diff --git a/.github/labeler-no-sync.yml b/.github/labeler-no-sync.yml
index 77d09a0ef8c0..88a2b267484a 100644
--- a/.github/labeler-no-sync.yml
+++ b/.github/labeler-no-sync.yml
@@ -22,17 +22,6 @@
               - doc/**/*
               - nixos/doc/**/*
 
-"backport release-25.11":
-  - all:
-      - changed-files:
-          - any-glob-to-any-file:
-              - .github/actions/**/*
-              - .github/workflows/*
-              - .github/labeler*.yml
-              - ci/**/*.*
-              - maintainers/github-teams.json
-      - base-branch: ['master']
-
 "backport release-26.05":
   - all:
       - changed-files:
diff --git a/.github/workflows/periodic-merge-24h.yml b/.github/workflows/periodic-merge-24h.yml
index 3aac3ccf8b73..d14c482df755 100644
--- a/.github/workflows/periodic-merge-24h.yml
+++ b/.github/workflows/periodic-merge-24h.yml
@@ -31,12 +31,6 @@ jobs:
       max-parallel: 1
       matrix:
         pairs:
-          - from: release-25.11
-            into: staging-next-25.11
-          - from: staging-next-25.11
-            into: staging-25.11
-          - from: release-25.11
-            into: staging-nixos-25.11
           - from: release-26.05
             into: staging-next-26.05
           - from: staging-next-26.05
diff --git a/ci/default.nix b/ci/default.nix
index 6ade8164d503..eb7b45e4bbb5 100644
--- a/ci/default.nix
+++ b/ci/default.nix
@@ -38,6 +38,17 @@ let
       check = treefmt.check nixFilesSrc;
     };
 
+  # nixos-render-docs and nixos-render-docs-redirects
+  # Should be used from tree to build the matching in-tree documentation
+  docPkgs = pkgs.extend (
+    final: prev: {
+      nixos-render-docs = final.callPackage ../pkgs/by-name/ni/nixos-render-docs/package.nix { };
+      nixos-render-docs-redirects =
+        final.callPackage ../pkgs/by-name/ni/nixos-render-docs-redirects/package.nix
+          { };
+    }
+  );
+
 in
 rec {
   inherit pkgs fmt;
@@ -53,7 +64,7 @@ rec {
   # CI jobs
   lib-tests = import ../lib/tests/release.nix { inherit pkgs; };
   manual-nixos = (import ../nixos/release.nix { }).manual.${system} or null;
-  manual-nixpkgs = (import ../doc { inherit pkgs; });
+  manual-nixpkgs = (import ../doc { pkgs = docPkgs; });
   nixpkgs-vet = pkgs.callPackage ./nixpkgs-vet.nix {
     nix = pkgs.nixVersions.latest;
   };
diff --git a/ci/eval/default.nix b/ci/eval/default.nix
index 547fcf1f26be..8feaf5cf77aa 100644
--- a/ci/eval/default.nix
+++ b/ci/eval/default.nix
@@ -100,6 +100,7 @@ let
         myChunk=$2
         system=$3
         outputDir=$4
+        preEvalFile=$5
 
         # Default is 5, higher values effectively disable the warning.
         # This randomly breaks Eval.
@@ -121,12 +122,12 @@ let
           --show-trace \
           --arg chunkSize "$chunkSize" \
           --arg myChunk "$myChunk" \
-          --arg preEvalFile "${preEvalFile}" \
+          --arg preEvalFile "$preEvalFile" \
           --arg systems "[ \"$system\" ]" \
           --arg includeBroken ${lib.boolToString includeBroken} \
           --argstr extraNixpkgsConfigJson ${lib.escapeShellArg (builtins.toJSON extraNixpkgsConfig)} \
           -I ${nixpkgs} \
-          -I ${preEvalFile} \
+          -I "$preEvalFile" \
           > "$outputDir/result/$myChunk" \
           2> "$outputDir/stderr/$myChunk"
         exitCode=$?
@@ -164,12 +165,6 @@ let
         echo "System: $evalSystem"
         cores=$NIX_BUILD_CORES
         echo "Cores: $cores"
-        attrCount=$(jq '.paths | length' "${preEvalFile}")
-        echo "Attribute count: $attrCount"
-        echo "Chunk size: $chunkSize"
-        # Same as `attrCount / chunkSize` but rounded up
-        chunkCount=$(( (attrCount - 1) / chunkSize + 1 ))
-        echo "Chunk count: $chunkCount"
 
         mkdir -p $out/${evalSystem}
 
@@ -190,29 +185,61 @@ let
           done
         ) &
 
-        seq_end=$(( chunkCount - 1 ))
+        chunkedEval() {
+          local chunkOutputDir=$1
+          local preEvalFile=$2
 
-        ${lib.optionalString quickTest ''
-          seq_end=0
-        ''}
+          local attrCount=$(jq '.paths | length' "$preEvalFile")
+          echo "Attribute count: $attrCount"
+          echo "Chunk size: $chunkSize"
+          # Same as `attrCount / chunkSize` but rounded up
+          local chunkCount=$(( (attrCount - 1) / chunkSize + 1 ))
+          echo "Chunk count: $chunkCount"
 
-        chunkOutputDir=$(mktemp -d)
-        mkdir "$chunkOutputDir"/{result,stats,timestats,stderr}
+          local seq_end=$(( chunkCount - 1 ))
+          ${lib.optionalString quickTest ''
+            seq_end=0
+          ''}
 
-        seq -w 0 "$seq_end" |
-          command time -f "%e" -o "$out/${evalSystem}/total-time" \
-          xargs -I{} -P"$cores" \
-          ${singleChunk} "$chunkSize" {} "$evalSystem" "$chunkOutputDir"
+          mkdir -p "$chunkOutputDir"/{result,stats,timestats,stderr}
 
-        cp -r "$chunkOutputDir"/stats $out/${evalSystem}/stats-by-chunk
+          seq -w 0 "$seq_end" |
+            xargs -I{} -P"$cores" \
+            ${singleChunk} "$chunkSize" {} "$evalSystem" "$chunkOutputDir" "$preEvalFile"
 
-        if (( chunkSize * chunkCount != attrCount )); then
-          # A final incomplete chunk would mess up the stats, don't include it
-          rm "$chunkOutputDir"/stats/"$seq_end"
-        fi
+          if (( chunkSize * chunkCount != attrCount )); then
+            # A final incomplete chunk would mess up the stats, don't include it
+            rm "$chunkOutputDir"/stats/"$seq_end"
+          fi
+        }
 
-        cat "$chunkOutputDir"/result/* | jq -s 'add | map_values(.outputs)' > $out/${evalSystem}/paths.json
-        cat "$chunkOutputDir"/result/* | jq -s 'add | map_values(.meta)' > $out/${evalSystem}/meta.json
+        chunkOutputDirs=$(mktemp -d)
+
+        # Preparation for the second eval
+        disallowedAttributesPreEvalFile=$(mktemp)
+        jq '{
+          paths: (.attrPathsDisallowedForInternalUse | map(.attrPath)),
+          attrPathsDisallowedForInternalUse: []
+        }' ${preEvalFile} > "$disallowedAttributesPreEvalFile"
+
+        startEpoch=$(date +%s)
+
+        # The first eval evaluates only attributes that are not disallowed for internal Nixpkgs use, ensuring that they don't depend on disallowed attributes
+        # Because the first eval doesn't evaluate the disallowed attributes themselves, but we still want to check that they don't fail evaluation, we evaluate them separately in a second eval
+        # The reason we need two evals is because we want disallowed attributes to be able to depend on other disallowed attributes, which inherently needs a separate Nixpkgs instantiation
+        # And while we could interleave that instantiation into a single eval, that would ~double memory usage for all chunks, while doing it separately doesn't
+        echo "Evaluating the internally allowed attributes"
+        chunkedEval "$chunkOutputDirs"/allowed ${preEvalFile}
+        echo "Evaluating the internally disallowed attributes"
+        chunkedEval "$chunkOutputDirs"/disallowed "$disallowedAttributesPreEvalFile"
+
+        echo $(( $(date +%s) - startEpoch )) > "$out/${evalSystem}/total-time"
+
+        # We only use the stats from the allowed attrs eval, because the disallowed attrs are generally not even a full chunk
+        cp -r "$chunkOutputDirs"/allowed/stats $out/${evalSystem}/stats-by-chunk
+
+        cat "$chunkOutputDirs"/*/result/* | jq -s 'add | map_values(.outputs)' > $out/${evalSystem}/paths.json
+        cat "$chunkOutputDirs"/*/result/* | jq -s 'add | map_values(.meta)' > $out/${evalSystem}/meta.json
       '';
 
   diff = callPackage ./diff.nix { };
diff --git a/doc/languages-frameworks/python.section.md b/doc/languages-frameworks/python.section.md
index 957037b95f4f..809f397407a7 100644
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@@ -204,25 +204,9 @@ following are specific to `buildPythonPackage`:
 * `setupPyGlobalFlags ? []`: List of flags passed to `setup.py` command.
 * `setupPyBuildFlags ? []`: List of flags passed to `setup.py build_ext` command.
 
-##### Using fixed-point arguments {#buildpythonpackage-fixed-point-arguments}
+##### Writing override-compatible packages {#buildpythonpackage-fixed-point-arguments}
 
-Both `buildPythonPackage` and `buildPythonApplication` support [fixed-point arguments](#chap-build-helpers-finalAttrs), similar to `stdenv.mkDerivation`.
-This allows you to reference the final attributes of the derivation.
-
-Instead of using `rec`:
-
-```nix
-buildPythonPackage rec {
-  pname = "pyspread";
-  version = "2.4";
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-...";
-  };
-}
-```
-
-You can use the `finalAttrs` pattern:
+Use `finalAttrs` to make a package easy to update and override:
 
 ```nix
 buildPythonPackage (finalAttrs: {
@@ -236,7 +220,9 @@ buildPythonPackage (finalAttrs: {
 })
 ```
 
-See the [general documentation on fixed-point arguments](#chap-build-helpers-finalAttrs) for more details on the benefits of this pattern.
+When a downstream callsite *overrides* `version` the override becomes visible as `finalAttrs.version`.
+
+Both `buildPythonPackage` and `buildPythonApplication` support [fixed-point arguments](#chap-build-helpers-finalAttrs), similar to `stdenv.mkDerivation`.
 
 ::: {.note}
 
diff --git a/lib/derivations.nix b/lib/derivations.nix
index 053625a2be0e..15c3495163a8 100644
--- a/lib/derivations.nix
+++ b/lib/derivations.nix
@@ -6,7 +6,6 @@ let
     isString
     mapAttrs
     removeAttrs
-    throwIfNot
     ;
 
   showMaybeAttrPosPre =
@@ -108,18 +107,18 @@ in
       # attrset spine returned by lazyDerivation does not depend on it.
       # Instead, the individual derivation attributes do depend on it.
       checked =
-        throwIfNot (derivation.type or null == "derivation") "lazyDerivation: input must be a derivation."
-          throwIfNot
-          # NOTE: Technically we could require our outputs to be a subset of the
-          # actual ones, or even leave them unchecked and fail on a lazy basis.
-          # However, consider the case where an output is added in the underlying
-          # derivation, such as dev. lazyDerivation would remove it and cause it
-          # to fail as a buildInputs item, without any indication as to what
-          # happened. Hence the more stringent condition. We could consider
-          # adding a flag to control this behavior if there's a valid case for it,
-          # but the documentation must have a note like this.
-          (derivation.outputs == outputs)
-          ''
+        if derivation.type or null != "derivation" then
+          throw "lazyDerivation: input must be a derivation."
+        # NOTE: Technically we could require our outputs to be a subset of the
+        # actual ones, or even leave them unchecked and fail on a lazy basis.
+        # However, consider the case where an output is added in the underlying
+        # derivation, such as dev. lazyDerivation would remove it and cause it
+        # to fail as a buildInputs item, without any indication as to what
+        # happened. Hence the more stringent condition. We could consider
+        # adding a flag to control this behavior if there's a valid case for it,
+        # but the documentation must have a note like this.
+        else if derivation.outputs != outputs then
+          throw ''
             lib.lazyDerivation: The derivation ${derivation.name or "<unknown>"} has outputs that don't match the assumed outputs.
 
             Assumed outputs passed to lazyDerivation${showMaybeAttrPosPre ",\n    at " "outputs" args}:
@@ -142,6 +141,7 @@ in
             If none of the above works for you, replace the lib.lazyDerivation call by the
             expression in the derivation argument.
           ''
+        else
           derivation;
     in
     {
diff --git a/lib/fetchers.nix b/lib/fetchers.nix
index 0f4192cc6822..24f257a1f883 100644
--- a/lib/fetchers.nix
+++ b/lib/fetchers.nix
@@ -22,7 +22,6 @@ let
     concatMapStringsSep
     head
     length
-    throwIf
     ;
   inherit (lib.attrsets)
     attrsToList
@@ -130,7 +129,7 @@ rec {
             hashesAsNVPairs = attrsToList (intersectAttrs hashSet args);
           in
           if hashesAsNVPairs == [ ] then
-            throwIf required "fetcher called without `hash`" null
+            if required then throw "fetcher called without `hash`" else null
           else if length hashesAsNVPairs != 1 then
             throw "fetcher called with mutually-incompatible arguments: ${
               concatMapStringsSep ", " (a: a.name) hashesAsNVPairs
diff --git a/lib/generators.nix b/lib/generators.nix
index 0e15a56db312..d20abb6264ab 100644
--- a/lib/generators.nix
+++ b/lib/generators.nix
@@ -24,7 +24,6 @@ let
   inherit (lib)
     addErrorContext
     any
-    assertMsg
     attrNames
     attrValues
     concatLists
@@ -64,7 +63,6 @@ let
     reverseList
     splitString
     tail
-    toList
     ;
 
   inherit (lib.strings)
@@ -849,7 +847,7 @@ rec {
         _type == "lua-inline";
 
       generatedBindings =
-        assert assertMsg (badVarNames == [ ]) "Bad Lua var names: ${toPretty { } badVarNames}";
+        assert badVarNames == [ ] || throw "Bad Lua var names: ${toPretty { } badVarNames}";
         concatStrings (mapAttrsToList (key: value: "${indent}${key} = ${toLua innerArgs value}\n") v);
 
       # https://en.wikibooks.org/wiki/Lua_Programming/variable#Variable_names
diff --git a/lib/gvariant.nix b/lib/gvariant.nix
index f64808347ee8..d47d5120ef9a 100644
--- a/lib/gvariant.nix
+++ b/lib/gvariant.nix
@@ -191,10 +191,15 @@ rec {
   mkArray =
     elems:
     let
-      vs = map mkValue (lib.throwIf (elems == [ ]) "Please create empty array with mkEmptyArray." elems);
-      elemType = lib.throwIfNot (lib.all (t: (head vs).type == t) (
-        map (v: v.type) vs
-      )) "Elements in a list should have same type." (head vs).type;
+      vs = map mkValue (
+        if elems == [ ] then throw "Please create empty array with mkEmptyArray." else elems
+      );
+      firstType = (head vs).type;
+      elemType =
+        if lib.any (v: v.type != firstType) vs then
+          throw "Elements in a list should have same type."
+        else
+          firstType;
     in
     mkPrimitive (type.arrayOf elemType) vs
     // {
diff --git a/lib/lists.nix b/lib/lists.nix
index a5ee7c5a880d..e2e24244ff28 100644
--- a/lib/lists.nix
+++ b/lib/lists.nix
@@ -1848,7 +1848,7 @@ rec {
   */
   last =
     list:
-    assert lib.assertMsg (list != [ ]) "lists.last: list must not be empty!";
+    assert list != [ ] || throw "lists.last: list must not be empty!";
     elemAt list (length list - 1);
 
   /**
@@ -1881,7 +1881,7 @@ rec {
   */
   init =
     list:
-    assert lib.assertMsg (list != [ ]) "lists.init: list must not be empty!";
+    assert list != [ ] || throw "lists.init: list must not be empty!";
     genList (elemAt list) (length list - 1);
 
   /**
@@ -2157,7 +2157,8 @@ rec {
   */
   replaceElemAt =
     list: idx: newElem:
-    assert lib.assertMsg (idx >= 0 && idx < length list)
-      "'lists.replaceElemAt' called with index ${toString idx} on a list of size ${toString (length list)}";
+    assert
+      idx >= 0 && idx < length list
+      || throw "'lists.replaceElemAt' called with index ${toString idx} on a list of size ${toString (length list)}";
     genList (i: if i == idx then newElem else elemAt list i) (length list);
 }
diff --git a/lib/meta.nix b/lib/meta.nix
index 5697b915061c..1defd305abc0 100644
--- a/lib/meta.nix
+++ b/lib/meta.nix
@@ -12,7 +12,6 @@ let
     all
     isDerivation
     getBin
-    assertMsg
     ;
   inherit (lib.attrsets) mapAttrs' filterAttrs;
   inherit (builtins)
@@ -571,12 +570,15 @@ rec {
   */
   getExe' =
     x: y:
-    assert assertMsg (isDerivation x)
-      "lib.meta.getExe': The first argument is of type ${typeOf x}, but it should be a derivation instead.";
-    assert assertMsg (isString y)
-      "lib.meta.getExe': The second argument is of type ${typeOf y}, but it should be a string instead.";
-    assert assertMsg (match ".*/.*" y == null)
-      "lib.meta.getExe': The second argument \"${y}\" is a nested path with a \"/\" character, but it should just be the name of the executable instead.";
+    assert
+      isDerivation x
+      || throw "lib.meta.getExe': The first argument is of type ${typeOf x}, but it should be a derivation instead.";
+    assert
+      isString y
+      || throw "lib.meta.getExe': The second argument is of type ${typeOf y}, but it should be a string instead.";
+    assert
+      match ".*/.*" y == null
+      || throw "lib.meta.getExe': The second argument \"${y}\" is a nested path with a \"/\" character, but it should just be the name of the executable instead.";
     "${getBin x}/bin/${y}";
 
   /**
diff --git a/lib/modules.nix b/lib/modules.nix
index c5c935144ea6..a206ed6ed8e2 100644
--- a/lib/modules.nix
+++ b/lib/modules.nix
@@ -46,7 +46,6 @@ let
     setAttrByPath
     substring
     take
-    throwIfNot
     trace
     typeOf
     types
@@ -680,8 +679,11 @@ let
           config = addFreeformType (addMeta (m.config or { }));
         }
     else
-      # shorthand syntax
-      throwIfNot (isAttrs m) "module ${file} (${key}) does not look like a module." {
+    # shorthand syntax
+    if !isAttrs m then
+      throw "module ${file} (${key}) does not look like a module."
+    else
+      {
         _file = toString m._file or file;
         _class = m._class or null;
         key = toString m.key or key;
diff --git a/lib/network/internal.nix b/lib/network/internal.nix
index adda711444fd..d22b2739c3f4 100644
--- a/lib/network/internal.nix
+++ b/lib/network/internal.nix
@@ -104,9 +104,9 @@ let
   */
   parseExpandedIpv6 =
     addr:
-    assert lib.assertMsg (
+    assert
       length addr == ipv6Pieces
-    ) "parseExpandedIpv6: expected list of integers with ${ipv6Pieces} elements";
+      || throw "parseExpandedIpv6: expected list of integers with ${ipv6Pieces} elements";
     let
       u16FromHexStr =
         hex:
diff --git a/lib/path/default.nix b/lib/path/default.nix
index 60c56948d68e..9cefcaa07314 100644
--- a/lib/path/default.nix
+++ b/lib/path/default.nix
@@ -32,10 +32,6 @@ let
     substring
     ;
 
-  inherit (lib.asserts)
-    assertMsg
-    ;
-
   inherit (lib.path.subpath)
     isValid
     ;
@@ -238,11 +234,14 @@ in
     path:
     # The subpath string to append
     subpath:
-    assert assertMsg (isPath path)
-      "lib.path.append: The first argument is of type ${builtins.typeOf path}, but a path was expected";
-    assert assertMsg (isValid subpath) ''
-      lib.path.append: Second argument is not a valid subpath string:
-          ${subpathInvalidReason subpath}'';
+    assert
+      isPath path
+      || throw "lib.path.append: The first argument is of type ${builtins.typeOf path}, but a path was expected";
+    assert
+      isValid subpath
+      || throw ''
+        lib.path.append: Second argument is not a valid subpath string:
+            ${subpathInvalidReason subpath}'';
     path + ("/" + subpath);
 
   /**
@@ -285,21 +284,25 @@ in
   */
   hasPrefix =
     path1:
-    assert assertMsg (isPath path1)
-      "lib.path.hasPrefix: First argument is of type ${typeOf path1}, but a path was expected";
+    assert
+      isPath path1
+      || throw "lib.path.hasPrefix: First argument is of type ${typeOf path1}, but a path was expected";
     let
       path1Deconstructed = deconstructPath path1;
     in
     path2:
-    assert assertMsg (isPath path2)
-      "lib.path.hasPrefix: Second argument is of type ${typeOf path2}, but a path was expected";
+    assert
+      isPath path2
+      || throw "lib.path.hasPrefix: Second argument is of type ${typeOf path2}, but a path was expected";
     let
       path2Deconstructed = deconstructPath path2;
     in
-    assert assertMsg (path1Deconstructed.root == path2Deconstructed.root) ''
-      lib.path.hasPrefix: Filesystem roots must be the same for both paths, but paths with different roots were given:
-          first argument: "${toString path1}" with root "${toString path1Deconstructed.root}"
-          second argument: "${toString path2}" with root "${toString path2Deconstructed.root}"'';
+    assert
+      path1Deconstructed.root == path2Deconstructed.root
+      || throw ''
+        lib.path.hasPrefix: Filesystem roots must be the same for both paths, but paths with different roots were given:
+            first argument: "${toString path1}" with root "${toString path1Deconstructed.root}"
+            second argument: "${toString path2}" with root "${toString path2Deconstructed.root}"'';
     take (length path1Deconstructed.components) path2Deconstructed.components
     == path1Deconstructed.components;
 
@@ -344,15 +347,17 @@ in
   */
   removePrefix =
     path1:
-    assert assertMsg (isPath path1)
-      "lib.path.removePrefix: First argument is of type ${typeOf path1}, but a path was expected.";
+    assert
+      isPath path1
+      || throw "lib.path.removePrefix: First argument is of type ${typeOf path1}, but a path was expected.";
     let
       path1Deconstructed = deconstructPath path1;
       path1Length = length path1Deconstructed.components;
     in
     path2:
-    assert assertMsg (isPath path2)
-      "lib.path.removePrefix: Second argument is of type ${typeOf path2}, but a path was expected.";
+    assert
+      isPath path2
+      || throw "lib.path.removePrefix: Second argument is of type ${typeOf path2}, but a path was expected.";
     let
       path2Deconstructed = deconstructPath path2;
       success = take path1Length path2Deconstructed.components == path1Deconstructed.components;
@@ -362,10 +367,12 @@ in
         else
           throw ''lib.path.removePrefix: The first path argument "${toString path1}" is not a component-wise prefix of the second path argument "${toString path2}".'';
     in
-    assert assertMsg (path1Deconstructed.root == path2Deconstructed.root) ''
-      lib.path.removePrefix: Filesystem roots must be the same for both paths, but paths with different roots were given:
-          first argument: "${toString path1}" with root "${toString path1Deconstructed.root}"
-          second argument: "${toString path2}" with root "${toString path2Deconstructed.root}"'';
+    assert
+      path1Deconstructed.root == path2Deconstructed.root
+      || throw ''
+        lib.path.removePrefix: Filesystem roots must be the same for both paths, but paths with different roots were given:
+            first argument: "${toString path1}" with root "${toString path1Deconstructed.root}"
+            second argument: "${toString path2}" with root "${toString path2Deconstructed.root}"'';
     joinRelPath components;
 
   /**
@@ -422,8 +429,9 @@ in
   splitRoot =
     # The path to split the root off of
     path:
-    assert assertMsg (isPath path)
-      "lib.path.splitRoot: Argument is of type ${typeOf path}, but a path was expected";
+    assert
+      isPath path
+      || throw "lib.path.splitRoot: Argument is of type ${typeOf path}, but a path was expected";
     let
       deconstructed = deconstructPath path;
     in
@@ -494,14 +502,15 @@ in
     let
       deconstructed = deconstructPath path;
     in
-    assert assertMsg (isPath path)
-      "lib.path.hasStorePathPrefix: Argument is of type ${typeOf path}, but a path was expected";
-    assert assertMsg
+    assert
+      isPath path
+      || throw "lib.path.hasStorePathPrefix: Argument is of type ${typeOf path}, but a path was expected";
+    assert
       # This function likely breaks or needs adjustment if used with other filesystem roots, if they ever get implemented.
       # Let's try to error nicely in such a case, though it's unclear how an implementation would work even and whether this could be detected.
       # See also https://github.com/NixOS/nix/pull/6530#discussion_r1422843117
-      (deconstructed.root == /. && toString deconstructed.root == "/")
-      "lib.path.hasStorePathPrefix: Argument has a filesystem root (${toString deconstructed.root}) that's not /, which is currently not supported.";
+      deconstructed.root == /. && toString deconstructed.root == "/"
+      || throw "lib.path.hasStorePathPrefix: Argument has a filesystem root (${toString deconstructed.root}) that's not /, which is currently not supported.";
     componentsHaveStorePathPrefix deconstructed.components;
 
   /**
@@ -702,9 +711,11 @@ in
   subpath.components =
     # The subpath string to split into components
     subpath:
-    assert assertMsg (isValid subpath) ''
-      lib.path.subpath.components: Argument is not a valid subpath string:
-          ${subpathInvalidReason subpath}'';
+    assert
+      isValid subpath
+      || throw ''
+        lib.path.subpath.components: Argument is not a valid subpath string:
+            ${subpathInvalidReason subpath}'';
     splitRelPath subpath;
 
   /**
@@ -799,9 +810,11 @@ in
   subpath.normalise =
     # The subpath string to normalise
     subpath:
-    assert assertMsg (isValid subpath) ''
-      lib.path.subpath.normalise: Argument is not a valid subpath string:
-          ${subpathInvalidReason subpath}'';
+    assert
+      isValid subpath
+      || throw ''
+        lib.path.subpath.normalise: Argument is not a valid subpath string:
+            ${subpathInvalidReason subpath}'';
     joinRelPath (splitRelPath subpath);
 
 }
diff --git a/lib/strings.nix b/lib/strings.nix
index b81a04a6666b..59a458aecf80 100644
--- a/lib/strings.nix
+++ b/lib/strings.nix
@@ -1589,15 +1589,14 @@ rec {
   */
   toSentenceCase =
     str:
-    lib.throwIfNot (isString str)
-      "toSentenceCase does only accepts string values, but got ${typeOf str}"
-      (
-        let
-          firstChar = substring 0 1 str;
-          rest = substring 1 (-1) str; # -1 takes till the end of the string
-        in
-        toUpper firstChar + toLower rest
-      );
+    if !isString str then
+      throw "toSentenceCase does only accepts string values, but got ${typeOf str}"
+    else
+      let
+        firstChar = substring 0 1 str;
+        rest = substring 1 (-1) str; # -1 takes till the end of the string
+      in
+      toUpper firstChar + toLower rest;
 
   /**
     Converts a string to camelCase. Handles snake_case, PascalCase,
@@ -1633,7 +1632,9 @@ rec {
   */
   toCamelCase =
     str:
-    lib.throwIfNot (isString str) "toCamelCase does only accepts string values, but got ${typeOf str}" (
+    if !isString str then
+      throw "toCamelCase does only accepts string values, but got ${typeOf str}"
+    else
       let
         separators = splitStringBy (
           prev: curr:
@@ -1653,8 +1654,7 @@ rec {
         first = if length parts > 0 then toLower (head parts) else "";
         rest = if length parts > 1 then map toSentenceCase (tail parts) else [ ];
       in
-      concatStrings ([ first ] ++ rest)
-    );
+      concatStrings ([ first ] ++ rest);
 
   /**
     Appends string context from string like object `src` to `target`.
@@ -2532,8 +2532,9 @@ rec {
       strw = lib.stringLength str;
       reqWidth = width - (lib.stringLength filler);
     in
-    assert lib.assertMsg (strw <= width)
-      "fixedWidthString: requested string length (${toString width}) must not be shorter than actual length (${toString strw})";
+    assert
+      strw <= width
+      || throw "fixedWidthString: requested string length (${toString width}) must not be shorter than actual length (${toString strw})";
     if strw == width then str else filler + fixedWidthString reqWidth filler str;
 
   /**
diff --git a/lib/trivial.nix b/lib/trivial.nix
index 9f0f5daf1332..9288a9e1b1db 100644
--- a/lib/trivial.nix
+++ b/lib/trivial.nix
@@ -474,7 +474,7 @@ in
   */
   oldestSupportedRelease =
     # Update on master only. Do not backport.
-    2511;
+    2605;
 
   /**
     Whether a feature is supported in all supported releases (at the time of
diff --git a/lib/types.nix b/lib/types.nix
index f9ae3c82a172..e7a8763983a1 100644
--- a/lib/types.nix
+++ b/lib/types.nix
@@ -21,7 +21,6 @@ let
     isString
     substring
     sort
-    throwIf
     toDerivation
     toList
     types
@@ -408,7 +407,7 @@ rec {
       betweenDesc = lowest: highest: "${toString lowest} and ${toString highest} (both inclusive)";
       between =
         lowest: highest:
-        assert lib.assertMsg (lowest <= highest) "ints.between: lowest must be smaller than highest";
+        assert lowest <= highest || throw "ints.between: lowest must be smaller than highest";
         addCheck int (x: x >= lowest && x <= highest)
         // {
           name = "intBetween";
@@ -495,7 +494,7 @@ rec {
     {
       between =
         lowest: highest:
-        assert lib.assertMsg (lowest <= highest) "numbers.between: lowest must be smaller than highest";
+        assert lowest <= highest || throw "numbers.between: lowest must be smaller than highest";
         addCheck number (x: x >= lowest && x <= highest)
         // {
           name = "numberBetween";
@@ -660,10 +659,10 @@ rec {
       inStore ? null,
       absolute ? null,
     }:
-    throwIf (inStore != null && absolute != null && inStore && !absolute)
-      "In pathWith, inStore means the path must be absolute"
-      mkOptionType
-      {
+    if inStore != null && absolute != null && inStore && !absolute then
+      throw "In pathWith, inStore means the path must be absolute"
+    else
+      mkOptionType {
         name = "path";
         description = (
           (if absolute == null then "" else (if absolute then "absolute " else "relative "))
@@ -1079,8 +1078,8 @@ rec {
         builtins.addErrorContext
           "while checking that attrTag tag ${lib.strings.escapeNixIdentifier n} is an option with a type${inAttrPosSuffix tags_ n}"
           (
-            throwIf (opt._type or null != "option")
-              "In attrTag, each tag value must be an option, but tag ${lib.strings.escapeNixIdentifier n} ${
+            if opt._type or null != "option" then
+              throw "In attrTag, each tag value must be an option, but tag ${lib.strings.escapeNixIdentifier n} ${
                 if opt ? _type then
                   if opt._type == "option-type" then
                     "was a bare type, not wrapped in mkOption."
@@ -1089,23 +1088,24 @@ rec {
                 else
                   "was not."
               }"
+            else
               opt
-            // {
-              declarations =
-                opt.declarations or (
-                  let
-                    pos = builtins.unsafeGetAttrPos n tags_;
-                  in
-                  if pos == null then [ ] else [ pos.file ]
-                );
-              declarationPositions =
-                opt.declarationPositions or (
-                  let
-                    pos = builtins.unsafeGetAttrPos n tags_;
-                  in
-                  if pos == null then [ ] else [ pos ]
-                );
-            }
+              // {
+                declarations =
+                  opt.declarations or (
+                    let
+                      pos = builtins.unsafeGetAttrPos n tags_;
+                    in
+                    if pos == null then [ ] else [ pos.file ]
+                  );
+                declarationPositions =
+                  opt.declarationPositions or (
+                    let
+                      pos = builtins.unsafeGetAttrPos n tags_;
+                    in
+                    if pos == null then [ ] else [ pos ]
+                  );
+              }
           )
       ) tags_;
       choicesStr = concatMapStringsSep ", " lib.strings.escapeNixIdentifier (attrNames tags);
@@ -1728,9 +1728,9 @@ rec {
   # converted to `finalType` using `coerceFunc`.
   coercedTo =
     coercedType: coerceFunc: finalType:
-    assert lib.assertMsg (
+    assert
       coercedType.getSubModules == null
-    ) "coercedTo: coercedType must not have submodules (it’s a ${coercedType.description})";
+      || throw "coercedTo: coercedType must not have submodules (it’s a ${coercedType.description})";
     mkOptionType rec {
       name = "coercedTo";
       description = "${optionDescriptionPhrase (class: class == "noun") finalType} or ${
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 516d4817bedf..14f2417297a4 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -814,6 +814,12 @@
     github = "aftix";
     githubId = 4008299;
   };
+  agarmu = {
+    name = "Mukul Agarwal";
+    email = "vcs@agarmu.com";
+    github = "agarmu";
+    githubId = 55563106;
+  };
   agbrooks = {
     email = "andrewgrantbrooks@gmail.com";
     github = "agbrooks";
@@ -876,6 +882,12 @@
     matrix = "aiya:catgirl.cloud";
     name = "aiya";
   };
+  aietes = {
+    email = "stefan@standa.de";
+    github = "Aietes";
+    githubId = 5823770;
+    name = "Stefan Krüger";
+  };
   aij = {
     email = "aij+git@mrph.org";
     github = "aij";
@@ -5753,6 +5765,12 @@
     githubId = 4162215;
     keys = [ { fingerprint = "CE97 9DEE 904C 26AA 3716  78C2 96A4 38F9 EE72 572F"; } ];
   };
+  croots = {
+    name = "Cameron Roots";
+    github = "croots";
+    githubId = 38054423;
+    keys = [ { fingerprint = "8496 ECF3 0961 115C A6DE 919F A01D C430 0605 1618"; } ];
+  };
   crop = {
     email = "crop_tech@proton.me";
     name = "crop";
@@ -8297,6 +8315,12 @@
     githubId = 7820865;
     name = "Eric Dallo";
   };
+  erics118 = {
+    name = "Eric Shen";
+    github = "erics118";
+    githubId = 52634785;
+    email = "ericshen118@gmail.com";
+  };
   ericson2314 = {
     email = "John.Ericson@Obsidian.Systems";
     matrix = "@Ericson2314:matrix.org";
@@ -9327,7 +9351,7 @@
   fraioveio = {
     email = "francesco@vecchia.lol";
     github = "FraioVeio";
-    githubId = 181361445;
+    githubId = 44584365;
     name = "Francesco Vecchia";
   };
   franciscod = {
@@ -9364,6 +9388,12 @@
     github = "frectonz";
     githubId = 53809656;
   };
+  fred441a = {
+    email = "frederik@altofte.dk";
+    github = "fred441a";
+    githubId = 10808098;
+    name = "Frederik Hansen";
+  };
   fredeb = {
     email = "frederikbraendstrup@gmail.com";
     github = "FredeHoey";
@@ -13634,6 +13664,11 @@
     githubId = 4611077;
     name = "Raymond Gauthier";
   };
+  jromer = {
+    github = "jelleromer";
+    githubId = 11951893;
+    name = "Jelle Römer";
+  };
   jrpotter = {
     email = "jrpotter2112@gmail.com";
     github = "jrpotter";
@@ -13926,6 +13961,13 @@
     githubId = 2396926;
     name = "Justin Woo";
   };
+  justkrysteq = {
+    email = "justkrysteq@proton.me";
+    github = "justkrysteq";
+    githubId = 43525126;
+    name = "Krysteq";
+    matrix = "@krysteq:matrix.org";
+  };
   jvanbruegge = {
     email = "supermanitu@gmail.com";
     github = "jvanbruegge";
@@ -15771,6 +15813,17 @@
     githubId = 124475;
     name = "Olli Helenius";
   };
+  ligerothetiger = {
+    email = "ligero@ligerothetiger.com";
+    name = "LigeroTheTiger";
+    github = "LigeroTheTiger";
+    githubId = 42996211;
+    keys = [
+      {
+        fingerprint = "5zLV9yqjL18GsG1qan0tGM5341niQNYnU/hiBCscn04";
+      }
+    ];
+  };
   lightbulbjim = {
     email = "chris@killred.net";
     github = "lightbulbjim";
@@ -17878,6 +17931,12 @@
     github = "merrkry";
     githubId = 124278440;
   };
+  mert-kurttutan = {
+    email = "mert-kurttutan@gmail.com";
+    name = "Mert Kurttutan";
+    github = "mert-kurttutan";
+    githubId = 88637659;
+  };
   messemar = {
     email = "martin.messer@cyberus-technology.de";
     name = "messemar";
@@ -19222,6 +19281,12 @@
     githubId = 61601147;
     name = "basti n00b0ss";
   };
+  n0pl4c3 = {
+    email = "mail@n0pl4c3.net";
+    github = "n0pl4c3";
+    githubId = 69087176;
+    name = "n0pl4c3";
+  };
   n3oney = {
     name = "Michał Minarowski";
     email = "nixpkgs@neoney.dev";
@@ -24989,6 +25054,12 @@
     githubId = 149248;
     name = "Christian Rackerseder";
   };
+  screwys = {
+    email = "screwygit@proton.me";
+    github = "screwys";
+    githubId = 254296947;
+    name = "screwy";
+  };
   Scriptkiddi = {
     email = "nixos@scriptkiddi.de";
     matrix = "@fritz.otlinghaus:helsinki-systems.de";
@@ -25226,6 +25297,13 @@
     githubId = 35622998;
     name = "Suwon Park";
   };
+  sepointon = {
+    email = "sampointon@gmail.com";
+    github = "sepointon";
+    githubId = 209542026;
+    matrix = "sampointon:matrix.org";
+    name = "Sam Pointon";
+  };
   seppeljordan = {
     email = "sebastian.jordan.mail@googlemail.com";
     github = "seppeljordan";
@@ -27442,6 +27520,12 @@
     github = "tembleking";
     githubId = 2988780;
   };
+  temidaradev = {
+    name = "temidaradev";
+    email = "temidaradev@proton.me";
+    github = "temidaradev";
+    githubId = 118509044;
+  };
   tengkuizdihar = {
     name = "Tengku Izdihar";
     email = "tengkuizdihar@gmail.com";
@@ -30072,6 +30156,11 @@
     githubId = 168610;
     name = "Ricardo M. Correia";
   };
+  wjohnsto = {
+    name = "Will Johnston";
+    github = "wjohnsto";
+    githubId = 785258;
+  };
   wkral = {
     email = "william.kral@gmail.com";
     github = "wkral";
@@ -30577,6 +30666,12 @@
     github = "yarektyshchenko";
     githubId = 185304;
   };
+  yarn = {
+    name = "yarncat";
+    github = "yaaaarn";
+    githubId = 30006414;
+    email = "nix@yarncat.moe";
+  };
   yarny = {
     github = "Yarny0";
     githubId = 41838844;
diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix
index 6cd174fabc2b..d9ac409599f6 100644
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@@ -2250,6 +2250,30 @@ in
               '';
             };
 
+            prompt = lib.mkOption {
+              default = null;
+              type = with lib.types; nullOr str;
+              description = ''
+                Set individual prompt message for interactive mode.
+                By setting this option, you can set a message to be shown by the
+                {option}`security.pam.u2f.settings.interactive` option.
+
+                Requires {option}`security.pam.u2f.settings.interactive` to be set to `true`.
+              '';
+            };
+
+            cue_prompt = lib.mkOption {
+              default = null;
+              type = with lib.types; nullOr str;
+              description = ''
+                Set individual prompt message for cue mode.
+                By setting this option, you can set a message to be shown by the
+                {option}`security.pam.u2f.settings.cue` option.
+
+                Requires {option}`security.pam.u2f.settings.cue` to be set to `true`.
+              '';
+            };
+
             cue = lib.mkOption {
               default = false;
               type = lib.types.bool;
diff --git a/nixos/modules/services/misc/paperless.nix b/nixos/modules/services/misc/paperless.nix
index 9df4e99ff9a5..f7ca6c2717bc 100644
--- a/nixos/modules/services/misc/paperless.nix
+++ b/nixos/modules/services/misc/paperless.nix
@@ -621,7 +621,7 @@ in
             PrivateNetwork = false;
           };
           environment = env // {
-            PYTHONPATH = "${cfg.package.python.pkgs.makePythonPath cfg.package.propagatedBuildInputs}:${cfg.package}/lib/paperless-ngx/src";
+            PYTHONPATH = "${cfg.package.python.pkgs.makePythonPath cfg.package.passthru.dependencies}:${cfg.package}/lib/paperless-ngx/src";
           };
           # Allow the web interface to access the private /tmp directory of the server.
           # This is required to support uploading files via the web interface.
diff --git a/nixos/modules/services/networking/tinc.nix b/nixos/modules/services/networking/tinc.nix
index e082214b5eca..22398f2ff5b0 100644
--- a/nixos/modules/services/networking/tinc.nix
+++ b/nixos/modules/services/networking/tinc.nix
@@ -421,10 +421,7 @@ in
               ExecStart = "${data.package}/bin/tincd -D -U tinc-${network} -n ${network} ${optionalString (data.chroot) "-R"} --pidfile /run/tinc.${network}.pid -d ${toString data.debugLevel}";
             };
             preStart = ''
-              mkdir -p /etc/tinc/${network}/hosts
-              chown tinc-${network} /etc/tinc/${network}/hosts
-              mkdir -p /etc/tinc/${network}/invitations
-              chown tinc-${network} /etc/tinc/${network}/invitations
+              install -d -o tinc-${network} /etc/tinc/${network} /etc/tinc/${network}/hosts /etc/tinc/${network}/invitations
 
               # Determine how we should generate our keys
               if type tinc >/dev/null 2>&1; then
diff --git a/nixos/modules/services/video/wivrn.nix b/nixos/modules/services/video/wivrn.nix
index 0515d93d71cb..82f923f13b0f 100644
--- a/nixos/modules/services/video/wivrn.nix
+++ b/nixos/modules/services/video/wivrn.nix
@@ -24,6 +24,7 @@ let
     getExe
     types
     maintainers
+    makeBinPath
     ;
   cfg = config.services.wivrn;
   configFormat = pkgs.formats.json { };
@@ -63,13 +64,24 @@ let
   enabledConfig = optionalString cfg.config.enable "-f ${configFile}";
 
   # Manage server executables and flags
-  serverExec = concatStringsSep " " (
+  serverCmdline = concatStringsSep " " (
     [
       serverPackageExe
       enabledConfig
     ]
     ++ cfg.extraServerFlags
   );
+  serverExec =
+    if cfg.steam.enable then
+      lib.getExe (
+        pkgs.writeShellScriptBin "start-wivrn-server" ''
+          # The server needs Steam in PATH to open Steam games from the application launcher
+          export PATH="${makeBinPath [ cfg.steam.package ]}:$PATH"
+          exec -a wivrn-server ${serverCmdline}
+        ''
+      )
+    else
+      serverCmdline;
 in
 {
   imports = [
@@ -184,6 +196,11 @@ in
             IPC_EXIT_ON_DISCONNECT = "off";
             PRESSURE_VESSEL_IMPORT_OPENXR_1_RUNTIMES = mkIf cfg.steam.importOXRRuntimes "1";
           } cfg.monadoEnvironment;
+          # WiVRn scans for .desktop files in $XDG_DATA_DIRS for the application launcher,
+          # which will execute the command in Exec when selected in the headset. If the
+          # Exec path isn't absolute, it will be resolved relative to $PATH, so we must
+          # not override the value of $PATH.
+          enableDefaultPath = false;
           serviceConfig = (
             if cfg.highPriority then
               {
@@ -211,8 +228,6 @@ in
                 RestrictSUIDSGID = true;
               }
           );
-          # Needs Steam in the PATH to allow launching games from the headset
-          path = mkIf cfg.steam.enable [ cfg.steam.package ];
           wantedBy = mkIf cfg.autoStart [ "default.target" ];
           restartTriggers = [
             cfg.package
diff --git a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
index 534efa8877e2..3e917a7cf48f 100644
--- a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
+++ b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
@@ -243,6 +243,38 @@ def run(
     return subprocess.run(cmd, check=True, text=True, stdout=stdout, stderr=sys.stderr)
 
 
+def bootctl_varlink_call(method: str, parameters: dict[str, Any]) -> dict[str, Any]:
+    # Spawn bootctl as a Varlink server on stdio, mirroring what varlinkctl
+    # does when given an executable path. We cannot talk to a running
+    # systemd-bootctl.socket because that would use bootctl from the booted
+    # system rather than the closure we are switching to, does not let us set
+    # SYSTEMD_ESP_PATH/SYSTEMD_XBOOTLDR_PATH, and is unavailable inside
+    # nixos-enter anyway.
+    env = os.environ | {
+        "SYSTEMD_VARLINK_LISTEN": "-",
+        "SYSTEMD_ESP_PATH": str(EFI_SYS_MOUNT_POINT),
+    }
+    if BOOT_MOUNT_POINT != EFI_SYS_MOUNT_POINT:
+        env["SYSTEMD_XBOOTLDR_PATH"] = str(BOOT_MOUNT_POINT)
+
+    proc = subprocess.Popen(
+        [f"{SYSTEMD}/bin/bootctl"],
+        stdin=subprocess.PIPE,
+        stdout=subprocess.PIPE,
+        stderr=sys.stderr,
+        env=env,
+    )
+    assert proc.stdin is not None and proc.stdout is not None
+    request = json.dumps({"method": method, "parameters": parameters}).encode()
+    out, _ = proc.communicate(request + b"\0")
+    reply, _, _ = out.partition(b"\0")
+    if not reply:
+        raise RuntimeError(
+            f"bootctl exited with status {proc.returncode} without a Varlink reply"
+        )
+    return json.loads(reply)
+
+
 def generation_dir(profile: str | None, generation: int) -> Path:
     if profile:
         return Path(
@@ -479,55 +511,29 @@ def install_bootloader(args: argparse.Namespace) -> None:
             + ["install"]
         )
     else:
-        # Update bootloader to latest if needed
-        available_out = run(
-            [f"{SYSTEMD}/bin/bootctl", "--version"], stdout=subprocess.PIPE
-        ).stdout.split()[2]
-        installed_out = run(
-            [f"{SYSTEMD}/bin/bootctl", f"--esp-path={EFI_SYS_MOUNT_POINT}", "status"],
-            stdout=subprocess.PIPE,
-        ).stdout
+        # Let bootctl compare versions itself. Over Varlink, an already
+        # current binary comes back as an io.systemd.System error carrying
+        # ESTALE, which we can tell apart from real failures.
+        params: dict[str, Any] = {"operation": "update"}
+        if not CAN_TOUCH_EFI_VARIABLES:
+            params["touchVariables"] = False
+        if GRACEFUL:
+            params["graceful"] = True
+        reply = bootctl_varlink_call("io.systemd.BootControl.Install", params)
 
-        # See status_binaries() in systemd bootctl.c for code which generates this
-        # Matches
-        # Available Boot Loaders on ESP:
-        #  ESP: /boot (/dev/disk/by-partuuid/9b39b4c4-c48b-4ebf-bfea-a56b2395b7e0)
-        # File: └─/EFI/systemd/systemd-bootx64.efi (systemd-boot 255.2)
-        # But also:
-        # Available Boot Loaders on ESP:
-        #  ESP: /boot (/dev/disk/by-partuuid/9b39b4c4-c48b-4ebf-bfea-a56b2395b7e0)
-        # File: ├─/EFI/systemd/HashTool.efi
-        #       └─/EFI/systemd/systemd-bootx64.efi (systemd-boot 255.2)
-        installed_match = re.search(
-            r"^\W+.*/EFI/(?:BOOT|systemd)/.*\.efi \(systemd-boot ([\d.]+[^)]*)\)$",
-            installed_out,
-            re.IGNORECASE | re.MULTILINE,
-        )
-
-        available_match = re.search(r"^\((.*)\)$", available_out)
-
-        if installed_match is None:
-            raise Exception(
-                "Could not find any previously installed systemd-boot. If you are switching to systemd-boot from a different bootloader, you need to run `nixos-rebuild switch --install-bootloader`"
-            )
-
-        if available_match is None:
-            raise Exception("could not determine systemd-boot version")
-
-        installed_version = installed_match.group(1)
-        available_version = available_match.group(1)
-
-        if installed_version < available_version:
-            print(
-                "updating systemd-boot from %s to %s"
-                % (installed_version, available_version),
-                file=sys.stderr,
-            )
-            run(
-                [f"{SYSTEMD}/bin/bootctl", f"--esp-path={EFI_SYS_MOUNT_POINT}"]
-                + bootctl_flags
-                + ["update"]
-            )
+        error = reply.get("error")
+        if error is not None:
+            error_params = reply.get("parameters") or {}
+            if (
+                error == "io.systemd.System"
+                and error_params.get("errno") == errno.ESTALE
+            ):
+                # Same or newer boot loader version already in place.
+                pass
+            else:
+                raise RuntimeError(
+                    f"bootctl update failed: {error} {json.dumps(error_params)}"
+                )
 
     (BOOT_MOUNT_POINT / NIXOS_DIR).mkdir(parents=True, exist_ok=True)
     (BOOT_MOUNT_POINT / "loader/entries").mkdir(parents=True, exist_ok=True)
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 71a18ed9e343..247bc1c6fdd0 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -623,6 +623,7 @@ in
   flannel = runTestOn [ "x86_64-linux" ] ./flannel.nix;
   flap-alerted = runTest ./flap-alerted.nix;
   flaresolverr = runTest ./flaresolverr.nix;
+  flarum = runTest ./flarum.nix;
   flood = runTest ./flood.nix;
   fluent-bit = runTest ./fluent-bit.nix;
   fluentd = runTest ./fluentd.nix;
diff --git a/nixos/tests/flarum.nix b/nixos/tests/flarum.nix
new file mode 100644
index 000000000000..17c7df02f44c
--- /dev/null
+++ b/nixos/tests/flarum.nix
@@ -0,0 +1,52 @@
+{ lib, ... }:
+{
+  name = "flarum";
+
+  meta = {
+    maintainers = with lib.maintainers; [
+      fsagbuya
+      jasonodoom
+    ];
+  };
+
+  nodes.machine =
+    { ... }:
+    {
+      # Flarum installs and migrates the database on first boot and runs a
+      # MariaDB server alongside PHP-FPM and nginx, so give the VM some headroom.
+      virtualisation.memorySize = 2048;
+
+      services.flarum = {
+        enable = true;
+        forumTitle = "NixOS Flarum Test Forum";
+        domain = "localhost";
+        baseUrl = "http://localhost";
+
+        # Run `flarum install` against the locally provisioned MariaDB. Safe here
+        # because the VM always starts from a fresh, empty database.
+        createDatabaseLocally = true;
+
+        adminUser = "admin";
+        adminEmail = "admin@example.com";
+        # Flarum rejects admin passwords shorter than 8 characters.
+        initialAdminPassword = "flarum-admin-password";
+      };
+    };
+
+  testScript = ''
+    start_all()
+
+    # PHP-FPM is ordered after the oneshot installer (Type=oneshot, no
+    # RemainAfterExit), so waiting on it implies the install/migrate finished.
+    machine.wait_for_unit("phpfpm-flarum.service")
+    machine.wait_for_unit("nginx.service")
+    machine.wait_for_open_port(80)
+
+    # The forum front page is server-rendered and embeds the configured title.
+    machine.wait_until_succeeds("curl -sf http://localhost/ -o /dev/null")
+    machine.succeed("curl -sf http://localhost/ | grep -F 'NixOS Flarum Test Forum'")
+
+    # The admin API endpoint should respond, confirming the app booted cleanly.
+    machine.succeed("curl -sf http://localhost/api -o /dev/null")
+  '';
+}
diff --git a/nixos/tests/matrix/matrix-authentication-service.nix b/nixos/tests/matrix/matrix-authentication-service.nix
index 7fac403e8421..2e93652b495e 100644
--- a/nixos/tests/matrix/matrix-authentication-service.nix
+++ b/nixos/tests/matrix/matrix-authentication-service.nix
@@ -67,7 +67,7 @@ in
 
   name = "matrix-authentication-service-upstream";
   meta = {
-    maintainers = pkgs.matrix-authentication-service.meta.maintainers ++ lib.teams.matrix.members;
+    teams = [ lib.teams.matrix ];
   };
 
   nodes = {
diff --git a/nixos/tests/systemd-boot.nix b/nixos/tests/systemd-boot.nix
index e001f11ce3a3..f36d3870f98e 100644
--- a/nixos/tests/systemd-boot.nix
+++ b/nixos/tests/systemd-boot.nix
@@ -478,7 +478,6 @@ in
               return machine.succeed("/run/current-system/bin/switch-to-configuration boot 2>&1")
 
           output = switch()
-          assert "updating systemd-boot from ${oldVersion} to " in output, "Couldn't find systemd-boot update message"
           assert 'to "/boot/EFI/systemd/systemd-bootx64.efi"' in output, "systemd-boot not copied to to /boot/EFI/systemd/systemd-bootx64.efi"
           assert 'to "/boot/EFI/BOOT/BOOTX64.EFI"' in output, "systemd-boot not copied to to /boot/EFI/BOOT/BOOTX64.EFI"
 
@@ -489,9 +488,12 @@ in
                   "mv /boot/EFI/BOOT/bootx64.efi.new /boot/EFI/BOOT/bootx64.efi",
               )
               output = switch()
-              assert "updating systemd-boot from ${oldVersion} to " in output, "Couldn't find systemd-boot update message"
               assert 'to "/boot/EFI/systemd/systemd-bootx64.efi"' in output, "systemd-boot not copied to to /boot/EFI/systemd/systemd-bootx64.efi"
               assert 'to "/boot/EFI/BOOT/BOOTX64.EFI"' in output, "systemd-boot not copied to to /boot/EFI/BOOT/BOOTX64.EFI"
+
+          with subtest("Test that switching with an up-to-date bootloader is a no-op"):
+              output = machine.succeed("/run/current-system/bin/switch-to-configuration boot 2>&1")
+              assert "same boot loader version in place already" in output, "Expected bootctl to skip already-current binary"
         '';
     }
   );
diff --git a/nixos/tests/victoriametrics/external-promscrape-config.nix b/nixos/tests/victoriametrics/external-promscrape-config.nix
index f645b8c839b9..15b8c9bde157 100644
--- a/nixos/tests/victoriametrics/external-promscrape-config.nix
+++ b/nixos/tests/victoriametrics/external-promscrape-config.nix
@@ -29,8 +29,8 @@ in
     ];
   };
 
-  nodes = {
-    victoriametrics =
+  containers = {
+    vmserver =
       { pkgs, ... }:
       {
         environment.systemPackages = [ pkgs.jq ];
@@ -55,14 +55,14 @@ in
     node.wait_for_unit("prometheus-node-exporter")
     node.wait_for_open_port(${toString nodeExporterPort})
 
-    victoriametrics.wait_for_unit("victoriametrics")
-    victoriametrics.wait_for_open_port(8428)
+    vmserver.wait_for_unit("victoriametrics")
+    vmserver.wait_for_open_port(8428)
 
 
-    promscrape_config = victoriametrics.succeed("journalctl -u victoriametrics -o cat | grep 'promscrape.config'")
+    promscrape_config = vmserver.succeed("journalctl -u victoriametrics -o cat | grep 'promscrape.config'")
     assert '${toString promscrapeConfigYaml}' in promscrape_config
 
-    victoriametrics.wait_until_succeeds(
+    vmserver.wait_until_succeeds(
       "curl -sf 'http://localhost:8428/api/v1/query?query=node_exporter_build_info\{instance=\"node:9100\"\}' | "
       + "jq '.data.result[0].value[1]' | grep '\"1\"'"
     )
diff --git a/nixos/tests/victoriametrics/remote-write.nix b/nixos/tests/victoriametrics/remote-write.nix
index 1788c9d8747c..721c4822c1d0 100644
--- a/nixos/tests/victoriametrics/remote-write.nix
+++ b/nixos/tests/victoriametrics/remote-write.nix
@@ -14,8 +14,8 @@ in
     ];
   };
 
-  nodes = {
-    victoriametrics =
+  containers = {
+    vmserver =
       { pkgs, ... }:
       {
         environment.systemPackages = [ pkgs.jq ];
@@ -34,7 +34,7 @@ in
         services.vmagent = {
           enable = true;
           remoteWrite = {
-            url = "http://victoriametrics:8428/api/v1/write";
+            url = "http://vmserver:8428/api/v1/write";
             basicAuthUsername = username;
             basicAuthPasswordFile = toString passwordFile;
           };
@@ -71,13 +71,13 @@ in
     node.wait_for_unit("prometheus-node-exporter")
     node.wait_for_open_port(9100)
 
-    victoriametrics.wait_for_unit("victoriametrics")
-    victoriametrics.wait_for_open_port(8428)
+    vmserver.wait_for_unit("victoriametrics")
+    vmserver.wait_for_open_port(8428)
 
     vmagent.wait_for_unit("vmagent")
 
     # check remote write
-    victoriametrics.wait_until_succeeds(
+    vmserver.wait_until_succeeds(
       "curl --user '${username}:${password}' -sf 'http://localhost:8428/api/v1/query?query=node_exporter_build_info\{instance=\"node:9100\"\}' | "
       + "jq '.data.result[0].value[1]' | grep '\"1\"'"
     )
diff --git a/nixos/tests/victoriametrics/vmalert.nix b/nixos/tests/victoriametrics/vmalert.nix
index e6a0ab5d4e52..684b60d0a605 100644
--- a/nixos/tests/victoriametrics/vmalert.nix
+++ b/nixos/tests/victoriametrics/vmalert.nix
@@ -9,8 +9,8 @@
     ];
   };
 
-  nodes = {
-    victoriametrics =
+  containers = {
+    vmserver =
       { config, pkgs, ... }:
       {
         environment.systemPackages = [ pkgs.jq ];
@@ -27,7 +27,7 @@
                 static_configs = [
                   {
                     targets = [
-                      "alertmanager:${toString config.services.prometheus.alertmanager.port}"
+                      "alert:${toString config.services.prometheus.alertmanager.port}"
                     ];
                   }
                 ];
@@ -51,7 +51,7 @@
           settings = {
             "datasource.url" = "http://localhost:8428"; # victoriametrics' api
             "notifier.url" = [
-              "http://alertmanager:${toString config.services.prometheus.alertmanager.port}"
+              "http://alert:${toString config.services.prometheus.alertmanager.port}"
             ]; # alertmanager's api
             rule = [
               (pkgs.writeText "instance-down.yml" ''
@@ -71,7 +71,7 @@
         };
       };
 
-    alertmanager = {
+    alert = {
       services.prometheus.alertmanager = {
         enable = true;
         openFirewall = true;
@@ -115,33 +115,33 @@
   };
 
   testScript = ''
-    alertmanager.wait_for_unit("alertmanager")
-    alertmanager.wait_for_open_port(9093)
-    alertmanager.wait_until_succeeds("curl -s http://127.0.0.1:9093/-/ready")
+    alert.wait_for_unit("alertmanager")
+    alert.wait_for_open_port(9093)
+    alert.wait_until_succeeds("curl -s http://127.0.0.1:9093/-/ready")
 
     logger.wait_for_unit("alertmanager-webhook-logger")
     logger.wait_for_open_port(6725)
 
-    victoriametrics.wait_for_unit("victoriametrics")
-    victoriametrics.wait_for_unit("vmalert")
-    victoriametrics.wait_for_open_port(8428)
+    vmserver.wait_for_unit("victoriametrics")
+    vmserver.wait_for_unit("vmalert")
+    vmserver.wait_for_open_port(8428)
 
-    victoriametrics.wait_until_succeeds(
+    vmserver.wait_until_succeeds(
       "curl -sf 'http://127.0.0.1:8428/api/v1/query?query=count(up\{job=\"alertmanager\"\}==1)' | "
       + "jq '.data.result[0].value[1]' | grep '\"1\"'"
     )
 
-    victoriametrics.wait_until_succeeds(
+    vmserver.wait_until_succeeds(
       "curl -sf 'http://127.0.0.1:8428/api/v1/query?query=sum(alertmanager_build_info)%20by%20(version)' | "
       + "jq '.data.result[0].metric.version' | grep '\"${pkgs.prometheus-alertmanager.version}\"'"
     )
 
-    victoriametrics.wait_until_succeeds(
+    vmserver.wait_until_succeeds(
       "curl -sf 'http://127.0.0.1:8428/api/v1/query?query=count(up\{job=\"node\"\}!=1)' | "
       + "jq '.data.result[0].value[1]' | grep '\"1\"'"
     )
 
-    victoriametrics.wait_until_succeeds(
+    vmserver.wait_until_succeeds(
       "curl -sf 'http://127.0.0.1:8428/api/v1/query?query=alertmanager_notifications_total\{integration=\"webhook\"\}' | "
       + "jq '.data.result[0].value[1]' | grep -v '\"0\"'"
     )
@@ -152,6 +152,6 @@
 
     logger.log(logger.succeed("systemd-analyze security alertmanager-webhook-logger.service | grep -v '✓'"))
 
-    alertmanager.log(alertmanager.succeed("systemd-analyze security alertmanager.service | grep -v '✓'"))
+    alert.log(alert.succeed("systemd-analyze security alertmanager.service | grep -v '✓'"))
   '';
 }
diff --git a/nixos/tests/web-apps/dashy.nix b/nixos/tests/web-apps/dashy.nix
index 39454b5b8d8a..d83c14d3294f 100644
--- a/nixos/tests/web-apps/dashy.nix
+++ b/nixos/tests/web-apps/dashy.nix
@@ -1,6 +1,5 @@
 { pkgs, lib, ... }:
 let
-
   customSettings = {
     pageInfo = {
       title = "My Custom Dashy Title";
@@ -45,29 +44,29 @@ in
         }
       ];
     };
-  nodes = {
-    machine = { };
+  containers = {
+    container = { };
 
-    machine-custom = {
+    custom = {
       services.dashy.settings = customSettings;
     };
   };
 
   testScript = ''
     start_all()
-    machine.wait_for_unit("nginx.service")
-    machine.wait_for_open_port(80)
+    container.wait_for_unit("nginx.service")
+    container.wait_for_open_port(80)
 
-    actual = machine.succeed("curl -v --stderr - http://dashy.local/", timeout=10)
+    actual = container.succeed("curl -v --stderr - http://dashy.local/", timeout=10)
     expected = "<title>Dashy</title>"
     assert expected in actual, \
       f"unexpected reply from Dashy, expected: '{expected}' got: '{actual}'"
 
-    machine_custom.wait_for_unit("nginx.service")
-    machine_custom.wait_for_open_port(80)
+    custom.wait_for_unit("nginx.service")
+    custom.wait_for_open_port(80)
 
-    actual_custom = machine_custom.succeed("curl -s --stderr - http://dashy.local/conf.yml", timeout=10).strip()
-    expected_custom = machine_custom.succeed("cat ${customSettingsYaml}").strip()
+    actual_custom = custom.succeed("curl -s --stderr - http://dashy.local/conf.yml", timeout=10).strip()
+    expected_custom = custom.succeed("cat ${customSettingsYaml}").strip()
 
     assert expected_custom == actual_custom, \
       f"unexpected reply from Dashy, expected: '{expected_custom}' got: '{actual_custom}'"
diff --git a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
index 554f417f9cfb..68e79bb14248 100644
--- a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
@@ -21,26 +21,26 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-wlsp+GNwhobe7RW2RsBAiSyAjhzJ7w5r9U6LCCpiBA0=";
+          hash = "sha256-fgIxS3c3+teMTMCXzRINFuV1aebJAQFIXfXC7Q2zHhg=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-emj4el3Sy0bWMp+XaU96cS0rOP/b2kthmUHDpuhbinM=";
+          hash = "sha256-LdSx/7CspsT5hff6oQKRFmxQS+vi0kpvCgbcq8OQSAA=";
         };
         "x86_64-darwin" = {
           arch = "darwin-x64";
-          hash = "sha256-zbfo97wQmyrN1QWbP/ZyAcJrYc5TbTge7WncLt+HOcg=";
+          hash = "sha256-ct7RcbzKHiZ/PRl42IFoHroR4i4gDVuHSX1t4FDN+R0=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-NScb6fr1OIr1jCo8Gdi71r84e2uT2mrO75JBVPFgdek=";
+          hash = "sha256-N/AeA4E0tSHH3lrPhuyqPDl5nE+aNK/ntsW4ai+Sf5s=";
         };
       };
     in
     {
       name = "claude-code";
       publisher = "anthropic";
-      version = "2.1.196";
+      version = "2.1.197";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");
diff --git a/pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/default.nix b/pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/default.nix
index b17bc1d76708..51f89e1e87c3 100644
--- a/pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/default.nix
@@ -16,7 +16,7 @@ assert lib.versionAtLeast python3.version "3.5";
 let
   publisher = "vadimcn";
   pname = "vscode-lldb";
-  version = "1.12.1";
+  version = "1.12.2";
 
   vscodeExtUniqueId = "${publisher}.${pname}";
   vscodeExtPublisher = publisher;
@@ -26,7 +26,7 @@ let
     owner = "vadimcn";
     repo = "codelldb";
     rev = "v${version}";
-    hash = "sha256-B8iCy4NXG7IzJVncbYm5VoAMfhMfxGF+HW7M5sVn5b0=";
+    hash = "sha256-7//+y02rfDloeNADpoM8tist7fPstBZ2Eqt4dM5dCaE=";
   };
 
   lldb = llvmPackages_19.lldb;
@@ -181,7 +181,7 @@ stdenv.mkDerivation {
     description = "Native debugger extension for VSCode based on LLDB";
     homepage = "https://github.com/vadimcn/vscode-lldb";
     license = [ lib.licenses.mit ];
-    maintainers = [ lib.maintainers.r4v3n6101 ];
+    maintainers = [ ];
     platforms = lib.platforms.all;
   };
 }
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index 3d4138570f74..dd4df835a93c 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -480,13 +480,15 @@ let
       # BUNDLE_WIDEVINE_CDM build flag does work in the way we want though.
       # We also need enable_widevine_cdm_component to be false. Unfortunately it isn't exposed as gn
       # flag (declare_args) so we simply hardcode it to false.
-      ./patches/widevine-disable-auto-download-allow-bundle.patch
+      ./patches/${lib.optionalString (chromiumVersionAtLeast "150") "chromium-150-"}widevine-disable-auto-download-allow-bundle.patch
     ]
-    ++ [
+    ++ lib.optionals (!chromiumVersionAtLeast "150") [
       # Required to fix the build with a more recent wayland-protocols version
       # (we currently package 1.26 in Nixpkgs while Chromium bundles 1.21):
       # Source: https://bugs.chromium.org/p/angleproject/issues/detail?id=7582#c1
       ./patches/angle-wayland-include-protocol.patch
+    ]
+    ++ [
       # Chromium reads initial_preferences from its own executable directory
       # This patch modifies it to read /etc/chromium/initial_preferences
       ./patches/chromium-initial-prefs.patch
@@ -504,11 +506,16 @@ let
       # allowing us to use our rustc and our clang.
       ./patches/chromium-140-rust.patch
     ]
-    ++ lib.optionals (chromiumVersionAtLeast "141") [
+    ++ lib.optionals (versionRange "141" "150") [
       # Rebased variant of the patch above due to
       # https://chromium-review.googlesource.com/c/chromium/src/+/6897026
       ./patches/chromium-141-rust.patch
     ]
+    ++ lib.optionals (chromiumVersionAtLeast "150") [
+      # Rebased variant of the patch above due to
+      # https://chromium-review.googlesource.com/c/chromium/src/+/7858711
+      ./patches/chromium-150-rust.patch
+    ]
     ++ lib.optionals (!chromiumVersionAtLeast "145" && stdenv.hostPlatform.isAarch64) [
       # Reverts decommit pooled pages which causes random crashes of tabs on systems
       # with page sizes different than 4k. It 'supports' runtime page sizes, but has
@@ -676,6 +683,17 @@ let
         revert = true;
         hash = "sha256-7xg8IZ2gO+Wtnv7lWLVE3lLpcmMgvtDtcWwUuMBzkrE=";
       })
+    ]
+    ++ lib.optionals (versionRange "150" "151") [
+      # ninja: Entering directory `out/Release'
+      # ninja: error: 'ar', needed by 'default_for_rust_host_build_tools/obj/build/rust/allocator/liballoc_error_handler_impl.a', missing and no known rule to make it
+      (fetchpatch {
+        name = "chromium-150-backport-build--Omit-ar-from-inputs-when-resolved-via--PATH.patch";
+        # https://chromium-review.googlesource.com/c/chromium/src/+/7904982
+        url = "https://chromium.googlesource.com/chromium/src/+/60f987d8d5f7272793a40290d060b8f50933f825^!?format=TEXT";
+        decode = "base64 -d";
+        hash = "sha256-MryWxSwBxSIONhl3X1cDxTWwNWy8a4yt/sqkrueSUNs=";
+      })
     ];
 
     postPatch =
@@ -910,6 +928,12 @@ let
         # TODO: remove opt-out of https://chromium.googlesource.com/chromium/src/+/main/docs/modules.md
         use_clang_modules = false;
       }
+      // lib.optionalAttrs (chromiumVersionAtLeast "150") {
+        # ERROR at //build/modules/BUILD.gn:80:23: Directory does not exist: /usr/include/
+        #     system_headers += expand_directory("${sysroot}/${root_include_dir}", true)
+        #                       ^------------------------------------------------------
+        use_unified_system_module = false;
+      }
       // {
         use_qt5 = false;
         use_qt6 = false;
@@ -986,24 +1010,34 @@ let
       runHook postConfigure
     '';
 
-    # Chromium expects nightly/bleeding edge rustc features to be available.
-    # Our rustc in nixpkgs follows stable, but since bootstrapping rustc requires
-    # nightly features too, we can (ab-)use RUSTC_BOOTSTRAP here as well to
-    # enable those features in our stable builds.
-    env.RUSTC_BOOTSTRAP = 1;
-    # Mute some warnings that are enabled by default. This is useful because
-    # our Clang is always older than Chromium's and the build logs have a size
-    # of approx. 25 MB without this option (and this saves e.g. 66 %).
-    env.NIX_CFLAGS_COMPILE =
-      "-Wno-unknown-warning-option -Wno-unused-command-line-argument -Wno-shadow"
-      # warning: '_LIBCPP_HARDENING_MODE' macro redefined [-Wmacro-redefined]
-      # because of hardeningDisable = [ "strictflexarrays1" ];
-      + lib.optionalString (chromiumVersionAtLeast "149") " -Wno-macro-redefined";
-    env.BUILD_CC = "$CC_FOR_BUILD";
-    env.BUILD_CXX = "$CXX_FOR_BUILD";
-    env.BUILD_AR = "$AR_FOR_BUILD";
-    env.BUILD_NM = "$NM_FOR_BUILD";
-    env.BUILD_READELF = "$READELF_FOR_BUILD";
+    env = {
+      # Chromium expects nightly/bleeding edge rustc features to be available.
+      # Our rustc in nixpkgs follows stable, but since bootstrapping rustc requires
+      # nightly features too, we can (ab-)use RUSTC_BOOTSTRAP here as well to
+      # enable those features in our stable builds.
+      RUSTC_BOOTSTRAP = 1;
+
+      # Mute some warnings that are enabled by default. This is useful because
+      # our Clang is always older than Chromium's and the build logs have a size
+      # of approx. 25 MB without this option (and this saves e.g. 66 %).
+      NIX_CFLAGS_COMPILE =
+        "-Wno-unknown-warning-option -Wno-unused-command-line-argument -Wno-shadow"
+        # warning: '_LIBCPP_HARDENING_MODE' macro redefined [-Wmacro-redefined]
+        # because of hardeningDisable = [ "strictflexarrays1" ];
+        + lib.optionalString (chromiumVersionAtLeast "149") " -Wno-macro-redefined";
+
+      BUILD_CC = "$CC_FOR_BUILD";
+      BUILD_CXX = "$CXX_FOR_BUILD";
+      BUILD_AR = "$AR_FOR_BUILD";
+      BUILD_NM = "$NM_FOR_BUILD";
+      BUILD_READELF = "$READELF_FOR_BUILD";
+    }
+    // lib.optionalAttrs (chromiumVersionAtLeast "150") {
+      # [56385/56385] LINK ./chrome
+      # FAILED: [code=1] chrome
+      # /nix/store/[...]/bin/ld.lld: line 288: /nix/store/[...]/bin/ld.lld: Argument list too long
+      NIX_LD_USE_RESPONSE_FILE = 1;
+    };
 
     buildPhase =
       let
diff --git a/pkgs/applications/networking/browsers/chromium/depot_tools.py b/pkgs/applications/networking/browsers/chromium/depot_tools.py
index ab8007a4e910..45f18098ff61 100755
--- a/pkgs/applications/networking/browsers/chromium/depot_tools.py
+++ b/pkgs/applications/networking/browsers/chromium/depot_tools.py
@@ -43,7 +43,14 @@ class Repo:
         )
 
         deps_file = self.get_file("DEPS")
-        evaluated = gclient_eval.Parse(deps_file, vars_override=repo_vars, filename="DEPS")
+        evaluated = gclient_eval.Parse(
+            deps_file,
+            filename="DEPS",
+            vars_override=repo_vars,
+            # KeyError: "host_cpu was used as a variable, but was not declared in the vars dict (file 'DEPS', line 114)"
+            # https://chromium.googlesource.com/webpagereplay.git/+/b2b856131e36c99e9de9c419fe8ca02f857082ba/DEPS#114
+            builtin_vars= {"host_cpu": "*host_cpu_placeholder*"} if path == "src/third_party/webpagereplay" else None,
+        )
 
         repo_vars = dict(evaluated.get("vars", {})) | repo_vars
 
diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index c87e4a647a90..6e075e7f9b3b 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -1,6 +1,6 @@
 {
   "chromium": {
-    "version": "149.0.7827.200",
+    "version": "150.0.7871.46",
     "chromedriver": {
       "version": "149.0.7827.201",
       "hash_darwin": "sha256-MHCcid+7wdYm8uIdrUIlXrk8ADHNUUXzPyMPFGP98WY=",
@@ -8,21 +8,21 @@
     },
     "deps": {
       "depot_tools": {
-        "rev": "45dedc4c3b87c982fd846b3dc599b233ed3aff90",
-        "hash": "sha256-Ttklyw6IdNeMExlzeiQg/qsCkTmqVhUJ34MFgYmCWD4="
+        "rev": "f4fadaf6a5ba1bced9d3d9021060667b563bf583",
+        "hash": "sha256-3atvbwYnFTA40MonAxSQWkF58Jku7O7fUzelGPQvDyY="
       },
       "gn": {
-        "version": "0-unstable-2026-05-01",
-        "rev": "1740f5c25bcac5a650ee3d1c1ec22bfa25fcd756",
-        "hash": "sha256-oFs7fZAZEs/gQ7X1A4uigo9+Y+iEN9sMMQYwAjEuD04="
+        "version": "0-unstable-2026-05-27",
+        "rev": "3357c4f51b1a9e676378c695dd9c7e9911c35ee6",
+        "hash": "sha256-/1A+DkzAQj2zGPe/A/G0Z3VrYJXUxq4Hd/+d/o5p3G8="
       },
       "npmHash": "sha256-pF0JtwFpPC4/fodbhSJnQKkczA9WlDg4VqEAy9aDVLg="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "c35c164b1b6d1adca9eddf914ed6d0d0743dba6a",
-        "hash": "sha256-b2gBRUzRjqVZEb/tWUL1JF6Afq5gHJ3aOM02My1FyYU=",
+        "rev": "5b586c06e0d27582900f17e2d59c5370d8d6e0bb",
+        "hash": "sha256-OAZNyZtR5WFWW42r74RSy9fT7Eb7CNZwzoIHhuoqR28=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -32,13 +32,13 @@
       },
       "src/third_party/compiler-rt/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/compiler-rt.git",
-        "rev": "0408cce08083f3d81379ed7d9f5bd26c03e1495b",
-        "hash": "sha256-kR5osTmp2girvNRVHzEKMZDCelgux9RrRuMoXMCRSGM="
+        "rev": "03641f7a5b05e48e318d64369057db577cafc594",
+        "hash": "sha256-KnWESGG6aI0S+fkJ3/T1x4QSiIYaOOvWUAm6l6l9iME="
       },
       "src/third_party/libc++/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx.git",
-        "rev": "be1c391acca009d8d80535ce924e3d285451cdfa",
-        "hash": "sha256-zKb9PUiiBvhVhWnbQwR8uOFJ9gt3uYmfJ4M9ijpgKRc="
+        "rev": "5abc7f839700f0f17338434e1c1c6a8c87c00c11",
+        "hash": "sha256-vT1km7JgVpotDoNK+ae1gplSHcwrVNLsv/QAFUrDsIM="
       },
       "src/third_party/libc++abi/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi.git",
@@ -47,13 +47,13 @@
       },
       "src/third_party/libunwind/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind.git",
-        "rev": "71192be150bbe04d87bb5298512d464e38d2f654",
-        "hash": "sha256-PxXemxdWZoEavKDOovi67IVWEr2YW8YK2F0LXM3LZPw="
+        "rev": "d6c7a21e978f0adaa43accaad53bc64f0b64f6ec",
+        "hash": "sha256-EuaVSYiR7qrlYqBR0UqdWCvwdzJSn0RS2wC/lnP19AE="
       },
       "src/third_party/llvm-libc/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc.git",
-        "rev": "deb95b5e48e875920a2eaae799c8dbcd76a6a4db",
-        "hash": "sha256-oAgIT3+vjBrX86jgi/Pb0SCyco0lozjBjXlrKm6i56M="
+        "rev": "6e5ec6f78d8b9f2e8a50fcc5692d1fc8b2964bde",
+        "hash": "sha256-qrkx8Z1fc088Ja32obIUPxDwklI7i1wdEw051UZ08u8="
       },
       "src/chrome/test/data/perf/canvas_bench": {
         "url": "https://chromium.googlesource.com/chromium/canvas_bench.git",
@@ -72,8 +72,8 @@
       },
       "src/docs/website": {
         "url": "https://chromium.googlesource.com/website.git",
-        "rev": "c9a9ad55e9ec9934244e58a5a8cab9a295526010",
-        "hash": "sha256-2GKWEnlExrTzoIYMxeP4n2klLLT/phB5ZVJ5Nj3/aoY="
+        "rev": "3da515a67f412be05ea1ea6b39832a69aef8f54e",
+        "hash": "sha256-wrkFsPX7jrsjD/Ow1gna/xLvk0E49m5GVxP1G7Vx7HM="
       },
       "src/media/cdm/api": {
         "url": "https://chromium.googlesource.com/chromium/cdm.git",
@@ -82,8 +82,8 @@
       },
       "src/net/third_party/quiche/src": {
         "url": "https://quiche.googlesource.com/quiche.git",
-        "rev": "fafc2fe9efc9f2e28a0815229fc14ca30c266ba8",
-        "hash": "sha256-4UmjE41MOFCBa3APDMyyJwkeV6LhHl5UsMxZpPRDsRY="
+        "rev": "997d654308b6a1a17435e472ef5190aecb12e3eb",
+        "hash": "sha256-xgDgW2foZZEWpr0ibSG21kf028FN07/1ecOqFCkNj/I="
       },
       "src/testing/libfuzzer/fuzzers/wasm_corpus": {
         "url": "https://chromium.googlesource.com/v8/fuzzer_wasm_corpus.git",
@@ -92,8 +92,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "355cc61af2aadd8f0494800325b2bf9908138108",
-        "hash": "sha256-fgaCyO0oaz90aTaWMHH8ocySA0hXDHsPEl6vtMj4BY0="
+        "rev": "bbf3d8a4755268f016087be2f56099fa5a5f3f6e",
+        "hash": "sha256-8iuHtNgHumlMXeXj2k0ZPcvnTeJ00di298+789OjScs="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -107,13 +107,18 @@
       },
       "src/third_party/angle/third_party/VK-GL-CTS/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/VK-GL-CTS",
-        "rev": "3fe33a325af90c1c820b1e8109f11ea0f4b60c9b",
-        "hash": "sha256-JgOdlwtjC5HiCWBAaeM+Ffp9KlbI7+erT0ZRZBlWxXI="
+        "rev": "01471f4b3846c97eceb5b16b8acad950808791b2",
+        "hash": "sha256-SrL+G3osTtJGQslfCBEYbslb2kWtHRrwO87PHi+5o6E="
       },
       "src/third_party/anonymous_tokens/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/anonymous-tokens.git",
-        "rev": "208ea23596884f6d86476ea88b64e7931cdec08a",
-        "hash": "sha256-HLUX0mUzA3xcXbw71sIxFBNEkL8x86urcdJH2Yuuy04="
+        "rev": "92d1fdf881a932e7aa2a9b20e006136a659c7a20",
+        "hash": "sha256-llPt+UR8hY0yaJkYmq+A3ZfRRReuaXN09qpap6C28jc="
+      },
+      "src/third_party/aria-practices/src": {
+        "url": "https://chromium.googlesource.com/external/github.com/w3c/aria-practices.git",
+        "rev": "7b134ce6d19497cce8a67db4a9f59980baf853dc",
+        "hash": "sha256-POnvoO1KfzJj4CbcMPI0pUTRk5EtHLTOyKKmJCZdXOc="
       },
       "src/third_party/readability/src": {
         "url": "https://chromium.googlesource.com/external/github.com/mozilla/readability.git",
@@ -127,13 +132,13 @@
       },
       "src/third_party/dav1d/libdav1d": {
         "url": "https://chromium.googlesource.com/external/github.com/videolan/dav1d.git",
-        "rev": "5cfc3832687e3229117203905faf5425ac6bc0d7",
-        "hash": "sha256-MWDDrb8P5AIFszY0u5gCrK+kZlbYffIt9Y1b/thXL7I="
+        "rev": "62501cc7db378532d7e85ea434b70d57e1ba2cb0",
+        "hash": "sha256-5cpKTUnhR+QzQJR4KbAvdvqsWnT1fpH0g9MObv8Nx0c="
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "54b4153cfef88e048f365f99b962478f0087dfe8",
-        "hash": "sha256-Bv30zz/pCNVzUl+mKCpusWc94poytv9ZFelZIcs+2B8="
+        "rev": "01249a97332468dbdd6cf5edb8dd7bae77875de5",
+        "hash": "sha256-tzomo+GTec2zixxk61gtlma/sjcBImgbLMwA+mIp1LM="
       },
       "src/third_party/dawn/third_party/glfw3/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -142,8 +147,8 @@
       },
       "src/third_party/dawn/third_party/directx-shader-compiler/src": {
         "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectXShaderCompiler",
-        "rev": "d73829d4e677ef00931e8e57de6d544396ab46cb",
-        "hash": "sha256-BIXNgVeF5x3BZWFWZ1Gz+zpNSOEl+hZWB0GgMEaNS2w="
+        "rev": "35c1b99e9e552267da5efaea07c003e322d65777",
+        "hash": "sha256-pzBk+jUp/FUV8ahHquE0942Qw/DjAUemSM9fxdFJ0JA="
       },
       "src/third_party/dawn/third_party/directx-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectX-Headers",
@@ -152,8 +157,8 @@
       },
       "src/third_party/dawn/third_party/OpenGL-Registry/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/OpenGL-Registry",
-        "rev": "9cb90ca4902d588bef3c830fbb1da484893bd5fb",
-        "hash": "sha256-mWVORjrbNFINr5WKAIDVnPs2T+96vkxWqZdJwp8oT9I="
+        "rev": "a30033d3e812c9bf10094f1010374a6b15e192eb",
+        "hash": "sha256-xLacUOSy783bCtv+wUnjVnNLwTQ3eLwUJtYXmELqekY="
       },
       "src/third_party/dawn/third_party/EGL-Registry/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/EGL-Registry",
@@ -162,8 +167,8 @@
       },
       "src/third_party/dawn/third_party/webgpu-cts": {
         "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts",
-        "rev": "5c6b119c4fa0d9059c45f7637df1fe26fc80a6e4",
-        "hash": "sha256-9DAdS2u2YtrCFJu0KTuwRJjTUNexFxdmnn7LkwQ+KiQ="
+        "rev": "f08551b0fc4d6cfa5ba582a0235b571aa363102d",
+        "hash": "sha256-f5kWMnaod/Ved1Fz/vTkdL0ihSUnNM8XN5Ht3Vs1YpU="
       },
       "src/third_party/dawn/third_party/webgpu-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/webgpu-native/webgpu-headers",
@@ -187,8 +192,8 @@
       },
       "src/third_party/boringssl/src": {
         "url": "https://boringssl.googlesource.com/boringssl.git",
-        "rev": "65818adf16411ca394625f5747a1af28faf95d2c",
-        "hash": "sha256-tcTTzQnBp8Od1jdDMrFoCr9bnW0OCjGqUjH3QMnusmo="
+        "rev": "3a9254f16eda7a4c5d2260039ff23456a0a34de4",
+        "hash": "sha256-JuMnNppWhIFHYfk6ANIZLC7ABhqMseoV5LYV7slevBE="
       },
       "src/third_party/breakpad/breakpad": {
         "url": "https://chromium.googlesource.com/breakpad/breakpad.git",
@@ -202,13 +207,8 @@
       },
       "src/third_party/catapult": {
         "url": "https://chromium.googlesource.com/catapult.git",
-        "rev": "6e4188cabb4f37314ea41e9adfcb2cf9b64e2641",
-        "hash": "sha256-/kleYYllR22KjxHT2gTMGf6LEUZ1Ud7j593fIIAgqAA="
-      },
-      "src/third_party/catapult/third_party/webpagereplay": {
-        "url": "https://chromium.googlesource.com/webpagereplay.git",
-        "rev": "b7ac48f52cd298e966a76eb054412915c3e445d4",
-        "hash": "sha256-smtwB6vzLgCAePz0jNfrpm8TxrxBnBkigLxERhxUEvE="
+        "rev": "2852bb7e91e4995502ffb72b7ed21412ee157914",
+        "hash": "sha256-XYufVvzOXD4voZUWUvumQQqLNsx9sy0QmQzNzrgNEWg="
       },
       "src/third_party/ced/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/compact_enc_det.git",
@@ -227,13 +227,13 @@
       },
       "src/third_party/cpu_features/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/cpu_features.git",
-        "rev": "d3b2440fcfc25fe8e6d0d4a85f06d68e98312f5b",
-        "hash": "sha256-IBJc1sHHh4G3oTzQm1RAHHahsEECC+BDl14DHJ8M1Ys="
+        "rev": "81d13c49649f0714dd41fb56bb246398b6584085",
+        "hash": "sha256-TrC1WMLAhko57rAyDCiAC/IJ0unAqVhyjkh7gKibyi4="
       },
       "src/third_party/cpuinfo/src": {
         "url": "https://chromium.googlesource.com/external/github.com/pytorch/cpuinfo.git",
-        "rev": "3681f0ce1446167d01dfe125d6db96ba2ac31c3c",
-        "hash": "sha256-PhWbzQgZSUb3eVyx+JTSnxVOAC2WzL2Dw1I9/6LEIsw="
+        "rev": "ea6b9f1bb6e1001d8b21574d5bc78ddef62e499d",
+        "hash": "sha256-/QsOjDik0TnH3FnK7LOwsJkvX+O+2DRFX4eF3MxD3fc="
       },
       "src/third_party/crc32c/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/crc32c.git",
@@ -242,28 +242,28 @@
       },
       "src/third_party/cros_system_api": {
         "url": "https://chromium.googlesource.com/chromiumos/platform2/system_api.git",
-        "rev": "7ecd2b41460516ecd7b7d6e5c298db25e1436b6f",
-        "hash": "sha256-ehbAXv4DZStWDMC3iOjmWkAc4PhAamyI4C9bdXO7FfA="
+        "rev": "1c69e700a01a7fd3dd331f526c8a31ac1e5e49d0",
+        "hash": "sha256-qIwUs0KVU9xYFLN3UUayPLfz0ObA+EN6owKPW61J/5w="
       },
       "src/third_party/crossbench": {
         "url": "https://chromium.googlesource.com/crossbench.git",
-        "rev": "cecd70a5f49f777f603d38d11ac1f66c03c3e8af",
-        "hash": "sha256-zLwIY8fQVebkfN4KFMbitZODhmiN65JK2s9IG/5Cd+o="
+        "rev": "7d52b4ffbc319a7d5a0e0a0ebff744e5281d60c5",
+        "hash": "sha256-iwwvvIOuRMo/ZEu8Gk0lZaS4P5uGt8zpnYMChpZPcUo="
       },
       "src/third_party/crossbench-web-tests": {
         "url": "https://chromium.googlesource.com/chromium/web-tests.git",
-        "rev": "baf176aadedccc44329231d5dd40346874c2a63e",
-        "hash": "sha256-oY1/uGB6ykePIklWe35rmJWsnpu/wjkER4TJeP4TTdw="
+        "rev": "7b3de17542cc613aaddbfc72c6e12be37eed7b73",
+        "hash": "sha256-7ly4vaK+Pj4y91t6Q+igQ0890CqKyu9jNBhJnxbNGjI="
       },
       "src/third_party/depot_tools": {
         "url": "https://chromium.googlesource.com/chromium/tools/depot_tools.git",
-        "rev": "45dedc4c3b87c982fd846b3dc599b233ed3aff90",
-        "hash": "sha256-Ttklyw6IdNeMExlzeiQg/qsCkTmqVhUJ34MFgYmCWD4="
+        "rev": "f4fadaf6a5ba1bced9d3d9021060667b563bf583",
+        "hash": "sha256-3atvbwYnFTA40MonAxSQWkF58Jku7O7fUzelGPQvDyY="
       },
       "src/third_party/devtools-frontend/src": {
         "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "33c2f401a9c8ddad2159eb0ab83aa244a5247361",
-        "hash": "sha256-M9aULI+HECgA0ptAG47OPK0QuB+xzmb29iOtJ3whpB0="
+        "rev": "1d67dc0dafa344bbd6ca75c124e2d6d9d53074d8",
+        "hash": "sha256-VBXch2YwnKm+lMcZ5L0SlW+vAYeaSwgZvcOhg1TE5/A="
       },
       "src/third_party/dom_distiller_js/dist": {
         "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
@@ -277,8 +277,8 @@
       },
       "src/third_party/eigen3/src": {
         "url": "https://chromium.googlesource.com/external/gitlab.com/libeigen/eigen.git",
-        "rev": "2cf9891537250255f50df5109ffe9e700e2a73de",
-        "hash": "sha256-1bu1Y9itHIKcwY5J0sF08DSyfElLHiZ6SRsNZkFjz8o="
+        "rev": "662ba79d796a2851b10cdafc6668e45b65b1120f",
+        "hash": "sha256-6bZFDeo7TqWNunkkQv8OJ+7/hfKwoIUtqZoXaeLp6M8="
       },
       "src/third_party/farmhash/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/farmhash.git",
@@ -287,18 +287,18 @@
       },
       "src/third_party/fast_float/src": {
         "url": "https://chromium.googlesource.com/external/github.com/fastfloat/fast_float.git",
-        "rev": "05087a303dad9c98768b33c829d398223a649bc6",
-        "hash": "sha256-ZQm8kDMYdwjKugc2vBG5mwTqXa01u6hODQc/Tai2I9A="
+        "rev": "cfd12ebcf1f82c4fd44a950b1815dd0549bc8d89",
+        "hash": "sha256-hzoB+Mmok3oe6B494uLc5ReWpUcB89zCGPYw4gvanK0="
       },
       "src/third_party/federated_compute/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google-parfait/federated-compute.git",
-        "rev": "3112513bf1a80872311e7718c5385f535a819b89",
-        "hash": "sha256-jnG3PCxjaYcClRgzOfIkHbbD3xU9TDLyQR3VZUwHIgU="
+        "rev": "8de5837b817f28abc54a387a9417631b905ba90a",
+        "hash": "sha256-GZYo0FjgW8XCplAi6jzzruwDlIzsWjNEVQuCwXBCPz8="
       },
       "src/third_party/ffmpeg": {
         "url": "https://chromium.googlesource.com/chromium/third_party/ffmpeg.git",
-        "rev": "f45bab87ce4c5fafc67fd53fcde777578d01bfa0",
-        "hash": "sha256-fsZSqmG6vFOPJYuBgG6OSWkzRu27B3mv/PqAP8s4ARk="
+        "rev": "ad41607c61898cf7150e0fb20fe4bbabd44922a3",
+        "hash": "sha256-41qpsOTedB51WMzzHXDiXA19OIzA7wG/Qgbz6IkmWpk="
       },
       "src/third_party/flac": {
         "url": "https://chromium.googlesource.com/chromium/deps/flac.git",
@@ -327,8 +327,8 @@
       },
       "src/third_party/freetype/src": {
         "url": "https://chromium.googlesource.com/chromium/src/third_party/freetype2.git",
-        "rev": "b6bcd2177f72bb4842c7701d7b7f633bb3fc951a",
-        "hash": "sha256-TUz3yUD9HxqUMCOpLk74rEf8J0tMTh4ZCuD94AD4+q4="
+        "rev": "b08a2eb0dd37f4a6c886fa5b0ecf5b3e1d27aac7",
+        "hash": "sha256-xnYeUAJx5n8LSg04AknfiudonfmlUdlj8nzHzSZi65I="
       },
       "src/third_party/fxdiv/src": {
         "url": "https://chromium.googlesource.com/external/github.com/Maratyszcza/FXdiv.git",
@@ -337,13 +337,13 @@
       },
       "src/third_party/harfbuzz/src": {
         "url": "https://chromium.googlesource.com/external/github.com/harfbuzz/harfbuzz.git",
-        "rev": "e6741e2205309752839da60ff075b7fa2e7cddd3",
-        "hash": "sha256-XjUuY17fcZi+dIZFojq+eDsDVrBxtAWRydPdudt56+8="
+        "rev": "d639197ed529b05c27f38ebaab365a621d5edad5",
+        "hash": "sha256-uT4zK2hwHzEH6Nrd2rAeyzpQA1TmwtrdcujKYEUbLsY="
       },
       "src/third_party/ink/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/ink.git",
-        "rev": "a988417b6d0b1ea03fb0b40269fbc42313acc6fd",
-        "hash": "sha256-6O+N/ULn8sqsdgFw7VZ7TMjWvCAZbYo398PruPScU/k="
+        "rev": "0f9c6172b2ccc6b830ae313d522caf09e6933e06",
+        "hash": "sha256-LF+OcqNeg+KRuYmGuMZb4tmnr53sZHn/ZW1jg9ArPfc="
       },
       "src/third_party/instrumented_libs": {
         "url": "https://chromium.googlesource.com/chromium/third_party/instrumented_libraries.git",
@@ -367,8 +367,8 @@
       },
       "src/third_party/libgav1/src": {
         "url": "https://chromium.googlesource.com/codecs/libgav1.git",
-        "rev": "40f58ed32ff39071c3f2a51056dbc49a070af0dc",
-        "hash": "sha256-gisU0p0HDL7Po/ZXIIZVOTnxnOuVvSE/FYo9DaEUFfo="
+        "rev": "66ac17620652635392f6ab24065c77b035e281c9",
+        "hash": "sha256-6/zMaX2DPSKpsaqirhrgi3nL/88Qr2VXacmyL5IyJ3U="
       },
       "src/third_party/googletest/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/googletest.git",
@@ -392,8 +392,8 @@
       },
       "src/third_party/jsoncpp/source": {
         "url": "https://chromium.googlesource.com/external/github.com/open-source-parsers/jsoncpp.git",
-        "rev": "42e892d96e47b1f6e29844cc705e148ec4856448",
-        "hash": "sha256-bSLNcoYBz3QCt5VuTR056V9mU2PmBuYBa0W6hFg2m8Q="
+        "rev": "d4d072177213b117fb81d4cfda140de090616161",
+        "hash": "sha256-q+DOwkjRlHacgfWf5UVY02aqfnKK9M/1YRBX6aMce9g="
       },
       "src/third_party/leveldatabase/src": {
         "url": "https://chromium.googlesource.com/external/leveldb.git",
@@ -407,8 +407,8 @@
       },
       "src/third_party/fuzztest/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/fuzztest.git",
-        "rev": "e24a91020ab19c3d6f590bd0911b7acb492f81be",
-        "hash": "sha256-wFjuvJzGEaal+pIo5UtkdLHYTpoWxRE6Vf5OGLObGQk="
+        "rev": "da27bcae1a8902af1ae6a5c55d3674f22709bbf5",
+        "hash": "sha256-317zRhJPc0D9A58W8fdCGFmpNZ5vACfd/tlZOsp/Cvw="
       },
       "src/third_party/domato/src": {
         "url": "https://chromium.googlesource.com/external/github.com/googleprojectzero/domato.git",
@@ -417,18 +417,18 @@
       },
       "src/third_party/libaddressinput/src": {
         "url": "https://chromium.googlesource.com/external/libaddressinput.git",
-        "rev": "e20690c8d5178bb282641d5eb06ef0298ff4cbc5",
-        "hash": "sha256-rX7LQNUgk5ZljUrayD1a/SUrBrvpomW0Cs0KBw3lYu4="
+        "rev": "81eb9628382b07d371d8ea0b11badf7de3857fd5",
+        "hash": "sha256-6yDZpZ+CwxGqNO4+lZLFB6ESREeVku1BoOMtR+hKQ3I="
       },
       "src/third_party/libaom/source/libaom": {
         "url": "https://aomedia.googlesource.com/aom.git",
-        "rev": "33dba9e12a9f12e737eaa7c2624e8c580950a89a",
-        "hash": "sha256-01DbV0kQFg1yyFpVeo82KBoZHhizA7xnZ1qOuu4HTcs="
+        "rev": "137bcff61e73fdd2836dc04e8258bfb49cef595e",
+        "hash": "sha256-oDubKvgqMk3w0luM//rR3NnCOk1h/WVTyRkuCmYASrw="
       },
       "src/third_party/crabbyavif/src": {
         "url": "https://chromium.googlesource.com/external/github.com/webmproject/CrabbyAvif.git",
-        "rev": "c433c9a32320aed983e4106931596fbbae3f77ee",
-        "hash": "sha256-yw1cXB6s6biD2vj2K/3sVbKiaNK7bt+NkbQovbYlJ2Q="
+        "rev": "5e140b5abb9a91eb25b5ef66d29f6ee784ab7eab",
+        "hash": "sha256-tN+2YH2O9FTV50o4OVhKcKdwRwTI8NuNA0WqljUcrmo="
       },
       "src/third_party/nearby/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/nearby-connections.git",
@@ -442,8 +442,8 @@
       },
       "src/third_party/jetstream/main": {
         "url": "https://chromium.googlesource.com/external/github.com/WebKit/JetStream.git",
-        "rev": "de88e36ae91d5bd13126fa4cc4b0e0346d779842",
-        "hash": "sha256-ZpU0ONqIVmY2VR0MxqtYj8KPNlK0L21gLJuT/Ff7KI8="
+        "rev": "b7babdf323e64e69bd2f6c376189c15825f5c73a",
+        "hash": "sha256-s6UMdUYWZqk/MbhyCi2zdQNgni98gGsYxcuUh/5AUy0="
       },
       "src/third_party/jetstream/v2.2": {
         "url": "https://chromium.googlesource.com/external/github.com/WebKit/JetStream.git",
@@ -482,8 +482,8 @@
       },
       "src/third_party/cros-components/src": {
         "url": "https://chromium.googlesource.com/external/google3/cros_components.git",
-        "rev": "e580888fcc1c108e25c218ccf8b7a4372de18d57",
-        "hash": "sha256-p0Wfvhg/j8v9xL9Pueo7xPVHBKowOLI00AeIZXPQw4k="
+        "rev": "0abb2efaa3d16db861c9710b193c39e657ac3bdf",
+        "hash": "sha256-viuntf6umyLZwDR9BXG+ZOakp9f8rvpZYDBYAUkKzL4="
       },
       "src/third_party/libdrm/src": {
         "url": "https://chromium.googlesource.com/chromiumos/third_party/libdrm.git",
@@ -492,8 +492,8 @@
       },
       "src/third_party/expat/src": {
         "url": "https://chromium.googlesource.com/external/github.com/libexpat/libexpat.git",
-        "rev": "f31adfd584b7f6c50bbf4d22eb928538ffc9145a",
-        "hash": "sha256-tLz4RejYQ/kFXhsWTduuGcinfUkqxYKPCpsou+WlvBc="
+        "rev": "9bdfbc77e3355405ceefbe59420abed953a5657e",
+        "hash": "sha256-veGg5/QjtBSmxYa8IyHF0NxEdJzlcJSZfzw8ay3ASVU="
       },
       "src/third_party/libipp/libipp": {
         "url": "https://chromium.googlesource.com/chromiumos/platform2/libipp.git",
@@ -502,8 +502,8 @@
       },
       "src/third_party/libjpeg_turbo": {
         "url": "https://chromium.googlesource.com/chromium/deps/libjpeg_turbo.git",
-        "rev": "d1f5f2393e0d51f840207342ae86e55a86443288",
-        "hash": "sha256-KGeB/lTjhm8DQBDZVSPENvZEGSHeLTkviJrYsFh5vEM="
+        "rev": "640f254ad0fa03f6b1f29f89b7dd9366f2f6e533",
+        "hash": "sha256-wor4RTF3/5BFL9EWcGEofY+M4HN2+/KJUaOY+u86K5Q="
       },
       "src/third_party/liblouis/src": {
         "url": "https://chromium.googlesource.com/external/liblouis-github.git",
@@ -512,8 +512,8 @@
       },
       "src/third_party/libphonenumber/src": {
         "url": "https://chromium.googlesource.com/external/libphonenumber.git",
-        "rev": "ade546d8856475d0493863ee270eb3be9628106b",
-        "hash": "sha256-cLtsM35Ir3iG3j8+Cy2McL1ysRB0Y1PXealAKl05Twg="
+        "rev": "c25558e39e2bcc9f26f7a2a1ef804324169eaf8f",
+        "hash": "sha256-Lr/gB5Em+TE092McPwJdOU0Ab4zyP4/2ZxlavMZMm+s="
       },
       "src/third_party/libprotobuf-mutator/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/libprotobuf-mutator.git",
@@ -537,8 +537,8 @@
       },
       "src/third_party/libvpx/source/libvpx": {
         "url": "https://chromium.googlesource.com/webm/libvpx.git",
-        "rev": "d1268a5f3f3553ad7735911c614e8548381ca3cd",
-        "hash": "sha256-6IZTDhtjVWiqTv+jUC6Wr/tSqvql3thi9+mt+M3ixt4="
+        "rev": "5f00413667d19ad683674524a9d03543d86d188b",
+        "hash": "sha256-uTteQ+z7t5KOtPuBoZazmonRHd8jGS1/YZAq+RAvhX4="
       },
       "src/third_party/libwebm/source": {
         "url": "https://chromium.googlesource.com/webm/libwebm.git",
@@ -552,8 +552,8 @@
       },
       "src/third_party/libyuv": {
         "url": "https://chromium.googlesource.com/libyuv/libyuv.git",
-        "rev": "644251f252a84bf8ce91ff0aca86a9b16b069ab8",
-        "hash": "sha256-DsoOY8bg0sPOF8tF67Gk7fRqdQzG1hc9fVMlZVjKWU4="
+        "rev": "3c5fa6ef272f6077d76816ee3d6a697ef1d6d272",
+        "hash": "sha256-FXFSC9dRb/KhSQdhJUqKEUpZbzU8ZpVnoSXtF/HPiJI="
       },
       "src/third_party/lss": {
         "url": "https://chromium.googlesource.com/linux-syscall-support.git",
@@ -572,8 +572,8 @@
       },
       "src/third_party/nasm": {
         "url": "https://chromium.googlesource.com/chromium/deps/nasm.git",
-        "rev": "358842b6b7dd69b2ed635bef17f941e030a05e5f",
-        "hash": "sha256-YwjwubijMZ9OvYeMUVMSunWZ2VCuqUFEOyv/MK/oojc="
+        "rev": "525a09a813be0f75b646ee93fc2a31c27b87d722",
+        "hash": "sha256-uC6bGxSdz1V2SXIQjMsDd6555b3gAPN1Y0ZQtWoqDww="
       },
       "src/third_party/neon_2_sse/src": {
         "url": "https://chromium.googlesource.com/external/github.com/intel/ARM_NEON_2_x86_SSE.git",
@@ -587,8 +587,8 @@
       },
       "src/third_party/openscreen/src": {
         "url": "https://chromium.googlesource.com/openscreen",
-        "rev": "684bcd767271a21f3e5d475b17a0fd862f16c65e",
-        "hash": "sha256-Yjz2E1/h+zp7L2x0zE0l+ktQIiSrJ4ZknXOhaVPKQVE="
+        "rev": "37ff938a93cb04c6b77e019b52328c8e9b320317",
+        "hash": "sha256-M57un/TVQPfTnKScVHS1VK1cUs8F/YPT3TwMVdo+mhM="
       },
       "src/third_party/openscreen/src/buildtools": {
         "url": "https://chromium.googlesource.com/chromium/src/buildtools",
@@ -602,13 +602,13 @@
       },
       "src/third_party/pdfium": {
         "url": "https://pdfium.googlesource.com/pdfium.git",
-        "rev": "be702d63baba7507bb1f6f6ff2d35be9c133c08c",
-        "hash": "sha256-hXqSJn1C0ISLWx68UicggiL8xzgQX2Y8l75vtpJgHeU="
+        "rev": "c052afb72a08d79a26bcf3103d11f344981b09f1",
+        "hash": "sha256-zqfErp0pDXHXIvRpZ1TJu2UGXNZjATRbPgQWTniKTJs="
       },
       "src/third_party/perfetto": {
         "url": "https://chromium.googlesource.com/external/github.com/google/perfetto.git",
-        "rev": "97c58a94bb6495c4e202467fb1c55eaa22b5670f",
-        "hash": "sha256-qtClkWAluLDRZn7yrHLU7qp9szP+/WsiG5JZZzRKd38="
+        "rev": "9ede949f025303868fa0c42418f122ac47312539",
+        "hash": "sha256-IRzEqgunO4Nfz+FkYir8G/Ht+Zsn6wpzncgkEFpsC+k="
       },
       "src/third_party/protobuf-javascript/src": {
         "url": "https://chromium.googlesource.com/external/github.com/protocolbuffers/protobuf-javascript",
@@ -617,8 +617,8 @@
       },
       "src/third_party/pthreadpool/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/pthreadpool.git",
-        "rev": "a56dcd79c699366e7ac6466792c3025883ff7704",
-        "hash": "sha256-WfyuPfII4eSmLskZV0TAcu4K6OyW38TjkDHm+VUx5eY="
+        "rev": "02460584c6092e527c8b89f7df4de143d70e801f",
+        "hash": "sha256-4EHJzZT+Gbhs8SkOhjSvDIPEqIQU93oJmtF3c/T+qjw="
       },
       "src/third_party/pyelftools": {
         "url": "https://chromium.googlesource.com/chromiumos/third_party/pyelftools.git",
@@ -647,13 +647,18 @@
       },
       "src/third_party/search_engines_data/resources": {
         "url": "https://chromium.googlesource.com/external/search_engines_data.git",
-        "rev": "2345fee6ce4ae24d9c365d5c0884ece593c55c67",
-        "hash": "sha256-5qkra6FURaMvEOk+ZKMRH1hc8ixEnk3u4rxNm0G8tuQ="
+        "rev": "1aab872af8d44dcf59362d7ba8255922f74fafde",
+        "hash": "sha256-5/XnNx6Pyk4KBb9krVo9u6i7LWNrsLLOIi4qhEY2PZc="
+      },
+      "src/third_party/sframe/src": {
+        "url": "https://chromium.googlesource.com/external/github.com/cisco/sframe",
+        "rev": "b14090904433bed0d4ec3f875b9b39f3e0555930",
+        "hash": "sha256-bw+6ycUpnFZJhtXFUzr7XTOljNrs+7oFdVY+LN0Rqek="
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "75c589e1f436688fca8f5b7f7a8affeafaa4f923",
-        "hash": "sha256-x0jEek7iJv7WBNdkOUPc5VvIYJw9QPzzTChFUofqErM="
+        "rev": "14d05ec761901b6e9e9193af8b347ab3a7f6fed0",
+        "hash": "sha256-KZGrztOKaT368KSCxiJAqnsgINpNODUlaXnH/maQNIA="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -667,13 +672,13 @@
       },
       "src/third_party/sqlite/src": {
         "url": "https://chromium.googlesource.com/chromium/deps/sqlite.git",
-        "rev": "508ab21dc25702ed6690c4dd77da209a6bcd1239",
-        "hash": "sha256-SfvLfBKdPjFvZ7CzUeFMcyoHdCzQgNRQwZyzb6MRtJg="
+        "rev": "fc121d7d03cd6cbf499ec06a5112b263471b1181",
+        "hash": "sha256-hf9PxQhXEKT49GbkFYCvRPBT0Qu+hDnDpebI92yO1Oo="
       },
       "src/third_party/swiftshader": {
         "url": "https://swiftshader.googlesource.com/SwiftShader.git",
-        "rev": "f9d5d49a3c599a315e3493dc1e9b5309cffb3305",
-        "hash": "sha256-kBfqgXXJeEPT80mu6CJ2Bwmdv/y8jVzM6TedMXbzo4o="
+        "rev": "fce27a96526f54c6d31fdccf57629788e3712220",
+        "hash": "sha256-bmXZLpz3wv7eQWoqTjZmjwnnILWSIjZ8iqo8CeLk5fw="
       },
       "src/third_party/text-fragments-polyfill/src": {
         "url": "https://chromium.googlesource.com/external/github.com/GoogleChromeLabs/text-fragments-polyfill.git",
@@ -682,23 +687,23 @@
       },
       "src/third_party/tflite/src": {
         "url": "https://chromium.googlesource.com/external/github.com/tensorflow/tensorflow.git",
-        "rev": "2216f531fb72119745382c62f232acf9790f4b6e",
-        "hash": "sha256-zySLNPmug5HS5pwJ/lEMAWjjZSOuxdTgup7Y90k7NZI="
+        "rev": "999d49c10046e240cd5366d349d3a5f6af16a0d4",
+        "hash": "sha256-eSqaWXtzZ4Bi9ilaJYGdZamzUjmo+AtDZ9KeZhsc/fY="
       },
       "src/third_party/litert/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google-ai-edge/LiteRT.git",
-        "rev": "9b5418dd7a1a318eed20395743dcc868df17d8b0",
-        "hash": "sha256-80amwDPF3RrcoTaTQsunNmlvBGs6KCv369FW3J/Xcts="
+        "rev": "09b4b05203fd7a9402ffcce9cc736d887ff7e3fc",
+        "hash": "sha256-skMOzpsn67mmOAp7Mf6UrJdi2lbiQQ8b6kBy4Ik2ED8="
       },
       "src/third_party/vulkan-deps": {
         "url": "https://chromium.googlesource.com/vulkan-deps",
-        "rev": "d234b7b29748c07ef389279dd24f533ebd04cadc",
-        "hash": "sha256-w49HOjPixSI/C5IGlxQMj/Ol9f/Lr2zI2oMhQzzu1zk="
+        "rev": "669a28b1f31f89bfc46b74791f127bcc5e5b2f06",
+        "hash": "sha256-lsR+sh+XQP/wKgkBbie6Gp+kQNFnnC8TeNWpiWTdevw="
       },
       "src/third_party/glslang/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/glslang",
-        "rev": "458ff50a67cb69371850068a62b78f1990a1ff9a",
-        "hash": "sha256-2WauVjAEeZn16b4fE4ImKPX3wjDmeN92mqWi3NMiXSw="
+        "rev": "f6d9303ddaf2e879b9155f7186cd234f5a79079c",
+        "hash": "sha256-ru3QVyyyqxZRcvSpy9pYhHHhkjuLVhQbgOT/vQJ/oIw="
       },
       "src/third_party/spirv-cross/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Cross",
@@ -707,43 +712,43 @@
       },
       "src/third_party/spirv-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Headers",
-        "rev": "126038020c2bd47efaa942ccc364ca5353ffccde",
-        "hash": "sha256-QBX2M+ZSWgVvCx58NeDIdf6mIkdJbecDktBfUWGPvNc="
+        "rev": "1e770e7de8373a8dd49f23416cf7ca4001d01040",
+        "hash": "sha256-t8Shkoa90TJt1MbTOefnLaguW4eYKsRFO1Jd0AUc70Y="
       },
       "src/third_party/spirv-tools/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Tools",
-        "rev": "2ec8457ab33d539b6f1fecc998360c0b8b05ed4f",
-        "hash": "sha256-9TBb/gnDXgZRZXhF27KEQ0XQI5itRHKJQjLrkFDQq7Q="
+        "rev": "b38c4f83024546d4000b2db8e2294cf81b7f26e0",
+        "hash": "sha256-q5G4B75xBIXl1aG/vzbIDrc3Hs/MFoQ4nwh4ozb8hys="
       },
       "src/third_party/vulkan-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Headers",
-        "rev": "f6a6f7ab165cedbfa2a7d0c93fe27a2d01ce09c8",
-        "hash": "sha256-ZbjmxbRUiVJADNRWziCH0UIM09qKf+lm9PRnWOhZFhQ="
+        "rev": "015e25c3c91b70eb1a754d36fb14c4ba6ad9b0b9",
+        "hash": "sha256-pUxPwFGbOzP8ymTooeA1slFWEFsRoqUROSnndVtLiY8="
       },
       "src/third_party/vulkan-loader/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Loader",
-        "rev": "15a84652b94e465e9a7b25eb507193929863bc2f",
-        "hash": "sha256-pdC3YCM0Nzeabi5TPD+qR5PVdsxmWMnf2L9HsOcbv84="
+        "rev": "cf0cf82ea16c0ff0be75940f282540d6085b2d3b",
+        "hash": "sha256-uyoysS7lSBNDRfvcwPT+gQqhE20UxiYUEw1UXnYS3fY="
       },
       "src/third_party/vulkan-tools/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Tools",
-        "rev": "7c46da2b39036a80ce088576d5794bf39e667f56",
-        "hash": "sha256-nAyNVveeGg9sA0E37YiEPm+UdKsy48nAOjnUYHQnuqw="
+        "rev": "e3d18f90c0b8ef1f52539e0674a42f0adfe30381",
+        "hash": "sha256-Hs9N0FM3eWWjLm4BrDJoZIrsPDVFx0iRAJeQ4gHTM7o="
       },
       "src/third_party/vulkan-utility-libraries/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Utility-Libraries",
-        "rev": "2c909c1ab6f9c6caba39a84a4887186b3fafdead",
-        "hash": "sha256-k3xeKHQbd2rTQJsOZKXEMPrYjcHwoCC1N12F6AIP6Ho="
+        "rev": "8383c46b129c2b3a5f3833e602d946d2fcc57e39",
+        "hash": "sha256-ZBie5uDTVEehxRQW1GZY5Ki/bnp82LoW3jfMUFL0O9A="
       },
       "src/third_party/vulkan-validation-layers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-ValidationLayers",
-        "rev": "b105d8ea361af258abed65efb5a1565c031dcf1c",
-        "hash": "sha256-GgznBGYgnCFMNaqAOQ15dlw2dOFfSp3mAV2KokVLzgk="
+        "rev": "044eaba8a34a6e3bfb1d6aafac7c01068813a2b6",
+        "hash": "sha256-i3hochkK0LZPg8CsZMFkAL+8tf8QuuwtApAc4FDd0RM="
       },
       "src/third_party/vulkan_memory_allocator": {
         "url": "https://chromium.googlesource.com/external/github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator.git",
-        "rev": "cb0597213b0fcb999caa9ed08c2f88dc45eb7d50",
-        "hash": "sha256-yBCs3zfqs/60htsZAOscjcyKhVbAWE6znweuXcs1oKo="
+        "rev": "7e55b011e16182fc349149abbd3aaf3b1db46421",
+        "hash": "sha256-fOnFkcQDEGIe5yB507qnP9nA1LBBPFblncNiJ8JxAwI="
       },
       "src/third_party/wayland/src": {
         "url": "https://chromium.googlesource.com/external/anongit.freedesktop.org/git/wayland/wayland.git",
@@ -777,18 +782,23 @@
       },
       "src/third_party/webgpu-cts/src": {
         "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts.git",
-        "rev": "3b327ebc44f11212fd3872972a6dd394634fb9e3",
-        "hash": "sha256-RSZVKv2Z0pg2cGa3Elr2r5VZqdxlRJ+6mzm1Au1qg1I="
+        "rev": "b507bd117e53db86f2fb52d0d858d3ae7d684a85",
+        "hash": "sha256-6Y5Z0ErtsZdbuWTHa+PEiOxcZSbjBcnuOHbgtI1/+80="
       },
       "src/third_party/webpagereplay": {
         "url": "https://chromium.googlesource.com/webpagereplay.git",
-        "rev": "b7ac48f52cd298e966a76eb054412915c3e445d4",
-        "hash": "sha256-smtwB6vzLgCAePz0jNfrpm8TxrxBnBkigLxERhxUEvE="
+        "rev": "b2b856131e36c99e9de9c419fe8ca02f857082ba",
+        "hash": "sha256-+hcaP7C5Eh3SLl5B8mRgOVdM/tvnFnb/oqUIWPoe0NA="
+      },
+      "src/third_party/webpagereplay/third_party/clang-format/script": {
+        "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/clang/tools/clang-format.git",
+        "rev": "6eddfb5ec5f92127a531eda66c568d3a11e7ec11",
+        "hash": "sha256-Cm6BOOlEyD0kdYxMSmk6Fj1Dnfs3zCzXsm+BOXgBme0="
       },
       "src/third_party/webrtc": {
         "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "28311abc149a9bb7e6761a3d54f362a8d77e6793",
-        "hash": "sha256-WuaxKrbISJ1nwyoj2sPAhGCNz33xEYSX1WlDiM+zxpw="
+        "rev": "1f975dfd761af6e5d76d28333191973b258d82a8",
+        "hash": "sha256-ucH+9HBkFyOKEItAWVoYmEzyU7h/UgWIvp/eC/JqGWU="
       },
       "src/third_party/wuffs/src": {
         "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -802,8 +812,8 @@
       },
       "src/third_party/xnnpack/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/XNNPACK.git",
-        "rev": "2ad25fc09167df69c6c02eb8082a0b9658dd5e80",
-        "hash": "sha256-vBMGBXzJPCcsc2kMyGecjti68oZHWUwJKd7tkKub6kg="
+        "rev": "56ac34b3f45fae2eca1f32584f7f0b279be2cf1f",
+        "hash": "sha256-uw3r5g5rWamlFubBkXDb4KRx3hkOAoQyFo8l95GYGZI="
       },
       "src/third_party/libei/src": {
         "url": "https://chromium.googlesource.com/external/gitlab.freedesktop.org/libinput/libei.git",
@@ -812,13 +822,18 @@
       },
       "src/third_party/zstd/src": {
         "url": "https://chromium.googlesource.com/external/github.com/facebook/zstd.git",
-        "rev": "3ae099b48dfcfe02b1b3ba81ab85457f8a922e9f",
-        "hash": "sha256-futF0sM6z9HAl6AMJwUULBRByN92FTBjRIzYb2vBFGg="
+        "rev": "5233c58e6ca0b1c4c6b353ad79649191ed195bdc",
+        "hash": "sha256-vEl0s7Mjh+5rciOMxm99PNWiamtCk+sTN4lRYKCIZ+8="
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "933ce636c562cd54d68e7f7c93ab5cdffd685fca",
-        "hash": "sha256-zYArO6QS9nDIVWPINRVaDN1uX8X/wchBDeZHPZnwHYk="
+        "rev": "968f19a8970f8d91702d86f0ec1522f3909781b7",
+        "hash": "sha256-x3rCWvC3hEjyJq6PNThhZEp4oRF9Y1JJEPnZTqVNVrY="
+      },
+      "src/agents/shared": {
+        "url": "https://chromium.googlesource.com/chromium/agents.git",
+        "rev": "e75efa515896f6bf1dea92eaffbcf8ee711a65d8",
+        "hash": "sha256-z2GrzF8jDkdfBdq1HP3gTgQpoqjmhc80kEZBmlue0os="
       }
     }
   },
diff --git a/pkgs/applications/networking/browsers/chromium/patches/chromium-150-rust.patch b/pkgs/applications/networking/browsers/chromium/patches/chromium-150-rust.patch
new file mode 100644
index 000000000000..113097a87be8
--- /dev/null
+++ b/pkgs/applications/networking/browsers/chromium/patches/chromium-150-rust.patch
@@ -0,0 +1,21 @@
+diff --git a/build/config/compiler/BUILD.gn b/build/config/compiler/BUILD.gn
+index e1da11405c1f667280099ee815abc5349d1ad1bd..202992dbbe1c2a70eb6d8b559568d388f98b28f6 100644
+--- a/build/config/compiler/BUILD.gn
++++ b/build/config/compiler/BUILD.gn
+@@ -1678,16 +1678,6 @@ config("runtime_library") {
+     configs += [ "//build/config/c++:runtime_library" ]
+   }
+ 
+-  # Rust and C++ both provide intrinsics for LLVM to call for math operations.
+-  # We want to use the C++ intrinsics, not the ones in the Rust
+-  # compiler_builtins library. The Rust symbols are marked as weak, so that they
+-  # can be replaced by the C++ symbols. This config ensures the C++ symbols
+-  # exist and are strong in order to cause that replacement to occur by
+-  # explicitly linking in clang's compiler-rt library.
+-  if (is_clang && !(is_a_target_toolchain && is_cronet_build)) {
+-    configs += [ "//build/config/clang:compiler_builtins" ]
+-  }
+-
+   # TODO(crbug.com/40570904): Come up with a better name for is POSIX + Fuchsia
+   # configuration.
+   if (is_posix || is_fuchsia) {
diff --git a/pkgs/applications/networking/browsers/chromium/patches/chromium-150-widevine-disable-auto-download-allow-bundle.patch b/pkgs/applications/networking/browsers/chromium/patches/chromium-150-widevine-disable-auto-download-allow-bundle.patch
new file mode 100644
index 000000000000..84926ab177b3
--- /dev/null
+++ b/pkgs/applications/networking/browsers/chromium/patches/chromium-150-widevine-disable-auto-download-allow-bundle.patch
@@ -0,0 +1,27 @@
+diff --git a/third_party/widevine/cdm/BUILD.gn b/third_party/widevine/cdm/BUILD.gn
+index 6d18f9fa163718d95610de9b6229dd38478543c7..93884543edcaa7211f4a7d61175bc068c6fd7dd4 100644
+--- a/third_party/widevine/cdm/BUILD.gn
++++ b/third_party/widevine/cdm/BUILD.gn
+@@ -19,7 +19,7 @@ buildflag_header("buildflags") {
+ 
+   flags = [
+     "ENABLE_WIDEVINE=$enable_widevine",
+-    "BUNDLE_WIDEVINE_CDM=$bundle_widevine_cdm",
++    "BUNDLE_WIDEVINE_CDM=true",
+     "ENABLE_WIDEVINE_CDM_COMPONENT=$enable_widevine_cdm_component",
+     "ENABLE_MEDIA_FOUNDATION_WIDEVINE_CDM=$enable_media_foundation_widevine_cdm",
+   ]
+diff --git a/third_party/widevine/cdm/widevine.gni b/third_party/widevine/cdm/widevine.gni
+index 927b2e4809cf76e6b3ef51ee6cd2bbd04a92d60b..41761d10a4105a20fc4acf35f761c7ab23f867dd 100644
+--- a/third_party/widevine/cdm/widevine.gni
++++ b/third_party/widevine/cdm/widevine.gni
+@@ -40,8 +40,7 @@ enable_library_widevine_cdm =
+ # Widevine CDM can be deployed as a component. Currently only supported on
+ # desktop platforms. The CDM can be bundled regardless whether it's a
+ # component. See below.
+-enable_widevine_cdm_component =
+-    enable_library_widevine_cdm && (is_win || is_mac || is_linux || is_chromeos)
++enable_widevine_cdm_component = false
+ 
+ # Enable (Windows) Media Foundation Widevine CDM component.
+ declare_args() {
diff --git a/pkgs/applications/networking/cluster/helm/plugins/helm-unittest.nix b/pkgs/applications/networking/cluster/helm/plugins/helm-unittest.nix
index 92ba7b5ddf05..983890fbc3c0 100644
--- a/pkgs/applications/networking/cluster/helm/plugins/helm-unittest.nix
+++ b/pkgs/applications/networking/cluster/helm/plugins/helm-unittest.nix
@@ -2,7 +2,6 @@
   buildGoModule,
   fetchFromGitHub,
   lib,
-  yq-go,
   nix-update-script,
 }:
 
@@ -22,21 +21,29 @@ buildGoModule {
 
   vendorHash = "sha256-4ckjM520MGYb64LbjYURe7AIScm4aGbj81rGKSSYaAo=";
 
-  # NOTE: Remove the install and upgrade hooks.
   postPatch = ''
-    sed -i '/^hooks:/,+2 d' plugin.yaml
+    # Remove the install and upgrade hooks.
+    sed -i '/^platformHooks:[[:space:]]*$/,/^[^[:space:]]/d' plugin.yaml
+    # Remove the per-platform commands
+    sed -i '/^platformCommand:[[:space:]]*$/,/^[^[:space:]]/d' plugin.yaml
+    # Add a simple runtime config
+    cat <<'EOF' >> ./plugin.yaml
+    platformCommand:
+      - command: "''$HELM_PLUGIN_DIR/helm-unittest"
+    EOF
   '';
 
-  postInstall = ''
-    install -dm755 $out/helm-unittest
-    mv $out/bin/helm-unittest $out/helm-unittest/untt
-    rmdir $out/bin
-    install -m644 -Dt $out/helm-unittest plugin.yaml
-  '';
+  subPackages = [ "cmd/helm-unittest" ];
 
-  nativeCheckInputs = [
-    yq-go
-  ];
+  installPhase = ''
+    runHook preInstall
+
+    install -dm755 "$out/helm-unittest"
+    install -m755 -Dt "$out/helm-unittest" "$GOPATH/bin/helm-unittest"
+    install -m644 -Dt "$out/helm-unittest" ./plugin.yaml
+
+    runHook postInstall
+  '';
 
   passthru = {
     updateScript = nix-update-script { };
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 59451136a9d6..a0ef1151b227 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -355,11 +355,11 @@
     "vendorHash": null
   },
   "dopplerhq_doppler": {
-    "hash": "sha256-vYLNRSk8U9Ez5+LrC9cr6Ux32p7n93WOJaM4lY7ghE0=",
+    "hash": "sha256-SS2S4JGG1Xu0p4k6lVlTr173Xanwc6hZ0A3osEWGdEg=",
     "homepage": "https://registry.terraform.io/providers/DopplerHQ/doppler",
     "owner": "DopplerHQ",
     "repo": "terraform-provider-doppler",
-    "rev": "v1.21.3",
+    "rev": "v1.21.4",
     "spdx": "Apache-2.0",
     "vendorHash": "sha256-B8mYLd4VdADWoQLWiCM85VQrBfDdlYQ0wkCp9eUBQ4U="
   },
@@ -968,13 +968,13 @@
     "vendorHash": "sha256-OAd8SeTqTrH0kMoM2LsK3vM2PI23b3gl57FaJYM9hM0="
   },
   "newrelic_newrelic": {
-    "hash": "sha256-sUawDMMhwCo2xqnPNiaRMGKo3rRxNGjLEl2NYwfVuMk=",
+    "hash": "sha256-/y3BdJAwmmR9FHzbYh+2EBAae+WQp5+wubPEh6Tw98s=",
     "homepage": "https://registry.terraform.io/providers/newrelic/newrelic",
     "owner": "newrelic",
     "repo": "terraform-provider-newrelic",
-    "rev": "v3.93.2",
+    "rev": "v3.94.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-fCdwTWYbwuJUh+9WeVN5WmpPxdop49oHZ2cUm3K5w6w="
+    "vendorHash": "sha256-gbkuHyFBc1WUbtDFXnyzUlYdIvyFPwBHd+gg7VPenb4="
   },
   "ns1-terraform_ns1": {
     "hash": "sha256-6w0r6QXm16h4I4PFj80dJhTDbF4FPMjJalO0TfXGBEA=",
diff --git a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
index 21f19b0f1323..f09df527aea4 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@@ -91,8 +91,8 @@ rec {
   thunderbird-140 = common {
     applicationName = "Thunderbird ESR";
 
-    version = "140.12.0esr";
-    sha512 = "ccbcc305d5cc10aa01aa5071f40a21b42de0300d9ad6763c4fc4ad71bf797566f2380c8fd84d46952e7c4eae0a35905173e6906b108192833660eae2ceea7b51";
+    version = "140.12.1esr";
+    sha512 = "24e795483ba7bc112c0debe1becdaf79cc2de95703b9ee726d0216bfc1db7b33c169503f83ac867e5998a8d1d0284a6ef12c7d35d98b10d6432497c2db237477";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-140";
diff --git a/pkgs/applications/window-managers/hyprwm/xdg-desktop-portal-hyprland/default.nix b/pkgs/applications/window-managers/hyprwm/xdg-desktop-portal-hyprland/default.nix
index 27dc09810161..c0da66554a81 100644
--- a/pkgs/applications/window-managers/hyprwm/xdg-desktop-portal-hyprland/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/xdg-desktop-portal-hyprland/default.nix
@@ -7,6 +7,7 @@
   pkg-config,
   wrapQtAppsHook,
   nix-update-script,
+  grim,
   hyprland,
   hyprland-protocols,
   hyprlang,
@@ -81,7 +82,12 @@ stdenv.mkDerivation (finalAttrs: {
       }
 
     wrapProgramShell $out/libexec/xdg-desktop-portal-hyprland \
-      --prefix PATH ":" ${lib.makeBinPath [ (placeholder "out") ]}
+      --prefix PATH ":" ${
+        lib.makeBinPath [
+          (placeholder "out")
+          grim
+        ]
+      }
   '';
 
   passthru = {
diff --git a/pkgs/by-name/_4/_4ti2/package.nix b/pkgs/by-name/_4/_4ti2/package.nix
index 775a034e64e0..f55cec22d687 100644
--- a/pkgs/by-name/_4/_4ti2/package.nix
+++ b/pkgs/by-name/_4/_4ti2/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "4ti2";
-  version = "1.6.14";
+  version = "1.6.15";
 
   src = fetchFromGitHub {
     owner = "4ti2";
     repo = "4ti2";
     tag = "Release_${builtins.replaceStrings [ "." ] [ "_" ] finalAttrs.version}";
-    hash = "sha256-bFvq90hLLGty7p6NLxOARVvKdizg3bp2NkP9nZpVFzQ=";
+    hash = "sha256-6X8zNp68KlKxplg1rdcotmXyIZE27POJs9/3n2BZLZE=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/aa/aaa/package.nix b/pkgs/by-name/aa/aaa/package.nix
index b9c5e18dc0d7..64bf894ee5a4 100644
--- a/pkgs/by-name/aa/aaa/package.nix
+++ b/pkgs/by-name/aa/aaa/package.nix
@@ -6,19 +6,19 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "aaa";
-  version = "1.1.1";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "asciimoth";
     repo = "aaa";
-    tag = "v${finalAttrs.version}";
-    sha256 = "sha256-gIOlPjZOcmVLi9oOn4gBv6F+3Eq6t5b/3fKzoFqxclw=";
+    tag = "${finalAttrs.version}";
+    sha256 = "sha256-z8PXkX6Bh3oD8tRf+tsLJHbx5wIz2mBYhJSEL88hBDc=";
   };
 
-  cargoHash = "sha256-CHX+Ugy4ND36cpxNEFpnqid6ALHMPXmfXi+D4aktPRk=";
+  cargoHash = "sha256-dt3nbVS8i075O8m9x+FsDi3VeihVKVIV0wnPqyYUaIk=";
 
   meta = {
-    description = "Terminal viewer for 3a format";
+    description = "Swiss Army knife for animated ascii art";
     homepage = "https://github.com/asciimoth/aaa";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ asciimoth ];
diff --git a/pkgs/by-name/ab/abtop/package.nix b/pkgs/by-name/ab/abtop/package.nix
new file mode 100644
index 000000000000..725caaea0152
--- /dev/null
+++ b/pkgs/by-name/ab/abtop/package.nix
@@ -0,0 +1,36 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "abtop";
+  version = "0.5.1";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "graykode";
+    repo = "abtop";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-2m0FYv2HouFqnmDaG6ounc8VJxlEK3N3uTBZyNiFwzI=";
+  };
+
+  cargoHash = "sha256-0sAjql2pH41dHdmV0uC4jjj6J1OFjMdEY1B+4C4id3Y=";
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Like htop, but for AI coding agents";
+    homepage = "https://github.com/graykode/abtop";
+    changelog = "https://github.com/graykode/abtop/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ Br1ght0ne ];
+    mainProgram = "abtop";
+  };
+})
diff --git a/pkgs/by-name/ac/acli/sources.json b/pkgs/by-name/ac/acli/sources.json
index ebc68bc98fb4..bd8c679ff957 100644
--- a/pkgs/by-name/ac/acli/sources.json
+++ b/pkgs/by-name/ac/acli/sources.json
@@ -1,21 +1,21 @@
 {
-  "version": "1.3.20-stable",
+  "version": "1.3.21-stable",
   "sources": {
     "aarch64-darwin": {
-      "url": "https://acli.atlassian.com/darwin/1.3.20-stable/acli_1.3.20-stable_darwin_arm64.tar.gz",
-      "sha256": "5fca5f021b8202f77f60ecc0ded293fb4af67afdb462ed20dce990cfedc49517"
+      "url": "https://acli.atlassian.com/darwin/1.3.21-stable/acli_1.3.21-stable_darwin_arm64.tar.gz",
+      "sha256": "39687d1c18054736f7264d76d33ceb89e8ebf480fbbba9541d9fefdda94ded66"
     },
     "aarch64-linux": {
-      "url": "https://acli.atlassian.com/linux/1.3.20-stable/acli_1.3.20-stable_linux_arm64.tar.gz",
-      "sha256": "2209f6ab1f7fb4c16247e30115d0ff7c1511161aeae4d166e0e79ec81125a4b1"
+      "url": "https://acli.atlassian.com/linux/1.3.21-stable/acli_1.3.21-stable_linux_arm64.tar.gz",
+      "sha256": "b6104cd1737613fe4b24c20619965bb59b7b9bc09e39fb95f41a671b2b320ab8"
     },
     "x86_64-darwin": {
-      "url": "https://acli.atlassian.com/darwin/1.3.20-stable/acli_1.3.20-stable_darwin_amd64.tar.gz",
-      "sha256": "4b9c4faa0d635b6e9194b101d4826b26cd6a15c46313f6a5f9436e20e8a48b78"
+      "url": "https://acli.atlassian.com/darwin/1.3.21-stable/acli_1.3.21-stable_darwin_amd64.tar.gz",
+      "sha256": "75f08d45886f770117405bb5b053bfa4c8e98045afe3dfa965905fabd8825f5c"
     },
     "x86_64-linux": {
-      "url": "https://acli.atlassian.com/linux/1.3.20-stable/acli_1.3.20-stable_linux_amd64.tar.gz",
-      "sha256": "4e0190233a58276001a3cdff23e4be5e30844f98c639c49cfdeb581b9eb147aa"
+      "url": "https://acli.atlassian.com/linux/1.3.21-stable/acli_1.3.21-stable_linux_amd64.tar.gz",
+      "sha256": "f158f6e8f6ae7e279d1ced8ce85a93647aa70c42c29f0d5ad303ebd3c727f956"
     }
   }
 }
diff --git a/pkgs/by-name/ad/adscan/package.nix b/pkgs/by-name/ad/adscan/package.nix
index 80646c0ab464..03e840cd3223 100644
--- a/pkgs/by-name/ad/adscan/package.nix
+++ b/pkgs/by-name/ad/adscan/package.nix
@@ -7,7 +7,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "adscan";
-  version = "9.1.1";
+  version = "9.2.0";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -16,7 +16,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "ADScanPro";
     repo = "adscan";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lVoDPRw2NQBQJo37uKT807HXN28cDFxiWwedTiYhojc=";
+    hash = "sha256-28v36+sbgt/xaE8N7w4o0WTMYd95QsW190VPhOgL3+8=";
   };
 
   pythonRelaxDeps = [ "credsweeper" ];
diff --git a/pkgs/by-name/al/allure/package.nix b/pkgs/by-name/al/allure/package.nix
index 0c85aa04c277..3f265620777a 100644
--- a/pkgs/by-name/al/allure/package.nix
+++ b/pkgs/by-name/al/allure/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "allure";
-  version = "2.43.0";
+  version = "2.44.0";
 
   src = fetchurl {
     url = "https://github.com/allure-framework/allure2/releases/download/${finalAttrs.version}/allure-${finalAttrs.version}.tgz";
-    hash = "sha256-Hrp4vTrtdPNSRpMVCdQKBg9v8He6VyhHiThGiPMQdsg=";
+    hash = "sha256-cCGpCCjADNbsmSAnzOSOipS9h/rUPQwtysR5XK3BeNc=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/am/amp-cli/package.nix b/pkgs/by-name/am/amp-cli/package.nix
index d74fdc80035b..783ddb154cfb 100644
--- a/pkgs/by-name/am/amp-cli/package.nix
+++ b/pkgs/by-name/am/amp-cli/package.nix
@@ -27,7 +27,7 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "amp-cli";
-  version = "0.0.1782120930-g64087b";
+  version = "0.0.1782851652-gfd0e56";
 
   src = finalAttrs.passthru.sources.${stdenvNoCC.hostPlatform.system};
 
@@ -78,10 +78,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
         url = "https://static.ampcode.com/cli/${finalAttrs.version}/amp-${platform}.gz";
         hash =
           {
-            x86_64-linux = "sha256-Ye1ch/mmhFelSv77Yy+fbpiBUlXzInACp2Hux+CLQzk=";
-            aarch64-linux = "sha256-cGV6tqiaHDjSCjhlSgAf0wIcOXY0Y78G2IT0ZQ5uuNk=";
-            x86_64-darwin = "sha256-5UmALYPSfUceumD4puKbMY+VwUsmAojHuu3pNXxVOr4=";
-            aarch64-darwin = "sha256-zzpPWKfYHAEXLNvAucVOwm0HE8Ui3Ai31XMs+utlXF4=";
+            x86_64-linux = "sha256-uLHPYfZyQAj562Zoq9ooTEBuQxCcAPBbsf9plhvn+TQ=";
+            aarch64-linux = "sha256-1hUKxNMJrh3m8G/4BpRrZSWaKTzQajFmtgayv04E5mM=";
+            x86_64-darwin = "sha256-BeQFup4s33TJnIvpsDsgUA9USWrlV+lQdSmR/FSfbis=";
+            aarch64-darwin = "sha256-AfiAUS8KAnGE/a3Q3mZV5Fa0htf2t1HP0LrC9vx1YF0=";
           }
           .${system'};
       }
diff --git a/pkgs/by-name/an/anki/addons/advanced-browser/default.nix b/pkgs/by-name/an/anki/addons/advanced-browser/default.nix
new file mode 100644
index 000000000000..6b1871240da2
--- /dev/null
+++ b/pkgs/by-name/an/anki/addons/advanced-browser/default.nix
@@ -0,0 +1,28 @@
+{
+  lib,
+  anki-utils,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+anki-utils.buildAnkiAddon (finalAttrs: {
+  pname = "advanced-browser";
+  version = "4.5";
+  src = fetchFromGitHub {
+    owner = "AnKing-VIP";
+    repo = "advanced-browser";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-oVL+Y96/d+uD8s6yjz6L7zWV2G6PgP7ZfIiEAAZR2T4=";
+  };
+  passthru.updateScript = nix-update-script { };
+  meta = {
+    description = "Adds more sorting options to the browser";
+    longDescription = ''
+      A general overview of the functionality can be found [here](https://ankiweb.net/shared/info/874215009).
+      The options to configure this add-on can be found [here](https://github.com/AnKing-VIP/advanced-browser/blob/v${finalAttrs.version}/advancedbrowser/config.md).
+    '';
+    homepage = "https://ankiweb.net/shared/info/874215009";
+    downloadPage = "https://github.com/AnKing-VIP/advanced-browser";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ n0pl4c3 ];
+  };
+})
diff --git a/pkgs/by-name/an/anki/addons/default.nix b/pkgs/by-name/an/anki/addons/default.nix
index 7aadfabde19d..7645d7a9967a 100644
--- a/pkgs/by-name/an/anki/addons/default.nix
+++ b/pkgs/by-name/an/anki/addons/default.nix
@@ -4,6 +4,8 @@
 {
   adjust-sound-volume = callPackage ./adjust-sound-volume { };
 
+  advanced-browser = callPackage ./advanced-browser { };
+
   ajt-card-management = callPackage ./ajt-card-management { };
 
   anki-connect = callPackage ./anki-connect { };
diff --git a/pkgs/by-name/au/audiness/package.nix b/pkgs/by-name/au/audiness/package.nix
index ad2e62c31d3d..80fd8022434d 100644
--- a/pkgs/by-name/au/audiness/package.nix
+++ b/pkgs/by-name/au/audiness/package.nix
@@ -17,6 +17,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
   };
 
   pythonRelaxDeps = [
+    "pytenable"
     "typer"
     "validators"
   ];
diff --git a/pkgs/by-name/av/avml/package.nix b/pkgs/by-name/av/avml/package.nix
index bfa33693cb21..4c2153083154 100644
--- a/pkgs/by-name/av/avml/package.nix
+++ b/pkgs/by-name/av/avml/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "avml";
-  version = "0.18.0";
+  version = "0.19.0";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "avml";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-d8H+UPCH3yyBNndlGzamgaPlhmvP4rcUSAywx8vYky0=";
+    hash = "sha256-2oVqweq06pzFVcUVq1lCJ4rGmiZG0A7xq6g1RSwR12M=";
   };
 
-  cargoHash = "sha256-LxoyvjFVn69s9Wf8pF+9wBgOV4fJ/th6GPzLW6hbz0E=";
+  cargoHash = "sha256-40NKzbxNY9t5e7OJnw9Kfvx86YsPAolcezeWeFsD0C4=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ];
diff --git a/pkgs/by-name/ba/bambuddy/package.nix b/pkgs/by-name/ba/bambuddy/package.nix
new file mode 100644
index 000000000000..f18e9781c66f
--- /dev/null
+++ b/pkgs/by-name/ba/bambuddy/package.nix
@@ -0,0 +1,121 @@
+{
+  fetchFromGitHub,
+  buildNpmPackage,
+  python3,
+  stdenv,
+  makeWrapper,
+  lib,
+  ffmpeg,
+}:
+let
+  version = "0.2.4.8";
+
+  src = fetchFromGitHub {
+    owner = "maziggy";
+    repo = "bambuddy";
+    tag = "v${version}";
+    hash = "sha256-6qeIidvi62NUok7I9UQ8DblT0/Wscju4FMnVuPXzMdM=";
+  };
+
+  frontend = buildNpmPackage {
+    pname = "bambuddy-frontend";
+    inherit version src;
+
+    sourceRoot = "${src.name}/frontend";
+    npmDepsHash = "sha256-/22FkXus5f3wYivyadZWU6ZKPYFLF8xA8mkVGxvdXm0=";
+
+    preBuild = "chmod -R u+w ../static";
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out
+      cp -r ../static/. $out/
+
+      runHook postInstall
+    '';
+  };
+
+  # https://github.com/maziggy/bambuddy/blob/main/requirements.txt
+  python = python3.withPackages (
+    ps: with ps; [
+      aiofiles
+      aioftp
+      aiosqlite
+      asyncpg
+      asyncssh
+      bcrypt
+      cryptography
+      curl-cffi
+      defusedxml
+      fastapi
+      fast-simplification
+      greenlet
+      httpx
+      ldap3
+      lxml
+      matplotlib
+      networkx
+      numpy
+      opencv4
+      openpyxl
+      paho-mqtt
+      passlib
+      pillow
+      psutil
+      pydantic
+      pydantic-settings
+      pyftpdlib
+      pyjwt
+      pyopenssl
+      pyotp
+      python-multipart
+      pywebpush
+      qrcode
+      reportlab
+      sqlalchemy
+      trimesh
+      uvicorn
+      websockets
+    ]
+  );
+in
+stdenv.mkDerivation {
+  pname = "bambuddy";
+  inherit version src;
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib/bambuddy
+    cp -r . $out/lib/bambuddy/
+
+    rm -rf $out/lib/bambuddy/static
+    ln -s ${frontend} $out/lib/bambuddy/static
+
+    mkdir -p $out/bin
+
+    makeWrapper ${lib.getExe' python "uvicorn"} $out/bin/bambuddy \
+      --chdir "$out/lib/bambuddy" \
+      --prefix PYTHONPATH : "$out/lib/bambuddy" \
+      --prefix PATH : ${ffmpeg}/bin \
+      --add-flags "backend.app.main:app"
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Self-hosted command center for Bambu Lab";
+    homepage = "https://bambuddy.cool/";
+    changelog = "https://github.com/maziggy/bambuddy/blob/v${version}/CHANGELOG.md";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ onatustun ];
+    mainProgram = "bambuddy";
+    platforms = with lib.platforms; linux ++ darwin;
+  };
+}
diff --git a/pkgs/by-name/be/bencher-cli/package.nix b/pkgs/by-name/be/bencher-cli/package.nix
new file mode 100644
index 000000000000..4145952c6736
--- /dev/null
+++ b/pkgs/by-name/be/bencher-cli/package.nix
@@ -0,0 +1,80 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  mold,
+  nix-update-script,
+  versionCheckHook,
+  rustc,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "bencher-cli";
+  version = "0.6.8";
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "bencherdev";
+    repo = "bencher";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-MlRj56QXRrvfBxi6+B6vpEKlDWMFB+V1CzQYOiGFpHE=";
+  };
+
+  cargoHash = "sha256-biCHEePgVxrnGUj94bwWrp9GVhspiMjcMRdp3A7O2h0=";
+
+  nativeBuildInputs = [ mold ];
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  cargoBuildFlags = [ "--package=bencher_cli" ];
+  cargoTestFlags = [ "--package=bencher_cli" ];
+  # Build the open-source version
+  buildNoDefaultFeatures = true;
+  checkNoDefaultFeatures = finalAttrs.buildNoDefaultFeatures;
+
+  postPatch = lib.optionalString finalAttrs.buildNoDefaultFeatures ''
+    # Replaces the proprietary Rust files with empty files
+    # This is just a safeguard, the build shouldn't touch these files anyways
+    echo "find . -path '*/plus/*' -type f ! -name Cargo.toml -exec truncate -s 0 {} +"
+    find . -path '*/plus/*' -type f ! -name Cargo.toml -exec truncate -s 0 {} +
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Command-Line interface for the Bencher continuous benchmarking platform";
+    mainProgram = "bencher";
+    longDescription = ''
+      Bencher is a suite of continuous benchmarking tools.
+      Bencher allows you to detect and prevent performance regressions
+      *before* they hit production.
+
+      - Run: Run your benchmarks locally or in CI using your favorite
+        benchmarking tools. The bencher CLI simply wraps your existing
+        benchmark harness and stores its results.
+      - Track: Track the results of your benchmarks over time. Monitor, query,
+        and graph the results using the Bencher web console based on the source
+        branch, testbed, benchmark, and measure.
+      - Catch: Catch performance regressions in CI. Bencher uses state of the
+        art, customizable analytics to detect performance regressions before
+        they make it to production.
+
+      Bencher's source repo includes non-free features, included in the build
+      as the Cargo feature "plus".
+      Files in the plus directories are proprietary, while the other files
+      are dual Apache-2.0/MIT licensed.
+      The Nix derivation does not compile the proprietary features.
+    '';
+    homepage = "https://bencher.dev";
+    license =
+      if finalAttrs.buildNoDefaultFeatures then
+        lib.licenses.OR [
+          lib.licenses.asl20
+          lib.licenses.mit
+        ]
+      else
+        lib.licenses.unfree;
+    platforms = rustc.meta.platforms;
+    maintainers = [ lib.maintainers.skyesoss ];
+  };
+})
diff --git a/pkgs/by-name/bi/bitcomet/package.nix b/pkgs/by-name/bi/bitcomet/package.nix
index 515c995451b9..bbcd2a03bc74 100644
--- a/pkgs/by-name/bi/bitcomet/package.nix
+++ b/pkgs/by-name/bi/bitcomet/package.nix
@@ -13,7 +13,7 @@
 
 let
   pname = "bitcomet";
-  version = "2.19.2";
+  version = "2.21.2";
 
   meta = {
     homepage = "https://www.bitcomet.com";
@@ -45,8 +45,8 @@ let
       fetchurl {
         url = "https://download.bitcomet.com/linux/${arch}/BitComet-${version}-${arch}.deb";
         hash = selectSystem {
-          x86_64-linux = "sha256-26hpKNCetqV0whfzNo950EAmK+LKC1RsN5f/9HU9zKs=";
-          aarch64-linux = "sha256-VrrjQ4dcj0XL2xmNspo2mJ+3BVy9vKyVw6QaHkha0LY=";
+          x86_64-linux = "sha256-qHPr4G921W1Pl7n0Wv98yLRbsAkJBrOcyg9kHHjtBGc=";
+          aarch64-linux = "sha256-VC/dvAGmhqlmZT5XB41x/fTGvMZjYCuz/tSp9MYFUHo=";
         };
       };
 
diff --git a/pkgs/by-name/br/breseq/package.nix b/pkgs/by-name/br/breseq/package.nix
new file mode 100644
index 000000000000..589c5ddeed20
--- /dev/null
+++ b/pkgs/by-name/br/breseq/package.nix
@@ -0,0 +1,94 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  callPackage,
+  nix-update-script,
+  libz,
+  libtool,
+  perl,
+  R,
+  bowtie2,
+  which,
+  ghostscript,
+  makeWrapper,
+  autoreconfHook,
+  versionCheckHook,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "breseq";
+  version = "0.39.0";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "barricklab";
+    repo = "breseq";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-DsDX2oGn7Ex50Wnp1phJjCziCzZIeeZOHriUGJbejsk=";
+  };
+
+  buildInputs = [
+    perl
+    libz
+    libtool
+  ];
+
+  nativeBuildInputs = [
+    makeWrapper
+    autoreconfHook
+  ];
+
+  postInstall = ''
+    # Make wrappers
+    wrapProgram $out/bin/breseq --prefix PATH : ${
+      lib.makeBinPath [
+        which
+        ghostscript
+        bowtie2
+        R
+      ]
+    }
+    wrapProgram $out/bin/gdtools --prefix PATH :  ${
+      lib.makeBinPath [
+        which
+        ghostscript
+        bowtie2
+        R
+      ]
+    }
+    # Copy over tests (incl necessary datasets) and license
+    cp LICENSE $out/license
+    mkdir $out/tests
+    mkdir $out/tests/data
+    cp tests/data/tmv_plasmid $out/tests/data/tmv_plasmid -r
+    cp tests/data/lambda $out/tests/data/lambda -r
+    cp tests/common.sh $out/tests/common.sh
+    cp tests/tmv_plasmid_circular_deletion $out/tests/tmv_plasmid_circular_deletion -r
+    cp tests/gdtools_compare_1 $out/tests/gdtools_compare_1 -r
+  '';
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+
+  passthru.tests = {
+    breseq_works = callPackage ./tests/breseq.nix { };
+    gdtools_works = callPackage ./tests/gdtools.nix { };
+  };
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Computational pipeline for finding mutations relative to a reference sequence in short-read DNA re-sequencing data";
+    mainProgram = "breseq";
+    homepage = "https://github.com/barricklab/breseq";
+    license = with lib.licenses; [
+      gpl2Plus # See barricklab/breseq#398
+    ];
+    maintainers = with lib.maintainers; [ croots ];
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/by-name/br/breseq/tests/breseq.nix b/pkgs/by-name/br/breseq/tests/breseq.nix
new file mode 100644
index 000000000000..0b0975206373
--- /dev/null
+++ b/pkgs/by-name/br/breseq/tests/breseq.nix
@@ -0,0 +1,21 @@
+{
+  runCommand,
+  breseq,
+}:
+
+let
+  inherit (breseq) pname version;
+in
+
+runCommand "breseq-tests" { meta.timeout = 60; } ''
+  echo "Testing breseq - breseq executable"
+  export TESTBINPREFIX=${breseq}/bin
+  cp ${breseq}/tests $PWD/breseqtests -r
+  chmod -R +w $PWD/breseqtests
+  output=$($PWD/breseqtests/tmv_plasmid_circular_deletion/testcmd.sh 2>&1) || {
+    echo "$output"
+    echo "Error testing breseq - breseq executable"
+    exit 1
+  }
+  touch $out
+''
diff --git a/pkgs/by-name/br/breseq/tests/gdtools.nix b/pkgs/by-name/br/breseq/tests/gdtools.nix
new file mode 100644
index 000000000000..fbb78e221d97
--- /dev/null
+++ b/pkgs/by-name/br/breseq/tests/gdtools.nix
@@ -0,0 +1,21 @@
+{
+  runCommand,
+  breseq,
+}:
+
+let
+  inherit (breseq) pname version;
+in
+
+runCommand "breseq-tests" { meta.timeout = 60; } ''
+  echo "Testing breseq - gdtools executable"
+  export TESTBINPREFIX=${breseq}/bin
+  cp ${breseq}/tests $PWD/breseqtests -r
+  chmod -R +w $PWD/breseqtests
+  output=$($PWD/breseqtests/gdtools_compare_1/testcmd.sh 2>&1) || {
+    echo "$output"
+    echo "Error testing breseq - gdtools executable"
+    exit 1
+  }
+  touch $out
+''
diff --git a/pkgs/by-name/bu/butane/package.nix b/pkgs/by-name/bu/butane/package.nix
index 82608d31e5d5..7897a9b2d95d 100644
--- a/pkgs/by-name/bu/butane/package.nix
+++ b/pkgs/by-name/bu/butane/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "butane";
-  version = "0.28.0";
+  version = "0.29.0";
 
   src = fetchFromGitHub {
     owner = "coreos";
     repo = "butane";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Cej00ugyOtjPys0E67z0oapwABdQxRuN4lOGu1qrtf8=";
+    hash = "sha256-lijMfxhUBopwbfEP4fEgszXh7zaRz7Xy1Y8PmatXXTE=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/ca/cargo-risczero/package.nix b/pkgs/by-name/ca/cargo-risczero/package.nix
index aed35ada6c6e..00e182b435ed 100644
--- a/pkgs/by-name/ca/cargo-risczero/package.nix
+++ b/pkgs/by-name/ca/cargo-risczero/package.nix
@@ -1,6 +1,5 @@
 {
   lib,
-  stdenv,
   fetchCrate,
   fetchurl,
   rustPlatform,
@@ -8,28 +7,31 @@
   openssl,
   nix-update-script,
 }:
+let
+  # That is from cargoDeps/risc0-circuit-recursion/build.rs
+  src-recursion-hash = "744b999f0a35b3c86753311c7efb2a0054be21727095cf105af6ee7d3f4d8849";
+  src-recursion = fetchurl {
+    name = "cargo-risczero-recursion-source";
+    url = "https://risc0-artifacts.s3.us-west-2.amazonaws.com/zkr/${src-recursion-hash}.zip";
+    outputHash = src-recursion-hash; # This hash should be the same as src-recuresion-hash
+    outputHashAlgo = "sha256";
+  };
+in
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-risczero";
-  version = "1.1.2";
+  version = "3.0.5";
 
   src = fetchCrate {
-    inherit pname version;
-    hash = "sha256-YZ3yhj1VLxl3Fg/yWhqrZXxIQ7oK6Gdo0NU39oDvoo8=";
-  };
-
-  src-recursion-hash = "28e4eeff7a8f73d27408d99a1e3e8842c79a5f4353e5117ec0b7ffaa7c193612"; # That is from cargoDeps/risc0-circuit-recursion/build.rs
-
-  src-recursion = fetchurl {
-    url = "https://risc0-artifacts.s3.us-west-2.amazonaws.com/zkr/${src-recursion-hash}.zip";
-    hash = "sha256-KOTu/3qPc9J0CNmaHj6IQseaX0NT5RF+wLf/qnwZNhI="; # This hash should be the same as src-recuresion-hash
+    inherit (finalAttrs) pname version;
+    hash = "sha256-1tuY+XoZpilak9gc5vDnRDEB1SK+itBWoGNxwefT6xo=";
   };
 
   env = {
     RECURSION_SRC_PATH = src-recursion;
   };
 
-  cargoHash = "sha256-r2bs1MT2jBK4ATUKyRGLEAFCHNaGnnQ4jbQOKbQbldY=";
+  cargoHash = "sha256-ayKQvhjYawPEl9ryVmDx4J93/EGPSeKds0mOnkRI2Fo=";
 
   nativeBuildInputs = [
     pkg-config
@@ -39,9 +41,6 @@ rustPlatform.buildRustPackage rec {
     openssl
   ];
 
-  # The tests require network access which is not available in sandboxed Nix builds.
-  doCheck = false;
-
   passthru.updateScript = nix-update-script { };
 
   meta = {
@@ -51,4 +50,4 @@ rustPlatform.buildRustPackage rec {
     license = with lib.licenses; [ asl20 ];
     maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/by-name/cf/cfripper/package.nix b/pkgs/by-name/cf/cfripper/package.nix
index b5e915bb043f..93e0ce49fcf0 100644
--- a/pkgs/by-name/cf/cfripper/package.nix
+++ b/pkgs/by-name/cf/cfripper/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "cfripper";
-  version = "1.20.1";
+  version = "1.21.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Skyscanner";
     repo = "cfripper";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HE9n28q1HX1HRSiXyEuUrAJGp4d5i1e0lROcsqpsobA=";
+    hash = "sha256-psuUG8Kk+pl9Qv9vpH7yCn2X6leciftgFN1Ft+zEgtg=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/by-name/ch/checkov/package.nix b/pkgs/by-name/ch/checkov/package.nix
index 4580028b3ebb..7437070891d8 100644
--- a/pkgs/by-name/ch/checkov/package.nix
+++ b/pkgs/by-name/ch/checkov/package.nix
@@ -35,14 +35,14 @@ let
 in
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "checkov";
-  version = "3.3.0";
+  version = "3.3.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     tag = finalAttrs.version;
-    hash = "sha256-1hm3ZNvrO+U3PWb5gBSwKSXgOHQLU4avncSZOH/ijCM=";
+    hash = "sha256-4wOFbEv1MVVuMpYQLs+oHQxCLw/tk++yTiR+yyLiCa8=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/by-name/ch/checkstyle/package.nix b/pkgs/by-name/ch/checkstyle/package.nix
index 5eb0d22fef51..acdc60aef140 100644
--- a/pkgs/by-name/ch/checkstyle/package.nix
+++ b/pkgs/by-name/ch/checkstyle/package.nix
@@ -8,17 +8,17 @@
 }:
 
 maven.buildMavenPackage (finalAttrs: {
-  version = "13.6.0";
+  version = "13.7.0";
   pname = "checkstyle";
 
   src = fetchFromGitHub {
     owner = "checkstyle";
     repo = "checkstyle";
     tag = "checkstyle-${finalAttrs.version}";
-    hash = "sha256-5E3GTE4fPmJYoSm2lK4tW1Dcu+SuyQKL396JLg3J22E=";
+    hash = "sha256-BrgjkqkVnLYMlouyopUoCTby2z4YWZl4UK7m3Ktm5bE=";
   };
 
-  mvnHash = "sha256-r0adD/80UguRCIznE6hGdhRifm29GxMhQRSmd2/nabc=";
+  mvnHash = "sha256-IKO61ugVjF03zA6pCwYKmwMVx/Ogy8hrt70ArOUm0NA=";
 
   nativeBuildInputs = [
     maven
diff --git a/pkgs/by-name/cl/claude-code/manifest.json b/pkgs/by-name/cl/claude-code/manifest.json
index b9a90d778bd2..d7cbad9eea6a 100644
--- a/pkgs/by-name/cl/claude-code/manifest.json
+++ b/pkgs/by-name/cl/claude-code/manifest.json
@@ -1,47 +1,47 @@
 {
-  "version": "2.1.196",
-  "commit": "a4ca500badcac68511fb5f04303e32e4360f3dfb",
-  "buildDate": "2026-06-29T01:55:28Z",
+  "version": "2.1.197",
+  "commit": "c8fd8048f30950a21d28734718275aa7e97f5143",
+  "buildDate": "2026-06-29T19:16:30Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude",
-      "checksum": "6fc6e61ab7582c2bf241225ff90d9f79e91d69380cb9589fc9dedd3a30070f5a",
-      "size": 225782608
+      "checksum": "8cc0c4d1e4eb1dca3b0cc92ab02ee3505de764e023f8c901761c167b72041fb8",
+      "size": 227251472
     },
     "darwin-x64": {
       "binary": "claude",
-      "checksum": "32c74d66e27b9ca77aea638fc46cb11c90470bd0d294b2a981065da8896d1ee0",
-      "size": 235139408
+      "checksum": "5e8a57cc7a92377f0744fa4c79191cf93d4b26c79cb919b07a407511fed1be26",
+      "size": 235288016
     },
     "linux-arm64": {
       "binary": "claude",
-      "checksum": "05aa9189d335d1e921ca9608acd699193e661559aff56704456ce5bda6fd4dd8",
-      "size": 242203376
+      "checksum": "fb48473c467c27615ac799a754f4ef0b68c363e4596cefbb59c3815d51a0cc8a",
+      "size": 242334448
     },
     "linux-x64": {
       "binary": "claude",
-      "checksum": "eb933c6dd5534db89b83ba09009d5c0932bd1395f7e3bb0f34ba37eec37bbade",
-      "size": 245373752
+      "checksum": "f54e69cbc89b2da61a415700af7ff52a147e862517d4f1b0eecf768448cf7f83",
+      "size": 245517112
     },
     "linux-arm64-musl": {
       "binary": "claude",
-      "checksum": "0591ff8e1378d3773c85456d0c812bf79b333cac2d06396cd076ecfc75022ba4",
-      "size": 235451576
+      "checksum": "acb885610ba06d90c46206ded9b14121bc30e96affecbfb3c37d511bf02af2bd",
+      "size": 235582648
     },
     "linux-x64-musl": {
       "binary": "claude",
-      "checksum": "fa7e93303ea5eda7defce9f70f360c1f951b06f9f36b03296baffbade512049f",
-      "size": 240058752
+      "checksum": "2f610c0f81341052426981b5dc59277a33e6ec3df924071b24edbc05e6a096dc",
+      "size": 240202112
     },
     "win32-x64": {
       "binary": "claude.exe",
-      "checksum": "180d7b279455e8b89d4353a5146447be2f80b80fb0db14bdc6dd9cb98c0aef09",
-      "size": 235977376
+      "checksum": "038bd9fe90c60304601e19751269a50d62925c541dd6a2b3da5274549e9416ee",
+      "size": 236121248
     },
     "win32-arm64": {
       "binary": "claude.exe",
-      "checksum": "882ed64ae93385067bff7b1e1d1975898f1cbca739dff322e0e370cd2db3e6ed",
-      "size": 230444704
+      "checksum": "8d2baeaf77b0e79ea33cf5ce78a37e64804c3a26d63d35355a830fda404a4f61",
+      "size": 230588064
     }
   }
 }
diff --git a/pkgs/by-name/cn/cnspec/package.nix b/pkgs/by-name/cn/cnspec/package.nix
index fed41ef87222..9574fd82a314 100644
--- a/pkgs/by-name/cn/cnspec/package.nix
+++ b/pkgs/by-name/cn/cnspec/package.nix
@@ -6,18 +6,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "cnspec";
-  version = "13.25.0";
+  version = "13.27.0";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnspec";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6DyF9gOXZfN5wUpUtTO/Pj8wOcHbTRbZbTCYF3t9clE=";
+    hash = "sha256-t/ugT15QxiwMJybX2mIwgx0wGQETLFJWplxNEosTq4A=";
   };
 
   proxyVendor = true;
 
-  vendorHash = "sha256-q9ur5wbiJGZ8K0dI3xjpB4RsnEkoQetZu6Kj7IB7kEc=";
+  vendorHash = "sha256-M2f2HApngE8GJRXy53u7bif1puNTE6BV6oxmnvSSS6Y=";
 
   subPackages = [ "apps/cnspec" ];
 
diff --git a/pkgs/by-name/co/cockpit/package.nix b/pkgs/by-name/co/cockpit/package.nix
index f956c4608a6d..15e75b87da26 100644
--- a/pkgs/by-name/co/cockpit/package.nix
+++ b/pkgs/by-name/co/cockpit/package.nix
@@ -53,13 +53,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cockpit";
-  version = "363.1";
+  version = "364";
 
   src = fetchFromGitHub {
     owner = "cockpit-project";
     repo = "cockpit";
     tag = finalAttrs.version;
-    hash = "sha256-w9+S3qc95gcNvVLGMdWlRxKXhNjZbcgKSGxlSvNJp9o=";
+    hash = "sha256-TAX0N6ZQWGr17GpyJS23Q5ES3USU2hxSiI867n6G17I=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/co/code2prompt/Cargo.lock b/pkgs/by-name/co/code2prompt/Cargo.lock
deleted file mode 100644
index 1136972201b9..000000000000
--- a/pkgs/by-name/co/code2prompt/Cargo.lock
+++ /dev/null
@@ -1,1699 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 3
-
-[[package]]
-name = "aho-corasick"
-version = "1.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916"
-dependencies = [
- "memchr",
-]
-
-[[package]]
-name = "anstream"
-version = "0.6.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "418c75fa768af9c03be99d17643f93f79bbba589895012a80e3452a19ddda15b"
-dependencies = [
- "anstyle",
- "anstyle-parse",
- "anstyle-query",
- "anstyle-wincon",
- "colorchoice",
- "is_terminal_polyfill",
- "utf8parse",
-]
-
-[[package]]
-name = "anstyle"
-version = "1.0.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "038dfcf04a5feb68e9c60b21c9625a54c2c0616e79b72b0fd87075a056ae1d1b"
-
-[[package]]
-name = "anstyle-parse"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c03a11a9034d92058ceb6ee011ce58af4a9bf61491aa7e1e59ecd24bd40d22d4"
-dependencies = [
- "utf8parse",
-]
-
-[[package]]
-name = "anstyle-query"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad186efb764318d35165f1758e7dcef3b10628e26d41a44bc5550652e6804391"
-dependencies = [
- "windows-sys 0.52.0",
-]
-
-[[package]]
-name = "anstyle-wincon"
-version = "3.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61a38449feb7068f52bb06c12759005cf459ee52bb4adc1d5a7c4322d716fb19"
-dependencies = [
- "anstyle",
- "windows-sys 0.52.0",
-]
-
-[[package]]
-name = "anyhow"
-version = "1.0.86"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3d1d046238990b9cf5bcde22a3fb3584ee5cf65fb2765f454ed428c7a0063da"
-
-[[package]]
-name = "autocfg"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c4b4d0bd25bd0b74681c0ad21497610ce1b7c91b1022cd21c80c6fbdd9476b0"
-
-[[package]]
-name = "base64"
-version = "0.21.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
-
-[[package]]
-name = "bit-set"
-version = "0.5.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0700ddab506f33b20a03b13996eccd309a48e5ff77d0d95926aa0210fb4e95f1"
-dependencies = [
- "bit-vec",
-]
-
-[[package]]
-name = "bit-vec"
-version = "0.6.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "349f9b6a179ed607305526ca489b34ad0a41aed5f7980fa90eb03160b69598fb"
-
-[[package]]
-name = "bitflags"
-version = "1.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
-
-[[package]]
-name = "bitflags"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf4b9d6a944f767f8e5e0db018570623c85f3d925ac718db4e06d0187adb21c1"
-
-[[package]]
-name = "block"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d8c1fef690941d3e7788d328517591fecc684c084084702d6ff1641e993699a"
-
-[[package]]
-name = "block-buffer"
-version = "0.10.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
-dependencies = [
- "generic-array",
-]
-
-[[package]]
-name = "bstr"
-version = "1.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05efc5cfd9110c8416e471df0e96702d58690178e206e61b7173706673c93706"
-dependencies = [
- "memchr",
- "regex-automata",
- "serde",
-]
-
-[[package]]
-name = "byteorder"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
-
-[[package]]
-name = "cc"
-version = "1.0.99"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96c51067fd44124faa7f870b4b1c969379ad32b2ba805aa959430ceaa384f695"
-dependencies = [
- "jobserver",
- "libc",
- "once_cell",
-]
-
-[[package]]
-name = "cfg-if"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
-
-[[package]]
-name = "clap"
-version = "4.5.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9689a29b593160de5bc4aacab7b5d54fb52231de70122626c178e6a368994c7"
-dependencies = [
- "clap_builder",
- "clap_derive",
-]
-
-[[package]]
-name = "clap_builder"
-version = "4.5.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e5387378c84f6faa26890ebf9f0a92989f8873d4d380467bcd0d8d8620424df"
-dependencies = [
- "anstream",
- "anstyle",
- "clap_lex",
- "strsim",
-]
-
-[[package]]
-name = "clap_derive"
-version = "4.5.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c780290ccf4fb26629baa7a1081e68ced113f1d3ec302fa5948f1c381ebf06c6"
-dependencies = [
- "heck",
- "proc-macro2",
- "quote",
- "syn 2.0.66",
-]
-
-[[package]]
-name = "clap_lex"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b82cf0babdbd58558212896d1a4272303a57bdb245c2bf1147185fb45640e70"
-
-[[package]]
-name = "cli-clipboard"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04087c1d4a2aa259784a563932aee09cbb0869d490775e051096174b070f3e3d"
-dependencies = [
- "clipboard-win",
- "objc",
- "objc-foundation",
- "objc_id",
- "wl-clipboard-rs",
- "x11-clipboard",
-]
-
-[[package]]
-name = "clipboard-win"
-version = "4.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7191c27c2357d9b7ef96baac1773290d4ca63b24205b82a3fd8a0637afcf0362"
-dependencies = [
- "error-code",
- "str-buf",
- "winapi",
-]
-
-[[package]]
-name = "code2prompt"
-version = "1.0.0"
-dependencies = [
- "anyhow",
- "clap",
- "cli-clipboard",
- "colored",
- "git2",
- "handlebars",
- "ignore",
- "indicatif",
- "inquire",
- "jwalk",
- "regex",
- "serde_json",
- "termtree",
- "tiktoken-rs",
-]
-
-[[package]]
-name = "colorchoice"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b6a852b24ab71dffc585bcb46eaf7959d175cb865a7152e35b348d1b2960422"
-
-[[package]]
-name = "colored"
-version = "2.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cbf2150cce219b664a8a70df7a1f933836724b503f8a413af9365b4dcc4d90b8"
-dependencies = [
- "lazy_static",
- "windows-sys 0.48.0",
-]
-
-[[package]]
-name = "console"
-version = "0.15.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e1f83fc076bd6dd27517eacdf25fef6c4dfe5f1d7448bafaaf3a26f13b5e4eb"
-dependencies = [
- "encode_unicode",
- "lazy_static",
- "libc",
- "unicode-width",
- "windows-sys 0.52.0",
-]
-
-[[package]]
-name = "cpufeatures"
-version = "0.2.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53fe5e26ff1b7aef8bca9c6080520cfb8d9333c7568e1829cef191a9723e5504"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "crossbeam"
-version = "0.8.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1137cd7e7fc0fb5d3c5a8678be38ec56e819125d8d7907411fe24ccb943faca8"
-dependencies = [
- "crossbeam-channel",
- "crossbeam-deque",
- "crossbeam-epoch",
- "crossbeam-queue",
- "crossbeam-utils",
-]
-
-[[package]]
-name = "crossbeam-channel"
-version = "0.5.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33480d6946193aa8033910124896ca395333cae7e2d1113d1fef6c3272217df2"
-dependencies = [
- "crossbeam-utils",
-]
-
-[[package]]
-name = "crossbeam-deque"
-version = "0.8.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "613f8cc01fe9cf1a3eb3d7f488fd2fa8388403e97039e2f73692932e291a770d"
-dependencies = [
- "crossbeam-epoch",
- "crossbeam-utils",
-]
-
-[[package]]
-name = "crossbeam-epoch"
-version = "0.9.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
-dependencies = [
- "crossbeam-utils",
-]
-
-[[package]]
-name = "crossbeam-queue"
-version = "0.3.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df0346b5d5e76ac2fe4e327c5fd1118d6be7c51dfb18f9b7922923f287471e35"
-dependencies = [
- "crossbeam-utils",
-]
-
-[[package]]
-name = "crossbeam-utils"
-version = "0.8.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22ec99545bb0ed0ea7bb9b8e1e9122ea386ff8a48c0922e43f36d45ab09e0e80"
-
-[[package]]
-name = "crossterm"
-version = "0.25.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e64e6c0fbe2c17357405f7c758c1ef960fce08bdfb2c03d88d2a18d7e09c4b67"
-dependencies = [
- "bitflags 1.3.2",
- "crossterm_winapi",
- "libc",
- "mio",
- "parking_lot",
- "signal-hook",
- "signal-hook-mio",
- "winapi",
-]
-
-[[package]]
-name = "crossterm_winapi"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "acdd7c62a3665c7f6830a51635d9ac9b23ed385797f70a83bb8bafe9c572ab2b"
-dependencies = [
- "winapi",
-]
-
-[[package]]
-name = "crypto-common"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
-dependencies = [
- "generic-array",
- "typenum",
-]
-
-[[package]]
-name = "derive-new"
-version = "0.5.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3418329ca0ad70234b9735dc4ceed10af4df60eff9c8e7b06cb5e520d92c3535"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 1.0.109",
-]
-
-[[package]]
-name = "digest"
-version = "0.10.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
-dependencies = [
- "block-buffer",
- "crypto-common",
-]
-
-[[package]]
-name = "downcast-rs"
-version = "1.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75b325c5dbd37f80359721ad39aca5a29fb04c89279657cffdda8736d0c0b9d2"
-
-[[package]]
-name = "dyn-clone"
-version = "1.0.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d6ef0072f8a535281e4876be788938b528e9a1d43900b82c2569af7da799125"
-
-[[package]]
-name = "either"
-version = "1.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3dca9240753cf90908d7e4aac30f630662b02aebaa1b58a3cadabdb23385b58b"
-
-[[package]]
-name = "encode_unicode"
-version = "0.3.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a357d28ed41a50f9c765dbfe56cbc04a64e53e5fc58ba79fbc34c10ef3df831f"
-
-[[package]]
-name = "equivalent"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
-
-[[package]]
-name = "errno"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "534c5cf6194dfab3db3242765c03bbe257cf92f22b38f6bc0c58d59108a820ba"
-dependencies = [
- "libc",
- "windows-sys 0.52.0",
-]
-
-[[package]]
-name = "error-code"
-version = "2.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "64f18991e7bf11e7ffee451b5318b5c1a73c52d0d0ada6e5a3017c8c1ced6a21"
-dependencies = [
- "libc",
- "str-buf",
-]
-
-[[package]]
-name = "fancy-regex"
-version = "0.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7493d4c459da9f84325ad297371a6b2b8a162800873a22e3b6b6512e61d18c05"
-dependencies = [
- "bit-set",
- "regex",
-]
-
-[[package]]
-name = "fastrand"
-version = "2.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fc0510504f03c51ada170672ac806f1f105a88aa97a5281117e1ddc3368e51a"
-
-[[package]]
-name = "fixedbitset"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ce7134b9999ecaf8bcd65542e436736ef32ddca1b3e06094cb6ec5755203b80"
-
-[[package]]
-name = "fnv"
-version = "1.0.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
-
-[[package]]
-name = "form_urlencoded"
-version = "1.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e13624c2627564efccf4934284bdd98cbaa14e79b0b5a141218e507b3a823456"
-dependencies = [
- "percent-encoding",
-]
-
-[[package]]
-name = "fuzzy-matcher"
-version = "0.3.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "54614a3312934d066701a80f20f15fa3b56d67ac7722b39eea5b4c9dd1d66c94"
-dependencies = [
- "thread_local",
-]
-
-[[package]]
-name = "fxhash"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c31b6d751ae2c7f11320402d34e41349dd1016f8d5d45e48c4312bc8625af50c"
-dependencies = [
- "byteorder",
-]
-
-[[package]]
-name = "generic-array"
-version = "0.14.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
-dependencies = [
- "typenum",
- "version_check",
-]
-
-[[package]]
-name = "gethostname"
-version = "0.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1ebd34e35c46e00bb73e81363248d627782724609fe1b6396f553f68fe3862e"
-dependencies = [
- "libc",
- "winapi",
-]
-
-[[package]]
-name = "git2"
-version = "0.18.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "232e6a7bfe35766bf715e55a88b39a700596c0ccfd88cd3680b4cdb40d66ef70"
-dependencies = [
- "bitflags 2.5.0",
- "libc",
- "libgit2-sys",
- "log",
- "openssl-probe",
- "openssl-sys",
- "url",
-]
-
-[[package]]
-name = "globset"
-version = "0.4.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57da3b9b5b85bd66f31093f8c408b90a74431672542466497dcbdfdc02034be1"
-dependencies = [
- "aho-corasick",
- "bstr",
- "log",
- "regex-automata",
- "regex-syntax",
-]
-
-[[package]]
-name = "handlebars"
-version = "4.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "faa67bab9ff362228eb3d00bd024a4965d8231bbb7921167f0cfa66c6626b225"
-dependencies = [
- "log",
- "pest",
- "pest_derive",
- "serde",
- "serde_json",
- "thiserror",
-]
-
-[[package]]
-name = "hashbrown"
-version = "0.14.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
-
-[[package]]
-name = "heck"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
-
-[[package]]
-name = "home"
-version = "0.5.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3d1354bf6b7235cb4a0576c2619fd4ed18183f689b12b006a0ee7329eeff9a5"
-dependencies = [
- "windows-sys 0.52.0",
-]
-
-[[package]]
-name = "idna"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "634d9b1461af396cad843f47fdba5597a4f9e6ddd4bfb6ff5d85028c25cb12f6"
-dependencies = [
- "unicode-bidi",
- "unicode-normalization",
-]
-
-[[package]]
-name = "ignore"
-version = "0.4.22"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b46810df39e66e925525d6e38ce1e7f6e1d208f72dc39757880fcb66e2c58af1"
-dependencies = [
- "crossbeam-deque",
- "globset",
- "log",
- "memchr",
- "regex-automata",
- "same-file",
- "walkdir",
- "winapi-util",
-]
-
-[[package]]
-name = "indexmap"
-version = "2.2.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "168fb715dda47215e360912c096649d23d58bf392ac62f73919e831745e40f26"
-dependencies = [
- "equivalent",
- "hashbrown",
-]
-
-[[package]]
-name = "indicatif"
-version = "0.17.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "763a5a8f45087d6bcea4222e7b72c291a054edf80e4ef6efd2a4979878c7bea3"
-dependencies = [
- "console",
- "instant",
- "number_prefix",
- "portable-atomic",
- "unicode-width",
-]
-
-[[package]]
-name = "inquire"
-version = "0.7.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fddf93031af70e75410a2511ec04d49e758ed2f26dad3404a934e0fb45cc12a"
-dependencies = [
- "bitflags 2.5.0",
- "crossterm",
- "dyn-clone",
- "fuzzy-matcher",
- "fxhash",
- "newline-converter",
- "once_cell",
- "unicode-segmentation",
- "unicode-width",
-]
-
-[[package]]
-name = "instant"
-version = "0.1.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e0242819d153cba4b4b05a5a8f2a7e9bbf97b6055b2a002b395c96b5ff3c0222"
-dependencies = [
- "cfg-if",
-]
-
-[[package]]
-name = "is_terminal_polyfill"
-version = "1.70.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8478577c03552c21db0e2724ffb8986a5ce7af88107e6be5d2ee6e158c12800"
-
-[[package]]
-name = "itoa"
-version = "1.0.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b"
-
-[[package]]
-name = "jobserver"
-version = "0.1.31"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2b099aaa34a9751c5bf0878add70444e1ed2dd73f347be99003d4577277de6e"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "jwalk"
-version = "0.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2735847566356cd2179a2a38264839308f7079fa96e6bd5a42d740460e003c56"
-dependencies = [
- "crossbeam",
- "rayon",
-]
-
-[[package]]
-name = "lazy_static"
-version = "1.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
-
-[[package]]
-name = "libc"
-version = "0.2.155"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97b3888a4aecf77e811145cadf6eef5901f4782c53886191b2f693f24761847c"
-
-[[package]]
-name = "libgit2-sys"
-version = "0.16.2+1.7.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee4126d8b4ee5c9d9ea891dd875cfdc1e9d0950437179104b183d7d8a74d24e8"
-dependencies = [
- "cc",
- "libc",
- "libssh2-sys",
- "libz-sys",
- "openssl-sys",
- "pkg-config",
-]
-
-[[package]]
-name = "libssh2-sys"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dc8a030b787e2119a731f1951d6a773e2280c660f8ec4b0f5e1505a386e71ee"
-dependencies = [
- "cc",
- "libc",
- "libz-sys",
- "openssl-sys",
- "pkg-config",
- "vcpkg",
-]
-
-[[package]]
-name = "libz-sys"
-version = "1.1.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c15da26e5af7e25c90b37a2d75cdbf940cf4a55316de9d84c679c9b8bfabf82e"
-dependencies = [
- "cc",
- "libc",
- "pkg-config",
- "vcpkg",
-]
-
-[[package]]
-name = "linux-raw-sys"
-version = "0.4.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78b3ae25bc7c8c38cec158d1f2757ee79e9b3740fbc7ccf0e59e4b08d793fa89"
-
-[[package]]
-name = "lock_api"
-version = "0.4.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07af8b9cdd281b7915f413fa73f29ebd5d55d0d3f0155584dade1ff18cea1b17"
-dependencies = [
- "autocfg",
- "scopeguard",
-]
-
-[[package]]
-name = "log"
-version = "0.4.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90ed8c1e510134f979dbc4f070f87d4313098b704861a105fe34231c70a3901c"
-
-[[package]]
-name = "malloc_buf"
-version = "0.0.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62bb907fe88d54d8d9ce32a3cceab4218ed2f6b7d35617cafe9adf84e43919cb"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "memchr"
-version = "2.7.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c8640c5d730cb13ebd907d8d04b52f55ac9a2eec55b440c8892f40d56c76c1d"
-
-[[package]]
-name = "memoffset"
-version = "0.6.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5aa361d4faea93603064a027415f07bd8e1d5c88c9fbf68bf56a285428fd79ce"
-dependencies = [
- "autocfg",
-]
-
-[[package]]
-name = "minimal-lexical"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
-
-[[package]]
-name = "mio"
-version = "0.8.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4a650543ca06a924e8b371db273b2756685faae30f8487da1b56505a8f78b0c"
-dependencies = [
- "libc",
- "log",
- "wasi",
- "windows-sys 0.48.0",
-]
-
-[[package]]
-name = "newline-converter"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "47b6b097ecb1cbfed438542d16e84fd7ad9b0c76c8a65b7f9039212a3d14dc7f"
-dependencies = [
- "unicode-segmentation",
-]
-
-[[package]]
-name = "nix"
-version = "0.24.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa52e972a9a719cecb6864fb88568781eb706bac2cd1d4f04a648542dbf78069"
-dependencies = [
- "bitflags 1.3.2",
- "cfg-if",
- "libc",
- "memoffset",
-]
-
-[[package]]
-name = "nom"
-version = "7.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
-dependencies = [
- "memchr",
- "minimal-lexical",
-]
-
-[[package]]
-name = "number_prefix"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "830b246a0e5f20af87141b25c173cd1b609bd7779a4617d6ec582abaf90870f3"
-
-[[package]]
-name = "objc"
-version = "0.2.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "915b1b472bc21c53464d6c8461c9d3af805ba1ef837e1cac254428f4a77177b1"
-dependencies = [
- "malloc_buf",
-]
-
-[[package]]
-name = "objc-foundation"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1add1b659e36c9607c7aab864a76c7a4c2760cd0cd2e120f3fb8b952c7e22bf9"
-dependencies = [
- "block",
- "objc",
- "objc_id",
-]
-
-[[package]]
-name = "objc_id"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c92d4ddb4bd7b50d730c215ff871754d0da6b2178849f8a2a2ab69712d0c073b"
-dependencies = [
- "objc",
-]
-
-[[package]]
-name = "once_cell"
-version = "1.19.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
-
-[[package]]
-name = "openssl-probe"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf"
-
-[[package]]
-name = "openssl-sys"
-version = "0.9.102"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c597637d56fbc83893a35eb0dd04b2b8e7a50c91e64e9493e398b5df4fb45fa2"
-dependencies = [
- "cc",
- "libc",
- "pkg-config",
- "vcpkg",
-]
-
-[[package]]
-name = "os_pipe"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29d73ba8daf8fac13b0501d1abeddcfe21ba7401ada61a819144b6c2a4f32209"
-dependencies = [
- "libc",
- "windows-sys 0.52.0",
-]
-
-[[package]]
-name = "parking_lot"
-version = "0.12.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1bf18183cf54e8d6059647fc3063646a1801cf30896933ec2311622cc4b9a27"
-dependencies = [
- "lock_api",
- "parking_lot_core",
-]
-
-[[package]]
-name = "parking_lot_core"
-version = "0.9.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e401f977ab385c9e4e3ab30627d6f26d00e2c73eef317493c4ec6d468726cf8"
-dependencies = [
- "cfg-if",
- "libc",
- "redox_syscall",
- "smallvec",
- "windows-targets 0.52.5",
-]
-
-[[package]]
-name = "percent-encoding"
-version = "2.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"
-
-[[package]]
-name = "pest"
-version = "2.7.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "560131c633294438da9f7c4b08189194b20946c8274c6b9e38881a7874dc8ee8"
-dependencies = [
- "memchr",
- "thiserror",
- "ucd-trie",
-]
-
-[[package]]
-name = "pest_derive"
-version = "2.7.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26293c9193fbca7b1a3bf9b79dc1e388e927e6cacaa78b4a3ab705a1d3d41459"
-dependencies = [
- "pest",
- "pest_generator",
-]
-
-[[package]]
-name = "pest_generator"
-version = "2.7.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ec22af7d3fb470a85dd2ca96b7c577a1eb4ef6f1683a9fe9a8c16e136c04687"
-dependencies = [
- "pest",
- "pest_meta",
- "proc-macro2",
- "quote",
- "syn 2.0.66",
-]
-
-[[package]]
-name = "pest_meta"
-version = "2.7.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7a240022f37c361ec1878d646fc5b7d7c4d28d5946e1a80ad5a7a4f4ca0bdcd"
-dependencies = [
- "once_cell",
- "pest",
- "sha2",
-]
-
-[[package]]
-name = "petgraph"
-version = "0.6.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4c5cc86750666a3ed20bdaf5ca2a0344f9c67674cae0515bec2da16fbaa47db"
-dependencies = [
- "fixedbitset",
- "indexmap",
-]
-
-[[package]]
-name = "pkg-config"
-version = "0.3.30"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d231b230927b5e4ad203db57bbcbee2802f6bce620b1e4a9024a07d94e2907ec"
-
-[[package]]
-name = "portable-atomic"
-version = "1.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7170ef9988bc169ba16dd36a7fa041e5c4cbeb6a35b76d4c03daded371eae7c0"
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.85"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22244ce15aa966053a896d1accb3a6e68469b97c7f33f284b99f0d576879fc23"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "quote"
-version = "1.0.36"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fa76aaf39101c457836aec0ce2316dbdc3ab723cdda1c6bd4e6ad4208acaca7"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "rayon"
-version = "1.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b418a60154510ca1a002a752ca9714984e21e4241e804d32555251faf8b78ffa"
-dependencies = [
- "either",
- "rayon-core",
-]
-
-[[package]]
-name = "rayon-core"
-version = "1.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1465873a3dfdaa8ae7cb14b4383657caab0b3e8a0aa9ae8e04b044854c8dfce2"
-dependencies = [
- "crossbeam-deque",
- "crossbeam-utils",
-]
-
-[[package]]
-name = "redox_syscall"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "469052894dcb553421e483e4209ee581a45100d31b4018de03e5a7ad86374a7e"
-dependencies = [
- "bitflags 2.5.0",
-]
-
-[[package]]
-name = "regex"
-version = "1.10.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c117dbdfde9c8308975b6a18d71f3f385c89461f7b3fb054288ecf2a2058ba4c"
-dependencies = [
- "aho-corasick",
- "memchr",
- "regex-automata",
- "regex-syntax",
-]
-
-[[package]]
-name = "regex-automata"
-version = "0.4.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "86b83b8b9847f9bf95ef68afb0b8e6cdb80f498442f5179a29fad448fcc1eaea"
-dependencies = [
- "aho-corasick",
- "memchr",
- "regex-syntax",
-]
-
-[[package]]
-name = "regex-syntax"
-version = "0.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "adad44e29e4c806119491a7f06f03de4d1af22c3a680dd47f1e6e179439d1f56"
-
-[[package]]
-name = "rustc-hash"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
-
-[[package]]
-name = "rustix"
-version = "0.38.34"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70dc5ec042f7a43c4a73241207cecc9873a06d45debb38b329f8541d85c2730f"
-dependencies = [
- "bitflags 2.5.0",
- "errno",
- "libc",
- "linux-raw-sys",
- "windows-sys 0.52.0",
-]
-
-[[package]]
-name = "ryu"
-version = "1.0.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3cb5ba0dc43242ce17de99c180e96db90b235b8a9fdc9543c96d2209116bd9f"
-
-[[package]]
-name = "same-file"
-version = "1.0.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
-dependencies = [
- "winapi-util",
-]
-
-[[package]]
-name = "scopeguard"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
-
-[[package]]
-name = "serde"
-version = "1.0.203"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7253ab4de971e72fb7be983802300c30b5a7f0c2e56fab8abfc6a214307c0094"
-dependencies = [
- "serde_derive",
-]
-
-[[package]]
-name = "serde_derive"
-version = "1.0.203"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "500cbc0ebeb6f46627f50f3f5811ccf6bf00643be300b4c3eabc0ef55dc5b5ba"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.66",
-]
-
-[[package]]
-name = "serde_json"
-version = "1.0.117"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "455182ea6142b14f93f4bc5320a2b31c1f266b66a4a5c858b013302a5d8cbfc3"
-dependencies = [
- "itoa",
- "ryu",
- "serde",
-]
-
-[[package]]
-name = "sha2"
-version = "0.10.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "793db75ad2bcafc3ffa7c68b215fee268f537982cd901d132f89c6343f3a3dc8"
-dependencies = [
- "cfg-if",
- "cpufeatures",
- "digest",
-]
-
-[[package]]
-name = "signal-hook"
-version = "0.3.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8621587d4798caf8eb44879d42e56b9a93ea5dcd315a6487c357130095b62801"
-dependencies = [
- "libc",
- "signal-hook-registry",
-]
-
-[[package]]
-name = "signal-hook-mio"
-version = "0.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29ad2e15f37ec9a6cc544097b78a1ec90001e9f71b81338ca39f430adaca99af"
-dependencies = [
- "libc",
- "mio",
- "signal-hook",
-]
-
-[[package]]
-name = "signal-hook-registry"
-version = "1.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9e9e0b4211b72e7b8b6e85c807d36c212bdb33ea8587f7569562a84df5465b1"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "smallvec"
-version = "1.13.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
-
-[[package]]
-name = "str-buf"
-version = "1.0.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e08d8363704e6c71fc928674353e6b7c23dcea9d82d7012c8faf2a3a025f8d0"
-
-[[package]]
-name = "strsim"
-version = "0.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
-
-[[package]]
-name = "syn"
-version = "1.0.109"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "syn"
-version = "2.0.66"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c42f3f41a2de00b01c0aaad383c5a45241efc8b2d1eda5661812fda5f3cdcff5"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "tempfile"
-version = "3.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85b77fafb263dd9d05cbeac119526425676db3784113aa9295c88498cbf8bff1"
-dependencies = [
- "cfg-if",
- "fastrand",
- "rustix",
- "windows-sys 0.52.0",
-]
-
-[[package]]
-name = "termtree"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3369f5ac52d5eb6ab48c6b4ffdc8efbcad6b89c765749064ba298f2c68a16a76"
-
-[[package]]
-name = "thiserror"
-version = "1.0.61"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c546c80d6be4bc6a00c0f01730c08df82eaa7a7a61f11d656526506112cc1709"
-dependencies = [
- "thiserror-impl",
-]
-
-[[package]]
-name = "thiserror-impl"
-version = "1.0.61"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46c3384250002a6d5af4d114f2845d37b57521033f30d5c3f46c4d70e1197533"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.66",
-]
-
-[[package]]
-name = "thread_local"
-version = "1.1.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b9ef9bad013ada3808854ceac7b46812a6465ba368859a37e2100283d2d719c"
-dependencies = [
- "cfg-if",
- "once_cell",
-]
-
-[[package]]
-name = "tiktoken-rs"
-version = "0.5.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c314e7ce51440f9e8f5a497394682a57b7c323d0f4d0a6b1b13c429056e0e234"
-dependencies = [
- "anyhow",
- "base64",
- "bstr",
- "fancy-regex",
- "lazy_static",
- "parking_lot",
- "rustc-hash",
-]
-
-[[package]]
-name = "tinyvec"
-version = "1.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87cc5ceb3875bb20c2890005a4e226a4651264a5c75edb2421b52861a0a0cb50"
-dependencies = [
- "tinyvec_macros",
-]
-
-[[package]]
-name = "tinyvec_macros"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
-
-[[package]]
-name = "tree_magic_mini"
-version = "3.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "469a727cac55b41448315cc10427c069c618ac59bb6a4480283fcd811749bdc2"
-dependencies = [
- "fnv",
- "home",
- "memchr",
- "nom",
- "once_cell",
- "petgraph",
-]
-
-[[package]]
-name = "typenum"
-version = "1.17.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825"
-
-[[package]]
-name = "ucd-trie"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed646292ffc8188ef8ea4d1e0e0150fb15a5c2e12ad9b8fc191ae7a8a7f3c4b9"
-
-[[package]]
-name = "unicode-bidi"
-version = "0.3.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08f95100a766bf4f8f28f90d77e0a5461bbdb219042e7679bebe79004fed8d75"
-
-[[package]]
-name = "unicode-ident"
-version = "1.0.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
-
-[[package]]
-name = "unicode-normalization"
-version = "0.1.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a56d1686db2308d901306f92a263857ef59ea39678a5458e7cb17f01415101f5"
-dependencies = [
- "tinyvec",
-]
-
-[[package]]
-name = "unicode-segmentation"
-version = "1.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4c87d22b6e3f4a18d4d40ef354e97c90fcb14dd91d7dc0aa9d8a1172ebf7202"
-
-[[package]]
-name = "unicode-width"
-version = "0.1.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0336d538f7abc86d282a4189614dfaa90810dfc2c6f6427eaf88e16311dd225d"
-
-[[package]]
-name = "url"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "31e6302e3bb753d46e83516cae55ae196fc0c309407cf11ab35cc51a4c2a4633"
-dependencies = [
- "form_urlencoded",
- "idna",
- "percent-encoding",
-]
-
-[[package]]
-name = "utf8parse"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
-
-[[package]]
-name = "vcpkg"
-version = "0.2.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
-
-[[package]]
-name = "version_check"
-version = "0.9.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
-
-[[package]]
-name = "walkdir"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
-dependencies = [
- "same-file",
- "winapi-util",
-]
-
-[[package]]
-name = "wasi"
-version = "0.11.0+wasi-snapshot-preview1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
-
-[[package]]
-name = "wayland-client"
-version = "0.29.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f3b068c05a039c9f755f881dc50f01732214f5685e379829759088967c46715"
-dependencies = [
- "bitflags 1.3.2",
- "downcast-rs",
- "libc",
- "nix",
- "wayland-commons",
- "wayland-scanner",
- "wayland-sys",
-]
-
-[[package]]
-name = "wayland-commons"
-version = "0.29.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8691f134d584a33a6606d9d717b95c4fa20065605f798a3f350d78dced02a902"
-dependencies = [
- "nix",
- "once_cell",
- "smallvec",
- "wayland-sys",
-]
-
-[[package]]
-name = "wayland-protocols"
-version = "0.29.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b950621f9354b322ee817a23474e479b34be96c2e909c14f7bc0100e9a970bc6"
-dependencies = [
- "bitflags 1.3.2",
- "wayland-client",
- "wayland-commons",
- "wayland-scanner",
-]
-
-[[package]]
-name = "wayland-scanner"
-version = "0.29.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f4303d8fa22ab852f789e75a967f0a2cdc430a607751c0499bada3e451cbd53"
-dependencies = [
- "proc-macro2",
- "quote",
- "xml-rs",
-]
-
-[[package]]
-name = "wayland-sys"
-version = "0.29.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be12ce1a3c39ec7dba25594b97b42cb3195d54953ddb9d3d95a7c3902bc6e9d4"
-dependencies = [
- "pkg-config",
-]
-
-[[package]]
-name = "winapi"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
-dependencies = [
- "winapi-i686-pc-windows-gnu",
- "winapi-x86_64-pc-windows-gnu",
-]
-
-[[package]]
-name = "winapi-i686-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
-
-[[package]]
-name = "winapi-util"
-version = "0.1.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4d4cc384e1e73b93bafa6fb4f1df8c41695c8a91cf9c4c64358067d15a7b6c6b"
-dependencies = [
- "windows-sys 0.52.0",
-]
-
-[[package]]
-name = "winapi-wsapoll"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1eafc5f679c576995526e81635d0cf9695841736712b4e892f87abbe6fed3f28"
-dependencies = [
- "winapi",
-]
-
-[[package]]
-name = "winapi-x86_64-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
-
-[[package]]
-name = "windows-sys"
-version = "0.48.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
-dependencies = [
- "windows-targets 0.48.5",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.52.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
-dependencies = [
- "windows-targets 0.52.5",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
-dependencies = [
- "windows_aarch64_gnullvm 0.48.5",
- "windows_aarch64_msvc 0.48.5",
- "windows_i686_gnu 0.48.5",
- "windows_i686_msvc 0.48.5",
- "windows_x86_64_gnu 0.48.5",
- "windows_x86_64_gnullvm 0.48.5",
- "windows_x86_64_msvc 0.48.5",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.52.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f0713a46559409d202e70e28227288446bf7841d3211583a4b53e3f6d96e7eb"
-dependencies = [
- "windows_aarch64_gnullvm 0.52.5",
- "windows_aarch64_msvc 0.52.5",
- "windows_i686_gnu 0.52.5",
- "windows_i686_gnullvm",
- "windows_i686_msvc 0.52.5",
- "windows_x86_64_gnu 0.52.5",
- "windows_x86_64_gnullvm 0.52.5",
- "windows_x86_64_msvc 0.52.5",
-]
-
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
-
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.52.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7088eed71e8b8dda258ecc8bac5fb1153c5cffaf2578fc8ff5d61e23578d3263"
-
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
-
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.52.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9985fd1504e250c615ca5f281c3f7a6da76213ebd5ccc9561496568a2752afb6"
-
-[[package]]
-name = "windows_i686_gnu"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
-
-[[package]]
-name = "windows_i686_gnu"
-version = "0.52.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88ba073cf16d5372720ec942a8ccbf61626074c6d4dd2e745299726ce8b89670"
-
-[[package]]
-name = "windows_i686_gnullvm"
-version = "0.52.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87f4261229030a858f36b459e748ae97545d6f1ec60e5e0d6a3d32e0dc232ee9"
-
-[[package]]
-name = "windows_i686_msvc"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
-
-[[package]]
-name = "windows_i686_msvc"
-version = "0.52.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db3c2bf3d13d5b658be73463284eaf12830ac9a26a90c717b7f771dfe97487bf"
-
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
-
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.52.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e4246f76bdeff09eb48875a0fd3e2af6aada79d409d33011886d3e1581517d9"
-
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
-
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.52.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "852298e482cd67c356ddd9570386e2862b5673c85bd5f88df9ab6802b334c596"
-
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
-
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.52.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bec47e5bfd1bff0eeaf6d8b485cc1074891a197ab4225d504cb7a1ab88b02bf0"
-
-[[package]]
-name = "wl-clipboard-rs"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "981a303dfbb75d659f6612d05a14b2e363c103d24f676a2d44a00d18507a1ad9"
-dependencies = [
- "derive-new",
- "libc",
- "log",
- "nix",
- "os_pipe",
- "tempfile",
- "thiserror",
- "tree_magic_mini",
- "wayland-client",
- "wayland-protocols",
-]
-
-[[package]]
-name = "x11-clipboard"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "980b9aa9226c3b7de8e2adb11bf20124327c054e0e5812d2aac0b5b5a87e7464"
-dependencies = [
- "x11rb",
-]
-
-[[package]]
-name = "x11rb"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "592b4883219f345e712b3209c62654ebda0bb50887f330cbd018d0f654bfd507"
-dependencies = [
- "gethostname",
- "nix",
- "winapi",
- "winapi-wsapoll",
- "x11rb-protocol",
-]
-
-[[package]]
-name = "x11rb-protocol"
-version = "0.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56b245751c0ac9db0e006dc812031482784e434630205a93c73cfefcaabeac67"
-dependencies = [
- "nix",
-]
-
-[[package]]
-name = "xml-rs"
-version = "0.8.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "791978798f0597cfc70478424c2b4fdc2b7a8024aaff78497ef00f24ef674193"
diff --git a/pkgs/by-name/co/code2prompt/package.nix b/pkgs/by-name/co/code2prompt/package.nix
index 66d9da853e45..a4f046ddc03a 100644
--- a/pkgs/by-name/co/code2prompt/package.nix
+++ b/pkgs/by-name/co/code2prompt/package.nix
@@ -4,31 +4,30 @@
   rustPlatform,
   pkg-config,
   openssl,
+  perl,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "code2prompt";
-  version = "1.1.0";
+  version = "4.2.0";
 
   src = fetchFromGitHub {
     owner = "mufeedvh";
     repo = "code2prompt";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-KZqh0Vq4Mn56PhUO1JUzVpNBAGOZqUAsj31Cj5K+Lyk=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Gh8SsSTZW7QlyyC3SWJ5pOK2x85/GT7+LPJn2Jeczpc=";
   };
 
-  cargoLock = {
-    lockFile = ./Cargo.lock;
-  };
+  cargoHash = "sha256-t4HpGqojIkw9OBUAYz4ZEaB7XyHQxkFB2HtlkGKbe2s=";
 
-  postPatch = ''
-    # src is missing Cargo.lock
-    ln -s ${./Cargo.lock} Cargo.lock
-  '';
+  nativeBuildInputs = [
+    pkg-config
+    perl
+  ];
 
-  nativeBuildInputs = [ pkg-config ];
-
-  buildInputs = [ openssl ];
+  buildInputs = [
+    openssl
+  ];
 
   meta = {
     description = "CLI tool that converts your codebase into a single LLM prompt with a source tree, prompt templating, and token counting";
diff --git a/pkgs/by-name/co/coroot/package.nix b/pkgs/by-name/co/coroot/package.nix
index 923b36d20808..30a3d4d1f5e6 100644
--- a/pkgs/by-name/co/coroot/package.nix
+++ b/pkgs/by-name/co/coroot/package.nix
@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "coroot";
-  version = "1.22.0";
+  version = "1.23.2";
 
   src = fetchFromGitHub {
     owner = "coroot";
     repo = "coroot";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-FntRLdYazY/FeZrOp+DEV3eaaVhn5hxlE4dkUGbemTc=";
+    hash = "sha256-aOTn7keIM5xTcYLOUW+8pmfpXyMSE/+Yq42Uitlr4OE=";
   };
 
   vendorHash = "sha256-npMQah59pJqF6wgD2dlEleneIZbP/atDGEpjjb+KCpI=";
diff --git a/pkgs/by-name/ct/ctranslate2/package.nix b/pkgs/by-name/ct/ctranslate2/package.nix
index 35e175647aaf..812a6d88286f 100644
--- a/pkgs/by-name/ct/ctranslate2/package.nix
+++ b/pkgs/by-name/ct/ctranslate2/package.nix
@@ -51,13 +51,6 @@ stdenv'.mkDerivation (finalAttrs: {
         'CMAKE_MINIMUM_REQUIRED(VERSION 3.10 FATAL_ERROR)'
 
     sed -e '1i #include <cstdint>' -i third_party/cxxopts/include/cxxopts.hpp
-
-    # Prevent setting the default nvcc arch flags, which can be
-    # ones that don't work with the current CUDA version
-    substituteInPlace CMakeLists.txt \
-      --replace-fail \
-        'list(APPEND CUDA_NVCC_FLAGS ''${ARCH_FLAGS})' \
-        ""
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/da/daktari/package.nix b/pkgs/by-name/da/daktari/package.nix
index 6c2d4c810748..0a1b7f8574c9 100644
--- a/pkgs/by-name/da/daktari/package.nix
+++ b/pkgs/by-name/da/daktari/package.nix
@@ -7,7 +7,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "daktari";
-  version = "0.0.335";
+  version = "0.0.340";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -15,7 +15,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "genio-learn";
     repo = "daktari";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yIhtP5k1qoy59qR10Pv6dqh7X8MACvQRsSAJR/6kEJ4=";
+    hash = "sha256-gHBpezrya7i4Gh3dQHynS5vJtBhvXndruGsRRBBRde8=";
   };
 
   patches = [ ./optional-pyclip.patch ];
diff --git a/pkgs/by-name/da/dalfox/package.nix b/pkgs/by-name/da/dalfox/package.nix
index f20c03219d1e..1d0872f47438 100644
--- a/pkgs/by-name/da/dalfox/package.nix
+++ b/pkgs/by-name/da/dalfox/package.nix
@@ -1,10 +1,13 @@
 {
   lib,
-  buildGoModule,
   fetchFromGitHub,
+  openssl,
+  pkg-config,
+  rustPlatform,
+  versionCheckHook,
 }:
 
-buildGoModule (finalAttrs: {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "dalfox";
   version = "3.1.2";
 
@@ -15,20 +18,24 @@ buildGoModule (finalAttrs: {
     hash = "sha256-0amVlnLwwb7YAUbTce9gRmjv3W1FMgc2/XZQKCettTY=";
   };
 
-  vendorHash = null;
+  cargoHash = "sha256-pxlUEGCrJjoakAVpXFq2q73wEWiODsHvdax12quDlec=";
 
-  ldflags = [
-    "-w"
-    "-s"
-  ];
+  nativeBuildInputs = [ pkg-config ];
 
-  # Tests require network access
+  buildInputs = [ openssl ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  # Many unit tests perform live HTTP requests / OOB interactsh lookups and
+  # fail in the sandbox.
   doCheck = false;
 
+  doInstallCheck = true;
+
   meta = {
-    description = "Tool for analysing parameter and XSS scanning";
+    description = "Tool for analyzing parameter and XSS scanning";
     homepage = "https://github.com/hahwul/dalfox";
-    changelog = "https://github.com/hahwul/dalfox/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/hahwul/dalfox/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "dalfox";
diff --git a/pkgs/by-name/de/deck/package.nix b/pkgs/by-name/de/deck/package.nix
index c06bc72fb5f1..e7ec6588744b 100644
--- a/pkgs/by-name/de/deck/package.nix
+++ b/pkgs/by-name/de/deck/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "deck";
-  version = "1.63.0";
+  version = "1.64.0";
 
   src = fetchFromGitHub {
     owner = "Kong";
     repo = "deck";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WmzjFMOOyx65EGnHdn9pWItFh1HVIp1DbNNwtQrPnPQ=";
+    hash = "sha256-nVV1nNOQ5zqywUXg3vdyiudryWVRKiDWU0Yc8b0albo=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
@@ -28,7 +28,7 @@ buildGoModule (finalAttrs: {
   ];
 
   proxyVendor = true; # darwin/linux hash mismatch
-  vendorHash = "sha256-YJ8Q/m+yL9x5CYnIOtYWNYcVUy4lHm/IYSm7kNZqqt4=";
+  vendorHash = "sha256-lo+1ijaWod0UB2PXzmg806q2KYrVu9yNgkI/Nq2lyq4=";
 
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd deck \
diff --git a/pkgs/by-name/de/dethrace/package.nix b/pkgs/by-name/de/dethrace/package.nix
index 35620afd9a81..46cb6facf837 100644
--- a/pkgs/by-name/de/dethrace/package.nix
+++ b/pkgs/by-name/de/dethrace/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dethrace";
-  version = "0.9.0";
+  version = "0.10.1";
 
   src = fetchFromGitHub {
     owner = "dethrace-labs";
     repo = "dethrace";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+C3NyRLmvXrkZuhLGwIIHFWjXLMpt3srLZCVrxRUlkA=";
+    hash = "sha256-SGQGErlmsJEhjdvZa2YPJWwNFuZR4RL81W7meilw8t0=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/di/diffoscope/fix-tests-with-zipdetails-4.006.patch b/pkgs/by-name/di/diffoscope/fix-tests-with-zipdetails-4.006.patch
deleted file mode 100644
index 04593b366e76..000000000000
--- a/pkgs/by-name/di/diffoscope/fix-tests-with-zipdetails-4.006.patch
+++ /dev/null
@@ -1,97 +0,0 @@
-From fade8d04bfdbf473f3930feba7183957372e7fa7 Mon Sep 17 00:00:00 2001
-From: Michael Daniels <mdaniels5757@gmail.com>
-Date: Sun, 28 Jun 2026 16:20:43 -0400
-Subject: [PATCH] fix tests with zipdetails 4.006
-
----
- tests/comparators/test_zip.py            |  3 ++-
- tests/data/zip2_zipdetails_expected_diff |  2 +-
- tests/data/zip_zipdetails_expected_diff  | 10 +++++-----
- 3 files changed, 8 insertions(+), 7 deletions(-)
-
-diff --git a/tests/comparators/test_zip.py b/tests/comparators/test_zip.py
-index 75ec38be..ecff1930 100644
---- a/tests/comparators/test_zip.py
-+++ b/tests/comparators/test_zip.py
-@@ -81,7 +81,7 @@ def differences2(zip1, zip3):
- 
- 
- @skip_unless_tools_exist("zipinfo", "zipdetails")
--@skip_unless_tool_is_at_least("zipdetails", zipdetails_version, "4.004")
-+@skip_unless_tool_is_at_least("zipdetails", zipdetails_version, "4.006")
- @skip_unless_tool_is_at_least("perl", io_compress_zip_version, "2.212")
- def test_metadata(differences):
-     assert_diff(differences[0], "zip_zipinfo_expected_diff")
-@@ -96,6 +96,7 @@ def test_compressed_files(differences):
- 
- 
- @skip_unless_tools_exist("zipinfo", "bsdtar", "zipdetails")
-+@skip_unless_tool_is_at_least("zipdetails", zipdetails_version, "4.006")
- @skip_unless_tool_is_at_least("perl", io_compress_zip_version, "2.212")
- def test_extra_fields(differences2):
-     assert_diff(differences2[0], "zip_bsdtar_expected_diff")
-diff --git a/tests/data/zip2_zipdetails_expected_diff b/tests/data/zip2_zipdetails_expected_diff
-index 291dca88..281cf6c5 100644
---- a/tests/data/zip2_zipdetails_expected_diff
-+++ b/tests/data/zip2_zipdetails_expected_diff
-@@ -5,7 +5,7 @@
-  #
-  0064 Extra ID #1           5455 (21589) 'Extended Timestamp [UT]'
-  0066   Length              0009 (9)
-- 0068   Flags               03 (3) 'Modification Access'
-+ 0068   Flags               03 (3) 'Modification & Access'
- -0069   Modification Time   558AB455 (1435153493) 'Wed Jun 24 13:44:53 2015'
- -006D   Access Time         558AB45F (1435153503) 'Wed Jun 24 13:45:03 2015'
- +0069   Modification Time   41414141 (1094795585) 'Fri Sep 10 05:53:05 2004'
-diff --git a/tests/data/zip_zipdetails_expected_diff b/tests/data/zip_zipdetails_expected_diff
-index 978c2583..50df2696 100644
---- a/tests/data/zip_zipdetails_expected_diff
-+++ b/tests/data/zip_zipdetails_expected_diff
-@@ -23,7 +23,7 @@
-  #
-  0064 Extra ID #1           5455 (21589) 'Extended Timestamp [UT]'
-  0066   Length              0009 (9)
-- 0068   Flags               03 (3) 'Modification Access'
-+ 0068   Flags               03 (3) 'Modification & Access'
- -0069   Modification Time   558AB455 (1435153493) 'Wed Jun 24 13:44:53 2015'
- +0069   Modification Time   558AB474 (1435153524) 'Wed Jun 24 13:45:24 2015'
-  006D   Access Time         558AB45F (1435153503) 'Wed Jun 24 13:45:03 2015'
-@@ -85,7 +85,7 @@
-  #
- -01BF Extra ID #1           5455 (21589) 'Extended Timestamp [UT]'
- -01C1   Length              0005 (5)
---01C3   Flags               03 (3) 'Modification Access'
-+-01C3   Flags               03 (3) 'Modification & Access'
- -01C4   Modification Time   558AB455 (1435153493) 'Wed Jun 24 13:44:53 2015'
- -01C8 Extra ID #2           7875 (30837) 'Unix Extra type 3 [ux]'
- -01CA   Length              000B (11)
-@@ -96,7 +96,7 @@
- -01D3   GID                 000003E8 (1000)
- +024E Extra ID #1           5455 (21589) 'Extended Timestamp [UT]'
- +0250   Length              0005 (5)
--+0252   Flags               03 (3) 'Modification Access'
-++0252   Flags               03 (3) 'Modification & Access'
- +0253   Modification Time   558AB455 (1435153493) 'Wed Jun 24 13:44:53 2015'
- +0257 Extra ID #2           7875 (30837) 'Unix Extra type 3 [ux]'
- +0259   Length              000B (11)
-@@ -163,7 +163,7 @@
-  #
- -020D Extra ID #1           5455 (21589) 'Extended Timestamp [UT]'
- -020F   Length              0005 (5)
---0211   Flags               03 (3) 'Modification Access'
-+-0211   Flags               03 (3) 'Modification & Access'
- -0212   Modification Time   558AB455 (1435153493) 'Wed Jun 24 13:44:53 2015'
- -0216 Extra ID #2           7875 (30837) 'Unix Extra type 3 [ux]'
- -0218   Length              000B (11)
-@@ -174,7 +174,7 @@
- -0221   GID                 000003E8 (1000)
- +029C Extra ID #1           5455 (21589) 'Extended Timestamp [UT]'
- +029E   Length              0005 (5)
--+02A0   Flags               03 (3) 'Modification Access'
-++02A0   Flags               03 (3) 'Modification & Access'
- +02A1   Modification Time   558AB474 (1435153524) 'Wed Jun 24 13:45:24 2015'
- +02A5 Extra ID #2           7875 (30837) 'Unix Extra type 3 [ux]'
- +02A7   Length              000B (11)
--- 
-2.54.0
-
diff --git a/pkgs/by-name/di/diffoscope/package.nix b/pkgs/by-name/di/diffoscope/package.nix
index dc5169673518..5898aba19644 100644
--- a/pkgs/by-name/di/diffoscope/package.nix
+++ b/pkgs/by-name/di/diffoscope/package.nix
@@ -109,12 +109,12 @@ in
 # Note: when upgrading this package, please run the list-missing-tools.sh script as described below!
 python.pkgs.buildPythonApplication rec {
   pname = "diffoscope";
-  version = "322";
+  version = "323";
   pyproject = true;
 
   src = fetchurl {
     url = "https://diffoscope.org/archive/diffoscope-${version}.tar.bz2";
-    hash = "sha256-dina2JdbLL/jfo4eMuUo62KggST95w0b7oonY86zjgk=";
+    hash = "sha256-TFSeCS7D2D496rUrosYAWP4kHsu6x386c8AJ5c4aKYs=";
   };
 
   outputs = [
@@ -124,10 +124,6 @@ python.pkgs.buildPythonApplication rec {
 
   patches = [
     ./ignore_links.patch
-    # Remove flags output from an OCaml test's diff, as it's Debian-specific
-    ./remove-flags-from-ocaml-diff.patch
-    # https://salsa.debian.org/reproducible-builds/diffoscope/-/merge_requests/166
-    ./fix-tests-with-zipdetails-4.006.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/by-name/di/diffoscope/remove-flags-from-ocaml-diff.patch b/pkgs/by-name/di/diffoscope/remove-flags-from-ocaml-diff.patch
deleted file mode 100644
index 61138d263c6e..000000000000
--- a/pkgs/by-name/di/diffoscope/remove-flags-from-ocaml-diff.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From 18cf9ab675691c7173a9b7fafd6d521c3ea75862 Mon Sep 17 00:00:00 2001
-From: Michael Daniels <mdaniels5757@gmail.com>
-Date: Sat, 20 Jun 2026 11:42:29 -0400
-Subject: [PATCH] tests/data/ocaml_expected_diff: remove flags from diff
-
-This output comes from a Debian-specific OCaml patch, see
-https://salsa.debian.org/ocaml-team/ocaml/-/blob/archive/debian/5.4.1-1/debian/patches/Print-.cmi-flags-in-objinfo.patch
----
- tests/data/ocaml_expected_diff | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/tests/data/ocaml_expected_diff b/tests/data/ocaml_expected_diff
-index 79631882..a48de841 100644
---- a/tests/data/ocaml_expected_diff
-+++ b/tests/data/ocaml_expected_diff
-@@ -1,7 +1,6 @@
--@@ -1,6 +1,6 @@
-+@@ -1,5 +1,5 @@
- -Unit name: Test1
- +Unit name: Test2
-- Flags: [ Alerts _ ]
-  Interfaces imported:
- -	351c2dc2fb4a56dac258b47c26262db6	Test1
- +	ac02205dc900024a67ede9f394c59d72	Test2
--- 
-2.54.0
-
diff --git a/pkgs/by-name/do/docker-sbx/package.nix b/pkgs/by-name/do/docker-sbx/package.nix
new file mode 100644
index 000000000000..74cecebba681
--- /dev/null
+++ b/pkgs/by-name/do/docker-sbx/package.nix
@@ -0,0 +1,128 @@
+{
+  lib,
+  fetchurl,
+  stdenvNoCC,
+  installShellFiles,
+  autoPatchelfHook,
+  makeWrapper,
+  gccForLibs,
+  e2fsprogs,
+  lz4,
+  xxhash,
+  zlib,
+  zstd,
+  versionCheckHook,
+  nix-update-script,
+}:
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "docker-sbx";
+  version = "0.34.0";
+  src =
+    if stdenvNoCC.hostPlatform.system == "x86_64-linux" then
+      fetchurl {
+        url = "https://github.com/docker/sbx-releases/releases/download/v${finalAttrs.version}/DockerSandboxes-linux-amd64.tar.gz";
+        hash = "sha256-5H9LOyKi0/SBVJ0ld6OkcP1h9r9eHrAb4fsVVVdMusg=";
+      }
+    else if stdenvNoCC.hostPlatform.system == "aarch64-linux" then
+      fetchurl {
+        url = "https://github.com/docker/sbx-releases/releases/download/v${finalAttrs.version}/DockerSandboxes-linux-arm64.tar.gz";
+        hash = "sha256-dZ/ttnmaf62rA5Cs8YSmZGHVQoy9PQh3Ok/AnIjCqZ4=";
+      }
+    else if stdenvNoCC.hostPlatform.system == "aarch64-darwin" then
+      fetchurl {
+        url = "https://github.com/docker/sbx-releases/releases/download/v${finalAttrs.version}/DockerSandboxes-darwin.tar.gz";
+        hash = "sha256-aBh6NbtQ5o2zxuR+d1U1gZpm2bch/J3Y8GZ73DeUBUk=";
+      }
+    else
+      throw "Unsupported host platform ${stdenvNoCC.hostPlatform.system}";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  sourceRoot = if stdenvNoCC.hostPlatform.isDarwin then "." else null;
+
+  nativeBuildInputs = [
+    installShellFiles
+    versionCheckHook
+  ]
+  ++ lib.optionals stdenvNoCC.hostPlatform.isLinux [
+    autoPatchelfHook
+    makeWrapper
+    e2fsprogs
+  ];
+
+  buildInputs = lib.optionals stdenvNoCC.hostPlatform.isLinux [
+    lz4
+    zlib
+    zstd
+    xxhash
+    gccForLibs
+  ];
+
+  dontBuild = true;
+  doInstallCheck = true;
+  versionCheckProgramArg = "version";
+  versionCheckKeepEnvironment = [ "HOME" ];
+  preVersionCheck = ''
+    export HOME=$TMPDIR
+  '';
+
+  installPhase =
+    if stdenvNoCC.hostPlatform.isLinux then
+      ''
+        runHook preInstall
+
+        PREFIX=$out bash ./install.sh
+
+        wrapProgram $out/bin/sbx \
+          --prefix PATH : ${lib.makeBinPath [ e2fsprogs ]}
+
+        ${lib.optionalString (stdenvNoCC.buildPlatform.canExecute stdenvNoCC.hostPlatform) ''
+          export HOME=$TMPDIR
+          $out/bin/sbx completion bash > sbx.bash
+          $out/bin/sbx completion fish > sbx.fish
+          $out/bin/sbx completion zsh  > sbx.zsh
+          installShellCompletion sbx.{bash,fish,zsh}
+        ''}
+
+        runHook postInstall
+      ''
+    else
+      ''
+        runHook preInstall
+
+        mkdir -pv $out
+        cp -rv bin libexec $out
+
+        installShellCompletion \
+          --bash --name sbx.bash completions/bash/sbx \
+          --zsh  --name _sbx     completions/zsh/_sbx \
+          --fish --name sbx.fish completions/fish/sbx.fish
+
+        runHook postInstall
+      '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Safe environments for agents";
+    longDescription = ''
+      Docker Sandboxes provides sandboxes with controlled access to your
+      filesystem, network, and tools. This means your agents can work
+      autonomously without putting your machine or data at risk.
+    '';
+    homepage = "https://docs.docker.com/reference/cli/sbx/";
+    changelog = "https://github.com/docker/sbx-releases/releases/tag/v${finalAttrs.version}";
+    mainProgram = "sbx";
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+      "aarch64-darwin"
+    ];
+    license = lib.licenses.unfree;
+    maintainers = [
+      lib.maintainers.skyesoss
+      lib.maintainers.erics118
+    ];
+  };
+})
diff --git a/pkgs/by-name/du/dumpifs/package.nix b/pkgs/by-name/du/dumpifs/package.nix
index 6966e375bd7c..c01a80115082 100644
--- a/pkgs/by-name/du/dumpifs/package.nix
+++ b/pkgs/by-name/du/dumpifs/package.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   postUnpack = ''
-    rm source/{dumpifs,exMifsLzo,uuu,zzz}
+    rm ${finalAttrs.src.name}/{dumpifs,exMifsLzo,uuu,zzz}
   '';
 
   patches = [ ./package.patch ];
diff --git a/pkgs/by-name/el/electron-mail/package.nix b/pkgs/by-name/el/electron-mail/package.nix
index 22ed742e22d5..335241bfcf75 100644
--- a/pkgs/by-name/el/electron-mail/package.nix
+++ b/pkgs/by-name/el/electron-mail/package.nix
@@ -10,20 +10,20 @@
 
 let
   pname = "electron-mail";
-  version = "5.3.7";
+  version = "5.3.8";
 
   sources = {
     x86_64-linux = fetchurl {
       url = "https://github.com/vladimiry/ElectronMail/releases/download/v${version}/electron-mail-${version}-linux-x86_64.AppImage";
-      hash = "sha256-VJbCQ/4yIuBE4NPDFUbp8t2G/QjUclphH/MghvamDVo=";
+      hash = "sha256-twqB1D3zLlZJuxQWD4dGF70w57yYv6i3abGBidERsss=";
     };
     aarch64-darwin = fetchurl {
       url = "https://github.com/vladimiry/ElectronMail/releases/download/v${version}/electron-mail-${version}-mac-arm64.dmg";
-      hash = "sha256-ulB+dlp6ZBhcBJiLY4k+E/oEWy9XSIuIzd5rTzEq9+4=";
+      hash = "sha256-V32Wi0oCU9dLfzqxg3OdseiILX7wPiBGNz7KuG0vlZY=";
     };
     x86_64-darwin = fetchurl {
       url = "https://github.com/vladimiry/ElectronMail/releases/download/v${version}/electron-mail-${version}-mac-x64.dmg";
-      hash = "sha256-LbAqUj34m8qSq8sQ1xgCQj9+MfJHoFDRMq+/waMKtzM=";
+      hash = "sha256-I1UvFMSdAwkqgkhn+mkBGslA8v+VTajO/Za0lJ5uYZ8=";
     };
   };
 
diff --git a/pkgs/by-name/em/embedxpl/package.nix b/pkgs/by-name/em/embedxpl/package.nix
index d0dc0c484c3e..71069e1fa840 100644
--- a/pkgs/by-name/em/embedxpl/package.nix
+++ b/pkgs/by-name/em/embedxpl/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "embedxpl";
-  version = "3.8.1";
+  version = "3.8.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mrhenrike";
     repo = "EmbedXPL-Forge";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-y3Ftmqb5RnY1U2uqrq4Olyr0I0ZVJo/pgMY7RpbZqlU=";
+    hash = "sha256-L3gY2wna1V7nF/vGwr1hzq8WeQxTTsvgKMAatVUKZ9E=";
   };
 
   __structuredAttrs = true;
diff --git a/pkgs/by-name/en/enzyme/package.nix b/pkgs/by-name/en/enzyme/package.nix
index 60df13ea76ef..79d889e24f39 100644
--- a/pkgs/by-name/en/enzyme/package.nix
+++ b/pkgs/by-name/en/enzyme/package.nix
@@ -7,13 +7,13 @@
 }:
 llvmPackages.stdenv.mkDerivation rec {
   pname = "enzyme";
-  version = "0.0.271";
+  version = "0.0.277";
 
   src = fetchFromGitHub {
     owner = "EnzymeAD";
     repo = "Enzyme";
     rev = "v${version}";
-    hash = "sha256-R3hdy6VSTHBe2ei4aysJhrc++ptQioVe88p/c2CuUP4=";
+    hash = "sha256-GAICiChPRRFBsZsQtCpPBzNvjWpx5YSAlwYL0/fEe5A=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/fa/faraday-agent-dispatcher/package.nix b/pkgs/by-name/fa/faraday-agent-dispatcher/package.nix
index b371db2fd199..7229bcf79d0a 100644
--- a/pkgs/by-name/fa/faraday-agent-dispatcher/package.nix
+++ b/pkgs/by-name/fa/faraday-agent-dispatcher/package.nix
@@ -2,6 +2,7 @@
   lib,
   fetchFromGitHub,
   python3,
+  writableTmpDirAsHomeHook,
 }:
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
@@ -21,6 +22,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
       --replace-fail '"pytest-runner",' ""  '';
 
   pythonRelaxDeps = [
+    "pytenable"
     "python-socketio"
   ];
 
@@ -28,13 +30,9 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     "python-owasp-zap-v2.4"
   ];
 
-  build-system = with python3.pkgs; [
-    setuptools-scm
-  ];
+  build-system = with python3.pkgs; [ setuptools-scm ];
 
-  nativeBuildInputs = [
-    python3.pkgs.python-owasp-zap-v2-4
-  ];
+  nativeBuildInputs = with python3.pkgs; [ python-owasp-zap-v2-4 ];
 
   dependencies = with python3.pkgs; [
     aiohttp
@@ -57,12 +55,9 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
   nativeCheckInputs = with python3.pkgs; [
     pytest-asyncio
     pytestCheckHook
+    writableTmpDirAsHomeHook
   ];
 
-  preCheck = ''
-    export HOME=$(mktemp -d);
-  '';
-
   disabledTests = [
     "test_execute_agent"
     "SSL"
@@ -74,14 +69,12 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     "tests/unittests/test_import_official_executors.py"
   ];
 
-  pythonImportsCheck = [
-    "faraday_agent_dispatcher"
-  ];
+  pythonImportsCheck = [ "faraday_agent_dispatcher" ];
 
   meta = {
     description = "Tool to send result from tools to the Faraday Platform";
     homepage = "https://github.com/infobyte/faraday_agent_dispatcher";
-    changelog = "https://github.com/infobyte/faraday_agent_dispatcher/releases/tag/${finalAttrs.version}";
+    changelog = "https://github.com/infobyte/faraday_agent_dispatcher/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "faraday-dispatcher";
diff --git a/pkgs/by-name/fe/fetchtastic/package.nix b/pkgs/by-name/fe/fetchtastic/package.nix
index bbc80f11b9cc..6d17d5b252f3 100644
--- a/pkgs/by-name/fe/fetchtastic/package.nix
+++ b/pkgs/by-name/fe/fetchtastic/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "fetchtastic";
-  version = "0.10.10";
+  version = "0.10.11";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jeremiah-k";
     repo = "fetchtastic";
     tag = finalAttrs.version;
-    hash = "sha256-ImXBH1mvJE+Ae7fUqR/Z381TKGt6hq0BRHhdtOz3YO4=";
+    hash = "sha256-/kp9bfJJLffZp+9dEY7G+RQmE43XXwNozkDYjeAjPkc=";
   };
 
   pythonRelaxDeps = [ "platformdirs" ];
diff --git a/pkgs/by-name/fl/flarum/package.nix b/pkgs/by-name/fl/flarum/package.nix
index 227eb5b395fe..d79a26a5bb34 100644
--- a/pkgs/by-name/fl/flarum/package.nix
+++ b/pkgs/by-name/fl/flarum/package.nix
@@ -2,6 +2,7 @@
   lib,
   php,
   fetchFromGitHub,
+  nixosTests,
 }:
 
 php.buildComposerProject2 (finalAttrs: {
@@ -19,6 +20,8 @@ php.buildComposerProject2 (finalAttrs: {
   composerStrictValidation = false;
   vendorHash = "sha256-EHl+Mr6y5A51EpLPAWUGtiPkLOky6KvsSY4JWHeyO28=";
 
+  passthru.tests.module = nixosTests.flarum;
+
   meta = {
     changelog = "https://github.com/flarum/framework/blob/main/CHANGELOG.md";
     description = "Delightfully simple discussion platform for your website";
diff --git a/pkgs/by-name/fl/flyctl/package.nix b/pkgs/by-name/fl/flyctl/package.nix
index c4251bf2aecb..5890e1c2af06 100644
--- a/pkgs/by-name/fl/flyctl/package.nix
+++ b/pkgs/by-name/fl/flyctl/package.nix
@@ -12,7 +12,7 @@
 
 buildGoModule rec {
   pname = "flyctl";
-  version = "0.4.60";
+  version = "0.4.63";
 
   src = fetchFromGitHub {
     owner = "superfly";
@@ -22,11 +22,11 @@ buildGoModule rec {
       cd "$out"
       git rev-parse HEAD > COMMIT
     '';
-    hash = "sha256-ToKKn3Scj++VLv0SCMNQHkbffs2aADto0tLv80aFqzc=";
+    hash = "sha256-dGqL6lKx67VzlfHvaCpOTpHtFao99zLIYXiORPHP5e8=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-XBpLOhC3fY18o0tQZXgyKrQRgd84U5SRo6Rrgkuq4f8=";
+  vendorHash = "sha256-X6cEAaUIHTJoNwoBlGFZUA4M8/AnRY3oTiWW7/03PXY=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/fo/forgejo-mcp/package.nix b/pkgs/by-name/fo/forgejo-mcp/package.nix
index cf5cdef3bbc1..72b5cb81d249 100644
--- a/pkgs/by-name/fo/forgejo-mcp/package.nix
+++ b/pkgs/by-name/fo/forgejo-mcp/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "forgejo-mcp";
-  version = "2.30.0";
+  version = "2.30.1";
 
   src = fetchFromCodeberg {
     owner = "goern";
     repo = "forgejo-mcp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DV8lL6Q/0gD8mFn3q5UusHv8ahNtmk9t9vtbhpvpxBs=";
+    hash = "sha256-Xi75PFZuNKDfxFhnwYsArD9GphrRLxJlFZgzocMR4C4=";
   };
 
   vendorHash = "sha256-QDJRbF4mZzBv1vxvo1ZQJaUJayRHj1jMgjaRfAmLMik=";
diff --git a/pkgs/by-name/fr/freelens-bin/package.nix b/pkgs/by-name/fr/freelens-bin/package.nix
index 19f61da6d001..adc3239312c1 100644
--- a/pkgs/by-name/fr/freelens-bin/package.nix
+++ b/pkgs/by-name/fr/freelens-bin/package.nix
@@ -16,24 +16,24 @@
 let
 
   pname = "freelens-bin";
-  version = "1.10.1";
+  version = "1.10.2";
 
   sources = {
     x86_64-linux = {
       url = "https://github.com/freelensapp/freelens/releases/download/v${version}/Freelens-${version}-linux-amd64.AppImage";
-      hash = "sha256-Hbu28vbgaSEjJTAVSfHJ3cZGd2PRU0ex7dNv0wo1SrI=";
+      hash = "sha256-l+6QnlDnNs2t4auJRS0MLy592OfQDd0tDNqiVH5xJ3g=";
     };
     aarch64-linux = {
       url = "https://github.com/freelensapp/freelens/releases/download/v${version}/Freelens-${version}-linux-arm64.AppImage";
-      hash = "sha256-JrApeOjMXNNi/wCq6vY6rYpPGgMWti0H+2i7QNEXaTc=";
+      hash = "sha256-Pw6RPa6T9jN7XAfOqj6lDFzTqhwOT1DgK35cANyBAOE=";
     };
     x86_64-darwin = {
       url = "https://github.com/freelensapp/freelens/releases/download/v${version}/Freelens-${version}-macos-amd64.dmg";
-      hash = "sha256-BIBEaQFny/DvzrvsC38UPiIqBFaxUO/DOVQTIe2gL+Q=";
+      hash = "sha256-6qn/3Zly7nvj9XxihUdmkguLWw0a7Y321Xv7EnJzjkc=";
     };
     aarch64-darwin = {
       url = "https://github.com/freelensapp/freelens/releases/download/v${version}/Freelens-${version}-macos-arm64.dmg";
-      hash = "sha256-5duswriuDmL92tXqLckBhH2RMPFDqFRG/WW9oYMClGY=";
+      hash = "sha256-ARIvUMkkdUK5O6xdplXJ/JkPdezO/16HvO2P21W6y8I=";
     };
   };
 
diff --git a/pkgs/by-name/fr/frotz/package.nix b/pkgs/by-name/fr/frotz/package.nix
index 845cc7f48790..f78b72dc3ade 100644
--- a/pkgs/by-name/fr/frotz/package.nix
+++ b/pkgs/by-name/fr/frotz/package.nix
@@ -83,7 +83,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://davidgriffith.gitlab.io/frotz/";
-    changelog = "https://gitlab.com/DavidGriffith/frotz/-/raw/${finalAttrs.version}/NEWS";
+    changelog = "https://gitlab.com/DavidGriffith/frotz/-/raw/${finalAttrs.version}/ChangeLog";
     description = "Z-machine interpreter for Infocom games and other interactive fiction (${frontend})";
     mainProgram = progName;
     platforms = lib.platforms.unix;
diff --git a/pkgs/by-name/ga/gamemac/package.nix b/pkgs/by-name/ga/gamemac/package.nix
new file mode 100644
index 000000000000..4e0bd43b621a
--- /dev/null
+++ b/pkgs/by-name/ga/gamemac/package.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  undmg,
+  makeWrapper,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "gamemac";
+  version = "0.8.328";
+
+  src = fetchurl {
+    name = "GameHub_en_${finalAttrs.version}.dmg";
+    url = "https://gamehub-cdn.masnet.cn/uploads/upgrade/20260618/b616a96780c249a789d95f7b897333cb.dmg";
+    hash = "sha256-uo/kr9PAFREfbkXX9hpJJNT6OZDv3jnOuZgc2fwtSyM=";
+  };
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [
+    undmg
+    makeWrapper
+  ];
+
+  sourceRoot = ".";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/Applications" "$out/bin"
+    mv GameHub.app "$out/Applications/"
+    makeWrapper "$out/Applications/GameHub.app/Contents/MacOS/GameHub" "$out/bin/GameHub"
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = ./update.sh;
+
+  meta = {
+    description = "Play mobile games natively on macOS";
+    homepage = "https://www.gamemac.com/en/";
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ damidoug ];
+    mainProgram = "GameHub";
+    platforms = lib.platforms.darwin;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+})
diff --git a/pkgs/by-name/ga/gamemac/update.sh b/pkgs/by-name/ga/gamemac/update.sh
new file mode 100755
index 000000000000..e12550fcc7d6
--- /dev/null
+++ b/pkgs/by-name/ga/gamemac/update.sh
@@ -0,0 +1,32 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p bash curl gnused nix
+
+set -euo pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")"
+
+ROLLING_URL="https://api-international-gamehub.xiaoji.com/game/download/mac/en"
+UA="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
+
+# Resolve rolling URL to stable CDN URL (strip query string)
+DIRECT_URL=$(curl -fsSL -A "$UA" -w "%{url_effective}" -o /dev/null "$ROLLING_URL")
+CDN_URL="${DIRECT_URL%%\?*}"
+
+# Extract version from CDN filename (e.g. .../GameHub_en_0.8.328.dmg)
+VERSION=$(basename "$CDN_URL" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')
+
+CURRENT=$(grep 'version = ' package.nix | head -1 | grep -oE '"[0-9.]+"' | tr -d '"')
+if [ "$VERSION" = "$CURRENT" ]; then
+  echo "Already at $VERSION"
+  exit 0
+fi
+
+HASH=$(nix-prefetch-url --name "GameHub_en_${VERSION}.dmg" --type sha256 "$CDN_URL")
+SRI=$(nix-hash --to-sri --type sha256 "$HASH")
+
+sed -i \
+  -e "s|version = \"[^\"]*\"|version = \"$VERSION\"|" \
+  -e "s|https://gamehub-cdn\.masnet\.cn/uploads/upgrade/[^\"]*|$CDN_URL|" \
+  -e "s|hash = \"sha256-[^\"]*\"|hash = \"$SRI\"|" \
+  package.nix
+
+echo "Updated $CURRENT -> $VERSION"
diff --git a/pkgs/by-name/gc/gcx/package.nix b/pkgs/by-name/gc/gcx/package.nix
index a5bcefec7be5..9cc520404eac 100644
--- a/pkgs/by-name/gc/gcx/package.nix
+++ b/pkgs/by-name/gc/gcx/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gcx";
-  version = "0.4.0";
+  version = "0.4.2";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "gcx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6ZKlNLtP3dwPAIXGnupIk0wuXs+qMy2d2OreKfKJlxM=";
+    hash = "sha256-Gf05N13ZJLjB55eCcIfXIoJn3CVAAR5mcFyEq8s+RxY=";
   };
 
-  vendorHash = "sha256-FzhQfooCApBsnNH/cZYFfy3m4cDSBVX9ueaWfhTgx1k=";
+  vendorHash = "sha256-JioNpEqGFxD6Gg84ZZ/9OrETxTGn2V+HMlGGiiZfeIo=";
 
   subPackages = [ "cmd/gcx" ];
 
diff --git a/pkgs/by-name/gh/ghostfolio/package.nix b/pkgs/by-name/gh/ghostfolio/package.nix
index 5ee10e29eb8f..11b14a9bcb6d 100644
--- a/pkgs/by-name/gh/ghostfolio/package.nix
+++ b/pkgs/by-name/gh/ghostfolio/package.nix
@@ -12,13 +12,13 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "ghostfolio";
-  version = "3.13.0";
+  version = "3.18.0";
 
   src = fetchFromGitHub {
     owner = "ghostfolio";
     repo = "ghostfolio";
     tag = finalAttrs.version;
-    hash = "sha256-tPVGMAP45x/4NTL8px9jEbW6hQyhiOYiZp0tuDdfYL8=";
+    hash = "sha256-BSH7NQV2iTmfGE6dHQEeObQQ5CkKZxsgHAbrjElHHHE=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -28,7 +28,7 @@ buildNpmPackage (finalAttrs: {
     '';
   };
 
-  npmDepsHash = "sha256-0/tHzfJrotlCxhiiVC6yddlj62Ef6IAeaZf/xufFiWU=";
+  npmDepsHash = "sha256-0Si+3zHyGoMbgEpNWdZVp+obNE0oqM8ghYDZvloJU5g=";
 
   postPatch = ''
     substituteInPlace replace.build.mjs \
diff --git a/pkgs/by-name/gi/git-machete/package.nix b/pkgs/by-name/gi/git-machete/package.nix
index d3a7763334ef..4fc954b08a34 100644
--- a/pkgs/by-name/gi/git-machete/package.nix
+++ b/pkgs/by-name/gi/git-machete/package.nix
@@ -9,14 +9,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "git-machete";
-  version = "3.41.0";
+  version = "3.44.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "virtuslab";
     repo = "git-machete";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3BofEBgHgtdpQeaMx1BaNtDQ/HmX3GYagKOVHGq1+os=";
+    hash = "sha256-3yUzHzhc6qHw8jPbO9ZMsffhXgEyAlT2NzYCuC9/qsc=";
   };
 
   build-system = with python3.pkgs; [ setuptools ];
diff --git a/pkgs/by-name/gi/git-mit/package.nix b/pkgs/by-name/gi/git-mit/package.nix
index adb4c7f12c76..7b30aecb3479 100644
--- a/pkgs/by-name/gi/git-mit/package.nix
+++ b/pkgs/by-name/gi/git-mit/package.nix
@@ -9,7 +9,7 @@
 }:
 
 let
-  version = "6.4.3";
+  version = "6.5.2";
 in
 rustPlatform.buildRustPackage {
   pname = "git-mit";
@@ -19,10 +19,10 @@ rustPlatform.buildRustPackage {
     owner = "PurpleBooth";
     repo = "git-mit";
     tag = "v${version}";
-    hash = "sha256-Id7S0qE1020pPMoyCl8jkHWrbdOb6FZHLNsqRvwjpf8=";
+    hash = "sha256-5tVNCvaNxW9Ko+x2GWi3fMpyuwxgjMNLTED6gvxagnI=";
   };
 
-  cargoHash = "sha256-edKtumK9HGIXHy/ZdxZ1+lxYi+cS5G129E+WK9/JE10=";
+  cargoHash = "sha256-gSvFdvW+XW0MGFkwAkVrcC1ETjoGaFJxioD9ENEpml4=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/gi/github-mcp-server/package.nix b/pkgs/by-name/gi/github-mcp-server/package.nix
index 3cab6eaa7ee1..8789264aba3d 100644
--- a/pkgs/by-name/gi/github-mcp-server/package.nix
+++ b/pkgs/by-name/gi/github-mcp-server/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "github-mcp-server";
-  version = "1.4.0";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "github";
     repo = "github-mcp-server";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5INN7B/F1KcyZwZ3xeOBiCnfAdK1PXVnMZf3t8JIk6I=";
+    hash = "sha256-O8ooNaFmWXMhsn7UQITgo48VkdYbVTCC4WkHoU9abyo=";
   };
 
   vendorHash = "sha256-J1hC4hdEKLENXLJrsyV41TaJ9+2CuPz5KoIMm2mXvTE=";
diff --git a/pkgs/by-name/gi/gitify/package.nix b/pkgs/by-name/gi/gitify/package.nix
index b78302dcb6d7..a1a7e0824265 100644
--- a/pkgs/by-name/gi/gitify/package.nix
+++ b/pkgs/by-name/gi/gitify/package.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  pnpm_10_29_2,
+  pnpm_10,
   fetchPnpmDeps,
   pnpmConfigHook,
   nodejs,
@@ -14,7 +14,7 @@
   nix-update-script,
 }:
 let
-  pnpm = pnpm_10_29_2;
+  pnpm = pnpm_10;
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gitify";
diff --git a/pkgs/by-name/gi/gitlab-ci-validate/package.nix b/pkgs/by-name/gi/gitlab-ci-validate/package.nix
new file mode 100644
index 000000000000..7d428ed66608
--- /dev/null
+++ b/pkgs/by-name/gi/gitlab-ci-validate/package.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "gitlab-ci-validate";
+  version = "0.6.0";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "Code0x58";
+    repo = "gitlab-ci-validate";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-j32knPhVio2OTATkW1Z3SMMYwl9u6Lh00Rell/knQ/0=";
+  };
+
+  vendorHash = "sha256-/+iu9SIaLtE51xcEzgA8dCp0eTAoPskp4xGlm1bsXTs=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=main.version=${finalAttrs.version}"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Command line tool to validate .gitlab-ci.yml files";
+    homepage = "https://github.com/Code0x58/gitlab-ci-validate";
+    changelog = "https://github.com/Code0x58/gitlab-ci-validate/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ drupol ];
+    mainProgram = "gitlab-ci-validate";
+  };
+})
diff --git a/pkgs/by-name/gl/glitchtip/frontend.nix b/pkgs/by-name/gl/glitchtip/frontend.nix
index e57cd1aef060..86c37d73d166 100644
--- a/pkgs/by-name/gl/glitchtip/frontend.nix
+++ b/pkgs/by-name/gl/glitchtip/frontend.nix
@@ -10,13 +10,13 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "glitchtip-frontend";
-  version = "6.1.8";
+  version = "6.2.0";
 
   src = fetchFromGitLab {
     owner = "glitchtip";
     repo = "glitchtip-frontend";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-y8NPj1xjGnGS9yBFaRjFRxLdTGrAq08T9N7cZN5IeSc=";
+    hash = "sha256-iKY1w9lmfuyvDblH/TlnUwAnda17qWGxmx1qtmQRENg=";
   };
 
   nodejs = nodejs_22;
@@ -25,7 +25,7 @@ buildNpmPackage (finalAttrs: {
     name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";
     inherit (finalAttrs) src;
     npmDepsFetcherVersion = 3;
-    hash = "sha256-AIzPJpNvGV/U71UFAUwOqx8kb31s7LXhMha4bXV+oCU=";
+    hash = "sha256-V9aRKoJ6+BN/q7NS21eZBopzkWje8sOGGL1AgO4cUM0=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/gl/glitchtip/glitchtip-rust.nix b/pkgs/by-name/gl/glitchtip/glitchtip-rust.nix
new file mode 100644
index 000000000000..455d00a4614a
--- /dev/null
+++ b/pkgs/by-name/gl/glitchtip/glitchtip-rust.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitLab,
+  rustPlatform,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "glitchtip-rust";
+  version = "0.3.0";
+  pyproject = true;
+
+  src = fetchFromGitLab {
+    owner = "glitchtip";
+    repo = "glitchtip-rust";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-0FG+seIWqfyOG3JR0WF4ICnxMAPx9FO0JyFSB43CttU=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-14j7h4TgQhTE5oihnvjAxtGZhPajuTRD4Cga8xzN9Lg=";
+  };
+
+  nativeBuildInputs = [
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+  ];
+
+  pythonImportsCheck = [ "gt_rust" ];
+
+  meta = {
+    description = "Rust components of GlitchTip Backend";
+    homepage = "https://glitchtip.com";
+    changelog = "https://gitlab.com/glitchtip/glitchtip-rust/-/tags/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      defelo
+      felbinger
+    ];
+  };
+})
diff --git a/pkgs/by-name/gl/glitchtip/package.nix b/pkgs/by-name/gl/glitchtip/package.nix
index 60e7ef7aae3a..a623377e0b95 100644
--- a/pkgs/by-name/gl/glitchtip/package.nix
+++ b/pkgs/by-name/gl/glitchtip/package.nix
@@ -13,6 +13,7 @@ let
     self = python;
     packageOverrides = final: prev: {
       django = final.django_6;
+      glitchtip-rust = final.callPackage ./glitchtip-rust.nix { };
     };
   };
 
@@ -24,7 +25,6 @@ let
       arro3-core
       arro3-io
       boto3
-      brotli
       cxxfilt
       django
       django-allauth
@@ -46,8 +46,10 @@ let
       duckdb
       google-cloud-logging
       granian
+      glitchtip-rust
       mcp
       minidump
+      opentelemetry-proto
       orjson
       psycopg
       pydantic
@@ -77,14 +79,14 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "glitchtip";
-  version = "6.1.8";
+  version = "6.2.0";
   pyproject = true;
 
   src = fetchFromGitLab {
     owner = "glitchtip";
     repo = "glitchtip-backend";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4RAZYGoS1tUbcPVv8L0sFWqFfBX05yXKZHFZDbEn0C0=";
+    hash = "sha256-E1YwJwfL5+Q68xRfnoi2Sg+vAZxGQa0IKfOSVuLVnK0=";
   };
 
   postPatch = ''
@@ -128,6 +130,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru = {
     inherit frontend python;
+    inherit (python.pkgs) glitchtip-rust;
     tests = { inherit (nixosTests) glitchtip; };
     updateScript = ./update.sh;
   };
diff --git a/pkgs/by-name/gl/glitchtip/update.sh b/pkgs/by-name/gl/glitchtip/update.sh
index e0a5cf370e59..33816b26d0b3 100755
--- a/pkgs/by-name/gl/glitchtip/update.sh
+++ b/pkgs/by-name/gl/glitchtip/update.sh
@@ -7,3 +7,4 @@ version=$(curl ${GITLAB_TOKEN:+-H "Private-Token: $GITLAB_TOKEN"} -sL https://gi
 
 nix-update --version="$version" glitchtip
 nix-update --version="$version" glitchtip.frontend
+nix-update glitchtip.glitchtip-rust
diff --git a/pkgs/by-name/go/google-chrome/package.nix b/pkgs/by-name/go/google-chrome/package.nix
index a0b030218353..e639b0005187 100644
--- a/pkgs/by-name/go/google-chrome/package.nix
+++ b/pkgs/by-name/go/google-chrome/package.nix
@@ -179,11 +179,11 @@ let
 
   linux = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "149.0.7827.200";
+    version = "150.0.7871.46";
 
     src = fetchurl {
       url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb";
-      hash = "sha256-HDCPrhH44nKTr6Fzm9SqAV/Vdmtyx1znIZXsPkGmEqg=";
+      hash = "sha256-abQBOftzoCGnSfMvzeCFP7F4G286izyvFzrY9nR/qnw=";
     };
 
     # With strictDeps on, some shebangs were not being patched correctly
diff --git a/pkgs/by-name/go/google-cloud-sql-proxy/package.nix b/pkgs/by-name/go/google-cloud-sql-proxy/package.nix
index 6b89b0bad4cf..30e2d43c064e 100644
--- a/pkgs/by-name/go/google-cloud-sql-proxy/package.nix
+++ b/pkgs/by-name/go/google-cloud-sql-proxy/package.nix
@@ -7,18 +7,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "google-cloud-sql-proxy";
-  version = "2.22.1";
+  version = "2.23.0";
 
   src = fetchFromGitHub {
     owner = "GoogleCloudPlatform";
     repo = "cloud-sql-proxy";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-vTTYQ1D42X1L03EE9c5Xz/SCRE3wWROT/daY+f0vLPI=";
+    hash = "sha256-hCnwNSOu9aSdWC5Gtr0nytmQQnkMS6i84pICBrN2VVg=";
   };
 
   subPackages = [ "." ];
 
-  vendorHash = "sha256-lOT9GpZk6Bv5P8kiyMR4j+aHOO0be4pW4WvVux8hpnQ=";
+  vendorHash = "sha256-bM8BEdq5EY5RtsCNkRNTsc9dGgAEZkGHcUOip2LwKik=";
 
   checkFlags = [
     "-short"
diff --git a/pkgs/by-name/go/gotenberg/package.nix b/pkgs/by-name/go/gotenberg/package.nix
index 45dd66b54510..1f1ebbe5b267 100644
--- a/pkgs/by-name/go/gotenberg/package.nix
+++ b/pkgs/by-name/go/gotenberg/package.nix
@@ -24,7 +24,7 @@ let
 in
 buildGo126Module (finalAttrs: {
   pname = "gotenberg";
-  version = "8.33.0";
+  version = "8.34.0";
 
   outputs = [
     "out"
@@ -35,10 +35,10 @@ buildGo126Module (finalAttrs: {
     owner = "gotenberg";
     repo = "gotenberg";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hTG2O8F/0FdKVKHQsFf027OJU60moey4qkMHUwIQ8xM=";
+    hash = "sha256-HFRymNfhQOBzXBWZhiujr8sn4m/hpfjcBGg/3/C67DU=";
   };
 
-  vendorHash = "sha256-E0PVPuSxXtacxaFLrrIVFEre5C/woj3VUckLIdrQWoI=";
+  vendorHash = "sha256-njyxP+1S1ebaF9xJ1kBL9HrTWMTdEhu8MwUF6FYKHvs=";
 
   postPatch = ''
     find ./pkg -name '*_test.go' -exec sed -i -e 's#/tests#${finalAttrs.src}#g' {} \;
diff --git a/pkgs/by-name/go/govc/package.nix b/pkgs/by-name/go/govc/package.nix
index 0f77e32c9f3e..48c1142764cc 100644
--- a/pkgs/by-name/go/govc/package.nix
+++ b/pkgs/by-name/go/govc/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "govc";
-  version = "0.53.1";
+  version = "0.55.0";
 
   src = fetchFromGitHub {
     owner = "vmware";
     repo = "govmomi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-egyXzA+0xobHcq3dGOYou4sPCHRDv2l8QWo8ZLWofKU=";
+    hash = "sha256-wz0+x0abPEScOYdwm94YW7KxGX6SANh0nf2TpgcyHmk=";
   };
 
-  vendorHash = "sha256-xRhjAOQKX6CU9BmdNZonDMwmnEvFXWOaP73j7wPIexk=";
+  vendorHash = "sha256-pPni473N8W3hrAITQ2hhIfcRiKZu1XvDzJH9rOrSxt8=";
 
   sourceRoot = "${finalAttrs.src.name}/govc";
 
diff --git a/pkgs/by-name/gr/greenmask/package.nix b/pkgs/by-name/gr/greenmask/package.nix
index 8a9a72457091..1b0f2f0799a9 100644
--- a/pkgs/by-name/gr/greenmask/package.nix
+++ b/pkgs/by-name/gr/greenmask/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "greenmask";
-  version = "0.2.21";
+  version = "0.2.22";
 
   src = fetchFromGitHub {
     owner = "GreenmaskIO";
     repo = "greenmask";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QlNw2kCh5Rd8kwuA/BiNHXaw0p5qCfn4hzo9dgN45lU=";
+    hash = "sha256-bmKy3naQiLG4z3+VNkUck3UNVh2Oi8faXRz20qjwL9g=";
   };
 
-  vendorHash = "sha256-zVbSppCgLil0qS4WYhkzQZxbBx6L/0gbexY//I+GzwQ=";
+  vendorHash = "sha256-PsGeh7PzZFFhzQClW56GfvsGp8T7dccyErdnOv3urhs=";
 
   subPackages = [ "cmd/greenmask/" ];
 
diff --git a/pkgs/by-name/gr/grimblast/package.nix b/pkgs/by-name/gr/grimblast/package.nix
index e7a388c33bf9..4d4fad7ffbc7 100644
--- a/pkgs/by-name/gr/grimblast/package.nix
+++ b/pkgs/by-name/gr/grimblast/package.nix
@@ -20,13 +20,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "grimblast";
-  version = "0.1-unstable-2026-05-29";
+  version = "0.1-unstable-2026-06-30";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "contrib";
-    rev = "bf1a7cdb086587e6bed6e8ecd285a81c01a11c54";
-    hash = "sha256-epTJKmTCNL1Hm6/YdEWAgiOMVBSzC9/v/rjyOieP3yA=";
+    rev = "3dcbce715ae8b93107fa8632db15bf976862a573";
+    hash = "sha256-JP0D8r8o9+jnYk0/B5O722La+oZeC5iNQ3lonKFTmbQ=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/ha/handheld-daemon/package.nix b/pkgs/by-name/ha/handheld-daemon/package.nix
index c13f6c85b96f..f46fb5cd7457 100644
--- a/pkgs/by-name/ha/handheld-daemon/package.nix
+++ b/pkgs/by-name/ha/handheld-daemon/package.nix
@@ -16,14 +16,14 @@
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "handheld-daemon";
-  version = "4.1.9";
+  version = "4.1.10";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "hhd-dev";
     repo = "hhd";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pzcMIXLZUkSqJuZTujAoKjfPuZgtit4u08wHZPPz8Ss=";
+    hash = "sha256-+POL5d9kn5oCGeu79gWxK0b0UHn//j/QjHq9wLZw6h8=";
   };
 
   # Handheld-daemon runs some selinux-related utils which are not in nixpkgs.
diff --git a/pkgs/by-name/ic/icestudio/package.nix b/pkgs/by-name/ic/icestudio/package.nix
index 025a837aaffc..9e7995642d03 100644
--- a/pkgs/by-name/ic/icestudio/package.nix
+++ b/pkgs/by-name/ic/icestudio/package.nix
@@ -13,13 +13,13 @@
 
 let
   # Use unstable because it has improvements for finding python
-  version = "0.12-unstable-2026-05-28";
+  version = "0.12-unstable-2026-06-29";
 
   src = fetchFromGitHub {
     owner = "FPGAwars";
     repo = "icestudio";
-    rev = "cfa40bd83ada8d7f3594c2cd60e39d2d63ff14d0";
-    hash = "sha256-vp4cLDK2mfheLw+0ysNjKW5bbrm806Y6sHkSpEgWo4U=";
+    rev = "8607f7ef538c4b447362b2ab90aece2fbb7d1b75";
+    hash = "sha256-8KYwlOKKmTQza71cVpssOGJJNwIUvMHMYcokhK/LhEo=";
   };
 
   collection = fetchurl {
diff --git a/pkgs/by-name/ic/icinga2/package.nix b/pkgs/by-name/ic/icinga2/package.nix
index c0230cffa753..0f75802365bd 100644
--- a/pkgs/by-name/ic/icinga2/package.nix
+++ b/pkgs/by-name/ic/icinga2/package.nix
@@ -33,13 +33,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "icinga2${nameSuffix}";
-  version = "2.16.2";
+  version = "2.16.3";
 
   src = fetchFromGitHub {
     owner = "icinga";
     repo = "icinga2";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-+9NveqbvOsw9ipoWCk5HA0ykVZS8WxBTuOzdoSb8HH8=";
+    hash = "sha256-0gKNHtSc6uaabDHujlUKrcZfx6wz0vDp7Z4YMSem4iY=";
   };
 
   patches = [
diff --git a/pkgs/by-name/in/incus-ui-canonical/package.nix b/pkgs/by-name/in/incus-ui-canonical/package.nix
index daf58189b326..e4e500e0ecbf 100644
--- a/pkgs/by-name/in/incus-ui-canonical/package.nix
+++ b/pkgs/by-name/in/incus-ui-canonical/package.nix
@@ -20,14 +20,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "incus-ui-canonical";
-  version = "0.21.2";
+  version = "0.21.3";
 
   src = fetchFromGitHub {
     owner = "zabbly";
     repo = "incus-ui-canonical";
     # only use tags prefixed by incus- they are the tested fork versions
     tag = "incus-${finalAttrs.version}";
-    hash = "sha256-nCussrzWjFbZ6its3X74KBktv/dZO76OJGwG7upjkMw=";
+    hash = "sha256-fyeh7KX2Cvo2YmUNnmzeWkTGgGrJHhjbq39AmnwhgAs=";
   };
 
   offlineCache = fetchYarnDeps {
diff --git a/pkgs/by-name/in/interval-tree/package.nix b/pkgs/by-name/in/interval-tree/package.nix
new file mode 100644
index 000000000000..71ce2ea68ead
--- /dev/null
+++ b/pkgs/by-name/in/interval-tree/package.nix
@@ -0,0 +1,43 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "interval-tree";
+  version = "3.1.1";
+
+  src = fetchFromGitHub {
+    owner = "5cript";
+    repo = "interval-tree";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-bSZ56EzzNy6gHgs8OptT/iBlf56RJz+09BE4WGGJpog=";
+  };
+
+  # interval-tree is a header only library
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/
+    cp -r $src/include/ $out/
+
+    runHook postInstall
+  '';
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "C++ header only interval tree implementation";
+    maintainers = with lib.maintainers; [ aiyion ];
+    homepage = "https://github.com/5cript/interval-tree";
+    license = lib.licenses.cc0;
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/by-name/in/intiface-central/package.nix b/pkgs/by-name/in/intiface-central/package.nix
index 34b2c6e0a62d..7a4fd3bc653e 100644
--- a/pkgs/by-name/in/intiface-central/package.nix
+++ b/pkgs/by-name/in/intiface-central/package.nix
@@ -146,9 +146,8 @@ flutter338.buildFlutterApplication {
     ln -s ${buttplug} ../buttplug
   '';
 
-  # without this, only the splash screen will be shown and the logs will contain the
-  # line `Failed to load dynamic library 'lib/libintiface_engine_flutter_bridge.so'`
-  extraWrapProgramArgs = "--chdir $out/app/intiface-central";
+  # without this, only the splash screen will be shown
+  extraWrapProgramArgs = "--set FRB_DART_LOAD_EXTERNAL_LIBRARY_NATIVE_LIB_DIR $out/app/intiface-central/lib";
 
   postInstall = ''
     install -Dm644 $out/app/intiface-central/data/flutter_assets/assets/icons/intiface_central_icon.png $out/share/icons/hicolor/512x512/apps/intiface-central.png
diff --git a/pkgs/by-name/it/itch/package.nix b/pkgs/by-name/it/itch/package.nix
index 8fd0def5db54..c9a14712a105 100644
--- a/pkgs/by-name/it/itch/package.nix
+++ b/pkgs/by-name/it/itch/package.nix
@@ -12,7 +12,7 @@
 }:
 
 let
-  version = "26.9.0";
+  version = "26.13.0";
 
   itch-setup = fetchzip {
     url = "https://broth.itch.zone/itch-setup/linux-amd64/1.29.0/archive.zip";
@@ -26,7 +26,7 @@ let
       owner = "itchio";
       repo = "itch";
       rev = "v${version}";
-      hash = "sha256-zTUCHpyjfPiYDAatkavNlSHekBTHadiHUa3VyLChYKE=";
+      hash = "sha256-v/2y9F+uigGaVsEy4gaa7WGTByW1wqYosti6AEOsaQQ=";
       sparseCheckout = [ sparseCheckout ];
     }
     + sparseCheckout;
@@ -38,7 +38,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   src = fetchzip {
     url = "https://github.com/itchio/itch/releases/download/v${finalAttrs.version}/itch-v${finalAttrs.version}-linux-amd64.tar.gz";
     stripRoot = false;
-    hash = "sha256-SRgaVweNqf/13C948eWncuCn9Cj82hYxDF3AzCaL5E0=";
+    hash = "sha256-//QA4aW9uwZ/yhKf1xJRthj36YqfXuu/6yU1yGXQeFo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/it/itgmania/themes/digital-dance.nix b/pkgs/by-name/it/itgmania/themes/digital-dance.nix
index 7a502dc9f249..f7ecc099fc25 100644
--- a/pkgs/by-name/it/itgmania/themes/digital-dance.nix
+++ b/pkgs/by-name/it/itgmania/themes/digital-dance.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "digital-dance";
-  version = "1.1.3-unstable-2026-06-22";
+  version = "1.1.4-unstable-2026-06-30";
 
   src = fetchFromCodeberg {
     owner = "JNero";
     repo = "Digital-Dance-ITGMania";
-    rev = "14d3d31a4f79f1557e3515de41a7907130d7b163";
-    hash = "sha256-e/lOhwI+Q4sMn0EL5sPMhCaxoN6eOLVLBs7bMOPJUxY=";
+    rev = "90087bfd1182d1240f22e48fb348df52f784e799";
+    hash = "sha256-iZ3N1+epG8EF8H9KViI3fgtHeayxmWaumxkOOK9qK0c=";
   };
 
   postInstall = ''
diff --git a/pkgs/by-name/it/itgmania/themes/itg3encore.nix b/pkgs/by-name/it/itgmania/themes/itg3encore.nix
index ae675009a8f9..76c915a9be1f 100644
--- a/pkgs/by-name/it/itgmania/themes/itg3encore.nix
+++ b/pkgs/by-name/it/itgmania/themes/itg3encore.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "itg3encore";
-  version = "0-unstable-2026-06-22";
+  version = "0-unstable-2026-06-28";
 
   src = fetchFromGitHub {
     owner = "DarkBahamut162";
     repo = "itg3encore";
-    rev = "c669a04ce6487a32263a2f617efa26bfd5eaf764";
-    hash = "sha256-CbqIzHcHmxICoi23z032Ti8AZyB5Ur/SPsolr1VjBhY=";
+    rev = "408a726f31287bfe98144fa62f64abac5a4fbb92";
+    hash = "sha256-6MGbwkU8dppAs/mg6hA2jmDjrHU7sgITouUjKh92ozE=";
   };
 
   postInstall = ''
diff --git a/pkgs/by-name/it/itgmania/unwrapped.nix b/pkgs/by-name/it/itgmania/unwrapped.nix
index f0d65de916e3..6eced844d6a9 100644
--- a/pkgs/by-name/it/itgmania/unwrapped.nix
+++ b/pkgs/by-name/it/itgmania/unwrapped.nix
@@ -23,14 +23,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "itgmania";
-  version = "1.2.1";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "itgmania";
     repo = "itgmania";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-bTABfTflWasuXvX+YPciUIICAFVROk/SgeClgrTUjkQ=";
+    hash = "sha256-dwalGEQFNhjuKwUBBskCHDYzmyjuf0r9TYM2ex8wzio=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ja/jack-passthrough/package.nix b/pkgs/by-name/ja/jack-passthrough/package.nix
index 4725c4c63e2f..22c88835c545 100644
--- a/pkgs/by-name/ja/jack-passthrough/package.nix
+++ b/pkgs/by-name/ja/jack-passthrough/package.nix
@@ -7,11 +7,12 @@
   meson,
   ninja,
   fmt_9,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation {
   pname = "jack-passthrough";
-  version = "2021-9-25";
+  version = "0-unstable-2021-9-25";
 
   # https://github.com/guysherman/jack-passthrough
   src = fetchFromGitHub {
@@ -26,11 +27,14 @@ stdenv.mkDerivation {
     meson
     ninja
   ];
+
   buildInputs = [
     fmt_9
     libjack2
   ];
 
+  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
+
   meta = {
     description = "Simple app to help with JACK apps that behave strangely";
     longDescription = ''
@@ -42,7 +46,10 @@ stdenv.mkDerivation {
     homepage = "https://github.com/guysherman/jack-passthrough";
     # license unknown: https://github.com/guysherman/jack-passthrough/issues/2
     license = lib.licenses.unfree;
-    maintainers = [ lib.maintainers.PowerUser64 ];
+    maintainers = with lib.maintainers; [
+      PowerUser64
+      l1npengtul
+    ];
     platforms = [ "x86_64-linux" ];
     mainProgram = "jack-passthru";
   };
diff --git a/pkgs/by-name/ja/jackett/package.nix b/pkgs/by-name/ja/jackett/package.nix
index 78fb01480bab..d94c61242a64 100644
--- a/pkgs/by-name/ja/jackett/package.nix
+++ b/pkgs/by-name/ja/jackett/package.nix
@@ -12,13 +12,13 @@
 
 buildDotnetModule (finalAttrs: {
   pname = "jackett";
-  version = "0.24.2108";
+  version = "0.24.2151";
 
   src = fetchFromGitHub {
     owner = "jackett";
     repo = "jackett";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-MWA5gTiNjkKIaHgUGVt2XV3QBPYGTf/dVqCnmdAaJ0U=";
+    hash = "sha256-V4oBku723EWLTBBjFVkAJTBdhXYTs3Vx98YDinTr5Kc=";
   };
 
   projectFile = "src/Jackett.Server/Jackett.Server.csproj";
diff --git a/pkgs/by-name/jf/jfrog-cli/package.nix b/pkgs/by-name/jf/jfrog-cli/package.nix
index 4c75f009fb03..e83bd5b6d3df 100644
--- a/pkgs/by-name/jf/jfrog-cli/package.nix
+++ b/pkgs/by-name/jf/jfrog-cli/package.nix
@@ -9,17 +9,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "jfrog-cli";
-  version = "2.109.0";
+  version = "2.112.0";
 
   src = fetchFromGitHub {
     owner = "jfrog";
     repo = "jfrog-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jzQNwNdqNMcwDf3RgEdS4ACUPDL3ujlkGD5kFuHRd8Q=";
+    hash = "sha256-jqzjkUbCwR+EMA4Zrb4rZHDsQWD4YimPVhHA2GcLNF8=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-lI24KDC31yQaUYe9uV7ZiQLzwROSaFh7M1J0B7k0iWI=";
+  vendorHash = "sha256-Bw2g9bfuG+IgItrRh85G9lyFZP8oXNXxkZTcvSy0WWA=";
 
   checkFlags = "-skip=^(TestReleaseBundle|TestVisibilitySendUsage_RtCurl_E2E)";
 
diff --git a/pkgs/by-name/jw/jwx/package.nix b/pkgs/by-name/jw/jwx/package.nix
index 6ce0302271fa..e43423d5ab58 100644
--- a/pkgs/by-name/jw/jwx/package.nix
+++ b/pkgs/by-name/jw/jwx/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "jwx";
-  version = "4.0.2";
+  version = "4.1.0";
 
   src = fetchFromGitHub {
     owner = "lestrrat-go";
     repo = "jwx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CGBQF//smVUt1/SQkxvZJ+7zlAhAuxVtO3WWWHCSvII=";
+    hash = "sha256-+u2PR1L66cua6iGer9qYlnPpfYt1j9cZ0PSrWntpYp0=";
   };
 
-  vendorHash = "sha256-g+kawcxLJdR77kkR6pJoRKe48kV+/kS33gYjOY30pAc=";
+  vendorHash = "sha256-dxC00wr51c48yxdCUWsL44RMmk+pBmqXkUQqjP90GNU=";
 
   sourceRoot = "${finalAttrs.src.name}/cmd/jwx";
 
diff --git a/pkgs/by-name/ke/keto/package.nix b/pkgs/by-name/ke/keto/package.nix
index 2c65e602a957..19bf5849239f 100644
--- a/pkgs/by-name/ke/keto/package.nix
+++ b/pkgs/by-name/ke/keto/package.nix
@@ -1,48 +1,84 @@
 {
+  lib,
+  stdenv,
   fetchFromGitHub,
   buildGoModule,
-  lib,
+  versionCheckHook,
+  installShellFiles,
 }:
-let
+buildGoModule (finalAttrs: {
   pname = "keto";
   version = "26.2.0";
-  commit = "e4393662cd2e744deeb79de77669e07b6ccf51f3";
-in
-buildGoModule {
-  inherit pname version commit;
 
   src = fetchFromGitHub {
     owner = "ory";
     repo = "keto";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-wRtz4RvJ7LxVnSLmXVZFGa9QXjcPnDNJxHKosbyTed0=";
   };
 
   vendorHash = "sha256-B27aC4yXS36eOoq53+RWp0vq1Oqw2aR+gOjv0m+b/I4=";
 
+  __structuredAttrs = true;
+
   tags = [
     "sqlite"
     "json1"
     "hsm"
   ];
 
-  subPackages = [ "." ];
+  subPackages = [ "..." ];
 
   # Pass versioning information via ldflags
   ldflags = [
     "-s"
-    "-w"
-    "-X github.com/ory/keto/internal/driver/config.Version=${version}"
-    "-X github.com/ory/keto/internal/driver/config.Commit=${commit}"
+    "-X github.com/ory/keto/internal/driver/config.Version=${finalAttrs.src.tag}"
+    "-X github.com/ory/keto/internal/driver/config.Commit=${finalAttrs.src.rev}"
   ];
 
+  nativeBuildInputs = [ installShellFiles ];
+  # tests use dynamic port assignment via port `0`
+  __darwinAllowLocalNetworking = true;
+
+  preCheck = ''
+    export version='${finalAttrs.src.tag}'
+  '';
+  checkFlags = [
+    "-short"
+  ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = [ "version" ];
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd keto \
+      --bash <($out/bin/keto completion bash) \
+      --fish <($out/bin/keto completion fish) \
+      --zsh <($out/bin/keto completion zsh)
+  '';
+
   meta = {
-    description = "ORY Keto, the open source access control server";
-    homepage = "https://www.ory.sh/keto/";
+    description = "Scalable and customizable permission server ";
+    longDescription = ''
+      Open source implementation of "Zanzibar: Google's Consistent, Global Authorization System". It follows
+      [cloud architecture best practices](https://www.ory.com/docs/ecosystem/software-architecture-philosophy)
+      and focuses on:
+
+      - Scalable permission checks based on the Zanzibar model
+      - The Ory Permission Language for defining access control policies
+      - Relationship-based access control (ReBAC)
+      - Low latency permission checks (sub-10ms)
+      - Horizontal scaling to billions of relationships
+      - Consistency and high availability
+    '';
+    homepage = "https://github.com/ory/keto";
+    changelog = "https://github.com/ory/keto/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
       mrmebelman
       debtquity
     ];
+    mainProgram = "keto";
   };
-}
+})
diff --git a/pkgs/by-name/ke/keylights/package.nix b/pkgs/by-name/ke/keylights/package.nix
new file mode 100644
index 000000000000..096a4559aa2a
--- /dev/null
+++ b/pkgs/by-name/ke/keylights/package.nix
@@ -0,0 +1,57 @@
+{
+  lib,
+  fetchFromCodeberg,
+  installShellFiles,
+  rustPlatform,
+  stdenv,
+  testers,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "keylights";
+  version = "0.1.0";
+
+  __structuredAttrs = true;
+
+  src = fetchFromCodeberg {
+    owner = "wjohnsto";
+    repo = "keylights";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-cl/IRkQMowrWOt0yLEFZC1J2MM6Fr68J6YaakUXwxTQ=";
+  };
+
+  cargoHash = "sha256-ns+EppqGP19P+xzevgZcovPKwYkMkWTcu5L0bovuQuk=";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    keylightsBin="target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/keylights"
+
+    "$keylightsBin" completions bash > keylights.bash
+    "$keylightsBin" completions fish > keylights.fish
+    "$keylightsBin" completions zsh > _keylights
+
+    installShellCompletion --cmd keylights \
+      --bash keylights.bash \
+      --fish keylights.fish \
+      --zsh _keylights
+  '';
+
+  passthru.tests.version = testers.testVersion {
+    package = finalAttrs.finalPackage;
+    command = "keylights --version";
+  };
+
+  meta = {
+    description = "Daemonless CLI for discovering and controlling Elgato Key Light devices";
+    homepage = "https://codeberg.org/wjohnsto/keylights";
+    changelog = "https://codeberg.org/wjohnsto/keylights/releases/tag/v${finalAttrs.version}";
+    license = with lib.licenses; [
+      mit
+      asl20
+    ];
+    maintainers = with lib.maintainers; [ wjohnsto ];
+    mainProgram = "keylights";
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/ki/kitty-themes/package.nix b/pkgs/by-name/ki/kitty-themes/package.nix
index 61d68f4ba1b0..dad3f76181f6 100644
--- a/pkgs/by-name/ki/kitty-themes/package.nix
+++ b/pkgs/by-name/ki/kitty-themes/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "kitty-themes";
-  version = "0-unstable-2026-06-08";
+  version = "0-unstable-2026-06-29";
 
   src = fetchFromGitHub {
     owner = "kovidgoyal";
     repo = "kitty-themes";
-    rev = "6f27c71721e4eb6702630f6e57fe16baacd76aa0";
-    hash = "sha256-IDXRlup2naBmCSlPYdjrgL/m4FAhkf4IEAiLsMUdepQ=";
+    rev = "f54e894cce7c2232c8af9a82f85dca874e496da1";
+    hash = "sha256-XYL/7Sr3Ct1n4lnji06I2EM4EQU3cNJuWbAadSz8PAE=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/ko/kopuz/package.nix b/pkgs/by-name/ko/kopuz/package.nix
new file mode 100644
index 000000000000..28fa8650215e
--- /dev/null
+++ b/pkgs/by-name/ko/kopuz/package.nix
@@ -0,0 +1,142 @@
+{
+  lib,
+  stdenv,
+  rustPlatform,
+  pkg-config,
+  cmake,
+  git,
+  openssl,
+  tailwindcss_4,
+  dioxus-cli,
+  yt-dlp,
+  fetchFromGitHub,
+  libopus,
+  # Linux only
+  wrapGAppsHook3,
+  webkitgtk_4_1,
+  gtk3,
+  libsoup_3,
+  glib-networking,
+  alsa-lib,
+  xdotool,
+  wayland,
+  dbus,
+  libayatana-appindicator,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  __structuredAttrs = true;
+
+  pname = "kopuz";
+  version = "0.8.2";
+
+  src = fetchFromGitHub {
+    owner = "Kopuz-org";
+    repo = "kopuz";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-d6wSefvx2KT1EyhLq2pn9MSDtW+AvDj7WVz27MJeTmg=";
+  };
+
+  cargoHash = "sha256-fr65eE8wFWtW/PT5ZACGMcNCo/QNo9xf39LVBQMGLVk=";
+
+  nativeBuildInputs = [
+    pkg-config
+    cmake
+    tailwindcss_4
+    dioxus-cli
+    git
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    wrapGAppsHook3
+  ];
+
+  buildInputs = [
+    libopus
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    webkitgtk_4_1
+    gtk3
+    libsoup_3
+    glib-networking
+    alsa-lib
+    openssl
+    xdotool
+    wayland
+    dbus
+    libayatana-appindicator
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    tailwindcss -i tailwind.css -o crates/kopuz/assets/tailwind.css --minify
+
+    ${lib.optionalString stdenv.hostPlatform.isDarwin ''
+            mkdir -p "$TMPDIR/fake-bin"
+            cat > "$TMPDIR/fake-bin/codesign" << 'CODESIGN_EOF'
+      #!/bin/sh
+      exec true
+      CODESIGN_EOF
+            chmod +x "$TMPDIR/fake-bin/codesign"
+            export PATH="$TMPDIR/fake-bin:$PATH"
+    ''}
+
+    dx build --release --platform desktop -p kopuz --offline --frozen
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+
+    ${
+      if stdenv.hostPlatform.isLinux then
+        ''
+          cp -r target/dx/kopuz/release/linux/app/* $out/bin/
+
+          install -Dm644 data/com.temidaradev.kopuz.desktop \
+            $out/share/applications/com.temidaradev.kopuz.desktop
+          substituteInPlace $out/share/applications/com.temidaradev.kopuz.desktop \
+            --replace-fail "Exec=kopuz" "Exec=$out/bin/kopuz"
+
+          install -Dm644 data/com.temidaradev.kopuz.metainfo.xml \
+            $out/share/metainfo/com.temidaradev.kopuz.metainfo.xml
+
+          install -Dm644 crates/kopuz/assets/logo.png \
+            $out/share/icons/hicolor/256x256/apps/com.temidaradev.kopuz.png
+        ''
+      else
+        ''
+          # Dioxus outputs the bundle at macos/Kopuz.app (capitalised, no app/ subdir)
+          cp -r target/dx/kopuz/release/macos/Kopuz.app $out/bin/kopuz.app
+          # Symlink whatever binary dioxus placed in MacOS/ (name may differ in case)
+          macBin=$(find $out/bin/kopuz.app/Contents/MacOS -maxdepth 1 -type f | head -1)
+          ln -s "$macBin" $out/bin/kopuz
+        ''
+    }
+
+    runHook postInstall
+  '';
+
+  preFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
+    gappsWrapperArgs+=(
+      --chdir $out/bin
+      --prefix PATH : ${lib.makeBinPath [ yt-dlp ]}
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libayatana-appindicator ]}
+    )
+  '';
+
+  meta = {
+    description = "Fast, modern music player with Jellyfin and local library support";
+    homepage = "https://github.com/Kopuz-org/kopuz";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      temidaradev
+      NotAShelf
+    ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+    mainProgram = "kopuz";
+  };
+})
diff --git a/pkgs/by-name/ko/kotofetch/package.nix b/pkgs/by-name/ko/kotofetch/package.nix
new file mode 100644
index 000000000000..e8a25ccea7b0
--- /dev/null
+++ b/pkgs/by-name/ko/kotofetch/package.nix
@@ -0,0 +1,33 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  versionCheckHook,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "kotofetch";
+  version = "0.2.22";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "hxpe-dev";
+    repo = "kotofetch";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-aY8HRKSHLQKjl4b7v5q3SeNMc+GJPnE2XVrEsl+nGR0=";
+  };
+
+  cargoHash = "sha256-r36x/I/RaIWFEoDYXf3edpLeqGvEyozhT4EuCTSEe/k=";
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  meta = {
+    description = "Minimalist fetch tool for Japanese quotes";
+    mainProgram = "kotofetch";
+    homepage = "https://github.com/hxpe-dev/kotofetch";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ yarn ];
+  };
+})
diff --git a/pkgs/by-name/kt/ktailctl/package.nix b/pkgs/by-name/kt/ktailctl/package.nix
index 739c374a00b4..d6e25dd9a379 100644
--- a/pkgs/by-name/kt/ktailctl/package.nix
+++ b/pkgs/by-name/kt/ktailctl/package.nix
@@ -11,13 +11,13 @@
 }:
 
 let
-  version = "0.22.0";
+  version = "0.22.1";
 
   src = fetchFromGitHub {
     owner = "f-koehler";
     repo = "KTailctl";
-    rev = "v${version}";
-    hash = "sha256-20hR/N3m1BsbMGiaWVV/SH/OHgfk7ZC1+WWhYqQpIls=";
+    tag = "v${version}";
+    hash = "sha256-BRkjVZaoxiMW8JltIkYDiCCE2kNGLDpRJd0iclQMcGY=";
   };
 
   goDeps =
@@ -74,6 +74,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "GUI to monitor and manage Tailscale on your Linux desktop";
+    changelog = "https://github.com/f-koehler/KTailctl/releases/tag/${src.tag}";
     homepage = "https://github.com/f-koehler/KTailctl";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ k900 ];
diff --git a/pkgs/by-name/ld/ldash/package.nix b/pkgs/by-name/ld/ldash/package.nix
new file mode 100644
index 000000000000..4e7a78529154
--- /dev/null
+++ b/pkgs/by-name/ld/ldash/package.nix
@@ -0,0 +1,32 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitea,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "ldash";
+  version = "1.3.1";
+  __structuredAttrs = true;
+
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "md-weber";
+    repo = "ldash";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ji1sgzDjJ8KVUVaKzhhCFBgIAAzRS2NQ7DTvJxb3PKA=";
+  };
+
+  cargoHash = "sha256-9/Dk3FQuSlUWPm4z3VadJl5FYtZ1gFY9mdZwiSXzzvc=";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "This is a TUI for hledger to show a nice dashboard";
+    homepage = "https://codeberg.org/md-weber/ldash";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ matthewcroughan ];
+    mainProgram = "ldash";
+  };
+})
diff --git a/pkgs/by-name/le/ledger-live-desktop/package.nix b/pkgs/by-name/le/ledger-live-desktop/package.nix
index 4ad0adf69705..90d9826a1584 100644
--- a/pkgs/by-name/le/ledger-live-desktop/package.nix
+++ b/pkgs/by-name/le/ledger-live-desktop/package.nix
@@ -8,11 +8,11 @@
 
 let
   pname = "ledger-live-desktop";
-  version = "4.8.0";
+  version = "4.10.0";
 
   src = fetchurl {
     url = "https://download.live.ledger.com/${pname}-${version}-linux-x86_64.AppImage";
-    hash = "sha256-9S2Iuxqe6YpuV3lXqirO4b1J71EkTZW1wSmxv7Qg3uY=";
+    hash = "sha256-Wxgv40Gg7FpUNOClO63h5grybZIptw2U9KuQV6F0Lcg=";
   };
 
   appimageContents = appimageTools.extractType2 {
diff --git a/pkgs/by-name/li/libdict/package.nix b/pkgs/by-name/li/libdict/package.nix
index b5013a3df553..7558978c2f4b 100644
--- a/pkgs/by-name/li/libdict/package.nix
+++ b/pkgs/by-name/li/libdict/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libdict";
-  version = "1.0.5";
+  version = "1.0.6";
 
   src = fetchFromGitHub {
     owner = "rtbrick";
     repo = "libdict";
     rev = finalAttrs.version;
-    hash = "sha256-604escyV5MVuYggs1awIrorCrdXSUj3IhjwXV2QdDMU=";
+    hash = "sha256-JO8gIZwSZ1vOigiM2IoGRYW2m2zoAa1af/eMBP3ZRjY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/libfprint-tod/package.nix b/pkgs/by-name/li/libfprint-tod/package.nix
index 9abebbb42b25..120082b2029e 100644
--- a/pkgs/by-name/li/libfprint-tod/package.nix
+++ b/pkgs/by-name/li/libfprint-tod/package.nix
@@ -27,6 +27,10 @@ libfprint.overrideAttrs (
       hash = "sha256-xkywuFbt8EFJOlIsSN2hhZfMUhywdgJ/uT17uiO3YV4=";
     };
 
+    # Different source than libfprint, so override any patches, because they
+    # would only apply to the original source tree
+    patches = [ ];
+
     mesonFlags = [
       # Include virtual drivers for fprintd tests
       "-Ddrivers=all"
diff --git a/pkgs/by-name/li/libfprint/package.nix b/pkgs/by-name/li/libfprint/package.nix
index 160cec4aa0f9..edfc4aa8ea74 100644
--- a/pkgs/by-name/li/libfprint/package.nix
+++ b/pkgs/by-name/li/libfprint/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitLab,
+  fetchpatch,
   pkg-config,
   meson,
   python3,
@@ -35,6 +36,35 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-aNBUIKY3PP5A07UNg3N0qq+2cwb6Fk67oKQcXgr2G/4=";
   };
 
+  patches = [
+    # New hardware support since 1.94.10, just new USB Product IDs
+    (fetchpatch {
+      name = "realtek-3274-9003.patch";
+      url = "https://gitlab.freedesktop.org/libfprint/libfprint/-/commit/a25f71cf97820c51edc4c32f84686fcdc608d9d1.patch";
+      sha256 = "sha256-T9rvT53Ij+5gtiVOp+xfzQwiVkyF0m6lZAUCXWmaugg=";
+    })
+    (fetchpatch {
+      name = "elan-0c58.patch";
+      url = "https://gitlab.freedesktop.org/libfprint/libfprint/-/commit/4610f2285e6373c2fe4ead0dff4ebf8dabe4e532.patch";
+      sha256 = "sha256-VR96V+7FvSa8sE6JpcCx/slZ0MaK9HLuNuAay2P9C6M=";
+    })
+    (fetchpatch {
+      name = "elan-04F3-0C9C.patch";
+      url = "https://gitlab.freedesktop.org/libfprint/libfprint/-/commit/2bdc2b7ca6d8bedc675054934fbc8f8b6a21deac.patch";
+      sha256 = "sha256-LFMip9Mq55uDRgHkW+XeI+j0mILOb7DIHscHjyKe4yE=";
+    })
+    (fetchpatch {
+      name = "focal-077a-079a.patch";
+      url = "https://gitlab.freedesktop.org/libfprint/libfprint/-/commit/2c7842c905147a2d127c1b168b2e9d432b8c91a4.patch";
+      sha256 = "sha256-PuISGITn0/6AWY0WVUfViZtdcQFh+0s+4OLIszqdLUs=";
+    })
+    (fetchpatch {
+      name = "focal-a97a.patch";
+      url = "https://gitlab.freedesktop.org/libfprint/libfprint/-/commit/0dc384b90ed8cd78b3e8d7c0d30a953bd088b98c.patch";
+      sha256 = "sha256-X/wl4MpxfQ7sLlFTkkiDQGyRFQ6lC9pdcy3XPrSeOZw=";
+    })
+  ];
+
   postPatch = ''
     patchShebangs \
       tests/test-runner.sh \
diff --git a/pkgs/by-name/li/librewolf-unwrapped/src.json b/pkgs/by-name/li/librewolf-unwrapped/src.json
index 7995f6b699ea..9c6e1baf5b1f 100644
--- a/pkgs/by-name/li/librewolf-unwrapped/src.json
+++ b/pkgs/by-name/li/librewolf-unwrapped/src.json
@@ -1,11 +1,11 @@
 {
-  "packageVersion": "152.0.2-1",
+  "packageVersion": "152.0.4-1",
   "source": {
-    "rev": "152.0.2-1",
-    "hash": "sha256-CgH0HOtNbdoHMZ/MJL/zPK0Gn+e+qqtZjqPDSq63gX8="
+    "rev": "152.0.4-1",
+    "hash": "sha256-sbL3lZyYaewS84Yhb9HOHgV3xPvzbu+IcjdAW1hdlAY="
   },
   "firefox": {
-    "version": "152.0.2",
-    "hash": "sha512-5OVM///P1XUerFgXp7dLDvCqQ/wA7yk5fMnfmqUlcrInK5bmA3OnDXEr5NyEkXDY1cG0SfPql4tKso3uGQVrAw=="
+    "version": "152.0.4",
+    "hash": "sha512-DFZiq6j7iXkCr5Xbsv2YixltnPmui5h66J4KZJKsdTuNS4u3sydJCcLrIAqwmN81biPNYIRVZGf1XmkScxfzmg=="
   }
 }
diff --git a/pkgs/by-name/ll/llama-cpp/package.nix b/pkgs/by-name/ll/llama-cpp/package.nix
index 00848f3d83ca..6bfc3ffbed05 100644
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@@ -81,7 +81,7 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
   pname = "llama-cpp";
-  version = "9747";
+  version = "9842";
 
   outputs = [
     "out"
@@ -92,7 +92,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
     owner = "ggml-org";
     repo = "llama.cpp";
     tag = "b${finalAttrs.version}";
-    hash = "sha256-ecXJxidnlQRAyDftYIcTrER5U3+YQ+XfvAxA29pj+uI=";
+    hash = "sha256-wtaHsVOyCNCITABe1TvDo/MiWpNlH2YqZewBDxERtt4=";
     leaveDotGit = true;
     postFetch = ''
       git -C "$out" rev-parse --short HEAD > $out/COMMIT
@@ -125,7 +125,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
     ++ [ openssl ];
 
   npmRoot = "tools/ui";
-  npmDepsHash = "sha256-0dctM/apI3ysMIEVBaBXO9hZMWskpJpNpOws1gwiOYc=";
+  npmDepsHash = "sha256-X1DZgmhS/zHTqDT5zq0kywwntthcJ9vRXeqyO3zz6UU=";
   npmDeps = fetchNpmDeps {
     name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";
     inherit (finalAttrs) src patches;
diff --git a/pkgs/by-name/ln/lnd/package.nix b/pkgs/by-name/ln/lnd/package.nix
index 13bb7e007a82..8a1c6e54808c 100644
--- a/pkgs/by-name/ln/lnd/package.nix
+++ b/pkgs/by-name/ln/lnd/package.nix
@@ -23,16 +23,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "lnd";
-  version = "0.21.0-beta";
+  version = "0.21.1-beta";
 
   src = fetchFromGitHub {
     owner = "lightningnetwork";
     repo = "lnd";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Sbg80Bn5PqrNQ23OEeSN5+s71NeJl/ENFtH+OGYZS1c=";
+    hash = "sha256-LOP5vyffwxzXRI16Jgfjb+JykHcNWrGApM27frYUoPw=";
   };
 
-  vendorHash = "sha256-dTKonSAFc/iRhBtlUqhznX+ljRfJ0gqv8m7d1Ue6Mi4=";
+  vendorHash = "sha256-7fssqutcagEv6JKxwaAp9g3TtxHnQ34Kyln4DIhxjSQ=";
 
   subPackages = [
     "cmd/lncli"
diff --git a/pkgs/by-name/lo/lockbook-desktop/package.nix b/pkgs/by-name/lo/lockbook-desktop/package.nix
index 3425e2bbdfc1..7a553d786a10 100644
--- a/pkgs/by-name/lo/lockbook-desktop/package.nix
+++ b/pkgs/by-name/lo/lockbook-desktop/package.nix
@@ -18,16 +18,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lockbook-desktop";
-  version = "26.6.16";
+  version = "26.6.22";
 
   src = fetchFromGitHub {
     owner = "lockbook";
     repo = "lockbook";
     tag = finalAttrs.version;
-    hash = "sha256-HtmuFN7iNNwuQ0CXzqnEJN4PNh0D7weHniegtF4EuqQ=";
+    hash = "sha256-OgNscshw445uf2PtiYVlyCfx/l2BNZyZK5QwQSunCQ0=";
   };
 
-  cargoHash = "sha256-PUfXwtxuaheoyZA2fAyoc9CyD/oBAjkUsVrP6U7qvA0=";
+  cargoHash = "sha256-USdDHcWexjAllH/kOZVc4XMehESoIozkvvOw47ZeBD8=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/lu/lumen/package.nix b/pkgs/by-name/lu/lumen/package.nix
index 16f2556b2a10..af26fb66b206 100644
--- a/pkgs/by-name/lu/lumen/package.nix
+++ b/pkgs/by-name/lu/lumen/package.nix
@@ -2,8 +2,11 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
+  makeWrapper,
   pkg-config,
   openssl,
+  fzf,
+  mdcat,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -26,10 +29,22 @@ rustPlatform.buildRustPackage (finalAttrs: {
   # use the non-vendored openssl
   env.OPENSSL_NO_VENDOR = 1;
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    makeWrapper
+    pkg-config
+  ];
 
   buildInputs = [ openssl ];
 
+  postFixup = ''
+    wrapProgram $out/bin/lumen --prefix PATH : ${
+      lib.makeBinPath [
+        fzf
+        mdcat
+      ]
+    }
+  '';
+
   # tests that require a git repository to run
   checkFlags = [
     "--skip=vcs::git::tests::test_get_merge_base_returns_ancestor"
diff --git a/pkgs/by-name/ly/lyricspot/package.nix b/pkgs/by-name/ly/lyricspot/package.nix
new file mode 100644
index 000000000000..6a7eaef1388e
--- /dev/null
+++ b/pkgs/by-name/ly/lyricspot/package.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  fetchFromGitHub,
+  stdenvNoCC,
+  makeWrapper,
+  python3,
+  playerctl,
+}:
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "lyricspot";
+  version = "2.0.0";
+
+  src = fetchFromGitHub {
+    owner = "vlensys";
+    repo = "lyricspot";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-qDXTcTlpMWW7vAQuOFBEnM26DvIdy/fvkGTL/TdDa2A=";
+  };
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp lyricspot.py $out/bin/lyricspot
+    chmod +x $out/bin/lyricspot
+    wrapProgram $out/bin/lyricspot \
+      --prefix PATH ":" ${
+        lib.makeBinPath [
+          python3
+          playerctl
+        ]
+      }
+  '';
+
+  meta = {
+    homepage = "https://github.com/vlensys/lyricspot";
+    description = "Good old live synced lyrics in your terminal";
+    license = lib.licenses.gpl3Only;
+    mainProgram = "lyricspot";
+    maintainers = with lib.maintainers; [
+      yarn
+    ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/ma/mailpit/source.nix b/pkgs/by-name/ma/mailpit/source.nix
index 163ac2f273cb..16256eccff09 100644
--- a/pkgs/by-name/ma/mailpit/source.nix
+++ b/pkgs/by-name/ma/mailpit/source.nix
@@ -1,6 +1,6 @@
 {
-  version = "1.30.2";
-  hash = "sha256-37nJRJL1mxvUdD7L9/yO/Lzyjvn09Tu9xHTEt4pxu2s=";
-  npmDepsHash = "sha256-AApRrIIYC4NtKIFyGQ3lnKIOk7LZNDK8wvUUbSczTrA=";
-  vendorHash = "sha256-em0317Q1u5sl8gws4/qqM8e9H5F4vfBiM7tLCyufgEk=";
+  version = "1.30.3";
+  hash = "sha256-6Vt1GpGWHfaYaORBFa/cB+AxYQxAdkGtGTsrvL08dsA=";
+  npmDepsHash = "sha256-vXAXuvKqLWbwCjSLNS8mLDA9AmaGSRsB67iKQMi+/No=";
+  vendorHash = "sha256-A/kef2PgrA0Jpb/o+f1nUeiwSibOgsnyYLOzJ/HB1Fo=";
 }
diff --git a/pkgs/by-name/ma/matrix-authentication-service/package.nix b/pkgs/by-name/ma/matrix-authentication-service/package.nix
index 9d063b4fa960..38b359752e54 100644
--- a/pkgs/by-name/ma/matrix-authentication-service/package.nix
+++ b/pkgs/by-name/ma/matrix-authentication-service/package.nix
@@ -113,7 +113,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     homepage = "https://github.com/element-hq/matrix-authentication-service";
     changelog = "https://github.com/element-hq/matrix-authentication-service/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.agpl3Only;
-    maintainers = with lib.maintainers; [ teutat3s ];
+    teams = [ lib.teams.matrix ];
     mainProgram = "mas-cli";
   };
 })
diff --git a/pkgs/by-name/mc/mcporter/package.nix b/pkgs/by-name/mc/mcporter/package.nix
index 68cfd3f26480..797be48a03bf 100644
--- a/pkgs/by-name/mc/mcporter/package.nix
+++ b/pkgs/by-name/mc/mcporter/package.nix
@@ -15,20 +15,20 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "mcporter";
-  version = "0.11.3";
+  version = "0.12.3";
 
   src = fetchFromGitHub {
     owner = "steipete";
     repo = "mcporter";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xBH0OMrAQ3eVqBczzJnbaxbBLo2mRc6cCZBb5w4SkhI=";
+    hash = "sha256-dfbNyvIbdhZOLuwRDNLqUJHVeMEemioanktD6nL0Pmk=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-Ga1M3SQBaQnODQXh4+AXQ0FVCr7e8wPpbaV1ffQYNLM=";
+    hash = "sha256-EGG9ycEMssFE4MOiXL5YuCRiXEaP//3boceR3d7/VQo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/md/mdbook-linkcheck2/package.nix b/pkgs/by-name/md/mdbook-linkcheck2/package.nix
index dc9ae64f3899..8a3acf3e211d 100644
--- a/pkgs/by-name/md/mdbook-linkcheck2/package.nix
+++ b/pkgs/by-name/md/mdbook-linkcheck2/package.nix
@@ -2,25 +2,39 @@
   lib,
   fetchFromGitHub,
   rustPlatform,
-  testers,
-  mdbook-linkcheck2,
+  cacert,
+  versionCheckHook,
+  nix-update-script,
 }:
+
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mdbook-linkcheck2";
   version = "0.12.2";
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "marxin";
     repo = "mdbook-linkcheck2";
     tag = "v${finalAttrs.version}";
-    sha256 = "sha256-D0pteKtmBDkqcaonbNzL6tyo97x+qQhn6oY88+4VGFE=";
+    hash = "sha256-D0pteKtmBDkqcaonbNzL6tyo97x+qQhn6oY88+4VGFE=";
   };
 
   cargoHash = "sha256-XY1epCro/BqHm95HVP1eK0oVLSPYjD2hU7IdiEkgNMM=";
 
-  doCheck = false; # tries to access network to test broken web link functionality
+  propagatedNativeBuildInputs = [ cacert ];
 
-  passthru.tests.version = testers.testVersion { package = mdbook-linkcheck2; };
+  checkFlags = map (t: "--skip=${t}") [
+    "check_all_links_in_a_valid_book"
+    "correctly_find_broken_links"
+  ];
+
+  # see https://github.com/NixOS/nixpkgs/pull/531531#pullrequestreview-4492334034
+  # should be dropped in the next update
+  doInstallCheck = false;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "Backend for mdbook which will check your links for you";
@@ -29,6 +43,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       scandiravian
+      stepbrobd
     ];
   };
 })
diff --git a/pkgs/by-name/md/mdns-scanner/package.nix b/pkgs/by-name/md/mdns-scanner/package.nix
index 886ee73438fe..34ab0e9b72ab 100644
--- a/pkgs/by-name/md/mdns-scanner/package.nix
+++ b/pkgs/by-name/md/mdns-scanner/package.nix
@@ -7,7 +7,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mdns-scanner";
-  version = "0.27.2";
+  version = "0.27.3";
 
   __structuredAttrs = true;
 
@@ -15,10 +15,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "CramBL";
     repo = "mdns-scanner";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-oqU7lpDD2umCBAcPYKjo+5kdsCu3gjBiP5MPNvH2fhs=";
+    hash = "sha256-daJEiYOF1N2m4zVbsBuRl8KGrDs62GGDP9lCok9r/3w=";
   };
 
-  cargoHash = "sha256-TqTN9qXnfvP067kh+bfdXlU1lKaZistIvq1qJsgmJ8o=";
+  cargoHash = "sha256-eCB5nVEucMFX/wz9zrAKO9d3yI7BK/URpjlU39Y4g4I=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/me/mendingwall/package.nix b/pkgs/by-name/me/mendingwall/package.nix
new file mode 100644
index 000000000000..029face5d87e
--- /dev/null
+++ b/pkgs/by-name/me/mendingwall/package.nix
@@ -0,0 +1,58 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  wrapGAppsHook4,
+  meson,
+  blueprint-compiler,
+  glib,
+  gtk4,
+  libadwaita,
+  gettext,
+  appstream,
+  desktop-file-utils,
+  pkg-config,
+  ninja,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "mendingwall";
+  version = "0.3.8";
+
+  src = fetchFromGitHub {
+    owner = "lawmurray";
+    repo = "mendingwall";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-bt2DvbtwUaad5j2XpySA4KBfI4953tc1bHRuUUkS84M=";
+  };
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [
+    meson
+    blueprint-compiler
+    gettext
+    appstream
+    desktop-file-utils
+    pkg-config
+    ninja
+    wrapGAppsHook4
+  ];
+
+  buildInputs = [
+    glib
+    gtk4
+    libadwaita
+  ];
+
+  meta = with lib; {
+    description = "Fix theme and menu inconsistencies when using multiple desktop environments";
+    homepage = "https://mendingwall.indii.org/";
+    changelog = "https://github.com/lawmurray/mendingwall/releases/tag/v${finalAttrs.version}";
+    license = licenses.gpl3Plus;
+    maintainers = [ maintainers.jromer ];
+    platforms = platforms.linux;
+    mainProgram = "mendingwall";
+  };
+})
diff --git a/pkgs/by-name/mi/microcad/package.nix b/pkgs/by-name/mi/microcad/package.nix
new file mode 100644
index 000000000000..b731861af064
--- /dev/null
+++ b/pkgs/by-name/mi/microcad/package.nix
@@ -0,0 +1,54 @@
+{
+  lib,
+  fetchFromCodeberg,
+  rustPlatform,
+  pkg-config,
+  wayland,
+  cmake,
+  ninja,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "microcad";
+  version = "0.5.0";
+  __structuredAttrs = true;
+
+  src = fetchFromCodeberg {
+    owner = "microcad";
+    repo = "microcad";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-2164ynL01cLv5/D1FkcZpuBXTHPMjbpeaPPEZpmrSso=";
+  };
+
+  cargoHash = "sha256-OwPAl8LirPQEQ8ytx/+9OnrdbUagLA25mGMw1z/L6V0=";
+
+  nativeBuildInputs = [
+    cmake
+    ninja
+    pkg-config
+  ];
+  buildInputs = [ wayland ];
+  cargoBuildFlags = [
+    "-p"
+    "microcad-viewer"
+    "-p"
+    "microcad"
+    "-p"
+    "microcad-lsp"
+  ];
+
+  dontUseCmakeConfigure = true;
+  dontUseNinjaBuild = true;
+  dontUseNinjaInstall = true;
+  dontUseNinjaCheck = true;
+
+  meta = {
+    description = "Description language for modeling parameterizable geometric objects";
+    homepage = "https://microcad.xyz";
+    license = lib.licenses.agpl3Plus;
+    mainProgram = "microcad";
+    donationPage = "https://opencollective.com/microcad/donate";
+    platforms = [ "x86_64-linux" ];
+    maintainers = with lib.maintainers; [ fred441a ];
+  };
+})
diff --git a/pkgs/by-name/mu/multica-cli/package.nix b/pkgs/by-name/mu/multica-cli/package.nix
index 59e6c8e5f6a0..2cefcc613deb 100644
--- a/pkgs/by-name/mu/multica-cli/package.nix
+++ b/pkgs/by-name/mu/multica-cli/package.nix
@@ -9,18 +9,18 @@ buildGoModule rec {
   __structuredAttrs = true;
 
   pname = "multica-cli";
-  version = "0.3.27";
+  version = "0.3.34";
 
   src = fetchFromGitHub {
     owner = "multica-ai";
     repo = "multica";
     rev = "v${version}";
-    hash = "sha256-zHjyITvFG7dTk8mFQ62f8JY9wLbKeOvlo0pjF6hQxcI=";
+    hash = "sha256-8SZ9NIWpyZirUYM5zvQv7bA82XhxgZanzw0oeyAkntg=";
   };
 
   sourceRoot = "${src.name}/server";
 
-  vendorHash = "sha256-NXdBykPMWDD4BGLo2ams+KC14mxGNJYoV/dqobH6dv8=";
+  vendorHash = "sha256-4OHW+OEIzi65iZ+XZqhBcs9ZNR13Js0dHDHZTbEG6nc=";
 
   subPackages = [ "cmd/multica" ];
 
diff --git a/pkgs/by-name/mu/musescore-evolution/package.nix b/pkgs/by-name/mu/musescore-evolution/package.nix
index 03f01633f930..a544f3ec94f1 100644
--- a/pkgs/by-name/mu/musescore-evolution/package.nix
+++ b/pkgs/by-name/mu/musescore-evolution/package.nix
@@ -28,13 +28,13 @@ stdenv.mkDerivation (finalAttrs: {
   __structuredAttrs = true;
 
   pname = "musescore-evolution";
-  version = "3.7.0-unstable-2026-06-10";
+  version = "3.7.0-unstable-2026-06-30";
 
   src = fetchFromGitHub {
     owner = "Jojo-Schmitz";
     repo = "MuseScore";
-    rev = "ec719c0152fbb0fb57758a14a3754ad08d31dfc7";
-    hash = "sha256-yXVKjaY/utXA3617ik4misxeOVFp+0oo0RSU3yPUA00=";
+    rev = "8b07f250f0a657582609a870f27ea4794ec81ff2";
+    hash = "sha256-XclDbyopuP4+3tfgsCThxr7QYdKmoaBSfWd+3h8A+6w=";
   };
 
   patches = [
diff --git a/pkgs/by-name/mu/music-assistant-desktop/package.nix b/pkgs/by-name/mu/music-assistant-desktop/package.nix
index 54179caddd17..24342160219b 100644
--- a/pkgs/by-name/mu/music-assistant-desktop/package.nix
+++ b/pkgs/by-name/mu/music-assistant-desktop/package.nix
@@ -30,13 +30,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "music-assistant-desktop";
-  version = "0.4.2";
+  version = "0.4.4";
 
   src = fetchFromGitHub {
     owner = "music-assistant";
     repo = "desktop-app";
     tag = finalAttrs.version;
-    hash = "sha256-AzKUv0lEpxM4lVEmgDV89RCD78YKcGNj1FTBs8spdyI=";
+    hash = "sha256-t63DUejUyNnOD7gIPow/xsCo2TcmDaK3C5R+TkoBZo8=";
   };
 
   patches = [
@@ -46,7 +46,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   cargoRoot = "src-tauri";
   buildAndTestSubdir = finalAttrs.cargoRoot;
 
-  cargoHash = "sha256-PevHpvDIlah0jQw/mZkDxQ5xY3t6KicGLlDYbtPco5A=";
+  cargoHash = "sha256-Z7iyPEEPvUhVLma4n20faoz47CK+PHAIB6epNDF5sUo=";
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/yarn.lock";
diff --git a/pkgs/by-name/ne/nerva/package.nix b/pkgs/by-name/ne/nerva/package.nix
index 4b1d57c903a5..eb5599180716 100644
--- a/pkgs/by-name/ne/nerva/package.nix
+++ b/pkgs/by-name/ne/nerva/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "nerva";
-  version = "1.30.0";
+  version = "1.36.0";
 
   src = fetchFromGitHub {
     owner = "praetorian-inc";
     repo = "nerva";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kiVZFByiNCyubtzDryVwi6x/Xo1StEtlnOTlD9MfwP0=";
+    hash = "sha256-akGiZ5KolHOzZddgAYA3zWcFG0VSqHe6cFiB6AvRyhg=";
   };
 
   vendorHash = "sha256-Z0MSD+1/1VzrJ+pz5x0JvxrCxtJe59ckaTqHK/+TVN8=";
diff --git a/pkgs/by-name/ne/netavark/package.nix b/pkgs/by-name/ne/netavark/package.nix
index 21ab26755886..cdccae339838 100644
--- a/pkgs/by-name/ne/netavark/package.nix
+++ b/pkgs/by-name/ne/netavark/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "netavark";
-  version = "2.0.0";
+  version = "1.17.2";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "netavark";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-hMtYAG1OnnK1xECp8yiGEtgrWWnVfywLokOw6fzKEjw=";
+    hash = "sha256-FdJNcHYK6Jc1dNqcUr5Ne8dv1dzlHRhcjoldiihrov8=";
   };
 
-  cargoHash = "sha256-oVIOS0bzvT6FW43TJ/p0PZO/cjskzljhyxqeM0aSCCo=";
+  cargoHash = "sha256-wp/1lWc3OfNQt74m8DtpuFO/Mf07+M7numq2FMEkeGo=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/oa/oathkeeper/package.nix b/pkgs/by-name/oa/oathkeeper/package.nix
index ef923bc2f4ca..16b04e5b4bc3 100644
--- a/pkgs/by-name/oa/oathkeeper/package.nix
+++ b/pkgs/by-name/oa/oathkeeper/package.nix
@@ -1,44 +1,89 @@
 {
+  lib,
+  stdenv,
   fetchFromGitHub,
   buildGoModule,
-  lib,
+  installShellFiles,
+  versionCheckHook,
 }:
-let
+buildGoModule (finalAttrs: {
   pname = "oathkeeper";
   version = "26.2.0";
-  commit = "c84dbe07ecbf6f10154f04ec49b137a115155289";
-in
-buildGoModule {
-  inherit pname version commit;
 
   src = fetchFromGitHub {
     owner = "ory";
     repo = "oathkeeper";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-Dux9g5AWnbj9kXoIogVneOYywgg9TnyXqP41YT/1C8k=";
   };
 
   vendorHash = "sha256-/Qgdes8EAxP9FDKbahQdCpAD7PSe4iCkUvL1+poqaWc=";
 
+  __structuredAttrs = true;
   tags = [
     "sqlite"
     "json1"
     "hsm"
   ];
 
-  subPackages = [ "." ];
+  subPackages = [ "..." ];
 
   # Pass versioning information via ldflags
   ldflags = [
     "-s"
-    "-w"
-    "-X github.com/ory/oathkeeper/x.Version=${version}"
-    "-X github.com/ory/oathkeeper/x.Commit=${commit}"
+    "-X github.com/ory/oathkeeper/x.Version=${finalAttrs.src.tag}"
+    "-X github.com/ory/oathkeeper/x.Commit=${finalAttrs.src.rev}"
   ];
 
+  nativeBuildInputs = [ installShellFiles ];
+  # upstream tests use dynamic port assignment
+  __darwinAllowLocalNetworking = true;
+
+  # The configuration contains values or keys which are invalid:
+  # version:
+  #          ^-- does not match pattern "^v(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?$"
+  preCheck = ''
+    export version="${finalAttrs.src.tag}"
+  '';
+  checkFlags =
+    let
+      skippedTests = [
+        # flaky test, if system under high load the underlying server may be unavailable
+        "TestAuthenticatorOAuth2Introspection"
+        # flaky test(s): likely due to race condition within parallel test run, revisit at later date
+        # Error:          Expected nil, but got: &oauth2.Token{AccessToken:"some-token", TokenType:"Bearer", RefreshToken:"", Expiry:time.Date(2026, time.June, 24, 22, 41, 47, 887223251, time.UTC), ExpiresIn:0, raw:interface {}(nil), expiryDelta:0}
+        "TestClientCredentialsCache"
+        # Error: Not equal:
+        #     expected: rule.Rule{ID:"foo2", Version:"", Description:"Get users rule", Match:(*rule.Match)(0x64e4fd34c30), Authenticators>
+        #     actual  : rule.Rule{ID:"foo2", Version:"v26.2.0", Description:"Get users rule", Match:(*rule.Match)(0x64e4ff56ed0), Authent>
+        "TestHandler"
+      ];
+    in
+    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = [ "version" ];
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd oathkeeper \
+      --bash <($out/bin/oathkeeper completion bash) \
+      --fish <($out/bin/oathkeeper completion fish) \
+      --zsh <($out/bin/oathkeeper completion zsh)
+  '';
   meta = {
-    description = "Open-source identity and access proxy that authorizes HTTP requests based on sets of rules";
-    homepage = "https://www.ory.sh/oathkeeper/";
+    description = "Identity and access proxy that authorizes HTTP requests based on sets of rules";
+    longDescription = ''
+      It follows
+      [cloud architecture best practices](https://www.ory.com/docs/ecosystem/software-architecture-philosophy) and focuses on:
+
+      - Authenticating and authorizing HTTP requests
+      - Acting as a reverse proxy or decision API
+      - Mutating requests with identity information
+      - Integrating with existing API gateways and proxies
+      - Supporting multiple authentication and authorization strategies
+      - Working in Zero-Trust network architectures
+    '';
+    homepage = "https://github.com/ory/oathkeeper";
+    changelog = "https://github.com/ory/oathkeeper/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
       camcalaquian
@@ -46,4 +91,4 @@ buildGoModule {
     ];
     mainProgram = "oathkeeper";
   };
-}
+})
diff --git a/pkgs/by-name/oe/oelint-adv/package.nix b/pkgs/by-name/oe/oelint-adv/package.nix
index 7e6f2035d5a8..21a043873d5c 100644
--- a/pkgs/by-name/oe/oelint-adv/package.nix
+++ b/pkgs/by-name/oe/oelint-adv/package.nix
@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "oelint-adv";
-  version = "9.9.0";
+  version = "9.9.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "priv-kweihmann";
     repo = "oelint-adv";
     tag = finalAttrs.version;
-    hash = "sha256-c25opp+T1E3LiB6YUb393ar+pLiswpwTuR9fJezewTY=";
+    hash = "sha256-656OiHkRVP2M9/gR8faR2mEw9EzjHy92JRk82bD+I4k=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/on/onnxruntime/nvrtc-link.patch b/pkgs/by-name/on/onnxruntime/nvrtc-link.patch
new file mode 100644
index 000000000000..8c83c364498a
--- /dev/null
+++ b/pkgs/by-name/on/onnxruntime/nvrtc-link.patch
@@ -0,0 +1,26 @@
+diff --git a/cmake/onnxruntime_providers_cuda.cmake b/cmake/onnxruntime_providers_cuda.cmake
+index 624057dd43..64de9a0860 100644
+--- a/cmake/onnxruntime_providers_cuda.cmake
++++ b/cmake/onnxruntime_providers_cuda.cmake
+@@ -310,7 +310,7 @@
+           message( WARNING "To compile with NHWC ops enabled please compile against cuDNN 9 or newer." )
+         endif()
+       endif()
+-      target_link_libraries(${target} PRIVATE CUDA::cublasLt CUDA::cublas CUDNN::cudnn_all cudnn_frontend CUDA::curand CUDA::cufft CUDA::cudart
++      target_link_libraries(${target} PRIVATE CUDA::cublasLt CUDA::cublas CUDNN::cudnn_all cudnn_frontend CUDA::curand CUDA::cufft CUDA::cudart CUDA::nvrtc CUDA::cuda_driver
+               ${ABSEIL_LIBS} ${ONNXRUNTIME_PROVIDERS_SHARED} Boost::mp11 safeint_interface)
+     endif()
+ 
+diff --git a/cmake/onnxruntime_providers_cuda_plugin.cmake b/cmake/onnxruntime_providers_cuda_plugin.cmake
+index e345c944dc..82742df359 100644
+--- a/cmake/onnxruntime_providers_cuda_plugin.cmake
++++ b/cmake/onnxruntime_providers_cuda_plugin.cmake
+@@ -250,6 +250,8 @@ target_link_libraries(onnxruntime_providers_cuda_plugin PRIVATE
+     CUDA::cublas
+     CUDA::cublasLt
+     CUDA::cufft
++    CUDA::nvrtc
++    CUDA::cuda_driver
+     CUDNN::cudnn_all
+     cudnn_frontend
+     Boost::mp11
diff --git a/pkgs/by-name/on/onnxruntime/package.nix b/pkgs/by-name/on/onnxruntime/package.nix
index 01bd2b82e828..01b8ee43df55 100644
--- a/pkgs/by-name/on/onnxruntime/package.nix
+++ b/pkgs/by-name/on/onnxruntime/package.nix
@@ -134,6 +134,12 @@ effectiveStdenv.mkDerivation (finalAttrs: {
     # https://github.com/microsoft/onnxruntime/issues/9155
     # Patch adapted from https://gitlab.alpinelinux.org/alpine/aports/-/raw/462dfe0eb4b66948fe48de44545cc22bb64fdf9f/community/onnxruntime/0001-Remove-MATH_NO_EXCEPT-macro.patch
     ./remove-MATH_NO_EXCEPT-macro.patch
+  ]
+  # Include additional target_link_libraries needed for cudnn-frontend >= 2.19
+  # See: https://github.com/microsoft/onnxruntime/pull/28849
+  # These changes are included in 548ab6e and fc7a9f0 upstream
+  ++ lib.optionals cudaSupport [
+    ./nvrtc-link.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/by-name/or/ory-hydra/package.nix b/pkgs/by-name/or/ory-hydra/package.nix
index 14ab16c90129..237ec0a80b80 100644
--- a/pkgs/by-name/or/ory-hydra/package.nix
+++ b/pkgs/by-name/or/ory-hydra/package.nix
@@ -1,8 +1,10 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   versionCheckHook,
+  installShellFiles,
 }:
 buildGoModule (finalAttrs: {
   pname = "hydra";
@@ -17,6 +19,7 @@ buildGoModule (finalAttrs: {
 
   vendorHash = "sha256-KVCoDATyt5Qp0r3vGwdXqkjh0FEdNyKi6mXk99D6HD8=";
 
+  __structuredAttrs = true;
   # `json1` not needed (see: https://github.com/ory/hydra/commit/93edc9ad894771c67f46ae2c57ee7e50382d73cd)
   # `sqlite_omit_load_extension` consistency with upstream (see: https://github.com/ory/hydra/blob/master/.docker/Dockerfile-local-build#L20C58-L20C84). Will disable sqlite runtime extension loading (see: https://sqlite.org/loadext.html)
   tags = [
@@ -25,22 +28,49 @@ buildGoModule (finalAttrs: {
     "sqlite_omit_load_extension"
   ];
 
-  subPackages = [ "." ];
+  subPackages = [ "..." ];
 
   ldflags = [
     "-s"
-    "-X github.com/ory/hydra/v2/driver/config.Version=v${finalAttrs.version}"
+    "-X github.com/ory/hydra/v2/driver/config.Version=${finalAttrs.src.tag}"
     "-X github.com/ory/hydra/v2/driver/config.Commit=${finalAttrs.src.rev}"
   ];
 
+  nativeBuildInputs = [ installShellFiles ];
+  # tests use dynamic port assignment via port `0`
+  __darwinAllowLocalNetworking = true;
+  preCheck = ''
+    export version="${finalAttrs.src.tag}"
+  '';
+  checkFlags = [
+    "-short"
+  ];
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = [ "version" ];
 
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd hydra \
+      --bash <($out/bin/hydra completion bash) \
+      --fish <($out/bin/hydra completion fish) \
+      --zsh <($out/bin/hydra completion zsh)
+  '';
+
   meta = {
     description = "OpenID Certified™ OAuth 2.0 Server and OpenID Connect Provider";
-    homepage = "https://www.ory.com/hydra";
-    changelog = "https://github.com/ory/hydra/releases/tag/v${finalAttrs.version}";
+    longDescription = ''
+      Server implementation of the OAuth 2.0 authorization framework and the OpenID Connect Core 1.0. It follows
+      [cloud architecture best practices](https://www.ory.com/docs/ecosystem/software-architecture-philosophy) and focuses on:
+
+      - OAuth 2.0 and OpenID Connect flows
+      - Token issuance and validation
+      - Client management
+      - Consent and login flow orchestration
+      - JWKS management
+      - Low latency and high throughput
+    '';
+    homepage = "https://github.com/ory/hydra";
+    changelog = "https://github.com/ory/hydra/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
       debtquity
diff --git a/pkgs/by-name/ot/otel-desktop-viewer/package.nix b/pkgs/by-name/ot/otel-desktop-viewer/package.nix
index f5111b93be6c..50a095b9c449 100644
--- a/pkgs/by-name/ot/otel-desktop-viewer/package.nix
+++ b/pkgs/by-name/ot/otel-desktop-viewer/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "otel-desktop-viewer";
-  version = "0.3.0";
+  version = "0.3.2";
 
   src = fetchFromGitHub {
     owner = "CtrlSpice";
     repo = "otel-desktop-viewer";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-oHnawHizBsyGSMORZz8qVQ6PZ/Ta/ftX+m799J1GhWM=";
+    hash = "sha256-9m1W2DxbMyBOGeECTn78X7I3GcToW5Gi33HWXGyWFO8=";
   };
 
   # NOTE: This project uses Go workspaces, but 'buildGoModule' does not support
diff --git a/pkgs/by-name/pa/pana/package.nix b/pkgs/by-name/pa/pana/package.nix
index fb5d0c9a97ab..6881bae84334 100644
--- a/pkgs/by-name/pa/pana/package.nix
+++ b/pkgs/by-name/pa/pana/package.nix
@@ -9,13 +9,13 @@
 }:
 buildDartApplication rec {
   pname = "pana";
-  version = "0.23.12";
+  version = "0.23.13";
 
   src = fetchFromGitHub {
     owner = "dart-lang";
     repo = "pana";
     tag = version;
-    hash = "sha256-y72E2ojoAJF38QLb+5iKiAjF7c8AqglmY0qI53MohX4=";
+    hash = "sha256-LPTcmAb0eZKhxzz/LzV4GnHfw/RAKCItoC7Vn9vvOuw=";
   };
 
   dartEntryPoints = {
diff --git a/pkgs/by-name/pa/pana/pubspec.lock.json b/pkgs/by-name/pa/pana/pubspec.lock.json
index 4e3c4076ee5e..2ca72fb00a18 100644
--- a/pkgs/by-name/pa/pana/pubspec.lock.json
+++ b/pkgs/by-name/pa/pana/pubspec.lock.json
@@ -4,21 +4,21 @@
       "dependency": "transitive",
       "description": {
         "name": "_fe_analyzer_shared",
-        "sha256": "1dd467c7e56541bea70bbd35d537e3aa12dfba81f39e2a75bb6a61fc5595985b",
+        "sha256": "1b0e6a07425a3e460666e88bf1c949ccc7bb0116ad562ce94a1eca60fe820725",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "97.0.0"
+      "version": "103.0.0"
     },
     "analyzer": {
       "dependency": "direct main",
       "description": {
         "name": "analyzer",
-        "sha256": "041602214e3ec5a02ba85c08fe8e381aa25ac5367db17d03fbb6d22d851d4bba",
+        "sha256": "61c04d0c1bfed555c681ea079519933f071a5a026578ff73c4ff0df2d3462e5e",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "11.0.0"
+      "version": "13.3.0"
     },
     "args": {
       "dependency": "direct main",
@@ -54,11 +54,11 @@
       "dependency": "direct dev",
       "description": {
         "name": "build",
-        "sha256": "aadd943f4f8cc946882c954c187e6115a84c98c81ad1d9c6cbf0895a8c85da9c",
+        "sha256": "a156715e7cd728130c592f30552575908aae5b100005fbc1f0fb16b3c03a3d10",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.0.5"
+      "version": "4.0.6"
     },
     "build_config": {
       "dependency": "direct dev",
@@ -84,11 +84,11 @@
       "dependency": "direct dev",
       "description": {
         "name": "build_runner",
-        "sha256": "521daf8d189deb79ba474e43a696b41c49fb3987818dbacf3308f1e03673a75e",
+        "sha256": "1523ce62448ebac2c15a8ba5fbad8acac169788658a7dd2a1c2d9c2a9318b9a6",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.13.1"
+      "version": "2.15.0"
     },
     "build_verify": {
       "dependency": "direct dev",
@@ -124,11 +124,11 @@
       "dependency": "transitive",
       "description": {
         "name": "built_value",
-        "sha256": "0730c18c770d05636a8f945c32a4d7d81cb6e0f0148c8db4ad12e7748f7e49af",
+        "sha256": "34e4067d30ce212937df995f03b69992eea683539ceeac7f679a1f1eba055b56",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "8.12.5"
+      "version": "8.12.6"
     },
     "checked_yaml": {
       "dependency": "transitive",
@@ -154,21 +154,11 @@
       "dependency": "direct main",
       "description": {
         "name": "cli_util",
-        "sha256": "ff6785f7e9e3c38ac98b2fb035701789de90154024a75b6cb926445e83197d1c",
+        "sha256": "5909d2c6b66817222779e1eedc19e0e28b76d1df7bd9856a4792ccb9881df358",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.4.2"
-    },
-    "code_builder": {
-      "dependency": "transitive",
-      "description": {
-        "name": "code_builder",
-        "sha256": "6a6cab2ba4680d6423f34a9b972a4c9a94ebe1b62ecec4e1a1f2cba91fd1319d",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "4.11.1"
+      "version": "0.5.1"
     },
     "collection": {
       "dependency": "direct main",
@@ -194,11 +184,11 @@
       "dependency": "transitive",
       "description": {
         "name": "coverage",
-        "sha256": "5da775aa218eaf2151c721b16c01c7676fbfdd99cebba2bf64e8b807a28ff94d",
+        "sha256": "956a3de0725ca232ad353565a8290d3357592bf4250f6f298a185e2d949c5d3d",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.15.0"
+      "version": "1.15.1"
     },
     "crypto": {
       "dependency": "direct main",
@@ -234,11 +224,21 @@
       "dependency": "transitive",
       "description": {
         "name": "dart_style",
-        "sha256": "29f7ecc274a86d32920b1d9cfc7502fa87220da41ec60b55f329559d5732e2b2",
+        "sha256": "59d53ef8eaed9d288ed9767618e2b31c4fa0383a127db59d5eb2e737a7638a60",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.1.7"
+      "version": "3.1.9"
+    },
+    "ffi": {
+      "dependency": "transitive",
+      "description": {
+        "name": "ffi",
+        "sha256": "6d7fd89431262d8f3125e81b50d3847a091d846eafcd4fdb88dd06f36d705a45",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.2.0"
     },
     "file": {
       "dependency": "transitive",
@@ -344,21 +344,21 @@
       "dependency": "direct main",
       "description": {
         "name": "json_annotation",
-        "sha256": "cb09e7dac6210041fad964ed7fbee004f14258b4eca4040f72d1234062ace4c8",
+        "sha256": "2a743920d81b7910627f68ee2c9ac1fc0bfee32b9fc3403587d7c6791ca12f80",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.11.0"
+      "version": "4.12.0"
     },
     "json_serializable": {
       "dependency": "direct dev",
       "description": {
         "name": "json_serializable",
-        "sha256": "fbcf404b03520e6e795f6b9b39badb2b788407dfc0a50cf39158a6ae1ca78925",
+        "sha256": "ffcd10cde35a93b2abbbcc26bd9971f4ca93763e8abe78d855e3c4177797e501",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.13.1"
+      "version": "6.14.0"
     },
     "lints": {
       "dependency": "direct main",
@@ -394,21 +394,21 @@
       "dependency": "transitive",
       "description": {
         "name": "matcher",
-        "sha256": "dc0b7dc7651697ea4ff3e69ef44b0407ea32c487a39fff6a4004fa585e901861",
+        "sha256": "31bd099b47c10cd1aeb55146a2d46ce0277630ecef3f7dae54ad7873f36696cd",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.12.19"
+      "version": "0.12.20"
     },
     "meta": {
       "dependency": "direct main",
       "description": {
         "name": "meta",
-        "sha256": "df0c643f44ad098eb37988027a8e2b2b5a031fd3977f06bbfd3a76637e8df739",
+        "sha256": "c82594181e3312f3d0695fc95aaaf7758d75b8d4ae2bbecf223b9fd5109a059d",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.18.2"
+      "version": "1.18.3"
     },
     "mime": {
       "dependency": "transitive",
@@ -544,21 +544,21 @@
       "dependency": "direct dev",
       "description": {
         "name": "source_gen",
-        "sha256": "732792cfd197d2161a65bb029606a46e0a18ff30ef9e141a7a82172b05ea8ecd",
+        "sha256": "ec37cc0e6694374cbef59ed79685572c870a54ede6fa30a3e420feb3adffea02",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.2.2"
+      "version": "4.2.3"
     },
     "source_helper": {
       "dependency": "transitive",
       "description": {
         "name": "source_helper",
-        "sha256": "1d3b229b2934034fb2e691fbb3d53e0f75a4af7b1407f88425ed8f209bcb1b8f",
+        "sha256": "4227d54ceefd0bb8ca4c8fcb96e1719dc53f1ee1b6e2ca9d7a6069da160e4eae",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.3.11"
+      "version": "1.3.12"
     },
     "source_map_stack_trace": {
       "dependency": "transitive",
@@ -654,31 +654,31 @@
       "dependency": "direct main",
       "description": {
         "name": "test",
-        "sha256": "8d9ceddbab833f180fbefed08afa76d7c03513dfdba87ffcec2718b02bbcbf20",
+        "sha256": "0d5ba5602ec3baa28c8ce365e1efc5575969c765f45c554a3e167dc7945b9c30",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.31.0"
+      "version": "1.31.2"
     },
     "test_api": {
       "dependency": "transitive",
       "description": {
         "name": "test_api",
-        "sha256": "949a932224383300f01be9221c39180316445ecb8e7547f70a41a35bf421fb9e",
+        "sha256": "475610b2aa23c19687cce2961e44b0cc57cafe220f67c2b80201231b2a07fbe7",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.7.11"
+      "version": "0.7.13"
     },
     "test_core": {
       "dependency": "transitive",
       "description": {
         "name": "test_core",
-        "sha256": "1991d4cfe85d5043241acac92962c3977c8d2f2add1ee73130c7b286417d1d34",
+        "sha256": "a39c204a4fc7a7ccb04a2b985e359fda3cc37e45e0b8ac61c3fb1a05aa832132",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.6.17"
+      "version": "0.6.19"
     },
     "test_descriptor": {
       "dependency": "direct dev",
@@ -714,11 +714,11 @@
       "dependency": "transitive",
       "description": {
         "name": "vm_service",
-        "sha256": "45caa6c5917fa127b5dbcfbd1fa60b14e583afdc08bfc96dda38886ca252eb60",
+        "sha256": "0016aef94fc66495ac78af5859181e3f3bf2026bd8eecc72b9565601e19ab360",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "15.0.2"
+      "version": "15.2.0"
     },
     "watcher": {
       "dependency": "transitive",
@@ -782,6 +782,6 @@
     }
   },
   "sdks": {
-    "dart": ">=3.10.0 <4.0.0"
+    "dart": ">=3.11.0 <4.0.0"
   }
 }
diff --git a/pkgs/by-name/pa/paperless-ngx/frontend.nix b/pkgs/by-name/pa/paperless-ngx/frontend.nix
new file mode 100644
index 000000000000..20f2843c7793
--- /dev/null
+++ b/pkgs/by-name/pa/paperless-ngx/frontend.nix
@@ -0,0 +1,88 @@
+{
+  stdenv,
+  lib,
+  fetchPnpmDeps,
+  pnpmConfigHook,
+  pnpm_10,
+  nodejs,
+  node-gyp,
+  pkg-config,
+  python3,
+  pango,
+  giflib,
+  xcbuild,
+  src,
+  version,
+  meta,
+}:
+let
+  pnpm = pnpm_10;
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "paperless-ngx-frontend";
+  inherit version;
+
+  src = src + "/src-ui";
+
+  pnpmDeps = fetchPnpmDeps {
+    inherit pnpm;
+    inherit (finalAttrs) pname version src;
+    fetcherVersion = 3;
+    hash = "sha256-HO+IDNB3NXWgvV0cvZ5zx46JuXv6Tgroz+YfVump5MA=";
+  };
+
+  nativeBuildInputs = [
+    node-gyp
+    nodejs
+    pkg-config
+    pnpmConfigHook
+    pnpm
+    python3
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    xcbuild
+  ];
+
+  buildInputs = [
+    pango
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    giflib
+  ];
+
+  CYPRESS_INSTALL_BINARY = "0";
+  NG_CLI_ANALYTICS = "false";
+
+  buildPhase = ''
+    runHook preBuild
+
+    pushd node_modules/canvas
+    node-gyp rebuild
+    popd
+
+    # cat forcefully disables angular cli's spinner which doesn't work with nix' tty which is 0x0
+    pnpm run build --configuration production | cat
+
+    runHook postBuild
+  '';
+
+  doCheck = true;
+  checkPhase = ''
+    runHook preCheck
+
+    pnpm run test | cat
+
+    runHook postCheck
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib/paperless-ui
+    mv ../src/documents/static/frontend $out/lib/paperless-ui/
+
+    runHook postInstall
+  '';
+
+  inherit meta;
+})
diff --git a/pkgs/by-name/pa/paperless-ngx/package.nix b/pkgs/by-name/pa/paperless-ngx/package.nix
index 084331ade53a..641da02e2848 100644
--- a/pkgs/by-name/pa/paperless-ngx/package.nix
+++ b/pkgs/by-name/pa/paperless-ngx/package.nix
@@ -3,12 +3,10 @@
   stdenv,
   fetchFromGitHub,
   fetchPypi,
-  node-gyp,
-  nodejs,
+  callPackage,
   nixosTests,
   gettext,
   python3,
-  giflib,
   ghostscript_headless,
   imagemagickBig,
   jbig2enc,
@@ -16,50 +14,40 @@
   pngquant,
   qpdf,
   tesseract5,
-  fetchPnpmDeps,
-  pnpmConfigHook,
-  pnpm_10,
   poppler-utils,
   liberation_ttf,
-  xcbuild,
-  pango,
-  pkg-config,
   symlinkJoin,
   nltk-data,
   lndir,
+  nix-update-script,
+  extraPythonPackageOverrides ? (_final: _prev: { }),
 }:
 let
-  pnpm = pnpm_10;
+  defaultPythonPackageOverrides = final: prev: {
+    django = prev.django_5;
 
-  version = "2.20.15";
+    fido2 = prev.fido2.overridePythonAttrs {
+      version = "1.2.0";
 
-  src = fetchFromGitHub {
-    owner = "paperless-ngx";
-    repo = "paperless-ngx";
-    tag = "v${version}";
-    hash = "sha256-Czh4Knel0IIHsTc3kEnp1153Kv+3721GRCbTYTkeCDg=";
+      src = fetchPypi {
+        pname = "fido2";
+        version = "1.2.0";
+        hash = "sha256-45+VkgEi1kKD/aXlWB2VogbnBPpChGv6RmL4aqDTMzs=";
+      };
+
+      pytestFlags = [ ];
+    };
+
+    # tesseract5 may be overwritten in the paperless module and we need to propagate that to make the closure reduction effective
+    ocrmypdf = prev.ocrmypdf_16.override { tesseract = tesseract5; };
   };
 
   python = python3.override {
     self = python;
-    packageOverrides = final: prev: {
-      django = prev.django_5;
-
-      fido2 = prev.fido2.overridePythonAttrs {
-        version = "1.2.0";
-
-        src = fetchPypi {
-          pname = "fido2";
-          version = "1.2.0";
-          hash = "sha256-45+VkgEi1kKD/aXlWB2VogbnBPpChGv6RmL4aqDTMzs=";
-        };
-
-        pytestFlags = [ ];
-      };
-
-      # tesseract5 may be overwritten in the paperless module and we need to propagate that to make the closure reduction effective
-      ocrmypdf = prev.ocrmypdf_16.override { tesseract = tesseract5; };
-    };
+    packageOverrides = lib.composeManyExtensions [
+      defaultPythonPackageOverrides
+      extraPythonPackageOverrides
+    ];
   };
 
   path = lib.makeBinPath [
@@ -73,73 +61,6 @@ let
     poppler-utils
   ];
 
-  frontend = stdenv.mkDerivation (finalAttrs: {
-    pname = "paperless-ngx-frontend";
-    inherit version;
-
-    src = src + "/src-ui";
-
-    pnpmDeps = fetchPnpmDeps {
-      inherit pnpm;
-      inherit (finalAttrs) pname version src;
-      fetcherVersion = 3;
-      hash = "sha256-HO+IDNB3NXWgvV0cvZ5zx46JuXv6Tgroz+YfVump5MA=";
-    };
-
-    nativeBuildInputs = [
-      node-gyp
-      nodejs
-      pkg-config
-      pnpmConfigHook
-      pnpm
-      python3
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      xcbuild
-    ];
-
-    buildInputs = [
-      pango
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      giflib
-    ];
-
-    CYPRESS_INSTALL_BINARY = "0";
-    NG_CLI_ANALYTICS = "false";
-
-    buildPhase = ''
-      runHook preBuild
-
-      pushd node_modules/canvas
-      node-gyp rebuild
-      popd
-
-      # cat forcefully disables angular cli's spinner which doesn't work with nix' tty which is 0x0
-      pnpm run build --configuration production | cat
-
-      runHook postBuild
-    '';
-
-    doCheck = true;
-    checkPhase = ''
-      runHook preCheck
-
-      pnpm run test | cat
-
-      runHook postCheck
-    '';
-
-    installPhase = ''
-      runHook preInstall
-
-      mkdir -p $out/lib/paperless-ui
-      mv ../src/documents/static/frontend $out/lib/paperless-ui/
-
-      runHook postInstall
-    '';
-  });
-
   nltkDataDir = symlinkJoin {
     name = "paperless_ngx_nltk_data";
     paths = with nltk-data; [
@@ -149,11 +70,18 @@ let
     ];
   };
 in
-python.pkgs.buildPythonApplication rec {
+python.pkgs.buildPythonApplication (finalAttrs: {
   pname = "paperless-ngx";
   pyproject = true;
 
-  inherit version src;
+  version = "2.20.15";
+
+  src = fetchFromGitHub {
+    owner = "paperless-ngx";
+    repo = "paperless-ngx";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Czh4Knel0IIHsTc3kEnp1153Kv+3721GRCbTYTkeCDg=";
+  };
 
   postPatch = ''
     # pytest-xdist with to many threads makes the tests flaky
@@ -266,14 +194,14 @@ python.pkgs.buildPythonApplication rec {
 
   installPhase =
     let
-      pythonPath = python.pkgs.makePythonPath dependencies;
+      pythonPath = python.pkgs.makePythonPath finalAttrs.passthru.dependencies;
     in
     ''
       runHook preInstall
 
       mkdir -p $out/lib/paperless-ngx/static/frontend
       cp -r {src,static,LICENSE} $out/lib/paperless-ngx
-      lndir -silent ${frontend}/lib/paperless-ui/frontend $out/lib/paperless-ngx/static/frontend
+      lndir -silent ${finalAttrs.passthru.frontend}/lib/paperless-ui/frontend $out/lib/paperless-ngx/static/frontend
       chmod +x $out/lib/paperless-ngx/src/manage.py
       makeWrapper $out/lib/paperless-ngx/src/manage.py $out/bin/paperless-ngx \
         --prefix PYTHONPATH : "${pythonPath}" \
@@ -319,7 +247,7 @@ python.pkgs.buildPythonApplication rec {
     export PATH="${path}:$PATH"
     export HOME=$(mktemp -d)
     export XDG_DATA_DIRS="${liberation_ttf}/share:$XDG_DATA_DIRS"
-    export PAPERLESS_NLTK_DIR=${passthru.nltkDataDir}
+    export PAPERLESS_NLTK_DIR=${finalAttrs.passthru.nltkDataDir}
     # Limit threads per worker based on NIX_BUILD_CORES, capped at 256
     # ocrmypdf has an internal limit of 256 jobs and will fail with more:
     # https://github.com/ocrmypdf/OCRmyPDF/blob/66308c281306302fac3470f587814c3b212d0c40/src/ocrmypdf/cli.py#L234
@@ -351,20 +279,29 @@ python.pkgs.buildPythonApplication rec {
   doCheck = !stdenv.hostPlatform.isDarwin;
 
   passthru = {
+    frontend = callPackage ./frontend.nix {
+      inherit (finalAttrs) src version;
+      meta = removeAttrs finalAttrs.meta [ "mainProgram" ];
+    };
     inherit
-      frontend
       nltkDataDir
       path
       python
       tesseract5
       ;
     tests = { inherit (nixosTests) paperless; };
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--subpackage"
+        "frontend"
+      ];
+    };
   };
 
   meta = {
     description = "Tool to scan, index, and archive all of your physical documents";
     homepage = "https://docs.paperless-ngx.com/";
-    changelog = "https://github.com/paperless-ngx/paperless-ngx/releases/tag/${src.tag}";
+    changelog = "https://github.com/paperless-ngx/paperless-ngx/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.gpl3Only;
     platforms = lib.platforms.unix;
     mainProgram = "paperless-ngx";
@@ -374,4 +311,4 @@ python.pkgs.buildPythonApplication rec {
       erikarvstedt
     ];
   };
-}
+})
diff --git a/pkgs/by-name/pd/pdk-ciel/package.nix b/pkgs/by-name/pd/pdk-ciel/package.nix
index 517086ba4c4c..3eb3f69a63ae 100644
--- a/pkgs/by-name/pd/pdk-ciel/package.nix
+++ b/pkgs/by-name/pd/pdk-ciel/package.nix
@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "ciel";
-  version = "2.5.1";
+  version = "2.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "fossi-foundation";
     repo = "ciel";
     tag = finalAttrs.version;
-    hash = "sha256-O2HgkRzTWd8GjMEkQZw9F4Re7zYIxZ+gPjs3gwy4DqE=";
+    hash = "sha256-koN65VQLGXvVmVd8hNJvbDn7R/4EHg/sNaHvWDWW4DM=";
   };
 
   build-system = [ python3Packages.poetry-core ];
diff --git a/pkgs/by-name/pe/pear-desktop/package.nix b/pkgs/by-name/pe/pear-desktop/package.nix
index d1748c3592f1..902c753439a0 100644
--- a/pkgs/by-name/pe/pear-desktop/package.nix
+++ b/pkgs/by-name/pe/pear-desktop/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   fetchFromGitHub,
   makeWrapper,
+  actool,
   electron,
   python3,
   copyDesktopItems,
@@ -43,6 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
     pnpmConfigHook
     pnpm_10
   ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ actool ]
   ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [ copyDesktopItems ];
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = 1;
diff --git a/pkgs/by-name/ph/phpstan/package.nix b/pkgs/by-name/ph/phpstan/package.nix
index cdc91f106bd9..e24c35dc4c40 100644
--- a/pkgs/by-name/ph/phpstan/package.nix
+++ b/pkgs/by-name/ph/phpstan/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "phpstan";
-  version = "2.2.2";
+  version = "2.2.3";
 
   src = fetchFromGitHub {
     owner = "phpstan";
     repo = "phpstan";
     tag = finalAttrs.version;
-    hash = "sha256-4C3d8ae9TGpyLNspClSS+Eor6epjG1BTS/Nzy4K5zZE=";
+    hash = "sha256-P0LmURcau2DGHJI5NZd9nZ56rWvO1EDYXoK1++ZcG6A=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pl/plezy/package.nix b/pkgs/by-name/pl/plezy/package.nix
index ea0434432b95..36952fbf6120 100644
--- a/pkgs/by-name/pl/plezy/package.nix
+++ b/pkgs/by-name/pl/plezy/package.nix
@@ -27,13 +27,13 @@
 
 let
   pname = "plezy";
-  version = "2.7.1";
+  version = "2.8.0";
 
   src = fetchFromGitHub {
     owner = "edde746";
     repo = "plezy";
     tag = version;
-    hash = "sha256-lzq0a7zxKpRwLM6T2VeD4A+qbW55bkwmtBN0bc6Lq4g=";
+    hash = "sha256-NvBCh++teOB0uNyy71NmOFwCQvkg9/v9Rx+76UybLQo=";
   };
 
   simdutf = fetchurl {
@@ -152,7 +152,7 @@ let
 
     src = fetchurl {
       url = "https://github.com/edde746/plezy/releases/download/${version}/plezy-macos.dmg";
-      hash = "sha256-tkkZWwMK3SHzkB2r/JDj+JPggXHFGSinMn8ZtKyRUMU=";
+      hash = "sha256-eN8CJ/yaV4wln6fN2lJqJnn+RvW+ZiD3oCDhjQjyBvU=";
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/by-name/po/pocketsphinx/package.nix b/pkgs/by-name/po/pocketsphinx/package.nix
index 2f5e7f162956..caa8e1f85b48 100644
--- a/pkgs/by-name/po/pocketsphinx/package.nix
+++ b/pkgs/by-name/po/pocketsphinx/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pocketsphinx";
-  version = "5.0.4";
+  version = "5.1.1";
 
   src = fetchFromGitHub {
     owner = "cmusphinx";
     repo = "pocketsphinx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DUK3zPPtv+sQhC1dfJXDmwtt3UV6DGacb3mMQUpvVpk=";
+    hash = "sha256-bB/k1KRrdP52MN5iZr2Q2MGWh0JOCsqJxccUyVu2Va0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pr/pretix/package.nix b/pkgs/by-name/pr/pretix/package.nix
index a830390a9ad2..22f3855b68e9 100644
--- a/pkgs/by-name/pr/pretix/package.nix
+++ b/pkgs/by-name/pr/pretix/package.nix
@@ -54,14 +54,14 @@ let
 in
 pythonPackages.buildPythonApplication (finalAttrs: {
   pname = "pretix";
-  version = "2026.5.2";
+  version = "2026.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pretix";
     repo = "pretix";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lamvhcch/EajS8/b1tocAKjCgW0WqFD0wsm4e5o25nM=";
+    hash = "sha256-yKJGJziMpOB8ttz0n4USay03wJTId77bYT7id4OgoIE=";
   };
 
   patches = [
@@ -87,7 +87,7 @@ pythonPackages.buildPythonApplication (finalAttrs: {
 
   npmDeps = fetchNpmDeps {
     inherit (finalAttrs) src;
-    hash = "sha256-Gkcz/QJCNuvhIdZnP/mPx5GD0EOJzxoP1dGI43pyOro=";
+    hash = "sha256-DJCvNcgDIY71Q9qg4Ng7SAM9i9wHhHOdJonpt5t/Xx8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pr/pretix/plugins/fontpack-free/package.nix b/pkgs/by-name/pr/pretix/plugins/fontpack-free/package.nix
new file mode 100644
index 000000000000..2c4b91cc706f
--- /dev/null
+++ b/pkgs/by-name/pr/pretix/plugins/fontpack-free/package.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pretix-plugin-build,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "pretix-fontpack-free";
+  version = "1.11.1";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "pretix";
+    repo = "pretix-fontpack-free";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-eeU8awLf/PSsLuAOobZhXVyQ3KM7jOEIz1ZLt4eDxzQ=";
+  };
+
+  build-system = [
+    pretix-plugin-build
+    setuptools
+  ];
+
+  pythonImportsCheck = [
+    "pretix_fontpackfree"
+  ];
+
+  meta = {
+    description = "Set of free fonts for pretix";
+    homepage = "https://github.com/pretix/pretix-fontpack-free";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ hexa ];
+  };
+})
diff --git a/pkgs/by-name/pr/pretix/plugins/mollie/package.nix b/pkgs/by-name/pr/pretix/plugins/mollie/package.nix
index b17d5d52a534..1b3aa88c3a92 100644
--- a/pkgs/by-name/pr/pretix/plugins/mollie/package.nix
+++ b/pkgs/by-name/pr/pretix/plugins/mollie/package.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pretix-mollie";
-  version = "2.5.6";
+  version = "2.5.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pretix";
     repo = "pretix-mollie";
     tag = "v${version}";
-    hash = "sha256-XInwUecuC3sEcRpuS+xa7Gb2Isb18SexbZ2+CcUF7/E=";
+    hash = "sha256-LApnvohrNiyqRmBIysxR5ZAMy5nZhPts0znirOUsxq0=";
   };
 
   build-system = [
diff --git a/pkgs/by-name/pr/pretix/plugins/payone/package.nix b/pkgs/by-name/pr/pretix/plugins/payone/package.nix
index 1d38c6c820b5..60bff54203cd 100644
--- a/pkgs/by-name/pr/pretix/plugins/payone/package.nix
+++ b/pkgs/by-name/pr/pretix/plugins/payone/package.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pretix-payone";
-  version = "1.4.2";
+  version = "1.4.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pretix";
     repo = "pretix-payone";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-y1BO8Hz/pGKalURCbF3QJ49xn+L/sd8SWTGdCIl43yw=";
+    hash = "sha256-ru944WkeNBYq5XkIMoAFLgGcU2gGxClEYVhCwuZGioI=";
   };
 
   build-system = [
diff --git a/pkgs/by-name/pr/prusa-slicer/package.nix b/pkgs/by-name/pr/prusa-slicer/package.nix
index 2529acf23b33..5292f59478b9 100644
--- a/pkgs/by-name/pr/prusa-slicer/package.nix
+++ b/pkgs/by-name/pr/prusa-slicer/package.nix
@@ -62,14 +62,14 @@ let
 in
 clangStdenv.mkDerivation (finalAttrs: {
   pname = "prusa-slicer";
-  version = "2.9.5";
+  version = "2.9.6";
   # Build with clang even on Linux, because GCC uses absolutely obscene amounts of memory
   # on this particular code base (OOM with 32GB memory and --cores 16 on GCC, succeeds
   # with --cores 32 on clang).
   src = fetchFromGitHub {
     owner = "prusa3d";
     repo = "PrusaSlicer";
-    hash = "sha256-tVC/hIykg0flc9HgB4ddJqUEVolZ4Lu/Cx5I10Z2eCI=";
+    hash = "sha256-SXNIyAncnPU6Zac8/plM32sPBgj9Uj9eVDL3NBu+IL4=";
     rev = "version_${finalAttrs.version}";
   };
 
diff --git a/pkgs/by-name/qi/qidi-studio/package.nix b/pkgs/by-name/qi/qidi-studio/package.nix
index b316f1eaa172..c45e9637967d 100644
--- a/pkgs/by-name/qi/qidi-studio/package.nix
+++ b/pkgs/by-name/qi/qidi-studio/package.nix
@@ -7,11 +7,11 @@
 }:
 let
   pname = "qidi-studio";
-  version = "2.06.00.51";
+  version = "2.07.01.57";
 
   src = fetchurl {
     url = "https://github.com/QIDITECH/QIDIStudio/releases/download/v${version}/QIDIStudio_v0${version}_Ubuntu24.AppImage";
-    hash = "sha256-Qb/NbyjOCtIg74O5yPxX9Jq0Hf92hJXo9RqQTQh/ESM=";
+    hash = "sha256-hMkA8rlMOzV1t4aEi3KLrgeWUIgO+CVjwIM6mwM8pGA=";
   };
 
   appimageContents = appimageTools.extract {
diff --git a/pkgs/by-name/qo/qovery-cli/package.nix b/pkgs/by-name/qo/qovery-cli/package.nix
index 60c9f5d0b35a..47a33f715938 100644
--- a/pkgs/by-name/qo/qovery-cli/package.nix
+++ b/pkgs/by-name/qo/qovery-cli/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "qovery-cli";
-  version = "1.166.0";
+  version = "1.166.2";
 
   src = fetchFromGitHub {
     owner = "Qovery";
     repo = "qovery-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-orNVII6Y82YVtgEKpQnEpNXVWsg6P3sHluW1FGU20DA=";
+    hash = "sha256-GjfgdW5A2afQ46GfT3wjj+foxQEXsmI83NBaxU19uig=";
   };
 
   vendorHash = "sha256-fZqzHJa5VFC1z5ZaHCXNyIKbwLjb3pSEb9FHs4YhWZg=";
diff --git a/pkgs/by-name/r0/r0vm/package.nix b/pkgs/by-name/r0/r0vm/package.nix
deleted file mode 100644
index 6027d2ce8357..000000000000
--- a/pkgs/by-name/r0/r0vm/package.nix
+++ /dev/null
@@ -1,57 +0,0 @@
-{
-  rustPlatform,
-  fetchFromGitHub,
-  fetchurl,
-  pkg-config,
-  perl,
-  openssl,
-  lib,
-}:
-rustPlatform.buildRustPackage (finalAttrs: {
-  pname = "r0vm";
-  version = "1.0.5";
-  src = fetchFromGitHub {
-    owner = "risc0";
-    repo = "risc0";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-jtROtI5/4W2pNvn1ZYR/wQAZmECTr7YxuZGu2Ns9paw=";
-  };
-
-  buildAndTestSubdir = "risc0/r0vm";
-
-  nativeBuildInputs = [
-    pkg-config
-    perl
-  ];
-
-  buildInputs = [
-    openssl.dev
-  ];
-
-  doCheck = false;
-
-  cargoHash = "sha256-7vN3HRBCzvXT5Xoj+ciCiy+OQ0bC8s4C5360W+1Uld0=";
-
-  postPatch =
-    let
-      # see https://github.com/risc0/risc0/blob/v1.0.5/risc0/circuit/recursion/build.rs
-      sha256Hash = "4e8496469e1efa00efb3630d261abf345e6b2905fb64b4f3a297be88ebdf83d2";
-      recursionZkr = fetchurl {
-        name = "recursion_zkr.zip";
-        url = "https://risc0-artifacts.s3.us-west-2.amazonaws.com/zkr/${sha256Hash}.zip";
-        hash = "sha256-ToSWRp4e+gDvs2MNJhq/NF5rKQX7ZLTzope+iOvfg9I=";
-      };
-    in
-    ''
-      ln -sf ${recursionZkr} ./risc0/circuit/recursion/src/recursion_zkr.zip
-    '';
-
-  meta = {
-    description = "RISC Zero zero-knowledge VM";
-    homepage = "https://github.com/risc0/risc0";
-    changelog = "https://github.com/risc0/risc0/blob/${finalAttrs.src.rev}/CHANGELOG.md";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ marijanp ];
-    mainProgram = "r0vm";
-  };
-})
diff --git a/pkgs/by-name/rd/rdfind/package.nix b/pkgs/by-name/rd/rdfind/package.nix
index 107fc932af99..a88ebc058953 100644
--- a/pkgs/by-name/rd/rdfind/package.nix
+++ b/pkgs/by-name/rd/rdfind/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  autoreconfHook,
   nettle,
 }:
 
@@ -14,6 +15,11 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-eMRjFS4dnk/Rv+uDuckt9ef8TF+Tx9Qm+x9++ivk3yk=";
   };
 
+  # the built-in configure script was generated by autoconf 2.72 and
+  # passes -std=gnu++11 when using gcc 16 instead of the intended c++20.
+  # autoconf 2.73 fixes this, so we autoreconf to avoid this issue.
+  nativeBuildInputs = [ autoreconfHook ];
+
   buildInputs = [ nettle ];
 
   meta = {
diff --git a/pkgs/by-name/rd/rdup/package.nix b/pkgs/by-name/rd/rdup/package.nix
index 1649ad98882a..078aac483789 100644
--- a/pkgs/by-name/rd/rdup/package.nix
+++ b/pkgs/by-name/rd/rdup/package.nix
@@ -5,29 +5,38 @@
   pkg-config,
   autoreconfHook,
   glib,
-  pcre,
+  pcre2,
+  coreutils,
 }:
 
 stdenv.mkDerivation {
   pname = "rdup";
-  version = "1.1.15";
+  version = "1.1.16-unstable-2024-03-05";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+  enableParallelBuilding = true;
 
   src = fetchFromGitHub {
     owner = "miekg";
     repo = "rdup";
-    rev = "d66e4320cd0bbcc83253baddafe87f9e0e83caa6";
-    sha256 = "0bzyv6qmnivxnv9nw7lnfn46k0m1dlxcjj53zcva6v8y8084l1iw";
+    rev = "fa1c753a107c12b3797204c41779ce2c8d5da45a";
+    hash = "sha256-k+386SrXE0IULP02/aOa5E/F/HWhnD/ttGzFStric5M=";
   };
 
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
+    glib
   ];
+
   buildInputs = [
     glib
-    pcre
+    pcre2
   ];
 
+  installFlags = [ "INSTALL=${coreutils}/bin/install" ];
+
   meta = {
     description = "Only backup program that doesn't make backups";
     homepage = "https://github.com/miekg/rdup";
diff --git a/pkgs/by-name/re/recordbox/package.nix b/pkgs/by-name/re/recordbox/package.nix
index fec7c9434630..077143cee220 100644
--- a/pkgs/by-name/re/recordbox/package.nix
+++ b/pkgs/by-name/re/recordbox/package.nix
@@ -74,6 +74,7 @@ stdenv.mkDerivation (finalAttrs: {
     sqlite
   ]
   ++ (with gst_all_1; [
+    gst-libav
     gst-plugins-bad
     gst-plugins-base
     gst-plugins-good
diff --git a/pkgs/by-name/re/reqable/package.nix b/pkgs/by-name/re/reqable/package.nix
index 4ebeb565775d..dc2b3cce6df6 100644
--- a/pkgs/by-name/re/reqable/package.nix
+++ b/pkgs/by-name/re/reqable/package.nix
@@ -28,11 +28,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "reqable";
-  version = "3.1.3";
+  version = "3.2.3";
 
   src = fetchurl {
     url = "https://github.com/reqable/reqable-app/releases/download/${finalAttrs.version}/reqable-app-linux-x86_64.deb";
-    hash = "sha256-kOxR9qAEwQu+fFRWemMHFsal4kqC0wzPBkN/pYlEE7E=";
+    hash = "sha256-C1nBAr/vrkMdqG6PyLWatdhom8u+IDUYvQCQd+genS4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ri/rime-wanxiang/package.nix b/pkgs/by-name/ri/rime-wanxiang/package.nix
index ef2a83f0a359..89a8ddad195e 100644
--- a/pkgs/by-name/ri/rime-wanxiang/package.nix
+++ b/pkgs/by-name/ri/rime-wanxiang/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "rime-wanxiang";
-  version = "15.14.2";
+  version = "15.16.0";
 
   src = fetchFromGitHub {
     owner = "amzxyz";
     repo = "rime_wanxiang";
     tag = "v" + finalAttrs.version;
-    hash = "sha256-OSOnMt9kk0wc1uGAxzp7Fa8OLNs89feKTqKZj4iu/1Y=";
+    hash = "sha256-+7Ao0Mr+vNeMUTA5DXldQD9ruA1wVA1QcU5CUk39Q9c=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/ru/rufin/package.nix b/pkgs/by-name/ru/rufin/package.nix
new file mode 100644
index 000000000000..17fdd59bffc6
--- /dev/null
+++ b/pkgs/by-name/ru/rufin/package.nix
@@ -0,0 +1,104 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  cacert,
+  gdk-pixbuf,
+  gettext,
+  gst_all_1,
+  gtk4,
+  libadwaita,
+  pkg-config,
+  wrapGAppsHook4,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "rufin";
+  version = "0.7.8";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "screwys";
+    repo = "Rufin";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-TgPjv3s0ERLSnncbtzyr+K1cVscr0PbPxFuDuiPwuV4=";
+  };
+
+  cargoHash = "sha256-hddBiTzJBSk37/Lq7GQ+kTOx6ikLh641B0ISWN2Z2qI=";
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    gettext
+    pkg-config
+    wrapGAppsHook4
+  ];
+
+  buildInputs = [
+    gdk-pixbuf
+    gettext
+    gtk4
+    libadwaita
+  ]
+  ++ (with gst_all_1; [
+    gstreamer
+    gst-plugins-base
+    gst-plugins-good
+    gst-plugins-bad
+    gst-plugins-ugly
+    gst-libav
+  ]);
+
+  cargoBuildFlags = [
+    "-p"
+    "rufin"
+  ];
+
+  doCheck = false;
+
+  postInstall = ''
+    install -Dm644 data/io.github.screwys.Rufin.desktop \
+      "$out/share/applications/io.github.screwys.Rufin.desktop"
+    substituteInPlace "$out/share/applications/io.github.screwys.Rufin.desktop" \
+      --replace-fail "Exec=rufin" "Exec=$out/bin/rufin"
+    install -Dm644 data/io.github.screwys.Rufin.metainfo.xml \
+      "$out/share/metainfo/io.github.screwys.Rufin.metainfo.xml"
+    install -Dm644 data/icons/hicolor/scalable/apps/io.github.screwys.Rufin.svg \
+      "$out/share/icons/hicolor/scalable/apps/io.github.screwys.Rufin.svg"
+    install -Dm644 -t "$out/share/icons/hicolor/scalable/actions" \
+      data/icons/hicolor/scalable/actions/*.svg
+    install -Dm644 -t "$out/share/icons/hicolor/scalable/status" \
+      data/icons/hicolor/scalable/status/*.svg
+    install -Dm644 -t "$out/share/icons/hicolor/512x512/apps" \
+      data/icons/hicolor/512x512/apps/*.png
+    install -Dm644 -t "$out/share/icons/hicolor/64x64/apps" \
+      data/icons/hicolor/64x64/apps/*.png
+
+    for po_file in locales/*.po; do
+      if [ -f "$po_file" ]; then
+        lang="$(basename "$po_file" .po)"
+        mkdir -p "$out/share/locale/$lang/LC_MESSAGES"
+        msgfmt "$po_file" -o "$out/share/locale/$lang/LC_MESSAGES/rufin.mo"
+      fi
+    done
+  '';
+
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --set-default RUFIN_LOCALEDIR "$out/share/locale"
+      --set-default SSL_CERT_FILE "${cacert}/etc/ssl/certs/ca-bundle.crt"
+      --prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0"
+    )
+  '';
+
+  meta = {
+    description = "Native GTK music client for Jellyfin";
+    homepage = "https://github.com/screwys/Rufin";
+    changelog = "https://github.com/screwys/Rufin/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ screwys ];
+    mainProgram = "rufin";
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/ru/run0-sudo-shim/package.nix b/pkgs/by-name/ru/run0-sudo-shim/package.nix
index 937d0da8bfae..e9e8eb0ff4c4 100644
--- a/pkgs/by-name/ru/run0-sudo-shim/package.nix
+++ b/pkgs/by-name/ru/run0-sudo-shim/package.nix
@@ -5,22 +5,31 @@
   nix-update-script,
   coreutils,
   polkit-stdin-agent,
+  installShellFiles,
+  versionCheckHook,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "run0-sudo-shim";
-  version = "1.3.1";
+  version = "1.4.2";
 
   src = fetchFromGitHub {
     owner = "LordGrimmauld";
     repo = "run0-sudo-shim";
     tag = finalAttrs.version;
-    hash = "sha256-QkDoEBgcWh/eKX8jxctMNEy08Sf8kpxXFhWbsygTWz8=";
+    hash = "sha256-J/I7VPXpOwNtEk9H+lbZVT+xJYBsSKgnMlwzlVIJSWk=";
   };
 
-  cargoHash = "sha256-ly2e2x1Z1XEXblGqWi+/r5q2FmvpekVfzGVGm+S1xio=";
+  cargoHash = "sha256-JfxMmYgYLKxVqj8H0/qRGn9z8XNoNpPK3RcIhb/RKOc=";
 
   __structuredAttrs = true;
 
+  nativeBuildInputs = [
+    installShellFiles
+    versionCheckHook
+  ];
+
+  doInstallCheck = true;
+
   env = {
     POLKIT_STDIN_AGENT = lib.getExe polkit-stdin-agent;
     TRUE = lib.getExe' coreutils "true";
@@ -28,6 +37,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   postInstall = ''
     ln -s $out/bin/run0-sudo-shim $out/bin/sudo
+    installManPage target/tmp/run0-sudo-shim/manpage/*
+    installShellCompletion \
+      target/tmp/run0-sudo-shim/completion/sudo.{bash,fish} \
+      --zsh target/tmp/run0-sudo-shim/completion/_sudo
   '';
 
   passthru.updateScript = nix-update-script { };
diff --git a/pkgs/by-name/ru/runme/package.nix b/pkgs/by-name/ru/runme/package.nix
index 75c900b5b249..3ed050fcaa34 100644
--- a/pkgs/by-name/ru/runme/package.nix
+++ b/pkgs/by-name/ru/runme/package.nix
@@ -13,16 +13,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "runme";
-  version = "3.16.15";
+  version = "3.16.17";
 
   src = fetchFromGitHub {
     owner = "runmedev";
     repo = "runme";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-mU8U/aak0FrQEFanVksM/32bsGx5damuf6BxshTk/M0=";
+    hash = "sha256-1N1VQT+VJd+Pd9rltyEiF6s45GjB/ORqpbzzy9/ABGs=";
   };
 
-  vendorHash = "sha256-q+NVyzTCKgyOW94O/YWbmgvgUVh9xlnBOMLWCp/0jrM=";
+  vendorHash = "sha256-51Hp00t/FlOL99uEe5R6ehTkLUfjrR8rw2LE8ERB1og=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/sa/sage/patches/lower-sleep2-test-threshold.patch b/pkgs/by-name/sa/sage/patches/lower-sleep2-test-threshold.patch
new file mode 100644
index 000000000000..1ac7f5571baf
--- /dev/null
+++ b/pkgs/by-name/sa/sage/patches/lower-sleep2-test-threshold.patch
@@ -0,0 +1,32 @@
+diff --git a/src/sage/doctest/test.py b/src/sage/doctest/test.py
+index 812f8167c12..a4822642f0c 100644
+--- a/src/sage/doctest/test.py
++++ b/src/sage/doctest/test.py
+@@ -49,11 +49,11 @@ Check that :issue:`2235` has been fixed::
+ 
+ Check slow doctest warnings are correctly raised::
+ 
+-    sage: subprocess.call(["python3", "-m", "sage.doctest", "--warn-long",     # long time
++    sage: subprocess.call(["python3", "-m", "sage.doctest", "--warn-long", "0.2",     # long time
+     ....:       "--random-seed=0", "--optional=sage", "sleep2.rst"], **kwds)
+     Running doctests...
+     Doctesting 1 file.
+-    ... --warn-long --random-seed=0 sleep2.rst
++    ... --warn-long 0.2 --random-seed=0 sleep2.rst
+     **********************************************************************
+     File "sleep2.rst", line 4, in sage.doctest.tests.sleep2
+     Warning: slow doctest:
+@@ -66,11 +66,11 @@ Check slow doctest warnings are correctly raised::
+     ----------------------------------------------------------------------
+     ...
+     0
+-    sage: subprocess.call(["python3", "-m", "sage.doctest", "--format=github", "--warn-long",     # long time
++    sage: subprocess.call(["python3", "-m", "sage.doctest", "--format=github", "--warn-long", "0.2",    # long time
+     ....:       "--random-seed=0", "--optional=sage", "sleep2.rst"], **kwds)
+     Running doctests...
+     Doctesting 1 file.
+-    ... --warn-long --random-seed=0 sleep2.rst
++    ... --warn-long 0.2 --random-seed=0 sleep2.rst
+     **********************************************************************
+     ::warning title=Warning: slow doctest:,file=sleep2.rst,line=4::slow doctest:: Test ran for ...s cpu, ...s wall%0ACheck ran for ...s cpu, ...s wall%0A
+         while walltime(t) < 2: pass
diff --git a/pkgs/by-name/sa/sage/sage-src.nix b/pkgs/by-name/sa/sage/sage-src.nix
index eae82d4c9d6e..7362bf8f3897 100644
--- a/pkgs/by-name/sa/sage/sage-src.nix
+++ b/pkgs/by-name/sa/sage/sage-src.nix
@@ -78,6 +78,9 @@ stdenv.mkDerivation rec {
     # a more conservative version of https://github.com/sagemath/sage/pull/37951
     ./patches/gap-element-crash.patch
 
+    # https://github.com/sagemath/sage/issues/42473
+    ./patches/lower-sleep2-test-threshold.patch
+
     # https://github.com/sagemath/sage/pull/42009, landed in 10.10.beta0
     (fetchpatch2 {
       name = "gap-root-paths.patch";
diff --git a/pkgs/by-name/sa/sagittarius-scheme/fix-roundeven-declaration.patch b/pkgs/by-name/sa/sagittarius-scheme/fix-roundeven-declaration.patch
new file mode 100644
index 000000000000..124cf1f3f744
--- /dev/null
+++ b/pkgs/by-name/sa/sagittarius-scheme/fix-roundeven-declaration.patch
@@ -0,0 +1,38 @@
+diff --git a/src/bignum.c b/src/bignum.c
+index 1a5553d5a..6bcdb5b6b 100644
+--- a/src/bignum.c
++++ b/src/bignum.c
+@@ -1949,6 +1949,7 @@ static SgObject small_bignum_to_string(SgBignum *b, int radix, int use_upper)
+ }
+ 
+ /* FIXME this is also in number.c */
++#if !defined(__GLIBC__) || !__GLIBC_PREREQ(2, 26)
+ static inline double roundeven(double v)
+ {
+   double r;
+@@ -1966,6 +1967,7 @@ static inline double roundeven(double v)
+   }
+   return r;
+ }
++  #endif
+ /* this is used here */
+ static SgBignum * bignum_expt(SgBignum *b, long exponent);
+ 
+diff --git a/src/roundeven.inc b/src/roundeven.inc
+index 36d3c5535..1a29eefce 100644
+--- a/src/roundeven.inc
++++ b/src/roundeven.inc
+@@ -31,6 +31,7 @@
+ #include <math.h>
+ #include <float.h>
+ 
++#if !defined(__GLIBC__) || !__GLIBC_PREREQ(2, 26)
+ static inline double roundeven(double v)
+ {
+   double r;
+@@ -50,3 +51,5 @@ static inline double roundeven(double v)
+ }
+ 
+ #endif
++
++#endif
diff --git a/pkgs/by-name/sa/sagittarius-scheme/package.nix b/pkgs/by-name/sa/sagittarius-scheme/package.nix
index eadaffaf7c21..97541be796a3 100644
--- a/pkgs/by-name/sa/sagittarius-scheme/package.nix
+++ b/pkgs/by-name/sa/sagittarius-scheme/package.nix
@@ -23,17 +23,23 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "sagittarius-scheme";
-  version = "0.9.12";
+  version = "0.9.14";
   src = fetchurl {
-    url = "https://bitbucket.org/ktakashi/sagittarius-scheme/downloads/sagittarius-${finalAttrs.version}.tar.gz";
-    hash = "sha256-w6aQkC7/vKO8exvDpsSsLyLXrm4FSKh8XYGJgseEII0=";
+    url = "https://github.com/ktakashi/sagittarius-scheme/releases/download/v${finalAttrs.version}/sagittarius-${finalAttrs.version}.tar.gz";
+    hash = "sha256-L0ZKCiSbneWe1+czj83x+bCHPZw1uuYSdJwKHp4qTnk=";
   };
+
+  patches = [
+    ./fix-roundeven-declaration.patch
+  ];
+
   preBuild = ''
     # since we lack rpath during build, need to explicitly add build path
     # to LD_LIBRARY_PATH so we can load libsagittarius.so as required to
     # build extensions
     export ${platformLdLibraryPath}="$(pwd)/build"
   '';
+
   nativeBuildInputs = [
     pkg-config
     cmake
@@ -76,9 +82,10 @@ stdenv.mkDerivation (finalAttrs: {
       -  mostly works O(n)
       -  Replaceable reader
     '';
-    homepage = "https://bitbucket.org/ktakashi/sagittarius-scheme";
+    homepage = "https://github.com/ktakashi/sagittarius-scheme";
     license = lib.licenses.bsd2;
     platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [ abbe ];
+    broken = stdenv.hostPlatform.isDarwin;
   };
 })
diff --git a/pkgs/by-name/sa/sail/package.nix b/pkgs/by-name/sa/sail/package.nix
index d15dd6681274..ceca9973d555 100644
--- a/pkgs/by-name/sa/sail/package.nix
+++ b/pkgs/by-name/sa/sail/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "sail";
-  version = "0.6.3";
+  version = "0.6.5";
 
   src = fetchFromGitHub {
     owner = "lakehq";
     repo = "sail";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-B5VEm2Hzbi+RBgqpVZE6QNiPneVETlU44JZ8NUWucTY=";
+    hash = "sha256-pCxlGCOLxupgxCtRfUSLbA88dFIWvO16fgibLmydNBQ=";
   };
 
-  cargoHash = "sha256-1az/NiHNQGbvf0GpmnxWILqYWH5OT6+4tPaMnvxE5RE=";
+  cargoHash = "sha256-V3FS28H+lGORTFYWaMNeLdz0s+Bv4bo3By5VlIOWiOc=";
 
   cargoBuildFlags = [
     "-p"
diff --git a/pkgs/by-name/sc/scid/package.nix b/pkgs/by-name/sc/scid/package.nix
index c093366bf294..2b7a4a21c8f1 100644
--- a/pkgs/by-name/sc/scid/package.nix
+++ b/pkgs/by-name/sc/scid/package.nix
@@ -35,6 +35,8 @@ tcl.mkTclDerivation rec {
     zlib
   ];
 
+  addTclConfigureFlags = false;
+
   configureFlags = [
     "BINDIR=$(out)/bin"
     "SHAREDIR=$(out)/share"
diff --git a/pkgs/by-name/sc/scipopt-soplex/package.nix b/pkgs/by-name/sc/scipopt-soplex/package.nix
index 36bfe673c7af..748358d57eb2 100644
--- a/pkgs/by-name/sc/scipopt-soplex/package.nix
+++ b/pkgs/by-name/sc/scipopt-soplex/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "scipopt-soplex";
-  version = "8.0.1";
+  version = "8.0.2";
 
   src = fetchFromGitHub {
     owner = "scipopt";
     repo = "soplex";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NN1UwwvLPfRIpL49UV8f2G4glUmTEywKNXK3m1LFHcg=";
+    hash = "sha256-TW3OSBw8ok64kZedsXYjkO2eFqr0LH8uvrOsi3bwQC4=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/sc/scss-lint/Gemfile.lock b/pkgs/by-name/sc/scss-lint/Gemfile.lock
index 8f6ebd379216..7b9e58ae45e4 100644
--- a/pkgs/by-name/sc/scss-lint/Gemfile.lock
+++ b/pkgs/by-name/sc/scss-lint/Gemfile.lock
@@ -1,7 +1,7 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    ffi (1.17.2)
+    ffi (1.17.4)
     rb-fsevent (0.11.2)
     rb-inotify (0.11.1)
       ffi (~> 1.0)
@@ -20,4 +20,4 @@ DEPENDENCIES
   scss_lint
 
 BUNDLED WITH
-   2.7.1
+   2.7.2
diff --git a/pkgs/by-name/sc/scss-lint/gemset.nix b/pkgs/by-name/sc/scss-lint/gemset.nix
index 7300ead8b4b2..4a8ff7693705 100644
--- a/pkgs/by-name/sc/scss-lint/gemset.nix
+++ b/pkgs/by-name/sc/scss-lint/gemset.nix
@@ -4,10 +4,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "19kdyjg3kv7x0ad4xsd4swy5izsbb1vl1rpb6qqcqisr5s23awi9";
+      sha256 = "1kqasqvy8d7r09ri4n6bkdwbk63j7afd9ilsw34nzlgh0qp69ldw";
       type = "gem";
     };
-    version = "1.17.2";
+    version = "1.17.4";
   };
   rb-fsevent = {
     groups = [ "default" ];
diff --git a/pkgs/by-name/se/seconlay/package.nix b/pkgs/by-name/se/seconlay/package.nix
index 3394ddee73cf..cb798eb324f9 100644
--- a/pkgs/by-name/se/seconlay/package.nix
+++ b/pkgs/by-name/se/seconlay/package.nix
@@ -12,14 +12,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "seconlay";
-  version = "0-unstable-2026-06-18";
+  version = "0-unstable-2026-06-22";
 
   src = fetchFromGitLab {
     group = "alasca.cloud";
     owner = "scl";
     repo = "scl-management";
-    rev = "bd2d56e3537824537390cb0ba5e9efd4db1410c2";
-    hash = "sha256-f/eySU2lq1DwFPZ1CD8P7EeVO8b26Fz6d3PH3OrTm/0=";
+    rev = "0ba7e2283341cdcf54d82546e0f99078c06dce54";
+    hash = "sha256-DevFMumN/Tpqkbu3ktwWGpxzeIv3J1T7vKwr1pcdZXY=";
   };
 
   cargoHash = "sha256-aX5HL/zDdrQ+V4vCYZrqlO2vNWuvF4GW2P30jtbv1tE=";
diff --git a/pkgs/by-name/sk/skaffold/package.nix b/pkgs/by-name/sk/skaffold/package.nix
index 5d6ebf6c067b..485ce51bbb1e 100644
--- a/pkgs/by-name/sk/skaffold/package.nix
+++ b/pkgs/by-name/sk/skaffold/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "skaffold";
-  version = "2.21.0";
+  version = "2.23.0";
 
   src = fetchFromGitHub {
     owner = "GoogleContainerTools";
     repo = "skaffold";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ny1iWispfR9V4SBhTTn8e8lShi2X+HLjVT6RcqigCR8=";
+    hash = "sha256-mFJOveUkOJC7bIzxrjQgDKhCf0WvOTgSDqBSIVgZZzw=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/sk/skypilot/CVE-2026-13482.patch b/pkgs/by-name/sk/skypilot/CVE-2026-13482.patch
new file mode 100644
index 000000000000..a6c7766082d6
--- /dev/null
+++ b/pkgs/by-name/sk/skypilot/CVE-2026-13482.patch
@@ -0,0 +1,364 @@
+From 2435727f0c6b02d56e254a5ba1d8e041c7c33c86 Mon Sep 17 00:00:00 2001
+From: DanielZhangQD <36026334+DanielZhangQD@users.noreply.github.com>
+Date: Mon, 29 Jun 2026 14:59:48 +0800
+Subject: [PATCH] [Core] Mark non-security MD5/SHA1 hashes with
+ usedforsecurity=False (#9972)
+
+* [Core] Mark non-security MD5/SHA1 hashes with usedforsecurity=False
+
+These hashlib.md5/sha1 calls derive identifiers, cache keys, and resource
+names from non-secret inputs (usernames, paths, region/subscription ids,
+cluster/host names, wheel/catalog contents). None protects a secret or
+makes an authentication decision -- passwords use bcrypt via crypt_ctx and
+auth is enforced by oauth2-proxy / SSO. Pass usedforsecurity=False so
+weak-hash scanners (CWE-328) stop flagging them. The flag does not change
+any digest value, so all derived ids, cache keys and names are unchanged.
+
+Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
+
+* [Core] Address review: avoid split hexdigest() call in oauth2_proxy
+
+Compute the digest first, then slice, instead of splitting the empty
+hexdigest() parentheses across lines. yapf-stable and more readable.
+
+Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
+
+---------
+
+Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
+---
+ sky/backends/backend_utils.py       |  3 ++-
+ sky/backends/wheel_utils.py         |  3 ++-
+ sky/batch/io_formats.py             |  3 ++-
+ sky/catalog/aws_catalog.py          |  6 ++++--
+ sky/catalog/common.py               |  4 +++-
+ sky/clouds/aws.py                   |  2 +-
+ sky/clouds/nebius.py                |  3 ++-
+ sky/data/mounting_utils.py          |  3 ++-
+ sky/data/storage.py                 |  6 ++++--
+ sky/provision/azure/config.py       |  2 +-
+ sky/provision/kubernetes/utils.py   |  3 ++-
+ sky/provision/scp/instance.py       |  2 +-
+ sky/server/auth/oauth2_proxy.py     |  7 +++++--
+ sky/server/server.py                |  5 ++++-
+ sky/users/permission.py             |  6 ++++--
+ sky/users/server.py                 | 13 ++++++++++---
+ sky/utils/command_runner.py         |  7 ++++---
+ sky/utils/common_utils.py           | 13 ++++++++++---
+ sky/utils/kubernetes/gpu_labeler.py |  3 ++-
+ 19 files changed, 65 insertions(+), 29 deletions(-)
+
+diff --git a/sky/backends/backend_utils.py b/sky/backends/backend_utils.py
+index ff4662b4160..ec0b4bf74fb 100644
+--- a/sky/backends/backend_utils.py
++++ b/sky/backends/backend_utils.py
+@@ -707,7 +707,8 @@ def get_expirable_clouds(
+ 
+ 
+ def _get_volume_name(path: str, cluster_name_on_cloud: str) -> str:
+-    path_hash = hashlib.md5(path.encode()).hexdigest()[:6]
++    path_hash = hashlib.md5(path.encode(),
++                            usedforsecurity=False).hexdigest()[:6]
+     return f'{cluster_name_on_cloud}-{path_hash}'
+ 
+ 
+diff --git a/sky/backends/wheel_utils.py b/sky/backends/wheel_utils.py
+index 4cfd4c485a5..f142011bfe1 100644
+--- a/sky/backends/wheel_utils.py
++++ b/sky/backends/wheel_utils.py
+@@ -210,7 +210,8 @@ def _build_sky_wheel() -> pathlib.Path:
+         # wheel content hash doesn't change.
+         with open(wheel_path, 'rb') as f:
+             contents = f.read()
+-        hash_of_latest_wheel = hashlib.md5(contents).hexdigest()
++        hash_of_latest_wheel = hashlib.md5(contents,
++                                           usedforsecurity=False).hexdigest()
+ 
+         wheel_dir = WHEEL_DIR / hash_of_latest_wheel
+         wheel_dir.mkdir(parents=True, exist_ok=True)
+diff --git a/sky/catalog/aws_catalog.py b/sky/catalog/aws_catalog.py
+index c2480965708..e842068beaa 100644
+--- a/sky/catalog/aws_catalog.py
++++ b/sky/catalog/aws_catalog.py
+@@ -113,7 +113,8 @@ def _get_az_mappings(aws_user_hash: str) -> Optional['pd.DataFrame']:
+         # Write md5 of the az_mapping file to a file so we can check it for
+         # any changes when uploading to the controller
+         with open(az_mapping_path, 'r', encoding='utf-8') as f:
+-            az_mapping_hash = hashlib.md5(f.read().encode()).hexdigest()
++            az_mapping_hash = hashlib.md5(f.read().encode(),
++                                          usedforsecurity=False).hexdigest()
+         with open(az_mapping_md5_path, 'w', encoding='utf-8') as f:
+             f.write(az_mapping_hash)
+     else:
+@@ -147,7 +148,8 @@ def _fetch_and_apply_az_mapping(df: common.LazyDataFrame) -> 'pd.DataFrame':
+         user_identity_list = aws.AWS.get_active_user_identity()
+         assert user_identity_list, user_identity_list
+         user_identity = user_identity_list[0]
+-        aws_user_hash = hashlib.md5(user_identity.encode()).hexdigest()[:8]
++        aws_user_hash = hashlib.md5(user_identity.encode(),
++                                    usedforsecurity=False).hexdigest()[:8]
+     except (exceptions.CloudUserIdentityError, ImportError):
+         # If failed to get user identity, or import aws dependencies, we use the
+         # latest mapping file or the default mapping file.
+diff --git a/sky/catalog/common.py b/sky/catalog/common.py
+index 00829871e53..a0397e6301f 100644
+--- a/sky/catalog/common.py
++++ b/sky/catalog/common.py
+@@ -291,7 +291,9 @@ def _update_catalog():
+                         tmp_path = f.name
+                     os.rename(tmp_path, catalog_path)
+                     with open(meta_path + '.md5', 'w', encoding='utf-8') as f:
+-                        f.write(hashlib.md5(r.text.encode()).hexdigest())
++                        f.write(
++                            hashlib.md5(r.text.encode(),
++                                        usedforsecurity=False).hexdigest())
+             logger.debug(f'Updated {cloud} catalog {filename}.')
+         return True
+ 
+diff --git a/sky/clouds/aws.py b/sky/clouds/aws.py
+index af4ca56e911..06607e0d802 100644
+--- a/sky/clouds/aws.py
++++ b/sky/clouds/aws.py
+@@ -1347,7 +1347,7 @@ def get_user_identities(cls) -> Optional[List[List[str]]]:
+             # - aws credentials are not set, proceed anyway to get unified error
+             #   message for users
+             return cls._sts_get_caller_identity()
+-        config_hash = hashlib.md5(stdout).hexdigest()[:8]
++        config_hash = hashlib.md5(stdout, usedforsecurity=False).hexdigest()[:8]
+         # Getting aws identity cost ~1s, so we cache the result with the output of
+         # `aws configure list` as cache key. Different `aws configure list` output
+         # can have same aws identity, our assumption is the output would be stable
+diff --git a/sky/data/mounting_utils.py b/sky/data/mounting_utils.py
+index f49a8db097f..6b97b2d6ef0 100644
+--- a/sky/data/mounting_utils.py
++++ b/sky/data/mounting_utils.py
+@@ -714,7 +714,8 @@ def get_mount_cached_cmd(
+     # This is because the full path may be longer than
+     # the filename length limit.
+     # The hash is a non-negative integer in string form.
+-    hashed_mount_path = hashlib.md5(mount_path.encode()).hexdigest()
++    hashed_mount_path = hashlib.md5(mount_path.encode(),
++                                    usedforsecurity=False).hexdigest()
+     log_file_path = os.path.join(constants.RCLONE_MOUNT_CACHED_LOG_DIR,
+                                  f'{hashed_mount_path}.log')
+     create_log_cmd = (f'mkdir -p {constants.RCLONE_MOUNT_CACHED_LOG_DIR} && '
+diff --git a/sky/data/storage.py b/sky/data/storage.py
+index 022fc471f41..13e068c5be5 100644
+--- a/sky/data/storage.py
++++ b/sky/data/storage.py
+@@ -3367,10 +3367,12 @@ def get_default_storage_account_name(region: Optional[str]) -> str:
+         """
+         assert region is not None
+         subscription_id = azure.get_subscription_id()
+-        subscription_hash_obj = hashlib.md5(subscription_id.encode('utf-8'))
++        subscription_hash_obj = hashlib.md5(subscription_id.encode('utf-8'),
++                                            usedforsecurity=False)
+         subscription_hash = subscription_hash_obj.hexdigest(
+         )[:AzureBlobStore._SUBSCRIPTION_HASH_LENGTH]
+-        region_hash_obj = hashlib.md5(region.encode('utf-8'))
++        region_hash_obj = hashlib.md5(region.encode('utf-8'),
++                                      usedforsecurity=False)
+         region_hash = region_hash_obj.hexdigest()[:AzureBlobStore.
+                                                   _REGION_HASH_LENGTH]
+ 
+diff --git a/sky/provision/azure/config.py b/sky/provision/azure/config.py
+index 2dbf115807f..074bc801c3e 100644
+--- a/sky/provision/azure/config.py
++++ b/sky/provision/azure/config.py
+@@ -44,7 +44,7 @@ def get_azure_sdk_function(client: Any, function_name: str) -> Callable:
+ 
+ def get_cluster_id_and_nsg_name(resource_group: str,
+                                 cluster_name_on_cloud: str) -> Tuple[str, str]:
+-    hasher = hashlib.md5(resource_group.encode('utf-8'))
++    hasher = hashlib.md5(resource_group.encode('utf-8'), usedforsecurity=False)
+     unique_id = hasher.hexdigest()[:UNIQUE_ID_LEN]
+     # We use the cluster name + resource group hash as the
+     # unique ID for the cluster, as we need to make sure that
+diff --git a/sky/provision/kubernetes/utils.py b/sky/provision/kubernetes/utils.py
+index 1ec32ffb095..e3478c45608 100644
+--- a/sky/provision/kubernetes/utils.py
++++ b/sky/provision/kubernetes/utils.py
+@@ -5085,7 +5085,8 @@ def format_kubeconfig_exec_auth_with_cache(kubeconfig_path: str) -> str:
+     with open(kubeconfig_path, 'r', encoding='utf-8') as file:
+         config = yaml_utils.safe_load(file)
+     normalized = yaml.dump(config, sort_keys=True)
+-    hashed = hashlib.sha1(normalized.encode('utf-8')).hexdigest()
++    hashed = hashlib.sha1(normalized.encode('utf-8'),
++                          usedforsecurity=False).hexdigest()
+     path = os.path.expanduser(
+         f'{kubernetes_constants.SKY_K8S_EXEC_AUTH_KUBECONFIG_CACHE}/{hashed}.yaml'
+     )
+diff --git a/sky/provision/scp/instance.py b/sky/provision/scp/instance.py
+index 9aae05c9196..5a03c308e3f 100644
+--- a/sky/provision/scp/instance.py
++++ b/sky/provision/scp/instance.py
+@@ -223,7 +223,7 @@ def _worker(cluster_name_on_cloud: str):
+ 
+ 
+ def _suffix(name: str, n: int = 5):
+-    return hashlib.sha1(name.encode()).hexdigest()[:n]
++    return hashlib.sha1(name.encode(), usedforsecurity=False).hexdigest()[:n]
+ 
+ 
+ def _get_instance_id(instance_name, cluster_name_on_cloud):
+diff --git a/sky/server/auth/oauth2_proxy.py b/sky/server/auth/oauth2_proxy.py
+index dece4792fa9..7d117642cf7 100644
+--- a/sky/server/auth/oauth2_proxy.py
++++ b/sky/server/auth/oauth2_proxy.py
+@@ -204,8 +204,11 @@ def get_auth_user(
+         """Extract user info from OAuth2 proxy response headers."""
+         email_header = response.headers.get('X-Auth-Request-Email')
+         if email_header:
+-            user_hash = hashlib.md5(email_header.encode()).hexdigest(
+-            )[:common_utils.USER_HASH_LENGTH]
++            # MD5 only derives a stable user id from the (non-secret) SSO
++            # email; auth itself is done by oauth2-proxy. Not a security use.
++            email_hash = hashlib.md5(email_header.encode(),
++                                     usedforsecurity=False).hexdigest()
++            user_hash = email_hash[:common_utils.USER_HASH_LENGTH]
+             return models.User(id=user_hash,
+                                name=email_header,
+                                user_type=models.UserType.SSO.value)
+diff --git a/sky/server/server.py b/sky/server/server.py
+index 4ec8ce1a86d..995ef89764c 100644
+--- a/sky/server/server.py
++++ b/sky/server/server.py
+@@ -282,8 +282,11 @@ def _extract_user_from_header(
+     if not user_name:
+         return None
+ 
++    # MD5 only derives a stable user id from the (non-secret) user name;
++    # not a security use.
+     user_hash = hashlib.md5(
+-        user_name.encode()).hexdigest()[:common_utils.USER_HASH_LENGTH]
++        user_name.encode(),
++        usedforsecurity=False).hexdigest()[:common_utils.USER_HASH_LENGTH]
+     if proxy_config.enabled:
+         return models.User(id=user_hash,
+                            name=user_name,
+diff --git a/sky/users/permission.py b/sky/users/permission.py
+index 82fb2877e50..a07be1c9b05 100644
+--- a/sky/users/permission.py
++++ b/sky/users/permission.py
+@@ -182,8 +182,10 @@ def _maybe_initialize_basic_auth_user(self) -> None:
+             return
+         username, password = basic_auth.split(':', 1)
+         if username and password:
+-            user_hash = hashlib.md5(
+-                username.encode()).hexdigest()[:common_utils.USER_HASH_LENGTH]
++            # MD5 only derives a stable user id from the (non-secret)
++            # username; the password is checked separately. Not a security use.
++            user_hash = hashlib.md5(username.encode(), usedforsecurity=False
++                                   ).hexdigest()[:common_utils.USER_HASH_LENGTH]
+             user_info = global_user_state.get_user(user_hash)
+             if user_info:
+                 logger.debug(f'Basic auth user {username} already exists')
+diff --git a/sky/users/server.py b/sky/users/server.py
+index 7cd42ee1726..8258702a2ff 100644
+--- a/sky/users/server.py
++++ b/sky/users/server.py
+@@ -287,8 +287,12 @@ def user_create(user_create_body: payloads.UserCreateBody) -> None:
+ 
+     # Create user
+     password_hash = server_common.crypt_ctx.hash(password)
++    # MD5 here only derives a stable user identifier from the (non-secret)
++    # username; it is not used for any security purpose (passwords use bcrypt
++    # via crypt_ctx).
+     user_hash = hashlib.md5(
+-        username.encode()).hexdigest()[:common_utils.USER_HASH_LENGTH]
++        username.encode(),
++        usedforsecurity=False).hexdigest()[:common_utils.USER_HASH_LENGTH]
+     with _user_lock(user_hash):
+         # Check if user already exists
+         if global_user_state.get_user_by_name(username):
+@@ -627,8 +631,11 @@ def user_import(user_import_body: payloads.UserImportBody) -> Dict[str, Any]:
+                 # Password is plain text, hash it
+                 password_hash = server_common.crypt_ctx.hash(password)
+ 
+-            user_hash = hashlib.md5(
+-                username.encode()).hexdigest()[:common_utils.USER_HASH_LENGTH]
++            # MD5 only derives a stable user identifier from the (non-secret)
++            # username; not a security use (passwords use bcrypt via crypt_ctx).
++            user_hash = hashlib.md5(username.encode(),
++                                    usedforsecurity=False).hexdigest()
++            user_hash = user_hash[:common_utils.USER_HASH_LENGTH]
+ 
+             with _user_lock(user_hash):
+                 global_user_state.add_or_update_user(
+diff --git a/sky/utils/command_runner.py b/sky/utils/command_runner.py
+index 344a65eb789..44f981ac520 100644
+--- a/sky/utils/command_runner.py
++++ b/sky/utils/command_runner.py
+@@ -875,8 +875,8 @@ def git_clone(
+             raise exceptions.CommandError(1, '', error_msg, None)
+ 
+         # Remote script path (use a unique name to avoid conflicts)
+-        script_hash = hashlib.md5(
+-            f'{self.node_id}_{target_dir}'.encode()).hexdigest()[:8]
++        script_hash = hashlib.md5(f'{self.node_id}_{target_dir}'.encode(),
++                                  usedforsecurity=False).hexdigest()[:8]
+         remote_script_path = f'/tmp/sky_git_clone_{script_hash}.sh'
+ 
+         # Step 1: Transfer the script to remote machine using rsync
+@@ -992,7 +992,8 @@ def __init__(
+         self.ssh_private_key = ssh_private_key
+         self.ssh_control_name = (
+             None if ssh_control_name is None else hashlib.md5(
+-                ssh_control_name.encode()).hexdigest()[:_HASH_MAX_LENGTH])
++                ssh_control_name.encode(),
++                usedforsecurity=False).hexdigest()[:_HASH_MAX_LENGTH])
+         self._ssh_proxy_command = ssh_proxy_command
+         self._ssh_proxy_jump = ssh_proxy_jump
+         self.disable_control_master = (
+diff --git a/sky/utils/common_utils.py b/sky/utils/common_utils.py
+index 027a59d5bca..71e7034f6a7 100644
+--- a/sky/utils/common_utils.py
++++ b/sky/utils/common_utils.py
+@@ -91,7 +91,10 @@ def is_valid_user_hash(user_hash: Optional[str]) -> bool:
+ def generate_user_hash() -> str:
+     """Generates a unique user-machine specific hash."""
+     hash_str = user_and_hostname_hash()
+-    user_hash = hashlib.md5(hash_str.encode()).hexdigest()[:USER_HASH_LENGTH]
++    # MD5 only derives a stable machine-specific identifier, not a security
++    # use.
++    user_hash = hashlib.md5(
++        hash_str.encode(), usedforsecurity=False).hexdigest()[:USER_HASH_LENGTH]
+     if not is_valid_user_hash(user_hash):
+         # A fallback in case the hash is invalid.
+         user_hash = uuid.uuid4().hex[:USER_HASH_LENGTH]
+@@ -297,7 +300,9 @@ def make_cluster_name_on_cloud(display_name: str,
+     if truncate_cluster_name.endswith('-'):
+         truncate_cluster_name = truncate_cluster_name.rstrip('-')
+     assert truncate_cluster_name_length > 0, (cluster_name_on_cloud, max_length)
+-    display_name_hash = hashlib.md5(display_name.encode()).hexdigest()
++    # MD5 only derives a short suffix for the cluster name, not a security use.
++    display_name_hash = hashlib.md5(display_name.encode(),
++                                    usedforsecurity=False).hexdigest()
+     # Use base36 to reduce the length of the hash.
+     display_name_hash = base36_encode(display_name_hash)
+     return (f'{truncate_cluster_name}'
+@@ -650,7 +655,9 @@ def user_and_hostname_hash() -> str:
+     The reason is AWS security group names are derived from this string, and
+     thus changing the SG name makes these clusters unrecognizable.
+     """
+-    hostname_hash = hashlib.md5(socket.gethostname().encode()).hexdigest()[-4:]
++    # MD5 only derives a short hostname suffix, not a security use.
++    hostname_hash = hashlib.md5(socket.gethostname().encode(),
++                                usedforsecurity=False).hexdigest()[-4:]
+     return f'{getpass.getuser()}-{hostname_hash}'
+ 
+ 
+diff --git a/sky/utils/kubernetes/gpu_labeler.py b/sky/utils/kubernetes/gpu_labeler.py
+index 227847cd50c..5de797139f9 100644
+--- a/sky/utils/kubernetes/gpu_labeler.py
++++ b/sky/utils/kubernetes/gpu_labeler.py
+@@ -71,7 +71,8 @@ def cleanup(context: Optional[str] = None) -> Tuple[bool, str]:
+ 
+ def get_node_hash(node_name: str):
+     # Generates a 32 character md5 hash from a string
+-    md5_hash = hashlib.md5(node_name.encode()).hexdigest()
++    md5_hash = hashlib.md5(node_name.encode(),
++                           usedforsecurity=False).hexdigest()
+     return md5_hash[:32]
+ 
+ 
diff --git a/pkgs/by-name/sk/skypilot/package.nix b/pkgs/by-name/sk/skypilot/package.nix
index fe2dfc14dbe9..71df3b03526f 100644
--- a/pkgs/by-name/sk/skypilot/package.nix
+++ b/pkgs/by-name/sk/skypilot/package.nix
@@ -38,6 +38,8 @@ python3Packages.buildPythonApplication (finalAttrs: {
   patches = [
     ./0001-Fix-docker-flag-default-for-Click-8.2-compatibility.patch
     ./0002-Fix-websocket-proxy-call-script-directly-as-executable.patch
+    # https://github.com/skypilot-org/skypilot/pull/9972
+    ./CVE-2026-13482.patch
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sl/sleuthkit/package.nix b/pkgs/by-name/sl/sleuthkit/package.nix
index d91930eaa07f..85e26a31d01f 100644
--- a/pkgs/by-name/sl/sleuthkit/package.nix
+++ b/pkgs/by-name/sl/sleuthkit/package.nix
@@ -67,11 +67,11 @@ stdenv.mkDerivation (finalAttrs: {
     export ANT_ARGS="-Doffline=true -Ddefault-jar-location=$IVY_HOME/lib"
 
     # pre-positioning these jar files allows -Doffline=true to work
-    mkdir -p source/{bindings,case-uco}/java $IVY_HOME
-    cp -r ${finalAttrs.rdeps}/bindings/java/lib source/bindings/java
-    chmod -R 755 source/bindings/java
-    cp -r ${finalAttrs.rdeps}/case-uco/java/lib source/case-uco/java
-    chmod -R 755 source/case-uco/java
+    mkdir -p ${finalAttrs.src.name}/{bindings,case-uco}/java $IVY_HOME
+    cp -r ${finalAttrs.rdeps}/bindings/java/lib ${finalAttrs.src.name}/bindings/java
+    chmod -R 755 ${finalAttrs.src.name}/bindings/java
+    cp -r ${finalAttrs.rdeps}/case-uco/java/lib ${finalAttrs.src.name}/case-uco/java
+    chmod -R 755 ${finalAttrs.src.name}/case-uco/java
     cp -r ${finalAttrs.rdeps}/lib $IVY_HOME
     chmod -R 755 $IVY_HOME
   '';
diff --git a/pkgs/by-name/sl/slint-viewer/package.nix b/pkgs/by-name/sl/slint-viewer/package.nix
index 400d7d6c2ab1..a9a19355bdc4 100644
--- a/pkgs/by-name/sl/slint-viewer/package.nix
+++ b/pkgs/by-name/sl/slint-viewer/package.nix
@@ -13,14 +13,14 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "slint-viewer";
-  version = "1.16.1";
+  version = "1.17.0";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-/hv/5qd0JhV2H91VWjzUh4cOPOLj6/fsXHSwdDSnfCc=";
+    hash = "sha256-2Zjt7kt9tCxDyixa7Az0cPXh3noR2BN7Nxrq2bdxkSs=";
   };
 
-  cargoHash = "sha256-9x33UuQGFfHFEsTdSjNnfBlgER4fBIfAmemeWSes304=";
+  cargoHash = "sha256-KaVPQ14QQpabaJVsyhsQ3j546j63Lp16AzQtuz49niY=";
 
   buildInputs = [
     qt6.qtbase
diff --git a/pkgs/by-name/sm/smux/package.nix b/pkgs/by-name/sm/smux/package.nix
new file mode 100644
index 000000000000..4bc93de97d24
--- /dev/null
+++ b/pkgs/by-name/sm/smux/package.nix
@@ -0,0 +1,62 @@
+{
+  lib,
+  stdenv,
+  rustPlatform,
+  fetchFromGitHub,
+  installShellFiles,
+  makeWrapper,
+  tmux,
+  fzf,
+  zoxide,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "smux";
+  version = "0.3.1";
+
+  src = fetchFromGitHub {
+    owner = "Aietes";
+    repo = "smux";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-mc7sspGN4Wf8Jn995S/jsZ0v1s5kgJ0ASn9iGbzH13U=";
+  };
+
+  cargoHash = "sha256-nUJwIOdVmZR+inDz4kYpPTFXREyZyf891ATed6UFIJo=";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    installShellFiles
+    makeWrapper
+  ];
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    $out/bin/smux completions zsh --dir completions
+    installShellCompletion --zsh completions/_smux
+
+    $out/bin/smux man --dir man
+    installManPage man/*.1
+    installManPage man/*.5
+  '';
+
+  postFixup = ''
+    wrapProgram $out/bin/smux \
+      --prefix PATH : ${
+        lib.makeBinPath [
+          tmux
+          fzf
+          zoxide
+        ]
+      }
+  '';
+
+  meta = {
+    description = "Tmux session manager with fzf-powered project and template selection";
+    homepage = "https://github.com/Aietes/smux";
+    license = lib.licenses.mit;
+    mainProgram = "smux";
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ aietes ];
+  };
+})
diff --git a/pkgs/by-name/sn/snowflake/package.nix b/pkgs/by-name/sn/snowflake/package.nix
index d91f0ebf0de7..819f410a2d9c 100644
--- a/pkgs/by-name/sn/snowflake/package.nix
+++ b/pkgs/by-name/sn/snowflake/package.nix
@@ -6,7 +6,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "snowflake";
-  version = "2.13.1";
+  version = "2.14.1";
 
   src = fetchFromGitLab {
     domain = "gitlab.torproject.org";
@@ -14,10 +14,10 @@ buildGoModule (finalAttrs: {
     owner = "anti-censorship/pluggable-transports";
     repo = "snowflake";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-XbBlUEkv0ptrb+X+oPDRCvy6HE6XHgSSLwFTXw071pU=";
+    sha256 = "sha256-MvV1kP+Xm3a4Q8+YZLwC9vpVK54ltb73cRkJhReSA2U=";
   };
 
-  vendorHash = "sha256-bhv7soUyZnIG+AS1mMH38GZEG74tDk/ap7cQr6k4Pzs=";
+  vendorHash = "sha256-onxJDRURyQIA+t4PbuIk14VkVUFnuALTteF9nfMZuBY=";
 
   meta = {
     description = "System to defeat internet censorship";
diff --git a/pkgs/by-name/sp/spotube/package.nix b/pkgs/by-name/sp/spotube/package.nix
index 1e7ad8ec566b..2cf5e96731a7 100644
--- a/pkgs/by-name/sp/spotube/package.nix
+++ b/pkgs/by-name/sp/spotube/package.nix
@@ -22,7 +22,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "spotube";
-  version = "5.1.1";
+  version = "5.1.2";
 
   src = finalAttrs.passthru.sources.${stdenv.hostPlatform.system};
 
@@ -87,19 +87,19 @@ stdenv.mkDerivation (finalAttrs: {
     {
       "aarch64-linux" = fetchArtifact {
         suffix = "linux-aarch64.deb";
-        hash = "sha256-Wn+eE8nkHXRBZYVw+sm+Nxf75nK/JJ8bnVK7YZ0O47A=";
+        hash = "sha256-cb9qPNJ1wB3zURvBCLEJIr+L4BGYwtgjAezSRm4QQDE=";
       };
       "x86_64-linux" = fetchArtifact {
         suffix = "linux-x86_64.deb";
-        hash = "sha256-jzi1HPJErDhZwt1Eu1lzG29QaAw3vL+PVRNDVBxn7ZQ=";
+        hash = "sha256-FEb5mPmGOAMw4nnFJ0kC+ymg4zBdUXWjvIO0sGOS6M0=";
       };
       "x86_64-darwin" = fetchArtifact {
         suffix = "macos-universal.dmg";
-        hash = "sha256-kUQdLWawtIVhzeO5NfUa435JOf7/SCVBhSKfQh3J96I=";
+        hash = "sha256-J2J9/UQZAECvGmumqGzcRFA5kpakOmFpQKlK5oesCRM=";
       };
       "aarch64-darwin" = fetchArtifact {
         suffix = "macos-universal.dmg";
-        hash = "sha256-kUQdLWawtIVhzeO5NfUa435JOf7/SCVBhSKfQh3J96I=";
+        hash = "sha256-J2J9/UQZAECvGmumqGzcRFA5kpakOmFpQKlK5oesCRM=";
       };
     };
 
diff --git a/pkgs/by-name/sq/squix/package.nix b/pkgs/by-name/sq/squix/package.nix
index 89ab281abe86..98ef9fe8c859 100644
--- a/pkgs/by-name/sq/squix/package.nix
+++ b/pkgs/by-name/sq/squix/package.nix
@@ -10,16 +10,16 @@ buildGoModule (finalAttrs: {
   __structuredAttrs = true;
 
   pname = "squix";
-  version = "0.4.0-beta";
+  version = "0.5.0-beta";
 
   src = fetchFromGitHub {
     owner = "eduardofuncao";
     repo = "squix";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-lJOXzBgVgRdUi+btu/eOlYXDLhS2FLEnJQ/UjGk5jF4=";
+    hash = "sha256-R/y1fl4MehZ+VDWBtSL3EDzVBsAdCeR5nS687vwk1IM=";
   };
 
-  vendorHash = "sha256-JRmNajvCb57dMo8eggOD1m4N01p2RSK8r49pmBB56Z0=";
+  vendorHash = "sha256-kSv3VAQi+qdT29gZAjLmHauItaMFd9NG7bdRtQE1MZo=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/st/stalwart_0_16/package.nix b/pkgs/by-name/st/stalwart_0_16/package.nix
index 311ba8536bb2..608ae1d9a6ab 100644
--- a/pkgs/by-name/st/stalwart_0_16/package.nix
+++ b/pkgs/by-name/st/stalwart_0_16/package.nix
@@ -112,6 +112,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
   ++ lib.optionals withFoundationdb [ "foundationdb" ]
   ++ lib.optionals stalwartEnterprise [ "enterprise" ];
 
+  cargoBuildFlags = [
+    "-p"
+    "stalwart"
+  ];
+  cargoTestFlags = finalAttrs.cargoBuildFlags;
+
   doCheck = true;
   nativeCheckInputs = [
     openssl
diff --git a/pkgs/by-name/st/steam-art-manager/package.nix b/pkgs/by-name/st/steam-art-manager/package.nix
index 611081155b07..dc9e8eeaf5e4 100644
--- a/pkgs/by-name/st/steam-art-manager/package.nix
+++ b/pkgs/by-name/st/steam-art-manager/package.nix
@@ -6,10 +6,10 @@
 
 let
   pname = "steam-art-manager";
-  version = "3.16.0";
+  version = "3.16.1";
   src = fetchurl {
     url = "https://github.com/Tormak9970/Steam-Art-Manager/releases/download/v${version}/steam-art-manager.AppImage";
-    hash = "sha256-khjSvATja5ffz7Z6uUmebU3rmgTI6xjNJMxHDBm3O5M=";
+    hash = "sha256-7Lqcj9Q5P29YFt6biFXLlVdWHdlzF/daLIaA2fGY0+A=";
   };
   appimageContents = appimageTools.extract { inherit pname version src; };
 in
diff --git a/pkgs/by-name/st/steam-lancache-prefill/deps.json b/pkgs/by-name/st/steam-lancache-prefill/deps.json
index 03ae8464bfbc..072c50f1a7da 100644
--- a/pkgs/by-name/st/steam-lancache-prefill/deps.json
+++ b/pkgs/by-name/st/steam-lancache-prefill/deps.json
@@ -136,8 +136,8 @@
   },
   {
     "pname": "Spectre.Console",
-    "version": "0.49.2-preview.0.67",
-    "hash": "sha256-e1BrfX8ME8Ob7ZVKx8VYExKNvLzHHxNJ1R+Yv2lVE3A="
+    "version": "0.51.1",
+    "hash": "sha256-FQAK07dEwEsNYVI1T3S488LHv8AXJ+ZeA9N2hPpWBoo="
   },
   {
     "pname": "Spectre.Console.Analyzer",
diff --git a/pkgs/by-name/st/steam-lancache-prefill/package.nix b/pkgs/by-name/st/steam-lancache-prefill/package.nix
index 9c4cc31e6018..db96a6b71858 100644
--- a/pkgs/by-name/st/steam-lancache-prefill/package.nix
+++ b/pkgs/by-name/st/steam-lancache-prefill/package.nix
@@ -10,13 +10,13 @@
 
 buildDotnetModule (finalAttrs: {
   pname = "steam-lancache-prefill";
-  version = "3.4.2";
+  version = "3.5.1";
 
   src = fetchFromGitHub {
     owner = "tpill90";
     repo = "steam-lancache-prefill";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-FD7rC73VF+jhdCrSPKEillRXAi7jbY+h+oHi0Bpng3k=";
+    hash = "sha256-BDJB4kubcA9Uu84CubZ0uyKYwYWQYq+pBJa0t0q481Y=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/st/stockfish/package.nix b/pkgs/by-name/st/stockfish/package.nix
index 7d30479a5953..91045ea9dce5 100644
--- a/pkgs/by-name/st/stockfish/package.nix
+++ b/pkgs/by-name/st/stockfish/package.nix
@@ -25,6 +25,8 @@ let
       "x86-32"
     else if stdenv.hostPlatform.isAarch64 then
       "armv8"
+    else if stdenv.hostPlatform.isAarch32 then
+      "armv7"
     else
       "unknown";
 
@@ -66,6 +68,7 @@ stdenv.mkDerivation rec {
     "PREFIX=$(out)"
     "ARCH=${arch}"
     "CXX=${stdenv.cc.targetPrefix}c++"
+    "STRIP=${stdenv.cc.targetPrefix}strip"
   ];
   buildFlags = [ "build" ];
 
@@ -121,6 +124,7 @@ stdenv.mkDerivation rec {
       "x86_64-darwin"
       "aarch64-linux"
       "aarch64-darwin"
+      "armv7l-linux"
     ];
     license = lib.licenses.gpl3Only;
   };
diff --git a/pkgs/by-name/su/survex/package.nix b/pkgs/by-name/su/survex/package.nix
index 60194c39e689..07ea3ca3d66a 100644
--- a/pkgs/by-name/su/survex/package.nix
+++ b/pkgs/by-name/su/survex/package.nix
@@ -19,11 +19,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "survex";
-  version = "1.4.21";
+  version = "1.4.22";
 
   src = fetchurl {
     url = "https://survex.com/software/${finalAttrs.version}/survex-${finalAttrs.version}.tar.gz";
-    hash = "sha256-9lmCFrAhI8Zko6wCjkRf7rv+LmKDBTOGekRM3lyz8wI=";
+    hash = "sha256-omli2IhiHP0gQ6fMaiJ/yQUTDfvRTEUNwcTAL7/dnbw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/th/thokr/package.nix b/pkgs/by-name/th/thokr/package.nix
index 0b95ea03803e..232c451f9902 100644
--- a/pkgs/by-name/th/thokr/package.nix
+++ b/pkgs/by-name/th/thokr/package.nix
@@ -8,8 +8,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
   pname = "thokr";
   version = "0.4.1";
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   src = fetchFromGitHub {
-    owner = "thatvegandev";
+    owner = "jrnxf";
     repo = "thokr";
     rev = "v${finalAttrs.version}";
     sha256 = "0aryfx9qlnjdq3iq2d823c82fhkafvibmbz58g48b8ah5x5fv3ir";
@@ -19,9 +22,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   meta = {
     description = "Typing tui with visualized results and historical logging";
-    homepage = "https://github.com/thatvegandev/thokr";
+    homepage = "https://github.com/jrnxf/thokr";
     license = lib.licenses.mit;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ aiyion ];
     mainProgram = "thokr";
   };
 })
diff --git a/pkgs/by-name/th/thorium-reader/package.nix b/pkgs/by-name/th/thorium-reader/package.nix
index 13ae3960b747..e345900043fa 100644
--- a/pkgs/by-name/th/thorium-reader/package.nix
+++ b/pkgs/by-name/th/thorium-reader/package.nix
@@ -1,12 +1,15 @@
 {
   lib,
+  stdenv,
   buildNpmPackage,
   fetchFromGitHub,
   nodejs_24,
-  makeWrapper,
+  makeShellWrapper,
+  makeBinaryWrapper,
   electron,
   copyDesktopItems,
   makeDesktopItem,
+  desktopToDarwinBundle,
 }:
 
 buildNpmPackage (finalAttrs: {
@@ -24,23 +27,39 @@ buildNpmPackage (finalAttrs: {
   };
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
-
+  # makeBinaryWrapper is required on Darwin since MacOS is confuses itself
+  # into thinking it needs Rosetta 2 if it encounters a non-MachO executable
+  # in a .app bundle.
+  # Simultaneously, we need makeShellWrapper on linux platforms to pass
+  # electron-specific flags.
   nativeBuildInputs = [
-    makeWrapper
     copyDesktopItems
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    makeShellWrapper
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    makeBinaryWrapper
+    desktopToDarwinBundle
   ];
 
-  postInstall = ''
-    install -Dpm644 resources/icon.png $out/share/icons/thorium-reader.png
+  postInstall =
+    let
+      ozoneFlags = lib.optionalString stdenv.hostPlatform.isLinux ''--add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}"'';
+    in
+    ''
+      install -Dpm644 resources/icon.png $out/share/icons/thorium-reader.png
 
-    cp -r dist/* $out/lib/node_modules/EDRLab.ThoriumReader/
+      cp -r dist/* $out/lib/node_modules/EDRLab.ThoriumReader/
 
-    makeWrapper '${lib.getExe electron}' "$out/bin/thorium-reader" \
-      --add-flags $out/lib/node_modules/EDRLab.ThoriumReader \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
-      --set-default ELECTRON_IS_DEV 0 \
-      --inherit-argv0
-  '';
+      ${
+        if stdenv.hostPlatform.isDarwin then "makeBinaryWrapper" else "makeWrapper"
+      } '${lib.getExe electron}' "$out/bin/thorium-reader" \
+        --add-flags $out/lib/node_modules/EDRLab.ThoriumReader \
+        ${ozoneFlags} \
+        --set-default ELECTRON_IS_DEV 0 \
+        --inherit-argv0
+    '';
 
   desktopItems = [
     (makeDesktopItem {
@@ -71,7 +90,10 @@ buildNpmPackage (finalAttrs: {
     description = "EPUB reader";
     homepage = "https://www.edrlab.org/software/thorium-reader/";
     license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ YodaDaCoda ];
+    maintainers = with lib.maintainers; [
+      YodaDaCoda
+      agarmu
+    ];
     platforms = lib.platforms.all;
     mainProgram = "thorium-reader";
   };
diff --git a/pkgs/by-name/to/tofu-ls/package.nix b/pkgs/by-name/to/tofu-ls/package.nix
index 00c2ba918d7a..e881984bea59 100644
--- a/pkgs/by-name/to/tofu-ls/package.nix
+++ b/pkgs/by-name/to/tofu-ls/package.nix
@@ -8,7 +8,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "tofu-ls";
-  version = "0.5.0";
+  version = "0.5.1";
 
   __structuredAttrs = true;
 
@@ -16,10 +16,10 @@ buildGoModule (finalAttrs: {
     owner = "opentofu";
     repo = "tofu-ls";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-v6oqCRsiTAOGqhVZD6Zwhq0/bSl55PhH9+aEYxjlQcA=";
+    hash = "sha256-lmTvFtgXV8u4GNR3Bof+bfLMoq+luFdT1YeQq7ooLg8=";
   };
 
-  vendorHash = "sha256-vugyEaOD7diOiymo9nDEfIez++mPYWq1qVj3a9wCqoc=";
+  vendorHash = "sha256-+yG4Tz29NJ3m2is0ERMqW8vC/HJv4uudyDg9KSA/z/o=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index 4063d42962c2..601293797c4e 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -189,15 +189,15 @@
   };
 
   c = {
-    version = "0.24.1";
+    version = "0.24.2";
     url = "github:tree-sitter/tree-sitter-c";
-    hash = "sha256-gmzbdwvrKSo6C1fqTJFGxy8x0+T+vUTswm7F5sojzKc=";
+    hash = "sha256-Juuf57GQI7OAP6O03KtSzyKJAoXtGKjyYJ+sTM1A4mU=";
   };
 
   c-sharp = {
-    version = "0.23.1";
+    version = "0.23.5";
     url = "github:tree-sitter/tree-sitter-c-sharp";
-    hash = "sha256-weH0nyLpvVK/OpgvOjTuJdH2Hm4a1wVshHmhUdFq3XA=";
+    hash = "sha256-N5AAlwQFGGi47cj0m7Te08bA486gwY6NBOx4Qcy4lpo=";
     meta = {
       license = lib.licenses.mit;
     };
@@ -451,9 +451,9 @@
   };
 
   devicetree = {
-    version = "0.11.1";
+    version = "0.15.0";
     url = "github:joelspadin/tree-sitter-devicetree";
-    hash = "sha256-2uJEItLwoBoiB49r2XuO216Dhu9AnAa0p7Plmm4JNY8=";
+    hash = "sha256-iMmr4zSm6B7goevHE03DMj9scW4ldXS7CV74sKeqGD4=";
     meta = {
       license = lib.licenses.mit;
     };
@@ -777,9 +777,9 @@
   };
 
   gdscript = {
-    version = "6.0.0";
+    version = "6.1.0";
     url = "github:prestonknopp/tree-sitter-gdscript";
-    hash = "sha256-S+AF6slDnw3O00C8hcL013A8MU7fKU5mCwhyV50rqmI=";
+    hash = "sha256-QT28TQBt20lMScfF4zb2RJhlPFNekjocOWbvQ2a2yuM=";
     meta = {
       license = lib.licenses.mit;
     };
@@ -1033,10 +1033,10 @@
   };
 
   gren = {
-    version = "2.0.0-unstable-2025-05-03";
+    version = "2.0.0-unstable-2026-03-31";
     url = "github:MaeBrooks/tree-sitter-gren";
-    rev = "c36aac51a915fdfcaf178128ba1e9c2205b25930";
-    hash = "sha256-XtLP2ncpwAiubHug6k4sJCYRZo5f+Nu02tho/4tVD/k=";
+    rev = "cecd8ce9b18f1803d37682f33b6224978fd04d31";
+    hash = "sha256-E96GzFmQDEb3Uq6sEThxqpRwqEH+JwE/hJ0xM1r2VjI=";
     meta = {
       license = lib.licenses.mit;
       maintainers = with lib.maintainers; [
@@ -1372,9 +1372,9 @@
   };
 
   julia = {
-    version = "0.23.1";
+    version = "0.25.0";
     url = "github:tree-sitter/tree-sitter-julia";
-    hash = "sha256-jwtMgHYSa9/kcsqyEUBrxC+U955zFZHVQ4N4iogiIHY=";
+    hash = "sha256-Jk2jby7vWWSdnUU8s8zIIfyXFt7keWPJPyTyxPBrqBw=";
     meta = {
       license = lib.licenses.mit;
     };
@@ -1494,7 +1494,7 @@
   };
 
   llvm = {
-    version = "0-unstable-2025-08-22";
+    version = "1.1.0-unstable-2025-08-22";
     url = "github:benwilliamgraham/tree-sitter-llvm";
     rev = "2914786ae6774d4c4e25a230f4afe16aa68fe1c1";
     hash = "sha256-jBSotMFsBUcgQrWH5p8EiywG00+v9QqePcUTI6ZqAkw=";
@@ -1891,10 +1891,9 @@
   };
 
   org = {
-    version = "1.3.1-unstable-2023-06-19";
-    url = "github:milisims/tree-sitter-org";
-    rev = "64cfbc213f5a83da17632c95382a5a0a2f3357c1";
-    hash = "sha256-/03eZBbv23W5s/GbDgPgaJV5TyK+/lrWUVeINRS5wtA=";
+    version = "2.0.4";
+    url = "github:nvim-orgmode/tree-sitter-org";
+    hash = "sha256-76ImC8GMW+yAKG++AHryUi+MYTmtJ5ogygC+bgNMErA=";
     meta = {
       license = lib.licenses.mit;
       maintainers = with lib.maintainers; [
@@ -1904,10 +1903,9 @@
   };
 
   org-nvim = {
-    version = "1.3.1-unstable-2023-06-19";
-    url = "github:emiasims/tree-sitter-org";
-    rev = "64cfbc213f5a83da17632c95382a5a0a2f3357c1";
-    hash = "sha256-/03eZBbv23W5s/GbDgPgaJV5TyK+/lrWUVeINRS5wtA=";
+    version = "2.0.4";
+    url = "github:nvim-orgmode/tree-sitter-org";
+    hash = "sha256-76ImC8GMW+yAKG++AHryUi+MYTmtJ5ogygC+bgNMErA=";
     meta = {
       license = lib.licenses.mit;
     };
@@ -2384,9 +2382,9 @@
   };
 
   scala = {
-    version = "0.25.0";
+    version = "0.26.0";
     url = "github:tree-sitter/tree-sitter-scala";
-    hash = "sha256-xDp1+i0QLnY18EtiwurW1B4bbeS1qZKNJRxS6Qeb3pw=";
+    hash = "sha256-CnTcQFqYp60rGkLVLRHokUwBenqtWV4hw8boFYNRkbw=";
     meta = {
       license = lib.licenses.mit;
     };
diff --git a/pkgs/by-name/um/umple/2DShapes.ump b/pkgs/by-name/um/umple/2DShapes.ump
new file mode 100644
index 000000000000..427d794b44e5
--- /dev/null
+++ b/pkgs/by-name/um/umple/2DShapes.ump
@@ -0,0 +1,62 @@
+// Taken from https://github.com/umple/Umple/wiki/examples
+
+// 2D Shapes class hierarchy - sample UML class
+// diagram in Umple
+// From Book by Lethbridge and Laganiere, McGraw Hill 2004
+// Object-Oriented Software Engineering:
+//   Practical Software Engineering using UML and Java
+// See https://www.site.uottawa.ca/school/research/lloseng/
+
+//Namespace for core of the system.
+namespace Shapes.core;
+
+class Shape2D {
+ center;
+}
+//Abstract
+class EllipticalShape {
+ isA Shape2D;
+ semiMajorAxis;
+}
+//Abstract
+class Polygon {
+ isA Shape2D;
+}
+class Circle {
+ isA EllipticalShape;
+}
+class Ellipse{
+ isA EllipticalShape;
+}
+class SimplePolygon {
+ orientation;
+ isA Polygon;
+}
+class ArbitraryPolygon {
+ points;
+ isA Polygon;
+}
+class Rectangle {
+ isA SimplePolygon;
+ height;
+ width;
+}
+class RegularPolygon {
+ numPoints;
+ radius;
+ isA SimplePolygon;
+}
+
+class Shape2D {
+  public static void main(String [] argc) Java {
+    Shape2D s = new
+      RegularPolygon("0,0","0","3","100");
+    System.out.println(s);
+  }
+
+  public static void main(String [] argc) Python{
+    import RegularPolygon
+    s = RegularPolygon.RegularPolygon("0,0","0","3","100")
+    print(str(s))
+  }
+}
diff --git a/pkgs/by-name/um/umple/deps.json b/pkgs/by-name/um/umple/deps.json
new file mode 100644
index 000000000000..74ff05bdcd87
--- /dev/null
+++ b/pkgs/by-name/um/umple/deps.json
@@ -0,0 +1,622 @@
+{
+ "!comment": "This is a nixpkgs Gradle dependency lockfile. For more details, refer to the Gradle section in the nixpkgs manual.",
+ "!version": 1,
+ "https://plugins.gradle.org/m2": {
+  "com/bmuschko#gradle-docker-plugin/3.2.1": {
+   "jar": "sha256-BfgdS5EdMR7nrEhJ6/eLMD4HdDQY1OiaVZVCK/OAIxQ=",
+   "pom": "sha256-slOHkvEGJnUa9sjeAgdH/1E4kntOKfL69KjtOsFKzSE="
+  },
+  "com/github/luben#zstd-jni/1.5.6-3": {
+   "jar": "sha256-9y7eGzklj6+BJ33FjeMMccuuQlNzJVjSzhC1PYtXY9U=",
+   "pom": "sha256-39L6ex0jk5IWkC+ET6XoannN+5IJdg5MBCQrWljUlJA="
+  },
+  "com/netflix/nebula#gradle-ospackage-plugin/12.3.0": {
+   "jar": "sha256-G31BgIxAfGFKaH53ytCTsGRe/axv/3VaYfqsycGx0Tk=",
+   "module": "sha256-48jwwoAZ8Lp9rUUjg+VPZBr2c4OqEOyWeRRcA6fcajQ=",
+   "pom": "sha256-O9fcqwynS7fY3nSxxN4ekJBKIwghlDCxfi9V+pe45/8="
+  },
+  "com/netflix/nebula/ospackage#com.netflix.nebula.ospackage.gradle.plugin/12.3.0": {
+   "pom": "sha256-NbRAjb4z1OaaXaHzN77BhG9M+BiakQi7RXh9BpL/FR8="
+  },
+  "commons-codec#commons-codec/1.17.0": {
+   "jar": "sha256-9wDegKwnDQNE/ep0aCAdi5yAXlxkgzHDYZ8u4GfM/Fk=",
+   "pom": "sha256-wBxM2l5Aj0HtHYPkoKFwz1OAG2M4q6SfD5BHhrwSFPw="
+  },
+  "commons-io#commons-io/2.16.1": {
+   "jar": "sha256-9B97qs1xaJZEes6XWGIfYsHGsKkdiazuSI2ib8R3yE8=",
+   "pom": "sha256-V3fSkiUceJXASkxXAVaD7Ds1OhJIbJs+cXjpsLPDj/8="
+  },
+  "de/undercouch#gradle-download-task/4.1.1": {
+   "jar": "sha256-6wi1cOQI1GRnBecKlJYU1DnqKxFFXxZSqwMw3olU2rk=",
+   "pom": "sha256-EQnx9xpUJU1ZAzfYudRD+d/AhyjJwdgzVlXMHcyIwLk="
+  },
+  "io/airlift#airbase/112": {
+   "pom": "sha256-GMzRBMvZfrRL1XtowEerf/gfvIAJh/gtgVxorEwjBM4="
+  },
+  "io/airlift#aircompressor/0.27": {
+   "jar": "sha256-/b7zE3oo9juwy5NIeAMIDt50ak7D1CHjbG8MMFw15eQ=",
+   "pom": "sha256-Wqzaib44VjvfO/rHkzNhbAgCymFwcN6ma6ZJUHyZREE="
+  },
+  "javax/inject#javax.inject/1": {
+   "jar": "sha256-kcdwRKUMSBY2wy2Rb9ickRinIZU5BFLIEGUID5V95/8=",
+   "pom": "sha256-lD4SsQBieARjj6KFgFoKt4imgCZlMeZQkh6/5GIai/o="
+  },
+  "org/apache#apache/23": {
+   "pom": "sha256-vBBiTgYj82V3+sVjnKKTbTJA7RUvttjVM6tNJwVDSRw="
+  },
+  "org/apache#apache/30": {
+   "pom": "sha256-Y91KOTqcDfyzFO/oOHGkHSQ7yNIAy8fy0ZfzDaeCOdg="
+  },
+  "org/apache#apache/31": {
+   "pom": "sha256-VV0MnqppwEKv+SSSe5OB6PgXQTbTVe6tRFIkRS5ikcw="
+  },
+  "org/apache#apache/33": {
+   "pom": "sha256-14vYUkxfg4ChkKZSVoZimpXf5RLfIRETg6bYwJI6RBU="
+  },
+  "org/apache/ant#ant-launcher/1.10.15": {
+   "jar": "sha256-XIVRmQMHoDIzbZjdrtVJo5ponwfU1Ma5UGAb8is9ahs=",
+   "pom": "sha256-ea+EKil53F/gAivAc8SYgQ7q2DvGKD7t803E3+MNrJU="
+  },
+  "org/apache/ant#ant-parent/1.10.11": {
+   "pom": "sha256-V6BTJoLzD6MHQWoiWSnVcQrNpy17Je4IyvmNyCzTXbY="
+  },
+  "org/apache/ant#ant-parent/1.10.15": {
+   "pom": "sha256-SYhPGHPFEHzCN/QoXER3R5uwgEvwc3OUgBsI114rvrA="
+  },
+  "org/apache/ant#ant/1.10.11": {
+   "pom": "sha256-wiiU2ctGq/XOv27rK8z+TXjhju6jEaDqat3VnftLH+M="
+  },
+  "org/apache/ant#ant/1.10.15": {
+   "jar": "sha256-djrNpKaViMnqiBepUoUf8ML8S/+h0IHCVl3EB/KdV5Q=",
+   "pom": "sha256-R4DmHoeBbu4fIdGE7Jl7Zfk9tfS5BCwXitsp4j50JdY="
+  },
+  "org/apache/commons#commons-compress/1.21": {
+   "pom": "sha256-Z1uwI8m+7d4yMpSZebl0Kl/qlGKApVobRi1Mp4AQiM0="
+  },
+  "org/apache/commons#commons-compress/1.26.2": {
+   "jar": "sha256-kWigMUHY/H7aIaI2DYPMBBK8ux1iBNmSvUjCVzyzxrg=",
+   "pom": "sha256-FChxmJXNCpE67jPiQkuagEsQ8Rl+XTWpzpnPKhF0yw4="
+  },
+  "org/apache/commons#commons-lang3/3.14.0": {
+   "jar": "sha256-e5a/PuaJSau1vEZVWawnDgVRWW+jRSP934kOxBjd4Tw=",
+   "pom": "sha256-EQQ4hjutN8KPkGv4cBbjjHqMdYujIeCdEdxaI2Oo554="
+  },
+  "org/apache/commons#commons-parent/52": {
+   "pom": "sha256-ddvo806Y5MP/QtquSi+etMvNO18QR9VEYKzpBtu0UC4="
+  },
+  "org/apache/commons#commons-parent/64": {
+   "pom": "sha256-bxljiZToNXtO1zRpb5kgV++q+hI1ZzmYEzKZeY4szds="
+  },
+  "org/apache/commons#commons-parent/69": {
+   "pom": "sha256-1Q2pw5vcqCPWGNG0oDtz8ZZJf8uGFv0NpyfIYjWSqbs="
+  },
+  "org/apache/maven#maven-archiver/3.6.3": {
+   "jar": "sha256-g1ZhKYmMejhL/6oRinakBmfVRpSEYLQ+64Vj+hdjWEg=",
+   "pom": "sha256-vBMCWcXhCHonDqjPP4GC/syQv5MROiB01kChpn8QLsQ="
+  },
+  "org/apache/maven#maven-parent/43": {
+   "pom": "sha256-RooSYumqpf6/nWBOKDYmf4FTUfK0Ug8o+xf1PHHjNVQ="
+  },
+  "org/apache/maven/shared#maven-shared-components/43": {
+   "pom": "sha256-YHLdEDvboxmVhMW3PtRbAFZ80+qRjiFgsQvHQ3yegYE="
+  },
+  "org/bouncycastle#bcpg-jdk15on/1.69": {
+   "jar": "sha256-o5hP9/2VGNAAlONPPT5xSkgj8lBa2hwZs1wSnib2OTQ=",
+   "pom": "sha256-2iKA/jlan+d4adxcwAqpvuiPaUx8R4XqEHOXIrafrU8="
+  },
+  "org/bouncycastle#bcprov-jdk15on/1.69": {
+   "jar": "sha256-5Gm9Ofk2mZ8lYAJjEAP/AioilR2p1b2Xicer+pdjopI=",
+   "pom": "sha256-/YHicUSVvOeeauazAp2s0kzyz/NAJB2lgQVYlae6eN4="
+  },
+  "org/codehaus/plexus#plexus-archiver/4.10.0": {
+   "jar": "sha256-TAeBT/SjkZmZmugruh44qk8lY3Rn/KxqZu1jp2U1eZo=",
+   "pom": "sha256-k8oAH9M9pT04t09trxnnG8lzbtYUMJH/kAPNTAWs5sk="
+  },
+  "org/codehaus/plexus#plexus-interpolation/1.27": {
+   "jar": "sha256-P7T7YUP9+WQCTDy3OFUVJLnqhOXCEc1mDFWa0HA+UjA=",
+   "pom": "sha256-1U+8vEOZ41IyKHSkEoudKP6f4Vg/iew2HeJC6jjTP5s="
+  },
+  "org/codehaus/plexus#plexus-io/3.5.0": {
+   "jar": "sha256-ll7SiRLPGuTGKBEsQAngwZgZvETtXbivVO5e2iEDaj4=",
+   "pom": "sha256-9bhs0iOgv0umSd4Z5+jk4fFDRP9jb4sAJMicRtKMydg="
+  },
+  "org/codehaus/plexus#plexus/16": {
+   "pom": "sha256-aNTu1lo9u8NC7YDdE4++nGfLf7TCq8T1IBzbW59kWGg="
+  },
+  "org/codehaus/plexus#plexus/18": {
+   "pom": "sha256-tD7onIiQueW8SNB5/LTETwgrUTklM1bcRVgGozw92P0="
+  },
+  "org/junit#junit-bom/5.10.0": {
+   "module": "sha256-6z7mEnYIAQaUqJgFbnQH0RcpYAOrpfXbgB30MLmIf88=",
+   "pom": "sha256-4AbdiJT5/Ht1/DK7Ev5e2L5lZn1bRU+Z4uC4xbuNMLM="
+  },
+  "org/junit#junit-bom/5.10.1": {
+   "module": "sha256-IbCvz//i7LN3D16wCuehn+rulOdx+jkYFzhQ2ueAZ7c=",
+   "pom": "sha256-IcSwKG9LIAaVd/9LIJeKhcEArIpGtvHIZy+6qzN7w/I="
+  },
+  "org/junit#junit-bom/5.10.2": {
+   "module": "sha256-3iOxFLPkEZqP5usXvtWjhSgWaYus5nBxV51tkn67CAo=",
+   "pom": "sha256-Fp3ZBKSw9lIM/+ZYzGIpK/6fPBSpifqSEgckzeQ6mWg="
+  },
+  "org/junit#junit-bom/5.10.3": {
+   "module": "sha256-qnlAydaDEuOdiaZShaqa9F8U2PQ02FDujZPbalbRZ7s=",
+   "pom": "sha256-EJN9RMQlmEy4c5Il00cS4aMUVkHKk6w/fvGG+iX2urw="
+  },
+  "org/junit#junit-bom/5.8.0-M1": {
+   "module": "sha256-vgUUcTA6UD9MIkZwdbJ0kEE3fd1tWoywc53tZ9kW2C0=",
+   "pom": "sha256-dxREMv/Gi9mKeQqxBpYZ2RAyz8Dk4TwIFjqgPaNv1uI="
+  },
+  "org/redline-rpm#redline/1.2.10": {
+   "jar": "sha256-LgdOe9QhdOrqyYzrx4Lw17zI3CpBYXkyrJx51WvIbs0=",
+   "pom": "sha256-B6tuIriDJfDPdNQuiaZjQY5Vb+pXmMZnjSY8+YJuxC4="
+  },
+  "org/slf4j#slf4j-api/1.7.36": {
+   "jar": "sha256-0+9XXj5JeWeNwBvx3M5RAhSTtNEft/G+itmCh3wWocA=",
+   "pom": "sha256-+wRqnCKUN5KLsRwtJ8i113PriiXmDL0lPZhSEN7cJoQ="
+  },
+  "org/slf4j#slf4j-api/1.7.5": {
+   "pom": "sha256-r6+OdAGbIw0/Vv3XyT+xBwwNyjTz0tWrXeqfxha9XKQ="
+  },
+  "org/slf4j#slf4j-parent/1.7.36": {
+   "pom": "sha256-uziNN/vN083mTDzt4hg4aTIY3EUfBAQMXfNgp47X6BI="
+  },
+  "org/slf4j#slf4j-parent/1.7.5": {
+   "pom": "sha256-xDvFoCLb/Z3oK+Iy3/5GIIy8feEsFDhbXagk4zHlNbs="
+  },
+  "org/sonatype/forge#forge-parent/4": {
+   "pom": "sha256-GDjRMkeQBbS3RZt5jp2ZFVFQkMKICC/c2G2wsQmDokw="
+  },
+  "org/sonatype/oss#oss-parent/9": {
+   "pom": "sha256-+0AmX5glSCEv+C42LllzKyGH7G8NgBgohcFO8fmCgno="
+  },
+  "org/sonatype/plexus#plexus-cipher/1.4": {
+   "jar": "sha256-WhX9uiJmng/dBuENzOYyCHnh9zmPvJEM0Gd7UGcqeMQ=",
+   "pom": "sha256-pjouI5iMyn+sbJOIbW8FBv0m2I1+jMDLibnG4NbJlK0="
+  },
+  "org/sonatype/plexus#plexus-sec-dispatcher/1.4": {
+   "jar": "sha256-2nPjK1gTLmTa8SJp/Z0BHAswPyNIQPF5kIclpjK2tXw=",
+   "pom": "sha256-tNbx4rkXL7dRDhixSupMpaBkb8izotcKLr/6b+SHh9w="
+  },
+  "org/sonatype/spice#spice-parent/12": {
+   "pom": "sha256-IaGbJtvlw43bURTPTq2/XMtBG8axKP3VlJscyxLzaD4="
+  },
+  "org/tukaani#xz/1.4": {
+   "pom": "sha256-/kqLT1R/okQ0L7r0pOgPDEg3HYXMQBtYUViRKENiWJI="
+  },
+  "org/tukaani#xz/1.9": {
+   "jar": "sha256-IRswbPxE+Plt86Cj3a91uoxSie7XfWDXL4ibuFX1NeU=",
+   "pom": "sha256-CTvhsDMxvOKTLWglw36YJy12Ieap6fuTKJoAJRi43Vo="
+  },
+  "org/vafer#jdeb/1.14": {
+   "jar": "sha256-K5maQLdp9syj+zgbjxEY/DRLiKvi84uhstUyV/ifNgI=",
+   "pom": "sha256-UhZkuBz7sPxlYawUMG105wkNjrgh1De0de9jwlxaoIc="
+  },
+  "org/yaml#snakeyaml/1.19": {
+   "jar": "sha256-CnsQY/yuuAa0C3KNAbk2HTjh7Y3rk/lFmU/sfBdh2tE=",
+   "pom": "sha256-LPLw3zc1cHbH8clmIV6L5urKSM670TZHjaZ0mpjjomE="
+  }
+ },
+ "https://repo1.maven.org/maven2": {
+  "aopalliance#aopalliance/1.0": {
+   "jar": "sha256-Ct3sZw/tzT8RPFyAkdeDKA0j9146y4QbYanNsHk3agg=",
+   "pom": "sha256-JugjMBV9a4RLZ6gGSUXiBlgedyl3GD4+Mf7GBYqppZs="
+  },
+  "com/google#google/5": {
+   "pom": "sha256-4J00XnPKP7yn8+BfMN63Tp053Wt5qT/ujFEfI0F7aCg="
+  },
+  "com/google/code/findbugs#jsr305/3.0.2": {
+   "jar": "sha256-dmrSoHg/JoeWLIrXTO7MOKKLn3Ki0IXuQ4t4E+ko0Mc=",
+   "pom": "sha256-GYidvfGyVLJgGl7mRbgUepdGRIgil2hMeYr+XWPXjf4="
+  },
+  "com/google/errorprone#error_prone_annotations/2.3.4": {
+   "jar": "sha256-uvfW6pfOYGxT4RtoVLpfLOfvXCTd3wr6GNEmC9JbACw=",
+   "pom": "sha256-EyZziktPfMrPYHuGahH7hRk+9g9qWUYRh85yZfm+W+0="
+  },
+  "com/google/errorprone#error_prone_parent/2.3.4": {
+   "pom": "sha256-QElbQ3pg0jmPD9/AVLidnDlKgjR6J0oHIcLpUKQwIYY="
+  },
+  "com/google/guava#failureaccess/1.0.1": {
+   "jar": "sha256-oXHuTHNN0tqDfksWvp30Zhr6typBra8x64Tf2vk2yiY=",
+   "pom": "sha256-6WBCznj+y6DaK+lkUilHyHtAopG1/TzWcqQ0kkEDxLk="
+  },
+  "com/google/guava#guava-parent/14.0.1": {
+   "pom": "sha256-5aUl7Ttdf/8qjalkHgy5hcf9uEfjCB4qNz2vLnADm2M="
+  },
+  "com/google/guava#guava-parent/26.0-android": {
+   "pom": "sha256-+GmKtGypls6InBr8jKTyXrisawNNyJjUWDdCNgAWzAQ="
+  },
+  "com/google/guava#guava-parent/30.1-jre": {
+   "pom": "sha256-4q+3R+vE/iMo1qkPqIxdioO7HjIGG7mxD/Q+LEetbnM="
+  },
+  "com/google/guava#guava/14.0.1": {
+   "pom": "sha256-PdSpktU+tSShxlRqJLhTszKyZSB1XiayXTgQATFCS3s="
+  },
+  "com/google/guava#guava/30.1-jre": {
+   "jar": "sha256-5t0HL50/4CpGAGiDgL1CK9rBhMr2/iQYz90JNPCUMqo=",
+   "pom": "sha256-lkbUzVAJTUq+UH5VXT921340pMVWayL7Ew71XU676Sc="
+  },
+  "com/google/guava#listenablefuture/9999.0-empty-to-avoid-conflict-with-guava": {
+   "jar": "sha256-s3KgN9QjCqV/vv/e8w/WEj+cDC24XQrO0AyRuXTzP5k=",
+   "pom": "sha256-GNSx2yYVPU5VB5zh92ux/gXNuGLvmVSojLzE/zi4Z5s="
+  },
+  "com/google/guava/guava/maven-metadata": {
+   "xml": {
+    "groupId": "com.google.guava",
+    "lastUpdated": "20260414193116",
+    "release": "33.6.0-jre"
+   }
+  },
+  "com/google/inject#guice-parent/3.0": {
+   "pom": "sha256-XG44w1mE5VAzSY/CLRUZslAcNqvwif1EUIFJH2/M6Ro="
+  },
+  "com/google/inject#guice/3.0": {
+   "jar": "sha256-GlnQQh/9NVzAtwtC3xwumvdEyKLQyS2jefX8ovB/HSI=",
+   "pom": "sha256-IogoDGRaFuamSRGbP0PrysKmmCFrgFssbw7uo5GR7cA="
+  },
+  "com/google/j2objc#j2objc-annotations/1.3": {
+   "jar": "sha256-Ia8wySJnvWEiwOC00gzMtmQaN+r5VsZUDsRx1YTmSns=",
+   "pom": "sha256-X6yoJLoRW+5FhzAzff2y/OpGui/XdNQwTtvzD6aj8FU="
+  },
+  "com/ibm/icu#icu4j/52.1": {
+   "pom": "sha256-9fXj+DzEgf4xtKcZAY0/tWpTa5pkGyvcN4kBYkSYhkY="
+  },
+  "io/github/classgraph#classgraph/4.8.35": {
+   "jar": "sha256-S+jLCgnY0HfSfyj6J/KnwQuEYwxj4cD2IH1EvfLO78g=",
+   "pom": "sha256-gzF7P8oJQDa082OVdOs94t8QKub80+Yr3PaF9lkg/ak="
+  },
+  "javax/inject#javax.inject/1": {
+   "jar": "sha256-kcdwRKUMSBY2wy2Rb9ickRinIZU5BFLIEGUID5V95/8=",
+   "pom": "sha256-lD4SsQBieARjj6KFgFoKt4imgCZlMeZQkh6/5GIai/o="
+  },
+  "junit#junit/4.13.2": {
+   "jar": "sha256-jklbY0Rp1k+4rPo0laBly6zIoP/1XOHjEAe+TBbcV9M=",
+   "pom": "sha256-Vptpd+5GA8llwcRsMFj6bpaSkbAWDraWTdCSzYnq3ZQ="
+  },
+  "log4j#log4j/1.2.15": {
+   "pom": "sha256-SkgVA4q+8Kdy2zj/BvmFx9I9wxCb+Hf12DMpQm3afa8="
+  },
+  "log4j#log4j/1.2.16": {
+   "pom": "sha256-Kx6fEFXPC0pGWar0dLZehC1cHcWAtcTgI472NHDREP0="
+  },
+  "log4j#log4j/1.2.17": {
+   "jar": "sha256-HTFpZEVpdyBScJF1Q2kIKmZRvUl4G2AF3rlOVnU0Bvk=",
+   "pom": "sha256-O5Wj083TqkuRqzJ921ob/gPYHic3lONqoUQEcdXXDl4="
+  },
+  "net/java/dev/jna#jna-platform/5.18.1": {
+   "jar": "sha256-rRTBsexPQ9OWIxIZ36Y16/go9zjqyfiQ6hvAd5WJLZo=",
+   "pom": "sha256-OdU4qVmaRHR3CDiGXtQs+j5rPRMIbLHld7i7QxSNGmU="
+  },
+  "net/java/dev/jna#jna/5.18.1": {
+   "jar": "sha256-JgxLHiKx254RDuRBxPE84RX4QfpIxB14dQmGIUs5VVc=",
+   "pom": "sha256-mLYq5v8oDXR/s1n8QuSP7RE9Rbw3Kagj3DC4MIqAZkU="
+  },
+  "net/sf/jopt-simple#jopt-simple/4.4": {
+   "jar": "sha256-PKo+nzO/XYuMCu/qjPFmp/RomIBCHESkLZzqDTrG4u0=",
+   "pom": "sha256-grxfPGJDqK9v7dC7tLUQvUNQOYrRqH1CBcuB6ltMkXQ="
+  },
+  "org/antlr#antlr-master/3.2": {
+   "pom": "sha256-fRkllZP6jp3uFclxr/qZy/4mP4mAhXSwLzxkntc9GjU="
+  },
+  "org/antlr#antlr-runtime/3.2": {
+   "jar": "sha256-bZ+ZcgLMAtTU+j1OhObS0946Gx+VHpoag7QNAnmlA4k=",
+   "pom": "sha256-7LFOJegtITLWPHQuMMML0qWxiVQfmPGaVAaLVvHz1o8="
+  },
+  "org/apache/ant#ant-launcher/1.9.15": {
+   "jar": "sha256-O2x8C7wGSm1AA5+ZX23Dm8O3mjs18+lH7VRcS2Yb2Us=",
+   "pom": "sha256-g2t7bhQDQxWvlcxFLrUnz2kS4vo/hOxRQAYIc3zaBT8="
+  },
+  "org/apache/ant#ant-parent/1.9.15": {
+   "pom": "sha256-PS+Wc7hr27MK3bdcWdnP/BKDOVfX6t1SSZuOpBMW9DQ="
+  },
+  "org/apache/ant#ant/1.9.15": {
+   "jar": "sha256-VZh4OBCCR0ZVx0DoNzosmZD+Sph6pMJvOccizvXELMw=",
+   "pom": "sha256-0VF8gmrVqm32WpXqw6h+Zult7Qf/YiR3bbhKZb6rpTs="
+  },
+  "org/checkerframework#checker-qual/3.5.0": {
+   "jar": "sha256-cpmQs/GKlWBvwlc4NraVi820TLUr+9G3qpwznP81paQ=",
+   "pom": "sha256-KDazuKeO2zGhgDWS5g/HZ7IfLRkHZGMbpu+gg3uzVyE="
+  },
+  "org/eclipse/emf#org.eclipse.emf.common/2.17.0": {
+   "jar": "sha256-W4qj/X71SsaVqnPGv+opmpviz3Ry7WuKn6hN/QAL3LM=",
+   "pom": "sha256-zYf3dhgsAKnai7KIbXx7rLvoMjJsKw4sQ3rrs7fvAVg="
+  },
+  "org/eclipse/emf#org.eclipse.emf.common/2.45.0": {
+   "pom": "sha256-Momjqyn/zL6YIl3+lfnffSiuQz6xrNNUZkZQfzXtqwc="
+  },
+  "org/eclipse/emf#org.eclipse.emf.ecore.xmi/2.16.0": {
+   "jar": "sha256-2NoRRs2DZ19dVBf92R/Inyr0tD5KMBEGYTJplNxxF20=",
+   "pom": "sha256-McYAPeGYu++mcsQ9ixI5b+K0DnXH8M+N6pvOkGZix18="
+  },
+  "org/eclipse/emf#org.eclipse.emf.ecore.xmi/2.40.0": {
+   "pom": "sha256-Vo7z0mmi/HE1/EBvXJ5JbdQjQ6CB3xufaaMj9fHuSzE="
+  },
+  "org/eclipse/emf#org.eclipse.emf.ecore/2.20.0": {
+   "jar": "sha256-nuU5o8UO88/LqjqF808EHupoKtRZ0+lW33dp9rKZGzY=",
+   "pom": "sha256-6aoQO2xLlRT1Par3jX/y2/B6zexP7uKVCb4I6hvsOSw="
+  },
+  "org/eclipse/emf#org.eclipse.emf.ecore/2.42.0": {
+   "pom": "sha256-9J8c6yPnlQi1R0TqD5Ii8y97jTTpQq2rDrmKwv6JvtY="
+  },
+  "org/eclipse/emf/org.eclipse.emf.common/maven-metadata": {
+   "xml": {
+    "groupId": "org.eclipse.emf",
+    "lastUpdated": "20260224162236",
+    "release": "2.45.0"
+   }
+  },
+  "org/eclipse/emf/org.eclipse.emf.ecore.xmi/maven-metadata": {
+   "xml": {
+    "groupId": "org.eclipse.emf",
+    "lastUpdated": "20260224162235",
+    "release": "2.40.0"
+   }
+  },
+  "org/eclipse/emf/org.eclipse.emf.ecore/maven-metadata": {
+   "xml": {
+    "groupId": "org.eclipse.emf",
+    "lastUpdated": "20260224162245",
+    "release": "2.42.0"
+   }
+  },
+  "org/eclipse/jdt#org.eclipse.jdt.compiler.apt/1.3.1100": {
+   "jar": "sha256-zJqUAyG8X/IdsjBRdcPGYBYYoeosDbr65NGJBX5fVsI=",
+   "pom": "sha256-96v/7G1ehU+ora9ZJyT7rFFM8gKsaO9Q6ZTBzx9Dyjg="
+  },
+  "org/eclipse/jdt#org.eclipse.jdt.compiler.tool/1.2.1000": {
+   "jar": "sha256-XVB7Co4RPPyccS9TBuzp0ON3VEfIEfyl+EkMNhWnVLQ=",
+   "pom": "sha256-qryopLNthGmhzCQ4AnWupz5YZqvAl8spXubpXK9Lpwk="
+  },
+  "org/eclipse/jdt#org.eclipse.jdt.core/3.17.0": {
+   "pom": "sha256-F04xhLHTa8gqBjdPLhcacmXRXgjCDDXqtL8y4OGdG48="
+  },
+  "org/eclipse/jdt#org.eclipse.jdt.core/3.23.0": {
+   "jar": "sha256-sf7D5ZoMCcXisipnc3pUFithF/FQA3iya+SQgWw0Q8I=",
+   "pom": "sha256-IHpNbAWKRyIzp/n11ufbRdIG1szT9c6jTgQHuoQm0yU="
+  },
+  "org/eclipse/platform#org.eclipse.core.commands/3.12.500": {
+   "jar": "sha256-RHEzYuVe0o5ttdLDG/Z1JP7wh2RaRNwyOdrGDs4BfLk=",
+   "pom": "sha256-yD+4t0dc62ANfijxwyfGjhzSaFHeyEEKthn/9W17SoI="
+  },
+  "org/eclipse/platform#org.eclipse.core.contenttype/3.9.800": {
+   "jar": "sha256-4MLblmANUZzjanX5t8lxr9KHDS0Fnu5L8kNtmzOqC40=",
+   "pom": "sha256-vZ20X3R3JIQpxxz4RlcC2r+xUgzoU0+dwl1BeOu1iXs="
+  },
+  "org/eclipse/platform#org.eclipse.core.expressions/3.9.600": {
+   "jar": "sha256-7/hM/I8g4jVEjDpk+kwvpl+X4O0I0mMC8zG2d9/3emY=",
+   "pom": "sha256-LoubbvcTC0GLfGQY7X7mTAo7nd806z3Va/qLIzr2qtI="
+  },
+  "org/eclipse/platform#org.eclipse.core.filesystem/1.11.400": {
+   "jar": "sha256-b3C5XRS5DsV7lMXj26fh0YlnnPmkvEUm6ckb7tfWoO8=",
+   "pom": "sha256-sQA8+u8BN+YzwThrzFfbCl5Yelm1Fx5We6Uwz6u/jMU="
+  },
+  "org/eclipse/platform#org.eclipse.core.jobs/3.15.700": {
+   "jar": "sha256-NwFReae5uQ0Wy5L0sb5gg6Gm2tJUKPqPa4libwzC2nk=",
+   "pom": "sha256-OUVAotjHPjVRHz1f8J2fNkdm4P4steb4V8Tfqwl9Ot8="
+  },
+  "org/eclipse/platform#org.eclipse.core.jobs/3.15.800": {
+   "pom": "sha256-4BqLscYYZjcJv4yyFznslhvc6MVVXQTn+3VzvjD2jWY="
+  },
+  "org/eclipse/platform#org.eclipse.core.resources/3.24.0": {
+   "jar": "sha256-4mcC2BfWwm6D5Nbn5v9HYaU3dEh6JHsfr3yXXTlWg/4=",
+   "pom": "sha256-2LzuUCsfE1UK/R4pjZCLeh4cbNveVUj2joroopFNShE="
+  },
+  "org/eclipse/platform#org.eclipse.core.runtime/3.19.0": {
+   "pom": "sha256-5d9UsnVbbVg/aoJOpuRLwYBQKfaaF6M8GISSOPCCMnQ="
+  },
+  "org/eclipse/platform#org.eclipse.core.runtime/3.34.200": {
+   "jar": "sha256-tPNqCssI8D0LPbVLIfxWOMggxEdEakELpJalBw+jQ2M=",
+   "pom": "sha256-VUfhQDP4BRrlX0qDhwRsdAk7UgNs3DVu9p6lGOrn5uw="
+  },
+  "org/eclipse/platform#org.eclipse.equinox.app/1.7.600": {
+   "jar": "sha256-/TUzmINRB2CPVUd5pukYkXJe+5Tg9XVZ0Ks86kthVsc=",
+   "pom": "sha256-cZhnUaan5uJyMJs6ZqySGUPplQlqXIgI1C6aDMJR1eg="
+  },
+  "org/eclipse/platform#org.eclipse.equinox.common/3.13.0": {
+   "pom": "sha256-+3O5zurY3z4CrkYhA323gKKaURHCIDHszq+BXLmw35A="
+  },
+  "org/eclipse/platform#org.eclipse.equinox.common/3.20.300": {
+   "pom": "sha256-ALs//vT1/wr/lXaIGYlvxY1kxitKkEc60niE6P0viFI="
+  },
+  "org/eclipse/platform#org.eclipse.equinox.common/3.20.400": {
+   "jar": "sha256-QjtYYTpOm7vm7CI5aQ/zKfE9aeuyhAal+dcFFqZkOiQ=",
+   "pom": "sha256-uGupfIVGTB0QapWYJrNFQkoubQ1bCI/Sf/8FGW/xS+8="
+  },
+  "org/eclipse/platform#org.eclipse.equinox.preferences/3.12.100": {
+   "jar": "sha256-/QToGiirMra7BzKG6yk8RLdgF2/PHjXvFWFNYt+CD4Y=",
+   "pom": "sha256-IYxiWoWw5QQU6dGRKFYUtrL+qf9/0TITKm4PkyQzMZY="
+  },
+  "org/eclipse/platform#org.eclipse.equinox.registry/3.12.600": {
+   "jar": "sha256-T4zXJoFEa1mDkKjCTum5mW9uTF+r7QIrUL0m9vWgv2w=",
+   "pom": "sha256-Kwg3b6gZu5Q3vHDKJM6w8NtE3gE/63F9vmmaKU+2MSc="
+  },
+  "org/eclipse/platform#org.eclipse.osgi/3.23.100": {
+   "pom": "sha256-gph5O0PkohKzeJ6c/dpZEqEGTCkPTgr4pUrLSNB5TuQ="
+  },
+  "org/eclipse/platform#org.eclipse.osgi/3.24.200": {
+   "jar": "sha256-v+g/zR+gNOuamGs8tuXisY27rLZ+q9qtLaMoBOzYxlo=",
+   "pom": "sha256-sMVs+qxqcAh+RUJXzABLfTb7uYk9vu5N64fGISWGERY="
+  },
+  "org/eclipse/platform#org.eclipse.text/3.14.700": {
+   "jar": "sha256-QHX3qjoZ8s5v/R9VXrwIhOBlzEC1n3HXdNoJKMFCNVU=",
+   "pom": "sha256-CUpEEYG78vzd7jYOoXXKFPO/NfAVtPlNpV6CTltDM+0="
+  },
+  "org/eclipse/platform/org.eclipse.core.contenttype/maven-metadata": {
+   "xml": {
+    "groupId": "org.eclipse.platform",
+    "lastUpdated": "20251208072734",
+    "release": "3.9.800"
+   }
+  },
+  "org/eclipse/platform/org.eclipse.core.filesystem/maven-metadata": {
+   "xml": {
+    "groupId": "org.eclipse.platform",
+    "lastUpdated": "20251208072743",
+    "release": "1.11.400"
+   }
+  },
+  "org/eclipse/platform/org.eclipse.core.jobs/maven-metadata": {
+   "xml": {
+    "groupId": "org.eclipse.platform",
+    "lastUpdated": "20260608064403",
+    "release": "3.15.800"
+   }
+  },
+  "org/eclipse/platform/org.eclipse.core.resources/maven-metadata": {
+   "xml": {
+    "groupId": "org.eclipse.platform",
+    "lastUpdated": "20260608064402",
+    "release": "3.24.0"
+   }
+  },
+  "org/eclipse/platform/org.eclipse.equinox.app/maven-metadata": {
+   "xml": {
+    "groupId": "org.eclipse.platform",
+    "lastUpdated": "20260309141957",
+    "release": "1.7.600"
+   }
+  },
+  "org/eclipse/platform/org.eclipse.equinox.preferences/maven-metadata": {
+   "xml": {
+    "groupId": "org.eclipse.platform",
+    "lastUpdated": "20251208072801",
+    "release": "3.12.100"
+   }
+  },
+  "org/eclipse/platform/org.eclipse.equinox.registry/maven-metadata": {
+   "xml": {
+    "groupId": "org.eclipse.platform",
+    "lastUpdated": "20251208072814",
+    "release": "3.12.600"
+   }
+  },
+  "org/eclipse/platform/org.eclipse.osgi/maven-metadata": {
+   "xml": {
+    "groupId": "org.eclipse.platform",
+    "lastUpdated": "20260608064445",
+    "release": "3.24.200"
+   }
+  },
+  "org/eclipse/platform/org.eclipse.text/maven-metadata": {
+   "xml": {
+    "groupId": "org.eclipse.platform",
+    "lastUpdated": "20260608064456",
+    "release": "3.14.700"
+   }
+  },
+  "org/eclipse/xtend#org.eclipse.xtend.core/2.26.0.M1": {
+   "jar": "sha256-cSJpnGjNwDzHCD+416m8Fu9X81Zs+VHb8iAu59hBPP4=",
+   "pom": "sha256-gAUnNNtYJj1M81i7Xnts2YM8SOpYrrEz6OU7HJh6bnk="
+  },
+  "org/eclipse/xtend#org.eclipse.xtend.lib.macro/2.26.0.M1": {
+   "jar": "sha256-0JD3xc6lbz4fU5zR7DBJF9vcW0CatfhJH+fRKweHaqc=",
+   "pom": "sha256-noRJeVGBYI2AALRM4yFw2UzP1JaN1V2KgGNyqYnrPj8="
+  },
+  "org/eclipse/xtend#org.eclipse.xtend.lib.macro/2.9.0.beta3": {
+   "pom": "sha256-mrnejeg674gkxdP7ejRO4ucqCkFKvjRaU9fQu3QMK/8="
+  },
+  "org/eclipse/xtend#org.eclipse.xtend.lib/2.26.0.M1": {
+   "jar": "sha256-WDcavdMrnHaEcXE9KbTTOVE0Mhxu1u6sMDT2H6DO868=",
+   "pom": "sha256-cdrQr0y9l+9VG/GjtdISVz6Wm8Ahcqvn24VOLLr3on8="
+  },
+  "org/eclipse/xtend#org.eclipse.xtend.lib/2.9.0.beta3": {
+   "pom": "sha256-tvTav1nQs3hAJpu5l9g8blJklfs3PgS/4gyUkro7WrY="
+  },
+  "org/eclipse/xtext#org.eclipse.xtext.common.types/2.26.0.M1": {
+   "jar": "sha256-J4CbsOaZyXIjvMqgWb5gUsgm7cjOTWjk4a8c8OA8WpI=",
+   "pom": "sha256-KBblpXkaPCgF70MCp2FD5bosfgHNRWSYJmKi6NBNzG4="
+  },
+  "org/eclipse/xtext#org.eclipse.xtext.parent/2.9.0.beta3": {
+   "pom": "sha256-iitPMtKIuMIpKhznz1PSniKrUJLrQJCGHk7fWH5dxXE="
+  },
+  "org/eclipse/xtext#org.eclipse.xtext.tycho.parent/2.9.0.beta3": {
+   "pom": "sha256-aw4ohgIotMlzzRlMG75OAWJ3Z9eFa8IPLXhJdsqM3Hc="
+  },
+  "org/eclipse/xtext#org.eclipse.xtext.ui/2.9.0.beta3": {
+   "jar": "sha256-LdJ4gAHfV5Tdh3PcoWTLVf9loRXq2KyoTxcQIv1YXEk=",
+   "pom": "sha256-ijONMPrjEGreQAPcjqK4D4UYWks2MIvqLmXwNet5xao="
+  },
+  "org/eclipse/xtext#org.eclipse.xtext.util/2.26.0.M1": {
+   "jar": "sha256-GjUOUkVY9wqbaPoU1CpkzfSHJZSIMmbVHVM6XtHe87k=",
+   "pom": "sha256-PiFttra2eWhlgERIshGKlnMU088VE07lShOxcmNCcls="
+  },
+  "org/eclipse/xtext#org.eclipse.xtext.util/2.9.0.beta3": {
+   "pom": "sha256-Av48mI0vXSEvRU1Dd6sW87+kuCmmriSDjmW5mKXfXkM="
+  },
+  "org/eclipse/xtext#org.eclipse.xtext.xbase.lib/2.26.0.M1": {
+   "jar": "sha256-6t00qIDs00kIirnsc8/esHRlaL8lhACb0CUt5EgNjZM=",
+   "pom": "sha256-RQGK9XRXRnva6chBnh86GlIXMPixtWsV9vFihq2YW7M="
+  },
+  "org/eclipse/xtext#org.eclipse.xtext.xbase.lib/2.9.0.beta3": {
+   "pom": "sha256-PdmWaS7jFJPKsPuHXR8dH/TYVJR9w9h7/v4wXwn+ICM="
+  },
+  "org/eclipse/xtext#org.eclipse.xtext.xbase/2.26.0.M1": {
+   "jar": "sha256-jk8M2/NovIVnk1V6qrrBiRUwTMv6thT0GfAkY+w+Z/o=",
+   "pom": "sha256-WwQhe/Y1tnJ+6AvbD7ou1Zc6mcznyJuAqCO932xde5o="
+  },
+  "org/eclipse/xtext#org.eclipse.xtext/2.26.0.M1": {
+   "jar": "sha256-AJqnshwnSwjN0HYZLCYrSTwfRsk4O1Uzo0HvnAr/Uro=",
+   "pom": "sha256-bVw1Q8nsT1RgOUbQWaMwYnWDRJTMXnBHMTuf4gTgqkk="
+  },
+  "org/eclipse/xtext#org.eclipse.xtext/2.9.0.beta3": {
+   "pom": "sha256-sdYgpLPTQpjRnvmniZuQG4ujVrWmWsBikJHChbNOQRs="
+  },
+  "org/eclipse/xtext#xtext-dev-bom/2.26.0.M1": {
+   "pom": "sha256-rS44hS+MKr4hxk2eMIfDDiqruej4VkLEjYK+CUTf4hY="
+  },
+  "org/hamcrest#hamcrest-core/1.3": {
+   "jar": "sha256-Zv3vkelzk0jfeglqo4SlaF9Oh1WEzOiThqekclHE2Ok=",
+   "pom": "sha256-/eOGp5BRc6GxA95quCBydYS1DQ4yKC4nl3h8IKZP+pM="
+  },
+  "org/hamcrest#hamcrest-parent/1.3": {
+   "pom": "sha256-bVNflO+2Y722gsnyelAzU5RogAlkK6epZ3UEvBvkEps="
+  },
+  "org/osgi#org.osgi.service.prefs/1.1.2": {
+   "jar": "sha256-Q8fIcHEONjQF1CLaZTzODXmKRTf3bkkw95vOrdOlU0U=",
+   "pom": "sha256-bqSDzqF36RMQmExkUuaUqiCAGVG1AfF8uboRQyjCzCY="
+  },
+  "org/osgi#osgi.annotation/8.0.1": {
+   "jar": "sha256-oOikw2K9NgCBLzew6kX7qWbHvASdAf7Vagnsx0CCdZ4=",
+   "pom": "sha256-iC0Hao4lypIH95ywk4DEcvazxBUIFivSuqBpF74d7XM="
+  },
+  "org/ow2#ow2/1.5": {
+   "pom": "sha256-D4obEW52C4/mOJxRuE5LB6cPwRCC1Pk25FO1g91QtDs="
+  },
+  "org/ow2/asm#asm-analysis/9.1": {
+   "jar": "sha256-gaiAQbG4vtpaiplkYJgEbEhwlTgnDEne9oq/8lrDvjQ=",
+   "pom": "sha256-rFRUwRsDQxypUd9x+06GyMTIDfaXn5W3V8rtOrD0cVY="
+  },
+  "org/ow2/asm#asm-commons/9.1": {
+   "jar": "sha256-r8sm3B/BLAxKma2mcJCN2C4Y38SIyvXuklRplrRwwAw=",
+   "pom": "sha256-oPZRsnuK/pwOYS16Ambqy197HHh7xLWsgkXz16EYG38="
+  },
+  "org/ow2/asm#asm-tree/9.1": {
+   "jar": "sha256-/QCvpJ6VlddkYgWwnOy0p3ao/wugby1ZuPe/nHBLSnM=",
+   "pom": "sha256-tqANkgfANUYPgcfXDtQSU/DSFmUr7UX6GjBS/81QuUw="
+  },
+  "org/ow2/asm#asm/9.1": {
+   "jar": "sha256-zaTeRV+rSP8Ly3xItGOUR9TehZp6/DCglKmG8JNr66I=",
+   "pom": "sha256-xoOpDdaPKxeIy9/EZH6pQF71kls3HBmfj9OdRNPO3o0="
+  },
+  "org/sonatype/forge#forge-parent/6": {
+   "pom": "sha256-nF981SJqyMN5jLH4AMAx997cFgbcUNwpVnh3yCJEWac="
+  },
+  "org/sonatype/oss#oss-parent/7": {
+   "pom": "sha256-tR+IZ8kranIkmVV/w6H96ne9+e9XRyL+kM5DailVlFQ="
+  },
+  "org/sonatype/oss#oss-parent/9": {
+   "pom": "sha256-+0AmX5glSCEv+C42LllzKyGH7G8NgBgohcFO8fmCgno="
+  },
+  "org/sonatype/sisu/inject#cglib/2.2.1-v20090111": {
+   "pom": "sha256-SvNVR7tds+Sft1CGWvDjM6/cgubm19itvRwUEd+tYIE="
+  }
+ },
+ "https://repository.jboss.org": {
+  "nexus/content/groups/public-jboss/com/google/guava/guava/maven-metadata": {
+   "xml": {
+    "groupId": "com.google.guava",
+    "lastUpdated": "20160429131712",
+    "release": "20.0-hal"
+   }
+  }
+ }
+}
diff --git a/pkgs/by-name/um/umple/fix-manpage.patch b/pkgs/by-name/um/umple/fix-manpage.patch
new file mode 100644
index 000000000000..19f01ec569ba
--- /dev/null
+++ b/pkgs/by-name/um/umple/fix-manpage.patch
@@ -0,0 +1,13 @@
+--- a/build.gradle
++++ b/build.gradle
+@@ -605,8 +605,8 @@ task packageAllJars {
+ 
+ // Generate options text from help message
+ task genOptions(type:Exec) {
+-  workingDir "${rootProject.projectDir.toString()}/dist/"
+-  commandLine 'java', '-jar', 'umple.jar', '-help'
++  workingDir "${rootProject.projectDir.toString()}/dist/gradle/libs/"
++  commandLine 'java', '-jar', '@UMPLE_OUT_JAR@', '-help'
+   standardOutput = new ByteArrayOutputStream()
+   doLast {
+     def strings = standardOutput.toString().split('-----------')
diff --git a/pkgs/by-name/um/umple/gradle-8-compat.patch b/pkgs/by-name/um/umple/gradle-8-compat.patch
new file mode 100644
index 000000000000..f05059be10ee
--- /dev/null
+++ b/pkgs/by-name/um/umple/gradle-8-compat.patch
@@ -0,0 +1,48 @@
+diff --git a/build.gradle b/build.gradle
+index 897ab9d0a..ff84824f9 100644
+--- a/build.gradle
++++ b/build.gradle
+@@ -10,7 +10,7 @@ buildscript {
+ }
+ 
+ plugins {
+-  id 'nebula.ospackage' version '9.1.1'
++  id 'com.netflix.nebula.ospackage' version '12.3.0'
+ }
+ 
+ String runGit(List<String> args, String fallback) {
+@@ -376,7 +376,6 @@ sourceSets {
+             ]
+             exclude '**/*.ump', '**/.git*'
+         }
+-        java.outputDir = file(rootProject.ext.classfileOutputDir)
+     }
+     test {
+         compileClasspath = files(
+@@ -394,10 +393,16 @@ sourceSets {
+             ]
+             exclude '**/*.ump', '**/.git*'
+         }
+-        java.outputDir = file(rootProject.ext.testClassfileOutputDir)
+     }
+ }
+ 
++tasks.named("compileJava") {
++    destinationDirectory.set(file(rootProject.ext.classfileOutputDir))
++}
++
++tasks.named("compileTestJava") {
++    destinationDirectory.set(file(rootProject.ext.testClassfileOutputDir))
++}
+ 
+ // ===============
+ //  Jar packaging
+@@ -2011,7 +2016,7 @@ task executeDocJar (type: JavaExec){
+     def drop = fileTree ("${rootProject.ext.umpleoscripts}/dropbox") {
+       include '*.js'
+     }
+-   files = files (
++   files = project.files (
+      'umpleonline/scripts/prototype.js',
+      'umpleonline/scripts/dom.js',
+      'umpleonline/scripts/ajax.js', 
diff --git a/pkgs/by-name/um/umple/package.nix b/pkgs/by-name/um/umple/package.nix
new file mode 100644
index 000000000000..d3234708baa2
--- /dev/null
+++ b/pkgs/by-name/um/umple/package.nix
@@ -0,0 +1,159 @@
+{
+  lib,
+  stdenvNoCC,
+  runCommand,
+  fetchurl,
+  fetchFromGitHub,
+  gradle_8, # incompatible with gradle 9+
+  installShellFiles,
+  makeBinaryWrapper,
+  opentxl,
+  jre,
+}:
+let
+  versions = lib.importJSON ./versions.json;
+  inherit (versions.umple) version longVersion;
+
+  # Required for bootstrapping
+  umpleJar = fetchurl versions.umpleJar;
+
+  # Not managed through Gradle
+  joptSimple = fetchFromGitHub {
+    owner = "jopt-simple";
+    repo = "jopt-simple";
+    tag = "jopt-simple-4.4";
+    hash = "sha256-sOQaEq2qzvEwJzwZIcMQus3tetzA6O2VPl8XUJAtupM=";
+  };
+
+in
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "umple";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "umple";
+    repo = "umple";
+    tag = "v${version}";
+    hash = "sha256-BPy1L3bzvKoywM0srv36SXVe8psaY/m0bljy30z5dr8=";
+  };
+
+  patches = [
+    # The upstream project uses some deprecated Gradle 7 features and old dependencies
+    ./gradle-8-compat.patch
+    # Replaces the logic to determine the current version (requires Git at runtime)
+    ./replace-version.patch
+    # Fixes broken working directory + updates Jar paths for manpage generation task
+    ./fix-manpage.patch
+  ];
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [
+    gradle_8
+    gradle_8.jdk
+    installShellFiles
+    makeBinaryWrapper
+    opentxl
+  ];
+
+  postPatch = ''
+    # Set variables from patches + use Nix store paths
+    substituteInPlace build.gradle \
+      --replace-fail @UMPLE_VERSION@ "${longVersion}" \
+      --replace-fail @UMPLE_OUT_JAR@ "umple-${longVersion}.jar" \
+      --replace-fail '${"$"}{rootProject.projectDir.toString()}/libs/umple-latest.jar' '${umpleJar}' \
+      --replace-fail '${"$"}{rootProject.projectDir.toString()}/dist/gradle/libs/vendors/jopt-simple-jopt-simple-4.4/src/main/java/joptsimple' '${joptSimple}/src/main/java/joptsimple'
+
+    # Replace outdated version in manpage
+    substituteInPlace build/package-files/template.1 \
+      --replace-warn 1.31.1 "${longVersion}"
+
+    # Replace @UMPLE_VERSION@ template in original source code with actual version.
+    # This ensures that emitted files include comments indicating the proper version,
+    # e.g. "Generated with Umple x.y.z"
+    find . -type f \( -name '*.java' -o -name '*.ump' \) -exec sed -i "s/@UMPLE_VERSION@/${longVersion}/g" {} +
+  '';
+
+  mitmCache = gradle_8.fetchDeps {
+    inherit (finalAttrs) pname;
+    data = ./deps.json;
+  };
+
+  __darwinAllowLocalNetworking = true;
+
+  gradleBuildTask = "quickbuild";
+
+  gradleFlags = [
+    # Network-dependent tasks
+    "--exclude-task=downloadUmpleJar"
+    "--exclude-task=downloadJOptSimpleVendorZip"
+    "--exclude-task=downloadAndUnzipJOptSimpleVendor"
+    "--exclude-task=prepareJOptSimpleVendor"
+    # Tasks that try to modify readonly files
+    "--exclude-task=cleanUpUmple"
+  ];
+
+  postBuild = ''
+    gradle --no-daemon genManpage
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/{bin,share/java}
+    cp dist/gradle/libs/umple*.jar $out/share/java
+    installManPage build/package-files/umple.1
+
+    pushd $out/share/java
+    # Strip version suffix from filenames
+    for file in *.jar; do
+      mv "$file" "''${file%-${longVersion}.jar}.jar"
+    done
+    # Create wrappers
+    for file in *.jar; do
+      makeWrapper ${lib.getExe jre} "$out/bin/''${file%.jar}" \
+        --add-flags "-jar $out/share/java/$file"
+    done
+    popd
+
+    runHook postInstall
+  '';
+
+  passthru = {
+    updateScript = ./update.sh;
+
+    bootstrap = umpleJar;
+
+    tests."2dshapes" =
+      runCommand "umple-test"
+        {
+          nativeBuildInputs = [
+            finalAttrs.finalPackage
+            gradle_8.jdk
+          ];
+          src = ./2DShapes.ump;
+        }
+        ''
+          set -euo pipefail
+          cp $src .
+          umple $(basename $src)
+          javac -d bin Shapes/core/*.java
+          java -cp bin Shapes.core.Shape2D
+          touch $out
+        '';
+  };
+
+  meta = {
+    description = "Model-oriented programming language and modelling tool for integrating UML constructs into high-level languages";
+    mainProgram = "umple";
+    homepage = "https://github.com/umple/umple";
+    downloadPage = "https://github.com/umple/umple/releases";
+    license = lib.licenses.mit;
+    sourceProvenance = with lib.sourceTypes; [
+      fromSource
+      binaryBytecode
+    ];
+    maintainers = with lib.maintainers; [ MysteryBlokHed ];
+  };
+})
diff --git a/pkgs/by-name/um/umple/replace-version.patch b/pkgs/by-name/um/umple/replace-version.patch
new file mode 100644
index 000000000000..f376b15c2ec8
--- /dev/null
+++ b/pkgs/by-name/um/umple/replace-version.patch
@@ -0,0 +1,11 @@
+--- a/build.gradle
++++ b/build.gradle
+@@ -32,7 +32,7 @@ ext {
+     umpleMajorVersionFile = new File("${rootProject.projectDir.toString()}/build/umpleversion.txt")
+     umpleLastVersion = new org.yaml.snakeyaml.Yaml().load(rootProject.ext.umpleLastVersionFile.newInputStream()).version
+     umpleMajorVersion = new org.yaml.snakeyaml.Yaml().load(rootProject.ext.umpleMajorVersionFile.newInputStream()).version
+-    umpleCurrentVersion = "${rootProject.ext.umpleMajorVersion}.${runGit(['rev-list', '--count', 'master'], 'x')}.${runGit(['rev-parse', '--short', 'master'], 'dev')}"
++    umpleCurrentVersion = "@UMPLE_VERSION@"
+     umpleCurrentJarBase = "umple-${rootProject.ext.umpleCurrentVersion}"
+     umpleCurrentJar = "${rootProject.projectDir.toString()}/dist/gradle/libs/${rootProject.ext.umpleCurrentJarBase}.jar"
+     umpleJarRemoteSource = "https://cruise.umple.org/umpleonline/scripts/umple.jar"
diff --git a/pkgs/by-name/um/umple/update.sh b/pkgs/by-name/um/umple/update.sh
new file mode 100755
index 000000000000..0ec6f3e14525
--- /dev/null
+++ b/pkgs/by-name/um/umple/update.sh
@@ -0,0 +1,67 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl git jq nix-update
+set -euo pipefail
+
+release=$(curl -s ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} https://api.github.com/repos/umple/umple/releases/latest)
+latestTag=$(echo "$release" | jq -r '.tag_name')
+latestVersion="${latestTag#v}"
+currentVersion=$(nix-instantiate --eval -E "with import ./. {}; umple.version or (lib.getVersion umple)" | tr -d '"')
+echo "Current version: $currentVersion"
+echo "Latest version: $latestVersion"
+
+if [[ "$currentVersion" = "$latestVersion" ]]; then
+  echo "Up-to-date."
+  exit
+fi
+
+echo "Updating to $latestVersion"
+
+location="$(dirname -- "${BASH_SOURCE[0]}")"
+
+# Get commit count and hash from upstream repository tag
+tmpdir=$(mktemp -d)
+trap 'rm -rf "$tmpdir"' EXIT
+
+pushd "$tmpdir"
+git clone --branch "$latestVersion" --single-branch https://github.com/umple/umple.git .
+revision=$(git rev-parse --short HEAD)
+commitCount=$(git rev-list --count HEAD)
+longVersion="$latestVersion.$commitCount.$revision"
+popd
+
+# Find the filename and hash of the latest stable Umple JAR for bootstrapping.
+# The best way to do this is to just check the prefix of release assets,
+# since the commit count + hash used don't match the release tag, for some reason.
+umpleName=$(echo "$release" | jq -r 'first(.assets[] | select(.name | startswith("umple-")) | .name)')
+if [[ -z "$umpleName" ]]; then
+  echo "Could not find Umple JAR in GitHub release assets."
+  exit 1
+fi
+
+umpleUrl="https://github.com/umple/umple/releases/download/$latestTag/$umpleName"
+umpleHash=$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 \
+  "$(nix-prefetch-url "$umpleUrl")")
+
+# Save version info
+jq -n \
+  --arg version "$latestVersion" \
+  --arg longVersion "$longVersion" \
+  --arg revision "$revision" \
+  --arg commitCount "$commitCount" \
+  --arg umpleUrl "$umpleUrl" \
+  --arg umpleHash "$umpleHash" \
+  '{
+    "umple": {
+      "version": $version,
+      "longVersion": $longVersion,
+      "revision": $revision,
+      "commitCount": $commitCount
+    },
+    "umpleJar": {
+      "url": $umpleUrl,
+      "hash": $umpleHash
+    }
+  }' > "$location/versions.json"
+
+# Version update is done; use nix-update for hashes and Gradle deps
+nix-update umple --version=skip
diff --git a/pkgs/by-name/um/umple/versions.json b/pkgs/by-name/um/umple/versions.json
new file mode 100644
index 000000000000..9ca7502961c5
--- /dev/null
+++ b/pkgs/by-name/um/umple/versions.json
@@ -0,0 +1,12 @@
+{
+  "umple": {
+    "version": "1.37.0",
+    "longVersion": "1.37.0.8543.1593c2b83",
+    "revision": "1593c2b83",
+    "commitCount": "8543"
+  },
+  "umpleJar": {
+    "url": "https://github.com/umple/umple/releases/download/v1.37.0/umple-1.37.0.8542.3a8c87689.jar",
+    "hash": "sha256-pBHHbURbe7B5A11tShvHGlSO4XMJPcdM7Iy+ph3PxAE="
+  }
+}
diff --git a/pkgs/by-name/us/usage/package.nix b/pkgs/by-name/us/usage/package.nix
index 7dfe44e304d4..07f36b5dde3e 100644
--- a/pkgs/by-name/us/usage/package.nix
+++ b/pkgs/by-name/us/usage/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "usage";
-  version = "3.5.0";
+  version = "3.5.3";
 
   src = fetchFromGitHub {
     owner = "jdx";
     repo = "usage";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ZXjOuf8xjKtFnxzrb4mU6TBae75Nyl6zGllT9orbNMY=";
+    hash = "sha256-j5aS+zjGyQhUNv59GACMwZuSpN/jBzZNbe2VoBfxF/Y=";
   };
 
-  cargoHash = "sha256-78lTRHIy1VYJP3dxljfrsMh1MXT7dyVw2yxHNrGJJk0=";
+  cargoHash = "sha256-xAENsXf/VW4nkRiXIA9DppD/PyjoU3fxu4UNPYGYTho=";
 
   postPatch = ''
     substituteInPlace ./examples/*.sh \
diff --git a/pkgs/by-name/va/vacuum-tube/package.nix b/pkgs/by-name/va/vacuum-tube/package.nix
index f88f17919e8c..18aa76fa911c 100644
--- a/pkgs/by-name/va/vacuum-tube/package.nix
+++ b/pkgs/by-name/va/vacuum-tube/package.nix
@@ -10,16 +10,16 @@
 
 buildNpmPackage rec {
   pname = "vacuum-tube";
-  version = "1.7.3";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "shy1132";
     repo = "VacuumTube";
     tag = "v${version}";
-    hash = "sha256-SHCfg8DVhhGwWR0qHzm3zKxsXPycRSJg5LDPTNKMiOY=";
+    hash = "sha256-LVsNCf0rvgWuyKEzt5b2AcwK6JdDe3ghiSOUXg7nSaA=";
   };
 
-  npmDepsHash = "sha256-IE8P7RblF6tpjQX4PrH2p4OnVq2MLwi+/7JzAcI9NvY=";
+  npmDepsHash = "sha256-hbSN5I3LG4+y0Ggkv5C1zsaLYbrFjGXiwURfc51d0Kk=";
   makeCacheWritable = true;
 
   env = {
diff --git a/pkgs/by-name/va/vault/package.nix b/pkgs/by-name/va/vault/package.nix
index 034215dbe73b..ec92e58ba9d9 100644
--- a/pkgs/by-name/va/vault/package.nix
+++ b/pkgs/by-name/va/vault/package.nix
@@ -12,16 +12,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "vault";
-  version = "1.21.4";
+  version = "2.0.3";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "vault";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-1yBvcGKzLZYFWlZJL1iJgDFkiT4g2f84iZCjWi2CwDg=";
+    hash = "sha256-s6Muogxe+jvre1qZYRiSGTDgMf0+BVsSOwyxF6+Aa2o=";
   };
 
-  vendorHash = "sha256-LxWqJroDfGqqCrTej+jkpxEO/+ipXuqSPB2R3bg2v10=";
+  vendorHash = "sha256-utF/CgWNtJNin5NIq7ZGjNc7YbjAuN5nm/G57uQal94=";
 
   proxyVendor = true;
 
diff --git a/pkgs/by-name/ve/veila/package.nix b/pkgs/by-name/ve/veila/package.nix
index 078f9bf36a0b..d56ea5fcfe96 100644
--- a/pkgs/by-name/ve/veila/package.nix
+++ b/pkgs/by-name/ve/veila/package.nix
@@ -12,17 +12,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "veila";
-  version = "0.4.2";
+  version = "0.4.3";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "naurissteins";
     repo = "Veila";
     tag = finalAttrs.version;
-    hash = "sha256-4aweH5ckOGa7T0SiU+cHd4GA4m1Iw24BiJqbTSoMj08=";
+    hash = "sha256-6b8KODC62pL0ocgcGiO4P9cwVkomFen6tn3H7QilOhc=";
   };
 
-  cargoHash = "sha256-1vbnqiK7ourVJGgRi7lprPNNwuviDuf70cl69M1PZ7A=";
+  cargoHash = "sha256-zWGVDgnL2AjgO1gdx6Ye3DX5kmy+6nzQ9ZeMHE9l/NQ=";
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/by-name/vi/vikunja-desktop/package.nix b/pkgs/by-name/vi/vikunja-desktop/package.nix
index 6c23462109d4..001c2c7c99f6 100644
--- a/pkgs/by-name/vi/vikunja-desktop/package.nix
+++ b/pkgs/by-name/vi/vikunja-desktop/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   makeWrapper,
   makeDesktopItem,
+  darwin,
   pnpm_10_29_2,
   pnpmConfigHook,
   nodejs,
@@ -52,6 +53,9 @@ stdenv.mkDerivation (finalAttrs: {
     pnpm_10_29_2
     pnpmConfigHook
     vikunja.passthru.frontend
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    darwin.autoSignDarwinBinariesHook
   ];
 
   buildPhase = ''
@@ -60,7 +64,18 @@ stdenv.mkDerivation (finalAttrs: {
     sed -i "s/\$${version}/${version}/g" package.json
     sed -i "s/\"version\": \".*\"/\"version\": \"${version}\"/" package.json
     ln -s '${vikunja.passthru.frontend}' frontend
-    pnpm run pack -c.electronDist="${electron.dist}" -c.electronVersion="${electron.version}"
+
+    electronDist="${electron.dist}"
+    ${lib.optionalString stdenv.hostPlatform.isDarwin ''
+      electronDist="$(mktemp -d)"
+      cp -R "${electron.dist}/." "$electronDist"
+      chmod -R u+w "$electronDist"
+      export CSC_IDENTITY_AUTO_DISCOVERY=false
+    ''}
+    pnpm run pack \
+      -c.electronDist="$electronDist" \
+      -c.electronVersion="${electron.version}" \
+      ${lib.optionalString stdenv.hostPlatform.isDarwin "-c.mac.identity=null"}
 
     runHook postBuild
   '';
@@ -70,20 +85,30 @@ stdenv.mkDerivation (finalAttrs: {
   installPhase = ''
     runHook preInstall
 
-    mkdir -p "$out/share/lib/vikunja-desktop"
-    cp -r ./dist/*-unpacked/{locales,resources{,.pak}} "$out/share/lib/vikunja-desktop"
-    cp -r ./node_modules "$out/share/lib/vikunja-desktop/resources"
+    ${lib.optionalString stdenv.hostPlatform.isLinux ''
+      mkdir -p "$out/share/lib/vikunja-desktop"
+      cp -r ./dist/*-unpacked/{locales,resources{,.pak}} "$out/share/lib/vikunja-desktop"
+      cp -r ./node_modules "$out/share/lib/vikunja-desktop/resources"
 
-    install -Dm644 "build/icon.png" "$out/share/icons/hicolor/256x256/apps/vikunja-desktop.png"
+      install -Dm644 "build/icon.png" "$out/share/icons/hicolor/256x256/apps/vikunja-desktop.png"
 
-    # use makeShellWrapper (instead of the makeBinaryWrapper provided by wrapGAppsHook3) for proper shell variable expansion
-    # see https://github.com/NixOS/nixpkgs/issues/172583
-    makeShellWrapper "${lib.getExe electron}" "$out/bin/vikunja-desktop" \
-      --add-flags "$out/share/lib/vikunja-desktop/resources/app.asar" \
-      "''${gappsWrapperArgs[@]}" \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=UseOzonePlatform,WaylandWindowDecorations,WebRTCPipeWireCapturer}}" \
-      --set-default ELECTRON_IS_DEV 0 \
-      --inherit-argv0
+      # use makeShellWrapper (instead of the makeBinaryWrapper provided by wrapGAppsHook3) for proper shell variable expansion
+      # see https://github.com/NixOS/nixpkgs/issues/172583
+      makeShellWrapper "${lib.getExe electron}" "$out/bin/vikunja-desktop" \
+        --add-flags "$out/share/lib/vikunja-desktop/resources/app.asar" \
+        "''${gappsWrapperArgs[@]}" \
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=UseOzonePlatform,WaylandWindowDecorations,WebRTCPipeWireCapturer}}" \
+        --set-default ELECTRON_IS_DEV 0 \
+        --inherit-argv0
+    ''}
+
+    ${lib.optionalString stdenv.hostPlatform.isDarwin ''
+      mkdir -p "$out/Applications" "$out/bin"
+      mv ./dist/mac*/*.app "$out/Applications"
+      makeWrapper \
+        "$out/Applications/Vikunja Desktop.app/Contents/MacOS/Vikunja Desktop" \
+        "$out/bin/vikunja-desktop"
+    ''}
 
     runHook postInstall
   '';
diff --git a/pkgs/by-name/vi/vivaldi/package.nix b/pkgs/by-name/vi/vivaldi/package.nix
index de2af51620bc..f1f08fc50e47 100644
--- a/pkgs/by-name/vi/vivaldi/package.nix
+++ b/pkgs/by-name/vi/vivaldi/package.nix
@@ -67,7 +67,7 @@
 
 stdenv.mkDerivation rec {
   pname = "vivaldi";
-  version = "8.0.4033.50";
+  version = "8.0.4033.54";
 
   suffix =
     {
@@ -80,8 +80,8 @@ stdenv.mkDerivation rec {
     url = "https://downloads.vivaldi.com/stable/vivaldi-stable_${version}-1_${suffix}.deb";
     hash =
       {
-        aarch64-linux = "sha256-5n5+DY03lRDKLWX/WPX17Wg7IeTl4MDKEWOZEYHaPDE=";
-        x86_64-linux = "sha256-IVytlw5NzxV1TwLHeX81AgWEHHVzksVC3a0S/WuWEaA=";
+        aarch64-linux = "sha256-i2FAMp3MFsnXTjQoF4Y/BuB6j+x3ugfsu0ePGI/h5Po=";
+        x86_64-linux = "sha256-a4ZLX/DpygZgPPjt4BQxTuRbFoPmNuRgdZFiI6UclQI=";
       }
       .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
diff --git a/pkgs/by-name/wa/wasilibc/0000-relax-version-bounds.patch b/pkgs/by-name/wa/wasilibc/0000-relax-version-bounds.patch
new file mode 100644
index 000000000000..3a11547a763e
--- /dev/null
+++ b/pkgs/by-name/wa/wasilibc/0000-relax-version-bounds.patch
@@ -0,0 +1,39 @@
+Commit ID: bf0251709e0440ff00036298d94177a72382979d
+Change ID: nukukykqkzqunwukokzxwlxrpxptuwzm
+Author   : Sam Pointon <sampointon@gmail.com> (2026-06-17 09:26:00)
+Committer: Sam Pointon <sampointon@gmail.com> (2026-06-17 09:27:26)
+
+    Relax strict version bounds on tools
+
+    Nixpkgs has more recent versions of these, and they work fine.
+
+diff --git a/cmake/bindings.cmake b/cmake/bindings.cmake
+index a629ecd006..14fdb8aed3 100644
+--- a/cmake/bindings.cmake
++++ b/cmake/bindings.cmake
+@@ -15,10 +15,6 @@
+     OUTPUT_VARIABLE WIT_BINDGEN_VERSION
+     OUTPUT_STRIP_TRAILING_WHITESPACE)
+ 
+-  if (NOT (WIT_BINDGEN_VERSION MATCHES "0\\.53\\.1"))
+-    message(WARNING "wit-bindgen version 0.53.1 is required, found: ${WIT_BINDGEN_VERSION}")
+-    set(WIT_BINDGEN_EXECUTABLE "")
+-  endif()
+ endif()
+ 
+ if (NOT WIT_BINDGEN_EXECUTABLE)
+diff --git a/cmake/wasi-wits.cmake b/cmake/wasi-wits.cmake
+index e21ab0258d..d72ed9bcc2 100644
+--- a/cmake/wasi-wits.cmake
++++ b/cmake/wasi-wits.cmake
+@@ -12,10 +12,6 @@
+     OUTPUT_VARIABLE WKG_VERSION
+     OUTPUT_STRIP_TRAILING_WHITESPACE)
+ 
+-  if (NOT (WKG_VERSION MATCHES "0\\.13\\.0"))
+-    message(WARNING "wkg version 0.13.0 is required, found: ${WKG_VERSION}")
+-    set(WKG_EXECUTABLE "")
+-  endif()
+ endif()
+ 
+ if (NOT WKG_EXECUTABLE)
diff --git a/pkgs/by-name/wa/wasilibc/package.nix b/pkgs/by-name/wa/wasilibc/package.nix
index 1745a80f2916..a9dcd85aed88 100644
--- a/pkgs/by-name/wa/wasilibc/package.nix
+++ b/pkgs/by-name/wa/wasilibc/package.nix
@@ -1,72 +1,78 @@
 {
   stdenvNoLibc,
+  cmake,
   fetchFromGitHub,
   lib,
+  lld,
+  llvmPackages,
+  ninja,
+  wasm-tools,
+  wit-bindgen,
+  wkg,
   firefox-unwrapped,
   firefox-esr-unwrapped,
-  enablePosixThreads ? false,
 }:
 
 stdenvNoLibc.mkDerivation (finalAttrs: {
   pname = "wasilibc";
-  version = "27";
+  version = "32";
+
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "WebAssembly";
     repo = "wasi-libc";
     tag = "wasi-sdk-${finalAttrs.version}";
-    hash = "sha256-RIjph1XdYc1aGywKks5JApcLajbNFEuWm+Wy/GMHddg=";
+    hash = "sha256-iP/SFYvO8zQMwwbY4VvIboO+Kx195L9brpMq8cbsA7c=";
     fetchSubmodules = true;
   };
 
-  # These flags break pkgsCross.wasi32.llvmPackages.libcxx
-  hardeningDisable = [
-    "libcxxhardeningfast"
-    "libcxxhardeningextensive"
+  patches = [
+    ./0000-relax-version-bounds.patch
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    lld
+    ninja
+    wasm-tools
+    wit-bindgen
+    wkg
   ];
 
   outputs = [
     "out"
     "dev"
-    "share"
   ];
 
-  # clang-13: error: argument unused during compilation: '-rtlib=compiler-rt' [-Werror,-Wunused-command-line-argument]
-  postPatch = ''
-    substituteInPlace Makefile \
-      --replace "-Werror" ""
-    patchShebangs scripts/
-  '';
-
-  preBuild = ''
-    export SYSROOT_LIB=${placeholder "out"}/lib
-    export SYSROOT_INC=${placeholder "dev"}/include
-    export SYSROOT_SHARE=${placeholder "share"}/share
-    mkdir -p "$SYSROOT_LIB" "$SYSROOT_INC" "$SYSROOT_SHARE"
-    makeFlagsArray+=(
-      "SYSROOT_LIB:=$SYSROOT_LIB"
-      "SYSROOT_INC:=$SYSROOT_INC"
-      "SYSROOT_SHARE:=$SYSROOT_SHARE"
-      "TARGET_TRIPLE:=${stdenvNoLibc.system}"
-      ${lib.strings.optionalString enablePosixThreads "THREAD_MODEL:=posix"}
-    )
-  '';
+  cmakeFlags = [
+    (lib.cmakeFeature "BUILTINS_LIB" "${llvmPackages.compiler-rt}/lib/${stdenvNoLibc.targetPlatform.parsed.kernel.name}/libclang_rt.builtins-wasm32.a")
+    #https://stackoverflow.com/questions/53633705/cmake-the-c-compiler-is-not-able-to-compile-a-simple-test-program
+    (lib.cmakeFeature "CMAKE_TRY_COMPILE_TARGET_TYPE" "STATIC_LIBRARY")
+    (lib.cmakeFeature "TARGET_TRIPLE" stdenvNoLibc.system)
+    # clang already knows to use wasm-component-ld to link
+    (lib.cmakeFeature "USE_WASM_COMPONENT_LD" "OFF")
+  ];
 
   enableParallelBuilding = true;
 
-  # We just build right into the install paths, per the `preBuild`.
-  dontInstall = true;
+  preFixup =
+    lib.optionalString (stdenvNoLibc.system != stdenvNoLibc.targetPlatform.rust.rustcTargetSpec)
+      ''
+        ln -s $out/lib/${stdenvNoLibc.system} $out/lib/${stdenvNoLibc.targetPlatform.rust.rustcTargetSpec}
+      '';
 
-  preFixup = ''
-    ln -s $share/share/undefined-symbols.txt $out/lib/wasi.imports
-    ln -s $out/lib $out/lib/${stdenvNoLibc.system}
-  ''
-  + lib.optionalString (stdenvNoLibc.system != stdenvNoLibc.targetPlatform.rust.rustcTargetSpec) ''
-    ln -s $out/lib $out/lib/${stdenvNoLibc.targetPlatform.rust.rustcTargetSpec}
-  '';
+  # TODO: run wasilibc tests. Nixpkgs never runs the check phase during cross compiles
+  # (sensibly), but this package is always cross compiled due to its nature, and the tests
+  # expect to be run in a cross-compilation environment. There are instructions on how to run
+  # them but I don't understand enough about Nixpkgs' CMake set-up to work out how to apply them.
 
-  passthru.tests = {
-    inherit firefox-unwrapped firefox-esr-unwrapped;
+  passthru = {
+    incdir = "/include/${stdenvNoLibc.system}";
+    libdir = "/lib/${stdenvNoLibc.system}";
+    tests = {
+      inherit firefox-unwrapped firefox-esr-unwrapped;
+    };
   };
 
   meta = {
diff --git a/pkgs/by-name/wa/wasm-component-ld/package.nix b/pkgs/by-name/wa/wasm-component-ld/package.nix
new file mode 100644
index 000000000000..ccc96dd71141
--- /dev/null
+++ b/pkgs/by-name/wa/wasm-component-ld/package.nix
@@ -0,0 +1,40 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "wasm-component-ld";
+  version = "0.5.25";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "bytecodealliance";
+    repo = "wasm-component-ld";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-EQqNm3GRuMafbrOyzsdZ5e1pX4LH40wCyKVgSgm8A48=";
+  };
+
+  cargoHash = "sha256-1e54TLWGjfNORwr6uLIe/XhdDDOkbalw/6/0UGuBiPk=";
+
+  # Tests require a rustc that can target wasm32-wasip1, including std. This is awkward for
+  # Nixpkgs to provide at the same time as providing a rustc that's targetting the actual target.
+  # TODO: work around by patching the test suite to invoke pkgsBuildTarget.rustc rather than just looking in PATH for any old rustc
+  doCheck = false;
+
+  meta = {
+    description = "Command line linker for creating WebAssembly components";
+    homepage = "https://github.com/bytecodealliance/wasm-component-ld";
+    license = with lib.licenses; [
+      asl20
+      llvm-exception
+      mit
+    ];
+    maintainers = with lib.maintainers; [
+      sepointon
+    ];
+    mainProgram = "wasm-component-ld";
+  };
+})
diff --git a/pkgs/by-name/wa/wasmer/package.nix b/pkgs/by-name/wa/wasmer/package.nix
index 263cfc2a7422..3ed828198893 100644
--- a/pkgs/by-name/wa/wasmer/package.nix
+++ b/pkgs/by-name/wa/wasmer/package.nix
@@ -10,7 +10,7 @@
   curl,
   writeShellApplication,
   installShellFiles,
-  llvmPackages_21,
+  llvmPackages_22,
   libffi,
   libxml2,
   fixDarwinDylibNames,
@@ -20,26 +20,26 @@
 }:
 
 let
-  v8Version = "11.9.2";
+  v8Version = "11.9.7";
 
   # Prebuilt V8 from wasmerio's custom builds, only evaluated when withV8 = true.
 
   # Per-platform hashes, auto-updated via the general updateScript
   v8Hashes = {
-    "v8-linux-amd64.tar.xz" = "sha256-nTCVdBKtyVMb7lE+Db4RDsShKkLbG/0r980ejd+EAvo=";
-    "v8-linux-musl-amd64.tar.xz" = "sha256-XgRs3I46B2PG7Jrv5E+KSeuNfXLhgB7R66cAkA/Bvv8=";
-    "v8-darwin-arm64.tar.xz" = "sha256-xAG1PcAGw8a0A9k8d78/whTUXnqdfRZBz8yrg/+iz0M=";
+    "v8-linux-amd64.tar.xz" = "sha256-VOGZOKA07neIixDPJ3BLGeMX37/o9o16X4rYlo/nMbo=";
+    "v8-linux-musl.tar.xz" = "sha256-drD0YfCA56zej5PFR1olfdUMOOlgYo8LGbxWEJ1NusY=";
+    "v8-darwin-aarch64.tar.xz" = "sha256-Vk0ys6MjHSa8Gjd7XN0Jj4gyxORU0yP7hEmYk1ENeq4=";
   };
 
   v8Prebuilt =
     let
       assetName =
         if stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isx86_64 && stdenv.hostPlatform.isMusl then
-          "v8-linux-musl-amd64.tar.xz"
+          "v8-linux-musl.tar.xz"
         else if stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isx86_64 then
           "v8-linux-amd64.tar.xz"
         else if stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64 then
-          "v8-darwin-arm64.tar.xz"
+          "v8-darwin-aarch64.tar.xz"
         else
           throw "withV8 = true is not supported on ${stdenv.hostPlatform.system}";
     in
@@ -61,7 +61,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wasmer";
-  version = "7.1.0";
+  version = "7.2.0";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -70,13 +70,13 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "wasmerio";
     repo = "wasmer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-A1SkZY+iSR9xlu6R1p9uZYsGFPAOifuYTHtEXaEgves=";
+    hash = "sha256-HiMxBABLkX0i5jGowZU7dWhW46hvtcvbX7rskL3i+iY=";
     fetchSubmodules = true;
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-wBEwGKjj9DdZESFlXS8T7B0Xdp7yMe08DYTGr4wnTVI=";
+    hash = "sha256-+O/JbgozCHF/QBABMtxqkGFQYtAQwu6OUDoD5EZZmXs=";
   };
 
   nativeBuildInputs = [
@@ -89,42 +89,34 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
 
   buildInputs = lib.optionals withLLVM [
-    llvmPackages_21.llvm
+    llvmPackages_22.llvm
     libffi
     libxml2
   ];
 
   postPatch =
-    # In 7.1.0 there is no nice flag to toggle napi/v8 on or off,
-    # so we manually delete the Makefile entry when we don't want v8
-    # TODO: v7.2.0 pre-release has a flag, when updating to 7.2.0
-    #  add "ENABLE_NAPI_V8=${if withV8 then "1" else "0"}" to makeFlags
-    lib.optionalString (!withV8) ''
-      substituteInPlace Makefile \
-        --replace-fail '	build_wasmer_extra_features += napi-v8' ""
-    ''
-    +
-      lib.optionalString stdenv.hostPlatform.isDarwin
-        # `install -Dm644 /dev/stdin DEST` fails on darwin with
-        # "skipping file '/dev/stdin', as it was replaced while being copied".
-        (
-          ''
-            substituteInPlace Makefile \
-              --replace-fail 'echo "$$pc" | install -Dm644 /dev/stdin "$(DESTDIR)"/lib/pkgconfig/wasmer.pc;' \
-                             'mkdir -p "$(DESTDIR)/lib/pkgconfig" && printf "%s\n" "$$pc" > "$(DESTDIR)/lib/pkgconfig/wasmer.pc";'
-          ''
-          # install-capi-lib hardcodes libwasmer.so and a Linux SONAME symlink chain
-          # (also marked Linux only in the Makefile)
-          + ''
-            substituteInPlace Makefile \
-              --replace-fail 'install-capi-lib ' ""
-          ''
-        );
+    lib.optionalString stdenv.hostPlatform.isDarwin
+      # `install -Dm644 /dev/stdin DEST` fails on darwin with
+      # "skipping file '/dev/stdin', as it was replaced while being copied".
+      (
+        ''
+          substituteInPlace Makefile \
+            --replace-fail 'echo "$$pc" | install -Dm644 /dev/stdin "$(DESTDIR)"/lib/pkgconfig/wasmer.pc;' \
+                           'mkdir -p "$(DESTDIR)/lib/pkgconfig" && printf "%s\n" "$$pc" > "$(DESTDIR)/lib/pkgconfig/wasmer.pc";'
+        ''
+        # install-capi-lib hardcodes libwasmer.so and a Linux SONAME symlink chain
+        # (also marked Linux only in the Makefile)
+        + ''
+          substituteInPlace Makefile \
+            --replace-fail 'install-capi-lib ' ""
+        ''
+      );
 
   makeFlags = [
     "WASMER_INSTALL_PREFIX=${placeholder "out"}"
     "DESTDIR=${placeholder "out"}"
     "ENABLE_LLVM=${if withLLVM then "1" else "0"}"
+    "ENABLE_NAPI_V8=${if withV8 then "1" else "0"}"
   ];
 
   # Default all target includes headless C API which doesn't get installed
@@ -136,7 +128,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   env =
     lib.optionalAttrs withLLVM {
-      LLVM_SYS_211_PREFIX = llvmPackages_21.llvm.dev;
+      LLVM_SYS_221_PREFIX = llvmPackages_22.llvm.dev;
     }
     // lib.optionalAttrs withV8 {
       # build.rs skips the download when these are set; see resolve_explicit_v8 in lib/napi/build.rs
diff --git a/pkgs/by-name/wa/wasmer/update.sh b/pkgs/by-name/wa/wasmer/update.sh
index 7729a17c0a4b..ef789b9bf286 100644
--- a/pkgs/by-name/wa/wasmer/update.sh
+++ b/pkgs/by-name/wa/wasmer/update.sh
@@ -1,9 +1,20 @@
-old_version=$(grep -oP '^  version = "\K[^"]+(?=";)' pkgs/by-name/wa/wasmer/package.nix)
+set -euo pipefail
+
+pkg=pkgs/by-name/wa/wasmer/package.nix
+
+die() {
+  echo "update-wasmer: error: $*" >&2
+  exit 1
+}
+
+[ -f "$pkg" ] || die "cannot find $pkg (run from the nixpkgs root)"
+
+old_version=$(grep -oP '^  version = "\K[^"]+(?=";)' "$pkg")
 echo "Current wasmer version: $old_version"
 
 nix-update wasmer "$@"
 
-new_version=$(grep -oP '^  version = "\K[^"]+(?=";)' pkgs/by-name/wa/wasmer/package.nix)
+new_version=$(grep -oP '^  version = "\K[^"]+(?=";)' "$pkg")
 if [ "$old_version" = "$new_version" ]; then
   echo "Already at $old_version, nothing to do"
   exit 0
@@ -14,10 +25,16 @@ echo "Updated wasmer $old_version -> $new_version"
 # lib/napi is a submodule, so resolve its pinned SHA first, then fetch build.rs from that repo.
 echo "Fetching PREBUILT_V8_VERSION from lib/napi/build.rs..."
 napi_sha=$(curl -fsSL "https://api.github.com/repos/wasmerio/wasmer/contents/lib/napi?ref=v${new_version}" \
-           | grep -oP '"sha":\s*"\K[^"]+' | head -1)
+           | grep -oP '"sha":\s*"\K[^"]+' | head -1) \
+  || die "failed to query lib/napi submodule SHA for v${new_version} (does the tag exist?)"
+[ -n "$napi_sha" ] || die "could not resolve lib/napi submodule SHA for v${new_version}"
+
 new_v8=$(curl -fsSL "https://raw.githubusercontent.com/wasmerio/napi/${napi_sha}/build.rs" \
-         | grep -oP 'PREBUILT_V8_VERSION\s*:\s*&str\s*=\s*"\K[^"]+')
-cur_v8=$(grep -oP '^  v8Version = "\K[^"]+(?=";)' pkgs/by-name/wa/wasmer/package.nix)
+         | grep -oP 'PREBUILT_V8_VERSION\s*:\s*&str\s*=\s*"\K[^"]+') \
+  || die "failed to fetch build.rs from wasmerio/napi@${napi_sha}"
+[ -n "$new_v8" ] || die "could not parse PREBUILT_V8_VERSION from wasmerio/napi@${napi_sha}/build.rs (format may have changed)"
+
+cur_v8=$(grep -oP '^  v8Version = "\K[^"]+(?=";)' "$pkg")
 echo "V8: current=$cur_v8, required=$new_v8"
 
 if [ "$new_v8" = "$cur_v8" ]; then
@@ -25,25 +42,35 @@ if [ "$new_v8" = "$cur_v8" ]; then
   exit 0
 fi
 
-echo "V8 bumped $cur_v8 -> $new_v8, fetching hashes for all platforms..."
-sed -i "s|^  v8Version = \"[^\"]*\";$|  v8Version = \"$new_v8\";|" \
-  pkgs/by-name/wa/wasmer/package.nix
+# The asset filenames live in the v8Hashes attrset (also referenced by the
+# assetName mapping below it). Treat package.nix as the single source of truth
+# so this list can never drift from what the derivation actually fetches.
+mapfile -t assets < <(grep -oP '^\s*"\Kv8-[^"]+\.tar\.xz(?=" = "sha256)' "$pkg")
+[ "${#assets[@]}" -gt 0 ] || die "found no v8 assets in the v8Hashes attrset of $pkg"
+
+echo "V8 bumped $cur_v8 -> $new_v8, fetching hashes for ${#assets[@]} platform(s)..."
+sed -i "s|^  v8Version = \"[^\"]*\";$|  v8Version = \"$new_v8\";|" "$pkg"
 
 base="https://github.com/wasmerio/v8-custom-builds/releases/download/$new_v8"
-declare -A assets=(
-  ["v8-linux-amd64.tar.xz"]="$base/v8-linux-amd64.tar.xz"
-  ["v8-linux-musl-amd64.tar.xz"]="$base/v8-linux-musl-amd64.tar.xz"
-  ["v8-darwin-arm64.tar.xz"]="$base/v8-darwin-arm64.tar.xz"
-)
-
-for asset in "${!assets[@]}"; do
-  url="${assets[$asset]}"
+for asset in "${assets[@]}"; do
+  url="$base/$asset"
   echo "  Fetching hash for $asset..."
-  hash=$(nix-prefetch-url --type sha256 "$url" 2>/dev/null \
-         | xargs nix hash convert --hash-algo sha256 --to sri)
+  # Do not suppress errors here: a 404 usually means upstream renamed the asset
+  # between releases (e.g. v8-darwin-arm64 -> v8-darwin-aarch64), in which case
+  # the asset key in package.nix must be updated by hand before this can work.
+  if ! raw=$(nix-prefetch-url --type sha256 "$url"); then
+    die "could not download $url
+    The asset may have been renamed in the $new_v8 release. Check
+      https://github.com/wasmerio/v8-custom-builds/releases/tag/$new_v8
+    and update the v8Hashes keys and the assetName mapping in $pkg to match,
+    then re-run this script."
+  fi
+  hash=$(nix hash convert --hash-algo sha256 --to sri "$raw") \
+    || die "failed to convert hash for $asset ($raw)"
   echo "  $asset -> $hash"
-  sed -i "s|\"$asset\" = \"[^\"]*\"|\"$asset\" = \"$hash\"|" \
-    pkgs/by-name/wa/wasmer/package.nix
+  sed -i "s|\"$asset\" = \"[^\"]*\"|\"$asset\" = \"$hash\"|" "$pkg"
+  grep -qF "\"$asset\" = \"$hash\"" "$pkg" \
+    || die "failed to write hash for $asset into $pkg (pattern did not match)"
 done
 
 echo "Done"
diff --git a/pkgs/by-name/we/webwormhole/package.nix b/pkgs/by-name/we/webwormhole/package.nix
index 45b53957b34f..45e0fe8f204b 100644
--- a/pkgs/by-name/we/webwormhole/package.nix
+++ b/pkgs/by-name/we/webwormhole/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule {
   pname = "webwormhole";
-  version = "0-unstable-2023-11-15";
+  version = "0-unstable-2025-12-22";
 
   src = fetchFromGitHub {
     owner = "saljam";
     repo = "webwormhole";
-    rev = "6ceee76274ee881e828bd48c5cc15c758b9ad77c";
-    hash = "sha256-C9r6wFhP5BkIClgTQol7LyMUHXOzyrX9Pn91VqBaqFQ=";
+    rev = "abf852af0458ba79772d9c26ef01434165f217d8";
+    hash = "sha256-hP5MtIoGod3FS4TipNkgoyo43HWnywPintqpjmvrTc8=";
   };
 
-  vendorHash = "sha256-+7ctAm2wnjmfMd6CHXlcAUwiUMS7cH4koDAvlEUAXEg=";
+  vendorHash = "sha256-ULlaicl4o/YyHSS64Q2hsl5l5Mm3C6cBG8zaxrEijOU=";
 
   meta = {
     description = "Send files using peer authenticated WebRTC";
diff --git a/pkgs/by-name/wh/whatsapp-emoji-font/package.nix b/pkgs/by-name/wh/whatsapp-emoji-font/package.nix
index 877bba8f7c6d..eb0a1a257e85 100644
--- a/pkgs/by-name/wh/whatsapp-emoji-font/package.nix
+++ b/pkgs/by-name/wh/whatsapp-emoji-font/package.nix
@@ -12,13 +12,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "whatsapp-emoji-linux";
-  version = "2.25.9.78-3";
+  version = "2.26.8.72-1";
 
   src = fetchFromGitHub {
     tag = version;
     owner = "dmlls";
     repo = "whatsapp-emoji-linux";
-    hash = "sha256-IP8zWFttr7Osy8rrTLL0bTrdEMLvTNjuadZ2ksfTViw=";
+    hash = "sha256-72qqW68kmAqm2+Z5ldWMHEJL8LXpE93A32VsmW+dbY8=";
   };
 
   makeFlags = [
diff --git a/pkgs/by-name/wp/wp-scanner/package.nix b/pkgs/by-name/wp/wp-scanner/package.nix
new file mode 100644
index 000000000000..ea61d89e93ad
--- /dev/null
+++ b/pkgs/by-name/wp/wp-scanner/package.nix
@@ -0,0 +1,56 @@
+{
+  lib,
+  fetchFromGitHub,
+  nix-update-script,
+  python3,
+}:
+
+python3.pkgs.buildPythonApplication (finalAttrs: {
+  pname = "wp-scanner";
+  version = "2.0.1-unstable-2026-03-17";
+  pyproject = false;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "Triotion";
+    repo = "WP-Scanner";
+    rev = "1f75728384ca5422f69cf5f1d0a284c36b0ed45a";
+    hash = "sha256-gIfOxoiVdRKa2GGDy9GMi7+6u2Lh/yVdin/hY9lh4bs=";
+  };
+
+  dependencies = with python3.pkgs; [
+    beautifulsoup4
+    colorama
+    lxml
+    packaging
+    python-dateutil
+    requests
+    tqdm
+    urllib3
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -vD wp_scanner.py $out/bin/wp-scanner
+    install -vd $out/${python3.sitePackages}/
+    cp -R data modules $out/${python3.sitePackages}
+
+    runHook postInstall
+  '';
+
+  # Project has no tests
+  doCheck = false;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Wordpress Security Scanner and Auto Exploiter";
+    homepage = "https://github.com/Triotion/WP-Scanner";
+    # https://github.com/Triotion/WP-Scanner/issues/2
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "wp-scanner";
+  };
+})
diff --git a/pkgs/by-name/wx/wxmaxima/package.nix b/pkgs/by-name/wx/wxmaxima/package.nix
index f26b0512c6d2..b2bf7cc85c54 100644
--- a/pkgs/by-name/wx/wxmaxima/package.nix
+++ b/pkgs/by-name/wx/wxmaxima/package.nix
@@ -6,24 +6,25 @@
   cmake,
   gettext,
   maxima,
-  wxwidgets_3_2,
+  # Supports also wxwidgets_3_2
+  wxwidgets_3_3,
   adwaita-icon-theme,
   glib,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wxmaxima";
-  version = "26.06.2";
+  version = "26.07.0";
 
   src = fetchFromGitHub {
     owner = "wxMaxima-developers";
     repo = "wxmaxima";
     rev = "Version-${finalAttrs.version}";
-    hash = "sha256-BehuFRofeU3k7hmdAM6b1gRuxQBhvonvPtTyW3gauV0=";
+    hash = "sha256-rrXYSW3PU4CvtmBH0dU/sBwe1sVel9IkI89HTj0YEqc=";
   };
 
   buildInputs = [
-    wxwidgets_3_2
+    wxwidgets_3_3
     maxima
     # So it won't embed svg files into headers.
     adwaita-icon-theme
@@ -38,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   cmakeFlags = [
-    "-DwxWidgets_LIBRARIES=${wxwidgets_3_2}/lib"
+    "-DwxWidgets_LIBRARIES=${wxwidgets_3_3}/lib"
   ];
 
   preConfigure = ''
diff --git a/pkgs/by-name/xa/xaos/package.nix b/pkgs/by-name/xa/xaos/package.nix
index ff631444d357..dae3ccd98241 100644
--- a/pkgs/by-name/xa/xaos/package.nix
+++ b/pkgs/by-name/xa/xaos/package.nix
@@ -12,10 +12,9 @@ in
 stdenv.mkDerivation (finalAttrs: {
   pname = "xaos";
   version = "4.3.5";
-  outputs = [
-    "out"
-    "man"
-  ];
+
+  __structuredAttrs = true;
+  strictDeps = true;
 
   src = fetchFromGitHub {
     owner = "xaos-project";
@@ -45,23 +44,20 @@ stdenv.mkDerivation (finalAttrs: {
   postPatch = ''
     substituteInPlace src/include/config.h \
       --replace-fail "/usr/share/XaoS" "${datapath}"
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    substituteInPlace XaoS.pro \
+      --replace-fail \
+        "QMAKE_APPLE_DEVICE_ARCHS = x86_64 arm64" \
+        "QMAKE_APPLE_DEVICE_ARCHS = ${if stdenv.hostPlatform.isAarch64 then "arm64" else "x86_64"}"
   '';
 
   desktopItems = [ "xdg/xaos.desktop" ];
 
-  installPhase = ''
-    runHook preInstall
-
-    install -D bin/xaos "$out/bin/xaos"
-
+  postInstall = ''
     mkdir -p "${datapath}"
     cp -r tutorial examples catalogs "${datapath}"
-
     install -D "xdg/xaos.png" "$out/share/icons/xaos.png"
-
-    install -D doc/xaos.6 "$man/man6/xaos.6"
-
-    runHook postInstall
   '';
 
   meta = finalAttrs.src.meta // {
@@ -69,7 +65,7 @@ stdenv.mkDerivation (finalAttrs: {
     mainProgram = "xaos";
     homepage = "https://xaos-project.github.io/";
     license = lib.licenses.gpl2Plus;
-    platforms = [ "x86_64-linux" ];
+    platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ coolcuber ];
   };
 })
diff --git a/pkgs/by-name/xl/xlights/package.nix b/pkgs/by-name/xl/xlights/package.nix
index 547ea042748a..450c28ea209e 100644
--- a/pkgs/by-name/xl/xlights/package.nix
+++ b/pkgs/by-name/xl/xlights/package.nix
@@ -13,6 +13,16 @@ appimageTools.wrapType2 rec {
     hash = "sha256-kTJD2xeclNApeSo1ALNI/XAwDY8tsBO0eMMQurtRF/M=";
   };
 
+  appimageContents = appimageTools.extract { inherit pname version src; };
+
+  extraInstallCommands = ''
+    install -m 444 -D ${appimageContents}/xlights.desktop $out/share/applications/xlights.desktop
+    install -m 444 -D ${appimageContents}/usr/share/icons/hicolor/256x256/apps/xlights.png \
+      $out/share/icons/hicolor/256x256/apps/xlights.png
+    substituteInPlace $out/share/applications/xlights.desktop \
+      --replace-fail 'Exec=xLights' 'Exec=xlights'
+  '';
+
   meta = {
     description = "Sequencer for lights with USB and E1.31 drivers";
     homepage = "https://xlights.org";
diff --git a/pkgs/by-name/yo/youtubedr/package.nix b/pkgs/by-name/yo/youtubedr/package.nix
new file mode 100644
index 000000000000..cdb3023f698f
--- /dev/null
+++ b/pkgs/by-name/yo/youtubedr/package.nix
@@ -0,0 +1,70 @@
+{
+  lib,
+  buildGoModule,
+  versionCheckHook,
+  fetchFromGitHub,
+}:
+
+let
+  # Disabled because tests rely on network requests
+  disabledTests = [
+    "TestTranscript"
+    "TestSimpleTest"
+    "TestGetPlaylist"
+    "TestGetBigPlaylist"
+    "TestDownload_SensitiveContent"
+    "TestGetVideo_MultiLanguage"
+    "TestParseVideo"
+    "TestParse_PublishDate"
+    "TestDownload_WhenPlayabilityStatusIsNotOK"
+    "TestDownload_Regular"
+    "TestYoutube_GetItagInfo"
+    "TestClient_httpGetBodyBytes"
+    "TestClient_httpGetBodyBytes"
+    "TestGetStream"
+    "TestGetVideoWithManifestURL"
+    "TestWebClientGetVideoWithoutManifestURL"
+    "TestGetVideoWithoutManifestURL"
+    "TestClient_httpGetBodyBytes"
+    "TestDownload_FirstStream"
+  ];
+in
+buildGoModule (finalAttrs: {
+  pname = "youtubedr";
+  version = "2.10.6";
+
+  src = fetchFromGitHub {
+    owner = "kkdai";
+    repo = "youtube";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-rkkqLBH4P5DMrbfsZwVgBjnQG1/fHdjVL4mU6amYUxM=";
+  };
+
+  __structuredAttrs = true;
+
+  vendorHash = "sha256-DIdDDS8U4UR3ZPmwqrhsOfejUJ4UHmwcr4JCpjkwOzs=";
+
+  ldflags = [
+    "-X main.version=${finalAttrs.version}"
+  ];
+
+  checkFlags = [
+    "-skip=${lib.concatStringsSep "|" disabledTests}"
+  ];
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+
+  versionCheckProgramArg = "version";
+  versionCheckKeepEnvironment = [ "HOME" ];
+  doInstallCheck = true;
+
+  meta = {
+    homepage = "https://github.com/kkdai/youtube";
+    description = "YouTube video download CLI";
+    mainProgram = "youtubedr";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.ligerothetiger ];
+  };
+})
diff --git a/pkgs/by-name/ys/yscan/package.nix b/pkgs/by-name/ys/yscan/package.nix
new file mode 100644
index 000000000000..287154072164
--- /dev/null
+++ b/pkgs/by-name/ys/yscan/package.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  fetchpatch2,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "yscan";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "yetidevworks";
+    repo = "yscan";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-dIRtqn6vismwgQUwfK5KzApBDBlAmOt+mfdBY8sr47g=";
+  };
+
+  __structuredAttrs = true;
+
+  cargoPatches = [
+    # https://github.com/yetidevworks/yscan/pull/2
+    (fetchpatch2 {
+      name = "cargo-lock.patch";
+      url = "https://github.com/yetidevworks/yscan/commit/54c0d9f008e0a9205ff639db8223c0a89fe72f34.patch?full_index=1";
+      hash = "sha256-n1JthKGLAS+Rx4BiLNwtRNZ4NHpS0Azv6uThjQgWqJg=";
+    })
+  ];
+
+  cargoHash = "sha256-nQV0vtx2hwKxysSHNB6j9d6JSuFlFFqtZr2hPciyo40=";
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  doInstallCheck = true;
+
+  meta = {
+    description = "TUI IP and Port Scanner";
+    homepage = "https://github.com/yetidevworks/yscan";
+    changelog = "https://github.com/yetidevworks/yscan/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "yscan";
+  };
+})
diff --git a/pkgs/by-name/ze/zed-wakatime-ls/package.nix b/pkgs/by-name/ze/zed-wakatime-ls/package.nix
new file mode 100644
index 000000000000..b0f77399e259
--- /dev/null
+++ b/pkgs/by-name/ze/zed-wakatime-ls/package.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "zed-wakatime-ls";
+  version = "0.1.10";
+
+  src = fetchFromGitHub {
+    owner = "wakatime";
+    repo = "zed-wakatime";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Jmm+eRHMNBkc6ZzadvkWrfsb+bwEBNM0fnXU4dJ0NgE=";
+  };
+
+  buildAndTestSubdir = "wakatime-ls";
+
+  cargoHash = "sha256-x2axmHinxYZ2VEddeCTqMJd8ok0KgAVdUhbWaOdRA30=";
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  __structuredAttrs = true;
+
+  meta = {
+    description = "WakaTime language server for Zed";
+    longDescription = ''
+      Usage: Add "zed-wakatime-ls" to programs.zed-editor.extraPackages in home-manager or globally
+      in home.packages or environment.systemPackages to allow the Zed WakaTime extension to find and
+      run the language server.
+    '';
+    homepage = "https://github.com/wakatime/zed-wakatime";
+    changelog = "https://github.com/wakatime/zed-wakatime/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ krishnans2006 ];
+    mainProgram = "wakatime-ls";
+  };
+})
diff --git a/pkgs/by-name/ze/zennotes-desktop/package.nix b/pkgs/by-name/ze/zennotes-desktop/package.nix
new file mode 100644
index 000000000000..4264cd2d426c
--- /dev/null
+++ b/pkgs/by-name/ze/zennotes-desktop/package.nix
@@ -0,0 +1,96 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  makeDesktopItem,
+  copyDesktopItems,
+  electron_41,
+  makeBinaryWrapper,
+  nix-update-script,
+
+  installCli ? false,
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "zennotes-desktop";
+  version = "2.8.0";
+  npmDepsHash = "sha256-4YEBo/8HIMcvlj36ACv5r9iN995/QX2mc6vwTZh4AV8=";
+
+  src = fetchFromGitHub {
+    owner = "ZenNotes";
+    repo = "zennotes";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-cVFiL1SNMmLZQyce83hNbE7NLuTPIQqNhDaeiUkK+mo=";
+  };
+
+  npmWorkspace = "apps/desktop";
+
+  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [
+    makeBinaryWrapper
+    copyDesktopItems
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib/node_modules/zennotes-monorepo
+    cp -r . $out/lib/node_modules/zennotes-monorepo/
+
+    for icon in apps/desktop/build/icons/*.png; do
+      size="$(basename "$icon" .png)"
+      install -Dm644 $icon $out/share/icons/hicolor/$size/apps/zennotes-desktop.png
+    done
+
+    mkdir -p $out/bin
+    makeWrapper ${electron_41}/bin/electron $out/bin/zennotes-desktop \
+      --add-flags "$out/lib/node_modules/zennotes-monorepo/apps/desktop"
+
+    ${lib.optionalString installCli ''
+      makeWrapper ${electron_41}/libexec/electron/electron $out/bin/zen \
+        --set ELECTRON_RUN_AS_NODE 1 \
+        --add-flags "$out/lib/node_modules/zennotes-monorepo/apps/desktop/out/main/cli.js"
+    ''}
+
+    runHook postInstall
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "zennotes-desktop";
+      desktopName = "ZenNotes";
+      exec = "zennotes-desktop %U";
+      icon = "zennotes-desktop";
+      comment = "Keyboard-first local Markdown notes";
+      categories = [
+        "Office"
+        "Utility"
+        "TextEditor"
+      ];
+      startupWMClass = "ZenNotes";
+      mimeTypes = [
+        "text/markdown"
+        "x-scheme-handler/zennotes"
+      ];
+    })
+  ];
+
+  passthru.updateScript = nix-update-script { extraArgs = [ "--use-github-releases" ]; };
+
+  meta = {
+    description = "Keyboard-first local Markdown notes with Vim motions, diagrams, and MCP integration";
+    homepage = "https://zennotes.org/";
+    changelog = "https://github.com/ZenNotes/zennotes/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      justkrysteq
+      Br1ght0ne
+    ];
+    mainProgram = "zennotes-desktop";
+    platforms = lib.platforms.darwin ++ lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/zi/zigbee2mqtt/package.nix b/pkgs/by-name/zi/zigbee2mqtt/package.nix
index 8311c4f3ba47..ddf527f7b93e 100644
--- a/pkgs/by-name/zi/zigbee2mqtt/package.nix
+++ b/pkgs/by-name/zi/zigbee2mqtt/package.nix
@@ -14,20 +14,20 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "zigbee2mqtt";
-  version = "2.12.0";
+  version = "2.12.1";
 
   src = fetchFromGitHub {
     owner = "Koenkk";
     repo = "zigbee2mqtt";
     tag = finalAttrs.version;
-    hash = "sha256-R5r8aJmIF3FLc4+wESLoNw+xeE6ixSYy2xcg1gIX2YA=";
+    hash = "sha256-DTL27AcPmAI5XEEHb2S74LYWm4f6kUASsTmQeGftDzM=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_10;
     fetcherVersion = 4;
-    hash = "sha256-/cNV0PHxoR8P7JXSArPq2hziQnwH5n858SzQhktvXus=";
+    hash = "sha256-RI6tz8pyqYg/L6wSc0Rt5ZqHT8aktReyVjNgISPqKRQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/alibabacloud-ecs20140526/default.nix b/pkgs/development/python-modules/alibabacloud-ecs20140526/default.nix
index cb33051d3649..92ac4d69c58a 100644
--- a/pkgs/development/python-modules/alibabacloud-ecs20140526/default.nix
+++ b/pkgs/development/python-modules/alibabacloud-ecs20140526/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "alibabacloud-ecs20140526";
-  version = "7.8.7";
+  version = "7.9.0";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -17,7 +17,7 @@ buildPythonPackage (finalAttrs: {
   src = fetchPypi {
     pname = "alibabacloud_ecs20140526";
     inherit (finalAttrs) version;
-    hash = "sha256-78QeY9Qpcwf71EelPt0wP+KUg3foUUSynhCcn+ofbGc=";
+    hash = "sha256-m1eaDj6VLGwJwfF3Dg6nN+YISHQuY+ij7uJ1KMFKvDU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/array-api-compat/default.nix b/pkgs/development/python-modules/array-api-compat/default.nix
index da6af0b98537..2a8a22171ba5 100644
--- a/pkgs/development/python-modules/array-api-compat/default.nix
+++ b/pkgs/development/python-modules/array-api-compat/default.nix
@@ -24,14 +24,14 @@
 
 buildPythonPackage rec {
   pname = "array-api-compat";
-  version = "1.13";
+  version = "1.14";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "data-apis";
     repo = "array-api-compat";
     tag = version;
-    hash = "sha256-4ZoYtqkY/xPRyBP1xeMR80zMfwiaKtXX/3XzqiweCtc=";
+    hash = "sha256-Dhiq6GWxVm9BEeO81VSa3L644gp00LxFPJAliz8LbAE=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index 604908d6d0ab..6360263fefa4 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -358,13 +358,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "boto3-stubs";
-  version = "1.43.37";
+  version = "1.43.39";
   pyproject = true;
 
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit (finalAttrs) version;
-    hash = "sha256-Fr5uizegW2n+8iLKxmBJwnYhr+6zlpvI7uBMcdZ/rtU=";
+    hash = "sha256-PzXmBl1uo+oNEuh1PFJ3BDqQiPRjL7vzF8DE9eBx5mM=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/cashews/default.nix b/pkgs/development/python-modules/cashews/default.nix
index 4f1ea982051b..bf3460779315 100644
--- a/pkgs/development/python-modules/cashews/default.nix
+++ b/pkgs/development/python-modules/cashews/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "cashews";
-  version = "7.4.4";
+  version = "7.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Krukov";
     repo = "cashews";
     tag = version;
-    hash = "sha256-KYMKqTLXQR7/pgXCOgDb9F2pelw9uyjEeJAwhWuXEZ8=";
+    hash = "sha256-GQObsWTCAKuYCyHZVd1wDzhvyYK5Xw1z1QazLuAP3Jg=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/cvxpy/default.nix b/pkgs/development/python-modules/cvxpy/default.nix
index 9fad43a2f257..90ff31cb0d2c 100644
--- a/pkgs/development/python-modules/cvxpy/default.nix
+++ b/pkgs/development/python-modules/cvxpy/default.nix
@@ -28,7 +28,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "cvxpy";
-  version = "1.9.1";
+  version = "1.9.2";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -36,7 +36,7 @@ buildPythonPackage (finalAttrs: {
     owner = "cvxpy";
     repo = "cvxpy";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xQ2WD0S4GiFLYqQlOE+3V23bIs7AqJY6Xn9m4sjc10I=";
+    hash = "sha256-nYfS9HXWTKcvVrq+wm5cgvB7keMAQPmKEe8bI0jngFg=";
   };
 
   postPatch =
diff --git a/pkgs/development/python-modules/deebot-client/default.nix b/pkgs/development/python-modules/deebot-client/default.nix
index 6357af360a4f..2d0a0e2670e5 100644
--- a/pkgs/development/python-modules/deebot-client/default.nix
+++ b/pkgs/development/python-modules/deebot-client/default.nix
@@ -22,21 +22,21 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "deebot-client";
-  version = "18.3.0";
+  version = "18.4.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.13";
+  disabled = pythonOlder "3.14";
 
   src = fetchFromGitHub {
     owner = "DeebotUniverse";
     repo = "client.py";
     tag = finalAttrs.version;
-    hash = "sha256-dQh98CIEbxpRga2BbB8X1KtGZ18jvVv4DhyJ1LFNNuw=";
+    hash = "sha256-SFOwIK1rjvbLw5W0d6vzXVUDlUOlBYOu/GMvlwwFDs0=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-MNMLOF3j+bGEhDeRln5wLOG6gY+ssSQqrb8vdmyJdtA=";
+    hash = "sha256-mvHHwfeP7k8bvOMFcNTn7wZlumMJ8wx7H+p8SNreIuE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/django-vtasks/default.nix b/pkgs/development/python-modules/django-vtasks/default.nix
index d890b5894ef3..f582ae5992e9 100644
--- a/pkgs/development/python-modules/django-vtasks/default.nix
+++ b/pkgs/development/python-modules/django-vtasks/default.nix
@@ -23,14 +23,14 @@
 
 buildPythonPackage rec {
   pname = "django-vtasks";
-  version = "2.1.1";
+  version = "2.1.2";
   pyproject = true;
 
   src = fetchFromGitLab {
     owner = "glitchtip";
     repo = "django-vtasks";
     tag = "v${version}";
-    hash = "sha256-f9x6atPMYgQQ/jpCJdDj33l+mhyei+6IWi4bqqVWxU8=";
+    hash = "sha256-L2desiA5ZSdW6KcWuJ4UmtqDVuvAFeRplLgJex7inVM=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/env-canada/default.nix b/pkgs/development/python-modules/env-canada/default.nix
index d7bdcb34d671..f87f56c944ee 100644
--- a/pkgs/development/python-modules/env-canada/default.nix
+++ b/pkgs/development/python-modules/env-canada/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "env-canada";
-  version = "0.15.0";
+  version = "0.16.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "michaeldavie";
     repo = "env_canada";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-iiNsbXvZPLCJ0BzPYCs6UEZIm1S0tEqi3ClY7vX6le4=";
+    hash = "sha256-99kf2A8nkxWZmhgD/x3YipYpxAJej5RjBTGomS/U8EQ=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/faraday-agent-parameters-types/default.nix b/pkgs/development/python-modules/faraday-agent-parameters-types/default.nix
index acfc96d9db60..6f2a1f3d3678 100644
--- a/pkgs/development/python-modules/faraday-agent-parameters-types/default.nix
+++ b/pkgs/development/python-modules/faraday-agent-parameters-types/default.nix
@@ -3,31 +3,13 @@
   buildPythonPackage,
   fetchFromGitHub,
   flit-core,
+  marshmallow,
   packaging,
   pytestCheckHook,
   setuptools,
   validators,
 }:
-let
-  marshmallow' = buildPythonPackage {
-    pname = "marshmallow";
-    version = "3.26.2";
-    pyproject = true;
 
-    src = fetchFromGitHub {
-      owner = "marshmallow-code";
-      repo = "marshmallow";
-      tag = "3.26.2";
-      hash = "sha256-ioe+aZHOW8r3wF3UknbTjAP0dEggd/NL9PTkPVQ46zM=";
-    };
-
-    build-system = [ flit-core ];
-
-    doCheck = false;
-
-    pythonImportsCheck = [ "marshmallow" ];
-  };
-in
 buildPythonPackage (finalAttrs: {
   pname = "faraday-agent-parameters-types";
   version = "1.9.1";
@@ -40,7 +22,10 @@ buildPythonPackage (finalAttrs: {
     hash = "sha256-Oe/9/zKOoCLK3JHMacOhk2+d91MrhzkBTW3POoFm71M=";
   };
 
-  pythonRelaxDeps = [ "validators" ];
+  pythonRelaxDeps = [
+    "marshmallow"
+    "validators"
+  ];
 
   postPatch = ''
     substituteInPlace setup.py \
@@ -50,7 +35,7 @@ buildPythonPackage (finalAttrs: {
   build-system = [ setuptools ];
 
   dependencies = [
-    marshmallow'
+    marshmallow
     packaging
     validators
   ];
@@ -65,12 +50,16 @@ buildPythonPackage (finalAttrs: {
   disabledTests = [
     # assert 'Version requested not valid' in "Invalid version: 'hola'"
     "test_incorrect_version_requested"
+    # Tests are outdated
+    "test_deserialize"
+    "test_invalid_data"
+    "test_serialize"
   ];
 
   meta = {
     description = "Collection of Faraday agent parameters types";
     homepage = "https://github.com/infobyte/faraday_agent_parameters_types";
-    changelog = "https://github.com/infobyte/faraday_agent_parameters_types/blob/${finalAttrs.version}/CHANGELOG.md";
+    changelog = "https://github.com/infobyte/faraday_agent_parameters_types/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/free-proxy/default.nix b/pkgs/development/python-modules/free-proxy/default.nix
index c315076b09c5..349d006b710c 100644
--- a/pkgs/development/python-modules/free-proxy/default.nix
+++ b/pkgs/development/python-modules/free-proxy/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "free-proxy";
-  version = "1.1.3";
+  version = "1.2.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jundymek";
     repo = "free-proxy";
     tag = "v${version}";
-    hash = "sha256-8SxKGGifQTU0CUrtUQUtrmeq+Do4GIqNUWAdCt++eUA=";
+    hash = "sha256-Q8102tnssVnIYEP9fBOBFSSsZqTGGulalyAkvnlp3UY=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/granian/default.nix b/pkgs/development/python-modules/granian/default.nix
index aceaea74a293..b015bead770d 100644
--- a/pkgs/development/python-modules/granian/default.nix
+++ b/pkgs/development/python-modules/granian/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "granian";
-  version = "2.7.5";
+  version = "2.7.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "emmett-framework";
     repo = "granian";
     tag = "v${version}";
-    hash = "sha256-6NOag3PHI4BOi5JuulRqhKeyDWuMxxu0bfb8ViQxDWY=";
+    hash = "sha256-89Kl/MrotK0fv0oAayUuZXyLLG9PPM1km57ER+dM1jw=";
   };
 
   # Granian forces a custom allocator for all the things it runs,
@@ -40,7 +40,7 @@ buildPythonPackage rec {
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-R4thKT3lMo/CFv+CokGSDzynTKOMCLRjVEy7Ojip4qA=";
+    hash = "sha256-mnqtzZ2+xuxUezhsgw+gr6MmWbi4Z4j0bHndys6vHFw=";
   };
 
   nativeBuildInputs = with rustPlatform; [
diff --git a/pkgs/development/python-modules/granian/no-alloc.patch b/pkgs/development/python-modules/granian/no-alloc.patch
index d6b01f9475b1..bd885bab87ed 100644
--- a/pkgs/development/python-modules/granian/no-alloc.patch
+++ b/pkgs/development/python-modules/granian/no-alloc.patch
@@ -1,5 +1,5 @@
 diff --git a/Cargo.toml b/Cargo.toml
-index e1b6a3d..8fe77cf 100644
+index a33fb2c..8426d66 100644
 --- a/Cargo.toml
 +++ b/Cargo.toml
 @@ -46,3 +46,2 @@ itertools = "0.14"
@@ -7,8 +7,8 @@ index e1b6a3d..8fe77cf 100644
 -mimalloc = { version = "0.1.49", default-features = false, features = ["local_dynamic_tls"], optional = true }
  mime_guess = "=2.0"
 @@ -58,3 +57,2 @@ socket2 = { version = "=0.6", features = ["all"] }
- sysinfo = "=0.38"
--tikv-jemallocator = { version = "0.6.0", default-features = false, features = ["disable_initial_exec_tls"], optional = true }
+ sysinfo = "=0.39"
+-tikv-jemallocator = { version = "=0.7", default-features = false, features = ["disable_initial_exec_tls"], optional = true }
  tls-listener = { version = "=0.11", git = "https://github.com/gi0baro/tls-listener.git", branch = "0.11.x", features = ["rustls-ring", "rustls-tls12"] }
 @@ -68,6 +66,2 @@ pyo3-build-config = "=0.27"
  
diff --git a/pkgs/development/python-modules/hstspreload/default.nix b/pkgs/development/python-modules/hstspreload/default.nix
index 67a4e364e18c..a45d43089bc5 100644
--- a/pkgs/development/python-modules/hstspreload/default.nix
+++ b/pkgs/development/python-modules/hstspreload/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "hstspreload";
-  version = "2026.6.1";
+  version = "2026.7.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "sethmlarson";
     repo = "hstspreload";
     tag = finalAttrs.version;
-    hash = "sha256-9YkMEu3ll2hRYrkiIo6mIdRIYoOLrtjv3B4Jq9wfgOo=";
+    hash = "sha256-nq9dr8Jd+OvRCXLOQbarXTnUg4QISEty7wvi/P2YUU8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index 3a17e9616c6b..06331d262a0f 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202606301";
+  version = "0.1.202607011";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hTRttoUj5hDoNbvw2tOysRZNwITZImNIfYPDP7qbhOs=";
+    hash = "sha256-Qa6n4ZR3OGErk59R16FifHJNVWzrFPCEZkktSFU+OKk=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/iocx/default.nix b/pkgs/development/python-modules/iocx/default.nix
index 15f6d1537c75..c66f5013ab83 100644
--- a/pkgs/development/python-modules/iocx/default.nix
+++ b/pkgs/development/python-modules/iocx/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iocx";
-  version = "0.7.4.1";
+  version = "0.7.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "iocx-dev";
     repo = "iocx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bSfmAAsVgtyCapcc9k4ky+nAFZV6GUf/EX1Ht8TOEg4=";
+    hash = "sha256-j7GApoKh0LBTWMLnapqzRncDFLu+89wLeNmSHxflcks=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/kazoo/default.nix b/pkgs/development/python-modules/kazoo/default.nix
index 06ddce72862c..2c3f84bc2bc7 100644
--- a/pkgs/development/python-modules/kazoo/default.nix
+++ b/pkgs/development/python-modules/kazoo/default.nix
@@ -2,6 +2,11 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+
+  # optional dependencies
+  eventlet,
+  gevent,
+  pure-sasl,
 }:
 
 buildPythonPackage rec {
@@ -14,6 +19,17 @@ buildPythonPackage rec {
     hash = "sha256-kFeWrk9MEr1OSukubl0BhDnmtWyM+7JIJTYuebIw2rE=";
   };
 
+  optional-dependencies = {
+    eventlet = [ eventlet ];
+    gevent = [ gevent ];
+    sasl = [ pure-sasl ];
+  };
+
+  pythonImportsCheck = [
+    "kazoo"
+    "kazoo.client"
+  ];
+
   # tests take a long time to run and leave threads hanging
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/langchain-anthropic/default.nix b/pkgs/development/python-modules/langchain-anthropic/default.nix
index b541bd8ec9d6..968e52b49a00 100644
--- a/pkgs/development/python-modules/langchain-anthropic/default.nix
+++ b/pkgs/development/python-modules/langchain-anthropic/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langchain-anthropic";
-  version = "1.4.6";
+  version = "1.4.8";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -32,7 +32,7 @@ buildPythonPackage (finalAttrs: {
     owner = "langchain-ai";
     repo = "langchain";
     tag = "langchain-anthropic==${finalAttrs.version}";
-    hash = "sha256-X+YS+T9mG+H4I2vHDYBi3Eev6OaCMgi56nKHEewgEXg=";
+    hash = "sha256-MX+DhFEkRNZ3IEKMXFT61XR6hEx2WPdGGaA0b/KlPZE=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/libs/partners/anthropic";
diff --git a/pkgs/development/python-modules/llama-cloud/default.nix b/pkgs/development/python-modules/llama-cloud/default.nix
index db6c820a0cd8..9c20619fa6e4 100644
--- a/pkgs/development/python-modules/llama-cloud/default.nix
+++ b/pkgs/development/python-modules/llama-cloud/default.nix
@@ -25,13 +25,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "llama-cloud";
-  version = "2.9.0";
+  version = "2.10.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "llama_cloud";
     inherit (finalAttrs) version;
-    hash = "sha256-yNRVw2Vdelkpn3N7lmhyEpRGi76LPyL3pAsbF16oUcU=";
+    hash = "sha256-KzoEcyQVCM/yadbb/GkWNHrjL3csYsMSW3aFbwfMUBw=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/logic2-automation/default.nix b/pkgs/development/python-modules/logic2-automation/default.nix
new file mode 100644
index 000000000000..4ed3e086519b
--- /dev/null
+++ b/pkgs/development/python-modules/logic2-automation/default.nix
@@ -0,0 +1,53 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build
+  hatchling,
+
+  # dependencies
+  grpcio,
+  grpcio-tools,
+  protobuf,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "logic2-automation";
+  version = "1.0.11";
+
+  src = fetchFromGitHub {
+    owner = "saleae";
+    repo = "logic2-automation";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-e0UvRwUs+rKFF3ky8bnHV22ZA9sU+AoghcMui2pIzQ0=";
+  };
+
+  sourceRoot = "source/python";
+
+  preBuild = "./build.sh";
+
+  pyproject = true;
+
+  build-system = [
+    hatchling
+  ];
+
+  dependencies = [
+    grpcio
+    grpcio-tools
+    protobuf
+  ];
+
+  # Tests require the unfree saleae-logic-2 package, plus gRPC server which is not packaged, yet.
+  doCheck = false;
+
+  pythonImportsCheck = [ "saleae.automation" ];
+
+  meta = {
+    description = "Automation interface for Saleae Logic 2 software";
+    homepage = "https://github.com/saleae/logic2-automation";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ krishnans2006 ];
+  };
+})
diff --git a/pkgs/development/python-modules/microsoft-kiota-abstractions/default.nix b/pkgs/development/python-modules/microsoft-kiota-abstractions/default.nix
index c2f1d0baa7f1..8aa585a8d1ce 100644
--- a/pkgs/development/python-modules/microsoft-kiota-abstractions/default.nix
+++ b/pkgs/development/python-modules/microsoft-kiota-abstractions/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "microsoft-kiota-abstractions";
-  version = "1.11.6";
+  version = "1.11.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "kiota-python";
     tag = "microsoft-kiota-abstractions-v${finalAttrs.version}";
-    hash = "sha256-hhYQsNcy+jVVmKiDuB1nGpx+aA7toM6WDFoU5Vnu5Vs=";
+    hash = "sha256-Fd9XSO3H1Au8y+Acft5to7hi7QNwWcmP0/NeWZlufjg=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/packages/abstractions/";
diff --git a/pkgs/development/python-modules/microsoft-kiota-authentication-azure/default.nix b/pkgs/development/python-modules/microsoft-kiota-authentication-azure/default.nix
index 0fa9c9743652..c852aa291716 100644
--- a/pkgs/development/python-modules/microsoft-kiota-authentication-azure/default.nix
+++ b/pkgs/development/python-modules/microsoft-kiota-authentication-azure/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "microsoft-kiota-authentication-azure";
-  version = "1.11.6";
+  version = "1.11.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "kiota-python";
     tag = "microsoft-kiota-authentication-azure-v${finalAttrs.version}";
-    hash = "sha256-hhYQsNcy+jVVmKiDuB1nGpx+aA7toM6WDFoU5Vnu5Vs=";
+    hash = "sha256-Fd9XSO3H1Au8y+Acft5to7hi7QNwWcmP0/NeWZlufjg=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/packages/authentication/azure/";
diff --git a/pkgs/development/python-modules/microsoft-kiota-http/default.nix b/pkgs/development/python-modules/microsoft-kiota-http/default.nix
index 128abade58b3..a12063bcf6d0 100644
--- a/pkgs/development/python-modules/microsoft-kiota-http/default.nix
+++ b/pkgs/development/python-modules/microsoft-kiota-http/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "microsoft-kiota-http";
-  version = "1.11.6";
+  version = "1.11.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "kiota-python";
     tag = "microsoft-kiota-http-v${finalAttrs.version}";
-    hash = "sha256-hhYQsNcy+jVVmKiDuB1nGpx+aA7toM6WDFoU5Vnu5Vs=";
+    hash = "sha256-Fd9XSO3H1Au8y+Acft5to7hi7QNwWcmP0/NeWZlufjg=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/packages/http/httpx/";
diff --git a/pkgs/development/python-modules/microsoft-kiota-serialization-form/default.nix b/pkgs/development/python-modules/microsoft-kiota-serialization-form/default.nix
index 1d39a5b99acb..295f052c8097 100644
--- a/pkgs/development/python-modules/microsoft-kiota-serialization-form/default.nix
+++ b/pkgs/development/python-modules/microsoft-kiota-serialization-form/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "microsoft-kiota-serialization-form";
-  version = "1.11.6";
+  version = "1.11.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "kiota-python";
     tag = "microsoft-kiota-serialization-form-v${finalAttrs.version}";
-    hash = "sha256-hhYQsNcy+jVVmKiDuB1nGpx+aA7toM6WDFoU5Vnu5Vs=";
+    hash = "sha256-Fd9XSO3H1Au8y+Acft5to7hi7QNwWcmP0/NeWZlufjg=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/packages/serialization/form/";
diff --git a/pkgs/development/python-modules/microsoft-kiota-serialization-json/default.nix b/pkgs/development/python-modules/microsoft-kiota-serialization-json/default.nix
index ca39e6a8824f..9f2ce27fed5a 100644
--- a/pkgs/development/python-modules/microsoft-kiota-serialization-json/default.nix
+++ b/pkgs/development/python-modules/microsoft-kiota-serialization-json/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "microsoft-kiota-serialization-json";
-  version = "1.11.6";
+  version = "1.11.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "kiota-python";
     tag = "microsoft-kiota-serialization-json-v${finalAttrs.version}";
-    hash = "sha256-hhYQsNcy+jVVmKiDuB1nGpx+aA7toM6WDFoU5Vnu5Vs=";
+    hash = "sha256-Fd9XSO3H1Au8y+Acft5to7hi7QNwWcmP0/NeWZlufjg=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/packages/serialization/json/";
diff --git a/pkgs/development/python-modules/microsoft-kiota-serialization-multipart/default.nix b/pkgs/development/python-modules/microsoft-kiota-serialization-multipart/default.nix
index 1b081aa9a210..c69d9b592d02 100644
--- a/pkgs/development/python-modules/microsoft-kiota-serialization-multipart/default.nix
+++ b/pkgs/development/python-modules/microsoft-kiota-serialization-multipart/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "microsoft-kiota-serialization-multipart";
-  version = "1.11.6";
+  version = "1.11.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "kiota-python";
     tag = "microsoft-kiota-serialization-multipart-v${version}";
-    hash = "sha256-hhYQsNcy+jVVmKiDuB1nGpx+aA7toM6WDFoU5Vnu5Vs=";
+    hash = "sha256-Fd9XSO3H1Au8y+Acft5to7hi7QNwWcmP0/NeWZlufjg=";
   };
 
   sourceRoot = "${src.name}/packages/serialization/multipart/";
diff --git a/pkgs/development/python-modules/microsoft-kiota-serialization-text/default.nix b/pkgs/development/python-modules/microsoft-kiota-serialization-text/default.nix
index bae91e5e83ec..8293507d456e 100644
--- a/pkgs/development/python-modules/microsoft-kiota-serialization-text/default.nix
+++ b/pkgs/development/python-modules/microsoft-kiota-serialization-text/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "microsoft-kiota-serialization-text";
-  version = "1.11.6";
+  version = "1.11.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "kiota-python";
     tag = "microsoft-kiota-serialization-text-v${version}";
-    hash = "sha256-hhYQsNcy+jVVmKiDuB1nGpx+aA7toM6WDFoU5Vnu5Vs=";
+    hash = "sha256-Fd9XSO3H1Au8y+Acft5to7hi7QNwWcmP0/NeWZlufjg=";
   };
 
   sourceRoot = "${src.name}/packages/serialization/text/";
diff --git a/pkgs/development/python-modules/mpl-typst/default.nix b/pkgs/development/python-modules/mpl-typst/default.nix
index c333bece263e..c709ec5c7bdc 100644
--- a/pkgs/development/python-modules/mpl-typst/default.nix
+++ b/pkgs/development/python-modules/mpl-typst/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "mpl-typst";
-  version = "0.2.1";
+  version = "0.3.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "daskol";
     repo = "mpl-typst";
     tag = "v${version}";
-    hash = "sha256-lkO4BTo3duNAsppTjteeBuzgSJL/UnKVW2QXgrfVrqM=";
+    hash = "sha256-RVzovICoDqEnjq0HngSe4vLlPszSgkq1FF0/Jrnw34Y=";
   };
 
   postPatch = ''
@@ -53,14 +53,21 @@ buildPythonPackage rec {
     "mpl_typst.as_default"
   ];
 
-  disabledTests = [
-    # runs typst and gets "error: failed to download package"
-    "test_draw_path"
-    "test_draw_image_lenna"
-    "test_draw_image_spy"
-  ];
-
-  disabledTestPaths = lib.optional stdenv.hostPlatform.isDarwin [
+  disabledTestPaths = [
+    # These render generated Typst through the typst binary. The prologue
+    # imports @preview/based, so Typst attempts to download a package in the
+    # Nix sandbox.
+    "mpl_typst/backend_test.py::TestTypstRenderer::test_draw_path"
+    "mpl_typst/backend_test.py::TestTypstRenderer::test_draw_path_clips_to_bbox"
+    "mpl_typst/backend_test.py::TestTypstRenderer::test_draw_path_bbox_pixels"
+    "mpl_typst/backend_test.py::TestTypstRenderer::test_draw_path_hatched_rect_pixels"
+    "mpl_typst/backend_test.py::TestTypstRenderer::test_draw_path_hatched_rect_pixels_golden"
+    "mpl_typst/backend_test.py::TestTypstRenderer::test_draw_text_colored"
+    "mpl_typst/backend_test.py::TestTypstRenderer::test_draw_image_lenna"
+    "mpl_typst/backend_test.py::TestTypstRenderer::test_draw_image_spy"
+    "tests/regression/issue32_test.py::TestIssue32::test_reference"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
     # fatal error when matplotlib creates a canvas
     "mpl_typst/backend_test.py"
   ];
diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 5bc2ef9d3c91..a2761d3eb7ad 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -51,8 +51,8 @@ in
       "sha256-KNFTnweHO/8xVFHLcjBP0USqBQfc5BQjj+JBEGlM7kI=";
 
   mypy-boto3-acm =
-    buildMypyBoto3Package "acm" "1.43.29"
-      "sha256-vZdnq48mhv+8MGFL+X3Q5x7TUT8JH1rKNjvK1tlo0g8=";
+    buildMypyBoto3Package "acm" "1.43.38"
+      "sha256-m4sUtL3riEkcXGeWgD0vAkKx78R2SYrwHycxz1Fjxw8=";
 
   mypy-boto3-acm-pca =
     buildMypyBoto3Package "acm-pca" "1.43.0"
@@ -147,8 +147,8 @@ in
       "sha256-0QMHGUpHVdAUf8hw4RtgU3wManp26riDDbx49a9929U=";
 
   mypy-boto3-autoscaling =
-    buildMypyBoto3Package "autoscaling" "1.43.0"
-      "sha256-8Wme8qFuxcX74RuNmGl+9mszIpPXh5bcttMRoeqN7ww=";
+    buildMypyBoto3Package "autoscaling" "1.43.38"
+      "sha256-xpwzqlkGC3ZCKuCMLZ5DvZAuPCQCRdwpccVuhsmaOWY=";
 
   mypy-boto3-autoscaling-plans =
     buildMypyBoto3Package "autoscaling-plans" "1.43.0"
@@ -207,12 +207,12 @@ in
       "sha256-51MoyiVhP371RZ8pD0N38qenWpsW3HTn4PL/6Hd8Ki8=";
 
   mypy-boto3-cleanrooms =
-    buildMypyBoto3Package "cleanrooms" "1.43.13"
-      "sha256-y9b/pwcRa4VFZ0v0rDwzdzYTnCyn6lgeNmk9JTLRtEI=";
+    buildMypyBoto3Package "cleanrooms" "1.43.38"
+      "sha256-m7y4NwYn4tNtJ2V8wlXSkOMdhTrNFZUWXc8g1yqLFGA=";
 
   mypy-boto3-cloud9 =
-    buildMypyBoto3Package "cloud9" "1.43.0"
-      "sha256-76N3xUFKaU+cepHviRw2SWdjptNmVZkg6giAF7B1b5s=";
+    buildMypyBoto3Package "cloud9" "1.43.39"
+      "sha256-n+O246n0LbH1Tc8QK93YRO2Cxj9pz8nfAetvq1lidj8=";
 
   mypy-boto3-cloudcontrol =
     buildMypyBoto3Package "cloudcontrol" "1.43.0"
@@ -223,8 +223,8 @@ in
       "sha256-Ula0Hx4jZ6JVlT9v4P88bmtQSYyFtofeZiN9vAILqxw=";
 
   mypy-boto3-cloudformation =
-    buildMypyBoto3Package "cloudformation" "1.43.23"
-      "sha256-5uR0CjqWzTHzthGWM/IkolEZ4i2CSGGb0joju66Mp6g=";
+    buildMypyBoto3Package "cloudformation" "1.43.38"
+      "sha256-u0rjspNF01rMTNE1gCrxMlA85Ve1Ma0KGb7FzHuCGjo=";
 
   mypy-boto3-cloudfront =
     buildMypyBoto3Package "cloudfront" "1.43.8"
@@ -255,16 +255,16 @@ in
       "sha256-PVskBSuwqSfNybHDtLLfVpDG0dwR/Q1LhrHz1imsR8A=";
 
   mypy-boto3-cloudwatch =
-    buildMypyBoto3Package "cloudwatch" "1.43.37"
-      "sha256-OXmuNkF7rntBEHJWv4CLoCLBguB/RilcYdUJaPCQ1W0=";
+    buildMypyBoto3Package "cloudwatch" "1.43.38"
+      "sha256-3STwHJJpbVZa1ACznoyPLvYMpBGL7xxS1+5h0bx40+Y=";
 
   mypy-boto3-codeartifact =
     buildMypyBoto3Package "codeartifact" "1.43.0"
       "sha256-CubsXd2HL6MvlyE5z1pnAacMWILCRnlWE0cZODrVeJk=";
 
   mypy-boto3-codebuild =
-    buildMypyBoto3Package "codebuild" "1.43.0"
-      "sha256-2w+09jNgnpl3wQSKfnz7vsaQBVy+puyOsvimwa/axgg=";
+    buildMypyBoto3Package "codebuild" "1.43.38"
+      "sha256-Gc/u06NkA6juz5ji9jPs3Z8xp/GVrKEwhFqL0jGedaU=";
 
   mypy-boto3-codecatalyst =
     buildMypyBoto3Package "codecatalyst" "1.43.0"
@@ -335,8 +335,8 @@ in
       "sha256-6FyB/VCGsMYDBFUu0VzWpge94lASfg6CVewhkmpxycQ=";
 
   mypy-boto3-connect =
-    buildMypyBoto3Package "connect" "1.43.34"
-      "sha256-NOESFHTxOOYkpkV3Eer4M0Ag7jYA0eZvIdGzQUZlrAg=";
+    buildMypyBoto3Package "connect" "1.43.39"
+      "sha256-yu5th3IYwC4kGT/DnRy9A3MXR/XxxtpeQomeRQoD7ck=";
 
   mypy-boto3-connect-contact-lens =
     buildMypyBoto3Package "connect-contact-lens" "1.43.0"
@@ -443,8 +443,8 @@ in
       "sha256-dXNkOcMonYrBh4yzeubd+v3mW42s9XpmpfvgbtgoJgY=";
 
   mypy-boto3-ec2 =
-    buildMypyBoto3Package "ec2" "1.43.37"
-      "sha256-f2PTD4ft+tjN3+RBVpI8kY8I6QwMWscGFXIB7YUm6eI=";
+    buildMypyBoto3Package "ec2" "1.43.39"
+      "sha256-iatW0Ijl1hGkkP3tOwC49kvmO3r3BdYfvRclRw+pmbA=";
 
   mypy-boto3-ec2-instance-connect =
     buildMypyBoto3Package "ec2-instance-connect" "1.43.0"
@@ -459,16 +459,16 @@ in
       "sha256-02BUkAFhr9sT8ohkJJFPYNni0O9/UI/G0GUee/Kx5Dw=";
 
   mypy-boto3-ecs =
-    buildMypyBoto3Package "ecs" "1.43.37"
-      "sha256-ym5rilQYYSdP29ZaGS23KbD0fCORWLJj14YWlpq1SpI=";
+    buildMypyBoto3Package "ecs" "1.43.38"
+      "sha256-cC5wmNdGFHsl1HBxsKcoAxEe1PBe2ps7T7rNPoH8AHs=";
 
   mypy-boto3-efs =
     buildMypyBoto3Package "efs" "1.43.23"
       "sha256-11KpPRxGId76g/I4jXwMQ55kwGEQVsasgvMUXsiLbM4=";
 
   mypy-boto3-eks =
-    buildMypyBoto3Package "eks" "1.43.33"
-      "sha256-ryLZyMekjwdF6LGgNkQ5m6ocEm1DFys/U7QJl/sst3k=";
+    buildMypyBoto3Package "eks" "1.43.38"
+      "sha256-d8nAhWJTMytBpPwwp0kVjxmeX+l7mFZzd2NfNBNmaIY=";
 
   mypy-boto3-elastic-inference =
     buildMypyBoto3Package "elastic-inference" "1.36.0"
@@ -858,8 +858,8 @@ in
       "sha256-ZlvcxMsMtkPwzyBpxGWffcD2g73aNIU6WG7jYn66ZjU=";
 
   mypy-boto3-mediaconvert =
-    buildMypyBoto3Package "mediaconvert" "1.43.24"
-      "sha256-VaGwdqgERTszcGip4FytIsm6r9mADouitpOWVmBFBko=";
+    buildMypyBoto3Package "mediaconvert" "1.43.39"
+      "sha256-3s5d1ZZ+XoVjYP3uZ2zuaAjH76fbj0j0a5v2H3Ji8vA=";
 
   mypy-boto3-medialive =
     buildMypyBoto3Package "medialive" "1.43.27"
@@ -898,8 +898,8 @@ in
       "sha256-13fAVct/Icy2iWt9z+fFyHLbp+7X6kZjLCtiiqC8Emc=";
 
   mypy-boto3-meteringmarketplace =
-    buildMypyBoto3Package "meteringmarketplace" "1.43.0"
-      "sha256-+gJkfsKfgRQbXovoZwas++rwAFxKlkGUdjqVGgE9jvA=";
+    buildMypyBoto3Package "meteringmarketplace" "1.43.39"
+      "sha256-HIHcM0wk4B50OYDf9Dsb81hsfrXYnZ7WyQ9R6BBvjNk=";
 
   mypy-boto3-mgh =
     buildMypyBoto3Package "mgh" "1.43.0"
@@ -946,8 +946,8 @@ in
       "sha256-rkVxsY4MQ+eB3uQhD3kI7bBpCHiDVcQDNUXA5zUyeok=";
 
   mypy-boto3-network-firewall =
-    buildMypyBoto3Package "network-firewall" "1.43.0"
-      "sha256-23FKHmxHWa7mgIWe0SRxbBzO6LZNdNkaU1XOqqI8knw=";
+    buildMypyBoto3Package "network-firewall" "1.43.38"
+      "sha256-kkxtrL98SOemo4LBPn5d2U0R0a5Yb9C0XBGTqAhRurM=";
 
   mypy-boto3-networkmanager =
     buildMypyBoto3Package "networkmanager" "1.43.0"
@@ -966,8 +966,8 @@ in
       "sha256-1wQApBLsMnKRZ3lJZdd2W0+2Zz50QFdzYAhrOvEzByM=";
 
   mypy-boto3-opensearch =
-    buildMypyBoto3Package "opensearch" "1.43.34"
-      "sha256-MCgsSuTTm5JpFVTCWYOqi4usXhqThxyda6Q8dd4FiLA=";
+    buildMypyBoto3Package "opensearch" "1.43.39"
+      "sha256-ML0Y1a5twHRFUmR0MppMRopU2RG9n6y0HpQj4jUb/Dk=";
 
   mypy-boto3-opensearchserverless =
     buildMypyBoto3Package "opensearchserverless" "1.43.17"
@@ -1070,8 +1070,8 @@ in
       "sha256-YrrEKl3aGz//5Z5JGapHhWtk6hBXQ4cuRQmLqGYztzg=";
 
   mypy-boto3-quicksight =
-    buildMypyBoto3Package "quicksight" "1.43.35"
-      "sha256-47+AzLZ3ovvK0wLQ4xFoFkMocEjP1Kv44z+X1Ad4aYs=";
+    buildMypyBoto3Package "quicksight" "1.43.39"
+      "sha256-xjqIi2ZTAZusw3FDL2AQx871Yg0VM++K32w+ht74F34=";
 
   mypy-boto3-ram =
     buildMypyBoto3Package "ram" "1.43.0"
@@ -1310,8 +1310,8 @@ in
       "sha256-V1og1LY/ORrXbfFVs4vF8LYe30/kvG71F3rWwXmNSJ4=";
 
   mypy-boto3-sso-admin =
-    buildMypyBoto3Package "sso-admin" "1.43.1"
-      "sha256-1LtstuBIeRytha3ExMzo17fE4TUe2zVQq9ud8rGfFwM=";
+    buildMypyBoto3Package "sso-admin" "1.43.38"
+      "sha256-XItUg7rif3WcSEFp5+7vLqibBz9j43OpmA+whTlu/iM=";
 
   mypy-boto3-sso-oidc =
     buildMypyBoto3Package "sso-oidc" "1.43.0"
diff --git a/pkgs/development/python-modules/ngff-zarr/default.nix b/pkgs/development/python-modules/ngff-zarr/default.nix
index dd1d3284aa05..0eee8e95bc0c 100644
--- a/pkgs/development/python-modules/ngff-zarr/default.nix
+++ b/pkgs/development/python-modules/ngff-zarr/default.nix
@@ -31,14 +31,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "ngff-zarr";
-  version = "0.36.0";
+  version = "0.37.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "fideus-labs";
     repo = "ngff-zarr";
     tag = "py-v${finalAttrs.version}";
-    hash = "sha256-TsPyW815ITcBtAvRyQgEqgHhp9MqtRlkmKLFNVdnKR8=";
+    hash = "sha256-v747oBJMKORiEgy3fVzzgl35+9uRbyGvtor+Ga4UkNI=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/py/";
@@ -130,6 +130,9 @@ buildPythonPackage (finalAttrs: {
     "test_3d_zyx"
     "test_smaller_dask_graph"
     "test_tensorstore_compression"
+    # Test requires network access
+    "test_cli_orientation_preset_end_to_end"
+    "test_cli_itk_input_writes_orientation_automatically"
   ];
 
   meta = {
diff --git a/pkgs/development/python-modules/ocrmypdf/default.nix b/pkgs/development/python-modules/ocrmypdf/default.nix
index 33cebeede2e8..265ede72e8aa 100644
--- a/pkgs/development/python-modules/ocrmypdf/default.nix
+++ b/pkgs/development/python-modules/ocrmypdf/default.nix
@@ -32,7 +32,7 @@
 
 buildPythonPackage rec {
   pname = "ocrmypdf";
-  version = "17.7.1";
+  version = "17.8.0";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -45,7 +45,7 @@ buildPythonPackage rec {
     postFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    hash = "sha256-LHNaWpnx11EGKvmudicMFCQJzTQMB2+Rz5JgHJN7lFk=";
+    hash = "sha256-E6SheIepSXQPxTCf6/vWeGpUs0x7VO+h86JhtSxK6e0=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/openinference-instrumentation/default.nix b/pkgs/development/python-modules/openinference-instrumentation/default.nix
index 6c2e2fbf3a3b..d86bfeefe993 100644
--- a/pkgs/development/python-modules/openinference-instrumentation/default.nix
+++ b/pkgs/development/python-modules/openinference-instrumentation/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "openinference-instrumentation";
-  version = "0.1.53";
+  version = "0.1.54";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -27,7 +27,7 @@ buildPythonPackage (finalAttrs: {
     owner = "Arize-ai";
     repo = "openinference";
     tag = "python-openinference-instrumentation-v${finalAttrs.version}";
-    hash = "sha256-1FzAiO3Vxt2o9YCzwPfHOn4hwvOLDt9Luv3zQTJ6J2Q=";
+    hash = "sha256-6GWZmgb9ZcT/yx7MvGUQlht5fljQGCKMHMpJWZQKpPI=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/python/${finalAttrs.pname}";
diff --git a/pkgs/development/python-modules/pure-sasl/default.nix b/pkgs/development/python-modules/pure-sasl/default.nix
index 6e76ecb7dd61..e7f339d0e9aa 100644
--- a/pkgs/development/python-modules/pure-sasl/default.nix
+++ b/pkgs/development/python-modules/pure-sasl/default.nix
@@ -2,7 +2,15 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+
+  # build system
+  setuptools,
+
+  # optional dependencies
   pykerberos,
+
+  # test dependencies
+  mock,
   pytestCheckHook,
   six,
 }:
@@ -10,7 +18,7 @@
 buildPythonPackage rec {
   pname = "pure-sasl";
   version = "0.6.2";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "thobbs";
@@ -19,23 +27,29 @@ buildPythonPackage rec {
     hash = "sha256-AHoZ3QZLr0JLE8+a2zkB06v2wRknxhgm/tcEPXaJX/U=";
   };
 
-  postPatch = ''
-    substituteInPlace tests/unit/test_mechanism.py \
-      --replace 'from mock import patch' 'from unittest.mock import patch'
-  '';
+  build-system = [ setuptools ];
 
-  pythonImportsCheck = [ "puresasl" ];
+  optional-dependencies = {
+    gssapi = [ pykerberos ];
+  };
+
+  pythonImportsCheck = [
+    "puresasl"
+    "puresasl.client"
+    "puresasl.mechanisms"
+  ];
 
   nativeCheckInputs = [
-    pykerberos
+    mock
     pytestCheckHook
     six
-  ];
+  ]
+  ++ lib.concatAttrValues optional-dependencies;
 
   meta = {
     description = "Reasonably high-level SASL client written in pure Python";
     homepage = "http://github.com/thobbs/pure-sasl";
-    changelog = "https://github.com/thobbs/pure-sasl/blob/0.6.2/CHANGES.rst";
+    changelog = "https://github.com/thobbs/pure-sasl/blob/${src.tag}/CHANGES.rst";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ jherland ];
   };
diff --git a/pkgs/development/python-modules/pyanglianwater/default.nix b/pkgs/development/python-modules/pyanglianwater/default.nix
index abc7172cb4cd..311e81b2f1a6 100644
--- a/pkgs/development/python-modules/pyanglianwater/default.nix
+++ b/pkgs/development/python-modules/pyanglianwater/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "pyanglianwater";
-  version = "3.2.2";
+  version = "3.2.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pantherale0";
     repo = "pyanglianwater";
     tag = version;
-    hash = "sha256-u1s/XsNN6AuTzj0jLE7us1Mmoe8r+VuCl0khS5BRxkQ=";
+    hash = "sha256-hXHkRiKnv59TW1Wr2aJcMvW65SQbkfSokGjh9AvmN3s=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pycfmodel/default.nix b/pkgs/development/python-modules/pycfmodel/default.nix
index 750256d81f59..4bd9057b9d9b 100644
--- a/pkgs/development/python-modules/pycfmodel/default.nix
+++ b/pkgs/development/python-modules/pycfmodel/default.nix
@@ -6,23 +6,27 @@
   pydantic,
   pytestCheckHook,
   setuptools,
+  setuptools-scm,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pycfmodel";
-  version = "1.2.0";
+  version = "2.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Skyscanner";
     repo = "pycfmodel";
-    tag = "v${version}";
-    hash = "sha256-ta6kS+MiSa2DZx18EQr7hvWYrK55j48hSBACtcklCpI=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-fI6CeBJc1ry0vbXCxq7sfGiNDIrb3TiyimNacoOg8Lw=";
   };
 
   pythonRelaxDeps = [ "pydantic" ];
 
-  build-system = [ setuptools ];
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
 
   dependencies = [ pydantic ];
 
@@ -43,13 +47,18 @@ buildPythonPackage rec {
     "test_raise_error_if_invalid_fields_in_resource"
   ];
 
+  disabledTestPaths = [
+    # Test requires network access
+    "tests/test_resource_generator.py"
+  ];
+
   pythonImportsCheck = [ "pycfmodel" ];
 
   meta = {
     description = "Model for Cloud Formation scripts";
     homepage = "https://github.com/Skyscanner/pycfmodel";
-    changelog = "https://github.com/Skyscanner/pycfmodel/releases/tag/${src.tag}";
+    changelog = "https://github.com/Skyscanner/pycfmodel/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/pyglossary/default.nix b/pkgs/development/python-modules/pyglossary/default.nix
index 0a1bd012c8f7..f8023ecc2851 100644
--- a/pkgs/development/python-modules/pyglossary/default.nix
+++ b/pkgs/development/python-modules/pyglossary/default.nix
@@ -28,14 +28,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pyglossary";
-  version = "5.4.1";
+  version = "5.4.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ilius";
     repo = "pyglossary";
     tag = finalAttrs.version;
-    hash = "sha256-R0+iPcEuiSWaPecyo1Qf2kFWWzmE7xnZg2ZgFOPWCTU=";
+    hash = "sha256-Q2QS/Kg4iN1WMFTADfoqN9UC9da/5Bcp7ZjiZ5V3InM=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pyhomee/default.nix b/pkgs/development/python-modules/pyhomee/default.nix
index e2f91641c678..89393645b849 100644
--- a/pkgs/development/python-modules/pyhomee/default.nix
+++ b/pkgs/development/python-modules/pyhomee/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "pyhomee";
-  version = "1.4.0";
+  version = "1.4.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Taraman17";
     repo = "pyHomee";
     tag = "v${version}";
-    hash = "sha256-kFsg1abnH9aL5dwSNwQ1WHPdZ6EApc48j8si92kR8ts=";
+    hash = "sha256-SH31V/9Z1fw63K7SLQeBQcpQ0DnDVOrngggBNsG5Kk4=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pysail/default.nix b/pkgs/development/python-modules/pysail/default.nix
new file mode 100644
index 000000000000..624c066ca517
--- /dev/null
+++ b/pkgs/development/python-modules/pysail/default.nix
@@ -0,0 +1,73 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  rustPlatform,
+  nix-update-script,
+  testers,
+  pysail,
+
+  protoc,
+  protobuf,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "pysail";
+  version = "0.6.4";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "lakehq";
+    repo = "sail";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-EX8cDed32uF7NSreViKBn7RQeWIG7C7sI6O0c+hVf4M=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) pname src version;
+    hash = "sha256-ouNXKPpwKTLfI+Gcp393r7oHZAjUFQL9225+AuFzdoo=";
+  };
+
+  # The `generate-import-lib` PyO3 feature only matters when building Windows
+  # import libraries; on other platforms it just pulls in the `python3-dll-a`
+  # crate, which is not vendored. Drop it so the offline maturin build resolves.
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail '"pyo3/generate-import-lib",' ""
+  '';
+
+  nativeBuildInputs = with rustPlatform; [
+    cargoSetupHook
+    maturinBuildHook
+    protoc
+  ];
+
+  buildInputs = [
+    protobuf
+  ];
+
+  pythonImportsCheck = [
+    "pysail"
+    "pysail._native"
+  ];
+
+  # The test suite requires a running Spark Connect server and many
+  # heavyweight optional dependencies (pyspark-client, duckdb, ...).
+  doCheck = false;
+
+  passthru = {
+    updateScript = nix-update-script { };
+    tests.version = testers.testVersion {
+      package = pysail;
+    };
+  };
+
+  meta = {
+    description = "Python bindings for Sail, a Spark-compatible compute engine on Apache Arrow and DataFusion";
+    homepage = "https://github.com/lakehq/sail";
+    changelog = "https://github.com/lakehq/sail/blob/${finalAttrs.src.tag}/docs/reference/changelog/index.md";
+    license = lib.licenses.asl20;
+    mainProgram = "sail";
+    maintainers = [ lib.maintainers.davidlghellin ];
+  };
+})
diff --git a/pkgs/development/python-modules/pytenable/default.nix b/pkgs/development/python-modules/pytenable/default.nix
index 8b2f87c33dc4..4bf9d75941ab 100644
--- a/pkgs/development/python-modules/pytenable/default.nix
+++ b/pkgs/development/python-modules/pytenable/default.nix
@@ -1,74 +1,42 @@
 {
   lib,
   buildPythonPackage,
-  fetchFromGitHub,
-
-  # build-system
-  setuptools,
-
-  # dependencies
   cryptography,
   defusedxml,
+  fetchFromGitHub,
   gql,
   graphql-core,
-  pydantic,
+  marshmallow,
   pydantic-extra-types,
-  python-box,
-  python-dateutil,
-  requests,
-  requests-toolbelt,
-  restfly,
-  semver,
-  typing-extensions,
-
-  # marshmallow build system
-  flit-core,
-
-  # tests
+  pydantic,
   pytest-cov-stub,
   pytest-datafiles,
   pytest-vcr,
   pytestCheckHook,
+  python-box,
+  python-dateutil,
   requests-pkcs12,
+  requests-toolbelt,
+  requests,
   responses,
+  restfly,
+  semver,
+  setuptools,
+  typing-extensions,
 }:
-let
-  marshmallow' = buildPythonPackage {
-    pname = "marshmallow";
-    version = "3.26.2";
-    pyproject = true;
 
-    src = fetchFromGitHub {
-      owner = "marshmallow-code";
-      repo = "marshmallow";
-      tag = "3.26.2";
-      hash = "sha256-ioe+aZHOW8r3wF3UknbTjAP0dEggd/NL9PTkPVQ46zM=";
-    };
-
-    build-system = [ flit-core ];
-
-    doCheck = false;
-
-    pythonImportsCheck = [ "marshmallow" ];
-  };
-in
 buildPythonPackage (finalAttrs: {
   pname = "pytenable";
-  version = "1.9.1";
+  version = "26.5.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tenable";
     repo = "pyTenable";
     tag = finalAttrs.version;
-    hash = "sha256-WAKZe1m6EaNE+y2B/1/k8qZsEftLfAVPVEvIkh2N/4g=";
+    hash = "sha256-o11Lq11btpIwzgZlPMcChHexNOZSFEFOsnaIv1n66uY=";
   };
 
-  pythonRelaxDeps = [
-    "cryptography"
-    "defusedxml"
-  ];
-
   build-system = [ setuptools ];
 
   dependencies = [
@@ -76,7 +44,7 @@ buildPythonPackage (finalAttrs: {
     defusedxml
     gql
     graphql-core
-    marshmallow'
+    marshmallow
     pydantic
     pydantic-extra-types
     python-box
@@ -115,6 +83,7 @@ buildPythonPackage (finalAttrs: {
     # Test requires network access
     "test_assets_list_vcr"
     "test_events_list_vcr"
+    "test_session_ssl_error"
     # https://github.com/tenable/pyTenable/issues/953
     "test_construct_query_str"
     "test_construct_query_stored_file"
diff --git a/pkgs/development/python-modules/reolink-aio/default.nix b/pkgs/development/python-modules/reolink-aio/default.nix
index d384a522147e..6efd2ecd025f 100644
--- a/pkgs/development/python-modules/reolink-aio/default.nix
+++ b/pkgs/development/python-modules/reolink-aio/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "reolink-aio";
-  version = "0.21.1";
+  version = "0.21.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "starkillerOG";
     repo = "reolink_aio";
     tag = finalAttrs.version;
-    hash = "sha256-Rq+fciIG3W0X+2zHSsI23pHbkr+A3flu3E6VbTEeKnI=";
+    hash = "sha256-XL6Z+1dr35XgMczUcxp4v3ejBcdgWkhUOISFA4lpjU4=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/rich-rst/default.nix b/pkgs/development/python-modules/rich-rst/default.nix
index 457138c5e226..15750beec57c 100644
--- a/pkgs/development/python-modules/rich-rst/default.nix
+++ b/pkgs/development/python-modules/rich-rst/default.nix
@@ -1,33 +1,31 @@
 {
   lib,
   buildPythonPackage,
-  docutils,
   fetchFromGitHub,
+  pygments,
   pytestCheckHook,
   rich,
-  setuptools-scm,
   setuptools,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "rich-rst";
-  version = "2.0.1";
+  version = "2.0.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "wasi-master";
     repo = "rich-rst";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7nniBu9UnXA0pogv0TDkANTeOcsVYbyDxEr6/r7MxcY=";
+    hash = "sha256-M4ngZNYPasEqqfRay8aGHDII+LkwLhBp5kF9ryJ5LwQ=";
   };
 
   build-system = [
     setuptools
-    setuptools-scm
   ];
 
   dependencies = [
-    docutils
+    pygments
     rich
   ];
 
diff --git a/pkgs/development/python-modules/selenium-wire-roadtx/default.nix b/pkgs/development/python-modules/selenium-wire-roadtx/default.nix
index f3b333bd7bb7..c1f67db1995a 100644
--- a/pkgs/development/python-modules/selenium-wire-roadtx/default.nix
+++ b/pkgs/development/python-modules/selenium-wire-roadtx/default.nix
@@ -26,7 +26,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "selenium-wire-roadtx";
-  version = "0-unstable-2026-05-20";
+  version = "5.2.4-unstable-2026-05-20";
   pyproject = true;
 
   __structuredAttrs = true;
diff --git a/pkgs/development/python-modules/simplisafe-python/default.nix b/pkgs/development/python-modules/simplisafe-python/default.nix
index 27b021ff8fb1..03cf12a85c32 100644
--- a/pkgs/development/python-modules/simplisafe-python/default.nix
+++ b/pkgs/development/python-modules/simplisafe-python/default.nix
@@ -18,21 +18,21 @@
   websockets,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "simplisafe-python";
-  version = "2024.01.0";
+  version = "2026.06.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bachya";
     repo = "simplisafe-python";
-    tag = version;
-    hash = "sha256-ewbR2FI0t2F8HF0ZL5omsclB9OPAjHygGLPtSkVlvgM=";
+    tag = finalAttrs.version;
+    hash = "sha256-e59h4zX0AuzNlR1sovw4QJ6zXxksElY5emEM9eTfjwI=";
   };
 
-  nativeBuildInputs = [ poetry-core ];
+  build-system = [ poetry-core ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     aiohttp
     backoff
     beautifulsoup4
@@ -69,10 +69,10 @@ buildPythonPackage rec {
   __darwinAllowLocalNetworking = true;
 
   meta = {
-    changelog = "https://github.com/bachya/simplisafe-python/releases/tag/${version}";
     description = "Python library the SimpliSafe API";
     homepage = "https://simplisafe-python.readthedocs.io/";
-    license = with lib.licenses; [ mit ];
+    changelog = "https://github.com/bachya/simplisafe-python/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/slack-bolt/default.nix b/pkgs/development/python-modules/slack-bolt/default.nix
index 93e5b09cd7e4..4588046e0c26 100644
--- a/pkgs/development/python-modules/slack-bolt/default.nix
+++ b/pkgs/development/python-modules/slack-bolt/default.nix
@@ -41,14 +41,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "slack-bolt";
-  version = "1.28.0";
+  version = "1.29.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "slackapi";
     repo = "bolt-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1AJO7+7YG/NFh6Rmqwkm6yua2LWdYQ9Rv1oadfHAlhE=";
+    hash = "sha256-3U15V++q/x73LuEgw9uWaIGWulJmPkmkpUxxK1EXuzU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/slack-sdk/default.nix b/pkgs/development/python-modules/slack-sdk/default.nix
index b6eeaa14fc7e..a434650c1ed3 100644
--- a/pkgs/development/python-modules/slack-sdk/default.nix
+++ b/pkgs/development/python-modules/slack-sdk/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "slack-sdk";
-  version = "3.42.0";
+  version = "3.43.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "slackapi";
     repo = "python-slack-sdk";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-d0XuzBhn2Ex57xjeAF1q5RcwoWVsFWnlsWUufB3Um4g=";
+    hash = "sha256-slgf9U/Rm0pSV84CZR/8gGhvEi1zowjzE7YG9FsqwKk=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/swh-shard/default.nix b/pkgs/development/python-modules/swh-shard/default.nix
index cefb105097a4..a55a6917be78 100644
--- a/pkgs/development/python-modules/swh-shard/default.nix
+++ b/pkgs/development/python-modules/swh-shard/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "swh-shard";
-  version = "2.2.0";
+  version = "2.2.1";
   pyproject = true;
 
   src = fetchFromGitLab {
@@ -26,7 +26,7 @@ buildPythonPackage (finalAttrs: {
     owner = "devel";
     repo = "swh-shard";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-97oZ+Wa8GmyL2V4CnlSvaTbQZJ+mPbg6uVmWd0oxv1Q=";
+    hash = "sha256-acspStM+ohWDSqLH/aapWkI/VqAXnJCqeLTJ+lBlDcE=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index 107cb41190a8..6336ce199f81 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "tencentcloud-sdk-python";
-  version = "3.1.123";
+  version = "3.1.125";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = finalAttrs.version;
-    hash = "sha256-rX55rckAb3+rVobAKc3arWU99njl2VLEXYdLcdNI+5g=";
+    hash = "sha256-Z0I7hpHu1zfzDMKdiS+wOckUEdLM+uEcumAcWKrRf1Q=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/torchdata/default.nix b/pkgs/development/python-modules/torchdata/default.nix
index 07c376e92679..ae6516a3d887 100644
--- a/pkgs/development/python-modules/torchdata/default.nix
+++ b/pkgs/development/python-modules/torchdata/default.nix
@@ -16,6 +16,7 @@
 
   # tests
   datasets,
+  expecttest,
   parameterized,
   pytest-xdist,
   pytestCheckHook,
@@ -26,6 +27,7 @@ buildPythonPackage (finalAttrs: {
   pname = "torchdata";
   version = "0.11.0";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "meta-pytorch";
@@ -51,6 +53,7 @@ buildPythonPackage (finalAttrs: {
 
   nativeCheckInputs = [
     datasets
+    expecttest
     parameterized
     pytest-xdist
     pytestCheckHook
diff --git a/pkgs/development/python-modules/torchsnapshot/default.nix b/pkgs/development/python-modules/torchsnapshot/default.nix
index 017494ba6ff5..abef8ccc4f34 100644
--- a/pkgs/development/python-modules/torchsnapshot/default.nix
+++ b/pkgs/development/python-modules/torchsnapshot/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
 
@@ -11,6 +12,7 @@
   aiohttp,
   importlib-metadata,
   nest-asyncio,
+  numpy,
   psutil,
   pyyaml,
   torch,
@@ -21,15 +23,16 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "torchsnapshot";
   version = "0.1.0";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "pytorch";
     repo = "torchsnapshot";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-F8OaxLH8BL6MPNLFv1hBuVmeEdnEQ5w2Qny6by1wP6k=";
   };
 
@@ -52,6 +55,7 @@ buildPythonPackage rec {
     aiohttp
     importlib-metadata
     nest-asyncio
+    numpy
     psutil
     pyyaml
     torch
@@ -69,12 +73,17 @@ buildPythonPackage rec {
     # torch.distributed.elastic.multiprocessing.errors.ChildFailedError:
     # AssertionError: "Socket Timeout" does not match "wait timeout after 5000ms
     "test_linear_barrier_timeout"
+  ]
+  ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
+    # aarch64-linux fails cpuinfo test, because /sys/devices/system/cpu/ does not exist in the sandbox:
+    # RuntimeError: Failed to initialize cpuinfo!
+    "test_tensor_copy"
   ];
 
   meta = {
     description = "Performant, memory-efficient checkpointing library for PyTorch applications, designed with large, complex distributed workloads in mind";
     homepage = "https://github.com/pytorch/torchsnapshot/";
-    changelog = "https://github.com/pytorch/torchsnapshot/releases/tag/${version}";
+    changelog = "https://github.com/pytorch/torchsnapshot/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ GaetanLepage ];
     badPlatforms = [
@@ -82,4 +91,4 @@ buildPythonPackage rec {
       lib.systems.inspect.patterns.isDarwin
     ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/torchtune/default.nix b/pkgs/development/python-modules/torchtune/default.nix
index 04e344e4195a..b6ec79556151 100644
--- a/pkgs/development/python-modules/torchtune/default.nix
+++ b/pkgs/development/python-modules/torchtune/default.nix
@@ -28,29 +28,82 @@
 
   # tests
   comet-ml,
+  expecttest,
   mlflow,
   pytest-integration,
   pytest-mock,
   pytestCheckHook,
+  tensorboard,
   writableTmpDirAsHomeHook,
+
+  # passthru
+  nix-update-script,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "torchtune";
-  version = "0.6.2-unstable-2026-02-19";
+  version = "0.6.1-unstable-2026-04-23";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "meta-pytorch";
     repo = "torchtune";
-    rev = "6f2aa7254458145f99d7004cbd6ebc8e53a06404";
-    hash = "sha256-ryR5iO3IwkoLdMLSFGhHCLl0P8yD+GQdZFEE6M/EYh0=";
+    rev = "bd2a0fc7c31430972728494fa01aaeeb0ebf1ba1";
+    hash = "sha256-6jE8+ZCm46qyoSOCkBjxsXNvtVEOUP6v3NEmMh+ocl8=";
   };
 
+  postPatch = ''
+    substituteInPlace \
+      tests/torchtune/modules/low_precision/test_nf4_dispatch_registration.py \
+      torchtune/modules/low_precision/_register_nf4_dispatch_ops.py \
+      torchtune/modules/low_precision/nf4_linear.py \
+      torchtune/modules/peft/dora.py \
+      torchtune/modules/peft/lora.py \
+      --replace-fail \
+        "from torchao.quantization import to_nf4" \
+        "from torchao.dtypes import to_nf4" \
+
+    substituteInPlace \
+      tests/torchtune/models/llama2/test_lora_llama2.py \
+      tests/torchtune/models/phi3/test_lora_phi3.py \
+      tests/torchtune/modules/low_precision/test_nf4_linear.py \
+      tests/torchtune/training/test_distributed.py \
+      torchtune/modules/common_utils.py \
+      torchtune/training/_activation_offloading.py \
+      --replace-fail \
+        "from torchao.quantization import NF4Tensor" \
+        "from torchao.dtypes.nf4tensor import NF4Tensor"
+
+    substituteInPlace \
+      tests/torchtune/modules/peft/test_dora.py \
+      tests/torchtune/modules/peft/test_lora.py \
+      torchtune/training/_distributed.py \
+      --replace-fail \
+        "from torchao.quantization import NF4Tensor, to_nf4" \
+        "from torchao.dtypes.nf4tensor import NF4Tensor, to_nf4"
+
+    substituteInPlace \
+      torchtune/modules/low_precision/nf4_linear.py \
+      torchtune/modules/peft/dora.py \
+      torchtune/modules/peft/lora.py \
+      --replace-fail \
+        "from torchao.quantization.quantize_.workflows.nf4.nf4_tensor import linear_nf4" \
+        "from torchao.dtypes.nf4tensor import linear_nf4"
+
+    substituteInPlace torchtune/modules/low_precision/_register_nf4_dispatch_ops.py \
+      --replace-fail \
+        "from torchao.quantization.quantize_.workflows.nf4.nf4_tensor import implements as nf4_tensor_impl" \
+        "from torchao.dtypes.nf4tensor import implements as nf4_tensor_impl"
+  '';
+
   build-system = [
     setuptools
   ];
 
+  pythonRelaxDeps = [
+    "pyarrow"
+  ];
   dependencies = [
     blobfile
     datasets
@@ -77,10 +130,12 @@ buildPythonPackage (finalAttrs: {
 
   nativeCheckInputs = [
     comet-ml
+    expecttest
     mlflow
     pytest-integration
     pytest-mock
     pytestCheckHook
+    tensorboard
     writableTmpDirAsHomeHook
   ];
 
@@ -157,6 +212,10 @@ buildPythonPackage (finalAttrs: {
     "tests/torchtune/utils"
   ];
 
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };
+
   meta = {
     description = "PyTorch native post-training library";
     homepage = "https://github.com/meta-pytorch/torchtune";
diff --git a/pkgs/development/python-modules/tt-perf-report/default.nix b/pkgs/development/python-modules/tt-perf-report/default.nix
new file mode 100644
index 000000000000..1535db15f8aa
--- /dev/null
+++ b/pkgs/development/python-modules/tt-perf-report/default.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  setuptools,
+  wheel,
+
+  # dependencies
+  matplotlib,
+  pandas,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "tt-perf-report";
+  version = "1.2.4";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "tenstorrent";
+    repo = "tt-perf-report";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-cSlQ9Byv9LzKc4gS3QLeq3bHdmIVpl8AeK3Gh0mNDAQ=";
+  };
+
+  build-system = [
+    setuptools
+    wheel
+  ];
+
+  dependencies = [
+    matplotlib
+    pandas
+  ];
+
+  pythonRelaxDeps = [ "matplotlib" ];
+
+  pythonImportsCheck = [ "tt_perf_report" ];
+
+  meta = {
+    description = "Tool for analyzing performance traces from Metal operations";
+    homepage = "https://github.com/tenstorrent/tt-perf-report";
+    changelog = "https://github.com/tenstorrent/tt-perf-report/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ mert-kurttutan ];
+    mainProgram = "tt-perf-report";
+  };
+})
diff --git a/pkgs/development/python-modules/yaswfp/default.nix b/pkgs/development/python-modules/yaswfp/default.nix
index f0c7998a453f..6ed211dd9a0b 100644
--- a/pkgs/development/python-modules/yaswfp/default.nix
+++ b/pkgs/development/python-modules/yaswfp/default.nix
@@ -6,9 +6,9 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage {
+buildPythonPackage (finalAttrs: {
   pname = "yaswfp";
-  version = "unstable-20210331";
+  version = "0.9.3-unstable-20210331";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -28,9 +28,9 @@ buildPythonPackage {
 
   meta = {
     description = "Python SWF Parser";
-    mainProgram = "swfparser";
     homepage = "https://github.com/facundobatista/yaswfp";
-    license = with lib.licenses; [ gpl3Only ];
+    license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "swfparser";
   };
-}
+})
diff --git a/pkgs/development/web/nodejs/update.nix b/pkgs/development/web/nodejs/update.nix
index 37f854fb5cd9..ebbc6b7db7a2 100644
--- a/pkgs/development/web/nodejs/update.nix
+++ b/pkgs/development/web/nodejs/update.nix
@@ -13,10 +13,10 @@
 }:
 
 let
-  rev = "7b6eb2d6ab524bb30487f31612cdbeb35ae37533"; # should be the HEAD of nodejs/release-keys
+  rev = "890d535527789c9ebccdccdafd708f60dbd56786"; # should be the HEAD of nodejs/release-keys
   pubring = fetchurl {
     url = "https://github.com/nodejs/release-keys/raw/${rev}/gpg-only-active-keys/pubring.kbx";
-    hash = "sha256-cNpMrJ0Eh8F3bGZAPV9v55mR8bo0+ulkFgN94ZUBl+E=";
+    hash = "sha256-jm+JUhoGlORF9C3s0CL0g2nGNPG1vLWXUTW2nIhimug=";
   };
 in
 writeScript "update-nodejs" ''
diff --git a/pkgs/kde/plasma/plasma-bigscreen/default.nix b/pkgs/kde/plasma/plasma-bigscreen/default.nix
index 311a6e33a498..f6134e521251 100644
--- a/pkgs/kde/plasma/plasma-bigscreen/default.nix
+++ b/pkgs/kde/plasma/plasma-bigscreen/default.nix
@@ -1,9 +1,11 @@
 {
+  lib,
   mkKdeDerivation,
   plasma-workspace,
   pkg-config,
   qtwebengine,
   libcec,
+  libcec_platform,
   sdl3,
 }:
 
@@ -19,7 +21,7 @@ mkKdeDerivation {
   '';
 
   extraCmakeFlags = [
-    "-DQT_FIND_PRIVATE_MODULES=ON"
+    (lib.cmakeBool "QT_FIND_PRIVATE_MODULES" true)
   ];
 
   extraNativeBuildInputs = [
@@ -30,6 +32,7 @@ mkKdeDerivation {
     qtwebengine
 
     libcec
+    libcec_platform
     sdl3
   ];
 
diff --git a/pkgs/os-specific/linux/batman-adv/version.nix b/pkgs/os-specific/linux/batman-adv/version.nix
index e12da2673ae4..8f05cf345198 100644
--- a/pkgs/os-specific/linux/batman-adv/version.nix
+++ b/pkgs/os-specific/linux/batman-adv/version.nix
@@ -1,14 +1,14 @@
 {
-  version = "2026.1";
+  version = "2026.2";
 
   # To get these, run:
   #
   # ```
-  # for tool in alfred batctl batman-adv; do nix-prefetch-url https://downloads.open-mesh.org/batman/releases/batman-adv-2026.1/$tool-2026.1.tar.gz --type sha256 | xargs nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri; done
+  # for tool in alfred batctl batman-adv; do nix-prefetch-url https://downloads.open-mesh.org/batman/releases/batman-adv-2026.2/$tool-2026.2.tar.gz --type sha256 | xargs nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri; done
   # ```
   sha256 = {
-    alfred = "sha256-Rd+8uKfLuq7j4SYHpGYB3YbOUiUHJTXptJ2kC78CtIk=";
-    batctl = "sha256-hEQWhsHUTtV6Vg8qC+n4brksMQ8iqqSgCTPrbIk2CHo=";
-    batman-adv = "sha256-ZIfdO0rQ+FUQ3tu6M1/nexuHfQ53OTxR3coHp0Ubj0U=";
+    alfred = "sha256-2ZV0i+X2KkIJFSXMwQLfWsZCGG6bkBRpipVaRGm2m5Y=";
+    batctl = "sha256-wdWAr7Bm0xZcI5tnQwuUxpkyYZwGqQsSlegoy1CBsSI=";
+    batman-adv = "sha256-Thf87SyAlF4iYJvodTRIFzP/G10XBQ3k5PMjwXFBgTU=";
   };
 }
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 91bea44bf1a7..b30adcd27ea4 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -861,13 +861,15 @@ let
       # enable temporary caching of the last request_key() result
       KEYS_REQUEST_CACHE = yes;
       # randomized slab caches
-      RANDOM_KMALLOC_CACHES = whenAtLeast "6.6" yes;
+      RANDOM_KMALLOC_CACHES = whenBetween "6.6" "7.2" yes;
+      KMALLOC_PARTITION_CACHES = whenAtLeast "7.2" yes;
+      KMALLOC_PARTITION_RANDOM = whenAtLeast "7.2" yes;
 
       # NIST SP800-90A DRBG modes - enabled by most distributions
       #   and required by some out-of-tree modules (ShuffleCake)
       #   This does not include the NSA-backdoored Dual-EC mode from the same NIST publication.
-      CRYPTO_DRBG_HASH = yes;
-      CRYPTO_DRBG_CTR = yes;
+      CRYPTO_DRBG_HASH = whenOlder "7.2" yes;
+      CRYPTO_DRBG_CTR = whenOlder "7.2" yes;
 
       # Enable KFENCE
       # See: https://docs.kernel.org/dev-tools/kfence.html
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 1850e03a312b..b1bbd932a1ee 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,7 +1,7 @@
 {
     "testing": {
-        "version": "7.1-rc7",
-        "hash": "sha256:1jncfqvbiwsvvhiqs23paiy7xvsbmqcpxj02jwvy0albp16kfxd7",
+        "version": "7.2-rc1",
+        "hash": "sha256:1gpwr6n3cc2hqg36gy9g9w4rxawpz3y126j752z4zyls6h80b43v",
         "lts": false
     },
     "6.1": {
diff --git a/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix b/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix
index 31d0bf0b2d4b..7bc24178269c 100644
--- a/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix
@@ -13,13 +13,13 @@
 buildHomeAssistantComponent rec {
   owner = "luuquangvu";
   domain = "blueprints_updater";
-  version = "2.9.0";
+  version = "2.9.1";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "blueprints-updater";
     tag = version;
-    hash = "sha256-zIkK7ZhUC8fPycWJqXP706XbOdhVlNAOwZBTYTII3dE=";
+    hash = "sha256-OGQ6lE14w84C88QJv5w+mNBGg7gbCtqb9nde47FkL6A=";
   };
 
   patches = [
diff --git a/pkgs/servers/home-assistant/custom-components/frigidaire/package.nix b/pkgs/servers/home-assistant/custom-components/frigidaire/package.nix
index c5a9fba9f302..a206536768d7 100644
--- a/pkgs/servers/home-assistant/custom-components/frigidaire/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/frigidaire/package.nix
@@ -7,13 +7,13 @@
 buildHomeAssistantComponent rec {
   owner = "bm1549";
   domain = "frigidaire";
-  version = "0.1.21";
+  version = "0.1.22";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "home-assistant-frigidaire";
     tag = version;
-    hash = "sha256-Pa1pVxP1gB/1XNqFy3U5t2xeHk+BUe6TQKtU00xcbx4=";
+    hash = "sha256-ASxedLzRP/+FkRDojXsXlvrvA18BzjGfsw0xoDnVaQA=";
   };
 
   dependencies = [ frigidaire ];
diff --git a/pkgs/servers/http/angie/default.nix b/pkgs/servers/http/angie/default.nix
index ee4dd5c50979..fc468d763bdf 100644
--- a/pkgs/servers/http/angie/default.nix
+++ b/pkgs/servers/http/angie/default.nix
@@ -9,11 +9,11 @@
 
 callPackage ../nginx/generic.nix args rec {
   pname = "angie";
-  version = "1.11.5";
+  version = "1.11.8";
 
   src = fetchurl {
     url = "https://download.angie.software/files/angie-${version}.tar.gz";
-    hash = "sha256-tfKXxt8qdLnQCRp83XR//9LQ4dC+Q2MtphwcdTnbIEM=";
+    hash = "sha256-hJiXx495w7BNA1d440mTqSGI5r0sDDuozjrV6xUF69M=";
   };
 
   configureFlags = lib.optionals withAcme [
diff --git a/pkgs/shells/fish/plugins/forgit.nix b/pkgs/shells/fish/plugins/forgit.nix
index f21eb8c2d5f2..682dbfb3256e 100644
--- a/pkgs/shells/fish/plugins/forgit.nix
+++ b/pkgs/shells/fish/plugins/forgit.nix
@@ -6,13 +6,13 @@
 
 buildFishPlugin rec {
   pname = "forgit";
-  version = "26.05.0";
+  version = "26.07.0";
 
   src = fetchFromGitHub {
     owner = "wfxr";
     repo = "forgit";
     rev = version;
-    hash = "sha256-EFbzrVgLfVO+dEEQ1vZUcZkIszZFCktYjQjwkBVrHQI=";
+    hash = "sha256-Ks/kUuQLtzKLjwIDpfkh6pL90aII8Rfh8ijxDmlFvmg=";
   };
 
   postInstall = ''
diff --git a/pkgs/tools/networking/iroh/default.nix b/pkgs/tools/networking/iroh/default.nix
index d0dc19d8b749..90d79532ef82 100644
--- a/pkgs/tools/networking/iroh/default.nix
+++ b/pkgs/tools/networking/iroh/default.nix
@@ -12,16 +12,16 @@ let
     }:
     rustPlatform.buildRustPackage rec {
       pname = name;
-      version = "1.0.0";
+      version = "1.0.1";
 
       src = fetchFromGitHub {
         owner = "n0-computer";
         repo = "iroh";
         rev = "v${version}";
-        hash = "sha256-L5y2/u5Sxh0tnl1NJS5dcRVLHDExHMiF12p0gRY2fzM=";
+        hash = "sha256-Tk9QXg+5Pu+xmfmo1FZRlshG3VLr3jTycybjKvnP9DU=";
       };
 
-      cargoHash = "sha256-R6b1BfKlgFCcPSif0qMHCj/gZ6v2beawbF4P3knkROw=";
+      cargoHash = "sha256-iLN2PJkWNyFPSNkAD/kgtmPb5c2HmMrhN+rUNoAnIFY=";
 
       buildFeatures = cargoFeatures;
       cargoBuildFlags = [
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index cdab56d218b2..2437fab8052a 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1939,6 +1939,7 @@ mapAliases {
   quorum = throw "'quorum' has been removed as it was broken and unmaintained upstream"; # Added 2025-11-07
   qutebrowser-qt5 = lib.warnOnInstantiate "'qutebrowser-qt5' has been removed as it depended on vulnerable and outdated qt5 webengine" qutebrowser; # Added 2026-01-14
   qv2ray = throw "'qv2ray' has been removed as it was unmaintained"; # Added 2025-06-03
+  r0vm = throw "'r0vm' has been removed as the binary is provided by 'cargo-risczero'"; # Added 2026-03-25
   ra-multiplex = lib.warnOnInstantiate "'ra-multiplex' has been renamed to/replaced by 'lspmux'" lspmux; # Added 2025-10-27
   rabbit = throw "'rabbit' has been renamed to/replaced by 'rabbit-ng'"; # Added 2026-02-18
   radiance = throw "'radiance' has been removed as it was broken for a long time"; # Added 2026-01-02
diff --git a/pkgs/top-level/default.nix b/pkgs/top-level/default.nix
index 4e19941441da..c9e888067a74 100644
--- a/pkgs/top-level/default.nix
+++ b/pkgs/top-level/default.nix
@@ -216,27 +216,37 @@ let
 
   fixedPoint = boot stages;
 
+  removeInternallyDisallowedAttrPaths =
+    let
+      # Same as `lib.removeAttrs`, but can remove nested attributes (and order of arguments is fixed)
+      # TODO: Consider moving to lib.attrpaths.removeAttrPaths
+      removeAttrPaths =
+        attrPathsToRemove: set:
+        let
+          split = lib.partition (
+            attrPath:
+            assert attrPath != [ ];
+            lib.length attrPath == 1
+          ) attrPathsToRemove;
+          nestedApplied =
+            set
+            // lib.mapAttrs (name: attrPaths: removeAttrPaths (lib.map lib.tail attrPaths) set.${name}) (
+              lib.groupBy (attrPath: lib.head attrPath) split.wrong
+            );
+        in
+        lib.removeAttrs nestedApplied (lib.map lib.head split.right);
+    in
+    removeAttrPaths (map (x: x.attrPath) config.attrPathsDisallowedForInternalUse);
+
   pkgs =
     # Generally only set by CI, don't want to cause a performance hit for users
     if config.attrPathsDisallowedForInternalUse == [ ] then
       fixedPoint
     else
       # See ./stage.nix, which replaced config.attrPathsDisallowedForInternalUse with aborts.
-      # We replace these attribute paths with their original derivations again,
-      # because CI would just error out from the aborting attributes themselves.
-      # Internally all packages still see the aborting attributes if used as dependencies,
-      # because we do this here after the fixed-point is calculated.
-      # Note that we don't want to remove the attributes entirely like what aliases.nix does,
-      # because unlike aliases, CI still needs to check the packages to evaluate at all,
-      # which it wouldn't if they're removed entirely.
-      lib.updateManyAttrsByPath
-        (map (attrs: {
-          path = attrs.attrPath;
-          update =
-            _:
-            lib.getAttrFromPath attrs.attrPath fixedPoint.__internalBeforeInternallyDisallowedAttrPathsOverlay;
-        }) config.attrPathsDisallowedForInternalUse)
-        (removeAttrs fixedPoint [ "__internalBeforeInternallyDisallowedAttrPathsOverlay" ]);
+      # To prevent these attributes from causing CI failures we remove them entirely.
+      # These attrs are still evaluated but in a different way, see ci/eval/default.nix
+      removeInternallyDisallowedAttrPaths fixedPoint;
 
 in
 checked pkgs
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 467fcdfb9c96..9033e7b92583 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -9574,6 +9574,8 @@ self: super: with self; {
 
   logging-tree = callPackage ../development/python-modules/logging-tree { };
 
+  logic2-automation = callPackage ../development/python-modules/logic2-automation { };
+
   logical-unification = callPackage ../development/python-modules/logical-unification { };
 
   logilab-common = callPackage ../development/python-modules/logilab/common.nix {
@@ -15351,6 +15353,10 @@ self: super: with self; {
 
   pysabnzbd = callPackage ../development/python-modules/pysabnzbd { };
 
+  pysail = callPackage ../development/python-modules/pysail {
+    protoc = pkgs.protobuf;
+  };
+
   pysaj = callPackage ../development/python-modules/pysaj { };
 
   pysam = callPackage ../development/python-modules/pysam { };
@@ -20423,6 +20429,8 @@ self: super: with self; {
 
   tt-flash = callPackage ../development/python-modules/tt-flash { };
 
+  tt-perf-report = callPackage ../development/python-modules/tt-perf-report { };
+
   tt-tools-common = callPackage ../development/python-modules/tt-tools-common { };
 
   ttach = callPackage ../development/python-modules/ttach { };
diff --git a/pkgs/top-level/stage.nix b/pkgs/top-level/stage.nix
index bc50a3f24247..8a01dc2f6aa8 100644
--- a/pkgs/top-level/stage.nix
+++ b/pkgs/top-level/stage.nix
@@ -310,20 +310,16 @@ let
   };
 
   # Replaces the attributes in config.attrPathsDisallowedForInternalUse with aborts.
+  # Not warnings because those wouldn't give a backtrace, which is important for debugging
   # Not throws because those would be ignored by nix-env, which is what CI uses to evaluate everything
-  # See also ./default.nix, where these attributes are added back again so they're still checked by CI
+  # See also ./default.nix, which removes these attributes entirely from the end result
   internallyDisallowedAttrPathsOverlay =
     final: prev:
     # Generally only set by CI, don't want to cause a performance hit for users
     if config.attrPathsDisallowedForInternalUse == [ ] then
       { }
     else
-      {
-        # So that ./default.nix can add them back again outside the fixed point
-        # Don't use this in packages!
-        __internalBeforeInternallyDisallowedAttrPathsOverlay = prev;
-      }
-      // lib.updateManyAttrsByPath (map (
+      lib.updateManyAttrsByPath (map (
         { attrPath, reason }:
         {
           path = attrPath;