diff --git a/ci/eval/compare/default.nix b/ci/eval/compare/default.nix
index 4d651afe092e..e596b6d1994f 100644
--- a/ci/eval/compare/default.nix
+++ b/ci/eval/compare/default.nix
@@ -172,6 +172,7 @@ let
       rebuildCountByKernel = lib.mapAttrs (
         kernel: kernelRebuilds: lib.length kernelRebuilds
       ) rebuildsByKernel;
+      rebuildNames = extractPackageNames diffAttrs.rebuilds;
     in
     writeText "changed-paths.json" (
       builtins.toJSON {
@@ -188,7 +189,8 @@ let
             kernel: rebuilds: lib.nameValuePair "10.rebuild-${kernel}-stdenv" (lib.elem "stdenv" rebuilds)
           ) rebuildsByKernel
           // {
-            "10.rebuild-nixos-tests" = lib.elem "nixosTests.simple" (extractPackageNames diffAttrs.rebuilds);
+            "10.rebuild-nixos-tests" =
+              lib.elem "nixosTests.simple-container" rebuildNames || lib.elem "nixosTests.simple-vm" rebuildNames;
           };
       }
     );
diff --git a/ci/eval/outpaths.nix b/ci/eval/outpaths.nix
index 6c29ff403b47..afbce48f3321 100755
--- a/ci/eval/outpaths.nix
+++ b/ci/eval/outpaths.nix
@@ -108,6 +108,8 @@ in
 tweak (
   (removeAttrs nixpkgsJobs blacklist)
   // {
-    nixosTests = lib.filterAttrs (name: _: name == "simple") nixosJobs.tests;
+    nixosTests = lib.filterAttrs (
+      name: _: name == "simple-container" || name == "simple-vm"
+    ) nixosJobs.tests;
   }
 )
diff --git a/ci/github-script/check-target-branch.js b/ci/github-script/check-target-branch.js
index cdb2670aeac0..01c062d410ab 100644
--- a/ci/github-script/check-target-branch.js
+++ b/ci/github-script/check-target-branch.js
@@ -99,7 +99,8 @@ async function checkTargetBranch({ github, context, core, dry }) {
     ...Object.values(changed.rebuildCountByKernel),
   )
   const rebuildsAllTests =
-    changed.attrdiff.changed.includes('nixosTests.simple')
+    changed.attrdiff.changed.includes('nixosTests.simple-container') ||
+    changed.attrdiff.changed.includes('nixosTests.simple-vm')
 
   // https://github.com/NixOS/nixpkgs/pull/481205#issuecomment-3790123921
   // These should go to staging-nixos instead of master,
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index e37ff00cb911..8276726f45e6 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -28117,12 +28117,6 @@
     githubId = 50843046;
     name = "tornax";
   };
-  toschmidt = {
-    email = "tobias.schmidt@in.tum.de";
-    github = "toschmidt";
-    githubId = 27586264;
-    name = "Tobias Schmidt";
-  };
   totalchaos = {
     email = "basil.keeler@outlook.com";
     github = "totalchaos05";
diff --git a/nixos/lib/test-driver/src/test_driver/machine/__init__.py b/nixos/lib/test-driver/src/test_driver/machine/__init__.py
index 3dc4f1f8d171..790da705cf4f 100644
--- a/nixos/lib/test-driver/src/test_driver/machine/__init__.py
+++ b/nixos/lib/test-driver/src/test_driver/machine/__init__.py
@@ -1475,7 +1475,6 @@ class NspawnMachine(BaseMachine):
 
         self.start_command = start_command
         self.process = None
-        self.pid = None
 
         self.machine_sock_path = self.tmp_dir / f"{self.name}-nspawn.sock"
 
@@ -1486,14 +1485,13 @@ class NspawnMachine(BaseMachine):
         return f'ssh -o User=root -o ProxyCommand="{proxy_cmd}" bash'
 
     def release(self) -> None:
-        if self.pid is None:
+        if self.process is None:
             return
 
         if self.machine_sock:
             self.machine_sock.close()
 
-        self.logger.info(f"kill NspawnMachine (pid {self.pid})")
-        assert self.process is not None
+        self.logger.info(f"kill NspawnMachine (pid {self.process.pid})")
         self.process.terminate()
         # Wait for the wrapper to finish its context-manager cleanups
         # (veth/bridge/netns teardown) before returning, so the driver's
@@ -1502,7 +1500,7 @@ class NspawnMachine(BaseMachine):
             self.process.wait(timeout=30)
         except subprocess.TimeoutExpired:
             self.logger.error(
-                f"NspawnMachine {self.name} (pid {self.pid}) did not exit after SIGTERM; sending SIGKILL"
+                f"NspawnMachine {self.name} (pid {self.process.pid}) did not exit after SIGTERM; sending SIGKILL"
             )
             self.process.kill()
             self.process.wait()
@@ -1694,9 +1692,7 @@ class NspawnMachine(BaseMachine):
             stdout=subprocess.PIPE,
         )
 
-        self.pid = self.process.pid
-
-        self.log(f"systemd-nspawn running (pid {self.pid})")
+        self.log(f"systemd-nspawn running (pid {self.process.pid})")
 
         journal_thread = threading.Thread(target=self._stream_journal, daemon=True)
         journal_thread.start()
diff --git a/nixos/modules/services/desktops/seatd.nix b/nixos/modules/services/desktops/seatd.nix
index bedcc9a43120..939b9f338af9 100644
--- a/nixos/modules/services/desktops/seatd.nix
+++ b/nixos/modules/services/desktops/seatd.nix
@@ -40,7 +40,6 @@ in
   config = lib.mkIf cfg.enable {
     environment.systemPackages = with pkgs; [
       seatd
-      sdnotify-wrapper
     ];
     users.groups.seat = lib.mkIf (cfg.group == "seat") { };
 
@@ -55,7 +54,7 @@ in
         Type = "notify";
         NotifyAccess = "all";
         SyslogIdentifier = "seatd";
-        ExecStart = "${pkgs.sdnotify-wrapper}/bin/sdnotify-wrapper ${pkgs.seatd.bin}/bin/seatd -n 1 -u ${cfg.user} -g ${cfg.group} -l ${cfg.logLevel}";
+        ExecStart = "${lib.getExe' pkgs.s6 "s6-notify-socket-from-fd"} ${pkgs.seatd.bin}/bin/seatd -n 1 -u ${cfg.user} -g ${cfg.group} -l ${cfg.logLevel}";
         RestartSec = 1;
         Restart = "always";
       };
diff --git a/nixos/modules/services/display-managers/gdm.nix b/nixos/modules/services/display-managers/gdm.nix
index 79eb5b4537cc..dd043cbf272a 100644
--- a/nixos/modules/services/display-managers/gdm.nix
+++ b/nixos/modules/services/display-managers/gdm.nix
@@ -45,9 +45,19 @@ let
 
   setSessionScript = pkgs.callPackage ../x11/display-managers/account-service-util.nix { };
 
-  greeterEnvFile = pkgs.writeText "gdm-greeter-env" ''
-    DCONF_PROFILE=gdm
-  '';
+  greeterUsers = lib.genAttrs' [ null 1 2 3 4 ] (
+    i:
+    let
+      # adding 1 to create `gdm-greeter{-2,-3,-4,-5}`
+      suffix = lib.optionalString (i != null) "-${toString (i + 1)}";
+    in
+    lib.nameValuePair "gdm-greeter${suffix}" {
+      isSystemUser = true;
+      uid = 60578 + (if i == null then 0 else i);
+      group = "gdm";
+      home = "/run/gdm/home/gdm-greeter${suffix}";
+    }
+  );
 in
 
 {
@@ -190,6 +200,8 @@ in
 
   config = lib.mkIf cfg.enable {
 
+    warnings = lib.optional config.services.pulseaudio.enable "Support for Pulseaudio + gdm will be removed in NixOS 26.11";
+
     services.xserver.displayManager.lightdm.enable = false;
 
     users.users = lib.mkMerge [
@@ -200,24 +212,8 @@ in
           group = "gdm";
           description = "GDM user";
         };
-
-        gdm-greeter = {
-          isSystemUser = true;
-          uid = 60578;
-          group = "gdm";
-          home = "/run/gdm";
-        };
       }
-
-      (lib.genAttrs' [ 1 2 3 4 ] (
-        i:
-        lib.nameValuePair "gdm-greeter-${toString i}" {
-          isSystemUser = true;
-          uid = 60578 + i;
-          group = "gdm";
-          home = "/run/gdm-${toString i}";
-        }
-      ))
+      greeterUsers
     ];
 
     users.groups.gdm.gid = config.ids.gids.gdm;
@@ -259,17 +255,20 @@ in
       };
     };
 
-    systemd.tmpfiles.rules = [
-      "d /run/gdm/.config 0711 gdm gdm"
-    ]
-    ++ lib.optionals config.services.pulseaudio.enable [
-      "d /run/gdm/.config/pulse 0711 gdm gdm"
-      "L+ /run/gdm/.config/pulse/${pulseConfig.name} - - - - ${pulseConfig}"
-    ]
-    ++ lib.optionals config.services.gnome.gnome-initial-setup.enable [
-      # Create stamp file for gnome-initial-setup to prevent it starting in GDM.
-      "f /run/gdm/.config/gnome-initial-setup-done 0711 gdm gdm - yes"
-    ];
+    systemd.tmpfiles.rules =
+      lib.optionals config.services.pulseaudio.enable (
+        lib.concatLists (
+          lib.mapAttrsToList (name: user: [
+            "d ${user.home}/.config 0711 ${name} gdm"
+            "d ${user.home}/.config/pulse 0711 ${name} gdm"
+            "L+ ${user.home}/.config/pulse/${pulseConfig.name} - - - - ${pulseConfig}"
+          ]) greeterUsers
+        )
+      )
+      ++ lib.optionals config.services.gnome.gnome-initial-setup.enable [
+        # Create stamp file for gnome-initial-setup to prevent it starting in GDM.
+        "f /run/gdm/gdm.ran-initial-setup 0711 gdm gdm - yes"
+      ];
 
     # Otherwise GDM will not be able to start correctly and display Wayland sessions
     systemd.packages = [
@@ -456,12 +455,6 @@ in
               settings.conffile = "/etc/pam/environment";
               settings.readenv = 0;
             }
-            {
-              name = "env-greeter";
-              control = "required";
-              modulePath = "${config.security.pam.package}/lib/security/pam_env.so";
-              settings.envfile = greeterEnvFile;
-            }
             {
               name = "systemd";
               control = "optional";
diff --git a/nixos/modules/system/boot/systemd/initrd.nix b/nixos/modules/system/boot/systemd/initrd.nix
index 9727fe33d23c..f242cb8c6a5b 100644
--- a/nixos/modules/system/boot/systemd/initrd.nix
+++ b/nixos/modules/system/boot/systemd/initrd.nix
@@ -7,9 +7,29 @@
   ...
 }:
 
-with lib;
-
 let
+  inherit (lib)
+    filter
+    elem
+    filterAttrs
+    concatLists
+    mapAttrsToList
+    getBin
+    concatStringsSep
+    mkEnableOption
+    mkOption
+    types
+    literalExpression
+    mkIf
+    any
+    isBool
+    isString
+    optionalAttrs
+    mapAttrs'
+    nameValuePair
+    listToAttrs
+    ;
+
   inherit (utils) systemdUtils escapeSystemdPath;
   inherit (systemdUtils.unitOptions) unitOption;
   inherit (systemdUtils.lib)
@@ -27,6 +47,12 @@ let
 
   cfg = config.boot.initrd.systemd;
 
+  withKmod =
+    let
+      kconfig = config.system.build.kernel.config;
+    in
+    kconfig.isSet "MODULES" -> kconfig.isYes "MODULES";
+
   upstreamUnits = [
     "basic.target"
     "breakpoint-pre-udev.service"
@@ -505,7 +531,7 @@ in
         pkgs.coreutils
         cfg.package
       ]
-      ++ lib.optional (config.system.build.kernel.config.isYes "MODULES") cfg.package.kmod
+      ++ lib.optional withKmod cfg.package.kmod
       ++ lib.optionals cfg.shell.enable [
         # bashInteractive is easier to use and also required by debug-shell.service
         pkgs.bashInteractive
@@ -555,7 +581,7 @@ in
       // optionalAttrs (config.environment.etc ? "modprobe.d/nixos.conf") {
         "/etc/modprobe.d/nixos.conf".source = config.environment.etc."modprobe.d/nixos.conf".source;
       }
-      // optionalAttrs (with config.system.build.kernel.config; isSet "MODULES" -> isYes "MODULES") {
+      // optionalAttrs withKmod {
         "/lib".source = "${config.system.build.modulesClosure}/lib";
 
         "/etc/modules-load.d/nixos.conf".text = concatStringsSep "\n" config.boot.initrd.kernelModules;
@@ -640,7 +666,7 @@ in
           ) cfg.automounts
         );
 
-      services."modprobe@" = lib.mkIf (config.system.build.kernel.config.isYes "MODULES") {
+      services."modprobe@" = lib.mkIf withKmod {
         serviceConfig.ExecSearchPath = lib.makeBinPath [ cfg.package.kmod ];
       };
 
diff --git a/nixos/modules/virtualisation/nixos-containers.nix b/nixos/modules/virtualisation/nixos-containers.nix
index a952e64c5b65..84bb0b6c4856 100644
--- a/nixos/modules/virtualisation/nixos-containers.nix
+++ b/nixos/modules/virtualisation/nixos-containers.nix
@@ -524,6 +524,19 @@ let
     tmpfs = null;
   };
 
+  # Parses an IPv4 address with an optional prefix
+  ipv4FromString =
+    str:
+    let
+      segments = lib.splitString "/" str;
+      prefix = lib.elemAt segments 1;
+      hasPrefix = builtins.length segments == 2;
+    in
+    {
+      address = lib.head segments;
+      prefixLength = if hasPrefix then builtins.fromJSON prefix else 32;
+    };
+
 in
 
 {
@@ -594,6 +607,14 @@ in
                                 boot.isNspawnContainer = true;
                                 networking.hostName = mkDefault name;
                                 networking.useDHCP = false;
+                                networking.interfaces = lib.mkIf config.privateNetwork {
+                                  eth0.ipv4.addresses = lib.optional (config.localAddress != null) (
+                                    ipv4FromString config.localAddress
+                                  );
+                                  eth0.ipv6.addresses = lib.optional (config.localAddress6 != null) (
+                                    lib.network.ipv6.fromString config.localAddress6
+                                  );
+                                };
                                 assertions = [
                                   {
                                     assertion =
diff --git a/nixos/release-combined.nix b/nixos/release-combined.nix
index 40eb4a0d34ae..d6ec21f82226 100644
--- a/nixos/release-combined.nix
+++ b/nixos/release-combined.nix
@@ -202,7 +202,8 @@ rec {
         (onFullSupported "nixos.tests.proxy")
         (onFullSupported "nixos.tests.sddm.default")
         (onFullSupported "nixos.tests.shadow")
-        (onFullSupported "nixos.tests.simple")
+        (onFullSupported "nixos.tests.simple-container")
+        (onFullSupported "nixos.tests.simple-vm")
         (onFullSupported "nixos.tests.sway")
         (onFullSupported "nixos.tests.switchTest")
         (onFullSupported "nixos.tests.udisks2")
diff --git a/nixos/release-small.nix b/nixos/release-small.nix
index 461afb49d4db..8db36109abf7 100644
--- a/nixos/release-small.nix
+++ b/nixos/release-small.nix
@@ -67,7 +67,8 @@ rec {
         php
         predictable-interface-names
         proxy
-        simple
+        simple-container
+        simple-vm
         ;
       latestKernel = {
         inherit (nixos'.tests.latestKernel)
@@ -165,7 +166,8 @@ rec {
           "nixos.tests.predictable-interface-names.unpredictable"
           "nixos.tests.predictable-interface-names.unpredictableNetworkd"
           "nixos.tests.proxy"
-          "nixos.tests.simple"
+          "nixos.tests.simple-container"
+          "nixos.tests.simple-vm"
           "nixpkgs.jdk"
           "nixpkgs.tests.stdenv.tests-stdenv-gcc-stageCompare"
           "nixpkgs.opensshTest"
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 3475d14e7f26..799c3d5d9791 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -245,6 +245,7 @@ in
   authelia = runTest ./authelia.nix;
   auto-cpufreq = runTest ./auto-cpufreq.nix;
   autobrr = runTest ./autobrr.nix;
+  autopush-rs = runTest ./autopush-rs.nix;
   autosuspend = runTest ./autosuspend.nix;
   avahi = runTest {
     imports = [ ./avahi.nix ];
@@ -386,6 +387,7 @@ in
   containers-custom-pkgs = runTest ./containers-custom-pkgs.nix;
   containers-ephemeral = runTest ./containers-ephemeral.nix;
   containers-extra_veth = runTest ./containers-extra_veth.nix;
+  containers-gateway = runTest ./containers-gateway.nix;
   containers-hosts = runTest ./containers-hosts.nix;
   containers-imperative = runTest ./containers-imperative.nix;
   containers-ip = runTest ./containers-ip.nix;
@@ -1508,7 +1510,8 @@ in
   shoko = import ./shoko.nix { inherit runTest; };
   signal-desktop = runTest ./signal-desktop.nix;
   silverbullet = runTest ./silverbullet.nix;
-  simple = runTest ./simple.nix;
+  simple-container = runTest ./simple-container.nix;
+  simple-vm = runTest ./simple-vm.nix;
   sing-box = runTest ./sing-box.nix;
   sks = runTest ./sks.nix;
   slimserver = runTest ./slimserver.nix;
diff --git a/nixos/tests/autopush-rs.nix b/nixos/tests/autopush-rs.nix
new file mode 100644
index 000000000000..e1075bd3d17f
--- /dev/null
+++ b/nixos/tests/autopush-rs.nix
@@ -0,0 +1,60 @@
+{ lib, ... }:
+{
+  _class = "nixosTest";
+  name = "autopush-rs";
+
+  nodes = {
+    machine =
+      { pkgs, config, ... }:
+      {
+        environment.systemPackages = [
+          pkgs.curl
+        ];
+
+        services.redis.servers.autopush-rs = {
+          enable = true;
+          port = 6000;
+        };
+        system.services.autopush-autoconnect = {
+          imports = [
+            pkgs.autopush-rs.services.autoconnect
+          ];
+          autoconnect.settings = {
+            #do not use this key in production!!!
+            crypto_key = "[fZQX8jgdESUYFTYfWw3Dv5RRMuwYJPPaaPcbUgHM69Q=]";
+            db_dsn = "redis://localhost:${toString config.services.redis.servers.autopush-rs.port}";
+            port = 8000;
+          };
+        };
+        system.services.autopush-autoendpoint = {
+          imports = [
+            pkgs.autopush-rs.services.autoendpoint
+          ];
+          autoendpoint.settings = {
+            #do not use this key in production!!!
+            crypto_key = "[fZQX8jgdESUYFTYfWw3Dv5RRMuwYJPPaaPcbUgHM69Q=]";
+            db_dsn = "redis://localhost:${toString config.services.redis.servers.autopush-rs.port}";
+            port = 8080;
+          };
+        };
+
+        networking.firewall.allowedTCPPorts = [
+          8080
+          8000
+        ];
+      };
+  };
+
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_for_unit("autopush-autoconnect.service")
+    machine.wait_for_unit("autopush-autoendpoint.service")
+    machine.wait_for_open_port(8080)
+    machine.wait_for_open_port(8000)
+    machine.succeed("curl -s -f http://localhost:8080/health")
+    machine.succeed("curl -s -f http://localhost:8000/health")
+  '';
+
+  meta.maintainers = with lib.maintainers; [ zimward ];
+}
diff --git a/nixos/tests/containers-gateway.nix b/nixos/tests/containers-gateway.nix
new file mode 100644
index 000000000000..48a29f6c99dc
--- /dev/null
+++ b/nixos/tests/containers-gateway.nix
@@ -0,0 +1,67 @@
+let
+  hostIp4 = "192.168.0.1";
+  containerIp4 = "192.168.0.100/24";
+  hostIp6 = "fc00::1";
+  containerIp6 = "fc00::2/7";
+in
+
+{ lib, ... }:
+{
+  name = "containers-gateway";
+  meta = {
+    maintainers = with lib.maintainers; [
+      rnhmjoj
+    ];
+  };
+
+  nodes.machine = {
+    networking.bridges = {
+      br0.interfaces = [ ];
+    };
+    networking.interfaces = {
+      br0.ipv4.addresses = [
+        {
+          address = hostIp4;
+          prefixLength = 24;
+        }
+      ];
+      br0.ipv6.addresses = [
+        {
+          address = hostIp6;
+          prefixLength = 7;
+        }
+      ];
+    };
+
+    containers.test = {
+      autoStart = true;
+      privateNetwork = true;
+      hostBridge = "br0";
+      localAddress = containerIp4;
+      localAddress6 = containerIp6;
+      config.networking = {
+        defaultGateway.address = hostIp4;
+        defaultGateway6.address = hostIp6;
+      };
+    };
+  };
+
+  testScript = ''
+    def container_succeed(command: str):
+        machine.succeed(f"nixos-container run test -- {command}")
+
+    machine.wait_for_unit("default.target")
+    assert "test" in machine.succeed("nixos-container list")
+
+    with subtest("Container has started"):
+        assert "up" in machine.succeed("nixos-container status test")
+
+    with subtest("Container can ping the host"):
+        container_succeed("ping -n -c 1 ${hostIp4}")
+        container_succeed("ping -n -c 1 ${hostIp6}")
+
+    with subtest("Container default gateways are set"):
+        container_succeed("ip -4 route show default | grep 'via ${hostIp4}'")
+        container_succeed("ip -6 route show default | grep 'via ${hostIp6}'")
+  '';
+}
diff --git a/nixos/tests/nixos-test-driver/skip-typecheck.nix b/nixos/tests/nixos-test-driver/skip-typecheck.nix
index b36e4a819693..887cab290389 100644
--- a/nixos/tests/nixos-test-driver/skip-typecheck.nix
+++ b/nixos/tests/nixos-test-driver/skip-typecheck.nix
@@ -1,5 +1,5 @@
 /**
-  nixosTests.simple, but with skipTypeCheck.
+  nixosTests.simple-vm, but with skipTypeCheck.
   This catches regressions in the wiring, e.g.
   https://github.com/NixOS/nixpkgs/pull/511225
 */
diff --git a/nixos/tests/simple-container.nix b/nixos/tests/simple-container.nix
new file mode 100644
index 000000000000..269853423651
--- /dev/null
+++ b/nixos/tests/simple-container.nix
@@ -0,0 +1,11 @@
+{
+  name = "simple-container";
+
+  containers.machine = { };
+
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("multi-user.target")
+    machine.shutdown()
+  '';
+}
diff --git a/nixos/tests/simple.nix b/nixos/tests/simple-vm.nix
similarity index 86%
rename from nixos/tests/simple.nix
rename to nixos/tests/simple-vm.nix
index f9b9db05302b..51fe6b596d29 100644
--- a/nixos/tests/simple.nix
+++ b/nixos/tests/simple-vm.nix
@@ -1,5 +1,5 @@
 {
-  name = "simple";
+  name = "simple-vm";
 
   nodes.machine = { };
 
diff --git a/pkgs/applications/editors/vscode/extensions/ms-python.flake8/default.nix b/pkgs/applications/editors/vscode/extensions/ms-python.flake8/default.nix
index a228ae85084d..272cfbb11de3 100644
--- a/pkgs/applications/editors/vscode/extensions/ms-python.flake8/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-python.flake8/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "ms-python";
     name = "flake8";
-    version = "2026.4.0";
-    hash = "sha256-2o6a0wPYVFa+XWQoKBxKcWxlH8IPOzKxtXNt7qUi9mM=";
+    version = "2026.6.0";
+    hash = "sha256-n++DEjZsNY3YkvldyWuk3dCYgFbIxqMOun42lWEHGog=";
   };
 
   meta = {
diff --git a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hypr-darkwindow.nix b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hypr-darkwindow.nix
index 7ecbde27f2fe..8cc7cec60189 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hypr-darkwindow.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hypr-darkwindow.nix
@@ -7,13 +7,13 @@
 
 mkHyprlandPlugin (finalAttrs: {
   pluginName = "hypr-darkwindow";
-  version = "0.54.3";
+  version = "0.55.2";
 
   src = fetchFromGitHub {
     owner = "micha4w";
     repo = "Hypr-DarkWindow";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-nbaNBxREqiqc6bwUkgfyuCah61O89atJyNTPYq4Xij8=";
+    hash = "sha256-8Ht9yhlwOtDWFvL6VYlryNxyRethFqc0iWtBetP0xws=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/_4/_4th/package.nix b/pkgs/by-name/_4/_4th/package.nix
index b0a291f9f761..325b497f082d 100644
--- a/pkgs/by-name/_4/_4th/package.nix
+++ b/pkgs/by-name/_4/_4th/package.nix
@@ -20,6 +20,11 @@ stdenv.mkDerivation (finalAttrs: {
 
   dontConfigure = true;
 
+  preBuild = ''
+    cp sources/include${if stdenv.hostPlatform.is64bit then "64" else "32"}/* sources/
+    make -C sources clean
+  '';
+
   makeFlags = [
     "-C sources"
     "CC:=$(CC)"
diff --git a/pkgs/by-name/ap/apidog/package.nix b/pkgs/by-name/ap/apidog/package.nix
index cbf57de68d1b..9abfb1a8c63b 100644
--- a/pkgs/by-name/ap/apidog/package.nix
+++ b/pkgs/by-name/ap/apidog/package.nix
@@ -7,11 +7,11 @@
 
 let
   pname = "apidog";
-  version = "2.8.28";
+  version = "2.8.30";
 
   src = fetchurl {
     url = "https://file-assets.apidog.com/download/${version}/Apidog-${version}.AppImage";
-    hash = "sha256-P338wk3YrNaeMwhMyMCKZOY2mIi2A6V+RG4f9qSHBhg=";
+    hash = "sha256-h5h/zhUbnYYtYVyWySLZk3QISd4VWs5Gl/JdhgMJKh8=";
   };
 
   appimageContents = appimageTools.extract {
diff --git a/pkgs/by-name/at/atlauncher/package.nix b/pkgs/by-name/at/atlauncher/package.nix
index 89e037f04f70..523c3b8bd504 100644
--- a/pkgs/by-name/at/atlauncher/package.nix
+++ b/pkgs/by-name/at/atlauncher/package.nix
@@ -36,6 +36,12 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     hash = "sha256-pRYXzFUbVXYwD7edhBoVcVo/QDo6QSJJQd58Hf3rBGo=";
   };
 
+  patches = [
+    # Launch4j does not publish the Linux workdir artifact selected on aarch64.
+    # Nixpkgs only needs the cross-platform jar, so remove the Windows exe task.
+    ./remove-launch4j.patch
+  ];
+
   nativeBuildInputs = [
     gradle
     makeWrapper
@@ -52,8 +58,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   gradleFlags = [
     "-Dorg.gradle.java.home=${jdk17_headless.home}"
-    "--exclude-task"
-    "createExe"
   ];
 
   installPhase =
diff --git a/pkgs/by-name/at/atlauncher/remove-launch4j.patch b/pkgs/by-name/at/atlauncher/remove-launch4j.patch
new file mode 100644
index 000000000000..c4b4b46a8494
--- /dev/null
+++ b/pkgs/by-name/at/atlauncher/remove-launch4j.patch
@@ -0,0 +1,71 @@
+diff --git a/build.gradle b/build.gradle
+index 474c0c0..59fc2d2 100644
+--- a/build.gradle
++++ b/build.gradle
+@@ -24,7 +24,6 @@ plugins {
+     id 'org.cadixdev.licenser' version '0.6.1'
+     id 'com.adarshr.test-logger' version '4.0.0'
+     id 'edu.sc.seis.macAppBundle' version '2.3.0'
+-    id 'edu.sc.seis.launch4j' version '3.0.6'
+     id 'de.undercouch.download' version '5.6.0'
+     id 'com.github.johnrengelman.shadow' version '8.1.1'
+     id 'com.github.ben-manes.versions' version '0.52.0'
+@@ -282,34 +281,15 @@ def currentYear() {
+     return df.format(new Date())
+ }
+ 
+-launch4j {
+-    outfile = "ATLauncher-${project.version}.exe"
+-    jreMinVersion = "${project.targetCompatibility.toString()}"
+-    mainClassName = 'com.atlauncher.App'
+-    icon = "${projectDir}/src/main/resources/assets/image/icon.ico"
+-    version = "${project.version}"
+-    textVersion = "${project.version}"
+-    copyright = "2013-${currentYear()} ${project.name}"
+-    companyName = "${project.name}"
+-    bundledJrePath = "jre/;%JAVA_HOME%;%PATH%"
+-    jvmOptions = [
+-        "-Djna.nosys=true",
+-        "-Djava.net.preferIPv4Stack=true",
+-        "-Dawt.useSystemAAFontSettings=on",
+-        "-Dswing.aatext=true"
+-    ]
+-}
+ 
+ artifacts {
+     archives shadowJar
+-    archives file(project.tasks.jar.getArchivePath().getPath().replace('.jar', '.exe').replace('libs', 'launch4j'))
+     archives file(project.tasks.jar.getArchivePath().getPath().replace('.jar', '.zip').replace('libs', 'distributions'))
+ }
+ 
+ task copyArtifacts(type: Copy) {
+     dependsOn build
+     from shadowJar
+-    from file(project.tasks.jar.getArchivePath().getPath().replace('.jar', '.exe').replace('libs', 'launch4j'))
+     from file(project.tasks.jar.getArchivePath().getPath().replace('.jar', '.zip').replace('libs', 'distributions'))
+     into "${projectDir}/dist"
+ }
+@@ -368,14 +348,6 @@ clean.doFirst {
+     delete "${projectDir}/dist"
+ }
+ 
+-project.afterEvaluate {
+-    tasks.check {
+-        dependsOn -= tasks.find {
+-            it.name.equals("checkLicenses")
+-        }
+-    }
+-}
+-
+ def shouldIgnoreUpdate = { String version -> return ['ALPHA', 'BETA', 'RC', '-M'].any { it -> version.toUpperCase(Locale.ENGLISH).contains(it) } }
+ tasks.named("dependencyUpdates").configure {
+     rejectVersionIf {
+@@ -385,8 +357,6 @@ tasks.named("dependencyUpdates").configure {
+ 
+ build.finalizedBy copyArtifacts
+ shadowJar.dependsOn jar
+-build.dependsOn createExe, createMacApp
+ startScripts.dependsOn shadowJar
+-createExe.dependsOn shadowJar
+ createAppZip.dependsOn downloadNewerUniversalJavaApplicationStub
+ createDmg.dependsOn downloadNewerUniversalJavaApplicationStub
diff --git a/pkgs/by-name/au/autopush-rs/package.nix b/pkgs/by-name/au/autopush-rs/package.nix
new file mode 100644
index 000000000000..08c946b5d6a4
--- /dev/null
+++ b/pkgs/by-name/au/autopush-rs/package.nix
@@ -0,0 +1,136 @@
+{
+  lib,
+  pkgs,
+  nixosTests,
+  fetchFromGitHub,
+  rustPlatform,
+  stdenv,
+  pkg-config,
+  cmake,
+  openssl,
+  libffi,
+  grpc,
+  nix-update-script,
+  python3Packages,
+}:
+let
+  #script to generate the fernet key
+  fernetKey =
+    {
+      src,
+      version,
+    }:
+    python3Packages.buildPythonApplication {
+      pname = "fernet_key";
+      inherit version src;
+
+      __structuredAttrs = true;
+
+      format = "other";
+
+      # this would run the upstream docker makefile
+      dontBuild = true;
+
+      dependencies = [ python3Packages.cryptography ];
+
+      installPhase = ''
+        mkdir -p $out/bin
+        echo "#!/usr/bin/env python3" |  \
+        cat - $src/scripts/fernet_key.py > $out/bin/fernet_key
+        chmod +x $out/bin/fernet_key
+      '';
+
+      postFixup = ''
+        wrapPythonPrograms
+      '';
+    };
+in
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "autopush";
+  version = "1.81.3";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  outputs = [
+    "out"
+    "fernet"
+  ];
+
+  src = fetchFromGitHub {
+    owner = "mozilla-services";
+    repo = "autopush-rs";
+    tag = finalAttrs.version;
+    hash = "sha256-DP02mcEMoQoJqi5rw5eSuep0i7zeJ0LLYsakikt9hho=";
+  };
+
+  cargoHash = "sha256-LqmuUtFF30TO6iw7LPFB7yJGrzrhh7R0OKCWMhe/OjU=";
+
+  nativeBuildInputs = [
+    pkg-config
+    rustPlatform.bindgenHook
+    cmake
+  ];
+
+  buildInputs = [
+    openssl
+    libffi
+    grpc
+  ];
+
+  # by default only google bigtable is supported as a db
+  buildNoDefaultFeatures = true;
+  buildFeatures = [
+    "postgres"
+    "redis"
+    "reliable_report"
+  ];
+
+  env = {
+    #needed for bingen to find libc
+    BINDGEN_EXTRA_CLANG_ARGS = "-I${stdenv.cc.libc.dev}/include";
+    CMAKE_POLICY_VERSION_MINIMUM = "3.5";
+  };
+
+  #check build fails
+  doCheck = false;
+
+  postInstall = ''
+    mkdir -p $fernet/bin
+    ln -s ${fernetKey { inherit (finalAttrs) src version; }}/bin/fernet_key $fernet/bin/fernet_key
+  '';
+
+  passthru = {
+    tests = nixosTests.autopush-rs;
+    services.autoconnect = {
+      imports = [
+        (lib.modules.importApply ./service-autoconnect.nix { inherit pkgs; })
+      ];
+      package = finalAttrs.finalPackage.out;
+    };
+    services.autoendpoint = {
+      imports = [
+        (lib.modules.importApply ./service-autoendpoint.nix { inherit pkgs; })
+      ];
+      package = finalAttrs.finalPackage.out;
+    };
+
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Mozilla Push server and Push Endpoint";
+    homepage = "https://mozilla-services.github.io/autopush-rs/index.html";
+    changelog = "https://github.com/mozilla-services/autopush-rs/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.mpl20;
+    platforms = lib.platforms.linux;
+    maintainers = [
+      lib.maintainers.zimward
+    ];
+    # install the fernet_key script in devshells as users will only use it once most likely
+    outputsToInstall = [
+      "out"
+      "fernet"
+    ];
+  };
+})
diff --git a/pkgs/by-name/au/autopush-rs/service-autoconnect.nix b/pkgs/by-name/au/autopush-rs/service-autoconnect.nix
new file mode 100644
index 000000000000..eca44eee4b87
--- /dev/null
+++ b/pkgs/by-name/au/autopush-rs/service-autoconnect.nix
@@ -0,0 +1,96 @@
+#v Non-module dependencies (`importApply`)
+{ pkgs }:
+
+# Service module
+{
+  lib,
+  options,
+  config,
+  ...
+}:
+let
+  cfg = config.autoconnect;
+  tomlFmt = pkgs.formats.toml { };
+in
+{
+  _class = "service";
+  options = {
+    package = lib.mkPackageOption pkgs "autopush-rs.out" { };
+    autoconnect.settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = tomlFmt.type;
+        options = {
+          db_dsn = lib.mkOption {
+            description = "Endpoint of the database server.";
+            type = lib.types.str;
+            default = "";
+            example = lib.literalExpression "redis+socket://${config.services.redis.servers.autopush-rs.unixSocket}";
+          };
+        };
+      };
+      default = { };
+      description = "";
+    };
+  };
+  config =
+    let
+      configFile = tomlFmt.generate "autoconnect.toml" cfg.settings;
+    in
+    {
+      process.argv = [
+        "${config.package}/bin/autoconnect"
+        "-c"
+        (toString configFile)
+      ];
+    }
+    // lib.optionalAttrs (options ? systemd) {
+      systemd.service = {
+        after = [ "network.target" ];
+        wants = [ "network.target" ];
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          Restart = "on-failure";
+
+          #hardening
+          MemoryDenyWriteExecute = true;
+          StateDirectoryMode = 0700;
+          UMask = 077;
+          DynamicUser = true;
+          PrivateUsers = true;
+          PrivateTmp = true;
+          PrivateDevices = true;
+          ProtectSystem = "full";
+          ProtectHome = true;
+          NoNewPrivileges = true;
+          RuntimeDirectoryMode = 755;
+          ProtectHostname = true;
+          ProtectClock = true;
+          ProtectKernelTunables = true;
+          ProtectKernelModules = true;
+          ProtectKernelLogs = true;
+          ProtectControlGroups = true;
+          RestrictNamespaces = true;
+          LockPersonality = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          RemoveIPC = true;
+          SystemCallArchitectures = "native";
+
+          ProtectProc = "invisible";
+          ProcSubset = "pid";
+
+          SystemCallFilter = [
+            "~@clock"
+            "~@cpu-emulation"
+            "~@debug"
+            "~@module"
+            "~@mount"
+            "~@obsolete"
+            "~@raw-io"
+            "~@reboot"
+            "~@swap"
+          ];
+        };
+      };
+    };
+}
diff --git a/pkgs/by-name/au/autopush-rs/service-autoendpoint.nix b/pkgs/by-name/au/autopush-rs/service-autoendpoint.nix
new file mode 100644
index 000000000000..d4c87dff54a7
--- /dev/null
+++ b/pkgs/by-name/au/autopush-rs/service-autoendpoint.nix
@@ -0,0 +1,98 @@
+# Non-module dependencies (`importApply`)
+{ pkgs }:
+
+# Service module
+{
+  lib,
+  config,
+  options,
+  ...
+}:
+let
+  cfg = config.autoendpoint;
+  tomlFmt = pkgs.formats.toml { };
+in
+{
+  _class = "service";
+  options = {
+    package = lib.mkPackageOption pkgs "autopush-rs.out" { };
+    autoendpoint = {
+      settings = lib.mkOption {
+        type = lib.types.submodule {
+          freeformType = tomlFmt.type;
+          options = {
+            db_dsn = lib.mkOption {
+              description = "Endpoint of the database server.";
+              type = lib.types.str;
+              default = "";
+              example = lib.literalExpression "redis+socket://${config.services.redis.servers.autopush-rs.unixSocket}";
+            };
+          };
+        };
+        default = { };
+        description = "";
+      };
+    };
+  };
+  config =
+    let
+      configFile = tomlFmt.generate "autoendpoint.toml" cfg.settings;
+    in
+    {
+      process.argv = [
+        "${config.package}/bin/autoendpoint"
+        "-c"
+        (toString configFile)
+      ];
+    }
+    // lib.optionalAttrs (options ? systemd) {
+      systemd.service = {
+        after = [ "network.target" ];
+        wants = [ "network.target" ];
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          Restart = "on-failure";
+
+          #hardening
+          MemoryDenyWriteExecute = true;
+          StateDirectoryMode = 0700;
+          UMask = 077;
+          DynamicUser = true;
+          PrivateUsers = true;
+          PrivateTmp = true;
+          PrivateDevices = true;
+          ProtectSystem = "full";
+          ProtectHome = true;
+          NoNewPrivileges = true;
+          RuntimeDirectoryMode = 755;
+          ProtectHostname = true;
+          ProtectClock = true;
+          ProtectKernelTunables = true;
+          ProtectKernelModules = true;
+          ProtectKernelLogs = true;
+          ProtectControlGroups = true;
+          RestrictNamespaces = true;
+          LockPersonality = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          RemoveIPC = true;
+          SystemCallArchitectures = "native";
+
+          ProtectProc = "invisible";
+          ProcSubset = "pid";
+
+          SystemCallFilter = [
+            "~@clock"
+            "~@cpu-emulation"
+            "~@debug"
+            "~@module"
+            "~@mount"
+            "~@obsolete"
+            "~@raw-io"
+            "~@reboot"
+            "~@swap"
+          ];
+        };
+      };
+    };
+}
diff --git a/pkgs/by-name/az/azure-cli/extensions-generated.json b/pkgs/by-name/az/azure-cli/extensions-generated.json
index df571b6d90cf..9b8e401f8b39 100644
--- a/pkgs/by-name/az/azure-cli/extensions-generated.json
+++ b/pkgs/by-name/az/azure-cli/extensions-generated.json
@@ -22,9 +22,9 @@
   },
   "acrtransfer": {
     "pname": "acrtransfer",
-    "version": "1.1.1b1",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/acrtransfer-1.1.1b1-py3-none-any.whl",
-    "hash": "sha256-9rbBiFCxK0cInu5puF5y2kAYcQ7xFa/X3/va5n5i/J0=",
+    "version": "2.0.0",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/acrtransfer-2.0.0-py3-none-any.whl",
+    "hash": "sha256-nG+BxgBHoi4hCF/j4wLbpOlI2MIKB8JjdJoz2LRD+iE=",
     "description": "Microsoft Azure Command-Line Tools Acrtransfer Extension"
   },
   "ad": {
@@ -50,9 +50,9 @@
   },
   "aks-preview": {
     "pname": "aks-preview",
-    "version": "20.0.0b1",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/aks_preview-20.0.0b1-py2.py3-none-any.whl",
-    "hash": "sha256-arH7mhRieuEn5s2G8dpZsqk/RKyuslEphOi62FviS7U=",
+    "version": "20.0.0b8",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/aks_preview-20.0.0b8-py2.py3-none-any.whl",
+    "hash": "sha256-ugLew461nhWWg73OZJW7g/xblclV5IfNHKm1it6j+Dc=",
     "description": "Provides a preview for upcoming AKS features"
   },
   "alb": {
@@ -153,11 +153,18 @@
     "hash": "sha256-sdk0uNtQX6yBiEboywNE8FAreY1pBiimah0PdmCDRYg=",
     "description": "Microsoft Azure Command-Line Tools AutomationClient Extension"
   },
+  "azure-changesafety": {
+    "pname": "azure-changesafety",
+    "version": "1.0.0b1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/azure_changesafety-1.0.0b1-py3-none-any.whl",
+    "hash": "sha256-ZR2Bm9U9C4rXrCfPVGRu65MBFjZ4iUtXS44l+ClJXsY=",
+    "description": "Microsoft Azure Command-Line Tools ChangeSafety Extension"
+  },
   "azure-firewall": {
     "pname": "azure-firewall",
-    "version": "2.1.1",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/azure_firewall-2.1.1-py2.py3-none-any.whl",
-    "hash": "sha256-gjt7/Ba38xrpdRyc4oybPbqmhOqZ8Ik/dNP8XRzm4Wc=",
+    "version": "2.2.0",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/azure_firewall-2.2.0-py2.py3-none-any.whl",
+    "hash": "sha256-f1ZxkLZVI4+kzUmwOnY8hMaR/nuxqnLM92xlLQG3rIw=",
     "description": "Manage Azure Firewall resources"
   },
   "azurelargeinstance": {
@@ -202,6 +209,13 @@
     "hash": "sha256-w+HDLtCIAIhlFTpR4iUMEKPC2vInPWWmMTX0VT9q1lg=",
     "description": "Microsoft Azure Command-Line Tools Carbon Extension"
   },
+  "cdn": {
+    "pname": "cdn",
+    "version": "1.0.0b1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/cdn-1.0.0b1-py2.py3-none-any.whl",
+    "hash": "sha256-YybIrCjZnZQ0IFgOZbm4JfMnXNC/Sah8YaZuss1M5B4=",
+    "description": "Microsoft Azure Command-Line Tools CDN and AFD Extension"
+  },
   "change-analysis": {
     "pname": "change-analysis",
     "version": "0.1.0",
@@ -309,9 +323,9 @@
   },
   "databricks": {
     "pname": "databricks",
-    "version": "1.3.1",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/databricks-1.3.1-py3-none-any.whl",
-    "hash": "sha256-D6+Sbp49vxPP/IENPPn6TSL3qhwgBZyWBB3KjSgjdCc=",
+    "version": "1.3.2",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/databricks-1.3.2-py3-none-any.whl",
+    "hash": "sha256-iGI+Fk/kVT2/4CspDu/r2UlDrXimUWWx9IAknnNjqhg=",
     "description": "Microsoft Azure Command-Line Tools DatabricksClient Extension"
   },
   "datadog": {
@@ -337,9 +351,9 @@
   },
   "dataprotection": {
     "pname": "dataprotection",
-    "version": "1.9.0",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/dataprotection-1.9.0-py3-none-any.whl",
-    "hash": "sha256-YGJlWG4VPvcyKJ2qOnkgt1JYXqPF9LTrnvdTkIZcF30=",
+    "version": "1.10.0",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/dataprotection-1.10.0-py3-none-any.whl",
+    "hash": "sha256-cssrKqmWbQv3qlr8A3GUNklnIGOQ9V2x3e+YWpXeCvQ=",
     "description": "Microsoft Azure Command-Line Tools DataProtectionClient Extension"
   },
   "datashare": {
@@ -482,6 +496,13 @@
     "hash": "sha256-x1mbd/Y28BcYqEf+T1rZcOHT8wrq9VnWnCfw9rBnl80=",
     "description": "Microsoft Azure Command-Line Tools ExpressRouteCrossConnection Extension"
   },
+  "fileshares": {
+    "pname": "fileshares",
+    "version": "1.0.0b1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/fileshares-1.0.0b1-py3-none-any.whl",
+    "hash": "sha256-IrJwPQaMuX9VItIEkJzK3cmANHzU50fIaWn2s32nDVk=",
+    "description": "Commands for managing Azure file shares, snapshots, and private endpoint connections"
+  },
   "firmwareanalysis": {
     "pname": "firmwareanalysis",
     "version": "2.0.1",
@@ -491,9 +512,9 @@
   },
   "fleet": {
     "pname": "fleet",
-    "version": "1.9.0",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/fleet-1.9.0-py3-none-any.whl",
-    "hash": "sha256-5CsWYP0r2UfUTekKDsqWBNonDOPaR5TrhxZDF7hAtXI=",
+    "version": "1.10.0",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/fleet-1.10.0-py3-none-any.whl",
+    "hash": "sha256-hgAwdLExAvKR0G9Ey81rTSa2QLxeoMnUZ7KRaCYhfM8=",
     "description": "Microsoft Azure Command-Line Tools Fleet Extension"
   },
   "fluid-relay": {
@@ -512,9 +533,9 @@
   },
   "front-door": {
     "pname": "front-door",
-    "version": "2.1.0",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/front_door-2.1.0-py3-none-any.whl",
-    "hash": "sha256-7aa9A+tq+qXzMuabG9McHkXpU3TRZVjQWDbmuHTTsFk=",
+    "version": "2.2.0",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/front_door-2.2.0-py3-none-any.whl",
+    "hash": "sha256-5vj/OzbfMmv/SI8qS659o+QiMfPofoBCJR/mQV3XZNE=",
     "description": "Manage networking Front Doors"
   },
   "fzf": {
@@ -573,6 +594,13 @@
     "hash": "sha256-VTL1/L/UfORNWvyY0hvSJrvoz5zHabLPFX/sEdQaLhI=",
     "description": "Microsoft Azure Command-Line Tools HealthcareApisManagementClient Extension"
   },
+  "horizondb": {
+    "pname": "horizondb",
+    "version": "1.0.0b1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/horizondb-1.0.0b1-py2.py3-none-any.whl",
+    "hash": "sha256-bvjD6FSGjkuMjnc1XYnglbzd2cLMDuwRiPW9+7n6efA=",
+    "description": "Microsoft Azure Command-Line Tools HorizonDB Extension"
+  },
   "hpc-cache": {
     "pname": "hpc-cache",
     "version": "0.1.6",
@@ -680,9 +708,9 @@
   },
   "maintenance": {
     "pname": "maintenance",
-    "version": "1.7.0b2",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/maintenance-1.7.0b2-py3-none-any.whl",
-    "hash": "sha256-ebiJ8U5FyRLG9VHBGB75AqkjPVars8kGxWnjUCMiiCI=",
+    "version": "2.0.0b1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/maintenance-2.0.0b1-py3-none-any.whl",
+    "hash": "sha256-ax3HeCaCq9p5fokc9W3y2XtVHsRYNTZQRkNfXqwpPGk=",
     "description": "Microsoft Azure Command-Line Tools MaintenanceManagementClient Extension"
   },
   "managedccfs": {
@@ -694,10 +722,10 @@
   },
   "managednetworkfabric": {
     "pname": "managednetworkfabric",
-    "version": "9.1.1",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/managednetworkfabric-9.1.1-py3-none-any.whl",
-    "hash": "sha256-bLPE5Spy4Lhtv6ZEWx2E2nLRqkrZ/LfJVmDQWjqEZi0=",
-    "description": "Support for managednetworkfabric commands based on 2025-07-15 API version"
+    "version": "10.0.0b1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/managednetworkfabric-10.0.0b1-py3-none-any.whl",
+    "hash": "sha256-7veSgSJp7isa+JwAiep+3dMTJFLohIAHNcF9UVIFaNc=",
+    "description": "Support for managednetworkfabric commands based on 2026-01-15-preview API version"
   },
   "managementpartner": {
     "pname": "managementpartner",
@@ -757,9 +785,9 @@
   },
   "monitor-pipeline-group": {
     "pname": "monitor-pipeline-group",
-    "version": "1.0.0b2",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/monitor_pipeline_group-1.0.0b2-py3-none-any.whl",
-    "hash": "sha256-skfHQJ7vGnKZtaDmAGmjPLtuxNfyHE44pxi1Usl9X9s=",
+    "version": "1.0.0",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/monitor_pipeline_group-1.0.0-py3-none-any.whl",
+    "hash": "sha256-oVPbg8B2TMiHSNKMakl45zkfJenXX5el0tEjirIi9/k=",
     "description": "Microsoft Azure Command-Line Tools MonitorPipelineGroup Extension"
   },
   "multicloud-connector": {
@@ -853,6 +881,13 @@
     "hash": "sha256-/k47qFwfZZZqBZKR5G6+t8lW8o2isVtUGwSSdltiOZI=",
     "description": "Microsoft Azure Command-Line Tools PeeringManagementClient Extension"
   },
+  "planetarycomputer": {
+    "pname": "planetarycomputer",
+    "version": "1.0.0b1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/planetarycomputer-1.0.0b1-py3-none-any.whl",
+    "hash": "sha256-FPvUcZx5yHHB2du7F6ulDjoNsNCek2HtuVMJd6g0mBE=",
+    "description": "Microsoft Azure Command-Line Tools Planetary Computer Extension"
+  },
   "portal": {
     "pname": "portal",
     "version": "1.0.0b2",
@@ -890,9 +925,9 @@
   },
   "quantum": {
     "pname": "quantum",
-    "version": "1.0.0b12",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/quantum-1.0.0b12-py3-none-any.whl",
-    "hash": "sha256-9tjBvpu1F2/2JYKUD2IbxUckYofUH0rEnimkpRXF2wY=",
+    "version": "1.0.0b13",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/quantum-1.0.0b13-py3-none-any.whl",
+    "hash": "sha256-zNyvYvtJY2AgASUoMvN/cCXWIOJ1d3JEQ7G/tuyV/o4=",
     "description": "Microsoft Azure Command-Line Tools Quantum Extension"
   },
   "qumulo": {
@@ -909,6 +944,13 @@
     "hash": "sha256-i0w0dd8MNUTbzCjkh161sWPXK0Cv9CUKr9rZQYDD+ZU=",
     "description": "Microsoft Azure Command-Line Tools AzureQuotaExtensionAPI Extension"
   },
+  "relationship": {
+    "pname": "relationship",
+    "version": "1.0.0b1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/relationship-1.0.0b1-py2.py3-none-any.whl",
+    "hash": "sha256-pEXG6+Gf/JlzjeQGw0VadoArnX+2yjhYVMxg78Qg06g=",
+    "description": "Microsoft Azure Command-Line Tools Relationship Extension"
+  },
   "reservation": {
     "pname": "reservation",
     "version": "0.3.1",
@@ -965,11 +1007,18 @@
     "hash": "sha256-VRFUS040KwOkpCY2F8YD2HRCrVF5zp2MDR/RCRX5O3o=",
     "description": "Microsoft Azure Command-Line Tools Sentinel Extension"
   },
+  "servicegroup": {
+    "pname": "servicegroup",
+    "version": "1.0.0b1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/servicegroup-1.0.0b1-py3-none-any.whl",
+    "hash": "sha256-6vOfQdjX+/4Sba1qswxVcDBy+xLCgNOEG01wLL10GvQ=",
+    "description": "Microsoft Azure Command-Line Tools ServiceGroup Extension"
+  },
   "sftp": {
     "pname": "sftp",
-    "version": "1.0.0b2",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/sftp-1.0.0b2-py3-none-any.whl",
-    "hash": "sha256-3ugWIeKK9U8vKgFMbQfMKXxbgW+zO9IB6lPYJFHZm/E=",
+    "version": "1.0.0b3",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/sftp-1.0.0b3-py3-none-any.whl",
+    "hash": "sha256-hCpM/ZAJjn4hLElyLzwZzthR4OF36tPDevC2UlR0q0U=",
     "description": "Secure access to Azure Storage blob data via SFTP with SSH certificates"
   },
   "site": {
@@ -995,9 +1044,9 @@
   },
   "stack-hci-vm": {
     "pname": "stack-hci-vm",
-    "version": "1.13.0",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/stack_hci_vm-1.13.0-py3-none-any.whl",
-    "hash": "sha256-/GKJy7+iT33evnZ4UpNXB9GNBWtiLIOJXhk5VZowIos=",
+    "version": "1.14.5",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/stack_hci_vm-1.14.5-py3-none-any.whl",
+    "hash": "sha256-JE2Qq5OPy+AnTn4GxFeDhiyuCnUV3v1ciu7AqP2TwR4=",
     "description": "Microsoft Azure Command-Line Tools Stack-HCi-VM Extension"
   },
   "standbypool": {
@@ -1051,9 +1100,9 @@
   },
   "stream-analytics": {
     "pname": "stream-analytics",
-    "version": "1.0.2",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/stream_analytics-1.0.2-py3-none-any.whl",
-    "hash": "sha256-HAkhteF4LaAO3YnOrWHvHJ+9K6Kd4ns9GCcnDXDJtLg=",
+    "version": "1.0.3",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/stream_analytics-1.0.3-py3-none-any.whl",
+    "hash": "sha256-FFRNCsg9Put3GcARODA6HpwGXbWfD1kb7qDvc+/TAkg=",
     "description": "Microsoft Azure Command-Line Tools StreamAnalyticsManagementClient Extension"
   },
   "subscription": {
diff --git a/pkgs/by-name/az/azure-cli/package.nix b/pkgs/by-name/az/azure-cli/package.nix
index 8ced980fbff2..01c2a4516808 100644
--- a/pkgs/by-name/az/azure-cli/package.nix
+++ b/pkgs/by-name/az/azure-cli/package.nix
@@ -26,14 +26,14 @@
 }:
 
 let
-  version = "2.85.0";
+  version = "2.86.0";
 
   src = fetchFromGitHub {
     name = "azure-cli-${version}-src";
     owner = "Azure";
     repo = "azure-cli";
     tag = "azure-cli-${version}";
-    hash = "sha256-fNch6QiiHffyHOHw30dlRoe5UFvGVIZkneULjNihGdU=";
+    hash = "sha256-3C39e9C3m9M0faGUgOEWo66fFGDytfGohgUYX55VN8g=";
   };
 
   # put packages that needs to be overridden in the py package scope
diff --git a/pkgs/by-name/ba/ballerburg/package.nix b/pkgs/by-name/ba/ballerburg/package.nix
index 1c3a003b68aa..355ef471140b 100644
--- a/pkgs/by-name/ba/ballerburg/package.nix
+++ b/pkgs/by-name/ba/ballerburg/package.nix
@@ -34,6 +34,16 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [ SDL ];
 
+  # CMake's default framework search order on Darwin finds Kernel.framework
+  # headers while detecting SDL 1.2, which makes standard includes like
+  # <string.h> resolve to the wrong SDK header and breaks the build.
+  # Keep this package on the old Nixpkgs search order without restoring it
+  # globally: https://github.com/NixOS/nixpkgs/pull/455592
+  # CMake docs: https://cmake.org/cmake/help/latest/variable/CMAKE_FIND_FRAMEWORK.html
+  cmakeFlags = lib.optionals stdenv.hostPlatform.isDarwin [
+    "-DCMAKE_FIND_FRAMEWORK=LAST"
+  ];
+
   desktopItems = [
     (makeDesktopItem {
       name = "Ballerburg";
diff --git a/pkgs/by-name/bi/bind/package.nix b/pkgs/by-name/bi/bind/package.nix
index aa435fcb2feb..2f12ebf30ea0 100644
--- a/pkgs/by-name/bi/bind/package.nix
+++ b/pkgs/by-name/bi/bind/package.nix
@@ -29,11 +29,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bind";
-  version = "9.20.22";
+  version = "9.20.23";
 
   src = fetchurl {
     url = "https://downloads.isc.org/isc/bind9/${finalAttrs.version}/bind-${finalAttrs.version}.tar.xz";
-    hash = "sha256-y6kv9jG5SWVfR1/ktUKQ9oYP0AcNOZ8iefZDfA04PsY=";
+    hash = "sha256-XUR1rtP55QDvVUsrFNlyvbg9M94hSps76SkY6kaQg3E=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/bi/bite/package.nix b/pkgs/by-name/bi/bite/package.nix
index a7032f8db0cf..a74b819c65e1 100644
--- a/pkgs/by-name/bi/bite/package.nix
+++ b/pkgs/by-name/bi/bite/package.nix
@@ -21,16 +21,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "bite";
-  version = "0.3";
+  version = "0.43";
+
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "WINSDK";
     repo = "bite";
-    rev = "V${finalAttrs.version}";
-    hash = "sha256-gio4J+V8achSuR2vQa2dnvOR/u4Zbb5z0UE0xP0gGCU=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-akwkTV1bZJ3GcEtObyF+qN5IkBRoXdztUSOghjQy7A0=";
   };
 
-  cargoHash = "sha256-ESGX1hnDnU2taKQXre4AQRzQxTC7W+0cEIoQPPC9Lfs=";
+  cargoHash = "sha256-OlxUHYTbljWGWdiceBmW3J0oB4w0/5izgNnwCafV6xY=";
 
   nativeBuildInputs = [
     pkg-config
@@ -90,7 +92,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     description = "Disassembler focused on comprehensive rust support";
     homepage = "https://github.com/WINSDK/bite";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ vinnymeller ];
+    maintainers = with lib.maintainers; [
+      vinnymeller
+      kybe236
+    ];
     mainProgram = "bite";
   };
 })
diff --git a/pkgs/by-name/bo/borgbackup/package.nix b/pkgs/by-name/bo/borgbackup/package.nix
index eed4f1dcc91f..9300650bace2 100644
--- a/pkgs/by-name/bo/borgbackup/package.nix
+++ b/pkgs/by-name/bo/borgbackup/package.nix
@@ -70,11 +70,15 @@ python.pkgs.buildPythonApplication (finalAttrs: {
     acl
   ];
 
-  dependencies = with python.pkgs; [
-    msgpack
-    packaging
-    (if stdenv.hostPlatform.isLinux then pyfuse3 else llfuse)
-  ];
+  dependencies =
+    with python.pkgs;
+    [
+      msgpack
+      packaging
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      pyfuse3
+    ];
 
   makeWrapperArgs = [
     ''--prefix PATH ':' "${openssh}/bin"''
diff --git a/pkgs/by-name/ch/chess-tui/package.nix b/pkgs/by-name/ch/chess-tui/package.nix
index 11ee29dec0ab..fcaed57dc550 100644
--- a/pkgs/by-name/ch/chess-tui/package.nix
+++ b/pkgs/by-name/ch/chess-tui/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "chess-tui";
-  version = "2.5.1";
+  version = "2.7.0";
 
   src = fetchFromGitHub {
     owner = "thomas-mauran";
     repo = "chess-tui";
     tag = finalAttrs.version;
-    hash = "sha256-jO3pa4N7XNyKQCbPjFByYmLlOtrrdpzS5lkxU9giE+w=";
+    hash = "sha256-BGJOPsePE5S5ySrOg63cNKn9pT+7MmDLHZrW3YhUFz8=";
   };
 
-  cargoHash = "sha256-9LXg4zX/irLt2MCq7V0dQA3o1QRqGgfRcX4HneNGAns=";
+  cargoHash = "sha256-n9rjr5vUK619XIfuHIlf+lxUAeTbhTAzmdysliKNOFY=";
 
   checkFlags = [
     # assertion failed: result.is_ok()
diff --git a/pkgs/by-name/cp/cppitertools/package.nix b/pkgs/by-name/cp/cppitertools/package.nix
index 90a73ff7f9d9..4fe9b2958964 100644
--- a/pkgs/by-name/cp/cppitertools/package.nix
+++ b/pkgs/by-name/cp/cppitertools/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cppitertools";
-  version = "2.1";
+  version = "2.3";
 
   src = fetchFromGitHub {
     owner = "ryanhaining";
     repo = "cppitertools";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mii4xjxF1YC3H/TuO/o4cEz8bx2ko6U0eufqNVw5LNA=";
+    hash = "sha256-1lHpy+9e17lP/58EEIzrmyBwbmMD665ypDJtkSFrN9E=";
   };
 
   __structuredAttrs = true;
@@ -25,13 +25,6 @@ stdenv.mkDerivation (finalAttrs: {
   # tests. The CMake system defines tests and install targets, including a
   # cppitertools-config.cmake, which is really helpful for downstream consumers
   # to detect this package since it has no pkg-config.
-  # However the CMake system also specifies the entire source repo as an install
-  # target, including support files, the build directory, etc.
-  # We can't simply take cppitertools-config.cmake for ourselves because before
-  # install it's placed in non-specific private CMake subdirectory of the build
-  # directory.
-  # Therefore, we instead simply patch CMakeLists.txt to make the target that
-  # installs the entire directory non-default, and then install the headers manually.
 
   strictDeps = true;
 
@@ -47,7 +40,6 @@ stdenv.mkDerivation (finalAttrs: {
   # files that are also in that repo.
   cmakeBuildDir = "cmake-build";
 
-  includeInstallDir = "${placeholder "out"}/include/cppitertools";
   cmakeInstallDir = "${placeholder "out"}/share/cmake";
 
   # This version of cppitertools considers itself as having used the default value,
@@ -58,12 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   cmakeFlags = [ "-Dcppitertools_INSTALL_CMAKE_DIR=${finalAttrs.cmakeInstallDir}" ];
 
-  prePatch = ''
-    # Mark the `.` install target as non-default.
-    substituteInPlace CMakeLists.txt \
-      --replace-fail "  DIRECTORY ." "  DIRECTORY . EXCLUDE_FROM_ALL"
-  ''
-  + lib.optionalString finalAttrs.finalPackage.doCheck ''
+  prePatch = lib.optionalString finalAttrs.finalPackage.doCheck ''
     # Required for tests.
     cp ${lib.getDev catch2}/include/catch2/catch.hpp test/
   '';
@@ -77,11 +64,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   installPhase = ''
     runHook preInstall
-    # Install the -config.cmake files.
     cmake --install . "--prefix=$out"
-    # Install the headers.
-    mkdir -p "$includeInstallDir"
-    cp -r ../*.hpp ../internal "$includeInstallDir"
     runHook postInstall
   '';
 
diff --git a/pkgs/by-name/fo/fotema/cargo-lock-bump-ffmpeg-next.patch b/pkgs/by-name/fo/fotema/cargo-lock-bump-ffmpeg-next.patch
new file mode 100644
index 000000000000..ba274dd90ca8
--- /dev/null
+++ b/pkgs/by-name/fo/fotema/cargo-lock-bump-ffmpeg-next.patch
@@ -0,0 +1,193 @@
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -428,7 +428,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "993776b509cfb49c750f11b8f07a46fa23e0a1386ffc01fb1e7d343efc387895"
+ dependencies = [
+- "bitflags 2.10.0",
++ "bitflags 2.11.1",
+  "cexpr",
+  "clang-sys",
+  "itertools 0.13.0",
+@@ -454,9 +454,9 @@
+ 
+ [[package]]
+ name = "bitflags"
+-version = "2.10.0"
++version = "2.11.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "812e12b5285cc515a9c72a5c1d3b6d46a19dac5acfef5265968c166106e31dd3"
++checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3"
+ 
+ [[package]]
+ name = "bitreader"
+@@ -555,7 +555,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "b01fe135c0bd16afe262b6dea349bd5ea30e6de50708cec639aae7c5c14cc7e4"
+ dependencies = [
+- "bitflags 2.10.0",
++ "bitflags 2.11.1",
+  "cairo-sys-rs",
+  "glib",
+  "libc",
+@@ -1132,20 +1132,20 @@
+ 
+ [[package]]
+ name = "ffmpeg-next"
+-version = "8.0.0"
++version = "8.1.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "d658424d233cbd993a972dd73a66ca733acd12a494c68995c9ac32ae1fe65b40"
++checksum = "f7c4bd5ab1ac61f29c634df1175d350ded29cf74c3c6d4f7030431a5ae3c7d5d"
+ dependencies = [
+- "bitflags 2.10.0",
++ "bitflags 2.11.1",
+  "ffmpeg-sys-next",
+  "libc",
+ ]
+ 
+ [[package]]
+ name = "ffmpeg-sys-next"
+-version = "8.0.1"
++version = "8.1.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "9bca20aa4ee774fe384c2490096c122b0b23cf524a9910add0686691003d797b"
++checksum = "a314bc0e022a33a99567ed4bd2576bd58ffd8fcff7891c29194cfecc26a62547"
+ dependencies = [
+  "bindgen",
+  "cc",
+@@ -1709,7 +1709,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "16de123c2e6c90ce3b573b7330de19be649080ec612033d397d72da265f1bd8b"
+ dependencies = [
+- "bitflags 2.10.0",
++ "bitflags 2.11.1",
+  "futures-channel",
+  "futures-core",
+  "futures-executor",
+@@ -1796,7 +1796,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "6e9b31c7fa5ccb9d91317c956e767daef59be9fee3ae9df30468470368678482"
+ dependencies = [
+- "bitflags 2.10.0",
++ "bitflags 2.11.1",
+  "gufo-common",
+  "half",
+  "memmap2",
+@@ -1816,7 +1816,7 @@
+ checksum = "7dfec0cd29d5ecfb1dd723868e22e2c49441020f35d5f14307018ff0a1679e2f"
+ dependencies = [
+  "async-lock",
+- "bitflags 2.10.0",
++ "bitflags 2.11.1",
+  "blocking",
+  "env_logger",
+  "futures-util",
+@@ -2819,7 +2819,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "3d0b95e02c851351f877147b7deea7b1afb1df71b63aa5f8270716e0c5720616"
+ dependencies = [
+- "bitflags 2.10.0",
++ "bitflags 2.11.1",
+  "libc",
+ ]
+ 
+@@ -2829,7 +2829,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "0e5310a2c5b6ffbc094b5f70a2ca7b79ed36ad90e6f90994b166489a1bce3fcc"
+ dependencies = [
+- "bitflags 2.10.0",
++ "bitflags 2.11.1",
+  "libc",
+  "libseccomp-sys",
+  "pkg-config",
+@@ -3190,7 +3190,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "74523f3a35e05aba87a1d978330aef40f67b0304ac79c1c00b294c9830543db6"
+ dependencies = [
+- "bitflags 2.10.0",
++ "bitflags 2.11.1",
+  "cfg-if",
+  "cfg_aliases",
+  "libc",
+@@ -3422,7 +3422,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "08838db121398ad17ab8531ce9de97b244589089e290a384c900cb9ff7434328"
+ dependencies = [
+- "bitflags 2.10.0",
++ "bitflags 2.11.1",
+  "cfg-if",
+  "foreign-types 0.3.2",
+  "libc",
+@@ -3631,7 +3631,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "60769b8b31b2a9f263dae2776c37b1b28ae246943cf719eb6946a1db05128a61"
+ dependencies = [
+- "bitflags 2.10.0",
++ "bitflags 2.11.1",
+  "crc32fast",
+  "fdeflate",
+  "flate2",
+@@ -3996,7 +3996,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
+ dependencies = [
+- "bitflags 2.10.0",
++ "bitflags 2.11.1",
+ ]
+ 
+ [[package]]
+@@ -4242,7 +4242,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "165ca6e57b20e1351573e3729b958bc62f0e48025386970b6e4d29e7a7e71f3f"
+ dependencies = [
+- "bitflags 2.10.0",
++ "bitflags 2.11.1",
+  "chrono",
+  "fallible-iterator",
+  "fallible-streaming-iterator",
+@@ -4323,7 +4323,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "146c9e247ccc180c1f61615433868c99f3de3ae256a30a43b49f67c2d9171f34"
+ dependencies = [
+- "bitflags 2.10.0",
++ "bitflags 2.11.1",
+  "errno",
+  "libc",
+  "linux-raw-sys",
+@@ -4465,7 +4465,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "897b2245f0b511c87893af39b033e5ca9cce68824c4d7e7630b5a1d339658d02"
+ dependencies = [
+- "bitflags 2.10.0",
++ "bitflags 2.11.1",
+  "core-foundation 0.9.4",
+  "core-foundation-sys",
+  "libc",
+@@ -4478,7 +4478,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "b3297343eaf830f66ede390ea39da1d462b6b0c1b000f420d0a83f898bbbe6ef"
+ dependencies = [
+- "bitflags 2.10.0",
++ "bitflags 2.11.1",
+  "core-foundation 0.10.1",
+  "core-foundation-sys",
+  "libc",
+@@ -4844,7 +4844,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "a13f3d0daba03132c0aa9767f98351b3488edc2c100cda2d2ec2b04f3d8d3c8b"
+ dependencies = [
+- "bitflags 2.10.0",
++ "bitflags 2.11.1",
+  "core-foundation 0.9.4",
+  "system-configuration-sys 0.6.0",
+ ]
+@@ -5205,7 +5205,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "d4e6559d53cc268e5031cd8429d05415bc4cb4aefc4aa5d6cc35fbf5b924a1f8"
+ dependencies = [
+- "bitflags 2.10.0",
++ "bitflags 2.11.1",
+  "bytes",
+  "futures-util",
+  "http 1.4.0",
diff --git a/pkgs/by-name/fo/fotema/package.nix b/pkgs/by-name/fo/fotema/package.nix
index 10da6b71cd04..723d9ab9d6aa 100644
--- a/pkgs/by-name/fo/fotema/package.nix
+++ b/pkgs/by-name/fo/fotema/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  applyPatches,
   clangStdenv,
   fetchFromGitHub,
   rustPlatform,
@@ -40,9 +41,17 @@ clangStdenv.mkDerivation (finalAttrs: {
     hash = "sha256-g1CxgK8gaX24TFnlGUons3ve8Ow9YaiMh1kMwlcP/F8=";
   };
 
+  patches = [
+    # Bump ffmpeg-next 8.0.0 -> 8.1.0 in Cargo.lock for ffmpeg 8.1 compatibility.
+    ./cargo-lock-bump-ffmpeg-next.patch
+  ];
+
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) pname version src;
-    hash = "sha256-vA1vB2Lgyo5SfexDC4Ag85nM+/NzsYZNeIH4HmiESHc=";
+    inherit (finalAttrs) pname version;
+    src = applyPatches {
+      inherit (finalAttrs) src patches;
+    };
+    hash = "sha256-AEZY1QODq4F+CTrJce14qA6XSZjv29wSwIqUjZPWJo4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ho/hooky/package.nix b/pkgs/by-name/ho/hooky/package.nix
index 04ba4fb69eb5..9a087b351419 100644
--- a/pkgs/by-name/ho/hooky/package.nix
+++ b/pkgs/by-name/ho/hooky/package.nix
@@ -20,6 +20,11 @@ haskellPackages.mkDerivation {
     hash = "sha256-w4sWD5dZTNKwrYhrJw9RcwGoeNxpJnm/6RRqYjiIiBg=";
   };
 
+  postPatch = ''
+    substituteInPlace src/Hooky/Config.hs \
+      --replace-fail 'KDL.text' 'KDL.string'
+  '';
+
   isLibrary = true;
   isExecutable = true;
   libraryHaskellDepends = with haskellPackages; [
diff --git a/pkgs/by-name/ho/hot-resize/package.nix b/pkgs/by-name/ho/hot-resize/package.nix
index 3afc22dd2067..6c82cd57bc4f 100644
--- a/pkgs/by-name/ho/hot-resize/package.nix
+++ b/pkgs/by-name/ho/hot-resize/package.nix
@@ -15,16 +15,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "hot-resize";
-  version = "0.1.6";
+  version = "0.1.7";
 
   src = fetchFromGitHub {
     owner = "liberodark";
     repo = "hot-resize";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8UA5Wv96PUerBRTwTwkSAv1iw6lt9nd4MXGdKUmxoz4=";
+    hash = "sha256-TMLtU2c5jkZEc14rII/+I1GtUzBnnZgPyPUgghqs7sM=";
   };
 
-  cargoHash = "sha256-uGMd9xZRYbCJyHkUZXvUnN3M5N1FTaROfoww+oODAHE=";
+  cargoHash = "sha256-z9jWAGhSjYFQ8EhK0V4JsxToLYbEB4TJvhJJfUTGZS0=";
 
   nativeBuildInputs = [
     makeWrapper
@@ -43,6 +43,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
       }
   '';
 
+  __structuredAttrs = true;
+
   nativeInstallCheckInputs = [
     versionCheckHook
   ];
diff --git a/pkgs/by-name/ir/ironbar/package.nix b/pkgs/by-name/ir/ironbar/package.nix
index 7dfade94684e..8e4e1f47191c 100644
--- a/pkgs/by-name/ir/ironbar/package.nix
+++ b/pkgs/by-name/ir/ironbar/package.nix
@@ -12,7 +12,6 @@
   gtk4-layer-shell,
   adwaita-icon-theme,
   libxkbcommon,
-  openssl,
   pkg-config,
   hicolor-icon-theme,
   rustPlatform,
@@ -33,16 +32,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "ironbar";
-  version = "0.18.0";
+  version = "0.19.0";
 
   src = fetchFromGitHub {
     owner = "JakeStanger";
     repo = "ironbar";
     rev = "v${version}";
-    hash = "sha256-vhkNdvzY9xd8qmKgKtpVRTdvmS1QxnGKDFCpttqX1GE=";
+    hash = "sha256-9UPBSOgiyBOlUYZlx+xQN5PTPwDWCDdYKdCAhigzHwA=";
   };
 
-  cargoHash = "sha256-ptzq0407IaNrXXiksQKXDUbs2wPTz4GHtnCG49EbOcY=";
+  cargoHash = "sha256-ticVPKKfQnz21LpegKDwAtizi7bavIPEmpXsrZdRN48=";
 
   buildInputs = [
     gtk4
@@ -58,7 +57,6 @@ rustPlatform.buildRustPackage rec {
     systemd
     dbus
   ]
-  ++ lib.optionals (hasFeature "http") [ openssl ]
   ++ lib.optionals (hasFeature "volume") [ libpulseaudio ]
   ++ lib.optionals (hasFeature "cairo") [ luajit ]
   ++ lib.optionals (hasFeature "keyboard") [
diff --git a/pkgs/by-name/la/labwc-tweaks-gtk/package.nix b/pkgs/by-name/la/labwc-tweaks-gtk/package.nix
index f61536173388..0802fd78730f 100644
--- a/pkgs/by-name/la/labwc-tweaks-gtk/package.nix
+++ b/pkgs/by-name/la/labwc-tweaks-gtk/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "labwc-tweaks-gtk";
-  version = "0-unstable-2026-05-09";
+  version = "0-unstable-2026-05-22";
 
   src = fetchFromGitHub {
     owner = "labwc";
     repo = "labwc-tweaks-gtk";
-    rev = "c84d78c601e9f9a6e863766e35f736635cfa52d0";
-    hash = "sha256-qyMgo9QB8wLzZiUlbz/NjTssYy8FB28A5RX7Hd05ays=";
+    rev = "ebe05bef2cf5966a45a42370371ae879c472cf6d";
+    hash = "sha256-5HqxB03yXksRBV/wZa3J5xLEIbv2oZvLp2YQ3FMgd1k=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/lt/lttv/package.nix b/pkgs/by-name/lt/lttv/package.nix
deleted file mode 100644
index c55200acf6a7..000000000000
--- a/pkgs/by-name/lt/lttv/package.nix
+++ /dev/null
@@ -1,52 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  fetchpatch,
-  pkg-config,
-  glib,
-  gtk2,
-  popt,
-  babeltrace,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "lttv";
-  version = "1.5";
-
-  src = fetchurl {
-    url = "https://lttng.org/files/packages/lttv-${finalAttrs.version}.tar.bz2";
-    sha256 = "1faldxnh9dld5k0vxckwpqw241ya1r2zv286l6rpgqr500zqw7r1";
-  };
-
-  patches = [
-    # fix build with gcc14:
-    (fetchpatch {
-      name = "lttv-c99-compatibility-fix.patch";
-      url = "https://git.lttng.org/?p=lttv.git;a=patch;h=6b9d59fe4cc1dc943501ab6ede93856b2f06c3ce";
-      hash = "sha256-zcLHBri0i10NGkgiZT6QRZbixffYvkzLaFBeC/ESF/U=";
-    })
-  ];
-
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [
-    glib
-    gtk2
-    popt
-    babeltrace
-  ];
-
-  meta = {
-    description = "Graphical trace viewer for LTTng trace files";
-    homepage = "https://lttng.org/";
-    # liblttvtraceread (ltt/ directory) is distributed under the GNU LGPL v2.1.
-    # The rest of the LTTV package is distributed under the GNU GPL v2.
-    license = with lib.licenses; [
-      gpl2
-      lgpl21
-    ];
-    platforms = lib.platforms.linux;
-    maintainers = [ lib.maintainers.bjornfor ];
-  };
-
-})
diff --git a/pkgs/by-name/ma/macopix/package.nix b/pkgs/by-name/ma/macopix/package.nix
index 66a06004ae5f..c8dfbd2040e0 100644
--- a/pkgs/by-name/ma/macopix/package.nix
+++ b/pkgs/by-name/ma/macopix/package.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
     # Workaround build failure on -fno-common toolchains:
     #   ld: dnd.o:src/main.h:136: multiple definition of
     #     `MENU_EXT'; main.o:src/main.h:136: first defined here
-    NIX_CFLAGS_COMPILE = "-fcommon";
+    NIX_CFLAGS_COMPILE = "-fcommon -std=gnu99";
     NIX_LDFLAGS = "-lX11";
   };
 
diff --git a/pkgs/by-name/ma/mailspring/package.nix b/pkgs/by-name/ma/mailspring/package.nix
index b90828e6276b..37011710992f 100644
--- a/pkgs/by-name/ma/mailspring/package.nix
+++ b/pkgs/by-name/ma/mailspring/package.nix
@@ -17,10 +17,7 @@ let
       Mailspring's sync engine runs locally, but its source is not open.
     '';
     mainProgram = "mailspring";
-    maintainers = with lib.maintainers; [
-      toschmidt
-      wrench-exile-legacy
-    ];
+    maintainers = with lib.maintainers; [ wrench-exile-legacy ];
     platforms = [
       "x86_64-linux"
       "aarch64-darwin"
diff --git a/pkgs/by-name/mi/mirrord/manifest.json b/pkgs/by-name/mi/mirrord/manifest.json
index e709411eb6a9..d0919eeffcf3 100644
--- a/pkgs/by-name/mi/mirrord/manifest.json
+++ b/pkgs/by-name/mi/mirrord/manifest.json
@@ -1,21 +1,21 @@
 {
-  "version": "3.210.0",
+  "version": "3.211.0",
   "assets": {
     "x86_64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.210.0/mirrord_linux_x86_64",
-      "hash": "sha256-eg7eO97SHZQoju/wH/6IvyEmLi//HXLsDJ3AjeJyPA8="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.211.0/mirrord_linux_x86_64",
+      "hash": "sha256-5ke7ZXbqGAWcwUNW5ofrc0Ez7XS9oekHFuVagFeMwKA="
     },
     "aarch64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.210.0/mirrord_linux_aarch64",
-      "hash": "sha256-J+2jHv3/QhpxOHoCMTJMr1k8TTQfQVYjPGuZeZ0GufQ="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.211.0/mirrord_linux_aarch64",
+      "hash": "sha256-o9Hu5TqPzcOmbwAG40f6CDw5VE/3v3ggXJ6/2RPuReU="
     },
     "aarch64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.210.0/mirrord_mac_universal",
-      "hash": "sha256-GctpfiYZOfkYqbAmTWV+VHxbg4IGc/xhZvacgBltJnU="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.211.0/mirrord_mac_universal",
+      "hash": "sha256-aOPjhsMAVP5Jn8pjxRyr/92HXlMB5nix9BwHoc2uf8A="
     },
     "x86_64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.210.0/mirrord_mac_universal",
-      "hash": "sha256-GctpfiYZOfkYqbAmTWV+VHxbg4IGc/xhZvacgBltJnU="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.211.0/mirrord_mac_universal",
+      "hash": "sha256-aOPjhsMAVP5Jn8pjxRyr/92HXlMB5nix9BwHoc2uf8A="
     }
   }
 }
diff --git a/pkgs/by-name/na/nav/package.nix b/pkgs/by-name/na/nav/package.nix
index 72b5577c752b..58b7b178fd94 100644
--- a/pkgs/by-name/na/nav/package.nix
+++ b/pkgs/by-name/na/nav/package.nix
@@ -4,18 +4,21 @@
   fetchurl,
   autoPatchelfHook,
   libxcrypt-legacy,
+  zlib,
+  testers,
+  nav,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nav";
-  version = "1.5.0";
+  version = "1.5.2";
 
   src = fetchurl {
     url = "https://github.com/Jojo4GH/nav/releases/download/v${finalAttrs.version}/nav-${stdenv.hostPlatform.parsed.cpu.name}-unknown-linux-gnu.tar.gz";
     sha256 =
       {
-        x86_64-linux = "sha256-LQdw8/V1KFNM6TY1rFt/RiZuiRQXM+8HNGkJXDrE/mw=";
-        aarch64-linux = "sha256-SMcdnUxKbJ5GXB358WglIMiPHWsn1uVnjN9UiL3V6dk=";
+        x86_64-linux = "sha256-/A6IZRX8v8yKfcxYxo0gxbsZri2dgTs8YH7H2LauaBE=";
+        aarch64-linux = "sha256-YNS/P6TU7qLPn39X6GyUtjBw7GXOi2btd3AV+etpUhQ=";
       }
       .${stdenv.hostPlatform.system} or (throw "unsupported system ${stdenv.hostPlatform.system}");
   };
@@ -26,6 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     stdenv.cc.cc.lib
     libxcrypt-legacy
+    zlib
   ];
 
   installPhase = ''
@@ -37,6 +41,12 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  passthru.tests = {
+    version = testers.testVersion {
+      package = nav;
+    };
+  };
+
   passthru.updateScript = ./update.sh;
 
   meta = {
diff --git a/pkgs/by-name/ne/netbird/package.nix b/pkgs/by-name/ne/netbird/package.nix
index c67befca45d6..d2b9c19e7bba 100644
--- a/pkgs/by-name/ne/netbird/package.nix
+++ b/pkgs/by-name/ne/netbird/package.nix
@@ -67,13 +67,13 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "netbird-${componentName}";
-  version = "0.71.3";
+  version = "0.71.4";
 
   src = fetchFromGitHub {
     owner = "netbirdio";
     repo = "netbird";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1doOf/rgGbD/YtMY0+j1VM7933zR+G+Vyq6bF5fyuMg=";
+    hash = "sha256-e/fe4wEjz7apA5RZ4nGIaunp0+5NVH4yMHK/l/MfcWI=";
   };
 
   vendorHash = "sha256-NeZuj9o2yu5di+6jbNqCnAw0fI55GA5Otmr77c08QFc=";
diff --git a/pkgs/by-name/nw/nwg-panel/package.nix b/pkgs/by-name/nw/nwg-panel/package.nix
index a0b79ff060b5..a33a524a55e2 100644
--- a/pkgs/by-name/nw/nwg-panel/package.nix
+++ b/pkgs/by-name/nw/nwg-panel/package.nix
@@ -23,14 +23,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "nwg-panel";
-  version = "0.10.13";
+  version = "0.10.15";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = "nwg-panel";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TfE2RjbCBoHcdp9st+HeVhSfTMahZdQaItOIuT8Sxcc=";
+    hash = "sha256-zRoOsVnwn2DQctB9ZP0pAAnf9Ragd2RZGHZGN1KnMsQ=";
   };
 
   # No tests
diff --git a/pkgs/by-name/on/onnxruntime/package.nix b/pkgs/by-name/on/onnxruntime/package.nix
index 08514fbd6c7c..0bfb17de83b2 100644
--- a/pkgs/by-name/on/onnxruntime/package.nix
+++ b/pkgs/by-name/on/onnxruntime/package.nix
@@ -25,6 +25,7 @@
   cudaSupport ? config.cudaSupport,
   ncclSupport ? cudaSupport && cudaPackages.nccl.meta.available,
   rocmSupport ? config.rocmSupport,
+  coremlSupport ? stdenv.hostPlatform.isDarwin,
   withFullProtobuf ? false,
   cudaPackages ? { },
   rocmPackages,
@@ -80,6 +81,30 @@ let
     hash = "sha256-YqgzCyNywixebpHGx16tUuczmFS5pjCz5WjR89mv9eI=";
   };
 
+  coremltools-src = fetchFromGitHub {
+    name = "coremltools-src";
+    owner = "apple";
+    repo = "coremltools";
+    tag = "7.1";
+    hash = "sha256-kajQFHpl+4UK6fp+rM8TP0GiqIFYXPVFc2x1p19rBSw=";
+  };
+
+  fp16-src = fetchFromGitHub {
+    name = "fp16-src";
+    owner = "Maratyszcza";
+    repo = "FP16";
+    rev = "0a92994d729ff76a58f692d3028ca1b64b145d91";
+    hash = "sha256-m2d9bqZoGWzuUPGkd29MsrdscnJRtuIkLIMp3fMmtRY=";
+  };
+
+  psimd-src = fetchFromGitHub {
+    name = "psimd-src";
+    owner = "Maratyszcza";
+    repo = "psimd";
+    rev = "072586a71b55b7f8c584153d223e95687148a900";
+    hash = "sha256-lV+VZi2b4SQlRYrhKx9Dxc6HlDEFz3newvcBjTekupo=";
+  };
+
   isCudaJetson = cudaSupport && cudaPackages.flags.isJetsonBuild;
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
@@ -263,6 +288,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "onnxruntime_USE_CUDA" cudaSupport)
     (lib.cmakeBool "onnxruntime_USE_NCCL" (cudaSupport && ncclSupport))
     (lib.cmakeBool "onnxruntime_USE_MIGRAPHX" rocmSupport)
+    (lib.cmakeBool "onnxruntime_USE_COREML" coremlSupport)
     (lib.cmakeBool "onnxruntime_ENABLE_LTO" (!cudaSupport || cudaPackages.cudaOlder "12.8"))
   ]
   ++ lib.optionals pythonSupport [
@@ -284,6 +310,12 @@ effectiveStdenv.mkDerivation (finalAttrs: {
     # Incompatible with packaged version, far too slow to build vendored version
     (lib.cmakeBool "onnxruntime_USE_COMPOSABLE_KERNEL" false)
     (lib.cmakeBool "onnxruntime_USE_COMPOSABLE_KERNEL_CK_TILE" false)
+  ]
+  ++ lib.optionals coremlSupport [
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_COREMLTOOLS" "${coremltools-src}")
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_FP16" "${fp16-src}")
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_PSIMD" "${psimd-src}")
+    (lib.cmakeFeature "CMAKE_POLICY_VERSION_MINIMUM" "3.5") # needed for psimd
   ];
 
   env =
@@ -314,6 +346,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
     !(
       cudaSupport
       || rocmSupport
+      || coremlSupport
       # cross-compiled test binaries can't execute on the build platform
       || (effectiveStdenv.hostPlatform != effectiveStdenv.buildPlatform)
       || builtins.elem effectiveStdenv.buildPlatform.system [
@@ -337,7 +370,8 @@ effectiveStdenv.mkDerivation (finalAttrs: {
     install -m644 -Dt $out/include \
       ../include/onnxruntime/core/framework/provider_options.h \
       ../include/onnxruntime/core/providers/cpu/cpu_provider_factory.h \
-      ../include/onnxruntime/core/session/onnxruntime_*.h
+      ../include/onnxruntime/core/session/onnxruntime_*.h \
+      ../include/onnxruntime/core/providers/coreml/coreml_provider_factory.h
   '';
 
   # See comments in `cudaPackages.nccl`
diff --git a/pkgs/by-name/po/pokefinder/package.nix b/pkgs/by-name/po/pokefinder/package.nix
index 931aa676ce42..3aaabf75cbef 100644
--- a/pkgs/by-name/po/pokefinder/package.nix
+++ b/pkgs/by-name/po/pokefinder/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pokefinder";
-  version = "4.3.1";
+  version = "4.3.2";
 
   src = fetchFromGitHub {
     owner = "Admiral-Fish";
     repo = "PokeFinder";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-tItPvA0f2HnY7SUSnb7A5jGwbRs7eQoS4vibBomZ9pw=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-viObYX9W1bUzwGyf7rI1gQeB9OHlLfj5Uny0js/1f6M=";
     fetchSubmodules = true;
   };
 
@@ -27,6 +27,32 @@ stdenv.mkDerivation (finalAttrs: {
     ./set-desktop-file-name.patch
   ];
 
+  postPatch = ''
+        substituteInPlace CMakeLists.txt \
+          --replace-fail 'set(CMAKE_OSX_ARCHITECTURES "x86_64;arm64")' ""
+        substituteInPlace Core/CMakeLists.txt \
+          --replace-fail 'if (APPLE)' 'if (FALSE)'
+        substituteInPlace Core/RNG/SHA1.cpp \
+          --replace-fail '#include "SHA1.hpp"' '#include "SHA1.hpp"
+    #include <algorithm>'
+
+        mkdir -p Core/Resources/compression
+        touch Core/Resources/compression/__init__.py
+        cat <<EOF > Core/Resources/compression/zstd.py
+    import zstandard as zstd
+
+    def compress(data, level=3):
+        cctx = zstd.ZstdCompressor(level=level)
+        return cctx.compress(data)
+
+    def decompress(data):
+        dctx = zstd.ZstdDecompressor()
+        return dctx.decompress(data)
+    EOF
+  '';
+
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isAarch "-flax-vector-conversions";
+
   installPhase = ''
     runHook preInstall
   ''
diff --git a/pkgs/by-name/po/portablemc/package.nix b/pkgs/by-name/po/portablemc/package.nix
index 2e795d12a94e..cd22a688b430 100644
--- a/pkgs/by-name/po/portablemc/package.nix
+++ b/pkgs/by-name/po/portablemc/package.nix
@@ -1,96 +1,136 @@
 {
   lib,
   stdenv,
-  python3Packages,
   fetchFromGitHub,
-  installShellFiles,
-  jre,
 
+  rustPlatform,
+  pkg-config,
+  openssl,
+
+  makeWrapper,
+
+  addDriverRunpath,
+  alsa-lib,
+  glfw3-minecraft,
+  libGL,
+  libjack2,
+  libpulseaudio,
   libx11,
-  libxext,
   libxcursor,
+  libxext,
   libxrandr,
   libxxf86vm,
-  libpulseaudio,
-  libGL,
-  glfw,
   openal,
+  pipewire,
   udev,
+  vulkan-loader,
 
   textToSpeechSupport ? stdenv.hostPlatform.isLinux,
   flite,
+
+  pciutils,
+  xrandr,
+
+  jdk25,
+  jdk21,
+  jdk17,
+  jdk8,
+
+  # can be overriden to reduce the closure size
+  jvms ? [
+    jdk25
+    jdk21
+    jdk17
+    jdk8
+  ],
+
+  additionalLibs ? [ ],
+  additionalPrograms ? [ ],
 }:
 
 let
   # Copied from the `prismlauncher` package
   runtimeLibs = [
-    # lwjgl
-    libGL
-    glfw
-    openal
     (lib.getLib stdenv.cc.cc)
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    ## native versions
+    glfw3-minecraft
+    openal
+
+    ## openal
+    alsa-lib
+    libjack2
+    libpulseaudio
+    pipewire
+
+    ## glfw
+    libGL
     libx11
-    libxext
     libxcursor
+    libxext
     libxrandr
     libxxf86vm
 
-    # lwjgl
-    libpulseaudio
+    udev # oshi
 
-    # oshi
-    udev
+    vulkan-loader # VulkanMod's lwjgl
   ]
-  ++ lib.optional textToSpeechSupport flite;
+  ++ lib.optional textToSpeechSupport flite
+  ++ additionalLibs;
+
+  # Copied from the `prismlauncher` package
+  runtimePrograms = [
+    pciutils # need lspci
+    xrandr # needed for LWJGL [2.9.2, 3) https://github.com/LWJGL/lwjgl/issues/128
+  ]
+  ++ additionalPrograms;
+
 in
-python3Packages.buildPythonApplication (finalAttrs: {
+stdenv.mkDerivation (finalAttrs: {
   pname = "portablemc";
-  version = "4.4.1";
-  pyproject = true;
+  version = "5.0.3";
 
   src = fetchFromGitHub {
     owner = "theorzr";
     repo = "portablemc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KE1qf6aIcDjwKzrdKDUmriWfAt+vuriew6ixHKm0xs8=";
+    hash = "sha256-P/ah7pwOdbgRDgpvhEDcNA1RiDzG2nYZCR13vzljLd8=";
   };
 
-  patches = [
-    # Use the jre package provided by nixpkgs by default
-    ./use-builtin-java.patch
-  ];
+  dontUnpack = true;
 
-  nativeBuildInputs = [ installShellFiles ];
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-Ub9XVc6gcu6fEiOheew9Uh3LqdaSzVKITboDTK+MQUI=";
+  };
 
-  build-system = [ python3Packages.poetry-core ];
+  unwrapped = rustPlatform.buildRustPackage {
+    name = "portablemc-${finalAttrs.version}-unwrapped";
+    inherit (finalAttrs) src cargoDeps;
 
-  dependencies = [ python3Packages.certifi ];
+    nativeBuildInputs = [ pkg-config ];
 
-  # Note: Tests use networking, so we don't run them
+    buildInputs = [ openssl ];
+  };
 
-  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-    installShellCompletion --cmd portablemc \
-        --bash <($out/bin/portablemc show completion bash) \
-        --zsh <($out/bin/portablemc show completion zsh)
-  '';
+  strictDeps = true;
+  nativeBuildInputs = [ makeWrapper ];
 
-  preFixup = ''
-    makeWrapperArgs+=(
-      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath runtimeLibs}
-      --prefix PATH : ${lib.makeBinPath [ jre ]}
-    )
+  installPhase = ''
+    runHook preInstall
+
+    makeWrapper "$unwrapped/bin/portablemc" "$out/bin/portablemc" \
+      ${lib.optionalString stdenv.hostPlatform.isLinux ''
+        --prefix LD_LIBRARY_PATH : "${addDriverRunpath.driverLink}/lib:${lib.makeLibraryPath runtimeLibs}" \
+        --prefix PATH : "${lib.makeBinPath runtimePrograms}" \
+      ''} \
+      --prefix PATH : ${lib.makeBinPath jvms}
+
+    runHook postInstall
   '';
 
   meta = {
     homepage = "https://github.com/theorzr/portablemc";
-    description = "Fast, reliable and cross-platform command-line Minecraft launcher and API for developers";
-    longDescription = ''
-      A fast, reliable and cross-platform command-line Minecraft launcher and API for developers.
-      Including fast and easy installation of common mod loaders such as Fabric, Forge, NeoForge and Quilt.
-      This launcher is compatible with the standard Minecraft directories.
-    '';
+    description = "Cross platform command line utility for launching Minecraft quickly and reliably with included support for Mojang versions and popular mod loaders";
     changelog = "https://github.com/theorzr/portablemc/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.gpl3Only;
     mainProgram = "portablemc";
diff --git a/pkgs/by-name/po/portablemc/use-builtin-java.patch b/pkgs/by-name/po/portablemc/use-builtin-java.patch
deleted file mode 100644
index a88d97bae9b5..000000000000
--- a/pkgs/by-name/po/portablemc/use-builtin-java.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-diff --git a/portablemc/standard.py b/portablemc/standard.py
-index f59c55d..0f017e1 100644
---- a/portablemc/standard.py
-+++ b/portablemc/standard.py
-@@ -843,6 +843,8 @@ class Version:
-         if jvm_major_version is not None and not isinstance(jvm_major_version, int):
-             raise ValueError("metadata: /javaVersion/majorVersion must be an integer")
- 
-+        return self._resolve_builtin_jvm(watcher, JvmNotFoundError.UNSUPPORTED_ARCH, jvm_major_version)
-+
-         if platform.system() == "Linux" and platform.libc_ver()[0] != "glibc":
-             return self._resolve_builtin_jvm(watcher, JvmNotFoundError.UNSUPPORTED_LIBC, jvm_major_version)
- 
-@@ -926,31 +928,10 @@ class Version:
-         builtin_path = shutil.which(jvm_bin_filename)
-         if builtin_path is None:
-             raise JvmNotFoundError(reason)
--        
--        try:
--            
--            # Get version of the JVM.
--            process = Popen([builtin_path, "-version"], bufsize=1, stdout=PIPE, stderr=STDOUT, universal_newlines=True)
--            stdout, _stderr = process.communicate(timeout=1)
--
--            version_start = stdout.index(f"1.{major_version}" if major_version <= 8 else str(major_version))
--            version = None
--            
--            # Parse version by getting all character that are numeric or '.'.
--            for i, ch in enumerate(stdout[version_start:]):
--                if not ch.isnumeric() and ch not in (".", "_"):
--                    version = stdout[version_start:i]
--                    break
--            
--            if version is None:
--                raise ValueError()
--
--        except (TimeoutExpired, ValueError):
--            raise JvmNotFoundError(JvmNotFoundError.BUILTIN_INVALID_VERSION)
- 
-         self._jvm_path = Path(builtin_path)
--        self._jvm_version = version
--        watcher.handle(JvmLoadedEvent(version, JvmLoadedEvent.BUILTIN))
-+        self._jvm_version = "nixpkgs"
-+        watcher.handle(JvmLoadedEvent("nixpkgs", JvmLoadedEvent.BUILTIN))
- 
-     def _download(self, watcher: Watcher) -> None:
-         
diff --git a/pkgs/by-name/pr/praat/package.nix b/pkgs/by-name/pr/praat/package.nix
index 08b5e00ceef1..78ee87bb9771 100644
--- a/pkgs/by-name/pr/praat/package.nix
+++ b/pkgs/by-name/pr/praat/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "praat";
-  version = "6.4.63";
+  version = "6.4.65";
 
   src = fetchFromGitHub {
     owner = "praat";
     repo = "praat.github.io";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-96fw5WRk1/zex65hcRdmx0wq2FTVett3FRDPhmsZr6g=";
+    hash = "sha256-v4cAFLSJllrNgTm6ewR40HYvdi8a1bZcEBz/BTdFsxA=";
   };
 
   strictDeps = true;
@@ -44,9 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
   configurePhase = ''
     runHook preConfigure
 
-    cp makefiles/makefile.defs.linux.pulse-gcc.${
-      if stdenv.hostPlatform.isLittleEndian then "LE" else "BE"
-    } makefile.defs
+    cp makefiles/makefile.defs.linux.pulse-gcc makefile.defs
 
     runHook postConfigure
   '';
diff --git a/pkgs/by-name/qu/qui/package.nix b/pkgs/by-name/qu/qui/package.nix
index a9b394da46d9..02ea8d115375 100644
--- a/pkgs/by-name/qu/qui/package.nix
+++ b/pkgs/by-name/qu/qui/package.nix
@@ -6,7 +6,7 @@
   nixosTests,
   nix-update-script,
   nodejs,
-  pnpm_9,
+  pnpm_11,
   fetchPnpmDeps,
   pnpmConfigHook,
   typescript,
@@ -14,12 +14,12 @@
 }:
 buildGo126Module (finalAttrs: {
   pname = "qui";
-  version = "1.18.0";
+  version = "1.19.0";
   src = fetchFromGitHub {
     owner = "autobrr";
     repo = "qui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Rdg8fcoUY7WrNXj+LZyMXx6hFo8+OGrCLjhE3JD1y4o=";
+    hash = "sha256-h6GmxwOxqh88Zy7tFD/GFQ8NrpBcanFPBXGUmfoIe3I=";
   };
 
   qui-web = stdenvNoCC.mkDerivation (finalAttrs': {
@@ -29,7 +29,7 @@ buildGo126Module (finalAttrs: {
     nativeBuildInputs = [
       nodejs
       pnpmConfigHook
-      pnpm_9
+      pnpm_11
       typescript
     ];
 
@@ -42,9 +42,9 @@ buildGo126Module (finalAttrs: {
         src
         sourceRoot
         ;
-      pnpm = pnpm_9;
+      pnpm = pnpm_11;
       fetcherVersion = 3;
-      hash = "sha256-hCiIbVroyMhl2xT0WAGbmLSXfUH6RJHlC1g3isMlUJs=";
+      hash = "sha256-OEr5uyMnwP1TkSxRFNaopB9AAx2OVE7lNEzGyQwF6kc=";
     };
 
     postBuild = ''
@@ -56,7 +56,7 @@ buildGo126Module (finalAttrs: {
     '';
   });
 
-  vendorHash = "sha256-7MzKE3pBvoW/ajB6gHtBBS1M/NuQsRw3ZSNtCJzrEyI=";
+  vendorHash = "sha256-pkktl+0dBSbUuxZ1ycTV0HZl/wO79LtmNaamyZ+Z9lY=";
 
   preBuild = ''
     cp -r ${finalAttrs.qui-web}/* web/dist
diff --git a/pkgs/by-name/qw/qwen-code/package.nix b/pkgs/by-name/qw/qwen-code/package.nix
index f4c863b0d39c..50a1d4e02c9c 100644
--- a/pkgs/by-name/qw/qwen-code/package.nix
+++ b/pkgs/by-name/qw/qwen-code/package.nix
@@ -14,17 +14,17 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "qwen-code";
-  version = "0.15.11";
+  version = "0.16.0";
 
   src = fetchFromGitHub {
     owner = "QwenLM";
     repo = "qwen-code";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6ArEbnJOAKexoSy7Epis5OC8XYmmQpZPILtUEv4E0k4=";
+    hash = "sha256-XWhQ5GlAGW0WAyiPwBULLz1yQps2IdjVkusQ0a88tCs=";
   };
 
   npmDepsFetcherVersion = 3;
-  npmDepsHash = "sha256-J/dvHeC38uiZKgB6mGAnlCbAKXdai/mMzdP1E1Pa6Yg=";
+  npmDepsHash = "sha256-dRc+hTk5ELw0rJhT71heFnLjTmjN1UpIOHUMXKt4YwU=";
 
   # npm 11 incompatible with fetchNpmDeps
   # https://github.com/NixOS/nixpkgs/issues/474535
diff --git a/pkgs/by-name/ro/roave-backward-compatibility-check/package.nix b/pkgs/by-name/ro/roave-backward-compatibility-check/package.nix
index 92df6bc019d7..afd30beb1191 100644
--- a/pkgs/by-name/ro/roave-backward-compatibility-check/package.nix
+++ b/pkgs/by-name/ro/roave-backward-compatibility-check/package.nix
@@ -7,16 +7,16 @@
 
 php.buildComposerProject2 (finalAttrs: {
   pname = "roave-backward-compatibility-check";
-  version = "8.20.0";
+  version = "8.21.0";
 
   src = fetchFromGitHub {
     owner = "Roave";
     repo = "BackwardCompatibilityCheck";
     tag = finalAttrs.version;
-    hash = "sha256-skLTpDak2mgltZpDrNLQXw00omLW/xW5hBPNuX/noSc=";
+    hash = "sha256-kCs9lDvbhUacOH4bEAZjm2LzHSvJnVMR9lzmt00GgTw=";
   };
 
-  vendorHash = "sha256-v8Wv5BK9r3zYst1P0AcpkYCcl0iBvWt+UL2+fEF8Ahw=";
+  vendorHash = "sha256-68KE/ieWYST/jQMaaK5lLqBLEmI4YhYPOE4XuXNMfqM=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/by-name/rt/rtk/package.nix b/pkgs/by-name/rt/rtk/package.nix
index 239b12843bef..942cbf312e8c 100644
--- a/pkgs/by-name/rt/rtk/package.nix
+++ b/pkgs/by-name/rt/rtk/package.nix
@@ -12,17 +12,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rtk";
-  version = "0.40.0";
+  version = "0.41.0";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "rtk-ai";
     repo = "rtk";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xWHIOZRpSyyOPQe/db9dxoODcnheBlpXrnKET010vVg=";
+    hash = "sha256-C8ns53qLpBdb5osdX68UBGMqM2Rs5UJyfal/iDns6a4=";
   };
 
-  cargoHash = "sha256-DJazpSx1FCt9pjFjqsoL3MLEQLdFvLwEj3UsP0aYHmc=";
+  cargoHash = "sha256-gDkXAiW8ajEpsEBb7KT9MO5fPEWyUqS+2ak34cipPdc=";
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/by-name/ru/ruff/package.nix b/pkgs/by-name/ru/ruff/package.nix
index bc1345b250c4..08d40e4e30ff 100644
--- a/pkgs/by-name/ru/ruff/package.nix
+++ b/pkgs/by-name/ru/ruff/package.nix
@@ -16,7 +16,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ruff";
-  version = "0.15.13";
+  version = "0.15.14";
 
   __structuredAttrs = true;
 
@@ -24,12 +24,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "astral-sh";
     repo = "ruff";
     tag = finalAttrs.version;
-    hash = "sha256-Sr5eD5aZP+1/wbRHQjampWbWea+rXshcwOfCr4JCvxA=";
+    hash = "sha256-Z8UhVS+YbYAxVWodU/I+p3Ns5/EpmzBTChcbkvJwe6Y=";
   };
 
   cargoBuildFlags = [ "--package=ruff" ];
 
-  cargoHash = "sha256-3y7kqhAUXZ+Ui6quGEDSRXrh3ii9NJLoFWnGX/Mp0l4=";
+  cargoHash = "sha256-GnRC5jXySAna7uAKPDtpPQUJe8AKqVSU+ynmGKZtfTs=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/sa/samrewritten/package.nix b/pkgs/by-name/sa/samrewritten/package.nix
index f282f60c539c..22c6dc8bfba5 100644
--- a/pkgs/by-name/sa/samrewritten/package.nix
+++ b/pkgs/by-name/sa/samrewritten/package.nix
@@ -15,16 +15,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "samrewritten";
-  version = "1.2.3";
+  version = "1.3.4";
 
   src = fetchFromGitHub {
     owner = "PaulCombal";
     repo = "SamRewritten";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-UHq09i0f7tLgAMIEA+GrLqKxzdsFmUrp3iIGAM+MXJ0=";
+    hash = "sha256-5SXek64kccyUs+vSyA8QCX+UpRSm0aDEZwULYZgmIUw=";
   };
 
-  cargoHash = "sha256-jPCF+wIb+DESph5dtF80NV7ydxWm09BQyf4eO2BKmNI=";
+  cargoHash = "sha256-sL6kIkYWnD7QKw/RGMDS9ZZK/LcKtYjFr5pQ6758IuQ=";
 
   # Tests require network access and a running Steam client. Skipping.
   doCheck = false;
diff --git a/pkgs/by-name/sh/sherpa-onnx/package.nix b/pkgs/by-name/sh/sherpa-onnx/package.nix
index b09d89265c8b..bc584ff8a08f 100644
--- a/pkgs/by-name/sh/sherpa-onnx/package.nix
+++ b/pkgs/by-name/sh/sherpa-onnx/package.nix
@@ -191,6 +191,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   doCheck = true;
 
+  preCheck = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    export DYLD_FALLBACK_LIBRARY_PATH=${lib.getLib onnxruntime}/lib
+  '';
+
   # Use ctest directly because the default `make check` target includes clang-tidy.
   checkPhase = ''
     runHook preCheck
@@ -202,6 +206,10 @@ stdenv.mkDerivation (finalAttrs: {
     mkdir -p $python
     cp -r ../sherpa-onnx/python/sherpa_onnx $python/
     rm $out/lib/_sherpa_onnx*.so
+    ${lib.optionalString stdenv.hostPlatform.isDarwin ''
+      install_name_tool -add_rpath ${lib.getLib onnxruntime}/lib \
+        $python/sherpa_onnx/lib/_sherpa_onnx*.so
+    ''}
   '';
 
   passthru = {
diff --git a/pkgs/by-name/sn/sngrep/fix-sng_strncpy-declaration.patch b/pkgs/by-name/sn/sngrep/fix-sng_strncpy-declaration.patch
new file mode 100644
index 000000000000..5f2aa4d573f6
--- /dev/null
+++ b/pkgs/by-name/sn/sngrep/fix-sng_strncpy-declaration.patch
@@ -0,0 +1,15 @@
+--- a/src/util.h
++++ b/src/util.h
+@@ -58,6 +58,12 @@
+ char *
+ sng_basename(const char *name);
+ 
++/**
++ * @brief Wrapper for strncpy
++ */
++char *
++sng_strncpy(char *dst, const char *src, size_t len);
++
+ /**
+  * @brief Compare two timeval structures
+  *
diff --git a/pkgs/by-name/sn/sngrep/package.nix b/pkgs/by-name/sn/sngrep/package.nix
index 67eb2b6ff149..a0033a48bfa5 100644
--- a/pkgs/by-name/sn/sngrep/package.nix
+++ b/pkgs/by-name/sn/sngrep/package.nix
@@ -4,32 +4,35 @@
   autoconf,
   automake,
   fetchFromGitHub,
+  libgcrypt,
   libpcap,
   ncurses,
   openssl,
   pcre,
+  pkg-config,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sngrep";
-  version = "1.8.2";
+  version = "1.8.3";
 
   src = fetchFromGitHub {
     owner = "irontec";
     repo = "sngrep";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-nvuT//FWJAa6DzmjBsBW9s2p1M+6Zs4cVmpK4dVemnE=";
+    hash = "sha256-4DLbQ3OOMvJw37n3jVuztG49HlPbWrfxByi6g6AvELQ=";
   };
 
   nativeBuildInputs = [
     autoconf
     automake
+    pkg-config
   ];
 
   buildInputs = [
+    libgcrypt
     libpcap
     ncurses
-    ncurses
     openssl
     pcre
   ];
@@ -42,6 +45,10 @@ stdenv.mkDerivation (finalAttrs: {
     "--with-openssl"
   ];
 
+  patches = [
+    ./fix-sng_strncpy-declaration.patch
+  ];
+
   preConfigure = ''
     ./bootstrap.sh
   '';
diff --git a/pkgs/by-name/so/solanum/package.nix b/pkgs/by-name/so/solanum/package.nix
index d001db6151cd..cb0e89a330c8 100644
--- a/pkgs/by-name/so/solanum/package.nix
+++ b/pkgs/by-name/so/solanum/package.nix
@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "solanum";
-  version = "0-unstable-2026-05-13";
+  version = "0-unstable-2026-05-23";
 
   src = fetchFromGitHub {
     owner = "solanum-ircd";
     repo = "solanum";
-    rev = "8cbf75cc728f99224fe0f2fa86689db07a317ea9";
-    hash = "sha256-6+EkYOgiQo6mD7O7Id74WTRJ4FtBie1/i+SBj+g7su8=";
+    rev = "dfe6757a577109d2180465da6270b5a6bc08f8d7";
+    hash = "sha256-ngg/0HPZeCYodIWt8p9zpCj6hQMiVoc9E2cm/87eE8k=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/sp/speedify/package.nix b/pkgs/by-name/sp/speedify/package.nix
index 9d83ca8c86fd..592d86ada965 100644
--- a/pkgs/by-name/sp/speedify/package.nix
+++ b/pkgs/by-name/sp/speedify/package.nix
@@ -3,17 +3,18 @@
   stdenv,
   dpkg,
   fetchurl,
-  procps,
-  net-tools,
+  libgcc,
+  libnetfilter_conntrack,
   autoPatchelfHook,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "speedify";
-  version = "15.8.2-12611";
+  # Find latest version within https://apt.connectify.me/dists/speedify/main/binary-amd64/Packages.gz
+  version = "16.7.0-12928";
 
   src = fetchurl {
     url = "https://apt.connectify.me/pool/main/s/speedify/speedify_${finalAttrs.version}_amd64.deb";
-    hash = "sha256-61GQZkXBe3EQpOUODpL60SCHJO0FGqvpL9xFn+q+kPs=";
+    hash = "sha256-A77LYBGLAgoRFV64/ZmpTL76NQx6xHq0a7leDYi9Izg=";
   };
 
   nativeBuildInputs = [
@@ -22,8 +23,8 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
-    procps
-    net-tools
+    libgcc
+    libnetfilter_conntrack
   ];
 
   installPhase = ''
diff --git a/pkgs/by-name/st/starlark/package.nix b/pkgs/by-name/st/starlark/package.nix
index 7f4f4d885785..57ca8a24f0a1 100644
--- a/pkgs/by-name/st/starlark/package.nix
+++ b/pkgs/by-name/st/starlark/package.nix
@@ -6,13 +6,13 @@
 }:
 buildGoModule {
   pname = "starlark";
-  version = "0-unstable-2026-03-26";
+  version = "0-unstable-2026-05-22";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "starlark-go";
-    rev = "fadfc96def35ea95e7f2bd9952256d4db1d80d91";
-    hash = "sha256-t+7QUORMlRCA1lLhekPrR3ag7hmX++DrSOBQunTMLFM=";
+    rev = "ec58d4b459e2866ed51124596d888ed7aa4f90b8";
+    hash = "sha256-9H0TIp2CIGo5Rqld9Xvsg/uQmfswiUzSsu7vwazjcho=";
   };
 
   vendorHash = "sha256-Ejw5f5ulEcLHm4WYKatwA7FZ9lfdqZTOE3SdkaK6jYE=";
diff --git a/pkgs/by-name/st/streamcontroller/package.nix b/pkgs/by-name/st/streamcontroller/package.nix
index 14a47105110d..c61531459adc 100644
--- a/pkgs/by-name/st/streamcontroller/package.nix
+++ b/pkgs/by-name/st/streamcontroller/package.nix
@@ -18,19 +18,19 @@
 }:
 let
   # We have to hardcode revision because upstream often create multiple releases for the same version number.
-  # This is the commit hash that maps to 1.5.0-beta.13 released on 2025-12-30
-  rev = "359de976eb23120d6e6a2d31104e15b37d1edfeb";
+  # This is the commit hash that maps to 1.5.0-beta.14 released on 2026-5-21
+  rev = "12052dec15d0e0948032c7ec11eff2da0d109106";
 in
 stdenv.mkDerivation {
   pname = "streamcontroller";
 
-  version = "1.5.0-beta.13";
+  version = "1.5.0-beta.14";
 
   src = fetchFromGitHub {
     repo = "StreamController";
     owner = "StreamController";
     inherit rev;
-    hash = "sha256-b5tRhXEQGRhaJd1Q/hlmqUTO+0F+3+lziYSi8QpUa9c=";
+    hash = "sha256-JGJc7bj58oZwvtExSv+tv7Ug84RYdEkcMBI3ZmqpaKY=";
   };
 
   # The installation method documented upstream
@@ -200,7 +200,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Elegant Linux app for the Elgato Stream Deck with support for plugins";
-    homepage = "https://core447.com/";
+    homepage = "https://streamcontroller.core447.com/";
     license = lib.licenses.gpl3;
     mainProgram = "streamcontroller";
     maintainers = with lib.maintainers; [ sifmelcara ];
diff --git a/pkgs/by-name/up/updatecli/package.nix b/pkgs/by-name/up/updatecli/package.nix
index ccba32226c20..45243ebb97de 100644
--- a/pkgs/by-name/up/updatecli/package.nix
+++ b/pkgs/by-name/up/updatecli/package.nix
@@ -12,16 +12,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "updatecli";
-  version = "0.116.3";
+  version = "0.117.0";
 
   src = fetchFromGitHub {
     owner = "updatecli";
     repo = "updatecli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-5dJfbw0xoB34XuCym/TcqwdeUORZezfJNu7Plt82VPM=";
+    hash = "sha256-9nA+sOlcIm5Try0oag1Oz/ALPDaMag0jZKzHrS0Brf8=";
   };
 
-  vendorHash = "sha256-cMXepPUJoJGRlQSRSByA2/pjsQXfyH8Va320CywxxDw=";
+  proxyVendor = true;
+  vendorHash = "sha256-8WPwZjoDbRDi1IbjdZ40796JA5PRh8T75wRlWgTF7dI=";
 
   # tests require network access
   doCheck = false;
diff --git a/pkgs/by-name/uv/uv/package.nix b/pkgs/by-name/uv/uv/package.nix
index dca877c6060e..a754b34d8058 100644
--- a/pkgs/by-name/uv/uv/package.nix
+++ b/pkgs/by-name/uv/uv/package.nix
@@ -18,17 +18,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "uv";
-  version = "0.11.15";
+  version = "0.11.16";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "uv";
     tag = finalAttrs.version;
-    hash = "sha256-Nwf7DSxXG5F515LW19q+2VpXtdVLUWx2sMQr35lvsgk=";
+    hash = "sha256-5LJspcHj/RjOMv7eRB7n+tofX4s51M3kqHCPymCg90A=";
   };
 
-  cargoHash = "sha256-PWkDAl6jkpZBz19mz4ZQmiA/RvgFC0KOftXQtZ0SFdk=";
+  cargoHash = "sha256-2lg86WxPGVbJ91zi61lKrSqnzFgmmSrBrl+SfV5SJWU=";
 
   buildInputs = [
     rust-jemalloc-sys
diff --git a/pkgs/by-name/wc/wcslib/package.nix b/pkgs/by-name/wc/wcslib/package.nix
index a56265119a1f..34cd40987cb3 100644
--- a/pkgs/by-name/wc/wcslib/package.nix
+++ b/pkgs/by-name/wc/wcslib/package.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wcslib";
-  version = "8.7";
+  version = "8.8";
 
   src = fetchurl {
     url = "ftp://ftp.atnf.csiro.au/pub/software/wcslib/wcslib-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-eS/gXAlURDOppOpUgPrNvsLabSgFgnW16QBqHyjFZGU=";
+    hash = "sha256-3NW5UuaAFtDiRZ4fD5hmND54uTljXbZEKfz0eOHqS/w=";
   };
 
   # error: call to undeclared library function 'snprintf'
diff --git a/pkgs/by-name/wg/wgsl-analyzer/package.nix b/pkgs/by-name/wg/wgsl-analyzer/package.nix
index 14872174f4b7..9c670bbd998f 100644
--- a/pkgs/by-name/wg/wgsl-analyzer/package.nix
+++ b/pkgs/by-name/wg/wgsl-analyzer/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wgsl-analyzer";
-  version = "2026-03-13";
+  version = "2026-04-26";
 
   src = fetchFromGitHub {
     owner = "wgsl-analyzer";
     repo = "wgsl-analyzer";
     tag = finalAttrs.version;
-    hash = "sha256-a1H/QJhLdBiwjqiG3icsKrSMz079yBjdBKffGANgdTQ=";
+    hash = "sha256-OmXuUqkoLYs4R6Bb0oguiC3oG0C+F0Vy3X8DTNnlFYU=";
   };
 
-  cargoHash = "sha256-UM8oEg8gpsq9lnoDpeArGTl36EE7Tn6YMHXEIagVGvI=";
+  cargoHash = "sha256-fWgpzuo9+VfG3/mf2Bpfc9ZuzpL9Cap0BkXLyuBaq+s=";
 
   checkFlags = [
     # Imports failures
diff --git a/pkgs/by-name/wh/whatsapp-for-mac/package.nix b/pkgs/by-name/wh/whatsapp-for-mac/package.nix
index d9cef26bc0db..afb42a53d69e 100644
--- a/pkgs/by-name/wh/whatsapp-for-mac/package.nix
+++ b/pkgs/by-name/wh/whatsapp-for-mac/package.nix
@@ -10,13 +10,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "whatsapp-for-mac";
-  version = "2.26.10.18";
+  version = "2.26.19.17";
 
   src = fetchzip {
     extension = "zip";
     name = "WhatsApp.app";
     url = "https://web.whatsapp.com/desktop/mac_native/release/?version=${finalAttrs.version}&extension=zip&configuration=Release&branch=master";
-    hash = "sha256-cQB2AF/emNHtSpf1DrjCV+yds8kbD2Lv9UTkAo7CZlM=";
+    hash = "sha256-jR8Hi4IWSfPvCthe/zH6mACQYQsGLcBmj2m8vwXX8Do=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/xq/xqilla/package.nix b/pkgs/by-name/xq/xqilla/package.nix
index a76ccea14a00..15df00cf7510 100644
--- a/pkgs/by-name/xq/xqilla/package.nix
+++ b/pkgs/by-name/xq/xqilla/package.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://sourceforge/xqilla/XQilla-${finalAttrs.version}.tar.gz";
-    sha256 = "0m9z7diw7pdyb4qycbqyr2x55s13v8310xsi7yz0inpw27q4vzdd";
+    hash = "sha256-KSYxeRYx/i5+uXJzdzNQY6SPEmEdZB0Clml+DAdZAus=";
   };
 
   patches = [
@@ -29,6 +29,8 @@ stdenv.mkDerivation (finalAttrs: {
     "CXXFLAGS=-std=c++14"
   ];
 
+  enableParallelBuilding = true;
+
   buildInputs = [
     xercesc
   ];
diff --git a/pkgs/development/octave-modules/datatypes/default.nix b/pkgs/development/octave-modules/datatypes/default.nix
index 4bdeb14888d4..59ad7b8388b0 100644
--- a/pkgs/development/octave-modules/datatypes/default.nix
+++ b/pkgs/development/octave-modules/datatypes/default.nix
@@ -7,13 +7,13 @@
 
 buildOctavePackage rec {
   pname = "datatypes";
-  version = "1.2.2";
+  version = "1.2.3";
 
   src = fetchFromGitHub {
     owner = "pr0m1th3as";
     repo = "datatypes";
     tag = "release-${version}";
-    sha256 = "sha256-qgFYyRMrdWhbHBvOEsDAetpllr5yyhtoEB+7Ri6zbSI=";
+    sha256 = "sha256-WyuL1xDRw4QPouJbJ8op8mh2fLOBfPLUnp4syKmyYLE=";
   };
 
   passthru.updateScript = nix-update-script { extraArgs = [ "--version-regex=release-(.*)" ]; };
diff --git a/pkgs/development/python-modules/aiolyric/default.nix b/pkgs/development/python-modules/aiolyric/default.nix
index 316e1f3aed84..df2a318f6ac2 100644
--- a/pkgs/development/python-modules/aiolyric/default.nix
+++ b/pkgs/development/python-modules/aiolyric/default.nix
@@ -4,7 +4,7 @@
   aioresponses,
   buildPythonPackage,
   fetchFromGitHub,
-  incremental,
+  packaging,
   pytest-asyncio,
   pytestCheckHook,
   setuptools,
@@ -12,24 +12,27 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "aiolyric";
-  version = "2.1.0";
+  version = "2.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "timmo001";
     repo = "aiolyric";
     tag = finalAttrs.version;
-    hash = "sha256-kLsq1pBRWz49DZgX47k132OipDcfn+kby6/GYDL3pPc=";
+    hash = "sha256-+OYMe63sX5TtvJpNn6dzvnephlhS/MyFXmUerYZqF5A=";
   };
 
   build-system = [
-    incremental
     setuptools
   ];
 
+  pythonRelaxDeps = [
+    "packaging"
+  ];
+
   dependencies = [
     aiohttp
-    incremental
+    packaging
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/ansible/core.nix b/pkgs/development/python-modules/ansible/core.nix
index eb3dcf16e611..c812c039ed9f 100644
--- a/pkgs/development/python-modules/ansible/core.nix
+++ b/pkgs/development/python-modules/ansible/core.nix
@@ -32,7 +32,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "ansible-core";
-  version = "2.20.5";
+  version = "2.21.0";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -41,7 +41,7 @@ buildPythonPackage (finalAttrs: {
     owner = "ansible";
     repo = "ansible";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-AU6LTKqtBMW2s+0a0HsMrkXDqaWbcEqbtG3dp/5bQOA=";
+    hash = "sha256-I0XEEGyTMQMpGTApbzVzHRuRAALl+C28GfpW4CeeTIA=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/azure-mgmt-cognitiveservices/default.nix b/pkgs/development/python-modules/azure-mgmt-cognitiveservices/default.nix
index f98d7eef34a1..dc1e286405f8 100644
--- a/pkgs/development/python-modules/azure-mgmt-cognitiveservices/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-cognitiveservices/default.nix
@@ -12,13 +12,13 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-cognitiveservices";
-  version = "14.1.0";
+  version = "15.0.0b1";
   pyproject = true;
 
   src = fetchPypi {
     pname = "azure_mgmt_cognitiveservices";
     inherit version;
-    hash = "sha256-kVGRN00K20Q4Y8IKrqLJ87nVWKhJrCt48VIkkmL9yvg=";
+    hash = "sha256-3ydbAI1IkiIuwnQbd6829kZv9IgFkqTFwG155l58JFQ=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/azure-mgmt-containerservice/default.nix b/pkgs/development/python-modules/azure-mgmt-containerservice/default.nix
index c6e36e97f98a..c688420e3ce8 100644
--- a/pkgs/development/python-modules/azure-mgmt-containerservice/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-containerservice/default.nix
@@ -10,13 +10,13 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-containerservice";
-  version = "41.0.0";
+  version = "41.1.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "azure_mgmt_containerservice";
     inherit version;
-    hash = "sha256-mDDQpCcwYJyXoTOpE+LK/70WPU0/8xWvw6dnKCIqP2E=";
+    hash = "sha256-fssuY+hzZgEv2nwT02uv9qKqWZ/GeSUqKWB2M+0YbKg=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/bayesian-optimization/default.nix b/pkgs/development/python-modules/bayesian-optimization/default.nix
index 555652ea68db..5e718d05d23f 100644
--- a/pkgs/development/python-modules/bayesian-optimization/default.nix
+++ b/pkgs/development/python-modules/bayesian-optimization/default.nix
@@ -24,14 +24,14 @@
 
 buildPythonPackage rec {
   pname = "bayesian-optimization";
-  version = "3.2.1";
+  version = "3.2.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bayesian-optimization";
     repo = "BayesianOptimization";
     tag = "v${version}";
-    hash = "sha256-pTtwuBQUdVsi98nndEyY9mawGiTwjgiD05EsQwQFiPo=";
+    hash = "sha256-w1L4W99OaNknFtdsdkjJXsdOCmjtYvOG7Iy9z9EXFf0=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/cadwyn/default.nix b/pkgs/development/python-modules/cadwyn/default.nix
index 48146c35e02f..05b665315500 100644
--- a/pkgs/development/python-modules/cadwyn/default.nix
+++ b/pkgs/development/python-modules/cadwyn/default.nix
@@ -27,14 +27,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "cadwyn";
-  version = "6.2.0";
+  version = "6.2.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "zmievsa";
     repo = "cadwyn";
     tag = finalAttrs.version;
-    hash = "sha256-vkW3ZSIRuIDVQCHMsZrBEs+VBW55kn0dE2nMXqL5XmU=";
+    hash = "sha256-IM/7IF3zQHaJWlMmG3el9x4/BOFTXYUmJq4gRLP4gVs=";
   };
 
   disabled = pythonAtLeast "3.14";
diff --git a/pkgs/development/python-modules/clickhouse-cityhash/default.nix b/pkgs/development/python-modules/clickhouse-cityhash/default.nix
index a34f16c53378..8af68b4ae28c 100644
--- a/pkgs/development/python-modules/clickhouse-cityhash/default.nix
+++ b/pkgs/development/python-modules/clickhouse-cityhash/default.nix
@@ -32,6 +32,11 @@ buildPythonPackage rec {
     })
   ];
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "Cython>=3.0,<3.1" "Cython>=3.0"
+  '';
+
   doCheck = false;
 
   pythonImportsCheck = [ "clickhouse_cityhash" ];
@@ -39,7 +44,7 @@ buildPythonPackage rec {
   meta = {
     description = "Python-bindings for CityHash, a fast non-cryptographic hash algorithm";
     homepage = "https://github.com/xzkostyan/python-cityhash";
-    license = lib.licenses.upl;
+    license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ breakds ];
   };
 }
diff --git a/pkgs/development/python-modules/django-mailman3/default.nix b/pkgs/development/python-modules/django-mailman3/default.nix
index 467867a3cead..f6099fb25799 100644
--- a/pkgs/development/python-modules/django-mailman3/default.nix
+++ b/pkgs/development/python-modules/django-mailman3/default.nix
@@ -41,6 +41,18 @@ buildPythonPackage rec {
       ];
       hash = "sha256-gSFczuNLlMclqixOu6ElS0BewUTGyhP6RXtE/waLzyo=";
     })
+
+    (fetchpatch {
+      # Only needed so the next one applies.
+      name = "allauth-64-1.patch";
+      url = "https://gitlab.com/mailman/django-mailman3/-/commit/96f3f3bf0c718395ccd1b0d539a40d627522a9c4.patch";
+      hash = "sha256-xgQu70DkbPz+ULRFgKeJTbx/Tq2PLEyGgrncf26ChA4=";
+    })
+    (fetchpatch {
+      name = "allauth-64-2.patch";
+      url = "https://gitlab.com/mailman/django-mailman3/-/commit/cfdacb9195ce266e5ae23307b31304898369f696.patch";
+      hash = "sha256-6mwGSw31Q0+APwdGFe0JE0gBigdo453HZZ6JApqgtTE=";
+    })
   ];
 
   pythonRelaxDeps = [ "django-allauth" ];
@@ -77,7 +89,6 @@ buildPythonPackage rec {
     homepage = "https://gitlab.com/mailman/django-mailman3";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [ qyliss ];
-    broken =
-      lib.versionAtLeast django-allauth.version "65.0.0" || lib.versionAtLeast django.version "5.3";
+    broken = lib.versionAtLeast django.version "5.3";
   };
 }
diff --git a/pkgs/development/python-modules/duct-py/default.nix b/pkgs/development/python-modules/duct-py/default.nix
index 27da99cb6319..3bb63cd26ae9 100644
--- a/pkgs/development/python-modules/duct-py/default.nix
+++ b/pkgs/development/python-modules/duct-py/default.nix
@@ -2,13 +2,15 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  hatchling,
   pytestCheckHook,
+  ps,
 }:
 
 buildPythonPackage rec {
   pname = "duct-py";
   version = "1.0.1";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "oconnor663";
@@ -17,9 +19,14 @@ buildPythonPackage rec {
     hash = "sha256-i811nQB8CVJPYPR0Jdzpk64EXxrTMDIBpdDoUs9Xu/k=";
   };
 
+  build-system = [ hatchling ];
+
   pythonImportsCheck = [ "duct" ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytestCheckHook
+    ps
+  ];
 
   disabledTests = [
     # This test completely empties the environment then tries to run a Python command.
diff --git a/pkgs/development/python-modules/flufl/lock.nix b/pkgs/development/python-modules/flufl/lock.nix
index 8f0a68f996d2..0cf5218ddfbc 100644
--- a/pkgs/development/python-modules/flufl/lock.nix
+++ b/pkgs/development/python-modules/flufl/lock.nix
@@ -12,13 +12,13 @@
 
 buildPythonPackage rec {
   pname = "flufl-lock";
-  version = "8.2.0";
+  version = "9.1.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "flufl_lock";
     inherit version;
-    hash = "sha256-FbMzw1+rGjayI4QAVyWK60zXnw+6+CwUTyPN9s8U1eM=";
+    hash = "sha256-jXPIjKt8mLeSZxApnBFivsfOJT+bnF8KLKgDf58kAjQ=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/gguf/default.nix b/pkgs/development/python-modules/gguf/default.nix
index 8a3fcd81928e..d4a4e30e0bf6 100644
--- a/pkgs/development/python-modules/gguf/default.nix
+++ b/pkgs/development/python-modules/gguf/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "gguf";
-  version = "9101";
+  version = "9222";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ggml-org";
     repo = "llama.cpp";
     tag = "b${finalAttrs.version}";
-    hash = "sha256-dQ0KsUsiTYJXtWuU16yTbHiyWCspw5WofQVjvrY2OVc=";
+    hash = "sha256-LIGtXaO53Y3Ze0x6uevb2vzcKHbyj2o/8ZHvyZ22uo4=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/gguf-py";
diff --git a/pkgs/development/python-modules/ha-garmin/default.nix b/pkgs/development/python-modules/ha-garmin/default.nix
index 3b29e289b009..2ff56875c109 100644
--- a/pkgs/development/python-modules/ha-garmin/default.nix
+++ b/pkgs/development/python-modules/ha-garmin/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "ha-garmin";
-  version = "0.1.22";
+  version = "0.1.23";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cyberjunky";
     repo = "ha-garmin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-q5bNa6HT2GeqdElsSG7Rgk3a14GsjGyLkHWVrg3CTYs=";
+    hash = "sha256-0x7+pABt0i9QFty/i8IeU2CLmDUQiw16pYZ1Wr7CARI=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/jedi-language-server/default.nix b/pkgs/development/python-modules/jedi-language-server/default.nix
index 05374f57690e..ee63c0a81d29 100644
--- a/pkgs/development/python-modules/jedi-language-server/default.nix
+++ b/pkgs/development/python-modules/jedi-language-server/default.nix
@@ -37,6 +37,10 @@ buildPythonPackage rec {
     poetry-core
   ];
 
+  pythonRelaxDeps = [
+    "jedi"
+  ];
+
   dependencies = [
     docstring-to-markdown
     jedi
diff --git a/pkgs/development/python-modules/langgraph-checkpoint-mongodb/default.nix b/pkgs/development/python-modules/langgraph-checkpoint-mongodb/default.nix
index f16e5a605c15..837a8e42e8a1 100644
--- a/pkgs/development/python-modules/langgraph-checkpoint-mongodb/default.nix
+++ b/pkgs/development/python-modules/langgraph-checkpoint-mongodb/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langgraph-checkpoint-mongodb";
-  version = "0.3.1";
+  version = "0.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain-mongodb";
     tag = "libs/langgraph-checkpoint-mongodb/v${finalAttrs.version}";
-    hash = "sha256-vCiZ6Mp6aHmSEkLbeM6qTLJaxH0uoAdq80olTT5saX0=";
+    hash = "sha256-AdTAyMHNzkuvNB7DsbWxAxNKNqSxdgYwIB5UHBAAxZc=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/libs/langgraph-checkpoint-mongodb";
diff --git a/pkgs/development/python-modules/langgraph-runtime-inmem/default.nix b/pkgs/development/python-modules/langgraph-runtime-inmem/default.nix
index 40082663db52..97efcb9aeaf9 100644
--- a/pkgs/development/python-modules/langgraph-runtime-inmem/default.nix
+++ b/pkgs/development/python-modules/langgraph-runtime-inmem/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langgraph-runtime-inmem";
-  version = "0.28.0";
+  version = "0.28.1";
   pyproject = true;
 
   # Not available in any repository
   src = fetchPypi {
     pname = "langgraph_runtime_inmem";
     inherit (finalAttrs) version;
-    hash = "sha256-4CU2UItcFU8YokJAZjr3wjifQ8tPu6yZWicXtM/kDS8=";
+    hash = "sha256-lFfLJVVN9psEruTfnaEXLNH6e8nLWQqegH8vnkXsjr0=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/langgraph-store-mongodb/default.nix b/pkgs/development/python-modules/langgraph-store-mongodb/default.nix
index 953906a2e0a9..fcae0393fe2a 100644
--- a/pkgs/development/python-modules/langgraph-store-mongodb/default.nix
+++ b/pkgs/development/python-modules/langgraph-store-mongodb/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langgraph-store-mongodb";
-  version = "0.2.0";
+  version = "0.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain-mongodb";
     tag = "libs/langgraph-store-mongodb/v${finalAttrs.version}";
-    hash = "sha256-IXISxo3mC0/FkjGdHTmin6z/fk71ecto+L+VZ6VFdeE=";
+    hash = "sha256-uivrfCTUu7Pq/ncAGH6HUzgyOGRcOzsQ+SVN6wW33tQ=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/libs/langgraph-store-mongodb";
diff --git a/pkgs/development/python-modules/llfuse/default.nix b/pkgs/development/python-modules/llfuse/default.nix
deleted file mode 100644
index 433b33e9b9d1..000000000000
--- a/pkgs/development/python-modules/llfuse/default.nix
+++ /dev/null
@@ -1,67 +0,0 @@
-{
-  lib,
-  stdenv,
-  buildPythonPackage,
-  fetchFromGitHub,
-  cython,
-  fuse,
-  pkg-config,
-  pytestCheckHook,
-  python,
-  setuptools,
-  which,
-}:
-
-buildPythonPackage rec {
-  pname = "llfuse";
-  version = "1.5.2";
-
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "python-llfuse";
-    repo = "python-llfuse";
-    tag = "release-${version}";
-    hash = "sha256-PFnY+gmm1tjZhptc27XTE9yxF0IaJ+U4Ng/OGhNDDPI=";
-  };
-
-  nativeBuildInputs = [
-    cython
-    pkg-config
-    setuptools
-  ];
-
-  buildInputs = [ fuse ];
-
-  preConfigure = ''
-    substituteInPlace setup.py \
-        --replace "'pkg-config'" "'${stdenv.cc.targetPrefix}pkg-config'"
-  '';
-
-  preBuild = ''
-    ${python.pythonOnBuildForHost.interpreter} setup.py build_cython
-  '';
-
-  # On Darwin, the test requires macFUSE to be installed outside of Nix.
-  doCheck = !stdenv.hostPlatform.isDarwin;
-  nativeCheckInputs = [
-    pytestCheckHook
-    which
-  ];
-
-  disabledTests = [
-    "test_listdir" # accesses /usr/bin
-  ];
-
-  meta = {
-    description = "Python bindings for the low-level FUSE API";
-    homepage = "https://github.com/python-llfuse/python-llfuse";
-    changelog = "https://github.com/python-llfuse/python-llfuse/raw/release-${src.tag}/Changes.rst";
-    license = lib.licenses.lgpl2Plus;
-    platforms = lib.platforms.unix;
-    maintainers = with lib.maintainers; [
-      bjornfor
-      dotlambda
-    ];
-  };
-}
diff --git a/pkgs/development/python-modules/nengo/default.nix b/pkgs/development/python-modules/nengo/default.nix
index 144568fd080e..2d65b48c8122 100644
--- a/pkgs/development/python-modules/nengo/default.nix
+++ b/pkgs/development/python-modules/nengo/default.nix
@@ -10,21 +10,21 @@
   scikit-learn,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "nengo";
-  version = "4.0.0";
+  version = "4.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "nengo";
     repo = "nengo";
-    tag = "v${version}";
-    sha256 = "sha256-b9mPjKdewIqIeRrddV1/M3bghSyox7Lz6VbfSLCHZjA=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-yZDnttXU5qMmQwFESkhQb06BXcqPEiPYl54azS5b284=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     numpy
   ]
   ++ lib.optionals scipySupport [ scipy ]
@@ -41,7 +41,7 @@ buildPythonPackage rec {
   meta = {
     description = "Python library for creating and simulating large-scale brain models";
     homepage = "https://nengo.ai/";
-    license = lib.licenses.unfreeRedistributable;
+    license = lib.licenses.gpl2Only;
     maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/nextcord/default.nix b/pkgs/development/python-modules/nextcord/default.nix
index 2f3345ffc4eb..b9a4074db409 100644
--- a/pkgs/development/python-modules/nextcord/default.nix
+++ b/pkgs/development/python-modules/nextcord/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "nextcord";
-  version = "3.1.1";
+  version = "3.2.0";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = "nextcord";
     repo = "nextcord";
     tag = "v${version}";
-    hash = "sha256-ex6amnB51Jla5ia2HVaMOZsDOEtgJ8RB1eNTLpXNzSY=";
+    hash = "sha256-4/3RM32kEYt5J4bL7/SsPvKhnT1eGS3o0+9lNMqbSj8=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/nodriver/default.nix b/pkgs/development/python-modules/nodriver/default.nix
index 8dd60efd35ce..06b1780e74ba 100644
--- a/pkgs/development/python-modules/nodriver/default.nix
+++ b/pkgs/development/python-modules/nodriver/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "nodriver";
-  version = "0.48.1";
+  version = "0.50.3";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-SsjNiLavEzwm3BV/t49asXRipZtKDaMwTjrxK75LQ0M=";
+    hash = "sha256-JMpojYZG74/61cjOZYBOXnZxp3mtJqJNdvZGXVZmxjE=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/pycyphal/default.nix b/pkgs/development/python-modules/pycyphal/default.nix
index 8fed197d2e4d..a53a14fde62c 100644
--- a/pkgs/development/python-modules/pycyphal/default.nix
+++ b/pkgs/development/python-modules/pycyphal/default.nix
@@ -95,6 +95,13 @@ buildPythonPackage rec {
     "pycyphal/application/register/_value.py"
   ];
 
+  disabledTests = lib.optionals (pythonAtLeast "3.14") [
+    # leaked tasks from prior doctest's event loop break doctest stdout capture, causing "Got nothing" on REPL-style assertions
+    "MonotonicClusteringSynchronizer"
+    "TransferIDSynchronizer"
+    "PythonCANMedia"
+  ];
+
   pythonImportsCheck = [ "pycyphal" ];
 
   meta = {
diff --git a/pkgs/development/python-modules/python-backoff/default.nix b/pkgs/development/python-modules/python-backoff/default.nix
new file mode 100644
index 000000000000..32b863d24f68
--- /dev/null
+++ b/pkgs/development/python-modules/python-backoff/default.nix
@@ -0,0 +1,42 @@
+{
+  buildPythonPackage,
+  fetchFromGitHub,
+  hatchling,
+  lib,
+  pytest-asyncio,
+  pytestCheckHook,
+  requests,
+  responses,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "python-backoff";
+  version = "2.3.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "python-backoff";
+    repo = "backoff";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Os20Gz+uWaEdUPPF9/tT7LNxbmN0W/tuzVZa3H+ZG2A=";
+  };
+
+  build-system = [ hatchling ];
+
+  pythonImportsCheck = [ "backoff" ];
+
+  nativeCheckInputs = [
+    pytest-asyncio
+    pytestCheckHook
+    requests
+    responses
+  ];
+
+  meta = {
+    changelog = "https://github.com/python-backoff/backoff/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    description = "Python library providing function decorators for configurable backoff and retry";
+    homepage = "https://github.com/python-backoff/backoff";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.dotlambda ];
+  };
+})
diff --git a/pkgs/development/python-modules/python-roborock/default.nix b/pkgs/development/python-modules/python-roborock/default.nix
index 8e4d835f553e..34f860deabfa 100644
--- a/pkgs/development/python-modules/python-roborock/default.nix
+++ b/pkgs/development/python-modules/python-roborock/default.nix
@@ -24,14 +24,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "python-roborock";
-  version = "5.5.1";
+  version = "5.12.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Python-roborock";
     repo = "python-roborock";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2ShXt2mtMhMugzqOHhY1GT7cQ0K78k/4/bPmmP/uheI=";
+    hash = "sha256-v4hONQ3EmpenjnAVKm8YMrynVyxtduefN5oqGW9MoE0=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/renault-api/default.nix b/pkgs/development/python-modules/renault-api/default.nix
index 978dfc6425dd..5302b73e4355 100644
--- a/pkgs/development/python-modules/renault-api/default.nix
+++ b/pkgs/development/python-modules/renault-api/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "renault-api";
-  version = "0.5.8";
+  version = "0.5.10";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "hacf-fr";
     repo = "renault-api";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/ZvMrEe3qgtMpg49OLZH1YTXQKSGR8e3yaShghnyMv4=";
+    hash = "sha256-1ym2xDJo8Ax76jC7rvVYI+EADKkdjGiKKvtiyE/rk/4=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/sigrok/default.nix b/pkgs/development/python-modules/sigrok/default.nix
index 5a0a6997df16..e31a42e1e98f 100644
--- a/pkgs/development/python-modules/sigrok/default.nix
+++ b/pkgs/development/python-modules/sigrok/default.nix
@@ -25,6 +25,14 @@ toPythonModule (
       ./python-install.patch
     ];
 
+    postPatch = ''
+      ${orig.postPatch or ""}
+
+      # %init block lands in SWIG_mod_exec (returns int) under swig >= 4.4.
+      substituteInPlace bindings/python/sigrok/core/classes.i \
+        --replace-fail 'return nullptr;' 'return -1;'
+    '';
+
     nativeBuildInputs =
       orig.nativeBuildInputs or [ ]
       ++ [
diff --git a/pkgs/development/python-modules/uncompyle6/default.nix b/pkgs/development/python-modules/uncompyle6/default.nix
index d58e1916717b..562ad1a9d7a2 100644
--- a/pkgs/development/python-modules/uncompyle6/default.nix
+++ b/pkgs/development/python-modules/uncompyle6/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  fetchpatch,
   setuptools,
   spark-parser,
   xdis,
@@ -20,6 +21,14 @@ buildPythonPackage rec {
     hash = "sha256-eLdk1MhDsEVfs5223rQhpI1dPruEZTe6ZESv4QfE68E=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "support-xdis-6.3-api.patch";
+      url = "https://github.com/rocky/python-uncompyle6/commit/62372825c62044428c29a9ce86b5afa81e93c5ae.patch";
+      hash = "sha256-z11AKF5RC4gibUbH3hI2Rsbn8VDg49SnKfqV4TuVnjc=";
+    })
+  ];
+
   build-system = [ setuptools ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/wled/default.nix b/pkgs/development/python-modules/wled/default.nix
index 8aa2d8395ae3..c61060adfd24 100644
--- a/pkgs/development/python-modules/wled/default.nix
+++ b/pkgs/development/python-modules/wled/default.nix
@@ -3,9 +3,7 @@
   aiohttp,
   aioresponses,
   awesomeversion,
-  backoff,
   buildPythonPackage,
-  cachetools,
   fetchFromGitHub,
   mashumaro,
   orjson,
@@ -14,6 +12,7 @@
   pytest-cov-stub,
   pytest-xdist,
   pytestCheckHook,
+  python-backoff,
   syrupy,
   typer,
   yarl,
@@ -22,14 +21,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "wled";
-  version = "0.22.0";
+  version = "0.23.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "frenck";
     repo = "python-wled";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CUTuIQf6gj9teLicIOtu1FUsYiYXtKeLNuDbNh/21sc=";
+    hash = "sha256-1JLW3wze4W3Uva9xIeSAmYw8f9tDfGxe9rueixVedms=";
   };
 
   postPatch = ''
@@ -43,10 +42,9 @@ buildPythonPackage (finalAttrs: {
   dependencies = [
     aiohttp
     awesomeversion
-    backoff
-    cachetools
     mashumaro
     orjson
+    python-backoff
     yarl
   ];
 
@@ -70,6 +68,8 @@ buildPythonPackage (finalAttrs: {
   disabledTests = [
     # wled release table rendering is inconsistent
     "test_releases_command"
+    # outdated snapshots
+    "test_device_version_fixture"
   ];
 
   pythonImportsCheck = [ "wled" ];
diff --git a/pkgs/development/python-modules/xdis/default.nix b/pkgs/development/python-modules/xdis/default.nix
index a5ca14400421..39a50ce8511a 100644
--- a/pkgs/development/python-modules/xdis/default.nix
+++ b/pkgs/development/python-modules/xdis/default.nix
@@ -3,6 +3,7 @@
   buildPythonPackage,
   click,
   fetchFromGitHub,
+  fetchpatch,
   pytestCheckHook,
   setuptools,
   six,
@@ -10,16 +11,31 @@
 
 buildPythonPackage rec {
   pname = "xdis";
-  version = "6.1.8";
+  version = "6.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "rocky";
     repo = "python-xdis";
     tag = version;
-    hash = "sha256-sAL2D7Rg/iyob2nawXX/b5F/uOGCMsb1q0ZnPLIfh6o=";
+    hash = "sha256-k1SawlgbItbWe8J2pAxYOku/4CHyzWH3UR1j3kBZy1Q=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "python-3.13.13.patch";
+      url = "https://github.com/rocky/python-xdis/commit/f2c46c8c89898157c2345c0a026a2d31f14e7ea9.patch";
+      includes = [ "xdis/magics.py" ];
+      hash = "sha256-+k3mbiAmM69Pl7k0Wogx+qpib5+p3Gn/pSpnDn5e6pE=";
+    })
+    (fetchpatch {
+      name = "python-3.14.4.patch";
+      url = "https://github.com/rocky/python-xdis/commit/36a1a2442c224e3bfca776f727a5e262968855a4.patch";
+      includes = [ "xdis/magics.py" ];
+      hash = "sha256-q+MX737Xn+iUObuV5IirnT71/0W6JH0TgtmS1cqR0x4=";
+    })
+  ];
+
   build-system = [
     setuptools
   ];
diff --git a/pkgs/development/skaware-packages/default.nix b/pkgs/development/skaware-packages/default.nix
index b0877ada8c36..0ae8c4d43865 100644
--- a/pkgs/development/skaware-packages/default.nix
+++ b/pkgs/development/skaware-packages/default.nix
@@ -1,4 +1,8 @@
-{ lib, pkgs }:
+{
+  lib,
+  pkgs,
+  config,
+}:
 
 lib.makeScope pkgs.newScope (
   self:
@@ -22,7 +26,6 @@ lib.makeScope pkgs.newScope (
     # libs
     skalibs = callPackage ./skalibs { };
     skalibs_2_10 = callPackage ./skalibs/2_10.nix { };
-    sdnotify-wrapper = callPackage ./sdnotify-wrapper { };
 
     # s6 tooling
     s6 = callPackage ./s6 { };
@@ -40,4 +43,7 @@ lib.makeScope pkgs.newScope (
     s6-portable-utils-man-pages = self.s6-portable-utils.passthru.manpages;
     s6-rc-man-pages = self.s6-rc.passthru.manpages;
   }
+  // lib.optionalAttrs config.allowAliases {
+    sdnotify-wrapper = throw "sdnotify-wrapper has been removed in favour of s6-notify-socket-from-fd in the s6 package";
+  }
 )
diff --git a/pkgs/development/skaware-packages/execline/default.nix b/pkgs/development/skaware-packages/execline/default.nix
index ed2f1795d87e..f47dd73b295f 100644
--- a/pkgs/development/skaware-packages/execline/default.nix
+++ b/pkgs/development/skaware-packages/execline/default.nix
@@ -7,14 +7,14 @@
 }:
 
 let
-  version = "2.9.8.1";
+  version = "2.9.9.1";
 in
 skawarePackages.buildPackage {
   inherit version;
 
   pname = "execline";
   # ATTN: also check whether there is a new manpages version
-  sha256 = "sha256-IzUNEHl5CWNgYFImB1kctKIRgyjLWMXmX7GaLA1HJk4=";
+  sha256 = "sha256-vmNTMpepPDb9JnGVEXtOZoaHpSb4NFF6jbR9hbbH7Go=";
 
   # Maintainer of manpages uses following versioning scheme: for every
   # upstream $version he tags manpages release as ${version}.1, and,
@@ -22,8 +22,8 @@ skawarePackages.buildPackage {
   # ${version}.3 and so on are created.
   manpages = skawarePackages.buildManPages {
     pname = "execline-man-pages";
-    version = "2.9.8.1.3";
-    sha256 = "sha256-jYNx15n9pOK4PPEf0ynvHpgGucgWQKd/4nggY7OmR4M=";
+    version = "2.9.9.1.1";
+    sha256 = "sha256-SMQLeiS03fW9HGDmk+MMfUbnvRGqTzXc/4CuS5LW18U=";
     description = "Port of the documentation for the execline suite to mdoc";
     maintainers = [ lib.maintainers.sternenseemann ];
   };
diff --git a/pkgs/development/skaware-packages/execline/execlineb-wrapper.c b/pkgs/development/skaware-packages/execline/execlineb-wrapper.c
index c8e91813b774..7daff48894f2 100644
--- a/pkgs/development/skaware-packages/execline/execlineb-wrapper.c
+++ b/pkgs/development/skaware-packages/execline/execlineb-wrapper.c
@@ -10,7 +10,7 @@
 
 #include <skalibs/stralloc.h>
 #include <skalibs/djbunix.h>
-#include <skalibs/strerr2.h>
+#include <skalibs/strerr.h>
 #include <skalibs/env.h>
 #include <skalibs/exec.h>
 
diff --git a/pkgs/development/skaware-packages/mdevd/default.nix b/pkgs/development/skaware-packages/mdevd/default.nix
index 6c4d17b7763a..2804326b3218 100644
--- a/pkgs/development/skaware-packages/mdevd/default.nix
+++ b/pkgs/development/skaware-packages/mdevd/default.nix
@@ -6,8 +6,8 @@
 
 skawarePackages.buildPackage {
   pname = "mdevd";
-  version = "0.1.8.1";
-  sha256 = "sha256-k9K7pymf87G58kmSjC6E4jpa89gp69lnfqRFNcWFqoI=";
+  version = "0.1.8.2";
+  sha256 = "sha256-zhrgFJtqV6NPYIIY/WGBqmqmgTXKwvTZMbW0F7By4kQ=";
 
   description = "mdev-compatible Linux hotplug manager daemon";
   platforms = lib.platforms.linux;
diff --git a/pkgs/development/skaware-packages/nsss/default.nix b/pkgs/development/skaware-packages/nsss/default.nix
index 099bb24d2b3b..9432e8293649 100644
--- a/pkgs/development/skaware-packages/nsss/default.nix
+++ b/pkgs/development/skaware-packages/nsss/default.nix
@@ -2,8 +2,8 @@
 
 skawarePackages.buildPackage {
   pname = "nsss";
-  version = "0.2.1.1";
-  sha256 = "sha256-pff2y8Gdey3ALVjiupwJ0I+iRZ/j3xh3815jnA8rEpI=";
+  version = "0.2.1.2";
+  sha256 = "sha256-zKpz6QUJ8/pbUq+F2QIDumKMFsna7TTFQmea52gfEGc=";
 
   description = "Implementation of a subset of the pwd.h, group.h and shadow.h family of functions";
 
diff --git a/pkgs/development/skaware-packages/s6-dns/default.nix b/pkgs/development/skaware-packages/s6-dns/default.nix
index ba87616942c4..ee0c7878533e 100644
--- a/pkgs/development/skaware-packages/s6-dns/default.nix
+++ b/pkgs/development/skaware-packages/s6-dns/default.nix
@@ -2,8 +2,8 @@
 
 skawarePackages.buildPackage {
   pname = "s6-dns";
-  version = "2.4.1.1";
-  sha256 = "sha256-JkPP9JmgeOoXDl+mqH2GxNcjtl89FICnE318xJlHQzg=";
+  version = "2.4.1.2";
+  sha256 = "sha256-BhjYgw/OY+4Xt/VeSUKAachcl6FxCCensjSbZgzTOk4=";
 
   description = "Suite of DNS client programs and libraries for Unix systems";
 
diff --git a/pkgs/development/skaware-packages/s6-linux-init/default.nix b/pkgs/development/skaware-packages/s6-linux-init/default.nix
index 9643b8a0ebb7..ff8137aa19ec 100644
--- a/pkgs/development/skaware-packages/s6-linux-init/default.nix
+++ b/pkgs/development/skaware-packages/s6-linux-init/default.nix
@@ -10,8 +10,8 @@
 
 skawarePackages.buildPackage {
   pname = "s6-linux-init";
-  version = "1.2.0.0";
-  sha256 = "sha256-82cImDHGlI/evomW2khKuP0Uhclek8HlsDe4hxGN6dk=";
+  version = "1.2.0.1";
+  sha256 = "sha256-ctWbE2g9E5D335ooa+Rn5zKTQWAhr5+hAjySk+xcfXw=";
 
   description = "Set of minimalistic tools used to create a s6-based init system, including a /sbin/init binary, on a Linux kernel";
   platforms = lib.platforms.linux;
diff --git a/pkgs/development/skaware-packages/s6-linux-utils/default.nix b/pkgs/development/skaware-packages/s6-linux-utils/default.nix
index 1a9d58065237..0b91b576b217 100644
--- a/pkgs/development/skaware-packages/s6-linux-utils/default.nix
+++ b/pkgs/development/skaware-packages/s6-linux-utils/default.nix
@@ -7,8 +7,8 @@
 
 skawarePackages.buildPackage {
   pname = "s6-linux-utils";
-  version = "2.6.4.0";
-  sha256 = "sha256-zHJ/cNXoeAQzpJest8sxAGVrMSZYmrAunSBCAGx5TPI=";
+  version = "2.6.4.1";
+  sha256 = "sha256-FuGltaK0qYZ0tKlxlhKtt5WI48IMQIM2AnjqOPLTISk=";
 
   description = "Set of minimalistic Linux-specific system utilities";
   platforms = lib.platforms.linux;
diff --git a/pkgs/development/skaware-packages/s6-networking/default.nix b/pkgs/development/skaware-packages/s6-networking/default.nix
index b96feb033247..79a133fc8886 100644
--- a/pkgs/development/skaware-packages/s6-networking/default.nix
+++ b/pkgs/development/skaware-packages/s6-networking/default.nix
@@ -25,8 +25,8 @@ assert sslSupportEnabled -> sslLibs ? ${sslSupport};
 
 skawarePackages.buildPackage {
   pname = "s6-networking";
-  version = "2.7.2.1";
-  sha256 = "sha256-Z5+GUthb40PawfB2SXzTbKjFZACUh4D4XcZONAVeLBs=";
+  version = "2.8.0.0";
+  sha256 = "sha256-rE9lhA/OwWJPe/nGMvtAVThRvJApV/+VayofIoGkXNQ=";
 
   manpages = skawarePackages.buildManPages {
     pname = "s6-networking-man-pages";
diff --git a/pkgs/development/skaware-packages/s6-portable-utils/default.nix b/pkgs/development/skaware-packages/s6-portable-utils/default.nix
index adac6eec681e..cb6c1148f05d 100644
--- a/pkgs/development/skaware-packages/s6-portable-utils/default.nix
+++ b/pkgs/development/skaware-packages/s6-portable-utils/default.nix
@@ -6,8 +6,8 @@
 
 skawarePackages.buildPackage {
   pname = "s6-portable-utils";
-  version = "2.3.1.1";
-  sha256 = "sha256-zwjXGWPA6hcIzdgr1ArTARVLzMWbaO77Qoqnm0InMkI=";
+  version = "2.3.1.2";
+  sha256 = "sha256-z7kBhtDA6yBOHlxvk3nplBPFRrzPOLtudhd/gjcao6o=";
 
   manpages = skawarePackages.buildManPages {
     pname = "s6-portable-utils-man-pages";
diff --git a/pkgs/development/skaware-packages/s6-rc/default.nix b/pkgs/development/skaware-packages/s6-rc/default.nix
index 0029eb0afd6d..63c5cda8cf3d 100644
--- a/pkgs/development/skaware-packages/s6-rc/default.nix
+++ b/pkgs/development/skaware-packages/s6-rc/default.nix
@@ -10,8 +10,8 @@
 
 skawarePackages.buildPackage {
   pname = "s6-rc";
-  version = "0.6.0.0";
-  sha256 = "sha256-RtSmKVnvFgl7hNz7DDsxpv9JqkdtSu7Jxbe94c5oSQE=";
+  version = "0.6.1.1";
+  sha256 = "sha256-tU8iajW+HuVqIovxpMOUN/ByvGTmnb81bnM+YGqGQC0=";
 
   manpages = skawarePackages.buildManPages {
     pname = "s6-rc-man-pages";
diff --git a/pkgs/development/skaware-packages/s6/default.nix b/pkgs/development/skaware-packages/s6/default.nix
index 19e9f206b473..d88a808762db 100644
--- a/pkgs/development/skaware-packages/s6/default.nix
+++ b/pkgs/development/skaware-packages/s6/default.nix
@@ -7,8 +7,8 @@
 
 skawarePackages.buildPackage {
   pname = "s6";
-  version = "2.14.0.1";
-  sha256 = "sha256-wlr+gXy8P1lO/FBQNR+LkQG6eGFtDOkVZY83Dn7i4lg=";
+  version = "2.15.0.0";
+  sha256 = "sha256-J9/3PWJihVQBM+B151iHCH9RF/1R3llQPvfSnpb2nkw=";
 
   manpages = skawarePackages.buildManPages {
     pname = "s6-man-pages";
diff --git a/pkgs/development/skaware-packages/sdnotify-wrapper/default.nix b/pkgs/development/skaware-packages/sdnotify-wrapper/default.nix
deleted file mode 100644
index d9fa940a3294..000000000000
--- a/pkgs/development/skaware-packages/sdnotify-wrapper/default.nix
+++ /dev/null
@@ -1,47 +0,0 @@
-{
-  lib,
-  runCommandCC,
-  skalibs,
-}:
-
-let
-  # From https://skarnet.org/software/misc/sdnotify-wrapper.c,
-  # which is unversioned.
-  src = ./sdnotify-wrapper.c;
-
-in
-runCommandCC "sdnotify-wrapper"
-  {
-
-    outputs = [
-      "bin"
-      "doc"
-      "out"
-    ];
-
-    meta = {
-      homepage = "https://skarnet.org/software/misc/sdnotify-wrapper.c";
-      description = "Use systemd sd_notify without having to link against libsystemd";
-      mainProgram = "sdnotify-wrapper";
-      platforms = lib.platforms.linux;
-      license = lib.licenses.isc;
-      maintainers = with lib.maintainers; [ Profpatsch ];
-    };
-
-  }
-  ''
-    mkdir -p $bin/bin
-    mkdir $out
-
-    # the -lskarnet has to come at the end to support static builds
-    $CC \
-      -o $bin/bin/sdnotify-wrapper \
-      -I${skalibs.dev}/include \
-      -L${skalibs.lib}/lib \
-      ${src} \
-      -lskarnet
-
-    mkdir -p $doc/share/doc/sdnotify-wrapper
-    # copy the documentation comment
-    sed -ne '/Usage:/,/*\//p' ${src} > $doc/share/doc/sdnotify-wrapper/README
-  ''
diff --git a/pkgs/development/skaware-packages/sdnotify-wrapper/sdnotify-wrapper.c b/pkgs/development/skaware-packages/sdnotify-wrapper/sdnotify-wrapper.c
deleted file mode 100644
index 3ad3cbc69063..000000000000
--- a/pkgs/development/skaware-packages/sdnotify-wrapper/sdnotify-wrapper.c
+++ /dev/null
@@ -1,174 +0,0 @@
-/*
-   Copyright: (C)2015-2020 Laurent Bercot.  http://skarnet.org/
-   ISC license. See http://opensource.org/licenses/ISC
-
-   Build-time requirements: skalibs.  https://skarnet.org/software/skalibs/
-   Run-time requirements: none, if you link skalibs statically.
-
-   Compilation:
-     gcc -o sdnotify-wrapper -L/usr/lib/skalibs sdnotify-wrapper.c -lskarnet
-   Use /usr/lib/skalibs/libskarnet.a instead of -lskarnet to link statically.
-   Adapt gcc's -I and -L options to your skalibs installation paths.
-
-   Usage: if a daemon would be launched by systemd as "foobard args...",
-   launch it as "sdnotify-wrapper foobard args..." instead, and you can now
-   tell systemd that this daemon supports readiness notification.
-
-   Instead of using sd_notify() and having to link against the systemd
-   library, the daemon notifies readiness by writing whatever it wants
-   to a file descriptor (by default: stdout), then a newline. (Then it
-   should close that file descriptor.) The simplest way is something like
-   int notify_readiness() { write(1, "\n", 1) ; close(1) ; }
-   This mechanism is understandable by any notification readiness framework.
-
-   Readiness notification occurs when the newline is written, not when
-   the descriptor is closed; but since sdnotify-wrapper stops reading
-   after the first newline and will exit, any subsequent writes will
-   fail and it's best to simply close the descriptor right away.
-
-   sdnotify-wrapper sees the notification when it occurs and sends it
-   to systemd using the sd_notify format.
-
-   Options:
-     -d fd: the daemon will write its notification on descriptor fd.
-     Default is 1.
-     -f: do not doublefork. Use if the daemon waits for children it does
-     not know it has (for instance, superservers do this). When in doubt,
-     do not use that option, or you may have a zombie hanging around.
-     -t timeout: if the daemon has not sent a notification after timeout
-     milliseconds, give up and exit; systemd will not be notified.
-     -k: keep the NOTIFY_SOCKET environment variable when execing into the
-     daemon. By default, the variable is unset: the daemon should not need it.
-
-   Notes:
-     sdnotify-wrapper does not change the daemon's pid. It runs as a
-     (grand)child of the daemon.
-     If the NOTIFY_SOCKET environment variable is not set, sdnotify-wrapper
-     does nothing - it only execs into the daemon.
-     sdnotify-wrapper is more liberal than sd_notify(). It will accept
-     a relative path in NOTIFY_SOCKET.
-*/
-
-
-#include <sys/types.h>
-#include <string.h>
-#include <unistd.h>
-#include <stdlib.h>
-#include <errno.h>
-#include <sys/socket.h>
-#include <sys/un.h>
-
-#include <skalibs/uint64.h>
-#include <skalibs/types.h>
-#include <skalibs/bytestr.h>
-#include <skalibs/sgetopt.h>
-#include <skalibs/strerr2.h>
-#include <skalibs/allreadwrite.h>
-#include <skalibs/tai.h>
-#include <skalibs/iopause.h>
-#include <skalibs/djbunix.h>
-#include <skalibs/socket.h>
-#include <skalibs/exec.h>
-
-#define USAGE "sdnotify-wrapper [ -d fd ] [ -f ] [ -t timeout ] [ -k ] prog..."
-#define dieusage() strerr_dieusage(100, USAGE)
-
-#define VAR "NOTIFY_SOCKET"
-
-static inline int ipc_sendto (int fd, char const *s, size_t len, char const *path)
-{
-  struct sockaddr_un sa ;
-  size_t l = strlen(path) ;
-  if (l > IPCPATH_MAX) return (errno = ENAMETOOLONG, 0) ;
-  memset(&sa, 0, sizeof sa) ;
-  sa.sun_family = AF_UNIX ;
-  memcpy(sa.sun_path, path, l+1) ;
-  if (path[0] == '@') sa.sun_path[0] = 0 ;
-  return sendto(fd, s, len, MSG_NOSIGNAL, (struct sockaddr *)&sa, sizeof sa) >= 0 ;
-}
-
-static inline void notify_systemd (pid_t pid, char const *socketpath)
-{
-  size_t n = 16 ;
-  char fmt[16 + PID_FMT] = "READY=1\nMAINPID=" ;
-  int fd = ipc_datagram_b() ;
-  if (fd < 0) strerr_diefu1sys(111, "create socket") ;
-  n += pid_fmt(fmt + n, pid) ;
-  fmt[n++] = '\n' ;
-  if (!ipc_sendto(fd, fmt, n, socketpath))
-    strerr_diefu2sys(111, "send notification message to ", socketpath) ;
-  close(fd) ;
-}
-
-static inline int run_child (int fd, unsigned int timeout, pid_t pid, char const *s)
-{
-  char dummy[4096] ;
-  iopause_fd x = { .fd = fd, .events = IOPAUSE_READ } ;
-  tain deadline ;
-  tain_now_g() ;
-  if (timeout) tain_from_millisecs(&deadline, timeout) ;
-  else deadline = tain_infinite_relative ;
-  tain_add_g(&deadline, &deadline) ;
-  for (;;)
-  {
-    int r = iopause_g(&x, 1, &deadline) ;
-    if (r < 0) strerr_diefu1sys(111, "iopause") ;
-    if (!r) return 99 ;
-    r = sanitize_read(fd_read(fd, dummy, 4096)) ;
-    if (r < 0)
-      if (errno == EPIPE) return 1 ;
-      else strerr_diefu1sys(111, "read from parent") ;
-    else if (r && memchr(dummy, '\n', r)) break ;
-  }
-  close(fd) ;
-  notify_systemd(pid, s) ;
-  return 0 ;
-}
-
-int main (int argc, char const *const *argv)
-{
-  char const *s = getenv(VAR) ;
-  unsigned int fd = 1 ;
-  unsigned int timeout = 0 ;
-  int df = 1, keep = 0 ;
-  PROG = "sdnotify-wrapper" ;
-  {
-    subgetopt l = SUBGETOPT_ZERO ;
-    for (;;)
-    {
-      int opt = subgetopt_r(argc, argv, "d:ft:k", &l) ;
-      if (opt == -1) break ;
-      switch (opt)
-      {
-        case 'd' : if (!uint0_scan(l.arg, &fd)) dieusage() ; break ;
-        case 'f' : df = 0 ; break ;
-        case 't' : if (!uint0_scan(l.arg, &timeout)) dieusage() ; break ;
-        case 'k' : keep = 1 ; break ;
-        default : dieusage() ;
-      }
-    }
-    argc -= l.ind ; argv += l.ind ;
-  }
-  if (!argc) dieusage() ;
-
-  if (!s) xexec(argv) ;
-  else
-  {
-    pid_t parent = getpid() ;
-    pid_t child ;
-    int p[2] ;
-    if (pipe(p) < 0) strerr_diefu1sys(111, "pipe") ;
-    child = df ? doublefork() : fork() ;
-    if (child < 0) strerr_diefu1sys(111, df ? "doublefork" : "fork") ;
-    else if (!child)
-    {
-      PROG = "sdnotify-wrapper (child)" ;
-      close(p[1]) ;
-      return run_child(p[0], timeout, parent, s) ;
-    }
-    close(p[0]) ;
-    if (fd_move((int)fd, p[1]) < 0) strerr_diefu1sys(111, "move descriptor") ;
-    if (keep) xexec(argv) ;
-    else xmexec_m(argv, VAR, sizeof(VAR)) ;
-  }
-}
diff --git a/pkgs/development/skaware-packages/skalibs/default.nix b/pkgs/development/skaware-packages/skalibs/default.nix
index 9ce53d52cbf6..9d0c622612dd 100644
--- a/pkgs/development/skaware-packages/skalibs/default.nix
+++ b/pkgs/development/skaware-packages/skalibs/default.nix
@@ -7,8 +7,8 @@
 
 skawarePackages.buildPackage {
   pname = "skalibs";
-  version = "2.14.5.1";
-  sha256 = "sha256-+jWccEObSAQAoKLvaAJqJzazFQJanZXfadNGAfuTjw8=";
+  version = "2.15.0.0";
+  sha256 = "sha256-f96W6K+0GRWToVMoiD6cdybJaJHPBxIiFGgh6Mh/gAc=";
 
   description = "Set of general-purpose C programming libraries";
 
diff --git a/pkgs/development/skaware-packages/tipidee/default.nix b/pkgs/development/skaware-packages/tipidee/default.nix
index 9b822903866b..6e8d07841ef8 100644
--- a/pkgs/development/skaware-packages/tipidee/default.nix
+++ b/pkgs/development/skaware-packages/tipidee/default.nix
@@ -6,8 +6,8 @@
 
 skawarePackages.buildPackage {
   pname = "tipidee";
-  version = "0.0.7.1";
-  sha256 = "sha256-ah5JwvCvWqRNuO3sK5KUxPXPaLg6eDGatJkE+KUv63M=";
+  version = "0.0.7.2";
+  sha256 = "sha256-x34St9s/3FbcI9s3ncpmhhbnQmA/6Gf6K9yNTxrKj5s=";
 
   description = "HTTP 1.1 webserver, serving static files and CGI/NPH";
 
diff --git a/pkgs/development/skaware-packages/utmps/default.nix b/pkgs/development/skaware-packages/utmps/default.nix
index 58157ec79aa7..37a375380465 100644
--- a/pkgs/development/skaware-packages/utmps/default.nix
+++ b/pkgs/development/skaware-packages/utmps/default.nix
@@ -2,8 +2,8 @@
 
 skawarePackages.buildPackage {
   pname = "utmps";
-  version = "0.1.3.2";
-  sha256 = "sha256-sRTVauysicBctMDtM8Y4igIRSwnenM44Srm4qTRphmg=";
+  version = "0.1.3.3";
+  sha256 = "sha256-4iEr0C/hdzBCT39eMKTd5x0IYqUrI9i3Ke7XRCCjSaI=";
 
   description = "Secure utmpx and wtmp implementation";
 
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 448a6a216e2e..7cb0b65eaecc 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -20,23 +20,23 @@
         "lts": true
     },
     "6.6": {
-        "version": "6.6.140",
-        "hash": "sha256:1nxpckv5kq4i0vhg0nszzkq1sf9lsjjkaf8q8wvpyc6ll9s9cz6n",
+        "version": "6.6.141",
+        "hash": "sha256:1qbzxgqs7q9gyqfrf0j7p0pgjxnjj5mibamhm280mf9anqp6bhiv",
         "lts": true
     },
     "6.12": {
-        "version": "6.12.90",
-        "hash": "sha256:1a521y1gins69ir1dskhavmrn9bq28c1vknkhii8m2s6azq1y6hz",
+        "version": "6.12.91",
+        "hash": "sha256:0sbrb612b653w64g5jkpbf68y0fka2sgnwblam41k7wz2sgapwhg",
         "lts": true
     },
     "6.18": {
-        "version": "6.18.32",
-        "hash": "sha256:195xsf4d2rpzkkjdp570sgz4128djzvi5wsqc7m890jp8paasz86",
+        "version": "6.18.33",
+        "hash": "sha256:10mp1ypsdz42jr26g1xxbw806mvpy0n35418fhsgxxlr4lqgy5kg",
         "lts": true
     },
     "7.0": {
-        "version": "7.0.9",
-        "hash": "sha256:1i7ihfnidi3q91g24swa7i9rk9m1f016g8l7a7622ingfvgsq1xc",
+        "version": "7.0.10",
+        "hash": "sha256:1p1j9s0b4qv9m0pm6vj477rqgyd1b0lsk0gy74cks3n2cbmpfj89",
         "lts": false
     }
 }
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 5dc925bea9e1..4f36bf596988 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2026.5.3";
+  version = "2026.5.4";
   components = {
     "3_day_blinds" =
       ps: with ps; [
diff --git a/pkgs/servers/home-assistant/custom-components/alarmo/package.nix b/pkgs/servers/home-assistant/custom-components/alarmo/package.nix
index 25d688430fc6..dcf7a722f78c 100644
--- a/pkgs/servers/home-assistant/custom-components/alarmo/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/alarmo/package.nix
@@ -7,13 +7,13 @@
 buildHomeAssistantComponent rec {
   owner = "nielsfaber";
   domain = "alarmo";
-  version = "1.10.17";
+  version = "1.10.18";
 
   src = fetchFromGitHub {
     owner = "nielsfaber";
     repo = "alarmo";
     tag = "v${version}";
-    hash = "sha256-LVTwqJsuFvAGUgZDq6lkUUI/Ch0Ex+ApNxsyuUbDz14=";
+    hash = "sha256-SBR/NVz7E+gsVLnEO3o30irNeFnnBZb5YVJImWHLk2Y=";
   };
 
   postPatch = ''
diff --git a/pkgs/servers/home-assistant/custom-components/closest_intent/package.nix b/pkgs/servers/home-assistant/custom-components/closest_intent/package.nix
new file mode 100644
index 000000000000..11c480e8954e
--- /dev/null
+++ b/pkgs/servers/home-assistant/custom-components/closest_intent/package.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  buildHomeAssistantComponent,
+  fetchFromGitHub,
+  rapidfuzz,
+  # Test dependencies
+  pytestCheckHook,
+  pytest-asyncio,
+  pyyaml,
+}:
+
+buildHomeAssistantComponent (finalAttrs: {
+  owner = "charludo";
+  domain = "closest_intent";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    inherit (finalAttrs) owner;
+    repo = "hass-closest-intent";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-8ST+xYqmDwovDqNLnDsoIvIoPIDussAswGOOvMhRQWk=";
+  };
+
+  dependencies = [
+    rapidfuzz
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-asyncio
+    pyyaml
+  ];
+
+  meta = {
+    changelog = "https://github.com/charludo/hass-closest-intent/releases/tag/${finalAttrs.src.tag}";
+    description = "Fuzzy intent matcher for Home Assistant; garbled STT output in, actual intent out";
+    homepage = "https://github.com/charludo/hass-closest-intent";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [
+      charludo
+      jpds
+    ];
+  };
+})
diff --git a/pkgs/servers/home-assistant/custom-components/entity-notes/package.nix b/pkgs/servers/home-assistant/custom-components/entity-notes/package.nix
index 5318b402b1c7..bc71285acac1 100644
--- a/pkgs/servers/home-assistant/custom-components/entity-notes/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/entity-notes/package.nix
@@ -8,13 +8,13 @@
 buildHomeAssistantComponent rec {
   owner = "martindell";
   domain = "entity_notes";
-  version = "3.3.4";
+  version = "3.3.10";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "ha-entity-notes";
     tag = "v${version}";
-    hash = "sha256-5JKZ/KC2sSDQQeg3taLyuZdF6QJHdc7pJ1jaFD9S3kc=";
+    hash = "sha256-2ZwIqqF3OQ6wjfi5c3cV8NyJNcucd95Nkrs/OimHrb0=";
   };
 
   dependencies = [
diff --git a/pkgs/servers/home-assistant/custom-components/garmin_connect/package.nix b/pkgs/servers/home-assistant/custom-components/garmin_connect/package.nix
index d2c0983671a4..0d440ae0a62e 100644
--- a/pkgs/servers/home-assistant/custom-components/garmin_connect/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/garmin_connect/package.nix
@@ -8,13 +8,13 @@
 buildHomeAssistantComponent rec {
   owner = "cyberjunky";
   domain = "garmin_connect";
-  version = "3.0.7";
+  version = "3.0.8";
 
   src = fetchFromGitHub {
     owner = "cyberjunky";
     repo = "home-assistant-garmin_connect";
     tag = version;
-    hash = "sha256-qCpUMmxH/Fjm2vlC9o5IUuip8QvOUGuPCZTZOnC/uuM=";
+    hash = "sha256-F/zMwaGt9lbMzhgy3Jk23ylalMJqMT5xf90YUeH0Fv4=";
   };
 
   dependencies = [
diff --git a/pkgs/servers/home-assistant/custom-components/local_openai/package.nix b/pkgs/servers/home-assistant/custom-components/local_openai/package.nix
new file mode 100644
index 000000000000..d0d446d34d25
--- /dev/null
+++ b/pkgs/servers/home-assistant/custom-components/local_openai/package.nix
@@ -0,0 +1,33 @@
+{
+  lib,
+  buildHomeAssistantComponent,
+  fetchFromGitHub,
+  openai,
+  demoji,
+}:
+
+buildHomeAssistantComponent (finalAttrs: {
+  owner = "skye-harris";
+  domain = "local_openai";
+  version = "1.6.0";
+
+  src = fetchFromGitHub {
+    inherit (finalAttrs) owner;
+    repo = "hass_local_openai_llm";
+    tag = finalAttrs.version;
+    hash = "sha256-S7gtm9JRaxNh6xbeKRyW6l6nXqE4+h9kgyUZ9RkbLR0=";
+  };
+
+  dependencies = [
+    openai
+    demoji
+  ];
+
+  meta = {
+    changelog = "https://github.com/skye-harris/hass_local_openai_llm/releases/tag/${finalAttrs.src.tag}";
+    description = "Home Assistant LLM integration for local OpenAI-compatible services (llama.cpp, vLLM, etc.)";
+    homepage = "https://github.com/skye-harris/hass_local_openai_llm";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ jpds ];
+  };
+})
diff --git a/pkgs/servers/home-assistant/custom-components/mypyllant/package.nix b/pkgs/servers/home-assistant/custom-components/mypyllant/package.nix
index 5a4dd545c493..7d1e88102d05 100644
--- a/pkgs/servers/home-assistant/custom-components/mypyllant/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/mypyllant/package.nix
@@ -19,13 +19,13 @@
 buildHomeAssistantComponent rec {
   owner = "signalkraft";
   domain = "mypyllant";
-  version = "0.9.12";
+  version = "0.9.13";
 
   src = fetchFromGitHub {
     owner = "signalkraft";
     repo = "mypyllant-component";
     tag = "v${version}";
-    hash = "sha256-vXzcVua2cGQXXeug6Zy4AAeTok+BLH5k+krq3UBuQjw=";
+    hash = "sha256-ydayYZjebVQULYyF3KWJHuSg89dY+bGYe+5zHGxfnEw=";
   };
 
   dependencies = [
diff --git a/pkgs/servers/home-assistant/custom-components/oref_alert/package.nix b/pkgs/servers/home-assistant/custom-components/oref_alert/package.nix
index 30aaf68b387a..e1af2e00991a 100644
--- a/pkgs/servers/home-assistant/custom-components/oref_alert/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/oref_alert/package.nix
@@ -15,13 +15,13 @@
 buildHomeAssistantComponent rec {
   owner = "amitfin";
   domain = "oref_alert";
-  version = "6.18.2";
+  version = "6.18.3";
 
   src = fetchFromGitHub {
     owner = "amitfin";
     repo = "oref_alert";
     tag = "v${version}";
-    hash = "sha256-1z/0nvwQ0cyYWl+LDhCTZQhEzKU/RgSbHejqoZLDRSo=";
+    hash = "sha256-gF8JemhOxnwDHoMcC3Znp9lx92bPdRk/a8e3Upbhb+o=";
   };
 
   # Do not publish cards, currently broken, attempting to write to nix store.
diff --git a/pkgs/servers/home-assistant/custom-components/yandex-station/package.nix b/pkgs/servers/home-assistant/custom-components/yandex-station/package.nix
index 2b3ea307a515..e27df2137651 100644
--- a/pkgs/servers/home-assistant/custom-components/yandex-station/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/yandex-station/package.nix
@@ -10,13 +10,13 @@
 buildHomeAssistantComponent rec {
   owner = "AlexxIT";
   domain = "yandex_station";
-  version = "3.20.3";
+  version = "3.21.1";
 
   src = fetchFromGitHub {
     owner = "AlexxIT";
     repo = "YandexStation";
     tag = "v${version}";
-    hash = "sha256-odI16EkIqQ6tubr0BZHwRWwnAC7816DezNA8FoRcwyc=";
+    hash = "sha256-5a+631Gu7xaPq8EF+34bybm40YVTXPA/ylq6k8LPBNU=";
   };
 
   dependencies = [
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index dfc6e7a1e9f1..e930d470b54a 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -4,6 +4,7 @@
   callPackage,
   fetchFromGitHub,
   fetchPypi,
+  fetchpatch,
   python314,
   replaceVars,
   ffmpeg-headless,
@@ -262,7 +263,7 @@ let
   extraBuildInputs = extraPackages python.pkgs;
 
   # Don't forget to run update-component-packages.py after updating
-  hassVersion = "2026.5.3";
+  hassVersion = "2026.5.4";
 
 in
 python.pkgs.buildPythonApplication rec {
@@ -283,13 +284,13 @@ python.pkgs.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     tag = version;
-    hash = "sha256-U3P97V/3+4eKMPyT6JzqLiDgei84iEOyWdknFvJBn1o=";
+    hash = "sha256-Z5FUkljaWRr9tfBb6RXJCC86ZbyNkw0PvUcOl+bZ2cc=";
   };
 
   # Secondary source is pypi sdist for translations
   sdist = fetchPypi {
     inherit pname version;
-    hash = "sha256-SAeqGo+fTQG//Abix+6pjHKQJY1XBrNL7IexgqoXsYc=";
+    hash = "sha256-o5S6rnOTqzPLZpMBxgmp9IpmLlEHLvHTH68ql2EkVbI=";
   };
 
   build-system = with python.pkgs; [
@@ -318,6 +319,19 @@ python.pkgs.buildPythonApplication rec {
     (replaceVars ./patches/ffmpeg-path.patch {
       ffmpeg = "${lib.getExe ffmpeg-headless}";
     })
+
+    (fetchpatch {
+      name = "2026.5.4-shelly-tests-fix.patch";
+      url = "https://github.com/home-assistant/core/commit/072e9b51a2321b0d4489bae6f1e04f7ed845222f.patch";
+      includes = [ "tests/components/shelly/test_coordinator.py" ];
+      hash = "sha256-0XQdw2MnwzrHKYY06TotfJJem0bqremmi7k8SyVQVGA=";
+    })
+
+    (fetchpatch {
+      name = "2026.5.4-homewizard-tests-fix.patch";
+      url = "https://github.com/home-assistant/core/commit/e796d9c46744097585bfada483108a55ae16344a.patch";
+      hash = "sha256-T0Nb6LcL/21WdUm8RmczhHaVX92n5O/rpMdpqDVQ2VU=";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix b/pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix
index cdbf0b08a477..43bb5b244499 100644
--- a/pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix
+++ b/pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "pytest-homeassistant-custom-component";
-  version = "0.13.332";
+  version = "0.13.333";
   pyproject = true;
 
   disabled = pythonOlder "3.13";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "MatthewFlamm";
     repo = "pytest-homeassistant-custom-component";
     tag = version;
-    hash = "sha256-zkRmuNUmRVvnIwIx494xzFKT0/00GZzkVo6cva9tut4=";
+    hash = "sha256-zSssvqYxgGguKUanzpAYzammeWrBOi0bZrLIfg8NwC0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/servers/home-assistant/stubs.nix b/pkgs/servers/home-assistant/stubs.nix
index 8f1d055b6a8d..b91aba91147f 100644
--- a/pkgs/servers/home-assistant/stubs.nix
+++ b/pkgs/servers/home-assistant/stubs.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "homeassistant-stubs";
-  version = "2026.5.3";
+  version = "2026.5.4";
   pyproject = true;
 
   disabled = python.version != home-assistant.python.version;
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "KapJI";
     repo = "homeassistant-stubs";
     tag = version;
-    hash = "sha256-kgfnT+qTsbB3T8PPsSA698QcxcM1o1QW8hLnfXjGm5M=";
+    hash = "sha256-AMJZxGN/asXcWbT/X92tQQ82/f8vI8MYft/Xx43GInc=";
   };
 
   build-system = [
diff --git a/pkgs/servers/home-assistant/tests.nix b/pkgs/servers/home-assistant/tests.nix
index a4c17265f8cd..c1c60a74c2d8 100644
--- a/pkgs/servers/home-assistant/tests.nix
+++ b/pkgs/servers/home-assistant/tests.nix
@@ -142,6 +142,11 @@ let
       # [2026.5.2] Failed: Description not found for placeholder `modulation` in component.honeywell_string_lights.config.abort.no_compatible_transmitters"
       "test_no_compatible_transmitters"
     ];
+    lutron_caseta = [
+      # [2026.5.4] creates binary_sensor.basement_bedroom_left_shade_battery
+      #            expects binary_sensor.basement_bedroom_basement_bedroom_left_shade_battery
+      "test_battery_sensor_handles_bridge_response_error"
+    ];
     novy_cooker_hood = [
       # [2026.5.2] Failed: Description not found for placeholder `modulation` in component.novy_cooker_hood.config.abort.no_compatible_transmitters
       "test_no_compatible_transmitters"
diff --git a/pkgs/servers/http/angie/default.nix b/pkgs/servers/http/angie/default.nix
index c5e5e3f817c7..ee4dd5c50979 100644
--- a/pkgs/servers/http/angie/default.nix
+++ b/pkgs/servers/http/angie/default.nix
@@ -9,11 +9,11 @@
 
 callPackage ../nginx/generic.nix args rec {
   pname = "angie";
-  version = "1.11.3";
+  version = "1.11.5";
 
   src = fetchurl {
     url = "https://download.angie.software/files/angie-${version}.tar.gz";
-    hash = "sha256-CPqZ0YqQ9zhnSzAPZIZ0BgRa1cUY6VLNJOP/2wwUEX0=";
+    hash = "sha256-tfKXxt8qdLnQCRp83XR//9LQ4dC+Q2MtphwcdTnbIEM=";
   };
 
   configureFlags = lib.optionals withAcme [
diff --git a/pkgs/servers/mail/mailman/package.nix b/pkgs/servers/mail/mailman/package.nix
index 75cd2331ff87..fac9ea19cf35 100644
--- a/pkgs/servers/mail/mailman/package.nix
+++ b/pkgs/servers/mail/mailman/package.nix
@@ -12,16 +12,16 @@ with python3.pkgs;
 
 buildPythonPackage (finalAttrs: {
   pname = "mailman";
-  version = "3.3.9";
+  version = "3.3.10";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-GblXI6IwkLl+V1gEbMAe1baVyZOHMaYaYITXcTkp2Mo=";
+    hash = "sha256-DeR4/PMm8l2TGTjDdE5hxc1nWWtG5bHjuyq/mdVEVjI=";
   };
 
   build-system = with python3.pkgs; [
-    setuptools
+    pdm-backend
   ];
 
   dependencies = with python3.pkgs; [
@@ -71,6 +71,11 @@ buildPythonPackage (finalAttrs: {
       --replace /usr/sbin/postmap ${postfix}/bin/postmap
     substituteInPlace src/mailman/config/schema.cfg \
       --replace /usr/bin/lynx ${lynx}/bin/lynx
+
+    # Backport of
+    # https://gitlab.com/mailman/mailman/-/commit/3a22537382d41ab3e46b859054547755963b069d.patch
+    substituteInPlace pyproject.toml \
+      --replace-fail '"nntplib;' '"standard-nntplib;'
   '';
 
   # Mailman assumes that those scripts in $out/bin are Python scripts. Wrapping
diff --git a/pkgs/servers/mail/mailman/postorius.nix b/pkgs/servers/mail/mailman/postorius.nix
index aabcf02e5115..f25a2ac011a8 100644
--- a/pkgs/servers/mail/mailman/postorius.nix
+++ b/pkgs/servers/mail/mailman/postorius.nix
@@ -10,12 +10,12 @@ with python3.pkgs;
 
 buildPythonPackage (finalAttrs: {
   pname = "postorius";
-  version = "1.3.10";
-  format = "setuptools";
+  version = "1.3.13";
+  format = "pyproject";
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-GmbIqO+03LgbUxJ1nTStXrYN3t2MfvzbeYRAipfTW1o=";
+    hash = "sha256-YC3vXEhSkA1J6K2VGWojNOE8MeSdnAhZMkh558UTGiI=";
   };
 
   patches = [
@@ -25,9 +25,20 @@ buildPythonPackage (finalAttrs: {
       excludes = [ "src/postorius/doc/news.rst" ];
       hash = "sha256-M8C7mO/KoVhl1YtZ5x3wqL+aBkepJ/7NoIRUmd0JpiM=";
     })
+
+    (fetchpatch {
+      name = "django-5.2.patch";
+      url = "https://gitlab.com/mailman/postorius/-/commit/0468ab0329df85b89e6b5d9f7b4d1805f47450c9.patch";
+      excludes = [
+        ".gitlab-ci.yml"
+        "src/postorius/doc/news.rst"
+      ];
+      hash = "sha256-4yk7hLF6cRfS7Kelr49LPeVfrqvNoX1jxTy8sdGrMAk=";
+    })
   ];
 
-  propagatedBuildInputs = [
+  build-system = [ pdm-backend ];
+  dependencies = [
     django-mailman3
     readme-renderer
   ]
diff --git a/pkgs/servers/mail/mailman/python.nix b/pkgs/servers/mail/mailman/python.nix
index 9a1b7b094413..c470f72e7f4c 100644
--- a/pkgs/servers/mail/mailman/python.nix
+++ b/pkgs/servers/mail/mailman/python.nix
@@ -27,19 +27,6 @@ lib.fix (
             [2] f931bc81d63f5cfda55ac73d754c87b3fd63b291
           */
           django = super.django_5;
-
-          django-allauth = super.django-allauth.overrideAttrs (
-            new:
-            { src, ... }:
-            {
-              version = "0.63.6";
-              src = src.override {
-                tag = new.version;
-                hash = "sha256-13/QbA//wyHE9yMB7Jy/sJEyqPKxiMN+CZwSc4U6okU=";
-              };
-              patches = [ ];
-            }
-          );
         })
 
         overlay;
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 2f8f01bbf5eb..6d85a8eecd08 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1333,6 +1333,7 @@ mapAliases {
   log4shell-detector = throw "'log4shell-detector' has been removed, as it was unmaintained upstream and no longer relevant given that the Log4Shell vulnerability has been fixed."; # Added 2025-11-15
   lowPrio = warnAlias "'lowPrio' has been removed from pkgs, use `lib.lowPrio` instead" lib.lowPrio; # Added 2025-10-30
   LPCNet = throw "'LPCNet' has been renamed to/replaced by 'lpcnet'"; # Converted to throw 2025-10-27
+  lttv = throw "'lttv' has been removed, as it is broken and unmaintained. Upstream suggests using 'tracecompass' or 'babeltrace2' instead"; # Added 2026-05-04
   luci-go = throw "luci-go has been removed since it was unused and failing to build for 5 months"; # Added 2025-08-27
   luminanceHDR = throw "'luminanceHDR' has been removed as it depended on EOL qt5 webengine and was unmaintained"; # Added 2026-04-17
   lunarvim = throw "'lunarvim' has been removed since it was abandoned upstream and relied on an older version of 'neovim' to work properly"; # Added 2026-02-05
@@ -1902,6 +1903,7 @@ mapAliases {
   SDL2_classic_image = throw "'SDL2_classic_image' has been removed as part of the deprecation of 'SDL2_classic'. Consider upgrading to 'SDL2_image' built with 'sdl2-compat'."; # Added 2025-05-20
   SDL2_classic_mixer = throw "'SDL2_classic_mixer' has been removed as part of the deprecation of 'SDL2_classic'. Consider upgrading to 'SDL2_mixer' built with 'sdl2-compat'."; # Added 2025-05-20
   SDL2_classic_ttf = throw "'SDL2_classic_ttf' has been removed as part of the deprecation of 'SDL2_classic'. Consider upgrading to 'SDL2_ttf' built with 'sdl2-compat'."; # Added 2025-05-20
+  sdnotify-wrapper = skawarePackages.sdnotify-wrapper;
   seafile-server = throw "'seafile-server' has been removed as it is unmaintained"; # Added 2025-08-21
   seahub = throw "'seahub' has been removed as it is unmaintained"; # Added 2025-08-21
   semantik = throw "'semantik' has been removed as it depended on EOL qt5 webengine"; # Added 2026-04-17
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 6f190f299de3..c23d2d579a98 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7204,7 +7204,6 @@ with pkgs;
     s6-portable-utils-man-pages
     s6-rc
     s6-rc-man-pages
-    sdnotify-wrapper
     skalibs
     skalibs_2_10
     tipidee
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index a955635c4354..1b6bca6440ee 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -316,6 +316,7 @@ mapAliases {
   llama-index-readers-llama-parse = throw "'llama-index-readers-llama-parse' has been removed as it was deprecated upstream in favor of 'llama-cloud'"; # added 2026-03-25
   llama-parse = throw "'llama-parse' has been removed as it was deprecated upstream in favor of 'llama-cloud'"; # added 2026-03-25
   llamaindex-py-client = throw "'llamaindex-pyclient' has been removed as it was removed from upstream"; # Added 2026-04-03
+  llfuse = throw "'llfuse' hase been removed, as it depends on fuse2, and is no longer developed. Please use 'mfusepy' instead"; # Added 2026-05-20
   lmcloud = throw "'lmcloud' has been renamed to/replaced by 'pylamarzocco'"; # Converted to throw 2025-10-29
   logilab_common = throw "'logilab_common' has been renamed to/replaced by 'logilab-common'"; # Converted to throw 2025-10-29
   loo-py = throw "'loo-py' has been renamed to/replaced by 'loopy'"; # Converted to throw 2025-10-29
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 6df32da3a38b..712df11f6f61 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -9268,8 +9268,6 @@ self: super: with self; {
 
   llama-stack-client = callPackage ../development/python-modules/llama-stack-client { };
 
-  llfuse = callPackage ../development/python-modules/llfuse { inherit (pkgs) fuse; };
-
   llguidance = callPackage ../development/python-modules/llguidance { };
 
   llm = callPackage ../development/python-modules/llm { };
@@ -15756,6 +15754,8 @@ self: super: with self; {
 
   python-axolotl-curve25519 = callPackage ../development/python-modules/python-axolotl-curve25519 { };
 
+  python-backoff = callPackage ../development/python-modules/python-backoff { };
+
   python-barbicanclient = callPackage ../development/python-modules/python-barbicanclient { };
 
   python-barcode = callPackage ../development/python-modules/python-barcode { };