diff --git a/doc/release-notes/rl-2611.section.md b/doc/release-notes/rl-2611.section.md
index 5e674df1f8da..20aa808653cd 100644
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@@ -19,6 +19,13 @@
 
 - `uhttpmock` providing 0.0 ABI was removed. `uhttpmock_1_0` providing 1.0 ABI was renamed to `uhttpmock` and `uhttpmock_1_0` was kept as an alias.
 
+- Linux kernel configuration has been moved out of the `linux-kernel` field of the platform structure into the kernel builders:
+  - `linux-kernel.name` has been removed.
+  - `linux-kernel.target` is available as the `target` parameter and passthru attribute on the kernel builders.
+  - `linux-kernel.installTarget` has been removed, as it should not be necessary to customize.
+  - `linux-kernel.DTB` is available as the `buildDTBs` parameter and passthru attribute on the kernel builders.
+  - `linux-kernel.{autoModules,preferBuiltin,extraConfig}` were already available as kernel builder parameters.
+
 - The ARMv5 Linux kernel build now uses a standard configuration and generates a standard compressed image instead of the deprecated legacy U‐Boot image format.
   `lib.systems.{examples,platforms}.{sheevaplug,pogoplug4}` have been unified into `lib.systems.examples.armv5tel-multiplatform`.
   Note that there is no official support for ARMv5 and it is not possible to build even a simple NixOS configuration out of the box.
diff --git a/lib/systems/default.nix b/lib/systems/default.nix
index 0df2efacdfcb..53c095711aef 100644
--- a/lib/systems/default.nix
+++ b/lib/systems/default.nix
@@ -299,12 +299,10 @@ let
         inherit
           (
             {
-              linux-kernel = args.linux-kernel or { };
               gcc = args.gcc or { };
             }
             // platforms.select final
           )
-          linux-kernel
           gcc
           ;
 
@@ -692,6 +690,11 @@ let
         };
       };
     in
+    # TODO: Remove in 27.05.
+    assert
+      args ? linux-kernel
+      -> throw "lib.systems.elaborate: linux-kernel has been removed; see the 26.11 release notes";
+
     assert final.useAndroidPrebuilt -> final.isAndroid;
     assert foldl' (pass: { assertion, message }: if assertion final then pass else throw message) true (
       final.parsed.abi.assertions or [ ]
diff --git a/lib/systems/platforms.nix b/lib/systems/platforms.nix
index 7c49b40e53d4..bf10364f796c 100644
--- a/lib/systems/platforms.nix
+++ b/lib/systems/platforms.nix
@@ -3,74 +3,21 @@
 # targetPlatform, etc) containing at least the minimal set of attrs
 # required (see types.parsedPlatform in lib/systems/parse.nix).  This
 # file takes an already-valid platform and further elaborates it with
-# optional fields; currently these are: linux-kernel, gcc, and rustc.
+# optional fields; currently these are: gcc, and rustc.
 
 { lib }:
 rec {
-  pc = {
-    linux-kernel = {
-      name = "pc";
-
-      baseConfig = "defconfig";
-      # Build whatever possible as a module, if not stated in the extra config.
-      autoModules = true;
-      target = "bzImage";
-    };
-  };
-
-  ##
-  ## POWER
-  ##
-
-  powernv = {
-    linux-kernel = {
-      name = "PowerNV";
-
-      baseConfig = "powernv_defconfig";
-      target = "vmlinux";
-      autoModules = true;
-    };
-  };
-
-  ppc64 = {
-    linux-kernel = {
-      name = "powerpc64";
-
-      baseConfig = "ppc64_defconfig";
-      target = "vmlinux";
-      autoModules = true;
-    };
-  };
-
   ##
   ## ARM
   ##
 
   armv5tel-multiplatform = {
-    linux-kernel = {
-      name = "armv5tel-multiplatform";
-
-      baseConfig = "multi_v5_defconfig";
-      DTB = true;
-      autoModules = true;
-      preferBuiltin = true;
-      target = "zImage";
-    };
     gcc = {
       arch = "armv5te";
     };
   };
 
   raspberrypi = {
-    linux-kernel = {
-      name = "raspberrypi";
-
-      baseConfig = "bcm2835_defconfig";
-      DTB = true;
-      autoModules = true;
-      preferBuiltin = true;
-      target = "zImage";
-    };
     gcc = {
       # https://en.wikipedia.org/wiki/Raspberry_Pi#Specifications
       arch = "armv6kz";
@@ -105,7 +52,6 @@ rec {
 
   # https://developer.android.com/ndk/guides/abis#v7a
   armv7a-android = {
-    linux-kernel.name = "armeabi-v7a";
     gcc = {
       arch = "armv7-a";
       float-abi = "softfp";
@@ -114,14 +60,6 @@ rec {
   };
 
   armv7l-hf-multiplatform = {
-    linux-kernel = {
-      name = "armv7l-hf-multiplatform";
-      baseConfig = "defconfig";
-      DTB = true;
-      autoModules = true;
-      preferBuiltin = true;
-      target = "zImage";
-    };
     gcc = {
       # Some table about fpu flags:
       # http://community.arm.com/servlet/JiveServlet/showImage/38-1981-3827/blogentry-103749-004812900+1365712953_thumb.png
@@ -146,14 +84,6 @@ rec {
   };
 
   aarch64-multiplatform = {
-    linux-kernel = {
-      name = "aarch64-multiplatform";
-      baseConfig = "defconfig";
-      DTB = true;
-      autoModules = true;
-      preferBuiltin = true;
-      target = "Image";
-    };
     gcc = {
       arch = "armv8-a";
     };
@@ -171,9 +101,6 @@ rec {
   ##
 
   ben_nanonote = {
-    linux-kernel = {
-      name = "ben_nanonote";
-    };
     gcc = {
       arch = "mips32";
       float = "soft";
@@ -230,17 +157,6 @@ rec {
   ## Other
   ##
 
-  riscv-multiplatform = {
-    linux-kernel = {
-      name = "riscv-multiplatform";
-      target = "Image";
-      autoModules = true;
-      preferBuiltin = true;
-      baseConfig = "defconfig";
-      DTB = true;
-    };
-  };
-
   loongarch64-multiplatform = {
     gcc = {
       # https://github.com/loongson/la-softdev-convention/blob/master/la-softdev-convention.adoc#10-operating-system-package-build-requirements
@@ -252,14 +168,6 @@ rec {
       # https://github.com/llvm/llvm-project/pull/132173
       cmodel = "medium";
     };
-    linux-kernel = {
-      name = "loongarch-multiplatform";
-      target = "vmlinuz.efi";
-      autoModules = true;
-      preferBuiltin = true;
-      baseConfig = "defconfig";
-      DTB = true;
-    };
   };
 
   # This function takes a minimally-valid "platform" and returns an
@@ -267,17 +175,13 @@ rec {
   # included in the platform in order to further elaborate it.
   select =
     platform:
-    # x86
-    if platform.isx86 then
-      pc
-
     # ARM
-    else if platform.isAarch32 then
+    if platform.isAarch32 then
       let
         version = platform.parsed.cpu.version or null;
       in
       if version == null then
-        pc
+        { }
       else if lib.versionOlder version "6" then
         armv5tel-multiplatform
       else if lib.versionOlder version "7" then
@@ -291,24 +195,9 @@ rec {
     else if platform.isLoongArch64 then
       loongarch64-multiplatform
 
-    else if platform.isRiscV then
-      riscv-multiplatform
-
     else if platform.parsed.cpu == lib.systems.parse.cpuTypes.mipsel then
       (import ./examples.nix { inherit lib; }).mipsel-linux-gnu
 
-    else if platform.isPower64 then
-      if platform.isLittleEndian then powernv else ppc64
-
-    else if platform.isSh4 then
-      {
-        linux-kernel = {
-          target = "vmlinux";
-          # SH arch doesn't have a 'make install' target.
-          installTarget = "vmlinux";
-        };
-      }
-
     else
       { };
 }
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 8e6e1d2b93ac..70c41ee05e2b 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -9663,6 +9663,11 @@
     githubId = 293586;
     name = "Adam Gamble";
   };
+  gamebeaker = {
+    github = "gamebeaker";
+    githubId = 9269847;
+    name = "gamebeaker";
+  };
   gamedungeon = {
     github = "GameDungeon";
     githubId = 60719255;
@@ -10930,6 +10935,11 @@
     githubId = 58676303;
     name = "hhydraa";
   };
+  hibiday = {
+    name = "Katsumi Takeuchi";
+    github = "hibiday";
+    githubId = 137286929;
+  };
   higebu = {
     name = "Yuya Kusakabe";
     email = "yuya.kusakabe@gmail.com";
diff --git a/nixos/modules/hardware/device-tree.nix b/nixos/modules/hardware/device-tree.nix
index dab3488b320e..3ba99cefcb20 100644
--- a/nixos/modules/hardware/device-tree.nix
+++ b/nixos/modules/hardware/device-tree.nix
@@ -123,7 +123,8 @@ in
   options = {
     hardware.deviceTree = {
       enable = lib.mkOption {
-        default = pkgs.stdenv.hostPlatform.linux-kernel.DTB or false;
+        default = config.boot.kernelPackages.kernel.buildDTBs;
+        defaultText = lib.literalExpression "config.boot.kernelPackages.kernel.buildDTBs";
         type = lib.types.bool;
         description = ''
           Build device tree files. These are used to describe the
diff --git a/nixos/modules/installer/netboot/netboot.nix b/nixos/modules/installer/netboot/netboot.nix
index 4b5593d37d88..6e589f6cde3d 100644
--- a/nixos/modules/installer/netboot/netboot.nix
+++ b/nixos/modules/installer/netboot/netboot.nix
@@ -111,7 +111,7 @@ with lib;
       #!ipxe
       # Use the cmdline variable to allow the user to specify custom kernel params
       # when chainloading this script from other iPXE scripts like netboot.xyz
-      kernel ${pkgs.stdenv.hostPlatform.linux-kernel.target} init=${config.system.build.toplevel}/init initrd=initrd ${toString config.boot.kernelParams} ''${cmdline}
+      kernel ${config.boot.kernelPackages.kernel.target} init=${config.system.build.toplevel}/init initrd=initrd ${toString config.boot.kernelParams} ''${cmdline}
       initrd initrd
       boot
     '';
diff --git a/nixos/modules/system/activation/top-level.nix b/nixos/modules/system/activation/top-level.nix
index e7f569fd78e5..2a05a18f83b7 100644
--- a/nixos/modules/system/activation/top-level.nix
+++ b/nixos/modules/system/activation/top-level.nix
@@ -139,8 +139,8 @@ in
 
     system.boot.loader.kernelFile = mkOption {
       internal = true;
-      default = pkgs.stdenv.hostPlatform.linux-kernel.target;
-      defaultText = literalExpression "pkgs.stdenv.hostPlatform.linux-kernel.target";
+      default = config.boot.kernelPackages.kernel.target;
+      defaultText = literalExpression "config.boot.kernelPackages.kernel.target";
       type = types.str;
       description = ''
         Name of the kernel file to be passed to the bootloader.
diff --git a/nixos/modules/system/boot/loader/generations-dir/generations-dir.nix b/nixos/modules/system/boot/loader/generations-dir/generations-dir.nix
index 75d83d3190a3..705778c99e8c 100644
--- a/nixos/modules/system/boot/loader/generations-dir/generations-dir.nix
+++ b/nixos/modules/system/boot/loader/generations-dir/generations-dir.nix
@@ -66,7 +66,6 @@ in
 
     system.build.installBootLoader = generationsDirBuilder;
     system.boot.loader.id = "generationsDir";
-    system.boot.loader.kernelFile = pkgs.stdenv.hostPlatform.linux-kernel.target;
 
   };
 }
diff --git a/nixos/release.nix b/nixos/release.nix
index eb86134241d8..efc2570c5a70 100644
--- a/nixos/release.nix
+++ b/nixos/release.nix
@@ -152,7 +152,7 @@ let
     tarball
     // {
       meta = {
-        description = "NixOS system tarball for ${system} - ${stdenv.hostPlatform.linux-kernel.name}";
+        description = "NixOS system tarball for ${system}";
         maintainers = map (x: lib.maintainers.${x}) maintainers;
       };
       inherit config;
@@ -188,7 +188,7 @@ let
         modules = makeModules module { };
       };
       build = configEvaled.config.system.build;
-      kernelTarget = configEvaled.pkgs.stdenv.hostPlatform.linux-kernel.target;
+      kernelTarget = build.kernel.target;
     in
     configEvaled.pkgs.symlinkJoin {
       name = "netboot";
diff --git a/nixos/tests/zenohd.nix b/nixos/tests/zenohd.nix
index ee1959e86c48..04f423057899 100644
--- a/nixos/tests/zenohd.nix
+++ b/nixos/tests/zenohd.nix
@@ -84,7 +84,7 @@
     client.wait_for_unit("multi-user.target")
 
     for be in ["fs", "rocksdb", "mem" ]:
-      client.succeed(f"mosquitto_pub -h router -t {be}/test -m hello")
+      client.succeed(f"mosquitto_pub -q 1 -h router -t {be}/test -m hello")
       client.succeed(f"curl router:8000/{be}/test | grep hello")
   '';
 }
diff --git a/pkgs/applications/virtualization/krunvm/default.nix b/pkgs/applications/virtualization/krunvm/default.nix
index cfc28c1e8bc0..8dd4fc569e42 100644
--- a/pkgs/applications/virtualization/krunvm/default.nix
+++ b/pkgs/applications/virtualization/krunvm/default.nix
@@ -16,18 +16,18 @@
 
 stdenv.mkDerivation rec {
   pname = "krunvm";
-  version = "0.2.4";
+  version = "0.2.6";
 
   src = fetchFromGitHub {
-    owner = "containers";
+    owner = "libkrun";
     repo = "krunvm";
     rev = "v${version}";
-    hash = "sha256-YbK4DKw0nh9IO1F7QsJcbOMlHekEdeUBbDHwuQ2x1Ww=";
+    hash = "sha256-peOaPivQKOwioh5skPNFiA3ptHv9pSsnjpy43cms8O8=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit src;
-    hash = "sha256-TMV9xCcqBQgPsUSzsTJAi4qsplTOSm3ilaUmtmdaGnE=";
+    hash = "sha256-MRcQ0Vnd3PJqE2q981JpXPjwMUKT4t+RcOvzWptK7PQ=";
   };
 
   nativeBuildInputs = [
@@ -51,12 +51,12 @@ stdenv.mkDerivation rec {
   postPatch = ''
     # do not pollute etc
     substituteInPlace src/utils.rs \
-      --replace "etc/containers" "share/krunvm/containers"
+      --replace-fail "etc/containers" "share/krunvm/containers"
   '';
 
   postInstall = ''
     mkdir -p $out/share/krunvm/containers
-    install -D -m755 ${buildah-unwrapped.src}/docs/samples/registries.conf $out/share/krunvm/containers/registries.conf
+    install -D -m755 ${buildah-unwrapped.src}/tests/registries.conf $out/share/krunvm/containers/registries.conf
     install -D -m755 ${buildah-unwrapped.src}/tests/policy.json $out/share/krunvm/containers/policy.json
   '';
 
@@ -71,7 +71,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "CLI-based utility for creating microVMs from OCI images";
-    homepage = "https://github.com/containers/krunvm";
+    homepage = "https://github.com/libkrun/krunvm";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ nickcao ];
     platforms = libkrun.meta.platforms;
diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index b1b9bb59f905..4a70df24fbf5 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -27,11 +27,10 @@
 
   # ----------------------------
   # The following  arguments form the "interface" of `pkgs.vmTools`.
-  # Note that `img` is a real package, but is set to this default in `all-packages.nix`.
   # ----------------------------
   customQemu ? null,
   kernel ? linux,
-  img ? stdenv.hostPlatform.linux-kernel.target,
+  img ? kernel.target,
   storeDir ? builtins.storeDir,
   rootModules ? [
     "virtio_pci"
diff --git a/pkgs/by-name/au/augustus-go/package.nix b/pkgs/by-name/au/augustus-go/package.nix
index 608bfc8e5f4e..197c5c6c5031 100644
--- a/pkgs/by-name/au/augustus-go/package.nix
+++ b/pkgs/by-name/au/augustus-go/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "augustus-go";
-  version = "0.0.10";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "praetorian-inc";
     repo = "augustus";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Lh0N2wWTPCsWWaiIcntCqeMIo9ZPGhMEwy0pP42iLzY=";
+    hash = "sha256-ZQoE8liABfAEceNvtJsHtLyfxECEJIRwK3eKGrMIpIE=";
   };
 
-  vendorHash = "sha256-LPBv1i2F5hgJBXBcuZiBwgY0S5OGi0B9Nmy488mbaBQ=";
+  vendorHash = "sha256-IdfrBD0N9zEreUzwMmT84d/UP6KnGETzvwyUfJVpNXo=";
 
   ldflags = [ "-s" ];
 
diff --git a/pkgs/by-name/aw/awsbck/package.nix b/pkgs/by-name/aw/awsbck/package.nix
index 90194cfb5643..d42f7f482a06 100644
--- a/pkgs/by-name/aw/awsbck/package.nix
+++ b/pkgs/by-name/aw/awsbck/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "awsbck";
-  version = "1.0.3";
+  version = "1.0.4";
 
   src = fetchFromGitHub {
     owner = "beeb";
     repo = "awsbck";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-DZ2k0fwEyfeP24maTuxG2vmQaZuQ4LJo0KaKFTUDSYM=";
+    hash = "sha256-6idZCa96HLbvrjVlZmZsF8YD91b+hXw2qIpqqqgwNV8=";
   };
 
-  cargoHash = "sha256-wydSzfb8GAJYJPNtSyYBUHtN3+9jsGINSex2F3ILQKI=";
+  cargoHash = "sha256-5PCenLDOZAFp8G9dvU/pSkJa0HnGPKfFOj/DkTb6prI=";
 
   # tests run in CI on the source repo
   doCheck = false;
diff --git a/pkgs/by-name/bl/blendfarm/package.nix b/pkgs/by-name/bl/blendfarm/package.nix
index eb6e32c15ed1..de227c59e8d6 100644
--- a/pkgs/by-name/bl/blendfarm/package.nix
+++ b/pkgs/by-name/bl/blendfarm/package.nix
@@ -5,7 +5,7 @@
   buildDotnetModule,
   dotnetCorePackages,
   xz,
-  pcre,
+  pcre2,
   autoPatchelfHook,
   bintools,
   fixDarwinDylibNames,
@@ -86,7 +86,7 @@ buildDotnetModule rec {
 
   runtimeDeps = [
     xz
-    pcre
+    pcre2
     libgdiplus
     glib
     libxrandr
@@ -116,7 +116,7 @@ buildDotnetModule rec {
 
   # add libraries not found by autopatchelf
   libPath = lib.makeLibraryPath [
-    pcre
+    pcre2
     xz
   ];
   makeWrapperArgs = [ "--prefix LD_LIBRARY_PATH : ${libPath}" ];
diff --git a/pkgs/by-name/bl/blesh/package.nix b/pkgs/by-name/bl/blesh/package.nix
index 0a6cbbe79977..3fa018822f68 100644
--- a/pkgs/by-name/bl/blesh/package.nix
+++ b/pkgs/by-name/bl/blesh/package.nix
@@ -63,6 +63,7 @@ stdenvNoCC.mkDerivation {
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [
       aiotter
+      hibiday
       matthiasbeyer
     ];
     platforms = lib.platforms.unix;
diff --git a/pkgs/by-name/c3/c3c/package.nix b/pkgs/by-name/c3/c3c/package.nix
index 5d0c86ebf857..ee4d24d771d9 100644
--- a/pkgs/by-name/c3/c3c/package.nix
+++ b/pkgs/by-name/c3/c3c/package.nix
@@ -19,13 +19,13 @@ in
 llvmPackages.stdenv.mkDerivation (finalAttrs: {
 
   pname = "c3c${optionalString debug "-debug"}";
-  version = "0.8.0_3";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "c3lang";
     repo = "c3c";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7RqRnExQNnB4eM2LSLWdvHrDA7tJbiF6pzKGPRDgqHs=";
+    hash = "sha256-HPPeedpbEgG6Zx6a+eV8CBO3rxMXMstLa4kx2NkNYnM=";
   };
 
   cmakeBuildType = if debug then "Debug" else "Release";
diff --git a/pkgs/by-name/cl/cloudlog/package.nix b/pkgs/by-name/cl/cloudlog/package.nix
index 843d386d9dd7..42817d250b80 100644
--- a/pkgs/by-name/cl/cloudlog/package.nix
+++ b/pkgs/by-name/cl/cloudlog/package.nix
@@ -9,13 +9,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "cloudlog";
-  version = "2.8.12";
+  version = "2.8.14";
 
   src = fetchFromGitHub {
     owner = "magicbug";
     repo = "Cloudlog";
     rev = version;
-    hash = "sha256-9NC9hon+okj4jmOY0TMoDUPELDObJiermqSfgmf0gyY=";
+    hash = "sha256-036wo8QiRoqiMNj7ag/txfecxITb1aPI4YydWc9N/yA=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/co/codex/package.nix b/pkgs/by-name/co/codex/package.nix
index 56ebb1faba9f..13a1a98bf7a9 100644
--- a/pkgs/by-name/co/codex/package.nix
+++ b/pkgs/by-name/co/codex/package.nix
@@ -15,6 +15,7 @@
     inherit (callPackage ./fetchers.nix { }) fetchLibrustyV8;
   },
   livekit-libwebrtc,
+  lld,
   makeBinaryWrapper,
   nix-update-script,
   pkg-config,
@@ -25,18 +26,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "codex";
-  version = "0.137.0";
+  version = "0.139.0";
 
   src = fetchFromGitHub {
     owner = "openai";
     repo = "codex";
     tag = "rust-v${finalAttrs.version}";
-    hash = "sha256-puszZqi1lZeq8iXWAD9U9+WMnNvzMYKf6wVT9mtjSUU=";
+    hash = "sha256-XjzlkBUkBey+P3tFLDYB3ae5oseUfW5tmzhLzqlqj2E=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/codex-rs";
 
-  cargoHash = "sha256-SX5LMO+IWismbH61Jd0g1mgykfav8DrqG+wjyNCWyCo=";
+  cargoHash = "sha256-8mN4OTRJvt2mBYHQXZS55PSOChLqEIiXwPu2y+2MZ9o=";
 
   __structuredAttrs = true;
 
@@ -58,7 +59,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     substituteInPlace $cargoDepsCopy/*/webrtc-sys-*/build.rs \
       --replace-fail "cargo:rustc-link-lib=static=webrtc" "cargo:rustc-link-lib=dylib=webrtc"
     substituteInPlace Cargo.toml \
-      --replace-fail 'lto = "fat"' "" \
+      --replace-fail 'lto = "thin"' "" \
       --replace-fail 'codegen-units = 1' ""
   '';
 
@@ -95,6 +96,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
       ]
     );
     RUSTY_V8_ARCHIVE = librusty_v8;
+  }
+  // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    # Link with lld on Darwin. nixpkgs' classic open-source ld64 fails to insert
+    # ARM64 branch thunks for this binary, producing `b(l) ARM64 branch out of range`.
+    NIX_CFLAGS_LINK = "-fuse-ld=${lib.getExe' lld "ld64.lld"}";
   };
 
   # NOTE: part of the test suite requires access to networking, local shells,
diff --git a/pkgs/by-name/cp/cppcms/package.nix b/pkgs/by-name/cp/cppcms/package.nix
index ef6dc5c8e270..4cf92c1bac6e 100644
--- a/pkgs/by-name/cp/cppcms/package.nix
+++ b/pkgs/by-name/cp/cppcms/package.nix
@@ -3,7 +3,7 @@
   stdenv,
   fetchurl,
   cmake,
-  pcre,
+  pcre2,
   zlib,
   python3,
   openssl,
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
     python3
   ];
   buildInputs = [
-    pcre
+    pcre2
     zlib
     openssl
   ];
diff --git a/pkgs/by-name/ev/evcc/package.nix b/pkgs/by-name/ev/evcc/package.nix
index 066bbe64a063..48da78ebcc5d 100644
--- a/pkgs/by-name/ev/evcc/package.nix
+++ b/pkgs/by-name/ev/evcc/package.nix
@@ -17,16 +17,16 @@
 }:
 
 let
-  version = "0.308.1";
+  version = "0.309.0";
 
   src = fetchFromGitHub {
     owner = "evcc-io";
     repo = "evcc";
     tag = version;
-    hash = "sha256-MsNDWTv6CDQfQMA9miImvGkQeJnsh6/zYtAcQJjHaF4=";
+    hash = "sha256-Uyb83sBFNJLRU78Q60Mj3Q6j9Uvrv3unj0kkAdTXePc=";
   };
 
-  vendorHash = "sha256-UI1WyTDJA5GRgt8TmpMQi4DmYzfQFGhDd5WeitT8VnI=";
+  vendorHash = "sha256-95yI/ObkLByzO+BBbACylaNcCrple8MpxY8dKLGqFDE=";
 
   commonMeta = {
     license = lib.licenses.mit;
diff --git a/pkgs/by-name/ex/exploitdb/package.nix b/pkgs/by-name/ex/exploitdb/package.nix
index ff1dae6d81ec..5009c2d77a46 100644
--- a/pkgs/by-name/ex/exploitdb/package.nix
+++ b/pkgs/by-name/ex/exploitdb/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "exploitdb";
-  version = "2026-06-06";
+  version = "2026-06-09";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = "exploitdb";
     tag = finalAttrs.version;
-    hash = "sha256-UoRwDDesvmiVefGXD7aFQSo49IweT7LRPFcDLNkKmvk=";
+    hash = "sha256-iNtAJkcbrEcjjMs4lqwDzMc1xussDTONVW7IsPrgnB0=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/gh/ghr-cli/package.nix b/pkgs/by-name/gh/ghr-cli/package.nix
new file mode 100644
index 000000000000..67d0ae0a7b34
--- /dev/null
+++ b/pkgs/by-name/gh/ghr-cli/package.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+  gitMinimal,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "ghr-cli";
+  version = "0.8.1";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "chenyukang";
+    repo = "ghr";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-lo8a5EhLslqjnUG/xM8XFU1x1Eam47lFD8KRMzuCSD4=";
+  };
+
+  cargoHash = "sha256-PtnQVdW9yC2309047PFt/HXV1QyqNttZ0zJ8hocLRAo=";
+
+  passthru.updateScript = nix-update-script { };
+
+  nativeCheckInputs = [
+    gitMinimal
+  ];
+
+  meta = {
+    description = "Fast terminal workspace for staying on top of GitHub";
+    homepage = "https://catcoding.me/ghr/";
+    changelog = "https://github.com/chenyukang/ghr/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ pborzenkov ];
+    mainProgram = "ghr";
+  };
+})
diff --git a/pkgs/by-name/gr/grype/package.nix b/pkgs/by-name/gr/grype/package.nix
index 9b679cffe312..184eb03217c6 100644
--- a/pkgs/by-name/gr/grype/package.nix
+++ b/pkgs/by-name/gr/grype/package.nix
@@ -12,7 +12,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "grype";
-  version = "0.113.0";
+  version = "0.114.0";
 
   # required for tests
   __darwinAllowLocalNetworking = true;
@@ -21,7 +21,7 @@ buildGoModule (finalAttrs: {
     owner = "anchore";
     repo = "grype";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wNInrYI7cxn/WsPLZp01rEzQm4gUG0xUgvSLlv27WUM=";
+    hash = "sha256-JMcqoFqd7WtU/EKobNbiraOlQO7GdYT8IKzSnR26gXY=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -36,7 +36,7 @@ buildGoModule (finalAttrs: {
 
   proxyVendor = true;
 
-  vendorHash = "sha256-VZutEOKZK0aYiS5e9WWXCBOw7epr3xfYJo0xrpSecdk=";
+  vendorHash = "sha256-wAibdRMWscqu2nX08jzoS9rY+OrJEFB2TehYYkDQJ64=";
 
   patches = [
     # several test golden files have unstable paths based on the platform
diff --git a/pkgs/by-name/if/ifstate/package.nix b/pkgs/by-name/if/ifstate/package.nix
index 13f092217138..1a215e80e3fb 100644
--- a/pkgs/by-name/if/ifstate/package.nix
+++ b/pkgs/by-name/if/ifstate/package.nix
@@ -13,12 +13,12 @@
 }:
 
 let
-  version = "2.3.0";
+  version = "2.4.1";
   src = fetchFromCodeberg {
     owner = "routerkit";
     repo = "ifstate";
     tag = version;
-    hash = "sha256-qJdWoe9hbLMmyaaK7m+NzU3415KavbBkHJdFPhmlOnY=";
+    hash = "sha256-/kibcWSGg7AqkjvQAzhSs+aoRHE/YoYhTqVjw4NWNgA=";
   };
   docs = stdenv.mkDerivation {
     pname = "ifstate-docs";
diff --git a/pkgs/by-name/li/libkrun/package.nix b/pkgs/by-name/li/libkrun/package.nix
index aecdc47cb31f..fb413d835be4 100644
--- a/pkgs/by-name/li/libkrun/package.nix
+++ b/pkgs/by-name/li/libkrun/package.nix
@@ -34,13 +34,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "libkrun" + lib.optionalString (variant != null) "-${variant}";
-  version = "1.17.4";
+  version = "1.18.1";
 
   src = fetchFromGitHub {
-    owner = "containers";
+    owner = "libkrun";
     repo = "libkrun";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Th4vCg3xHb6lbo26IDZES7tLOUAJTebQK2+h3xSYX7U=";
+    hash = "sha256-JXbCDByrWhmcEqwREX/kgVAtS4K8blfpjknTdJwQCLo=";
   };
 
   outputs = [
@@ -50,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src;
-    hash = "sha256-0xpAyNe1jF1OMtc7FXMsejqIv0xKc1ktEvm3rj/mVFU=";
+    hash = "sha256-dfIe2pl957MRcY1hIv6wPPX/4He+ou+eCZLbylVeGAE=";
   };
 
   # Make sure libkrunfw can be found by dlopen()
@@ -106,7 +106,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Dynamic library providing Virtualization-based process isolation capabilities";
-    homepage = "https://github.com/containers/libkrun";
+    homepage = "https://github.com/libkrun/libkrun";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
       nickcao
diff --git a/pkgs/by-name/li/libkrunfw/package.nix b/pkgs/by-name/li/libkrunfw/package.nix
index aa5c19c4a513..c9598b861dcd 100644
--- a/pkgs/by-name/li/libkrunfw/package.nix
+++ b/pkgs/by-name/li/libkrunfw/package.nix
@@ -21,19 +21,19 @@ assert lib.elem variant [
 
 let
   kernelSrc = fetchurl {
-    url = "mirror://kernel/linux/kernel/v6.x/linux-6.12.76.tar.xz";
-    hash = "sha256-u7Q+g0xG5r1JpcKPIuZ5qTdENATh9lMgTUskkp862JY=";
+    url = "mirror://kernel/linux/kernel/v6.x/linux-6.12.91.tar.xz";
+    hash = "sha256-D/KrnhafnxlIVXRx+7RQ0wGPjFt3yvKI4aOYJYJZeWk=";
   };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "libkrunfw" + lib.optionalString (variant != null) "-${variant}";
-  version = "5.3.0";
+  version = "5.5.0";
 
   src = fetchFromGitHub {
-    owner = "containers";
+    owner = "libkrun";
     repo = "libkrunfw";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-fhG/bP1HzmhyU2N+wnr1074WEGsD9RdTUUBhYUFpWlA=";
+    hash = "sha256-MF1oDqhS4xqyQJIntl4DBfDBvuqCxQn9Zdws82Tn5Gg=";
   };
 
   postPatch = ''
@@ -74,7 +74,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Dynamic library bundling the guest payload consumed by libkrun";
-    homepage = "https://github.com/containers/libkrunfw";
+    homepage = "https://github.com/libkrun/libkrunfw";
     license = with lib.licenses; [
       lgpl2Only
       lgpl21Only
diff --git a/pkgs/by-name/li/libwebsockets/package.nix b/pkgs/by-name/li/libwebsockets/package.nix
index 1435543f0ad7..f0e50b0f6132 100644
--- a/pkgs/by-name/li/libwebsockets/package.nix
+++ b/pkgs/by-name/li/libwebsockets/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   cmake,
   openssl,
   zlib,
@@ -13,28 +12,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libwebsockets";
-  version = "4.4.1";
+  version = "4.4.5";
 
   src = fetchFromGitHub {
     owner = "warmcat";
     repo = "libwebsockets";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Xvcnfvm9UCNXm3G3tVe7jExE3fwpzYuz8wllvINymeI=";
+    hash = "sha256-VY5caFHEJY06Vb4abDKmfcL12lRkmk0auxb/4ZZwqqc=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "CVE-2025-11677.patch";
-      url = "https://libwebsockets.org/git/libwebsockets/patch?id=2f082ec31261f556969160143ba94875d783971a";
-      hash = "sha256-FeiZAbr1kpt+YNjhi2gfG2A6nXKiSssMFRmlALaneu4=";
-    })
-    (fetchpatch {
-      name = "CVE-2025-11678.patch";
-      url = "https://libwebsockets.org/git/libwebsockets/patch?id=2bb9598562b37c942ba5b04bcde3f7fdf66a9d3a";
-      hash = "sha256-1uQUkoMbK+3E/QYMIBLlBZypwHBIrWBtm+KIW07WRj8=";
-    })
-  ];
-
   outputs = [
     "out"
     "dev"
@@ -69,8 +55,13 @@ stdenv.mkDerivation (finalAttrs: {
       ]
   );
 
+  postPatch = ''
+    substituteInPlace lib/CMakeLists.txt \
+      --replace-fail '=\''${exec_prefix}/''${LWS_INSTALL_LIB_DIR}' '=''${CMAKE_INSTALL_FULL_LIBDIR}' \
+      --replace-fail '=\''${prefix}/''${LWS_INSTALL_INCLUDE_DIR}' '=''${CMAKE_INSTALL_FULL_INCLUDEDIR}'
+  ''
   # Remove after https://github.com/warmcat/libwebsockets/pull/3567 has been merged or otherwise addressed
-  postPatch = lib.optionalString stdenv.hostPlatform.isStatic ''
+  + lib.optionalString stdenv.hostPlatform.isStatic ''
     substituteInPlace "cmake/libwebsockets-config.cmake.in" --replace-fail \
       "set(LIBWEBSOCKETS_LIBRARIES websockets websockets_shared)" \
       "set(LIBWEBSOCKETS_LIBRARIES websockets)"
diff --git a/pkgs/by-name/md/mdfried/package.nix b/pkgs/by-name/md/mdfried/package.nix
index 28e7059e2cac..2291edeeeba0 100644
--- a/pkgs/by-name/md/mdfried/package.nix
+++ b/pkgs/by-name/md/mdfried/package.nix
@@ -2,23 +2,38 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
+  pkg-config,
+  chafa,
+  glib,
+  nix-update-script,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mdfried";
-  version = "0.15.0";
+  version = "0.22.0";
 
   src = fetchFromGitHub {
     owner = "benjajaja";
     repo = "mdfried";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-V++xkJBnTlqzcsw6BDkrqScIV+phzxyDqQXcV34L4ps=";
+    hash = "sha256-zJSh5g1FkR/nqk2qj22Xo8qIOjwyF346PM4KOUOCBBo=";
   };
 
-  cargoHash = "sha256-qnsJkwAmBcakYcoqGdYRqfN6e46PG5IH6SAXLvy3mM8=";
+  cargoHash = "sha256-2wwaEKknnxX6QuE+6udHL2GTOuPpS1oqRI+b3aP0e1I=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    chafa
+    glib
+  ];
 
   doCheck = true;
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Markdown viewer TUI for the terminal, with big text and image rendering";
     homepage = "https://github.com/benjajaja/mdfried";
diff --git a/pkgs/by-name/mo/modelio/package.nix b/pkgs/by-name/mo/modelio/package.nix
new file mode 100644
index 000000000000..dad1c78bd655
--- /dev/null
+++ b/pkgs/by-name/mo/modelio/package.nix
@@ -0,0 +1,136 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  dpkg,
+  makeWrapper,
+  autoPatchelfHook,
+  wrapGAppsHook3,
+  gtk3,
+  glib,
+  libsecret,
+  libx11,
+  libxtst,
+  openjdk11,
+  webkitgtk_4_1,
+  glib-networking,
+  imagemagick,
+}:
+
+let
+  # SWT 3.120 hardcodes dlopen("libwebkit2gtk-4.0.so.37") but nixpkgs
+  # only ships webkitgtk_4_1 (soname libwebkit2gtk-4.1.so.0).
+  webkitCompat = stdenvNoCC.mkDerivation {
+    name = "webkitgtk-4.0-compat";
+    dontUnpack = true;
+    installPhase = ''
+      mkdir -p $out/lib
+      ln -s ${webkitgtk_4_1}/lib/libwebkit2gtk-4.1.so.0 $out/lib/libwebkit2gtk-4.0.so.37
+    '';
+  };
+in
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "modelio";
+  version = "5.4.1";
+  # Using .deb package instead of building from source as the build process uses eclipse gui as a necessary build step.
+  # Building from source steps: https://github.com/ModelioOpenSource/Modelio/wiki/Build-Modelio-Index
+  # I was unsuccessful in the attempt to build it via cli.
+  src = fetchurl {
+    url = "https://github.com/ModelioOpenSource/Modelio/releases/download/v${finalAttrs.version}/modelio-open-source-${finalAttrs.version}_amd64.deb";
+    hash = "sha256-cg7ruIYpOgz2nfax37M8sUs89Qvbb5PMudyR0ZNiURo=";
+  };
+
+  nativeBuildInputs = [
+    dpkg
+    makeWrapper
+    autoPatchelfHook
+    wrapGAppsHook3
+    imagemagick
+  ];
+
+  buildInputs = [
+    gtk3
+    glib
+    libsecret
+    libx11
+    libxtst
+  ];
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  unpackPhase = ''
+    runHook preUnpack
+    dpkg-deb --extract $src .
+    runHook postUnpack
+  '';
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    rm -rf usr/lib/modelio-open-source5.4/jre
+
+    mkdir -p $out/opt/modelio $out/bin
+    cp -r usr/lib/modelio-open-source5.4/* $out/opt/modelio
+
+    # Remove upstream's blanket TLS error suppression
+    substituteInPlace $out/opt/modelio/modelio.ini \
+      --replace-fail "-Dorg.eclipse.swt.internal.webkitgtk.ignoretlserrors=true" ""
+
+    # change dark theme to light theme as the text isn't readable in dark themes GTK_THEME "Adwaita:light" isn't enough
+    # https://github.com/ModelioOpenSource/Modelio/issues/59
+    cp $out/opt/modelio/plugins/org.eclipse.ui.themes_1.2.1200.v20201112-1139/css/{e4_basestyle,e4-dark_linux}.css
+
+    # --set GTK_THEME "Adwaita:light" as the text isn't readable in dark themes
+    # https://github.com/ModelioOpenSource/Modelio/issues/59
+    makeWrapper $out/opt/modelio/modelio $out/bin/modelio \
+      --prefix PATH : "${openjdk11}/bin" \
+      --set JAVA_HOME "${openjdk11.home}" \
+      --set GDK_BACKEND "x11" \
+      --set GTK_THEME "Adwaita:light" \
+      --set SWT_GTK3 "1" \
+      --set SWT_WEBKIT2 "1" \
+      --set UBUNTU_MENUPROXY "0" \
+      --set LIBOVERLAY_SCROLLBAR "0" \
+      --prefix GIO_EXTRA_MODULES : "${glib-networking}/lib/gio/modules" \
+      --prefix LD_LIBRARY_PATH : "${
+        lib.makeLibraryPath [
+          gtk3
+          glib
+          webkitCompat
+          glib-networking
+        ]
+      }"
+
+    mkdir -p $out/share/applications
+    cp usr/share/applications/modelio-open-source5.4.desktop $out/share/applications/modelio.desktop
+    substituteInPlace $out/share/applications/modelio.desktop \
+      --replace-fail "Exec=/usr/bin/modelio-open-source5.4" "Exec=$out/bin/modelio" \
+      --replace-fail "Icon=modelio-open-source5.4" "Icon=modelio"
+
+    mkdir -p $out/share/icons/hicolor/scalable/apps
+    cp usr/share/icons/hicolor/scalable/apps/modelio-open-source5.4.svg \
+       $out/share/icons/hicolor/scalable/apps/modelio.svg
+
+    for size in 16 32 48 64 128 256 512; do
+      mkdir -p $out/share/icons/hicolor/"$size"x"$size"/apps
+      magick -background none $out/share/icons/hicolor/scalable/apps/modelio.svg -resize "$size"x"$size" $out/share/icons/hicolor/"$size"x"$size"/apps/modelio.png
+    done
+
+    runHook postInstall
+  '';
+
+  meta = {
+    homepage = "https://www.modelio.org/";
+    changelog = "https://github.com/ModelioOpenSource/Modelio/releases/tag/v${finalAttrs.version}";
+    description = "Open-source UML, BPMN, ArchiMate and SysML modeling environment";
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ gamebeaker ];
+    platforms = [ "x86_64-linux" ];
+    mainProgram = "modelio";
+  };
+})
diff --git a/pkgs/by-name/ne/netflow2ng/package.nix b/pkgs/by-name/ne/netflow2ng/package.nix
new file mode 100644
index 000000000000..fd994151395b
--- /dev/null
+++ b/pkgs/by-name/ne/netflow2ng/package.nix
@@ -0,0 +1,56 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+  pkg-config,
+  versionCheckHook,
+  zeromq,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "netflow2ng";
+  version = "0.2.2";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "synfinatic";
+    repo = "netflow2ng";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-cBAgZhHYA9YpQ9NoiW6WNQvPi5nnZ0V3R/bbL8mNXuo=";
+  };
+
+  vendorHash = "sha256-2hGY58ofzY7BTIrecdSDoo6JuQwJe4AyNPGiBpGY9lA=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ zeromq ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  ldflags = [
+    "-s"
+    "-X=main.Version=${finalAttrs.version}"
+    "-X=main.Buildinfos=nixpkgs"
+    "-X=main.Tag=${finalAttrs.src.tag}"
+    "-X=main.CommitID=${finalAttrs.src.rev}"
+  ];
+
+  doInstallCheck = true;
+
+  postInstall = ''
+    mv $out/bin/cmd $out/bin/${finalAttrs.pname}
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "NetFlow v9 collector for ntopng";
+    homepage = "https://github.com/synfinatic/netflow2ng";
+    changelog = "https://github.com/synfinatic/netflow2ng/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "netflow2ng";
+  };
+})
diff --git a/pkgs/by-name/ni/niks3/package.nix b/pkgs/by-name/ni/niks3/package.nix
index 74680e6952a7..c085fd2fa609 100644
--- a/pkgs/by-name/ni/niks3/package.nix
+++ b/pkgs/by-name/ni/niks3/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "niks3";
-  version = "1.6.0";
+  version = "1.6.1";
 
   src = fetchFromGitHub {
     owner = "Mic92";
     repo = "niks3";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-S2nSP6YWUz8I2uRZuAY93FoAAUa9TiZetLzjBv1n5vk=";
+    hash = "sha256-/JsYspjkvMXmtcHjZ9o4+rznCuI5RxruJ228TQN5slY=";
   };
 
-  vendorHash = "sha256-KJM0m9QrtU6nJMmR+GBaJDNf5DUzmsVySroKIq0cMsE=";
+  vendorHash = "sha256-dxNk5DWBMyahl36RARCu/JfrpQ6RFATKEuDLEhea5RQ=";
 
   subPackages = [
     "cmd/niks3"
diff --git a/pkgs/by-name/nu/nuclei/package.nix b/pkgs/by-name/nu/nuclei/package.nix
index 215eab34f4af..e1fd21bc2229 100644
--- a/pkgs/by-name/nu/nuclei/package.nix
+++ b/pkgs/by-name/nu/nuclei/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "nuclei";
-  version = "3.8.0";
+  version = "3.9.0";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "nuclei";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jzXV9QBpeH26nrViHdKR6Id7Dkdl0Ob1r71RhorCJvM=";
+    hash = "sha256-xu9CFZR3hv6oIZvmyKELpYUVbE/Yu3ApnTwi0LMTQWg=";
   };
 
-  vendorHash = "sha256-dxyyaletTVud6p81QzOsitw7m4yAZG3r1ZoEb2vQqOY=";
+  vendorHash = "sha256-bJYN2hsNI99AUGRjLFzzd6ZIIXUW2oDxmAsIniRM868=";
 
   proxyVendor = true; # hash mismatch between Linux and Darwin
 
diff --git a/pkgs/by-name/nu/numkong/package.nix b/pkgs/by-name/nu/numkong/package.nix
new file mode 100644
index 000000000000..af5ed0c42a5d
--- /dev/null
+++ b/pkgs/by-name/nu/numkong/package.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  cmake,
+  fetchFromGitHub,
+  stdenv,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "numkong";
+  version = "7.7.0";
+
+  outputs = [
+    "out"
+    "lib"
+    "dev"
+  ];
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "ashvardanian";
+    repo = "NumKong";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-JZafqqq3jDX+iim2DvyuavuvZ0wrPLIU+hcrOiT1L84=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  meta = {
+    description = "Portable mixed-precision math, linear-algebra, & retrieval library with 2000+ SIMD kernels for x86, Arm, RISC-V, LoongArch, Power, & WebAssembly";
+    homepage = "https://github.com/ashvardanian/NumKong/";
+    changelog = "https://github.com/ashvardanian/NumKong/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ SuperSandro2000 ];
+  };
+})
diff --git a/pkgs/by-name/op/open-websearch/package.nix b/pkgs/by-name/op/open-websearch/package.nix
index cd31a340d163..a90c445b1761 100644
--- a/pkgs/by-name/op/open-websearch/package.nix
+++ b/pkgs/by-name/op/open-websearch/package.nix
@@ -5,7 +5,7 @@
 }:
 buildNpmPackage (finalAttrs: {
   pname = "open-websearch";
-  version = "1.2.7";
+  version = "2.1.9";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -14,10 +14,10 @@ buildNpmPackage (finalAttrs: {
     owner = "Aas-ee";
     repo = "open-webSearch";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ko216HwLEFhVOsyOBTDZNK0MfXL55OFrIM7RR1BRJJM=";
+    hash = "sha256-ZS56Eoy9IePLeyopv4AK6FU8+b1E8r/WPK6RYDvy6yA=";
   };
 
-  npmDepsHash = "sha256-yhWFDXEPvm7HWFOiO3X1YRFYpAT0QeZJuFt65yxu+E0=";
+  npmDepsHash = "sha256-Ua20YOYr/D06eMQsgBgfN/W7F74wfjjHXL10XIB0nFA=";
 
   meta = {
     description = "Web search MCP server";
diff --git a/pkgs/by-name/op/openasar/package.nix b/pkgs/by-name/op/openasar/package.nix
index da1f7016f4b1..34ea244b802c 100644
--- a/pkgs/by-name/op/openasar/package.nix
+++ b/pkgs/by-name/op/openasar/package.nix
@@ -14,13 +14,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "openasar";
-  version = "0-unstable-2026-05-08";
+  version = "0-unstable-2026-06-04";
 
   src = fetchFromGitHub {
     owner = "GooseMod";
     repo = "OpenAsar";
-    rev = "4b47bb79f45e2c50fbeb5d86e4846c1a41ef0bef";
-    hash = "sha256-5LJ6Fm27tV2A+oqve3UJSA/rICpHhgHf79PZBJriyg0=";
+    rev = "82015ce64e753977a3f67bd915e6e42ef5ff77a6";
+    hash = "sha256-+UFAcVClwBE2501Spd/cJUd1SGBv3oJvTpr0J7IYuV8=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/ra/ralphex/package.nix b/pkgs/by-name/ra/ralphex/package.nix
index 1157f9f84228..de0b83afdcc8 100644
--- a/pkgs/by-name/ra/ralphex/package.nix
+++ b/pkgs/by-name/ra/ralphex/package.nix
@@ -9,7 +9,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "ralphex";
-  version = "1.4.0";
+  version = "1.5.1";
 
   __structuredAttrs = true;
 
@@ -17,7 +17,7 @@ buildGoModule (finalAttrs: {
     owner = "umputun";
     repo = "ralphex";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-IIGZ4uJRm4eYZW0Ezxuis1unEPUs8jUaKIcNyaUBCMg=";
+    hash = "sha256-oW2BQIq98YwTc9h4u3KOhx6x7qgGMLetXNnOTOjM49Q=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/re/restish/package.nix b/pkgs/by-name/re/restish/package.nix
index b078977cc0e6..4201f4ae9d40 100644
--- a/pkgs/by-name/re/restish/package.nix
+++ b/pkgs/by-name/re/restish/package.nix
@@ -3,27 +3,29 @@
   stdenv,
   buildGoModule,
   fetchFromGitHub,
-  restish,
-  testers,
-  libxrandr,
+  libx11,
+  libxcursor,
   libxi,
   libxinerama,
-  libxcursor,
-  libx11,
+  libxrandr,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "restish";
-  version = "2.0.0";
+  version = "2.2.0";
+
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "danielgtaylor";
     repo = "restish";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4piN0W/9y2NTsTuZ2B4Czhr9RQNb4eT9ZIX9MYzfMLI=";
+    hash = "sha256-wGchbKSEbzr1vQlYWgUTubA1xQVcxq7iyRUIuWqVL0Y=";
   };
 
-  vendorHash = "sha256-ZRyGCdmPenOeLtFuj0howJH0rah05sPUuD7RH/c0LKI=";
+  vendorHash = "sha256-Y0GwgrkD09WAlmyI6Oe3Kw6L62E7QRTCIThZGXbbn74=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
     libx11
@@ -33,25 +35,27 @@ buildGoModule (finalAttrs: {
     libxrandr
   ];
 
-  ldflags = [
-    "-s"
-    "-w"
-    "-X=main.version=${finalAttrs.version}"
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
   ];
 
-  preCheck = ''
-    export HOME=$(mktemp -d)
-  '';
+  ldflags = [
+    "-s"
+    "-X=github.com/rest-sh/restish/v2/internal/cli.Version=${finalAttrs.version}"
+  ];
 
-  passthru.tests.version = testers.testVersion {
-    package = restish;
-    command = "HOME=$(mktemp -d) restish --version";
-  };
+  checkFlags = [
+    # Test requires network access and test with hard-coded version '2.0.0'
+    "-skip=TestAPISyncDiscoveryDoesNotSendAuthToCrossOriginLinkSpec|TestVersion$|TestVersionCommand"
+  ];
+
+  doInstallCheck = true;
 
   meta = {
     description = "CLI tool for interacting with REST-ish HTTP APIs";
     homepage = "https://rest.sh/";
-    changelog = "https://github.com/danielgtaylor/restish/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/danielgtaylor/restish/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "restish";
diff --git a/pkgs/by-name/so/solvespace/package.nix b/pkgs/by-name/so/solvespace/package.nix
index bb4700682213..6c777902041b 100644
--- a/pkgs/by-name/so/solvespace/package.nix
+++ b/pkgs/by-name/so/solvespace/package.nix
@@ -24,7 +24,7 @@
   libthai,
   libxkbcommon,
   pangomm,
-  pcre,
+  pcre2,
   util-linuxMinimal, # provides libmount
   libxtst,
   libxdmcp,
@@ -36,6 +36,8 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "solvespace";
   version = "3.2";
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "solvespace";
     repo = "solvespace";
@@ -44,6 +46,8 @@ stdenv.mkDerivation (finalAttrs: {
     fetchSubmodules = true;
   };
 
+  strictDeps = true;
+
   nativeBuildInputs = [
     cmake
     pkg-config
@@ -70,7 +74,7 @@ stdenv.mkDerivation (finalAttrs: {
     libthai
     libxkbcommon
     pangomm
-    pcre
+    pcre2
     util-linuxMinimal
     libpthread-stubs
     libxdmcp
diff --git a/pkgs/by-name/t3/t3code/package.nix b/pkgs/by-name/t3/t3code/package.nix
index b833ddc2d99a..166256dbb0c4 100644
--- a/pkgs/by-name/t3/t3code/package.nix
+++ b/pkgs/by-name/t3/t3code/package.nix
@@ -31,6 +31,8 @@
   codex,
   enableCursor ? false,
   code-cursor,
+  enableCursorCli ? false,
+  cursor-cli,
   enableGitHub ? true,
   gh,
   enableGit ? true,
@@ -39,6 +41,8 @@
   glab,
   enableJujutsu ? false,
   jujutsu,
+  enableOpencode ? false,
+  opencode,
 }:
 
 stdenv.mkDerivation (
@@ -52,6 +56,7 @@ stdenv.mkDerivation (
         "assets/prod/black-macos-1024.png"
       else
         "assets/prod/black-universal-1024.png";
+
     runtimePackages =
       lib.optionals enableAzureDevOps [
         azure-cli.withExtensions
@@ -61,10 +66,13 @@ stdenv.mkDerivation (
       ++ lib.optionals enableClaude [ claude-code ]
       ++ lib.optionals enableCodex [ codex ]
       ++ lib.optionals enableCursor [ code-cursor ]
+      ++ lib.optionals enableCursorCli [ cursor-cli ]
       ++ lib.optionals enableGitHub [ gh ]
       ++ lib.optionals enableGit [ git ]
       ++ lib.optionals enableGitLab [ glab ]
-      ++ lib.optionals enableJujutsu [ jujutsu ];
+      ++ lib.optionals enableJujutsu [ jujutsu ]
+      ++ lib.optionals enableOpencode [ opencode ];
+
     runtimePathWrapperArgs = lib.optionalString (runtimePackages != [ ]) ''
       \
         --prefix PATH : ${lib.makeBinPath runtimePackages}
@@ -72,7 +80,7 @@ stdenv.mkDerivation (
   in
   {
     pname = "t3code";
-    version = "0.0.25";
+    version = "0.0.27";
     strictDeps = true;
     __structuredAttrs = true;
 
@@ -80,7 +88,7 @@ stdenv.mkDerivation (
       owner = "pingdotgg";
       repo = "t3code";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-R9FTqKT67POU9dED/EdPJVsu/rSEQ2C4WoNUwgkL0e8=";
+      hash = "sha256-KwiF6A7pTlkzr43FJ9XM+oEXBOEtw3vrazVOjBaD5lU=";
     };
 
     postPatch = ''
@@ -128,7 +136,7 @@ stdenv.mkDerivation (
         ;
 
       fetcherVersion = 4;
-      hash = "sha256-gctAlOtQMAbw4xWH9QyyVae6f0fk+o+EkLW+4rpmF9c=";
+      hash = "sha256-vpL0kjDAtxnBpm+izcJ06KXuzX888yxmzrcEc9yKtm0=";
     };
 
     # This workaround turns the `pnpmWorkspaces` array into a space-separated
diff --git a/pkgs/by-name/ta/talhelper/package.nix b/pkgs/by-name/ta/talhelper/package.nix
index 10e9daa87bc1..fe7686c2db2c 100644
--- a/pkgs/by-name/ta/talhelper/package.nix
+++ b/pkgs/by-name/ta/talhelper/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "talhelper";
-  version = "3.1.10";
+  version = "3.1.11";
 
   src = fetchFromGitHub {
     owner = "budimanjojo";
     repo = "talhelper";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TxmbT/qY0G5qtssvfyj10yuVuOsMJSF6qpN+TB/K1Qg=";
+    hash = "sha256-OFBgC2K41W+amq+GvI8ZH3g8hY8Zx7kp8+5O9srtftU=";
   };
 
-  vendorHash = "sha256-f/kCaSJJ0d0vDTjVkQA/W9kDnrPNBxr5n6mdElK+Sts=";
+  vendorHash = "sha256-xWDadWLiL2NRHleX1dqzG7CeKuiihbdSU1C96DuV7fM=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ta/talosctl/package.nix b/pkgs/by-name/ta/talosctl/package.nix
index 41eeda7c5e33..9ecd50659267 100644
--- a/pkgs/by-name/ta/talosctl/package.nix
+++ b/pkgs/by-name/ta/talosctl/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "talosctl";
-  version = "1.13.3";
+  version = "1.13.4";
 
   src = fetchFromGitHub {
     owner = "siderolabs";
     repo = "talos";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6WjjJXgsgLzE30VEpnl163nw4wjs8stRd7EGKFlSOoY=";
+    hash = "sha256-jcBRAixpdfbzOfCc7BjyDScWPsrW9Mc7A8vGLyN1f68=";
   };
 
-  vendorHash = "sha256-TyBitraiVyjgfQnx2Yehd+81IDeJtjpHPx7MhJ/4uBE=";
+  vendorHash = "sha256-dbuPRXAz+YOxmhEdd1R3R5rOAiNn9TOEeDavL+40MV4=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index a06f347fa0f0..b6f4ce09d851 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -525,6 +525,19 @@
     };
   };
 
+  dune = {
+    version = "0-unstable-2026-05-21";
+    url = "github:tmcgilchrist/tree-sitter-dune";
+    rev = "dd00f0d232e5f081b583966a414994338614b35b";
+    hash = "sha256-yJYuK1uPgN2DH8SIq67prQ1eEazPeBQNlPgGdkEjjHg=";
+    meta = {
+      license = lib.licenses.mit;
+      maintainers = with lib.maintainers; [
+        leungbk
+      ];
+    };
+  };
+
   dunstrc = {
     version = "0-unstable-2025-05-04";
     url = "github:rotmh/tree-sitter-dunstrc";
diff --git a/pkgs/by-name/tr/trivy/package.nix b/pkgs/by-name/tr/trivy/package.nix
index 38423c3c63a6..e5a6a88f7410 100644
--- a/pkgs/by-name/tr/trivy/package.nix
+++ b/pkgs/by-name/tr/trivy/package.nix
@@ -17,19 +17,19 @@ buildGoModule (finalAttrs: {
   # that the signs present then are not present now.
   # Finally, weigh the risk of a compromised release against the expected
   # benefit of the update, and consider the possibility of not updating.
-  version = "0.69.3"; # Did you read the comment?
+  version = "0.71.0"; # Did you read the comment?
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = "trivy";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lzFcLyrORA+1LxS4nzJVvilg29GTNiGRmnjJ47ev/yU=";
+    hash = "sha256-wlvG8iGPBbHV66SOT0zek2VN1QawksVQwM9LSEItzh4=";
   };
 
   # Hash mismatch on across Linux and Darwin
   proxyVendor = true;
 
-  vendorHash = "sha256-aqSB2pakYH713GSbIAHwAL9Gio17MzZtwqfh9sbzDBs=";
+  vendorHash = "sha256-n5eWyKpG47LuXPzMO+/tzhFs4F+grWQAThCoGEMQ2S8=";
 
   subPackages = [ "cmd/trivy" ];
 
diff --git a/pkgs/by-name/us/usearch/package.nix b/pkgs/by-name/us/usearch/package.nix
new file mode 100644
index 000000000000..544e8e6a3876
--- /dev/null
+++ b/pkgs/by-name/us/usearch/package.nix
@@ -0,0 +1,102 @@
+{
+  lib,
+  cmake,
+  fetchFromGitHub,
+  fetchzip,
+  jemalloc,
+  llvmPackages,
+  numkong,
+  stdenv,
+}:
+let
+  sqliteSrc = fetchzip {
+    url = "https://sqlite.org/2024/sqlite-amalgamation-3450200.zip";
+    hash = "sha256-nkDMIiTHjeiopPbGcviQekgSOYifuNM/kr07IHgQvoI=";
+  };
+
+  inherit (stdenv.hostPlatform.extensions) sharedLibrary;
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "usearch";
+  version = "2.25.3";
+
+  outputs = [
+    "out"
+    "lib"
+    "dev"
+  ];
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "unum-cloud";
+    repo = "USearch";
+    tag = "v${finalAttrs.version}";
+    # we need to use the pinned stringzilla because the now removed (or partially by levenshtein replaced) hamming_distance is being used.
+    fetchSubmodules = true;
+    hash = "sha256-lk6cBUwu3+ud/43HSmDWVP2RhXtH8+KmWSuREPoKQ4s=";
+  };
+
+  postPatch = ''
+    rm -r numkong
+    # TODO: change numkong to provide a CMakeLists.txt file or pc config file, so that headers can be auto discovered
+    ln -s ${numkong.src} numkong
+  '';
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = [
+    jemalloc
+  ]
+  ++ lib.optional stdenv.hostPlatform.isDarwin llvmPackages.openmp;
+
+  postInstall = ''
+    install {libusearch*,sqlite/libsqlite3}${sharedLibrary} -t $lib/lib/
+  '';
+
+  preFixup =
+    lib.optionalString stdenv.hostPlatform.isLinux ''
+      patchelf \
+        --replace-needed libnumkong${sharedLibrary} $lib/lib/libnumkong${sharedLibrary} \
+        --replace-needed libsqlite3${sharedLibrary} $lib/lib/libsqlite3${sharedLibrary} \
+        --shrink-rpath $lib/lib/libusearch*
+    ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      install_name_tool -id $lib/lib/libnumkong${sharedLibrary} $lib/lib/libnumkong${sharedLibrary}
+      for f in $lib/lib/libusearch*${sharedLibrary}; do
+        install_name_tool \
+          -change @rpath/libnumkong${sharedLibrary} $lib/lib/libnumkong${sharedLibrary} \
+          "$f"
+      done
+    '';
+
+  cmakeFlags = [
+    # dependencies
+    (lib.cmakeBool "USEARCH_USE_JEMALLOC" true)
+    (lib.cmakeBool "USEARCH_USE_NUMKONG" true)
+    (lib.cmakeBool "USEARCH_USE_OPENMP" true)
+
+    # libraries
+    (lib.cmakeBool "USEARCH_BUILD_LIB_C" true)
+    (lib.cmakeBool "USEARCH_BUILD_SQLITE" true)
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_SQLITE3" sqliteSrc.outPath)
+
+    # checks
+    (lib.cmakeBool "USEARCH_BUILD_TEST_C" true)
+    (lib.cmakeBool "USEARCH_BUILD_TEST_CPP" true)
+
+    # benchmarking not only wastes CPU, but also requires the clipp repo to be cloned
+    (lib.cmakeBool "USEARCH_BUILD_BENCH_CPP" false)
+  ];
+
+  meta = {
+    description = "Smaller & Faster Single-File Vector Search Engine from Unum";
+    homepage = "https://github.com/unum-cloud/USearch/";
+    changelog = "https://github.com/unum-cloud/USearch/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ SuperSandro2000 ];
+  };
+})
diff --git a/pkgs/by-name/xe/xen/package.nix b/pkgs/by-name/xe/xen/package.nix
index 97fcdac5c16d..ed25d4d3e2df 100644
--- a/pkgs/by-name/xe/xen/package.nix
+++ b/pkgs/by-name/xe/xen/package.nix
@@ -210,6 +210,120 @@ stdenv.mkDerivation (finalAttrs: {
       hash = "sha256-QttKWdmWC6Zn5k2hd6RIMCpLWv71HB/A9mCbDP+i8to=";
     })
 
+    # XSA #490
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa490-4.21.patch";
+      hash = "sha256-PF4zNeaS8aXHBNKLcgjVBUqmREg+nvdyHyLlhX2YBiw=";
+    })
+
+    # XSA #491
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa491-4.21.patch";
+      hash = "sha256-I21YIcaK1v7BfBJi/aiVACgR3QyN+/gXnB4YMprT4zA=";
+    })
+
+    # XSA #492
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-01.patch";
+      hash = "sha256-U3nE7jgTKh2HmS9tMVQG+TIGvgU5B1aikC3NSER0CaY=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-02.patch";
+      hash = "sha256-Y3k9ICThfnIcu59F2pFDbFWD5DL6siPJmINmC7nT2uY=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-03.patch";
+      hash = "sha256-k4nPft59/MQwYKcdrzj5d80+LDhp05e86iJWzabjkQc=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-04.patch";
+      hash = "sha256-Mn+8q9zsstXbmrS/rkDdtwWEiD3EGNlmpa+eB1wESA4=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-05.patch";
+      hash = "sha256-csf9nf6cz3skhq1ph8HIs2AEVgBkw29hP39zwqy2vwM=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-06.patch";
+      hash = "sha256-urY9bjqqzKSGqGqEhDnagLUrzDsKkARMERT7vmukeUU=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-07.patch";
+      hash = "sha256-OyUC9bJevxiMuJuyJO9Z3ScXebe7lZM95HkK5YxGino=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-08.patch";
+      hash = "sha256-g3zV+r9LKjuMbkl4gprhWqClOgDU/Kbesr39LQiM+Aw=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-09.patch";
+      hash = "sha256-Wuc5dqwm+zwlYOzDXpRgyQH584sKwETi+xcE7HASHyI=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-10.patch";
+      hash = "sha256-ggln1O+epVOErBSUhIxX7xhwBy808vnQtcae3KYoQdo=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-11.patch";
+      hash = "sha256-/Yb1i/ms8MaVsEa/nK84CTFclOKcJoWMjjQJQab7l40=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-12.patch";
+      hash = "sha256-IpUeM+t7AZ8IVlzake+PiFAe0FCeFzChy+eaN9MAiSM=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-13.patch";
+      hash = "sha256-3vZj9VrDcFtlKrlMy1OD//F+6O252m23jJ0BRShQ6wA=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-14.patch";
+      hash = "sha256-LiBavW+FTfXdELs8Fm79KeOvskRqDXytv/e7eYRgSvY=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-15.patch";
+      hash = "sha256-0eK2hIFPNDIfv2W0ivkGL8Z3F+NpN4p2X0JVKjeBYWE=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-16.patch";
+      hash = "sha256-iEEkPC9mIuSF6Swt3/myUizsc8DubSPEkLkf1zm0/NE=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-17.patch";
+      hash = "sha256-YNo1wr+fRKk8+78Jf/zqJ7q9ugbzg7gyiyJ3zU+nB60=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-18.patch";
+      hash = "sha256-qNWe3iw+bYDtvBZ2KVfcy4VKu/waOyhoKZ0L8bqLdNc=";
+    })
+
+    # XSA #493
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa493/xsa493-4.20-01.patch";
+      hash = "sha256-SvAj+9CIyedpFENCB/lQTJUB4kpVkGh+z+NNk82lQqM=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa493/xsa493-4.20-02.patch";
+      hash = "sha256-4fajBBBKMnMTy7mvFSUghwkRbYo833s3jATeGfiOrjc=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa493/xsa493-4.20-03.patch";
+      hash = "sha256-/AI9gtd60UWf89NNd7+Zx1g+KyAIM2wCih/07LN5zt4=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa493/xsa493-4.20-04.patch";
+      hash = "sha256-qvXQG9VZkgca/za3bx1zTDkmRz5lFT3JPkbdI1mlBGY=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa493/xsa493-4.20-05.patch";
+      hash = "sha256-6pGjjPjalw6TY0n9TInE3nCXNmt6BUxwy1r1xf55U7k=";
+    })
+
+    # XSA #494
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa494-4.20.patch";
+      hash = "sha256-ns0s++J2adUD/HWuMiYad/g3MITs+twlMnkpFnP7T0w=";
+    })
+
     # patch `libxl` to search for `qemu-system-i386` properly. (Before 4.21)
     (fetchpatch {
       url = "https://github.com/xen-project/xen/commit/f6281291704aa356489f4bd927cc7348a920bd01.diff?full_index=1";
diff --git a/pkgs/by-name/yt/yt-dlp/package.nix b/pkgs/by-name/yt/yt-dlp/package.nix
index 9beb3ddae167..d02d3c968c27 100644
--- a/pkgs/by-name/yt/yt-dlp/package.nix
+++ b/pkgs/by-name/yt/yt-dlp/package.nix
@@ -32,14 +32,14 @@ python3Packages.buildPythonApplication rec {
   # The websites yt-dlp deals with are a very moving target. That means that
   # downloads break constantly. Because of that, updates should always be backported
   # to the latest stable release.
-  version = "2026.03.17";
+  version = "2026.06.09";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "yt-dlp";
     repo = "yt-dlp";
     tag = version;
-    hash = "sha256-A4LUCuKCjpVAOJ8jNoYaC3mRCiKH0/wtcsle0YfZyTA=";
+    hash = "sha256-ykqTDPzKKIWRGSQmw2esCRKyYqDZKXRYDeba888tkDU=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/apache-tvm-ffi/default.nix b/pkgs/development/python-modules/apache-tvm-ffi/default.nix
index 8344d888b80c..7850d08d382d 100644
--- a/pkgs/development/python-modules/apache-tvm-ffi/default.nix
+++ b/pkgs/development/python-modules/apache-tvm-ffi/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "apache-tvm-ffi";
-  version = "0.1.11";
+  version = "0.1.12";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -30,7 +30,7 @@ buildPythonPackage (finalAttrs: {
     repo = "tvm-ffi";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-dqAO6RLLGIRzPk7dNQsQCck+ziyONddhK/t4+S28cn8=";
+    hash = "sha256-ZFi7MKFiHK2lNoVkQbPhOc7NpIf24PLLP8SqGQiQ9Lw=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index 9e4fed7d3dc2..f550e69e4261 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -358,13 +358,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "boto3-stubs";
-  version = "1.43.25";
+  version = "1.43.26";
   pyproject = true;
 
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit (finalAttrs) version;
-    hash = "sha256-HhY3fGAi+qKL6QdY/8fRq56STqPv1rSKIMINkc7Y0vw=";
+    hash = "sha256-S8wFKxv8m2Z+tb2wnGDizSVCpnSTfmHLsZw8pWEnvoA=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/circuit-webhook/default.nix b/pkgs/development/python-modules/circuit-webhook/default.nix
index 43c1dceac1ca..890ab09cb001 100644
--- a/pkgs/development/python-modules/circuit-webhook/default.nix
+++ b/pkgs/development/python-modules/circuit-webhook/default.nix
@@ -2,18 +2,23 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "circuit-webhook";
   version = "1.0.1";
-  format = "setuptools";
+  pyproject = true;
+
+  __structuredAttrs = true;
 
   src = fetchPypi {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-NhePKBfzdkw7iVHmVrOxf8ZcQrb1Sq2xMIfu4P9+Ppw=";
   };
 
+  build-system = [ setuptools ];
+
   # Module has no tests
   doCheck = false;
 
@@ -25,4 +30,4 @@ buildPythonPackage rec {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/circuitbreaker/default.nix b/pkgs/development/python-modules/circuitbreaker/default.nix
index 71f4421efbda..f5b7985d8a0c 100644
--- a/pkgs/development/python-modules/circuitbreaker/default.nix
+++ b/pkgs/development/python-modules/circuitbreaker/default.nix
@@ -2,23 +2,28 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  setuptools,
   pytestCheckHook,
   pytest-asyncio,
   pytest-mock,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "circuitbreaker";
   version = "2.1.3";
-  format = "setuptools";
+  pyproject = true;
+
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "fabfuel";
     repo = "circuitbreaker";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-7BpYGhha0PTYzsE9CsN4KxfJW/wm2i6V+uAeamBREBQ=";
   };
 
+  build-system = [ setuptools ];
+
   nativeCheckInputs = [
     pytestCheckHook
     pytest-asyncio
@@ -33,4 +38,4 @@ buildPythonPackage rec {
     license = with lib.licenses; [ bsd3 ];
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/colorful/default.nix b/pkgs/development/python-modules/colorful/default.nix
index cf890a3b95b4..d8be8caeab4b 100644
--- a/pkgs/development/python-modules/colorful/default.nix
+++ b/pkgs/development/python-modules/colorful/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  gitUpdater,
   pytestCheckHook,
 }:
 
@@ -21,6 +22,13 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "colorful" ];
 
+  passthru.updateScript = gitUpdater {
+    # Drop the "v" tag prefix before version comparison.
+    rev-prefix = "v";
+    # Skip PEP 440 pre-release tags.
+    ignoredVersions = "(a|b|rc)[0-9]+$";
+  };
+
   meta = {
     description = "Library for terminal string styling";
     homepage = "https://github.com/timofurrer/colorful";
diff --git a/pkgs/development/python-modules/daphne/default.nix b/pkgs/development/python-modules/daphne/default.nix
index 103bbccaf828..0c2042d634d9 100644
--- a/pkgs/development/python-modules/daphne/default.nix
+++ b/pkgs/development/python-modules/daphne/default.nix
@@ -13,16 +13,16 @@
   twisted,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "daphne";
-  version = "4.2.1";
+  version = "4.2.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "django";
     repo = "daphne";
-    tag = version;
-    hash = "sha256-MPlvXcg7bBF1yaphjjMtnGsGpp6ca5GsgmXONw/V9Do=";
+    tag = finalAttrs.version;
+    hash = "sha256-i0BwZCpMZW6WXK94FSvlEheXHUzXviCBEew6AbkLkpk=";
   };
 
   build-system = [ setuptools ];
@@ -49,9 +49,9 @@ buildPythonPackage rec {
   meta = {
     description = "Django ASGI (HTTP/WebSocket) server";
     homepage = "https://github.com/django/daphne";
-    changelog = "https://github.com/django/daphne/blob/${src.tag}/CHANGELOG.txt";
+    changelog = "https://github.com/django/daphne/blob/${finalAttrs.src.tag}/CHANGELOG.txt";
     license = lib.licenses.bsd3;
     maintainers = [ ];
     mainProgram = "daphne";
   };
-}
+})
diff --git a/pkgs/development/python-modules/fava-dashboards/default.nix b/pkgs/development/python-modules/fava-dashboards/default.nix
index f491284adf9d..05801e2c29a6 100644
--- a/pkgs/development/python-modules/fava-dashboards/default.nix
+++ b/pkgs/development/python-modules/fava-dashboards/default.nix
@@ -11,14 +11,14 @@
 }:
 buildPythonPackage rec {
   pname = "fava-dashboards";
-  version = "2.0.0b8";
+  version = "2.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "andreasgerstmayr";
     repo = "fava-dashboards";
     tag = "v${version}";
-    hash = "sha256-OK7gMppM71ah7BfzpFbv2bhfqLrx5tv1zIH+InjKCgM=";
+    hash = "sha256-VmTdo6FUnGyy+7o5azE81SqQFsY4zaHzz7dK83SVbpg=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/genai-prices/default.nix b/pkgs/development/python-modules/genai-prices/default.nix
index b70c8e0720af..2ffb33367aca 100644
--- a/pkgs/development/python-modules/genai-prices/default.nix
+++ b/pkgs/development/python-modules/genai-prices/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "genai-prices";
-  version = "0.0.65";
+  version = "0.0.66";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "genai-prices";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3iqHpJpEdCfBObdcbS0MlVrPNqAAvN4ymCD6JDeb+LE=";
+    hash = "sha256-bvAAdlijxRzgjEeZEibuywJXhxKBWWQVPzO8gr6dWzo=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/packages/python";
diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index a56e9144c04d..555f5afc4ada 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202606081";
+  version = "0.1.202606101";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HSbPchHp31UCv/XPWfzlrYq3BBzFvm+S++IzRurFj5U=";
+    hash = "sha256-tEa1DRwZyh8ZY0yfzvYHReSZH/Cyt4xP0K6pO5NKtzI=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/mitsubishi-comfort/default.nix b/pkgs/development/python-modules/mitsubishi-comfort/default.nix
index 9aaeab111986..25d0c4055739 100644
--- a/pkgs/development/python-modules/mitsubishi-comfort/default.nix
+++ b/pkgs/development/python-modules/mitsubishi-comfort/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "mitsubishi-comfort";
-  version = "0.3.0";
+  version = "0.3.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "nikolairahimi";
     repo = "mitsubishi-comfort";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-O/HAPb7MYU0/LEVS4ynddQuN6HKZUOUKWFn/CMz2q5E=";
+    hash = "sha256-PyNWGCxO04+/4BCN22qvKoHB1Molp5jLFNHIxRFavNY=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index aef5fe5abba5..7eeb58980c45 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -255,8 +255,8 @@ in
       "sha256-PVskBSuwqSfNybHDtLLfVpDG0dwR/Q1LhrHz1imsR8A=";
 
   mypy-boto3-cloudwatch =
-    buildMypyBoto3Package "cloudwatch" "1.43.2"
-      "sha256-oI+4JjIbiNqAQ6QXXX3OeigRmsIqym4S2TiwrjMijQU=";
+    buildMypyBoto3Package "cloudwatch" "1.43.26"
+      "sha256-O14h+8ujsxe+RSA5NxmZyfRHMdQDr9g3Yre15qjV7Oc=";
 
   mypy-boto3-codeartifact =
     buildMypyBoto3Package "codeartifact" "1.43.0"
@@ -443,8 +443,8 @@ in
       "sha256-dXNkOcMonYrBh4yzeubd+v3mW42s9XpmpfvgbtgoJgY=";
 
   mypy-boto3-ec2 =
-    buildMypyBoto3Package "ec2" "1.43.20"
-      "sha256-OGxCwLfDYlx43+HEuVHsrC59c67yTJ37ttOu4TWw3U0=";
+    buildMypyBoto3Package "ec2" "1.43.26"
+      "sha256-IGl4y8hDpdsqKcky6UgukfDlnSjbyYsa69sPiYZYcN4=";
 
   mypy-boto3-ec2-instance-connect =
     buildMypyBoto3Package "ec2-instance-connect" "1.43.0"
@@ -990,8 +990,8 @@ in
       "sha256-0rAEnU+3VsESGKlu8OTnY//rzwRqvROhRFga+vnwd1k=";
 
   mypy-boto3-outposts =
-    buildMypyBoto3Package "outposts" "1.43.0"
-      "sha256-fVKNAX3cx9jeCndcQYyxp9lgqHL91yFOg6dX/kNv27Q=";
+    buildMypyBoto3Package "outposts" "1.43.26"
+      "sha256-GWsZ1RZyTt8A04O9s1HeakDhUpOmdGRSGjXy2lIXxKo=";
 
   mypy-boto3-panorama =
     buildMypyBoto3Package "panorama" "1.43.0"
diff --git a/pkgs/development/python-modules/niquests/default.nix b/pkgs/development/python-modules/niquests/default.nix
index aa35897ace86..be93ae9a06c9 100644
--- a/pkgs/development/python-modules/niquests/default.nix
+++ b/pkgs/development/python-modules/niquests/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "niquests";
-  version = "3.19.0";
+  version = "3.19.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jawah";
     repo = "niquests";
     tag = "v${version}";
-    hash = "sha256-rdF+/AGZgfqdiQKlcwa4GDlYWdplAktpkYK9FAN10xk=";
+    hash = "sha256-YADGkjNAG7k6peC0vaH/8OSLbaQSsxsKik3RWIqgc+w=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/numkong/default.nix b/pkgs/development/python-modules/numkong/default.nix
new file mode 100644
index 000000000000..8c80135f1069
--- /dev/null
+++ b/pkgs/development/python-modules/numkong/default.nix
@@ -0,0 +1,53 @@
+{
+  lib,
+  buildPythonPackage,
+  llvmPackages,
+  ml-dtypes,
+  numpy,
+  pkgs,
+  pytest-repeat,
+  pytest-xdist,
+  pytestCheckHook,
+  scipy,
+  setuptools,
+  stdenv,
+}:
+
+buildPythonPackage {
+  inherit (pkgs.numkong) pname version src;
+  pyproject = true;
+
+  build-system = [
+    setuptools
+  ];
+
+  buildInputs = lib.optional stdenv.hostPlatform.isDarwin llvmPackages.openmp;
+
+  pythonImportsCheck = [ "numkong" ];
+
+  nativeCheckInputs = [
+    numpy
+    scipy
+    ml-dtypes
+    pytest-repeat
+    pytest-xdist
+    pytestCheckHook
+    # there are more tests for big libraries, but we avoid them to not explode the closure size
+  ];
+
+  disabledTestPaths = lib.optionals stdenv.hostPlatform.isDarwin [
+    # slight floating point error
+    "test/test_similarities.py::test_cdist_float_accuracy"
+    "test/test_similarities.py::test_cdist_jaccard"
+  ];
+
+  meta = {
+    inherit (pkgs.numkong.meta)
+      description
+      homepage
+      changelog
+      license
+      maintainers
+      ;
+  };
+}
diff --git a/pkgs/development/python-modules/ocrmypdf/default.nix b/pkgs/development/python-modules/ocrmypdf/default.nix
index af30537a6d2d..1da37e14a025 100644
--- a/pkgs/development/python-modules/ocrmypdf/default.nix
+++ b/pkgs/development/python-modules/ocrmypdf/default.nix
@@ -32,7 +32,7 @@
 
 buildPythonPackage rec {
   pname = "ocrmypdf";
-  version = "17.4.2";
+  version = "17.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -45,7 +45,7 @@ buildPythonPackage rec {
     postFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    hash = "sha256-UH05Q80FgbHzCvTnMX/J5LXGb7mNj5giLIx+8FdbKfU=";
+    hash = "sha256-t8uczNeuGgFRMToXNn/aX/eXlfeDU5Hgq82gJl9zB1E=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/ocrmypdf/paths.patch b/pkgs/development/python-modules/ocrmypdf/paths.patch
index ad3741760b43..68309f5bbfd0 100644
--- a/pkgs/development/python-modules/ocrmypdf/paths.patch
+++ b/pkgs/development/python-modules/ocrmypdf/paths.patch
@@ -1,8 +1,8 @@
 diff --git a/src/ocrmypdf/_exec/ghostscript.py b/src/ocrmypdf/_exec/ghostscript.py
-index ec9017ca..0986641d 100644
+index 5afd6e17..0db47849 100644
 --- a/src/ocrmypdf/_exec/ghostscript.py
 +++ b/src/ocrmypdf/_exec/ghostscript.py
-@@ -35,7 +35,7 @@ COLOR_CONVERSION_STRATEGIES = frozenset(
+@@ -36,7 +36,7 @@ COLOR_CONVERSION_STRATEGIES = frozenset(
      ]
  )
  # Ghostscript executable - gswin32c is not supported
@@ -12,19 +12,19 @@ index ec9017ca..0986641d 100644
  
  log = logging.getLogger(__name__)
 diff --git a/src/ocrmypdf/_exec/jbig2enc.py b/src/ocrmypdf/_exec/jbig2enc.py
-index 736de67e..d8c24ebd 100644
+index 9f107a07..469aed48 100644
 --- a/src/ocrmypdf/_exec/jbig2enc.py
 +++ b/src/ocrmypdf/_exec/jbig2enc.py
-@@ -15,7 +15,7 @@ from ocrmypdf.subprocess import get_version, run
+@@ -13,7 +13,7 @@ from ocrmypdf._exec._probe import ToolProbe
+ from ocrmypdf.exceptions import MissingDependencyError
+ from ocrmypdf.subprocess import run
+ 
+-_PROBE = ToolProbe(program='jbig2', version_regex=r'jbig2enc (\d+(\.\d+)*).*')
++_PROBE = ToolProbe(program='@jbig2@', version_regex=r'jbig2enc (\d+(\.\d+)*).*')
+ 
  
  def version() -> Version:
-     try:
--        version = get_version('jbig2', regex=r'jbig2enc (\d+(\.\d+)*).*')
-+        version = get_version('@jbig2@', regex=r'jbig2enc (\d+(\.\d+)*).*')
-     except CalledProcessError as e:
-         # TeX Live for Windows provides an incompatible jbig2.EXE which may
-         # be on the PATH.
-@@ -32,7 +32,7 @@ def available():
+@@ -34,7 +34,7 @@ def available() -> bool:
  
  
  def convert_single(cwd, infile, outfile, threshold):
@@ -34,19 +34,19 @@ index 736de67e..d8c24ebd 100644
          proc = run(args, cwd=cwd, stdout=fstdout, stderr=PIPE)
      proc.check_returncode()
 diff --git a/src/ocrmypdf/_exec/pngquant.py b/src/ocrmypdf/_exec/pngquant.py
-index 5b8600d0..fcad771b 100644
+index 94bcdbf0..c0ae0fa3 100644
 --- a/src/ocrmypdf/_exec/pngquant.py
 +++ b/src/ocrmypdf/_exec/pngquant.py
-@@ -15,7 +15,7 @@ from ocrmypdf.subprocess import get_version, run
+@@ -11,7 +11,7 @@ from subprocess import PIPE
+ from ocrmypdf._exec._probe import ToolProbe
+ from ocrmypdf.subprocess import run
  
+-PROBE = ToolProbe(program='pngquant', version_regex=r'(\d+(\.\d+)*).*')
++PROBE = ToolProbe(program='@pngquant@', version_regex=r'(\d+(\.\d+)*).*')
+ version = PROBE.version
+ available = PROBE.available
  
- def version() -> Version:
--    return Version(get_version('pngquant', regex=r'(\d+(\.\d+)*).*'))
-+    return Version(get_version('@pngquant@', regex=r'(\d+(\.\d+)*).*'))
- 
- 
- def available():
-@@ -37,7 +37,7 @@ def quantize(input_file: Path, output_file: Path, quality_min: int, quality_max:
+@@ -27,7 +27,7 @@ def quantize(input_file: Path, output_file: Path, quality_min: int, quality_max:
      """
      with open(input_file, 'rb') as input_stream:
          args = [
@@ -56,19 +56,19 @@ index 5b8600d0..fcad771b 100644
              '--skip-if-larger',
              '--quality',
 diff --git a/src/ocrmypdf/_exec/tesseract.py b/src/ocrmypdf/_exec/tesseract.py
-index d41a0af7..b189b0de 100644
+index 861f2d50..010ef6a6 100644
 --- a/src/ocrmypdf/_exec/tesseract.py
 +++ b/src/ocrmypdf/_exec/tesseract.py
-@@ -116,7 +116,7 @@ class TesseractVersion(Version):
+@@ -117,7 +117,7 @@ class TesseractVersion(Version):
  
  
- def version() -> Version:
--    return TesseractVersion(get_version('tesseract', regex=r'tesseract\s(.+)'))
-+    return TesseractVersion(get_version('@tesseract@', regex=r'tesseract\s(.+)'))
- 
- 
- def has_thresholding() -> bool:
-@@ -134,7 +134,7 @@ def get_languages() -> set[str]:
+ PROBE = ToolProbe(
+-    program='tesseract',
++    program='@tesseract@',
+     version_regex=r'tesseract\s(.+)',
+     version_cls=TesseractVersion,
+ )
+@@ -140,7 +140,7 @@ def get_languages() -> set[str]:
          msg += output
          return msg
  
@@ -77,7 +77,7 @@ index d41a0af7..b189b0de 100644
      try:
          proc = run(
              args_tess,
-@@ -156,7 +156,7 @@ def get_languages() -> set[str]:
+@@ -162,7 +162,7 @@ def get_languages() -> set[str]:
  
  
  def tess_base_args(langs: list[str], engine_mode: int | None) -> list[str]:
@@ -87,19 +87,19 @@ index d41a0af7..b189b0de 100644
          args.extend(['-l', '+'.join(langs)])
      if engine_mode is not None:
 diff --git a/src/ocrmypdf/_exec/unpaper.py b/src/ocrmypdf/_exec/unpaper.py
-index 065fc9ef..4fab9313 100644
+index 54bf6a24..5d8ee18a 100644
 --- a/src/ocrmypdf/_exec/unpaper.py
 +++ b/src/ocrmypdf/_exec/unpaper.py
-@@ -47,7 +47,7 @@ class UnpaperImageTooLargeError(Exception):
+@@ -46,7 +46,7 @@ class UnpaperImageTooLargeError(Exception):
+         super().__init__(self.message)
  
  
- def version() -> Version:
--    return Version(get_version('unpaper', regex=r'(?m).*?(\d+(\.\d+)(\.\d+)?)'))
-+    return Version(get_version('@unpaper@', regex=r'(?m).*?(\d+(\.\d+)(\.\d+)?)'))
+-PROBE = ToolProbe(program='unpaper', version_regex=r'(?m).*?(\d+(\.\d+)(\.\d+)?)')
++PROBE = ToolProbe(program='@unpaper@', version_regex=r'(?m).*?(\d+(\.\d+)(\.\d+)?)')
+ version = PROBE.version
+ available = PROBE.available
  
- 
- @contextmanager
-@@ -69,7 +69,7 @@ def _setup_unpaper_io(input_file: Path) -> Iterator[tuple[Path, Path, Path]]:
+@@ -70,7 +70,7 @@ def _setup_unpaper_io(input_file: Path) -> Iterator[tuple[Path, Path, Path]]:
  def run_unpaper(
      input_file: Path, output_file: Path, *, dpi: DecFloat, mode_args: list[str]
  ) -> None:
diff --git a/pkgs/development/python-modules/oelint-data/default.nix b/pkgs/development/python-modules/oelint-data/default.nix
index 210e0b730448..9a050028b68b 100644
--- a/pkgs/development/python-modules/oelint-data/default.nix
+++ b/pkgs/development/python-modules/oelint-data/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "oelint-data";
-  version = "1.5.2";
+  version = "1.5.3";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -16,7 +16,7 @@ buildPythonPackage (finalAttrs: {
     owner = "priv-kweihmann";
     repo = "oelint-data";
     tag = finalAttrs.version;
-    hash = "sha256-M0vGXXoQvVW6801gWQ6gf6/Z/ZFzREfVlHD6pTyG7rU=";
+    hash = "sha256-cTfalHdfMu21sxAY8ssXE9a1L5xTHtbM7bQX2PPUdWE=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/opower/default.nix b/pkgs/development/python-modules/opower/default.nix
index e7b09c307ad1..7a1a3fb5cba2 100644
--- a/pkgs/development/python-modules/opower/default.nix
+++ b/pkgs/development/python-modules/opower/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "opower";
-  version = "0.18.3";
+  version = "0.18.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tronikos";
     repo = "opower";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LQKXBK8JHSAGpzbbRz1ELEtQkPaU6I4OKW3NWA0kqKo=";
+    hash = "sha256-AAKaRnjj6M4mmFkYRInmxlIwEGA7lA2foiT8FwDOB98=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pydantic-ai-slim/default.nix b/pkgs/development/python-modules/pydantic-ai-slim/default.nix
index 02a619664d12..b628379a6623 100644
--- a/pkgs/development/python-modules/pydantic-ai-slim/default.nix
+++ b/pkgs/development/python-modules/pydantic-ai-slim/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pydantic-ai-slim";
-  version = "1.106.0";
+  version = "1.107.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "pydantic-ai";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-D7fCBhGJjcBeIoddIFobfZBUocgQW2R0vhTGdvd/Dew=";
+    hash = "sha256-++tAI+KRCscDWqPQx5oswrjDq2txpzdI1ls/O/aAClE=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/pydantic_ai_slim";
diff --git a/pkgs/development/python-modules/pydantic-graph/default.nix b/pkgs/development/python-modules/pydantic-graph/default.nix
index 388b913037bb..f06f28fb636f 100644
--- a/pkgs/development/python-modules/pydantic-graph/default.nix
+++ b/pkgs/development/python-modules/pydantic-graph/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pydantic-graph";
-  version = "1.106.0";
+  version = "1.107.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "pydantic-ai";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-D7fCBhGJjcBeIoddIFobfZBUocgQW2R0vhTGdvd/Dew=";
+    hash = "sha256-++tAI+KRCscDWqPQx5oswrjDq2txpzdI1ls/O/aAClE=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/pydantic_graph";
diff --git a/pkgs/development/python-modules/pyfirefly/default.nix b/pkgs/development/python-modules/pyfirefly/default.nix
index 45ecc9622d72..401c52be868c 100644
--- a/pkgs/development/python-modules/pyfirefly/default.nix
+++ b/pkgs/development/python-modules/pyfirefly/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "pyfirefly";
-  version = "0.1.15";
+  version = "0.1.16";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "erwindouna";
     repo = "pyfirefly";
     tag = "v${version}";
-    hash = "sha256-vB/2CJMr5UEkANmJYCSA8igDCTYX0DFitDK3RFr68aE=";
+    hash = "sha256-RrVjXhV42DBvmTcZMowmHXN5K4nZfKPT/CDbvf1tOAQ=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/pylacus/default.nix b/pkgs/development/python-modules/pylacus/default.nix
index ada67fdb2fcc..4cedb1b119a2 100644
--- a/pkgs/development/python-modules/pylacus/default.nix
+++ b/pkgs/development/python-modules/pylacus/default.nix
@@ -2,25 +2,31 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  lookyloo-models,
   poetry-core,
+  pydantic,
   requests,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "pylacus";
-  version = "1.21.3";
+  version = "1.24.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ail-project";
     repo = "PyLacus";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cQsrrifoDnNrliRoDoJtTgFMu8FjgSmm3Td4HXrLjwQ=";
+    hash = "sha256-qrHYEt837BN24ds63TdHdhfhthYlm9spBKONyTYFePg=";
   };
 
   build-system = [ poetry-core ];
 
-  dependencies = [ requests ];
+  dependencies = [
+    lookyloo-models
+    pydantic
+    requests
+  ];
 
   # Tests require network access
   doCheck = false;
diff --git a/pkgs/development/python-modules/pypdf/default.nix b/pkgs/development/python-modules/pypdf/default.nix
index c31050919373..a6be695a03a8 100644
--- a/pkgs/development/python-modules/pypdf/default.nix
+++ b/pkgs/development/python-modules/pypdf/default.nix
@@ -13,6 +13,7 @@
 
   # optionals
   cryptography,
+  fonttools,
   pillow,
 
   # tests
@@ -23,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "pypdf";
-  version = "6.12.2";
+  version = "6.13.2";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -32,7 +33,7 @@ buildPythonPackage rec {
     tag = version;
     # fetch sample files used in tests
     fetchSubmodules = true;
-    hash = "sha256-rRvRAasPgE5nCChYJYB9olSE3RWmztYSJoAbmh+a3Q0=";
+    hash = "sha256-P/tm4roaVVnEq/bUsyk3S2ts7UWBWbDuZ1RqNKGxUS0=";
   };
 
   outputs = [
@@ -54,8 +55,9 @@ buildPythonPackage rec {
   ];
 
   optional-dependencies = rec {
-    full = crypto ++ image;
+    full = crypto ++ fonts ++ image;
     crypto = [ cryptography ];
+    fonts = [ fonttools ];
     image = [ pillow ];
   };
 
diff --git a/pkgs/development/python-modules/pyportainer/default.nix b/pkgs/development/python-modules/pyportainer/default.nix
index 8c439ec7cd1e..82d1a4a55b4f 100644
--- a/pkgs/development/python-modules/pyportainer/default.nix
+++ b/pkgs/development/python-modules/pyportainer/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pyportainer";
-  version = "1.0.40";
+  version = "1.0.41";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "erwindouna";
     repo = "pyportainer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pwyGy2pVwY4vfjEpEYLK+9kh+HxLjfQE+JfvPzsLt5k=";
+    hash = "sha256-pQGObEYmj5Off573wwxLdU6p+kJsGqDyPVPzmD6vCc8=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/pytransportnswv2/default.nix b/pkgs/development/python-modules/pytransportnswv2/default.nix
index 5e1d1bc09663..5e0bea53508a 100644
--- a/pkgs/development/python-modules/pytransportnswv2/default.nix
+++ b/pkgs/development/python-modules/pytransportnswv2/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pytransportnswv2";
-  version = "3.0.2";
+  version = "3.0.5";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-mAVrt0Ui/mXDKAq0sf2A9E3zM3P5Eq9NXSQdw68B4hY=";
+    hash = "sha256-ECU5uCcglCOIDwqL2hc0XS8L0gpY1JUzoogzmzGwApo=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/qh3/default.nix b/pkgs/development/python-modules/qh3/default.nix
index a9dd473d49e6..972e74318f10 100644
--- a/pkgs/development/python-modules/qh3/default.nix
+++ b/pkgs/development/python-modules/qh3/default.nix
@@ -12,21 +12,21 @@
   stdenv,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "qh3";
-  version = "1.9.1";
+  version = "1.9.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jawah";
     repo = "qh3";
-    tag = "v${version}";
-    hash = "sha256-8eH/aHEVFNKxgjHYycmzs0EiZFQXeL6uJ4NY7S1BU5w=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-B1bCh4/KKXMbGb89XTiMaNqabeIdJ2hbDObzuNEj4NE=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit pname version src;
-    hash = "sha256-/YEci4OvRg6RR0HG+vvz4S+KBXwpLiH0gbiLaY989+4=";
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-9Bx8K9UwjEN/25+rePzm7ZNZ4nkNOCnwPjlooIA+Cuk=";
   };
 
   nativeBuildInputs = [
@@ -69,10 +69,10 @@ buildPythonPackage rec {
   ];
 
   meta = {
-    changelog = "https://github.com/jawah/qh3/blob/${src.tag}/CHANGELOG.rst";
+    changelog = "https://github.com/jawah/qh3/blob/${finalAttrs.src.tag}/CHANGELOG.rst";
     description = "Lightweight QUIC and HTTP/3 implementation in Python";
     homepage = "https://github.com/jawah/qh3";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ dotlambda ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/renault-api/default.nix b/pkgs/development/python-modules/renault-api/default.nix
index 04c5c5e1be50..86d6d6a4f489 100644
--- a/pkgs/development/python-modules/renault-api/default.nix
+++ b/pkgs/development/python-modules/renault-api/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "renault-api";
-  version = "0.5.11";
+  version = "0.5.12";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "hacf-fr";
     repo = "renault-api";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rIUG+HuHf5MXxPtOPjMRtRfurm1yUoNuqG494im2dQw=";
+    hash = "sha256-XUrI03gr3U0wfEXLNGaxGil2tOfXrmeUUuH5lVKF0e0=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/sqlmap/default.nix b/pkgs/development/python-modules/sqlmap/default.nix
index be7951219592..da441931a960 100644
--- a/pkgs/development/python-modules/sqlmap/default.nix
+++ b/pkgs/development/python-modules/sqlmap/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "sqlmap";
-  version = "1.10.5";
+  version = "1.10.6";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-LS4K7+3KyxjVoFKeNteRypSa7Yr6RAHiL/eviY8YajE=";
+    hash = "sha256-8dww72u6Y1WG3Fy3sb8RPVoWIaPW6uNWhE7MliCbMis=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/ssdeep/default.nix b/pkgs/development/python-modules/ssdeep/default.nix
index 8c56f06ceeed..6890c339e553 100644
--- a/pkgs/development/python-modules/ssdeep/default.nix
+++ b/pkgs/development/python-modules/ssdeep/default.nix
@@ -4,25 +4,30 @@
   cffi,
   fetchFromGitHub,
   pytestCheckHook,
+  setuptools,
   six,
   ssdeep,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "ssdeep";
   version = "3.4.1";
-  format = "setuptools";
+  pyproject = true;
+
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "DinoTools";
     repo = "python-ssdeep";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-I5ci5BS+B3OE0xdLSahu3HCh99jjhnRHJFz830SvFpg=";
   };
 
   buildInputs = [ ssdeep ];
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     cffi
     six
   ];
@@ -39,8 +44,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python wrapper for the ssdeep library";
     homepage = "https://github.com/DinoTools/python-ssdeep";
-    changelog = "https://github.com/DinoTools/python-ssdeep/blob/${version}/CHANGELOG.rst";
+    changelog = "https://github.com/DinoTools/python-ssdeep/blob/${finalAttrs.version}/CHANGELOG.rst";
     license = lib.licenses.lgpl3Plus;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/torchcodec/default.nix b/pkgs/development/python-modules/torchcodec/default.nix
index 07ad8ff72b81..db1d474a6be0 100644
--- a/pkgs/development/python-modules/torchcodec/default.nix
+++ b/pkgs/development/python-modules/torchcodec/default.nix
@@ -99,6 +99,9 @@ buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
 
     ENABLE_CUDA = cudaSupport;
   }
+  // lib.optionalAttrs cudaSupport {
+    TORCH_CUDA_ARCH_LIST = "${lib.concatStringsSep ";" torch.cudaCapabilities}";
+  }
   // lib.optionalAttrs rocmSupport {
     ROCM_PATH = torch.rocmtoolkit_joined;
     ROCM_SOURCE_DIR = torch.rocmtoolkit_joined;
diff --git a/pkgs/development/python-modules/usearch/default.nix b/pkgs/development/python-modules/usearch/default.nix
new file mode 100644
index 000000000000..c04ce651f768
--- /dev/null
+++ b/pkgs/development/python-modules/usearch/default.nix
@@ -0,0 +1,71 @@
+{
+  lib,
+  buildPythonPackage,
+  cmake,
+  numba,
+  numpy,
+  numkong,
+  py-cpuinfo,
+  pybind11,
+  pytestCheckHook,
+  setuptools,
+  tqdm,
+  pkgs,
+  stdenv,
+  which,
+  writableTmpDirAsHomeHook,
+}:
+
+buildPythonPackage {
+  inherit (pkgs.usearch) pname version src;
+  pyproject = true;
+
+  postPatch = ''
+    substituteInPlace python/usearch/__init__.py \
+      --replace-fail 'manager = BinaryManager(version=version)' \
+        'return "${lib.getLib pkgs.usearch}/lib/libusearch_sqlite${
+          if stdenv.hostPlatform.isDarwin then "" else stdenv.hostPlatform.extensions.sharedLibrary
+        }"'
+  '';
+
+  nativeBuildInputs = [
+    which
+  ];
+
+  buildInputs = [
+    pkgs.numkong
+  ];
+
+  build-system = [
+    cmake
+    pybind11
+    setuptools
+  ];
+
+  dependencies = [
+    numkong
+    numpy
+    tqdm
+  ];
+
+  dontUseCmakeConfigure = true;
+
+  pythonImportsCheck = [ "usearch" ];
+
+  nativeCheckInputs = [
+    numba
+    py-cpuinfo
+    pytestCheckHook
+    writableTmpDirAsHomeHook
+  ];
+
+  meta = {
+    inherit (pkgs.usearch.meta)
+      description
+      homepage
+      changelog
+      license
+      maintainers
+      ;
+  };
+}
diff --git a/pkgs/development/python-modules/webdriver-manager/default.nix b/pkgs/development/python-modules/webdriver-manager/default.nix
index 1c02bd404cc0..d0ded688ed0f 100644
--- a/pkgs/development/python-modules/webdriver-manager/default.nix
+++ b/pkgs/development/python-modules/webdriver-manager/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "webdriver-manager";
-  version = "4.1.1";
+  version = "4.1.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "SergeyPirogov";
     repo = "webdriver_manager";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-MqLM1mSfoirBaJYKkikNuS2XPWPTM2MQNgEwhtp+2ek=";
+    hash = "sha256-UQeiBtql0+IEG0iY0XoY+iqKqMB9Wmt+NxH7coxrJCw=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/zinvolt/default.nix b/pkgs/development/python-modules/zinvolt/default.nix
index 0690f318b7e0..81bec8ce2c43 100644
--- a/pkgs/development/python-modules/zinvolt/default.nix
+++ b/pkgs/development/python-modules/zinvolt/default.nix
@@ -6,7 +6,7 @@
   fetchFromGitHub,
   mashumaro,
   orjson,
-  poetry-core,
+  hatchling,
   pytest-asyncio,
   pytest-cov-stub,
   pytestCheckHook,
@@ -16,17 +16,17 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "zinvolt";
-  version = "0.4.3";
+  version = "1.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "joostlek";
     repo = "python-zinvolt";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-psZ9/V/bBGGvKdKxuvncJzJOB1jolYTeNw2XOJmxfco=";
+    hash = "sha256-e4kbAEUxJzc2qOnXhtNMFUeDcsUc/G1Wo0LHwTQcgXs=";
   };
 
-  build-system = [ poetry-core ];
+  build-system = [ hatchling ];
 
   dependencies = [
     aiohttp
diff --git a/pkgs/development/tools/pnpm/default.nix b/pkgs/development/tools/pnpm/default.nix
index 894e449b3d1c..b8fdc30fd0f6 100644
--- a/pkgs/development/tools/pnpm/default.nix
+++ b/pkgs/development/tools/pnpm/default.nix
@@ -26,8 +26,8 @@ let
       hash = "sha256-WOFDJYhx31FYm2UcBiBdq+xIdmpdu6PCWZm2m1C+WY4=";
     };
     "11" = {
-      version = "11.5.2";
-      hash = "sha256-dJ3FT709zenkFLquMsF3yoR3DT/NaciBbVea3D5qLJk=";
+      version = "11.5.3";
+      hash = "sha256-I41jmkdxIni7cui22ywpesHM2A3XZC98kztzrr3ntR8=";
     };
   };
 
diff --git a/pkgs/os-specific/linux/kernel/build.nix b/pkgs/os-specific/linux/kernel/build.nix
index 23a08f5beaa4..8d727aa521fb 100644
--- a/pkgs/os-specific/linux/kernel/build.nix
+++ b/pkgs/os-specific/linux/kernel/build.nix
@@ -63,6 +63,19 @@ lib.makeOverridable (
     kernelPatches ? [ ],
     # The kernel .config file
     configfile,
+    target ?
+      if stdenv.hostPlatform.isx86 then
+        "bzImage"
+      else if stdenv.hostPlatform.isAarch32 then
+        "zImage"
+      else if stdenv.hostPlatform.isAarch64 || stdenv.hostPlatform.isRiscV then
+        "Image"
+      else if stdenv.hostPlatform.isLoongArch64 then
+        "vmlinuz.efi"
+      else
+        "vmlinux",
+    buildDTBs ?
+      stdenv.hostPlatform.isAarch || stdenv.hostPlatform.isRiscV || stdenv.hostPlatform.isLoongArch64,
     # Manually specified nixexpr representing the config
     # If unspecified, this will be autodetected from the .config
     config ? lib.optionalAttrs (builtins.isPath configfile || allowImportFromDerivation) (
@@ -139,9 +152,7 @@ lib.makeOverridable (
     isModular = config.isYes "MODULES";
     withRust = config.isYes "RUST";
 
-    target = stdenv.hostPlatform.linux-kernel.target or "vmlinux";
-
-    buildDTBs = stdenv.hostPlatform.linux-kernel.DTB or false;
+    inherit buildDTBs target;
 
     # Dependencies that are required to build kernel modules
     moduleBuildDependencies = [
@@ -204,7 +215,7 @@ lib.makeOverridable (
 
     buildFlags = [
       "KBUILD_BUILD_VERSION=1-NixOS"
-      stdenv.hostPlatform.linux-kernel.target
+      target
       "vmlinux" # for "perf" and things like that
       "scripts_gdb"
     ]
@@ -496,6 +507,8 @@ lib.makeOverridable (
         config
         kernelPatches
         configfile
+        target
+        buildDTBs
         moduleBuildDependencies
         stdenv
         commonMakeFlags
@@ -511,7 +524,7 @@ lib.makeOverridable (
 
     # Some image types need special install targets
     installTargets = [
-      (stdenv.hostPlatform.linux-kernel.installTarget or (
+      (
         if
           (target == "zImage" || target == "Image.gz" || target == "vmlinuz.efi")
           && builtins.elem stdenv.hostPlatform.linuxArch [
@@ -525,7 +538,6 @@ lib.makeOverridable (
         else
           "install"
       )
-      )
     ];
 
     karch = stdenv.hostPlatform.linuxArch;
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 6ff780c690a6..f89fa487bfe2 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -1134,7 +1134,7 @@ let
         useZstd = stdenv.buildPlatform.is64bit;
       in
       {
-        # stdenv.hostPlatform.linux-kernel.target assumes uncompressed on RISC-V.
+        # The default target assumes uncompressed on RISC-V.
         KERNEL_UNCOMPRESSED = lib.mkIf stdenv.hostPlatform.isRiscV yes;
 
         KERNEL_XZ = lib.mkIf (
diff --git a/pkgs/os-specific/linux/kernel/common-flags.nix b/pkgs/os-specific/linux/kernel/common-flags.nix
index 410a112825ee..7e5b72d490d0 100644
--- a/pkgs/os-specific/linux/kernel/common-flags.nix
+++ b/pkgs/os-specific/linux/kernel/common-flags.nix
@@ -36,5 +36,4 @@
     "CFLAGS_KERNEL=-I${clangLib}/lib/clang/${majorVer}/include"
   ]
 )
-++ (stdenv.hostPlatform.linux-kernel.makeFlags or [ ])
 ++ extraMakeFlags
diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index f1e46a32b9c1..30c356823ddc 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -32,7 +32,16 @@ lib.makeOverridable (
     version,
 
     # Allows overriding the default defconfig
-    defconfig ? null,
+    # TODO: Reconsider some of these defaults?
+    defconfig ?
+      if stdenv.hostPlatform.isAarch32 && stdenv.hostPlatform.parsed.cpu.version or null == "5" then
+        "multi_v5_defconfig"
+      else if stdenv.hostPlatform.isAarch32 && stdenv.hostPlatform.parsed.cpu.version or null == "6" then
+        "bcm2835_defconfig"
+      else if stdenv.hostPlatform.isPower64 then
+        if stdenv.hostPlatform.isLittleEndian then "powernv_defconfig" else "ppc64_defconfig"
+      else
+        "defconfig",
 
     # Legacy overrides to the intermediate kernel config, as string
     extraConfig ? "",
@@ -66,20 +75,17 @@ lib.makeOverridable (
     # symbolic name and `patch' is the actual patch.  The patch may
     # optionally be compressed with gzip or bzip2.
     kernelPatches ? [ ],
-    ignoreConfigErrors ?
-      !lib.elem stdenv.hostPlatform.linux-kernel.name or "" [
-        "aarch64-multiplatform"
-        "pc"
-      ],
+    ignoreConfigErrors ? !(stdenv.hostPlatform.isx86 || stdenv.hostPlatform.isAarch64),
     extraMeta ? { },
     extraPassthru ? { },
 
     isLTS ? false,
     isZen ? false,
 
-    # easy overrides to stdenv.hostPlatform.linux-kernel members
-    autoModules ? stdenv.hostPlatform.linux-kernel.autoModules or true,
-    preferBuiltin ? stdenv.hostPlatform.linux-kernel.preferBuiltin or false,
+    autoModules ? true,
+    # TODO: Remove this default?
+    preferBuiltin ?
+      stdenv.hostPlatform.isAarch || stdenv.hostPlatform.isRiscV || stdenv.hostPlatform.isLoongArch64,
     kernelArch ? stdenv.hostPlatform.linuxArch,
     kernelTests ? { },
 
@@ -116,9 +122,7 @@ lib.makeOverridable (
     intermediateNixConfig =
       configfile.moduleStructuredConfig.intermediateNixConfig
       # extra config in legacy string format
-      + extraConfig
-      # need the 'or ""' at the end in case enableCommonConfig = true and extraConfig is not present
-      + lib.optionalString enableCommonConfig stdenv.hostPlatform.linux-kernel.extraConfig or "";
+      + extraConfig;
 
     structuredConfigFromPatches = map (
       {
@@ -205,8 +209,7 @@ lib.makeOverridable (
       buildPhase =
         let
           # e.g. "defconfig"
-          kernelBaseConfig =
-            if defconfig != null then defconfig else stdenv.hostPlatform.linux-kernel.baseConfig or "defconfig";
+          kernelBaseConfig = defconfig;
           kernelIntermediateConfig = writeText "kernel-intermediate-config" (
             kernelConfigFun intermediateNixConfig
           );
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index ea940fc4af42..2885826325b6 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2026.6.1";
+  version = "2026.6.2";
   components = {
     "3_day_blinds" =
       ps: with ps; [
diff --git a/pkgs/servers/home-assistant/custom-components/auth_oidc/package.nix b/pkgs/servers/home-assistant/custom-components/auth_oidc/package.nix
index e45457d9c237..81e12c92cc09 100644
--- a/pkgs/servers/home-assistant/custom-components/auth_oidc/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/auth_oidc/package.nix
@@ -16,13 +16,13 @@
 buildHomeAssistantComponent rec {
   owner = "christaangoossens";
   domain = "auth_oidc";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "christiaangoossens";
     repo = "hass-oidc-auth";
     tag = "v${version}";
-    hash = "sha256-hA4Nic5AerghZZVEFSFRpBwX+2vl/0HhTeFgwkd3QPE=";
+    hash = "sha256-d1nRSAR4HAoW+gpAtyb0s6bh40CcoT59dgVOkwKHavU=";
   };
 
   postPatch = ''
@@ -37,7 +37,7 @@ buildHomeAssistantComponent rec {
   env.npmDeps = fetchNpmDeps {
     name = "${domain}-npm-deps";
     inherit src;
-    hash = "sha256-CmJ8AdD+AcqxwXK3lINJ0+8/feJM7dl9Q4cx7vftnMk=";
+    hash = "sha256-rVBc1RSARmKZhjEAoWtb/kJLbaY0Hxhyj/ZaPJVj3jo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix b/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix
index e061bb578741..a292540c5a2b 100644
--- a/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix
@@ -13,13 +13,13 @@
 buildHomeAssistantComponent rec {
   owner = "luuquangvu";
   domain = "blueprints_updater";
-  version = "2.7.2";
+  version = "2.7.3";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "blueprints-updater";
     tag = version;
-    hash = "sha256-qWWb4n20wFiunvjYUFWXnze3kqYF4n2GCNy5Q34+7ao=";
+    hash = "sha256-Sb4ZUuOw4S8kh8N3fSgE35lD38LyvLW2oouot2zIWYg=";
   };
 
   patches = [
diff --git a/pkgs/servers/home-assistant/custom-components/dreo/package.nix b/pkgs/servers/home-assistant/custom-components/dreo/package.nix
index d0d0f42b617e..c7942bb4d5ce 100644
--- a/pkgs/servers/home-assistant/custom-components/dreo/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/dreo/package.nix
@@ -12,13 +12,13 @@
 buildHomeAssistantComponent rec {
   owner = "JeffSteinbok";
   domain = "dreo";
-  version = "1.9.10";
+  version = "1.9.12";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "hass-dreo";
     tag = "v${version}";
-    hash = "sha256-kzZzsZMJa0ypQHWbGS+q84frkkLszqbH7CehIYFOJu8=";
+    hash = "sha256-CMp3UIpLSpqTL0EGH6z5bvqOd68Ay8o7bDDdjNMawWg=";
   };
 
   dependencies = [ websockets ];
diff --git a/pkgs/servers/home-assistant/custom-components/ecoflow_ble/package.nix b/pkgs/servers/home-assistant/custom-components/ecoflow_ble/package.nix
index 42b63d7a79c7..39f9a11289f2 100644
--- a/pkgs/servers/home-assistant/custom-components/ecoflow_ble/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/ecoflow_ble/package.nix
@@ -18,13 +18,13 @@
 buildHomeAssistantComponent rec {
   owner = "rabits";
   domain = "ef_ble";
-  version = "0.9.2";
+  version = "0.9.3";
 
   src = fetchFromGitHub {
     owner = "rabits";
     repo = "ha-ef-ble";
     tag = "v${version}";
-    hash = "sha256-1P2Xn8DfLR7SFz/THyqqBkf18hgxK1kmlANlTYgcHZo=";
+    hash = "sha256-MSfXSvnaVFot4JkLSZrbL3DB3MV7DvgRT8MCxv6qHlQ=";
   };
 
   dependencies = [
diff --git a/pkgs/servers/home-assistant/custom-components/frigidaire/package.nix b/pkgs/servers/home-assistant/custom-components/frigidaire/package.nix
index 50d0089ec9d0..4658594802ea 100644
--- a/pkgs/servers/home-assistant/custom-components/frigidaire/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/frigidaire/package.nix
@@ -7,13 +7,13 @@
 buildHomeAssistantComponent rec {
   owner = "bm1549";
   domain = "frigidaire";
-  version = "0.1.19";
+  version = "0.1.20";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "home-assistant-frigidaire";
     tag = version;
-    hash = "sha256-/YgnWoUuFo0qdj/gJvEoaqNMmRySO68fJwm8GqIyauM=";
+    hash = "sha256-XUtffkwy1HGVt41rrPl5Yk2DkYQie2FcYMoxSnzlArY=";
   };
 
   dependencies = [ frigidaire ];
diff --git a/pkgs/servers/home-assistant/custom-components/llm_intents/package.nix b/pkgs/servers/home-assistant/custom-components/llm_intents/package.nix
index 0fd034413066..a27acf6b976a 100644
--- a/pkgs/servers/home-assistant/custom-components/llm_intents/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/llm_intents/package.nix
@@ -13,13 +13,13 @@
 buildHomeAssistantComponent (finalAttrs: {
   owner = "skye-harris";
   domain = "llm_intents";
-  version = "1.8.1";
+  version = "1.8.2";
 
   src = fetchFromGitHub {
     inherit (finalAttrs) owner;
     repo = "llm_intents";
     tag = finalAttrs.version;
-    hash = "sha256-KIC9rDu2AKSLlW0lNXR05AyhreAnFAhNuNRlqdZwy5w=";
+    hash = "sha256-UYWt+PpG0M1DE1nHqLJ/npp29JyfNz19Pyb1Jv3LM48=";
   };
 
   dependencies = [
diff --git a/pkgs/servers/home-assistant/custom-components/local_luftdaten/async-timeout.patch b/pkgs/servers/home-assistant/custom-components/local_luftdaten/async-timeout.patch
deleted file mode 100644
index 7872436b96dc..000000000000
--- a/pkgs/servers/home-assistant/custom-components/local_luftdaten/async-timeout.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From 06a6b3ff1ae181f9972b47838569d658ba4b3d9c Mon Sep 17 00:00:00 2001
-From: Martin Weinelt <hexa@darmstadt.ccc.de>
-Date: Sat, 4 Oct 2025 14:45:02 +0200
-Subject: [PATCH] Use the python native asyncio timeout function
-
-instead of depending on the undeclared async-timeout package.
----
- custom_components/local_luftdaten/sensor.py | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/custom_components/local_luftdaten/sensor.py b/custom_components/local_luftdaten/sensor.py
-index 4f4f5b4..82ea041 100644
---- a/custom_components/local_luftdaten/sensor.py
-+++ b/custom_components/local_luftdaten/sensor.py
-@@ -12,7 +12,6 @@
- import asyncio
- from typing import Optional
- import aiohttp
--import async_timeout
- import datetime
- 
- import json
-@@ -170,7 +169,7 @@ async def async_update(self):
-             responseData = None
-             try:
-                 _LOGGER.debug("Get data from %s", str(self._resource))
--                with async_timeout.timeout(30):
-+                async with asyncio.timeout(30):
-                     response = await self._session.get(self._resource)
-                 responseData = await response.text()
-                 _LOGGER.debug("Received data: %s", str(self.data))
diff --git a/pkgs/servers/home-assistant/custom-components/local_luftdaten/package.nix b/pkgs/servers/home-assistant/custom-components/local_luftdaten/package.nix
index de343fbe27da..62031f8dcbce 100644
--- a/pkgs/servers/home-assistant/custom-components/local_luftdaten/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/local_luftdaten/package.nix
@@ -7,19 +7,15 @@
 buildHomeAssistantComponent rec {
   owner = "lichtteil";
   domain = "local_luftdaten";
-  version = "2.3.1";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "lichtteil";
     repo = "local_luftdaten";
-    rev = version;
-    hash = "sha256-68clZgS7Qo62srcZWD3Un9BnNSwQUBr4Z5oBMTC9m8o=";
+    tag = version;
+    hash = "sha256-K8sQ/xm9aoJ6EBF9H9Y87m7a0OZN4y6T3DFZcSpPYOI=";
   };
 
-  # https://github.com/lichtteil/local_luftdaten/pull/70
-  # Replace undeclared async-timeout dependency with native asyncio.timeout
-  patches = [ ./async-timeout.patch ];
-
   meta = {
     changelog = "https://github.com/lichtteil/local_luftdaten/releases/tag/${version}";
     description = "Custom component for Home Assistant that integrates your (own) local Luftdaten sensor (air quality/particle sensor) without using the cloud";
diff --git a/pkgs/servers/home-assistant/custom-components/local_openai/package.nix b/pkgs/servers/home-assistant/custom-components/local_openai/package.nix
index c1111a3f4be3..76abfc48cf6c 100644
--- a/pkgs/servers/home-assistant/custom-components/local_openai/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/local_openai/package.nix
@@ -9,13 +9,13 @@
 buildHomeAssistantComponent (finalAttrs: {
   owner = "skye-harris";
   domain = "local_openai";
-  version = "1.7.0";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     inherit (finalAttrs) owner;
     repo = "hass_local_openai_llm";
     tag = finalAttrs.version;
-    hash = "sha256-hY5pBuQQ3/Ayr9jZ5clYaxn5aAZcub0XXtiqgBjdfxM=";
+    hash = "sha256-L5gcjKTT9KvTHCuUxg+r0mBJ+jRZqLvF9o+X+6tSH6g=";
   };
 
   dependencies = [
diff --git a/pkgs/servers/home-assistant/custom-components/polaris-mqtt/package.nix b/pkgs/servers/home-assistant/custom-components/polaris-mqtt/package.nix
index 31009c79d092..d0866b0336df 100644
--- a/pkgs/servers/home-assistant/custom-components/polaris-mqtt/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/polaris-mqtt/package.nix
@@ -7,13 +7,13 @@
 buildHomeAssistantComponent rec {
   owner = "samoswall";
   domain = "polaris";
-  version = "1.1.3";
+  version = "1.1.4";
 
   src = fetchFromGitHub {
     owner = "samoswall";
     repo = "polaris-mqtt";
     tag = "v${version}";
-    hash = "sha256-H/SYO3suxtLnvAvk2gdgMT+gBlvymmgmvRCVk1zMtHo=";
+    hash = "sha256-G0DWgDLS62yKXE6gktb8z2xKFeH7Cu2zssQhEiuhwD0=";
   };
 
   meta = {
diff --git a/pkgs/servers/home-assistant/custom-components/waste_collection_schedule/package.nix b/pkgs/servers/home-assistant/custom-components/waste_collection_schedule/package.nix
index 9ace6725e542..1f8d6879c947 100644
--- a/pkgs/servers/home-assistant/custom-components/waste_collection_schedule/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/waste_collection_schedule/package.nix
@@ -20,13 +20,13 @@
 buildHomeAssistantComponent rec {
   owner = "mampfes";
   domain = "waste_collection_schedule";
-  version = "2.26.0";
+  version = "2.27.0";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "hacs_waste_collection_schedule";
     tag = "v${version}";
-    hash = "sha256-/kkqPV7Djp1IQ67nhkeboqzHrku/l6NWVlrf9+2wQ+c=";
+    hash = "sha256-jjLebP2rkxI59JN4peTAGDBQe8/Si6xihQW8aqE1neo=";
   };
 
   dependencies = [
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/auto-entities/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/auto-entities/package.nix
index 4516244b4df3..18d09de8104b 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/auto-entities/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/auto-entities/package.nix
@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "auto-entities";
-  version = "2.3.0";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "Lint-Free-Technology";
     repo = "lovelace-auto-entities";
     tag = "v${version}";
-    hash = "sha256-BHiTg2HLOQB+jXzvyQMwTTX8smQhbZ2/AsBQyFCquhU=";
+    hash = "sha256-l6bg68PP+d9AiTAkT7MtuyIeSl9dmi9bMEaV+eByOIs=";
   };
 
-  npmDepsHash = "sha256-5DZlAhYY/Cf7/AfPa3+sIFy75nDopPLIFDe3FjRPevA=";
+  npmDepsHash = "sha256-1rJeyYn4QzYGxztFwJ812RjCApHlqnvrnFe69CUKCzM=";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/bubble-card/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/bubble-card/package.nix
index 7f853489c871..ae5928dad353 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/bubble-card/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/bubble-card/package.nix
@@ -6,13 +6,13 @@
 
 buildNpmPackage rec {
   pname = "bubble-card";
-  version = "3.2.2";
+  version = "3.2.3";
 
   src = fetchFromGitHub {
     owner = "Clooos";
     repo = "Bubble-Card";
     rev = "v${version}";
-    hash = "sha256-kYaAg5HJGoUpAllzJNYrVITbmZ8txJRoikfLLzyDHJo=";
+    hash = "sha256-X6Oh+0VcVSvr2JydMqWVzYFonxdsewi0lrrFVXtb/BA=";
   };
 
   npmDepsHash = "sha256-jyw8U99R7M3JJwu30ADefAitm4lWWVHEwq108gWZpfg=";
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/flower-card/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/flower-card/package.nix
index 51ef26af4429..8d90603f6d6e 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/flower-card/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/flower-card/package.nix
@@ -6,13 +6,13 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "flower-card";
-  version = "2026.6.0";
+  version = "2026.6.1";
 
   src = fetchFromGitHub {
     owner = "olen";
     repo = "lovelace-flower-card";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-iR1uxpkhLFPDBUUE0gwRlT9kwinAyI7SdWBiYD1UlXw=";
+    hash = "sha256-mep8+72yEGICoBywKQ0MAYN/VPCEwEvY93jECvk6FeE=";
   };
 
   npmDepsHash = "sha256-vP5ShzHQdBa+TY11P4QadyGBjXSw68/rGODiiJKBbnQ=";
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/material-you-utilities/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/material-you-utilities/package.nix
index 3439bf9e6ab1..0e886d89926d 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/material-you-utilities/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/material-you-utilities/package.nix
@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "material-you-utilities";
-  version = "2.1.14";
+  version = "2.1.15";
 
   src = fetchFromGitHub {
     owner = "Nerwyn";
     repo = "material-you-utilities";
     tag = version;
-    hash = "sha256-qHPbqJToMJQKlhXrYf1ydjIE1l9u7MDpS7D9b0r1b0g=";
+    hash = "sha256-fqs2+OEBOJDO3Y3QO7+R93TCNg+FooZVgilTxcDcNjo=";
   };
 
-  npmDepsHash = "sha256-Ko0rWO8nxdf99tNusuN7t70wrNbWI2iB6803b7xQvps=";
+  npmDepsHash = "sha256-1Cv90vnfhAY+XaiN523APShl6al/RkFbcVUiNayg+FE=";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index b21a1c68d836..1c2cc8014607 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -265,7 +265,7 @@ let
   extraBuildInputs = extraPackages python3Packages;
 
   # Don't forget to run update-component-packages.py after updating
-  hassVersion = "2026.6.1";
+  hassVersion = "2026.6.2";
 
 in
 python3Packages.buildPythonApplication rec {
@@ -286,13 +286,13 @@ python3Packages.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     tag = version;
-    hash = "sha256-gjXhWv64Uu3LHwxDR8HwsTFeAncgY94JeOqfKEnvgJ8=";
+    hash = "sha256-wDGXJoo1R2YX2qNRsMYNHm94WCsSHsC7ihCW6w8YAD8=";
   };
 
   # Secondary source is pypi sdist for translations
   sdist = fetchPypi {
     inherit pname version;
-    hash = "sha256-gtnIsOrJWyLhjEc9dstvRiVd4LrqJ6W48qXNwaV8YlU=";
+    hash = "sha256-XpFnxxa1liRUm8KEoI73t9wAfnsLKC3G56vrgkcIqR0=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/servers/home-assistant/frontend.nix b/pkgs/servers/home-assistant/frontend.nix
index 251cd0a4334f..45e989922e15 100644
--- a/pkgs/servers/home-assistant/frontend.nix
+++ b/pkgs/servers/home-assistant/frontend.nix
@@ -8,7 +8,7 @@ buildPythonPackage (finalAttrs: {
   # the frontend version corresponding to a specific home-assistant version can be found here
   # https://github.com/home-assistant/home-assistant/blob/master/homeassistant/components/frontend/manifest.json
   pname = "home-assistant-frontend";
-  version = "20260527.4";
+  version = "20260527.5";
   format = "wheel";
 
   src = fetchPypi {
@@ -17,7 +17,7 @@ buildPythonPackage (finalAttrs: {
     pname = "home_assistant_frontend";
     dist = "py3";
     python = "py3";
-    hash = "sha256-qF5tuwB5YqFXvNa1wc6Y7Yhy+WZzJ3PktgCERNGxDhg=";
+    hash = "sha256-DLuwjy3Gyqp8Y2N7Vbv4AbhFbFwaMOEvDzvkRncqmQE=";
   };
 
   # there is nothing to strip in this package
diff --git a/pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix b/pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix
index d4b591d5f69f..bfb1b0df374c 100644
--- a/pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix
+++ b/pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "pytest-homeassistant-custom-component";
-  version = "0.13.337";
+  version = "0.13.338";
   pyproject = true;
 
   disabled = pythonOlder "3.13";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "MatthewFlamm";
     repo = "pytest-homeassistant-custom-component";
     tag = version;
-    hash = "sha256-q5k38dN8Dwgvm29Zf8tkFCOt0Tj9J8ZDDyT57oHq5Os=";
+    hash = "sha256-O4h8vHjYo/cIBOqd+ag8jIoje9j1/zyBfuQq6IIFa3w=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/servers/home-assistant/stubs.nix b/pkgs/servers/home-assistant/stubs.nix
index c6dd0ddf513c..3351436b518d 100644
--- a/pkgs/servers/home-assistant/stubs.nix
+++ b/pkgs/servers/home-assistant/stubs.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "homeassistant-stubs";
-  version = "2026.6.1";
+  version = "2026.6.2";
   pyproject = true;
 
   disabled = python.version != home-assistant.python3Packages.python.version;
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "KapJI";
     repo = "homeassistant-stubs";
     tag = version;
-    hash = "sha256-HtDOM/cm8DFn8IKJ5Y8VtPYzRq0vWd8KJB2Dn7Zz4Ws=";
+    hash = "sha256-Rf5HHXNJR6TJnB0Gtg6mwlqteMUf2Yw7stonsoO2EHE=";
   };
 
   build-system = [
diff --git a/pkgs/tools/system/nvtop/build-nvtop.nix b/pkgs/tools/system/nvtop/build-nvtop.nix
index 25de0091ba2c..7662dc24e943 100644
--- a/pkgs/tools/system/nvtop/build-nvtop.nix
+++ b/pkgs/tools/system/nvtop/build-nvtop.nix
@@ -4,7 +4,7 @@
   fetchFromGitHub,
   cmake,
   gtest,
-  cudatoolkit,
+  cudaPackages,
   libdrm,
   ncurses,
   testers,
@@ -82,7 +82,7 @@ stdenv.mkDerivation (finalAttrs: {
     ncurses
   ]
   ++ lib.optional stdenv.hostPlatform.isLinux udev
-  ++ lib.optional nvidia cudatoolkit
+  ++ lib.optional nvidia cudaPackages.cuda_nvml_dev
   ++ lib.optional needDrm libdrm;
 
   # this helps cmake to find <drm.h>
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d1bb499f4f81..fe2fd4a521fc 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -909,9 +909,7 @@ with pkgs;
     inherit (darwin) signingUtils;
   };
 
-  vmTools = callPackage ../build-support/vm {
-    img = stdenv.hostPlatform.linux-kernel.target;
-  };
+  vmTools = callPackage ../build-support/vm { };
 
   releaseTools = callPackage ../build-support/release { };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 7df2b7d1b18d..ac9275d3b255 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -11473,6 +11473,8 @@ self: super: with self; {
 
   numexpr = callPackage ../development/python-modules/numexpr { };
 
+  numkong = callPackage ../development/python-modules/numkong { };
+
   numpy = numpy_2;
 
   numpy-financial = callPackage ../development/python-modules/numpy-financial { };
@@ -21079,6 +21081,8 @@ self: super: with self; {
 
   usbtmc = callPackage ../development/python-modules/usbtmc { };
 
+  usearch = callPackage ../development/python-modules/usearch { };
+
   useful-types = callPackage ../development/python-modules/useful-types { };
 
   user-agents = callPackage ../development/python-modules/user-agents { };