/hyprwm/hyprshutdown";
+    changelog = "https://github.com/hyprwm/hyprshutdown/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.bsd3;
     maintainers = [ lib.maintainers.mithicspirit ];
     teams = [ lib.teams.hyprland ];
diff --git a/pkgs/by-name/hy/hyprsunset/package.nix b/pkgs/by-name/hy/hyprsunset/package.nix
index e72feacfa216..02716ad867d5 100644
--- a/pkgs/by-name/hy/hyprsunset/package.nix
+++ b/pkgs/by-name/hy/hyprsunset/package.nix
@@ -52,6 +52,7 @@ gcc15Stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://github.com/hyprwm/hyprsunset";
+    changelog = "https://github.com/hyprwm/hyprsunset/releases/tag/${finalAttrs.src.tag}";
     description = "Application to enable a blue-light filter on Hyprland";
     license = lib.licenses.bsd3;
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/hy/hyprutils/package.nix b/pkgs/by-name/hy/hyprutils/package.nix
index 6b1153743b93..99329345a7b8 100644
--- a/pkgs/by-name/hy/hyprutils/package.nix
+++ b/pkgs/by-name/hy/hyprutils/package.nix
@@ -39,6 +39,7 @@ gcc15Stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://github.com/hyprwm/hyprutils";
+    changelog = "https://github.com/hyprwm/hyprutils/releases/tag/${finalAttrs.src.tag}";
     description = "Small C++ library for utilities used across the Hypr* ecosystem";
     license = lib.licenses.bsd3;
     platforms = lib.platforms.linux ++ lib.platforms.freebsd;
diff --git a/pkgs/by-name/ka/kazumi/package.nix b/pkgs/by-name/ka/kazumi/package.nix
index 0c34771bb540..845318238eb8 100644
--- a/pkgs/by-name/ka/kazumi/package.nix
+++ b/pkgs/by-name/ka/kazumi/package.nix
@@ -18,13 +18,13 @@
 }:
 
 let
-  version = "2.1.0";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "Predidit";
     repo = "Kazumi";
     tag = version;
-    hash = "sha256-cNyeEsH578q+noxOQpJs57x+6FEr6okDbwcaDj6eW1A=";
+    hash = "sha256-zXqSc89swNQ/zYLyqBOShJScqWFlsKC6+qHwHl5Pd1Y=";
   };
 in
 flutter338.buildFlutterApplication {
diff --git a/pkgs/by-name/ma/material-maker/package.nix b/pkgs/by-name/ma/material-maker/package.nix
index 9341464b084c..2fe3edc95452 100644
--- a/pkgs/by-name/ma/material-maker/package.nix
+++ b/pkgs/by-name/ma/material-maker/package.nix
@@ -73,6 +73,15 @@ stdenv.mkDerivation (finalAttrs: {
     mkdir -vp $out/bin
     ln -vs $out/share/material-maker/material-maker $out/bin/material-maker
 
+    mkdir -vp $out/share/applications
+    cp -v material_maker/misc/linux/io.github.RodZill4.Material-Maker.desktop $out/share/applications
+
+    mkdir -vp $out/share/metainfo
+    cp -v material_maker/misc/linux/io.github.RodZill4.Material-Maker.appdata.xml $out/share/metainfo
+
+    mkdir -vp $out/share/icons/hicolor/256x256/apps
+    cp -v icon.png $out/share/icons/hicolor/256x256/apps/material-maker.png
+
     runHook postInstall
   '';
 
diff --git a/pkgs/by-name/or/orbiton/package.nix b/pkgs/by-name/or/orbiton/package.nix
index 42108034393f..9aacda821dfe 100644
--- a/pkgs/by-name/or/orbiton/package.nix
+++ b/pkgs/by-name/or/orbiton/package.nix
@@ -12,13 +12,13 @@
 
 buildGoModule rec {
   pname = "orbiton";
-  version = "2.73.1";
+  version = "2.74.0";
 
   src = fetchFromGitHub {
     owner = "xyproto";
     repo = "orbiton";
     tag = "v${version}";
-    hash = "sha256-C1uPpNNb3XgMqcryVtbv3fU/lqVm2E2ACpvBTK7KajI=";
+    hash = "sha256-ZzGwcTmfx7f5TeHim+ynJ7l09sktmXz1fLt2pRyW1Og=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/ro/routedns/package.nix b/pkgs/by-name/ro/routedns/package.nix
index 947bb558fa88..687ab74c78d6 100644
--- a/pkgs/by-name/ro/routedns/package.nix
+++ b/pkgs/by-name/ro/routedns/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "routedns";
-  version = "0.1.159";
+  version = "0.1.169";
 
   src = fetchFromGitHub {
     owner = "folbricht";
     repo = "routedns";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-GIDB491bk/FaH/VBjPsWqZDWVA6EtJq6rx09SOdhfW0=";
+    hash = "sha256-VQ+8wGv46YZbCYedU1gYTNqd54+kjbuPKbaYRV3IHYc=";
   };
 
   vendorHash = "sha256-a4KcKb75yWv7+1vIYCypS9nnrFJ3zogXIPzUVVA7AXs=";
diff --git a/pkgs/by-name/vi/vicinae/package.nix b/pkgs/by-name/vi/vicinae/package.nix
index 69948d868bed..acf2fea0f7f3 100644
--- a/pkgs/by-name/vi/vicinae/package.nix
+++ b/pkgs/by-name/vi/vicinae/package.nix
@@ -21,13 +21,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "vicinae";
-  version = "0.20.15";
+  version = "0.21.0";
 
   src = fetchFromGitHub {
     owner = "vicinaehq";
     repo = "vicinae";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-aUM+rSGb6liWdSBVABBwUKZXhsr5iUPq2QfnjkIsEVE=";
+    hash = "sha256-F034G8DctTGGi1ijekwkaXE4w5WZqHt2Hvvu8hqRfJE=";
   };
 
   apiDeps = fetchNpmDeps {
diff --git a/pkgs/by-name/zu/zuban/package.nix b/pkgs/by-name/zu/zuban/package.nix
index 08174c0cb392..df8422c0453a 100644
--- a/pkgs/by-name/zu/zuban/package.nix
+++ b/pkgs/by-name/zu/zuban/package.nix
@@ -9,13 +9,13 @@
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zuban";
 
-  version = "0.7.1";
+  version = "0.7.2";
 
   src = fetchFromGitHub {
     owner = "zubanls";
     repo = "zuban";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-s2u4or9qittXMt9layFEVrtYLhNgghZQd7VdupUpxqU=";
+    hash = "sha256-KCQOJ2NyWohbfW6fdG7F+borxUEXOy1IRB/jlc1wrc0=";
     fetchSubmodules = true;
   };
 
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   buildAndTestSubdir = "crates/zuban";
 
-  cargoHash = "sha256-0CynAjkY1Q6IZ8yyZWL8p/MySriahql2fc3qqsNvPeI=";
+  cargoHash = "sha256-r8ezvIkd4R3rFdoKr+KKHKnLWl1/Vl3Ch9GdKhVflMo=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/os-specific/linux/kernel-headers/default.nix b/pkgs/os-specific/linux/kernel-headers/default.nix
index 7a7531738fae..3bee4e848c76 100644
--- a/pkgs/os-specific/linux/kernel-headers/default.nix
+++ b/pkgs/os-specific/linux/kernel-headers/default.nix
@@ -9,6 +9,8 @@
   flex,
   rsync,
   writeTextFile,
+  nix-update-script,
+  linux_latest,
 }:
 
 let
@@ -42,6 +44,7 @@ let
       src,
       version,
       patches ? [ ],
+      passthru ? { },
     }:
     stdenvNoCC.mkDerivation {
       inherit src;
@@ -139,6 +142,8 @@ let
         echo "${version}-default" > $out/include/config/kernel.release
       '';
 
+      inherit passthru;
+
       meta = {
         description = "Header files and scripts for Linux kernel";
         license = lib.licenses.gpl2Only;
@@ -163,5 +168,11 @@ in
       patches = [
         ./no-relocs.patch # for building x86 kernel headers on non-ELF platforms
       ];
+      passthru.updateScript = nix-update-script {
+        extraArgs = [
+          "--version"
+          "${linux_latest.meta.branch}"
+        ];
+      };
     };
 }
diff --git a/pkgs/servers/home-assistant/custom-components/entity-notes/package.nix b/pkgs/servers/home-assistant/custom-components/entity-notes/package.nix
new file mode 100644
index 000000000000..5318b402b1c7
--- /dev/null
+++ b/pkgs/servers/home-assistant/custom-components/entity-notes/package.nix
@@ -0,0 +1,31 @@
+{
+  lib,
+  buildHomeAssistantComponent,
+  fetchFromGitHub,
+  voluptuous,
+}:
+
+buildHomeAssistantComponent rec {
+  owner = "martindell";
+  domain = "entity_notes";
+  version = "3.3.4";
+
+  src = fetchFromGitHub {
+    inherit owner;
+    repo = "ha-entity-notes";
+    tag = "v${version}";
+    hash = "sha256-5JKZ/KC2sSDQQeg3taLyuZdF6QJHdc7pJ1jaFD9S3kc=";
+  };
+
+  dependencies = [
+    voluptuous
+  ];
+
+  meta = {
+    description = "Home Assistant custom component for adding notes to entities";
+    homepage = "https://github.com/martindell/ha-entity-notes";
+    changelog = "https://github.com/martindell/ha-entity-notes/releases/tag/${src.tag}";
+    maintainers = with lib.maintainers; [ SuperSandro2000 ];
+    license = lib.licenses.mit;
+  };
+}