diff --git a/lib/systems/default.nix b/lib/systems/default.nix
index 4c05525c9b36..0df2efacdfcb 100644
--- a/lib/systems/default.nix
+++ b/lib/systems/default.nix
@@ -85,11 +85,12 @@ let
     let
       allArgs = systemToAttrs systemOrArgs;
 
-      # Those two will always be derived from "config", if given, so they should NOT
-      # be overridden further down with "// args".
+      # These attributes are derived from other inputs, so they should NOT be
+      # overridden further down with "// args".
       args = removeAttrs allArgs [
         "parsed"
         "system"
+        "_withoutFunctions"
       ];
 
       # TODO: deprecate args.rustc in favour of args.rust after 23.05 is EOL.
diff --git a/lib/tests/systems.nix b/lib/tests/systems.nix
index 2cc8f7aa607e..3feef87d97c0 100644
--- a/lib/tests/systems.nix
+++ b/lib/tests/systems.nix
@@ -266,6 +266,22 @@ lib.runTests (
         }).parsed.cpu.arch;
       expected = "i686";
     };
+    test_equals_reelaborate_overridden_platform = {
+      expr =
+        let
+          base = lib.systems.elaborate "x86_64-linux";
+        in
+        lib.systems.equals base (
+          lib.systems.elaborate (
+            base
+            // {
+              useLLVM = true;
+              linker = "lld";
+            }
+          )
+        );
+      expected = false;
+    };
   }
   // {
     # equals.functionNames must list exactly the function-valued attrs of an
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index c9ed3a3e4efe..8ec7cbcba53d 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -20233,11 +20233,13 @@
     github = "numinit";
     githubId = 369111;
     keys = [
-      # >=2025, stays in one place
+      # SSH
+      { fingerprint = "XX/0lMz82MpucPqf0KG+5EJoozzNRi8i/t59byD2kNo"; }
+      # GPG, >=2025, stays in one place
       { fingerprint = "FD28 F9C9 81C5 D78E 56E8  8311 5C3E B94D 198F 1491"; }
-      # >=2025, travels with me
+      # GPG, >=2025, travels with me
       { fingerprint = "C48F 475F 30A9 B192 3213  D5D5 C6E2 4809 77B2 F2F4"; }
-      # <=2024
+      # GPG, <=2024
       { fingerprint = "190B DA97 F616 DE35 6899  ED17 F819 F1AF 2FC1 C1FF"; }
     ];
   };
@@ -30880,6 +30882,13 @@
     githubId = 873857;
     name = "Zack Newman";
   };
+  Zocker1999NET = {
+    github = "Zocker1999NET";
+    githubId = 1645646;
+    name = "Felix Stupp";
+    email = "felix.stupp@banananet.work";
+    keys = [ { fingerprint = "73D0 9948 B239 2D68 8A45  DC83 93E1 BD26 F6B0 2FB7"; } ];
+  };
   zodman = {
     github = "zodman";
     githubId = 44167;
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index 9d228a66b7f2..7db072c80629 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -358,7 +358,6 @@ with lib.maintainers;
   home-assistant = {
     members = [
       dotlambda
-      fab
       hexa
     ];
     scope = "Maintain the Home Assistant ecosystem";
diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
index e65ac9049ba8..709dd9e5925c 100644
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -306,6 +306,8 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.
 
 - support for `ecryptfs` in nixpkgs has been removed.
 
+- `services.xserver.cmt` has been removed as the `xf86-input-cmt` package was broken and unmaintained upstream.
+
 - `programs.light` was removed from nixpkgs due to the corresponding package being unmaintained upstream. `brightnessctl` and `programs.acpilight` offer replacements.
 
 - `ceph` has been upgraded to v20. See the [Ceph "tentacle" release notes](https://docs.ceph.com/en/latest/releases/tentacle/#v20-2-0-tentacle) for details and recommended upgrade procedure.
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index b9bf52b0068a..370dc1fc5ee1 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1856,7 +1856,6 @@
   ./services/x11/display-managers/xpra.nix
   ./services/x11/extra-layouts.nix
   ./services/x11/fractalart.nix
-  ./services/x11/hardware/cmt.nix
   ./services/x11/hardware/digimend.nix
   ./services/x11/hardware/synaptics.nix
   ./services/x11/hardware/wacom.nix
diff --git a/nixos/modules/rename.nix b/nixos/modules/rename.nix
index 5dbd2a2d09f2..4bca9ffcaaa0 100644
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@@ -390,6 +390,10 @@ in
       as the underlying package isn't being maintained. Working alternatives are
       libinput and synaptics.
     '')
+    (mkRemovedOptionModule [ "services" "xserver" "windowManager" "ragnarwm" ] ''
+      The services.xserver.windowManager.ragnarwm module has been removed
+      because the corresponding package was removed from nixpkgs.
+    '')
     (mkRemovedOptionModule [
       "services"
       "xmr-stak"
@@ -514,6 +518,9 @@ in
     (mkRemovedOptionModule [ "services" "xtreemfs" ] ''
       services.xtreemfs has been removed as it was broken and unmaintained upstream
     '')
+    (mkRemovedOptionModule [ "services" "xserver" "cmt" ] ''
+      services.xserver.cmt has been removed as it was broken and unmaintained upstream
+    '')
     # Do NOT add any option renames here, see top of the file
   ];
 }
diff --git a/nixos/modules/services/networking/mullvad-vpn.nix b/nixos/modules/services/networking/mullvad-vpn.nix
index 9903308d619c..895fc21bb610 100644
--- a/nixos/modules/services/networking/mullvad-vpn.nix
+++ b/nixos/modules/services/networking/mullvad-vpn.nix
@@ -39,7 +39,7 @@ with lib;
     };
 
     package = mkPackageOption pkgs "mullvad" {
-      example = "mullvad-vpn";
+      example = "pkgs.mullvad-vpn";
       extraDescription = ''
         `pkgs.mullvad` only provides the CLI tool, `pkgs.mullvad-vpn` provides both the CLI and the GUI.
       '';
diff --git a/nixos/modules/services/x11/hardware/cmt.nix b/nixos/modules/services/x11/hardware/cmt.nix
deleted file mode 100644
index ca636fdb73fe..000000000000
--- a/nixos/modules/services/x11/hardware/cmt.nix
+++ /dev/null
@@ -1,114 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-with lib;
-
-let
-
-  cfg = config.services.xserver.cmt;
-  etcPath = "X11/xorg.conf.d";
-
-in
-{
-
-  options = {
-
-    services.xserver.cmt = {
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-        description = "Enable chrome multitouch input (cmt). Touchpad drivers that are configured for chromebooks.";
-      };
-      models = mkOption {
-        type = types.enum [
-          "atlas"
-          "banjo"
-          "candy"
-          "caroline"
-          "cave"
-          "celes"
-          "clapper"
-          "cyan"
-          "daisy"
-          "elan"
-          "elm"
-          "enguarde"
-          "eve"
-          "expresso"
-          "falco"
-          "gandof"
-          "glimmer"
-          "gnawty"
-          "heli"
-          "kevin"
-          "kip"
-          "leon"
-          "lulu"
-          "orco"
-          "pbody"
-          "peppy"
-          "pi"
-          "pit"
-          "puppy"
-          "quawks"
-          "rambi"
-          "samus"
-          "snappy"
-          "spring"
-          "squawks"
-          "swanky"
-          "winky"
-          "wolf"
-          "auron_paine"
-          "auron_yuna"
-          "daisy_skate"
-          "nyan_big"
-          "nyan_blaze"
-          "veyron_jaq"
-          "veyron_jerry"
-          "veyron_mighty"
-          "veyron_minnie"
-          "veyron_speedy"
-        ];
-        example = "banjo";
-        description = ''
-          Which models to enable cmt for. Enter the Code Name for your Chromebook.
-          Code Name can be found at <https://www.chromium.org/chromium-os/developer-information-for-chrome-os-devices>.
-        '';
-      };
-    }; # closes services
-  }; # closes options
-
-  config = mkIf cfg.enable {
-
-    services.xserver.modules = [ pkgs.xf86-input-cmt ];
-
-    environment.etc = {
-      "${etcPath}/40-touchpad-cmt.conf" = {
-        source = "${pkgs.chromium-xorg-conf}/40-touchpad-cmt.conf";
-      };
-      "${etcPath}/50-touchpad-cmt-${cfg.models}.conf" = {
-        source = "${pkgs.chromium-xorg-conf}/50-touchpad-cmt-${cfg.models}.conf";
-      };
-      "${etcPath}/60-touchpad-cmt-${cfg.models}.conf" = {
-        source = "${pkgs.chromium-xorg-conf}/60-touchpad-cmt-${cfg.models}.conf";
-      };
-    };
-
-    assertions = [
-      {
-        assertion = !config.services.libinput.enable;
-        message = ''
-          cmt and libinput are incompatible, meaning you cannot enable them both.
-          To use cmt you need to disable libinput with `services.libinput.enable = false`
-          If you haven't enabled it in configuration.nix, it's enabled by default on a
-          different xserver module.
-        '';
-      }
-    ];
-  };
-}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 1be58d143740..3475d14e7f26 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1770,6 +1770,7 @@ in
   vector = import ./vector { inherit runTest; };
   velocity = runTest ./velocity.nix;
   vengi-tools = runTest ./vengi-tools.nix;
+  veroroute = runTest ./veroroute.nix;
   victorialogs = import ./victorialogs { inherit runTest; };
   victoriametrics = import ./victoriametrics { inherit runTest; };
   victoriatraces = import ./victoriatraces { inherit runTest; };
diff --git a/nixos/tests/gnupg.nix b/nixos/tests/gnupg.nix
index 1c720b2d6b84..5f3e731508d4 100644
--- a/nixos/tests/gnupg.nix
+++ b/nixos/tests/gnupg.nix
@@ -77,7 +77,7 @@
         machine.send_chars("pgp_p4ssphrase")
         machine.wait_until_tty_matches("1", "Passphrases match")
         machine.send_chars("\n")
-        machine.wait_until_tty_matches("1", "public and secret key created")
+        machine.wait_until_tty_matches("1", "secret key created and signed")
 
     with subtest("Confirm the key is in the keyring"):
         machine.wait_until_succeeds(as_alice("gpg --list-secret-keys | grep -q alice@machine"))
@@ -92,7 +92,7 @@
 
         # Note: again, this needs a tty because of pinentry
         machine.send_chars("ssh-add alice\n")
-        machine.wait_until_tty_matches("1", "Enter passphrase")
+        machine.wait_until_tty_matches("1", "passphrase for")
         machine.send_chars("ssh_p4ssphrase\n")
         machine.wait_until_tty_matches("1", "Please enter")
         machine.send_chars("ssh_agent_p4ssphrase")
diff --git a/nixos/tests/veroroute.nix b/nixos/tests/veroroute.nix
new file mode 100644
index 000000000000..0d3deb2f2831
--- /dev/null
+++ b/nixos/tests/veroroute.nix
@@ -0,0 +1,31 @@
+{ pkgs, ... }:
+{
+  name = "veroroute";
+  meta.maintainers = with pkgs.lib.maintainers; [ nh2 ];
+
+  enableOCR = true;
+
+  nodes.machine =
+    { ... }:
+    {
+      imports = [
+        ./common/x11.nix
+      ];
+
+      services.xserver.enable = true;
+      environment.systemPackages = [
+        pkgs.veroroute
+        pkgs.xdotool
+      ];
+    };
+
+  testScript = ''
+    start_all()
+    machine.wait_for_x()
+
+    machine.execute("veroroute >&2 &")
+    machine.wait_until_succeeds("xdotool search --pid $(pidof veroroute)")
+    machine.wait_for_text("File")  # menu entry renders correctly
+    machine.screenshot("screen")
+  '';
+}
diff --git a/pkgs/applications/editors/android-studio/default.nix b/pkgs/applications/editors/android-studio/default.nix
index 2330f3ac9ad0..6ca61b10e027 100644
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@@ -26,9 +26,9 @@ let
     url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2025.3.4.5/android-studio-panda4-rc1-linux.tar.gz";
   };
   latestVersion = {
-    version = "2026.1.1.4"; # "Android Studio Quail 1 | 2026.1.1 Canary 4"
-    sha256Hash = "sha256-aKbyRwgY4Z2W9hF3YY64dLLF5wUGIrdtGySYrV57lNQ=";
-    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.1.4/android-studio-quail1-canary4-linux.tar.gz";
+    version = "2026.1.1.5"; # "Android Studio Quail 1 | 2026.1.1 Canary 5"
+    sha256Hash = "sha256-k4rM0MyTh0wnpsK8m6Hs1nSdwYpqUiQ+z7oiO6hn9YQ=";
+    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.1.5/android-studio-quail1-canary5-linux.tar.gz";
   };
 in
 {
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 41226b4113df..a5a9f9b836f5 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1174,8 +1174,8 @@ let
         mktplcRef = {
           publisher = "DanielSanMedium";
           name = "dscodegpt";
-          version = "3.17.36";
-          hash = "sha256-7+Ja5/zeGq+W1aCIzZu0x+CU1ERwZhwvOaZKaGSWK4c=";
+          version = "3.20.6";
+          hash = "sha256-QDs+zi2Kb2APYxZOzvBnrEZqlmhzNFmQ3bpSfIaPjlc=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/DanielSanMedium.dscodegpt/changelog";
@@ -1226,8 +1226,8 @@ let
         mktplcRef = {
           name = "databricks";
           publisher = "databricks";
-          version = "2.10.6";
-          hash = "sha256-6D8QRH8x2LCZehkkaKf3s3yKzmAkiBg9gFaUCIzGJB4=";
+          version = "2.10.7";
+          hash = "sha256-ODAUmYiomllLMGbncU4T+8SfLZnhULggFB6Mfw7vn1o=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/databricks.databricks/changelog";
@@ -3239,6 +3239,8 @@ let
 
       ms-python.vscode-pylance = callPackage ./ms-python.vscode-pylance { };
 
+      ms-python.vscode-python-envs = callPackage ./ms-python.vscode-python-envs { };
+
       ms-toolsai.datawrangler = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "datawrangler";
@@ -4220,8 +4222,8 @@ let
         mktplcRef = {
           publisher = "shd101wyy";
           name = "markdown-preview-enhanced";
-          version = "0.8.25";
-          hash = "sha256-0yOtvHL24eJizmzXAC956Tx9eNJaWDPl/OAhmFv2KJk=";
+          version = "0.8.26";
+          hash = "sha256-OZMUHqc8l8BrpLONlOIeImnsJVa0TLN1R51ulQ5n8h4=";
         };
         meta = {
           description = "Provides a live preview of markdown using either markdown-it or pandoc";
diff --git a/pkgs/applications/editors/vscode/extensions/ms-python.vscode-python-envs/default.nix b/pkgs/applications/editors/vscode/extensions/ms-python.vscode-python-envs/default.nix
new file mode 100644
index 000000000000..a0b49680da49
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/ms-python.vscode-python-envs/default.nix
@@ -0,0 +1,23 @@
+{
+  lib,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "vscode-python-envs";
+    publisher = "ms-python";
+    version = "1.33.2026051501";
+    hash = "sha256-V5anlwzLt0V08HsO6TCBIUPD3VPhyohg7YnSc/1++GE=";
+  };
+
+  meta = {
+    description = "Provides a unified python environment experience";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=ms-python.vscode-python-envs";
+    homepage = "https://github.com/microsoft/vscode-python-environments";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      Zocker1999NET
+    ];
+  };
+}
diff --git a/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix b/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
index 1c0fe0f5ed3a..054acad39eb7 100644
--- a/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "claude-dev";
     publisher = "saoudrizwan";
-    version = "3.82.0";
-    hash = "sha256-+CtWfRGumMTFckmU9Z8TAwrn35WiUrri1x6XL9khOnM=";
+    version = "3.83.0";
+    hash = "sha256-d9b8mXi/PI87T9J67yzI2yID7hhd6OPdM2+Na3I5Wg8=";
   };
 
   meta = {
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index af40564ff327..994df17ef1b2 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -128,13 +128,13 @@
     "vendorHash": "sha256-/dOiXO2aPkuZaFiwv/6AXJdIADgx8T7eOwvJfBBoqg8="
   },
   "buildkite_buildkite": {
-    "hash": "sha256-/Bg9Dym8mdcsjnTzlBs8iw6z4JpGBRvDo2kJeFJQ2MY=",
+    "hash": "sha256-R9jG7ww2iEU1qif6NeV0lpgG6Nv5rsh5h+IVhSscuKI=",
     "homepage": "https://registry.terraform.io/providers/buildkite/buildkite",
     "owner": "buildkite",
     "repo": "terraform-provider-buildkite",
-    "rev": "v1.32.0",
+    "rev": "v1.33.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-CdaYWCQQ0L1LprQ5G/aXoA5GCQWCxOkkiDbMd20r7rs="
+    "vendorHash": "sha256-n6+8mufcH3rNe4yLkc+7NkV7UwNwyIVzDFStSC7iqE4="
   },
   "camptocamp_pass": {
     "hash": "sha256-GQ2g7VyK+eeBqW3LMR4U0gMYsvQnG3y+KEKKkvnmfsk=",
@@ -598,13 +598,13 @@
     "vendorHash": "sha256-qzwm0R51jvElo+T8ypkHrlQy/MH8c/o+NWIS+YrQ4uw="
   },
   "hashicorp_http": {
-    "hash": "sha256-IXqKZ9RQP0kZVxc9OfaWglF8GeycSAl5DATdqc8n35g=",
+    "hash": "sha256-5zZSKmlhSuIaIiXUZhmTCFwfJ/3QxdDOg4RVooY7qcA=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/http",
     "owner": "hashicorp",
     "repo": "terraform-provider-http",
-    "rev": "v3.5.0",
+    "rev": "v3.6.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-SsEWNIBkgcdTlSrB4hIvRmhMv2eJ2qQaPUmiN09A+NM="
+    "vendorHash": "sha256-hh0tOG9HY0cWTda5vjpGwCGntD7I/wCJf6B92EMKRrQ="
   },
   "hashicorp_kubernetes": {
     "hash": "sha256-P9ChE8AZa6LqDMOyjAx2COMGmzhCpIsiUJ9uXbTUPwo=",
@@ -1481,13 +1481,13 @@
     "vendorHash": "sha256-rUYHapEVqRupLOPVbcAH8YP0cuXclMmYTQUkqeOwCN0="
   },
   "vultr_vultr": {
-    "hash": "sha256-IKXby/v1oNjxwgzbFTSDQYEEWbV8v8qzB4ZC9ISEf5o=",
+    "hash": "sha256-TMja+5jeYxIjY/MvJwCR/2rsbHuF7RcPReQSzkksk7Q=",
     "homepage": "https://registry.terraform.io/providers/vultr/vultr",
     "owner": "vultr",
     "repo": "terraform-provider-vultr",
-    "rev": "v2.31.1",
+    "rev": "v2.31.2",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-XQcxOSvZKXyq+k8N5n1lMM1ThbWfDXBm1Hc+Rmagu7I="
+    "vendorHash": "sha256-OASLdReS245N4y0SQ4WY7kPNPpGTHptQgXlNqPlb3nM="
   },
   "wgebis_mailgun": {
     "hash": "sha256-Li4eyqZ6huO5Q+XTcQ+HQCg8IOjhxGU9Z4Uw3TbMdAc=",
diff --git a/pkgs/applications/networking/cluster/terraform/default.nix b/pkgs/applications/networking/cluster/terraform/default.nix
index e0a9677bce88..9e3d6fa9ecf1 100644
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@@ -200,9 +200,9 @@ rec {
   mkTerraform = attrs: pluggable (generic attrs);
 
   terraform_1 = mkTerraform {
-    version = "1.15.2";
-    hash = "sha256-jwmyZJHGfi2oO8FBebPKBQdXt61w02H6zbbqSXxMhMM=";
-    vendorHash = "sha256-Gv6V5aXqTuQoG1StbD/7Ln2QrLpMsW6fbUJUkyZMkvk=";
+    version = "1.15.3";
+    hash = "sha256-TyPatVcWgRbvUb9nlZ1gQXR2k8AUUubJlAAOhC9QYIc=";
+    vendorHash = "sha256-aGkIsUxKHRgz8vxNO8RhXS0CH78Q14zSVANLrBGdhWw=";
     patches = [ ./provider-path-0_15.patch ];
     passthru = {
       inherit plugins;
diff --git a/pkgs/applications/video/kodi/unwrapped.nix b/pkgs/applications/video/kodi/unwrapped.nix
index 4a7392e6d4a3..7f21512e4bba 100644
--- a/pkgs/applications/video/kodi/unwrapped.nix
+++ b/pkgs/applications/video/kodi/unwrapped.nix
@@ -287,7 +287,6 @@ stdenv.mkDerivation (
       tinyxml-2
       taglib
       libssh
-      gtest
       ncurses
       spdlog
       alsa-lib
@@ -405,6 +404,10 @@ stdenv.mkDerivation (
       waylandpp.bin
     ];
 
+    nativeCheckInputs = [
+      gtest
+    ];
+
     depsBuildBuild = [
       buildPackages.stdenv.cc
     ];
@@ -445,9 +448,23 @@ stdenv.mkDerivation (
       "-DWITH_TEXTUREPACKER=${lib.getExe texturePacker}"
     ];
 
-    # 14 tests fail but the biggest issue is that every test takes 30 seconds -
-    # I'm guessing there is a thing waiting to time out
-    doCheck = false;
+    doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+    checkPhase = ''
+      runHook preCheck
+
+      make -j $NIX_BUILD_CORES kodi-test
+
+      ./kodi-test --gtest_filter=-${
+        lib.concatStringsSep ":" [
+          "TestCPUInfo.GetCPUFrequency"
+          "TestNetwork.PingHost"
+          "TestSystemInfo.GetOsName"
+          "TestSystemInfo.GetOsPrettyNameWithVersion"
+        ]
+      }
+
+      runHook postCheck
+    '';
 
     preConfigure = ''
       cmakeFlagsArray+=("-DCORE_PLATFORM_NAME=${lib.concatStringsSep " " kodi_platforms}")
diff --git a/pkgs/applications/window-managers/hyprwm/xdg-desktop-portal-hyprland/default.nix b/pkgs/applications/window-managers/hyprwm/xdg-desktop-portal-hyprland/default.nix
index 755258e07856..27dc09810161 100644
--- a/pkgs/applications/window-managers/hyprwm/xdg-desktop-portal-hyprland/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/xdg-desktop-portal-hyprland/default.nix
@@ -20,7 +20,6 @@
   qtwayland,
   sdbus-cpp_2,
   slurp,
-  systemd,
   wayland,
   wayland-protocols,
   wayland-scanner,
@@ -60,7 +59,6 @@ stdenv.mkDerivation (finalAttrs: {
     qttools
     qtwayland
     sdbus-cpp_2
-    systemd
     wayland
     wayland-protocols
     wayland-scanner
diff --git a/pkgs/build-support/fetchpatch/tests.nix b/pkgs/build-support/fetchpatch/tests.nix
index 3e79e9dd5469..fac768421a60 100644
--- a/pkgs/build-support/fetchpatch/tests.nix
+++ b/pkgs/build-support/fetchpatch/tests.nix
@@ -6,26 +6,26 @@ in
 
 {
   simple = testers.invalidateFetcherByDrvHash fetchpatch {
-    url = "https://github.com/facebook/zstd/pull/2724/commits/e1f85dbca3a0ed5ef06c8396912a0914db8dea6a.patch";
+    url = "https://github.com/facebook/zstd/commit/e1f85dbca3a0ed5ef06c8396912a0914db8dea6a.patch?full_index=1";
     sha256 =
       if isFetchpatch2 then
-        "sha256-w4yU0wt64d0WkuBQPeGf8vn5TH6qSBJvNIgka9QK+/Q="
+        "sha256-2kFh8FC96njAKH69uJp1vZSye47Suf76RfBodqosLU0="
       else
         "sha256-PuYAqnJWAE+L9bsroOnnBGJhERW8LHrGSLtIEkKU9vg=";
   };
 
   relative = testers.invalidateFetcherByDrvHash fetchpatch {
-    url = "https://github.com/boostorg/math/commit/7d482f6ebc356e6ec455ccb5f51a23971bf6ce5b.patch";
+    url = "https://github.com/boostorg/math/commit/7d482f6ebc356e6ec455ccb5f51a23971bf6ce5b.patch?full_index=1";
     relative = "include";
     sha256 =
       if isFetchpatch2 then
-        "sha256-1TtmuKeNIl/Yp+sfzBMR8Ue78tPIgjqGgjasa5IN52o="
+        "sha256-NS1CH+V5I29Yc0PHXdVxAn5tAHTvnGphRjhv4hZGYIo="
       else
         "sha256-KlmIbixcds6GyKYt1fx5BxDIrU7msrgDdYo9Va/KJR4=";
   };
 
   hunks = testers.invalidateFetcherByDrvHash fetchpatch {
-    url = "https://github.com/openssh/openssh-portable/commit/35d5917652106aede47621bb3f64044604164043.patch";
+    url = "https://github.com/openssh/openssh-portable/commit/35d5917652106aede47621bb3f64044604164043.patch?full_index=1";
     stripLen = 1;
     hunks = [
       2
@@ -37,13 +37,13 @@ in
     ];
     sha256 =
       if isFetchpatch2 then
-        "sha256-SXJALY4zC4y/ZV7uVglf+XB5cpC5tS4M8QDGlFRmcFM="
+        "sha256-2eiufShDHVpiK9DaGUzfu1MlGrgE9OJAhmQcEcAViQw="
       else
         "sha256-MV7uGgA1ESMR7W6H5FjAIxKcpySdQjWB+L2zaHjd96M=";
   };
 
   full = testers.invalidateFetcherByDrvHash fetchpatch {
-    url = "https://github.com/boostorg/math/commit/7d482f6ebc356e6ec455ccb5f51a23971bf6ce5b.patch";
+    url = "https://github.com/boostorg/math/commit/7d482f6ebc356e6ec455ccb5f51a23971bf6ce5b.patch?full_index=1";
     relative = "test";
     stripLen = 1;
     extraPrefix = "foo/bar/";
@@ -66,10 +66,10 @@ in
   };
 
   fileWithSpace = testers.invalidateFetcherByDrvHash fetchpatch {
-    url = "https://github.com/jfly/annoying-filenames/commit/1e86a219f5fc9c4137b409bc9c38036f3922724b.patch";
+    url = "https://github.com/jfly/annoying-filenames/commit/1e86a219f5fc9c4137b409bc9c38036f3922724b.patch?full_index=1";
     sha256 =
       if isFetchpatch2 then
-        "sha256-RB6pjigoXtzHILkGFXYd3Lz2aM9DvO0NRmLdey1N6gg="
+        "sha256-HIS/I7tLl/XYcyLuyjrIkPmLPxJPAuAguMUmhL9Ei8g="
       else
         "sha256-aptUvVojqIIIVNuHqkl+C+dZBGFfs+1MUd0FNV+4j4E=";
   };
diff --git a/pkgs/by-name/aa/aacgain/package.nix b/pkgs/by-name/aa/aacgain/package.nix
index 103ff1bd5d5d..8ecde4be226e 100644
--- a/pkgs/by-name/aa/aacgain/package.nix
+++ b/pkgs/by-name/aa/aacgain/package.nix
@@ -6,6 +6,7 @@
   autoconf,
   automake,
   libtool,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation {
@@ -27,7 +28,11 @@ stdenv.mkDerivation {
     libtool
   ];
 
-  env.NIX_CFLAGS_COMPILE = "-Wno-error=narrowing";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=narrowing -DHAVE_GETOPT_H=1";
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };
 
   meta = {
     description = "ReplayGain for AAC files";
diff --git a/pkgs/by-name/ac/ac-library/fix-char-signedness-tests.patch b/pkgs/by-name/ac/ac-library/fix-char-signedness-tests.patch
new file mode 100644
index 000000000000..7373784dbe43
--- /dev/null
+++ b/pkgs/by-name/ac/ac-library/fix-char-signedness-tests.patch
@@ -0,0 +1,24 @@
+diff --git i/test/unittest/type_traits_test.cpp w/test/unittest/type_traits_test.cpp
+index 164cc79..123b3a2 100644
+--- i/test/unittest/type_traits_test.cpp
++++ w/test/unittest/type_traits_test.cpp
+@@ -1,5 +1,6 @@
+ #include "atcoder/internal_type_traits"
+ 
++#include <climits>
+ #include <type_traits>
+ 
+ #include <gtest/gtest.h>
+@@ -44,7 +45,12 @@ static_assert(internal::is_unsigned_int<unsigned long long>::value, "");
+ static_assert(!internal::is_signed_int<A>::value, "");
+ static_assert(!internal::is_unsigned_int<A>::value, "");
+ 
++#if CHAR_MIN < 0
+ static_assert(is_same<unsigned char, internal::to_unsigned_t<char>>::value, "");
++#else
++static_assert(is_same<char, internal::to_unsigned_t<char>>::value, "");
++#endif
++
+ static_assert(
+     is_same<unsigned char, internal::to_unsigned_t<signed char>>::value,
+     "");
diff --git a/pkgs/by-name/ac/ac-library/package.nix b/pkgs/by-name/ac/ac-library/package.nix
index b112b8128a81..bdbb3e5d2355 100644
--- a/pkgs/by-name/ac/ac-library/package.nix
+++ b/pkgs/by-name/ac/ac-library/package.nix
@@ -18,7 +18,12 @@ stdenv.mkDerivation (finalAttrs: {
     fetchSubmodules = true;
     hash = "sha256-1wwzN/JPS6daj1vDFuEN5z20tMdLfMvEKti0sxCVlHA=";
   };
-
+  patches = [
+    # Fix type_traits_test assumptions about char signedness on platforms
+    # where char is unsigned by default (e.g. aarch64-linux).
+    # Reported upstream: https://github.com/atcoder/ac-library/issues/191
+    ./fix-char-signedness-tests.patch
+  ];
   outputs = [
     "dev"
     "out"
@@ -60,7 +65,6 @@ stdenv.mkDerivation (finalAttrs: {
   env = {
     NIX_CFLAGS_COMPILE = toString [
       "-Wno-error=array-bounds"
-      "-Wno-character-conversion"
     ];
   };
 
diff --git a/pkgs/by-name/ac/acgtk/package.nix b/pkgs/by-name/ac/acgtk/package.nix
index f2b10fb687cb..fd886d2ce58f 100644
--- a/pkgs/by-name/ac/acgtk/package.nix
+++ b/pkgs/by-name/ac/acgtk/package.nix
@@ -2,9 +2,11 @@
   lib,
   stdenv,
   fetchFromGitLab,
-  fetchpatch,
   ocamlPackages,
+  darwin,
   dune,
+  nix-update-script,
+  writableTmpDirAsHomeHook,
 }:
 
 stdenv.mkDerivation {
@@ -22,12 +24,16 @@ stdenv.mkDerivation {
 
   strictDeps = true;
 
-  nativeBuildInputs = with ocamlPackages; [
-    dune
-    findlib
-    menhir
-    ocaml
-  ];
+  nativeBuildInputs =
+    with ocamlPackages;
+    [
+      dune
+      findlib
+      menhir
+      ocaml
+      writableTmpDirAsHomeHook
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.sigtool ];
 
   buildInputs = with ocamlPackages; [
     ansiterminal
@@ -54,6 +60,13 @@ stdenv.mkDerivation {
     dune install -p acgtk --prefix $out --libdir $OCAMLFIND_DESTDIR
   '';
 
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "^release-(\\d+\\.\\d+\\.\\d+)$"
+    ];
+  };
+
   meta = {
     homepage = "https://acg.loria.fr/";
     description = "Toolkit for developing ACG signatures and lexicon";
diff --git a/pkgs/by-name/ag/age-plugin-ledger/package.nix b/pkgs/by-name/ag/age-plugin-ledger/package.nix
index 57a2f6178934..e85448204524 100644
--- a/pkgs/by-name/ag/age-plugin-ledger/package.nix
+++ b/pkgs/by-name/ag/age-plugin-ledger/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   rustPlatform,
   fetchFromGitHub,
   pkg-config,
@@ -30,6 +31,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     openssl
   ];
 
+  # rage (used in tests) panics on locale detection in the Nix sandbox without
+  # a valid LANG set.
+  preCheck = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    export LANG=en_US.UTF-8
+  '';
+
   nativeCheckInputs = [
     rage
   ];
diff --git a/pkgs/by-name/au/autobrr/package.nix b/pkgs/by-name/au/autobrr/package.nix
index edb3a95e3f6d..8de06ffd3288 100644
--- a/pkgs/by-name/au/autobrr/package.nix
+++ b/pkgs/by-name/au/autobrr/package.nix
@@ -16,12 +16,12 @@
 
 let
   pname = "autobrr";
-  version = "1.77.1";
+  version = "1.78.0";
   src = fetchFromGitHub {
     owner = "autobrr";
     repo = "autobrr";
     tag = "v${version}";
-    hash = "sha256-XNTQmW8JUxe8bffe1eGvxoRQ3rKdoH0QQKDn/wY6L3o=";
+    hash = "sha256-iLMeKFDBzSYrCjwvafemSDq8cN3DTzT6KpJzmzgVbYY=";
   };
 
   autobrr-web = stdenvNoCC.mkDerivation {
diff --git a/pkgs/by-name/bl/blazingjj/package.nix b/pkgs/by-name/bl/blazingjj/package.nix
new file mode 100644
index 000000000000..e399293e9b26
--- /dev/null
+++ b/pkgs/by-name/bl/blazingjj/package.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  makeBinaryWrapper,
+  jujutsu,
+  versionCheckHook,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "blazingjj";
+  version = "0.8.0";
+
+  src = fetchFromGitHub {
+    owner = "blazingjj";
+    repo = "blazingjj";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-vefD93gzT6WEplpnYiENtzXLSeXBo+9K3/RYpSBafDs=";
+  };
+
+  cargoHash = "sha256-E/xddxdvCDWH1xPn/CPXFyJIHg1Dy6EG3VZMZouWHQY=";
+
+  nativeBuildInputs = [ makeBinaryWrapper ];
+
+  nativeCheckInputs = [
+    jujutsu
+  ];
+
+  postInstall = ''
+    wrapProgram $out/bin/blazingjj \
+      --prefix PATH : ${lib.makeBinPath [ jujutsu ]}
+  '';
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+
+  __structuredAttrs = true;
+
+  meta = {
+    description = "TUI for Jujutsu/jj";
+    homepage = "https://github.com/blazingjj/blazingjj";
+    changelog = "https://github.com/blazingjj/blazingjj/releases/tag/v${finalAttrs.version}";
+    mainProgram = "blazingjj";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
+      peret
+    ];
+  };
+})
diff --git a/pkgs/by-name/cd/cdesktopenv/package.nix b/pkgs/by-name/cd/cdesktopenv/package.nix
index 9523f084119d..5258c77abee8 100644
--- a/pkgs/by-name/cd/cdesktopenv/package.nix
+++ b/pkgs/by-name/cd/cdesktopenv/package.nix
@@ -110,6 +110,9 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
+  # https://sourceforge.net/p/cdesktopenv/tickets/193/
+  hardeningDisable = [ "fortify" ];
+
   # Can probably remove after next release
   # https://sourceforge.net/p/cdesktopenv/code/ci/f0154141b1f1501490bac8e0235214bf8f00f715/
   env.NIX_CFLAGS_COMPILE = "-std=gnu17";
diff --git a/pkgs/by-name/ch/chrony/package.nix b/pkgs/by-name/ch/chrony/package.nix
index 15905539e62c..9a8cda9e9610 100644
--- a/pkgs/by-name/ch/chrony/package.nix
+++ b/pkgs/by-name/ch/chrony/package.nix
@@ -77,6 +77,7 @@ stdenv.mkDerivation (finalAttrs: {
         darwin
         illumos
       ];
+    broken = stdenv.isDarwin;
     maintainers = with lib.maintainers; [
       thoughtpolice
       vifino
diff --git a/pkgs/by-name/cl/cliamp/package.nix b/pkgs/by-name/cl/cliamp/package.nix
index 6a0cae730303..384f87b16223 100644
--- a/pkgs/by-name/cl/cliamp/package.nix
+++ b/pkgs/by-name/cl/cliamp/package.nix
@@ -16,13 +16,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "cliamp";
-  version = "1.39.1";
+  version = "1.50.0";
 
   src = fetchFromGitHub {
     owner = "bjarneo";
     repo = "cliamp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xGOTX6KQVtVuGPqTJGOXX80OaMlaK94qr67YecrRUEo=";
+    hash = "sha256-wXOIJ6oJfphEtBs84ova5tErcmKO3bHbDmRTiTX5zUE=";
   };
 
   vendorHash = "sha256-A2Ygc1a9e2flZzaNAEXvr8Ui1cE89TxBfUNALmDzIo0=";
diff --git a/pkgs/by-name/co/comma/package.nix b/pkgs/by-name/co/comma/package.nix
index 6d38d4f30acd..819e9f9df38d 100644
--- a/pkgs/by-name/co/comma/package.nix
+++ b/pkgs/by-name/co/comma/package.nix
@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "comma";
-  version = "2.3.3";
+  version = "2.4.1";
 
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "comma";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-dNek1a8Yt3icWc8ZpVe1NGuG+eSoTDOmAAJbkYmMocU=";
+    hash = "sha256-XZB0zx4wyNzy0LggAmh2gT2aEWAqVI9NljRoOkeK0c8=";
   };
 
-  cargoHash = "sha256-SJBfWjOVrv2WMIh/cQbaFK8jn3oSbmJpdJM7pkJppDs=";
+  cargoHash = "sha256-lY5HwWZm9X0xusLcC6MciAgSWEskNElrjhe9fexR6g8=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/cp/cpp-utilities/package.nix b/pkgs/by-name/cp/cpp-utilities/package.nix
index 3b27e5042f12..3702d496aca3 100644
--- a/pkgs/by-name/cp/cpp-utilities/package.nix
+++ b/pkgs/by-name/cp/cpp-utilities/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cpp-utilities";
-  version = "5.34.0";
+  version = "5.34.1";
 
   src = fetchFromGitHub {
     owner = "Martchus";
     repo = "cpp-utilities";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-lwrGPWRzCmOP4xeMH4ruLJfVaYXKc//WRFBSmKQ2iw0=";
+    sha256 = "sha256-QzmjE0a89fdc6ueuZbg5JtoP74HRaE6VQ5N4hVoXhyI=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/di/dix/package.nix b/pkgs/by-name/di/dix/package.nix
index 7893caee541a..5a53d877eb8b 100644
--- a/pkgs/by-name/di/dix/package.nix
+++ b/pkgs/by-name/di/dix/package.nix
@@ -9,6 +9,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   pname = "dix";
   version = "1.4.2";
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "faukah";
     repo = "dix";
diff --git a/pkgs/by-name/ec/ecwolf/package.nix b/pkgs/by-name/ec/ecwolf/package.nix
index 91ee86673271..3278c8f18365 100644
--- a/pkgs/by-name/ec/ecwolf/package.nix
+++ b/pkgs/by-name/ec/ecwolf/package.nix
@@ -1,7 +1,7 @@
 {
   stdenv,
   lib,
-  fetchFromBitbucket,
+  fetchFromGitHub,
   cmake,
   pkg-config,
   makeWrapper,
@@ -15,16 +15,15 @@
   writers,
   python3Packages,
   nix-update,
-  fetchpatch,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ecwolf";
   version = "1.4.2";
 
-  src = fetchFromBitbucket {
-    owner = "ecwolf";
-    repo = "ecwolf";
+  src = fetchFromGitHub {
+    owner = "ECWolfEngine";
+    repo = "ECWolf";
     tag = finalAttrs.version;
     hash = "sha256-T5K6B2fWMKMLB/662p/YLEv0Od9n0vUakznyoOnr0kI=";
   };
@@ -98,12 +97,13 @@ stdenv.mkDerivation (finalAttrs: {
     ];
 
   meta = {
-    description = "Enhanched SDL-based port of Wolfenstein 3D for various platforms";
+    description = "Advanced source port for Wolfenstein 3D, Spear of Destiny, and Super 3D Noah's Ark";
     mainProgram = "ecwolf";
     homepage = "https://maniacsvault.net/ecwolf/";
     license = lib.licenses.gpl2Plus;
     maintainers = with lib.maintainers; [
       jayman2000
+      keenanweaver
     ];
     platforms = lib.platforms.all;
   };
diff --git a/pkgs/by-name/ex/explain/package.nix b/pkgs/by-name/ex/explain/package.nix
index 7a9971887f98..c74ab14649a1 100644
--- a/pkgs/by-name/ex/explain/package.nix
+++ b/pkgs/by-name/ex/explain/package.nix
@@ -4,6 +4,7 @@
   fetchurl,
   fetchpatch,
   libtool,
+  autoreconfHook,
   bison,
   groff,
   ghostscript,
@@ -24,7 +25,7 @@ stdenv.mkDerivation rec {
   patches =
     let
       debian-src = "https://sources.debian.org/data/main";
-      debian-ver = "${version}.D001-12";
+      debian-ver = "${version}.D001-17";
       debian-patch =
         fname: hash:
         fetchpatch {
@@ -35,14 +36,23 @@ stdenv.mkDerivation rec {
     in
     [
       (debian-patch "sanitize-bison.patch" "sha256-gU6JG32j2yIOwehZTUSvIr4TSDdlg+p1U3bhfZHMEDY=")
+      (debian-patch "01_termio.patch" "sha256-vLyhn1gqm6v+5e8jOiNyCUgEEY7dNSWKuxkUSoCZLxE=")
       (debian-patch "03_fsflags-4.5.patch" "sha256-ML7Qvf85vEBp+iwm6PSosMAn/frYdEOSHRToEggmR8M=")
+      (debian-patch "06_sysctl.patch" "sha256-GY2alw3um+j2fxA7gp6029Baej25PFQFgGgNbplP/P0=")
       (debian-patch "linux5.11.patch" "sha256-N7WwnTfwOxBfIiKntcFOqHTH9r2gd7NMEzic7szzR+Y=")
       (debian-patch "termiox-no-more-exists-since-kernel-5.12.patch" "sha256-cocgEYKoDMDnGk9VNQDtgoVxMGnnNpdae0hzgUlacOw=")
+      (debian-patch "missing-prototypes.patch" "sha256-RbVLVqAfjRN4FDt116WlIw2rKpYuOUxDmA+I7SziAJk=")
       (debian-patch "gcc-10.patch" "sha256-YNcYGyOOqPUuwpUpXGcR7zsWbepVg8SAqcVKlxENSQk=")
+      (debian-patch "gcc-14.patch" "sha256-hoDEG6Yk9j8WOHkNYAipPOgPTux308YCBEbjcykmEtA=")
     ];
 
+  postPatch = ''
+    ln -s etc/configure.ac configure.ac
+  '';
+
   nativeBuildInputs = [
     libtool
+    autoreconfHook
     bison
     groff
     ghostscript
@@ -69,7 +79,5 @@ stdenv.mkDerivation rec {
     license = lib.licenses.lgpl3Plus;
     maintainers = with lib.maintainers; [ McSinyx ];
     platforms = lib.platforms.unix;
-    # never built on aarch64-linux since first introduction in nixpkgs
-    broken = stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64;
   };
 }
diff --git a/pkgs/by-name/fb/fbpanel/package.nix b/pkgs/by-name/fb/fbpanel/package.nix
deleted file mode 100644
index 85ab03cc543f..000000000000
--- a/pkgs/by-name/fb/fbpanel/package.nix
+++ /dev/null
@@ -1,67 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  pkg-config,
-  libx11,
-  libxmu,
-  libxpm,
-  gtk2,
-  libpng,
-  libjpeg,
-  libtiff,
-  librsvg,
-  gdk-pixbuf,
-  gdk-pixbuf-xlib,
-  pypy2,
-}:
-
-stdenv.mkDerivation {
-  pname = "fbpanel";
-  version = "7.0";
-  src = fetchFromGitHub {
-    owner = "aanatoly";
-    repo = "fbpanel";
-    rev = "478754b687e2b48b111507ea22e8e2a001be5199";
-    hash = "sha256-+KcVcrh1aV6kjLGyiDnRHXSzJfelXWrhJS0DitG4yPA=";
-  };
-  nativeBuildInputs = [
-    pkg-config
-    pypy2
-  ];
-  buildInputs = [
-    libx11
-    libxmu
-    libxpm
-    gtk2
-    libpng
-    libjpeg
-    libtiff
-    librsvg
-    gdk-pixbuf
-    gdk-pixbuf-xlib.dev
-  ];
-
-  preConfigure = ''
-    sed -re '1i#!${pypy2}/bin/pypy' -i configure .config/*.py
-    sed -re 's/\<out\>/outputredirect/g' -i .config/rules.mk
-    sed -i 's/struct\ \_plugin_instance \*stam\;//' panel/plugin.h
-  '';
-
-  makeFlags = [ "V=1" ];
-
-  env.NIX_CFLAGS_COMPILE = toString [
-    "-Wno-error"
-    "-Wno-error=incompatible-pointer-types" # not implied by -Wno-error
-    "-I${gdk-pixbuf-xlib.dev}/include/gdk-pixbuf-2.0"
-  ];
-
-  meta = {
-    description = "Stand-alone panel";
-    maintainers = with lib.maintainers; [ raskin ];
-    platforms = lib.platforms.linux;
-    license = lib.licenses.mit;
-    mainProgram = "fbpanel";
-  };
-
-}
diff --git a/pkgs/by-name/fl/flood/package.nix b/pkgs/by-name/fl/flood/package.nix
index df630fb8d66a..5ece7f302559 100644
--- a/pkgs/by-name/fl/flood/package.nix
+++ b/pkgs/by-name/fl/flood/package.nix
@@ -10,13 +10,13 @@
 }:
 buildNpmPackage (finalAttrs: {
   pname = "flood";
-  version = "4.13.10";
+  version = "4.14.2";
 
   src = fetchFromGitHub {
     owner = "jesec";
     repo = "flood";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-b2Va/t1yiIo1cmxSXfFd74z7pc3NjRCktioqEKxzUJI=";
+    hash = "sha256-gSjkpAGkvgRRh8WDpL/F7fS8KDxHRJUuWVqHGcFEGAc=";
   };
 
   nativeBuildInputs = [ pnpm_9 ];
@@ -31,7 +31,7 @@ buildNpmPackage (finalAttrs: {
       ;
     pnpm = pnpm_9;
     fetcherVersion = 3;
-    hash = "sha256-NQ6SJ0etny+HE4ND/2s28Sbfi7vr+YnjCBfVB0OKWqM=";
+    hash = "sha256-Los6faQJ4it0fVqtRvPvYmyANK4qBcwHxmZBacR7Q6E=";
   };
 
   passthru = {
diff --git a/pkgs/by-name/fr/frankenphp/package.nix b/pkgs/by-name/fr/frankenphp/package.nix
index 154ff1b5ebb7..edce4f9563d5 100644
--- a/pkgs/by-name/fr/frankenphp/package.nix
+++ b/pkgs/by-name/fr/frankenphp/package.nix
@@ -30,13 +30,13 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "frankenphp";
-  version = "1.12.2";
+  version = "1.12.3";
 
   src = fetchFromGitHub {
     owner = "php";
     repo = "frankenphp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wXBqUxGUvgfX2XmygBMZ6UEDxy8pyjcl+yob9egU8qw=";
+    hash = "sha256-TYpbHwlFZ9S4uqdhZoU0YqhOrLHrKaMVlJLEi+heEgE=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/caddy";
@@ -44,7 +44,7 @@ buildGoModule (finalAttrs: {
   # frankenphp requires C code that would be removed with `go mod tidy`
   # https://github.com/golang/go/issues/26366
   proxyVendor = true;
-  vendorHash = "sha256-nfDKg1erdErCVankdoqr1u5c2+lkgXU2tEgF3PDyTmU=";
+  vendorHash = "sha256-xmaMQIhImi9E7H/zA8DqrGG4oK5KIQWUTn+c1eas0Ho=";
 
   buildInputs = [
     phpUnwrapped
diff --git a/pkgs/by-name/fr/fresh-editor/package.nix b/pkgs/by-name/fr/fresh-editor/package.nix
index 4babd94ed95a..7becc714d075 100644
--- a/pkgs/by-name/fr/fresh-editor/package.nix
+++ b/pkgs/by-name/fr/fresh-editor/package.nix
@@ -12,16 +12,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "fresh";
-  version = "0.3.5";
+  version = "0.3.6";
 
   src = fetchFromGitHub {
     owner = "sinelaw";
     repo = "fresh";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-L2UnVhNiZtawIYP8ni/TiAATt5gOAYUC0RgTe3zi5uk=";
+    hash = "sha256-seqYT2yRhRwQwsGjS6IMOwNtJAqhe2dL+uzr8qP7src=";
   };
 
-  cargoHash = "sha256-4SmvNOJIXV1u+BwOZgxEREtGdOpjACAf7AzYAzPWDVQ=";
+  cargoHash = "sha256-hJtLn4pW581Nazj+f4csHt/PQaxgOTfewmSZbyZKnNw=";
 
   nativeBuildInputs = [
     gzip
diff --git a/pkgs/by-name/ga/game-devices-udev-rules/package.nix b/pkgs/by-name/ga/game-devices-udev-rules/package.nix
index dc8dd8e0ac96..12d0a898d999 100644
--- a/pkgs/by-name/ga/game-devices-udev-rules/package.nix
+++ b/pkgs/by-name/ga/game-devices-udev-rules/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "game-devices-udev-rules";
-  version = "0.25";
+  version = "1.0";
 
   src = fetchFromCodeberg {
     owner = "fabiscafe";
     repo = "game-devices-udev";
     tag = finalAttrs.version;
-    hash = "sha256-CLQFdPr489OKZRj1v8EZypM1KOXgAOAOF0VQpeud4uo=";
+    hash = "sha256-J4LfRifTqBM+B/dryLHERaVa1UUWEbfjEUj+exCFVsU=";
   };
 
   nativeBuildInputs = [
@@ -24,8 +24,8 @@ stdenv.mkDerivation (finalAttrs: {
   doInstallCheck = true;
 
   postInstall = ''
-    install -Dm444 -t "$out/lib/udev/rules.d" *.rules
-    substituteInPlace $out/lib/udev/rules.d/71-powera-controllers.rules \
+    install -Dm444 -t "$out/lib/udev/rules.d" src/*.rules
+    substituteInPlace $out/lib/udev/rules.d/powera-gdu.rules \
       --replace-fail "/bin/sh" "${bash}/bin/bash"
   '';
 
diff --git a/pkgs/by-name/gi/git-town/package.nix b/pkgs/by-name/gi/git-town/package.nix
index c9dda550ec85..78fdab8d4277 100644
--- a/pkgs/by-name/gi/git-town/package.nix
+++ b/pkgs/by-name/gi/git-town/package.nix
@@ -56,13 +56,14 @@ buildGoModule (finalAttrs: {
     let
       # Disable tests requiring local operations
       skippedTests = [
-        "TestGodog"
         "TestMockingRunner/MockCommand"
         "TestMockingRunner/MockCommitMessage"
         "TestMockingRunner/QueryWith"
         "TestTestCommands/CreateChildFeatureBranch"
         "TestTestCommands/CreateChildBranch"
         "TestTestCommands/CreateLocalBranchUsingGitTown"
+        "TestFrontendRunner_RetryOnIndexLock" # Timing issues.
+
       ];
     in
     [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
diff --git a/pkgs/by-name/he/heroic-unwrapped/package.nix b/pkgs/by-name/he/heroic-unwrapped/package.nix
index d4a164f14a03..fe5df97a6ba3 100644
--- a/pkgs/by-name/he/heroic-unwrapped/package.nix
+++ b/pkgs/by-name/he/heroic-unwrapped/package.nix
@@ -29,13 +29,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "heroic-unwrapped";
-  version = "2.21.0";
+  version = "2.22.0";
 
   src = fetchFromGitHub {
     owner = "Heroic-Games-Launcher";
     repo = "HeroicGamesLauncher";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rgLmm9krjPYjSn/wGAYbnFw7kqvuu9IBipb4ibOClOw=";
+    hash = "sha256-RDJDeL5exEzF2BhEWoiXWsTpV5hytrB6RDoXV0mTWTw=";
   };
 
   pnpmDeps = fetchPnpmDeps {
@@ -47,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
       ;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-O3QQsk8pvF9U5QvuMebCsy/iYz1oZIMkPeMtWohqW3w=";
+    hash = "sha256-lPHL6pA39hvEtq5WkcAXfcY3a0VPseQL/nI+oEjIZeE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/hu/husky/package.nix b/pkgs/by-name/hu/husky/package.nix
index e97d02d42084..24fe9383b68a 100644
--- a/pkgs/by-name/hu/husky/package.nix
+++ b/pkgs/by-name/hu/husky/package.nix
@@ -2,27 +2,48 @@
   lib,
   buildNpmPackage,
   fetchFromGitHub,
+
+  nix-update-script,
 }:
 
-buildNpmPackage rec {
+buildNpmPackage (finalAttrs: {
   pname = "husky";
-  version = "8.0.3";
+  version = "9.1.7";
 
   src = fetchFromGitHub {
     owner = "typicode";
     repo = "husky";
-    rev = "v${version}";
-    hash = "sha256-KoF2+vikgFyCGjfKeaqkC720UVMuvCIn9ApDPKbudsA=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-rjj6kG0f9dbwc3MOS3sXBp1tNOfbOgWAQzm7MbImMk8=";
   };
 
-  npmDepsHash = "sha256-u1dndTKvInobva+71yI2vPiwrW9vqzAJ2sDAqT9YJsg=";
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    install -Dm755 bin.js husky -t $out/lib/node_modules/husky
+    install -Dm644 index.js -t $out/lib/node_modules/husky
+    ln -s ../lib/node_modules/husky/bin.js $out/bin/husky
+
+    runHook postInstall
+  '';
+
+  # The project is dependency free
+  dontNpmBuild = true;
+  forceEmptyCache = true;
+  npmDepsHash = "sha256-68/85gX0/9wZNOTpiy3AHqTW6FU9RoaeCKf8IQPOqys=";
+
+  passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "Git hooks made easy";
     mainProgram = "husky";
     homepage = "https://github.com/typicode/husky";
-    changelog = "https://github.com/typicode/husky/releases/tag/v${version}";
+    changelog = "https://github.com/typicode/husky/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [
+      iamanaws
+      mrdev023
+    ];
   };
-}
+})
diff --git a/pkgs/by-name/im/imapgoose/package.nix b/pkgs/by-name/im/imapgoose/package.nix
index 03546cd0e154..75eb104646aa 100644
--- a/pkgs/by-name/im/imapgoose/package.nix
+++ b/pkgs/by-name/im/imapgoose/package.nix
@@ -27,6 +27,8 @@ buildGoModule rec {
   postInstall = ''
     installManPage imapgoose.1
     installManPage imapgoose.conf.5
+
+    installShellCompletion --zsh contrib/_imapgoose
   '';
 
   meta = {
diff --git a/pkgs/by-name/in/inputplumber/package.nix b/pkgs/by-name/in/inputplumber/package.nix
index 7ea762f2c363..1025921944de 100644
--- a/pkgs/by-name/in/inputplumber/package.nix
+++ b/pkgs/by-name/in/inputplumber/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "inputplumber";
-  version = "0.77.0";
+  version = "0.77.1";
 
   src = fetchFromGitHub {
     owner = "ShadowBlip";
     repo = "InputPlumber";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-sSLazAjwkTu4Vns8Vs4Gx47WG8fYQYJX6zhk0p139q0=";
+    hash = "sha256-S3fyhgCNJFx9w64E/BfNh8i4nIBEFwoVLTcTFb8Escw=";
   };
 
-  cargoHash = "sha256-OEpv09DipaGtmlUWmvl4+Hm3DyBvSRkZaGePDy14/OU=";
+  cargoHash = "sha256-mnWjVM5nWkYMeRRKLsak0SZUUsVg9odjy7KFa/sldC8=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/in/intelli-shell/package.nix b/pkgs/by-name/in/intelli-shell/package.nix
index 6092863d52a3..380f7935c564 100644
--- a/pkgs/by-name/in/intelli-shell/package.nix
+++ b/pkgs/by-name/in/intelli-shell/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "intelli-shell";
-  version = "3.4.0";
+  version = "3.4.1";
 
   src = fetchFromGitHub {
     owner = "lasantosr";
     repo = "intelli-shell";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-TrT2gMc23m4xZ/fxxHqEkGpq3VBeLfkPXC9H1sSSOaQ=";
+    hash = "sha256-s5gbpobCxTtrlEwe1AAidoM8p/1yU/mnZ7JKUu4A0Qk=";
   };
 
-  cargoHash = "sha256-usALz3Wj3GyYjHjmEwFvjyDizXKQ66fkZ8Tb7GgT9BA=";
+  cargoHash = "sha256-D17BqWiUECM9DeOu/I3xN+aopmw8lZBbUyAIygse0kA=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/io/ioq3-scion/package.nix b/pkgs/by-name/io/ioq3-scion/package.nix
index b4960e84e9fc..c054f1cc3b50 100644
--- a/pkgs/by-name/io/ioq3-scion/package.nix
+++ b/pkgs/by-name/io/ioq3-scion/package.nix
@@ -18,8 +18,11 @@ ioquake3.overrideAttrs (old: {
     rev = "a21c257b9ad1d897f6c31883511c3f422317aa0a";
     hash = "sha256-CBy3Av/mkFojXr0tAXPRWKwLeQJPebazXQ4wzKEmx0I=";
   };
+  # gcc15
+  env.NIX_CFLAGS_COMPILE = "-std=gnu17";
   meta = {
     description = "ioquake3 with support for path aware networking";
     maintainers = with lib.maintainers; [ matthewcroughan ];
+    platforms = lib.platforms.linux;
   };
 })
diff --git a/pkgs/by-name/iv/ivpn-service/package.nix b/pkgs/by-name/iv/ivpn-service/package.nix
index 37c67ce44ace..e62ed995af50 100644
--- a/pkgs/by-name/iv/ivpn-service/package.nix
+++ b/pkgs/by-name/iv/ivpn-service/package.nix
@@ -17,7 +17,7 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "ivpn-service";
-  version = "3.15.0";
+  version = "3.15.6";
 
   buildInputs = [ wirelesstools ];
   nativeBuildInputs = [ makeWrapper ];
@@ -26,14 +26,15 @@ buildGoModule (finalAttrs: {
     owner = "ivpn";
     repo = "desktop-app";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Y+oW/2WDkH/YydR+xSzEHPdCNKTmmsV4yEsju+OmDYE=";
+    hash = "sha256-C24klcr10i0lki74eNfJ4bappdIttp3S4FGg1wkAGcY=";
   };
 
   strictDeps = true;
   __structuredAttrs = true;
 
   modRoot = "daemon";
-  vendorHash = "sha256-DVKSCcEeE7vI8aOYuEwk22n0wtF7MMDOyAgYoXYadwI=";
+  subPackages = [ "." ];
+  vendorHash = "sha256-YDvZVmResoieSBIp/yuZDvI9GSz3M6Bi5KksHOljuR0=";
 
   proxyVendor = true; # .c file
 
diff --git a/pkgs/by-name/iv/ivpn-ui/package.nix b/pkgs/by-name/iv/ivpn-ui/package.nix
index f887a76c4e02..cc069c4a06ac 100644
--- a/pkgs/by-name/iv/ivpn-ui/package.nix
+++ b/pkgs/by-name/iv/ivpn-ui/package.nix
@@ -11,18 +11,18 @@
 }:
 buildNpmPackage (finalAttrs: {
   pname = "ivpn-ui";
-  version = "3.15.0";
+  version = "3.15.6";
 
   src = fetchFromGitHub {
     owner = "ivpn";
     repo = "desktop-app";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Y+oW/2WDkH/YydR+xSzEHPdCNKTmmsV4yEsju+OmDYE=";
+    hash = "sha256-C24klcr10i0lki74eNfJ4bappdIttp3S4FGg1wkAGcY=";
   };
 
   sourceRoot = "source/ui";
 
-  npmDepsHash = "sha256-OOBBUDJwTP2T/KqzJPRV+A9ncRmb14KBoAXqa0T6c58=";
+  npmDepsHash = "sha256-S/fB3MxEDLVEZ762EkBkyemYW2rgBGtCH5y/6p6nqgE=";
 
   nativeBuildInputs = [
     copyDesktopItems
diff --git a/pkgs/by-name/iv/ivpn/package.nix b/pkgs/by-name/iv/ivpn/package.nix
index 82a4666a777b..1667c623677c 100644
--- a/pkgs/by-name/iv/ivpn/package.nix
+++ b/pkgs/by-name/iv/ivpn/package.nix
@@ -7,7 +7,7 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "ivpn";
-  version = "3.15.0";
+  version = "3.15.6";
 
   buildInputs = [ wirelesstools ];
 
@@ -15,13 +15,13 @@ buildGoModule (finalAttrs: {
     owner = "ivpn";
     repo = "desktop-app";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Y+oW/2WDkH/YydR+xSzEHPdCNKTmmsV4yEsju+OmDYE=";
+    hash = "sha256-C24klcr10i0lki74eNfJ4bappdIttp3S4FGg1wkAGcY=";
   };
 
   __structuredAttrs = true;
 
   modRoot = "cli";
-  vendorHash = "sha256-xZ1tMiv06fE2wtpDagKjHiVTPYWpj32hM6n/v9ZcgrE=";
+  vendorHash = "sha256-Qm3OZq3W8GyfkYP674Jzse7wDPWgXfc0bi8ZpYl4T1I=";
 
   proxyVendor = true; # .c file
 
diff --git a/pkgs/by-name/ja/jamin/fix-crash.patch b/pkgs/by-name/ja/jamin/fix-crash.patch
new file mode 100644
index 000000000000..68bbc0f6722f
--- /dev/null
+++ b/pkgs/by-name/ja/jamin/fix-crash.patch
@@ -0,0 +1,21 @@
+From a6498278654792d46ebef4f918b8a1c7b663a2d9 Mon Sep 17 00:00:00 2001
+From: Herwig Hochleitner <herwig@bendlas.net>
+Date: Mon, 14 Apr 2025 15:11:37 +0200
+Subject: [PATCH] fix use-after-free during init
+
+---
+ src/state.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/state.c b/src/state.c
+index 6ee4099..48e0b30 100644
+--- a/src/state.c
++++ b/src/state.c
+@@ -234,6 +234,7 @@ void s_clear_history()
+     }
+     g_list_free(history);
+     history = NULL;
++    undo_pos = NULL;
+     s_history_add("Initial state");
+     undo_pos = history->next;
+     //s_restore_state((s_state *)history->data);
diff --git a/pkgs/by-name/ja/jamin/package.nix b/pkgs/by-name/ja/jamin/package.nix
index d48169a7c6ac..9b64872a07d6 100644
--- a/pkgs/by-name/ja/jamin/package.nix
+++ b/pkgs/by-name/ja/jamin/package.nix
@@ -1,45 +1,73 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchgit,
+  fetchpatch,
   fftwFloat,
-  gtk2,
+  gtk3,
   ladspaPlugins,
   libjack2,
   liblo,
   libxml2,
+  autoconf,
+  automake,
+  intltool,
+  libtool,
   makeWrapper,
   pkg-config,
   perlPackages,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "0.95.0";
   pname = "jamin";
+  version = "0.98.9-unstable-2015-01-14";
 
-  src = fetchurl {
-    url = "mirror://sourceforge/jamin/jamin-${finalAttrs.version}.tar.gz";
-    hash = "sha256-di/uiGgvJ4iORt+wE6mrXnmFM7m2dkP/HXdgUBk5uzw=";
+  src = fetchgit {
+    url = "https://git.code.sf.net/p/jamin/code";
+    rev = "199091a6e3709e2890eaf2c8b4e57c6749776cdc";
+    hash = "sha256-wiIBymvpPxY+z/nZi+dH0hXEuhO5FYQjon6VfJaTwC0=";
   };
 
-  nativeBuildInputs = [
-    pkg-config
-    makeWrapper
+  patches = [
+    (fetchpatch {
+      url = "https://sources.debian.org/data/main/j/jamin/0.98.9~git20170111~199091~repack1-3/debian/patches/gcc15.patch";
+      hash = "sha256-dH0NI12Xfw9Rl7Iwm4QzDvXIHT7XzBC8Ly0lQOpDD84=";
+    })
+    # https://github.com/bendlas/jamin/commit/a6498278654792d46ebef4f918b8a1c7b663a2d9.patch
+    ./fix-crash.patch
   ];
 
-  buildInputs = [
-    fftwFloat
-    gtk2
-    ladspaPlugins
-    libjack2
-    liblo
-    libxml2
+  postPatch = ''
+    patchShebangs --build controller/xml2c.pl
+    # for whatever reason the default config file is gzipped
+    mv examples/default.jam{,.gz}
+    gunzip examples/default.jam.gz
+  '';
+
+  preConfigure = "./autogen.sh";
+
+  nativeBuildInputs = [
+    autoconf
+    automake
+    intltool
+    libtool
+    pkg-config
+    makeWrapper
   ]
   ++ (with perlPackages; [
     perl
     XMLParser
   ]);
 
+  buildInputs = [
+    fftwFloat
+    gtk3
+    ladspaPlugins
+    libjack2
+    liblo
+    libxml2
+  ];
+
   # Workaround build failure on -fno-common toolchains like upstream
   # gcc-10. Otherwise build fails as:
   #     ld: jamin-preferences.o:/build/jamin-0.95.0/src/hdeq.h:64: multiple definition of
diff --git a/pkgs/by-name/ji/jitterentropy-rngd/package.nix b/pkgs/by-name/ji/jitterentropy-rngd/package.nix
index ca7cb23a0fb7..876dd2422f4c 100644
--- a/pkgs/by-name/ji/jitterentropy-rngd/package.nix
+++ b/pkgs/by-name/ji/jitterentropy-rngd/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -11,10 +12,18 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "smuellerDD";
     repo = "jitterentropy-rngd";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-iXpeN0PAPk8mcaNXwj6TlyK57NSFNOVs/XmEmUG1gIg=";
   };
 
+  patches = [
+    # Allow the systemd service to mlock the daemon's entropy buffer.
+    (fetchpatch {
+      url = "https://github.com/smuellerDD/jitterentropy-rngd/compare/v1.3.1...61ad2e7c83b95402536b90b52eabe20ce60cfbd7.patch";
+      hash = "sha256-Twg59vrqJGF0bH4pkIewbReCjabOFuqq+MtCnwjO9lw=";
+    })
+  ];
+
   enableParallelBuilding = true;
 
   installPhase = ''
@@ -36,7 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Random number generator, which injects entropy to the kernel";
     homepage = "https://github.com/smuellerDD/jitterentropy-rngd";
-    changelog = "https://github.com/smuellerDD/jitterentropy-rngd/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/smuellerDD/jitterentropy-rngd/releases/tag/${finalAttrs.src.tag}";
     license = [
       lib.licenses.gpl2Only
       lib.licenses.bsd3
diff --git a/pkgs/by-name/jw/jwt-hack/package.nix b/pkgs/by-name/jw/jwt-hack/package.nix
index 9ecab2c65bd7..b18de6590e5a 100644
--- a/pkgs/by-name/jw/jwt-hack/package.nix
+++ b/pkgs/by-name/jw/jwt-hack/package.nix
@@ -33,7 +33,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     openssl
   ];
 
-  OPENSSL_NO_VENDOR = 1;
+  env.OPENSSL_NO_VENDOR = 1;
 
   meta = {
     description = "JSON Web Token Hack Toolkit";
diff --git a/pkgs/by-name/ko/kopia/package.nix b/pkgs/by-name/ko/kopia/package.nix
index 24c9e6bec650..933ad27aa7aa 100644
--- a/pkgs/by-name/ko/kopia/package.nix
+++ b/pkgs/by-name/ko/kopia/package.nix
@@ -11,18 +11,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "kopia";
-  version = "0.22.3";
+  version = "0.23.0";
 
   src = fetchFromGitHub {
     owner = "kopia";
     repo = "kopia";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5oNam99Mij78snSO6jiGPYzeD68sXEBKM2dGQtTUrww=";
+    hash = "sha256-9xvgm+A8h2pAX3oHtiFSa2xNab5BDkEBEtXQZz3Fd5A=";
   };
 
   __structuredAttrs = true;
 
-  vendorHash = "sha256-szlCiZOLU0KVWb2YX3Wmicrumn+fNm2AWdPxaJZZT90=";
+  vendorHash = "sha256-VMfFXGBIUtRa4JxhOn7YBfdLNmpmGrkBVKiIDn5vKTc=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/ld/ldmtool/package.nix b/pkgs/by-name/ld/ldmtool/package.nix
index e72931cbbc9b..7c0403980982 100644
--- a/pkgs/by-name/ld/ldmtool/package.nix
+++ b/pkgs/by-name/ld/ldmtool/package.nix
@@ -14,36 +14,24 @@
   lvm2,
   libxslt,
   docbook_xsl,
-  fetchpatch,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ldmtool";
-  version = "0.2.4";
+  version = "0.2.5-unstable-2025-02-06";
 
   src = fetchFromGitHub {
     owner = "mdbooth";
     repo = "libldm";
-    rev = "libldm-${finalAttrs.version}";
-    sha256 = "1fy5wbmk8kwl86lzswq0d1z2j5y023qzfm2ppm8knzv9c47kniqk";
+    rev = "1eafb653ac6347a9d4281848c8295f9daffb1613";
+    hash = "sha256-Vd+3FnM+U5y2FxuslEsEzgZEx+5AQWuTjUVRnoFhm3I=";
   };
 
-  patches = [
-    # Remove usage of deprecrated G_PARAM_PRIVATE
-    (fetchpatch {
-      url = "https://github.com/mdbooth/libldm/commit/ee1b37a034038f09d61b121cc8b3651024acc46f.patch";
-      sha256 = "02y34kbcpcpffvy1n9yqngvdldmxmvdkha1v2xjqvrnclanpigcp";
-    })
-  ];
-
   preConfigure = ''
     sed -i docs/reference/ldmtool/Makefile.am \
       -e 's|-nonet http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl|--nonet ${docbook_xsl}/xml/xsl/docbook/manpages/docbook.xsl|g'
   '';
 
-  # glib-2.62 deprecations
-  env.NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
-
   configureScript = "sh autogen.sh";
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/lib2geom/package.nix b/pkgs/by-name/li/lib2geom/package.nix
index 6bd3333901fe..54232c52b488 100644
--- a/pkgs/by-name/li/lib2geom/package.nix
+++ b/pkgs/by-name/li/lib2geom/package.nix
@@ -46,11 +46,16 @@ stdenv.mkDerivation (finalAttrs: {
     double-conversion
   ];
 
-  nativeCheckInputs = [
+  checkInputs = [
     gtest
+  ];
+
+  nativeCheckInputs = [
     ctestCheckHook
   ];
 
+  strictDeps = true;
+
   cmakeFlags = [
     "-D2GEOM_BUILD_SHARED=ON"
     # For cross compilation.
diff --git a/pkgs/by-name/li/libgestures/include-fix.patch b/pkgs/by-name/li/libgestures/include-fix.patch
deleted file mode 100644
index 851be4771434..000000000000
--- a/pkgs/by-name/li/libgestures/include-fix.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -ur a/include/gestures/include/finger_metrics.h b/include/gestures/include/finger_metrics.h
---- a/include/gestures/include/finger_metrics.h    1970-01-01 09:00:01.000000000 +0900
-+++ b/include/gestures/include/finger_metrics.h    2018-12-01 16:58:51.590718511 +0900
-@@ -5,6 +5,8 @@
- #ifndef GESTURES_FINGER_METRICS_H_
- #define GESTURES_FINGER_METRICS_H_
- 
-+#include <math.h>
-+
- #include "gestures/include/gestures.h"
- #include "gestures/include/prop_registry.h"
-#include "gestures/include/vector.h"
diff --git a/pkgs/by-name/li/libgestures/package.nix b/pkgs/by-name/li/libgestures/package.nix
deleted file mode 100644
index 8d76910e4b7b..000000000000
--- a/pkgs/by-name/li/libgestures/package.nix
+++ /dev/null
@@ -1,45 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  pkg-config,
-  glib,
-  jsoncpp,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "libgestures";
-  version = "2.0.1";
-  src = fetchFromGitHub {
-    owner = "hugegreenbug";
-    repo = "libgestures";
-    rev = "v${finalAttrs.version}";
-    sha256 = "0dfvads2adzx4k8cqc1rbwrk1jm2wn9wl2jk51m26xxpmh1g0zab";
-  };
-  patches = [ ./include-fix.patch ];
-
-  postPatch = ''
-    substituteInPlace Makefile \
-      --replace -Werror -Wno-error \
-      --replace '$(DESTDIR)/usr/include' '$(DESTDIR)/include'
-  '';
-
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [
-    glib
-    jsoncpp
-  ];
-
-  makeFlags = [
-    "DESTDIR=$(out)"
-    "LIBDIR=/lib"
-  ];
-
-  meta = {
-    description = "ChromiumOS libgestures modified to compile for Linux";
-    license = lib.licenses.bsd3;
-    platforms = lib.platforms.linux;
-    homepage = "https://chromium.googlesource.com/chromiumos/platform/gestures";
-    maintainers = with lib.maintainers; [ kcalvinalvin ];
-  };
-})
diff --git a/pkgs/by-name/li/link-grammar/package.nix b/pkgs/by-name/li/link-grammar/package.nix
index f380ccddf09a..ab5d87c6f85d 100644
--- a/pkgs/by-name/li/link-grammar/package.nix
+++ b/pkgs/by-name/li/link-grammar/package.nix
@@ -5,17 +5,18 @@
   pkg-config,
   python3,
   flex,
-  sqlite,
   libedit,
+  pcre2,
+  sqlite,
   runCommand,
   dieHook,
 }:
 
 let
 
-  link-grammar = stdenv.mkDerivation rec {
+  link-grammar = stdenv.mkDerivation (finalAttrs: {
     pname = "link-grammar";
-    version = "5.10.5";
+    version = "5.13.0";
 
     outputs = [
       "bin"
@@ -25,8 +26,8 @@ let
     ];
 
     src = fetchurl {
-      url = "http://www.abisource.com/downloads/link-grammar/${version}/link-grammar-${version}.tar.gz";
-      sha256 = "sha256-MkcQzYEyl1/5zLU1CXMvdVhHOxwZ8XiSAAo97bhhiu0=";
+      url = "https://www.gnucash.org/link-grammar/downloads/${finalAttrs.version}/link-grammar-${finalAttrs.version}.tar.gz";
+      hash = "sha256-5qDJBd+xdfNZefA1CgzzxnyzimgZ2fK3PGhN/nKpQd8=";
     };
 
     nativeBuildInputs = [
@@ -36,15 +37,28 @@ let
     ];
 
     buildInputs = [
-      sqlite
       libedit
+      sqlite
+    ]
+    ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
+      pcre2
     ];
 
     configureFlags = [
       "--disable-java-bindings"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      # multi-dict and multi-threads crash when built with pcre2
+      # https://github.com/opencog/link-grammar/issues/1514
+      "--disable-pcre2"
     ];
 
-    doCheck = true;
+    preCheck = lib.optionalString stdenv.hostPlatform.isDarwin ''
+      export DYLD_LIBRARY_PATH=$(pwd)/link-grammar/.libs
+    '';
+
+    # multi-dict test randomly fails on x86_64-darwin
+    doCheck = stdenv.hostPlatform.system != "x86_64-darwin";
 
     passthru.tests = {
       quick =
@@ -64,13 +78,13 @@ let
 
     meta = {
       description = "Grammar Checking library";
-      homepage = "https://www.abisource.com/projects/link-grammar/";
-      changelog = "https://github.com/opencog/link-grammar/blob/link-grammar-${version}/ChangeLog";
+      homepage = "https://opencog.github.io/link-grammar-website/";
+      changelog = "https://github.com/opencog/link-grammar/blob/link-grammar-${finalAttrs.version}/ChangeLog";
       license = lib.licenses.lgpl21Only;
       maintainers = with lib.maintainers; [ jtojnar ];
       platforms = lib.platforms.unix;
     };
-  };
+  });
 
 in
 link-grammar
diff --git a/pkgs/by-name/lr/lrs/package.nix b/pkgs/by-name/lr/lrs/package.nix
index dc3efda1023d..e83b5df60712 100644
--- a/pkgs/by-name/lr/lrs/package.nix
+++ b/pkgs/by-name/lr/lrs/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   fetchurl,
   gmp,
+  llvmPackages,
 }:
 
 stdenv.mkDerivation {
@@ -19,7 +20,18 @@ stdenv.mkDerivation {
     ./fix-signal-handler-type.patch
   ];
 
-  buildInputs = [ gmp ];
+  # https://github.com/macports/macports-ports/blob/master/math/lrslib/Portfile
+  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    substituteInPlace Makefile \
+      --replace-fail "-shared -Wl,-soname=" "-dynamiclib -install_name $out/lib/"
+  '';
+
+  buildInputs = [
+    gmp
+  ]
+  ++ lib.optionals stdenv.cc.isClang [
+    llvmPackages.openmp
+  ];
 
   makeFlags = [
     "prefix=${placeholder "out"}"
@@ -30,7 +42,7 @@ stdenv.mkDerivation {
     description = "Implementation of the reverse search algorithm for vertex enumeration/convex hull problems";
     license = lib.licenses.gpl2;
     maintainers = [ lib.maintainers.raskin ];
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.unix;
     homepage = "http://cgm.cs.mcgill.ca/~avis/C/lrs.html";
   };
 }
diff --git a/pkgs/by-name/ma/matrix-zulip-bridge/package.nix b/pkgs/by-name/ma/matrix-zulip-bridge/package.nix
index 79342c4081e9..84fbfdffa862 100644
--- a/pkgs/by-name/ma/matrix-zulip-bridge/package.nix
+++ b/pkgs/by-name/ma/matrix-zulip-bridge/package.nix
@@ -36,6 +36,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
   pythonRelaxDeps = [
     "bidict"
     "markdownify"
+    "mautrix"
     "ruamel-yaml"
     "zulip-emoji-mapping"
   ];
diff --git a/pkgs/by-name/ma/mattermost/package.nix b/pkgs/by-name/ma/mattermost/package.nix
index 51e25ec144dc..f7cbb3295385 100644
--- a/pkgs/by-name/ma/mattermost/package.nix
+++ b/pkgs/by-name/ma/mattermost/package.nix
@@ -12,6 +12,7 @@
   jq,
   nixosTests,
 
+  latestVersionInfo ? null,
   versionInfo ? {
     # ESR releases only. Note: if NixOS would release with an ESR that goes out
     # of support during the lifetime of the NixOS release, it is acceptable
@@ -23,11 +24,11 @@
     # the version regex here as well.
     #
     # Ensure you also check ../mattermostLatest/package.nix.
-    regex = "^v(11\\.[67]\\.[0-9]+)$";
-    version = "11.6.1";
-    srcHash = "sha256-0TUh5qKi64jt3YhgCTceoizOGzqyt70Rh8VH+bSfS5o=";
-    vendorHash = "sha256-bWl1rdVRTOJzS2HKKsSRhzVcH1sPgEAlRLjrc+/o0lo=";
-    npmDepsHash = "sha256-30xwoizNh6fAWS0YdEheXtcO6I9MjoFdCekvLnnoBMc=";
+    regex = "^v(11\\.7\\.[0-9]+)$";
+    version = "11.7.0";
+    srcHash = "sha256-oH9bLN2BPvRSWl5m3VNHBNMBXfdmkwaE9tzL7pcD1mg=";
+    vendorHash = "sha256-PmwwiXNaDarc1H7z1G4zstgs7tvmZ/d7V5eGqMh1VX4=";
+    npmDepsHash = "sha256-C3vfWW2hMOMnrPn1538kT+ma09T9VswrmADV/KPkrPc=";
   },
   ...
 }:
@@ -87,16 +88,27 @@ let
         };
     in
     finalPassthru.withoutTests;
+
+  versionInfo' =
+    if
+      latestVersionInfo != null && lib.versionAtLeast latestVersionInfo.version versionInfo.version
+    then
+      # Prefer the latest if we're building mattermostLatest
+      latestVersionInfo
+    else
+      # Prefer the one we have
+      assert versionInfo != null;
+      versionInfo;
 in
 buildMattermost rec {
   pname = "mattermost";
-  inherit (versionInfo) version;
+  inherit (versionInfo') version;
 
   src = fetchFromGitHub {
     owner = "mattermost";
     repo = "mattermost";
     tag = "v${version}";
-    hash = versionInfo.srcHash;
+    hash = versionInfo'.srcHash;
     postFetch = ''
       cd $out/webapp
 
@@ -107,13 +119,13 @@ buildMattermost rec {
       ' < package-lock.json > package-lock.fixed.json
 
       # Run the lockfile overlay, if present.
-      ${lib.optionalString (versionInfo.lockfileOverlay or null != null) ''
+      ${lib.optionalString (versionInfo'.lockfileOverlay or null != null) ''
         ${lib.getExe jq} ${lib.escapeShellArg ''
           # Unlock a dependency and let npm-lockfile-fix relock it.
           def unlock(root; dependency; path):
             root | .packages[path] |= del(.resolved, .integrity)
                  | .packages[path].version = root.packages.channels.dependencies[dependency];
-          ${versionInfo.lockfileOverlay}
+          ${versionInfo'.lockfileOverlay}
         ''} < package-lock.fixed.json > package-lock.overlaid.json
         mv package-lock.overlaid.json package-lock.fixed.json
       ''}
@@ -130,20 +142,24 @@ buildMattermost rec {
   # https://github.com/mattermost/mattermost/issues/26221#issuecomment-1945351597
   overrideModAttrs = _: {
     buildPhase = ''
+      runHook preBuild
+
       make setup-go-work
       go work vendor -e -v
+
+      runHook postBuild
     '';
   };
 
   npmDeps = fetchNpmDeps {
     inherit src;
     sourceRoot = "${src.name}/webapp";
-    hash = versionInfo.npmDepsHash;
+    hash = versionInfo'.npmDepsHash;
     makeCacheWritable = true;
     forceGitDeps = true;
   };
 
-  inherit (versionInfo) vendorHash;
+  inherit (versionInfo') vendorHash;
 
   modRoot = "./server";
   preBuild = ''
@@ -188,9 +204,14 @@ buildMattermost rec {
 
   doInstallCheck = true;
   installCheckPhase = ''
+    runHook preInstallCheck
+
     for subPackage in $subPackages; do
+      echo "Checking version for: $subPackage" >&2
       "$out/bin/$(basename -- "$subPackage")" version | grep "$version"
     done
+
+    runHook postInstallCheck
   '';
 
   passthru = {
@@ -198,11 +219,11 @@ buildMattermost rec {
       extraArgs = [
         "--use-github-releases"
         "--version-regex"
-        versionInfo.regex
+        versionInfo'.regex
       ]
-      ++ lib.optionals (versionInfo.autoUpdate or null != null) [
+      ++ lib.optionals (versionInfo'.autoUpdate or null != null) [
         "--override-filename"
-        versionInfo.autoUpdate
+        versionInfo'.autoUpdate
       ];
     };
     tests.mattermost = nixosTests.mattermost;
@@ -235,7 +256,9 @@ buildMattermost rec {
         runHook preBuild
 
         for ws in platform/{types,client,components,shared} channels; do
-          npm run build --workspace="$ws"
+          if [ -d "$ws" ]; then
+            npm run build --workspace="$ws"
+          fi
         done
 
         runHook postBuild
diff --git a/pkgs/by-name/ma/mattermostLatest/package.nix b/pkgs/by-name/ma/mattermostLatest/package.nix
index c601200a51c2..45685a9cfc8a 100644
--- a/pkgs/by-name/ma/mattermostLatest/package.nix
+++ b/pkgs/by-name/ma/mattermostLatest/package.nix
@@ -3,4 +3,24 @@
   ...
 }@args:
 
-mattermost.override args
+mattermost.override (
+  {
+    latestVersionInfo = {
+      # Latest, non-RC releases only.
+      # If the latest is an ESR (Extended Support Release),
+      # duplicate it here to facilitate the update script.
+      # Note that the Mattermost package will prefer whichever is later of this one
+      # or itself, in case the update script is lagging on one set of hashes.
+      # See https://docs.mattermost.com/about/mattermost-server-releases.html
+      # and make sure the version regex is up to date here.
+      # Ensure you also check ../mattermost/package.nix for ESR releases.
+      regex = "^v(11\\.[0-9]+\\.[0-9]+)$";
+      version = "11.7.0";
+      srcHash = "sha256-oH9bLN2BPvRSWl5m3VNHBNMBXfdmkwaE9tzL7pcD1mg=";
+      vendorHash = "sha256-PmwwiXNaDarc1H7z1G4zstgs7tvmZ/d7V5eGqMh1VX4=";
+      npmDepsHash = "sha256-C3vfWW2hMOMnrPn1538kT+ma09T9VswrmADV/KPkrPc=";
+      autoUpdate = ./package.nix;
+    };
+  }
+  // args
+)
diff --git a/pkgs/by-name/mi/microfetch/package.nix b/pkgs/by-name/mi/microfetch/package.nix
index 3fdfefc7f965..6ecf01979deb 100644
--- a/pkgs/by-name/mi/microfetch/package.nix
+++ b/pkgs/by-name/mi/microfetch/package.nix
@@ -9,21 +9,25 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "microfetch";
-  version = "0.4.13";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "NotAShelf";
     repo = "microfetch";
     tag = "${finalAttrs.version}";
-    hash = "sha256-aJ2QuMbUM/beMD8b62AqzTNljQ8RtBNOSvj9nJfRXbA=";
+    hash = "sha256-akJ44+X1POnV1dZnWq66X5vWokp9TGgJ5/Ey6kh/icA=";
   };
 
-  cargoHash = "sha256-vGvpjRJr4ez322JWUwboVml22vnRVRlwpZ9W4F5wATA=";
+  cargoHash = "sha256-mVS1fv/FI3rDoNm2D7ToiqZJZuySggK2zW2KbbxtpuQ=";
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ mold ];
 
   passthru.updateScript = nix-update-script { };
 
+  # For whatever reason the cargo test build in the checkphase attempts to use dynamic libraries.
+  # Could be wrong, but rectifying this is probably more of an investment than it's worth.
+  doCheck = false;
+
   meta = {
     description = "Microscopic fetch script in Rust, for NixOS systems";
     homepage = "https://github.com/NotAShelf/microfetch";
diff --git a/pkgs/by-name/mo/monkeys-audio/package.nix b/pkgs/by-name/mo/monkeys-audio/package.nix
index 7e31a861350c..1a1f94bd0f00 100644
--- a/pkgs/by-name/mo/monkeys-audio/package.nix
+++ b/pkgs/by-name/mo/monkeys-audio/package.nix
@@ -6,12 +6,12 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "12.84";
+  version = "12.93";
   pname = "monkeys-audio";
 
   src = fetchzip {
     url = "https://monkeysaudio.com/files/MAC_${builtins.concatStringsSep "" (lib.strings.splitString "." finalAttrs.version)}_SDK.zip";
-    hash = "sha256-WYBc59DJM5DVe7hZVXCsMJsShUQf8Ib0OLKISRjg4pY=";
+    hash = "sha256-T5Bt4g3xmxYb1YQyZ1/VnlJgk6JCPe8SiBT016dGPCA=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/mp/mpd/package.nix b/pkgs/by-name/mp/mpd/package.nix
index c9864a00ed9f..2a0e460b1d2d 100644
--- a/pkgs/by-name/mp/mpd/package.nix
+++ b/pkgs/by-name/mp/mpd/package.nix
@@ -197,13 +197,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "mpd";
-  version = "0.24.10";
+  version = "0.24.12";
 
   src = fetchFromGitHub {
     owner = "MusicPlayerDaemon";
     repo = "MPD";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-qwBX5NG1h55HoNtHMyLfjDQhua1xCyONqd386+QB6IU=";
+    sha256 = "sha256-CYwpPKFTW7engtPJoUqIWWn6YhmoSRjiew6n0tAZSmE=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/ne/netlistsvg/package-lock.json b/pkgs/by-name/ne/netlistsvg/package-lock.json
index 16a53394fe8a..5f0906e188b3 100644
--- a/pkgs/by-name/ne/netlistsvg/package-lock.json
+++ b/pkgs/by-name/ne/netlistsvg/package-lock.json
@@ -903,9 +903,9 @@
       }
     },
     "node_modules/ajv": {
-      "version": "6.12.6",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.6.tgz",
-      "integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==",
+      "version": "6.15.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
+      "integrity": "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==",
       "license": "MIT",
       "dependencies": {
         "fast-deep-equal": "^3.1.1",
@@ -1141,9 +1141,9 @@
       }
     },
     "node_modules/asn1.js/node_modules/bn.js": {
-      "version": "4.12.2",
-      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.2.tgz",
-      "integrity": "sha512-n4DSx829VRTRByMRGdjQ9iqsN0Bh4OolPsFnaZBLcbi8iXcB+kJ9s7EnRt4wILZNV3kPLHkRVfOc/HvhC3ovDw==",
+      "version": "4.12.3",
+      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.3.tgz",
+      "integrity": "sha512-fGTi3gxV/23FTYdAoUtLYp6qySe2KE3teyZitipKNRuVYcBkoP/bB3guXN/XVKUe9mxCHXnc9C4ocyz8OmgN0g==",
       "dev": true,
       "license": "MIT"
     },
@@ -1408,16 +1408,16 @@
       }
     },
     "node_modules/bn.js": {
-      "version": "5.2.2",
-      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-5.2.2.tgz",
-      "integrity": "sha512-v2YAxEmKaBLahNwE1mjp4WON6huMNeuDvagFZW+ASCuA/ku0bXR9hSMw0XpiqMoA3+rmnyck/tPRSFQkoC9Cuw==",
+      "version": "5.2.3",
+      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-5.2.3.tgz",
+      "integrity": "sha512-EAcmnPkxpntVL+DS7bO1zhcZNvCkxqtkd0ZY53h06GNQ3DEkkGZ/gKgmDv6DdZQGj9BgfSPKtJJ7Dp1GPP8f7w==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.12",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
-      "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+      "version": "1.1.14",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
+      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1678,25 +1678,24 @@
       "license": "MIT"
     },
     "node_modules/browserify-sign": {
-      "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/browserify-sign/-/browserify-sign-4.2.3.tgz",
-      "integrity": "sha512-JWCZW6SKhfhjJxO8Tyiiy+XYB7cqd2S5/+WeYHsKdNKFlCBhKbblba1A/HN/90YwtxKc8tCErjffZl++UNmGiw==",
+      "version": "4.2.5",
+      "resolved": "https://registry.npmjs.org/browserify-sign/-/browserify-sign-4.2.5.tgz",
+      "integrity": "sha512-C2AUdAJg6rlM2W5QMp2Q4KGQMVBwR1lIimTsUnutJ8bMpW5B52pGpR2gEnNBNwijumDo5FojQ0L9JrXA8m4YEw==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
-        "bn.js": "^5.2.1",
-        "browserify-rsa": "^4.1.0",
+        "bn.js": "^5.2.2",
+        "browserify-rsa": "^4.1.1",
         "create-hash": "^1.2.0",
         "create-hmac": "^1.1.7",
-        "elliptic": "^6.5.5",
-        "hash-base": "~3.0",
+        "elliptic": "^6.6.1",
         "inherits": "^2.0.4",
-        "parse-asn1": "^5.1.7",
+        "parse-asn1": "^5.1.9",
         "readable-stream": "^2.3.8",
         "safe-buffer": "^5.2.1"
       },
       "engines": {
-        "node": ">= 0.12"
+        "node": ">= 0.10"
       }
     },
     "node_modules/browserify-zlib": {
@@ -2302,9 +2301,9 @@
       }
     },
     "node_modules/create-ecdh/node_modules/bn.js": {
-      "version": "4.12.2",
-      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.2.tgz",
-      "integrity": "sha512-n4DSx829VRTRByMRGdjQ9iqsN0Bh4OolPsFnaZBLcbi8iXcB+kJ9s7EnRt4wILZNV3kPLHkRVfOc/HvhC3ovDw==",
+      "version": "4.12.3",
+      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.3.tgz",
+      "integrity": "sha512-fGTi3gxV/23FTYdAoUtLYp6qySe2KE3teyZitipKNRuVYcBkoP/bB3guXN/XVKUe9mxCHXnc9C4ocyz8OmgN0g==",
       "dev": true,
       "license": "MIT"
     },
@@ -2680,9 +2679,9 @@
       }
     },
     "node_modules/diff": {
-      "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/diff/-/diff-4.0.2.tgz",
-      "integrity": "sha512-58lmxKSA4BNyLz+HHMUzlOEpg09FV+ev6ZMe3vJihgdxzgcwZ8VoEEPmALCZG9LmqfVoNMMKpttIYTVG6uDY7A==",
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/diff/-/diff-4.0.4.tgz",
+      "integrity": "sha512-X07nttJQkwkfKfvTPG/KSnE2OMdcUCao6+eXF3wmnIQRn2aPAHH3VxDbDOdegkd6JbPsXqShpvEOHfAT+nCNwQ==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
@@ -2712,9 +2711,9 @@
       }
     },
     "node_modules/diffie-hellman/node_modules/bn.js": {
-      "version": "4.12.2",
-      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.2.tgz",
-      "integrity": "sha512-n4DSx829VRTRByMRGdjQ9iqsN0Bh4OolPsFnaZBLcbi8iXcB+kJ9s7EnRt4wILZNV3kPLHkRVfOc/HvhC3ovDw==",
+      "version": "4.12.3",
+      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.3.tgz",
+      "integrity": "sha512-fGTi3gxV/23FTYdAoUtLYp6qySe2KE3teyZitipKNRuVYcBkoP/bB3guXN/XVKUe9mxCHXnc9C4ocyz8OmgN0g==",
       "dev": true,
       "license": "MIT"
     },
@@ -2826,9 +2825,9 @@
       }
     },
     "node_modules/elliptic/node_modules/bn.js": {
-      "version": "4.12.2",
-      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.2.tgz",
-      "integrity": "sha512-n4DSx829VRTRByMRGdjQ9iqsN0Bh4OolPsFnaZBLcbi8iXcB+kJ9s7EnRt4wILZNV3kPLHkRVfOc/HvhC3ovDw==",
+      "version": "4.12.3",
+      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.3.tgz",
+      "integrity": "sha512-fGTi3gxV/23FTYdAoUtLYp6qySe2KE3teyZitipKNRuVYcBkoP/bB3guXN/XVKUe9mxCHXnc9C4ocyz8OmgN0g==",
       "dev": true,
       "license": "MIT"
     },
@@ -6198,9 +6197,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "3.14.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.1.tgz",
-      "integrity": "sha512-okMH7OXXJ7YrN9Ok3/SXrnu4iX9yOk+25nqX4imS2npuvTYDmo/QEZoqwZkYaIDk3jVvBOTOIEgEhaLOynBS9g==",
+      "version": "3.14.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz",
+      "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6519,9 +6518,9 @@
       }
     },
     "node_modules/lodash": {
-      "version": "4.17.21",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
-      "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==",
+      "version": "4.18.1",
+      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz",
+      "integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==",
       "license": "MIT"
     },
     "node_modules/lodash.memoize": {
@@ -6724,9 +6723,9 @@
       }
     },
     "node_modules/miller-rabin/node_modules/bn.js": {
-      "version": "4.12.2",
-      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.2.tgz",
-      "integrity": "sha512-n4DSx829VRTRByMRGdjQ9iqsN0Bh4OolPsFnaZBLcbi8iXcB+kJ9s7EnRt4wILZNV3kPLHkRVfOc/HvhC3ovDw==",
+      "version": "4.12.3",
+      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.3.tgz",
+      "integrity": "sha512-fGTi3gxV/23FTYdAoUtLYp6qySe2KE3teyZitipKNRuVYcBkoP/bB3guXN/XVKUe9mxCHXnc9C4ocyz8OmgN0g==",
       "dev": true,
       "license": "MIT"
     },
@@ -6791,9 +6790,9 @@
       "license": "MIT"
     },
     "node_modules/minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -7392,17 +7391,16 @@
       }
     },
     "node_modules/parse-asn1": {
-      "version": "5.1.7",
-      "resolved": "https://registry.npmjs.org/parse-asn1/-/parse-asn1-5.1.7.tgz",
-      "integrity": "sha512-CTM5kuWR3sx9IFamcl5ErfPl6ea/N8IYwiJ+vpeB2g+1iknv7zBl5uPwbMbRVznRVbrNY6lGuDoE5b30grmbqg==",
+      "version": "5.1.9",
+      "resolved": "https://registry.npmjs.org/parse-asn1/-/parse-asn1-5.1.9.tgz",
+      "integrity": "sha512-fIYNuZ/HastSb80baGOuPRo1O9cf4baWw5WsAp7dBuUzeTD/BoaG8sVTdlPFksBE2lF21dN+A1AnrpIjSWqHHg==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
         "asn1.js": "^4.10.1",
         "browserify-aes": "^1.2.0",
         "evp_bytestokey": "^1.0.3",
-        "hash-base": "~3.0",
-        "pbkdf2": "^3.1.2",
+        "pbkdf2": "^3.1.5",
         "safe-buffer": "^5.2.1"
       },
       "engines": {
@@ -7534,55 +7532,21 @@
       }
     },
     "node_modules/pbkdf2": {
-      "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/pbkdf2/-/pbkdf2-3.1.3.tgz",
-      "integrity": "sha512-wfRLBZ0feWRhCIkoMB6ete7czJcnNnqRpcoWQBLqatqXXmelSRqfdDK4F3u9T2s2cXas/hQJcryI/4lAL+XTlA==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/pbkdf2/-/pbkdf2-3.1.5.tgz",
+      "integrity": "sha512-Q3CG/cYvCO1ye4QKkuH7EXxs3VC/rI1/trd+qX2+PolbaKG0H+bgcZzrTt96mMyRtejk+JMCiLUn3y29W8qmFQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "create-hash": "~1.1.3",
+        "create-hash": "^1.2.0",
         "create-hmac": "^1.1.7",
-        "ripemd160": "=2.0.1",
+        "ripemd160": "^2.0.3",
         "safe-buffer": "^5.2.1",
-        "sha.js": "^2.4.11",
-        "to-buffer": "^1.2.0"
+        "sha.js": "^2.4.12",
+        "to-buffer": "^1.2.1"
       },
       "engines": {
-        "node": ">=0.12"
-      }
-    },
-    "node_modules/pbkdf2/node_modules/create-hash": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/create-hash/-/create-hash-1.1.3.tgz",
-      "integrity": "sha512-snRpch/kwQhcdlnZKYanNF1m0RDlrCdSKQaH87w1FCFPVPNCQ/Il9QJKAX2jVBZddRdaHBMC+zXa9Gw9tmkNUA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "cipher-base": "^1.0.1",
-        "inherits": "^2.0.1",
-        "ripemd160": "^2.0.0",
-        "sha.js": "^2.4.0"
-      }
-    },
-    "node_modules/pbkdf2/node_modules/hash-base": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/hash-base/-/hash-base-2.0.2.tgz",
-      "integrity": "sha512-0TROgQ1/SxE6KmxWSvXHvRj90/Xo1JvZShofnYF+f6ZsGtR4eES7WfrQzPalmyagfKZCXpVnitiRebZulWsbiw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "inherits": "^2.0.1"
-      }
-    },
-    "node_modules/pbkdf2/node_modules/ripemd160": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/ripemd160/-/ripemd160-2.0.1.tgz",
-      "integrity": "sha512-J7f4wutN8mdbV08MJnXibYpCOPHR+yzy+iQ/AsjMv2j8cLavQ8VGagDFUwwTAdF8FmRKVeNpbTTEwNHCW1g94w==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "hash-base": "^2.0.0",
-        "inherits": "^2.0.1"
+        "node": ">= 0.10"
       }
     },
     "node_modules/performance-now": {
@@ -7785,9 +7749,9 @@
       }
     },
     "node_modules/public-encrypt/node_modules/bn.js": {
-      "version": "4.12.2",
-      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.2.tgz",
-      "integrity": "sha512-n4DSx829VRTRByMRGdjQ9iqsN0Bh4OolPsFnaZBLcbi8iXcB+kJ9s7EnRt4wILZNV3kPLHkRVfOc/HvhC3ovDw==",
+      "version": "4.12.3",
+      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.3.tgz",
+      "integrity": "sha512-fGTi3gxV/23FTYdAoUtLYp6qySe2KE3teyZitipKNRuVYcBkoP/bB3guXN/XVKUe9mxCHXnc9C4ocyz8OmgN0g==",
       "dev": true,
       "license": "MIT"
     },
@@ -7810,9 +7774,9 @@
       "license": "MIT"
     },
     "node_modules/qs": {
-      "version": "6.5.3",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.5.3.tgz",
-      "integrity": "sha512-qxXIEh4pCGfHICj1mAJQ2/2XVZkjCDTcEgfoSQxc/fYivUZxTkk7L3bDBJSoNrEzXI17oUO5Dp07ktqE5KzczA==",
+      "version": "6.5.5",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.5.5.tgz",
+      "integrity": "sha512-mzR4sElr1bfCaPJe7m8ilJ6ZXdDaGoObcYR0ZHSsktM/Lt21MVHj5De30GQH2eiZ1qGRTO7LCAzQsUeXTNexWQ==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
@@ -8361,14 +8325,33 @@
       }
     },
     "node_modules/ripemd160": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/ripemd160/-/ripemd160-2.0.2.tgz",
-      "integrity": "sha512-ii4iagi25WusVoiC4B4lq7pbXfAp3D9v5CwfkY33vffw2+pkDjY1D8GaN7spsxvCSx8dkPqOZCEZyfxcmJG2IA==",
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/ripemd160/-/ripemd160-2.0.3.tgz",
+      "integrity": "sha512-5Di9UC0+8h1L6ZD2d7awM7E/T4uA1fJRlx6zk/NvdCCVEoAnFqvHmCuNeIKoCeIixBX/q8uM+6ycDvF8woqosA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "hash-base": "^3.0.0",
-        "inherits": "^2.0.1"
+        "hash-base": "^3.1.2",
+        "inherits": "^2.0.4"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/ripemd160/node_modules/hash-base": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/hash-base/-/hash-base-3.1.2.tgz",
+      "integrity": "sha512-Bb33KbowVTIj5s7Ked1OsqHUeCpz//tPwR+E2zJgJKo9Z5XolZ9b6bdUgjmYlwnWhoOQKoTd1TYToZGn5mAYOg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "inherits": "^2.0.4",
+        "readable-stream": "^2.3.8",
+        "safe-buffer": "^5.2.1",
+        "to-buffer": "^1.2.1"
+      },
+      "engines": {
+        "node": ">= 0.8"
       }
     },
     "node_modules/rsvp": {
@@ -10375,9 +10358,9 @@
       }
     },
     "node_modules/url/node_modules/qs": {
-      "version": "6.14.0",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.14.0.tgz",
-      "integrity": "sha512-YWWTjgABSKcvs/nWBi9PycY/JiPJqOD4JA6o9Sej2AtvSGarXxKC3OQSk4pAarbdQlKAh5D4FCQkJNkW+GAn3w==",
+      "version": "6.15.1",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.1.tgz",
+      "integrity": "sha512-6YHEFRL9mfgcAvql/XhwTvf5jKcOiiupt2FiJxHkiX1z4j7WL8J/jRHYLluORvc1XxB5rV20KoeK00gVJamspg==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
diff --git a/pkgs/by-name/ne/netlistsvg/package.nix b/pkgs/by-name/ne/netlistsvg/package.nix
index 6c302df88fb5..3d013d82f7ee 100644
--- a/pkgs/by-name/ne/netlistsvg/package.nix
+++ b/pkgs/by-name/ne/netlistsvg/package.nix
@@ -22,7 +22,7 @@ buildNpmPackage rec {
     cp ${./package-lock.json} ./package-lock.json
   '';
 
-  npmDepsHash = "sha256-Vs0RLj6ySkM5oQsBGv4MmgiIBMhiDhINpwuCBJH9L8s=";
+  npmDepsHash = "sha256-fESWYTx4cotURIjndLa5W+fCYJ12KwlDGXOPkzKmnTI=";
 
   dontNpmBuild = true;
 
diff --git a/pkgs/by-name/ne/networkmanager-strongswan/package.nix b/pkgs/by-name/ne/networkmanager-strongswan/package.nix
index 459bd9681f58..5356a0c52696 100644
--- a/pkgs/by-name/ne/networkmanager-strongswan/package.nix
+++ b/pkgs/by-name/ne/networkmanager-strongswan/package.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "NetworkManager-strongswan";
-  version = "1.6.4";
+  version = "1.6.5";
 
   src = fetchurl {
     url = "https://download.strongswan.org/NetworkManager/NetworkManager-strongswan-${finalAttrs.version}.tar.bz2";
-    sha256 = "sha256-X9ftnoogw2W+p9ZTdgoECfmyEkRABtQ2UzK7zFGPbBU=";
+    sha256 = "sha256-OpHK38x8dGFkcLKw+A203BfxAzYrOG7XY0edhQBQG2c=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/op/open-webui/package.nix b/pkgs/by-name/op/open-webui/package.nix
index f1e6bf46a83d..8a7d0cb36e52 100644
--- a/pkgs/by-name/op/open-webui/package.nix
+++ b/pkgs/by-name/op/open-webui/package.nix
@@ -24,11 +24,9 @@ let
 
     # the backend for run-on-client-browser python execution
     # must match lock file in open-webui
-    # TODO: should we automate this?
-    # TODO: with JQ? "jq -r '.packages["node_modules/pyodide"].version' package-lock.json"
-    pyodideVersion = "0.28.2";
+    pyodideVersion = "0.28.3";
     pyodide = fetchurl {
-      hash = "sha256-MQIRdOj9yVVsF+nUNeINnAfyA6xULZFhyjuNnV0E5+c=";
+      hash = "sha256-fcqubT8VmGoJ8PnmxHE6DA8kv/DJDHToWoFyPxvGCUA=";
       url = "https://github.com/pyodide/pyodide/releases/download/${pyodideVersion}/pyodide-${pyodideVersion}.tar.bz2";
     };
 
diff --git a/pkgs/by-name/op/open-webui/update.sh b/pkgs/by-name/op/open-webui/update.sh
index 0665c85fc8f4..47ea2fb8c6f8 100755
--- a/pkgs/by-name/op/open-webui/update.sh
+++ b/pkgs/by-name/op/open-webui/update.sh
@@ -22,11 +22,8 @@ npm_hash=$(prefetch-npm-deps package-lock.json)
 sed -i 's#npmDepsHash = "[^"]*"#npmDepsHash = "'"$npm_hash"'"#' "$path"
 
 # Extract pyodide version
-pyodide_version=$(sed -rn 's/^.*pyodide.*\^([0-9.]*)\".*$/\1/p' package.json)
+pyodide_version=$(jq -r '.packages["node_modules/pyodide"].version' package-lock.json)
 popd
 
-# Update the pyodide version if necessary
-current_pyodide_version=$(nix eval --raw -f . open-webui.frontend.pyodideVersion)
-if [ "$current_pyodide_version" < "$pyodide_version" ]; then
-  update-source-version open-webui.frontend "${pyodide_version}" --file="$path" --version-key=pyodideVersion --source-key=pyodide
-fi
+# Update the pyodide version
+update-source-version open-webui.frontend "${pyodide_version}" --file="$path" --version-key=pyodideVersion --source-key=pyodide
diff --git a/pkgs/by-name/op/opencode-desktop/package.nix b/pkgs/by-name/op/opencode-desktop/package.nix
index bfc0cf9c482c..8f2efe9ed76a 100644
--- a/pkgs/by-name/op/opencode-desktop/package.nix
+++ b/pkgs/by-name/op/opencode-desktop/package.nix
@@ -54,6 +54,12 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     OPENCODE_CHANNEL = "prod";
     MODELS_DEV_API_JSON = "${models-dev}/dist/_api.json";
     OPENCODE_DISABLE_MODELS_FETCH = true;
+  }
+  # Disable code signing on macOS. Public build hosts don't have Apple Developer
+  # certificates, so electron-builder's `security find-identity` spawns produce
+  # EPERM inside the nix sandbox.
+  // lib.optionalAttrs stdenvNoCC.hostPlatform.isDarwin {
+    CSC_IDENTITY_AUTO_DISCOVERY = "false";
   };
 
   postPatch = ''
@@ -73,6 +79,18 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     runHook postConfigure
   '';
 
+  preBuild = lib.optionalString stdenvNoCC.hostPlatform.isDarwin ''
+    # Patch electron-builder to skip code signing on macOS.
+    # The nix sandbox on public Darwin builders cannot spawn
+    # `security find-identity` — trying gives spawn EPERM.
+    # We patch the compiled JS to make getValidIdentities a no-op.
+    for f in $(find node_modules -path "*/app-builder-lib/out/codeSign/macCodeSign.js" -type f 2>/dev/null); do
+      substituteInPlace "$f" \
+        --replace-fail "async function getValidIdentities" \
+        "async function getValidIdentities() { return []; }; async function getValidIdentities_DISABLED"
+    done
+  '';
+
   buildPhase = ''
     runHook preBuild
 
@@ -98,7 +116,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       --config=electron-builder.config.ts \
       --config.electronDist="$HOME/.electron-dist" \
       --config.electronVersion=${electron.version} \
-      --config.asarUnpack='**/*.node'
+      --config.asarUnpack='**/*.node' \
+      ${lib.optionalString stdenvNoCC.hostPlatform.isDarwin "--config.mac.identity=null"}
 
     cd ../..
 
diff --git a/pkgs/by-name/op/opencode/package.nix b/pkgs/by-name/op/opencode/package.nix
index d4bcfb1d45a5..6a128e88368f 100644
--- a/pkgs/by-name/op/opencode/package.nix
+++ b/pkgs/by-name/op/opencode/package.nix
@@ -16,13 +16,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "opencode";
-  version = "1.14.48";
+  version = "1.15.3";
 
   src = fetchFromGitHub {
     owner = "anomalyco";
     repo = "opencode";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gyybqabTco+5ZeWv4lCX8t/R9Jm3tYsA8wVvkrxkEYQ=";
+    hash = "sha256-OKQR76q7trKQTvlMxH8tG2jNnRtBe3YeFfvNw8c3+8I=";
   };
 
   node_modules = stdenvNoCC.mkDerivation {
@@ -75,7 +75,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     # NOTE: Required else we get errors that our fixed-output derivation references store paths
     dontFixup = true;
 
-    outputHash = "sha256-94uXrhyGqW016U6LPE/xIfZGoDOzyUto5DyQrYYePds=";
+    outputHash = "sha256-O6czNd9n6b0TTIsPseZn9qOlxsPzRTrePu3L6gM13oM=";
     outputHashAlgo = "sha256";
     outputHashMode = "recursive";
   };
diff --git a/pkgs/by-name/op/openvino/package.nix b/pkgs/by-name/op/openvino/package.nix
index 8c3c86e8ac37..5063c6ca631a 100644
--- a/pkgs/by-name/op/openvino/package.nix
+++ b/pkgs/by-name/op/openvino/package.nix
@@ -55,14 +55,14 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "openvino";
-  version = "2026.1.0";
+  version = "2026.1.2";
 
   src = fetchFromGitHub {
     owner = "openvinotoolkit";
     repo = "openvino";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-ss6U4D1QyJM9hbauRBgNIrU09k6xMX0SUeleOXIDU6U=";
+    hash = "sha256-1lheHc0uajmUb1EW8q02bHX9PrCp4YoyT0l8dTyb4jM=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/pi/pigpio/package.nix b/pkgs/by-name/pi/pigpio/package.nix
index a106642e4931..9bd2683c82ec 100644
--- a/pkgs/by-name/pi/pigpio/package.nix
+++ b/pkgs/by-name/pi/pigpio/package.nix
@@ -26,6 +26,8 @@ mkDerivation rec {
     hash = "sha256-Z+SwUlBbtWtnbjTe0IghR3gIKS43ZziN0amYtmXy7HE=";
   };
 
+  NIX_CFLAGS_COMPILE = "-std=gnu17";
+
   nativeBuildInputs = [
     cmake
   ];
diff --git a/pkgs/by-name/pl/ploticus/package.nix b/pkgs/by-name/pl/ploticus/package.nix
index c197e67729dd..498fe40ada0b 100644
--- a/pkgs/by-name/pl/ploticus/package.nix
+++ b/pkgs/by-name/pl/ploticus/package.nix
@@ -40,6 +40,11 @@ stdenv.mkDerivation (finalAttrs: {
     ./fix-zlib-file-type.patch
   ];
 
+  # GCC 15 uses C23, which fails with the following error
+  # plg.h:283:8: error: conflicting types for 'atof'; have 'double(void)'
+  #   283 | double atof(), sqrt(), log();
+  env.NIX_CFLAGS_COMPILE = "-std=gnu17";
+
   buildInputs = [
     zlib
     libx11
diff --git a/pkgs/by-name/pu/pulse-visualizer/package.nix b/pkgs/by-name/pu/pulse-visualizer/package.nix
index d6daa5daff67..837ffe06f4df 100644
--- a/pkgs/by-name/pu/pulse-visualizer/package.nix
+++ b/pkgs/by-name/pu/pulse-visualizer/package.nix
@@ -6,12 +6,14 @@
   ninja,
   pkg-config,
   sdl3,
+  sdl3-image,
   libpulseaudio,
   pipewire,
   fftwFloat,
   freetype,
   glew,
   libGL,
+  curl,
   yaml-cpp,
   libebur128,
   clang,
@@ -19,13 +21,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pulse-visualizer";
-  version = "1.2.2";
+  version = "1.3.9";
 
   src = fetchFromGitHub {
     owner = "Audio-Solutions";
     repo = "pulse-visualizer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-OnZDNNDmN+OgsfzyPOtlpy8alt62WA6BNhNPJTtrHsU=";
+    hash = "sha256-IzJXFbsbpRszJEpU98exK4EKGU8kHH51BZzokJwzPzU=";
   };
 
   nativeBuildInputs = [
@@ -37,12 +39,14 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     sdl3
+    sdl3-image
     libpulseaudio
     pipewire
     fftwFloat
     freetype
     glew
     libGL
+    curl
     yaml-cpp
     libebur128
   ];
diff --git a/pkgs/by-name/qr/qrupdate/package.nix b/pkgs/by-name/qr/qrupdate/package.nix
index 9dd97a281227..0947f6267cf3 100644
--- a/pkgs/by-name/qr/qrupdate/package.nix
+++ b/pkgs/by-name/qr/qrupdate/package.nix
@@ -7,6 +7,7 @@
   which,
   gfortran,
   blas,
+  ctestCheckHook,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -42,16 +43,6 @@ stdenv.mkDerivation (finalAttrs: {
       "-DBLA_VENDOR=Generic"
     ];
 
-  patches =
-    # https://github.com/mpimd-csc/qrupdate-ng/issues/4
-    lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
-      ./disable-zch1dn-test.patch
-    ]
-    # https://github.com/mpimd-csc/qrupdate-ng/issues/7
-    ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
-      ./disable-aarch64-single-precision-tests.patch
-    ];
-
   postPatch = ''
     sed '/^cmake_minimum_required/Is/VERSION [0-9]\.[0-9]/VERSION 3.5/' -i ./CMakeLists.txt
   '';
@@ -63,11 +54,26 @@ stdenv.mkDerivation (finalAttrs: {
     which
     gfortran
   ];
+
   buildInputs = [
     blas
     lapack
   ];
 
+  nativeCheckInputs = [
+    ctestCheckHook
+  ];
+
+  disabledTests =
+    lib.optionals (stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isLinux) [
+      # https://github.com/mpimd-csc/qrupdate-ng/issues/7
+      "test_tchshx"
+    ]
+    ++ lib.optionals (stdenv.hostPlatform.isx86_64 && stdenv.hostPlatform.isDarwin) [
+      # https://github.com/mpimd-csc/qrupdate-ng/issues/4
+      "test_tch1dn"
+    ];
+
   meta = {
     description = "Library for fast updating of qr and cholesky decompositions";
     homepage = "https://github.com/mpimd-csc/qrupdate-ng";
diff --git a/pkgs/by-name/re/render-cli/package.nix b/pkgs/by-name/re/render-cli/package.nix
index 683d38ae84b4..b096b474ddbb 100644
--- a/pkgs/by-name/re/render-cli/package.nix
+++ b/pkgs/by-name/re/render-cli/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "render-cli";
-  version = "2.16.0";
+  version = "2.17.0";
 
   src = fetchFromGitHub {
     owner = "render-oss";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-y9XlOMNwqdooj3LcNFIF9gov9KX+WtB8eU0NsjzVuUc=";
+    hash = "sha256-YfGgFtGq9nnucsderlNv8No8yzDM7WQ5YGqa6YEmxtc=";
   };
 
-  vendorHash = "sha256-K2RKcz5wAP0ZA5g5aDgSsEXKEEncFtO9qamgG3fW02Y=";
+  vendorHash = "sha256-Ja0BcZXF8f3L+rdmk3+pyCY7khAjK+w6pyPzZdYuufs=";
 
   # Tests require network access
   doCheck = false;
diff --git a/pkgs/by-name/re/reprepro/package.nix b/pkgs/by-name/re/reprepro/package.nix
index fdc17da02cf3..9994497a538a 100644
--- a/pkgs/by-name/re/reprepro/package.nix
+++ b/pkgs/by-name/re/reprepro/package.nix
@@ -11,18 +11,22 @@
   libarchive,
   xz,
   zlib,
+  gcc14Stdenv,
 }:
 
-stdenv.mkDerivation (finalAttrs: {
+let
+  theStdenv = if stdenv.isDarwin then gcc14Stdenv else stdenv;
+in
+theStdenv.mkDerivation (finalAttrs: {
   pname = "reprepro";
-  version = "5.4.7";
+  version = "5.4.8";
 
   src = fetchFromGitLab {
     domain = "salsa.debian.org";
     owner = "debian";
     repo = "reprepro";
     tag = "reprepro-${finalAttrs.version}";
-    hash = "sha256-bGfVWOmcXvaE+t9jiZFrnaUTKVPJqGqbPFyThhKK8gQ=";
+    hash = "sha256-qHqRLWRbSwmpKkUQ8JenUo+CY91EY/h4yHHmq4TacMg=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/si/siege/package.nix b/pkgs/by-name/si/siege/package.nix
index d7bc095f546e..647c4dcd3594 100644
--- a/pkgs/by-name/si/siege/package.nix
+++ b/pkgs/by-name/si/siege/package.nix
@@ -18,6 +18,7 @@ stdenv.mkDerivation (finalAttrs: {
   env =
     lib.optionalAttrs stdenv.hostPlatform.isLinux {
       NIX_LDFLAGS = toString [ "-lgcc_s" ];
+      NIX_CFLAGS_COMPILE = "-std=gnu17";
     }
     // lib.optionalAttrs stdenv.cc.isClang {
       # Borrowed solution from homebrew: https://github.com/Homebrew/homebrew-core/blob/1c7c95183c0984a84b1680422afab6578c300a27/Formula/s/siege.rb#L31
diff --git a/pkgs/by-name/si/simplex-chat-desktop/package.nix b/pkgs/by-name/si/simplex-chat-desktop/package.nix
index b371758d3073..b2da687765b7 100644
--- a/pkgs/by-name/si/simplex-chat-desktop/package.nix
+++ b/pkgs/by-name/si/simplex-chat-desktop/package.nix
@@ -8,7 +8,7 @@
 
 let
   pname = "simplex-chat-desktop";
-  version = "6.5.1";
+  version = "6.5.2";
 
   sources = {
     "aarch64-linux" = fetchurl {
@@ -17,7 +17,7 @@ let
     };
     "x86_64-linux" = fetchurl {
       url = "https://github.com/simplex-chat/simplex-chat/releases/download/v${version}/simplex-desktop-x86_64.AppImage";
-      hash = "sha256-xRHMdHaV+ppxAm1BDOP743N53oDnVPt8b7H+cRqzuZE=";
+      hash = "sha256-caRL09PKJ33XHRReZ5qSpfgKH0wpJxGSHXfA83sz5UE=";
     };
   };
 
diff --git a/pkgs/by-name/sy/syncthingtray/package.nix b/pkgs/by-name/sy/syncthingtray/package.nix
index 2d37c61d419e..f7d020a004e9 100644
--- a/pkgs/by-name/sy/syncthingtray/package.nix
+++ b/pkgs/by-name/sy/syncthingtray/package.nix
@@ -27,14 +27,14 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "2.0.10";
+  version = "2.1.0";
   pname = "syncthingtray";
 
   src = fetchFromGitHub {
     owner = "Martchus";
     repo = "syncthingtray";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-dzsDTb7r1kbVTiapXskE5xvfdzGT2u3utbHGbt/1X7I=";
+    hash = "sha256-trmNK6lyKL6zNcL/FKELkLOJK9vVpFcS3uGMeMrlpPI=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/uh/uhexen2/package.nix b/pkgs/by-name/uh/uhexen2/package.nix
index d12906454201..bfe2ec3750c6 100644
--- a/pkgs/by-name/uh/uhexen2/package.nix
+++ b/pkgs/by-name/uh/uhexen2/package.nix
@@ -45,7 +45,7 @@ stdenv.mkDerivation {
     )
   '';
 
-  NIX_CFLAGS_COMPILE = "-std=gnu17";
+  env.NIX_CFLAGS_COMPILE = "-std=gnu17";
 
   buildPhase = ''
     runHook preBuild
diff --git a/pkgs/by-name/ve/veroroute/package.nix b/pkgs/by-name/ve/veroroute/package.nix
index e0e7cd43024f..17f0b92dda9a 100644
--- a/pkgs/by-name/ve/veroroute/package.nix
+++ b/pkgs/by-name/ve/veroroute/package.nix
@@ -2,7 +2,8 @@
   lib,
   stdenv,
   fetchurl,
-  libsForQt5,
+  qt6,
+  nixosTests,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -15,17 +16,21 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   nativeBuildInputs = [
-    libsForQt5.qmake
-    libsForQt5.wrapQtAppsHook
+    qt6.qmake
+    qt6.wrapQtAppsHook
   ];
   buildInputs = [
-    libsForQt5.qtbase
+    qt6.qtbase
   ];
 
   preConfigure = ''
     cd Src/
   '';
 
+  passthru.tests = {
+    veroroute = nixosTests.veroroute;
+  };
+
   meta = {
     description = "Qt based Veroboard/Perfboard/PCB layout and routing application";
     homepage = "https://sourceforge.net/projects/veroroute";
diff --git a/pkgs/by-name/wi/witr/package.nix b/pkgs/by-name/wi/witr/package.nix
index 79c5e0095627..6c8dd966efc7 100644
--- a/pkgs/by-name/wi/witr/package.nix
+++ b/pkgs/by-name/wi/witr/package.nix
@@ -6,13 +6,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "witr";
-  version = "0.3.1";
+  version = "0.3.2";
 
   src = fetchFromGitHub {
     owner = "pranshuparmar";
     repo = "witr";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kjWhSRPU4OwRi4Azs7Ql//aMOhHU9Aya2EDcpNwOr6E=";
+    hash = "sha256-kNiBcLk+rxJno1ZHPxr28EI5T3tpJnFXgh8zIvEYy6M=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
diff --git a/pkgs/by-name/xd/xdg-desktop-portal-termfilechooser/package.nix b/pkgs/by-name/xd/xdg-desktop-portal-termfilechooser/package.nix
index 31d83754a04d..962138d8994e 100644
--- a/pkgs/by-name/xd/xdg-desktop-portal-termfilechooser/package.nix
+++ b/pkgs/by-name/xd/xdg-desktop-portal-termfilechooser/package.nix
@@ -7,7 +7,7 @@
   meson,
   pkg-config,
   inih,
-  systemd,
+  systemdLibs,
   scdoc,
   nix-update-script,
 }:
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     xdg-desktop-portal
     inih
-    systemd
+    systemdLibs
   ];
 
   mesonFlags = [ "-Dsd-bus-provider=libsystemd" ];
diff --git a/pkgs/by-name/xf/xf86-input-cmt/package.nix b/pkgs/by-name/xf/xf86-input-cmt/package.nix
deleted file mode 100644
index 75a7501dd390..000000000000
--- a/pkgs/by-name/xf/xf86-input-cmt/package.nix
+++ /dev/null
@@ -1,48 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  pkg-config,
-  xorg-server,
-  xorgproto,
-  util-macros,
-  libgestures,
-  libevdevc,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "xf86-input-cmt";
-  version = "2.0.2";
-  src = fetchFromGitHub {
-    owner = "hugegreenbug";
-    repo = "xf86-input-cmt";
-    rev = "v${finalAttrs.version}";
-    sha256 = "1cnwf518nc0ybc1r3rsgc1gcql1k3785khffv0i4v3akrm9wdw98";
-  };
-
-  postPatch = ''
-    patchShebangs ./apply_patches.sh
-    ./apply_patches.sh
-  '';
-
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [
-    xorg-server
-    xorgproto
-    util-macros
-    libgestures
-    libevdevc
-  ];
-
-  configureFlags = [
-    "--with-sdkdir=${placeholder "out"}"
-  ];
-
-  meta = {
-    description = "Chromebook touchpad driver";
-    license = lib.licenses.bsd3;
-    platforms = lib.platforms.linux;
-    homepage = "https://www.github.com/hugegreenbug/xf86-input-cmt";
-    maintainers = with lib.maintainers; [ kcalvinalvin ];
-  };
-})
diff --git a/pkgs/by-name/ya/yazi-unwrapped/package.nix b/pkgs/by-name/ya/yazi-unwrapped/package.nix
index 59f3266373ed..0073eb002a96 100644
--- a/pkgs/by-name/ya/yazi-unwrapped/package.nix
+++ b/pkgs/by-name/ya/yazi-unwrapped/package.nix
@@ -8,17 +8,17 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "yazi";
-  version = "26.1.22";
+  version = "26.5.6";
 
   srcs = builtins.attrValues finalAttrs.passthru.srcs;
 
   sourceRoot = finalAttrs.passthru.srcs.code_src.name;
 
-  cargoHash = "sha256-VcoIjPZqLimo44atXh7pnCtF+QaZA7uHtKEE6FgTL2k=";
+  cargoHash = "sha256-gc0uEMNJ+eCIymXK10+Swi11xuyP5cj6MbLLB/ZDgXw=";
 
   env.YAZI_GEN_COMPLETIONS = true;
   env.VERGEN_GIT_SHA = "Nixpkgs";
-  env.VERGEN_BUILD_DATE = "2026-01-22";
+  env.VERGEN_BUILD_DATE = "2026-05-05";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = [ rust-jemalloc-sys ];
@@ -36,18 +36,13 @@ rustPlatform.buildRustPackage (finalAttrs: {
     install -Dm444 assets/logo.png $out/share/pixmaps/yazi.png
   '';
 
-  postPatch = ''
-    substituteInPlace yazi-shared/Cargo.toml \
-      --replace-fail 'rust-version = "1.92.0"' 'rust-version = "1.91"'
-  '';
-
   passthru.updateScript.command = [ ./update.sh ];
   passthru.srcs = {
     code_src = fetchFromGitHub {
       owner = "sxyazi";
       repo = "yazi";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-BZktPXn+8vyFyHapvW+9nepFsWRW/XBtdBcnLKrCNCw=";
+      hash = "sha256-sdaqZwLb+fBTg5Pd6WWfOWKCavsXWSSZrBEXuYuc8iM=";
     };
 
     man_src = fetchFromGitHub {
diff --git a/pkgs/by-name/ya/yazi-unwrapped/update.sh b/pkgs/by-name/ya/yazi-unwrapped/update.sh
index 6b32e2d8c347..3aaf5dd3a182 100755
--- a/pkgs/by-name/ya/yazi-unwrapped/update.sh
+++ b/pkgs/by-name/ya/yazi-unwrapped/update.sh
@@ -41,12 +41,12 @@ echo "Updating cargoHash"
 sed -i -E 's/cargoHash = ".*?"/cargoHash = ""/' package.nix
 
 # Build and get new hash
-cargoHash=$( (nix-build "$NIXPKGS_DIR" -A yazi-unwrapped 2>&1 || true) | awk '/got/{print $2}')
+cargoHash=$( (nix-build "$NIXPKGS_DIR" -A yazi-unwrapped 2>&1 || true) | awk '/got:/{print $2}')
 
 if [ "$cargoHash" == "" ]; then
     echo "Failed to get cargoHash, please update it manually"
     exit 0
 fi
 
-sed -i -E 's/cargoHash = ".*?"/cargoHash = "'"$cargoHash"'"/' package.nix
+sed -i -E 's#cargoHash = ".*?"#cargoHash = "'"$cargoHash"'"#' package.nix
 popd
diff --git a/pkgs/by-name/ya/yazi/plugins/split-tabs/default.nix b/pkgs/by-name/ya/yazi/plugins/split-tabs/default.nix
index a15e5869cf6e..b6dec940a6bf 100644
--- a/pkgs/by-name/ya/yazi/plugins/split-tabs/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/split-tabs/default.nix
@@ -11,8 +11,8 @@ mkYaziPlugin {
   src = fetchFromGitHub {
     owner = "terrakok";
     repo = "split-tabs.yazi";
-    rev = "ca95efc94a3a62e6e58c741f60801c1a0ddba1a6";
-    hash = "sha256-ic09opWZcoJ874bU2HN+5Y9mbnZEnvds+abqRQYuiYE=";
+    rev = "6da6089a0943bf5b9ee18942a890c294d4f227bc";
+    hash = "sha256-vIJNXmkIp5mjWuS/madKI/m9N8D4d6HaIyzeantrkig=";
   };
 
   meta = {
diff --git a/pkgs/by-name/yt/ytdl-sub/package.nix b/pkgs/by-name/yt/ytdl-sub/package.nix
index 03979e23b14b..441badb18644 100644
--- a/pkgs/by-name/yt/ytdl-sub/package.nix
+++ b/pkgs/by-name/yt/ytdl-sub/package.nix
@@ -9,14 +9,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "ytdl-sub";
-  version = "2026.04.13.post1";
+  version = "2026.05.10.post1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jmbannon";
     repo = "ytdl-sub";
     tag = finalAttrs.version;
-    hash = "sha256-nItpaxK2AuBn4yZLRGmUhqykawDIMZqxqPIXImZZwBE=";
+    hash = "sha256-lv82BqZHzAiQV8wAwZQ/BB/ohq+Sn2UlSNV6jFGE3Uk=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index 75393ee5533b..dde118097fb6 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -1008,15 +1008,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "fzf-lua";
-      version = "0.0.2646-1";
+      version = "0.0.2648-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/fzf-lua-0.0.2646-1.rockspec";
-          sha256 = "1mpvbkkj7lbmvcihz0f0sbh81g2y0kans1hj336298yc7mygj4b1";
+          url = "mirror://luarocks/fzf-lua-0.0.2648-1.rockspec";
+          sha256 = "0lkn7j9mfpv5vagp7xilki05k0ymrg22j95s2g8plg1fhvcykxxw";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/ibhagwan/fzf-lua/archive/97376e364f51f1b5ae3efaa3eb2e929430ca8419.zip";
-        sha256 = "029md3l7xccsnm3wwpdyi1mmxz7ha92c9qgx1qwqpnlc2p7cpdbm";
+        url = "https://github.com/ibhagwan/fzf-lua/archive/23f71140754b9162551dc8ccc1d6346e4275ecc2.zip";
+        sha256 = "0qw2chgv0zlwr524xi4ghxmfpn9nhxsbq7gga8i78sclsg7r8fhy";
       };
 
       disabled = luaOlder "5.1";
@@ -1105,15 +1105,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "grug-far.nvim";
-      version = "1.6.68-1";
+      version = "1.6.69-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/grug-far.nvim-1.6.68-1.rockspec";
-          sha256 = "1p5cmqb8k1ll8zmkmhf3q6vs73hfmzvmjlj9xxsirm8g697ya3sw";
+          url = "mirror://luarocks/grug-far.nvim-1.6.69-1.rockspec";
+          sha256 = "1fnk6s5kzq03ny3h18ap7454i2sv9c0ipbwl2zxhx1wkrpnbrnhy";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/MagicDuck/grug-far.nvim/archive/21790e59dd0109a92a70cb874dd002af186314f5.zip";
-        sha256 = "1zf9bf6l5069nx0yyv6bfk9y5f9589vxkhw4gy5f0qpn6j60h4qy";
+        url = "https://github.com/MagicDuck/grug-far.nvim/archive/a5875fde04e2940a5060f8df9c453bcfcfe0a5c0.zip";
+        sha256 = "0cygcm9giqxr701vn1dgq8bn3nvjnwl5f9shgxppdf5w9fw0l4bk";
       };
 
       disabled = luaOlder "5.1";
@@ -5468,15 +5468,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "rocks.nvim";
-      version = "2.48.0-1";
+      version = "2.49.0-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/rocks.nvim-2.48.0-1.rockspec";
-          sha256 = "125nhf4ncj1hdppy2w1c0c2j7ydhk0ai0caxcyn7qm69d1arqdix";
+          url = "mirror://luarocks/rocks.nvim-2.49.0-1.rockspec";
+          sha256 = "1krbnmx90avna2bzxvdv5zs7iakgkcm9w0dniingbhifkrkmiazr";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/lumen-oss/rocks.nvim/archive/v2.48.0.zip";
-        sha256 = "061a7xhnvqd2z3mhfpadlg51jsw1h7bb1g615bp07c9465diszcj";
+        url = "https://github.com/lumen-oss/rocks.nvim/archive/v2.49.0.zip";
+        sha256 = "13sr1alra4dlh22p6b53y6695zdv4vih3gdkvjfd7q3057ni7l20";
       };
 
       disabled = lua.luaversion != "5.1";
@@ -5840,29 +5840,25 @@ final: prev: {
       ltreesitter,
       lua-cjson,
       luafilesystem,
-      luarocks-build-treesitter-parser,
       lusc_luv,
       luv,
       tl,
-      tree-sitter-cli,
-      tree-sitter-teal,
     }:
     buildLuarocksPackage {
       pname = "teal-language-server";
-      version = "0.1.2-1";
+      version = "0.1.3-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/teal-language-server-0.1.2-1.rockspec";
-          sha256 = "1z7nbzhdqh2w7k635hbbfba2s37rxbcphaxq7dfsjfj3sgkj9snf";
+          url = "mirror://luarocks/teal-language-server-0.1.3-1.rockspec";
+          sha256 = "1mqg294rgzcfbfam0qdab3z93j7gsx250hs9f271337gqki34848";
         }).outPath;
       src = fetchFromGitHub {
         owner = "teal-language";
         repo = "teal-language-server";
-        tag = "0.1.2";
-        hash = "sha256-1ssgt+/e28TJ+1G1TWAPbZe5DiUYOafsSbc9exttesk=";
+        tag = "0.1.3";
+        hash = "sha256-XuHm6AbcBmv0fyQjlJlBMWqJlGYoveW7BEEN+axMRhw=";
       };
 
-      nativeBuildInputs = [ luarocks-build-treesitter-parser ];
       propagatedBuildInputs = [
         argparse
         inspect
@@ -5872,8 +5868,6 @@ final: prev: {
         lusc_luv
         luv
         tl
-        tree-sitter-cli
-        tree-sitter-teal
       ];
 
       meta = {
@@ -5939,8 +5933,8 @@ final: prev: {
       src = fetchFromGitHub {
         owner = "nvim-telescope";
         repo = "telescope.nvim";
-        rev = "f04ab730b8f9c6bf3f54a206d0dcddfd70c52d59";
-        hash = "sha256-M5cAQe0VxKwiOsLqXmlxNzd8xvLW+J1+Hd31PFmK+S8=";
+        rev = "7d324792b7943e4aa16ad007212e6acc6f9fe335";
+        hash = "sha256-+e/ijnuw0Zrj+zcfO2iRusukD4WHrgVC5reOTNk/04o=";
       };
 
       disabled = lua.luaversion != "5.1";
diff --git a/pkgs/development/lua-modules/overrides.nix b/pkgs/development/lua-modules/overrides.nix
index 9a4237032fdd..75d7668c6a7c 100644
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -1170,9 +1170,7 @@ in
       substituteInPlace ''${rockspecFilename} \
         --replace-fail '"ltreesitter == 0.1.0",' '"ltreesitter >= 0.2.0",' \
         --replace-fail '"luv == 1.51.0",' '"luv >= 1.51.0",' \
-        --replace-fail '"tree-sitter-cli == 0.24.7",' "" \
-        --replace-fail '"tl == 0.24.5",' '"tl >= 0.24.5",' \
-        --replace-fail '"tree-sitter-teal == 0.0.34",' '"tree-sitter-teal >= 0.0.34",'
+        --replace-fail '"tl == 0.24.5",' '"tl >= 0.24.5",'
     '';
   });
 
diff --git a/pkgs/development/perl-modules/Math-Pari-darwin-callback-abi.patch b/pkgs/development/perl-modules/Math-Pari-darwin-callback-abi.patch
new file mode 100644
index 000000000000..ff5fe4984dfb
--- /dev/null
+++ b/pkgs/development/perl-modules/Math-Pari-darwin-callback-abi.patch
@@ -0,0 +1,77 @@
+--- a/Pari.xs
++++ b/Pari.xs
+@@ -1518,21 +1518,63 @@
+ }
+ 
+ GEN
+-callPerlFunction(PerlFunctionArg1 long_ep, ...)
+-{
+-    GEN res;
++callPerlFunction_args(PerlFunctionArg1 long_ep, GEN *args)
++{
+     entree *ep = toEntreeP(long_ep);
+-    va_list args;
+     SV *cv = (SV*) ep->elt_CV;
+     int numargs = CV_NUMARGS_get(cv);
+-
+-    va_start(args, long_ep);
+-/*    warn("calling with numargs=%d", numargs); */
+-    res = callPerlFunction_va_list(G_SCALAR, numargs, cv, args);
+-/*    warn("ending call"); */
+-    va_end(args);
+-/*    warn("ended call"); */
++    GEN res;
++    int i;
++    dSP;
++    int count;
++    pari_sp oldavma = avma;
++    SV *oPariStack = PariStack;
++    SV *sv;
++
++    ENTER;
++    SAVETMPS;
++    SAVEINT(sentinel);
++    sentinel = avma;
++    PUSHMARK(sp);
++    EXTEND(sp, numargs + 1);
++    for (i = 0; i < numargs; i++)
++	PUSHs(pari2mortalsv(args[i], oldavma));
++    PUTBACK;
++    count = perl_call_sv(cv, G_SCALAR);
++
++    SPAGAIN;
++    if (count != 1)
++	croak("Perl function exported into PARI returns unexpected number %d of values (need 1)", count);
++
++    sv = SvREFCNT_inc(POPs);
++
++    PUTBACK;
++    FREETMPS;
++    LEAVE;
++
++    if (PariStack != oPariStack)
++	moveoffstack_newer_than(oPariStack);
++    res = sv2pari(sv);
++    res = myforcecopy(res);
++    SvREFCNT_dec(sv);
++
+     return res;
++}
++
++GEN
++callPerlFunction(PerlFunctionArg1 long_ep, GEN arg0, GEN arg1, GEN arg2, GEN arg3, GEN arg4, GEN arg5, GEN arg6, GEN arg7)
++{
++    GEN args[8];
++
++    args[0] = arg0;
++    args[1] = arg1;
++    args[2] = arg2;
++    args[3] = arg3;
++    args[4] = arg4;
++    args[5] = arg5;
++    args[6] = arg6;
++    args[7] = arg7;
++    return callPerlFunction_args(long_ep, args);
+ }
+ 
+ entree *
diff --git a/pkgs/development/python-modules/adb-enhanced/default.nix b/pkgs/development/python-modules/adb-enhanced/default.nix
index 0b732f51a227..bf0e1b8a7298 100644
--- a/pkgs/development/python-modules/adb-enhanced/default.nix
+++ b/pkgs/development/python-modules/adb-enhanced/default.nix
@@ -3,6 +3,7 @@
   buildPythonPackage,
   docopt,
   fetchFromGitHub,
+  fetchpatch,
   setuptools,
   jdk11,
   psutil,
@@ -19,6 +20,13 @@ buildPythonPackage (finalAttrs: {
     tag = finalAttrs.version;
     hash = "sha256-YuQgz3WeN50hg/IgdoNV61St9gpu6lcgFfKCfI/ENl0=";
   };
+  patches = [
+    # psutil==7.2.1 -> psutil==7.2.2
+    (fetchpatch {
+      url = "https://github.com/ashishb/adb-enhanced/pull/337.patch";
+      hash = "sha256-BRpdgLS6CNkmyj+OwnIaqfkmz1jzZg/qtoiN32jUIog=";
+    })
+  ];
 
   build-system = [ setuptools ];
 
diff --git a/pkgs/development/python-modules/aioesphomeapi/default.nix b/pkgs/development/python-modules/aioesphomeapi/default.nix
index 68331992f98a..4206059e92cc 100644
--- a/pkgs/development/python-modules/aioesphomeapi/default.nix
+++ b/pkgs/development/python-modules/aioesphomeapi/default.nix
@@ -26,14 +26,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "aioesphomeapi";
-  version = "44.23.0";
+  version = "45.0.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "esphome";
     repo = "aioesphomeapi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mKk4NO44mVTV5Fe8oDhQYcNp8V1OLsPt4xk+kztXwrM=";
+    hash = "sha256-ajucVk5yF0akOIfBX28sjOndpmHQumJBUp5jnq//B+M=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/aioharmony/default.nix b/pkgs/development/python-modules/aioharmony/default.nix
index 099581a01cf1..be5857afbb37 100644
--- a/pkgs/development/python-modules/aioharmony/default.nix
+++ b/pkgs/development/python-modules/aioharmony/default.nix
@@ -4,6 +4,7 @@
   async-timeout,
   buildPythonPackage,
   fetchFromGitHub,
+  pytest-asyncio,
   pytest-cov-stub,
   pytestCheckHook,
   setuptools,
@@ -12,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "aioharmony";
-  version = "0.5.3";
+  version = "1.0.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Harmony-Libs";
     repo = "aioharmony";
     tag = "v${version}";
-    hash = "sha256-H5zVY7LvTP8/CQtUGtXCXxOfG8GFQgdp7BY8jl9X+Gc=";
+    hash = "sha256-163L2ilmfMRL6qsD4RgWEX3kdKK6rnvjw9c78vKBtuE=";
   };
 
   build-system = [ setuptools ];
@@ -31,6 +32,7 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
+    pytest-asyncio
     pytest-cov-stub
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/axis/default.nix b/pkgs/development/python-modules/axis/default.nix
index a10cad6d8569..70f028ae9ab2 100644
--- a/pkgs/development/python-modules/axis/default.nix
+++ b/pkgs/development/python-modules/axis/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "axis";
-  version = "70";
+  version = "71";
   pyproject = true;
 
   disabled = pythonOlder "3.14";
@@ -24,7 +24,7 @@ buildPythonPackage (finalAttrs: {
     owner = "Kane610";
     repo = "axis";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LfWnqYtmQLh1ZhSnLrx40ZfilhUoi9qbd0TgWpehlAg=";
+    hash = "sha256-2CMfKpXd2u2cNTyCc4xxHcjYhR9oBRiccT7dcfY4DcA=";
   };
 
   postPatch = ''
@@ -53,7 +53,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Python library for communicating with devices from Axis Communications";
     homepage = "https://github.com/Kane610/axis";
-    changelog = "https://github.com/Kane610/axis/releases/tag/v${finalAttrs.src.tag}";
+    changelog = "https://github.com/Kane610/axis/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "axis";
diff --git a/pkgs/development/python-modules/databricks-sdk/default.nix b/pkgs/development/python-modules/databricks-sdk/default.nix
index f058f4ad8c3c..66c477b3f3e2 100644
--- a/pkgs/development/python-modules/databricks-sdk/default.nix
+++ b/pkgs/development/python-modules/databricks-sdk/default.nix
@@ -22,14 +22,15 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "databricks-sdk";
-  version = "0.106.0";
+  version = "0.108.0";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "databricks";
     repo = "databricks-sdk-py";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-l1fXVfEcQkHdRUxN02/K6r5t2IK5yGnEwfv9D1XK/Uc=";
+    hash = "sha256-WancthAPYJ3pZEgKSD3nAR21BhHNh2sWd2e6R/nSGHQ=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/discid/default.nix b/pkgs/development/python-modules/discid/default.nix
index c518fb18842b..622d45e84f73 100644
--- a/pkgs/development/python-modules/discid/default.nix
+++ b/pkgs/development/python-modules/discid/default.nix
@@ -5,16 +5,25 @@
   buildPythonPackage,
   fetchPypi,
   setuptools,
+  sphinxHook,
+  sphinx-autodoc-typehints,
+  sphinx-rtd-theme,
+  pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "discid";
-  version = "1.3.0";
+  version = "1.4.0";
   pyproject = true;
 
+  outputs = [
+    "out"
+    "doc"
+  ];
+
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-cWChIRrD1qbYIT+4jdPXPjKr5eATNqWkyYWwgql9QzU=";
+    sha256 = "sha256-UP09tEXK60S593Y3d+1JaIw89GM9qZ00DCW5GUlrqLU=";
   };
 
   build-system = [
@@ -31,6 +40,16 @@ buildPythonPackage rec {
                   "_open_library('${libdiscid}/lib/libdiscid${extension}')"
     '';
 
+  nativeBuildInputs = [
+    sphinxHook
+    sphinx-autodoc-typehints
+    sphinx-rtd-theme
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
   meta = {
     description = "Python binding of libdiscid";
     homepage = "https://python-discid.readthedocs.org/";
diff --git a/pkgs/development/python-modules/folium/default.nix b/pkgs/development/python-modules/folium/default.nix
index cb14e2af225c..326608205a04 100644
--- a/pkgs/development/python-modules/folium/default.nix
+++ b/pkgs/development/python-modules/folium/default.nix
@@ -3,6 +3,7 @@
   buildPythonPackage,
   branca,
   fetchFromGitHub,
+  fetchpatch2,
   geodatasets,
   geopandas,
   jinja2,
@@ -31,6 +32,15 @@ buildPythonPackage rec {
     hash = "sha256-yLF4TdrMVEtWvGXZGbwa3OxCkdXMsN4m45rPrGDHlCU=";
   };
 
+  patches = [
+    # https://github.com/python-visualization/folium/pull/2223
+    (fetchpatch2 {
+      name = "folium-fix-tests-proj-9.8.1";
+      url = "https://github.com/python-visualization/folium/commit/b4ea8aa12d0808536c4f50b63eddd006e68680cb.patch?full_index=1";
+      hash = "sha256-e6PFvK/qAfVTPs8LF2XgojwFJ/s2PDrIuwEkxRUzSkE=";
+    })
+  ];
+
   build-system = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/ha-garmin/default.nix b/pkgs/development/python-modules/ha-garmin/default.nix
index a445591e5dc3..3b29e289b009 100644
--- a/pkgs/development/python-modules/ha-garmin/default.nix
+++ b/pkgs/development/python-modules/ha-garmin/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "ha-garmin";
-  version = "0.1.19";
+  version = "0.1.22";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cyberjunky";
     repo = "ha-garmin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vzr32vuAVafdx64Fmv257gS2a+ZbfwZNwwuF5NPQbS0=";
+    hash = "sha256-q5bNa6HT2GeqdElsSG7Rgk3a14GsjGyLkHWVrg3CTYs=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/home-connect-async/default.nix b/pkgs/development/python-modules/home-connect-async/default.nix
index a149c84cbfd7..4abecad5d16c 100644
--- a/pkgs/development/python-modules/home-connect-async/default.nix
+++ b/pkgs/development/python-modules/home-connect-async/default.nix
@@ -13,13 +13,13 @@
 
 buildPythonPackage rec {
   pname = "home-connect-async";
-  version = "0.8.5";
+  version = "0.8.6";
   pyproject = true;
 
   src = fetchPypi {
     pname = "home_connect_async";
     inherit version;
-    hash = "sha256-LiBBE9AiyMWipQKtHsOZ5rfqOgB75flrJYtU1oAw+hs=";
+    hash = "sha256-4iF63TqmT47nHGJd9H4D6SnzclToj5S5Z/pm4YxbvQA=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/imgw-pib/default.nix b/pkgs/development/python-modules/imgw-pib/default.nix
index 4605c6a4143b..13d6036a8adb 100644
--- a/pkgs/development/python-modules/imgw-pib/default.nix
+++ b/pkgs/development/python-modules/imgw-pib/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "imgw-pib";
-  version = "2.1.1";
+  version = "2.1.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bieniu";
     repo = "imgw-pib";
     tag = finalAttrs.version;
-    hash = "sha256-R1WhKOboItkKamO+hyyJyTl0veDCHDc4N70UE7IuFqI=";
+    hash = "sha256-xCT/umB84iAyj7w9rY8KgOcE6nkuburIljhTU1aiYMk=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/johnnycanencrypt/default.nix b/pkgs/development/python-modules/johnnycanencrypt/default.nix
index 8391335dc0b7..17348ed902ac 100644
--- a/pkgs/development/python-modules/johnnycanencrypt/default.nix
+++ b/pkgs/development/python-modules/johnnycanencrypt/default.nix
@@ -10,24 +10,25 @@
   pkg-config,
   pytestCheckHook,
   rustPlatform,
+  tzdata,
   vcrpy,
 }:
 
 buildPythonPackage rec {
   pname = "johnnycanencrypt";
-  version = "0.16.0";
+  version = "0.18.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kushaldas";
     repo = "johnnycanencrypt";
     tag = "v${version}";
-    hash = "sha256-9T8B6zG3zMOBMX9C+u34MGBAgQ8YR44CW2BTdO1CciI=";
+    hash = "sha256-qpta6D5aslUwuJ0+voYrHFIDetlsUB6PkScrtl/plVs=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-V1z16GKaSQVjp+stWir7kAO2wsnOYPdhKi4KzIKmKx8=";
+    hash = "sha256-EzHbV/IBbGjoKFIbXSo2dlf+DU7ZXV16bVR93Sq0lis=";
   };
 
   build-system = with rustPlatform; [
@@ -53,7 +54,10 @@ buildPythonPackage rec {
     libiconv
   ];
 
-  dependencies = [ httpx ];
+  dependencies = [
+    httpx
+    tzdata
+  ];
 
   nativeCheckInputs = [
     pytestCheckHook
diff --git a/pkgs/development/python-modules/labgrid/default.nix b/pkgs/development/python-modules/labgrid/default.nix
index e4bb6ac0eef2..e886c06e3618 100644
--- a/pkgs/development/python-modules/labgrid/default.nix
+++ b/pkgs/development/python-modules/labgrid/default.nix
@@ -4,6 +4,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   fetchpatch,
+  fetchpatch2,
   grpcio,
   grpcio-tools,
   grpcio-reflection,
@@ -53,6 +54,11 @@ buildPythonPackage rec {
       url = "https://github.com/Emantor/labgrid/commit/f0b672afe1e8976c257f0adff9bf6e7ee9760d6f.patch";
       sha256 = "sha256-M7rg+W9SjWDdViWyWe3ERzbUowxzf09c4w1yG3jQGak=";
     })
+    # Fix test_help under python 3.14 argparse colored output.
+    (fetchpatch2 {
+      url = "https://github.com/labgrid-project/labgrid/commit/417ace60b9dc043767afb312113a02bcb0807b17.patch?full_index=1";
+      hash = "sha256-QCkO/PQbosqUldzJiOyF6BHvyzZI06CGs9IxHPPa6Ek=";
+    })
   ];
 
   build-system = [
@@ -98,6 +104,9 @@ buildPythonPackage rec {
     "test_argument_device_expansion"
     "test_argument_file_expansion"
     "test_local_managedfile"
+
+    # flaky: teardown race on x86_64-linux
+    "test_remoteplace_target"
   ];
 
   pytestFlags = [ "--benchmark-disable" ];
diff --git a/pkgs/development/python-modules/modelscope/default.nix b/pkgs/development/python-modules/modelscope/default.nix
index 447cc70e3e02..0f2c57694056 100644
--- a/pkgs/development/python-modules/modelscope/default.nix
+++ b/pkgs/development/python-modules/modelscope/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "modelscope";
-  version = "1.36.3";
+  version = "1.37.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "modelscope";
     repo = "modelscope";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4AmilIVmsfi+mS+iUhd4MX8n/U8gowkL0dnFpJ90iGQ=";
+    hash = "sha256-kGcu1iojClUhj8KS+TY0WU8+dKRanqbkJmXwSE0EoLk=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/paddleocr/default.nix b/pkgs/development/python-modules/paddleocr/default.nix
index f923f7ea9e51..931e79dc1411 100644
--- a/pkgs/development/python-modules/paddleocr/default.nix
+++ b/pkgs/development/python-modules/paddleocr/default.nix
@@ -32,14 +32,14 @@
 
 buildPythonPackage rec {
   pname = "paddleocr";
-  version = "3.4.1";
+  version = "3.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "PaddlePaddle";
     repo = "PaddleOCR";
     tag = "v${version}";
-    hash = "sha256-9iodDGi2orALGga+Rozn4tgd9VyOx6Arm9y2v/ZfQmM=";
+    hash = "sha256-bcunbaocltKGeIeLG8447y6wMFXL08XF7pEhHgoqmrY=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/paddlex/default.nix b/pkgs/development/python-modules/paddlex/default.nix
index bd1ab59eeb2c..d4b6ad23d11b 100644
--- a/pkgs/development/python-modules/paddlex/default.nix
+++ b/pkgs/development/python-modules/paddlex/default.nix
@@ -25,16 +25,16 @@
   nix-update-script,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "paddlex";
-  version = "3.4.3";
+  version = "3.5.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "PaddlePaddle";
     repo = "PaddleX";
-    tag = "v${version}";
-    hash = "sha256-XQrRo4B/xn7uBbQv7YjfKaK4DLiTciGnXjb+dL1hkw4=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Q6JVv+7HC/HtEK/LgKhld29tMrk0KY+h9c5VGDfHyvE=";
   };
 
   build-system = [
@@ -44,6 +44,7 @@ buildPythonPackage rec {
 
   pythonRelaxDeps = [
     "pyyaml"
+    "numpy"
   ];
 
   dependencies = [
@@ -73,7 +74,7 @@ buildPythonPackage rec {
     homepage = "https://github.com/PaddlePaddle/PaddleX";
     license = lib.licenses.asl20;
     description = "All-in-One Development Tool based on PaddlePaddle";
-    changelog = "https://github.com/PaddlePaddle/PaddleX/releases/tag/${src.tag}";
+    changelog = "https://github.com/PaddlePaddle/PaddleX/releases/tag/${finalAttrs.src.tag}";
     maintainers = [ ];
     platforms = [
       "x86_64-linux"
@@ -82,4 +83,4 @@ buildPythonPackage rec {
       "aarch64-darwin"
     ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/prometheus-flask-exporter/default.nix b/pkgs/development/python-modules/prometheus-flask-exporter/default.nix
index 32a3ed949336..1d3e170eedc4 100644
--- a/pkgs/development/python-modules/prometheus-flask-exporter/default.nix
+++ b/pkgs/development/python-modules/prometheus-flask-exporter/default.nix
@@ -27,6 +27,8 @@ buildPythonPackage rec {
     prometheus-client
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [ pytestCheckHook ];
 
   enabledTestPaths = [ "tests/" ];
@@ -34,6 +36,8 @@ buildPythonPackage rec {
   disabledTests = [
     # AssertionError
     "test_group_by_lambda_is_not_supported"
+    # prometheus-client 0.24 moved CONTENT_TYPE_LATEST to version=1.0.0 while choose_encoder still defaults to 0.0.4
+    "test_default_format"
   ];
 
   meta = {
diff --git a/pkgs/development/python-modules/publicsuffixlist/default.nix b/pkgs/development/python-modules/publicsuffixlist/default.nix
index 53d25389c762..27c3516fd522 100644
--- a/pkgs/development/python-modules/publicsuffixlist/default.nix
+++ b/pkgs/development/python-modules/publicsuffixlist/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "publicsuffixlist";
-  version = "1.0.2.20260514";
+  version = "1.0.2.20260515";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-sJhxWYOXtV4oYm4njrVAFxOA8BbPxHUjB4oeExSxCCM=";
+    hash = "sha256-qnDelCrTijATTHoi3kxSG2lKwbg10aYaFR5XqDbLfmM=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pysequoia/default.nix b/pkgs/development/python-modules/pysequoia/default.nix
index 83af787ac285..7ecd73151dbd 100644
--- a/pkgs/development/python-modules/pysequoia/default.nix
+++ b/pkgs/development/python-modules/pysequoia/default.nix
@@ -8,17 +8,17 @@
 
 buildPythonPackage rec {
   pname = "pysequoia";
-  version = "0.1.33";
+  version = "0.1.34";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-BNQJ8Ufggy3IfayPg+kfYwOXWuR5D3QIEJb/Zn7/xYA=";
+    hash = "sha256-pUJ+fMaV1NlcpOzcBqCdeYCe/XYd1Y9XdwKa1hBbU8k=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-M3cIgvdjyzVtFspwEfFEvey4gnyZoBLT6k2ADtrxZn4=";
+    hash = "sha256-qEn8+CySPwAV0zqbF4ooGsaXil7g6QJew7M+fbKsRqQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pytest-flake8/default.nix b/pkgs/development/python-modules/pytest-flake8/default.nix
index 9eb469bd84e8..82239cf430fc 100644
--- a/pkgs/development/python-modules/pytest-flake8/default.nix
+++ b/pkgs/development/python-modules/pytest-flake8/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch2,
   setuptools-scm,
   flake8,
   pytestCheckHook,
@@ -19,6 +20,14 @@ buildPythonPackage rec {
     hash = "sha256-uc5DOqqdoLfhzI2ogDOqhbJOHzdu+uqSOojIH+S1LZI=";
   };
 
+  patches = [
+    # Drop deprecated `path` arg from pytest_collect_file hook. (https://github.com/coherent-oss/pytest-flake8/issues/5)
+    (fetchpatch2 {
+      url = "https://raw.githubusercontent.com/OpenIndiana/oi-userland/0d06abedf17256d1f2c89086acc05cfa53dbc647/components/python/pytest-flake8/patches/02-deprecated-path.patch";
+      hash = "sha256-mHGRKaMmDTJdj6ajWS0Dts1ZTbT1bNLMjOOZAP156Jg=";
+    })
+  ];
+
   build-system = [ setuptools-scm ];
 
   dependencies = [ flake8 ];
diff --git a/pkgs/development/python-modules/python-tds/default.nix b/pkgs/development/python-modules/python-tds/default.nix
index 1b6fa7f8d92d..470fcff2092a 100644
--- a/pkgs/development/python-modules/python-tds/default.nix
+++ b/pkgs/development/python-modules/python-tds/default.nix
@@ -29,6 +29,11 @@ buildPythonPackage rec {
       --replace-fail "version.get_git_version()" '"${version}"'
   '';
 
+  preCheck = ''
+    # upstream conftest.py crashes without pytest-mypy installed
+    rm conftest.py
+  '';
+
   build-system = [ setuptools ];
 
   dependencies = [ six ];
@@ -42,6 +47,15 @@ buildPythonPackage rec {
     cryptography
   ];
 
+  disabledTestPaths = [
+    # requires live SQL Server / sqlalchemy fixtures
+    "tests/connected_test.py"
+    "tests/fedauth_test.py"
+    "tests/sqlalchemy_test.py"
+    "tests/transaction_test.py"
+    "tests/types_test.py"
+  ];
+
   disabledTests = [
     # ImportError: To use NTLM authentication you need to install ntlm-auth module
     # ntlm-auth has been removed from nixpkgs
@@ -60,6 +74,8 @@ buildPythonPackage rec {
     "test_encrypted_socket"
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   pythonImportsCheck = [ "pytds" ];
 
   meta = {
diff --git a/pkgs/development/python-modules/replicate/default.nix b/pkgs/development/python-modules/replicate/default.nix
index ee7b4587c82c..f00228e704ab 100644
--- a/pkgs/development/python-modules/replicate/default.nix
+++ b/pkgs/development/python-modules/replicate/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  pythonAtLeast,
   setuptools,
   httpx,
   packaging,
@@ -18,6 +19,9 @@ buildPythonPackage rec {
   version = "1.1.0b3";
   pyproject = true;
 
+  # uses pydantic.v1 compat layer, unsupported on 3.14
+  disabled = pythonAtLeast "3.14";
+
   src = fetchFromGitHub {
     owner = "replicate";
     repo = "replicate-python";
diff --git a/pkgs/development/python-modules/sentry-sdk/default.nix b/pkgs/development/python-modules/sentry-sdk/default.nix
index aac63e40f1de..16930a0c7b9d 100644
--- a/pkgs/development/python-modules/sentry-sdk/default.nix
+++ b/pkgs/development/python-modules/sentry-sdk/default.nix
@@ -223,12 +223,11 @@ buildPythonPackage (finalAttrs: {
     "test_span_templates_ai_dicts"
     "test_span_templates_ai_objects"
   ]
-  ++
-    lib.optionals (pythonAtLeast "3.14" && stdenv.hostPlatform.isx86_64 && stdenv.hostPlatform.isDarwin)
-      [
-        # profiler_id not populated on darwin
-        "test_segment_span_has_profiler_id"
-      ];
+  ++ lib.optionals (pythonAtLeast "3.14" && stdenv.hostPlatform.isDarwin) [
+    # profiler_id not populated on darwin
+    "test_profile_stops_when_segment_ends"
+    "test_segment_span_has_profiler_id"
+  ];
 
   pythonImportsCheck = [ "sentry_sdk" ];
 
diff --git a/pkgs/development/python-modules/serialx/default.nix b/pkgs/development/python-modules/serialx/default.nix
index 077891120c37..907bb0c27796 100644
--- a/pkgs/development/python-modules/serialx/default.nix
+++ b/pkgs/development/python-modules/serialx/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "serialx";
-  version = "1.7.2";
+  version = "1.7.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "puddly";
     repo = "serialx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-A8LdFpxnnluAlwVvNly4IfvCS8eZMDil6OmI4b9kGOA=";
+    hash = "sha256-KZeKH0sy5GZESwbwWOr/j51UtQjwm98E1Phu0D+Ailo=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
diff --git a/pkgs/development/python-modules/yoto-api/default.nix b/pkgs/development/python-modules/yoto-api/default.nix
index dd9f86db0f9f..219b104cf77e 100644
--- a/pkgs/development/python-modules/yoto-api/default.nix
+++ b/pkgs/development/python-modules/yoto-api/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "yoto-api";
-  version = "2.2.6";
+  version = "2.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cdnninja";
     repo = "yoto_api";
     tag = "v${version}";
-    hash = "sha256-f0bRi/4v71/jNYrONlTloFknP6xnXV3uirJMKUje5LY=";
+    hash = "sha256-kL3Ry3sRyDTKlhVUQ8rOCm2G8JkFZCmTwoInR6og73s=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/tools/misc/binutils/2.38/default.nix b/pkgs/development/tools/misc/binutils/2.38/default.nix
index 76fd22da449a..1354fddf50a9 100644
--- a/pkgs/development/tools/misc/binutils/2.38/default.nix
+++ b/pkgs/development/tools/misc/binutils/2.38/default.nix
@@ -8,6 +8,7 @@
   buildPackages,
   fetchFromGitHub,
   fetchurl,
+  fetchpatch,
   flex,
   gettext,
   lib,
@@ -84,6 +85,15 @@ stdenv.mkDerivation {
     # https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=99852365513266afdd793289813e8e565186c9e6
     # https://github.com/NixOS/nixpkgs/issues/170946
     ./deterministic-temp-prefixes.patch
+
+    # Fix gcc-15 build:
+    # https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=8ebe62f3f0d27806b1bf69f301f5e188b4acd2b4
+    (fetchpatch {
+      name = "gcc-15.patch";
+      url = "https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=8ebe62f3f0d27806b1bf69f301f5e188b4acd2b4";
+      hash = "sha256-Od0PXWKoo9rKhveZ1rWJsdpS17fgmU2AevcVWXvWkSA=";
+      excludes = [ "opcodes/s390-opc.c" ];
+    })
   ]
   ++ lib.optional targetPlatform.isiOS ./support-ios.patch
   ++ lib.optional stdenv.targetPlatform.isWindows ./windres-locate-gcc.patch
diff --git a/pkgs/games/tibia/default.nix b/pkgs/games/tibia/default.nix
deleted file mode 100644
index 04acf2b5fb5d..000000000000
--- a/pkgs/games/tibia/default.nix
+++ /dev/null
@@ -1,73 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  glibc,
-  libx11,
-  runtimeShell,
-  libGLU,
-  libGL,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "tibia";
-  version = "10.90";
-
-  src = fetchurl {
-    url = "http://static.tibia.com/download/tibia${lib.replaceStrings [ "." ] [ "" ] version}.tgz";
-    sha256 = "11mkh2dynmbpay51yfaxm5dmcys3rnpk579s9ypfkhblsrchbkhx";
-  };
-
-  shell = stdenv.shell;
-
-  # These binaries come stripped already and trying to strip after the
-  # files are in $out/res and after patchelf just breaks them.
-  # Strangely it works if the files are in $out but then nix doesn't
-  # put them in our PATH. We set all the files to $out/res because
-  # we'll be using a wrapper to start the program which will go into
-  # $out/bin.
-  dontStrip = true;
-
-  installPhase = ''
-    mkdir -pv $out/res
-    cp -r * $out/res
-
-    patchelf --set-interpreter ${glibc.out}/lib/ld-linux.so.2 \
-             --set-rpath ${
-               lib.makeLibraryPath [
-                 stdenv.cc.cc
-                 libx11
-                 libGLU
-                 libGL
-               ]
-             } \
-             "$out/res/Tibia"
-
-    # We've patchelf'd the files. The main ‘Tibia’ binary is a bit
-    # dumb so it looks for ‘./Tibia.dat’. This requires us to be in
-    # the same directory as the file itself but that's very tedious,
-    # especially with nix which changes store hashes. Here we generate
-    # a simple wrapper that we put in $out/bin which will do the
-    # directory changing for us.
-
-    mkdir -pv $out/bin
-
-    # The wrapper script itself. We use $LD_LIBRARY_PATH for libGL.
-    cat << EOF > "$out/bin/Tibia"
-    #!${runtimeShell}
-    cd $out/res
-    ${glibc.out}/lib/ld-linux.so.2 --library-path \$LD_LIBRARY_PATH ./Tibia "\$@"
-    EOF
-
-    chmod +x $out/bin/Tibia
-
-  '';
-
-  meta = {
-    description = "Top-down MMORPG set in a fantasy world";
-    homepage = "http://tibia.com";
-    license = lib.licenses.unfree;
-    platforms = [ "i686-linux" ];
-    maintainers = [ ];
-  };
-}
diff --git a/pkgs/os-specific/linux/apfs/default.nix b/pkgs/os-specific/linux/apfs/default.nix
index 405ec69e2cdc..5aa49720489b 100644
--- a/pkgs/os-specific/linux/apfs/default.nix
+++ b/pkgs/os-specific/linux/apfs/default.nix
@@ -8,7 +8,7 @@
 }:
 
 let
-  tag = "0.3.18";
+  tag = "0.3.20";
 in
 stdenv.mkDerivation {
   pname = "apfs";
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
     owner = "linux-apfs";
     repo = "linux-apfs-rw";
     tag = "v${tag}";
-    hash = "sha256-cyjaWNND8FIH6NOmLNxk/mYkYgQc4/SMpwXUVFGPe3c=";
+    hash = "sha256-sT84qK5rpPwxKVrtaIPpAUBvzFqNgTHaDHgKXWYCkV4=";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 6df6e6e8f35c..73a3705743b4 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2026.5.1";
+  version = "2026.5.2";
   components = {
     "3_day_blinds" =
       ps: with ps; [
@@ -1424,8 +1424,7 @@
       ];
     "duco" =
       ps: with ps; [
-        python-duco-client
-      ];
+      ]; # missing inputs: python-duco-connectivity
     "dunehd" =
       ps: with ps; [
         pdunehd
@@ -7653,7 +7652,6 @@
     "dsmr"
     "dsmr_reader"
     "duckdns"
-    "duco"
     "dunehd"
     "duotecno"
     "dwd_weather_warnings"
diff --git a/pkgs/servers/home-assistant/custom-components/auth_oidc/package.nix b/pkgs/servers/home-assistant/custom-components/auth_oidc/package.nix
index 196286b30579..e45457d9c237 100644
--- a/pkgs/servers/home-assistant/custom-components/auth_oidc/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/auth_oidc/package.nix
@@ -16,13 +16,13 @@
 buildHomeAssistantComponent rec {
   owner = "christaangoossens";
   domain = "auth_oidc";
-  version = "1.0.2";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "christiaangoossens";
     repo = "hass-oidc-auth";
     tag = "v${version}";
-    hash = "sha256-ZYJD0PVh2E07cdY1a7uxSxdooAMz78HwJpwr4uWofZM=";
+    hash = "sha256-hA4Nic5AerghZZVEFSFRpBwX+2vl/0HhTeFgwkd3QPE=";
   };
 
   postPatch = ''
@@ -37,7 +37,7 @@ buildHomeAssistantComponent rec {
   env.npmDeps = fetchNpmDeps {
     name = "${domain}-npm-deps";
     inherit src;
-    hash = "sha256-R5i4o2VnaXwgX72r6cBJULxSKadkU22vriMMWoMc5As=";
+    hash = "sha256-CmJ8AdD+AcqxwXK3lINJ0+8/feJM7dl9Q4cx7vftnMk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/home-assistant/custom-components/browser-mod/package.nix b/pkgs/servers/home-assistant/custom-components/browser-mod/package.nix
index ab0379ff29a4..0b6ee61243eb 100644
--- a/pkgs/servers/home-assistant/custom-components/browser-mod/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/browser-mod/package.nix
@@ -10,13 +10,13 @@
 buildHomeAssistantComponent rec {
   owner = "thomasloven";
   domain = "browser_mod";
-  version = "2.12.0";
+  version = "2.13.2";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "hass-browser_mod";
     tag = "v${version}";
-    hash = "sha256-z2Q6s3Dg536/PxViUUbR3NMl30y31i0xKFWGMn+vqEg=";
+    hash = "sha256-A0FxgLwm8MWFulFLL6qQmWd4DndMxg6zwqLfc/5WCbU=";
   };
 
   nativeBuildInputs = [
@@ -27,7 +27,7 @@ buildHomeAssistantComponent rec {
 
   npmDeps = fetchNpmDeps {
     inherit src;
-    hash = "sha256-a17iqEw+aierisbYs+blFY3R0Tsm6zQ4A5i+Q6fExWg=";
+    hash = "sha256-eSyHX36QeNDPUnvq13bUsO1utn4oZO3Przeoa75MoVk=";
   };
 
   npmBuildScript = "build";
diff --git a/pkgs/servers/home-assistant/custom-components/dreo/package.nix b/pkgs/servers/home-assistant/custom-components/dreo/package.nix
index fea18ded82c5..4196f923bf01 100644
--- a/pkgs/servers/home-assistant/custom-components/dreo/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/dreo/package.nix
@@ -12,13 +12,13 @@
 buildHomeAssistantComponent rec {
   owner = "JeffSteinbok";
   domain = "dreo";
-  version = "1.8.4";
+  version = "1.8.8";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "hass-dreo";
     tag = "v${version}";
-    hash = "sha256-jfYWkqoSAuDDTqnUypbR/KOrF0kWQpjC2gDyle57bjk=";
+    hash = "sha256-ryatIbmaZThytYib5aMt1Kicvuk+WurxDlcP8OK+BXA=";
   };
 
   dependencies = [ websockets ];
diff --git a/pkgs/servers/home-assistant/custom-components/frigidaire/package.nix b/pkgs/servers/home-assistant/custom-components/frigidaire/package.nix
index 2a088cb6f4d1..55b026d870d6 100644
--- a/pkgs/servers/home-assistant/custom-components/frigidaire/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/frigidaire/package.nix
@@ -7,13 +7,13 @@
 buildHomeAssistantComponent rec {
   owner = "bm1549";
   domain = "frigidaire";
-  version = "0.1.9";
+  version = "0.1.17";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "home-assistant-frigidaire";
     tag = version;
-    hash = "sha256-10jVWJSP3yd0wmaiP/5qwS9nT98vtK9yrNQQIyWBMuk=";
+    hash = "sha256-j/rqgD5k6KPXhmD/v2fcyjgAJglqOY2/7f50zCsczWk=";
   };
 
   dependencies = [ frigidaire ];
diff --git a/pkgs/servers/home-assistant/custom-components/garmin_connect/package.nix b/pkgs/servers/home-assistant/custom-components/garmin_connect/package.nix
index 76aede544d9f..d2c0983671a4 100644
--- a/pkgs/servers/home-assistant/custom-components/garmin_connect/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/garmin_connect/package.nix
@@ -8,13 +8,13 @@
 buildHomeAssistantComponent rec {
   owner = "cyberjunky";
   domain = "garmin_connect";
-  version = "3.0.5";
+  version = "3.0.7";
 
   src = fetchFromGitHub {
     owner = "cyberjunky";
     repo = "home-assistant-garmin_connect";
     tag = version;
-    hash = "sha256-omHgfkrje5xR9gLnQpAz33+LtXm5eGJ8nERYBX4F2sY=";
+    hash = "sha256-qCpUMmxH/Fjm2vlC9o5IUuip8QvOUGuPCZTZOnC/uuM=";
   };
 
   dependencies = [
diff --git a/pkgs/servers/home-assistant/custom-components/ha_mcp_tools/package.nix b/pkgs/servers/home-assistant/custom-components/ha_mcp_tools/package.nix
index 5616b761e4f8..eabdd8e23b2c 100644
--- a/pkgs/servers/home-assistant/custom-components/ha_mcp_tools/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/ha_mcp_tools/package.nix
@@ -9,13 +9,13 @@
 buildHomeAssistantComponent rec {
   owner = "homeassistant-ai";
   domain = "ha_mcp_tools";
-  version = "7.4.1";
+  version = "7.5.0";
 
   src = fetchFromGitHub {
     owner = "homeassistant-ai";
     repo = "ha-mcp";
     tag = "v${version}";
-    hash = "sha256-F13BoZinPnv+tlkiVnG7iAkr2JdEbFE0RIEgmHa/yq4=";
+    hash = "sha256-qRWNh7kKFQZpgZjkpc/Qv2s16DdWFX35HLHIToYXccU=";
   };
 
   dependencies = [
diff --git a/pkgs/servers/home-assistant/custom-components/home_connect_alt/package.nix b/pkgs/servers/home-assistant/custom-components/home_connect_alt/package.nix
index 23b79ab0be6a..a31a6a8b1a7d 100644
--- a/pkgs/servers/home-assistant/custom-components/home_connect_alt/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/home_connect_alt/package.nix
@@ -8,13 +8,13 @@
 buildHomeAssistantComponent rec {
   owner = "ekutner";
   domain = "home_connect_alt";
-  version = "1.4.0";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     owner = "ekutner";
     repo = "home-connect-hass";
     tag = version;
-    hash = "sha256-y4IzSRJrqOeKAZN1kibmsV/l23hjSQIuOoeEdYmbmBo=";
+    hash = "sha256-zrLDV5rO+i0nAXGnPuuPbQKbB8TAjNL0eOcvDuLiOF0=";
   };
 
   dependencies = [ home-connect-async ];
diff --git a/pkgs/servers/home-assistant/custom-components/solax_modbus/package.nix b/pkgs/servers/home-assistant/custom-components/solax_modbus/package.nix
index 64207bd91170..a567221480e0 100644
--- a/pkgs/servers/home-assistant/custom-components/solax_modbus/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/solax_modbus/package.nix
@@ -8,13 +8,13 @@
 buildHomeAssistantComponent rec {
   owner = "wills106";
   domain = "solax_modbus";
-  version = "2026.05.1";
+  version = "2026.05.2";
 
   src = fetchFromGitHub {
     owner = "wills106";
     repo = "homeassistant-solax-modbus";
     tag = version;
-    hash = "sha256-x6XvN0EDh5GHZy+ye4arw8RJOixszW9G7AKS9OHEZLk=";
+    hash = "sha256-MDeS4gWpXbXD9z4OnZDHZ0jPlCDnJ0QpAvWgesRG3hM=";
   };
 
   dependencies = [ pymodbus ];
diff --git a/pkgs/servers/home-assistant/custom-components/tibber_local/package.nix b/pkgs/servers/home-assistant/custom-components/tibber_local/package.nix
index 7a937c53f795..6c99cd62cfae 100644
--- a/pkgs/servers/home-assistant/custom-components/tibber_local/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/tibber_local/package.nix
@@ -8,13 +8,13 @@
 buildHomeAssistantComponent rec {
   owner = "marq24";
   domain = "tibber_local";
-  version = "2026.4.0";
+  version = "2026.5.1";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "ha-tibber-pulse-local";
     tag = version;
-    hash = "sha256-xUyKSR0X9gZhU3SsLmNWr2v5BzPRkIfhZTehLOnCIWc=";
+    hash = "sha256-PjFPk/hwgpyCtjy/kRrLpDDpcGq+JwcsSA3P9NG+W/w=";
   };
 
   dependencies = [
diff --git a/pkgs/servers/home-assistant/custom-components/yoto_ha/package.nix b/pkgs/servers/home-assistant/custom-components/yoto_ha/package.nix
index e1b2181412b9..9aa56af0c638 100644
--- a/pkgs/servers/home-assistant/custom-components/yoto_ha/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/yoto_ha/package.nix
@@ -8,13 +8,13 @@
 buildHomeAssistantComponent rec {
   owner = "cdnninja";
   domain = "yoto";
-  version = "3.2.0";
+  version = "3.2.1";
 
   src = fetchFromGitHub {
     owner = "cdnninja";
     repo = "yoto_ha";
     tag = "v${version}";
-    hash = "sha256-t//Ox8Ytwjp7kTdz8k1QZyDyejW+mZBt1auncikBYb0=";
+    hash = "sha256-LaDjT28m5JHIDRcIx9bVy2PNlbEbDANGgdw8fnh+BRU=";
   };
 
   dependencies = [
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index faefbc37df74..649c52dbe56e 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -262,7 +262,7 @@ let
   extraBuildInputs = extraPackages python.pkgs;
 
   # Don't forget to run update-component-packages.py after updating
-  hassVersion = "2026.5.1";
+  hassVersion = "2026.5.2";
 
 in
 python.pkgs.buildPythonApplication rec {
@@ -283,13 +283,13 @@ python.pkgs.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     tag = version;
-    hash = "sha256-aOiJPhTaJZGbY4P9iPiIe/PrRU+IDQTNS1JFhAJyH4w=";
+    hash = "sha256-fKHYlXb1j5A6vQ3B/Pb2O7WD6t9ubsNQXc9f/gK79Pk=";
   };
 
   # Secondary source is pypi sdist for translations
   sdist = fetchPypi {
     inherit pname version;
-    hash = "sha256-Hp7jYLHMQbqYmuQVH/7XPmV6tgBdhCZXpNhmchxHCUg=";
+    hash = "sha256-Zt+I/gaIyVAAgL9MF3T0WxivqY3D28tdtJX+GLbSES0=";
   };
 
   build-system = with python.pkgs; [
diff --git a/pkgs/servers/home-assistant/frontend.nix b/pkgs/servers/home-assistant/frontend.nix
index 52f9ad852ec2..9a14ffb72866 100644
--- a/pkgs/servers/home-assistant/frontend.nix
+++ b/pkgs/servers/home-assistant/frontend.nix
@@ -8,7 +8,7 @@ buildPythonPackage (finalAttrs: {
   # the frontend version corresponding to a specific home-assistant version can be found here
   # https://github.com/home-assistant/home-assistant/blob/master/homeassistant/components/frontend/manifest.json
   pname = "home-assistant-frontend";
-  version = "20260429.3";
+  version = "20260429.4";
   format = "wheel";
 
   src = fetchPypi {
@@ -17,7 +17,7 @@ buildPythonPackage (finalAttrs: {
     pname = "home_assistant_frontend";
     dist = "py3";
     python = "py3";
-    hash = "sha256-P4UMMscDsoX1Cdki0pKkZCcv5qQUKTIk9qVt3ZirQts=";
+    hash = "sha256-fXoz0pQSGkJWtematid3JNVN2sHWckNXAo/BcTAKpOM=";
   };
 
   # there is nothing to strip in this package
diff --git a/pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix b/pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix
index a041f7e6c158..3f3b1f915ad9 100644
--- a/pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix
+++ b/pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "pytest-homeassistant-custom-component";
-  version = "0.13.330";
+  version = "0.13.331";
   pyproject = true;
 
   disabled = pythonOlder "3.13";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "MatthewFlamm";
     repo = "pytest-homeassistant-custom-component";
     tag = version;
-    hash = "sha256-d+wRZPHdSIjXe6vqC8P85nuThQsiEu/qA3CuIOajsZ0=";
+    hash = "sha256-sFL2O/uPrb45c1QrLLwnAcII2sUO7BhuWA1MuzXJKTE=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/servers/home-assistant/stubs.nix b/pkgs/servers/home-assistant/stubs.nix
index 3aba4a0529f4..bc65225719be 100644
--- a/pkgs/servers/home-assistant/stubs.nix
+++ b/pkgs/servers/home-assistant/stubs.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "homeassistant-stubs";
-  version = "2026.5.1";
+  version = "2026.5.2";
   pyproject = true;
 
   disabled = python.version != home-assistant.python.version;
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "KapJI";
     repo = "homeassistant-stubs";
     tag = version;
-    hash = "sha256-ZETq0RWm5lEYTnOj7eb6u8SKol3zJBNc6ywLD3sNxmk=";
+    hash = "sha256-BTYgsaOr82eqD2Cwf/Se1i2zUr6/cKgHaynCyGQKSAQ=";
   };
 
   build-system = [
diff --git a/pkgs/servers/home-assistant/tests.nix b/pkgs/servers/home-assistant/tests.nix
index 2990ea4a76cf..6cc038efdb63 100644
--- a/pkgs/servers/home-assistant/tests.nix
+++ b/pkgs/servers/home-assistant/tests.nix
@@ -137,10 +137,22 @@ let
       # 2026.5.0: after reload device is in loaded state instead of retry state
       "test_usb_device_reactivity"
     ];
+    honeywell_string_lights = [
+      # [2026.5.2] Failed: Description not found for placeholder `modulation` in component.honeywell_string_lights.config.abort.no_compatible_transmitters"
+      "test_no_compatible_transmitters"
+    ];
+    novy_cooker_hood = [
+      # [2026.5.2] Failed: Description not found for placeholder `modulation` in component.novy_cooker_hood.config.abort.no_compatible_transmitters
+      "test_no_compatible_transmitters"
+    ];
     zeroconf = [
       # multicast socket bind, not possible in the sandbox
       "test_subscribe_discovery"
     ];
+    zha = [
+      # [2026.5.2] assert <HardwareType.OTHER: 'other'> == <HardwareType... 'skyconnect'>
+      "test_detect_radio_hardware"
+    ];
   };
 in
 lib.listToAttrs (
diff --git a/pkgs/servers/nosql/mongodb/7.0.nix b/pkgs/servers/nosql/mongodb/7.0.nix
index de1fc7d8e3ec..ce62a058ec82 100644
--- a/pkgs/servers/nosql/mongodb/7.0.nix
+++ b/pkgs/servers/nosql/mongodb/7.0.nix
@@ -21,8 +21,8 @@ let
 in
 buildMongoDB {
   inherit avxSupport;
-  version = "7.0.32";
-  hash = "sha256-1jK7MhYF+61sa5jAqPpJwmYcXebIZgk/8gFn0037I+E=";
+  version = "7.0.34";
+  hash = "sha256-T6TvgDf8LfOb/Licf1Z4mTxPrRjUypU9ytw9DthqGfM=";
   patches = [
     # ModuleNotFoundError: No module named 'mongo_tooling_metrics':
     # NameError: name 'SConsToolingMetrics' is not defined:
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 30677fe10d08..604432b74e66 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -701,6 +701,7 @@ mapAliases {
   faustPhysicalModeling = warnAlias "'faustPhysicalModeling' has been renamed to 'faust-physicalmodeling'" faust-physicalmodeling; # Added 2026-02-08
   faustStk = throw "'faustStk' has been renamed to/replaced by 'faustPhysicalModeling'"; # Converted to throw 2025-10-27
   fbjni = throw "fbjni has been removed, as it was broken"; # Added 2025-08-25
+  fbpanel = throw "'fbpanel' has been removed as it was broken and unmaintained upstream"; # Added 2026-05-16
   fcitx5-catppuccin = throw "'fcitx5-catppuccin' has been renamed to/replaced by 'catppuccin-fcitx5'"; # Converted to throw 2025-10-27
   fcitx5-chinese-addons = throw "'fcitx5-chinese-addons' has been renamed to/replaced by 'qt6Packages.fcitx5-chinese-addons'"; # Converted to throw 2025-10-27
   fcitx5-configtool = throw "'fcitx5-configtool' has been renamed to/replaced by 'qt6Packages.fcitx5-configtool'"; # Converted to throw 2025-10-27
@@ -1104,6 +1105,7 @@ mapAliases {
   libgadu = throw "'libgadu' has been removed as upstream is unmaintained and has no dependents or maintainers in Nixpkgs"; # Added 2025-05-17
   libgda = throw "'libgda' has been renamed to/replaced by 'libgda5'"; # Converted to throw 2025-10-27
   libGDSII = libgdsii; # Added 2026-02-08
+  libgestures = throw "'libgestures' has been removed as it was broken and unmaintained upstream"; # Added 2026-05-09
   libgme = throw "'libgme' has been renamed to/replaced by 'game-music-emu'"; # Converted to throw 2025-10-27
   libgnome-games-support_2_0 = throw "'libgnome-games-support_2_0' has been removed. Upstream has converted this library to a copylib and no more releases will happen"; # Added 2026-03-27
   libgnome-keyring3 = throw "'libgnome-keyring3' has been renamed to/replaced by 'libgnome-keyring'"; # Converted to throw 2025-10-27
@@ -2080,6 +2082,7 @@ mapAliases {
   thrust = throw "'thrust' has been removed due to lack of maintenance"; # Added 2025-08-21
   thunderbird-128 = throw "Thunderbird 128 support ended in August 2025"; # Added 2025-09-30
   thunderbird-128-unwrapped = throw "Thunderbird 128 support ended in August 2025"; # Added 2025-09-30
+  tibia = throw "'tibia' has been removed from nixpkgs due to being broken and unmaintained"; # Added 2026-05-16
   ticpp = throw "'ticpp' has been removed due to being unmaintained"; # Added 2025-09-10
   tidb = throw "TiDB has been removed because of hard dependency on TiKV which is challenging to package"; # Added 2026-05-03
   timescaledb = throw "'timescaledb' has been removed. Use 'postgresqlPackages.timescaledb' instead."; # Added 2025-07-19
@@ -2255,6 +2258,7 @@ mapAliases {
     use the reference implementation 'xdg-terminal-exec' instead.
   " xdg-terminal-exec; # Added 2026-01-14
   xdragon = throw "'xdragon' has been renamed to/replaced by 'dragon-drop'"; # Converted to throw 2025-10-27
+  xf86-input-cmt = throw "'xf86-input-cmt' has been removed as it was broken and unmaintained upstream"; # Added 2026-05-09
   xf86_input_cmt = xf86-input-cmt; # Added 2025-12-12
   xf86_input_wacom = xf86-input-wacom; # Added 2025-12-12
   xf86_video_nested = xf86-video-nested; # added 2026-01-13
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 663907a0f1d2..893992d7ac21 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10951,8 +10951,6 @@ with pkgs;
     ];
   };
 
-  tibia = pkgsi686Linux.callPackage ../games/tibia { };
-
   ultrastar-creator = libsForQt5.callPackage ../tools/misc/ultrastar-creator { };
 
   ultrastar-manager = libsForQt5.callPackage ../tools/misc/ultrastar-manager { };
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 44800a08a5d5..e8fae734e416 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -2416,8 +2416,8 @@ with self;
     };
 
     preConfigure = ''
-      echo "LIB = ${pkgs.db.out}/lib" > config.in
-      echo "INCLUDE = ${pkgs.db.dev}/include" >> config.in
+      echo "LIB = ${pkgs.db4.out}/lib" > config.in
+      echo "INCLUDE = ${pkgs.db4.dev}/include" >> config.in
     '';
     meta = {
       description = "Perl extension for Berkeley DB version 2, 3, 4, 5 or 6";
@@ -2656,6 +2656,34 @@ with self;
       # Fix out of memory error on Perl 5.19.4 and later.
       ../development/perl-modules/boost-geometry-utils-fix-oom.patch
     ];
+    postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
+      # Clang on Darwin defaults to a newer C++ mode where the old bundled Boost
+      # headers no longer compile.
+      substituteInPlace Build.PL \
+        --replace-fail "extra_compiler_flags => [qw(-DHAS_BOOL)]" \
+          "extra_compiler_flags => [qw(-DHAS_BOOL -std=c++14)]"
+
+      # Avoid Boost.MPL enum wrappers that modern Clang rejects as out-of-range
+      # enum constant expressions.
+      substituteInPlace src/boost/numeric/conversion/detail/int_float_mixture.hpp \
+        --replace-fail '#include "boost/mpl/integral_c.hpp"' "" \
+        --replace-fail "mpl::integral_c<int_float_mixture_enum, integral_to_integral>" "int_float_mixture_constant<integral_to_integral>" \
+        --replace-fail "mpl::integral_c<int_float_mixture_enum, integral_to_float>" "int_float_mixture_constant<integral_to_float>" \
+        --replace-fail "mpl::integral_c<int_float_mixture_enum, float_to_integral>" "int_float_mixture_constant<float_to_integral>" \
+        --replace-fail "mpl::integral_c<int_float_mixture_enum, float_to_float>" "int_float_mixture_constant<float_to_float>"
+      perl -i -pe 'if ($. == 22) { $_ .= "  template<int_float_mixture_enum v> struct int_float_mixture_constant { static const int_float_mixture_enum value = v; typedef int_float_mixture_constant type; typedef int_float_mixture_enum value_type; operator int_float_mixture_enum() const { return value; } };\n" }' \
+        src/boost/numeric/conversion/detail/int_float_mixture.hpp
+
+      # Same workaround for the user-defined-type/builtin-type conversion enum.
+      substituteInPlace src/boost/numeric/conversion/detail/udt_builtin_mixture.hpp \
+        --replace-fail '#include "boost/mpl/integral_c.hpp"' "" \
+        --replace-fail "mpl::integral_c<udt_builtin_mixture_enum, builtin_to_builtin>" "udt_builtin_mixture_constant<builtin_to_builtin>" \
+        --replace-fail "mpl::integral_c<udt_builtin_mixture_enum, builtin_to_udt>" "udt_builtin_mixture_constant<builtin_to_udt>" \
+        --replace-fail "mpl::integral_c<udt_builtin_mixture_enum, udt_to_builtin>" "udt_builtin_mixture_constant<udt_to_builtin>" \
+        --replace-fail "mpl::integral_c<udt_builtin_mixture_enum, udt_to_udt>" "udt_builtin_mixture_constant<udt_to_udt>"
+      perl -i -pe 'if ($. == 21) { $_ .= "  template<udt_builtin_mixture_enum v> struct udt_builtin_mixture_constant { static const udt_builtin_mixture_enum value = v; typedef udt_builtin_mixture_constant type; typedef udt_builtin_mixture_enum value_type; operator udt_builtin_mixture_enum() const { return value; } };\n" }' \
+        src/boost/numeric/conversion/detail/udt_builtin_mixture.hpp
+    '';
     buildInputs = [
       ExtUtilsCppGuess
       ExtUtilsTypemapsDefault
@@ -7582,6 +7610,9 @@ with self;
     ];
     env.NIX_CFLAGS_COMPILE = "-I${pkgs.openssl.dev}/include";
     env.NIX_CFLAGS_LINK = "-L${lib.getLib pkgs.openssl}/lib -lcrypto";
+    # Needed on Darwin so Crypt::OpenSSL::Guess does not pick /usr/bin/openssl and mix
+    # system libcrypto with the Nix one (perl aborts: "loading libcrypto in an unsafe way").
+    env.OPENSSL_PREFIX = pkgs.openssl;
     meta = {
       description = "Perl wrapper around OpenSSL's AES library";
       license = with lib.licenses; [
@@ -18618,6 +18649,8 @@ with self;
       hash = "sha256-BGSH8ITBL6HIIq/8X33lbv7ZtIkFpCbmMaa5ScEU2Gw=";
     };
     outputs = [ "out" ];
+    # Keep generated XS code stable across rebuilds.
+    env.PERL_HASH_SEED = "0";
     buildInputs = [
       pkgs.apacheHttpd
       pkgs.apr
@@ -18626,6 +18659,8 @@ with self;
       ExtUtilsXSBuilder
     ];
     propagatedBuildInputs = [ (pkgs.apacheHttpdPackages.mod_perl.override { inherit perl; }) ];
+    # Avoid libtool misdetecting gcc as the linker.
+    configureFlags = [ "LD=ld" ];
     makeMakerFlags = [
       "--with-apache2-src=${pkgs.apacheHttpd.dev}"
       "--with-apache2-apxs=${pkgs.apacheHttpd.dev}/bin/apxs"
@@ -18635,10 +18670,10 @@ with self;
     ];
     preConfigure = ''
       # override broken prereq check
-      substituteInPlace configure --replace "prereq_check=\"\$PERL \$PERL_OPTS build/version_check.pl\"" "prereq_check=\"echo\""
+      substituteInPlace configure --replace-fail "prereq_check=\"\$PERL \$PERL_OPTS build/version_check.pl\"" "prereq_check=\"echo\""
     '';
     preBuild = ''
-      substituteInPlace apreq2-config --replace "dirname" "${pkgs.coreutils}/bin/dirname"
+      substituteInPlace apreq2-config --replace-fail "dirname" "${pkgs.coreutils}/bin/dirname"
     '';
     installPhase = ''
       mkdir $out
@@ -18667,6 +18702,8 @@ with self;
       rm -r $out/nix
     '';
     doCheck = false; # test would need to start apache httpd
+    # Apache::Test resolves localhost while generating glue/perl (Makefile.PL / t/TEST).
+    __darwinAllowLocalNetworking = true;
     meta = {
       description = "Wrapper for libapreq2's module/handle API";
       license = with lib.licenses; [ asl20 ];
@@ -20926,13 +20963,16 @@ with self;
     # Workaround build failure on -fno-common toolchains:
     #   ld: libPARI/libPARI.a(compat.o):(.bss+0x8): multiple definition of
     #   `overflow'; Pari.o:(.bss+0x80): first defined here
-    env.NIX_CFLAGS_COMPILE = "-fcommon -Wno-error=implicit-int -Wno-error=implicit-function-declaration";
+    env.NIX_CFLAGS_COMPILE = "-std=gnu17 -fcommon -Wno-error=implicit-int -Wno-error=implicit-function-declaration";
     preConfigure = "cp ${pari_tgz} pari-${pariversion}.tar.gz";
     makeMakerFlags = [ "pari_tgz=pari-${pariversion}.tar.gz" ];
     src = fetchurl {
       url = "mirror://cpan/authors/id/I/IL/ILYAZ/modules/Math-Pari-2.030528.tar.gz";
       hash = "sha256-Z/dNIWxpY1qxxuo+J84ZdQqUorVgrnKIuy1s9xT85sg=";
     };
+    patches = lib.optionals stdenv.hostPlatform.isDarwin [
+      ../development/perl-modules/Math-Pari-darwin-callback-abi.patch
+    ];
     meta = {
       description = "Perl interface to PARI";
       license = with lib.licenses; [
@@ -25906,10 +25946,10 @@ with self;
 
   NetPatricia = buildPerlPackage {
     pname = "Net-Patricia";
-    version = "1.22";
+    version = "1.24";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/G/GR/GRUBER/Net-Patricia-1.22.tar.gz";
-      hash = "sha256-cINakm4cWo0DJMcv/+6C7rfsbBQd7gT9RGggtk9xxVI=";
+      url = "mirror://cpan/authors/id/G/GR/GRUBER/Net-Patricia-1.24.tar.gz";
+      hash = "sha256-2U9SCATiVBsc0g5zNmcgqXPK9d0tJiODj8jWOYr9fts=";
     };
     propagatedBuildInputs = [
       NetCIDRLite
@@ -25928,6 +25968,11 @@ with self;
       url = "mirror://cpan/authors/id/R/RU/RURBAN/Net-Ping-2.75.tar.gz";
       hash = "sha256-tH3zz9lpLM0Aca05/nRxjrwy9ZcBVWpgT9FaCfCeDXQ=";
     };
+    preCheck = ''
+      # On Linux these are skipped early ("no echo port"); on Darwin they proceed and
+      # hit external DNS (www.about.com), which fails in the sandbox.
+      rm -f t/400_ping_syn.t t/410_syn_host.t
+    '';
     meta = {
       description = "Check a remote host for reachability";
       license = with lib.licenses; [
@@ -30863,6 +30908,7 @@ with self;
         artistic1
         gpl1Plus
       ];
+      platforms = lib.platforms.linux; # configure probes PF_NETLINK; unavailable on Darwin
     };
   };