diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 3a33fef8b98c..21fb54fca7ec 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -16875,6 +16875,11 @@
     name = "Marcus";
     matrix = "@marker06:matrix.org";
   };
+  markhakansson = {
+    name = "Mark Håkansson";
+    github = "markhakansson";
+    githubId = 44841869;
+  };
   markus1189 = {
     email = "markus1189@gmail.com";
     github = "markus1189";
@@ -21013,6 +21018,12 @@
     githubId = 79252025;
     name = "Nicolas Benes";
   };
+  panicrune = {
+    email = "panicrune@tutamail.com";
+    github = "panicrune";
+    githubId = 161863235;
+    name = "panicrune";
+  };
   panky = {
     email = "dev@pankajraghav.com";
     github = "Panky-codes";
@@ -26912,12 +26923,6 @@
       }
     ];
   };
-  taliyahwebb = {
-    email = "taliyahmail@proton.me";
-    github = "taliyahwebb";
-    githubId = 161863235;
-    name = "Taliyah Webb";
-  };
   talkara = {
     email = "taito.horiuchi@relexsolutions.com";
     github = "talkara";
diff --git a/pkgs/applications/editors/neovim/build-neovim-plugin.nix b/pkgs/applications/editors/neovim/build-neovim-plugin.nix
index 09be43bdf14f..4ed1b6badb73 100644
--- a/pkgs/applications/editors/neovim/build-neovim-plugin.nix
+++ b/pkgs/applications/editors/neovim/build-neovim-plugin.nix
@@ -28,11 +28,12 @@ let
     version = attrs.version or old.version;
     __intentionallyOverridingVersion = true;
     rockspecVersion = old.rockspecVersion;
-
-    extraConfig = ''
-      -- to create a flat hierarchy
-      lua_modules_path = "lua"
-    '';
+    luarocksConfig = (old.luarocksConfig or { }) // {
+      # to create a flat hierarchy
+      lua_modules_path = "lua";
+      # neovim expects C modules to also be in the lua directory
+      lib_modules_path = "lua";
+    };
   });
 
   finalDrv = toVimPlugin (
diff --git a/pkgs/applications/emulators/wine/fonts.nix b/pkgs/applications/emulators/wine/fonts.nix
index 9620d51cb74e..94b2d74440a4 100644
--- a/pkgs/applications/emulators/wine/fonts.nix
+++ b/pkgs/applications/emulators/wine/fonts.nix
@@ -2,6 +2,7 @@
   stdenv,
   lib,
   callPackage,
+  installFonts,
 }:
 let
   src = (callPackage ./sources.nix { }).stable;
@@ -13,9 +14,9 @@ stdenv.mkDerivation {
   sourceRoot = "wine-${src.version}/fonts";
   inherit src;
 
-  installPhase = ''
-    install *.ttf -Dt $out/share/fonts/wine
-  '';
+  nativeBuildInputs = [
+    installFonts
+  ];
 
   meta = {
     description = "Microsoft replacement fonts by the Wine project";
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 2e8a4cbd64b6..5060b72393a0 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -45,13 +45,13 @@
     "vendorHash": "sha256-qjtyg+b3CfF24us0Fqw1KqKEbuoqL4eLe4QCuIAp4SE="
   },
   "aliyun_alicloud": {
-    "hash": "sha256-1CeivnFt+2RaO29JdqUhoHaIh/5K1dGG23Ca/P5fjT8=",
+    "hash": "sha256-IM7vrhWZG5aAm9qEdEthQJpLj/NPEPIVNzX3KFR8do0=",
     "homepage": "https://registry.terraform.io/providers/aliyun/alicloud",
     "owner": "aliyun",
     "repo": "terraform-provider-alicloud",
-    "rev": "v1.277.0",
+    "rev": "v1.278.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-1cvxBtsehwAhF48d/i8qTi6XJxxYMAeq1MAInuUE3Sw="
+    "vendorHash": "sha256-lBD9ifRpUwg45V7zZG3grHvndG0V42oiX68zgcM7t74="
   },
   "aminueza_minio": {
     "hash": "sha256-u3kCxgZ0Mg63TinXnncopP2nKpjnmXTUQYTN7g4DIRA=",
@@ -661,13 +661,13 @@
     "vendorHash": "sha256-JNTe1RI2aDw86jNzYJqmiBr5BBnr824/DhkJeaMpbKI="
   },
   "hashicorp_time": {
-    "hash": "sha256-ZArYfbzbrkxGlL1BRFM7PN3hLzdssIL4COsUBdLVMYY=",
+    "hash": "sha256-5+iPq2It3oFHPBHWshfIuNo1xkOPcuSYyljt6j+j7lg=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/time",
     "owner": "hashicorp",
     "repo": "terraform-provider-time",
-    "rev": "v0.13.1",
+    "rev": "v0.14.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-4XCCzB5Va1jtTn5vgIVKjQq4g8sKe0SIw3ynZExz/Vg="
+    "vendorHash": "sha256-boeh/lZHlBD/bQqLnrY9oul4GcRZUHT97FyhKb4nE/c="
   },
   "hashicorp_tls": {
     "hash": "sha256-r7nthgw7MycME+edQ4jHQQ33mmpNv3t/LDbD5IkXDYA=",
@@ -1229,13 +1229,13 @@
     "vendorHash": "sha256-skswuFKhN4FFpIunbom9rM/FVRJVOFb1WwHeAIaEjn8="
   },
   "spacelift-io_spacelift": {
-    "hash": "sha256-oS3Ikmi5wUlVbQos16x1BXoqhgOMIGyJcpl7sIXmDtk=",
+    "hash": "sha256-m8l0fmDo8lFu8xIqO3tVD0vHIvgWSKVE7J6BxKm7LSY=",
     "homepage": "https://registry.terraform.io/providers/spacelift-io/spacelift",
     "owner": "spacelift-io",
     "repo": "terraform-provider-spacelift",
-    "rev": "v1.48.0",
+    "rev": "v1.49.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-/4v25xY/fmfSAEALRbXu/a+x3nC1Ly/IJPOEKmYjgmw="
+    "vendorHash": "sha256-C8TE7uxMf6LOTS6v22mXwUdk2eqQRinwrCH4ZVUCx4k="
   },
   "splunk-terraform_signalfx": {
     "hash": "sha256-pzro0Uyu12u1pKy22GrZAktoTKngjn4h5mZpABqARk0=",
diff --git a/pkgs/by-name/ap/apache-jena/package.nix b/pkgs/by-name/ap/apache-jena/package.nix
index 88b7ce1f7fe7..9a2160db1c54 100644
--- a/pkgs/by-name/ap/apache-jena/package.nix
+++ b/pkgs/by-name/ap/apache-jena/package.nix
@@ -8,10 +8,10 @@
 
 stdenv.mkDerivation rec {
   pname = "apache-jena";
-  version = "6.0.0";
+  version = "6.1.0";
   src = fetchurl {
     url = "mirror://apache/jena/binaries/apache-jena-${version}.tar.gz";
-    hash = "sha256-N8TPKExwUNdlrPB23/qQm08io/JHq3bDzVoCd8ot6VQ=";
+    hash = "sha256-ZTEIqR/Zswmom8dWJYuuC8oBWHzvR1lC0RhS4766KuM=";
   };
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/by-name/as/astyle/package.nix b/pkgs/by-name/as/astyle/package.nix
index 3091be5059f1..3ed7b28e6e69 100644
--- a/pkgs/by-name/as/astyle/package.nix
+++ b/pkgs/by-name/as/astyle/package.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "astyle";
-  version = "3.6.15";
+  version = "3.6.16";
 
   src = fetchurl {
     url = "mirror://sourceforge/astyle/astyle-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-W0B31otZQWCJFs2KJjBGo1Yfl1k3A8BIMccwsjCoGuk=";
+    hash = "sha256-QU6dpM/e6zXY98Fw4V70OvX6AGbJ9ZKnRvcHHzVuzac=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/cg/cgit/package.nix b/pkgs/by-name/cg/cgit/package.nix
index f2c1c3a12266..e56eace373ec 100644
--- a/pkgs/by-name/cg/cgit/package.nix
+++ b/pkgs/by-name/cg/cgit/package.nix
@@ -23,21 +23,21 @@
   nixosTests,
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "cgit";
-  version = "1.3";
+  version = "1.3.1";
 
   src = fetchurl {
-    url = "https://git.zx2c4.com/cgit/snapshot/cgit-1.3.tar.xz";
-    sha256 = "836b6edbc7f99e11037a8b928d609ce346ed77a55545e17fff8cea59b5b7aa42";
+    url = "https://git.zx2c4.com/cgit/snapshot/cgit-${finalAttrs.version}.tar.xz";
+    sha256 = "c40fd71e120783d5e57d822208f3e17333cde2cd4baf3e7c8c75630b68afe12a";
   };
 
   # cgit is tightly coupled with git and needs a git source tree to build.
   # IMPORTANT: Remember to check which git version cgit needs on every version
   # bump (look for "GIT_VER" in the top-level Makefile).
   gitSrc = fetchurl {
-    url = "mirror://kernel/software/scm/git/git-2.53.0.tar.xz";
-    hash = "sha256-WBi9fYCwYbu9/sikM9YJ3IgYoFmR9zH/xKVh4soYxlM=";
+    url = "mirror://kernel/software/scm/git/git-2.54.0.tar.xz";
+    hash = "sha256-9okWI2TBDeee+Jqo2/SHMesFfjTtu9IKylEM4BVGgaM=";
   };
 
   separateDebugInfo = true;
@@ -125,4 +125,4 @@ stdenv.mkDerivation {
       sternenseemann
     ];
   };
-}
+})
diff --git a/pkgs/by-name/ch/chiri/package.nix b/pkgs/by-name/ch/chiri/package.nix
index fdb6d7adc99e..dd91ef50edcb 100644
--- a/pkgs/by-name/ch/chiri/package.nix
+++ b/pkgs/by-name/ch/chiri/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   rustPlatform,
   fetchFromGitHub,
+  nix-update-script,
 
   # build tools
   cargo-tauri,
@@ -23,21 +24,21 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "chiri";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "SapphoSys";
     repo = "chiri";
     tag = "app-v${finalAttrs.version}";
-    hash = "sha256-VrENUwkItT+8C7JowoEfqjIX4RhThTm+4hntdm9ifVk=";
+    hash = "sha256-45a1mmh8dxrWw+UQzJcbPAujFjCYC4ovsGhdAn39LkI=";
   };
 
-  cargoHash = "sha256-2CDwuZiE4b5cBUPZs8l4pf9/FyvtSpRwNwQZ5gp85zc=";
+  cargoHash = "sha256-TLYiCdkF/uX3uIVwplI7L1b7Ta5LTRdKqFlmnvCxFFc=";
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_10;
-    hash = "sha256-z2AMfMYNEK4pmjlE5YXn1DRCGyIcOO0EWCFlhXSxwrU=";
+    hash = "sha256-jDSljbGzEGDl0PsnjdmyhIGXX4fUPVeCndv5pUm/utE=";
     fetcherVersion = 3;
   };
 
@@ -103,6 +104,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   doCheck = false;
 
+  passthru.updateScript = nix-update-script;
+
   meta = {
     description = "Cross-platform CalDAV task management app";
     homepage = "https://github.com/SapphoSys/chiri";
diff --git a/pkgs/by-name/co/cosmic-applets/package.nix b/pkgs/by-name/co/cosmic-applets/package.nix
index e2491669e99d..f6cc2e0e5795 100644
--- a/pkgs/by-name/co/cosmic-applets/package.nix
+++ b/pkgs/by-name/co/cosmic-applets/package.nix
@@ -20,14 +20,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-applets";
-  version = "1.0.12";
+  version = "1.0.13";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-applets";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-8/9Cj30bAxxtMhqFgWvYJiuApDNgclPPTYh7aNR6OAs=";
+    hash = "sha256-JeV29myWGiLagaFOGAtK1MAIJVxYINe5TuNiArfBq54=";
   };
 
   cargoHash = "sha256-gA+dpodk6u8dv9VaKNi/xzI8ys39iztQdia+eGkzXs4=";
diff --git a/pkgs/by-name/co/cosmic-applibrary/package.nix b/pkgs/by-name/co/cosmic-applibrary/package.nix
index b1b3a70f8c11..4267b3fd971b 100644
--- a/pkgs/by-name/co/cosmic-applibrary/package.nix
+++ b/pkgs/by-name/co/cosmic-applibrary/package.nix
@@ -11,14 +11,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-applibrary";
-  version = "1.0.12";
+  version = "1.0.13";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-applibrary";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-deE9xXvRSZWSEdKPJr1HuA/gVs0a22lAVRmUnhwpDJM=";
+    hash = "sha256-IgRKdhs07FK8G4yRb+0d8JFKZv3Zkq/tp2pC4epkxaM=";
   };
 
   cargoHash = "sha256-uR0wm2+zmcec3esfYwgq4pRqSHkZnd3O8XhgnANf/1Q=";
diff --git a/pkgs/by-name/co/cosmic-bg/package.nix b/pkgs/by-name/co/cosmic-bg/package.nix
index c2cc636e9823..1b04f72d4853 100644
--- a/pkgs/by-name/co/cosmic-bg/package.nix
+++ b/pkgs/by-name/co/cosmic-bg/package.nix
@@ -13,7 +13,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-bg";
-  version = "1.0.12";
+  version = "1.0.13";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/co/cosmic-comp/package.nix b/pkgs/by-name/co/cosmic-comp/package.nix
index 7521c5b9cbde..2e932a1a6bdb 100644
--- a/pkgs/by-name/co/cosmic-comp/package.nix
+++ b/pkgs/by-name/co/cosmic-comp/package.nix
@@ -20,14 +20,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-comp";
-  version = "1.0.12";
+  version = "1.0.13";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-comp";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-C0s0u7g2LlLccaHsZLHvFs4JAPzQboEcqtwe0x8SVO4=";
+    hash = "sha256-sjWNWpwq3fWA7HQV6faP1VTFGfs/e0G0UgHuKk44Kak=";
   };
 
   cargoHash = "sha256-G2/nVy9I4iGZiG3+uVMnnqj82Wg2s5/SmNyQERqDhXY=";
diff --git a/pkgs/by-name/co/cosmic-edit/package.nix b/pkgs/by-name/co/cosmic-edit/package.nix
index 5bfbf3196277..b21228c50447 100644
--- a/pkgs/by-name/co/cosmic-edit/package.nix
+++ b/pkgs/by-name/co/cosmic-edit/package.nix
@@ -16,17 +16,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-edit";
-  version = "1.0.12";
+  version = "1.0.13";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-edit";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-ucDMl2qX7NApWxrfn4vk5eWrlESZNLBZCsR/tK0zwkI=";
+    hash = "sha256-KqdAz5CG9Gdsw/yWHCDhLwXNvmcASyzA6jdpbfcy3pM=";
   };
 
-  cargoHash = "sha256-iWZRxn0puWwAibjbj/jdk4t6qgETEUJUv612RZSavMw=";
+  cargoHash = "sha256-y7EpJrVq5dVP/t3UTsZrPbiHWGsFieLPo/DH0eM5OQE=";
 
   separateDebugInfo = true;
 
diff --git a/pkgs/by-name/co/cosmic-files/package.nix b/pkgs/by-name/co/cosmic-files/package.nix
index a0fd646b6c87..ef1d4e1694f6 100644
--- a/pkgs/by-name/co/cosmic-files/package.nix
+++ b/pkgs/by-name/co/cosmic-files/package.nix
@@ -12,17 +12,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-files";
-  version = "1.0.12";
+  version = "1.0.13";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-files";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-q9dNpSjwvqWTGaWg9VA4zJXQo8+YiYJ4qo/Ev4Nk4IY=";
+    hash = "sha256-/5PPDs2rDEGOMShclh+ZnX28zuF3MbQ7W+Rze1xIPu4=";
   };
 
-  cargoHash = "sha256-tMSqyl75XK2rgqRtgHAPtr+KFotx61HGqzv0iqzakS8=";
+  cargoHash = "sha256-1sY/V+/hd4vzjiufdLR8BIG5FC0F2sLbe8M2VqbinEU=";
 
   separateDebugInfo = true;
   __structuredAttrs = true;
diff --git a/pkgs/by-name/co/cosmic-greeter/package.nix b/pkgs/by-name/co/cosmic-greeter/package.nix
index 21ffc2a98e61..80296436169a 100644
--- a/pkgs/by-name/co/cosmic-greeter/package.nix
+++ b/pkgs/by-name/co/cosmic-greeter/package.nix
@@ -19,17 +19,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-greeter";
-  version = "1.0.12";
+  version = "1.0.13";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-greeter";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-mfgIVi/o5O715IX7Wt8QHfxzBX6ye+wztWU/GHaj9C0=";
+    hash = "sha256-+bxBm/IlOW4XKZhJDlr7Bp5h3sGIdVbTz1If5XWXkek=";
   };
 
-  cargoHash = "sha256-jhugV3eF7g6WU5ez3LzqKc/wP952Zpi8Hplg9SZflns=";
+  cargoHash = "sha256-mfY2hsMxBooRjmTB2jgUIKyKHBpGfZ9Qslwv+2aEQyg=";
 
   separateDebugInfo = true;
 
diff --git a/pkgs/by-name/co/cosmic-icons/package.nix b/pkgs/by-name/co/cosmic-icons/package.nix
index 21adcefeb9ee..dc3855fdfead 100644
--- a/pkgs/by-name/co/cosmic-icons/package.nix
+++ b/pkgs/by-name/co/cosmic-icons/package.nix
@@ -9,7 +9,7 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "cosmic-icons";
-  version = "1.0.12";
+  version = "1.0.13";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/co/cosmic-idle/package.nix b/pkgs/by-name/co/cosmic-idle/package.nix
index 273dc32db11a..1d13e46e3450 100644
--- a/pkgs/by-name/co/cosmic-idle/package.nix
+++ b/pkgs/by-name/co/cosmic-idle/package.nix
@@ -16,7 +16,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-idle";
-  version = "1.0.12";
+  version = "1.0.13";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/co/cosmic-initial-setup/package.nix b/pkgs/by-name/co/cosmic-initial-setup/package.nix
index 162a005de8ae..b1fd9cd7af06 100644
--- a/pkgs/by-name/co/cosmic-initial-setup/package.nix
+++ b/pkgs/by-name/co/cosmic-initial-setup/package.nix
@@ -14,14 +14,14 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-initial-setup";
-  version = "1.0.12";
+  version = "1.0.13";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-initial-setup";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-GyLh7vucn62SpxolYNjJodkb41BT1CDZdEa/TasJXYM=";
+    hash = "sha256-kAxGSXQ4w9rrcrFwtSPp22kZ5Uw6WhZ442i82v3ALRw=";
   };
 
   cargoHash = "sha256-DESnl5NjakU4++Ep6CHxDZzHn+o0Gi0eREpXk5BN5iY=";
diff --git a/pkgs/by-name/co/cosmic-launcher/package.nix b/pkgs/by-name/co/cosmic-launcher/package.nix
index ebd15f4a78e1..12e875206495 100644
--- a/pkgs/by-name/co/cosmic-launcher/package.nix
+++ b/pkgs/by-name/co/cosmic-launcher/package.nix
@@ -11,14 +11,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-launcher";
-  version = "1.0.12";
+  version = "1.0.13";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-launcher";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-pyfRGiVyXJPLoLdaeo7/TaW6+jm43SoPKk04NJLfLvc=";
+    hash = "sha256-dJxa11PCXpyN4m+bulcVGpqi6tphcVqNn7H2CgMHzPc=";
   };
 
   cargoHash = "sha256-wZgxlq9MVCeESH093MaQybVMyq50L7aYwj//2r/B0QM=";
diff --git a/pkgs/by-name/co/cosmic-notifications/package.nix b/pkgs/by-name/co/cosmic-notifications/package.nix
index d1269df6d353..1279ec7bd55f 100644
--- a/pkgs/by-name/co/cosmic-notifications/package.nix
+++ b/pkgs/by-name/co/cosmic-notifications/package.nix
@@ -12,7 +12,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-notifications";
-  version = "1.0.12";
+  version = "1.0.13";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/co/cosmic-osd/package.nix b/pkgs/by-name/co/cosmic-osd/package.nix
index ffddd73dacab..638ac576c928 100644
--- a/pkgs/by-name/co/cosmic-osd/package.nix
+++ b/pkgs/by-name/co/cosmic-osd/package.nix
@@ -15,14 +15,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-osd";
-  version = "1.0.12";
+  version = "1.0.13";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-osd";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-XpjU0Pad/xUK1vnpq4qT4UmfkBH8yuiOaC4EZWiphkE=";
+    hash = "sha256-zQL4kr7QpGKHD8Jwqv5h/U+QrCiHW5MEYTz+2/Oo1zY=";
   };
 
   cargoHash = "sha256-1YRWWI2qhCI0GrxBAAkGT/AbtkTHgdbYsG8obriZ+zg=";
diff --git a/pkgs/by-name/co/cosmic-panel/package.nix b/pkgs/by-name/co/cosmic-panel/package.nix
index 5637e5168235..1e4c647bb6fc 100644
--- a/pkgs/by-name/co/cosmic-panel/package.nix
+++ b/pkgs/by-name/co/cosmic-panel/package.nix
@@ -11,7 +11,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-panel";
-  version = "1.0.12";
+  version = "1.0.13";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/co/cosmic-player/package.nix b/pkgs/by-name/co/cosmic-player/package.nix
index e282b90ce106..ea4f000e0fff 100644
--- a/pkgs/by-name/co/cosmic-player/package.nix
+++ b/pkgs/by-name/co/cosmic-player/package.nix
@@ -18,17 +18,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-player";
-  version = "1.0.12";
+  version = "1.0.13";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-player";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-74iYH1jW5Tau9enem0SeLLTnWhaa/+ow1m3hvGfOt9c=";
+    hash = "sha256-UBZArnQqCtEHJAzfHKSdJaSmyuaAokqqIDad5vXYIZo=";
   };
 
-  cargoHash = "sha256-YPxbOSz/E3hoMT4dutk60jWJMpJHqOWpCSA91b+mHaE=";
+  cargoHash = "sha256-g/czcqTn6SPPkpM5jk4RCUGCd5o99gnMjddU0fhsYVI=";
 
   separateDebugInfo = true;
   __structuredAttrs = true;
diff --git a/pkgs/by-name/co/cosmic-randr/package.nix b/pkgs/by-name/co/cosmic-randr/package.nix
index 3e8821dcb032..6a181d7ebe3b 100644
--- a/pkgs/by-name/co/cosmic-randr/package.nix
+++ b/pkgs/by-name/co/cosmic-randr/package.nix
@@ -12,7 +12,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-randr";
-  version = "1.0.12";
+  version = "1.0.13";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/co/cosmic-reader/package.nix b/pkgs/by-name/co/cosmic-reader/package.nix
index 3bdcd5d8dcc3..176c9d4973e1 100644
--- a/pkgs/by-name/co/cosmic-reader/package.nix
+++ b/pkgs/by-name/co/cosmic-reader/package.nix
@@ -19,13 +19,13 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-reader";
-  version = "0-unstable-2026-04-16";
+  version = "0-unstable-2026-05-12";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-reader";
-    rev = "ebea761ab6853a9ac15b1bfc90b040d620d1d00f";
-    hash = "sha256-t2UKLip5SrKG4a3Eaqf8lS2hNtrqgz8eYpSTRCbrpfM=";
+    rev = "0dde6aed2c51b16e48d2756ceeb0c92620442418";
+    hash = "sha256-Is6SRWn7BbsT6GRsmPMDxQNzdGxSMXKM3hNVMV2NM7c=";
   };
 
   cargoHash = "sha256-p0dg5RNXkzbi+/RB5k+jr34RNOp+Irahj0BiFUddfnk=";
diff --git a/pkgs/by-name/co/cosmic-screenshot/package.nix b/pkgs/by-name/co/cosmic-screenshot/package.nix
index 4fa50f629a66..12a659a879f9 100644
--- a/pkgs/by-name/co/cosmic-screenshot/package.nix
+++ b/pkgs/by-name/co/cosmic-screenshot/package.nix
@@ -11,14 +11,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-screenshot";
-  version = "1.0.12";
+  version = "1.0.13";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-screenshot";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-vWLjMAyR2vgOGfIYZQFYPWGHx+T1ZrWAztm60qdHgBk=";
+    hash = "sha256-0vJ2vnmM9IiP7llil8BQN/YU/fmlLIOoJTQpp8o/OrA=";
   };
 
   cargoHash = "sha256-q0RJST1yeqPBjU5MseNZIrZw+brfDtQLKiw7wyViflE=";
diff --git a/pkgs/by-name/co/cosmic-session/package.nix b/pkgs/by-name/co/cosmic-session/package.nix
index a96f61bf4df9..2e1f5c7f875e 100644
--- a/pkgs/by-name/co/cosmic-session/package.nix
+++ b/pkgs/by-name/co/cosmic-session/package.nix
@@ -12,14 +12,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-session";
-  version = "1.0.12";
+  version = "1.0.13";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-session";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-ugVj4SIO77Fw9ET4zIyK3OJaRFH3ujbQBJ57Vc+f2Ao=";
+    hash = "sha256-FphY53MaOUUR2oQfZak3HbT+kvysUnw2AIc4L9O+TcU=";
   };
 
   cargoHash = "sha256-5dLG40X+yxJo566guyHqOCLNp+uNSE+HONS8GIDm58A=";
diff --git a/pkgs/by-name/co/cosmic-settings-daemon/package.nix b/pkgs/by-name/co/cosmic-settings-daemon/package.nix
index a79841654259..ce5c26914cce 100644
--- a/pkgs/by-name/co/cosmic-settings-daemon/package.nix
+++ b/pkgs/by-name/co/cosmic-settings-daemon/package.nix
@@ -16,7 +16,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-settings-daemon";
-  version = "1.0.12";
+  version = "1.0.13";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/co/cosmic-settings/package.nix b/pkgs/by-name/co/cosmic-settings/package.nix
index c6300e324015..661104987af5 100644
--- a/pkgs/by-name/co/cosmic-settings/package.nix
+++ b/pkgs/by-name/co/cosmic-settings/package.nix
@@ -27,14 +27,14 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-settings";
-  version = "1.0.12";
+  version = "1.0.13";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-settings";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-NRaavbpNUh4sSHwW0seSpJFBbH06nmKiofoJ4cmQFcY=";
+    hash = "sha256-idENXrYf92iVuw2Gb+8725nXfSNKoFMraDRaC+KcE0o=";
   };
 
   cargoHash = "sha256-O6d47H+vcSn9G6EIMpSshfL+cBJWZMYXHHKsu2n/huk=";
diff --git a/pkgs/by-name/co/cosmic-store/package.nix b/pkgs/by-name/co/cosmic-store/package.nix
index 9a8ec736a999..91c564377333 100644
--- a/pkgs/by-name/co/cosmic-store/package.nix
+++ b/pkgs/by-name/co/cosmic-store/package.nix
@@ -15,17 +15,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-store";
-  version = "1.0.12";
+  version = "1.0.13";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-store";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-oybxrzKofTbw8u8KMvcU0kODKZ3ttPtSfcoXRjgLq6s=";
+    hash = "sha256-4jD9Rv4K0xaqNvepbWIJ7BP3XzMErda4wcafJkSilJ0=";
   };
 
-  cargoHash = "sha256-DCqEXoJ1qTwKemSCGe7AwQCdOFw7Qh3PoxbB9XdLfHk=";
+  cargoHash = "sha256-uK9qXc6A1b1J/KOocUee2oVnVkubX0S7qtEwKcPwulI=";
 
   separateDebugInfo = true;
   __structuredAttrs = true;
diff --git a/pkgs/by-name/co/cosmic-term/package.nix b/pkgs/by-name/co/cosmic-term/package.nix
index b53241ee83d7..1ecda5b66cc5 100644
--- a/pkgs/by-name/co/cosmic-term/package.nix
+++ b/pkgs/by-name/co/cosmic-term/package.nix
@@ -15,17 +15,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-term";
-  version = "1.0.12";
+  version = "1.0.13";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-term";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-GpbLNr6B16hy7emdkjDfzOFfGgMOz6vfmmhCSL7lR5c=";
+    hash = "sha256-AG/yQg9LNmbB2K0SWAl2DEIcphdihEVhMBeIx3i76tk=";
   };
 
-  cargoHash = "sha256-9iHcmImA2tscpRuRKE/nUrwhR5RU5xA2zxJpcDt+2sE=";
+  cargoHash = "sha256-AYByonKIZWfNdaRIWijAv/8KUcO114hbZRH7Dx/MId8=";
 
   separateDebugInfo = true;
   __structuredAttrs = true;
diff --git a/pkgs/by-name/co/cosmic-wallpapers/package.nix b/pkgs/by-name/co/cosmic-wallpapers/package.nix
index 97b505e03623..b6e8c2daa482 100644
--- a/pkgs/by-name/co/cosmic-wallpapers/package.nix
+++ b/pkgs/by-name/co/cosmic-wallpapers/package.nix
@@ -7,7 +7,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "cosmic-wallpapers";
-  version = "1.0.12";
+  version = "1.0.13";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/co/cosmic-workspaces-epoch/package.nix b/pkgs/by-name/co/cosmic-workspaces-epoch/package.nix
index 2656c8198b12..2d55b4b3c5ef 100644
--- a/pkgs/by-name/co/cosmic-workspaces-epoch/package.nix
+++ b/pkgs/by-name/co/cosmic-workspaces-epoch/package.nix
@@ -14,14 +14,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-workspaces-epoch";
-  version = "1.0.12";
+  version = "1.0.13";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-workspaces-epoch";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-WYPVzFKMJ3Xhubr0rWW/u9Ex5NwuG2ZjSio6iWJwbCc=";
+    hash = "sha256-TdV/HeqUjaQcjAUDf5IP1GVwpc1gJEuOnu3Y0MlZoVs=";
   };
 
   cargoHash = "sha256-Z5dC3W8QoDBZWBjHwRj9MC8EScDjQwUiUcOPTRDToDA=";
diff --git a/pkgs/by-name/di/dillo/package.nix b/pkgs/by-name/di/dillo/package.nix
index e27b1d54e3a6..d48d66f85a22 100644
--- a/pkgs/by-name/di/dillo/package.nix
+++ b/pkgs/by-name/di/dillo/package.nix
@@ -1,7 +1,7 @@
 {
   lib,
   autoreconfHook,
-  fetchFromGitHub,
+  fetchFromCodeberg,
   fltk_1_3,
   libjpeg,
   libpng,
@@ -12,6 +12,7 @@
   pkg-config,
   stdenv,
   which,
+  nix-update-script,
   # Configurable options
   tlsLibrary ? "libressl",
 }:
@@ -27,13 +28,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "dillo";
-  version = "3.2.0";
+  version = "3.3.0";
 
-  src = fetchFromGitHub {
-    owner = "dillo-browser";
+  src = fetchFromCodeberg {
+    owner = "dillo";
     repo = "dillo";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-9nJq20iW8/UI3GgXWje+46WDSu3/omd1PN/uTlYCOac=";
+    hash = "sha256-MzfY5Wyrt7ChTxp+BPNuDG10D8CefhgHjuaSvAiquZI=";
   };
 
   nativeBuildInputs = [
@@ -59,6 +60,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   strictDeps = true;
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     homepage = "https://dillo-browser.github.io/";
     description = "Fast graphical web browser with a small footprint";
diff --git a/pkgs/by-name/dr/dragon-drop/package.nix b/pkgs/by-name/dr/dragon-drop/package.nix
index 9a3f5a7e64a2..a0ddcb95e703 100644
--- a/pkgs/by-name/dr/dragon-drop/package.nix
+++ b/pkgs/by-name/dr/dragon-drop/package.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [
       das_j
-      taliyahwebb
+      panicrune
     ];
     mainProgram = "dragon-drop";
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/fo/foot/package.nix b/pkgs/by-name/fo/foot/package.nix
index 01d9ab59d16f..2f18f121c896 100644
--- a/pkgs/by-name/fo/foot/package.nix
+++ b/pkgs/by-name/fo/foot/package.nix
@@ -27,7 +27,7 @@
 }:
 
 let
-  version = "1.26.1";
+  version = "1.27.0";
 
   # build stimuli file for PGO build and the script to generate it
   # independently of the foot's build, so we can cache the result
@@ -103,7 +103,7 @@ stdenv.mkDerivation {
     owner = "dnkl";
     repo = "foot";
     tag = version;
-    hash = "sha256-N9/lxbz9nLIGC7VyuRbNbuX0K0XAxhytLzsU16BMCWY=";
+    hash = "sha256-jbE44SpMqDhOOT2o4Wh7UCdXn6bBqxOMskCHHTzEKmU=";
   };
 
   separateDebugInfo = true;
diff --git a/pkgs/by-name/fr/fritzing/package.nix b/pkgs/by-name/fr/fritzing/package.nix
index cc14cf9f8898..b59df94f3cfe 100644
--- a/pkgs/by-name/fr/fritzing/package.nix
+++ b/pkgs/by-name/fr/fritzing/package.nix
@@ -87,7 +87,9 @@ stdenv.mkDerivation {
       --replace-fail "6.5.10" "${qt6.qtbase.version}"
 
     substituteInPlace src/simulation/ngspice_simulator.cpp \
-      --replace-fail 'path + "/" + libName' '"${libngspice}/lib/libngspice.so"'
+      --replace-fail 'path + "/" + libName' '"${
+        libngspice + "/lib/libngspice" + stdenv.hostPlatform.extensions.sharedLibrary
+      }"'
 
     mkdir parts
     cp -a ${parts}/* parts/
diff --git a/pkgs/by-name/go/go-ethereum/package.nix b/pkgs/by-name/go/go-ethereum/package.nix
index f2cef646489f..f3a004a8cc51 100644
--- a/pkgs/by-name/go/go-ethereum/package.nix
+++ b/pkgs/by-name/go/go-ethereum/package.nix
@@ -15,17 +15,17 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "go-ethereum";
-  version = "1.17.2";
+  version = "1.17.3";
 
   src = fetchFromGitHub {
     owner = "ethereum";
     repo = "go-ethereum";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-7otn9F+S4HJ2tWyn8w96NX3hWSLdApTwUL2zAyAW9Xw=";
+    hash = "sha256-BLcpUbE2lkXkpzYWSIVaLNXlFTvSuXw9Vm0iTtrqOKQ=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-rHTZmwy/ZHpsHNFh00mWXe6F8wEtL0JcLaehBwyvtJw=";
+  vendorHash = "sha256-AOdGqr738EgwbZhHHP3ctQYUilgyOc/tIJyaI0H3oeM=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/ha/harbor-cli/package.nix b/pkgs/by-name/ha/harbor-cli/package.nix
index 9ed4eac7841f..da71e8309da2 100644
--- a/pkgs/by-name/ha/harbor-cli/package.nix
+++ b/pkgs/by-name/ha/harbor-cli/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "harbor-cli";
-  version = "0.0.19";
+  version = "0.0.20";
 
   src = fetchFromGitHub {
     owner = "goharbor";
     repo = "harbor-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-X1+uke4X7JBN5kDrsVQ+oS6RkHG8fHt6lU6+9LPBNzk=";
+    hash = "sha256-ZpRnRxBF2N+sIvpQBxAFrMIJsZiqWTzcgygHoR+uXPc=";
   };
 
   vendorHash = "sha256-1Aj3QHQcswOmzeazk3Fr8gSP1VTok2U/NK3mCPSPC6o=";
diff --git a/pkgs/by-name/ll/lldpd/package.nix b/pkgs/by-name/ll/lldpd/package.nix
index 43a1418b91c5..8b2409643123 100644
--- a/pkgs/by-name/ll/lldpd/package.nix
+++ b/pkgs/by-name/ll/lldpd/package.nix
@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lldpd";
-  version = "1.0.21";
+  version = "1.0.22";
 
   src = fetchurl {
     url = "https://media.luffy.cx/files/lldpd/lldpd-${finalAttrs.version}.tar.gz";
-    hash = "sha256-WxsBBgeaB4W1XhvkXOxAtmtBd58+5vGo0tvXXTid8JE=";
+    hash = "sha256-lYeUDtIxSoZ3TFSZ89+xOo64YjKmLSQ6g6HwmIaEjgM=";
   };
 
   configureFlags = [
diff --git a/pkgs/by-name/md/mdbook-bib/package.nix b/pkgs/by-name/md/mdbook-bib/package.nix
new file mode 100644
index 000000000000..8f6955dbba22
--- /dev/null
+++ b/pkgs/by-name/md/mdbook-bib/package.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  openssl,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "mdbook-bib";
+  version = "0.5.2";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "francisco-perez-sorrosal";
+    repo = "mdbook-bib";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-xgGJYnOYUuxHs2sXzYKSZd0jLm/x/PoPsNHQcWpXkn8=";
+  };
+
+  cargoHash = "sha256-QyP+Mw/95NvjaAkr5eoeC49nLXCE9/TMPIWahJayqBQ=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+  ];
+
+  meta = {
+    description = "mdBook plugin for creating a bibliography & citations in your books";
+    homepage = "https://github.com/francisco-perez-sorrosal/mdbook-bib";
+    changelog = "https://github.com/francisco-perez-sorrosal/mdbook-bib/blob/v${finalAttrs.version}/CHANGELOG.md";
+    license = lib.licenses.mpl20;
+    maintainers = with lib.maintainers; [ markhakansson ];
+    mainProgram = "mdbook-bib";
+  };
+})
diff --git a/pkgs/by-name/mo/motus/package.nix b/pkgs/by-name/mo/motus/package.nix
new file mode 100644
index 000000000000..62f652e17ce9
--- /dev/null
+++ b/pkgs/by-name/mo/motus/package.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  fetchFromGitHub,
+  nix-update-script,
+  rustPlatform,
+  stdenv,
+  libxcb,
+  versionCheckHook,
+  withClipboard ? true,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  __structuredAttrs = true;
+  pname = "motus";
+  version = "0.4.0";
+
+  src = fetchFromGitHub {
+    owner = "oleiade";
+    repo = "motus";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-lMNXg6YYTxAycxOiVtBGrSHpccLwerIQcY25K/NkqMo=";
+  };
+
+  cargoHash = "sha256-6MKEHnB2MJVB4cNvz3JYlhuzxhzsA+Pq5OkpLNoAEyU=";
+
+  buildAndTestSubdir = "crates/motus-cli";
+
+  # The CLI crate version was not bumped to match the v0.4.0 release tag:
+  # https://github.com/oleiade/motus/issues/58
+  postPatch = ''
+    substituteInPlace crates/motus-cli/src/main.rs \
+      --replace-fail '#[command(version = "0.3.1")]' '#[command(version = "${finalAttrs.version}")]'
+  '';
+
+  buildNoDefaultFeatures = !withClipboard;
+
+  buildInputs = lib.optionals (withClipboard && stdenv.hostPlatform.isLinux) [ libxcb ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Dead simple password generator";
+    homepage = "https://github.com/oleiade/motus";
+    changelog = "https://github.com/oleiade/motus/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ britter ];
+    mainProgram = "motus";
+  };
+})
diff --git a/pkgs/by-name/pg/pgrok/package.nix b/pkgs/by-name/pg/pgrok/package.nix
index c51ce4967215..f651f430a818 100644
--- a/pkgs/by-name/pg/pgrok/package.nix
+++ b/pkgs/by-name/pg/pgrok/package.nix
@@ -11,12 +11,12 @@
 
 let
   pname = "pgrok";
-  version = "1.4.6";
+  version = "1.5.0";
   src = fetchFromGitHub {
     owner = "pgrok";
     repo = "pgrok";
     tag = "v${version}";
-    hash = "sha256-Meavhgq0xHRAfCgzdazC1wu8aDw39qQCZrVtZUScwgs=";
+    hash = "sha256-arPFccclBie3XOBt0q6UC96fPaPc7NmgQDMsd2H2bhI=";
   };
 in
 
@@ -42,10 +42,10 @@ buildGoModule {
       ;
     pnpm = pnpm_9;
     fetcherVersion = 3;
-    hash = "sha256-gVwwLTOA8rXsy8xg4uGPJyBdQ8yUqkiul9W5oKw6kGI=";
+    hash = "sha256-D8UZoN0ZnjB8CXQiHmBZwBEt57XGb5SDLg61xxSqNus=";
   };
 
-  vendorHash = "sha256-l/tUO7fevi+zUmUp6CQoVNrzMF7LIzbo2Qsa/ez6LiA=";
+  vendorHash = "sha256-ob8s1jYL2+JGaqjCsM10jgirPiEyTY4U3IVVlHVdoGQ=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/pr/protoc-gen-go-grpc/package.nix b/pkgs/by-name/pr/protoc-gen-go-grpc/package.nix
index aea9547dce27..129c33518995 100644
--- a/pkgs/by-name/pr/protoc-gen-go-grpc/package.nix
+++ b/pkgs/by-name/pr/protoc-gen-go-grpc/package.nix
@@ -7,17 +7,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "protoc-gen-go-grpc";
-  version = "1.6.1";
+  version = "1.6.2";
   modRoot = "cmd/protoc-gen-go-grpc";
 
   src = fetchFromGitHub {
     owner = "grpc";
     repo = "grpc-go";
     rev = "cmd/protoc-gen-go-grpc/v${finalAttrs.version}";
-    hash = "sha256-s6GZ9K0Wy18YF1RBL0RGDCbtCfAV2bskq6DNXwyorgg=";
+    hash = "sha256-I1sPfKhpCb/GNznKgEE2BZ11vAwJIc6HYf78/nIDRy4=";
   };
 
-  vendorHash = "sha256-+D3prb03c/Vgm+p3CxCZw14UMCvrDc1Cllzn1znZAE0=";
+  vendorHash = "sha256-lBOgdAE2FT5ZQxfG/ugqxtH5RB3946VJYjm+VUT1AEI=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ra/radicle-explorer/package.nix b/pkgs/by-name/ra/radicle-explorer/package.nix
index b09f047dadb6..7689932d4b7d 100644
--- a/pkgs/by-name/ra/radicle-explorer/package.nix
+++ b/pkgs/by-name/ra/radicle-explorer/package.nix
@@ -1,11 +1,9 @@
 {
-  radicle-httpd,
-  fetchFromGitHub,
   lib,
   buildNpmPackage,
-  writeText,
-  jq,
-  runCommand,
+  fetchFromGitHub,
+  radicle-httpd,
+  writers,
 }:
 
 let
@@ -14,106 +12,80 @@ let
   twemojiAssets = fetchFromGitHub {
     owner = "twitter";
     repo = "twemoji";
-    rev = "v14.0.2";
+    tag = "v14.0.2";
     hash = "sha256-YoOnZ5uVukzi/6bLi22Y8U5TpplPzB7ji42l+/ys5xI=";
     meta.license = [ lib.licenses.cc-by-40 ];
   };
-
-  mkPassthru = self: args: {
-    # radicle-explorer is configured through static build time configuration.
-    #
-    # Using this function you can override the this configuration, for example,
-    # to configure alternative preferred peers (which are shown in the UI by
-    # default).
-    #
-    # Example usage:
-    #
-    # ```nix
-    # radicle-explorer.withConfig {
-    #   preferredSeeds = [{
-    #     hostname = "seed.example.com";
-    #     port = 443;
-    #     scheme = "https";
-    #   }];
-    # }
-    # ```
-    withConfig =
-      config:
-      let
-        overrides = writeText "config-overrides.json" (builtins.toJSON config);
-        newConfig = runCommand "config.json" { } ''
-          ${jq}/bin/jq -s '.[0] * .[1]' ${(self args).src}/config/default.json ${overrides} > $out
-        '';
-      in
-      lib.fix (
-        final:
-        (self args).overrideAttrs (prev: {
-          preBuild = ''
-            ${prev.preBuild or ""}
-            cp ${newConfig} config/local.json
-          '';
-
-          passthru = prev.passthru // mkPassthru final args;
-        })
-      );
-  };
 in
-lib.fix (
-  self:
-  lib.makeOverridable (
-    {
-      npmDepsHash ? "sha256-8vmAs788PjdUTaQ5E8YLX0KiIPymJbH51oNaGZACe6I=",
-      patches ? [ ],
-    }@args:
-    buildNpmPackage {
-      pname = "radicle-explorer";
-      version = radicle-httpd.version;
-      inherit patches npmDepsHash;
 
-      # radicle-explorer uses the radicle-httpd API, and they are developed in the
-      # same repo. For this reason we pin the sources to each other, but due to
-      # radicle-httpd using a more limited sparse checkout we need to carry a
-      # separate hash.
-      src = radicle-httpd.src.override {
-        hash = "sha256-cnQsPWkRChC8yPrICRoUpGW2GGLB2TK9+3v8ZRGe3x0=";
-        sparseCheckout = [ ];
-      };
+buildNpmPackage (finalAttrs: {
+  pname = "radicle-explorer";
+  inherit (radicle-httpd) version;
 
-      postPatch = ''
-        patchShebangs --build ./scripts
-        mkdir -p "public/twemoji"
-        cp -t public/twemoji -r -- ${twemojiAssets}/assets/svg/*
-        : >scripts/install-twemoji-assets
-      '';
+  # radicle-explorer uses the radicle-httpd API, and they are developed in the
+  # same repo. For this reason we pin the sources to each other, but due to
+  # radicle-httpd using a more limited sparse checkout we need to carry a
+  # separate hash.
+  src = radicle-httpd.src.override {
+    hash = "sha256-cnQsPWkRChC8yPrICRoUpGW2GGLB2TK9+3v8ZRGe3x0=";
+    sparseCheckout = [ ];
+  };
 
-      dontConfigure = true;
-      doCheck = false;
+  npmDepsHash = "sha256-8vmAs788PjdUTaQ5E8YLX0KiIPymJbH51oNaGZACe6I=";
 
-      installPhase = ''
-        runHook preInstall
-        mkdir -p "$out"
-        cp -r -t "$out" build/*
-        runHook postInstall
-      '';
+  postPatch = ''
+    patchShebangs --build ./scripts
+    : >scripts/install-twemoji-assets
 
-      passthru = mkPassthru self args;
+    cp -r "${twemojiAssets}/assets/svg" public/twemoji
+  '';
 
-      meta = {
-        description = "Web frontend for Radicle";
-        longDescription = ''
-          Radicle Explorer is a web-frontend for Radicle which supports browsing
-          repositories, issues and patches on publicly available Radicle seeds.
+  preBuild = ''
+    if [[ $configFile ]]; then
+      cp "$configFile" config/local.json
+    fi
+  '';
 
-          This package builds the web interface, ready to be served by any web
-          server.
-        '';
+  installPhase = ''
+    runHook preInstall
 
-        homepage = "https://radicle.dev";
-        license = lib.licenses.gpl3;
+    mv build $out
 
-        teams = [ lib.teams.radicle ];
-        maintainers = with lib.maintainers; [ tazjin ];
-      };
-    }
-  )
-) { }
+    runHook postInstall
+  '';
+
+  # radicle-explorer is configured through static build time configuration.
+  #
+  # Using this function you can override this configuration, for example to
+  # configure alternative preferred peers (which are shown in the UI by default).
+  #
+  # Example usage:
+  #
+  # ```nix
+  # radicle-explorer.withConfig {
+  #   preferredSeeds = [{
+  #     hostname = "seed.example.com";
+  #     port = 443;
+  #     scheme = "https";
+  #   }];
+  # }
+  # ```
+  passthru.withConfig =
+    config:
+    finalAttrs.finalPackage.overrideAttrs { configFile = writers.writeJSON "config.json" config; };
+
+  meta = {
+    description = "Web frontend for Radicle";
+    longDescription = ''
+      Radicle Explorer is a web-frontend for Radicle which supports browsing
+      repositories, issues and patches on publicly available Radicle seeds.
+
+      This package builds the web interface, ready to be served by any web
+      server.
+    '';
+    homepage = "https://radicle.dev";
+    license = lib.licenses.gpl3;
+    teams = [ lib.teams.radicle ];
+    maintainers = with lib.maintainers; [ tazjin ];
+  };
+})
diff --git a/pkgs/by-name/ra/radicle-job/package.nix b/pkgs/by-name/ra/radicle-job/package.nix
index 7df15a219455..012ae7bdaa19 100644
--- a/pkgs/by-name/ra/radicle-job/package.nix
+++ b/pkgs/by-name/ra/radicle-job/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "radicle-job";
-  version = "0.5.2";
+  version = "0.6.0";
 
   src = fetchFromRadicle {
     seed = "seed.radicle.dev";
     repo = "z2UcCU1LgMshWvXj6hXSDDrwB8q8M";
     tag = "releases/v${finalAttrs.version}";
-    hash = "sha256-kFlSig0eiUdw6GHwacNHtuGkuW14CkHkc3okN2ZeTns=";
+    hash = "sha256-RZDItJq42yewct1kYnDLpr6Oun0AmHK9jMoQDORHkWc=";
   };
 
-  cargoHash = "sha256-kZg2X9GXyqr1kj82Pxq6+tjhIXAhOk0vMeU0owSi7gU=";
+  cargoHash = "sha256-kXgJEEvEAJTV9lok3f26WkEPHFHFopdqxSii49xwK+A=";
 
   nativeCheckInputs = [
     radicle-node
diff --git a/pkgs/by-name/re/retroarch-bare/wrapper.nix b/pkgs/by-name/re/retroarch-bare/wrapper.nix
index 8e19952f9e42..09337349dac7 100644
--- a/pkgs/by-name/re/retroarch-bare/wrapper.nix
+++ b/pkgs/by-name/re/retroarch-bare/wrapper.nix
@@ -31,7 +31,8 @@ let
   );
 in
 symlinkJoin {
-  name = "retroarch-with-cores-${lib.getVersion retroarch-bare}";
+  pname = "retroarch-with-cores";
+  version = lib.getVersion retroarch-bare;
 
   paths = [ retroarch-bare ] ++ cores;
 
diff --git a/pkgs/by-name/sa/sandbox-runtime/package.nix b/pkgs/by-name/sa/sandbox-runtime/package.nix
index 368f9ae8ce83..b463d9baa418 100644
--- a/pkgs/by-name/sa/sandbox-runtime/package.nix
+++ b/pkgs/by-name/sa/sandbox-runtime/package.nix
@@ -17,13 +17,15 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "sandbox-runtime";
-  version = "0.0.50";
+  version = "0.0.51";
+
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "anthropic-experimental";
     repo = "sandbox-runtime";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-L5MscAoXXaaUh0BgiDtVyjCdFneMP/w7jbE+1LVtRo0=";
+    hash = "sha256-/bvSbkW3cEopq6YHPS36uHEN53dVO5rhUoXt/nWdsRs=";
   };
 
   postPatch =
@@ -35,7 +37,7 @@ buildNpmPackage (finalAttrs: {
 
   strictDeps = true;
 
-  npmDepsHash = "sha256-YAzekNE9lOEMRaaGqLdpXMXgqh4kfGp4CF54ShS3xwA=";
+  npmDepsHash = "sha256-L/BJ0KCBYHAA6BaYZbzNFVPHJZHGnDnpZFo9XepKc4s=";
 
   postFixup =
     let
diff --git a/pkgs/by-name/si/signal-backup-deduplicator/package.nix b/pkgs/by-name/si/signal-backup-deduplicator/package.nix
index 5c098d7d46df..b4d496a8c88f 100644
--- a/pkgs/by-name/si/signal-backup-deduplicator/package.nix
+++ b/pkgs/by-name/si/signal-backup-deduplicator/package.nix
@@ -25,6 +25,9 @@ stdenv.mkDerivation {
     cryptopp
   ];
 
+  # Discards [[nodiscard]] return from ParseFromArray (protobuf 34).
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=unused-result";
+
   meta = {
     description = "Generate chunked backups for Signal messages";
     homepage = "https://gitlab.com/gerum/signal-backup-deduplicator";
diff --git a/pkgs/by-name/sl/slurm/package.nix b/pkgs/by-name/sl/slurm/package.nix
index 235a05912194..da347b5a949e 100644
--- a/pkgs/by-name/sl/slurm/package.nix
+++ b/pkgs/by-name/sl/slurm/package.nix
@@ -42,7 +42,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "slurm";
-  version = "25-11-5-1";
+  version = "25-11-6-1";
 
   # N.B. We use github release tags instead of https://www.schedmd.com/downloads.php
   # because the latter does not keep older releases.
@@ -51,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
     repo = "slurm";
     # The release tags use - instead of .
     rev = "slurm-${builtins.replaceStrings [ "." ] [ "-" ] finalAttrs.version}";
-    hash = "sha256-YGENCN4Ge8wftpSNSA9zw2xV0Ltd0wJMROY+fwOREE8=";
+    hash = "sha256-8Op/HP0v+cqhdPP6ZLmw+e/SSlFUznydD2pHpqr6kfU=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/ta/tageditor/package.nix b/pkgs/by-name/ta/tageditor/package.nix
index 69e4e2364e6a..7e59a5aa2209 100644
--- a/pkgs/by-name/ta/tageditor/package.nix
+++ b/pkgs/by-name/ta/tageditor/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tageditor";
-  version = "3.9.9";
+  version = "3.9.10";
 
   src = fetchFromGitHub {
     owner = "martchus";
     repo = "tageditor";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xBb2VXDXScSUoMU2qTD2Q18WvjZZadWa7wtOXnQbLTU=";
+    hash = "sha256-tjJFYVcl6g1vhH40bJOcRCPhge12L6rLQ1lUOBF8DPM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ti/tinygo/package.nix b/pkgs/by-name/ti/tinygo/package.nix
index 31a33629858e..e62935a3fc6b 100644
--- a/pkgs/by-name/ti/tinygo/package.nix
+++ b/pkgs/by-name/ti/tinygo/package.nix
@@ -38,13 +38,13 @@ in
 
 buildGoModule (finalAttrs: {
   pname = "tinygo";
-  version = "0.40.1";
+  version = "0.41.1";
 
   src = fetchFromGitHub {
     owner = "tinygo-org";
     repo = "tinygo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+dLdQdq47M+HKjiMQI1/NJZqiRFuR8rnv/osCbFTpQE=";
+    hash = "sha256-8Zpvhx+xgC/Cjdm3zSpntLKOT4HsBU7lPWdLumWeFyw=";
     fetchSubmodules = true;
     # The public hydra server on `hydra.nixos.org` is configured with
     # `max_output_size` of 3GB. The purpose of this `postFetch` step
@@ -55,7 +55,7 @@ buildGoModule (finalAttrs: {
     '';
   };
 
-  vendorHash = "sha256-+962anRjsh1N0QHgEQIL8Dqwwsbps+LLEDpqCFBHksM=";
+  vendorHash = "sha256-OO8o/s71jZIypfYZCLT6jwUPyQJ89AKg3DfzTrbrD/A=";
 
   patches = [
     ./0001-GNUmakefile.patch
diff --git a/pkgs/by-name/ve/versatiles/package.nix b/pkgs/by-name/ve/versatiles/package.nix
index cf41bac15e9f..34519c00bb94 100644
--- a/pkgs/by-name/ve/versatiles/package.nix
+++ b/pkgs/by-name/ve/versatiles/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "versatiles";
-  version = "4.0.0";
+  version = "4.1.0";
 
   src = fetchFromGitHub {
     owner = "versatiles-org";
     repo = "versatiles-rs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WqR0q9e19SoG4QBAPIa/sPSFCwpegbprQ6QCzzEUsVU=";
+    hash = "sha256-U83jh74h1GKb6JKO62mDfDa8monknUqQ33oXlC6E6Q0=";
   };
 
-  cargoHash = "sha256-sj2mvty9GLKOJF3W6lNHrUnWaDEcAyB0vf5Pe5hlWsI=";
+  cargoHash = "sha256-yD4oBrk8GaI9E7Lq1Z45yqFTpRnLgNXq6CyzzV7Z/0Q=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix b/pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix
index a0f5ed4a0d48..78c101b4b370 100644
--- a/pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix
+++ b/pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix
@@ -17,14 +17,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "xdg-desktop-portal-cosmic";
-  version = "1.0.12";
+  version = "1.0.13";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "xdg-desktop-portal-cosmic";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-o1H5Cw20sgcE8I5L5u64YM6l+vhlHIcaY6cEH9it0gQ=";
+    hash = "sha256-/mUSpPdv8cSJ2oAuwIAYXjpy0Zy9ERarWMUrLEKf9a0=";
   };
 
   cargoHash = "sha256-/7jxEktXW1+4nFK7ZFUO3oJhmLNuKMwErnqwgjBQiao=";
diff --git a/pkgs/by-name/xd/xdg-ninja/package.nix b/pkgs/by-name/xd/xdg-ninja/package.nix
index c877a926600d..acf142e49e6d 100644
--- a/pkgs/by-name/xd/xdg-ninja/package.nix
+++ b/pkgs/by-name/xd/xdg-ninja/package.nix
@@ -10,13 +10,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "xdg-ninja";
-  version = "0-unstable-2026-04-29";
+  version = "0-unstable-2026-05-10";
 
   src = fetchFromGitHub {
     owner = "b3nj5m1n";
     repo = "xdg-ninja";
-    rev = "8d3c540111840b4765c7df5c79221508864c8366";
-    hash = "sha256-am8FF2C8BQOS0z6GT5MX2MIfSDNQX7vaeet2tLr05Sg=";
+    rev = "f2ab12bbf1cf60dc3cc9459d122811c55ba88150";
+    hash = "sha256-VNYZ9WKspAL2mUb1SDuGxv1MhOCBya7eEMJmy5H99xU=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/zl/zlcompressor/package.nix b/pkgs/by-name/zl/zlcompressor/package.nix
index a7fff69c4ddd..9417c80aeb1a 100644
--- a/pkgs/by-name/zl/zlcompressor/package.nix
+++ b/pkgs/by-name/zl/zlcompressor/package.nix
@@ -8,6 +8,7 @@
   darwin,
   ninja,
   pkg-config,
+  python3,
   writableTmpDirAsHomeHook,
 
   # buildInputs
@@ -29,13 +30,13 @@
 
 clangStdenv.mkDerivation (finalAttrs: {
   pname = "zlcompressor";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "ZL-Audio";
     repo = "ZLCompressor";
     tag = finalAttrs.version;
-    hash = "sha256-u+2cfCNjMUXo+7/qBUU4BdDQcUyeQfd9kvARi3AAK48=";
+    hash = "sha256-vSGadtUm6AEWEaNr3gCybEtc7NY3s3SQi8UVXoRsKCA=";
     fetchSubmodules = true;
   };
 
@@ -43,6 +44,7 @@ clangStdenv.mkDerivation (finalAttrs: {
     cmake
     ninja
     pkg-config
+    python3
     writableTmpDirAsHomeHook
   ]
   ++ lib.optionals clangStdenv.hostPlatform.isDarwin [ darwin.sigtool ];
@@ -93,6 +95,20 @@ clangStdenv.mkDerivation (finalAttrs: {
       if clangStdenv.hostPlatform.isAarch64 then "neon64" else "sse2;avx;avx2"
     ))
     (lib.cmakeBool "ZL_JUCE_COPY_PLUGIN" false)
+    # Highway is vendored as a submodule and built in single-target static
+    # dispatch mode (HWY_COMPILE_ONLY_STATIC), so exactly one SIMD target must
+    # be picked at build time. Accepted values: SSE2 / SSE4 / AVX2 / NEON.
+    #
+    # We pick SSE2 on x86_64 because that's the only SIMD extension guaranteed
+    # by nixpkgs' baseline x86_64-linux platform.
+    # Users who know their CPU supports more can opt in per-package:
+    #
+    #   zlcompressor.overrideAttrs (old: {
+    #     cmakeFlags = (old.cmakeFlags or []) ++ [ "-DZL_HWY_STATIC_TARGET=AVX2" ];
+    #   })
+    (lib.cmakeFeature "ZL_HWY_STATIC_TARGET" (
+      if clangStdenv.hostPlatform.isAarch64 then "NEON" else "SSE2"
+    ))
     # set the version for in the settings screen.
     (lib.cmakeFeature "FOOBAR_VERSION" "${finalAttrs.version}")
   ];
diff --git a/pkgs/development/compilers/sbcl/default.nix b/pkgs/development/compilers/sbcl/default.nix
index ddb5dc2d07e2..bee53af0ccc4 100644
--- a/pkgs/development/compilers/sbcl/default.nix
+++ b/pkgs/development/compilers/sbcl/default.nix
@@ -158,22 +158,6 @@ stdenv.mkDerivation (finalAttrs: {
       "threads.pure.lisp"
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      # This test has a gotcha on Darwin which originally showed up in
-      # 57b36ea5c83a1841b174ec6cd5e423439fe9d7a0, and later again around Oct
-      # 2025 in staging.  The test wants a clean environment (using
-      # run-program, akin to fork & execve), but darwin keeps injecting this
-      # envvar:
-      #
-      #   __CF_USER_TEXT_ENCODING=0x15F:0:0
-      #
-      # It’s not clear to maintainers where the problem lies exactly, but
-      # removing the test at least fixes the build and unblocks others.
-      #
-      # see:
-      # - https://github.com/NixOS/nixpkgs/pull/359214
-      # - https://github.com/NixOS/nixpkgs/pull/453099
-      "run-program.test.sh"
-
       # Fails in sandbox
       "sb-posix.impure.lisp"
     ];
diff --git a/pkgs/development/interpreters/php/generic.nix b/pkgs/development/interpreters/php/generic.nix
index b40972d7696f..c69bf85633b8 100644
--- a/pkgs/development/interpreters/php/generic.nix
+++ b/pkgs/development/interpreters/php/generic.nix
@@ -399,9 +399,15 @@ let
                 newPhpAttrsOverrides = lib.composeExtensions (lib.toExtension phpAttrsOverrides) (
                   lib.toExtension f
                 );
-                php = generic (args // { phpAttrsOverrides = newPhpAttrsOverrides; });
+                phpOverridden = finalAttrs.overrideAttrs f;
               in
-              php;
+              phpOverridden
+              // {
+                passthru = phpOverridden.passthru // {
+                  buildEnv = mkBuildEnv { phpAttrsOverrides = newPhpAttrsOverrides; } [ ];
+                  withExtensions = mkWithExtensions { phpAttrsOverrides = newPhpAttrsOverrides; } [ ];
+                };
+              };
             inherit ztsSupport;
 
             services.default = {
diff --git a/pkgs/development/python-modules/cwsandbox/default.nix b/pkgs/development/python-modules/cwsandbox/default.nix
new file mode 100644
index 000000000000..33f1ddd727c6
--- /dev/null
+++ b/pkgs/development/python-modules/cwsandbox/default.nix
@@ -0,0 +1,77 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  hatchling,
+
+  # dependencies
+  googleapis-common-protos,
+  grpcio,
+  protobuf,
+
+  # optional-dependencies
+  click,
+
+  # tests
+  pytest-asyncio,
+  pytestCheckHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "cwsandbox";
+  version = "0.23.0";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "coreweave";
+    repo = "cwsandbox-client";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-y9rsuAXmpMok0ZqdLhAfavglXh5Hz4VPy1UByYMM1WA=";
+  };
+
+  build-system = [
+    hatchling
+  ];
+
+  pythonRelaxDeps = [
+    "protobuf"
+  ];
+  dependencies = [
+    googleapis-common-protos
+    grpcio
+    protobuf
+  ];
+
+  optional-dependencies = {
+    cli = [
+      click
+    ];
+  };
+
+  pythonImportsCheck = [ "cwsandbox" ];
+
+  nativeCheckInputs = [
+    pytest-asyncio
+    pytestCheckHook
+  ]
+  ++ finalAttrs.passthru.optional-dependencies.cli;
+
+  disabledTests = [
+    # Failed: DID NOT RAISE any of (<class 'cwsandbox.exceptions.SandboxNotRunningError'>, <class 'cwsandbox.exceptions.SandboxTerminatedError'>)
+    "test_stop_while_waiting"
+  ];
+
+  meta = {
+    description = "Python client library for CoreWeave Sandbox";
+    homepage = "https://github.com/coreweave/cwsandbox-client";
+    changelog = "https://github.com/coreweave/cwsandbox-client/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    license = with lib.licenses; [
+      asl20
+      bsd3
+    ];
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+})
diff --git a/pkgs/development/python-modules/fava-dashboards/default.nix b/pkgs/development/python-modules/fava-dashboards/default.nix
index 592792660bad..f491284adf9d 100644
--- a/pkgs/development/python-modules/fava-dashboards/default.nix
+++ b/pkgs/development/python-modules/fava-dashboards/default.nix
@@ -11,14 +11,14 @@
 }:
 buildPythonPackage rec {
   pname = "fava-dashboards";
-  version = "2.0.0b7";
+  version = "2.0.0b8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "andreasgerstmayr";
     repo = "fava-dashboards";
     tag = "v${version}";
-    hash = "sha256-DtytD8LA/DoyBwXjpSHaEzwf7YJscV0yvMn9EpL6eh8=";
+    hash = "sha256-OK7gMppM71ah7BfzpFbv2bhfqLrx5tv1zIH+InjKCgM=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/moyopy/default.nix b/pkgs/development/python-modules/moyopy/default.nix
index 9cd1d80ad24d..ba3bbdb78128 100644
--- a/pkgs/development/python-modules/moyopy/default.nix
+++ b/pkgs/development/python-modules/moyopy/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "moyopy";
-  version = "0.8.0";
+  version = "0.9.0";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -24,7 +24,7 @@ buildPythonPackage (finalAttrs: {
     owner = "spglib";
     repo = "moyo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+rSB6y9dEbUSMaWwZYhKAabxBx8jkCiUQesPJbxii8w=";
+    hash = "sha256-aOkxA9oQjP7EEJ+VoXTy+Hb8wHZD1V3hS4Xwhc0GsOM=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/moyopy";
@@ -47,7 +47,7 @@ buildPythonPackage (finalAttrs: {
       sourceRoot
       cargoRoot
       ;
-    hash = "sha256-Hy//xgkF3UToKq135WT2Gp6fCz0uHzhU8DtGDtgM76o=";
+    hash = "sha256-+Qhxn2nvPN4FKlz6nyPtxQeHcu/3bgmtvkgAM2gp85I=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/wandb/default.nix b/pkgs/development/python-modules/wandb/default.nix
index 2bbc8c5923ec..5882f46164d6 100644
--- a/pkgs/development/python-modules/wandb/default.nix
+++ b/pkgs/development/python-modules/wandb/default.nix
@@ -43,6 +43,7 @@
   bokeh,
   boto3,
   cloudpickle,
+  cwsandbox,
   flask,
   google-cloud-artifact-registry,
   google-cloud-compute,
@@ -75,12 +76,12 @@
 }:
 
 let
-  version = "0.26.1";
+  version = "0.27.0";
   src = fetchFromGitHub {
     owner = "wandb";
     repo = "wandb";
     tag = "v${version}";
-    hash = "sha256-QtMjiRqE9ZhA1S8gHt1F8NBXTq7QQ3ENhk02Lry80F4=";
+    hash = "sha256-A/tEyY47BDgahOhQWlmeF2koEDpIsV9QVoYMIBEbKqA=";
   };
 
   wandb-xpu = rustPlatform.buildRustPackage {
@@ -90,7 +91,7 @@ let
 
     sourceRoot = "${src.name}/xpu";
 
-    cargoHash = "sha256-RPvtMV9Mrzb6lJhMR+fi58h/ncvbNkbIjAP35sdaOO0=";
+    cargoHash = "sha256-vB0LZjfnf//U1BXCzvaQBjlXLlGx/4g+emSZWcS+oGU=";
 
     checkFlags = [
       # fails in sandbox
@@ -120,13 +121,15 @@ let
 
     sourceRoot = "${src.name}/parquet-rust-wrapper";
 
-    cargoHash = "sha256-w98wliTcVJr4IlmKFVU+glmawMJl5qVCSUSJ8LeceJ8=";
+    cargoHash = "sha256-BkeSRbZoehYGHj15KcInugRBvOLXJlh1NqTHhRnNOK8=";
 
     # The original build script renames the library:
     # https://github.com/wandb/wandb/blob/v0.26.0/parquet-rust-wrapper/build.sh#L37-L68
     postInstall = ''
       mv $out/lib/libarrow_rs_wrapper${sharedLibrary} $out/lib/${libRustParquet}
     '';
+
+    __darwinAllowLocalNetworking = true;
   };
 
   wandb-core = buildGoModule {
@@ -136,8 +139,15 @@ let
     sourceRoot = "${src.name}/core";
 
     postPatch =
-      # hardcode the `wandb-xpu` binary path.
+      # Relax the Go toolchain requirement; nixpkgs ships 1.26.2.
       ''
+        substituteInPlace go.mod \
+          --replace-fail \
+            "go 1.26.3" \
+            "go 1.26.2"
+      ''
+      # hardcode the `wandb-xpu` binary path.
+      + ''
         substituteInPlace internal/monitor/xpuresourcemanager.go \
           --replace-fail \
             'cmdPath, err := getXPUCmdPath()' \
@@ -250,6 +260,7 @@ buildPythonPackage (finalAttrs: {
     bokeh
     boto3
     cloudpickle
+    cwsandbox
     flask
     google-cloud-artifact-registry
     google-cloud-compute
diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index 2af276c445ad..2ee18b683b9e 100644
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -15,14 +15,14 @@ let
   variants = {
     # ./update-xanmod.sh lts
     lts = {
-      version = "6.18.29";
-      hash = "sha256-k4wmkVO8fXHkdEHEyJt2tu36191CY0OHahsIz+5Loq0=";
+      version = "6.18.30";
+      hash = "sha256-INIvc/mSio+yRwyQPMaypUbk/0NqPijhC5s+W2gWAYE=";
       isLTS = true;
     };
     # ./update-xanmod.sh main
     main = {
-      version = "7.0.6";
-      hash = "sha256-JKNYtxPXvUU2eTFK8GrjmTY2WnLPPtZJmkEfAycNxgg=";
+      version = "7.0.7";
+      hash = "sha256-HlmUAGhwI0NciwTO/WBirk8oVCsw0qcX/YBKfPcLbWY=";
     };
   };
 
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index fbb01f03780e..6ba6117273f9 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -12,13 +12,13 @@ let
   # override options if they need using lib.mkForce (that has 50 priority)
   mkKernelOverride = lib.mkOverride 90;
 
-  suffix = "zen1";
+  suffix = "zen2";
 in
 
 buildLinux (
   args
   // rec {
-    version = "7.0.6";
+    version = "7.0.7";
     pname = "linux-zen";
     modDirVersion = lib.versions.pad 3 "${version}-${suffix}";
     isZen = true;
@@ -27,7 +27,7 @@ buildLinux (
       owner = "zen-kernel";
       repo = "zen-kernel";
       rev = "v${version}-${suffix}";
-      sha256 = "10kmw6nrcvgxmwz9mp6bjqs72ld2717zdvi7mgy4940q6rfz802f";
+      sha256 = "0b27mh7rndbyjbqf4gfivacgda9srkjlh1hdflasl0vq4sdy3d68";
     };
 
     # This is based on the following source:
diff --git a/pkgs/servers/monitoring/zabbix/versions.nix b/pkgs/servers/monitoring/zabbix/versions.nix
index 07f7fbd98bec..2dcb0f98273c 100644
--- a/pkgs/servers/monitoring/zabbix/versions.nix
+++ b/pkgs/servers/monitoring/zabbix/versions.nix
@@ -1,14 +1,14 @@
 generic: {
   v74 = generic {
-    version = "7.4.9";
-    hash = "sha256-+X7YkyghpR9kUQCt99SA6HWA606DhJwQT0T9VWrxr88=";
+    version = "7.4.10";
+    hash = "sha256-hVdgC5Nmby+JsQjpmYl3dA4I7DXyoCXaMLdggi6Wa/o=";
   };
   v70 = generic {
-    version = "7.0.25";
-    hash = "sha256-OkLoXanL2KrdEb/L4CHw+cbKpRD1ZON/OsEEaYSstyk=";
+    version = "7.0.26";
+    hash = "sha256-PCepe1LHXi7M+kPexeP9fVKHb1/dlBcklbAl7J8qE6g=";
   };
   v60 = generic {
-    version = "6.0.45";
-    hash = "sha256-duB2w2xDH9ZHEDh9iZ5Fr6RH0dI2lMCVvySA5dmSZcU=";
+    version = "6.0.46";
+    hash = "sha256-WwI1cv8iHXyOBhzBis/n0Wom9GQgFnCZoJrbOcpc4Ao=";
   };
 }
diff --git a/pkgs/servers/sql/postgresql/14.nix b/pkgs/servers/sql/postgresql/14.nix
index 8dd87f358533..184d0a7b3b73 100644
--- a/pkgs/servers/sql/postgresql/14.nix
+++ b/pkgs/servers/sql/postgresql/14.nix
@@ -1,7 +1,7 @@
 import ./generic.nix {
-  version = "14.22";
-  rev = "refs/tags/REL_14_22";
-  hash = "sha256-0vZEdsrj2WAdXFpZAli5sd0liAfvp9/Os93GjVTy7wk=";
+  version = "14.23";
+  rev = "refs/tags/REL_14_23";
+  hash = "sha256-fjoboaUhrHFDqusmIXzSS5ZnIpSRHO9+qcqvkchl2dM=";
   muslPatches = {
     disable-test-collate-icu-utf8 = {
       url = "https://git.alpinelinux.org/aports/plain/main/postgresql14/disable-test-collate.icu.utf8.patch?id=56999e6d0265ceff5c5239f85fdd33e146f06cb7";
diff --git a/pkgs/servers/sql/postgresql/15.nix b/pkgs/servers/sql/postgresql/15.nix
index ce7fa81ed7f2..633131478a21 100644
--- a/pkgs/servers/sql/postgresql/15.nix
+++ b/pkgs/servers/sql/postgresql/15.nix
@@ -1,7 +1,7 @@
 import ./generic.nix {
-  version = "15.17";
-  rev = "refs/tags/REL_15_17";
-  hash = "sha256-IxvCNJfTbbKT/2dFnNLk3fNUYDaRwHQeeAmvGc1w/OY=";
+  version = "15.18";
+  rev = "refs/tags/REL_15_18";
+  hash = "sha256-tw1zzgLXx7Jr4bi8rMKRmTJzOSQFGvrP2nHr9FcVrjs=";
   muslPatches = {
     dont-use-locale-a = {
       url = "https://git.alpinelinux.org/aports/plain/main/postgresql15/dont-use-locale-a-on-musl.patch?id=f424e934e6d076c4ae065ce45e734aa283eecb9c";
diff --git a/pkgs/servers/sql/postgresql/16.nix b/pkgs/servers/sql/postgresql/16.nix
index 45e381ced790..22027d48d97c 100644
--- a/pkgs/servers/sql/postgresql/16.nix
+++ b/pkgs/servers/sql/postgresql/16.nix
@@ -1,7 +1,7 @@
 import ./generic.nix {
-  version = "16.13";
-  rev = "refs/tags/REL_16_13";
-  hash = "sha256-Ue117xTq4RMQfq70mnXRBwqJ+IUigW27FvHY7I519ng=";
+  version = "16.14";
+  rev = "refs/tags/REL_16_14";
+  hash = "sha256-g2+OdB2dGIKBSFJ24Z3Yy7oRAFywNMSVDdWfnsaeJJQ=";
   muslPatches = {
     dont-use-locale-a = {
       url = "https://git.alpinelinux.org/aports/plain/main/postgresql16/dont-use-locale-a-on-musl.patch?id=08a24be262339fd093e641860680944c3590238e";
diff --git a/pkgs/servers/sql/postgresql/17.nix b/pkgs/servers/sql/postgresql/17.nix
index c0238d083db9..c5298a23de81 100644
--- a/pkgs/servers/sql/postgresql/17.nix
+++ b/pkgs/servers/sql/postgresql/17.nix
@@ -1,7 +1,7 @@
 import ./generic.nix {
-  version = "17.9";
-  rev = "refs/tags/REL_17_9";
-  hash = "sha256-kmESMgxYL5FsDjg3MLHaginIu6IWMo20kNdOLMM1x4w=";
+  version = "17.10";
+  rev = "refs/tags/REL_17_10";
+  hash = "sha256-3ZAqlT3R8ywhNH13oqz2VUbSwpOJ2JaICbxZ29awaMw=";
   muslPatches = {
     dont-use-locale-a = {
       url = "https://git.alpinelinux.org/aports/plain/main/postgresql17/dont-use-locale-a-on-musl.patch?id=d69ead2c87230118ae7f72cef7d761e761e1f37e";
diff --git a/pkgs/servers/sql/postgresql/18.nix b/pkgs/servers/sql/postgresql/18.nix
index babdf3866792..4d70b2474f27 100644
--- a/pkgs/servers/sql/postgresql/18.nix
+++ b/pkgs/servers/sql/postgresql/18.nix
@@ -1,7 +1,7 @@
 import ./generic.nix {
-  version = "18.3";
-  rev = "refs/tags/REL_18_3";
-  hash = "sha256-3cu3oyPJ5q6ewv7RFY7Nys5l+10dsQv5f1HNIoYtrO8=";
+  version = "18.4";
+  rev = "refs/tags/REL_18_4";
+  hash = "sha256-Ac/Dqcj8vjcW3my5vsnKaMiQqTq/HPtUzckJ3SMyrfA=";
   muslPatches = {
     dont-use-locale-a = {
       url = "https://git.alpinelinux.org/aports/plain/main/postgresql17/dont-use-locale-a-on-musl.patch?id=d69ead2c87230118ae7f72cef7d761e761e1f37e";
diff --git a/pkgs/servers/sql/postgresql/ext/pg_textsearch.nix b/pkgs/servers/sql/postgresql/ext/pg_textsearch.nix
index 53d22f6d06d6..1ca972d4d9d1 100644
--- a/pkgs/servers/sql/postgresql/ext/pg_textsearch.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_textsearch.nix
@@ -8,13 +8,13 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "pg_textsearch";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "timescale";
     repo = "pg_textsearch";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zZctWEJVItzJBke46J4CgvOAGDLmOZbCeUThkrnaPug";
+    hash = "sha256-aFuaz/gd72rdMdQKI12ENF+CrKPaiqxysHUYidkLsHc=";
   };
 
   passthru.tests.extension = postgresqlTestExtension {
diff --git a/pkgs/test/php/default.nix b/pkgs/test/php/default.nix
index f2f129925f04..c203bc026fce 100644
--- a/pkgs/test/php/default.nix
+++ b/pkgs/test/php/default.nix
@@ -2,6 +2,8 @@
   lib,
   php,
   runCommand,
+  stdenv,
+  stdenvAdapters,
 }:
 
 let
@@ -96,6 +98,26 @@ in
       ${check (builtins.match ".*oAs-second.*" customPhp.postInstall != null)}
     '';
 
+  # Regression test for https://github.com/NixOS/nixpkgs/issues/509863:
+  # wrapping php's stdenv with an adapter that uses `extendMkDerivationArgs`
+  # (e.g. `keepDebugInfo`) used to trigger an infinite recursion via the
+  # custom `passthru.overrideAttrs` defined for unwrapped php. Forcing the
+  # derivation here would stack-overflow before the fix; checking
+  # `dontStrip` also confirms the adapter actually applied.
+  stdenvAdapter-keepDebugInfo-does-not-recurse =
+    let
+      customPhp = php.override {
+        stdenv = stdenvAdapters.keepDebugInfo stdenv;
+      };
+    in
+    runTest "php-test-stdenvAdapter-keepDebugInfo-does-not-recurse" ''
+      checking "if the override evaluates without infinite recursion"
+      ${check (builtins.isString customPhp.unwrapped.drvPath)}
+
+      checking "if keepDebugInfo's dontStrip propagated to the unwrapped derivation"
+      ${check (customPhp.unwrapped.dontStrip or false)}
+    '';
+
   wrapped-overrideAttrs-stacks =
     let
       customPhp = lib.pipe php [
diff --git a/pkgs/tools/text/highlight/default.nix b/pkgs/tools/text/highlight/default.nix
index 8ced4e84e293..73af231b7e48 100644
--- a/pkgs/tools/text/highlight/default.nix
+++ b/pkgs/tools/text/highlight/default.nix
@@ -15,13 +15,13 @@
 let
   self = stdenv.mkDerivation rec {
     pname = "highlight";
-    version = "4.18";
+    version = "4.19";
 
     src = fetchFromGitLab {
       owner = "saalen";
       repo = "highlight";
       rev = "v${version}";
-      hash = "sha256-QYW6kj5cp+TVLXwj7kxbgj0kpN0n5qXYU3xZ5UW66vc=";
+      hash = "sha256-4sPjTLgC4W77alpE/uZHOrnWKVXrWxeCtK70A6G87s8=";
     };
 
     enableParallelBuilding = true;
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 1b0154130a67..725d9fc87a4f 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3476,6 +3476,8 @@ self: super: with self; {
 
   cwlformat = callPackage ../development/python-modules/cwlformat { };
 
+  cwsandbox = callPackage ../development/python-modules/cwsandbox { };
+
   cx-freeze = callPackage ../development/python-modules/cx-freeze { };
 
   cx-logging = callPackage ../development/python-modules/cx-logging { };