diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 92da8927e855..292e24c778dc 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -20417,6 +20417,12 @@
     email = "nyu@nyuku.ru";
     githubId = 97425873;
   };
+  nyxar77 = {
+    name = "nyxar77";
+    github = "nyxar77";
+    email = "dev@nyxar.space";
+    githubId = 153492661;
+  };
   nyxonios = {
     name = "nyxonios";
     github = "Nyxonios";
diff --git a/pkgs/applications/editors/android-studio/default.nix b/pkgs/applications/editors/android-studio/default.nix
index 491e6f20937f..b7e6474653e3 100644
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@@ -26,9 +26,9 @@ let
     url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.1.6/android-studio-quail1-rc1-linux.tar.gz";
   };
   latestVersion = {
-    version = "2026.1.2.2"; # "Android Studio Quail 2 | 2026.1.2 Canary 2"
-    sha256Hash = "sha256-+FmW72k48GF71yzCdpIAl//qi6w26Qg8gZUW5/Nuh58=";
-    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.2.2/android-studio-quail2-canary2-linux.tar.gz";
+    version = "2026.1.2.4"; # "Android Studio Quail 2 | 2026.1.2 Canary 4"
+    sha256Hash = "sha256-fnJYHZPy9bOZJ2leG2+Mr5JGH5HMc2HeMeYGHBUxJXo=";
+    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.2.4/android-studio-quail2-canary4-linux.tar.gz";
   };
 in
 {
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 94ac0751f756..17403eb5163a 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -110,13 +110,13 @@
     "vendorHash": null
   },
   "bpg_proxmox": {
-    "hash": "sha256-eOllsoXIHOym4pn2pBh5Air5eDvgvppVcnw+FfxRet4=",
+    "hash": "sha256-HQDXazrYuO4Sy2p5M3T+ic34GXaLuAt/oPlUPC6kHSk=",
     "homepage": "https://registry.terraform.io/providers/bpg/proxmox",
     "owner": "bpg",
     "repo": "terraform-provider-proxmox",
-    "rev": "v0.107.0",
+    "rev": "v0.108.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-IbxQVfNvMiXGMkrNQoSBQW3VemK9NW8zs8o1epTZydE="
+    "vendorHash": "sha256-pk4FEx/GpI3pbRt1zXEnTwfEy2renn8gh0mVbBiwUE0="
   },
   "brightbox_brightbox": {
     "hash": "sha256-pwFbCP+qDL/4IUfbPRCkddkbsEEeAu7Wp12/mDL0ABA=",
@@ -1184,13 +1184,13 @@
     "vendorHash": "sha256-w/AmSHydCeyp/EURgPY2c/E2LjqAXXCORI53X1hEdxY="
   },
   "scaleway_scaleway": {
-    "hash": "sha256-79oqPfnfX1jFDM9hSXqGF1r3B6S0JEj2+6whxLEmq+Q=",
+    "hash": "sha256-nBx7zmNiQHL+VomJJ4/tyd0gujc2BNQfVA8zG3hT0wc=",
     "homepage": "https://registry.terraform.io/providers/scaleway/scaleway",
     "owner": "scaleway",
     "repo": "terraform-provider-scaleway",
-    "rev": "v2.75.0",
+    "rev": "v2.76.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-GwOKy2H06s+byyb0k4lta30lfAVmLSbEcyyQm0giw1E="
+    "vendorHash": "sha256-X5OVBa1vKsPA2gfXDZWJIcncor9V4NFmWILarqbIBiw="
   },
   "scottwinkler_shell": {
     "hash": "sha256-LTWEdXxi13sC09jh+EFZ6pOi1mzuvgBz5vceIkNE/JY=",
@@ -1202,13 +1202,13 @@
     "vendorHash": "sha256-MIO0VHofPtKPtynbvjvEukMNr5NXHgk7BqwIhbc9+u0="
   },
   "selectel_selectel": {
-    "hash": "sha256-DdQKI9YQcOYNOGNS0uCXFl6rSLVB+YShR+PHSB+W4dY=",
+    "hash": "sha256-1KHFXjYJIWgdZo5nAsckQI9ff+74yO0A5Q65symJjlw=",
     "homepage": "https://registry.terraform.io/providers/selectel/selectel",
     "owner": "selectel",
     "repo": "terraform-provider-selectel",
-    "rev": "v7.8.0",
+    "rev": "v8.0.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-U3v7oYqc3CJIFlNsUqy8ZLy7wRkgjIwLWjwU6eRYvzk="
+    "vendorHash": "sha256-ICMbdEr2vGKZ1ETZLmmrW8h+bzPkpSQk9U3qF+LHPzk="
   },
   "siderolabs_talos": {
     "hash": "sha256-/NACmEpodBNx+Q2M9y3JnKpw9a3Y1eFDdTQ+48MXAc8=",
diff --git a/pkgs/applications/networking/cluster/terraform/default.nix b/pkgs/applications/networking/cluster/terraform/default.nix
index fdd7cddc030e..544437d634bb 100644
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@@ -200,9 +200,9 @@ rec {
   mkTerraform = attrs: pluggable (generic attrs);
 
   terraform_1 = mkTerraform {
-    version = "1.15.4";
-    hash = "sha256-yZj/i/Fkd70y5dzQ7LoHVB8GfY0aaJ7LwmQrmR4DaKI=";
-    vendorHash = "sha256-aGkIsUxKHRgz8vxNO8RhXS0CH78Q14zSVANLrBGdhWw=";
+    version = "1.15.5";
+    hash = "sha256-U3A+Zwe+oj107z635uxzt4y06hvbv9sfokknYdFIglE=";
+    vendorHash = "sha256-3y9+KCmvskJ24X4F6gSLglmsl4hUlvzBb/ep4kcbS8A=";
     patches = [ ./provider-path-0_15.patch ];
     passthru = {
       inherit plugins;
diff --git a/pkgs/applications/networking/irc/weechat/default.nix b/pkgs/applications/networking/irc/weechat/default.nix
index efc8b1f73562..25fb22132ef7 100644
--- a/pkgs/applications/networking/irc/weechat/default.nix
+++ b/pkgs/applications/networking/irc/weechat/default.nix
@@ -105,11 +105,11 @@ assert lib.all (p: p.enabled -> !(builtins.elem null p.buildInputs)) plugins;
 
 stdenv.mkDerivation rec {
   pname = "weechat";
-  version = "4.9.0";
+  version = "4.9.1";
 
   src = fetchurl {
     url = "https://weechat.org/files/src/weechat-${version}.tar.xz";
-    hash = "sha256-fLubJ/JafS8djEJqCPjmJe77wdPlm793WSVET3I5S28=";
+    hash = "sha256-BJYLVuHdhhJ/Y8+P0Bu/93yBQvQK6KlBrD22QtMQzek=";
   };
 
   # Why is this needed? https://github.com/weechat/weechat/issues/2031
@@ -199,7 +199,7 @@ stdenv.mkDerivation rec {
       on https://nixos.org/nixpkgs/manual/#sec-weechat .
     '';
     license = lib.licenses.gpl3;
-    maintainers = with lib.maintainers; [ ncfavier ];
+    maintainers = with lib.maintainers; [ abbe ];
     mainProgram = "weechat";
     platforms = lib.platforms.unix;
   };
diff --git a/pkgs/by-name/_1/_1password-gui/update.sh b/pkgs/by-name/_1/_1password-gui/update.sh
index b4a2fb91f1f2..b1fa7a6a1feb 100755
--- a/pkgs/by-name/_1/_1password-gui/update.sh
+++ b/pkgs/by-name/_1/_1password-gui/update.sh
@@ -1,10 +1,14 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p jq curl
+#!nix-shell -i bash -p jq curl gawk
 #shellcheck shell=bash
 set -euo pipefail
 
-# For Linux version checks we rely on Repology API to check 1Password managed Arch User Repository.
-REPOLOGY_PROJECT_URI="https://repology.org/api/v1/project/1password"
+# For Linux version checks we query upstream's APT repository.
+#
+# Repository only offers amd64 packages for the desktop app.
+# We assume updates are always for both architectures.
+OP_APT_REPO_DIST_BASE="https://downloads.1password.com/linux/debian/amd64/dists"
+OP_APT_REPO_COMPONENT_INDEX="main/binary-amd64/Packages"
 
 # For Darwin version checks we query the same endpoint 1Password 8 for Mac queries.
 # This is the base URI. For stable channel an additional path of "N", for beta channel, "Y" is required.
@@ -17,11 +21,7 @@ CURL=(
   "-H" "user-agent: nixpkgs#_1password-gui update.sh" # repology requires a descriptive user-agent
 )
 
-JQ=(
-  "jq"
-  "--raw-output"
-  "--exit-status" # exit non-zero if no output is produced
-)
+JQ=("jq" "--raw-output")
 
 
 read_local_versions() {
@@ -37,36 +37,56 @@ read_local_versions() {
 
 read_remote_versions() {
   local channel="$1"
-  local darwin_beta_maybe
+  local apt_index="${OP_APT_REPO_DIST_BASE}/${channel}/${OP_APT_REPO_COMPONENT_INDEX}"
+  local apt_awk_prog=$'
+    /^Package: 1password$/ { pkg_is_1password_gui=1 }
+    /^Version/ && pkg_is_1password_gui { print $2; exit }
+  '
+  local chan_os ver
 
   if [[ ${channel} == "stable" ]]; then
-    remote_versions["stable/linux"]=$(
-      "${CURL[@]}" "${REPOLOGY_PROJECT_URI}" \
-        | "${JQ[@]}" '.[] | select(.repo == "aur" and .srcname == "1password" and .status == "newest") | .version'
-    )
+    chan_os="${channel}/linux"
+    ver=$("${CURL[@]}" "${apt_index}" | awk "${apt_awk_prog}")
+    if [[ -n ${ver} ]]; then
+      remote_versions["${chan_os}"]="${ver}"
+    else
+      echo "No remote version for ${chan_os}" >&2
+    fi
 
-    remote_versions["stable/darwin"]=$(
+    chan_os="${channel}/darwin"
+    ver=$(
       "${CURL[@]}" "${APP_UPDATES_URI_BASE}/N" \
         | "${JQ[@]}" 'select(.available == "1") | .version'
     )
+    if [[ -n ${ver} ]]; then
+      remote_versions["${chan_os}"]="${ver}"
+    else
+      echo "No remote version for ${chan_os}" >&2
+    fi
   else
-    remote_versions["beta/linux"]=$(
-      # AUR version string uses underscores instead of dashes for betas.
-      # We fix that with a `sub` in jq query.
-      "${CURL[@]}" "${REPOLOGY_PROJECT_URI}" \
-        | "${JQ[@]}" '.[] | select(.repo == "aur" and .srcname == "1password-beta") | .version | sub("_"; "-")'
+    chan_os="${channel}/linux"
+    ver=$(
+      # Deb package version string uses tilde instead of dashes for betas.
+      "${CURL[@]}" "${apt_index}" | awk "${apt_awk_prog}" | sed 's/~/-/'
     )
+    if [[ -n ${ver} ]]; then
+      remote_versions["${chan_os}"]="${ver}"
+    else
+      echo "No remote version for ${chan_os}" >&2
+    fi
 
     # Handle macOS Beta app-update feed quirk.
     # If there is a newer release in the stable channel, queries for beta
     # channel will return the stable channel version; masking the current beta.
-    darwin_beta_maybe=$(
+    chan_os="${channel}/darwin"
+    ver=$(
       "${CURL[@]}" "${APP_UPDATES_URI_BASE}/Y" \
-        | "${JQ[@]}" 'select(.available == "1") | .version'
+        | "${JQ[@]}" 'select(.available == "1" and (.version | endswith(".BETA"))) | .version'
     )
-    # Only consider versions that end with '.BETA'
-    if [[ ${darwin_beta_maybe} =~ \.BETA$ ]]; then
-      remote_versions["beta/darwin"]=${darwin_beta_maybe}
+    if [[ -n ${ver} ]]; then
+      remote_versions["${chan_os}"]="${ver}"
+    else
+      echo "No remote version for ${chan_os}" >&2
     fi
   fi
 }
diff --git a/pkgs/by-name/at/attyx/package.nix b/pkgs/by-name/at/attyx/package.nix
index 7f290279de0d..db515a54731e 100644
--- a/pkgs/by-name/at/attyx/package.nix
+++ b/pkgs/by-name/at/attyx/package.nix
@@ -18,13 +18,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "attyx";
-  version = "0.4.2";
+  version = "0.4.3";
 
   src = fetchFromGitHub {
     owner = "semos-labs";
     repo = "attyx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-b8a/fLW4jeek5KckBWmd+fIhN6S2JoNvxAW2zBCokiY=";
+    hash = "sha256-DJe1HreijOwFaqDY+Ai1utiK4u66pUbBkEY6TOat27A=";
   };
 
   deps = callPackage ./build.zig.zon.nix { };
diff --git a/pkgs/by-name/ba/base24-schemes/package.nix b/pkgs/by-name/ba/base24-schemes/package.nix
new file mode 100644
index 000000000000..f8bef3510d3a
--- /dev/null
+++ b/pkgs/by-name/ba/base24-schemes/package.nix
@@ -0,0 +1,27 @@
+{
+  lib,
+  stdenv,
+  base16-schemes,
+}:
+stdenv.mkDerivation {
+  pname = "base24-schemes";
+  inherit (base16-schemes) version src;
+
+  strictDeps = true;
+  __structuredAttrs = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/themes
+    install base24/*.yaml $out/share/themes/
+
+    runHook postInstall
+  '';
+
+  meta = base16-schemes.meta // {
+    description = "Base24 color schemes from Tinted Theming";
+    maintainers = with lib.maintainers; [ nyxar77 ];
+  };
+}
diff --git a/pkgs/by-name/br/broot/package.nix b/pkgs/by-name/br/broot/package.nix
index 384f677be005..2dc1d3488e50 100644
--- a/pkgs/by-name/br/broot/package.nix
+++ b/pkgs/by-name/br/broot/package.nix
@@ -16,16 +16,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "broot";
-  version = "1.56.4";
+  version = "1.57.0";
 
   src = fetchFromGitHub {
     owner = "Canop";
     repo = "broot";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JqD4CSTVbrqg7nAkSRp4SaGpFKt1U3CYLxM31AJfcPA=";
+    hash = "sha256-uRMa8zaXXM8KWUplYMyOLic/WITLU0eAbZ2VDgM/PBw=";
   };
 
-  cargoHash = "sha256-5VGgbrd+iDD+L6JFy4H6HFuRW6xtQDawSGGSQARjRU0=";
+  cargoHash = "sha256-p4R8+PcRmjy/2q7lpfUevuYROPrCQEffmXx5vRrjwKs=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/de/deptry/package.nix b/pkgs/by-name/de/deptry/package.nix
new file mode 100644
index 000000000000..e2633aa766b0
--- /dev/null
+++ b/pkgs/by-name/de/deptry/package.nix
@@ -0,0 +1,5 @@
+{ python3Packages }:
+with python3Packages;
+(toPythonApplication deptry).overrideAttrs (_: {
+  __structuredAttrs = true;
+})
diff --git a/pkgs/by-name/di/direwolf-unstable/package.nix b/pkgs/by-name/di/direwolf-unstable/package.nix
index bfcc33889a8f..13d4858ccc86 100644
--- a/pkgs/by-name/di/direwolf-unstable/package.nix
+++ b/pkgs/by-name/di/direwolf-unstable/package.nix
@@ -12,13 +12,13 @@
   inherit hamlibSupport gpsdSupport extraScripts;
 }).overrideAttrs
   (oldAttrs: {
-    version = "1.8.1-unstable-2026-03-18";
+    version = "1.8.1-unstable-2026-05-27";
 
     src = fetchFromGitHub {
       owner = "wb2osz";
       repo = "direwolf";
-      rev = "78d6559c67b94568b2f093fc9b4d4965749387ae";
-      hash = "sha256-sSXvDTnrOHplmg86kZ+ppPD0Y6JuhHBfrXZToK8EqmY=";
+      rev = "d6151874ecf202cbb401a671a90b15d0fab92fa9";
+      hash = "sha256-t19AjQzjkpteqwfRVI/tM5wCVNeFceWPHjq0UtdevXg=";
     };
 
     dontVersionCheck = true;
diff --git a/pkgs/by-name/do/dotenvx/package.nix b/pkgs/by-name/do/dotenvx/package.nix
index 880bfbbab67e..78729f99a991 100644
--- a/pkgs/by-name/do/dotenvx/package.nix
+++ b/pkgs/by-name/do/dotenvx/package.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "dotenvx";
-  version = "1.68.0";
+  version = "1.71.0";
 
   src = fetchFromGitHub {
     owner = "dotenvx";
     repo = "dotenvx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-w2AljviPNkXC+f4x3QEuR9FSkg0Dy+zYqVPrSWjbrDU=";
+    hash = "sha256-nnzjPyxqAu7r4rKkTEaQsHdORnVo6dqwG38ALjjmZMs=";
   };
 
-  npmDepsHash = "sha256-l9nRDYg7mrgF2GAYbQgoes0VzpTGAn9TMHrmWjvZnMY=";
+  npmDepsHash = "sha256-XMNpCgFVphdfdAWjclqjpGyhggbNm6A/RdIAy/Ga9po=";
 
   dontNpmBuild = true;
 
diff --git a/pkgs/by-name/fr/fresh-editor/package.nix b/pkgs/by-name/fr/fresh-editor/package.nix
index 2173c8629aa7..26b240c85534 100644
--- a/pkgs/by-name/fr/fresh-editor/package.nix
+++ b/pkgs/by-name/fr/fresh-editor/package.nix
@@ -12,16 +12,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "fresh";
-  version = "0.3.8";
+  version = "0.3.10";
 
   src = fetchFromGitHub {
     owner = "sinelaw";
     repo = "fresh";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HMKvqJ69EvlAK2Tc4yeY0mfJgUwFIGyhUWdqqOgu6Ec=";
+    hash = "sha256-5gMrQOhQVyIJuv5QAPOyiTFcY4RntmQV0Mtue1x8aAs=";
   };
 
-  cargoHash = "sha256-n48tWnb9NuPC9VET/LfcJD5ub8IZ62PvvqcQ5d5Pkg8=";
+  cargoHash = "sha256-5QHNIt7PoB2IhQU6IyL5Ljax0/CzVMHvMcNDfM9st7U=";
 
   __structuredAttrs = true;
 
diff --git a/pkgs/by-name/ge/geoserver/extensions.nix b/pkgs/by-name/ge/geoserver/extensions.nix
index 53cbcba30bb1..af55aa9b5123 100644
--- a/pkgs/by-name/ge/geoserver/extensions.nix
+++ b/pkgs/by-name/ge/geoserver/extensions.nix
@@ -42,159 +42,159 @@ in
 {
   app-schema = mkGeoserverExtension {
     name = "app-schema";
-    version = "2.28.3"; # app-schema
-    hash = "sha256-fxMFV5/lvhCcgRfL+2Qf0ePo6EC/bLM1IeL5qNoKVrQ="; # app-schema
+    version = "2.28.4"; # app-schema
+    hash = "sha256-qgzJP8m3CnkZHlM3Wmix9wl8M0G9m8DTJZ8HcBJx/aw="; # app-schema
   };
 
   authkey = mkGeoserverExtension {
     name = "authkey";
-    version = "2.28.3"; # authkey
-    hash = "sha256-pAB8vPn+cZnKQKGLHtXrkLbieTs7wMi6ArGL8fxo31s="; # authkey
+    version = "2.28.4"; # authkey
+    hash = "sha256-UDRVVPGqhCwen/irMz8YUbv01PQ4oRFJgELtzvJ6WGk="; # authkey
   };
 
   cas = mkGeoserverExtension {
     name = "cas";
-    version = "2.28.3"; # cas
-    hash = "sha256-BEDE9dZ4sZBr15Wvbpio9JOIEai53cJLe4QhvYbQwKw="; # cas
+    version = "2.28.4"; # cas
+    hash = "sha256-g0BqPXtRoIYfLps6cFCg/+DBYOZpQX/bolJcwGuCTaI="; # cas
   };
 
   charts = mkGeoserverExtension {
     name = "charts";
-    version = "2.28.3"; # charts
-    hash = "sha256-cFbMdIIQwZudSgDBW8YN81GduG1bSQFLldjtubaclqA="; # charts
+    version = "2.28.4"; # charts
+    hash = "sha256-vhFVGX64M+5NfHYBNj1yMadZ2bKLwemURjwd6jp2HPM="; # charts
   };
 
   control-flow = mkGeoserverExtension {
     name = "control-flow";
-    version = "2.28.3"; # control-flow
-    hash = "sha256-HrS+/QntfSdMHLzA1+wJh7JWA2THLSOBDdIdeG7I4u4="; # control-flow
+    version = "2.28.4"; # control-flow
+    hash = "sha256-FJj8g145s1qOoym+5SQymcSzH8bTzthUg5dWIR7ZGPU="; # control-flow
   };
 
   css = mkGeoserverExtension {
     name = "css";
-    version = "2.28.3"; # css
-    hash = "sha256-7gYg4v8ekThV3k21hrJlu6jULJxdyUFZZh0ToaZSyeI="; # css
+    version = "2.28.4"; # css
+    hash = "sha256-9BYc4j1fk5hTT4jKdHReaoSg7bWjxmyUrOdwMospiiM="; # css
   };
 
   csw = mkGeoserverExtension {
     name = "csw";
-    version = "2.28.3"; # csw
-    hash = "sha256-C/Th+KjiGWCfzMvVpby22BxXnkEtAYg1asYjO/Ge0fA="; # csw
+    version = "2.28.4"; # csw
+    hash = "sha256-/+IQO/X26cMz5+aOtMDJ23ovjnmOOATSgRNs40bzM0I="; # csw
   };
 
   csw-iso = mkGeoserverExtension {
     name = "csw-iso";
-    version = "2.28.3"; # csw-iso
-    hash = "sha256-ctZgjCQDLZKHAmd2Og+Vvu7iYxCU+08pTniImDDjmz0="; # csw-iso
+    version = "2.28.4"; # csw-iso
+    hash = "sha256-kmUH2g18/PXBTl2cUzs2q1fzSn6BllikvatRgNlxRtc="; # csw-iso
   };
 
   db2 = mkGeoserverExtension {
     name = "db2";
-    version = "2.28.3"; # db2
-    hash = "sha256-yVghGPW07USGx4ZYs6F2P5VuGbNaUo3wzOrx1BOvFkE="; # db2
+    version = "2.28.4"; # db2
+    hash = "sha256-4xeE1Y6PXqlt7LCz5s86+Uj6JMV2HqrmJpIAR6pnQhk="; # db2
   };
 
   # Needs wps extension.
   dxf = mkGeoserverExtension {
     name = "dxf";
-    version = "2.28.3"; # dxf
-    hash = "sha256-o40HBSTzAmaUdCHslpBnK8ALHKh36V8PqmGzqdAtl7w="; # dxf
+    version = "2.28.4"; # dxf
+    hash = "sha256-lfvvlennN7Ig0sV2ujAi3KpLmgqFSf1Y5m6pcpSc2wY="; # dxf
   };
 
   excel = mkGeoserverExtension {
     name = "excel";
-    version = "2.28.3"; # excel
-    hash = "sha256-7kOEb3ayiUZs0PV8qSiz+FuniWI1JEfod7wcf4e+1LM="; # excel
+    version = "2.28.4"; # excel
+    hash = "sha256-VSh9rNAnJzbfEYKELY1BRcoHRtifk3J0D08ZnF5+kTc="; # excel
   };
 
   feature-pregeneralized = mkGeoserverExtension {
     name = "feature-pregeneralized";
-    version = "2.28.3"; # feature-pregeneralized
-    hash = "sha256-/6qvxhpg5HG+FlTsUclxxEfAYdhqV/cefDAta1Iw3sg="; # feature-pregeneralized
+    version = "2.28.4"; # feature-pregeneralized
+    hash = "sha256-ZY7Qr3faGZOFg7zX4JFJ+FdSIhXQ1ROulcPRmGRGyAI="; # feature-pregeneralized
   };
 
   # Note: The extension name ("gdal") clashes with pkgs.gdal.
   gdal = mkGeoserverExtension {
     name = "gdal";
-    version = "2.28.3"; # gdal
+    version = "2.28.4"; # gdal
     buildInputs = [ pkgs.gdal ];
-    hash = "sha256-0IFF+x7T6qupakRx0Y+nwlVAC4byiDDCqovdPewdJWY="; # gdal
+    hash = "sha256-7GT6XfpDjCX+TYprg4Y59UshSYa0tACIFQrtPW8vrFM="; # gdal
   };
 
   # Throws "java.io.FileNotFoundException: URL [jar:file:/nix/store/.../WEB-INF/lib/gs-geofence-server-2.24.1.jar!/geofence-default-override.properties] cannot be resolved to absolute file path because it does not reside in the file system: jar:file:/nix/store/.../WEB-INF/lib/gs-geofence-server-2.24.1.jar!/geofence-default-override.properties" but seems to work out of the box.
   #geofence = mkGeoserverExtension {
   #  name = "geofence";
-  #  version = "2.28.3"; # geofence
-  #  hash = "sha256-IQ+s6Q/nEnUAKfCdWQNhVNIEOWyi2VhDxMxWg4lfWKI="; # geofence
+  #  version = "2.28.4"; # geofence
+  #  hash = "sha256-620nYoPkM1GitY221F/uN9Ts8D9h7DBvXf9DAxoUGBY="; # geofence
   #};
 
   #geofence-server-h2 = mkGeoserverExtension {
   #  name = "geofence-server-h2";
-  #  version = "2.28.3"; # geofence-server
-  #  hash = "sha256-WqzBPh0YNMcLbrKdNcYNZSQrVYPYczC/+uIw4I58A14="; # geofence-server-h2
+  #  version = "2.28.4"; # geofence-server
+  #  hash = "sha256-KL4VTHZ3/kfCBkvAKgCmXs+TVa2Z4Zb+UphRyVnZI2I="; # geofence-server-h2
   #};
 
   #geofence-server-postgres = mkGeoserverExtension {
   #  name = "geofence-server-postgres";
-  #  version = "2.28.3"; # geofence-server
-  #  hash = "sha256-ox7EjhVcetJInONerxtLK4MQt4BPIZ9EtPmmK6cnKJY="; # geofence-server-postgres
+  #  version = "2.28.4"; # geofence-server
+  #  hash = "sha256-7EVrhV6vbglGd15K81Ypygu+1tEYtZOy9wsERBu4sNM="; # geofence-server-postgres
   #};
 
   #geofence-wps = mkGeoserverExtension {
   #  name = "geofence-wps";
-  #  version = "2.28.3"; # geofence-wps
-  #  hash = "sha256-txQwmE8mkCttfd57JFYbVuwIpfY+FFzb/hMcGEiEeW4="; # geofence-wps
+  #  version = "2.28.4"; # geofence-wps
+  #  hash = "sha256-7yVXODL1Fx0KM4BSeHCa4Fw/+xE7j9LJtdpVLeWPOI8="; # geofence-wps
   #};
 
   geopkg-output = mkGeoserverExtension {
     name = "geopkg-output";
-    version = "2.28.3"; # geopkg-output
-    hash = "sha256-JlMDDHvieYPTdKzYJxALzVrVZ+Jce447lq99hRQwP6Y="; # geopkg-output
+    version = "2.28.4"; # geopkg-output
+    hash = "sha256-2CbA5opqZwwKBcM87nbY9e/i67vs70SShW08Fpryy8o="; # geopkg-output
   };
 
   grib = mkGeoserverExtension {
     name = "grib";
-    version = "2.28.3"; # grib
-    hash = "sha256-ydDlRbTxxieQkeSHAR4gf1+KrjvjGBQhAEyTc0jTN9E="; # grib
+    version = "2.28.4"; # grib
+    hash = "sha256-apCBtt1SOB8rimpUDny6KOjxzwMjCk+E3vdpv336iJE="; # grib
     buildInputs = [ netcdf ];
   };
 
   gwc-s3 = mkGeoserverExtension {
     name = "gwc-s3";
-    version = "2.28.3"; # gwc-s3
-    hash = "sha256-OsfS7b4w6PsJ6s20wn09FFJzjMv32iZldF9T8qaHH8A="; # gwc-s3
+    version = "2.28.4"; # gwc-s3
+    hash = "sha256-Jy3/EFNJym61st2LAysgRKsS2KBTFhkFSZc6WouO3LA="; # gwc-s3
   };
 
   h2 = mkGeoserverExtension {
     name = "h2";
-    version = "2.28.3"; # h2
-    hash = "sha256-3B0WJrYG7UaHHt2p98zd5mWPJWKz3J/R7iwH4b2PLe4="; # h2
+    version = "2.28.4"; # h2
+    hash = "sha256-tqchE8kkyo35rL9ESs/TD8n9CWAaWiWqe3wxKXt3Ut4="; # h2
   };
 
   iau = mkGeoserverExtension {
     name = "iau";
-    version = "2.28.3"; # iau
-    hash = "sha256-oIgED4jwp5QENorSdWSvj3Pvy92dSF/Pjm6YwdZrbw8="; # iau
+    version = "2.28.4"; # iau
+    hash = "sha256-yorqFxLh9PWoC0j4WXwXs5uK1sy2gV9S1vS36ebKBIc="; # iau
   };
 
   importer = mkGeoserverExtension {
     name = "importer";
-    version = "2.28.3"; # importer
-    hash = "sha256-6ZCmlzu5/sN76ZgVDtU02L9D/aNL+kawcf/EKakdlgU="; # importer
+    version = "2.28.4"; # importer
+    hash = "sha256-XGCVD/CUZjiPCzLyHec7na+fNARkBvnfR1+GbCdogXQ="; # importer
   };
 
   inspire = mkGeoserverExtension {
     name = "inspire";
-    version = "2.28.3"; # inspire
-    hash = "sha256-O/WPgBfyyI/sHZK9xGMjlYf4qyTT7Sx3psYWbjV3z1E="; # inspire
+    version = "2.28.4"; # inspire
+    hash = "sha256-/9juMAOOCycPeJcuB9a3DMIC8xzN1WjrzEi951utodg="; # inspire
   };
 
   # Needs Kakadu plugin from
   # https://github.com/geosolutions-it/imageio-ext
   #jp2k = mkGeoserverExtension {
   #  name = "jp2k";
-  #  version = "2.28.3"; # jp2k
-  #  hash = "sha256-rLwuY5aEIKrjgyAXexFEpsRt+pNZLxI/YFo0yiBCblc="; # jp2k
+  #  version = "2.28.4"; # jp2k
+  #  hash = "sha256-IfGThXCIEkmoTlA3EdIWekFDGBw3K+yqO49RZFDfAeQ="; # jp2k
   #};
 
   # Throws "java.lang.UnsatisfiedLinkError: 'void org.libjpegturbo.turbojpeg.TJDecompressor.init()'"
@@ -202,174 +202,174 @@ in
   # NOTE: When re-enabling this, RE-ENABLE THE CORRESPONDING TEST, TOO! (See tests/geoserver.nix)
   #libjpeg-turbo = mkGeoserverExtension {
   #  name = "libjpeg-turbo";
-  #  version = "2.28.3"; # libjpeg-turbo
-  #  hash = "sha256-cftD9VyJCxkYQBKuyBtnEeBAchYOAJGnl677MQAAdc4="; # libjpeg-turbo
+  #  version = "2.28.4"; # libjpeg-turbo
+  #  hash = "sha256-05aP0WypGM0dz/OXM/1paYgmmwGGcU7j34kYdJIlL0U="; # libjpeg-turbo
   #  buildInputs = [ libjpeg.out ];
   #};
 
   mapml = mkGeoserverExtension {
     name = "mapml";
-    version = "2.28.3"; # mapml
-    hash = "sha256-r7GJbqCAnsxJV8zyHQG8EP3sbiXcfpQHNgMmj7viJac="; # mapml
+    version = "2.28.4"; # mapml
+    hash = "sha256-fZVPUqUlNx2xvh9qEJgIX+rfvT2ZeLjb8SgTEdYC4FI="; # mapml
   };
 
   mbstyle = mkGeoserverExtension {
     name = "mbstyle";
-    version = "2.28.3"; # mbstyle
-    hash = "sha256-RtxnQoWUSHOfizRS1eYR+o+n9HXpCt+bG1UOxFyRy9I="; # mbstyle
+    version = "2.28.4"; # mbstyle
+    hash = "sha256-OHEJ5u1r4KcikluRjah1S137IjbDDtGtVQQbqczjoco="; # mbstyle
   };
 
   metadata = mkGeoserverExtension {
     name = "metadata";
-    version = "2.28.3"; # metadata
-    hash = "sha256-lFnZhs3FdGlQ4J37erOjLVB5QuRo6E0IUvAgONqvP4U="; # metadata
+    version = "2.28.4"; # metadata
+    hash = "sha256-pL1Xti6+TUPN0ujpJjGRt26q3ItEKQa37loNpmQvwVs="; # metadata
   };
 
   mongodb = mkGeoserverExtension {
     name = "mongodb";
-    version = "2.28.3"; # mongodb
-    hash = "sha256-M9l7jdp7oUfo0gMVfMcCVHizi0//YfBqh17tsiDMKno="; # mongodb
+    version = "2.28.4"; # mongodb
+    hash = "sha256-XwQAKp6XZH3W4qsNjhmA73hf6SjINz9/SOPwb2wGdcU="; # mongodb
   };
 
   monitor = mkGeoserverExtension {
     name = "monitor";
-    version = "2.28.3"; # monitor
-    hash = "sha256-HPdoKySCLT3zVdOlNIuJlEu99mJ9J/VjTFEfT63UdUs="; # monitor
+    version = "2.28.4"; # monitor
+    hash = "sha256-JhmsDRoHGbTBCKxKqlxdpmn2WGC/aQnyeuWLs1u0xFE="; # monitor
   };
 
   mysql = mkGeoserverExtension {
     name = "mysql";
-    version = "2.28.3"; # mysql
-    hash = "sha256-w/owOCOXJnw7EoJdPO8NGEw75MEfNMWSCySh0+2x84E="; # mysql
+    version = "2.28.4"; # mysql
+    hash = "sha256-f8xdJ2WVYQV+HG5U2J/1vKBAFo5srFWSPXVAyRUt8kE="; # mysql
   };
 
   netcdf = mkGeoserverExtension {
     name = "netcdf";
-    version = "2.28.3"; # netcdf
-    hash = "sha256-2O7s7SUjAm/V+O2LrdqOLou12WkjxIg0zuIgRMFUp9M="; # netcdf
+    version = "2.28.4"; # netcdf
+    hash = "sha256-wU5MkTYgxxOgBBybbbeHtT2Rj1CoTFBTjGzyLPlPT7A="; # netcdf
     buildInputs = [ netcdf ];
   };
 
   netcdf-out = mkGeoserverExtension {
     name = "netcdf-out";
-    version = "2.28.3"; # netcdf-out
-    hash = "sha256-KgqbHHxBlr0EIPJ1MStCPzV/844C3CUUBuBMe2ljbuA="; # netcdf-out
+    version = "2.28.4"; # netcdf-out
+    hash = "sha256-0RIRTDtTUEj9OUDpAD1LbCY1iGCbXAKbgmH7ZkNHWhM="; # netcdf-out
     buildInputs = [ netcdf ];
   };
 
   ogr-wfs = mkGeoserverExtension {
     name = "ogr-wfs";
-    version = "2.28.3"; # ogr-wfs
+    version = "2.28.4"; # ogr-wfs
     buildInputs = [ pkgs.gdal ];
-    hash = "sha256-+l9U1YoiKn1nxOUP5tRT/9WPRham5Lrk12xt/9rrZuM="; # ogr-wfs
+    hash = "sha256-UAsTKEMVlYTrCpbs8++Kxdn0w6ejzMiPrT7S2NlMNxc="; # ogr-wfs
   };
 
   # Needs ogr-wfs extension.
   ogr-wps = mkGeoserverExtension {
     name = "ogr-wps";
-    version = "2.28.3"; # ogr-wps
+    version = "2.28.4"; # ogr-wps
     # buildInputs = [ pkgs.gdal ];
-    hash = "sha256-PBqObn/gle6A8RVPmKOPhi2YNTqR2MmhbqZT3X7TygI="; # ogr-wps
+    hash = "sha256-sjV0YwR21GQYt4YuDIE2H+5UQ2qRmP7tWVyOXNuLkSM="; # ogr-wps
   };
 
   oracle = mkGeoserverExtension {
     name = "oracle";
-    version = "2.28.3"; # oracle
-    hash = "sha256-fHbgYIz7Kb7lTgDVlKPkMwldXIJn/mqG3oHDUk76rTc="; # oracle
+    version = "2.28.4"; # oracle
+    hash = "sha256-xiIPgpWCDycE6rTW49QnB/7rHbns1GJhWCdIfMEBuXE="; # oracle
   };
 
   params-extractor = mkGeoserverExtension {
     name = "params-extractor";
-    version = "2.28.3"; # params-extractor
-    hash = "sha256-nseCXkh4V13FfbWtva79ydxg7sFMTeGrK3HygaVNPR8="; # params-extractor
+    version = "2.28.4"; # params-extractor
+    hash = "sha256-/AOjfsA58btiOBv4zvF4jdLt2lE5GPDKUKzNZyX8fI0="; # params-extractor
   };
 
   printing = mkGeoserverExtension {
     name = "printing";
-    version = "2.28.3"; # printing
-    hash = "sha256-zGqDnmrO82cgCQgaorHa+O/Z5L42um/7CttZ2wC7Az4="; # printing
+    version = "2.28.4"; # printing
+    hash = "sha256-smytiUVPKq31YyWE/xLwiGPLQ6DxScj2gHjMbgKCjMc="; # printing
   };
 
   pyramid = mkGeoserverExtension {
     name = "pyramid";
-    version = "2.28.3"; # pyramid
-    hash = "sha256-BCvGhp9WmdqutPu09kIExJzuFGdOWQ8Eyin95iIhdw8="; # pyramid
+    version = "2.28.4"; # pyramid
+    hash = "sha256-xfOzBm5eTbzfRRiMQ63i29GW91IxWKIotrSUa6BgD5M="; # pyramid
   };
 
   querylayer = mkGeoserverExtension {
     name = "querylayer";
-    version = "2.28.3"; # querylayer
-    hash = "sha256-oA8F3J9i5sQTmUGLysddXF+GU6hR1yOHbNqiUAyPDTE="; # querylayer
+    version = "2.28.4"; # querylayer
+    hash = "sha256-WyLyUoLfv8JIKBqjphcXgWBbtkJEB3ig4cyY158lRQk="; # querylayer
   };
 
   sldservice = mkGeoserverExtension {
     name = "sldservice";
-    version = "2.28.3"; # sldservice
-    hash = "sha256-AehHS+ELScFdeZi5kyqqJ9nldKla06r8Yq1PB43cYA0="; # sldservice
+    version = "2.28.4"; # sldservice
+    hash = "sha256-DsN9tKZshcsz6/IsPA0l757YtmsakBi/NbgEUwnfafs="; # sldservice
   };
 
   sqlserver = mkGeoserverExtension {
     name = "sqlserver";
-    version = "2.28.3"; # sqlserver
-    hash = "sha256-ZS5ThHv/TEiH4BWcox68GKbqueFq7qhWDtDMgcUBINo="; # sqlserver
+    version = "2.28.4"; # sqlserver
+    hash = "sha256-MBMU4pJKgS3qra9pli8SAnOtIiDU2zD0sXJaKXlr0+A="; # sqlserver
   };
 
   vectortiles = mkGeoserverExtension {
     name = "vectortiles";
-    version = "2.28.3"; # vectortiles
-    hash = "sha256-vvZSFfKgAFFtzLKv+RVh99frUyG2RkWrCwfR7scF+xw="; # vectortiles
+    version = "2.28.4"; # vectortiles
+    hash = "sha256-6E3lwH573lTSMYtQ00b3fVtJYSsIFETwT7JAZHI6ubQ="; # vectortiles
   };
 
   wcs2_0-eo = mkGeoserverExtension {
     name = "wcs2_0-eo";
-    version = "2.28.3"; # wcs2_0-eo
-    hash = "sha256-x876KCXUbr1kGkAoHtDhoNqFGFVWw3te0tBt+03+ywU="; # wcs2_0-eo
+    version = "2.28.4"; # wcs2_0-eo
+    hash = "sha256-w30lrzli6++7NDu59QsRFxyIQBMSV7M5BeTqGSJmw18="; # wcs2_0-eo
   };
 
   web-resource = mkGeoserverExtension {
     name = "web-resource";
-    version = "2.28.3"; # web-resource
-    hash = "sha256-gjeqIP0qGCjogDgxug3k+1daVCxKQeHAsEJJWmPbe/8="; # web-resource
+    version = "2.28.4"; # web-resource
+    hash = "sha256-GH0foPjbBcKOXahqgPv+02Jex3ZE5XKmeWNDew0DKF4="; # web-resource
   };
 
   wmts-multi-dimensional = mkGeoserverExtension {
     name = "wmts-multi-dimensional";
-    version = "2.28.3"; # wmts-multi-dimensional
-    hash = "sha256-LbdMCDHjCiWpEUxL43RZY19a5DfJ9RKxmcq213NbAY8="; # wmts-multi-dimensional
+    version = "2.28.4"; # wmts-multi-dimensional
+    hash = "sha256-gi8qwwKG9K1l4AJ05vDGykxCmd42oSFSZtwhDwDI8m0="; # wmts-multi-dimensional
   };
 
   wps = mkGeoserverExtension {
     name = "wps";
-    version = "2.28.3"; # wps
-    hash = "sha256-QgDpKbRGwGnAVrx/PW87N22D2yhrmzfg6qNmevXWI44="; # wps
+    version = "2.28.4"; # wps
+    hash = "sha256-2qh7fDeJAswTb+P60zNQeH1nc0886Dfh7pWpUWCaEKc="; # wps
   };
 
   # Needs hazelcast (https://github.com/hazelcast/hazelcast (?)) which is not
   # available in nixpgs as of 2024/01.
   #wps-cluster-hazelcast = mkGeoserverExtension {
   #  name = "wps-cluster-hazelcast";
-  #  version = "2.28.3"; # wps-cluster-hazelcast
-  #  hash = "sha256-beSIkj3btLokQsS800vD0q2hiagLnnX+VTH8DMQy8NI="; # wps-cluster-hazelcast
+  #  version = "2.28.4"; # wps-cluster-hazelcast
+  #  hash = "sha256-r9BpjvFL00lgTrbhIxY7c16sGu6ujKJ6D4oDz61KekA="; # wps-cluster-hazelcast
   #};
 
   wps-download = mkGeoserverExtension {
     name = "wps-download";
-    version = "2.28.3"; # wps-download
-    hash = "sha256-2dIjMPA8Y3sPzJLtPxX0HFuq+dYxmz65dJzxugkSyS0="; # wps-download
+    version = "2.28.4"; # wps-download
+    hash = "sha256-MAL71aYRKOFSKnhj+3dxZhCDQL/6GAeAtB11Zs6C5tI="; # wps-download
   };
 
   # Needs Postrgres configuration or similar.
   # See https://docs.geoserver.org/main/en/user/extensions/wps-jdbc/index.html
   wps-jdbc = mkGeoserverExtension {
     name = "wps-jdbc";
-    version = "2.28.3"; # wps-jdbc
-    hash = "sha256-yL5xw1g2FcWCSgfw28gbYmrvIiHD0coE9AAH601Bqbg="; # wps-jdbc
+    version = "2.28.4"; # wps-jdbc
+    hash = "sha256-QBydO6EKLe22W+3pCP4p9TqMyp1KeKReyeidL5yxndo="; # wps-jdbc
   };
 
   ysld = mkGeoserverExtension {
     name = "ysld";
-    version = "2.28.3"; # ysld
-    hash = "sha256-oe/eT/IdqnlrQ58HBpuQA6ZRw8oCPAWPQ2Tles71V8M="; # ysld
+    version = "2.28.4"; # ysld
+    hash = "sha256-Qg+wzMzRebqqOAK4Y7hsfcTyKcz/E5Fw/fHLcUr3KwY="; # ysld
   };
 
 }
diff --git a/pkgs/by-name/ge/geoserver/package.nix b/pkgs/by-name/ge/geoserver/package.nix
index 4b045552ca99..d322bfae8b5b 100644
--- a/pkgs/by-name/ge/geoserver/package.nix
+++ b/pkgs/by-name/ge/geoserver/package.nix
@@ -10,11 +10,11 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "geoserver";
-  version = "2.28.3";
+  version = "2.28.4";
 
   src = fetchurl {
     url = "mirror://sourceforge/geoserver/GeoServer/${finalAttrs.version}/geoserver-${finalAttrs.version}-bin.zip";
-    hash = "sha256-jXvuIQvpOYGnRTcdHwa+p8lbMaaqiFDMLRRzpxs6wLg=";
+    hash = "sha256-bQECI2MEk8OcALk21bbv/V/yNbOrHKlhcpoVy37U1i0=";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/by-name/hy/hydralauncher/package.nix b/pkgs/by-name/hy/hydralauncher/package.nix
index 025ae112855f..099a9105b57b 100644
--- a/pkgs/by-name/hy/hydralauncher/package.nix
+++ b/pkgs/by-name/hy/hydralauncher/package.nix
@@ -6,10 +6,10 @@
 }:
 let
   pname = "hydralauncher";
-  version = "3.9.8";
+  version = "3.9.9";
   src = fetchurl {
     url = "https://github.com/hydralauncher/hydra/releases/download/v${version}/hydralauncher-${version}.AppImage";
-    hash = "sha256-jKhmcHfi3QuihTxIX73QRLfs8K7iH+lKxhCNpKJsumk=";
+    hash = "sha256-ZdrsEyJkenQbWTYEsgSaiMPx3JksHwjwti3HSb21iOw=";
   };
 
   appimageContents = appimageTools.extractType2 { inherit pname src version; };
diff --git a/pkgs/by-name/ir/irpf/package.nix b/pkgs/by-name/ir/irpf/package.nix
index 219d98f0d49b..39deddd2273a 100644
--- a/pkgs/by-name/ir/irpf/package.nix
+++ b/pkgs/by-name/ir/irpf/package.nix
@@ -17,7 +17,7 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "irpf";
-  version = "2026-1.3";
+  version = "2026-1.4";
 
   # https://www.gov.br/receitafederal/pt-br/centrais-de-conteudo/download/pgd/dirpf
   # Para outros sistemas operacionais -> Multi
@@ -27,7 +27,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     in
     fetchzip {
       url = "https://downloadirpf.receita.fazenda.gov.br/irpf/${year}/irpf/arquivos/IRPF${finalAttrs.version}.zip";
-      hash = "sha256-5CX+HaIfQRoeWQHvXTGBhqRAaCM7UH2Duq8+6+3Ai7o=";
+      hash = "sha256-tPIu1nt1FtGyjM1vnzAHenjlKeAKJfqPus+XsP2CH5g=";
     };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/libgphoto2/package.nix b/pkgs/by-name/li/libgphoto2/package.nix
index 5c3070a9e6ed..3e8043371f34 100644
--- a/pkgs/by-name/li/libgphoto2/package.nix
+++ b/pkgs/by-name/li/libgphoto2/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libgphoto2";
-  version = "2.5.33";
+  version = "2.5.34";
 
   src = fetchFromGitHub {
     owner = "gphoto";
     repo = "libgphoto2";
-    rev = "libgphoto2-${builtins.replaceStrings [ "." ] [ "_" ] version}-release";
-    sha256 = "sha256-gv84HD/ZjmAa0EpuYtUTGLcC7+BE8kWi4ut+RlvQvow=";
+    tag = "v${version}";
+    hash = "sha256-+yPpoIgyXL/Qp2C4ykSlUg2BheWjzTEi6wID6yCsP/s=";
   };
 
   depsBuildBuild = [ pkg-config ];
@@ -73,6 +73,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     homepage = "http://www.gphoto.org/proj/libgphoto2/";
+    changelog = "https://github.com/gphoto/libgphoto2/blob/${src.tag}/NEWS";
     description = "Library for accessing digital cameras";
     longDescription = ''
       This is the library backend for gphoto2. It contains the code for PTP,
diff --git a/pkgs/by-name/ma/mapserver/package.nix b/pkgs/by-name/ma/mapserver/package.nix
index 6d15836e8ad0..b075c21c6e20 100644
--- a/pkgs/by-name/ma/mapserver/package.nix
+++ b/pkgs/by-name/ma/mapserver/package.nix
@@ -30,13 +30,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mapserver";
-  version = "8.6.3";
+  version = "8.6.4";
 
   src = fetchFromGitHub {
     owner = "MapServer";
     repo = "MapServer";
     rev = "rel-${lib.replaceStrings [ "." ] [ "-" ] finalAttrs.version}";
-    hash = "sha256-PVuoljsDXxDFSB+VVCEmOsSQw8fGR0RaFcaom+W5B2E=";
+    hash = "sha256-kqCP0QZ8gNqS54B8nL8M9Wr9WyMQnORCs42O1eiMtRw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/mi/mimir/package.nix b/pkgs/by-name/mi/mimir/package.nix
index ba5e0d5907ff..0110ccee1694 100644
--- a/pkgs/by-name/mi/mimir/package.nix
+++ b/pkgs/by-name/mi/mimir/package.nix
@@ -7,13 +7,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "mimir";
-  version = "3.0.6";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     rev = "mimir-${finalAttrs.version}";
     owner = "grafana";
     repo = "mimir";
-    hash = "sha256-rz1Wzsnxt8eGf0rkI8pvhpft+EhTUsdFK4s+9QVn7dg=";
+    hash = "sha256-IF0Cjg6INAvHyWGnf+V8KphSAmcLEo276MMrsRJgMjI=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/mi/mirrord/manifest.json b/pkgs/by-name/mi/mirrord/manifest.json
index d0919eeffcf3..74781ac8546b 100644
--- a/pkgs/by-name/mi/mirrord/manifest.json
+++ b/pkgs/by-name/mi/mirrord/manifest.json
@@ -1,21 +1,21 @@
 {
-  "version": "3.211.0",
+  "version": "3.213.0",
   "assets": {
     "x86_64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.211.0/mirrord_linux_x86_64",
-      "hash": "sha256-5ke7ZXbqGAWcwUNW5ofrc0Ez7XS9oekHFuVagFeMwKA="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.213.0/mirrord_linux_x86_64",
+      "hash": "sha256-Bm4dLCd4u6WouFfgfMlyrM9HxiL1u3V+i31H0DDYYRE="
     },
     "aarch64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.211.0/mirrord_linux_aarch64",
-      "hash": "sha256-o9Hu5TqPzcOmbwAG40f6CDw5VE/3v3ggXJ6/2RPuReU="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.213.0/mirrord_linux_aarch64",
+      "hash": "sha256-5GhBdNgd60WGlaZmGM/Ck4qxbna6E07p9dxx9CfgDRg="
     },
     "aarch64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.211.0/mirrord_mac_universal",
-      "hash": "sha256-aOPjhsMAVP5Jn8pjxRyr/92HXlMB5nix9BwHoc2uf8A="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.213.0/mirrord_mac_universal",
+      "hash": "sha256-iW22NPH2cwiWRMlc+fOWkkn3OCbRmzYL4oFkau9QtFQ="
     },
     "x86_64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.211.0/mirrord_mac_universal",
-      "hash": "sha256-aOPjhsMAVP5Jn8pjxRyr/92HXlMB5nix9BwHoc2uf8A="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.213.0/mirrord_mac_universal",
+      "hash": "sha256-iW22NPH2cwiWRMlc+fOWkkn3OCbRmzYL4oFkau9QtFQ="
     }
   }
 }
diff --git a/pkgs/by-name/ox/oxlint/package.nix b/pkgs/by-name/ox/oxlint/package.nix
index ba67c8021240..393de5cfbe7b 100644
--- a/pkgs/by-name/ox/oxlint/package.nix
+++ b/pkgs/by-name/ox/oxlint/package.nix
@@ -23,25 +23,25 @@
 # runs without an external linter, which leaves `jsPlugins` configs inert.
 stdenv.mkDerivation (finalAttrs: {
   pname = "oxlint";
-  version = "1.66.0";
+  version = "1.68.0";
 
   src = fetchFromGitHub {
     owner = "oxc-project";
     repo = "oxc";
     tag = "oxlint_v${finalAttrs.version}";
-    hash = "sha256-Z2NLzW5e83Mdoj1B0dkJ17FBGGXLH4BH+BJcLjGV1Hk=";
+    hash = "sha256-/AXBMb+EEpA10omlpxG1jkCqMrhbB8AdEewyQrMJqTk=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-TLdLpOsZswVhi9F+wT9Jbx212wIUl/604sOfhOvoWLY=";
+    hash = "sha256-JHTbbVzXWyigk8NGqvBjVKUuR2p6+gpFRY1GWZEvEFk=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_10;
     fetcherVersion = 3;
-    hash = "sha256-i626Dy+J5bEqncxQrBV5mZCP09DwW7iF5fYLc8mvKG4=";
+    hash = "sha256-mYwkBQZ3ik3yGoPXc3BtLFhavmkj+QzZNMnYG3qyzyc=";
   };
 
   dontUseCmakeConfigure = true;
diff --git a/pkgs/by-name/qo/qownnotes/package.nix b/pkgs/by-name/qo/qownnotes/package.nix
index 5e1702855d80..1068cf819afb 100644
--- a/pkgs/by-name/qo/qownnotes/package.nix
+++ b/pkgs/by-name/qo/qownnotes/package.nix
@@ -19,11 +19,11 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "qownnotes";
   appname = "QOwnNotes";
-  version = "26.5.15";
+  version = "26.6.2";
 
   src = fetchurl {
     url = "https://github.com/pbek/QOwnNotes/releases/download/v${finalAttrs.version}/qownnotes-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Hx/OMImjjMdQLl5bhp3tQ+tDQjbEkptQjHavj7An4c0=";
+    hash = "sha256-+tyOP+nx28gM/IYkwQ9jaM0PNbvJIX95RGO1kOAw4zY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ss/sshified/package.nix b/pkgs/by-name/ss/sshified/package.nix
index 69913964c1df..18c8327b6667 100644
--- a/pkgs/by-name/ss/sshified/package.nix
+++ b/pkgs/by-name/ss/sshified/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "sshified";
-  version = "1.2.3";
+  version = "1.2.6";
 
   src = fetchFromGitHub {
     owner = "hoffie";
     repo = "sshified";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-XOVoITfP02m9fVimu+IHs14pbJA3+xJcSHeGV+9fSNw=";
+    hash = "sha256-YY9ZFIH4ST9xQRD7IkjC9rm+QTlfde5+2qR/reH9oHU=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/tr/trdsql/package.nix b/pkgs/by-name/tr/trdsql/package.nix
index ea3159b87ffb..d4ac52a35aba 100644
--- a/pkgs/by-name/tr/trdsql/package.nix
+++ b/pkgs/by-name/tr/trdsql/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "trdsql";
-  version = "1.2.1";
+  version = "1.2.3";
 
   src = fetchFromGitHub {
     owner = "noborus";
     repo = "trdsql";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gcEzOgoVhXJ5PqgQ9sV6dGiQlhk4cCpcPBBAKPoyNKg=";
+    hash = "sha256-lYBdroPg0Z+7p4akwBV3ey9S3s1uemQMfkyfZC8xeGQ=";
   };
 
   vendorHash = "sha256-1s2fQue0mLhJ9dKILrERa21Ut05/zVCwL2txZlqcCqE=";
diff --git a/pkgs/by-name/vc/vcpkg/package.nix b/pkgs/by-name/vc/vcpkg/package.nix
index f0040f63a6b4..e3d2a5b93172 100644
--- a/pkgs/by-name/vc/vcpkg/package.nix
+++ b/pkgs/by-name/vc/vcpkg/package.nix
@@ -9,13 +9,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "vcpkg";
-  version = "2026.04.27";
+  version = "2026.05.25";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "vcpkg";
     tag = finalAttrs.version;
-    hash = "sha256-UyT2+dm3h4w2sHzERPYYTe8QNqODBhbnT8I8cLD3/CY=";
+    hash = "sha256-UoskFd2Pmdr7U0y9x5AgNNTIWlJuk1lTY3Q/kxb+c7I=";
     leaveDotGit = true;
     postFetch = ''
       cd "$out"
diff --git a/pkgs/by-name/ze/zerofs/package.nix b/pkgs/by-name/ze/zerofs/package.nix
index bb66b5b3d286..807258e08238 100644
--- a/pkgs/by-name/ze/zerofs/package.nix
+++ b/pkgs/by-name/ze/zerofs/package.nix
@@ -10,18 +10,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zerofs";
-  version = "1.1.10";
+  version = "1.1.15";
 
   src = fetchFromGitHub {
     owner = "Barre";
     repo = "ZeroFS";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1nCtfFxIH0DJCNSTcUlxkxqyLONualGMKfcVZP5b24Q=";
+    hash = "sha256-FfIiGULAxwnU/TOUxlnGj1IPC71TxBW9HZ57qbs0qZY=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/zerofs";
 
-  cargoHash = "sha256-vbiRllYMRVufwNPA987keP0MJK+DRms6TnSA8UAn+Bw=";
+  cargoHash = "sha256-01yKdVuWR16ckmwyjpk4FMjLQl+b1VvcyGP2r1KMRCc=";
 
   nativeBuildInputs = [ cmake ];
 
diff --git a/pkgs/development/compilers/go/1.25.nix b/pkgs/development/compilers/go/1.25.nix
index e803ea01e584..7d68b1cdb1e0 100644
--- a/pkgs/development/compilers/go/1.25.nix
+++ b/pkgs/development/compilers/go/1.25.nix
@@ -25,11 +25,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
-  version = "1.25.10";
+  version = "1.25.11";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-IM8EqS5a+ZdI40G8iZb6KAkMmsmHZfoRXsXd9B169B0=";
+    hash = "sha256-e05bB5s8m8QgNzymhiGilrTRPBBzXUrKxBcZKNcPVIA=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/perl-modules/ImageExifTool/default.nix b/pkgs/development/perl-modules/ImageExifTool/default.nix
index faf5b87a8a6e..8564af93ebed 100644
--- a/pkgs/development/perl-modules/ImageExifTool/default.nix
+++ b/pkgs/development/perl-modules/ImageExifTool/default.nix
@@ -12,13 +12,13 @@
 
 buildPerlPackage rec {
   pname = "Image-ExifTool";
-  version = "13.58";
+  version = "13.59";
 
   src = fetchFromGitHub {
     owner = "exiftool";
     repo = "exiftool";
     tag = version;
-    hash = "sha256-Mzn1m26uBlulwlfkW+CSRBR8CVqy5oL8cv+85NGgwRc=";
+    hash = "sha256-GA2chp9xyPgjYNW6RQWjK83xmJvHlAvBhpA06uP3XRY=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/deptry/default.nix b/pkgs/development/python-modules/deptry/default.nix
new file mode 100644
index 000000000000..3fef82922dfc
--- /dev/null
+++ b/pkgs/development/python-modules/deptry/default.nix
@@ -0,0 +1,74 @@
+{
+  lib,
+  buildPythonPackage,
+  cargo,
+  click,
+  colorama,
+  fetchFromGitHub,
+  packaging,
+  python,
+  pytest-xdist,
+  pytestCheckHook,
+  requirements-parser,
+  rustc,
+  rustPlatform,
+  tomli,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "deptry";
+  version = "0.25.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "osprey-oss";
+    repo = "deptry";
+    tag = finalAttrs.version;
+    hash = "sha256-GQWivQMWQ8wi6cWsCbmvSSyPEx1yl9QidO+9mTDrN1c=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-axUqKks3vxiJF2bRI/Qwk7iKjoUNQQc3NynI60n3quY=";
+  };
+
+  build-system = [
+    cargo
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+    rustc
+  ];
+
+  dependencies = [
+    click
+    colorama
+    packaging
+    requirements-parser
+    tomli
+  ];
+
+  nativeCheckInputs = [
+    pytest-xdist
+    pytestCheckHook
+  ];
+
+  preCheck = ''
+    cp $out/${python.sitePackages}/deptry/rust*.so python/deptry/
+  '';
+
+  disabledTestPaths = [
+    # Don't run CLI tests
+    "tests/functional/cli/"
+  ];
+
+  pythonImportsCheck = [ "deptry" ];
+
+  meta = {
+    description = "Find unused, missing and transitive dependencies in a Python project";
+    homepage = "https://github.com/osprey-oss/deptry";
+    changelog = "https://github.com/osprey-oss/deptry/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "deptry";
+  };
+})
diff --git a/pkgs/development/python-modules/lxmf/default.nix b/pkgs/development/python-modules/lxmf/default.nix
index fe6f2b50d2a8..81d79182ead4 100644
--- a/pkgs/development/python-modules/lxmf/default.nix
+++ b/pkgs/development/python-modules/lxmf/default.nix
@@ -4,11 +4,12 @@
   fetchFromGitHub,
   rns,
   setuptools,
+  versionCheckHook,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "lxmf";
-  version = "1.0.0";
+  version = "1.0.1";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -16,18 +17,19 @@ buildPythonPackage (finalAttrs: {
     owner = "markqvist";
     repo = "lxmf";
     tag = finalAttrs.version;
-    hash = "sha256-ohbZSpjIyCiiwXUjvr0UBXKN4OScdTzxx5QimPWnCAI=";
+    hash = "sha256-Lx7eG7idbqjJrOE15/OJ8kh++4STQHxNVMTRVXdAEYE=";
   };
 
   build-system = [ setuptools ];
 
+  pythonRelaxDeps = [ "rns" ];
+
   dependencies = [ rns ];
 
-  # Module has no tests
-  doCheck = false;
-
   pythonImportsCheck = [ "LXMF" ];
 
+  nativeCheckInputs = [ versionCheckHook ];
+
   meta = {
     description = "Lightweight Extensible Message Format for Reticulum";
     homepage = "https://github.com/markqvist/lxmf";
diff --git a/pkgs/development/python-modules/rns/default.nix b/pkgs/development/python-modules/rns/default.nix
index 204bdc4b8312..2ab0dc34895e 100644
--- a/pkgs/development/python-modules/rns/default.nix
+++ b/pkgs/development/python-modules/rns/default.nix
@@ -16,6 +16,7 @@ buildPythonPackage (finalAttrs: {
   pname = "rns";
   version = "1.3.4";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "markqvist";
diff --git a/pkgs/development/python-modules/semgrep/common.nix b/pkgs/development/python-modules/semgrep/common.nix
index e6b1ef643199..cd5ff594de3c 100644
--- a/pkgs/development/python-modules/semgrep/common.nix
+++ b/pkgs/development/python-modules/semgrep/common.nix
@@ -1,9 +1,9 @@
 { lib }:
 
 rec {
-  version = "1.161.0";
+  version = "1.164.0";
 
-  srcHash = "sha256-WvvEn5PUEXgwtYd72IuEljHUxcJRJh7uHzNLFqaVEbc=";
+  srcHash = "sha256-ced287/jH+as/1rGBOfoZ06UuQ1sf1YI4AMHbHrtnHU=";
 
   # This tag is used to select the correct wheel from PyPI.
   # It is updated by the update.sh script.
@@ -17,8 +17,8 @@ rec {
     "cli/src/semgrep/semgrep_interfaces" = {
       owner = "semgrep";
       repo = "semgrep-interfaces";
-      rev = "8a09b2ed5838118f0ecc45305eb9d956aabcd700";
-      hash = "sha256-jWv0/DADhYmBGJdMpxX8Rq2KQ2wlYIrJGGeYikcskOM=";
+      rev = "f4a74a03e8ec3dd368b96101648a3210e03fa61e";
+      hash = "sha256-dy+oOB0QmZjMpTYINSPIjzhpN6d/45DaajqumKIYxC4=";
     };
   };
 
@@ -28,20 +28,20 @@ rec {
   # on github releases
   core = {
     x86_64-linux = {
-      platform = "manylinux_2_35_x86_64";
-      hash = "sha256-ioIlfWVDSPlCUPQQcB8RJNxwoMQzhGGsxe5xPhAbDZ0=";
+      platform = "manylinux_2_34_x86_64";
+      hash = "sha256-dFrlzhvvfJsDyStDHRdMpu54AaXioEfGSsIQTH5pUvs=";
     };
     aarch64-linux = {
-      platform = "manylinux_2_35_aarch64";
-      hash = "sha256-yDFnKdVIgt7eFNcWb0za9hdJJ7BYldEoiK46D0eRx4U=";
+      platform = "manylinux_2_34_aarch64";
+      hash = "sha256-N24E9xOyRO7pXopRs+gSQM2nwHE214GfcntcoH7H7Kk=";
     };
     x86_64-darwin = {
       platform = "macosx_10_14_x86_64";
-      hash = "sha256-NFBo32ZfO0h0KunOaWefWRnyuu1XkYku5RTxOpCfWWQ=";
+      hash = "sha256-O0kSaWou5GeoVo1UMP4J2m4RAQOQUqA+YG3PaOvjfAo=";
     };
     aarch64-darwin = {
       platform = "macosx_11_0_arm64";
-      hash = "sha256-H51DqX94yMqbwvDrlIa3D64hBtvYAvelK7HLnVj588g=";
+      hash = "sha256-AsKxA5Wmy3NEQJ0kS6ylE33d0W86e9F494aiIkwyrcA=";
     };
   };
 
diff --git a/pkgs/development/python-modules/semgrep/default.nix b/pkgs/development/python-modules/semgrep/default.nix
index 7b5adc161094..69df6e0beeb5 100644
--- a/pkgs/development/python-modules/semgrep/default.nix
+++ b/pkgs/development/python-modules/semgrep/default.nix
@@ -1,34 +1,30 @@
 {
   lib,
-  callPackage,
+  buildPythonPackage,
   fetchFromGitHub,
   semgrep-core,
-  buildPythonPackage,
 
-  pytestCheckHook,
+  # check tools
   git,
+  pytestCheckHook,
 
-  # python packages
+  # python runtime dependencies
   attrs,
   boltons,
   click,
   click-option-group,
   colorama,
   defusedxml,
-  flaky,
   glom,
   jsonschema,
+  mcp,
   opentelemetry-api,
   opentelemetry-exporter-otlp-proto-http,
   opentelemetry-instrumentation-requests,
   opentelemetry-instrumentation-threading,
   opentelemetry-sdk,
-  mcp,
   packaging,
   peewee,
-  pytest-freezegun,
-  pytest-mock,
-  pytest-snapshot,
   python-lsp-jsonrpc,
   requests,
   rich,
@@ -36,10 +32,18 @@
   semantic-version,
   tomli,
   tqdm,
-  types-freezegun,
   typing-extensions,
   urllib3,
   wcmatch,
+
+  # python check dependencies
+  flaky,
+  pytest-asyncio,
+  pytest-freezegun,
+  pytest-mock,
+  pytest-snapshot,
+  requests-mock,
+  types-freezegun,
 }:
 
 # testing locally post build:
@@ -89,30 +93,30 @@ buildPythonPackage rec {
   dependencies = [
     attrs
     boltons
-    colorama
     click
     click-option-group
+    colorama
+    defusedxml
     glom
+    jsonschema
+    mcp
+    opentelemetry-api
+    opentelemetry-exporter-otlp-proto-http
+    opentelemetry-instrumentation-requests
+    opentelemetry-instrumentation-threading
+    opentelemetry-sdk
+    packaging
+    peewee
+    python-lsp-jsonrpc
     requests
     rich
     ruamel-yaml
     semantic-version
-    tqdm
-    packaging
-    jsonschema
-    wcmatch
-    mcp
-    peewee
-    defusedxml
-    urllib3
-    typing-extensions
-    python-lsp-jsonrpc
     tomli
-    opentelemetry-api
-    opentelemetry-sdk
-    opentelemetry-exporter-otlp-proto-http
-    opentelemetry-instrumentation-requests
-    opentelemetry-instrumentation-threading
+    tqdm
+    typing-extensions
+    urllib3
+    wcmatch
   ];
 
   doCheck = true;
@@ -120,31 +124,34 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     git
     pytestCheckHook
+
     flaky
-    pytest-snapshot
-    pytest-mock
+    pytest-asyncio
     pytest-freezegun
+    pytest-mock
+    pytest-snapshot
+    requests-mock
     types-freezegun
   ];
 
   disabledTestPaths = [
     "tests/default/e2e"
-    "tests/default/e2e-pysemgrep"
     "tests/default/e2e-other"
+    "tests/default/e2e-pysemgrep"
     "tests/default/mcp"
   ];
 
   disabledTests = [
-    # requires networking
-    "test_send"
-    # requires networking
-    "test_parse_exclude_rules_auto"
-    # many child tests require networking to download files
-    "TestConfigLoaderForProducts"
-    # doesn't start flaky plugin correctly
-    "test_debug_performance"
     # requires .git directory
     "clean_project_url"
+    # doesn't start flaky plugin correctly
+    "test_debug_performance"
+    # requires networking
+    "test_parse_exclude_rules_auto"
+    # requires networking
+    "test_send"
+    # many child tests require networking to download files
+    "TestConfigLoaderForProducts"
   ];
 
   preCheck = ''
diff --git a/pkgs/development/python-modules/semgrep/semgrep-core.nix b/pkgs/development/python-modules/semgrep/semgrep-core.nix
index 97012ad1912e..b71eecfdcbe4 100644
--- a/pkgs/development/python-modules/semgrep/semgrep-core.nix
+++ b/pkgs/development/python-modules/semgrep/semgrep-core.nix
@@ -2,8 +2,9 @@
   lib,
   stdenv,
   fetchPypi,
-  unzip,
+
   autoPatchelfHook,
+  unzip,
 }:
 
 let
diff --git a/pkgs/servers/sql/postgresql/ext/timescaledb.nix b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
index 2e22c9998142..69917cfbd15d 100644
--- a/pkgs/servers/sql/postgresql/ext/timescaledb.nix
+++ b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
@@ -13,13 +13,13 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "timescaledb${lib.optionalString (!enableUnfree) "-apache"}";
-  version = "2.27.1";
+  version = "2.27.2";
 
   src = fetchFromGitHub {
     owner = "timescale";
     repo = "timescaledb";
     tag = finalAttrs.version;
-    hash = "sha256-wZGb2UPYUi0lQ7S+kjhlkVCIAP+JZ/8uSJUkIf357a8=";
+    hash = "sha256-/z8qr+56svxnUrnmh0uetPPttXdc1B8aDKZ5mtZpTt4=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 0feea771e7c1..28d33282cc71 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3892,6 +3892,8 @@ self: super: with self; {
 
   deprecation-alias = callPackage ../development/python-modules/deprecation-alias { };
 
+  deptry = callPackage ../development/python-modules/deptry { };
+
   depyf = callPackage ../development/python-modules/depyf { };
 
   derpconf = callPackage ../development/python-modules/derpconf { };