diff --git a/lib/systems/default.nix b/lib/systems/default.nix
index eb06f12f25a0..f60ece0c8f5c 100644
--- a/lib/systems/default.nix
+++ b/lib/systems/default.nix
@@ -300,6 +300,8 @@ let
             "powerpc"
           else if final.isRiscV then
             "riscv"
+          else if final.isSh4 then
+            "sh"
           else if final.isS390 then
             "s390"
           else if final.isLoongArch64 then
diff --git a/lib/systems/doubles.nix b/lib/systems/doubles.nix
index 10d72f0f6c10..e9fa908dfc88 100644
--- a/lib/systems/doubles.nix
+++ b/lib/systems/doubles.nix
@@ -40,6 +40,7 @@ let
     "i686-linux"
     "loongarch64-linux"
     "m68k-linux"
+    "sh4-linux"
     "microblaze-linux"
     "microblazeel-linux"
     "mips-linux"
@@ -145,6 +146,7 @@ in
   or1k = filterDoubles predicates.isOr1k;
   m68k = filterDoubles predicates.isM68k;
   arc = filterDoubles predicates.isArc;
+  sh4 = filterDoubles predicates.isSh4;
   s390 = filterDoubles predicates.isS390;
   s390x = filterDoubles predicates.isS390x;
   loongarch64 = filterDoubles predicates.isLoongArch64;
diff --git a/lib/systems/examples.nix b/lib/systems/examples.nix
index 274d6a1af729..14693ca44e97 100644
--- a/lib/systems/examples.nix
+++ b/lib/systems/examples.nix
@@ -243,6 +243,10 @@ rec {
     config = "arc-unknown-linux-gnu";
   };
 
+  sh4 = {
+    config = "sh4-unknown-linux-gnu";
+  };
+
   s390 = {
     config = "s390-unknown-linux-gnu";
   };
diff --git a/lib/systems/inspect.nix b/lib/systems/inspect.nix
index 499f0ce774d5..36a4036f210a 100644
--- a/lib/systems/inspect.nix
+++ b/lib/systems/inspect.nix
@@ -234,6 +234,11 @@ rec {
         family = "arc";
       };
     };
+    isSh4 = {
+      cpu = {
+        family = "sh";
+      };
+    };
     isS390 = {
       cpu = {
         family = "s390";
diff --git a/lib/systems/parse.nix b/lib/systems/parse.nix
index 974bcbdc2465..626b5bcb41ac 100644
--- a/lib/systems/parse.nix
+++ b/lib/systems/parse.nix
@@ -284,6 +284,12 @@ rec {
         family = "m68k";
       };
 
+      sh4 = {
+        bits = 32;
+        significantByte = littleEndian;
+        family = "sh";
+      };
+
       powerpc = {
         bits = 32;
         significantByte = bigEndian;
diff --git a/lib/systems/platforms.nix b/lib/systems/platforms.nix
index e230888d9fcb..b80ed1efc8e8 100644
--- a/lib/systems/platforms.nix
+++ b/lib/systems/platforms.nix
@@ -632,6 +632,15 @@ rec {
     else if platform.isPower64 then
       if platform.isLittleEndian then powernv else ppc64
 
+    else if platform.isSh4 then
+      {
+        linux-kernel = {
+          target = "vmlinux";
+          # SH arch doesn't have a 'make install' target.
+          installTarget = "vmlinux";
+        };
+      }
+
     else
       { };
 }
diff --git a/lib/tests/systems.nix b/lib/tests/systems.nix
index 9348e37a9d7b..e912d18cc73c 100644
--- a/lib/tests/systems.nix
+++ b/lib/tests/systems.nix
@@ -171,6 +171,7 @@ lib.runTests (
       "i686-linux"
       "loongarch64-linux"
       "m68k-linux"
+      "sh4-linux"
       "microblaze-linux"
       "microblazeel-linux"
       "mips-linux"
diff --git a/nixos/modules/programs/command-not-found/command-not-found.nix b/nixos/modules/programs/command-not-found/command-not-found.nix
index 51ec0922c4f7..e6ea41778172 100644
--- a/nixos/modules/programs/command-not-found/command-not-found.nix
+++ b/nixos/modules/programs/command-not-found/command-not-found.nix
@@ -61,7 +61,7 @@ in
   config = lib.mkMerge [
     {
       programs.command-not-found = {
-        enable = lib.mkOptionDefault (builtins.pathExists cfg.dbPath);
+        enable = lib.mkDefault (builtins.pathExists cfg.dbPath);
         dbPath = pkgs.path + "/programs.sqlite";
       };
     }
diff --git a/nixos/modules/services/hardware/pid-fan-controller.nix b/nixos/modules/services/hardware/pid-fan-controller.nix
index a90e515868d4..725cc96330c0 100644
--- a/nixos/modules/services/hardware/pid-fan-controller.nix
+++ b/nixos/modules/services/hardware/pid-fan-controller.nix
@@ -6,183 +6,70 @@
 }:
 let
   cfg = config.services.pid-fan-controller;
-  heatSource = {
-    options = {
-      name = lib.mkOption {
-        type = lib.types.uniq lib.types.nonEmptyStr;
-        description = "Name of the heat source.";
-      };
-      wildcardPath = lib.mkOption {
-        type = lib.types.nonEmptyStr;
-        description = ''
-          Path of the heat source's `hwmon` `temp_input` file.
-          This path can contain multiple wildcards, but has to resolve to
-          exactly one result.
-        '';
-      };
-      pidParams = {
-        setPoint = lib.mkOption {
-          type = lib.types.ints.unsigned;
-          description = "Set point of the controller in °C.";
-        };
-        P = lib.mkOption {
-          description = "K_p of PID controller.";
-          type = lib.types.float;
-        };
-        I = lib.mkOption {
-          description = "K_i of PID controller.";
-          type = lib.types.float;
-        };
-        D = lib.mkOption {
-          description = "K_d of PID controller.";
-          type = lib.types.float;
-        };
-      };
-    };
-  };
-
-  fan = {
-    options = {
-      wildcardPath = lib.mkOption {
-        type = lib.types.str;
-        description = ''
-          Wildcard path of the `hwmon` `pwm` file.
-          If the fans are not to be found in `/sys/class/hwmon/hwmon*` the corresponding
-          kernel module (like `nct6775`) needs to be added to `boot.kernelModules`.
-          See the [`hwmon` Documentation](https://www.kernel.org/doc/html/latest/hwmon/index.html).
-        '';
-      };
-      minPwm = lib.mkOption {
-        default = 0;
-        type = lib.types.ints.u8;
-        description = "Minimum PWM value.";
-      };
-      maxPwm = lib.mkOption {
-        default = 255;
-        type = lib.types.ints.u8;
-        description = "Maximum PWM value.";
-      };
-      cutoff = lib.mkOption {
-        default = false;
-        type = lib.types.bool;
-        description = "Whether to stop the fan when `minPwm` is reached.";
-      };
-      heatPressureSrcs = lib.mkOption {
-        type = lib.types.nonEmptyListOf lib.types.str;
-        description = "Heat pressure sources affected by the fan.";
-      };
-    };
-  };
+  settingsFormat = pkgs.formats.json { };
 in
 {
   options.services.pid-fan-controller = {
     enable = lib.mkEnableOption "the PID fan controller, which controls the configured fans by running a closed-loop PID control loop";
     package = lib.mkPackageOption pkgs "pid-fan-controller" { };
-    settings = {
-      interval = lib.mkOption {
-        default = 500;
-        type = lib.types.int;
-        description = "Interval between controller cycles in milliseconds.";
-      };
-      heatSources = lib.mkOption {
-        type = lib.types.listOf (lib.types.submodule heatSource);
-        description = "List of heat sources to be monitored.";
-        example = ''
-          [
-            {
-              name = "cpu";
-              wildcardPath = "/sys/devices/pci0000:00/0000:00:18.3/hwmon/hwmon*/temp1_input";
-              pidParams = {
-                setPoint = 60;
-                P = -5.0e-3;
-                I = -2.0e-3;
-                D = -6.0e-3;
-              };
-            }
-          ];
-        '';
-      };
-      fans = lib.mkOption {
-        type = lib.types.listOf (lib.types.submodule fan);
-        description = "List of fans to be controlled.";
-        example = ''
-          [
-            {
-              wildcardPath = "/sys/devices/platform/nct6775.2592/hwmon/hwmon*/pwm1";
-              minPwm = 60;
-              maxPwm = 255;
-              heatPressureSrcs = [
-                "cpu"
-                "gpu"
-              ];
-            }
-          ];
-        '';
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = lib.types.either settingsFormat.type (lib.types.listOf settingsFormat.type);
       };
+      default = { };
+      description = ''
+        Configuration for pid-fan-controller, see
+        <https://github.com/zimward/pid-fan-controller>
+        for supported values.
+      '';
     };
   };
-  config = lib.mkIf cfg.enable {
-    #map camel cased attrs into snake case for config
-    environment.etc."pid-fan-settings.json".text = builtins.toJSON {
-      interval = cfg.settings.interval;
-      heat_srcs = map (heatSrc: {
-        name = heatSrc.name;
-        wildcard_path = heatSrc.wildcardPath;
-        PID_params = {
-          set_point = heatSrc.pidParams.setPoint;
-          P = heatSrc.pidParams.P;
-          I = heatSrc.pidParams.I;
-          D = heatSrc.pidParams.D;
-        };
-      }) cfg.settings.heatSources;
-      fans = map (fan: {
-        wildcard_path = fan.wildcardPath;
-        min_pwm = fan.minPwm;
-        max_pwm = fan.maxPwm;
-        cutoff = fan.cutoff;
-        heat_pressure_srcs = fan.heatPressureSrcs;
-      }) cfg.settings.fans;
-    };
 
-    systemd.services.pid-fan-controller = {
-      wantedBy = [ "multi-user.target" ];
-      serviceConfig = {
-        Type = "simple";
-        ExecStart = [ (lib.getExe cfg.package) ];
-        ExecStopPost = [ "${lib.getExe cfg.package} disable" ];
-        Restart = "always";
-        #This service needs to run as root to write to /sys.
-        #therefore it should operate with the least amount of privileges needed
-        ProtectHome = "yes";
-        #strict is not possible as it needs /sys
-        ProtectSystem = "full";
-        ProtectProc = "invisible";
-        PrivateNetwork = "yes";
-        NoNewPrivileges = "yes";
-        MemoryDenyWriteExecute = "yes";
-        RestrictNamespaces = "~user pid net uts mnt";
-        ProtectKernelModules = "yes";
-        RestrictRealtime = "yes";
-        SystemCallFilter = "@system-service";
-        CapabilityBoundingSet = "~CAP_KILL CAP_WAKE_ALARM CAP_IPC_LOC CAP_BPF CAP_LINUX_IMMUTABLE CAP_BLOCK_SUSPEND CAP_MKNOD";
-      };
-      # restart unit if config changed
-      restartTriggers = [ config.environment.etc."pid-fan-settings.json".source ];
+  config =
+    let
+      oldConfig = cfg.settings ? heatSources;
+      configFile = settingsFormat.generate "pid-fan-settings.json" (
+        if oldConfig then
+          {
+            interval = cfg.settings.interval or 500;
+            heat_srcs = map (heatSrc: {
+              name = heatSrc.name or "";
+              wildcard_path = heatSrc.wildcardPath;
+              PID_params = {
+                set_point = heatSrc.pidParams.setPoint;
+                P = heatSrc.pidParams.P;
+                I = heatSrc.pidParams.I;
+                D = heatSrc.pidParams.D;
+              };
+            }) cfg.settings.heatSources;
+            fans = map (fan: {
+              wildcard_path = fan.wildcardPath;
+              min_pwm = fan.minPwm;
+              max_pwm = fan.maxPwm;
+              cutoff = fan.cutoff or false;
+              heat_pressure_srcs = fan.heatPressureSrcs;
+            }) cfg.settings.fans;
+          }
+        else
+          cfg.settings
+      );
+    in
+    lib.mkIf cfg.enable {
+      systemd.packages = [ cfg.package ];
+      systemd.services.pid-fan-controller.environment.PID_FAN_CONFIG = toString configFile;
+      systemd.services.pid-fan-controller.wantedBy = [ "multi-user.target" ];
+      systemd.services.pid-fan-controller-sleep.wantedBy = [ "sleep.target" ];
+
+      warnings =
+        if oldConfig then
+          [
+            ''
+              The configuration of `pid-fan-controller` is no longer deeply configured and the rewriting will be removed in 26.11!
+              Please switch to using underscore case as shown in the upstream documentation.
+            ''
+          ]
+        else
+          [ ];
     };
-    #sleep hook to restart the service as it breaks otherwise
-    systemd.services.pid-fan-controller-sleep = {
-      before = [ "sleep.target" ];
-      wantedBy = [ "sleep.target" ];
-      unitConfig = {
-        StopWhenUnneeded = "yes";
-      };
-      serviceConfig = {
-        Type = "oneshot";
-        RemainAfterExit = true;
-        ExecStart = [ "systemctl stop pid-fan-controller.service" ];
-        ExecStop = [ "systemctl restart pid-fan-controller.service" ];
-      };
-    };
-  };
   meta.maintainers = with lib.maintainers; [ zimward ];
 }
diff --git a/nixos/modules/services/misc/jellyfin.nix b/nixos/modules/services/misc/jellyfin.nix
index 5c08fc478e45..d9e76154f0a8 100644
--- a/nixos/modules/services/misc/jellyfin.nix
+++ b/nixos/modules/services/misc/jellyfin.nix
@@ -480,6 +480,11 @@ in
           ];
           SystemCallErrorNumber = "EPERM";
         };
+        unitConfig.RequiresMountsFor = [
+          cfg.configDir
+          cfg.logDir
+          cfg.cacheDir
+        ];
       };
     };
 
diff --git a/pkgs/applications/editors/emacs/make-emacs.nix b/pkgs/applications/editors/emacs/make-emacs.nix
index 0c44afee06e7..48474bc4b7cd 100644
--- a/pkgs/applications/editors/emacs/make-emacs.nix
+++ b/pkgs/applications/editors/emacs/make-emacs.nix
@@ -97,9 +97,10 @@
   withXwidgets ?
     !noGui
     && (withGTK3 || withPgtk || withNS || variant == "macport")
-    && (stdenv.hostPlatform.isDarwin || lib.versionOlder version "30"),
+    && (stdenv.hostPlatform.isDarwin || lib.versions.major version != "30"),
   # XXX: - upstream bug 66068 precludes newer versions of webkit2gtk (https://lists.gnu.org/archive/html/bug-gnu-emacs/2024-09/msg00695.html)
   # XXX: - Apple_SDK WebKit is compatible with Emacs.
+  # XXX: - upstream bug 80728 lifts the webkit2gtk version check added in upstream bug 66068
   withSmallJaDic ? false,
   withCompressInstall ? true,
 
@@ -505,11 +506,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   meta = {
-    broken =
-      (withNativeCompilation && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) || withWebkitgtk;
-    knownVulnerabilities = lib.optionals (lib.versionOlder version "30") [
-      "CVE-2024-53920 CVE-2025-1244, please use newer versions such as emacs30"
-    ];
+    broken = withNativeCompilation && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform);
   }
   // meta;
 })
diff --git a/pkgs/applications/editors/vscode/extensions/mkhl.shfmt/default.nix b/pkgs/applications/editors/vscode/extensions/mkhl.shfmt/default.nix
index bdaf18cfbb89..678b3ec01d40 100644
--- a/pkgs/applications/editors/vscode/extensions/mkhl.shfmt/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/mkhl.shfmt/default.nix
@@ -9,8 +9,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "shfmt";
     publisher = "mkhl";
-    version = "1.5.1";
-    hash = "sha256-rk+ykkWHxgQyyOC8JyhyOinRPJHh9XxNRAVUzcF7TRI=";
+    version = "1.5.2";
+    hash = "sha256-Mff3ZpxnLp/cEB17T0KGZ4GWG8jN4VxrfR/wIEi2ouM=";
   };
 
   postInstall = ''
diff --git a/pkgs/applications/editors/vscode/extensions/ms-vscode.js-debug/default.nix b/pkgs/applications/editors/vscode/extensions/ms-vscode.js-debug/default.nix
index 81e0cf62478b..217701a6ac02 100644
--- a/pkgs/applications/editors/vscode/extensions/ms-vscode.js-debug/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-vscode.js-debug/default.nix
@@ -18,19 +18,19 @@ let
   vsix = stdenv.mkDerivation (finalAttrs: {
     name = "vscode-js-debug-${finalAttrs.version}.vsix";
     pname = "vscode-js-debug-vsix";
-    version = "1.112.0";
+    version = "1.117.0";
 
     src = fetchFromGitHub {
       owner = "microsoft";
       repo = "vscode-js-debug";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-pgDrGbx4E6r5lkdY49RyEe04YZYVXbjKAB+pY5w5w7U=";
+      hash = "sha256-1Mj7nfX5iVO0hhydCV/VbqN1x77WFEzG6/ahk1kN1fw=";
     };
 
     npmDeps = fetchNpmDeps {
       name = "${finalAttrs.pname}-npm-deps";
       inherit (finalAttrs) src;
-      hash = "sha256-e+23PCPPQeHKxIT0nFEPumg2TvtNtpzil3XS5njHR9g=";
+      hash = "sha256-uTtA5XjHfuI2e9IuNAYfDNKZE8c/wa+CWqAsmd/M3Xk=";
     };
     makeCacheWritable = true;
 
diff --git a/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix b/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
index bd9772d19e74..68d61c8976fe 100644
--- a/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "claude-dev";
     publisher = "saoudrizwan";
-    version = "3.78.0";
-    hash = "sha256-Aah8K+ZOrlpJofeJIlOgL/42QVTmLsc6Ldk2xSK3RUw=";
+    version = "3.79.0";
+    hash = "sha256-BqIJNUkq7q2/WlsWqN/dHZtYqHvDm3v7CesEM4XJ1Es=";
   };
 
   meta = {
diff --git a/pkgs/applications/editors/vscode/extensions/tombi-toml.tombi/default.nix b/pkgs/applications/editors/vscode/extensions/tombi-toml.tombi/default.nix
index bdbf9b835c12..0a4e478368b6 100644
--- a/pkgs/applications/editors/vscode/extensions/tombi-toml.tombi/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/tombi-toml.tombi/default.nix
@@ -7,19 +7,19 @@
 let
   supported = {
     x86_64-linux = {
-      hash = "sha256-YoB9gH84F9h6vdRbgCJGQhBmcXQ6jzrxvF2hA7gb3aI=";
+      hash = "sha256-1N2D1+5AZionGw0pfuf9PW+Pfc3AI/v9BmqLiue/YZA=";
       arch = "linux-x64";
     };
     x86_64-darwin = {
-      hash = "sha256-IDJJuSLNt0SxV8LdDX0JC3P+VR6NUAfe5u8p9vI+ik8=";
+      hash = "sha256-izM0qVgTNJ2G5SDnULaNWWuI+VwWTNx95bU8O4sIa64=";
       arch = "darwin-x64";
     };
     aarch64-linux = {
-      hash = "sha256-gDufj8XYlowpKd2MQMZBsnZ2eT/pbngDlKeIFlkUKzU=";
+      hash = "sha256-tcjzqbGlycVDgJbHuuVUMvrBWU/UD4Y+kah9swny3Ws=";
       arch = "linux-arm64";
     };
     aarch64-darwin = {
-      hash = "sha256-biWq6nsO4XGOMSUA9/yXMejC1wTDKsuQdPU26w0r4Lg=";
+      hash = "sha256-gP7w+wCzUMjwI7Lk9aklzv2Wo6R0zdpVKoDwKw6HPhQ=";
       arch = "darwin-arm64";
     };
   };
@@ -34,7 +34,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = base // {
     name = "tombi";
     publisher = "tombi-toml";
-    version = "0.7.7";
+    version = "0.9.18";
   };
   meta = {
     description = "TOML Language Server";
diff --git a/pkgs/applications/emulators/libretro/cores/ppsspp.nix b/pkgs/applications/emulators/libretro/cores/ppsspp.nix
index 397e75376f98..1029c5f1b2d9 100644
--- a/pkgs/applications/emulators/libretro/cores/ppsspp.nix
+++ b/pkgs/applications/emulators/libretro/cores/ppsspp.nix
@@ -13,13 +13,13 @@
 }:
 mkLibretroCore {
   core = "ppsspp";
-  version = "0-unstable-2026-03-31";
+  version = "0-unstable-2026-04-20";
 
   src = fetchFromGitHub {
     owner = "hrydgard";
     repo = "ppsspp";
-    rev = "030c7a9e6b1a22bf8ee1db40f4d4b7402095bce1";
-    hash = "sha256-qy9S6/ThIA4YtO6J5R4RdPq4BvHDmwq7Y063gXXTuiQ=";
+    rev = "93601fe4a065ae25993047cc85de452b42b61c6e";
+    hash = "sha256-nBC1VTfGlGteYjElIPSCWXljzynoKAVhHgELhRK5a1o=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/emulators/libretro/cores/vice.nix b/pkgs/applications/emulators/libretro/cores/vice.nix
index fef84e62f32f..64ef6b5de474 100644
--- a/pkgs/applications/emulators/libretro/cores/vice.nix
+++ b/pkgs/applications/emulators/libretro/cores/vice.nix
@@ -6,13 +6,13 @@
 }:
 mkLibretroCore {
   core = "vice-${type}";
-  version = "0-unstable-2026-04-02";
+  version = "0-unstable-2026-04-18";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "vice-libretro";
-    rev = "8cf6a20017b1f331d5d3ac63b49a5fa75440073a";
-    hash = "sha256-KnqSx/wv5YTV4MnjEsgIIMnus3m5Rat4go8GzPNUZHs=";
+    rev = "13e9767dde2938c463e6f8cc4be2149f7d55c3c6";
+    hash = "sha256-uj8Mctc0NdUzi5eLtUuMAQwSOd301wa+GQuui7xHnfA=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/by-name/al/algolia-cli/package.nix b/pkgs/by-name/al/algolia-cli/package.nix
index 0b456a677d6f..0b035d211170 100644
--- a/pkgs/by-name/al/algolia-cli/package.nix
+++ b/pkgs/by-name/al/algolia-cli/package.nix
@@ -6,7 +6,7 @@
   installShellFiles,
 }:
 let
-  version = "1.7.3";
+  version = "1.8.2";
 in
 buildGoModule {
   pname = "algolia-cli";
@@ -16,10 +16,10 @@ buildGoModule {
     owner = "algolia";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-m7PAD9EKrl7eBzRwCHDcH+eBcFnfXIDnIm6wvOtay5g=";
+    hash = "sha256-i1x6/Ksiz8t8ho1SmcrypzQjERQ0e0Xxvnd5uIlQRoE=";
   };
 
-  vendorHash = "sha256-I6awzstThs0nC/Nyy00jCN3cpF1MXJcFTUM95E38HQI=";
+  vendorHash = "sha256-WdNuwUz64IZq3gfvFhXX536/tZ/67Ki0xiqIj7sLSEM=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/an/anki/addons/fsrs4anki-helper/default.nix b/pkgs/by-name/an/anki/addons/fsrs4anki-helper/default.nix
index d907594e3796..00b44473f34f 100644
--- a/pkgs/by-name/an/anki/addons/fsrs4anki-helper/default.nix
+++ b/pkgs/by-name/an/anki/addons/fsrs4anki-helper/default.nix
@@ -8,13 +8,13 @@
 
 anki-utils.buildAnkiAddon (finalAttrs: {
   pname = "fsrs4anki-helper";
-  version = "24.06.3-unstable-2026-03-30";
+  version = "24.06.3-unstable-2026-04-14";
 
   src = fetchFromGitHub {
     owner = "open-spaced-repetition";
     repo = "fsrs4anki-helper";
-    rev = "9823596b25e08e41dac06b3a24537dce6538f018";
-    hash = "sha256-Lcl2uNnjw83ShMQaYEniYGi8hyOl3J7H+YR0jaLb5xY=";
+    rev = "703c99f009fa0465237df248e2c83e43851d95b4";
+    hash = "sha256-yF0hTPdipFwhV1CcEmRRXezxc4754XCnX0HINrCgScQ=";
   };
 
   postFixup = ''
diff --git a/pkgs/by-name/ap/aperture/package.nix b/pkgs/by-name/ap/aperture/package.nix
index 4def1c33eb7b..123319c2bab3 100644
--- a/pkgs/by-name/ap/aperture/package.nix
+++ b/pkgs/by-name/ap/aperture/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "aperture";
-  version = "0.3-beta";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "lightninglabs";
     repo = "aperture";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-PsmaNJxWkXiFDA7IGhT+Kx1GUvv23c8L8Jz21/b48oo=";
+    hash = "sha256-XVLpIuBCavCbHcSMPFmxNxtdkr+jYy/AYjffzyKSYOg=";
   };
 
-  vendorHash = "sha256-rrDLdE7c6ykhdqOfRpuxyRO4xqYp3LZvovAppzy1wVw=";
+  vendorHash = "sha256-I7StCuL8UifVXBvchG0VRWA5nZc+nwIpK6+PQfkVGGo=";
 
   subPackages = [ "cmd/aperture" ];
 
diff --git a/pkgs/by-name/ar/arkenfox-userjs/package.nix b/pkgs/by-name/ar/arkenfox-userjs/package.nix
index 35eafcb5edb2..5caef59efe76 100644
--- a/pkgs/by-name/ar/arkenfox-userjs/package.nix
+++ b/pkgs/by-name/ar/arkenfox-userjs/package.nix
@@ -6,11 +6,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "arkenfox-userjs";
-  version = "140.1";
+  version = "144.0";
 
   src = fetchurl {
     url = "https://raw.githubusercontent.com/arkenfox/user.js/refs/tags/${finalAttrs.version}/user.js";
-    hash = "sha256-jxzIiARi+GXD+GSGPr1exeEHjR/LsXSUQPGZ+hF36xg=";
+    hash = "sha256-5KszxpFImRdc9wNeDlei1/CKyIfY+VfxGZ5+Sbvn4z4=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/bu/buck2/hashes.json b/pkgs/by-name/bu/buck2/hashes.json
index ced513105160..1f897e49538a 100644
--- a/pkgs/by-name/bu/buck2/hashes.json
+++ b/pkgs/by-name/bu/buck2/hashes.json
@@ -1,21 +1,21 @@
 {
+  "aarch64-darwin": {
+    "buck2": "sha256-zBZ2gEPRxyaBYmnRfYfhYDqswqfiXvxYDHrUI92Z1UQ=",
+    "rust-project": "sha256-K86j0E32w0DUwzpPT0NBUiL3rV4Ze8hzfbKDkpy9JXo="
+  },
   "x86_64-linux": {
-    "buck2": "sha256-TOgL0pLnNEAhHkKvynnM91kW06K6jZPeJnpSibYg8EU=",
-    "rust-project": "sha256-s5JY/m+yC3YNHiOxk6D43ZkWdtWLxlI4X72jSFFd3Hc="
+    "buck2": "sha256-IqDsyQ7Omy7QujT85oKrWwyirG7gwfupdxzvRoMRmQs=",
+    "rust-project": "sha256-iFSko4FTvAVlKUxJE/6FzR6H7V2SryRfEi7nRhfyhxQ="
   },
   "x86_64-darwin": {
-    "buck2": "sha256-8SvAZ30ZFsamVAheKpa2vzGty1TZECUv+BHeXLlDneQ=",
-    "rust-project": "sha256-0af+q1s7iEb6dWl4WuNxFbIskTfrHtU2uhatPyAhZNM="
+    "buck2": "sha256-G/xarAld9dXanZl7Ivcuoer3YsytmFXWED44u2U4q8g=",
+    "rust-project": "sha256-jbvvqPI7+qpONhk8UZfSiFpMGCGWRr85BocA58d+C7Y="
   },
   "aarch64-linux": {
-    "buck2": "sha256-Pka0HEEqRsQp2R435duy6gJy/RQXp5lK5Dg9+rfr9L8=",
-    "rust-project": "sha256-u3b+XscQpNZOo8OTrLSazFZvm496U4nsWti/6TRf8ZA="
+    "buck2": "sha256-VKV1vltATu3tAPmMiifba7MV9kNFH754FDda6i8cQrU=",
+    "rust-project": "sha256-oqxHdbNzQn1KHObboAd4/LTbilIJgLqMiWCgHLaPFrc="
   },
-  "aarch64-darwin": {
-    "buck2": "sha256-1Fv0LzAZUN/BbcorCBaPBbm8JAzLarhJysLqPT78XEQ=",
-    "rust-project": "sha256-PQ7WKjzAPT0uRirWzwJPxKr9V1RQajnlXUMnv8SYdso="
-  },
-  "version": "2025-12-01",
-  "preludeGit": "0a994e0b600f7d035e1ac69f374c0e37e1e19af6",
-  "preludeFod": "sha256-IQa4VatN5OaDSyoTbAj1tHNBpJV6Ost9RbLxDD23xVQ="
+  "version": "2026-04-15",
+  "preludeGit": "f0896771c4cc1ab8f87e032c5293376c89e5096b",
+  "preludeFod": "sha256-Ga4q9zzifgFDGx0TbcbBoDN29H3A4s1BZnSwwv9Mix0="
 }
diff --git a/pkgs/by-name/bu/buildbox/package.nix b/pkgs/by-name/bu/buildbox/package.nix
index cd9ef119ae58..94d57da92c98 100644
--- a/pkgs/by-name/bu/buildbox/package.nix
+++ b/pkgs/by-name/bu/buildbox/package.nix
@@ -23,13 +23,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "buildbox";
-  version = "1.4.0";
+  version = "1.4.4";
 
   src = fetchFromGitLab {
     owner = "BuildGrid";
     repo = "buildbox/buildbox";
     tag = finalAttrs.version;
-    hash = "sha256-yZux8uXjv9kQPGGL+y0p+1pURauFHhLpCAfjvOVMGmg=";
+    hash = "sha256-QVaREzIkFl/4S8gaDyhkTS5wPL5GpzKlJL70UvqsvU4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ch/chiptrack/package.nix b/pkgs/by-name/ch/chiptrack/package.nix
index 33bf51c5b814..fd015fd89dab 100644
--- a/pkgs/by-name/ch/chiptrack/package.nix
+++ b/pkgs/by-name/ch/chiptrack/package.nix
@@ -1,22 +1,13 @@
 {
-  clangStdenv,
+  stdenv,
   rustPlatform,
   lib,
-  linkFarm,
-  fetchgit,
   fetchFromGitHub,
-  runCommand,
   alsa-lib,
   brotli,
   cmake,
-  expat,
   fontconfig,
-  freetype,
-  gn,
-  harfbuzz,
-  icu,
   libglvnd,
-  libjpeg,
   libxkbcommon,
   libx11,
   libxcursor,
@@ -24,23 +15,21 @@
   libxi,
   libxrandr,
   makeWrapper,
-  ninja,
   pkg-config,
   python3,
-  removeReferencesTo,
   wayland,
   zlib,
 }:
 
-rustPlatform.buildRustPackage.override { stdenv = clangStdenv; } rec {
+rustPlatform.buildRustPackage {
   pname = "chiptrack";
-  version = "0.5";
+  version = "0.5-unstable-2026-02-09";
 
   src = fetchFromGitHub {
     owner = "jturcotte";
     repo = "chiptrack";
-    tag = "v${version}";
-    hash = "sha256-yQP5hFM5qBWdaF192PBvM4il6qpmlgUCeuwDCiw/LaQ=";
+    rev = "3cb0caa5bbc23d0579cdad8187c4371bdf0723a3";
+    hash = "sha256-jqtWmhP8h8v8bMPVgVZtraWOXRpEir6WnSoCg5EJKs0=";
   };
 
   strictDeps = true;
@@ -51,59 +40,18 @@ rustPlatform.buildRustPackage.override { stdenv = clangStdenv; } rec {
     makeWrapper
     pkg-config
     python3
-    removeReferencesTo
   ];
 
   buildInputs = [
-    expat
     fontconfig
-    freetype
-    harfbuzz
-    icu
-    libjpeg
   ]
-  ++ lib.optionals clangStdenv.hostPlatform.isLinux [ alsa-lib ];
+  ++ lib.optionals stdenv.hostPlatform.isLinux [ alsa-lib ];
 
   # Has git dependencies
 
-  cargoHash = "sha256-3LRyAY5NmXiJRrN+jwaUX65ArBCl8BiFoaWU2fVRMA8=";
+  cargoHash = "sha256-C9sNSD51Q0U4f4xhnTQI/457uk/yFSrEdok81bDgcc0=";
 
-  env = {
-    SKIA_SOURCE_DIR =
-      let
-        repo = fetchFromGitHub {
-          owner = "rust-skia";
-          repo = "skia";
-          # see rust-skia:skia-bindings/Cargo.toml#package.metadata skia
-          tag = "m129-0.77.1";
-          hash = "sha256-WRVuQpfRnYrE7KGFRFx66fXtMFmtJbC3xUcRPK1JoOM=";
-        };
-        # The externals for skia are taken from skia/DEPS
-        # Reduced to only what's necessary
-        externals = linkFarm "skia-externals" (
-          lib.mapAttrsToList (name: value: {
-            inherit name;
-            path = fetchgit value;
-          }) (lib.importJSON ./skia-externals.json)
-        );
-      in
-      runCommand "source" { } ''
-        cp -R ${repo} $out
-        chmod -R +w $out
-        ln -s ${externals} $out/third_party/externals
-      '';
-    SKIA_GN_COMMAND = lib.getExe gn;
-    SKIA_NINJA_COMMAND = lib.getExe ninja;
-    SKIA_USE_SYSTEM_LIBRARIES = "1";
-
-    NIX_CFLAGS_COMPILE = "-I${lib.getDev harfbuzz}/include/harfbuzz";
-  };
-
-  # library skia embeds the path to its sources
   postFixup = ''
-    remove-references-to -t "$SKIA_SOURCE_DIR" \
-      $out/bin/chiptrack
-
     wrapProgram $out/bin/chiptrack \
       --prefix LD_LIBRARY_PATH : ${
         lib.makeLibraryPath (
@@ -111,7 +59,7 @@ rustPlatform.buildRustPackage.override { stdenv = clangStdenv; } rec {
             brotli
             zlib
           ]
-          ++ lib.optionals clangStdenv.hostPlatform.isLinux [
+          ++ lib.optionals stdenv.hostPlatform.isLinux [
             libglvnd
             libxkbcommon
             libx11
@@ -125,8 +73,6 @@ rustPlatform.buildRustPackage.override { stdenv = clangStdenv; } rec {
       }
   '';
 
-  disallowedReferences = [ env.SKIA_SOURCE_DIR ];
-
   meta = {
     description = "Programmable cross-platform sequencer for the Game Boy Advance sound chip";
     homepage = "https://github.com/jturcotte/chiptrack";
@@ -137,6 +83,6 @@ rustPlatform.buildRustPackage.override { stdenv = clangStdenv; } rec {
     mainProgram = "chiptrack";
     maintainers = with lib.maintainers; [ OPNA2608 ];
     # Various issues with wrong max macOS version & misparsed target conditional checks, can't figure out the magic combination for this
-    broken = clangStdenv.hostPlatform.isDarwin;
+    broken = stdenv.hostPlatform.isDarwin;
   };
 }
diff --git a/pkgs/by-name/ci/circumflex/package.nix b/pkgs/by-name/ci/circumflex/package.nix
index 9f352fdd5fc2..fec1c1c85bbc 100644
--- a/pkgs/by-name/ci/circumflex/package.nix
+++ b/pkgs/by-name/ci/circumflex/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "circumflex";
-  version = "3.9";
+  version = "4.0";
 
   src = fetchFromGitHub {
     owner = "bensadeh";
     repo = "circumflex";
     tag = finalAttrs.version;
-    hash = "sha256-Wv0CSLXM6zMkK0FFAoe0oPpfD3Fq743jz+69qWh0njs=";
+    hash = "sha256-C5zjbs/34SUX23KDLLQvrVH9dNYT125cpnSCWyUhSqw=";
   };
 
-  vendorHash = "sha256-SlXTLL/6OElR5yJ86K2voq6Ui9Z+9CvXVjG0im92CTk=";
+  vendorHash = "sha256-zz0nYzjwiWnknfe82RAtCK7gOaI3j8lwwPxKqE0aGSA=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/by-name/cy/cyberchef/package.nix b/pkgs/by-name/cy/cyberchef/package.nix
index 8a47c17b1849..5b113a258f39 100644
--- a/pkgs/by-name/cy/cyberchef/package.nix
+++ b/pkgs/by-name/cy/cyberchef/package.nix
@@ -21,7 +21,7 @@ let
       categories = [ "Development" ];
     }
   );
-  version = "10.21.0";
+  version = "10.23.0";
 in
 stdenv.mkDerivation {
   pname = "cyberchef";
@@ -29,7 +29,7 @@ stdenv.mkDerivation {
 
   src = fetchzip {
     url = "https://github.com/gchq/CyberChef/releases/download/v${version}/CyberChef_v${version}.zip";
-    hash = "sha256-5w5Bl8LAmpx3dHAwfq4ALKKoS6zRBsh1X7p7ek4dy/s=";
+    hash = "sha256-O2nPVWhKbXkfPNLcfrP3iZmB4uG7F3pgMB/Nt52/h38=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/db/dblab/package.nix b/pkgs/by-name/db/dblab/package.nix
index 974b44424125..8d2687b74fbe 100644
--- a/pkgs/by-name/db/dblab/package.nix
+++ b/pkgs/by-name/db/dblab/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "dblab";
-  version = "0.34.3";
+  version = "0.38.0";
 
   src = fetchFromGitHub {
     owner = "danvergara";
     repo = "dblab";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-mK5DpFD1FgKmZscqJGHy+HY+GlYm2a6UgPFJHhjwtnU=";
+    hash = "sha256-0tkIDWAub+wfoJ760m1kU7XYnGNner/zLtCod6UPF60=";
   };
 
-  vendorHash = "sha256-NhBT0dBS3jKgWHxCMVV6NUMcvqCbKS+tlm3y1YI/sAE=";
+  vendorHash = "sha256-B5wyERNUkJIrKjKET9HX3F43CFW6aBtzAarkAuhxw9o=";
 
   ldflags = [ "-s -w -X main.version=${finalAttrs.version}" ];
 
diff --git a/pkgs/by-name/dr/dry/package.nix b/pkgs/by-name/dr/dry/package.nix
index 0b349b324b64..37e706b7130d 100644
--- a/pkgs/by-name/dr/dry/package.nix
+++ b/pkgs/by-name/dr/dry/package.nix
@@ -6,17 +6,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "dry";
-  version = "0.11.2";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "moncho";
     repo = "dry";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-JGtPX6BrB3q2EQyF6x2A5Wsn5DudOSVt3IxBAjjwlC8=";
+    hash = "sha256-mS7vb1geYqzj6KnkOE7j/HRdqmdipfTsFufK3v6AgdM=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-AduDbBpCoW7GmYrBPpL7wyLvwoez81qP/+mllgoHInY=";
+  vendorHash = "sha256-e8IkL+HRAWDKiw/Za899y1cuvKlaM6gUGToKvIsTZD8=";
 
   meta = {
     description = "Terminal application to manage Docker and Docker Swarm";
diff --git a/pkgs/by-name/fa/fastdds/package.nix b/pkgs/by-name/fa/fastdds/package.nix
index 94d46e30e87d..e7dd650186de 100644
--- a/pkgs/by-name/fa/fastdds/package.nix
+++ b/pkgs/by-name/fa/fastdds/package.nix
@@ -15,14 +15,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fastdds";
-  version = "3.4.2";
+  version = "3.6.0";
 
   src = fetchFromGitHub {
     owner = "eProsima";
     repo = "Fast-DDS";
     rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-NTdkGRbE4yVMMZ/PqLC2nZYD0uIcmo1tr+ieOBSijCM=";
+    hash = "sha256-r9ub7/ULkwVFM6Brz+rV+4yGxaGQAmpMW4xf6+jSAIQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/fo/forgejo-runner/package.nix b/pkgs/by-name/fo/forgejo-runner/package.nix
index f99da20163c9..977e022af41a 100644
--- a/pkgs/by-name/fo/forgejo-runner/package.nix
+++ b/pkgs/by-name/fo/forgejo-runner/package.nix
@@ -52,17 +52,17 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "forgejo-runner";
-  version = "12.8.2";
+  version = "12.9.0";
 
   src = fetchFromGitea {
     domain = "code.forgejo.org";
     owner = "forgejo";
     repo = "runner";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-bLW33r6BdIDt8kHJzRltlePzEfduiL5PBlVO/iZ6MYg=";
+    hash = "sha256-yhcD+FiRuo+WAvKFtgAI+36/uIci9O1s9RtXT0Q75Uo=";
   };
 
-  vendorHash = "sha256-M/x814rhG9hnl4vkHLYY2LQ4YfUqIrtM0ctrBebigrA=";
+  vendorHash = "sha256-CCUyL6ZxLRQy30TQUj1yOAuR7Ctp06/0jG8Q3De6/oo=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/by-name/ga/garnet/deps.json b/pkgs/by-name/ga/garnet/deps.json
index 87311a1ef33b..28e779db05da 100644
--- a/pkgs/by-name/ga/garnet/deps.json
+++ b/pkgs/by-name/ga/garnet/deps.json
@@ -31,8 +31,8 @@
   },
   {
     "pname": "diskann-garnet",
-    "version": "1.0.23",
-    "hash": "sha256-+/2r68Sx07ziIG66BGcZ54OYnZFMjB6jCePxfuzwQH4="
+    "version": "1.0.26",
+    "hash": "sha256-xKcv20olcK/0HBKsiaB+gNXqz6YyKHEdvYVjqssIjy0="
   },
   {
     "pname": "KeraLua",
@@ -46,43 +46,38 @@
   },
   {
     "pname": "Microsoft.Extensions.Configuration",
-    "version": "10.0.3",
-    "hash": "sha256-Qeh/7eMiP/RHekoK3LoIRYHEP7vPKWn/i3cTZiRQlIM="
+    "version": "10.0.5",
+    "hash": "sha256-6rOmJD7Jzq5MPLDd1aV+7gCQwIM9j4c+iT1pGea/daI="
   },
   {
     "pname": "Microsoft.Extensions.Configuration.Abstractions",
-    "version": "10.0.3",
-    "hash": "sha256-OfcPeDv7RJvvv7ns+wCMAQCdG/He2KtxV6MRlwvp35I="
+    "version": "10.0.5",
+    "hash": "sha256-DNK+lL2jeHFYyd43zfgVY32UskEfQ4YsTapztuQbYwo="
   },
   {
     "pname": "Microsoft.Extensions.Configuration.Binder",
-    "version": "10.0.3",
-    "hash": "sha256-XBHZjXmKz8W55kdqZSx1Ylxr1bQtekVPt6bcxRO1u3k="
+    "version": "10.0.5",
+    "hash": "sha256-cVG2NEW1rgLfeq/Gnh/XXqzDx2Tt8ecvgCAB4uFzcQo="
   },
   {
     "pname": "Microsoft.Extensions.DependencyInjection",
-    "version": "10.0.3",
-    "hash": "sha256-h/wiSaVtRCIGdkv6/soA41Dhdlmu2I9hjv/swP8OjDk="
+    "version": "10.0.5",
+    "hash": "sha256-ofDRirUV9XLSz4oksCqErwBJFtAieHACFfyZukHKFng="
   },
   {
     "pname": "Microsoft.Extensions.DependencyInjection.Abstractions",
-    "version": "10.0.3",
-    "hash": "sha256-ShB94jEtsq5X5r6xDZQ+wotZYG3OPKOCHNGy4B7NVFs="
+    "version": "10.0.5",
+    "hash": "sha256-KrP+hE3gk7pATbJYZsJ1LHiXjzLA+ntHW7G/VGgHk2g="
   },
   {
     "pname": "Microsoft.Extensions.Logging",
-    "version": "10.0.3",
-    "hash": "sha256-UmpmoOaxBJlm4FL6pGtRXKK+8YYj5hE/59ox2vGZl+A="
+    "version": "10.0.5",
+    "hash": "sha256-4gVrKZfo/YHZKgKNsgGZZYqa79XWK9wDUuiVfguUV6U="
   },
   {
     "pname": "Microsoft.Extensions.Logging.Abstractions",
-    "version": "10.0.0",
-    "hash": "sha256-BnhgGZc01HwTSxogavq7Ueq4V7iMA3wPnbfRwQ4RhGk="
-  },
-  {
-    "pname": "Microsoft.Extensions.Logging.Abstractions",
-    "version": "10.0.3",
-    "hash": "sha256-lIStSIPTxaoCRoUBHsBPXZbuVj5io02390Wkyepyflw="
+    "version": "10.0.5",
+    "hash": "sha256-e3A/l+II+n+D7/OPwjdyQM1IBtKHfHeIdlkJmuRw77w="
   },
   {
     "pname": "Microsoft.Extensions.Logging.Abstractions",
@@ -96,28 +91,28 @@
   },
   {
     "pname": "Microsoft.Extensions.Logging.Configuration",
-    "version": "10.0.3",
-    "hash": "sha256-aWROg7QQ+U8lOEqwqlph8/myeDe9bwaKKLTFoEMcq3A="
+    "version": "10.0.5",
+    "hash": "sha256-yp0WZcCm+SAkMP9U/B3Dg/v282pFMXbZHVzAp2GLGwA="
   },
   {
     "pname": "Microsoft.Extensions.Logging.Console",
-    "version": "10.0.3",
-    "hash": "sha256-q+0WzmR9/V+2K+C/OPP7f8abIc/kWCrbhi+cYAC9GFw="
+    "version": "10.0.5",
+    "hash": "sha256-Epf70cMofVjqKQxTTgsmNNRW8YcpHj5c80nX8cJTv40="
   },
   {
     "pname": "Microsoft.Extensions.Options",
-    "version": "10.0.3",
-    "hash": "sha256-KDYaVBSdNEuhs3U164RV0n20cjwrpi7uI71B0j/UFsA="
+    "version": "10.0.5",
+    "hash": "sha256-nw+m6VWXjmaBqZ1aH/l9SR9Oy62N9dmiMKloJ78kxv8="
   },
   {
     "pname": "Microsoft.Extensions.Options.ConfigurationExtensions",
-    "version": "10.0.3",
-    "hash": "sha256-Wia7KiEYjMilkXSDmsY7edXvtvUFw7kppv/J/cYMPXo="
+    "version": "10.0.5",
+    "hash": "sha256-VQPPvrvYWY/QpmilerCyTNLVejWeBE9mHtGTMOxXUlg="
   },
   {
     "pname": "Microsoft.Extensions.Primitives",
-    "version": "10.0.3",
-    "hash": "sha256-w0G+IW9kz70ug1BEuJTeS1N7werQhms3gQl6ODzNIpQ="
+    "version": "10.0.5",
+    "hash": "sha256-uvrur+0dg4zAAQcpLkkhPA77ST0tA3+EpGdDlCckC+E="
   },
   {
     "pname": "Microsoft.Identity.Client",
@@ -136,38 +131,38 @@
   },
   {
     "pname": "Microsoft.IdentityModel.Abstractions",
-    "version": "8.16.0",
-    "hash": "sha256-OpTFQpTtg1A8I1bBIOqv/n9pwYXTqzMI8ZLXLZDti5w="
+    "version": "8.17.0",
+    "hash": "sha256-AU+EMOZArc3rTdsnKYzAufFAtspuYQM3XYi8/VsQAio="
   },
   {
     "pname": "Microsoft.IdentityModel.JsonWebTokens",
-    "version": "8.16.0",
-    "hash": "sha256-Cctf2iuIXLMklTuCvzWv721v2mHs0HEBA47BqAKhp9I="
+    "version": "8.17.0",
+    "hash": "sha256-MH7vdhCNAae32p6UTvaDtmyvFDxa/W71qTsEQ6yC9xM="
   },
   {
     "pname": "Microsoft.IdentityModel.Logging",
-    "version": "8.16.0",
-    "hash": "sha256-355u+3LIn/QfiCHFMXD+3ipdRTnbXLAQNzC4sWEFapQ="
+    "version": "8.17.0",
+    "hash": "sha256-IM6jsPMz+l9JA0cye/v2ke51xlfP0u5HtWBqc2aKDYM="
   },
   {
     "pname": "Microsoft.IdentityModel.Protocols",
-    "version": "8.16.0",
-    "hash": "sha256-1arWAORCo4ogzYphGkkdamLinl2T9Euhu4BAdf95+ds="
+    "version": "8.17.0",
+    "hash": "sha256-T2Prc5tynPw9VY8gFBq7lqTrBlLGH63PdEE6G+2NkSk="
   },
   {
     "pname": "Microsoft.IdentityModel.Protocols.OpenIdConnect",
-    "version": "8.16.0",
-    "hash": "sha256-SgkwN+uAHQRm1VKoJdrbiMXBNa94nWrL2Pv0BVJh+qY="
+    "version": "8.17.0",
+    "hash": "sha256-jBY4s5PYGSDaAqX24pJS4lTQWULw6ftkz/AunrqQ0Cg="
   },
   {
     "pname": "Microsoft.IdentityModel.Tokens",
-    "version": "8.16.0",
-    "hash": "sha256-6s8ZLnKw32W6+KbnahCVe1v9YzpoemnpHNQ3VbFSV4M="
+    "version": "8.17.0",
+    "hash": "sha256-XcA0KXJbqMWt0I5LuHHMRLpgVQ18KcBej1BoySHeA1A="
   },
   {
     "pname": "Microsoft.IdentityModel.Validators",
-    "version": "8.16.0",
-    "hash": "sha256-dcoka+AtzN9W5UrAjw4Nm6NajvAMmOicQ4xvUKoIQIQ="
+    "version": "8.17.0",
+    "hash": "sha256-kmYad8WDMK9lZQBOCrsu3HuzXCbD+oQmRcOZU9++VPI="
   },
   {
     "pname": "System.ClientModel",
@@ -181,13 +176,13 @@
   },
   {
     "pname": "System.Diagnostics.DiagnosticSource",
-    "version": "10.0.3",
-    "hash": "sha256-YQzu50E7/1slw8IcFkVpQd33/IyWw1hJapTIscnoF5Q="
+    "version": "10.0.5",
+    "hash": "sha256-yVXEbpbQRF+B4oYUJEWUgMUmOvZTFZzK3CWrr9pynVY="
   },
   {
     "pname": "System.IdentityModel.Tokens.Jwt",
-    "version": "8.16.0",
-    "hash": "sha256-wCEkUPnKDjO7Kpfr1vpr5Icvk69gFHgEWcSLbFtD6pg="
+    "version": "8.17.0",
+    "hash": "sha256-DmAmWVosgwWlKGJm/0wFVbeV19YD2rT+gp8utjY0n0Q="
   },
   {
     "pname": "System.IO.Hashing",
@@ -196,8 +191,8 @@
   },
   {
     "pname": "System.IO.Pipelines",
-    "version": "10.0.3",
-    "hash": "sha256-+LsHlaUFMFVb60U7GFcvD1l7IpEcjdm1+Iw2g+qrUik="
+    "version": "10.0.5",
+    "hash": "sha256-zV+G9x2d3ugEaq7ClmZbMhQe0901hxj0WtleEEglpcE="
   },
   {
     "pname": "System.Memory.Data",
@@ -206,8 +201,8 @@
   },
   {
     "pname": "System.Numerics.Tensors",
-    "version": "10.0.3",
-    "hash": "sha256-EpyBN0KGkS9aVj1DU75G60Ok+SvwbtYmEqmQJFnRi40="
+    "version": "10.0.5",
+    "hash": "sha256-psWBXBfetquCOYPsbooxhef1Wi4TlwnPVRarSHBixKw="
   },
   {
     "pname": "System.Security.Cryptography.ProtectedData",
@@ -216,12 +211,12 @@
   },
   {
     "pname": "System.Text.Encodings.Web",
-    "version": "10.0.3",
-    "hash": "sha256-TuOSPfi9dfFnHvH5++zIi30JpRERp35HFpm2R0NWUAk="
+    "version": "10.0.5",
+    "hash": "sha256-8dXorb9rjnaqD8EpGlyHkvKrwgcxZblQdzeLYDdk6lw="
   },
   {
     "pname": "System.Text.Json",
-    "version": "10.0.3",
-    "hash": "sha256-E1gPHMAuk2tR4cyScCfsSlDDerhlLAQCUZZMiByIk18="
+    "version": "10.0.5",
+    "hash": "sha256-Phy+3UAOvqk8U0yeCSpr4n6H7JjKMTHdrHlV2bZfiUU="
   }
 ]
diff --git a/pkgs/by-name/ga/garnet/package.nix b/pkgs/by-name/ga/garnet/package.nix
index a3619c62ce4d..2d93a6363906 100644
--- a/pkgs/by-name/ga/garnet/package.nix
+++ b/pkgs/by-name/ga/garnet/package.nix
@@ -8,13 +8,13 @@
 
 buildDotnetModule rec {
   pname = "garnet";
-  version = "1.1.1";
+  version = "1.1.3";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "garnet";
     tag = "v${version}";
-    hash = "sha256-Ngy49BjWQoMC7hqZFJxzrFIPxjG3eZmjKgUzZ2e2owQ=";
+    hash = "sha256-4XGJ+TnWMiphXumy42AmNnCixqLGmLftANwDz11f6TQ=";
   };
 
   projectFile = "main/GarnetServer/GarnetServer.csproj";
diff --git a/pkgs/by-name/gi/gip/package.nix b/pkgs/by-name/gi/gip/package.nix
new file mode 100644
index 000000000000..1f0ac28a1485
--- /dev/null
+++ b/pkgs/by-name/gi/gip/package.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  fetchFromGitHub,
+  openssl,
+  pkg-config,
+  rustPlatform,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "gip";
+  version = "0.7.1";
+
+  src = fetchFromGitHub {
+    owner = "dalance";
+    repo = "gip";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-UgvXaDNdH8ZN00oJ/DjIlBs86ua3JmVz1JfLk2XBVFw=";
+  };
+
+  cargoHash = "sha256-C38pV8c7znbBua130qDaguUAWamGhxfI8y0Vy0yadWc=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ openssl ];
+
+  __structuredAttrs = true;
+
+  # Tests that require network access
+  doCheck = false;
+
+  meta = {
+    description = "Command-line tool to get global IP address";
+    homepage = "https://github.com/dalance/gip";
+    changelog = "https://github.com/dalance/gip/releases/tag/${finalAttrs.src.tag}";
+    license = with lib.licenses; [
+      mit
+      asl20
+    ];
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "gip";
+  };
+})
diff --git a/pkgs/by-name/gi/git-town/package.nix b/pkgs/by-name/gi/git-town/package.nix
index 14df721d7e21..7857c70e65ae 100644
--- a/pkgs/by-name/gi/git-town/package.nix
+++ b/pkgs/by-name/gi/git-town/package.nix
@@ -13,13 +13,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "git-town";
-  version = "22.7.0";
+  version = "22.7.1";
 
   src = fetchFromGitHub {
     owner = "git-town";
     repo = "git-town";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-nHuEwAb0FBTE3YQ0rMFYhC1YM+kh/f1cNgqN7U1E3dk=";
+    hash = "sha256-MGiWqFWA4PMyGL7QqgcDWrgM/Wo8us8GMhdsrXBgWmg=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/gl/glaze/package.nix b/pkgs/by-name/gl/glaze/package.nix
index b253b6c104f0..3872113d7446 100644
--- a/pkgs/by-name/gl/glaze/package.nix
+++ b/pkgs/by-name/gl/glaze/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "glaze";
-  version = "7.3.3";
+  version = "7.4.0";
 
   src = fetchFromGitHub {
     owner = "stephenberry";
     repo = "glaze";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-RqsJupqXvbgtGNCYszEx22KuDBH0zp9yha6dcsNlaKY=";
+    hash = "sha256-1/GCV6vGERfeIWMXNtb/TWkyc4Fvf4wRxncqrPnGnhQ=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/go/go-jsonnet/package.nix b/pkgs/by-name/go/go-jsonnet/package.nix
index 86d3cbf00944..b3cf773fdc33 100644
--- a/pkgs/by-name/go/go-jsonnet/package.nix
+++ b/pkgs/by-name/go/go-jsonnet/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "go-jsonnet";
-  version = "0.21.0";
+  version = "0.22.0";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "go-jsonnet";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-J92xNDpCidbiSsN6NveS6BX6Tx+qDQqkgm6pjk1wBTQ=";
+    hash = "sha256-O7b26aobvs1gHsUNM2RZ/WnIMpFJOa/XbupttTMJ8LA=";
   };
 
-  vendorHash = "sha256-Uh2rAXdye9QmmZuEqx1qeokE9Z9domyHsSFlU7YZsZw=";
+  vendorHash = "sha256-uFCvMmiZVaRYhaORI92W0pkDjDZNiWIcop70FssJiZo=";
 
   subPackages = [ "cmd/jsonnet*" ];
 
diff --git a/pkgs/by-name/hu/hut/package.nix b/pkgs/by-name/hu/hut/package.nix
index 6b6053067bdf..fe32cf221f19 100644
--- a/pkgs/by-name/hu/hut/package.nix
+++ b/pkgs/by-name/hu/hut/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "hut";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchFromSourcehut {
     owner = "~xenrox";
     repo = "hut";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-pc6E3ORDmaMhoNe8GQeYZrxhe5ySQqsMPe/iUbclnGk=";
+    hash = "sha256-dbFqc+zlUihf/gz4Oo3LtbOClDDDB/khlCbI9/UgD2E=";
   };
 
-  vendorHash = "sha256-/51cv/EvcBCyCOf91vJ5M75p0bkAQqVoRUp+C+i70Os=";
+  vendorHash = "sha256-7N+Zn7tzEG3dGeqNWmY98XUUKV7Y6g8wFZcQP9wea/8=";
 
   nativeBuildInputs = [
     scdoc
@@ -25,7 +25,7 @@ buildGoModule (finalAttrs: {
   makeFlags = [ "PREFIX=$(out)" ];
 
   ldflags = [
-    # Recommended in 0.7.0 release notes https://git.sr.ht/~xenrox/hut/refs/v0.7.0
+    # Recommended in 0.8.0 release notes https://git.sr.ht/~xenrox/hut/refs/v0.8.0
     "-X main.version=v${finalAttrs.version}"
   ];
 
diff --git a/pkgs/by-name/im/imgproxy/package.nix b/pkgs/by-name/im/imgproxy/package.nix
index 02cf4fd58fd8..4a25023a5e61 100644
--- a/pkgs/by-name/im/imgproxy/package.nix
+++ b/pkgs/by-name/im/imgproxy/package.nix
@@ -11,16 +11,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "imgproxy";
-  version = "3.30.1";
+  version = "3.31.2";
 
   src = fetchFromGitHub {
     owner = "imgproxy";
     repo = "imgproxy";
-    hash = "sha256-UaJ02TQ8jbebRDF5K3zFy+4ho+dt1o/o3cEDzUQY3iU=";
+    hash = "sha256-gKSSdBtmCSiiBPon3Fj+TGyGSITND5C+hUW9xdjJPZs=";
     rev = "v${finalAttrs.version}";
   };
 
-  vendorHash = "sha256-0NIsaSMOBenDCGvnGdLB60sp08EaC/CezWogxTrcDdY=";
+  vendorHash = "sha256-coHlsBh+ujEU9D/RloONAl+TDaxEJMdvvaNEuWe4SP8=";
 
   __darwinAllowLocalNetworking = true;
 
diff --git a/pkgs/by-name/in/inputplumber/package.nix b/pkgs/by-name/in/inputplumber/package.nix
index 94edc5abac56..326f1a95ecf6 100644
--- a/pkgs/by-name/in/inputplumber/package.nix
+++ b/pkgs/by-name/in/inputplumber/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "inputplumber";
-  version = "0.76.0";
+  version = "0.76.1";
 
   src = fetchFromGitHub {
     owner = "ShadowBlip";
     repo = "InputPlumber";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-81M/nVjLw+dI/ch+l/RJvq4ClMVCQqx+IfwPVPDB6HE=";
+    hash = "sha256-SkW79i1jutVwty18bWXJEUijDunHukF3Sxqm0VwzMz0=";
   };
 
-  cargoHash = "sha256-x/jPB3QClaYt/9fVnuz1yDUWsurcrx/mKouHMv2QsFc=";
+  cargoHash = "sha256-nHAdU/7JHPveOvUsXqdmUQtzET2Jv6T6PN83S7TwsIM=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/jj/jj-pre-push/package.nix b/pkgs/by-name/jj/jj-pre-push/package.nix
index 06f70563b978..1ff5b8512f3a 100644
--- a/pkgs/by-name/jj/jj-pre-push/package.nix
+++ b/pkgs/by-name/jj/jj-pre-push/package.nix
@@ -11,14 +11,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "jj-pre-push";
-  version = "0.3.5";
+  version = "0.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "acarapetis";
     repo = "jj-pre-push";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-T9IKPFGswwrszGkBCIz8et2vTgRpQ2l6ta2UfojGj7A=";
+    hash = "sha256-LULCTpsxTflqWm5ZVFHbnTI/2+4xI9MX4kbAtYzBIAI=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/js/jsonschema-cli/package.nix b/pkgs/by-name/js/jsonschema-cli/package.nix
index 91c508cb1f5c..846d21dc2253 100644
--- a/pkgs/by-name/js/jsonschema-cli/package.nix
+++ b/pkgs/by-name/js/jsonschema-cli/package.nix
@@ -9,15 +9,15 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "jsonschema-cli";
-  version = "0.46.0";
+  version = "0.46.2";
 
   src = fetchCrate {
     pname = "jsonschema-cli";
     inherit (finalAttrs) version;
-    hash = "sha256-tpapiI6FYHEgmI0XY5KZNNsZxKxkEN4BIJaNQXsMIJI=";
+    hash = "sha256-GN0dQy+ZKixOyo3n5n1GV3uS7wa4+e6o8R9vgjD7iJ0=";
   };
 
-  cargoHash = "sha256-1Wih2VwK3hzdjuoAZI/1j0jPwWwL4l4y4rQRX0VV4Sc=";
+  cargoHash = "sha256-wCz/EjHejsb+caUSVCT/4LoTcFPlObNuDNnnjhagirY=";
 
   preCheck = ''
     export SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt
diff --git a/pkgs/by-name/ka/kargo/package.nix b/pkgs/by-name/ka/kargo/package.nix
index df52f9b58383..1c842c896b04 100644
--- a/pkgs/by-name/ka/kargo/package.nix
+++ b/pkgs/by-name/ka/kargo/package.nix
@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "kargo";
-  version = "1.9.5";
+  version = "1.9.6";
 
   src = fetchFromGitHub {
     owner = "akuity";
     repo = "kargo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jdRba3n9jGpZIp8E7Fz4DC3eDV4GK+MpuxBpYhpR60o=";
+    hash = "sha256-1r6XHtYbY107KwXHXv+AZd/y0TFa/LgU513bAhQPvPk=";
   };
 
   vendorHash = "sha256-ir73yLXLOs6/6YX72EeyMcGLsImRkGmH4vppwKeOD+A=";
diff --git a/pkgs/by-name/ka/katawa-shoujo-re-engineered/package.nix b/pkgs/by-name/ka/katawa-shoujo-re-engineered/package.nix
index dbc3fbdafe72..50091ddfd37d 100644
--- a/pkgs/by-name/ka/katawa-shoujo-re-engineered/package.nix
+++ b/pkgs/by-name/ka/katawa-shoujo-re-engineered/package.nix
@@ -5,7 +5,7 @@
   makeDesktopItem,
   copyDesktopItems,
   makeWrapper,
-  renpy,
+  renpyMinimal,
   nix-update-script,
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
@@ -34,7 +34,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     makeWrapper
     copyDesktopItems
-    renpy
+    renpyMinimal
   ];
 
   postPatch = ''
@@ -45,6 +45,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     runHook preBuild
 
     renpy . compile
+    rm -r game/saves
 
     runHook postBuild
   '';
@@ -56,7 +57,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     mkdir -p $phome
     cp -r game $phome
     find $phome -type f -name "*.rpy" -delete
-    makeWrapper ${lib.getExe renpy} $out/bin/katawa-shoujo-re-engineered \
+    makeWrapper ${lib.getExe renpyMinimal} $out/bin/katawa-shoujo-re-engineered \
       --add-flags $phome --add-flags run
     install -D $src/web-icon.png $out/share/icons/hicolor/512x512/apps/katawa-shoujo-re-engineered.png
 
@@ -80,6 +81,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       rapiteanu
       ulysseszhan
     ];
-    platforms = renpy.meta.platforms;
+    platforms = renpyMinimal.meta.platforms;
   };
 })
diff --git a/pkgs/by-name/ku/kubeone/package.nix b/pkgs/by-name/ku/kubeone/package.nix
index af0b18db617d..e06f96cbfd92 100644
--- a/pkgs/by-name/ku/kubeone/package.nix
+++ b/pkgs/by-name/ku/kubeone/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "kubeone";
-  version = "1.12.3";
+  version = "1.13.4";
 
   src = fetchFromGitHub {
     owner = "kubermatic";
     repo = "kubeone";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-/fOtepUysZvJQrpdNklgSeL946tSf3Icohi0bRSLieA=";
+    hash = "sha256-PEGhLqBLDHLxa23+llB0LdaS/mGINyMzoCyPAsBU+vw=";
   };
 
-  vendorHash = "sha256-4thcMvdS2oxBai+3aOUPXd5T6f2DcW0Mm1d3y/DMGFc=";
+  vendorHash = "sha256-qXIlU1ZrJvJ0u8wSoBeESEfOMEGHkVg8kLMp/zlyfno=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/mi/mimir/package.nix b/pkgs/by-name/mi/mimir/package.nix
index 2b1fe31974d0..ba5e0d5907ff 100644
--- a/pkgs/by-name/mi/mimir/package.nix
+++ b/pkgs/by-name/mi/mimir/package.nix
@@ -7,13 +7,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "mimir";
-  version = "3.0.5";
+  version = "3.0.6";
 
   src = fetchFromGitHub {
     rev = "mimir-${finalAttrs.version}";
     owner = "grafana";
     repo = "mimir";
-    hash = "sha256-C7vfJrcFin4zv/wO9IWIzUPtjiOAoOEWcniCTNm1eRs=";
+    hash = "sha256-rz1Wzsnxt8eGf0rkI8pvhpft+EhTUsdFK4s+9QVn7dg=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/mo/mosh/package.nix b/pkgs/by-name/mo/mosh/package.nix
index 5e5fae1fee2a..11c6b1c66e62 100644
--- a/pkgs/by-name/mo/mosh/package.nix
+++ b/pkgs/by-name/mo/mosh/package.nix
@@ -13,7 +13,7 @@
   openssh,
   bash-completion,
   fetchpatch,
-  withUtempter ? stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isMusl,
+  withUtempter ? stdenv.hostPlatform.isLinux,
   libutempter,
   # build server binary only when set to false (useful for perlless systems)
   withClient ? true,
diff --git a/pkgs/by-name/ne/nextdns/package.nix b/pkgs/by-name/ne/nextdns/package.nix
index b42210699e3f..c49685fb5378 100644
--- a/pkgs/by-name/ne/nextdns/package.nix
+++ b/pkgs/by-name/ne/nextdns/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "nextdns";
-  version = "1.46.0";
+  version = "1.47.2";
 
   src = fetchFromGitHub {
     owner = "nextdns";
     repo = "nextdns";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-Vutd7sTVAcz7ueJYSDAOe8CUAS5agwHEG1hH8mp8its=";
+    sha256 = "sha256-AlKuC5UXQ2fRgnFnIYoa0/D7ydZTaZFfenGxiZbA3io=";
   };
 
-  vendorHash = "sha256-GOj07+OVvtp+/FiwBZJb/E9P/4wiHJrh0Cx2uO3NbCg=";
+  vendorHash = "sha256-ZGptjQg/LfvfAEKo1rqitNh2jME06JuryPIFuWdleZk=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ni/nix-fast-build/package.nix b/pkgs/by-name/ni/nix-fast-build/package.nix
index 6afeb825ff3a..0ee05b20949e 100644
--- a/pkgs/by-name/ni/nix-fast-build/package.nix
+++ b/pkgs/by-name/ni/nix-fast-build/package.nix
@@ -11,14 +11,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "nix-fast-build";
-  version = "1.3.0";
+  version = "1.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Mic92";
     repo = "nix-fast-build";
     tag = finalAttrs.version;
-    hash = "sha256-6X4BW+3C2nfkorMfe+tuoeYrdddxPtLqOJ1rZxuxPrc=";
+    hash = "sha256-sH/KWX8NO8iurnnkI7w8eWMkbnRBbvEIK9IW4LnR0qQ=";
   };
 
   build-system = [ python3Packages.setuptools ];
diff --git a/pkgs/by-name/op/openfga/package.nix b/pkgs/by-name/op/openfga/package.nix
index 0826a2c58aa3..4ec3cacd1cec 100644
--- a/pkgs/by-name/op/openfga/package.nix
+++ b/pkgs/by-name/op/openfga/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "openfga";
-  version = "1.13.1";
+  version = "1.14.2";
 
   src = fetchFromGitHub {
     owner = "openfga";
     repo = "openfga";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-fmTb5mRAbJGDfE4lLSFtfHuQv2pQn4fQnX7fTjq7KKs=";
+    hash = "sha256-nY5HRkZCKgjr1a5XxxRcUwCms9PCQs3IZiFgAEaD7To=";
   };
 
-  vendorHash = "sha256-sd1kDRicWb5ShEFDCJIjv4kk2dA5XwABH3Ii/P3uVvI=";
+  vendorHash = "sha256-q5NZLPtdwFeHzLi+ZmRzGScxkl0OOxTVo/W6yUL1lO8=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/op/openshadinglanguage/package.nix b/pkgs/by-name/op/openshadinglanguage/package.nix
index 1cb8e244badf..589df0d95b7d 100644
--- a/pkgs/by-name/op/openshadinglanguage/package.nix
+++ b/pkgs/by-name/op/openshadinglanguage/package.nix
@@ -24,13 +24,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "openshadinglanguage";
-  version = "1.15.1.0";
+  version = "1.15.3.0";
 
   src = fetchFromGitHub {
     owner = "AcademySoftwareFoundation";
     repo = "OpenShadingLanguage";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+PNh4xFdH8onxK0OTnQHbdupTaB2hTgDumY0krJiWUE=";
+    hash = "sha256-xNu973TbPIIOLpZDe2E9sRmX7GpidQeQrKkpz7zkuBY=";
   };
 
   cmakeFlags = [
diff --git a/pkgs/by-name/ov/ovhcloud-cli/package.nix b/pkgs/by-name/ov/ovhcloud-cli/package.nix
index 6f3cf5b51390..754d83b55bc1 100644
--- a/pkgs/by-name/ov/ovhcloud-cli/package.nix
+++ b/pkgs/by-name/ov/ovhcloud-cli/package.nix
@@ -8,16 +8,16 @@
 
 buildGo126Module (finalAttrs: {
   pname = "ovhcloud-cli";
-  version = "0.10.0";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "ovh";
     repo = "ovhcloud-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NBfMxXu5sZpv+OnoMCq4xc4AVQU+mbPrapVdq2Hffb8=";
+    hash = "sha256-MiDX819XWBdtaeVwTRDMuuvmfWRQ0qhi3gQABHVQR3k=";
   };
 
-  vendorHash = "sha256-JNnIpRr4zdGtlOOKGf1bQVViMgjnwGBAmYbFcCpzStY=";
+  vendorHash = "sha256-fDn6MUD2jr06T66xSxUtNFsL+upF1M2tD6IVdzhgfVI=";
 
   env.CGO_ENABLED = 0;
 
diff --git a/pkgs/by-name/pi/pid-fan-controller/package.nix b/pkgs/by-name/pi/pid-fan-controller/package.nix
index 12cfdc626b57..4c1b85750e3b 100644
--- a/pkgs/by-name/pi/pid-fan-controller/package.nix
+++ b/pkgs/by-name/pi/pid-fan-controller/package.nix
@@ -4,7 +4,7 @@
   lib,
 }:
 let
-  version = "0.1.1";
+  version = "0.1.3";
 in
 rustPlatform.buildRustPackage {
   pname = "pid-fan-controller";
@@ -13,10 +13,19 @@ rustPlatform.buildRustPackage {
   src = fetchFromGitHub {
     owner = "zimward";
     repo = "pid-fan-controller";
-    rev = version;
-    hash = "sha256-ALR9Qa0AhcGyc3+7x5CEG/72+bJzhaEoIvQNL+QjldY=";
+    tag = version;
+    hash = "sha256-BgBFX4x1gMSMla7lhkFk1n5fBC1TFK0Z5Z3mFH2oBF0=";
   };
-  cargoHash = "sha256-Y57VSheI94b43SwNCDdFvcNxzkA16KObBvzZ6ywYAyU=";
+  cargoHash = "sha256-AN7EbjKZBxb8UP0MEbJUw5Y8E/rE35MByKVmxX2ctko=";
+
+  postPatch = ''
+    substituteInPlace resources/pid-fan-controller.service \
+      --replace-fail '/usr/bin' "$out/bin"
+  '';
+  postInstall = ''
+    install -Dm0644 resources/pid-fan-controller.service $out/lib/systemd/system/pid-fan-controller.service
+    install -Dm0644 resources/pid-fan-controller-sleep.service $out/lib/systemd/system/pid-fan-controller-sleep.service
+  '';
 
   meta = {
     description = "Service to provide closed-loop PID fan control";
diff --git a/pkgs/by-name/pi/pinniped/package.nix b/pkgs/by-name/pi/pinniped/package.nix
index e2f28e4ba480..ebc07cfc9fbf 100644
--- a/pkgs/by-name/pi/pinniped/package.nix
+++ b/pkgs/by-name/pi/pinniped/package.nix
@@ -8,18 +8,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "pinniped";
-  version = "0.44.0";
+  version = "0.45.0";
 
   src = fetchFromGitHub {
     owner = "vmware-tanzu";
     repo = "pinniped";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-eReGKJRfn2MPJQjSSYf32WeElNw52egJxJF4aCkdHlg=";
+    sha256 = "sha256-KYhMJjUu+6suT9o4RbGRyBl5ItiYt/5JQPg4fUzqs0M=";
   };
 
   subPackages = "cmd/pinniped";
 
-  vendorHash = "sha256-zRc5kNsduZqMvBexwKfXppXxADE0egFh6KQ0qqByKZc=";
+  vendorHash = "sha256-PAq+Oc8+Iib3/hBGrC0xQl+kBtWtsU7XS0alJePkO7k=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/pr/protonmail-bridge/package.nix b/pkgs/by-name/pr/protonmail-bridge/package.nix
index 95b47a2869c8..13d2b8649214 100644
--- a/pkgs/by-name/pr/protonmail-bridge/package.nix
+++ b/pkgs/by-name/pr/protonmail-bridge/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "protonmail-bridge";
-  version = "3.23.1";
+  version = "3.24.1";
 
   src = fetchFromGitHub {
     owner = "ProtonMail";
     repo = "proton-bridge";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-QSK+MiHE8JFtUM4r+4xswOcNrcUd0flxuSf5uG2kZnI=";
+    hash = "sha256-olDmpTs4U9EFInYjuD4WjGmHWQIdNoq6dg9jr/2wjA0=";
   };
 
-  vendorHash = "sha256-Ww42BbdMHVUUc074vWNYTEMr1myqDPLgkMsaTarziag=";
+  vendorHash = "sha256-jGFefDKPrYZ7QB3R/fRiEC6FPp6U77mJ2E/RXeylsvI=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/pu/pureref/package.nix b/pkgs/by-name/pu/pureref/package.nix
index 5ff951531899..406afda60a73 100644
--- a/pkgs/by-name/pu/pureref/package.nix
+++ b/pkgs/by-name/pu/pureref/package.nix
@@ -9,7 +9,7 @@
   dpkg,
 }:
 let
-  version = "2.1.1";
+  version = "2.1.2";
   deb =
     runCommand "PureRef-${version}_x64"
       {
@@ -19,7 +19,7 @@ let
           cacert
           dpkg
         ];
-        outputHash = "sha256-Dyozn6WJ93AvXavlW3xmY5p5TsQxU+dJkogEBE8e+zs=";
+        outputHash = "sha256-aGHhesJ6JJQpuRbDgASjpY4e28WHaVSFNEgGZmG7U3g=";
         outputHashMode = "recursive";
       }
       ''
diff --git a/pkgs/by-name/re/renpy/distribute.patch b/pkgs/by-name/re/renpy/distribute.patch
new file mode 100644
index 000000000000..c0bceb135919
--- /dev/null
+++ b/pkgs/by-name/re/renpy/distribute.patch
@@ -0,0 +1,13 @@
+diff --git a/launcher/game/distribute.rpy b/launcher/game/distribute.rpy
+index bece65c63..831c405f8 100644
+--- a/launcher/game/distribute.rpy
++++ b/launcher/game/distribute.rpy
+@@ -863,7 +863,7 @@ fix_dlc("renios", "renios")
+                             )
+ 
+             for fn in os.listdir(directory):
+-                walk(fn, os.path.join(directory, fn))
++                walk(fn, os.path.join(directory, "renpy-dist" if fn == "renpy" else fn))
+ 
+         def merge_file_lists(self):
+             """
diff --git a/pkgs/by-name/re/renpy/dont-compile-system.patch b/pkgs/by-name/re/renpy/dont-compile-system.patch
new file mode 100644
index 000000000000..81d45adacf95
--- /dev/null
+++ b/pkgs/by-name/re/renpy/dont-compile-system.patch
@@ -0,0 +1,31 @@
+diff --git a/renpy/script.py b/renpy/script.py
+index 62e424415..7c3ae5922 100644
+--- a/renpy/script.py
++++ b/renpy/script.py
+@@ -969,6 +969,13 @@ class Script(object):
+                 f.seek(-hashlib.md5().digest_size, 2)
+                 digest = f.read(hashlib.md5().digest_size)
+ 
++        elif dir.startswith("@systemRenpy@"):
++            data, stmts = self.load_file(dir, fn + compiled)
++            lastfn = dir + "/" + fn + compiled
++            with open(lastfn, "rb") as f:
++                f.seek(-hashlib.md5().digest_size, 2)
++                digest = f.read(hashlib.md5().digest_size)
++
+         else:
+             # Otherwise, we're loading from disk. So we need to decide if
+             # we want to load the rpy or the rpyc file.
+diff --git a/launcher/game/distribute.rpy b/launcher/game/distribute.rpy
+index bece65c63..c2590bcf7 100644
+--- a/launcher/game/distribute.rpy
++++ b/launcher/game/distribute.rpy
+@@ -606,7 +606,7 @@ fix_dlc("renios", "renios")
+                 self.log.close()
+                 return
+ 
+-            if project.data['force_recompile']:
++            if project.data['force_recompile'] and False:
+                 import compileall
+ 
+                 compileall.compile_dir(
diff --git a/pkgs/by-name/re/renpy/new-project-prefix.patch b/pkgs/by-name/re/renpy/new-project-prefix.patch
new file mode 100644
index 000000000000..86d14fdf2d44
--- /dev/null
+++ b/pkgs/by-name/re/renpy/new-project-prefix.patch
@@ -0,0 +1,30 @@
+diff --git a/launcher/game/gui7/code.py b/launcher/game/gui7/code.py
+index 5c1b89f23c..c8ad04b6dd 100644
+--- a/launcher/game/gui7/code.py
++++ b/launcher/game/gui7/code.py
+@@ -243,9 +243,7 @@ def quote(s):
+ 
+         self.update_defines(replacements)
+ 
+-    def write_target(self, filename):
+-
+-        target = os.path.join(self.p.prefix, filename)
++    def write_target(self, target):
+ 
+         if os.path.exists(target):
+ 
+@@ -421,7 +419,7 @@ def generate_gui(self, fn, defines=False):
+             self.translate_comments()
+             self.add_code(fn)
+ 
+-        self.write_target(fn)
++        self.write_target(os.path.join(self.p.prefix, fn))
+ 
+     def generate_code(self, fn):
+ 
+@@ -439,4 +437,4 @@ def generate_code(self, fn):
+ 
+         self.add_code(fn)
+ 
+-        self.write_target(fn)
++        self.write_target(target)
diff --git a/pkgs/by-name/re/renpy/noSteam.patch b/pkgs/by-name/re/renpy/noSteam.patch
deleted file mode 100644
index 6322bcff3248..000000000000
--- a/pkgs/by-name/re/renpy/noSteam.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/renpy/common/00steam.rpy b/renpy/common/00steam.rpy
-index 9a5f9c405..68c8c26e0 100644
---- a/renpy/common/00steam.rpy
-+++ b/renpy/common/00steam.rpy
-@@ -1029,11 +1029,6 @@ init -1499 python in achievement:
-             steam = None
-             steamapi = None
- 
--    if renpy.windows or renpy.macintosh or renpy.linux:
--        steam_preinit()
--        steam_init()
--
--
- init 1500 python in achievement:
- 
-     # Steam position.
diff --git a/pkgs/by-name/re/renpy/package.nix b/pkgs/by-name/re/renpy/package.nix
index b99aa9d32ce1..0d462441f26f 100644
--- a/pkgs/by-name/re/renpy/package.nix
+++ b/pkgs/by-name/re/renpy/package.nix
@@ -1,45 +1,110 @@
 {
+  lib,
+  stdenv,
   assimp,
+  copyDesktopItems,
+  desktopToDarwinBundle,
   fetchFromGitHub,
+  fetchurl,
+  fetchzip,
   ffmpeg,
   freetype,
   fribidi,
   glew,
   harfbuzz,
-  lib,
   libGL,
   libGLU,
+  libjpeg,
   libpng,
-  makeWrapper,
+  makeBinaryWrapper,
+  makeDesktopItem,
+  openssl,
   pkg-config,
   python312,
   SDL2,
-  stdenv,
+  SDL2_image,
   versionCheckHook,
-  withoutSteam ? true,
+  zenity,
   zlib,
+
+  # the minimal package contains only compiled python and cython files, and the example projects and the launcher are removed
+  # one should use the minimal package in favor of the full package when packaging games, in which case only the game runtime is needed
+  minimal ? false,
+  # with this, you can click "Documentation" in the launcher to open local doc (otherwise it opens web doc)
+  withDoc ? !minimal,
+  # set this to true if you want to use this package to distribute games
+  # (to windows, linux, and macos, outside of nix; android, ios, and web are not supported)
+  withDistributedLibs ? !minimal,
+  # set this to true if you additionally want to distribute games for aarch64-linux
+  # this implies withDistributedLibs = true because it also includes the libraries for other platforms
+  withAarch64LinuxDistributedLibs ?
+    withDistributedLibs && stdenv.targetPlatform.isAarch64 && stdenv.targetPlatform.isLinux,
 }:
 
+# technically we can support cross-compilation by first compiling a renpy for the build platform besides a renpy for the host platform
+# and we can use the former to compile the rpy{,m} files but install the latter to $out
+# but let's not bother
+assert lib.assertMsg (stdenv.buildPlatform.canExecute stdenv.hostPlatform)
+  "Ren'Py cannot be cross-compiled because it needs to run itself during the build phase.";
+
+assert lib.assertMsg (!minimal || !withDistributedLibs && !withAarch64LinuxDistributedLibs)
+  "The distributed libraries are only useful when used with the Ren'Py launcher, which is not installed for the minimal Ren'Py package.";
+
 let
-  python = python312;
+  pythonBuildTime = python312.withPackages (
+    ps:
+    with ps;
+    [
+      cython
+      setuptools
+      pkgconfig
+
+      # the runtime dependencies are also added to compile bundled rpy{,m} files in renpy source tree
+      future
+      pefile
+      requests
+      rsa
+      six
+    ]
+    ++ lib.optionals withDoc [
+      sphinx
+      sphinx-rtd-theme
+      sphinx-rtd-dark-mode
+    ]
+  );
+  pythonRunTime = python312.withPackages (
+    ps: with ps; [
+      future
+      pefile
+      requests
+      rsa
+      six
+    ]
+  );
+
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "renpy";
-  version = "8.4.1.25072401";
+  # unstable version drops dependency on insecure package ecdsa
+  version = "8.5.2.26010301-unstable-2026-03-27";
 
   src = fetchFromGitHub {
     owner = "renpy";
     repo = "renpy";
-    tag = finalAttrs.version;
-    hash = "sha256-wJnMqUrRGWcsuZWdqbiUI/BD2sSRjJKEzsCOzSngoZM=";
+    rev = "09eb6986ea9e5dbe64c9096ed48a638e593ea0ef";
+    hash = "sha256-w7tQbZCH7F0Npu8rD2UADxe/KzsTUdtIhJY6GH4YFAs=";
   };
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   nativeBuildInputs = [
-    makeWrapper
+    makeBinaryWrapper
     pkg-config
-    python.pkgs.cython
-    python.pkgs.setuptools
-  ];
+    pythonBuildTime
+  ]
+  ++ lib.optional (!minimal) copyDesktopItems
+  ++ lib.optional (stdenv.hostPlatform.isDarwin && !minimal) desktopToDarwinBundle;
 
   buildInputs = [
     assimp
@@ -50,86 +115,170 @@ stdenv.mkDerivation (finalAttrs: {
     harfbuzz
     libGL
     libGLU
-    libpng
+    libjpeg
+    openssl
     SDL2
-    zlib
-  ]
-  ++ (with python.pkgs; [
-    ecdsa
-    future
-    pefile
-    pygame-sdl2
-    python
-    requests
-    six
-    tkinter
-  ]);
-
-  env = {
-    NIX_CFLAGS_COMPILE = "-I${python.pkgs.pygame-sdl2}/include";
-
-    RENPY_DEPS_INSTALL = lib.concatStringsSep "::" (
-      [
-        ffmpeg.lib
-        freetype
-        fribidi
-        glew.dev
-        harfbuzz.dev
-        libpng
-        SDL2
-        (lib.getDev SDL2)
-        zlib
-      ]
-      ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
-        libGL
-        libGLU
-      ]
-    );
-  };
+    SDL2_image
+    pythonRunTime
+  ];
 
   enableParallelBuilding = true;
 
   patches = [
-    ./shutup-erofs-errors.patch
-  ]
-  ++ lib.optional withoutSteam ./noSteam.patch;
+    # do not try to compile renpy files installed in nix store because we already compiled them at build phase
+    ./dont-compile-system.patch
+
+    # catch error instead of crashing when trying to write steam_appid.txt to nix store
+    # https://github.com/renpy/renpy/pull/6976
+    ./steam-preinit-catch.patch
+
+    # fix write_target looking for wrong file locations when launcher creates new project
+    # https://github.com/renpy/renpy/pull/6978
+    ./new-project-prefix.patch
+
+    # the distributed libs are not compatible with renpy built from source,
+    # so patch the launcher to look for renpy files in renpy-dist (where bin distribution from upstream is copied to) instead of renpy
+    ./distribute.patch
+  ];
 
   postPatch = ''
+    # use nix out path instead of `renpy.config.renpy_base` because otherwise we cannot compile them in the build phase
+    substituteInPlace renpy/script.py --replace-fail "@systemRenpy@" "$out/share/renpy"
+
+    patchShebangs --build setup.py
+
+    # https://github.com/renpy/renpy/blob/8.5.2.26010301/tutorial/game/01director_support.rpy
     cp tutorial/game/tutorial_director.rpy{m,}
 
     cat > renpy/vc_version.py << EOF
-    version = '${finalAttrs.version}'
+    branch = 'master'
+    version = '${finalAttrs.passthru.appver}'
     official = False
     nightly = False
     # Look at https://renpy.org/latest.html for what to put.
-    version_name = "Tomorrowland"
+    version_name = "In Good Health"
     EOF
   '';
 
+  env.PYTHONDONTWRITEBYTECODE = "1";
+
   buildPhase = ''
     runHook preBuild
-    ${python.pythonOnBuildForHost.interpreter} setup.py build --parallel=$NIX_BUILD_CORES
+
+    ./setup.py build_ext --inplace -j $NIX_BUILD_CORES
+
+    # so that these files won't need to be compiled on the host platform
+    python -m compileall renpy -q -d renpy -f${lib.optionalString minimal " -b"};
+
+    ${lib.optionalString (!minimal) ''
+      # compile bundled rpy{,m} files so that they don't have to be compiled when used on the host platform
+      python renpy.py gui compile
+      python renpy.py tutorial compile
+      python renpy.py the_question compile
+    ''}
+
+    # there is no single command to compile all rpym files, so apply a temporary patch for doing that
+    patch -p1 -i ${./temp-compile-modules.patch}
+    python renpy.py . compile
+    patch -p1 -R -i ${./temp-compile-modules.patch}
+
+    ${lib.optionalString (!minimal) "rm -r {tutorial,the_question}/game/saves"}
+
+    ${lib.optionalString withDoc ''
+      # https://github.com/renpy/renpy/blob/8.5.2.26010301/sphinx/build.sh
+      pushd sphinx
+      mkdir -p source/inc
+      python ../renpy.py .
+      RENPY_NO_FIGURES=1 sphinx-build -E -a source ../doc
+      popd
+    ''}
+
     runHook postBuild
   '';
 
   installPhase = ''
     runHook preInstall
 
-    ${python.pythonOnBuildForHost.interpreter} setup.py install_lib -d $out/${python.sitePackages}
-    mkdir -p $out/share/renpy
-    cp -vr sdk-fonts gui launcher renpy the_question tutorial renpy.py $out/share/renpy
+    ./setup.py install_lib -d $out/share/renpy
+    cp -ar renpy renpy.py $out/share/renpy
 
-    makeWrapper ${python.interpreter} $out/bin/renpy \
-      --set PYTHONPATH "$PYTHONPATH:$out/${python.sitePackages}" \
-      --add-flags "$out/share/renpy/renpy.py"
+    makeWrapper ${lib.getExe pythonRunTime} $out/bin/renpy --add-flags "$out/share/renpy/renpy.py" ${
+      # add zenity for file dialogs (https://github.com/renpy/renpy/blob/8.5.2.26010301/src/tinyfiledialogs/tinyfiledialogs.c#L188)
+      lib.optionalString (!minimal) "--prefix PATH : ${lib.makeBinPath [ zenity ]}"
+    }
+
+    ${lib.optionalString minimal ''
+      # delete files not necessary at runtime
+      find $out/share/renpy/renpy -type f -regextype posix-egrep -regex '.*\.(py|pyx|pyd|pxd|pyi|pxi|rpy|rpym)$' -delete
+    ''}
+
+    ${lib.optionalString (!minimal) ''
+      cp -ar sdk-fonts gui launcher the_question tutorial $out/share/renpy
+
+      # most commands (such as `distribute`) are commands of the launcher but not renpy itself
+      makeWrapper $out/bin/renpy $out/bin/renpy-launcher --add-flags "$out/share/renpy/launcher"
+
+      mkdir -p $out/share/icons/hicolor/{256x256,32x32}/apps
+      ln -s $out/share/renpy/launcher/game/images/window-icon.png $out/share/icons/hicolor/256x256/apps/renpy.png
+      ln -s $out/share/renpy/launcher/game/images/logo32.png $out/share/icons/hicolor/32x32/apps/renpy.png
+    ''}
+
+    ${lib.optionalString withDoc "cp -ar doc $out/share/renpy"}
+
+    ${lib.optionalString (finalAttrs.passthru.distributedRenpy != null) ''
+      # have to use cp instead of symlinkJoin because renpy resolves symlinks to find its base dir
+      cp -ar ${finalAttrs.passthru.distributedRenpy}/{update,lib,renpy.sh} $out/share/renpy
+      # renpy packaged from source in this nix package is not compatible with the distributed libs
+      cp -ar ${finalAttrs.passthru.distributedRenpy}/renpy $out/share/renpy/renpy-dist
+    ''}
 
     runHook postInstall
   '';
 
-  nativeInstallCheckInputs = [ versionCheckHook ];
-  doInstallCheck = true;
+  desktopItems = lib.optional (!minimal) (makeDesktopItem {
+    name = "renpy";
+    desktopName = "Ren'Py";
+    comment = finalAttrs.meta.description;
+    exec = "renpy-launcher %U";
+    icon = "renpy";
+    categories = [ "Development" ];
+  });
 
-  passthru.updateScript = ./update.sh;
+  # keep the files in $out/share/renpy/{renpy-dist,lib,renpy.sh} redistributable
+  dontStrip = true;
+  dontPatchShebangs = true;
+  dontPatchELF = true;
+  postFixup = lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
+    patchELF $out/share/renpy/renpy
+  '';
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = false; # set to true when the version is not unstable
+
+  passthru = {
+    appver = lib.head (builtins.match "([0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+).*" finalAttrs.version);
+    semver = lib.head (builtins.match "([0-9]+\\.[0-9]+\\.[0-9]+).*" finalAttrs.version);
+
+    binSrc = fetchzip {
+      url = "https://www.renpy.org/dl/${finalAttrs.passthru.semver}/renpy-${finalAttrs.passthru.semver}-sdk.tar.bz2";
+      hash = "sha256-wF6Z/lA8CyaCEZg1IqpZ4mG8CF8JgNHBf5KjKIOoKVI=";
+    };
+
+    binSrcArm = fetchzip {
+      url = "https://www.renpy.org/dl/${finalAttrs.passthru.semver}/renpy-${finalAttrs.passthru.semver}-sdkarm.tar.bz2";
+      hash = "sha256-DKXghs1XIRrtAGTifMx+7XAbxiqH7qYQiaKhBaO7PBA=";
+    };
+
+    distributedRenpy =
+      if withAarch64LinuxDistributedLibs then
+        finalAttrs.passthru.binSrcArm
+      else if withDistributedLibs then
+        finalAttrs.passthru.binSrc
+      else
+        null;
+
+    updateScript = ./update.sh;
+  };
 
   meta = {
     description = "Visual Novel Engine";
@@ -138,6 +287,16 @@ stdenv.mkDerivation (finalAttrs: {
     changelog = "https://renpy.org/doc/html/changelog.html";
     license = lib.licenses.mit;
     platforms = lib.platforms.unix;
-    maintainers = with lib.maintainers; [ shadowrz ];
+    maintainers = with lib.maintainers; [
+      shadowrz
+      ulysseszhan
+    ];
+    sourceProvenance =
+      with lib.sourceTypes;
+      [ fromSource ]
+      ++ lib.optionals (finalAttrs.passthru.distributedRenpy != null) [
+        binaryNativeCode # bundled python for windows, linux, and macos in the bin distribution from upstream
+        binaryBytecode # __pycache__ in the bin distribution from upstream
+      ];
   };
 })
diff --git a/pkgs/by-name/re/renpy/shutup-erofs-errors.patch b/pkgs/by-name/re/renpy/shutup-erofs-errors.patch
deleted file mode 100644
index 9889c9f8ef85..000000000000
--- a/pkgs/by-name/re/renpy/shutup-erofs-errors.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From 09e598ddf1f6af72ccb6c7c9301abff689e64f88 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?=E5=A4=9C=E5=9D=82=E9=9B=85?=
- <23130178+ShadowRZ@users.noreply.github.com>
-Date: Wed, 17 May 2023 14:32:03 +0800
-Subject: [PATCH] Don't print a backtrace on EROFS
-
-This can shut up EROFS errors caused by writing to read-only /nix/store.
----
- renpy/script.py | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/renpy/script.py b/renpy/script.py
-index de35457ba..b7d511560 100644
---- a/renpy/script.py
-+++ b/renpy/script.py
-@@ -705,6 +705,10 @@ class Script(object):
-                                 rpydigest = hashlib.md5(fullf.read()).digest()
- 
-                             self.write_rpyc_md5(f, rpydigest)
-+                    except OSError as e:
-+                        if e.errno != 30:
-+                            import traceback
-+                            traceback.print_exc()
-                     except Exception:
-                         import traceback
-                         traceback.print_exc()
--- 
-2.40.1
-
diff --git a/pkgs/by-name/re/renpy/steam-preinit-catch.patch b/pkgs/by-name/re/renpy/steam-preinit-catch.patch
new file mode 100644
index 000000000000..5b9b13bd761a
--- /dev/null
+++ b/pkgs/by-name/re/renpy/steam-preinit-catch.patch
@@ -0,0 +1,18 @@
+diff --git a/renpy/common/00steam.rpy b/renpy/common/00steam.rpy
+index 00581d850..ef00deee7 100644
+--- a/renpy/common/00steam.rpy
++++ b/renpy/common/00steam.rpy
+@@ -972,8 +972,11 @@ init -1499 python in achievement:
+         steam_appid_fn = os.path.join(os.path.dirname(sys.executable), "steam_appid.txt")
+ 
+         if config.steam_appid is not None:
+-            with open(steam_appid_fn, "w") as f:
+-                f.write(str(config.steam_appid) + "\n")
++            try:
++                with open(steam_appid_fn, "w") as f:
++                    f.write(str(config.steam_appid) + "\n")
++            except Exception as e:
++                renpy.write_log("Failed to write steam_appid.txt: %r", e)
+         else:
+             try:
+                 os.unlink(steam_appid_fn)
diff --git a/pkgs/by-name/re/renpy/temp-compile-modules.patch b/pkgs/by-name/re/renpy/temp-compile-modules.patch
new file mode 100644
index 000000000000..428db4ab1f44
--- /dev/null
+++ b/pkgs/by-name/re/renpy/temp-compile-modules.patch
@@ -0,0 +1,36 @@
+diff --git a/renpy/exports/__init__.py b/renpy/exports/__init__.py
+index 7265f1b32..dc0d0acc1 100644
+--- a/renpy/exports/__init__.py
++++ b/renpy/exports/__init__.py
+@@ -573,6 +573,7 @@ from renpy.exports.scriptexports import (
+     load_language,
+     load_module,
+     load_string,
++    loaded_modules,
+     munged_filename,
+ )
+ 
+diff --git a/renpy/main.py b/renpy/main.py
+index 60940a595..ed53e3072 100644
+--- a/renpy/main.py
++++ b/renpy/main.py
+@@ -423,6 +423,19 @@ def main():
+         print(time.time() - start)
+         sys.exit(0)
+ 
++    import re
++    pattern = re.compile(r"^(.*)\.rpym$")
++    for fn in renpy.exports.list_files(common=True):
++        m = pattern.match(fn)
++        if m:
++            name = m.group(1)
++            if name in renpy.exports.loaded_modules:
++                print("Module {} already loaded".format(name))
++            else:
++                print("Compiling module {}".format(name))
++                renpy.game.script.load_module(name)
++    sys.exit(0)
++
+     renpy.game.exception_info = "After loading the script."
+ 
+     # Find the save directory.
diff --git a/pkgs/by-name/re/renpy/update.sh b/pkgs/by-name/re/renpy/update.sh
index b09d1fdad4b4..7e71ac65ea80 100755
--- a/pkgs/by-name/re/renpy/update.sh
+++ b/pkgs/by-name/re/renpy/update.sh
@@ -1,11 +1,28 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p bash nix-update html-xml-utils
+#!nix-shell -i bash -p bash nix-update html-xml-utils curl
 
-set -ex
+set -euo pipefail
 
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" &>/dev/null && pwd)"
-
-codename=`curl -L https://renpy.org/latest.html | hxclean | hxselect -c h1 small`
-sed -E -i "s/(version_name = ).*/\1$codename/" $SCRIPT_DIR/package.nix
+attr() {
+  nix-instantiate --eval -A renpy.$1 | tr -d '"'
+}
 
+old_version="$(attr version)"
 nix-update renpy
+new_version="$(attr version)"
+if [[ "$old_version" == "$new_version" ]]; then
+  exit 0
+fi
+
+nix_file="$(attr meta.position | cut -d: -f1)"
+
+codename="$(curl -L https://renpy.org/latest.html | hxclean | hxselect -c h1 small)"
+sed -E -i "s/(version_name = ).*/\1$codename/" "$nix_file"
+
+old_bin_src_hash="$(attr binSrc.hash)"
+new_bin_src_hash="$(nix-hash --type sha256 --to-sri "$(nix-prefetch-url --unpack "$(attr binSrc.url)")")"
+sed -i "s|$old_bin_src_hash|$new_bin_src_hash|" "$nix_file"
+
+old_bin_src_arm_hash="$(attr binSrcArm.hash)"
+new_bin_src_arm_hash="$(nix-hash --type sha256 --to-sri "$(nix-prefetch-url --unpack "$(attr binSrcArm.url)")")"
+sed -i "s|$old_bin_src_arm_hash|$new_bin_src_arm_hash|" "$nix_file"
diff --git a/pkgs/by-name/re/renpyMinimal/package.nix b/pkgs/by-name/re/renpyMinimal/package.nix
new file mode 100644
index 000000000000..d68b270b52f2
--- /dev/null
+++ b/pkgs/by-name/re/renpyMinimal/package.nix
@@ -0,0 +1,5 @@
+{
+  renpy,
+}:
+
+renpy.override { minimal = true; }
diff --git a/pkgs/by-name/sc/sc68/package.nix b/pkgs/by-name/sc/sc68/package.nix
index ace1c3e81a2e..8f8da22a1f08 100644
--- a/pkgs/by-name/sc/sc68/package.nix
+++ b/pkgs/by-name/sc/sc68/package.nix
@@ -15,15 +15,22 @@
 
 stdenv.mkDerivation {
   pname = "sc68";
-  version = "unstable-2022-11-24";
+  version = "2.2.1-unstable-2024-09-09";
 
   src = fetchsvn {
     url = "svn://svn.code.sf.net/p/sc68/code/";
-    rev = "695";
-    sha256 = "sha256-RO3Yhjalu49BUM0fYOZtI2l6KbuUuw03whRxlKneabo=";
+    rev = "713";
+    sha256 = "sha256-kiOHUixsf/2mFMzi6P7oC7ujyydLO7K3w7Vwr/GMOvY=";
   };
 
-  preConfigure = "tools/svn-bootstrap.sh";
+  postPatch = ''
+    substituteInPlace vcversion.sh \
+      --replace-fail 'date -u "+%Y%m%d"' 'date -u --date=@$SOURCE_DATE_EPOCH "+%Y%m%d"'
+  '';
+
+  preConfigure = ''
+    tools/svn-bootstrap.sh
+  '';
 
   enableParallelBuilding = true;
 
@@ -42,6 +49,9 @@ stdenv.mkDerivation {
     zlib
   ];
 
+  # Doesn't specify any standard target, but it's >20yo code
+  env.CFLAGS = "-std=c99";
+
   meta = {
     description = "Atari ST and Amiga music player";
     homepage = "http://sc68.atari.org/project.html";
diff --git a/pkgs/by-name/sq/sq/package.nix b/pkgs/by-name/sq/sq/package.nix
index 009e2625ca49..fd94b6d559bf 100644
--- a/pkgs/by-name/sq/sq/package.nix
+++ b/pkgs/by-name/sq/sq/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "sq";
-  version = "0.48.12";
+  version = "0.50.0";
 
   src = fetchFromGitHub {
     owner = "neilotoole";
     repo = "sq";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-TAQiTZx13rYlJlT41/RE03Ro4CRjECBdQz42YSI1j74=";
+    hash = "sha256-K9bqV9iJADP3yHSay6ZUv+ohakbD5sIEDJusTGSoqec=";
   };
 
-  vendorHash = "sha256-jfUUVbvrdFX/++xRAgz7Tzqgu5AK2ZDmubWnWBIQeKE=";
+  vendorHash = "sha256-w08vGn2AxdZVQU/E/RPBipqFOuujnAjpvSluw/a8zjY=";
 
   proxyVendor = true;
 
diff --git a/pkgs/by-name/ta/tailwindcss_4/package.nix b/pkgs/by-name/ta/tailwindcss_4/package.nix
index 3a87fd981d7d..60c11ee53a74 100644
--- a/pkgs/by-name/ta/tailwindcss_4/package.nix
+++ b/pkgs/by-name/ta/tailwindcss_4/package.nix
@@ -7,7 +7,7 @@
   makeWrapper,
 }:
 let
-  version = "4.2.2";
+  version = "4.2.3";
   inherit (stdenv.hostPlatform) system;
   throwSystem = throw "tailwindcss has not been packaged for ${system} yet.";
 
@@ -22,10 +22,10 @@ let
 
   hash =
     {
-      aarch64-darwin = "sha256-LOZrfIEB7xJFoH0eertL6zW/US/Tvuy6HN+zJ1gNElI=";
-      aarch64-linux = "sha256-rWJ+d7SWzMraSm4m6v/2mO8IKQgeV1pLrzr4UkuwB0c=";
-      x86_64-darwin = "sha256-mONMar0Ap1p06i0grPnihCQdEwIxMwdtIgxvPKQZ2SA=";
-      x86_64-linux = "sha256-SrhPK0lsQC0+xP0l4OVVn+EYTYhtra6PtEODROwETCI=";
+      aarch64-darwin = "sha256-NPuPa7rYe8BOE9BSN0Tl4fLc/ezvO/RO9+d575QjXJU=";
+      aarch64-linux = "sha256-p+eWD9a64t6k+W7nTL1Qmd+W0E1kIpAqexRSnaN780U=";
+      x86_64-darwin = "sha256-q3CAQUIFQczepFKTFFyXFsuFYTdjlvFI0PsECOjtTZE=";
+      x86_64-linux = "sha256-rdyFwhwruoyVCCs7k2+f6jZZKYhwf4bhtN9aq5td9Ck=";
     }
     .${system} or throwSystem;
 in
diff --git a/pkgs/by-name/te/terraform-docs/package.nix b/pkgs/by-name/te/terraform-docs/package.nix
index 3981c50250bb..678e9b4ae1bf 100644
--- a/pkgs/by-name/te/terraform-docs/package.nix
+++ b/pkgs/by-name/te/terraform-docs/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "terraform-docs";
-  version = "0.21.0";
+  version = "0.22.0";
 
   src = fetchFromGitHub {
     owner = "terraform-docs";
     repo = "terraform-docs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vucMB0S8fYVTCqX+H29XdJTG9uQOMJii8aLAhiIGilg=";
+    hash = "sha256-yroGYLZX1MnCTVmDiTbWDNnwLcmTOT/jYECmFy/ZmRk=";
   };
 
-  vendorHash = "sha256-jk5NjGxFK8iSOK1RoqeIqFC52BLRDi2vhmYJwm94IUY=";
+  vendorHash = "sha256-k4xypyNk80EXH823oItjc45kkupjTSXHybnMrKEgFvs=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/tf/tf-summarize/package.nix b/pkgs/by-name/tf/tf-summarize/package.nix
index f286ee7c2f31..66ba7c11c794 100644
--- a/pkgs/by-name/tf/tf-summarize/package.nix
+++ b/pkgs/by-name/tf/tf-summarize/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "tf-summarize";
-  version = "0.3.15";
+  version = "0.3.20";
 
   src = fetchFromGitHub {
     owner = "dineshba";
     repo = "tf-summarize";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-m0XQkxcNW0QTYd3tPz9v13dsiI/jUV0eJW0Oo2vKKtk=";
+    hash = "sha256-+u1akn3cEWoRza8IyJLh5GFJAxd2VVnusVKUFtcr0MY=";
   };
 
   vendorHash = "sha256-ncXJCOmpf6cuZd7JouAlyae/+pbjmlByrT3Z32EZEhc=";
diff --git a/pkgs/by-name/tm/tmux/package.nix b/pkgs/by-name/tm/tmux/package.nix
index d3907e4b164e..b5efd8d2c9b0 100644
--- a/pkgs/by-name/tm/tmux/package.nix
+++ b/pkgs/by-name/tm/tmux/package.nix
@@ -13,7 +13,7 @@
   # broken on i686-linux https://github.com/tmux/tmux/issues/4597
   withUtf8proc ? !(stdenv.hostPlatform.is32bit),
   utf8proc, # gets Unicode updates faster than glibc
-  withUtempter ? stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isMusl,
+  withUtempter ? stdenv.hostPlatform.isLinux,
   libutempter,
   withSixel ? true,
   versionCheckHook,
diff --git a/pkgs/by-name/to/tomlc17/package.nix b/pkgs/by-name/to/tomlc17/package.nix
index 28243065b5a6..58ab13df420c 100644
--- a/pkgs/by-name/to/tomlc17/package.nix
+++ b/pkgs/by-name/to/tomlc17/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tomlc17";
-  version = "260323";
+  version = "260414";
 
   src = fetchFromGitHub {
     owner = "cktan";
     repo = "tomlc17";
     tag = "R${finalAttrs.version}";
-    hash = "sha256-pwUJkZRiVqTZqbjTcB/Uw5xY8vuvprWuiQVC/kzFsNM=";
+    hash = "sha256-NtytkrRdIGMIYMSfnNkWHdeu78+ac7EL361OZoTK9BI=";
   };
 
   doCheck = false; # tries to download toml-test suite
diff --git a/pkgs/by-name/to/touchosc/package.nix b/pkgs/by-name/to/touchosc/package.nix
index 1388e616bf40..af969a0f247a 100644
--- a/pkgs/by-name/to/touchosc/package.nix
+++ b/pkgs/by-name/to/touchosc/package.nix
@@ -46,7 +46,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "touchosc";
-  version = "1.4.7.243";
+  version = "1.4.9.248";
 
   suffix =
     {
@@ -60,9 +60,9 @@ stdenv.mkDerivation rec {
     url = "https://hexler.net/pub/${pname}/${pname}-${version}-${suffix}.deb";
     hash =
       {
-        aarch64-linux = "sha256-WHjtjxSLphODnYynKX5oYRirBWnv0wTh5mxCrw5DL3c=";
-        armv7l-linux = "sha256-g426dUSJ5UC4k2s/a8sFLNG0q0xyvPh824jXDHN+2SM=";
-        x86_64-linux = "sha256-MD3wxGM04x7gBoHS2J1I0hGGbgDZeEUTFCaEUsM/R6E=";
+        aarch64-linux = "sha256-IKk688XFTx1rHEF03uHZ3cN60GwwIlf/FK4mJ0c/PqM=";
+        armv7l-linux = "sha256-li1BLZ6/6OJzsCIN2T3V4vEVXfa9GH6PiFkm6lUl4Ec=";
+        x86_64-linux = "sha256-NM9v+wyLNnwNw4qY6jDPB9ig/GZfzzrDshMSmi/yvCM=";
       }
       .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
diff --git a/pkgs/by-name/vo/volanta/package.nix b/pkgs/by-name/vo/volanta/package.nix
index 7a8fcd3f64bb..0e6df61707be 100644
--- a/pkgs/by-name/vo/volanta/package.nix
+++ b/pkgs/by-name/vo/volanta/package.nix
@@ -9,11 +9,11 @@
 }:
 let
   pname = "volanta";
-  version = "1.16.4";
-  build = "af311390";
+  version = "1.17.2";
+  build = "a6e78d57";
   src = fetchurl {
     url = "https://cdn.volanta.app/software/volanta-app/${version}-${build}/volanta-${version}.AppImage";
-    hash = "sha256-KLbScB7yaFbSdoR1piQppK33Lsvlfamb+MVvESrFqAA=";
+    hash = "sha256-2LqKo2xv6EzyG1CbJeb/VX4Cv7Gey7G25QsPOk9x5MM=";
   };
   appImageContents = appimageTools.extract { inherit pname version src; };
 in
diff --git a/pkgs/by-name/we/webtunnel/package.nix b/pkgs/by-name/we/webtunnel/package.nix
index b4ddb56db5c7..9c3ea36bebd8 100644
--- a/pkgs/by-name/we/webtunnel/package.nix
+++ b/pkgs/by-name/we/webtunnel/package.nix
@@ -6,7 +6,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "webtunnel";
-  version = "0.0.3";
+  version = "0.0.4";
 
   src = fetchFromGitLab {
     domain = "gitlab.torproject.org";
@@ -14,7 +14,7 @@ buildGoModule (finalAttrs: {
     owner = "anti-censorship/pluggable-transports";
     repo = "webtunnel";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-HB95GCIJeO5fKUW23VHrtNZdc9x9fk2vnmI9JogDWSQ=";
+    hash = "sha256-00Wq2/xuDNftXG+r95/HyEcWQSX0GaQao28CG8yIiR4=";
   };
 
   vendorHash = "sha256-3AAPySLAoMimXUOiy8Ctl+ghG5q+3dWRNGXHpl9nfG0=";
diff --git a/pkgs/by-name/wh/whoogle-search/package.nix b/pkgs/by-name/wh/whoogle-search/package.nix
index eb1ad763fb91..def30f89e255 100644
--- a/pkgs/by-name/wh/whoogle-search/package.nix
+++ b/pkgs/by-name/wh/whoogle-search/package.nix
@@ -7,13 +7,13 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "whoogle-search";
-  version = "1.2.3";
+  version = "1.2.4";
   pyproject = true;
 
   src = fetchPypi {
     pname = "whoogle_search";
     inherit (finalAttrs) version;
-    hash = "sha256-RP7/KMAJUUkzAVlHK0ln4Xn3zYQOOKkHlmQPYJSEsWM=";
+    hash = "sha256-Vq8CLElP1P/Lcq98IZHgug7a4+sSSyEL2ih4Y5McAfg=";
   };
 
   build-system = with python3Packages; [ setuptools ];
diff --git a/pkgs/by-name/xf/xf86-input-joystick/package.nix b/pkgs/by-name/xf/xf86-input-joystick/package.nix
index 81df0d68b440..3af25a5bec91 100644
--- a/pkgs/by-name/xf/xf86-input-joystick/package.nix
+++ b/pkgs/by-name/xf/xf86-input-joystick/package.nix
@@ -52,6 +52,6 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = [ ];
     pkgConfigModules = [ "xorg-joystick" ];
     platforms = lib.platforms.unix;
-    broken = stdenv.hostPlatform.isDarwin; # never worked: https://hydra.nixos.org/job/nixpkgs/trunk/xf86-input-joystick.x86_64-darwin
+    broken = stdenv.hostPlatform.isDarwin; # no darwin driver
   };
 })
diff --git a/pkgs/by-name/xf/xf86-input-void/package.nix b/pkgs/by-name/xf/xf86-input-void/package.nix
index 03749b3da67e..17a855f094a6 100644
--- a/pkgs/by-name/xf/xf86-input-void/package.nix
+++ b/pkgs/by-name/xf/xf86-input-void/package.nix
@@ -54,6 +54,5 @@ stdenv.mkDerivation (finalAttrs: {
     ];
     maintainers = [ ];
     platforms = lib.platforms.unix;
-    broken = stdenv.hostPlatform.isDarwin; # never worked: https://hydra.nixos.org/job/nixpkgs/trunk/xf86-input-void.x86_64-darwin
   };
 })
diff --git a/pkgs/by-name/xf/xf86-video-dummy/package.nix b/pkgs/by-name/xf/xf86-video-dummy/package.nix
index 6bf910666a12..681bf3c9361b 100644
--- a/pkgs/by-name/xf/xf86-video-dummy/package.nix
+++ b/pkgs/by-name/xf/xf86-video-dummy/package.nix
@@ -47,6 +47,5 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.x11;
     maintainers = [ ];
     platforms = lib.platforms.unix;
-    broken = stdenv.hostPlatform.isDarwin;
   };
 })
diff --git a/pkgs/by-name/xf/xf86-video-suncg6/package.nix b/pkgs/by-name/xf/xf86-video-suncg6/package.nix
index 18dc2e1457e1..920e4e98813a 100644
--- a/pkgs/by-name/xf/xf86-video-suncg6/package.nix
+++ b/pkgs/by-name/xf/xf86-video-suncg6/package.nix
@@ -50,6 +50,5 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.hpndSellVariant;
     maintainers = [ ];
     platforms = lib.platforms.unix;
-    broken = stdenv.hostPlatform.isDarwin; # never worked: https://hydra.nixos.org/job/nixpkgs/trunk/xf86-video-suncg6.x86_64-darwin
   };
 })
diff --git a/pkgs/by-name/xf/xf86-video-sunffb/package.nix b/pkgs/by-name/xf/xf86-video-sunffb/package.nix
index 823adb0d851f..e67f7a277c1e 100644
--- a/pkgs/by-name/xf/xf86-video-sunffb/package.nix
+++ b/pkgs/by-name/xf/xf86-video-sunffb/package.nix
@@ -50,6 +50,5 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.mit;
     maintainers = [ ];
     platforms = lib.platforms.unix;
-    broken = stdenv.hostPlatform.isDarwin; # never worked: https://hydra.nixos.org/job/nixpkgs/trunk/xf86-video-sunffb.x86_64-darwin
   };
 })
diff --git a/pkgs/by-name/xf/xf86-video-sunleo/package.nix b/pkgs/by-name/xf/xf86-video-sunleo/package.nix
index 3b2b97d04693..9be9f6662ed7 100644
--- a/pkgs/by-name/xf/xf86-video-sunleo/package.nix
+++ b/pkgs/by-name/xf/xf86-video-sunleo/package.nix
@@ -52,6 +52,5 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.mit;
     maintainers = [ ];
     platforms = lib.platforms.unix;
-    broken = stdenv.hostPlatform.isDarwin; # never worked: https://hydra.nixos.org/job/nixpkgs/trunk/xf86-video-sunleo.x86_64-darwin
   };
 })
diff --git a/pkgs/by-name/xi/xinit/package.nix b/pkgs/by-name/xi/xinit/package.nix
index cd1b7eb26009..af3c4a7ccdb3 100644
--- a/pkgs/by-name/xi/xinit/package.nix
+++ b/pkgs/by-name/xi/xinit/package.nix
@@ -56,6 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
     "--with-xserver=${xorg-server.out}/bin/X"
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    "--with-launchd=yes"
     "--with-bundle-id-prefix=org.nixos.xquartz"
     "--with-launchdaemons-dir=${placeholder "out"}/LaunchDaemons"
     "--with-launchagents-dir=${placeholder "out"}/LaunchAgents"
diff --git a/pkgs/by-name/xv/xvfb/package.nix b/pkgs/by-name/xv/xvfb/package.nix
index 5514f0e1415d..4f6afbc8f6b3 100644
--- a/pkgs/by-name/xv/xvfb/package.nix
+++ b/pkgs/by-name/xv/xvfb/package.nix
@@ -106,6 +106,7 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     "-Ddtrace=false"
+    "-Dxquartz=false"
   ];
 
   meta = {
diff --git a/pkgs/desktops/lomiri/development/lomiri-api/default.nix b/pkgs/desktops/lomiri/development/lomiri-api/default.nix
index 3fa57e8c820c..a63f84b68b5d 100644
--- a/pkgs/desktops/lomiri/development/lomiri-api/default.nix
+++ b/pkgs/desktops/lomiri/development/lomiri-api/default.nix
@@ -25,13 +25,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "lomiri-api";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchFromGitLab {
     owner = "ubports";
     repo = "development/core/lomiri-api";
     tag = finalAttrs.version;
-    hash = "sha256-n9TlmmRRB618cXCOmo5CYqeMog7I7VxURN9mlDhljWw=";
+    hash = "sha256-2CVSKPZXZ74KUU5xVYSVIZLSPSyIudUcKR0CSfSpJyw=";
   };
 
   outputs = [
diff --git a/pkgs/development/compilers/gcc/common/builder.nix b/pkgs/development/compilers/gcc/common/builder.nix
index 1e90828a6643..edd28a26ce95 100644
--- a/pkgs/development/compilers/gcc/common/builder.nix
+++ b/pkgs/development/compilers/gcc/common/builder.nix
@@ -278,106 +278,117 @@ originalAttrs:
           makeCompatibilitySymlink lib $targetConfig/lib64
         '';
 
-    postInstall = ''
-      # Clean up our compatibility symlinks (see above)
-      for link in "''${compatibilitySymlinks[@]}"; do
-        echo "Removing compatibility symlink: $link"
-        rm -f "$link"
-      done
-
-      # Move target runtime libraries to lib output.
-      # For non-cross, they're in $out/lib; for cross, they're in $out/$targetConfig/lib.
-      targetLibDir="''${targetConfig+$targetConfig/}lib"
-
-      moveToOutput "$targetLibDir/lib*.so*" "''${!outputLib}"
-      moveToOutput "$targetLibDir/lib*.dylib" "''${!outputLib}"
-      moveToOutput "$targetLibDir/lib*.dll.a" "''${!outputLib}"
-      moveToOutput "$targetLibDir/lib*.dll" "''${!outputLib}"
-      moveToOutput "share/gcc-*/python" "''${!outputLib}"
-
-      if [ -z "$enableShared" ]; then
-          moveToOutput "$targetLibDir/lib*.a" "''${!outputLib}"
-      fi
-
-      for i in "''${!outputLib}"/$targetLibDir/*.py; do
-          substituteInPlace "$i" --replace "$out" "''${!outputLib}"
-      done
-
-      # Multilib and cross can't exist at the same time, so just use lib64 here
-      if [ -n "$enableMultilib" ]; then
-          moveToOutput "lib64/lib*.so*" "''${!outputLib}"
-          moveToOutput "lib64/lib*.dylib" "''${!outputLib}"
-          moveToOutput "lib64/lib*.dll.a" "''${!outputLib}"
-          moveToOutput "lib64/lib*.dll" "''${!outputLib}"
-
-          for i in "''${!outputLib}"/lib64/*.py; do
-              substituteInPlace "$i" --replace "$out" "''${!outputLib}"
-          done
-      fi
-
-      # Remove `fixincl' to prevent a retained dependency on the
-      # previous gcc.
-      rm -rf $out/libexec/gcc/*/*/install-tools
-      rm -rf $out/lib/gcc/*/*/install-tools
-
-      # More dependencies with the previous gcc or some libs (gccbug stores the build command line)
-      rm -rf $out/bin/gccbug
-
-      # Remove .la files, they're not adjusted for the makeCompatibilitySymlink magic,
-      # which confuses libtool and leads to weird linking errors.
-      # Removing the files just makes libtool link .so files directly, which is usually
-      # what we want anyway.
-      find $out -name '*.la' -delete
-
-      if type "install_name_tool"; then
-          for i in "''${!outputLib}"/lib/*.*.dylib "''${!outputLib}"/lib/*.so.[0-9]; do
-              install_name_tool -id "$i" "$i" || true
-              for old_path in $(otool -L "$i" | grep "$out" | awk '{print $1}'); do
-                new_path=`echo "$old_path" | sed "s,$out,''${!outputLib},"`
-                install_name_tool -change "$old_path" "$new_path" "$i" || true
-              done
-          done
-      fi
-
-      # Get rid of some "fixed" header files
-      rm -rfv $out/lib/gcc/*/*/include-fixed/{root,linux,sys/mount.h,bits/statx.h,pthread.h}
-
-      # Replace hard links for i686-pc-linux-gnu-gcc etc. with symlinks.
-      for i in $out/bin/*-gcc*; do
-          if cmp -s $out/bin/gcc $i; then
-              ln -sfn gcc $i
+    postInstall =
+      # SH installs libraries into a multilib subdirectory (e.g. lib/!m4/)
+      # even with --disable-multilib; move them to the expected location.
+      lib.optionalString stdenv.targetPlatform.isSh4 ''
+        for _mdir in $out/''${targetConfig+$targetConfig/}lib/!*/; do
+          if [ -d "$_mdir" ]; then
+            mv "$_mdir"/* $out/''${targetConfig+$targetConfig/}lib/
+            rmdir "$_mdir"
           fi
-      done
+        done
+      ''
+      + ''
+        # Clean up our compatibility symlinks (see above)
+        for link in "''${compatibilitySymlinks[@]}"; do
+          echo "Removing compatibility symlink: $link"
+          rm -f "$link"
+        done
 
-      for i in $out/bin/c++ $out/bin/*-c++* $out/bin/*-g++*; do
-          if cmp -s $out/bin/g++ $i; then
-              ln -sfn g++ $i
-          fi
-      done
+        # Move target runtime libraries to lib output.
+        # For non-cross, they're in $out/lib; for cross, they're in $out/$targetConfig/lib.
+        targetLibDir="''${targetConfig+$targetConfig/}lib"
 
-      # Two identical man pages are shipped (moving and compressing is done later)
-      for i in "$out"/share/man/man1/*g++.1; do
-          if test -e "$i"; then
-              man_prefix=`echo "$i" | sed "s,.*/\(.*\)g++.1,\1,"`
-              ln -sf "$man_prefix"gcc.1 "$i"
-          fi
-      done
-    ''
-    + lib.optionalString stdenv.targetPlatform.isCygwin ''
-      targetBinDir="''${targetConfig+$targetConfig/}bin"
-      for i in "''${!outputBin}/$targetLibDir"/cyg*.dll; do
-        mkdir -p "''${!outputLib}/$targetBinDir"
-        mv "$i" "''${!outputLib}/$targetBinDir"/
-      done
-    ''
-    # if cross-compiling, link from $lib/lib to $lib/${targetConfig}.
-    # since native-compiles have $lib/lib as a directory (not a
-    # symlink), this ensures that in every case we can assume that
-    # $lib/lib contains the .so files
-    + lib.optionalString isCross ''
-      if [ -e "$lib/$targetConfig/lib" ]; then
-        ln -s "$lib/$targetConfig/lib" "$lib/lib"
-      fi
-    '';
+        moveToOutput "$targetLibDir/lib*.so*" "''${!outputLib}"
+        moveToOutput "$targetLibDir/lib*.dylib" "''${!outputLib}"
+        moveToOutput "$targetLibDir/lib*.dll.a" "''${!outputLib}"
+        moveToOutput "$targetLibDir/lib*.dll" "''${!outputLib}"
+        moveToOutput "share/gcc-*/python" "''${!outputLib}"
+
+        if [ -z "$enableShared" ]; then
+            moveToOutput "$targetLibDir/lib*.a" "''${!outputLib}"
+        fi
+
+        for i in "''${!outputLib}"/$targetLibDir/*.py; do
+            substituteInPlace "$i" --replace "$out" "''${!outputLib}"
+        done
+
+        # Multilib and cross can't exist at the same time, so just use lib64 here
+        if [ -n "$enableMultilib" ]; then
+            moveToOutput "lib64/lib*.so*" "''${!outputLib}"
+            moveToOutput "lib64/lib*.dylib" "''${!outputLib}"
+            moveToOutput "lib64/lib*.dll.a" "''${!outputLib}"
+            moveToOutput "lib64/lib*.dll" "''${!outputLib}"
+
+            for i in "''${!outputLib}"/lib64/*.py; do
+                substituteInPlace "$i" --replace "$out" "''${!outputLib}"
+            done
+        fi
+
+        # Remove `fixincl' to prevent a retained dependency on the
+        # previous gcc.
+        rm -rf $out/libexec/gcc/*/*/install-tools
+        rm -rf $out/lib/gcc/*/*/install-tools
+
+        # More dependencies with the previous gcc or some libs (gccbug stores the build command line)
+        rm -rf $out/bin/gccbug
+
+        # Remove .la files, they're not adjusted for the makeCompatibilitySymlink magic,
+        # which confuses libtool and leads to weird linking errors.
+        # Removing the files just makes libtool link .so files directly, which is usually
+        # what we want anyway.
+        find $out -name '*.la' -delete
+
+        if type "install_name_tool"; then
+            for i in "''${!outputLib}"/lib/*.*.dylib "''${!outputLib}"/lib/*.so.[0-9]; do
+                install_name_tool -id "$i" "$i" || true
+                for old_path in $(otool -L "$i" | grep "$out" | awk '{print $1}'); do
+                  new_path=`echo "$old_path" | sed "s,$out,''${!outputLib},"`
+                  install_name_tool -change "$old_path" "$new_path" "$i" || true
+                done
+            done
+        fi
+
+        # Get rid of some "fixed" header files
+        rm -rfv $out/lib/gcc/*/*/include-fixed/{root,linux,sys/mount.h,bits/statx.h,pthread.h}
+
+        # Replace hard links for i686-pc-linux-gnu-gcc etc. with symlinks.
+        for i in $out/bin/*-gcc*; do
+            if cmp -s $out/bin/gcc $i; then
+                ln -sfn gcc $i
+            fi
+        done
+
+        for i in $out/bin/c++ $out/bin/*-c++* $out/bin/*-g++*; do
+            if cmp -s $out/bin/g++ $i; then
+                ln -sfn g++ $i
+            fi
+        done
+
+        # Two identical man pages are shipped (moving and compressing is done later)
+        for i in "$out"/share/man/man1/*g++.1; do
+            if test -e "$i"; then
+                man_prefix=`echo "$i" | sed "s,.*/\(.*\)g++.1,\1,"`
+                ln -sf "$man_prefix"gcc.1 "$i"
+            fi
+        done
+      ''
+      + lib.optionalString stdenv.targetPlatform.isCygwin ''
+        targetBinDir="''${targetConfig+$targetConfig/}bin"
+        for i in "''${!outputBin}/$targetLibDir"/cyg*.dll; do
+          mkdir -p "''${!outputLib}/$targetBinDir"
+          mv "$i" "''${!outputLib}/$targetBinDir"/
+        done
+      ''
+      # if cross-compiling, link from $lib/lib to $lib/${targetConfig}.
+      # since native-compiles have $lib/lib as a directory (not a
+      # symlink), this ensures that in every case we can assume that
+      # $lib/lib contains the .so files
+      + lib.optionalString isCross ''
+        if [ -e "$lib/$targetConfig/lib" ]; then
+          ln -s "$lib/$targetConfig/lib" "$lib/lib"
+        fi
+      '';
   }
 ))
diff --git a/pkgs/development/compilers/gcc/common/configure-flags.nix b/pkgs/development/compilers/gcc/common/configure-flags.nix
index 98da0be6322e..e2c735c0751f 100644
--- a/pkgs/development/compilers/gcc/common/configure-flags.nix
+++ b/pkgs/development/compilers/gcc/common/configure-flags.nix
@@ -227,6 +227,9 @@ let
         ]
       else
         [ "--disable-multilib" ]
+        # SH targets need m4 and m4-nofpu variants (the kernel uses -m4-nofpu).
+        # An empty list disables -m4-nofpu entirely.
+        ++ lib.optional targetPlatform.isSh4 "--with-multilib-list=m4,m4-nofpu"
     )
     ++ lib.optional (!enableShared) "--disable-shared"
     ++ lib.singleton (lib.enableFeature enablePlugin "plugin")
diff --git a/pkgs/development/compilers/llvm/default.nix b/pkgs/development/compilers/llvm/default.nix
index 2b05d88ab079..650a4f3b7251 100644
--- a/pkgs/development/compilers/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/default.nix
@@ -28,9 +28,9 @@ let
     "21.1.8".officialRelease.sha256 = "sha256-pgd8g9Yfvp7abjCCKSmIn1smAROjqtfZaJkaUkBSKW0=";
     "22.1.2".officialRelease.sha256 = "sha256-z6YcxgDd3F3JwfU5Y/wMw5MK+ZPISI3KLwHwUaraTuw=";
     "23.0.0-git".gitRelease = {
-      rev = "26697f4d07eb921aebabdaa7d064c5165c70717e";
-      rev-version = "23.0.0-unstable-2026-04-05";
-      sha256 = "sha256-0TDdZRERXJzSGnKK74+L4taPs0EEKH1hsoRmrGy00Ks=";
+      rev = "1b2ccf9c6c79d6e57ba6f0a4cf8a3bd1075edebb";
+      rev-version = "23.0.0-unstable-2026-04-19";
+      sha256 = "sha256-GLGH/FIwyEf48tRcEAnbs7SZceOexYbZH8hHA34hPIE=";
     };
   }
   // llvmVersions;
diff --git a/pkgs/development/libraries/gcc/libgcc/default.nix b/pkgs/development/libraries/gcc/libgcc/default.nix
index 022b766d9097..6895f555ddc7 100644
--- a/pkgs/development/libraries/gcc/libgcc/default.nix
+++ b/pkgs/development/libraries/gcc/libgcc/default.nix
@@ -94,7 +94,7 @@ stdenv.mkDerivation (finalAttrs: {
         options.h \
         insn-constants.h \
   ''
-  + lib.optionalString stdenv.targetPlatform.isM68k ''
+  + lib.optionalString (stdenv.targetPlatform.isM68k || stdenv.targetPlatform.isSh4) ''
     sysroot-suffix.h \
   ''
   + lib.optionalString stdenv.targetPlatform.isAarch32 ''
diff --git a/pkgs/development/php-packages/ds/default.nix b/pkgs/development/php-packages/ds/default.nix
index 0b289e9c2421..3cfb2314da93 100644
--- a/pkgs/development/php-packages/ds/default.nix
+++ b/pkgs/development/php-packages/ds/default.nix
@@ -7,7 +7,7 @@
 }:
 
 let
-  version = "1.6.0";
+  version = "2.0.0";
 in
 buildPecl {
   inherit version;
@@ -17,7 +17,7 @@ buildPecl {
     owner = "php-ds";
     repo = "ext-ds";
     rev = "v${version}";
-    sha256 = "sha256-c7MIqaPwIgdzKHRqR2km1uTQRrrr3OzDzopTbz5rLnE=";
+    sha256 = "sha256-QWBxjt3rzD3m3y2ScbYvtZnjPUYsd3uMMQOFY/RQ3Io=";
   };
 
   buildInputs = [ pcre2 ];
diff --git a/pkgs/development/php-packages/excimer/default.nix b/pkgs/development/php-packages/excimer/default.nix
index 06a8538faa6c..1c0346280aed 100644
--- a/pkgs/development/php-packages/excimer/default.nix
+++ b/pkgs/development/php-packages/excimer/default.nix
@@ -5,7 +5,7 @@
 }:
 
 let
-  version = "1.2.5";
+  version = "1.2.6";
 in
 buildPecl {
   inherit version;
@@ -15,7 +15,7 @@ buildPecl {
     owner = "wikimedia";
     repo = "mediawiki-php-excimer";
     tag = version;
-    hash = "sha256-xFnyqofazXtPfwp/4xNYwrPEW9vWzz5akXjCOiyP4nw=";
+    hash = "sha256-LnmhItq7OpxXXE6EnTOXZVdfo+MTa2Ud9j16rs8dTBo=";
   };
 
   meta = {
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index 87a5aa8f3f33..f1e8f78f97c6 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -358,13 +358,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "boto3-stubs";
-  version = "1.42.91";
+  version = "1.42.92";
   pyproject = true;
 
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit (finalAttrs) version;
-    hash = "sha256-J3424exTCrajFkdSPf70DgfQsGVDG+blQ2OiQ/eL+rs=";
+    hash = "sha256-S8k0BpxejHs83SRCVp2uFOgnL+IH1EW9OKpXi4RjY48=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index 3b0fe8a8e3e7..66c01a013434 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202604191";
+  version = "0.1.202604211";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cS7eh68a1EQmoqOkCnkvmYefUazQm7qClMZwRWXsSOo=";
+    hash = "sha256-Fw2Vql8Y6aJ/t1lUrZ9MDZhRKtuPNqUqX1RF8FHfz+I=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/mcstatus/default.nix b/pkgs/development/python-modules/mcstatus/default.nix
index 1eeb2ea73ccc..2d8ae434aebe 100644
--- a/pkgs/development/python-modules/mcstatus/default.nix
+++ b/pkgs/development/python-modules/mcstatus/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "mcstatus";
-  version = "13.0.1";
+  version = "13.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "py-mine";
     repo = "mcstatus";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Btnv5caqZXh7aLGHH7WBduX4CJ+OhcCKgvD0uLC0mPg=";
+    hash = "sha256-Fn2i9CCO5wESKSpeM8YlqrzF6RCwBbYQs2wSEgOYAcE=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index ef4cdde02b6a..2cc910182b58 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -443,8 +443,8 @@ in
       "sha256-92qhSUqTiLgbtvCdi/Mmgve18mcYR00ABL+bNy7/OnY=";
 
   mypy-boto3-ec2 =
-    buildMypyBoto3Package "ec2" "1.42.85"
-      "sha256-YYfuAmvVS4IKnqROoCzUjd2O0KyshgnVIQ0nBUh8KhQ=";
+    buildMypyBoto3Package "ec2" "1.42.92"
+      "sha256-gwR4f9HgMN8f1geH2aL8ez1ws+uuHeJVnE0tfffLARg=";
 
   mypy-boto3-ec2-instance-connect =
     buildMypyBoto3Package "ec2-instance-connect" "1.42.3"
@@ -590,8 +590,8 @@ in
       "sha256-mzSkLSIQyrcPyU+LhrlRJtjWbkpLXM8/iOpAH0lA6zA=";
 
   mypy-boto3-guardduty =
-    buildMypyBoto3Package "guardduty" "1.42.84"
-      "sha256-5sa/UWt6MAEl6zmsmohWZHc0iokmccLa4JgbXDYe/Rs=";
+    buildMypyBoto3Package "guardduty" "1.42.92"
+      "sha256-MVLmiiL5/PWk5KGwQffzd5bex6Cx6tEu/1DMnzv8g9I=";
 
   mypy-boto3-health =
     buildMypyBoto3Package "health" "1.42.59"
@@ -706,8 +706,8 @@ in
       "sha256-eAzIwmz5eZKf2NBGSMw4NopdHqAR5TcF9/0KQqVWr0s=";
 
   mypy-boto3-kafka =
-    buildMypyBoto3Package "kafka" "1.42.65"
-      "sha256-H7VAzW6c3HYxvKOG8H3hNbJepywDCqDLK5oeKGMqNTg=";
+    buildMypyBoto3Package "kafka" "1.42.92"
+      "sha256-c04LS1KMpksoxtA82xxRoERCvYrEabLF25iu9Oz0C34=";
 
   mypy-boto3-kafkaconnect =
     buildMypyBoto3Package "kafkaconnect" "1.42.47"
@@ -802,8 +802,8 @@ in
       "sha256-3XrmddaaOKkdaYOMguNWZ3k18yiOtUF23xMVtZ7n8gQ=";
 
   mypy-boto3-location =
-    buildMypyBoto3Package "location" "1.42.3"
-      "sha256-VGQzgnrUynTDjfYpEk+FR+PrljbULl0UpbeqbaPKqSc=";
+    buildMypyBoto3Package "location" "1.42.92"
+      "sha256-UBSxl5YmYh3m4gl4iKdDU2McetKuDcLkiR73Yvf0AQQ=";
 
   mypy-boto3-logs =
     buildMypyBoto3Package "logs" "1.42.90"
diff --git a/pkgs/development/python-modules/nexusrpc/default.nix b/pkgs/development/python-modules/nexusrpc/default.nix
index 4adba207216b..83504c927be0 100644
--- a/pkgs/development/python-modules/nexusrpc/default.nix
+++ b/pkgs/development/python-modules/nexusrpc/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "nexus-rpc";
-  version = "1.3.0";
+  version = "1.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "nexus-rpc";
     repo = "sdk-python";
     tag = version;
-    hash = "sha256-i2FfJ3aCncbqLY2oBG8zAPTbgxzH30MSmZxhDltN4JA=";
+    hash = "sha256-il+zCyU0dOlqFHGedyeBKgwQlqx1FLNuriGIw3RV3Gs=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/python-modules/temporalio/default.nix b/pkgs/development/python-modules/temporalio/default.nix
index 179a4442785c..b9d72902aa26 100644
--- a/pkgs/development/python-modules/temporalio/default.nix
+++ b/pkgs/development/python-modules/temporalio/default.nix
@@ -25,7 +25,7 @@
 
 buildPythonPackage rec {
   pname = "temporalio";
-  version = "1.23.0";
+  version = "1.25.0";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     repo = "sdk-python";
     tag = version;
     fetchSubmodules = true;
-    hash = "sha256-AV9kpy6EpfwLm3yx+xf9PRUcti+KJsOizPsf6YqIYws=";
+    hash = "sha256-o6QesUL9he2q5o+HDUA6Orb3uM6jWiWkN7uYbkhXopY=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
@@ -43,7 +43,7 @@ buildPythonPackage rec {
       src
       cargoRoot
       ;
-    hash = "sha256-uVSC4CPuoDw1JuZ6sCTErre1gYBov70qSvD4tQqKvl0=";
+    hash = "sha256-CL2ipOgnxGn0Zw2da85BzLJdjYamBXKftiRPExWCbb0=";
   };
 
   cargoRoot = "temporalio/bridge";
@@ -68,6 +68,10 @@ buildPythonPackage rec {
     rustc
   ];
 
+  pythonRelaxDeps = [
+    "protobuf"
+  ];
+
   pythonImportsCheck = [
     "temporalio"
     "temporalio.bridge.temporal_sdk_bridge"
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index 2a045096ea46..049c6ba3baed 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "tencentcloud-sdk-python";
-  version = "3.1.80";
+  version = "3.1.82";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = finalAttrs.version;
-    hash = "sha256-6MiRoIGIc608iu1av8JvqQ1JTZR8IG7P2xuPmjn9X58=";
+    hash = "sha256-pDV2hDsc0Vn4LgT9aWaaCoZ+smulfP+yblcpHqIJl1I=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/typedunits/default.nix b/pkgs/development/python-modules/typedunits/default.nix
index a0f8d285e5ef..93c6220ba28c 100644
--- a/pkgs/development/python-modules/typedunits/default.nix
+++ b/pkgs/development/python-modules/typedunits/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "typedunits";
-  version = "0.0.1";
+  version = "0.0.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "quantumlib";
     repo = "TypedUnits";
     tag = "v${version}";
-    hash = "sha256-g/kUPEtdyNvcWJOqcTCF27pW22WTg0EiHoEXgSs2xMs=";
+    hash = "sha256-dADN9zBwspfDPdgce5EKEclI1qLcqc0N09RGsiPrJ0c=";
   };
 
   build-system = [
diff --git a/pkgs/servers/klipper/cross-ffi.patch b/pkgs/servers/klipper/cross-ffi.patch
new file mode 100644
index 000000000000..9535d29c723f
--- /dev/null
+++ b/pkgs/servers/klipper/cross-ffi.patch
@@ -0,0 +1,14 @@
+diff --git a/klippy/chelper/__init__.py b/klippy/chelper/__init__.py
+index c26196e..b00bd97 100644
+--- a/chelper/__init__.py
++++ b/chelper/__init__.py
+@@ -318,11 +318,6 @@ def get_ffi():
+         FFI_main = cffi.FFI()
+         for d in defs_all:
+             FFI_main.cdef(d)
+-        FFI_lib = FFI_main.dlopen(destlib)
+-        # Setup error logging
+-        pyhelper_logging_callback = FFI_main.callback("void func(const char *)",
+-                                                      logging_callback)
+-        FFI_lib.set_python_logging_callback(pyhelper_logging_callback)
+     return FFI_main, FFI_lib
diff --git a/pkgs/servers/klipper/default.nix b/pkgs/servers/klipper/default.nix
index a0af8d52230e..2ac50f350bc8 100644
--- a/pkgs/servers/klipper/default.nix
+++ b/pkgs/servers/klipper/default.nix
@@ -3,6 +3,7 @@
   lib,
   fetchFromGitHub,
   python3,
+  python3Packages,
   extraPythonPackages ? ps: [ ],
   unstableGitUpdater,
   makeWrapper,
@@ -24,7 +25,7 @@ stdenv.mkDerivation rec {
 
   # NB: This is needed for the postBuild step
   nativeBuildInputs = [
-    (python3.withPackages (p: with p; [ cffi ]))
+    python3Packages.cffi
     makeWrapper
   ];
 
@@ -62,6 +63,11 @@ stdenv.mkDerivation rec {
       --replace 'GCC_CMD = "gcc"' 'GCC_CMD = "${stdenv.cc.targetPrefix}cc"'
   '';
 
+  patches = lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    # https://github.com/Klipper3d/klipper/pull/7254
+    ./cross-ffi.patch
+  ];
+
   pythonInterpreter =
     (python3.withPackages (
       p: with p; [
diff --git a/pkgs/servers/sql/postgresql/ext/pgmq.nix b/pkgs/servers/sql/postgresql/ext/pgmq.nix
index 174b4887d9c1..91ed2fc4fefc 100644
--- a/pkgs/servers/sql/postgresql/ext/pgmq.nix
+++ b/pkgs/servers/sql/postgresql/ext/pgmq.nix
@@ -7,13 +7,13 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "pgmq";
-  version = "1.11.0";
+  version = "1.11.1";
 
   src = fetchFromGitHub {
     owner = "tembo-io";
     repo = "pgmq";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-fJWINP7Dvc79blpfYbGfTEKZtcA/S8KAjmX5uPhmXBM=";
+    hash = "sha256-BPOrQ7HcgTaTJIRzWUCG3iJN3mUjwIxa/wPxvJ1l4o4=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/pgmq-extension";