diff --git a/doc/release-notes/rl-2605.section.md b/doc/release-notes/rl-2605.section.md
index 7f4c7a1469cd..14e5b9b8a494 100644
--- a/doc/release-notes/rl-2605.section.md
+++ b/doc/release-notes/rl-2605.section.md
@@ -145,6 +145,13 @@
 
 - Varnish Cache has been updated to major version 8, `varnish` now refers to `varnish80`. That release contains breaking changes, see [Upgrading to Varnish-Cache 8.0](https://vinyl-cache.org/docs/8.0/whats-new/upgrading-8.0.html).
   Note that the Varnish 6 LTS release remains available as `varnish60`.
+  The Varnish Cache open-source project renamed itself to Vinyl Cache. Please migrate to `vinyl-cache`. See the `vinyl-cache` release notes entry for more information.
+  Varnish 8 is not supported for the entire NixOS 26.05 release cycle.
+
+- Vinyl Cache has been introduced with the major version 9 as the Varnish Cache open source project renamed itself to Vinyl Cache. Please migrate to Vinyl Cache 9 when you still use Varnish Cache.
+  A new module has also been introduced for this migration: `services.vinyl-cache`.
+  This release contains breaking changes, see [Upgrading to Vinyl Cache 9.0](https://vinyl-cache.org/docs/9.0/whats-new/upgrading-9.0.html).
+  The `varnish-modules` project is currently not packaged for Vinyl Cache, as it is incompatible.
 
 - `eslint` has been updated from version 9 to version 10. Please see https://eslint.org/blog/2026/02/eslint-v10.0.0-released/ for details about the breaking changes included in the update.
 
@@ -355,6 +362,8 @@ gnuradioMinimal.override {
 }
 ```
 
+- Added `headplane` and `headplane-agent` packages, and `services.headplane` service.
+
 ## Nixpkgs Library {#sec-nixpkgs-release-26.05-lib}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/lib/strings.nix b/lib/strings.nix
index d6170fdf39e3..848e61a65ddf 100644
--- a/lib/strings.nix
+++ b/lib/strings.nix
@@ -337,6 +337,7 @@ rec {
 
   /**
     Concatenate a list of strings, adding a newline at the end of each one.
+    Defined as `concatMapStrings (s: s + "\n")`.
 
     # Inputs
 
@@ -360,7 +361,7 @@ rec {
 
     :::
   */
-  concatLines = str: concatStringsSep "\n" str + "\n";
+  concatLines = concatMapStrings (s: s + "\n");
 
   /**
     Given string `s`, replace every occurrence of the string `from` with the string `to`.
diff --git a/lib/tests/misc.nix b/lib/tests/misc.nix
index 916994152754..f257d9953fc3 100644
--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@@ -559,6 +559,10 @@ runTests {
     ];
     expected = "a\nb\nc\n";
   };
+  testConcatLinesEmpty = {
+    expr = concatLines [ ];
+    expected = "";
+  };
 
   testMakeIncludePathWithPkgs = {
     expr = (
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index b378529300af..c02e19e3231c 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -11298,6 +11298,12 @@
     githubId = 55025025;
     name = "Feather Lin";
   };
+  igor-ramazanov = {
+    email = "personal@igorramazanov.tech";
+    github = "igor-ramazanov";
+    githubId = 12570166;
+    name = "Igor Ramazanov";
+  };
   igsha = {
     email = "igor.sharonov@gmail.com";
     github = "igsha";
@@ -26045,6 +26051,12 @@
     github = "StayBlue";
     githubId = 23127866;
   };
+  stealthbadger747 = {
+    email = "parawell.erik@gmail.com";
+    github = "StealthBadger747";
+    githubId = 26052996;
+    name = "Erik Parawell";
+  };
   steamwalker = {
     email = "steamwalker@xs4all.nl";
     github = "steamwalker";
diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
index 9f31f8d12690..94d746430110 100644
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -51,6 +51,11 @@
 
   Users who wish to keep the classic daemon can set: `services.dbus.implementation = "dbus";`
 
+- The NixOS integration test driver now supports `systemd-nspawn` containers as an alternative backend to QEMU virtual machines ([#470248](https://github.com/NixOS/nixpkgs/pull/470248), [#478109](https://github.com/NixOS/nixpkgs/pull/478109), [#479968](https://github.com/NixOS/nixpkgs/pull/479968)).
+  Most NixOS integration tests do not require a full VM, and switching them to containers can considerably reduce test time and resource usage.
+  Container-based tests also run fine on Nix builders that are themselves VMs without KVM, and because containers can bind-mount host device nodes, they make it possible to exercise GPU/CUDA workloads from within NixOS integration tests.
+  See [the NixOS manual section on writing tests](https://nixos.org/manual/nixos/stable/#sec-writing-nixos-tests) for details on how to opt in and on the limitations of the container backend.
+
 ## New Modules {#sec-release-26.05-new-modules}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -75,6 +80,8 @@
 
 - [reaction](https://reaction.ppom.me/), a daemon that scans program outputs for repeated patterns, and takes action. A common usage is to scan ssh and webserver logs, and to ban hosts that cause multiple authentication errors. A modern alternative to fail2ban. Available as [services.reaction](#opt-services.reaction.enable).
 
+- [vinyl-cache] as the Varnish Cache project renamed itself. Available as [services.vinyl-cache](#opt-services.vinyl-cache.enable). To aid the migration, the old `services.varnish` module is still available.
+
 - [papra](https://papra.app/), an open-source document management platform designed to help you organize, secure, and archive your files effortlessly. Available as [services.papra](#opt-services.papra.enable).
 
 - [rqbit](https://github.com/ikatson/rqbit), a bittorrent client written in Rust. It has HTTP API and Web UI, and can be used as a library. Available as [services.rqbit](#opt-services.rqbit.enable).
@@ -141,7 +148,9 @@
 
 - [tabbyAPI](https://github.com/theroyallab/tabbyAPI), the official OpenAI compatible API server for Exllama. Available as [services.tabbyapi](#opt-services.tabbyapi.enable).
 
-- [Tdarr](https://tdarr.io), Audio/Video Library Analytics & Transcode/Remux Automation. Available as [services.tdarr](#opt-services.tdarr.enable)
+- [Tdarr](https://tdarr.io), Audio/Video Library Analytics & Transcode/Remux Automation. Available as [services.tdarr](#opt-services.tdarr.enable).
+
+- [Headplane](https://headplane.net), a feature-complete Web UI for Headscale. Available as [services.headplane](#opt-services.headplane.enable).
 
 - [whois](https://packages.qa.debian.org/w/whois.html), an intelligent WHOIS client. Available as `programs.whois`.
 
@@ -162,6 +171,8 @@
 
 - `services.crabfit` was removed because its upstream packages are unmaintained and insecure.
 
+- `services.mosquitto` now generates per-listener authentication and access control via the upstream `password-file` and `acl-file` plugins instead of the deprecated `password_file` and `acl_file` options. The plugins contain the same code, so behaviour is unchanged, but [](#opt-services.mosquitto.package) must now be at least version 2.1.
+
 - `sing-box` has been updated to 1.13.0, which has removed some deprecated options.  See [upstream documentation](https://sing-box.sagernet.org/configuration/) for details and migration options.
 
 - `services.statsd` has been removed because the packages it relies on do not exist anymore in nixpkgs.
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 082c26f90560..3545ca080531 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1226,6 +1226,7 @@
   ./services/networking/hans.nix
   ./services/networking/haproxy.nix
   ./services/networking/harmonia.nix
+  ./services/networking/headplane.nix
   ./services/networking/headscale.nix
   ./services/networking/hickory-dns.nix
   ./services/networking/hostapd.nix
@@ -1840,6 +1841,7 @@
   ./services/web-servers/unit/default.nix
   ./services/web-servers/uwsgi.nix
   ./services/web-servers/varnish/default.nix
+  ./services/web-servers/vinyl-cache/default.nix
   ./services/x11/clight.nix
   ./services/x11/colord.nix
   ./services/x11/desktop-managers/default.nix
diff --git a/nixos/modules/services/networking/headplane.nix b/nixos/modules/services/networking/headplane.nix
new file mode 100644
index 000000000000..5fac2f04e37d
--- /dev/null
+++ b/nixos/modules/services/networking/headplane.nix
@@ -0,0 +1,479 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib)
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
+    types
+    ;
+  inherit (lib.attrsets) filterAttrsRecursive;
+  cfg = config.services.headplane;
+  settingsFormat = pkgs.formats.yaml { };
+  filterSettings = lib.converge (
+    filterAttrsRecursive (
+      _: v:
+      !lib.elem v [
+        { }
+        null
+      ]
+    )
+  );
+  agentSettings = cfg.settings.integration.agent;
+  settings = cfg.settings // {
+    integration = cfg.settings.integration // {
+      agent = if agentSettings == null || !agentSettings.enabled then null else agentSettings;
+    };
+  };
+  settingsFile = settingsFormat.generate "headplane-config.yaml" (filterSettings settings);
+in
+{
+  options.services.headplane = {
+    enable = mkEnableOption "Headplane";
+    package = mkPackageOption pkgs "headplane" { };
+
+    agent.package = mkPackageOption pkgs "headplane-agent" { };
+
+    debug = mkEnableOption "debug logging";
+
+    settings = mkOption {
+      description = ''
+        Headplane configuration options. Generates a YAML config file.
+        See: https://github.com/tale/headplane/blob/main/config.example.yaml
+      '';
+      type = types.submodule {
+        options = {
+          server = mkOption {
+            type = types.submodule {
+              options = {
+                host = mkOption {
+                  type = types.str;
+                  default = "127.0.0.1";
+                  description = "The host address to bind to.";
+                  example = "0.0.0.0";
+                };
+
+                port = mkOption {
+                  type = types.port;
+                  default = 3000;
+                  description = "The port to listen on.";
+                };
+
+                cookie_secret_path = mkOption {
+                  type = types.nullOr types.path;
+                  default = null;
+                  description = ''
+                    Path to a file containing the cookie secret.
+                    The secret must be exactly 32 characters long.
+                  '';
+                  example = lib.literalExpression "config.sops.secrets.headplane_cookie.path";
+                };
+
+                cookie_secure = mkOption {
+                  type = types.bool;
+                  default = true;
+                  description = ''
+                    Should the cookies only work over HTTPS?
+                    Set to false if running via HTTP without a proxy.
+                    Recommended to be true in production.
+                  '';
+                };
+
+                data_path = mkOption {
+                  type = types.path;
+                  default = "/var/lib/headplane";
+                  description = ''
+                    The path to persist Headplane specific data.
+                    All data going forward is stored in this directory, including the internal database and any cache related files.
+                    Data formats prior to 0.6.1 will automatically be migrated.
+                  '';
+                  example = "/var/lib/headplane";
+                };
+              };
+            };
+            default = { };
+            description = "Server configuration for Headplane web application.";
+          };
+
+          headscale = mkOption {
+            type = types.submodule {
+              options = {
+                url = mkOption {
+                  type = types.str;
+                  default = "http://127.0.0.1:${toString config.services.headscale.port}";
+                  defaultText = lib.literalExpression "http://127.0.0.1:\${toString config.services.headscale.port}";
+                  description = ''
+                    The URL to your Headscale instance.
+                    All API requests are routed through this URL.
+                    THIS IS NOT the gRPC endpoint, but the HTTP endpoint.
+                    IMPORTANT: If you are using TLS this MUST be set to `https://`.
+                  '';
+                  example = "https://headscale.example.com";
+                };
+
+                tls_cert_path = mkOption {
+                  type = types.nullOr types.path;
+                  default = null;
+                  description = ''
+                    Path to a file containing the TLS certificate.
+                  '';
+                  example = lib.literalExpression "config.sops.secrets.tls_cert.path";
+                };
+
+                public_url = mkOption {
+                  type = types.nullOr types.str;
+                  default = config.services.headscale.settings.server_url;
+                  defaultText = lib.literalExpression "config.services.headscale.settings.server_url";
+                  description = "Public URL if different. This affects certain parts of the web UI.";
+                  example = "https://headscale.example.com";
+                };
+
+                config_path = mkOption {
+                  type = types.nullOr types.path;
+                  default = config.services.headscale.configFile;
+                  defaultText = lib.literalExpression "config.services.headscale.configFile";
+                  description = ''
+                    Path to the Headscale configuration file.
+                    This is optional, but HIGHLY recommended for the best experience.
+                    If this is read only, Headplane will show your configuration settings
+                    in the Web UI, but they cannot be changed.
+                  '';
+                  example = "/etc/headscale/config.yaml";
+                };
+
+                config_strict = mkEnableOption ''
+                  Headplane internally validates the Headscale configuration
+                  to ensure that it changes the configuration in a safe way.
+                  Disabled by default because it clashes with how the Headplane works in NixOS.
+                '';
+
+                dns_records_path = mkOption {
+                  type = types.nullOr types.path;
+                  default = null;
+                  description = ''
+                    If you are using `dns.extra_records_path` in your Headscale configuration, you need to set this to the path for Headplane to be able to read the DNS records.
+                    Ensure that the file is both readable and writable by the Headplane process.
+                    When using this, Headplane will no longer need to automatically restart Headscale for DNS record changes.
+                  '';
+                  example = "/var/lib/headplane/extra_records.json";
+                };
+              };
+            };
+            default = { };
+            description = "Headscale specific settings for Headplane integration.";
+          };
+
+          integration = mkOption {
+            type = types.submodule {
+              options = {
+                agent = mkOption {
+                  type = types.nullOr (
+                    types.submodule {
+                      options = {
+                        enabled = mkOption {
+                          type = types.bool;
+                          default = false;
+                          description = ''
+                            The Headplane agent allows retrieving information about nodes.
+                            This allows the UI to display version, OS, and connectivity data.
+                            You will see the Headplane agent in your Tailnet as a node when it connects.
+                          '';
+                        };
+
+                        executable_path = mkOption {
+                          type = types.path;
+                          readOnly = true;
+                          default = "${cfg.agent.package}/bin/hp_agent";
+                          defaultText = lib.literalExpression ''"''${config.services.headplane.agent.package}/bin/hp_agent"'';
+                          description = ''
+                            Path to the headplane agent binary.
+                          '';
+                        };
+
+                        pre_authkey_path = mkOption {
+                          type = types.nullOr types.path;
+                          default = null;
+                          description = ''
+                            Path to a file containing the agent preauth key.
+                            To connect to your Tailnet, you need to generate a pre-auth key.
+                            This can be done via the web UI or through the `headscale` CLI.
+                          '';
+                          example = lib.literalExpression "config.sops.secrets.agent_pre_authkey.path";
+                        };
+
+                        host_name = mkOption {
+                          type = types.str;
+                          default = "headplane-agent";
+                          description = "Optionally change the name of the agent in the Tailnet";
+                        };
+
+                        cache_ttl = mkOption {
+                          type = types.ints.positive;
+                          default = 180000;
+                          description = ''
+                            How long to cache agent information (in milliseconds).
+                            If you want data to update faster, reduce the TTL, but this will increase the frequency of requests to Headscale.
+                          '';
+                        };
+
+                        cache_path = mkOption {
+                          type = types.path;
+                          default = "/var/lib/headplane/agent_cache.json";
+                          description = "Where to store the agent cache.";
+                        };
+
+                        work_dir = mkOption {
+                          type = types.path;
+                          default = "/var/lib/headplane/agent";
+                          description = ''
+                            Do not change this unless you are running a custom deployment.
+                            The work_dir represents where the agent will store its data to be able to automatically reauthenticate with your Tailnet.
+                            It needs to be writable by the user running the Headplane process.
+                          '';
+                        };
+                      };
+                    }
+                  );
+                  default = null;
+                  description = "Agent configuration for the Headplane agent.";
+                };
+
+                proc = mkOption {
+                  type = types.submodule {
+                    options = {
+                      enabled = mkOption {
+                        type = types.bool;
+                        default = true;
+                        description = ''
+                          Enable "Native" integration that works when Headscale and
+                          Headplane are running outside of a container. There is no additional
+                          configuration, but you need to ensure that the Headplane process
+                          can terminate the Headscale process.
+                        '';
+                      };
+                    };
+                  };
+                  default = { };
+                  description = "Native process integration settings.";
+                };
+              };
+            };
+            default = { };
+            description = "Integration configurations for Headplane to interact with Headscale.";
+          };
+
+          oidc = mkOption {
+            type = types.nullOr (
+              types.submodule {
+                options = {
+                  issuer = mkOption {
+                    type = types.str;
+                    description = "URL to OpenID issuer.";
+                    example = "https://provider.example.com/issuer-url";
+                  };
+
+                  client_id = mkOption {
+                    type = types.str;
+                    description = "The client ID for the OIDC client.";
+                    example = "your-client-id";
+                  };
+
+                  client_secret_path = mkOption {
+                    type = types.nullOr types.path;
+                    default = null;
+                    description = ''
+                      Path to a file containing the OIDC client secret.
+                    '';
+                    example = lib.literalExpression "config.sops.secrets.oidc_client_secret.path";
+                  };
+
+                  disable_api_key_login = mkOption {
+                    type = types.bool;
+                    default = false;
+                    description = "Whether to disable API key login.";
+                  };
+
+                  token_endpoint_auth_method = mkOption {
+                    type = types.enum [
+                      "client_secret_post"
+                      "client_secret_basic"
+                      "client_secret_jwt"
+                    ];
+                    default = "client_secret_post";
+                    description = "The token endpoint authentication method.";
+                  };
+
+                  headscale_api_key_path = mkOption {
+                    type = types.nullOr types.path;
+                    default = null;
+                    description = ''
+                      Path to a file containing the Headscale API key.
+                      Required when `services.headplane.settings.oidc` is set.
+                    '';
+                    example = lib.literalExpression "config.sops.secrets.headscale_api_key.path";
+                  };
+
+                  redirect_uri = mkOption {
+                    type = types.nullOr types.str;
+                    default = null;
+                    description = ''
+                      This should point to your publicly accessible URL
+                      for your Headplane instance with /admin/oidc/callback.
+                    '';
+                    example = "https://headscale.example.com/admin/oidc/callback";
+                  };
+
+                  user_storage_file = mkOption {
+                    type = types.path;
+                    default = "/var/lib/headplane/users.json";
+                    description = ''
+                      Path to a file containing the users and their permissions for Headplane.
+                    '';
+                    example = "/var/lib/headplane/users.json";
+                  };
+
+                  profile_picture_source = mkOption {
+                    type = types.enum [
+                      "oidc"
+                      "gravatar"
+                    ];
+                    default = "oidc";
+                    description = "Source for user profile pictures.";
+                  };
+
+                  strict_validation = mkOption {
+                    type = types.bool;
+                    default = true;
+                    description = "Enable strict validation of OIDC configuration.";
+                  };
+
+                  scope = mkOption {
+                    type = types.str;
+                    default = "openid email profile";
+                    description = "OIDC scope to request.";
+                  };
+
+                  extra_params = mkOption {
+                    type = types.nullOr (types.attrsOf types.str);
+                    default = null;
+                    description = "Extra parameters to send to the OIDC provider.";
+                    example = {
+                      prompt = "consent";
+                    };
+                  };
+
+                  authorization_endpoint = mkOption {
+                    type = types.nullOr types.str;
+                    default = null;
+                    description = "Custom authorization endpoint URL.";
+                    example = "https://provider.example.com/authorize";
+                  };
+
+                  token_endpoint = mkOption {
+                    type = types.nullOr types.str;
+                    default = null;
+                    description = "Custom token endpoint URL.";
+                    example = "https://provider.example.com/token";
+                  };
+
+                  userinfo_endpoint = mkOption {
+                    type = types.nullOr types.str;
+                    default = null;
+                    description = "Custom userinfo endpoint URL.";
+                    example = "https://provider.example.com/userinfo";
+                  };
+                };
+              }
+            );
+            default = null;
+            description = "OIDC Configuration for authentication.";
+          };
+        };
+      };
+      default = { };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = config.services.headscale.enable;
+        message = ''
+          services.headplane requires services.headscale.enable = true.
+          The headplane module references the headscale systemd unit
+          (in `after`/`requires`) and reads its configFile, port, user,
+          and group. Enable headscale or disable headplane.
+        '';
+      }
+      {
+        assertion = cfg.settings.server.cookie_secret_path != null;
+        message = ''
+          services.headplane.settings.server.cookie_secret_path must be set.
+          Headplane refuses to start without either `cookie_secret` or
+          `cookie_secret_path` (validated at startup, see upstream
+          app/server/config/schema.ts). The NixOS module only exposes the
+          *_path form to keep secrets out of the world-readable /nix/store.
+          Provide a path to a file containing a 32-character secret, e.g.
+          via systemd `LoadCredential` or sops-nix.
+        '';
+      }
+      {
+        assertion =
+          cfg.settings.integration.agent == null
+          || !cfg.settings.integration.agent.enabled
+          || cfg.settings.integration.agent.pre_authkey_path != null;
+        message = ''
+          services.headplane.settings.integration.agent.pre_authkey_path must be set
+          when services.headplane.settings.integration.agent.enabled is true.
+        '';
+      }
+      {
+        assertion = cfg.settings.oidc == null || cfg.settings.oidc.headscale_api_key_path != null;
+        message = ''
+          services.headplane.settings.oidc.headscale_api_key_path must be set
+          when services.headplane.settings.oidc is non-null. Headplane's OIDC
+          flow requires a Headscale API key to mint sessions; upstream config
+          validation rejects an OIDC block without it.
+        '';
+      }
+    ];
+
+    environment = {
+      systemPackages = [ cfg.package ];
+      etc."headplane/config.yaml".source = "${settingsFile}";
+    };
+
+    systemd.services.headplane = {
+      description = "Headscale Web UI";
+
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
+      after = [
+        "network-online.target"
+        config.systemd.services.headscale.name
+      ];
+      requires = [ config.systemd.services.headscale.name ];
+
+      environment = {
+        HEADPLANE_DEBUG_LOG = toString cfg.debug;
+      };
+      serviceConfig = {
+        User = config.services.headscale.user;
+        Group = config.services.headscale.group;
+        StateDirectory = "headplane";
+
+        ExecStart = lib.getExe cfg.package;
+        Restart = "always";
+        RestartSec = 5;
+
+        # TODO: Harden `systemd` security according to the "The Principle of Least Power".
+        # See: `$ systemd-analyze security headplane`.
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/mosquitto.md b/nixos/modules/services/networking/mosquitto.md
index 53b5beb16b89..b1a6fabb1f2a 100644
--- a/nixos/modules/services/networking/mosquitto.md
+++ b/nixos/modules/services/networking/mosquitto.md
@@ -83,9 +83,10 @@ localhost).
 
 Almost all options of Mosquitto are available for configuration at their appropriate levels, some
 as NixOS options written in camel case, the remainders under `settings` with their exact names in
-the Mosquitto config file. The exceptions are `acl_file` (which is always set according to the
-`acl` attributes of a listener and its users) and `per_listener_settings` (which is always set to
-`true`).
+the Mosquitto config file. The exceptions are `per_listener_settings` (which is always set to
+`true`) and the per-listener access control, which is always configured via instances of the
+`acl-file` and `password-file` plugins generated from the `acl` and `users` attributes of each
+listener.
 
 ### Password authentication {#module-services-mosquitto-config-passwords}
 
@@ -101,8 +102,8 @@ will not be able to use the broker.
 
 ### ACL format {#module-services-mosquitto-config-acl}
 
-Every listener has a Mosquitto `acl_file` attached to it. This ACL is configured via two
-attributes of the config:
+Every listener has an instance of the Mosquitto `acl-file` plugin attached to it. This ACL is
+configured via two attributes of the config:
 
   * the `acl` attribute of the listener configures pattern ACL entries and topic ACL entries
     for anonymous users. Each entry must be prefixed with `pattern` or `topic` to distinguish
diff --git a/nixos/modules/services/networking/mosquitto.nix b/nixos/modules/services/networking/mosquitto.nix
index fd16442ad185..21b531533513 100644
--- a/nixos/modules/services/networking/mosquitto.nix
+++ b/nixos/modules/services/networking/mosquitto.nix
@@ -7,6 +7,8 @@
 let
   cfg = config.services.mosquitto;
 
+  pluginLibDir = "${lib.getLib cfg.package}/lib";
+
   # note that mosquitto config parsing is very simplistic as of may 2021.
   # often times they'll e.g. strtok() a line, check the first two tokens, and ignore the rest.
   # there's no escaping available either, so we have to prevent any being necessary.
@@ -239,8 +241,8 @@ let
         options = lib.mkOption {
           type = attrsOf optionType;
           description = ''
-            Options for the auth plugin. Each key turns into a `auth_opt_*`
-             line in the config.
+            Options for the plugin. Each key turns into a `plugin_opt_*`
+            line in the config.
           '';
           default = { };
         };
@@ -257,12 +259,13 @@ let
   formatAuthPlugin =
     plugin:
     [
-      "auth_plugin ${plugin.plugin}"
+      "plugin ${plugin.plugin}"
       "auth_plugin_deny_special_chars ${optionToString plugin.denySpecialChars}"
     ]
-    ++ formatFreeform { prefix = "auth_opt_"; } plugin.options;
+    ++ formatFreeform { prefix = "plugin_opt_"; } plugin.options;
 
   freeformListenerKeys = {
+    accept_protocol_versions = 1;
     allow_anonymous = 1;
     allow_zero_length_clientid = 1;
     auto_id_prefix = 1;
@@ -274,13 +277,18 @@ let
     "ciphers_tls1.3" = 1;
     crlfile = 1;
     dhparamfile = 1;
+    disable_client_cert_date_checks = 1;
+    enable_proxy_protocol = 1;
     http_dir = 1;
     keyfile = 1;
+    listener_allow_anonymous = 1;
+    listener_auto_id_prefix = 1;
     max_connections = 1;
     max_qos = 1;
     max_topic_alias = 1;
     mount_point = 1;
     protocol = 1;
+    proxy_protocol_v2_require_tls = 1;
     psk_file = 1;
     psk_hint = 1;
     require_certificate = 1;
@@ -292,6 +300,7 @@ let
     use_identity_as_username = 1;
     use_subject_as_username = 1;
     use_username_as_clientid = 1;
+    websockets_origin = 1;
   };
 
   listenerOptions =
@@ -393,10 +402,16 @@ let
     idx: listener:
     [
       "listener ${toString listener.port} ${toString listener.address}"
-      "acl_file ${cfg.dataDir}/acl-${toString idx}.conf"
     ]
-    ++ lib.optional (!listener.omitPasswordAuth) "password_file ${cfg.dataDir}/passwd-${toString idx}"
     ++ formatFreeform { } listener.settings
+    ++ [
+      "plugin ${pluginLibDir}/mosquitto_acl_file.so"
+      "plugin_opt_acl_file ${cfg.dataDir}/acl-${toString idx}.conf"
+    ]
+    ++ lib.optionals (!listener.omitPasswordAuth) [
+      "plugin ${pluginLibDir}/mosquitto_password_file.so"
+      "plugin_opt_password_file ${cfg.dataDir}/passwd-${toString idx}"
+    ]
     ++ lib.concatMap formatAuthPlugin listener.authPlugins;
 
   freeformBridgeKeys = {
@@ -413,7 +428,11 @@ let
     bridge_outgoing_retain = 1;
     bridge_protocol_version = 1;
     bridge_psk = 1;
+    bridge_receive_maximum = 1;
+    bridge_reload_type = 1;
     bridge_require_ocsp = 1;
+    bridge_session_expiry_interval = 1;
+    bridge_tls_use_os_certs = 1;
     bridge_tls_version = 1;
     cleansession = 1;
     idle_timeout = 1;
@@ -512,6 +531,9 @@ let
     autosave_on_changes = 1;
     check_retain_source = 1;
     connection_messages = 1;
+    enable_control_api = 1;
+    global_max_clients = 1;
+    global_max_connections = 1;
     log_facility = 1;
     log_timestamp = 1;
     log_timestamp_format = 1;
@@ -634,6 +656,13 @@ let
   globalAsserts =
     prefix: cfg:
     lib.flatten [
+      {
+        assertion = lib.versionAtLeast cfg.package.version "2.1";
+        message = ''
+          ${prefix}.package must be at least version 2.1, since the generated
+          configuration relies on the acl-file and password-file plugins.
+        '';
+      }
       (assertKeysValid "${prefix}.settings" freeformGlobalKeys cfg.settings)
       (lib.imap0 (n: l: listenerAsserts "${prefix}.listener.${toString n}" l) cfg.listeners)
       (lib.mapAttrsToList (n: b: bridgeAsserts "${prefix}.bridge.${n}" b) cfg.bridges)
diff --git a/nixos/modules/services/web-servers/varnish/default.nix b/nixos/modules/services/web-servers/varnish/default.nix
index 0f1217fa9b35..3d6a41498a70 100644
--- a/nixos/modules/services/web-servers/varnish/default.nix
+++ b/nixos/modules/services/web-servers/varnish/default.nix
@@ -223,16 +223,23 @@ in
       '')
     ];
 
-    assertions = concatMap (m: [
-      {
-        assertion = (hasPrefix "/" m.address) || (hasPrefix "@" m.address) -> m.port == null;
-        message = "Listen ports must not be specified with UNIX sockets: ${builtins.toJSON m}";
-      }
-      {
-        assertion = !(hasPrefix "/" m.address) -> m.user == null && m.group == null && m.mode == null;
-        message = "Abstract UNIX sockets or IP sockets can not be used with user, group, and mode settings: ${builtins.toJSON m}";
-      }
-    ]) cfg.listen;
+    assertions =
+      (concatMap (m: [
+        {
+          assertion = (hasPrefix "/" m.address) || (hasPrefix "@" m.address) -> m.port == null;
+          message = "Listen ports must not be specified with UNIX sockets: ${builtins.toJSON m}";
+        }
+        {
+          assertion = !(hasPrefix "/" m.address) -> m.user == null && m.group == null && m.mode == null;
+          message = "Abstract UNIX sockets or IP sockets can not be used with user, group, and mode settings: ${builtins.toJSON m}";
+        }
+      ]) cfg.listen)
+      ++ [
+        {
+          assertion = cfg.package.pname != "vinyl-cache";
+          message = "services.varnish only supports Varnish Cache. Please use services.vinyl-cache.";
+        }
+      ];
 
     warnings =
       lib.optional (!isNull cfg.http_address)
diff --git a/nixos/modules/services/web-servers/vinyl-cache/default.nix b/nixos/modules/services/web-servers/vinyl-cache/default.nix
new file mode 100644
index 000000000000..5efc681247e2
--- /dev/null
+++ b/nixos/modules/services/web-servers/vinyl-cache/default.nix
@@ -0,0 +1,258 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib)
+    types
+    mkOption
+    hasPrefix
+    concatMapStringsSep
+    optionalString
+    concatMap
+    ;
+
+  cfg = config.services.vinyl-cache;
+
+  # Vinyl Cache has very strong opinions and very complicated code around handling
+  # the stateDir. After a lot of back and forth, we decided that we a)
+  # do not want a configurable option here, as most of the handling depends
+  # on the version and the compile time options. Putting everything into
+  # /var/run (RAM backed) is absolutely recommended by Vinyl Cache anyways.
+  # We do need to pay attention to the version-dependend variations, though!
+  stateDir = "/var/run/vinyld";
+
+  # from --help:
+  #   -a [<name>=]address[:port][,proto] # HTTP listen address and port
+  #      [,user=<u>][,group=<g>]   # Can be specified multiple times.
+  #      [,mode=<m>]               #   default: ":80,HTTP"
+  #                                # Proto can be "PROXY" or "HTTP" (default)
+  #                                # user, group and mode set permissions for
+  #                                #   a Unix domain socket.
+  commandLineAddresses = (
+    concatMapStringsSep " " (
+      a:
+      "-a "
+      + optionalString (!isNull a.name) "${a.name}="
+      + a.address
+      + optionalString (!isNull a.port) ":${toString a.port}"
+      + optionalString (!isNull a.proto) ",${a.proto}"
+      + optionalString (!isNull a.user) ",user=${a.user}"
+      + optionalString (!isNull a.group) ",group=${a.group}"
+      + optionalString (!isNull a.mode) ",mode=${a.mode}"
+    ) cfg.listen
+  );
+
+  addressSubmodule = types.submodule {
+    options = {
+      name = mkOption {
+        description = "Name is referenced in logs. If name is not specified, 'a0', 'a1', etc. is used.";
+        default = null;
+        type = with types; nullOr str;
+      };
+      address = mkOption {
+        description = ''
+          If given an IP address, it can be a host name ("localhost"), an IPv4 dotted-quad
+          ("127.0.0.1") or an IPv6  address enclosed in square brackets ("[::1]").
+
+          (VCL4.1 and higher) If given an absolute Path ("/path/to/listen.sock") or "@"
+          followed by the name of an abstract socket ("@myvinyld") accept connections
+          on a Unix domain socket.
+
+          The user, group and mode sub-arguments may be used to specify the permissions
+          of the socket file. These sub-arguments do not apply to  abstract sockets.
+        '';
+        type = types.str;
+      };
+      port = mkOption {
+        description = "The port to use for IP sockets. If port is not specified, port 80 (http) is used.";
+        default = null;
+        type = with types; nullOr port;
+      };
+      proto = mkOption {
+        description = "PROTO can be 'HTTP' (the default) or 'PROXY'.  Both version 1 and 2 of the proxy protocol can be used.";
+        type = types.enum [
+          "HTTP"
+          "PROXY"
+        ];
+        default = "HTTP";
+      };
+      user = mkOption {
+        description = "User name who owns the socket file.";
+        default = null;
+        type = with lib.types; nullOr str;
+      };
+      group = mkOption {
+        description = "Group name who owns the socket file.";
+        default = null;
+        type = with lib.types; nullOr str;
+      };
+      mode = mkOption {
+        description = "Permission of the socket file (3-digit octal value).";
+        default = null;
+        type = with types; nullOr str;
+      };
+    };
+  };
+  checkedAddressModule = types.addCheck addressSubmodule (
+    m:
+    (
+      if ((hasPrefix "@" m.address) || (hasPrefix "/" m.address)) then
+        # this is a unix socket
+        (m.port != null)
+      else
+      # this is not a path-based unix socket
+      if !(hasPrefix "/" m.address) && (m.group != null) || (m.user != null) || (m.mode != null) then
+        false
+      else
+        true
+    )
+  );
+  commandLine =
+    "-f ${pkgs.writeText "default.vcl" cfg.config}"
+    +
+      lib.optionalString (cfg.extraModules != [ ])
+        " -p vmod_path='${
+           lib.makeSearchPathOutput "lib" "lib/vinyl/vmods" ([ cfg.package ] ++ cfg.extraModules)
+         }' -r vmod_path";
+in
+{
+  meta.maintainers = [
+    lib.maintainers.leona
+    lib.maintainers.osnyx
+  ];
+  options = {
+    services.vinyl-cache = {
+      enable = lib.mkEnableOption "Vinyl Cache";
+
+      enableConfigCheck = lib.mkEnableOption "checking the config during build time" // {
+        default = true;
+      };
+
+      package = lib.mkPackageOption pkgs "vinyl-cache" { };
+
+      listen = lib.mkOption {
+        description = "Accept for client requests on the specified listen addresses.";
+        type = lib.types.listOf checkedAddressModule;
+        defaultText = lib.literalExpression ''[ { address="*"; port=6081; } ]'';
+        default = [
+          {
+            address = "*";
+            port = 6081;
+          }
+        ];
+      };
+
+      config = lib.mkOption {
+        type = lib.types.lines;
+        description = ''
+          Verbatim default.vcl configuration.
+        '';
+      };
+
+      extraModules = lib.mkOption {
+        type = lib.types.listOf lib.types.package;
+        default = [ ];
+        description = ''
+          Vinyl Cache modules (except 'std').
+        '';
+      };
+
+      extraCommandLine = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+        example = "-s malloc,256M";
+        description = ''
+          Command line switches for vinyld (run 'vinyld -?' to get list of options)
+        '';
+      };
+
+      enableFileLogging = lib.mkEnableOption "file based logging";
+    };
+
+  };
+
+  config = lib.mkMerge [
+    (lib.mkIf cfg.enable {
+      systemd.services.vinyl-cache = {
+        description = "Vinyl Cache";
+        wantedBy = [ "multi-user.target" ];
+        after = [ "network.target" ];
+        serviceConfig = {
+          Type = "simple";
+          ExecStart = "${cfg.package}/bin/vinyld ${commandLineAddresses} -n ${stateDir} -F ${cfg.extraCommandLine} ${commandLine}";
+          Restart = "always";
+          RestartSec = "5s";
+          User = "vinyl-cache";
+          Group = "vinyl-cache";
+          DynamicUser = true;
+          RuntimeDirectory = lib.removePrefix "/var/run/" stateDir;
+          AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
+          NoNewPrivileges = true;
+          LimitNOFILE = 131072;
+        };
+      };
+
+      environment.systemPackages = [ cfg.package ];
+
+      # check .vcl syntax at compile time (e.g. before nixops deployment)
+      system.checks = lib.mkIf cfg.enableConfigCheck [
+        (pkgs.runCommand "check-vinyl-cache-syntax" { } ''
+          ${cfg.package}/bin/vinyld -C ${commandLine} 2> $out || (cat $out; exit 1)
+        '')
+      ];
+
+      assertions =
+        concatMap (m: [
+          {
+            assertion = (hasPrefix "/" m.address) || (hasPrefix "@" m.address) -> m.port == null;
+            message = "Listen ports must not be specified with UNIX sockets: ${builtins.toJSON m}";
+          }
+          {
+            assertion = !(hasPrefix "/" m.address) -> m.user == null && m.group == null && m.mode == null;
+            message = "Abstract UNIX sockets or IP sockets can not be used with user, group, and mode settings: ${builtins.toJSON m}";
+          }
+        ]) cfg.listen
+        ++ [
+          {
+            assertion = cfg.package.pname == "vinyl-cache";
+            message = "services.vinyl-cache only supports Vinyl Cache. Please use services.varnish.";
+          }
+        ];
+    })
+    (lib.mkIf (cfg.enable && cfg.enableFileLogging) {
+      systemd.services = {
+        vinylncsa = {
+          after = [ "vinyl-cache.service" ];
+          requires = [ "vinyl-cache.service" ];
+          description = "Vinyl Cache logging daemon";
+          wantedBy = [ "multi-user.target" ];
+          # We want to reopen logs with HUP. vinylncsa must run in daemon mode for that.
+          serviceConfig = {
+            Type = "forking";
+            Restart = "always";
+            RuntimeDirectory = "vinylncsa";
+            LogsDirectory = "vinyl-cache";
+            PIDFile = "/run/vinylncsa/vinylncsa.pid";
+            User = "vinyl-cache";
+            Group = "vinyl-cache";
+            ExecStart = "${cfg.package}/bin/vinylncsa -D -a -w /var/log/vinyl-cache/vinyl-cache.log -P /run/vinylncsa/vinylncsa.pid";
+            ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+          };
+        };
+      };
+
+      services.logrotate.settings.vinyl-cache = lib.mapAttrs (_: lib.mkDefault) {
+        files = [ "/var/log/vinyl-cache/*.log" ];
+        frequency = "daily";
+        rotate = 14;
+        compress = true;
+        delaycompress = true;
+        postrotate = "systemctl reload vinylncsa";
+      };
+    })
+  ];
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index d167ec0c90a5..783098ea4b2a 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1753,6 +1753,10 @@ in
   victoriametrics = import ./victoriametrics { inherit runTest; };
   victoriatraces = import ./victoriatraces { inherit runTest; };
   vikunja = runTest ./vikunja.nix;
+  vinyl-cache_9 = runTest {
+    imports = [ ./vinyl-cache.nix ];
+    _module.args.package = pkgs.vinyl-cache_9;
+  };
   virtualbox = handleTestOn [ "x86_64-linux" ] ./virtualbox.nix { };
   vm-variant = handleTest ./vm-variant.nix { };
   vscode-remote-ssh = handleTestOn [ "x86_64-linux" ] ./vscode-remote-ssh.nix { };
diff --git a/nixos/tests/rancher/multi-node.nix b/nixos/tests/rancher/multi-node.nix
index 2e47db1f18e4..d44884e5002e 100644
--- a/nixos/tests/rancher/multi-node.nix
+++ b/nixos/tests/rancher/multi-node.nix
@@ -224,7 +224,7 @@ in
 
       # Now create a pod on each node via a daemonset and verify they can talk to each other.
       server.succeed("kubectl apply -f ${networkTestDaemonset}")
-      server.wait_until_succeeds(f'[ "$(kubectl get ds test -o json | jq .status.numberReady)" -eq {len(machines)} ]')
+      server.wait_until_succeeds("kubectl rollout status daemonset test")
 
       # Get pod IPs
       pods = server.succeed("kubectl get po -o json | jq '.items[].metadata.name' -r").splitlines()
diff --git a/nixos/tests/vinyl-cache.nix b/nixos/tests/vinyl-cache.nix
new file mode 100644
index 000000000000..aec9415b333f
--- /dev/null
+++ b/nixos/tests/vinyl-cache.nix
@@ -0,0 +1,126 @@
+{
+  pkgs,
+  package,
+  lib,
+  ...
+}:
+let
+  testPath = pkgs.hello;
+in
+{
+  name = "vinyl";
+  meta = {
+    maintainers = [
+      lib.maintainers.leona
+      lib.maintainers.osnyx
+    ];
+  };
+
+  nodes = {
+    vinyl =
+      {
+        config,
+        pkgs,
+        lib,
+        ...
+      }:
+      {
+        services.nix-serve = {
+          enable = true;
+        };
+
+        services.vinyl-cache = {
+          inherit package;
+          enable = true;
+          enableFileLogging = true;
+          listen = [
+            {
+              address = "0.0.0.0";
+              port = 80;
+              proto = "HTTP";
+            }
+            {
+              name = "proxyport";
+              address = "0.0.0.0";
+              port = 8080;
+              proto = "PROXY";
+            }
+            {
+              address = "/var/run/vinyld/client.http.sock";
+              user = "vinyl-cache";
+              group = "vinyl-cache";
+              mode = "660";
+            }
+          ]
+          ++ lib.optionals (lib.versionAtLeast package.version "7.3") [
+            # Support added in 7.3.0
+            { address = "@asdf"; }
+          ];
+          config = ''
+            vcl 4.1;
+
+            backend nix-serve {
+              .host = "127.0.0.1";
+              .port = "${toString config.services.nix-serve.port}";
+            }
+          '';
+        };
+
+        networking.firewall.allowedTCPPorts = [ 80 ];
+        system.extraDependencies = [ testPath ];
+
+        assertions =
+          let
+            cmdline = config.systemd.services.vinyl-cache.serviceConfig.ExecStart;
+          in
+          map
+            (pattern: {
+              assertion = lib.hasInfix pattern cmdline;
+              message = "Address argument `${pattern}` missing in commandline `${cmdline}`.";
+            })
+            (
+              [
+                " -a 0.0.0.0:80,HTTP "
+                " -a proxyport=0.0.0.0:8080,PROXY "
+                " -a /var/run/vinyld/client.http.sock,HTTP,user=vinyl-cache,group=vinyl-cache,mode=660 "
+              ]
+              ++ lib.optionals (lib.versionAtLeast package.version "7.3") [
+                " -a @asdf,HTTP "
+              ]
+            );
+      };
+
+    client =
+      { lib, ... }:
+      {
+        nix.settings = {
+          require-sigs = false;
+          substituters = lib.mkForce [ "http://vinyl" ];
+        };
+      };
+  };
+
+  testScript = ''
+    from pathlib import Path
+    import os
+
+    start_all()
+    vinyl.wait_for_open_port(80)
+    vinyl.wait_for_unit("vinylncsa")
+
+    client.wait_until_succeeds("curl -f http://vinyl/nix-cache-info");
+
+    client.wait_until_succeeds("nix-store -r ${testPath}")
+    client.succeed("${testPath}/bin/hello")
+
+    output = vinyl.succeed("vinyladm status")
+    print(output)
+    assert "Child in state running" in output, "Unexpected vinyladm response"
+
+    vinyl.copy_from_machine("/var/log/vinyl-cache/vinyl-cache.log")
+
+    out_dir = os.environ.get("out", os.getcwd())
+    vinyl_log = (Path(out_dir) / "vinyl-cache.log").read_text()
+    assert "http://vinyl/nix-cache-info" in vinyl_log
+  '';
+}
diff --git a/pkgs/applications/emulators/libretro/cores/beetle-gba.nix b/pkgs/applications/emulators/libretro/cores/beetle-gba.nix
index ba6f74a5a6a0..c623e7702342 100644
--- a/pkgs/applications/emulators/libretro/cores/beetle-gba.nix
+++ b/pkgs/applications/emulators/libretro/cores/beetle-gba.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-gba";
-  version = "0-unstable-2024-10-21";
+  version = "0-unstable-2026-04-20";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-gba-libretro";
-    rev = "6cee80685f735ea6c2373db2622a1f1ee9f39d39";
-    hash = "sha256-a3XgExXVCUFw3GLCUkEl6now2L8qVdNOaXvrDMcT1ZE=";
+    rev = "145d4884ad246e3c16765f6d69decb2a4359b6ae";
+    hash = "sha256-4LRMPsPrYvdTJGcbbS3ZyimrWKxZSU+bP0SxUMLkYgE=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/emulators/libretro/cores/beetle-pcfx.nix b/pkgs/applications/emulators/libretro/cores/beetle-pcfx.nix
index a5b00be615cd..0f5331ab92a7 100644
--- a/pkgs/applications/emulators/libretro/cores/beetle-pcfx.nix
+++ b/pkgs/applications/emulators/libretro/cores/beetle-pcfx.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-pcfx";
-  version = "0-unstable-2026-03-31";
+  version = "0-unstable-2026-04-22";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-pcfx-libretro";
-    rev = "035191393485280cad1866ce3aedd626d4fa09d0";
-    hash = "sha256-jchEbKvHSE4D90ezwi//nl8vefQD4gp6YWb0eb6zkeY=";
+    rev = "650c30ea2203636a1716675854d11c608ed6eacc";
+    hash = "sha256-xB3O7N23bS2IAaWuvxIXfVodua8s1dcbZ2XAB0Lt6gc=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/emulators/libretro/cores/eightyone.nix b/pkgs/applications/emulators/libretro/cores/eightyone.nix
index 21b32cc816ac..d249284baa13 100644
--- a/pkgs/applications/emulators/libretro/cores/eightyone.nix
+++ b/pkgs/applications/emulators/libretro/cores/eightyone.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "81";
-  version = "0-unstable-2026-03-31";
+  version = "0-unstable-2026-04-20";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "81-libretro";
-    rev = "f9e5fa3bef9a6d6e1e19a4b1c7e5922467b582a2";
-    hash = "sha256-c/0L0NLAFyyjQcPNmmfHW29i1As4Wk2/U3qKtClk1VE=";
+    rev = "fa7094910d040baa5fd8b11dbf6a1a618330ecd9";
+    hash = "sha256-TuAx8frehC9h+s77xcigydMxvHXLzIc/q1y4vK8/WuI=";
   };
 
   meta = {
diff --git a/pkgs/applications/emulators/libretro/cores/melonds.nix b/pkgs/applications/emulators/libretro/cores/melonds.nix
index 83e335680e0a..b6846e4d1e89 100644
--- a/pkgs/applications/emulators/libretro/cores/melonds.nix
+++ b/pkgs/applications/emulators/libretro/cores/melonds.nix
@@ -7,13 +7,13 @@
 }:
 mkLibretroCore {
   core = "melonds";
-  version = "0-unstable-2026-03-31";
+  version = "0-unstable-2026-04-20";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "melonds";
-    rev = "e548eba517ccb964ddba31dcf8f0136041f5bb05";
-    hash = "sha256-4bCunBPpBP0RWwL1vUTQxLPtCBnQ0M5pC3GAX1uTL5A=";
+    rev = "634e51477364edc39aaccd3bebf8bcab5776148c";
+    hash = "sha256-/u6CQKpb9eIls0TYpSpWoIf+IQ0CTIx48oq8LscfhFw=";
   };
 
   extraBuildInputs = [
diff --git a/pkgs/applications/emulators/libretro/cores/neocd.nix b/pkgs/applications/emulators/libretro/cores/neocd.nix
index fef03cb990f8..9a5bb699732d 100644
--- a/pkgs/applications/emulators/libretro/cores/neocd.nix
+++ b/pkgs/applications/emulators/libretro/cores/neocd.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "neocd";
-  version = "0-unstable-2026-03-31";
+  version = "0-unstable-2026-04-20";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "neocd_libretro";
-    rev = "9216ca226f24e01e77fc2670035e97da154f3de4";
-    hash = "sha256-Mq9UOuPwmG2Di68jWUgCbBvG3jUCEMON8Kfly/aCdH4=";
+    rev = "9e9ad181bed60f84f9cff02c03617b41e8a31cfe";
+    hash = "sha256-1rmoV6jxClTSRWNzsYepP8VSHKbSB+HUOLkvRrvYz/c=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/emulators/libretro/cores/tgbdual.nix b/pkgs/applications/emulators/libretro/cores/tgbdual.nix
index 2f54c2ffd9f0..1256fe11673f 100644
--- a/pkgs/applications/emulators/libretro/cores/tgbdual.nix
+++ b/pkgs/applications/emulators/libretro/cores/tgbdual.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "tgbdual";
-  version = "0-unstable-2025-05-10";
+  version = "0-unstable-2026-04-20";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "tgbdual-libretro";
-    rev = "933707c0ba8f12360f6d79712f735a917713709a";
-    hash = "sha256-58OLuF14aSJGhmXR0RGgPpuHLXYk9LOz7LX03AEFPr4=";
+    rev = "12540f0b2d3783259a0dce34ac8aa7a86beeaa11";
+    hash = "sha256-l+WiFC5GxbdY9ulmtdqd2iKU7qKoVWqcf4YR/waSVhQ=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/emulators/libretro/cores/yabause.nix b/pkgs/applications/emulators/libretro/cores/yabause.nix
index 9f12cffb3c67..611196f73712 100644
--- a/pkgs/applications/emulators/libretro/cores/yabause.nix
+++ b/pkgs/applications/emulators/libretro/cores/yabause.nix
@@ -6,13 +6,13 @@
 }:
 mkLibretroCore {
   core = "yabause";
-  version = "0-unstable-2026-04-10";
+  version = "0-unstable-2026-04-20";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "yabause";
-    rev = "76faf7c601359bafc41785325d686644000a7ba9";
-    hash = "sha256-UHmUsqAK+As6qfvhto2aOsW9A/lZMypfn2NxFui2x8c=";
+    rev = "7cb15b8f9eea5a6fa7cae34468a6989522bcba75";
+    hash = "sha256-UWZgt0vdjncM7JCzdSWa4XZMJBJ/pnk4QpSKz459Fq0=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/networking/cluster/rke2/1_32/images-versions.json b/pkgs/applications/networking/cluster/rke2/1_32/images-versions.json
deleted file mode 100644
index a9287cab5d3c..000000000000
--- a/pkgs/applications/networking/cluster/rke2/1_32/images-versions.json
+++ /dev/null
@@ -1,138 +0,0 @@
-{
-  "images-calico-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-calico.linux-amd64.tar.gz",
-    "sha256": "b2b1ce6fc213202829513dd99997de7979dc5dd26f4fad8e02918848928ac892"
-  },
-  "images-calico-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-calico.linux-amd64.tar.zst",
-    "sha256": "9aae79e102c20418d184906f5e1e36bb01c6a2c41b7e9405b2a20816d0ec58ff"
-  },
-  "images-calico-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-calico.linux-arm64.tar.gz",
-    "sha256": "52bdb3ebd6f2cbe4fe0a1894dda8f853e33bc31eaee83a352d014f3464168116"
-  },
-  "images-calico-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-calico.linux-arm64.tar.zst",
-    "sha256": "86f6f5cfe607e15eeb7a35522325ccbea56f1d84ca27cd02c626e4356ca54c56"
-  },
-  "images-canal-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-canal.linux-amd64.tar.gz",
-    "sha256": "1fbe1a2c48fcedcec613cee071f0b524f007a191c858952c0c6243c28a292e30"
-  },
-  "images-canal-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-canal.linux-amd64.tar.zst",
-    "sha256": "7e3f80b037079922f6a0aaf5a701459ef550d67ca31119a0c74955254fa52b1e"
-  },
-  "images-canal-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-canal.linux-arm64.tar.gz",
-    "sha256": "1152d6f24c5b955e37300cbfcd68a8c212c1036ce8964e2ffc22422522fa1d83"
-  },
-  "images-canal-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-canal.linux-arm64.tar.zst",
-    "sha256": "50f4d1b1bb03523b922d7ce989d2d83f009d751d7fbf4aa8821fe52c9b9fd96d"
-  },
-  "images-cilium-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-cilium.linux-amd64.tar.gz",
-    "sha256": "c28b224620327061bb707c31733c3428a7573e2f905178ddd9d038dec7d00370"
-  },
-  "images-cilium-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-cilium.linux-amd64.tar.zst",
-    "sha256": "8db98924c2e9534574bab2584b08467cc1c379e740d345b8bad3768d1bed4c5f"
-  },
-  "images-cilium-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-cilium.linux-arm64.tar.gz",
-    "sha256": "b6a8a882c1285687a78add12e4be64c335f13de8975f9bb7c142aadbaa1f10c5"
-  },
-  "images-cilium-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-cilium.linux-arm64.tar.zst",
-    "sha256": "7ea32966e4a4fb2ad0c5fae8eece897d22e1a1515ce7d7954f7aa341c6ca51ac"
-  },
-  "images-core-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-core.linux-amd64.tar.gz",
-    "sha256": "02c940745706a79eedb0b579f2368cdbdf8c54de148f4d8fda70f7ee66d7ecf2"
-  },
-  "images-core-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-core.linux-amd64.tar.zst",
-    "sha256": "a52feceeb43d21fb8494def190841a046b896c4dfc8e964f3646916f1b20f829"
-  },
-  "images-core-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-core.linux-arm64.tar.gz",
-    "sha256": "2d2e23a72f23bedee62d2163df68009fc099ae9c3de1aa34c5cbcfa75f1a8e73"
-  },
-  "images-core-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-core.linux-arm64.tar.zst",
-    "sha256": "e872a4ceb854138916c4a283904f658398c6894e2595c348b40f03e1cdcc6f86"
-  },
-  "images-flannel-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-flannel.linux-amd64.tar.gz",
-    "sha256": "a3f60044c7da90d4c2dd5cbc44c897ffcc2660bd1d2dcafa8a900bf8ca100589"
-  },
-  "images-flannel-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-flannel.linux-amd64.tar.zst",
-    "sha256": "d843630e86003cf4b18a1ef070b44c3a73e1431770244e853eafcecdb714bfa3"
-  },
-  "images-flannel-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-flannel.linux-arm64.tar.gz",
-    "sha256": "e4a605d5af2a79bd7901f1678e488f776774916e1c5104090e813bd45a257bc3"
-  },
-  "images-flannel-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-flannel.linux-arm64.tar.zst",
-    "sha256": "c94fecb19b6b1eaa347c49fc60def2e1251d866714e9ab05ea6ce29d5da41fb3"
-  },
-  "images-harvester-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-harvester.linux-amd64.tar.gz",
-    "sha256": "d0d213e4e6a3931950b5b61f67c9c0163838095f3fb5486e9256902aff397547"
-  },
-  "images-harvester-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-harvester.linux-amd64.tar.zst",
-    "sha256": "6a914bba0f07f9f3431058f2b1b2c5ed9d8124069f436bfea747c293b5276dff"
-  },
-  "images-harvester-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-harvester.linux-arm64.tar.gz",
-    "sha256": "a133106b2348dcbfa28c7b219a22e6cc7cf399a741196c1a435a211050aba4b5"
-  },
-  "images-harvester-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-harvester.linux-arm64.tar.zst",
-    "sha256": "0a28d456de6bdc33b806a236e0732c5bcb8bd01dc0e64e84eb2daee51467dace"
-  },
-  "images-multus-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-multus.linux-amd64.tar.gz",
-    "sha256": "7df59c19b452c971cd5e739042d0cc3146ba061f3e54aeae25794203592e6866"
-  },
-  "images-multus-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-multus.linux-amd64.tar.zst",
-    "sha256": "83c9451a8dfc116bddc38146f2a6eddef95d09348386e2b11c7d5479a114de34"
-  },
-  "images-multus-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-multus.linux-arm64.tar.gz",
-    "sha256": "77a270820a7955fe9bc7b0d2b6b4b6b8b73e6f042ddd9101b89d1cc0a1b95908"
-  },
-  "images-multus-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-multus.linux-arm64.tar.zst",
-    "sha256": "d3eb6dab20944a417d0cbc6eed3a4838c008646a40c3e6b637729f7f9251ff8c"
-  },
-  "images-traefik-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-traefik.linux-amd64.tar.gz",
-    "sha256": "24f246a655706dbcfc34fb1fbe055978f79bee25791e3ba8c0239cd370b3630a"
-  },
-  "images-traefik-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-traefik.linux-amd64.tar.zst",
-    "sha256": "3b5b1a5016c70cc91676165a21594ce9ddc8866704c54613b98e5360e59a9f30"
-  },
-  "images-traefik-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-traefik.linux-arm64.tar.gz",
-    "sha256": "1f553eb44e38ffe20cae2a8297c249b3d46fa1ddee859b5823102077525e2ca7"
-  },
-  "images-traefik-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-traefik.linux-arm64.tar.zst",
-    "sha256": "c642a0fece74ba83840a1683159c06ca029012eda63458f42919ca69d14bd724"
-  },
-  "images-vsphere-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.gz",
-    "sha256": "a38d2489e69e4e25ecba96c3ecc91d087df4eb0ebb7f7dbffc9a25f3fef9e823"
-  },
-  "images-vsphere-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.13%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.zst",
-    "sha256": "768defc1af4754f6a77ac7fda8bf9472764dab3cc82b9b3f8f9622ed17fb311c"
-  }
-}
diff --git a/pkgs/applications/networking/cluster/rke2/1_32/versions.nix b/pkgs/applications/networking/cluster/rke2/1_32/versions.nix
deleted file mode 100644
index fedc30664a4a..000000000000
--- a/pkgs/applications/networking/cluster/rke2/1_32/versions.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-{
-  rke2Version = "1.32.13+rke2r1";
-  rke2Commit = "a361386c83e8e581c2634a408bc7e4dd44fdcedc";
-  rke2TarballHash = "sha256-jEr7wTMRUk0dOO50G0+iIKywVlBM5Et//nbt7R2mu/0=";
-  rke2VendorHash = "sha256-rptP0Pb5tgufcXMmtaYaNk/Lyqp1bmlk9upm2amKfno=";
-  k8sImageTag = "v1.32.13-rke2r1-build20260227";
-  etcdVersion = "v3.5.26-k3s1-build20260227";
-  pauseVersion = "3.6";
-  ccmVersion = "v1.32.12-0.20260211145907-0dc662e80238-build20260211";
-  dockerizedVersion = "v1.32.13-rke2r1";
-  helmJobVersion = "v0.9.14-build20260210";
-  imagesVersions = with builtins; fromJSON (readFile ./images-versions.json);
-}
diff --git a/pkgs/applications/networking/cluster/rke2/default.nix b/pkgs/applications/networking/cluster/rke2/default.nix
index 5b3f1ceac55f..a76456652e5d 100644
--- a/pkgs/applications/networking/cluster/rke2/default.nix
+++ b/pkgs/applications/networking/cluster/rke2/default.nix
@@ -5,8 +5,6 @@ let
   extraArgs = removeAttrs args [ "callPackage" ];
 in
 rec {
-  rke2_1_32 = common (import ./1_32/versions.nix) extraArgs;
-
   rke2_1_33 = common (import ./1_33/versions.nix) extraArgs;
 
   rke2_1_34 = common (import ./1_34/versions.nix) extraArgs;
diff --git a/pkgs/by-name/al/alistral/package.nix b/pkgs/by-name/al/alistral/package.nix
index a40ee4ae233b..609ae97d936d 100644
--- a/pkgs/by-name/al/alistral/package.nix
+++ b/pkgs/by-name/al/alistral/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "alistral";
-  version = "0.6.6";
+  version = "0.6.7";
 
   src = fetchFromGitHub {
     owner = "RustyNova016";
     repo = "Alistral";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-b6htcjBdh4E9cCUw4ETl3AnmMO3yT6654PLKIGPOPlo=";
+    hash = "sha256-XsN4UyIXkd0YVtO/q9EcFP/sBYkH9leISmbJZ93ef6E=";
   };
 
-  cargoHash = "sha256-Udbf0h8XZ8uD7MLTNRKaIJ8AdTvzq1dDQKPXWXunR/w=";
+  cargoHash = "sha256-KFNFioZ/5moC5FNXw+hA+NrPjsqu+3V8A5mtZ4FZUHw=";
 
   buildNoDefaultFeatures = true;
   # Would be cleaner with an "--all-features" option
diff --git a/pkgs/by-name/au/audiobookshelf/package.nix b/pkgs/by-name/au/audiobookshelf/package.nix
index 5291f1920343..131e32a76126 100644
--- a/pkgs/by-name/au/audiobookshelf/package.nix
+++ b/pkgs/by-name/au/audiobookshelf/package.nix
@@ -15,10 +15,10 @@
 
 let
   source = {
-    version = "2.33.2";
-    hash = "sha256-YsKUoJ0SlBO3fAbMvzaEEIgo90HclB+0iLVIH4LDmEY=";
-    npmDepsHash = "sha256-h/5brNurUEMHTSu2PGODhRtIenGzhsNM558i85Cs86w=";
-    clientNpmDepsHash = "sha256-EbXkHRjOE1A7Sk4MhbJFuBwG/VY+SHhHYjscsXkSMjU=";
+    version = "2.34.0";
+    hash = "sha256-ZHPrNQ36+bS5wwoiKUQKkGLnKhHKpftI3kQ08ItReWI=";
+    npmDepsHash = "sha256-8y0+3zj3UH5wi9Nbl7X5rne0/tzz6Bf7HrxZpYVYZ3Y=";
+    clientNpmDepsHash = "sha256-xna4tZK40dOew380exp/XR32ekyiFVCTWgWNE9BpTl8=";
   };
 
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/be/better-commits/package.nix b/pkgs/by-name/be/better-commits/package.nix
index 00428bcb4cad..7615c98783d6 100644
--- a/pkgs/by-name/be/better-commits/package.nix
+++ b/pkgs/by-name/be/better-commits/package.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "better-commits";
-  version = "1.19.1";
+  version = "1.21.0";
 
   src = fetchFromGitHub {
     owner = "Everduin94";
     repo = "better-commits";
     tag = "v${version}";
-    hash = "sha256-4akYngeDf7EqLxCzObjb5MUA8Cb3X3jlrvLEM71OcCA=";
+    hash = "sha256-JgAe55aMr6gP9/dEj3rDW5glA+ntftthJSCFYvtmWso=";
   };
 
-  npmDepsHash = "sha256-vtUtdgOJEQk9PzxOz7AlwOxWS6PTjAtrjAugXRXo89c=";
+  npmDepsHash = "sha256-7+WMrkAYKQgUdOBI4jSOTt6gxwfCwft4GcUKMvpTiYc=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/ch/chainsaw/package.nix b/pkgs/by-name/ch/chainsaw/package.nix
index 3e00f1af14a5..ad27f086988e 100644
--- a/pkgs/by-name/ch/chainsaw/package.nix
+++ b/pkgs/by-name/ch/chainsaw/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "chainsaw";
-  version = "2.14.1";
+  version = "2.15.0";
 
   src = fetchFromGitHub {
     owner = "WithSecureLabs";
     repo = "chainsaw";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-M+gHsh4u5CEZndMn5sUFk/69ojyaL2AftF8Ao0mKmtY=";
+    hash = "sha256-FsetcuVl1JHkVy4Haal6e16NLQz+zS9mFyqH65Qr5zU=";
   };
 
-  cargoHash = "sha256-NFyo6elDsqjFI4Kr9BG2ppM8DXictY+N+D3G5+89TJU=";
+  cargoHash = "sha256-UumlqHRssy401iiZSMq5N5r8a2f6ZLoqPuyBoDHPxYg=";
 
   ldflags = [
     "-w"
diff --git a/pkgs/by-name/fi/finit/package.nix b/pkgs/by-name/fi/finit/package.nix
index 8d6672388dc5..b9edd713a410 100644
--- a/pkgs/by-name/fi/finit/package.nix
+++ b/pkgs/by-name/fi/finit/package.nix
@@ -7,17 +7,21 @@
   libcap,
   libite,
   libuev,
+  shadow,
+  sysctl,
+  plymouth,
+  plymouthSupport ? false,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "finit";
-  version = "4.16";
+  version = "4.17";
 
   src = fetchFromGitHub {
     owner = "finit-project";
     repo = "finit";
     tag = finalAttrs.version;
-    hash = "sha256-DtocGgFvt7RLqwjHczwUbsszBD5MQI5fEuq9EB2tFp4=";
+    hash = "sha256-sH4xZNMEuIS+r6rVQAKnsHtSyTe2B6gdYcmH9J8eSZ0=";
   };
 
   postPatch = ''
@@ -57,12 +61,21 @@ stdenv.mkDerivation (finalAttrs: {
 
     # monitor kernel events, like ac power status
     "--with-keventd"
+  ]
+  ++ lib.optionals plymouthSupport [
+    "--enable-plymouth-plugin=yes"
   ];
 
-  env.NIX_CFLAGS_COMPILE = toString [
-    "-D_PATH_LOGIN=\"/run/current-system/sw/bin/login\""
-    "-DSYSCTL_PATH=\"/run/current-system/sw/bin/sysctl\""
-  ];
+  env.NIX_CFLAGS_COMPILE = toString (
+    [
+      "-D_PATH_LOGIN=\"${shadow}/bin/login\""
+      "-DSYSCTL_PATH=\"${sysctl}/bin/sysctl\""
+    ]
+    ++ lib.optionals plymouthSupport [
+      "-DPLYMOUTH_PATH=\"${plymouth}/bin/plymouth\""
+      "-DPLYMOUTHD_PATH=\"${plymouth}/bin/plymouthd\""
+    ]
+  );
 
   meta = {
     description = "Fast init for Linux";
diff --git a/pkgs/by-name/fi/firefly-iii-data-importer/package.nix b/pkgs/by-name/fi/firefly-iii-data-importer/package.nix
index fca5856cd4a5..d9afbec8e06e 100644
--- a/pkgs/by-name/fi/firefly-iii-data-importer/package.nix
+++ b/pkgs/by-name/fi/firefly-iii-data-importer/package.nix
@@ -16,13 +16,13 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "firefly-iii-data-importer";
-  version = "2.2.3";
+  version = "2.3.2";
 
   src = fetchFromGitHub {
     owner = "firefly-iii";
     repo = "data-importer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2/zfxBggXK9mJDpuofQyMZ+WWV0OHyUWTUU+4CRNOUQ=";
+    hash = "sha256-JLN13SCpMXByu3rWSclcsLBGCLFMzHGHOM+bWLJ2MPw=";
   };
 
   buildInputs = [ php ];
@@ -42,12 +42,12 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   composerStrictValidation = true;
   strictDeps = true;
 
-  vendorHash = "sha256-0p0xPBX4nKFYlpIvGVZU7ay+btjpxBO2s73wzysSzUU=";
+  vendorHash = "sha256-QobjMMPEhLvsTwlJJvf4nUi1PcZEDOaU8EzexluOI90=";
 
   npmDeps = fetchNpmDeps {
     inherit (finalAttrs) src;
     name = "${finalAttrs.pname}-npm-deps";
-    hash = "sha256-baPsbZwGu1tx6bMH2tWcZVlkZuIpSflwj9JyX9vQW/U=";
+    hash = "sha256-NkxCvC0EPMLi7GV5GG1+5niL3KIaqBsleo11/gzaX/s=";
   };
 
   composerRepository = php.mkComposerRepository {
diff --git a/pkgs/by-name/fo/fosrl-newt/package.nix b/pkgs/by-name/fo/fosrl-newt/package.nix
index cd02adca68f6..feaa90c5fab3 100644
--- a/pkgs/by-name/fo/fosrl-newt/package.nix
+++ b/pkgs/by-name/fo/fosrl-newt/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "newt";
-  version = "1.10.4";
+  version = "1.12.0";
 
   src = fetchFromGitHub {
     owner = "fosrl";
     repo = "newt";
     tag = finalAttrs.version;
-    hash = "sha256-Dtzx/Rs7aa2GkG7Qq4pvGN4ghfS7EyVhx7rQh8sRlQU=";
+    hash = "sha256-csD7QcSQE4/eRw3EHX0m2nI3JjglFxXlnyuS4xpCmRY=";
   };
 
-  vendorHash = "sha256-vy6Dqjek7pLdASbCrM9snq5Dt9lbwNJ0AuQboy1JWNQ=";
+  vendorHash = "sha256-+zMSzNbqmWm/DXL2xMUd5uPP5tSIybsRokwJ2zd0pf0=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
 
diff --git a/pkgs/by-name/fo/fosrl-olm/package.nix b/pkgs/by-name/fo/fosrl-olm/package.nix
index ea332c138ace..6bd26a00b0bd 100644
--- a/pkgs/by-name/fo/fosrl-olm/package.nix
+++ b/pkgs/by-name/fo/fosrl-olm/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "olm";
-  version = "1.4.4";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "fosrl";
     repo = "olm";
     tag = finalAttrs.version;
-    hash = "sha256-G2kYzYg4RUFHgW9z44PcQPK85FsD5SVBefpzBKIwUw0=";
+    hash = "sha256-OnHOfP3dCduTe0xnZD77YZcI3GOKxGsen5i7dOiCjy8=";
   };
 
-  vendorHash = "sha256-D93SPwXAeoTLCbScjyH8AB9TJIF2b/UbLNMIQYi+B+c=";
+  vendorHash = "sha256-+KQpYGoyNI2SnEjj23GM0FqZFX6lHx7oNw9qdkkgcPU=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ha/harmonia/package.nix b/pkgs/by-name/ha/harmonia/package.nix
index debe7bdd1de0..0d95003187cb 100644
--- a/pkgs/by-name/ha/harmonia/package.nix
+++ b/pkgs/by-name/ha/harmonia/package.nix
@@ -10,16 +10,19 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "harmonia";
-  version = "3.0.0";
+  version = "3.1.0";
+
+  __structuredAttrs = true;
+  strictDeps = true;
 
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "harmonia";
     tag = "harmonia-v${finalAttrs.version}";
-    hash = "sha256-BovRI3p2KXwQ6RF49NqLc0uKP/Jk+yA8E0eqScaIP68=";
+    hash = "sha256-fm8PBugKnw72/dAXsRj84jf4EZK1BcVEdEWgtojIuA0=";
   };
 
-  cargoHash = "sha256-X3A+gV32itmt0SqepioT64IGzHfrCdLsQjF6EDwCTbo=";
+  cargoHash = "sha256-qp4frhNsWDma8uYcRe3BXmfIu6btYb8IaoXhk4oI4qM=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/he/headplane-agent/package.nix b/pkgs/by-name/he/headplane-agent/package.nix
new file mode 100644
index 000000000000..a645d2e576f8
--- /dev/null
+++ b/pkgs/by-name/he/headplane-agent/package.nix
@@ -0,0 +1,39 @@
+{
+  buildGoModule,
+  fetchFromGitHub,
+  lib,
+}:
+buildGoModule (finalAttrs: {
+  pname = "headplane-agent";
+  __structuredAttrs = true;
+  # Note, if you are upgrading this, you should upgrade headplane at the same time
+  version = "0.6.1";
+
+  src = fetchFromGitHub {
+    owner = "tale";
+    repo = "headplane";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-hsrnmEwKXJlPjV4aIfmS6GAE414ArVRGoPPpZGmV0x4=";
+  };
+
+  vendorHash = "sha256-MvrqKMD+A+qBZmzQv+T9920U5uJop+pjfJpZdm2ZqEA=";
+  subPackages = [ "cmd/hp_agent" ];
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+  env.CGO_ENABLED = 0;
+
+  meta = {
+    description = "Optional sidecar process providing additional features for headplane";
+    homepage = "https://github.com/tale/headplane";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      igor-ramazanov
+      stealthbadger747
+    ];
+    mainProgram = "hp_agent";
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+  };
+})
diff --git a/pkgs/by-name/he/headplane/package.nix b/pkgs/by-name/he/headplane/package.nix
new file mode 100644
index 000000000000..bb42ab31bcee
--- /dev/null
+++ b/pkgs/by-name/he/headplane/package.nix
@@ -0,0 +1,119 @@
+{
+  buildGoModule,
+  fetchFromGitHub,
+  fetchPnpmDeps,
+  git,
+  lib,
+  makeWrapper,
+  nodejs_22,
+  pnpm_10,
+  pnpmConfigHook,
+  stdenv,
+}:
+let
+  pname = "headplane";
+  # Note, if you are upgrading this, you should upgrade headplane-agent at the same time
+  version = "0.6.1";
+  pnpmDepsHash = "sha256-AYfEL3HSRg87I+Y0fkLthFSDWgHTg5u0DBpzn6KBn1Q=";
+  src = fetchFromGitHub {
+    owner = "tale";
+    repo = "headplane";
+    tag = "v${version}";
+    hash = "sha256-hsrnmEwKXJlPjV4aIfmS6GAE414ArVRGoPPpZGmV0x4=";
+  };
+
+  headplaneSshWasm = buildGoModule {
+    pname = "headplane-ssh-wasm";
+    inherit version src;
+    subPackages = [ "cmd/hp_ssh" ];
+    vendorHash = "sha256-MvrqKMD+A+qBZmzQv+T9920U5uJop+pjfJpZdm2ZqEA=";
+    env.CGO_ENABLED = 0;
+    doCheck = false;
+    buildPhase = ''
+      export GOOS=js
+      export GOARCH=wasm
+      go build -o hp_ssh.wasm ./cmd/hp_ssh
+    '';
+
+    installPhase = ''
+      runHook preInstall
+      install -Dm444 hp_ssh.wasm "$out/hp_ssh.wasm"
+
+      # Go's WebAssembly shim (wasm_exec.js) has no stable `go env` key, and
+      # different Go packages may place it in different locations under GOROOT.
+      #   1. Ask `go env GOROOT` for the active GOROOT.
+      #   2. First try the path misc/wasm/wasm_exec.js.
+      #   3. If that fails, fall back to searching under GOROOT to handle
+      #      distro / OS / packaging layout variations.
+      goRoot="$(go env GOROOT)"
+
+      wasm_exec="$goRoot/misc/wasm/wasm_exec.js"
+      if [ ! -e "$wasm_exec" ]; then
+        wasm_exec="$(find "$goRoot" -path '*wasm_exec.js' -print -quit || true)"
+      fi
+
+      if [[ -z "$wasm_exec" || ! -e "$wasm_exec" ]]; then
+        echo "ERROR: wasm_exec.js not found under GOROOT=$goRoot" >&2
+        exit 1
+      fi
+
+      install -Dm444 "$wasm_exec" "$out/wasm_exec.js"
+      runHook postInstall
+    '';
+  };
+in
+stdenv.mkDerivation (finalAttrs: {
+  inherit pname version src;
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [
+    git
+    makeWrapper
+    nodejs_22
+    pnpm_10
+    pnpmConfigHook
+  ];
+
+  pnpmDeps = fetchPnpmDeps {
+    inherit (finalAttrs) pname version src;
+    hash = pnpmDepsHash;
+    fetcherVersion = 3;
+  };
+
+  buildPhase = ''
+    runHook preBuild
+    cp ${headplaneSshWasm}/hp_ssh.wasm app/hp_ssh.wasm
+    cp ${headplaneSshWasm}/wasm_exec.js app/wasm_exec.js
+    pnpm --offline build
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/{bin,share/headplane}
+    cp -r build $out/share/headplane/
+    cp -r node_modules $out/share/headplane/
+    cp -r drizzle $out/share/headplane/
+    substituteInPlace $out/share/headplane/build/server/index.js \
+      --replace "$PWD" "../.."
+    makeWrapper ${lib.getExe nodejs_22} $out/bin/headplane \
+      --chdir $out/share/headplane \
+      --add-flags $out/share/headplane/build/server/index.js
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Feature-complete Web UI for Headscale";
+    homepage = "https://github.com/tale/headplane";
+    changelog = "https://github.com/tale/headplane/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      igor-ramazanov
+      stealthbadger747
+    ];
+    mainProgram = "headplane";
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+  };
+})
diff --git a/pkgs/by-name/hy/hyprpanel/package.nix b/pkgs/by-name/hy/hyprpanel/package.nix
index 5f22894d9556..458773a33908 100644
--- a/pkgs/by-name/hy/hyprpanel/package.nix
+++ b/pkgs/by-name/hy/hyprpanel/package.nix
@@ -49,7 +49,7 @@ in
 
 ags.bundle {
   pname = "hyprpanel";
-  version = "0-unstable-2026-03-23";
+  version = "0-unstable-2026-04-23";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -57,8 +57,8 @@ ags.bundle {
   src = fetchFromGitHub {
     owner = "Jas-SinghFSU";
     repo = "HyprPanel";
-    rev = "e919b4a8a8ab5f2a0752f68576ab3eed6993cefd";
-    hash = "sha256-92ZbaBfsEXEE7VaWJjv9aRSk3l9nyoYYyMe2AwTqSZI=";
+    rev = "1961ba86ad5ab880beb639e5454054b2b5037e0d";
+    hash = "sha256-QowlCOrE4jGOTDCUCEx/E8gHjqSx3r25y7v4dEBpBhk=";
   };
 
   # keep in sync with https://github.com/Jas-SinghFSU/HyprPanel/blob/master/flake.nix#L42
diff --git a/pkgs/by-name/in/inko/package.nix b/pkgs/by-name/in/inko/package.nix
index edcfe47691ab..4eec30faba04 100644
--- a/pkgs/by-name/in/inko/package.nix
+++ b/pkgs/by-name/in/inko/package.nix
@@ -15,16 +15,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "inko";
-  version = "0.19.1";
+  version = "0.20.0";
 
   src = fetchFromGitHub {
     owner = "inko-lang";
     repo = "inko";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ZHVOwYvNRL2ObZt2PvayoqvS64MumN4oXQOgeCWbEUM=";
+    hash = "sha256-Bisw84MwdLb2pgzwQ5zpZiyNHSWtdJ2QpaFn40x+SdI=";
   };
 
-  cargoHash = "sha256-BHrbqPMQnhw8pjN8e0/qW1rPe/fMhs2iUbRVPt5ATrg=";
+  cargoHash = "sha256-+3U3rMVF3qwyTIGOb/6NIxSBdiLuf/uY/VL3tYHte+c=";
 
   buildInputs = [
     libffi
diff --git a/pkgs/by-name/li/lilypond/package.nix b/pkgs/by-name/li/lilypond/package.nix
index 0fad1654d612..7e1265019c13 100644
--- a/pkgs/by-name/li/lilypond/package.nix
+++ b/pkgs/by-name/li/lilypond/package.nix
@@ -41,12 +41,11 @@
     ]
   ),
   writeScript,
-  fetchpatch2,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lilypond";
-  version = "2.24.4";
+  version = "2.26.0";
   outputs = [
     "out"
     "man"
@@ -54,7 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchzip {
     url = "https://lilypond.org/download/sources/v${lib.versions.majorMinor finalAttrs.version}/lilypond-${finalAttrs.version}.tar.gz";
-    hash = "sha256-UYdORvodrVchxslOxpMiXrAh7DtB9sWp9yqZU/jeB9Y=";
+    hash = "sha256-HUkPhaWNZ4UKbmlEyLXepHCFcgrdoRSDtjZMriO68RM=";
   };
 
   postInstall = ''
@@ -79,18 +78,6 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail "mem=mf2pt1" "mem=$PWD/mf/mf2pt1"
   '';
 
-  patches = [
-    # fixes #475503
-    # distilled version of https://gitweb.git.savannah.gnu.org/gitweb/?p=lilypond.git;a=commit;h=f2192eb294e
-    # so, remove once that commit reaches a stable release
-    (fetchpatch2 {
-      name = "fix-clang-21-build.patch";
-      url = "https://cgit.freebsd.org/ports/plain/print/lilypond/files/patch-lily_include_smobs.hh?id=58bab68c706086774b17dcacc61c8fd37ecc8a15";
-      extraPrefix = ""; # adds old/new prefixes to process properly in patchPhase
-      hash = "sha256-nT8+nYU+m6lLTvHEvSIpG/yAwy1Omb6+4Z+NGwEVE4Q=";
-    })
-  ];
-
   strictDeps = true;
 
   depsBuildBuild = [
diff --git a/pkgs/by-name/mo/mosquitto/package.nix b/pkgs/by-name/mo/mosquitto/package.nix
index 967eade3b7dd..ae3e932a0aa6 100644
--- a/pkgs/by-name/mo/mosquitto/package.nix
+++ b/pkgs/by-name/mo/mosquitto/package.nix
@@ -7,11 +7,13 @@
   libxslt,
   c-ares,
   cjson,
+  libargon2,
   libuuid,
   libuv,
   libwebsockets,
   openssl,
   withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
+  sqlite,
   systemd,
   uthash,
   nixosTests,
@@ -32,13 +34,17 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "mosquitto";
-  version = "2.0.22";
+  version = "2.1.2";
+  # Tests disabled: upstream test suite requires additional Python deps,
+  # uses chown() to fixed UIDs, and relies on signal handling that breaks
+  # in sandboxed builds. Re-enable once upstream tests are sandbox-friendly.
+  doCheck = false;
 
   src = fetchFromGitHub {
-    owner = "eclipse";
+    owner = "eclipse-mosquitto";
     repo = "mosquitto";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-PCiNxRG2AqVlS2t/u7Cqn8NbTrrYGO1OXl8zvPQRrJM=";
+    hash = "sha256-Zl55yjuzQY2fyaKs/zLaJ7a3OONKTDQPaT+DpPURdZI=";
   };
 
   postPatch = ''
@@ -63,22 +69,27 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     c-ares
     cjson
+    libargon2
     libuuid
     libuv
     libwebsockets'
     openssl
+    sqlite
     uthash
   ]
   ++ lib.optional withSystemd systemd;
 
+  propagatedBuildInputs = [ cjson ];
+
   cmakeFlags = [
     (lib.cmakeBool "WITH_BUNDLED_DEPS" false)
     (lib.cmakeBool "WITH_WEBSOCKETS" true)
     (lib.cmakeBool "WITH_SYSTEMD" withSystemd)
+    (lib.cmakeBool "WITH_TESTS" finalAttrs.doCheck)
   ];
 
   postFixup = ''
-    sed -i "s|^prefix=.*|prefix=$lib|g" $dev/lib/pkgconfig/*.pc
+    sed -i "s|^libdir=.*|libdir=$lib/lib|g" $dev/lib/pkgconfig/*.pc
   '';
 
   passthru.tests = {
diff --git a/pkgs/by-name/pm/pmix/package.nix b/pkgs/by-name/pm/pmix/package.nix
index 2e3b89a42735..20949e93ddbd 100644
--- a/pkgs/by-name/pm/pmix/package.nix
+++ b/pkgs/by-name/pm/pmix/package.nix
@@ -37,6 +37,20 @@ stdenv.mkDerivation (finalAttrs: {
     patchShebangs --build ./config
     patchShebangs --build ./contrib
     patchShebangs --build ./src/util/convert-help.py
+
+  ''
+  # 1. Remove the build information (options to configure and the CC path)
+  # These are hardcoded in the library and create an unwanted dependency
+  # on *.dev inputs.
+  # 2. Remove the reference to the pmix include directories, which are
+  # also hardcoded into the library (would be a cyclic reference).
+  + ''
+    substituteInPlace ./src/runtime/pmix_info_support.c \
+      --replace-fail 'PMIX_CONFIGURE_CLI' '""' \
+      --replace-fail 'PMIX_CC_ABSOLUTE' '""'
+
+    substituteInPlace ./src/mca/pinstalldirs/config/pinstall_dirs.h.in \
+      --replace-fail '@includedir@' ""
   '';
 
   nativeBuildInputs = [
@@ -91,10 +105,6 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   postFixup = lib.optionalString (lib.elem "dev" finalAttrs.outputs) ''
-    # The build info (parameters to ./configure) are hardcoded
-    # into the library. This clears all references to $dev/include.
-    remove-references-to -t "''${!outputDev}" $(readlink -f $out/lib/libpmix.so)
-
     # The path to the pmixcc-wrapper-data.txt is hard coded and
     # points to $out instead of dev. Use wrapper to fix paths.
     wrapProgram "''${!outputDev}"/bin/pmixcc \
diff --git a/pkgs/by-name/pu/pur/package.nix b/pkgs/by-name/pu/pur/package.nix
index 08e81672c2a9..ccef7e0df538 100644
--- a/pkgs/by-name/pu/pur/package.nix
+++ b/pkgs/by-name/pu/pur/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "pur";
-  version = "7.3.3";
+  version = "7.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "alanhamlett";
     repo = "pip-update-requirements";
     tag = finalAttrs.version;
-    hash = "sha256-zSEzYYpDmu3fennTZNvQjAoMekzxoMDUEqvSjN6hNUk=";
+    hash = "sha256-BxUR4yyT6ipvBozWgat709rNPHELE/PNPVJ4LtfOdfQ=";
   };
 
   build-system = with python3.pkgs; [ setuptools ];
diff --git a/pkgs/by-name/qo/qovery-cli/package.nix b/pkgs/by-name/qo/qovery-cli/package.nix
index d45a2917a2a7..70896bacfbf8 100644
--- a/pkgs/by-name/qo/qovery-cli/package.nix
+++ b/pkgs/by-name/qo/qovery-cli/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "qovery-cli";
-  version = "1.157.6";
+  version = "1.158.0";
 
   src = fetchFromGitHub {
     owner = "Qovery";
     repo = "qovery-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zkTiGo8QtcE4TrmYpuXBzq/b9IJQ4e3T3h11NbuFRM0=";
+    hash = "sha256-b6nvJPLMvqXM+hYJzOG65G15N+ErJnWySQrjJQmsMe8=";
   };
 
   vendorHash = "sha256-kENqEnk5RxN8kJ/dnXtG6ypnb8CPcOsHKid1z6uuKAc=";
diff --git a/pkgs/by-name/ri/river/build.zig.zon.nix b/pkgs/by-name/ri/river/build.zig.zon.nix
index 9ba533294dc2..b032b0550ee9 100644
--- a/pkgs/by-name/ri/river/build.zig.zon.nix
+++ b/pkgs/by-name/ri/river/build.zig.zon.nix
@@ -7,6 +7,14 @@
 }:
 
 linkFarm "zig-packages" [
+  {
+    name = "aro-0.0.0-JSD1Qi7QNgDnfcrdEJf82v3o6MhZySjYVrtdfEf3E4Se";
+    path = fetchgit {
+      url = "https://github.com/Vexu/arocc";
+      rev = "5f5a050569a95ecc40a426f0c3666ae7ef987ede";
+      hash = "sha256-f8Z0SXWx5Uia2TCMB5SUpcO8+xUnaWk32Oknva7xcxw=";
+    };
+  }
   {
     name = "pixman-0.3.0-LClMnz2VAAAs7QSCGwLimV5VUYx0JFnX5xWU6HwtMuDX";
     path = fetchzip {
@@ -15,24 +23,25 @@ linkFarm "zig-packages" [
     };
   }
   {
-    name = "wayland-0.4.0-lQa1khbMAQAsLS2eBR7M5lofyEGPIbu2iFDmoz8lPC27";
-    path = fetchzip {
-      url = "https://codeberg.org/ifreund/zig-wayland/archive/v0.4.0.tar.gz";
-      hash = "sha256-ulIII5iJpM/W/VJB0HcdktEO2eb9T9J0ln2A1Z94dU4=";
+    name = "translate_c-0.0.0-Q_BUWlX1BgCD1wo6uo97prlp9VJ4gxAjwN_vZ7nsSjGN";
+    path = fetchgit {
+      url = "https://codeberg.org/ziglang/translate-c/";
+      rev = "57c559cf581b1fcad90494eda219f98abeb155ce";
+      hash = "sha256-7OlW2f5tRc1UZySDcEQERsLGChSxIcJAiVWdvuFUvvY=";
     };
   }
   {
-    name = "wayland-0.5.0-lQa1knz8AQCh08NA8BeQrwJB9U3CfqcVAdHZYGRKIGuu";
+    name = "wayland-0.6.0-lQa1kqz8AQADQmdNJsNhLoNHcnEGEUjrOaPV-dtEnEmX";
     path = fetchzip {
-      url = "https://codeberg.org/ifreund/zig-wayland/archive/v0.5.0.tar.gz";
-      hash = "sha256-mhqOtC26iACIvQUq74AbLSXSPsnWMi3AvDV7G2uElpo=";
+      url = "https://codeberg.org/ifreund/zig-wayland/archive/v0.6.0.tar.gz";
+      hash = "sha256-3m/ITNhZUJ/5uD/Tqm+0uZSktGoYgWF5oldOqOCUkIE=";
     };
   }
   {
-    name = "wlroots-0.20.0-jmOlcmtCBADS6eoJ6mkeiSNZkibrhD-c5Qwn-LiM86r1";
+    name = "wlroots-0.20.1-jmOlcqNVBAB3uB5oqBTzpRlwu-FmMyyZMVAWCe5kmcSt";
     path = fetchzip {
-      url = "https://codeberg.org/ifreund/zig-wlroots/archive/v0.20.0.tar.gz";
-      hash = "sha256-QblQBVsDV2kSj31jqmVVi4hQUXuv8bsRgRMaCqlNxNM=";
+      url = "https://codeberg.org/ifreund/zig-wlroots/archive/v0.20.1.tar.gz";
+      hash = "sha256-cfzHJ2ziiCkMyNlIo6I9o/NjaZGrsv22hq41WYwCnpk=";
     };
   }
   {
diff --git a/pkgs/by-name/ri/river/package.nix b/pkgs/by-name/ri/river/package.nix
index 66439a4bff31..7e317651dba9 100644
--- a/pkgs/by-name/ri/river/package.nix
+++ b/pkgs/by-name/ri/river/package.nix
@@ -18,14 +18,16 @@
   wayland-scanner,
   wlroots_0_20,
   xwayland,
-  zig_0_15,
+  zig_0_16,
   withManpages ? true,
   xwaylandSupport ? true,
 }:
-
+let
+  zig = zig_0_16;
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "river";
-  version = "0.4.2";
+  version = "0.4.5";
 
   outputs = [ "out" ] ++ lib.optionals withManpages [ "man" ];
 
@@ -33,7 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "river";
     repo = "river";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Nufonz39XphxPW1lERq2acVgE5mGmW+x1yimyS6O4tc=";
+    hash = "sha256-q4JAlr9/ex+BEgktBmFwOvZzQEAGvxXPD1QyKqyha4g=";
   };
 
   strictDeps = true;
@@ -44,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     wayland-scanner
     xwayland
-    zig_0_15
+    zig
   ]
   ++ lib.optional withManpages scdoc;
 
diff --git a/pkgs/by-name/sp/sparkle/package.nix b/pkgs/by-name/sp/sparkle/package.nix
index b813676aea24..17bb24a7275d 100644
--- a/pkgs/by-name/sp/sparkle/package.nix
+++ b/pkgs/by-name/sp/sparkle/package.nix
@@ -43,20 +43,20 @@ in
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "sparkle";
-  version = "1.26.3";
+  version = "1.26.4";
 
   src = fetchFromGitHub {
     owner = "xishang0128";
     repo = "sparkle";
     tag = finalAttrs.version;
-    hash = "sha256-36eqSgXDl3ASDO4wn8cCptSE4qf3FwFyl+TEhCzhGwA=";
+    hash = "sha256-+3MHCy1N1/kOVFYDNvNiP/jkL0HHi2RwfeIqe2Z40O8=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-uiUp2YtPMvG0d9GIedxNzkY0TR/bdbWQv4IFiVZew5s=";
+    hash = "sha256-Us4qsCJdRZKYJQAgcqeStX7MfEqBWr4rKXBqU2K+KZI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/te/tev/package.nix b/pkgs/by-name/te/tev/package.nix
index 9479653c736f..6f2218c1e56a 100644
--- a/pkgs/by-name/te/tev/package.nix
+++ b/pkgs/by-name/te/tev/package.nix
@@ -24,14 +24,14 @@
 
 stdenv.mkDerivation rec {
   pname = "tev";
-  version = "2.10.0";
+  version = "2.11.0";
 
   src = fetchFromGitHub {
     owner = "Tom94";
     repo = "tev";
     tag = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-o8ejMsaiplnTLiWtjaJnV9z2ZNkiOWy3DLU+x49MJrg=";
+    hash = "sha256-o5Yrlt39RGKjtfqMfq3w/JTPORuKbxTIX5uuF4zmGXk=";
   };
 
   postPatch = lib.optionalString stdenv.hostPlatform.isLinux (
diff --git a/pkgs/by-name/ts/tsgolint/package.nix b/pkgs/by-name/ts/tsgolint/package.nix
index cf3c71ec0e5c..47ad1919995a 100644
--- a/pkgs/by-name/ts/tsgolint/package.nix
+++ b/pkgs/by-name/ts/tsgolint/package.nix
@@ -8,13 +8,13 @@
 
 buildGo126Module (finalAttrs: {
   pname = "tsgolint";
-  version = "0.22.0";
+  version = "0.22.1";
 
   src = fetchFromGitHub {
     owner = "oxc-project";
     repo = "tsgolint";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tB+39Z6KpNj6/mejB/+Zxe4evdlGAnQW1LJtH3pQlVw=";
+    hash = "sha256-v6gSUeBcjSx/3/hjBST3ba6N366GQvryVTeAjV5+zEc=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/vi/victoriametrics/package.nix b/pkgs/by-name/vi/victoriametrics/package.nix
index 4527404d8b23..4a0e3ce6fe63 100644
--- a/pkgs/by-name/vi/victoriametrics/package.nix
+++ b/pkgs/by-name/vi/victoriametrics/package.nix
@@ -13,13 +13,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "VictoriaMetrics";
-  version = "1.140.0";
+  version = "1.141.0";
 
   src = fetchFromGitHub {
     owner = "VictoriaMetrics";
     repo = "VictoriaMetrics";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-f/qcUSf/JMfe0rTUY5qT9k7MCVqsZCwRzsCv6puz6tw=";
+    hash = "sha256-eMaCChrv3/w7KNlnLdV1/YGGh4ZMGqeNAnMV1OlIQWE=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/xn/xnldorker/package.nix b/pkgs/by-name/xn/xnldorker/package.nix
index 81a088bc5788..4c50caf38c94 100644
--- a/pkgs/by-name/xn/xnldorker/package.nix
+++ b/pkgs/by-name/xn/xnldorker/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "xnldorker";
-  version = "4.3";
+  version = "4.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "xnl-h4ck3r";
     repo = "xnldorker";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YOYBEoYZBZfGtnJKku88XMj56JSN/EP9jLvqNXNqNJs=";
+    hash = "sha256-2Oh341KTxD47aZVTikDMFs6e4HGfQ77BPptksw+6w7s=";
   };
 
   build-system = with python3.pkgs; [ setuptools ];
diff --git a/pkgs/development/compilers/elm/packages/elm-review/default.nix b/pkgs/development/compilers/elm/packages/elm-review/default.nix
index 8c13a4ec29be..cb2b178dc335 100644
--- a/pkgs/development/compilers/elm/packages/elm-review/default.nix
+++ b/pkgs/development/compilers/elm/packages/elm-review/default.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "elm-review";
-  version = "2.13.4";
+  version = "2.13.5";
 
   src = fetchFromGitHub {
     owner = "jfmengels";
     repo = "node-elm-review";
     rev = "v${version}";
-    hash = "sha256-rhNLIShZERxrzdTdrPcthTQ+gHUikgR0jchBfcBDGTo=";
+    hash = "sha256-IjaPJ9ic/5Z8pdtziNwLqzXfnSmgkurjC6afmNIX4LU=";
   };
 
-  npmDepsHash = "sha256-mI94fYNKZ9Jx1Iyo/VjZqaXQ64tZA2S8mtn5l6TtCSc=";
+  npmDepsHash = "sha256-eY9U9mLVL9tizN8touWQfLqFAJJ8pHaSHVD//cvNdhE=";
 
   postPatch = ''
     sed -i "s/elm-tooling install/echo 'skipping elm-tooling install'/g" package.json
@@ -32,7 +32,7 @@ buildNpmPackage rec {
   };
 
   meta = {
-    changelog = "https://github.com/jfmengels/node-elm-review/blob/v${src.rev}/CHANGELOG.md";
+    changelog = "https://github.com/jfmengels/node-elm-review/blob/main/CHANGELOG.md";
     description = "Analyzes Elm projects, to help find mistakes before your users find them";
     mainProgram = "elm-review";
     homepage = "https://github.com/jfmengels/node-elm-review";
diff --git a/pkgs/development/compilers/go/tests.nix b/pkgs/development/compilers/go/tests.nix
index 3eeaa8b53262..4f433a303f3a 100644
--- a/pkgs/development/compilers/go/tests.nix
+++ b/pkgs/development/compilers/go/tests.nix
@@ -9,11 +9,11 @@
   runCommand,
   bintools,
   # A package with CGO_ENABLED=0
-  athens,
+  uplosi,
 }:
 let
   skopeo' = skopeo.override { buildGoModule = buildGoModule; };
-  athens' = athens.override { buildGoModule = buildGoModule; };
+  uplosi' = uplosi.override { buildGoModule = buildGoModule; };
   expectedCgoEnabledType = "DYN";
   expectedCgoDisabledType = "EXE";
 in
@@ -24,7 +24,7 @@ in
     command = "go version";
     version = "go${go.version}";
   };
-  athens = testers.testVersion { package = athens'; };
+  uplosi = testers.testVersion { package = uplosi'; };
 }
 # bin type tests assume ELF file + linux-specific exe types
 // lib.optionalAttrs stdenv.hostPlatform.isLinux {
@@ -41,13 +41,13 @@ in
       exit 1
     fi
   '';
-  athens-bin-type = runCommand "athens-bin-type" { meta.broken = stdenv.hostPlatform.isStatic; } ''
-    bin="${lib.getExe athens'}"
+  uplosi-bin-type = runCommand "uplosi-bin-type" { meta.broken = stdenv.hostPlatform.isStatic; } ''
+    bin="${lib.getExe uplosi'}"
     ${lib.optionalString (stdenv.buildPlatform == stdenv.targetPlatform) ''
       # For CGO_ENABLED=0 the internal linker should be used, except
       # for cross where we rely on external linking by default
-      if ${lib.getExe' bintools "readelf"} -p .comment ${lib.getExe athens'} | grep -Fq "GCC: (GNU)"; then
-        echo "${lib.getExe athens'} has a GCC .comment, but it should have used the internal go linker"
+      if ${lib.getExe' bintools "readelf"} -p .comment ${lib.getExe uplosi'} | grep -Fq "GCC: (GNU)"; then
+        echo "${lib.getExe uplosi'} has a GCC .comment, but it should have used the internal go linker"
         exit 1
       fi
     ''}
diff --git a/pkgs/development/compilers/julia/default.nix b/pkgs/development/compilers/julia/default.nix
index c087b25153f9..f07dec30a6b9 100644
--- a/pkgs/development/compilers/julia/default.nix
+++ b/pkgs/development/compilers/julia/default.nix
@@ -23,12 +23,12 @@ in
 {
   julia_110-bin = wrapJulia (
     callPackage (import ./generic-bin.nix {
-      version = "1.10.10";
+      version = "1.10.11";
       sha256 = {
-        x86_64-linux = "6a78a03a71c7ab792e8673dc5cedb918e037f081ceb58b50971dfb7c64c5bf81";
-        aarch64-linux = "a4b157ed68da10471ea86acc05a0ab61c1a6931ee592a9b236be227d72da50ff";
-        x86_64-darwin = "942b0d4accc9704861c7781558829b1d521df21226ad97bd01e1e43b1518d3e6";
-        aarch64-darwin = "52d3f82c50d9402e42298b52edc3d36e0f73e59f81fc8609d22fa094fbad18be";
+        x86_64-linux = "1grpvdzkh4b6mfdn1khbs1nz1b7q61rkzfip3q2x4330fjqwcjgv";
+        aarch64-linux = "1cn62bmrgz344zsml80rqpmryp8hk6bdni3zhh43lpqf8a0aj11h";
+        x86_64-darwin = "0jzk0kl1jvnav8ccarpwzfvyyzibfhrhfj72s3q17kzxwhpgbimx";
+        aarch64-darwin = "0nzh0zwjlagn4aglimyajmqv5m6qwdqz7lyjaszfxzyf1p0hcmxx";
       };
     }) { }
   );
@@ -57,8 +57,8 @@ in
   julia_110 = wrapJulia (
     callPackage
       (import ./generic.nix {
-        version = "1.10.10";
-        hash = "sha256-/NTIGLlcNu4sI1rICa+PS/Jn+YnWi37zFBcbfMnv3Ys=";
+        version = "1.10.11";
+        hash = "sha256-XItQngSzszyIGzSvqdXBV/yLQGDxf5x8SnrQ/DtzUtU=";
         patches = [
           # Revert https://github.com/JuliaLang/julia/pull/55354
           # [build] Some improvements to the LLVM build system
diff --git a/pkgs/development/compilers/zulu/17.nix b/pkgs/development/compilers/zulu/17.nix
index 45abea1fc783..dd86c89ecd5e 100644
--- a/pkgs/development/compilers/zulu/17.nix
+++ b/pkgs/development/compilers/zulu/17.nix
@@ -10,43 +10,43 @@ callPackage ./common.nix (
     # Note that the latest build may differ by platform
     dists = {
       x86_64-linux = {
-        zuluVersion = "17.52.17";
-        jdkVersion = "17.0.12";
+        zuluVersion = "17.64.17";
+        jdkVersion = "17.0.18";
         hash =
           if enableJavaFX then
-            "sha256-qKpkvk7/IEnlOJoy7An0AVGUXWkWeuuiQzqKKE/+Ec4="
+            "sha256-jQ2ByIKtivoc9nJ/LPMZCktyjceqXY+B6a36sXmwUbE="
           else
-            "sha256-JCRcjQzkkV2G5wsoi13psbTHjxCtuw5rqT4pEAOarRk=";
+            "sha256-gZ4/CepiiQGiGyEE7Y9SVuF66RpBRbJysushMfgyrx0=";
       };
 
       aarch64-linux = {
-        zuluVersion = "17.52.17";
-        jdkVersion = "17.0.12";
+        zuluVersion = "17.64.17";
+        jdkVersion = "17.0.18";
         hash =
           if enableJavaFX then
-            "sha256-mpTM/43oyDsOnoZM8AW1Z7EFTznnPAnYoC+T6csc8Fw="
+            "sha256-ciyywX9R72RRt6HPfdmmsgFo/0ebr2xzNhnroAEDT7E="
           else
-            "sha256-uIz2D5WjqySy5lobuvWp3kFTGsBKhXzT56QgCGyXwSY=";
+            "sha256-21fcnh+CIsL47604yMo2CxAR2Ln7m+oJVths1157Lb0=";
       };
 
       x86_64-darwin = {
-        zuluVersion = "17.52.17";
-        jdkVersion = "17.0.12";
+        zuluVersion = "17.64.17";
+        jdkVersion = "17.0.18";
         hash =
           if enableJavaFX then
-            "sha256-jb1oPmRzlYUMONovdsHowlC44X3/PFZ8KilxSsR924U="
+            "sha256-td551xWmeHcD26J0gxboKS6Y3f5iLRhcUy97pfxhHxk="
           else
-            "sha256-8VlGFUhCn3NE2A42xi69KzZqu0RoGOV1ZYj8oaqCnTc=";
+            "sha256-mHVhWicg6xAn8BaT4uCN93ChT8gYSYAfX7h7kRgdqyI=";
       };
 
       aarch64-darwin = {
-        zuluVersion = "17.52.17";
-        jdkVersion = "17.0.12";
+        zuluVersion = "17.64.17";
+        jdkVersion = "17.0.18";
         hash =
           if enableJavaFX then
-            "sha256-rEILTKTpX8DEoOGhlrhbxpcCyF2+QrjW92h0ox9ezp0="
+            "sha256-TnN+tPJ8HJSlZ0EUDq5SHo40EviO0iMX0P9eYHyRVP4="
           else
-            "sha256-RZ3hNQQFE+spTT9lFHLjmkolSkpHDg2Hvro6xi7uNww=";
+            "sha256-EiRGuK028dyAZ3Jy29rXH9XKjXbfd0wB54Oce/TSZ9Y=";
       };
     };
   }
diff --git a/pkgs/development/interpreters/python/pypy/default.nix b/pkgs/development/interpreters/python/pypy/default.nix
index bee93cf1451f..df4de47e13f2 100644
--- a/pkgs/development/interpreters/python/pypy/default.nix
+++ b/pkgs/development/interpreters/python/pypy/default.nix
@@ -390,7 +390,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     homepage = "https://www.pypy.org/";
-    changelog = "https://doc.pypy.org/en/stable/release-v${version}.html";
+    changelog = "https://doc.pypy.org/release-v${version}.html";
     description = "Fast, compliant alternative implementation of the Python language (${pythonVersion})";
     mainProgram = "pypy";
     license = lib.licenses.mit;
diff --git a/pkgs/development/ocaml-modules/checkseum/default.nix b/pkgs/development/ocaml-modules/checkseum/default.nix
index c1c86eac9df0..f3bb3358a11d 100644
--- a/pkgs/development/ocaml-modules/checkseum/default.nix
+++ b/pkgs/development/ocaml-modules/checkseum/default.nix
@@ -2,7 +2,6 @@
   lib,
   fetchurl,
   buildDunePackage,
-  ocaml,
   dune-configurator,
   optint,
   fmt,
@@ -14,14 +13,12 @@
 }:
 
 buildDunePackage (finalAttrs: {
-  version = "0.5.2";
+  version = "0.5.3";
   pname = "checkseum";
 
-  minimalOCamlVersion = "4.07";
-
   src = fetchurl {
     url = "https://github.com/mirage/checkseum/releases/download/v${finalAttrs.version}/checkseum-${finalAttrs.version}.tbz";
-    hash = "sha256-nl5P1EBctKi03wCHdUMlGDPgimSZ70LMuNulgt8Nr8g=";
+    hash = "sha256-uIwRmUNBITo1wj80Fou6enS/P4kFH3e+s52COtzhpTE=";
   };
 
   buildInputs = [ dune-configurator ];
@@ -38,7 +35,7 @@ buildDunePackage (finalAttrs: {
     rresult
   ];
 
-  doCheck = lib.versionAtLeast ocaml.version "4.08";
+  doCheck = true;
 
   meta = {
     description = "ADLER-32 and CRC32C Cyclic Redundancy Check";
diff --git a/pkgs/development/ocaml-modules/duration/default.nix b/pkgs/development/ocaml-modules/duration/default.nix
index ba42a8b3af17..ab27a0aa2bd4 100644
--- a/pkgs/development/ocaml-modules/duration/default.nix
+++ b/pkgs/development/ocaml-modules/duration/default.nix
@@ -1,23 +1,20 @@
 {
   lib,
   buildDunePackage,
-  ocaml,
   fetchurl,
   alcotest,
 }:
 
 buildDunePackage (finalAttrs: {
   pname = "duration";
-  version = "0.2.1";
-
-  duneVersion = "3";
+  version = "0.3.1";
 
   src = fetchurl {
     url = "https://github.com/hannesm/duration/releases/download/v${finalAttrs.version}/duration-${finalAttrs.version}.tbz";
-    hash = "sha256-xzjB84z7mYIMEhzT3fgZ3ksiKPDVDqy9HMPOmefHHis=";
+    hash = "sha256-zYjaaTlR4SEuqD4kzhf3Z+laOanOKt2gZUsy11zmjBM=";
   };
 
-  doCheck = lib.versionAtLeast ocaml.version "4.08";
+  doCheck = true;
   checkInputs = [ alcotest ];
 
   meta = {
diff --git a/pkgs/development/ocaml-modules/earlybird/default.nix b/pkgs/development/ocaml-modules/earlybird/default.nix
index d34201eb8414..90c50211c7c4 100644
--- a/pkgs/development/ocaml-modules/earlybird/default.nix
+++ b/pkgs/development/ocaml-modules/earlybird/default.nix
@@ -21,7 +21,7 @@
 
 buildDunePackage (finalAttrs: {
   pname = "earlybird";
-  version = "1.3.5";
+  version = "1.3.6";
 
   minimalOCamlVersion = "4.12";
 
@@ -29,7 +29,7 @@ buildDunePackage (finalAttrs: {
     owner = "hackwaly";
     repo = "ocamlearlybird";
     tag = finalAttrs.version;
-    hash = "sha256-QDRtuphOb02L75JyCF9K1NqvIdtWlfefeLG3HmJVHW4=";
+    hash = "sha256-UtJwb941JEIaE4zUlOWqFX3w0U7gFdYlYpKl+mZ1FNg=";
   };
 
   nativeBuildInputs = [ menhir ];
diff --git a/pkgs/development/php-packages/spx/default.nix b/pkgs/development/php-packages/spx/default.nix
index a6fb3c8f3563..bb6e2b61c95b 100644
--- a/pkgs/development/php-packages/spx/default.nix
+++ b/pkgs/development/php-packages/spx/default.nix
@@ -15,7 +15,7 @@ buildPecl {
   src = fetchFromGitHub {
     owner = "NoiseByNorthwest";
     repo = "php-spx";
-    rev = "v${version}";
+    tag = "v${version}";
     hash = "sha256-P53g/o4i+QETWdErZaGA3AREvnr8kL9h0B1BMQlKdFA=";
   };
 
@@ -25,7 +25,7 @@ buildPecl {
   ];
 
   meta = {
-    changelog = "https://github.com/NoiseByNorthwest/php-spx/releases/tag/${version}";
+    changelog = "https://github.com/NoiseByNorthwest/php-spx/releases/tag/v${version}";
     description = "Simple & straight-to-the-point PHP profiling extension with its built-in web UI";
     homepage = "https://github.com/NoiseByNorthwest/php-spx";
     license = lib.licenses.php301;
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index 38a50181c4e5..130dba4d66a8 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -358,13 +358,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "boto3-stubs";
-  version = "1.42.96";
+  version = "1.42.97";
   pyproject = true;
 
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit (finalAttrs) version;
-    hash = "sha256-HngZw00ero5ePPr50UT9ytZarRhLOASIhx3h0LKFGHk=";
+    hash = "sha256-9/R3WwhR/22w4/sJcGSvZDfk3jG3l9h0pzcQSZjgKMY=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/chromadb/default.nix b/pkgs/development/python-modules/chromadb/default.nix
index 000a11787feb..3a1f93ed3f04 100644
--- a/pkgs/development/python-modules/chromadb/default.nix
+++ b/pkgs/development/python-modules/chromadb/default.nix
@@ -68,19 +68,19 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "chromadb";
-  version = "1.5.7";
+  version = "1.5.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "chroma-core";
     repo = "chroma";
     tag = finalAttrs.version;
-    hash = "sha256-JrkfLwEL7iTL9P/4UDM4hFQtRL1JYH47dgZ1d+Mphqw=";
+    hash = "sha256-bxRRpwd7pmE+/JMARaqjuE+xFh8Qx70Aon2w56sOi1I=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-Szy2mSTriMwMViVTbI+0XaizcQBKh1Ncipf84moDREI=";
+    hash = "sha256-0vuXMxwbbpfMA0UcHcLieTJK6u67o6EYdJLH5Q+wtc8=";
   };
 
   # Can't use fetchFromGitHub as the build expects a zipfile
@@ -263,6 +263,11 @@ buildPythonPackage (finalAttrs: {
     "chromadb/test/test_client.py::test_http_client_with_inconsistent_host_settings[async_client]"
     "chromadb/test/test_client.py::test_http_client_with_inconsistent_port_settings[async_client]"
     "chromadb/test/test_client.py::test_http_client[async_client]"
+
+    # ValueError: Could not connect to a Chroma server.
+    "chromadb/test/property/test_add_mcmr.py::test_add_small[single-region]"
+    "chromadb/test/property/test_add_mcmr.py::test_add_medium[single-region]"
+    "chromadb/test/property/test_add_mcmr.py::test_add_large[single-region]"
   ];
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/groq/default.nix b/pkgs/development/python-modules/groq/default.nix
index 6abb7629726c..d38d2e3ad854 100644
--- a/pkgs/development/python-modules/groq/default.nix
+++ b/pkgs/development/python-modules/groq/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "groq";
-  version = "1.1.2";
+  version = "1.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "groq";
     repo = "groq-python";
     tag = "v${version}";
-    hash = "sha256-uOTttpjV2iislaink/0Jewkinyb2hYt0J+sv/OSuhJ4=";
+    hash = "sha256-PisqKpVM2KAlGgZDcCoFJhoib7WhuM1AkJOGYVimW0U=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/gymnasium/default.nix b/pkgs/development/python-modules/gymnasium/default.nix
index 89b8ba72f766..d163732a96f2 100644
--- a/pkgs/development/python-modules/gymnasium/default.nix
+++ b/pkgs/development/python-modules/gymnasium/default.nix
@@ -36,7 +36,7 @@
 
 buildPythonPackage rec {
   pname = "gymnasium";
-  version = "1.2.3";
+  version = "1.3.0";
 
   pyproject = true;
 
@@ -44,7 +44,7 @@ buildPythonPackage rec {
     owner = "Farama-Foundation";
     repo = "gymnasium";
     tag = "v${version}";
-    hash = "sha256-b712BPs7AS8UE8Zsu9GW/J6Vag9NB/x728MtQ5yrjbY=";
+    hash = "sha256-asQ/RqnmGRoVdwBkp4RIkqzGtQ7PnISt8/mRcXrNbBc=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index 060ad122b126..b32847cf3012 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202604271";
+  version = "0.1.202604281";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WKbjXsBprC/z4FFRaEztdGCRKdZ926muGUM6tCxLXu0=";
+    hash = "sha256-8evw78YKTofoMEp+yHdzN0NdMX5aeP63ax3DsBwaSYA=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/llama-index-llms-openai-like/default.nix b/pkgs/development/python-modules/llama-index-llms-openai-like/default.nix
index 97016414c49b..37a0fa6ce05e 100644
--- a/pkgs/development/python-modules/llama-index-llms-openai-like/default.nix
+++ b/pkgs/development/python-modules/llama-index-llms-openai-like/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "llama-index-llms-openai-like";
-  version = "0.7.1";
+  version = "0.7.2";
   pyproject = true;
 
   src = fetchPypi {
     pname = "llama_index_llms_openai_like";
     inherit (finalAttrs) version;
-    hash = "sha256-znzvNoax5i18CBNLTYylZwbMqBbkxAmOrt4zACgppvk=";
+    hash = "sha256-7Z/3P5ddzkcPmKxhyYIVG6eO7fo/ubA4lLwdExKyE/8=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 4c4db47e089a..25104ad786cf 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -167,8 +167,8 @@ in
       "sha256-BpJmc4Dq72eN7RPSpo51FAfpfrYRz7X/p6QBUpj2wuk=";
 
   mypy-boto3-billingconductor =
-    buildMypyBoto3Package "billingconductor" "1.42.7"
-      "sha256-ZQsHPgnPepj1HbBd37u76Fd1td4M7B5o6kId8FPP5yQ=";
+    buildMypyBoto3Package "billingconductor" "1.42.97"
+      "sha256-CsBeZk3+PmOx8ZLXVZQM/wR9PXsKJ4YD8PqfUjV/2ho=";
 
   mypy-boto3-braket =
     buildMypyBoto3Package "braket" "1.42.85"
@@ -571,8 +571,8 @@ in
       "sha256-N0kQ7Fc44SFKXhl4V+oAclPNlWhluOs53NDokiXcSNM=";
 
   mypy-boto3-glue =
-    buildMypyBoto3Package "glue" "1.42.89"
-      "sha256-U+NzY02OyhR/GbZy+2Ye3+FgAVzF/UTNhUH3fy9SmMc=";
+    buildMypyBoto3Package "glue" "1.42.97"
+      "sha256-YtkjsZejVm6IHku0Iz0KYjRIo4LpI/DsYSn77a+O1tE=";
   mypy-boto3-grafana =
     buildMypyBoto3Package "grafana" "1.42.51"
       "sha256-QHAuRJrioMD7ASgV1Wobm81Gb+Z87c78yBs9X1+Kz+E=";
@@ -694,8 +694,8 @@ in
       "sha256-Q6ypzi2rIhj5oECPe/Xz6GoKU8Uu04PdpdGvMgxjpnc=";
 
   mypy-boto3-ivs =
-    buildMypyBoto3Package "ivs" "1.42.94"
-      "sha256-deZSEEfLk/ml9447Y4G5PPSj3OJHt/XHRfeD1CdBWBE=";
+    buildMypyBoto3Package "ivs" "1.42.97"
+      "sha256-UBVezeWNDLG2drCDZjKR5sgQBmKtZ8wZv1dLvI6OCx0=";
 
   mypy-boto3-ivs-realtime =
     buildMypyBoto3Package "ivs-realtime" "1.42.86"
@@ -758,8 +758,8 @@ in
       "sha256-x9ntwcOhUm5Hsd/L+O5N77xJ/NWxgQhNVdtaaShM7p8=";
 
   mypy-boto3-kms =
-    buildMypyBoto3Package "kms" "1.42.50"
-      "sha256-bCVvuhK3mpTeNDYDYaACVWgQMhKR9mIi9BbbCI0ynCA=";
+    buildMypyBoto3Package "kms" "1.42.97"
+      "sha256-VyPK4Jin6POXMX/A0zzOd2Fd9CQyzDqR1qpFprMvxsA=";
 
   mypy-boto3-lakeformation =
     buildMypyBoto3Package "lakeformation" "1.42.79"
@@ -806,8 +806,8 @@ in
       "sha256-UBSxl5YmYh3m4gl4iKdDU2McetKuDcLkiR73Yvf0AQQ=";
 
   mypy-boto3-logs =
-    buildMypyBoto3Package "logs" "1.42.96"
-      "sha256-MU6OS6h65vu4ILnioSVFSjptSkCow4T2qbTky2vo8ao=";
+    buildMypyBoto3Package "logs" "1.42.97"
+      "sha256-Vy973itXZ2B1hsp/f6D8X2QN290L+5QcuelK43H7bNU=";
 
   mypy-boto3-lookoutequipment =
     buildMypyBoto3Package "lookoutequipment" "1.42.3"
@@ -906,8 +906,8 @@ in
       "sha256-kFHGogiCfbftZr67o8zT7eb8na74J4AGneac03q+Pvc=";
 
   mypy-boto3-mgn =
-    buildMypyBoto3Package "mgn" "1.42.68"
-      "sha256-zrUwEeofbz+Tj7GgHzOzodYzsnPKqAISOuRGG6B7rpY=";
+    buildMypyBoto3Package "mgn" "1.42.97"
+      "sha256-45OfbZhzJ6bEZo+qIfvIc++26MeRThRp162iyWWQNEo=";
 
   mypy-boto3-migration-hub-refactor-spaces =
     buildMypyBoto3Package "migration-hub-refactor-spaces" "1.42.3"
@@ -962,12 +962,12 @@ in
       "sha256-CGt/WuKol9nVwLHEwNgEsQDzIBhFarJNbq30OpiK0+I=";
 
   mypy-boto3-omics =
-    buildMypyBoto3Package "omics" "1.42.78"
-      "sha256-h0urK602L1j2CtD1xsUOMaXizzc2CxbttMlaSNyQNoM=";
+    buildMypyBoto3Package "omics" "1.42.97"
+      "sha256-7eLIW6ucZ/KQ/yGFinkBAPLKXOBKdd9RpxUromwqc6c=";
 
   mypy-boto3-opensearch =
-    buildMypyBoto3Package "opensearch" "1.42.95"
-      "sha256-CGCwYDcgttsyYSKUB2kVVeeOxtT6svLxR+fDFtjZ854=";
+    buildMypyBoto3Package "opensearch" "1.42.97"
+      "sha256-jAtx5h6lBgoBf/nzt7WO/QC+ZGFBGGCC6OF9OmkAqYY=";
 
   mypy-boto3-opensearchserverless =
     buildMypyBoto3Package "opensearchserverless" "1.42.75"
@@ -1170,8 +1170,8 @@ in
       "sha256-juVfwdjPDNPaT5tvyXpzDtomugqxeu++AERLkVtFIxw=";
 
   mypy-boto3-sagemaker =
-    buildMypyBoto3Package "sagemaker" "1.42.93"
-      "sha256-ZxPcCnneSMwI0Yl3TiiMxim9FIBzen4hC5X76Dhnd7U=";
+    buildMypyBoto3Package "sagemaker" "1.42.97"
+      "sha256-FGjRmINeQxxdn20Jn7SvjwYfpDZdfDys/VTC6fzGov0=";
 
   mypy-boto3-sagemaker-a2i-runtime =
     buildMypyBoto3Package "sagemaker-a2i-runtime" "1.42.3"
@@ -1422,8 +1422,8 @@ in
       "sha256-bxh+mhwsHHwt/cx/njegTa/QGHu+xa7YPg4SRos1deM=";
 
   mypy-boto3-workspaces =
-    buildMypyBoto3Package "workspaces" "1.42.66"
-      "sha256-HFB5MRlLqUlk2KSwh6Fzv352mTR3ComSRK0vwNVxwoQ=";
+    buildMypyBoto3Package "workspaces" "1.42.97"
+      "sha256-WLheY3TM39Li6b6cvzsEgNTMplDikmoh5zuQ0aRLNAk=";
 
   mypy-boto3-workspaces-web =
     buildMypyBoto3Package "workspaces-web" "1.42.51"
diff --git a/pkgs/development/python-modules/oelint-data/default.nix b/pkgs/development/python-modules/oelint-data/default.nix
index ba54ec5d1ec5..d69acef6d247 100644
--- a/pkgs/development/python-modules/oelint-data/default.nix
+++ b/pkgs/development/python-modules/oelint-data/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "oelint-data";
-  version = "1.4.11";
+  version = "1.4.12";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "priv-kweihmann";
     repo = "oelint-data";
     tag = finalAttrs.version;
-    hash = "sha256-zd4SmDIHtOKYK19tr/72CIKAfhWtm7957Ax7b2kAXdw=";
+    hash = "sha256-Q+h5qSCvybxO+RojDNoS6g1Bt/fLpiWVJHRiMkgPpvY=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pyqt6-charts/default.nix b/pkgs/development/python-modules/pyqt6-charts/default.nix
index 92eb9ac0b9d7..a5234ebce56c 100644
--- a/pkgs/development/python-modules/pyqt6-charts/default.nix
+++ b/pkgs/development/python-modules/pyqt6-charts/default.nix
@@ -12,13 +12,13 @@
 
 buildPythonPackage rec {
   pname = "pyqt6-charts";
-  version = "6.10.0";
+  version = "6.11.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "pyqt6_charts";
     inherit version;
-    hash = "sha256-keFeKNARyqTIOIGpBoezXj0F71cpDN2XYIJMlb2saj4=";
+    hash = "sha256-EJHNkZgGo84F0idnKfeb5Oy9CpOVAKiJkCbD71dpxlA=";
   };
 
   # fix include path and increase verbosity
diff --git a/pkgs/development/python-modules/pyqt6-webengine/default.nix b/pkgs/development/python-modules/pyqt6-webengine/default.nix
index d1894ca206dd..009390998e4c 100644
--- a/pkgs/development/python-modules/pyqt6-webengine/default.nix
+++ b/pkgs/development/python-modules/pyqt6-webengine/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage rec {
   pname = "pyqt6-webengine";
-  version = "6.10.0";
+  version = "6.11.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "pyqt6_webengine";
     inherit version;
-    hash = "sha256-Jn0nJ10Mea4nC8pLA1IKQfp+hcKk2WMtqMucwjOlWtE=";
+    hash = "sha256-Fc9J77u9TGvIdlOyxK6A1gSfgA4xYgszZzSuLjfL7a4=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/stable-baselines3/default.nix b/pkgs/development/python-modules/stable-baselines3/default.nix
index cb752b201af5..efa234413391 100644
--- a/pkgs/development/python-modules/stable-baselines3/default.nix
+++ b/pkgs/development/python-modules/stable-baselines3/default.nix
@@ -24,6 +24,7 @@ buildPythonPackage (finalAttrs: {
   pname = "stable-baselines3";
   version = "2.8.0";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "DLR-RM";
@@ -34,6 +35,9 @@ buildPythonPackage (finalAttrs: {
 
   build-system = [ setuptools ];
 
+  pythonRelaxDeps = [
+    "gymnasium"
+  ];
   dependencies = [
     cloudpickle
     gymnasium
@@ -58,6 +62,12 @@ buildPythonPackage (finalAttrs: {
     "tests/test_dict_env.py"
     "tests/test_her.py"
     "tests/test_save_load.py"
+
+    # gymnasium.error.DeprecatedEnv: Environment version v3 for `Taxi` is deprecated.
+    # Please use `Taxi-v4` instead.
+    "tests/test_spaces.py::test_discrete_obs_space[Taxi-v3-A2C]"
+    "tests/test_spaces.py::test_discrete_obs_space[Taxi-v3-DQN]"
+    "tests/test_spaces.py::test_discrete_obs_space[Taxi-v3-PPO]"
   ];
 
   disabledTests = [
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index c4467b850b73..0b082f532648 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "tencentcloud-sdk-python";
-  version = "3.1.85";
+  version = "3.1.87";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = finalAttrs.version;
-    hash = "sha256-8uJNo4gDUlY4oX1cMrJtrwGYc0la2nac+rjHBRoPAj8=";
+    hash = "sha256-KxKUZNGn3SYxI9W4gJHRcWQMTUAxdgYiwNUbYKYaCp8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/servers/firebird/default.nix b/pkgs/servers/firebird/default.nix
index e90ec51768f9..96523788522a 100644
--- a/pkgs/servers/firebird/default.nix
+++ b/pkgs/servers/firebird/default.nix
@@ -105,7 +105,7 @@ rec {
         owner = "FirebirdSQL";
         repo = "firebird";
         rev = "v${version}";
-        hash = "sha256-EnD0cTQSOh1fARjKdoOCR5UjpvVA96EZVVWfqlH+m48=";
+        hash = "sha256-4u1Vgwk5cMCkrGfGSk2xO7hVHiDda0ioitvX/r3KPQc=";
       };
 
       nativeBuildInputs = base.nativeBuildInputs ++ [ unzip ];
@@ -126,7 +126,8 @@ rec {
         owner = "FirebirdSQL";
         repo = "firebird";
         rev = "v${version}";
-        hash = "sha256-wAiOyCVS7fjVqrDlJJwDFxw5ZD5spnXlYKCAQ8gctHI=";
+        fetchSubmodules = true;
+        hash = "sha256-IJrfs8q7GtX4Y+Cmg4avT5QJmLpld38tyR3TR1CcgyE=";
       };
 
       # CMake is just used for libcds
diff --git a/pkgs/servers/vinyl-cache/default.nix b/pkgs/servers/vinyl-cache/default.nix
new file mode 100644
index 000000000000..11f4438ea787
--- /dev/null
+++ b/pkgs/servers/vinyl-cache/default.nix
@@ -0,0 +1,133 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  buildPackages,
+  pcre2,
+  jemalloc,
+  libunwind,
+  libxslt,
+  groff,
+  ncurses,
+  pkg-config,
+  readline,
+  libedit,
+  coreutils,
+  python3,
+  makeWrapper,
+  nixosTests,
+}:
+
+let
+  generic =
+    {
+      version,
+      hash,
+    }:
+    stdenv.mkDerivation (finalAttrs: {
+      pname = "vinyl-cache";
+      inherit version;
+
+      src = fetchurl {
+        url = "https://vinyl-cache.org/downloads/${finalAttrs.pname}-${version}.tgz";
+        inherit hash;
+      };
+
+      __structuredAttrs = true;
+      strictDeps = true;
+
+      nativeBuildInputs = [
+        pkg-config
+        python3.pkgs.docutils
+        python3.pkgs.sphinx
+        makeWrapper
+      ];
+
+      buildInputs = [
+        libxslt
+        groff
+        ncurses
+        readline
+        libedit
+        pcre2
+        python3
+      ]
+      ++ lib.optional stdenv.hostPlatform.isDarwin libunwind
+      ++ lib.optional stdenv.hostPlatform.isLinux jemalloc;
+
+      configureFlags = [
+        # the checks behind those to not work when doing cross but for simplicity we always define them
+        "ac_cv_have_tcp_fastopen=yes"
+        "ac_cv_have_tcp_keep=yes"
+        "ac_cv_have_working_close_range=yes"
+        "PYTHON=${buildPackages.python3.interpreter}"
+      ];
+
+      buildFlags = [ "localstatedir=/var/run" ];
+
+      postPatch = ''
+        substituteInPlace bin/vinyltest/vtest2/src/vtc_main.c --replace-fail /bin/rm "${coreutils}/bin/rm"
+      '';
+
+      postConfigure = lib.optionalString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+        # prevent cache invalidation
+        substituteInPlace bin/vinyld/Makefile \
+          --replace-fail "vhp_hufdec.h: vhp_gen_hufdec" "vhp_hufdec.h:"
+
+        ln -s "${buildPackages.vinyl.vhp_hufdec_h}" bin/vinyld/vhp_hufdec.h
+
+        substituteInPlace bin/vinylstat/Makefile \
+          --replace-fail "vinylstat_curses_help.c: vinylstat_help_gen" "vinylstat_curses_help.c:" \
+          --replace-fail "./vinylstat_help_gen" "${buildPackages.vinyl}/bin/vinylstat_help_gen"
+
+        # the docs execute lots of commands to gather options and flags
+        substituteInPlace doc/Makefile \
+          --replace-fail "SUBDIRS = graphviz sphinx" "SUBDIRS = graphviz"
+        substituteInPlace Makefile \
+          --replace-fail "include lib bin vmod etc doc man contrib" "include lib bin vmod etc doc contrib"
+      '';
+
+      postInstall = ''
+        wrapProgram "$out/sbin/vinyld" --prefix PATH : "${lib.makeBinPath [ stdenv.cc ]}"
+      ''
+      + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+        cp bin/vinyld/vhp_hufdec.h $vhp_hufdec_h
+      '';
+
+      # https://github.com/varnishcache/varnish-cache/issues/1875
+      env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isi686 "-fexcess-precision=standard";
+
+      outputs = [
+        "out"
+        "dev"
+      ]
+      ++ lib.optionals (stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+        "man"
+        "vhp_hufdec_h" # only used for cross compilation
+      ];
+
+      passthru = {
+        python = python3;
+        tests = nixosTests."vinyl-cache_${lib.versions.major version}";
+      };
+
+      meta = {
+        description = "Web application accelerator also known as a caching HTTP reverse proxy";
+        homepage = "https://vinyl-cache.org";
+        license = lib.licenses.bsd2;
+        maintainers = [
+          lib.maintainers.leona
+          lib.maintainers.osnyx
+        ];
+        platforms = lib.platforms.unix;
+        broken = stdenv.hostPlatform.isDarwin;
+      };
+    });
+in
+{
+  # EOL 2027-03-16
+  vinyl-cache_9 = generic {
+    version = "9.0.0";
+    hash = "sha256-l0DCEMKndifVD9CtbHWdw8oJT8tOZVW6VfynHPSDvRc=";
+  };
+}
diff --git a/pkgs/tools/package-management/lix/default.nix b/pkgs/tools/package-management/lix/default.nix
index aa635e3e943a..dc16f7ab3cd4 100644
--- a/pkgs/tools/package-management/lix/default.nix
+++ b/pkgs/tools/package-management/lix/default.nix
@@ -238,14 +238,14 @@ lib.makeExtensible (
       attrName = "git";
 
       lix-args = rec {
-        version = "2.96.0-pre-20260318_${builtins.substring 0 12 src.rev}";
+        version = "2.96.0-pre-20260408_${builtins.substring 0 12 src.rev}";
 
         src = fetchFromGitea {
           domain = "git.lix.systems";
           owner = "lix-project";
           repo = "lix";
-          rev = "8294cd534b2f01ee967b28aa73fcab1535d62b3d";
-          hash = "sha256-BFijbNDCrfzpDdW+gNauP25QsTvEZ39dygWEI/RYeyY=";
+          rev = "bc9fb560ac2d36cd317a856ee96785ea2055fbff";
+          hash = "sha256-bONRPjhk5OZdnkQZexZNJzlvwIPg31Gy7fNiwGoX3BQ=";
         };
 
         cargoDeps = rustPlatform.fetchCargoVendor {
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 2418383e23bd..8b5fd13eab3e 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1804,6 +1804,7 @@ mapAliases {
   rke2_1_29 = throw "'rke2_1_29' has been removed from nixpkgs as it has reached end of life"; # Added 2025-05-05
   rke2_1_30 = throw "'rke2_1_30' has been removed from nixpkgs as it has reached end of life"; # Added 2025-11-04
   rke2_1_31 = throw "'rke2_1_31' has been removed from nixpkgs as it has reached end of life"; # Added 2025-12-08
+  rke2_1_32 = throw "'rke2_1_32' has been removed from nixpkgs as it has reached end of life"; # Added 2026-04-04
   rl_json = throw "'rl_json' has been renamed to/replaced by 'tclPackages.rl_json'"; # Converted to throw 2025-10-27
   rockbox_utility = throw "'rockbox_utility' has been renamed to/replaced by 'rockbox-utility'"; # Converted to throw 2025-10-27
   rockcraft = throw "rockcraft was removed in Sep 25 following removal of LXD from nixpkgs"; # Added 2025-09-18
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0aedba47158f..74542d928492 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3520,6 +3520,12 @@ with pkgs;
   varnishPackages = varnish80Packages;
   varnish = varnishPackages.varnish;
 
+  inherit (callPackages ../servers/vinyl-cache { })
+    vinyl-cache_9
+    ;
+
+  vinyl-cache = vinyl-cache_9;
+
   vncdo = with python3Packages; toPythonApplication vncdo;
 
   # An alias to work around the splicing incidents
@@ -10192,7 +10198,6 @@ with pkgs;
       callPackage ../applications/networking/instant-messengers/ripcord/darwin.nix { };
 
   inherit (callPackage ../applications/networking/cluster/rke2 { })
-    rke2_1_32
     rke2_1_33
     rke2_1_34
     rke2_1_35