diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 292e24c778dc..236e5638263b 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -25770,6 +25770,7 @@
   };
   skyesoss = {
     name = "Skye Soss";
+    email = "skye@soss.website";
     matrix = "@skyesoss:matrix.org";
     github = "Skyb0rg007";
     githubId = 30806179;
diff --git a/nixos/modules/config/nix-channel.nix b/nixos/modules/config/nix-channel.nix
index 515c3795a9fe..4d6e19975508 100644
--- a/nixos/modules/config/nix-channel.nix
+++ b/nixos/modules/config/nix-channel.nix
@@ -6,12 +6,16 @@
   - ./nix.nix
   - ./nix-flakes.nix
 */
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
   inherit (lib)
     mkIf
     mkOption
-    stringAfter
     types
     ;
 
@@ -98,8 +102,10 @@ in
       ''f /root/.nix-channels - - - - ${config.system.defaultChannel} nixos\n''
     ];
 
-    system.activationScripts.no-nix-channel = mkIf (!cfg.channel.enable) (
-      stringAfter [ "etc" "users" ] (builtins.readFile ./nix-channel/activation-check.sh)
+    system.preSwitchChecks.no-nix-channel = mkIf (!cfg.channel.enable) (
+      lib.replaceStrings [ "@getent@" ] [ (lib.getExe pkgs.getent) ] (
+        builtins.readFile ./nix-channel/pre-switch-check.sh
+      )
     );
   };
 }
diff --git a/nixos/modules/config/nix-channel/activation-check.sh b/nixos/modules/config/nix-channel/pre-switch-check.sh
similarity index 75%
rename from nixos/modules/config/nix-channel/activation-check.sh
rename to nixos/modules/config/nix-channel/pre-switch-check.sh
index 42b1b712d702..cf6d3af8395c 100644
--- a/nixos/modules/config/nix-channel/activation-check.sh
+++ b/nixos/modules/config/nix-channel/pre-switch-check.sh
@@ -1,4 +1,6 @@
-# shellcheck shell=bash
+warn() {
+    printf "\033[1;35mwarning:\033[0m %s\n" "$*" >&2
+}
 
 explainChannelWarning=0
 if [[ -e "/root/.nix-defexpr/channels" ]]; then
@@ -11,11 +13,13 @@ if [[ -e "/nix/var/nix/profiles/per-user/root/channels" ]]; then
 fi
 while IFS=: read -r _ _ _ _ _ home _ ; do
     if [[ -n  "$home" && -e "$home/.nix-defexpr/channels" ]]; then
-        warn "$home/.nix-defexpr/channels exists, but channels have been disabled." 1>&2
+        warn "$home/.nix-defexpr/channels exists, but channels have been disabled."
         explainChannelWarning=1
     fi
-done < <(getent passwd)
+done < <(@getent@ passwd)
 if [[ $explainChannelWarning -eq 1 ]]; then
-    echo "Due to https://github.com/NixOS/nix/issues/9574, Nix may still use these channels when NIX_PATH is unset." 1>&2
-    echo "Delete the above directory or directories to prevent this." 1>&2
+    echo "Due to https://github.com/NixOS/nix/issues/9574, Nix may still use these channels when NIX_PATH is unset." >&2
+    echo "Delete the above directory or directories to prevent this." >&2
 fi
+# This check is informational only and must never block a switch.
+true
diff --git a/nixos/modules/config/nix-channel/test.nix b/nixos/modules/config/nix-channel/test.nix
deleted file mode 100644
index 4692e01f12b1..000000000000
--- a/nixos/modules/config/nix-channel/test.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-# Run:
-#   nix-build -A nixosTests.nix-channel
-{ lib, testers }:
-let
-  inherit (lib) fileset;
-
-  runShellcheck = testers.shellcheck {
-    name = "activation-check";
-    src = fileset.toSource {
-      root = ./.;
-      fileset = fileset.unions [
-        ./activation-check.sh
-      ];
-    };
-  };
-
-in
-lib.recurseIntoAttrs {
-  inherit runShellcheck;
-}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 1dea04b0c19a..fa2faafc5054 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1122,7 +1122,6 @@ in
   nimdow = runTest ./nimdow.nix;
   nipap = runTest ./web-apps/nipap.nix;
   nitter = runTest ./nitter.nix;
-  nix-channel = pkgs.callPackage ../modules/config/nix-channel/test.nix { };
   nix-config = runTest ./nix-config.nix;
   nix-daemon-firewall = runTest ./nix-daemon-firewall.nix;
   nix-daemon-unprivileged = runTest ./nix-daemon-unprivileged.nix;
diff --git a/pkgs/applications/editors/neovim/tests/default.nix b/pkgs/applications/editors/neovim/tests/default.nix
index 20045b23a10a..de18a630cca4 100644
--- a/pkgs/applications/editors/neovim/tests/default.nix
+++ b/pkgs/applications/editors/neovim/tests/default.nix
@@ -9,6 +9,7 @@
 */
 {
   vimUtils,
+  neovimUtils,
   writeText,
   neovim,
   vimPlugins,
@@ -491,4 +492,70 @@ pkgs.lib.recurseIntoAttrs rec {
       '';
       passthru.requiredLuaModules = [ luassert ];
     };
+
+  nvim_require_check_neovim_plugin =
+    let
+      luaPkg = neovim-unwrapped.lua.pkgs.buildLuarocksPackage {
+        pname = "neovim-require-check-fails";
+        version = "0.0.1-1";
+        src = runCommandLocal "neovim-require-check-fails-src" { } ''
+          mkdir -p "$out"
+          cat > "$out/neovim-require-check-fails-0.0.1-1.rockspec" <<'EOF'
+          package = "neovim-require-check-fails"
+          version = "0.0.1-1"
+          source = {
+            url = "."
+          }
+          build = {
+            type = "none"
+          }
+          EOF
+        '';
+      };
+    in
+    testers.testBuildFailure (
+      neovimUtils.buildNeovimPlugin {
+        luaAttr = luaPkg;
+        doCheck = true;
+        postInstall = ''
+          mkdir -p "$out/lua"
+          cat > "$out/lua/require_check_fails.lua" <<'EOF'
+          error("neovimRequireCheckHook required installed module")
+          EOF
+        '';
+      }
+    );
+
+  nvim_require_check_ignores_test_modules = vimUtils.buildVimPlugin {
+    pname = "neovim-require-check-ignores-test-modules";
+    version = "0";
+    src = runCommandLocal "neovim-require-check-ignores-test-modules-src" { } ''
+      mkdir -p \
+        "$out/lua/require-check-ignores"/{debug,script,scripts,test,tests,spec,_meta} \
+        "$out/lua/require-check-ignores"
+      cat > "$out/lua/require-check-ignores/init.lua" <<'EOF'
+      return {}
+      EOF
+      for dir in debug script scripts test tests spec _meta; do
+        cat > "$out/lua/require-check-ignores/$dir/failing.lua" <<EOF
+      error("excluded $dir directory was required")
+      EOF
+      done
+      cat > "$out/lua/require-check-ignores/failing_meta.lua" <<'EOF'
+      error("excluded _meta module was required")
+      EOF
+      cat > "$out/lua/require-check-ignores/failing_spec.lua" <<'EOF'
+      error("excluded _spec module was required")
+      EOF
+      cat > "$out/lua/require-check-ignores/failing.spec.lua" <<'EOF'
+      error("excluded .spec module was required")
+      EOF
+      cat > "$out/lua/require-check-ignores/failing.test.lua" <<'EOF'
+      error("excluded .test module was required")
+      EOF
+      cat > "$out/lua/require-check-ignores/meta.lua" <<'EOF'
+      error("excluded meta module was required")
+      EOF
+    '';
+  };
 }
diff --git a/pkgs/applications/editors/vim/plugins/hooks/neovim-require-check-hook.sh b/pkgs/applications/editors/vim/plugins/hooks/neovim-require-check-hook.sh
index 60e6d6758198..5a309207cc53 100644
--- a/pkgs/applications/editors/vim/plugins/hooks/neovim-require-check-hook.sh
+++ b/pkgs/applications/editors/vim/plugins/hooks/neovim-require-check-hook.sh
@@ -4,17 +4,27 @@ echo "Sourcing neovim-require-check-hook.sh"
 
 # Discover modules automatically if nvimRequireCheck is not set
 discover_modules() {
-    echo "Running module discovery in source directory..."
+    echo "Running module discovery in output directory..."
 
     # Create unique lists so we can organize later
     modules=()
 
     while IFS= read -r lua_file; do
-        # Ignore certain infra directories
-        if [[ "$lua_file" =~ (^|/)(debug|script|scripts|test|tests|spec)(/|$) || "$lua_file" =~ .*\meta.lua ]]; then
-            continue
+        # Ignore infrastructure directories and non-runtime module files
+        case "/$lua_file/" in
+            */debug/* | */script/* | */scripts/* | */test/* | */tests/* | */spec/* | */_meta/*)
+                continue
+                ;;
+        esac
+
+        case "${lua_file##*/}" in
+            *meta.lua | *_spec.lua | *.spec.lua | *.test.lua)
+                continue
+                ;;
+        esac
+
         # Ignore optional telescope and lualine modules
-        elif [[ "$lua_file" =~ ^lua/telescope/_extensions/(.+)\.lua || "$lua_file" =~ ^lua/lualine/(.+)\.lua ]]; then
+        if [[ "$lua_file" =~ ^lua/telescope/_extensions/(.+)\.lua || "$lua_file" =~ ^lua/lualine/(.+)\.lua ]]; then
             continue
         # Grab main module names
         elif [[ "$lua_file" =~ ^lua/([^/]+)/init.lua$ ]]; then
@@ -30,7 +40,7 @@ discover_modules() {
             echo "$lua_file"
             modules+=("${BASH_REMATCH[1]}")
         fi
-    done < <(find "$src" -name '*.lua' | xargs -n 1 realpath --relative-to="$src")
+    done < <(find "$out" -name '*.lua' -exec realpath --relative-to="$out" {} +)
 
     nvimRequireCheck=("${modules[@]}")
     echo "Discovered modules: ${nvimRequireCheck[*]}"
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index aebfa6f8cc63..d66e45b02a3c 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -9,11 +9,11 @@
     "vendorHash": "sha256-RTfj2Omiqe92Ad0swEY/aGIMvcXb39bdQoObYKiekiw="
   },
   "a10networks_thunder": {
-    "hash": "sha256-RX3mP5btzyvuBjoMNiUL6ZeFLEo5SqmwwSK/eE0gWEw=",
+    "hash": "sha256-mqCXiBtVHzEOdLW0KudPWJO6kGi0SiGawN/NQvjAJdg=",
     "homepage": "https://registry.terraform.io/providers/a10networks/thunder",
     "owner": "a10networks",
     "repo": "terraform-provider-thunder",
-    "rev": "v1.5.0",
+    "rev": "v1.6.0",
     "spdx": "BSD-2-Clause",
     "vendorHash": null
   },
@@ -517,13 +517,13 @@
     "vendorHash": "sha256-XnVGjEz4mxqkNFrvgpRQ4W9s+j03mk0NTgEx4p5Z6qk="
   },
   "hashicorp_awscc": {
-    "hash": "sha256-kpLC5NdlpBNXj2V0hR8ZvsJjyVgKCXFt7xK8Z7AOyoQ=",
+    "hash": "sha256-ywRxQKGrQ+kT08gNgNgdT5FmvsHYucT/W29+uyz1mwg=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/awscc",
     "owner": "hashicorp",
     "repo": "terraform-provider-awscc",
-    "rev": "v1.85.0",
+    "rev": "v1.87.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-ryLMz2eh5LO0e6OLJJUoMbM+U53uDTq9sHNcnSuuWt4="
+    "vendorHash": "sha256-Bf2XnjX0G5iufWOi6E/imRQ+qgr8Yse73rrnY8CbSMg="
   },
   "hashicorp_azuread": {
     "hash": "sha256-BkQwLkGu8Xmb4laoXOLDbSPyya5v8HBBNIya5hUBlV8=",
@@ -851,11 +851,11 @@
     "vendorHash": "sha256-OgKOjLwDQxJiv+VWdOzjMcUDPu9LOuhyTRyLyM39vLM="
   },
   "linode_linode": {
-    "hash": "sha256-FUOVV0gyUMb7VnZkK0ua92IHOUJ4wmnkbjh0fSQ9vGc=",
+    "hash": "sha256-ZDU8rEmbq9tIXq9+jL30i5GnTIWM6lMJ+rljVJhBJis=",
     "homepage": "https://registry.terraform.io/providers/linode/linode",
     "owner": "linode",
     "repo": "terraform-provider-linode",
-    "rev": "v3.13.0",
+    "rev": "v3.14.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-6wWNt0TDqqwtRFMCLH81WQ55XLEn4dHx+prM0DA+e4U="
   },
diff --git a/pkgs/applications/networking/p2p/transmission/0001-Skip-bundle-fixup.patch b/pkgs/applications/networking/p2p/transmission/0001-Skip-bundle-fixup.patch
new file mode 100644
index 000000000000..0289bfbd9d90
--- /dev/null
+++ b/pkgs/applications/networking/p2p/transmission/0001-Skip-bundle-fixup.patch
@@ -0,0 +1,61 @@
+From a8122a78c496f09711e81c669ca3ee44c8df79f9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Stanis=C5=82aw=20Pitucha?= <stan.pitucha@envato.com>
+Date: Fri, 27 Mar 2026 08:58:08 +1100
+Subject: [PATCH] Skip fixup; it's unnecessary for nixpkgs
+
+---
+ cmake/TrMacros.cmake | 38 --------------------------------------
+ 1 file changed, 38 deletions(-)
+
+diff --git a/cmake/TrMacros.cmake b/cmake/TrMacros.cmake
+index 2efa8767c..cc17a47a5 100644
+--- a/cmake/TrMacros.cmake
++++ b/cmake/TrMacros.cmake
+@@ -376,44 +376,6 @@ function(tr_select_library LIBNAMES FUNCNAME DIRS OVAR)
+ endfunction()
+ 
+ function(tr_fixup_bundle_item BUNDLE_DIR BUNDLE_ITEMS DEP_DIRS)
+-    while(BUNDLE_ITEMS)
+-        list(GET BUNDLE_ITEMS 0 ITEM)
+-        list(REMOVE_AT BUNDLE_ITEMS 0)
+-
+-        set(ITEM_FULL_BUNDLE_PATH "${BUNDLE_DIR}/${ITEM}")
+-        get_filename_component(ITEM_FULL_BUNDLE_DIR "${ITEM_FULL_BUNDLE_PATH}" PATH)
+-
+-        unset(ITEM_DEPS)
+-        get_prerequisites("${ITEM_FULL_BUNDLE_PATH}" ITEM_DEPS 1 0 "${ITEM_FULL_BUNDLE_PATH}" "${DEP_DIRS}")
+-
+-        foreach(DEP IN LISTS ITEM_DEPS)
+-            gp_resolve_item("${ITEM_FULL_BUNDLE_PATH}" "${DEP}" "${ITEM_FULL_BUNDLE_DIR}" "${DEP_DIRS}" DEP_FULL_PATH)
+-
+-            if(DEP_FULL_PATH MATCHES "[.]dylib$")
+-                get_filename_component(DEP_NAME "${DEP_FULL_PATH}" NAME)
+-                file(COPY "${DEP_FULL_PATH}" DESTINATION "${BUNDLE_DIR}/Contents/MacOS/")
+-                set(DEP_BUNDLE_PATH "Contents/MacOS/${DEP_NAME}")
+-            elseif(DEP_FULL_PATH MATCHES "^(.+)/(([^/]+[.]framework)/.+)$")
+-                set(DEP_NAME "${CMAKE_MATCH_2}")
+-                file(
+-                    COPY "${CMAKE_MATCH_1}/${CMAKE_MATCH_3}"
+-                    DESTINATION "${BUNDLE_DIR}/Contents/Frameworks/"
+-                    PATTERN "Headers" EXCLUDE)
+-                set(DEP_BUNDLE_PATH "Contents/Frameworks/${DEP_NAME}")
+-            else()
+-                message(FATAL_ERROR "Don't know how to fixup '${DEP_FULL_PATH}'")
+-            endif()
+-
+-            execute_process(COMMAND install_name_tool -change "${DEP}" "@rpath/${DEP_NAME}" "${ITEM_FULL_BUNDLE_PATH}")
+-
+-            set(DEP_FULL_BUNDLE_PATH "${BUNDLE_DIR}/${DEP_BUNDLE_PATH}")
+-            execute_process(COMMAND chmod u+w "${DEP_FULL_BUNDLE_PATH}")
+-            execute_process(COMMAND install_name_tool -id "@rpath/${DEP_NAME}" "${DEP_FULL_BUNDLE_PATH}")
+-
+-            list(REMOVE_ITEM BUNDLE_ITEMS "${DEP_BUNDLE_PATH}")
+-            list(APPEND BUNDLE_ITEMS "${DEP_BUNDLE_PATH}")
+-        endforeach()
+-    endwhile()
+ endfunction()
+ 
+ function(tr_glib_compile_resources TGT NAME INPUT_DIR INPUT_FILE OUTPUT_FILE_BASE)
+-- 
+2.51.2
+
diff --git a/pkgs/applications/networking/p2p/transmission/4.nix b/pkgs/applications/networking/p2p/transmission/4.nix
index b41a170aee6e..c1adb44edcc2 100644
--- a/pkgs/applications/networking/p2p/transmission/4.nix
+++ b/pkgs/applications/networking/p2p/transmission/4.nix
@@ -30,6 +30,7 @@
   wrapGAppsHook3,
   enableQt5 ? false,
   enableQt6 ? false,
+  enableMac ? false,
   qt5,
   qt6Packages,
   nixosTests,
@@ -38,10 +39,14 @@
   enableCli ? true,
   installLib ? false,
   apparmorRulesFromClosure,
+  ibtool,
+  actool,
+  coreutils,
+  makeWrapper,
 }:
 
 let
-  inherit (lib) cmakeBool optionals;
+  inherit (lib) cmakeBool optionals optionalString;
 
   apparmorRules = apparmorRulesFromClosure { name = "transmission-daemon"; } (
     [
@@ -71,16 +76,29 @@ stdenv.mkDerivation (finalAttrs: {
     fetchSubmodules = true;
   };
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  patches = [
+    ./0001-Skip-bundle-fixup.patch
+  ];
+
   outputs = [
     "out"
+  ]
+  ++ optionals stdenv.hostPlatform.isLinux [
     "apparmor"
   ];
 
+  # Remove once https://github.com/NixOS/nixpkgs/pull/508307 lands
+  # Stop clang trying to write in $HOME
+  env.CLANG_MODULE_CACHE_PATH = "/tmp/clang_module_cache";
+
   cmakeFlags = [
     (cmakeBool "ENABLE_CLI" enableCli)
     (cmakeBool "ENABLE_DAEMON" enableDaemon)
     (cmakeBool "ENABLE_GTK" enableGTK3)
-    (cmakeBool "ENABLE_MAC" false) # requires xcodebuild
+    (cmakeBool "ENABLE_MAC" enableMac)
     (cmakeBool "ENABLE_QT" (enableQt5 || enableQt6))
     (cmakeBool "INSTALL_LIB" installLib)
     (cmakeBool "RUN_CLANG_TIDY" false)
@@ -88,6 +106,9 @@ stdenv.mkDerivation (finalAttrs: {
   ++ optionals stdenv.hostPlatform.isDarwin [
     # Transmission sets this to 10.13 if not explicitly specified, see https://github.com/transmission/transmission/blob/0be7091eb12f4eb55f6690f313ef70a66795ee72/CMakeLists.txt#L7-L16.
     "-DCMAKE_OSX_DEPLOYMENT_TARGET=${stdenv.hostPlatform.darwinMinVersion}"
+    # we don't have a compatible-enough signing tool right now
+    "-DCODESIGN_EXECUTABLE=${lib.getExe' coreutils "true"}"
+    "-DACTOOL_EXECUTABLE=${lib.getExe actool}"
   ];
 
   postPatch = ''
@@ -109,6 +130,12 @@ stdenv.mkDerivation (finalAttrs: {
     # Upstream uses different config file name.
     substituteInPlace CMakeLists.txt \
       --replace-fail 'find_package(UtfCpp)' 'find_package(utf8cpp)'
+  ''
+  + optionalString (stdenv.hostPlatform.isDarwin && (enableQt5 || enableQt6)) ''
+    substituteInPlace qt/CMakeLists.txt \
+      --replace-fail \
+        'transmission::qt_impl)' \
+        'transmission::qt_impl "-framework AppKit" "-framework CoreGraphics")'
   '';
 
   nativeBuildInputs = [
@@ -118,7 +145,12 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ optionals enableGTK3 [ wrapGAppsHook3 ]
   ++ optionals enableQt5 [ qt5.wrapQtAppsHook ]
-  ++ optionals enableQt6 [ qt6Packages.wrapQtAppsHook ];
+  ++ optionals enableQt6 [ qt6Packages.wrapQtAppsHook ]
+  ++ optionals enableMac [
+    ibtool
+    actool
+    makeWrapper
+  ];
 
   buildInputs = [
     curl
@@ -160,29 +192,33 @@ stdenv.mkDerivation (finalAttrs: {
   ++ optionals enableSystemd [ systemd ]
   ++ optionals stdenv.hostPlatform.isLinux [ inotify-tools ];
 
-  postInstall = ''
-    mkdir $apparmor
-    cat >$apparmor/bin.transmission-daemon <<EOF
-    abi <abi/4.0>,
-    include <tunables/global>
-    profile $out/bin/transmission-daemon {
-      include <abstractions/base>
-      include <abstractions/nameservice>
-      include <abstractions/ssl_certs>
-      include "${apparmorRules}"
-      @{PROC}/sys/kernel/random/uuid r,
-      @{PROC}/sys/vm/overcommit_memory r,
-      @{PROC}/@{pid}/environ r,
-      @{PROC}/@{pid}/mounts r,
-      /tmp/tr_session_id_* rwk,
+  postInstall =
+    optionalString stdenv.hostPlatform.isLinux ''
+      mkdir $apparmor
+      cat >$apparmor/bin.transmission-daemon <<EOF
+      abi <abi/4.0>,
+      include <tunables/global>
+      profile $out/bin/transmission-daemon {
+        include <abstractions/base>
+        include <abstractions/nameservice>
+        include <abstractions/ssl_certs>
+        include "${apparmorRules}"
+        @{PROC}/sys/kernel/random/uuid r,
+        @{PROC}/sys/vm/overcommit_memory r,
+        @{PROC}/@{pid}/environ r,
+        @{PROC}/@{pid}/mounts r,
+        /tmp/tr_session_id_* rwk,
 
-      $out/share/transmission/public_html/** r,
+        $out/share/transmission/public_html/** r,
 
-      include if exists <local/bin.transmission-daemon>
-    }
-    EOF
-    install -Dm0444 -t $out/share/icons ../icons/hicolor_apps_scalable_transmission.svg
-  '';
+        include if exists <local/bin.transmission-daemon>
+      }
+      EOF
+      install -Dm0444 -t $out/share/icons ../icons/hicolor_apps_scalable_transmission.svg
+    ''
+    + optionalString enableMac ''
+      makeWrapper $out/Applications/Transmission.app/Contents/MacOS/Transmission $out/bin/transmission-mac
+    '';
 
   passthru.tests = {
     apparmor = nixosTests.transmission_4; # starts the service with apparmor enabled
@@ -196,6 +232,8 @@ stdenv.mkDerivation (finalAttrs: {
         "transmission-qt"
       else if enableGTK3 then
         "transmission-gtk"
+      else if enableMac then
+        "transmission-mac"
       else
         "transmission-cli";
     longDescription = ''
diff --git a/pkgs/build-support/setup-hooks/install-fonts.sh b/pkgs/build-support/setup-hooks/install-fonts.sh
index 2e63cd75f0a5..46909fe83c03 100644
--- a/pkgs/build-support/setup-hooks/install-fonts.sh
+++ b/pkgs/build-support/setup-hooks/install-fonts.sh
@@ -46,6 +46,7 @@ installFonts() {
   installFont 'bdf' "$out/share/fonts/misc"
   installFont 'pcf' "$out/share/fonts/misc"
   installFont 'otb' "$out/share/fonts/misc"
+  installFont 'pcf.gz' "$out/share/fonts/misc"
   installFont 'psf' "$out/share/consolefonts"
   installFont 'psfu' "$out/share/consolefonts"
 
diff --git a/pkgs/by-name/ab/abaddon/package.nix b/pkgs/by-name/ab/abaddon/package.nix
index 8d989cc16bb1..a630b59c2bcc 100644
--- a/pkgs/by-name/ab/abaddon/package.nix
+++ b/pkgs/by-name/ab/abaddon/package.nix
@@ -21,14 +21,14 @@
   sqlite,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "abaddon";
   version = "0.2.4";
 
   src = fetchFromGitHub {
     owner = "uowuo";
     repo = "abaddon";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-fSNXMbyYmUOA4x911/an02fhhhWe6a4xlLVb2DIqIOE=";
     fetchSubmodules = true;
   };
@@ -74,11 +74,11 @@ stdenv.mkDerivation rec {
 
   desktopItems = [
     (makeDesktopItem {
-      name = pname;
-      exec = pname;
+      name = finalAttrs.pname;
+      exec = finalAttrs.pname;
       desktopName = "Abaddon";
-      genericName = meta.description;
-      startupWMClass = pname;
+      genericName = finalAttrs.meta.description;
+      startupWMClass = finalAttrs.pname;
       categories = [
         "Network"
         "InstantMessaging"
@@ -95,4 +95,4 @@ stdenv.mkDerivation rec {
     maintainers = with lib.maintainers; [ choco98 ];
     platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/by-name/ac/acpilight/package.nix b/pkgs/by-name/ac/acpilight/package.nix
index 79a45f5dbe72..97807bb733f3 100644
--- a/pkgs/by-name/ac/acpilight/package.nix
+++ b/pkgs/by-name/ac/acpilight/package.nix
@@ -7,14 +7,14 @@
   udevCheckHook,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "acpilight";
   version = "1.2";
 
   src = fetchgit {
     url = "https://gitlab.com/wavexx/acpilight.git";
-    tag = "v${version}";
-    sha256 = "1r0r3nx6x6vkpal6vci0zaa1n9dfacypldf6k8fxg7919vzxdn1w";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-PNjW/04hndcdmsY1ej1TriUblPogsm2ounObbrodGeQ=";
   };
 
   pyenv = python3.withPackages (
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     substituteInPlace Makefile --replace-fail udevadm true
   '';
 
-  buildInputs = [ pyenv ];
+  buildInputs = [ finalAttrs.pyenv ];
 
   makeFlags = [ "DESTDIR=$(out) prefix=" ];
 
@@ -45,4 +45,4 @@ stdenv.mkDerivation rec {
     platforms = lib.platforms.linux;
     mainProgram = "xbacklight";
   };
-}
+})
diff --git a/pkgs/by-name/ad/adl/package.nix b/pkgs/by-name/ad/adl/package.nix
index 1f4559144f4f..8d9afd647c21 100644
--- a/pkgs/by-name/ad/adl/package.nix
+++ b/pkgs/by-name/ad/adl/package.nix
@@ -11,7 +11,7 @@
   trackma,
   ueberzug,
 }:
-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "adl";
   version = "3.2.8";
 
@@ -41,7 +41,7 @@ stdenvNoCC.mkDerivation rec {
     mkdir -p $out/bin
     cp $src/adl $out/bin
     wrapProgram $out/bin/adl \
-      --prefix PATH : ${lib.makeBinPath buildInputs}
+      --prefix PATH : ${lib.makeBinPath finalAttrs.buildInputs}
   '';
 
   meta = {
@@ -52,4 +52,4 @@ stdenvNoCC.mkDerivation rec {
     maintainers = with lib.maintainers; [ weathercold ];
     mainProgram = "adl";
   };
-}
+})
diff --git a/pkgs/by-name/ad/adr-tools/package.nix b/pkgs/by-name/ad/adr-tools/package.nix
index ac790896b397..2b5ff00c943c 100644
--- a/pkgs/by-name/ad/adr-tools/package.nix
+++ b/pkgs/by-name/ad/adr-tools/package.nix
@@ -20,14 +20,14 @@
   runCommand,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "adr-tools";
   version = "3.0.0";
 
   src = fetchFromGitHub {
     owner = "npryce";
     repo = "adr-tools";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-JEwLn+SY6XcaQ9VhN8ARQaZc1zolgAJKfIqPggzV+sU=";
   };
 
@@ -112,4 +112,4 @@ stdenv.mkDerivation rec {
     mainProgram = "adr";
     platforms = lib.platforms.all;
   };
-}
+})
diff --git a/pkgs/by-name/af/afsctool/package.nix b/pkgs/by-name/af/afsctool/package.nix
index 2879be3d1ab9..67d1d48865ee 100644
--- a/pkgs/by-name/af/afsctool/package.nix
+++ b/pkgs/by-name/af/afsctool/package.nix
@@ -9,14 +9,14 @@
   sparsehash,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "afsctool";
   version = "1.7.3";
 
   src = fetchFromGitHub {
     owner = "RJVB";
     repo = "afsctool";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
     gitConfigFile = builtins.toFile "gitconfig" ''
       [url "https://github.com/"]
@@ -46,4 +46,4 @@ stdenv.mkDerivation rec {
     platforms = lib.platforms.darwin;
     homepage = "https://github.com/RJVB/afsctool";
   };
-}
+})
diff --git a/pkgs/by-name/ai/aixlog/package.nix b/pkgs/by-name/ai/aixlog/package.nix
index 7a3edcc4f535..f93cb7d04744 100644
--- a/pkgs/by-name/ai/aixlog/package.nix
+++ b/pkgs/by-name/ai/aixlog/package.nix
@@ -4,14 +4,14 @@
   fetchFromGitHub,
 }:
 
-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "aixlog";
   version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "badaix";
     repo = "aixlog";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-Xhle7SODRZlHT3798mYIzBi1Mqjz8ai74/UnbVWetiY=";
   };
 
@@ -30,8 +30,8 @@ stdenvNoCC.mkDerivation rec {
   meta = {
     description = "Header-only C++ logging library";
     homepage = "https://github.com/badaix/aixlog";
-    changelog = "https://github.com/badaix/aixlog/releases/tag/${src.rev}";
+    changelog = "https://github.com/badaix/aixlog/releases/tag/${finalAttrs.src.rev}";
     license = lib.licenses.mit;
     maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/by-name/as/astc-encoder/package.nix b/pkgs/by-name/as/astc-encoder/package.nix
index c50ccb7cd6a6..cd0ad68a83b2 100644
--- a/pkgs/by-name/as/astc-encoder/package.nix
+++ b/pkgs/by-name/as/astc-encoder/package.nix
@@ -47,13 +47,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "astc-encoder";
-  version = "5.3.0";
+  version = "5.4.0";
 
   src = fetchFromGitHub {
     owner = "ARM-software";
     repo = "astc-encoder";
     tag = finalAttrs.version;
-    hash = "sha256-15fX+3wzDoVzvQAhneeGajMsFXqSwmYtlsi3qrNFNus=";
+    hash = "sha256-mpaLSf1K+SsxkQm/b+QIWU34TzHQ7CAkyDNczBrcmBo=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/au/auto-editor/package.nix b/pkgs/by-name/au/auto-editor/package.nix
index e05306603a54..2d66a987d949 100644
--- a/pkgs/by-name/au/auto-editor/package.nix
+++ b/pkgs/by-name/au/auto-editor/package.nix
@@ -19,13 +19,13 @@
 
 buildNimPackage rec {
   pname = "auto-editor";
-  version = "30.3.0";
+  version = "30.4.0";
 
   src = fetchFromGitHub {
     owner = "WyattBlue";
     repo = "auto-editor";
     tag = version;
-    hash = "sha256-1DFTT6dyIYlB3EMPf5eleXvRr1d29jmtt7GQfRpOkUE=";
+    hash = "sha256-AzUTDOWzyhZLrwqO9HfZ/Ke72LElJAMzVoDydBfYKwg=";
   };
 
   lockFile = ./lock.json;
diff --git a/pkgs/by-name/ba/babelstone-han/package.nix b/pkgs/by-name/ba/babelstone-han/package.nix
index 183963b55897..6b8287cccac7 100644
--- a/pkgs/by-name/ba/babelstone-han/package.nix
+++ b/pkgs/by-name/ba/babelstone-han/package.nix
@@ -2,29 +2,19 @@
   lib,
   stdenvNoCC,
   fetchzip,
+  installFonts,
 }:
 
-let
-  version = "16.0.3";
-in
-
-stdenvNoCC.mkDerivation {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "babelstone-han";
-  inherit version;
+  version = "16.0.3";
 
   src = fetchzip {
-    url = "https://babelstone.co.uk/Fonts/Download/BabelStoneHan-${version}.zip";
+    url = "https://babelstone.co.uk/Fonts/Download/BabelStoneHan-${finalAttrs.version}.zip";
     hash = "sha256-HmmRJLs51hoHoKQYdjbiivnJl+RhcBwzkng+5PoqX10=";
   };
 
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/share/fonts/truetype
-    cp *.ttf $out/share/fonts/truetype
-
-    runHook postInstall
-  '';
+  nativeBuildInputs = [ installFonts ];
 
   meta = {
     description = "Unicode CJK font with over 36000 Han characters";
@@ -34,4 +24,4 @@ stdenvNoCC.mkDerivation {
     platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [ emily ];
   };
-}
+})
diff --git a/pkgs/by-name/ca/catalyst/package.nix b/pkgs/by-name/ca/catalyst/package.nix
index b0e0c1ca8c52..59fd8080d95b 100644
--- a/pkgs/by-name/ca/catalyst/package.nix
+++ b/pkgs/by-name/ca/catalyst/package.nix
@@ -19,14 +19,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "catalyst";
-  version = "2.0.0";
+  version = "2.1.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.kitware.com";
     owner = "paraview";
     repo = "catalyst";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-uPb7vgJpKquZVmSMxeWDVMiNkUdYv3oVVKu7t4+zkbs=";
+    hash = "sha256-8pBQQE5/h9LKRgFJi/KHtQPQ9rm7JyxBRVgh6Uf0Q98=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/cd/cdncheck/package.nix b/pkgs/by-name/cd/cdncheck/package.nix
index f4eea41b6e56..0034ed03c267 100644
--- a/pkgs/by-name/cd/cdncheck/package.nix
+++ b/pkgs/by-name/cd/cdncheck/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "cdncheck";
-  version = "1.2.37";
+  version = "1.2.38";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "cdncheck";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gw3WhhuCXFTAaqO4Sp8TDZ1W6xTCvH91hK5R/GEgoY0=";
+    hash = "sha256-OZ+rCxcJCeo8kWoL0UT7+bsT+QWt/xtKFKb0oHogB7o=";
   };
 
-  vendorHash = "sha256-gCq1m+9XCo4HGL1sT5AEMP0M430sy+5aKeOHwUWlme4=";
+  vendorHash = "sha256-iJ1agL7sZ3ZKbW1wMA+qi8FgHdPa6gZLQ5BBPKJTNaQ=";
 
   subPackages = [ "cmd/cdncheck/" ];
 
diff --git a/pkgs/by-name/ch/chatbox/package.nix b/pkgs/by-name/ch/chatbox/package.nix
deleted file mode 100644
index dd4a2bd893b2..000000000000
--- a/pkgs/by-name/ch/chatbox/package.nix
+++ /dev/null
@@ -1,49 +0,0 @@
-{
-  lib,
-  appimageTools,
-  fetchurl,
-  writeScript,
-}:
-let
-  pname = "chatbox";
-  version = "1.20.3";
-
-  src = fetchurl {
-    url = "https://download.chatboxai.app/releases/Chatbox-${version}-x86_64.AppImage";
-    hash = "sha256-m2nCVYa2OGd1vV685+0Z3K6g4LjkHL5edhJ43ENWAZM=";
-  };
-
-  appimageContents = appimageTools.extract { inherit pname version src; };
-in
-appimageTools.wrapType2 {
-  inherit pname version src;
-
-  extraInstallCommands = ''
-    install -m 444 -D ${appimageContents}/xyz.chatboxapp.app.desktop $out/share/applications/chatbox.desktop
-    install -m 444 -D ${appimageContents}/usr/share/icons/hicolor/512x512/apps/xyz.chatboxapp.app.png $out/share/icons/hicolor/512x512/apps/chatbox.png
-    substituteInPlace $out/share/applications/chatbox.desktop \
-      --replace-fail 'Exec=AppRun' 'Exec=chatbox' \
-      --replace-fail 'Icon=xyz.chatboxapp.app' 'Icon=chatbox'
-  '';
-
-  passthru.updateScript = writeScript "update-chatbox" ''
-    #!/usr/bin/env nix-shell
-    #!nix-shell -i bash -p curl gnugrep common-updater-scripts
-    version=$(curl -I -X GET https://chatboxai.app/install_chatbox/linux | grep -oP 'Chatbox-\K[0-9]+\.[0-9]+\.[0-9]+')
-    update-source-version chatbox $version
-  '';
-
-  meta = {
-    description = "AI client application and smart assistant";
-    homepage = "https://chatboxai.app";
-    downloadPage = "https://chatboxai.app/en#download";
-    changelog = "https://chatboxai.app/en/help-center/changelog";
-    license = lib.licenses.unfree;
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    maintainers = with lib.maintainers; [ c31io ];
-    mainProgram = "chatbox";
-
-    # Help porting to other platforms :)
-    platforms = [ "x86_64-linux" ];
-  };
-}
diff --git a/pkgs/by-name/cn/cnspec/package.nix b/pkgs/by-name/cn/cnspec/package.nix
index ef3826002e66..77212ab59b19 100644
--- a/pkgs/by-name/cn/cnspec/package.nix
+++ b/pkgs/by-name/cn/cnspec/package.nix
@@ -6,18 +6,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "cnspec";
-  version = "13.11.0";
+  version = "13.21.0";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnspec";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-MhORGeHFIiNHCipbpCl18utmCVD09UyN5dwNravus0o=";
+    hash = "sha256-RQ7OmsGTibOPL1R9h9+2sRXQhgToI+zwmMfuupwcjQI=";
   };
 
   proxyVendor = true;
 
-  vendorHash = "sha256-4p8vsWUdeVVG6qy1QMbuyxJarA1l72euzoswmMDn7gM=";
+  vendorHash = "sha256-TMrDKXQC/l6859ygN8yjVE5vVoJWHLUh+bUpPirNp/Y=";
 
   subPackages = [ "apps/cnspec" ];
 
diff --git a/pkgs/by-name/co/conduit/package.nix b/pkgs/by-name/co/conduit/package.nix
index b86b3f91bfac..21d7033120f5 100644
--- a/pkgs/by-name/co/conduit/package.nix
+++ b/pkgs/by-name/co/conduit/package.nix
@@ -15,14 +15,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "conduit";
-  version = "0.9.5";
+  version = "0.9.7";
 
   src = fetchFromGitHub {
     owner = "LLNL";
     repo = "conduit";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-mX7/5C4wd70Kx1rQyo2BcZMwDRqvxo4fBdz3pq7PuvM=";
+    hash = "sha256-DmnHGj6Q/i+wVNIbaTGrFX9f0Kry2X5bC7zahXv29I4=";
   };
 
   nativeBuildInputs = [
@@ -41,13 +41,24 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "ENABLE_MPI" mpiSupport)
   ];
 
-  installCheckPhase = ''
-    runHook preInstallCheck
+  installCheckPhase =
+    let
+      excludedTests = lib.optionals stdenv.hostPlatform.isDarwin [
+        # SIGTRAP***Exception
+        "t_conduit_fixed_size_vector"
+      ];
 
-    make test
+      excludedTestsString = lib.optionalString (
+        excludedTests != [ ]
+      ) "-E '^(${builtins.concatStringsSep "|" excludedTests})$'";
+    in
+    ''
+      runHook preInstallCheck
 
-    runHook postInstallCheck
-  '';
+      ctest --output-on-failure ${excludedTestsString}
+
+      runHook postInstallCheck
+    '';
   doInstallCheck = true;
 
   passthru = {
diff --git a/pkgs/by-name/da/dalfox/package.nix b/pkgs/by-name/da/dalfox/package.nix
index ffc577f06654..5254924b25ad 100644
--- a/pkgs/by-name/da/dalfox/package.nix
+++ b/pkgs/by-name/da/dalfox/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "dalfox";
-  version = "3.0.0";
+  version = "3.0.2";
 
   src = fetchFromGitHub {
     owner = "hahwul";
     repo = "dalfox";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-EYX+nag7aaqm9Saa9w4fbuxyuHxx1TIIgIj/yTKfE98=";
+    hash = "sha256-IUCpDTTJJHZS+e/7ZR2ObZOxLIQhPD6MZvYp9opqUAI=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/em/embedxpl/package.nix b/pkgs/by-name/em/embedxpl/package.nix
index f01cb4bd46fe..5a4b59fb776f 100644
--- a/pkgs/by-name/em/embedxpl/package.nix
+++ b/pkgs/by-name/em/embedxpl/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "embedxpl";
-  version = "3.1.0";
+  version = "3.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mrhenrike";
     repo = "EmbedXPL-Forge";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-C7BTFRvhIjUePXxVmUbZXN2EKi+D/nE220/6ms30yAs=";
+    hash = "sha256-UzlJFg/30xwUmWDoRBlTbHKgLvCudHOGeqyfBYQO2qQ=";
   };
 
   __structuredAttrs = true;
diff --git a/pkgs/by-name/en/envypn-font/package.nix b/pkgs/by-name/en/envypn-font/package.nix
index 2535b2db9a22..5ea85b53d92f 100644
--- a/pkgs/by-name/en/envypn-font/package.nix
+++ b/pkgs/by-name/en/envypn-font/package.nix
@@ -5,6 +5,7 @@
   libfaketime,
   mkfontscale,
   fonttosfnt,
+  installFonts,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -17,6 +18,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   nativeBuildInputs = [
+    installFonts
     libfaketime
     fonttosfnt
     mkfontscale
@@ -38,13 +40,8 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postBuild
   '';
 
-  installPhase = ''
-    runHook preInstall
-
-    install -D -m 644 -t "$out/share/fonts/misc" *.otb *.pcf.gz
+  postInstall = ''
     mkfontdir "$out/share/fonts/misc"
-
-    runHook postInstall
   '';
 
   meta = {
diff --git a/pkgs/by-name/fe/feishin/package.nix b/pkgs/by-name/fe/feishin/package.nix
index bcdb50f4a5a0..4e2f82063d42 100644
--- a/pkgs/by-name/fe/feishin/package.nix
+++ b/pkgs/by-name/fe/feishin/package.nix
@@ -3,29 +3,30 @@
   stdenv,
   buildNpmPackage,
   fetchFromGitHub,
-  electron_40,
+  electron_41,
   dart-sass,
   mpv-unwrapped,
   fetchPnpmDeps,
   pnpmConfigHook,
   pnpm_10_29_2,
   darwin,
+  actool,
   copyDesktopItems,
   makeDesktopItem,
   nix-update-script,
 }:
 let
   pname = "feishin";
-  version = "1.11.0";
+  version = "1.13.0";
 
   src = fetchFromGitHub {
     owner = "jeffvli";
     repo = "feishin";
     tag = "v${version}";
-    hash = "sha256-TSjgjNHhPSZ4k7zZTH5e3FCkl6d7B/2w2WCt0S5OW0g=";
+    hash = "sha256-v6dWzEB1+IK4bHmDo8Rr5e0Xi3OWKcm+UPBmBiSfdZ0=";
   };
 
-  electron = electron_40;
+  electron = electron_41;
 in
 buildNpmPackage {
   inherit pname version;
@@ -43,7 +44,7 @@ buildNpmPackage {
       ;
     pnpm = pnpm_10_29_2;
     fetcherVersion = 3;
-    hash = "sha256-2fLqqCbbCIPoW/wGzsZOpZd5tnvyrLYlrVhbFWixlDM=";
+    hash = "sha256-zNOGJ24G0xcgsGK4DmbBm7d1PHTp7IJS+RTALGRtfDg=";
   };
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
@@ -52,17 +53,15 @@ buildNpmPackage {
     pnpm_10_29_2
   ]
   ++ lib.optionals (stdenv.hostPlatform.isLinux) [ copyDesktopItems ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.autoSignDarwinBinariesHook ];
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    darwin.autoSignDarwinBinariesHook
+    actool
+  ];
 
   postPatch = ''
     # release/app dependencies are installed on preConfigure
     substituteInPlace package.json \
       --replace-fail '"postinstall": "electron-builder install-app-deps",' ""
-  ''
-  + lib.optionalString stdenv.hostPlatform.isLinux ''
-    # https://github.com/electron/electron/issues/31121
-    substituteInPlace src/main/index.ts \
-      --replace-fail "process.resourcesPath" "'$out/share/feishin/resources'"
   '';
 
   preBuild = ''
diff --git a/pkgs/by-name/gl/gleam/package.nix b/pkgs/by-name/gl/gleam/package.nix
index 0db5b8368bad..58580ef85722 100644
--- a/pkgs/by-name/gl/gleam/package.nix
+++ b/pkgs/by-name/gl/gleam/package.nix
@@ -12,20 +12,21 @@
   deno,
   versionCheckHook,
   nix-update-script,
+  writableTmpDirAsHomeHook,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "gleam";
-  version = "1.16.0";
+  version = "1.17.0";
 
   src = fetchFromGitHub {
     owner = "gleam-lang";
     repo = "gleam";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/AYtZ/nd0PIAaf9z/Uk8tw9ziczczerQO8D3g7n5sJo=";
+    hash = "sha256-lW57+JvinIHWhXuKagDcrfNDOUurIC53TjAxqrHN11I=";
   };
 
-  cargoHash = "sha256-3B8RSow/aLzv0wl+eMCnS42+DnUa6NdG2TuR7aAJCA8=";
+  cargoHash = "sha256-Wbmi/GyoflpDEnFC+1FicxqFJgOa8O2iUHwB7JcDuyU=";
 
   nativeBuildInputs = [
     pkg-config
@@ -42,6 +43,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
     nodejs
     bun
     deno
+
+    writableTmpDirAsHomeHook
   ];
 
   checkFlags = [
diff --git a/pkgs/by-name/go/goldendict-ng/package.nix b/pkgs/by-name/go/goldendict-ng/package.nix
index 0016ba1628aa..937edbecdf44 100644
--- a/pkgs/by-name/go/goldendict-ng/package.nix
+++ b/pkgs/by-name/go/goldendict-ng/package.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "goldendict-ng";
-  version = "26.3.0";
+  version = "26.5.6";
 
   src = fetchFromGitHub {
     owner = "xiaoyifang";
     repo = "goldendict-ng";
-    tag = "v${finalAttrs.version}-Release.fce2b872";
-    hash = "sha256-DLo3dVoeib/lIp6jKeMyeREN6pHufa3HhyNIxtu3Q94=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Y/I03WqEkgg1O8AP6lAcf6H6Uys4SL6zAqx+zxMuNEM=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/hp/hplip/package.nix b/pkgs/by-name/hp/hplip/package.nix
index 0c06677b14f5..a2bbe644a777 100644
--- a/pkgs/by-name/hp/hplip/package.nix
+++ b/pkgs/by-name/hp/hplip/package.nix
@@ -35,16 +35,21 @@
 let
 
   pname = "hplip";
-  version = "3.25.2";
+  version = "3.26.4";
 
   src = fetchurl {
-    url = "mirror://sourceforge/hplip/${pname}-${version}.tar.gz";
-    hash = "sha256-6HL/KOslF3Balfbhg576HlCnejOq6JBSeN8r2CCRllM=";
+    url = "mirror://sourceforge/hplip/hplip-${version}.tar.gz";
+    hash = "sha256-ucYSUnVPNbSiNzlsqJYeez4MVtt21mpnEre/PjDmlGM=";
   };
 
   plugin = fetchurl {
-    url = "https://www.openprinting.org/download/printdriver/auxfiles/HP/plugins/${pname}-${version}-plugin.run";
-    hash = "sha256-miz41WYehGVI27tZUjGlRIpctjcpzJPfjR9lLf0WelQ=";
+    url = "https://developers.hp.com/sites/default/files/2026-05/hplip-${version}-plugin.run";
+    # HTTP 403 otherwise
+    curlOptsList = [
+      "--user-agent"
+      "Mozilla/5.0 Gecko/20100101 Firefox/150.0"
+    ];
+    hash = "sha256-GZ94+K9/NolNcYDpCQljziVQp17HAfikujdmWpdG/fA=";
   };
 
   hplipState = replaceVars ./hplip.state {
@@ -85,7 +90,7 @@ python3Packages.buildPythonApplication {
     sh "$curSrc" --noexec --keep
   '';
 
-  sourceRoot = "${pname}-${version}";
+  sourceRoot = "hplip-${version}";
 
   buildInputs = [
     libjpeg
diff --git a/pkgs/by-name/jo/jol/package.nix b/pkgs/by-name/jo/jol/package.nix
index 0e333f57ceee..66aaec985d5e 100644
--- a/pkgs/by-name/jo/jol/package.nix
+++ b/pkgs/by-name/jo/jol/package.nix
@@ -6,14 +6,14 @@
   makeWrapper,
   nix-update-script,
 }:
-maven.buildMavenPackage rec {
+maven.buildMavenPackage (finalAttrs: {
   pname = "jol";
   version = "0.17";
 
   src = fetchFromGitHub {
     owner = "OpenJDK";
     repo = "jol";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-ZJFuY2QYB8eUS3y3VRMGGwklCS93HHVkNe/dhyIx0SY=";
   };
 
@@ -46,7 +46,7 @@ maven.buildMavenPackage rec {
       This makes JOL much more accurate than other tools relying on heap dumps, specification assumptions, etc.
     '';
     homepage = "https://openjdk.org/projects/code-tools/jol/";
-    changelog = "https://github.com/openjdk/jol/releases/tag/${version}";
+    changelog = "https://github.com/openjdk/jol/releases/tag/${finalAttrs.version}";
     license = with lib.licenses; [
       gpl2Plus
       classpathException20
@@ -62,4 +62,4 @@ maven.buildMavenPackage rec {
     ];
     inherit (jre_minimal.meta) platforms;
   };
-}
+})
diff --git a/pkgs/by-name/kt/ktfmt/deps.json b/pkgs/by-name/kt/ktfmt/deps.json
index c38db5a787a8..916bee9ce268 100644
--- a/pkgs/by-name/kt/ktfmt/deps.json
+++ b/pkgs/by-name/kt/ktfmt/deps.json
@@ -92,6 +92,10 @@
    "module": "sha256-wDgW20RCyzvDuEg3XZte4z0cjjmZnT6e/eVHzq8U20A=",
    "pom": "sha256-9sHbW2XrT34FtcQu6/fXwzBtwn8gRkGreobv9+UCsWs="
   },
+  "com/fasterxml/jackson/module#jackson-module-jaxb-annotations/2.17.2": {
+   "module": "sha256-JR4jRcce8k2uUpe84BAk2ESa3L6IJimArNCt1fiTil4=",
+   "pom": "sha256-L4BbIPMNTBlqQV+9HljEE1p71xh9LhnFae9Eo2dKjTs="
+  },
   "com/fasterxml/jackson/module#jackson-module-kotlin/2.12.7": {
    "module": "sha256-KFgSNtUkPvn4QIbqYSnl+onOmomANlBHJ+tP0gthWN8=",
    "pom": "sha256-n3uQJAkenbt/rP6uXhDF1a2TvRMste4UFlRfn6+Rf24="
@@ -108,6 +112,9 @@
   "com/fasterxml/jackson/module#jackson-modules-base/2.12.7": {
    "pom": "sha256-EhnfADQxBTWu+hl6YsSgr7gjqIIu1Ch9F3kDElMmoVw="
   },
+  "com/fasterxml/jackson/module#jackson-modules-base/2.17.2": {
+   "pom": "sha256-rrMBBVHhN9CeuDhPO4PCQSXcOSwqmHIexorT/4TlWSU="
+  },
   "com/fasterxml/woodstox#woodstox-core/7.1.0": {
    "jar": "sha256-gSZpIKHNxHMGqKK0cmyZ7Imz+/McJHDk9eR32dhXyp8=",
    "pom": "sha256-+ZXFCx0gl18KjW8OUyK8jRPHiuPcGCcXdoQUlypmzIU="
@@ -185,6 +192,9 @@
   "com/sun/activation#all/1.2.0": {
    "pom": "sha256-HYUY46x1MqEE5Pe+d97zfJguUwcjxr2z1ncIzOKwwsQ="
   },
+  "com/sun/activation#all/1.2.1": {
+   "pom": "sha256-NgiDv2RIbs7xYbjygvZQNTbdGmcNU6Coccj7IBcOZ5U="
+  },
   "com/sun/istack#istack-commons-runtime/3.0.7": {
    "jar": "sha256-ZEPhC6LiWfuCHZtr7PENtTFihfwwxTzsnXsZo4d+f98=",
    "pom": "sha256-bXBORQqBakW86Aa6IsIv6D2Ojc96cVF2A95jChcmgJ8="
@@ -277,12 +287,21 @@
   "io/undertow#undertow-parent/2.3.18.Final": {
    "pom": "sha256-qpkXz8Zt5AQHOZ5vE12MJRtohHwusR+LnMdQmIRRZsw="
   },
+  "jakarta/activation#jakarta.activation-api/1.2.1": {
+   "pom": "sha256-QlhcsH3afyOqBOteCUAGGUSiRqZ609FpQvvlaf8DzTE="
+  },
   "jakarta/platform#jakarta.jakartaee-bom/9.1.0": {
    "pom": "sha256-35jgJmIZ/buCVigm15o6IHdqi6Aqp4fw8HZaU4ZUyKQ="
   },
   "jakarta/platform#jakartaee-api-parent/9.1.0": {
    "pom": "sha256-p3AsSHAmgCeEtXl7YjMKi41lkr8PRzeyXGel6sgmWcA="
   },
+  "jakarta/xml/bind#jakarta.xml.bind-api-parent/2.3.2": {
+   "pom": "sha256-FaVbfVN8n5lwrq0o0q+XwFn2X/YQL3a70p8SR92Kbfs="
+  },
+  "jakarta/xml/bind#jakarta.xml.bind-api/2.3.2": {
+   "pom": "sha256-tTeziNurTMBpC50vsMdBJNZyUxc0VnrPblMTDqsTGtY="
+  },
   "javax/activation#javax.activation-api/1.2.0": {
    "jar": "sha256-Q/3vC1ts6zGwQksgi5MMdKtY+sLO63s/b9OuuLXKQ5M=",
    "pom": "sha256-2ikm88i+iYZDzBCs3sbeCwNRpX+yc1dw+gF3sGrecbk="
@@ -399,6 +418,9 @@
    "jar": "sha256-phxI1VPvrXi8Af/8SsUovruuZMuuwXCypeOc9h61Gr4=",
    "pom": "sha256-TpAuxVb8ZZi0HClS7BVz7cgVA35zMOxJIuq2GUImhuI="
   },
+  "org/eclipse/ee4j#project/1.0.2": {
+   "pom": "sha256-dJWgenl+iOQ8O8GodCG9ix/FXjIpH6GOTjLYAx3chz8="
+  },
   "org/eclipse/ee4j#project/1.0.5": {
    "pom": "sha256-kWtHlNjYIgpZo/32pk2+eUrrIzleiIuBrjaptaLFkaY="
   },
@@ -513,77 +535,71 @@
    "module": "sha256-VFW1pwpMpqldNFHGoh+QebqzFS8sSgTRU5rwBrnMulY=",
    "pom": "sha256-Z0Am3mN1U2SDXSRoRcFVSgRa57qLFCzL7Qx5yYWezZk="
   },
-  "org/jetbrains/kotlin#abi-tools-api/2.2.0": {
-   "jar": "sha256-hxeDiGZkLjvdR+yeAmC70wdujH6GvgXirahoMesq+Qo=",
-   "pom": "sha256-UwmmvuGytgrDtfXTXMS2zDiKFzOA17jeqgIJ6wgUnpA="
+  "org/jetbrains/kotlin#abi-tools-api/2.3.20": {
+   "jar": "sha256-U2hfV4OwSQaDiY11Wrrk1Bi26DugYTSFiv3ctZRYmek=",
+   "pom": "sha256-qIbJ/X8rlmlFf+wCHxnc8V8EY+DbS9rVOuGBJTZsxvk="
   },
-  "org/jetbrains/kotlin#fus-statistics-gradle-plugin/2.2.0": {
-   "module": "sha256-5d0u34ivdW30d1ra13xS0AkDUav1EZLPGdP+YsZnyrg=",
-   "pom": "sha256-Qejc6FcbX7TuAzURlYL+IoBQqP8ZPiRg1SmMX5Dj1nU="
+  "org/jetbrains/kotlin#fus-statistics-gradle-plugin/2.3.20": {
+   "module": "sha256-bNjWSw5lN3kE8wb2qFja/ZMcQTUkD4RMk9UpTumP6Dk=",
+   "pom": "sha256-SgpFTor25QOv5ngwoYVjubaA3u67GhcGoNe0S8UHQKE="
   },
-  "org/jetbrains/kotlin#fus-statistics-gradle-plugin/2.2.0/gradle813": {
-   "jar": "sha256-0M+f8jrTjCEO7QzCWlExWjhOYf3BWlP+uGwAvuaRqug="
+  "org/jetbrains/kotlin#fus-statistics-gradle-plugin/2.3.20/gradle813": {
+   "jar": "sha256-pPEKPw6l3dH1VaT3BuCep/VSs8hSK7EAY2HdMG4152o="
   },
-  "org/jetbrains/kotlin#kotlin-build-statistics/2.2.0": {
-   "jar": "sha256-klfy37x4iCf2AnUPrijX6UWTLq2QQVP3f09sTE2Y5RE=",
-   "pom": "sha256-8Uct+ZZDqe4VJrFEka0vaNz8Zunr9WywFuSFzaj69sI="
+  "org/jetbrains/kotlin#kotlin-build-statistics/2.3.20": {
+   "jar": "sha256-ptJ7PINhdlLdBlYG+Yz1nPviY/jCDr5OvVpvJonrDU8=",
+   "pom": "sha256-nQqNf/FyPV1y00ldVVc9jTxrd3TWHYBXlxT3nCQmX48="
   },
-  "org/jetbrains/kotlin#kotlin-build-tools-api/2.2.0": {
-   "jar": "sha256-HezZmyKUN3QfNqAIxnip2PrjBxbodyFRMI9W9owQ844=",
-   "pom": "sha256-I6QFgttMPijHq6X8fpZHvI1e/d+dAFWp5CyaCJbVzjM="
+  "org/jetbrains/kotlin#kotlin-build-tools-api/2.3.20": {
+   "jar": "sha256-IvGrIjhUuUkJn2slnO9UHVtYo2Q9+aScRXfGPEFuhDs=",
+   "pom": "sha256-G14LLDaQXcL1XgpLeBKuY+MSXe/PaG0sD0kPg7c9nV4="
   },
-  "org/jetbrains/kotlin#kotlin-compiler-runner/2.2.0": {
-   "jar": "sha256-kHBq6Gcd77oBQI3RxUG6MJEskHDN8d3aGMUero1nkwQ=",
-   "pom": "sha256-iQfZfcaLv0CgrmZ5RZAvDtwWYdvPdDuuDf2nw7mp1Mg="
+  "org/jetbrains/kotlin#kotlin-compiler-runner/2.3.20": {
+   "jar": "sha256-wGnzCkA75wyBUviqnyXsy6GI7q1UJjrgKvFEIUN6Igg=",
+   "pom": "sha256-jYTqDt1gs4vOpWLeUXgVKiZxqaAFPWcPkxRSs9sBMig="
   },
-  "org/jetbrains/kotlin#kotlin-daemon-client/2.2.0": {
-   "jar": "sha256-ISk9oBbkuhKhKKwm/ZIKdOi4f1dM+bxDxgo9LnZFp64=",
-   "pom": "sha256-HESKBvDKmGiVi+CHesnof8TgG8uTaHp8rBLTxNCd7uY="
+  "org/jetbrains/kotlin#kotlin-daemon-client/2.3.20": {
+   "jar": "sha256-xxp8G+j7/wTgr0XJ7oy3ph2JU7ymuL8iWlcZxyWpC0Q=",
+   "pom": "sha256-nnyLgHJBF/cqrOZfa+SNg224/Dl1OtlR8ruQhi1+cIA="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-annotations/2.2.0": {
-   "jar": "sha256-nRsH2uVVnD/JwtzhW9hcNtwedt/zd/ExJIm9ZmDBZUQ=",
-   "pom": "sha256-uvxt1O1fRcLhvCgXfCxkDie/t8WQEZ6GW7nkCZOLrEA="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-annotations/2.3.20": {
+   "jar": "sha256-4WYu10cyK2P2HU+t2Zq3gQTEXq8JwRp4mGJBXoHBjcQ=",
+   "pom": "sha256-aP+Cf8E1DZPw1nM2jAZHm2K31eXDBlipWM+TBmgx6Nk="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-api/2.2.0": {
-   "jar": "sha256-u6au4h0YX3LfiW80jw6nsRdcEc1mNzeZid+JnLSMl+E=",
-   "module": "sha256-AmOgtdQFEGmmFjJYOK5CGmxNAG3JsVWnpCkmYIiAC6c=",
-   "pom": "sha256-iG8sRJ+dvmQc0kPxk3FNegQlNrMCrEHHLVYOWmZmDIg="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-api/2.3.20": {
+   "module": "sha256-04UBEP9ajrcP7S1Xi0X7B+vESvaika5M88eUMMZRKLo=",
+   "pom": "sha256-AdVSITSRyFPVb4frdIEwON+e4dhekIaqN70GY7JJb4g="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-api/2.2.0/gradle813": {
-   "jar": "sha256-u6au4h0YX3LfiW80jw6nsRdcEc1mNzeZid+JnLSMl+E="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-api/2.3.20/gradle813": {
+   "jar": "sha256-ybwX32m/OZB8WXweGb7EtHnHWqx1+/1jIeNEW0lxLog="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-idea-proto/2.2.0": {
-   "jar": "sha256-QY4hdjJ20qlGFr6ZCCanRdWdTF2WY48LviERDSxWSTs=",
-   "pom": "sha256-w5AgQre9S2t3oY8+4f6ol9N7vroloD0Uqe7//hWCXn0="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-idea-proto/2.3.20": {
+   "jar": "sha256-5Cicv5/0lAfwQd3GM24bV3pspM8r4dKjEzgnHBPu0+0=",
+   "pom": "sha256-9veHObqf4nEunwyeW8T16TcZzP6pW0fC9JslC+F2NX4="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-idea/2.2.0": {
-   "jar": "sha256-7JacXwsJn4I4RiMiOPm9ZPPTdB5i6pBQrS5DL6150KA=",
-   "module": "sha256-r+m2AUJwBIVJuyAySjGdYkoFoLnmtBfmm2kHldfPDUs=",
-   "pom": "sha256-/ewxpJDZDsNuf5qj12xVDgqVq9Otg3lTvUn6E9pwFQ0="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-idea/2.3.20": {
+   "jar": "sha256-lS5zlI4qINOYwmuHprtwzPZkGPuvFSfDUVsYjqnUvWA=",
+   "module": "sha256-b7XZcwCl5Vmv1Nn/msA1bE2Wb31pS2Yvrhaf2HQhUx4=",
+   "pom": "sha256-WROHIVGNgqND99wvCRK3BJjT7vM2PJ66wiCssPyTjsw="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-model/2.2.0": {
-   "jar": "sha256-Z6FKxCSqGWo0ax3Jn0QqbVc0WCrXt+epzN8oqc0rIJs=",
-   "module": "sha256-LC4w2DDqdpq6iX9PlvGeHoLY1qI/UzaJugn0GTMASYY=",
-   "pom": "sha256-bBzMOzcGY8KHIUn12briW/fpLqcVFepzxSlwlzbKMYk="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin/2.3.20": {
+   "module": "sha256-lVUmc7gbNXitmy86/xRUtjzoBsb9SrfGBJIx6GQKtHE=",
+   "pom": "sha256-EcMjwt2KgE6fWOBHwsAYZLKgHcDYEys2PApDEiFbwJs="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin/2.2.0": {
-   "module": "sha256-Y3w/yuVyOnQnAmwO2z3GeW3T/nmQ3CKG1PdJbt9dKYU=",
-   "pom": "sha256-E2FqOVx9n8Xc7iclKn9ocX2MaZTNEldL0dsxelGG1yE="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin/2.3.20/gradle813": {
+   "jar": "sha256-RuFu4mWU9ID+y5LJbarjdTDoNQJreON+8yUelX8D9vs="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin/2.2.0/gradle813": {
-   "jar": "sha256-g1xNwYoHMl9XkwUMfy52XSNcWWdJVo5HtZe0Sdhnlo0="
+  "org/jetbrains/kotlin#kotlin-gradle-plugins-bom/2.3.20": {
+   "module": "sha256-+CvXZF0MPv609PZVIKPGWz6MMCsIMyIDegABuHsC6ZA=",
+   "pom": "sha256-3WuRkZfhMv5x3axw9vxdj65/Und6/YN7FN6HG4wKVAA="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugins-bom/2.2.0": {
-   "module": "sha256-ur08SXopcd/GjlAlT/lwZak6Ixg+jto8OY+E9gzsErI=",
-   "pom": "sha256-2cRaL1cw6E6bhPpCxkoYdNy6ZmjyEsT+KXvqJdwAeHg="
+  "org/jetbrains/kotlin#kotlin-klib-commonizer-api/2.3.20": {
+   "jar": "sha256-vpN3SFQS0A8B54KZyzC+SAJZHCcwNCtuva/AiU91J0M=",
+   "pom": "sha256-IbFbpb1i0h1Ta7egyMtnQ1cfwPQwklSKQjWybyodIgs="
   },
-  "org/jetbrains/kotlin#kotlin-klib-commonizer-api/2.2.0": {
-   "jar": "sha256-8FcCw6bq725+hCNTvmT1jTMHGX4Vp/F5gE08VQcZ7mk=",
-   "pom": "sha256-6R0DUNf9G+4pyP9OP9bxcZBS7P6V98wXZtnVwnD3iQk="
-  },
-  "org/jetbrains/kotlin#kotlin-native-utils/2.2.0": {
-   "jar": "sha256-pOlvczba6EnznPK2NKU20CoqvfARS3M5Wty4yIGFDp4=",
-   "pom": "sha256-DafPXrsb0m4u/IkRhLzqM8tPKxwpNYEnr1MGHNataZY="
+  "org/jetbrains/kotlin#kotlin-native-utils/2.3.20": {
+   "jar": "sha256-QxnCdkeV773/K3julUVRV9evC5FVaYuqG6Uqar46vy0=",
+   "pom": "sha256-LAp+ADViCIXUN+fxJidEdbpYqiJC+1279D+R8gyvpwg="
   },
   "org/jetbrains/kotlin#kotlin-stdlib-common/2.0.21": {
    "module": "sha256-b134r2M2AKa5z7D8x2SvPVEZ83Zndne5G2rugWsdMKs=",
@@ -605,24 +621,24 @@
    "module": "sha256-gf1tGBASSH7jJG7/TiustktYxG5bWqcpcaTd8b0VQe0=",
    "pom": "sha256-/LraTNLp85ZYKTVw72E3UjMdtp/R2tHKuqYFSEA+F9o="
   },
-  "org/jetbrains/kotlin#kotlin-tooling-core/2.2.0": {
-   "jar": "sha256-dAFOxPPveM59p+Pmlk8sUmoxIdXFj++MopeeXzRFgvQ=",
-   "pom": "sha256-Fiq+zmN9Egvzs1mfJIETV3zey68Q1bInq3cFLmYykpM="
+  "org/jetbrains/kotlin#kotlin-tooling-core/2.3.20": {
+   "jar": "sha256-NnFCeBKZvA+RIMHe7A5ik0oa+ep/AaqpxaU1TcXY19k=",
+   "pom": "sha256-R+Ou/SS1vmLYB7bLzXnFW4P5S1XP4Y79xuM84RvxkOQ="
   },
-  "org/jetbrains/kotlin#kotlin-util-io/2.2.0": {
-   "jar": "sha256-h//zwBlwqqkBGr3lZbtSoXmqbckDjFh4koHtK2jVji0=",
-   "pom": "sha256-NcfaTe0E3/GCIeDzgPo/NhIOvq2hOYOmEQtGWWaKbr0="
+  "org/jetbrains/kotlin#kotlin-util-io/2.3.20": {
+   "jar": "sha256-DnbnRx6RxT6mjS0k7x8p+1kqxfuw0dEPqpFkMO/z2so=",
+   "pom": "sha256-lcKKgo/B8eWeZWOCR6ZPdm2B2LWfbY3r7y0YoMwyH4k="
   },
-  "org/jetbrains/kotlin#kotlin-util-klib-metadata/2.2.0": {
-   "jar": "sha256-nOOw3gU8uf8HoPcXyhQvKQp05NGdkzLbImq+D+thyB4=",
-   "pom": "sha256-XVJ2wbYor7xCBZ80CoTe/Uv7XroYJm3zdDYH5XftX4c="
+  "org/jetbrains/kotlin#kotlin-util-klib-metadata/2.3.20": {
+   "jar": "sha256-qJlOC8poRt+xn0WMTMFdexN3nKGw2fNIgLX/LCorc7M=",
+   "pom": "sha256-jxApEHGu+rvY5m/5r3dDojiB1pxqryjhNhbMDpW9F7c="
   },
-  "org/jetbrains/kotlin#kotlin-util-klib/2.2.0": {
-   "jar": "sha256-FPB+vZrfvk6F+06/MSJSULL8P1Qo7OQ31O1j7D+prE0=",
-   "pom": "sha256-NU7YchvXXwfcCyQbiFg+7oLCTZIdN+lrctmNpi1ISEo="
+  "org/jetbrains/kotlin#kotlin-util-klib/2.3.20": {
+   "jar": "sha256-lWK407egS+uisUwFZx5xOFnqVLvAohB+ZbK88nP6hEg=",
+   "pom": "sha256-WlhMPMK6O0HR5c1+eiCDV2wbjDl6ebuBY2dtjvew6hc="
   },
-  "org/jetbrains/kotlin/jvm#org.jetbrains.kotlin.jvm.gradle.plugin/2.2.0": {
-   "pom": "sha256-kALsce2lmj+9LC/mUmCaz3lOCHEbETyXdeZHrzdyOqo="
+  "org/jetbrains/kotlin/jvm#org.jetbrains.kotlin.jvm.gradle.plugin/2.3.20": {
+   "pom": "sha256-OVGM+ut/cxup+D2UpCkwR/U6Th+1KpF1cFddfYzWs04="
   },
   "org/jetbrains/kotlinx#kotlinx-coroutines-bom/1.7.3": {
    "pom": "sha256-Tl0ZAOY3nvP1lw0EqPMFKa3IL4WejMEHwhzoFJ72ZsQ="
@@ -1103,6 +1119,36 @@
    "jar": "sha256-15lSLVearAaxcGA/jwgPbjJI2twB+WUs3X6nvDGMIc4=",
    "pom": "sha256-1WEbRtjJqHPjFgh91raE3fabdoyAhDraiyKiOuvGIwE="
   },
+  "org/bouncycastle#bcpg-jdk18on/1.80": {
+   "jar": "sha256-N5mg1TURuGB4CvQ8RK6OBRmvq7JjGVr0AXT0YxLNWL0=",
+   "pom": "sha256-B6JGwq2vtih4OhroSsGNTfQCXfBq42NN/pOHq5T56nQ="
+  },
+  "org/bouncycastle#bcpkix-jdk18on/1.80": {
+   "jar": "sha256-T0umqSYX6hncGD8PpdtJLu5Cb93ioKLWyUd3/9GvZBM=",
+   "pom": "sha256-pKEiETRntyjhjyb7DP1X8LGg18SlO4Zxis5wv4uG7Uc="
+  },
+  "org/bouncycastle#bcprov-jdk18on/1.80.2": {
+   "jar": "sha256-szIn8H3OJk2vGqwueY7xCaSQHzGr7axTY1dG3ZNnnTs=",
+   "pom": "sha256-EqUFpxejvHZH99jt6ndzLJxty1PE32Kju1i3pUIooo8="
+  },
+  "org/bouncycastle#bcutil-jdk18on/1.80.2": {
+   "jar": "sha256-vHjTLX/7FB7ifk+3ffBCWdhCyJnn6Or5EvmQ1yU707Q=",
+   "pom": "sha256-Joi+GvSZ1SUJYRTML1HHp6TKI8PScxe3HhjByWvsA9E="
+  },
+  "org/bouncycastle/bcprov-jdk18on/maven-metadata": {
+   "xml": {
+    "groupId": "org.bouncycastle",
+    "lastUpdated": "20260515080931",
+    "release": "1.84"
+   }
+  },
+  "org/bouncycastle/bcutil-jdk18on/maven-metadata": {
+   "xml": {
+    "groupId": "org.bouncycastle",
+    "lastUpdated": "20260515080933",
+    "release": "1.84"
+   }
+  },
   "org/checkerframework#checker-compat-qual/2.5.5": {
    "jar": "sha256-EdE0skXpysxHRRTS1mtbhhj4A5oUZc3FW7wLNOAAi3o=",
    "pom": "sha256-QvIevZGDvgSe5a/IIrNFQDpdp2QDeHVzSgObDW4DU74="
@@ -1176,45 +1222,65 @@
    "module": "sha256-iA7+arXz1MMGrsNVkBQ+5Bhujyuzw6yVKaxTZAVmetY=",
    "pom": "sha256-SWN/vvKBVW4wjx0Gz8EV00p2q5OvfpXkiSYnNHwov5E="
   },
-  "org/jetbrains/kotlin#abi-tools-api/2.2.0": {
-   "jar": "sha256-hxeDiGZkLjvdR+yeAmC70wdujH6GvgXirahoMesq+Qo=",
-   "pom": "sha256-UwmmvuGytgrDtfXTXMS2zDiKFzOA17jeqgIJ6wgUnpA="
+  "org/jetbrains/kotlin#abi-tools-api/2.3.20": {
+   "jar": "sha256-U2hfV4OwSQaDiY11Wrrk1Bi26DugYTSFiv3ctZRYmek=",
+   "pom": "sha256-qIbJ/X8rlmlFf+wCHxnc8V8EY+DbS9rVOuGBJTZsxvk="
   },
-  "org/jetbrains/kotlin#abi-tools/2.2.0": {
-   "jar": "sha256-Pngn8qdqgpa3vvfzyzrPxJJA1gtTNwidRHyJIfbgi00=",
-   "pom": "sha256-avzEJec8EEvnrSCQF1u1wgHGQWV1sdX1suMFEDl6o1c="
+  "org/jetbrains/kotlin#abi-tools/2.3.20": {
+   "jar": "sha256-R9fBgRPZhYUGWrUky6HEcLTDaTB2l8qdHIEOULk9C9E=",
+   "pom": "sha256-Pi8inRHuIgaFPTAL/l0R3dzpYFqJ5cmvrwa3Ij0Zh1c="
   },
-  "org/jetbrains/kotlin#kotlin-build-tools-api/2.2.0": {
-   "jar": "sha256-HezZmyKUN3QfNqAIxnip2PrjBxbodyFRMI9W9owQ844=",
-   "pom": "sha256-I6QFgttMPijHq6X8fpZHvI1e/d+dAFWp5CyaCJbVzjM="
+  "org/jetbrains/kotlin#kotlin-build-tools-api/2.3.20": {
+   "jar": "sha256-IvGrIjhUuUkJn2slnO9UHVtYo2Q9+aScRXfGPEFuhDs=",
+   "pom": "sha256-G14LLDaQXcL1XgpLeBKuY+MSXe/PaG0sD0kPg7c9nV4="
   },
-  "org/jetbrains/kotlin#kotlin-build-tools-impl/2.2.0": {
-   "jar": "sha256-SofzwCcvFyhdYOmGQ+whn1Ppta1aI/O8TFQ6hkT4bxc=",
-   "pom": "sha256-6DgEIFq2l7pyL0YiprG1GS70ejDL35ApdwFJQ3hQTv8="
+  "org/jetbrains/kotlin#kotlin-build-tools-compat/2.3.20": {
+   "jar": "sha256-RMMHtO3UysUflgqBNBEtZkyTB2cAzaXoZulNmkKWNA4=",
+   "pom": "sha256-rpC+JesEdhCNlo6+Mqjd9SXhQIhYj6BUc9sSgVoPG3Q="
+  },
+  "org/jetbrains/kotlin#kotlin-build-tools-cri-impl/2.3.20": {
+   "jar": "sha256-VOztYw8oEkzP4uRk5srMKB5SiopQqJclchVUyWk1SP4=",
+   "pom": "sha256-5zeMZYHvXw4stA46TOxR0rlj5iVkWpK2fqCVJa+XxMM="
+  },
+  "org/jetbrains/kotlin#kotlin-build-tools-impl/2.3.20": {
+   "jar": "sha256-loG8IWSovZ9t30wIXPSoNrktJ1BmZ9c7q59thVM2yRA=",
+   "pom": "sha256-gswavl5j0/5nV+eXKE8F25r9fq3D6D0ROcOlW2TUstU="
   },
   "org/jetbrains/kotlin#kotlin-compiler-embeddable/2.2.0": {
    "jar": "sha256-svdD6luhL2ng815djUYGnXTI4oYQh1SKfg4Up4S8TPE=",
    "pom": "sha256-FqFd0ZfPJBNJT3iMuWFE2aFGJnw9b38cFbejweBSNGo="
   },
-  "org/jetbrains/kotlin#kotlin-compiler-runner/2.2.0": {
-   "jar": "sha256-kHBq6Gcd77oBQI3RxUG6MJEskHDN8d3aGMUero1nkwQ=",
-   "pom": "sha256-iQfZfcaLv0CgrmZ5RZAvDtwWYdvPdDuuDf2nw7mp1Mg="
+  "org/jetbrains/kotlin#kotlin-compiler-embeddable/2.3.20": {
+   "jar": "sha256-l2+YnQtfXYDo6KitS3PaC/wn/dllufo4Nisr557MEzc=",
+   "pom": "sha256-DDWu7jcvB1FOvtN7lAe44RgdFCd1UTnlzudxnKBf5+g="
   },
-  "org/jetbrains/kotlin#kotlin-daemon-client/2.2.0": {
-   "jar": "sha256-ISk9oBbkuhKhKKwm/ZIKdOi4f1dM+bxDxgo9LnZFp64=",
-   "pom": "sha256-HESKBvDKmGiVi+CHesnof8TgG8uTaHp8rBLTxNCd7uY="
+  "org/jetbrains/kotlin#kotlin-compiler-runner/2.3.20": {
+   "jar": "sha256-wGnzCkA75wyBUviqnyXsy6GI7q1UJjrgKvFEIUN6Igg=",
+   "pom": "sha256-jYTqDt1gs4vOpWLeUXgVKiZxqaAFPWcPkxRSs9sBMig="
+  },
+  "org/jetbrains/kotlin#kotlin-daemon-client/2.3.20": {
+   "jar": "sha256-xxp8G+j7/wTgr0XJ7oy3ph2JU7ymuL8iWlcZxyWpC0Q=",
+   "pom": "sha256-nnyLgHJBF/cqrOZfa+SNg224/Dl1OtlR8ruQhi1+cIA="
   },
   "org/jetbrains/kotlin#kotlin-daemon-embeddable/2.2.0": {
    "jar": "sha256-omzI4thhkZfMTRFb6ndm6aqODx54duoETuG58wVlRgE=",
    "pom": "sha256-vSrk4skWBWVKilUn2nV/KyJ2WA0fXq6+q9M0OvjVxGc="
   },
-  "org/jetbrains/kotlin#kotlin-klib-commonizer-embeddable/2.2.0": {
-   "jar": "sha256-KEF+GZd6pJjcCJk6riAf/CG5Tp/0IvUiUi1gj2BrkgY=",
-   "pom": "sha256-DDfkh0Gs5zKbymh/4hRTg4vRn+ZhE1uE5o5dBkM7ZIE="
+  "org/jetbrains/kotlin#kotlin-daemon-embeddable/2.3.20": {
+   "jar": "sha256-iHC6uEC4CHyWxN3AYIi0rt9RMcQIrzZ0MGME8flq8/Q=",
+   "pom": "sha256-YVQOWzoywLEZYkSWZZJMbNdVTqmu4IVb2OT1t/YQoKs="
   },
-  "org/jetbrains/kotlin#kotlin-metadata-jvm/2.2.0": {
-   "jar": "sha256-UBIirn1jUn5V8uXmRfGNTv8sGQdMhbm8BVhm4+0rF78=",
-   "pom": "sha256-Vav6RtrO+hAxYMwE4MUeVgq6DKIyAD/bz7TtjN05m0U="
+  "org/jetbrains/kotlin#kotlin-klib-abi-reader/2.3.20": {
+   "jar": "sha256-XAo6pyBAjdL2PnYIdd0/Z9t+0Ws/AAKA4IgcYHDOT2M=",
+   "pom": "sha256-ui+7W5OjnlGraeWCJPGNdxYqDrYDkIbl9lVne8O3xno="
+  },
+  "org/jetbrains/kotlin#kotlin-klib-commonizer-embeddable/2.3.20": {
+   "jar": "sha256-4FeWYwUcbaKyPZX8LDpBKnYnnbg6eQHuhqfjrPbnHjQ=",
+   "pom": "sha256-shhlfghlbEa018djdux6BOoGAJpGLTpkcBFvr92OPss="
+  },
+  "org/jetbrains/kotlin#kotlin-metadata-jvm/2.3.20": {
+   "jar": "sha256-FyZLlpD+7TSqi459VW+y55UfaABGLxFyQ/upYgEBT30=",
+   "pom": "sha256-DF/7/5dG1Ca56GasBWviiSizGKJc3FaDkIHsRJspzZc="
   },
   "org/jetbrains/kotlin#kotlin-reflect/1.6.10": {
    "jar": "sha256-MnesECrheq0QpVq+x1/1aWyNEJeQOWQ0tJbnUIeFQgM=",
@@ -1228,21 +1294,25 @@
    "jar": "sha256-Ttl/0eDJux0JSO1eY8yRRWMTpZUYKVuSssFRSu9VYVA=",
    "pom": "sha256-5QdIv0Z09lRgPnsbuDBjTsmevZwzDeukytzuwHZ8u1Y="
   },
-  "org/jetbrains/kotlin#kotlin-scripting-common/2.2.0": {
-   "jar": "sha256-fJrISZ+pGyAep4NlN8Yl3VKoJUnlfms/F1zAx56atgQ=",
-   "pom": "sha256-1M1vjH2tiOZ9iVzT23qNTH3I6N3Y6WeOH1619gHZsO0="
+  "org/jetbrains/kotlin#kotlin-script-runtime/2.3.20": {
+   "jar": "sha256-b8232m5lz4zEPlqrq5S9zEiCXnkzaG+KG/aU64j44A4=",
+   "pom": "sha256-ZgmWdnA6CB/ZrEMTlmWIPlwUUCC2QHWd4FOdiRb/JH8="
   },
-  "org/jetbrains/kotlin#kotlin-scripting-compiler-embeddable/2.2.0": {
-   "jar": "sha256-ksfW7HxfBdisAcN+dHrGd9iS6ZusDeXlFmg7jzZAdys=",
-   "pom": "sha256-VjapUSxI/NqPgm+ypKwXPCnW6zV0ZHE9VNJaTUbsbBM="
+  "org/jetbrains/kotlin#kotlin-scripting-common/2.3.20": {
+   "jar": "sha256-tMI52HsjvhgvBb9Xz16B+V1wv370qYnrmLczicbryJ8=",
+   "pom": "sha256-h+/vFa4RjxNDUmPrEJcAZGD7qDlph340uKcvDjPIOsk="
   },
-  "org/jetbrains/kotlin#kotlin-scripting-compiler-impl-embeddable/2.2.0": {
-   "jar": "sha256-HSbL3a7rb/1FgIU5bs6gsID8Io/gBtz4MD2ldxHzN0U=",
-   "pom": "sha256-oeMpM4wq8LRweB0ECGnpsZdS+KTesi9D9qiR68dPH4I="
+  "org/jetbrains/kotlin#kotlin-scripting-compiler-embeddable/2.3.20": {
+   "jar": "sha256-vVX49hvUHOxSllbC1HeEvLpawmDpT0FWwnLDFJZu71k=",
+   "pom": "sha256-1l8YaBd9zkuKkv+93bVrFzH5+66IyOcw7XvLcAy7soo="
   },
-  "org/jetbrains/kotlin#kotlin-scripting-jvm/2.2.0": {
-   "jar": "sha256-YKjHQtYfRPIxH73IqGt2fRcboJ2XvnLWukUNN/fj/b8=",
-   "pom": "sha256-dii0nV53BennadESYAZtmmlXPW2Av4Iw0FRvWo54yJ4="
+  "org/jetbrains/kotlin#kotlin-scripting-compiler-impl-embeddable/2.3.20": {
+   "jar": "sha256-gG/WOzvOxea17rGghD1qsJTVV4aoRl5HSiQ5KVocCiU=",
+   "pom": "sha256-xKkTo4XzTjKlbyBd8XoI3U4RfDBsV+XkfcXUlSPw6+E="
+  },
+  "org/jetbrains/kotlin#kotlin-scripting-jvm/2.3.20": {
+   "jar": "sha256-cEfOA1P0kSXDx0Z5LU92wyZde3L+YmlLfuwHW7oCUow=",
+   "pom": "sha256-B8Ba4tHs4K4e1mAQ7TGNnN3LNYcEbGM8GGvRTM8EYdU="
   },
   "org/jetbrains/kotlin#kotlin-stdlib-common/1.8.20": {
    "pom": "sha256-YFWRuJs3ISfmspxpMl+i9qjEb0aMRdCUEOeOtZ/IChc="
@@ -1269,21 +1339,29 @@
    "module": "sha256-pbmP3NnbAX1ULhlyJdzuGNZYpW3h2yzEHhMZbWsXaaQ=",
    "pom": "sha256-jDyCEAfBNBFVhzm589U4LrgVUds4lc/7iVYeVsD03BY="
   },
-  "org/jetbrains/kotlin#kotlin-stdlib/2.2.0/all": {
-   "jar": "sha256-4jAPqlnJNSk9q7Chg9LmEIqbARxCcHbD97oQ0ktzugo="
+  "org/jetbrains/kotlin#kotlin-stdlib/2.3.20": {
+   "jar": "sha256-CuElBKUEDrrzdwOQhINCDRpWJN0dk/NXZl+Md8hIoB4=",
+   "module": "sha256-9Os0T8TR46KK4WwIbsPkL1I3O0ZtQwgYL7OG45LA76M=",
+   "pom": "sha256-yDwC2afi6VRzBJHDPC8dwDwnZi4ntWbsK0TS0Bhjm5g="
   },
-  "org/jetbrains/kotlin#kotlin-test-junit/2.2.0": {
-   "jar": "sha256-9F7TLnIdkB08voPs5/QcmFM7NBVRhjaKeb/cZn5DPc4=",
-   "module": "sha256-n6+SISVQscjI0TBYtXXn6nACioWDFxtKZI076Rn4TuM=",
-   "pom": "sha256-hc82imSEEI+R1zdgEJBuHO4AvDzhv3lzSVWGz8pqDf4="
+  "org/jetbrains/kotlin#kotlin-test-junit/2.3.20": {
+   "jar": "sha256-ocfwKcBEVT8dQl7FgQynmXMl6MGB/pLM4M8NSisL5yc=",
+   "module": "sha256-P4OnSuo3+9ZdUyNUqDjhhgGmXRgVodYDR7FJ/5bpmDo=",
+   "pom": "sha256-+u+Tgw4+2e1b1/EumqtCjuHpYoG6xH9PIkXmKrjRdew="
   },
   "org/jetbrains/kotlin#kotlin-test/2.2.0": {
    "jar": "sha256-jbF1o/Vs8Tnr34k28pPOWmSha1KgQIgE4OwHfohI6zI=",
    "module": "sha256-VKfhwH1Wew4MfZE5V563Qe0H4N5bWgx/86V6017mWjw=",
    "pom": "sha256-cBlAy7cIWLKmC6xeNyqmsKciVI0c3QrVtSU6RmH6R2M="
   },
-  "org/jetbrains/kotlin#kotlin-test/2.2.0/all": {
-   "jar": "sha256-ptjE3eggYYEtrAlyi75/forfL5KDNfM6wjPzS42iG2c="
+  "org/jetbrains/kotlin#kotlin-test/2.3.20": {
+   "jar": "sha256-1snM+C9n5s9/2vngzqQZ2sTfpYYgoWU9PbpF9USiiaw=",
+   "module": "sha256-HkVtJGsHORSGHhYzMNNvg4OhZLBnZ5ZqVJ7N5DfuBJY=",
+   "pom": "sha256-XU8LL1JZAqBG392bZlSk/ntsnsSct7hauDFcDv9bc7E="
+  },
+  "org/jetbrains/kotlin#kotlin-tooling-core/2.3.20": {
+   "jar": "sha256-NnFCeBKZvA+RIMHe7A5ik0oa+ep/AaqpxaU1TcXY19k=",
+   "pom": "sha256-R+Ou/SS1vmLYB7bLzXnFW4P5S1XP4Y79xuM84RvxkOQ="
   },
   "org/jetbrains/kotlinx#kotlinx-coroutines-bom/1.7.3": {
    "pom": "sha256-Tl0ZAOY3nvP1lw0EqPMFKa3IL4WejMEHwhzoFJ72ZsQ="
diff --git a/pkgs/by-name/kt/ktfmt/package.nix b/pkgs/by-name/kt/ktfmt/package.nix
index f7ae34f9afc5..7746a0dc3ac7 100644
--- a/pkgs/by-name/kt/ktfmt/package.nix
+++ b/pkgs/by-name/kt/ktfmt/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ktfmt";
-  version = "0.61";
+  version = "0.63";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "ktfmt";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WY3d25c8VLsgeNBV/lSlOL+C3XtM9lfRYqMz3Z0mT3s=";
+    hash = "sha256-wAnlUEPFyilAbEXN6DGXHXeYfZgx2tlp4vDENP4O2Hw=";
   };
 
   patches = ./remove-idea-plugin.patch;
diff --git a/pkgs/by-name/li/libkrunfw/package.nix b/pkgs/by-name/li/libkrunfw/package.nix
index aa5c19c4a513..8060cae59360 100644
--- a/pkgs/by-name/li/libkrunfw/package.nix
+++ b/pkgs/by-name/li/libkrunfw/package.nix
@@ -10,6 +10,7 @@
   perl,
   elfutils,
   python3,
+  buildPackages,
   variant ? null,
 }:
 
@@ -57,6 +58,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   makeFlags = [
     "PREFIX=${placeholder "out"}"
+    "STRIP=${stdenv.cc.targetPrefix}strip"
   ]
   ++ lib.optionals (variant == "sev") [
     "SEV=1"
@@ -65,9 +67,14 @@ stdenv.mkDerivation (finalAttrs: {
     "TDX=1"
   ];
 
+  depsBuildBuild = [
+    elfutils
+    buildPackages.stdenv.cc
+  ];
+
   # Fixes https://github.com/containers/libkrunfw/issues/55
   env = lib.optionalAttrs stdenv.targetPlatform.isAarch64 {
-    NIX_CFLAGS_COMPILE = "-march=armv8-a+crypto";
+    NIX_CFLAGS_COMPILE_FOR_TARGET = "-march=armv8-a+crypto";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/li/lilex/package.nix b/pkgs/by-name/li/lilex/package.nix
index 138d5e591d54..abe21e68e097 100644
--- a/pkgs/by-name/li/lilex/package.nix
+++ b/pkgs/by-name/li/lilex/package.nix
@@ -2,30 +2,29 @@
   lib,
   stdenvNoCC,
   fetchurl,
+  installFonts,
   unzip,
 }:
-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "lilex";
   version = "2.700";
 
   src = fetchurl {
-    url = "https://github.com/mishamyrt/Lilex/releases/download/${version}/Lilex.zip";
+    url = "https://github.com/mishamyrt/Lilex/releases/download/${finalAttrs.version}/Lilex.zip";
     hash = "sha256-NDEO20unSfdy1CuI4+7EpjGFJ+dc7qqWz8VW7jU2b7w=";
   };
 
-  nativeBuildInputs = [ unzip ];
+  sourceRoot = ".";
 
-  unpackPhase = ''
-    runHook preUnpack
-    unzip $src
-    runHook postUnpack
-  '';
+  outputs = [
+    "out"
+    "webfont"
+  ];
 
-  installPhase = ''
-    runHook preInstall
-    find . -name '*.ttf' -exec install -m444 -Dt $out/share/fonts/truetype {} +
-    runHook postInstall
-  '';
+  nativeBuildInputs = [
+    installFonts
+    unzip
+  ];
 
   meta = {
     description = "Open source programming font";
@@ -34,4 +33,4 @@ stdenvNoCC.mkDerivation rec {
     maintainers = with lib.maintainers; [ redyf ];
     platforms = lib.platforms.all;
   };
-}
+})
diff --git a/pkgs/by-name/li/line-awesome/package.nix b/pkgs/by-name/li/line-awesome/package.nix
index 1ad61941fdf0..59e4177d0a40 100644
--- a/pkgs/by-name/li/line-awesome/package.nix
+++ b/pkgs/by-name/li/line-awesome/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  installFonts,
   unzip,
 }:
 
@@ -14,18 +15,17 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "07qkz8s1wjh5xwqlq1b4lpihr1zah3kh6bnqvfwvncld8l9wjqfk";
   };
 
-  nativeBuildInputs = [ unzip ];
-
   sourceRoot = "${finalAttrs.version}/fonts";
 
-  installPhase = ''
-    mkdir -p $out/share/fonts/truetype
-    mkdir -p $out/share/fonts/woff
-    mkdir -p $out/share/fonts/woff2
-    cp *.ttf $out/share/fonts/truetype
-    cp *.woff $out/share/fonts/woff
-    cp *.woff2 $out/share/fonts/woff2
-  '';
+  outputs = [
+    "out"
+    "webfont"
+  ];
+
+  nativeBuildInputs = [
+    unzip
+    installFonts
+  ];
 
   meta = {
     description = "Replace Font Awesome with modern line icons";
diff --git a/pkgs/by-name/ll/llama-cpp/package.nix b/pkgs/by-name/ll/llama-cpp/package.nix
index 8cb110649619..ae72f38c5064 100644
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@@ -81,7 +81,7 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
   pname = "llama-cpp";
-  version = "9309";
+  version = "9484";
 
   outputs = [
     "out"
@@ -92,7 +92,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
     owner = "ggml-org";
     repo = "llama.cpp";
     tag = "b${finalAttrs.version}";
-    hash = "sha256-RzxQjVRn6G8M+6N9ulWKIfkfFkD1gTee0L/JWTcOXY0=";
+    hash = "sha256-YPf563WfSLlV4qc9eQRjW1YPxCbqsRs9yN/x30C/IGA=";
     leaveDotGit = true;
     postFetch = ''
       git -C "$out" rev-parse --short HEAD > $out/COMMIT
diff --git a/pkgs/by-name/ma/mastodon/gemset.nix b/pkgs/by-name/ma/mastodon/gemset.nix
index 30f7bb99c7e0..ebf07a65f2df 100644
--- a/pkgs/by-name/ma/mastodon/gemset.nix
+++ b/pkgs/by-name/ma/mastodon/gemset.nix
@@ -807,10 +807,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1izp5vna86s7xivqzml4nviy01bv76arrd5is8wkncwp1by3zzbc";
+      sha256 = "1ha0bcz71z48ahdvc0dp71apnbqnnpgffq0dac2q65y68259hx7j";
       type = "gem";
     };
-    version = "1.21.1";
+    version = "1.22.0";
   };
   csv = {
     groups = [ "default" ];
@@ -1127,10 +1127,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0rqfmrgp4ihwmnpi9ah0y6pah7rr7d3pid94z2cqd93bgc2m6vjn";
+      sha256 = "1ncmbdjf2bwmk0jf5cxywns9zbxyfiy4h4p3pzi7yddyjhv81qrq";
       type = "gem";
     };
-    version = "5.1.3";
+    version = "6.0.4";
   };
   erubi = {
     groups = [
@@ -1207,10 +1207,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "077n5ss3z3ds4vj54w201kd12smai853dp9c9n7ii7g3q7nwwg54";
+      sha256 = "1b930ag8nh99v8n9645ac1wcah9fx0mclbp323q4i1ly9acvkk3k";
       type = "gem";
     };
-    version = "2.14.1";
+    version = "2.14.2";
   };
   faraday-follow_redirects = {
     dependencies = [ "faraday" ];
@@ -1889,10 +1889,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1x64l31nkqjwfv51s2vsm0yqq4cwzrlnji12wvaq761myx3fxq9i";
+      sha256 = "115ll278g3zdvff7b05gfxqc9n74vw9xfzcc8jkv22bkphpkbng4";
       type = "gem";
     };
-    version = "2.10.2";
+    version = "2.10.3";
   };
   kaminari = {
     dependencies = [
diff --git a/pkgs/by-name/ma/mastodon/source.nix b/pkgs/by-name/ma/mastodon/source.nix
index 35750b4f79fe..46470a7e4d2a 100644
--- a/pkgs/by-name/ma/mastodon/source.nix
+++ b/pkgs/by-name/ma/mastodon/source.nix
@@ -5,14 +5,14 @@
   patches ? [ ],
 }:
 let
-  version = "4.5.10";
+  version = "4.5.11";
 in
 applyPatches {
   src = fetchFromGitHub {
     owner = "mastodon";
     repo = "mastodon";
     rev = "v${version}";
-    hash = "sha256-aW5WMmhfV+q/ddebSuEuCL5Mdwav+qocMPBnbvXFBk4=";
+    hash = "sha256-YAWlge8dShDFfMBhyRQHryZUs1yD5KNKzXOyCpRsy9w=";
     passthru = {
       inherit version;
       yarnHash = "sha256-OFPwe0OqvJhbJuY6gVuQJB5dGE8q6IPrsfW9NK8oVPM=";
diff --git a/pkgs/by-name/mo/mos/package.nix b/pkgs/by-name/mo/mos/package.nix
index 4ac9ee5d042f..deaae5b146e1 100644
--- a/pkgs/by-name/mo/mos/package.nix
+++ b/pkgs/by-name/mo/mos/package.nix
@@ -7,11 +7,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "mos";
-  version = "4.0.2";
+  version = "4.2.0";
 
   src = fetchurl {
-    url = "https://github.com/Caldis/Mos/releases/download/${finalAttrs.version}/Mos.Versions.${finalAttrs.version}-20260308.2.zip";
-    hash = "sha256-1DBFRIRjR9Fcl5DtHeuwn3qZgQ+jWRujYFzjPqa3/dY=";
+    url = "https://github.com/Caldis/Mos/releases/download/${finalAttrs.version}/Mos.Versions.${finalAttrs.version}-20260505.1.zip";
+    hash = "sha256-SswAG7V+7LbAbPcHwS4Kr+0TFg6XWhYTEK7lVC3lYCQ=";
   };
   sourceRoot = ".";
 
@@ -26,8 +26,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
-  passthru.updateScript = nix-update-script { };
-
   meta = {
     description = "Smooths scrolling and set mouse scroll directions independently on macOS";
     homepage = "https://mos.caldis.me/";
diff --git a/pkgs/by-name/nk/nkeys/package.nix b/pkgs/by-name/nk/nkeys/package.nix
index 0a5efee7ccae..13188c6b839f 100644
--- a/pkgs/by-name/nk/nkeys/package.nix
+++ b/pkgs/by-name/nk/nkeys/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "nkeys";
-  version = "0.4.15";
+  version = "0.4.16";
 
   src = fetchFromGitHub {
     owner = "nats-io";
     repo = "nkeys";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hlVPfL3ecEmqXRsV3skiOD7B1s2a0ZZ5RX6LV6ISEWI=";
+    hash = "sha256-GR1OvyA8bjZRTPTn12izxQXjACIaXFbGsSquHucusRY=";
   };
 
-  vendorHash = "sha256-3gyWzCYpkXnEURKB05GtGJxDMk6oIzWS4u3U5OUd3p4=";
+  vendorHash = "sha256-WszCsYEK0xOuSNI3UxJJLWKus8viVREaNj4xVQY6eBM=";
 
   meta = {
     description = "Public-key signature system for NATS";
diff --git a/pkgs/by-name/no/nosql-workbench/package.nix b/pkgs/by-name/no/nosql-workbench/package.nix
index 839673a63004..f79d7c92c358 100644
--- a/pkgs/by-name/no/nosql-workbench/package.nix
+++ b/pkgs/by-name/no/nosql-workbench/package.nix
@@ -8,22 +8,22 @@
 }:
 let
   pname = "nosql-workbench";
-  version = "3.13.0";
+  version = "3.20.2";
 
   src =
     fetchurl
       {
         x86_64-darwin = {
           url = "https://s3.amazonaws.com/nosql-workbench/NoSQL%20Workbench-mac-x64-${version}.dmg";
-          hash = "sha256-Dof1F1LTD478wh7jTR5zwFmbrvyCOWVO/C1QXTebi3c=";
+          hash = "sha256-ewlaaaWxPHxaOdAMbkHChzbxAB5MNdZS/p8ROD/SvcQ=";
         };
         aarch64-darwin = {
           url = "https://s3.amazonaws.com/nosql-workbench/NoSQL%20Workbench-mac-arm64-${version}.dmg";
-          hash = "sha256-QD0F6onP3GhMRIzNifx/RZkxPIS/GMtnF4zro5ygucg=";
+          hash = "sha256-U6Gea89/cXY9Fd6JAWrUtf7Q4VfEXDPzbjCQcHMRjiE=";
         };
         x86_64-linux = {
           url = "https://s3.amazonaws.com/nosql-workbench/NoSQL%20Workbench-linux-${version}.AppImage";
-          hash = "sha256-ewlaaaWxPHxaOdAMbkHChzbxAB5MNdZS/p8ROD/SvcQ=";
+          hash = "sha256-O62JsVHJ5OE6HLt3Pg9XVrd3j1eoY3O+bjqroowGEOE=";
         };
       }
       .${stdenv.system} or (throw "Unsupported system: ${stdenv.system}");
diff --git a/pkgs/by-name/op/opendkim/package.nix b/pkgs/by-name/op/opendkim/package.nix
index c80d68b098af..d33ebb0afe04 100644
--- a/pkgs/by-name/op/opendkim/package.nix
+++ b/pkgs/by-name/op/opendkim/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   nix-update-script,
   autoreconfHook,
   pkg-config,
@@ -24,6 +25,28 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-/IqWB0s39t8BeqpRIa8MZn4HgXlIMuU2UbYbpZGNo1s=";
   };
 
+  # TODO: remove when is merge
+  patches = [
+    (fetchpatch {
+      # https://github.com/trusteddomainproject/OpenDKIM/pull/288
+      name = "CVE-2020-35766.patch";
+      url = "https://github.com/trusteddomainproject/OpenDKIM/commit/520338d25af68cf263b97ba63037e3f5856a10da.patch";
+      hash = "sha256-O4a4boa67tj0nqxee6V+u7rd3l3RGaiWE+Mu0ib4DWE=";
+    })
+    (fetchpatch {
+      # https://github.com/trusteddomainproject/OpenDKIM/pull/287
+      name = "CVE-2022-48521.patch";
+      url = "https://github.com/trusteddomainproject/OpenDKIM/commit/e67c33e1a08cca793470e6a6ff44082f73f6d222.patch";
+      hash = "sha256-QtxiRM+/NDlQhfGB8XNX1M1PtQyXXarawoF+8pTTMVo=";
+    })
+    (fetchpatch {
+      # https://github.com/trusteddomainproject/OpenDKIM/pull/261
+      name = "fix-old-style-dkimf_base64_encode_file.patch";
+      url = "https://github.com/trusteddomainproject/OpenDKIM/commit/3f0aa0a31c11b9924f826708535071b68c22b731.patch";
+      hash = "sha256-nQCBGef2kjs9ZyHwPreNPQYW6jBOBTDhVq9RyeGSN/Y=";
+    })
+  ];
+
   configureFlags = [
     "--with-milter=${libmilter}"
     "ac_cv_func_malloc_0_nonnull=yes"
@@ -63,11 +86,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.bsd3;
     platforms = lib.platforms.unix;
     mainProgram = "opendkim";
-    knownVulnerabilities = [
-      "CVE-2020-35766: Privilege escalation in test suite"
-      "CVE-2022-48521: Specially crafted e-mails can bypass DKIM signature validation"
-      "Upstream OpenDKIM hasn't been updated in years, and is assumed to be unmaintained. Consider using an alternative such as rspamd."
-    ];
     maintainers = with lib.maintainers; [ maevii ];
   };
 })
diff --git a/pkgs/by-name/pe/penelope/package.nix b/pkgs/by-name/pe/penelope/package.nix
index ffe51baad703..674a5c4070ce 100644
--- a/pkgs/by-name/pe/penelope/package.nix
+++ b/pkgs/by-name/pe/penelope/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "penelope";
-  version = "0.19.1";
+  version = "0.20.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "brightio";
     repo = "penelope";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-72HFPByH4FBRIYaTeEWaZ2dW43Q1OjosT3qAOMiu5t4=";
+    hash = "sha256-mqdNPMKTwReIk2zUU+oZ21QOH+l3L12/TADB6YbcOzk=";
   };
 
   build-system = with python3.pkgs; [ setuptools ];
diff --git a/pkgs/by-name/pr/probe-rs-tools/package.nix b/pkgs/by-name/pr/probe-rs-tools/package.nix
index 7529bfad0593..a8e2464d9e56 100644
--- a/pkgs/by-name/pr/probe-rs-tools/package.nix
+++ b/pkgs/by-name/pr/probe-rs-tools/package.nix
@@ -5,8 +5,10 @@
   fetchurl,
   cmake,
   pkg-config,
+  installShellFiles,
   libusb1,
   openssl,
+  stdenv,
 }:
 
 let
@@ -36,6 +38,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     # https://github.com/rust-lang/libz-sys/issues/158
     cmake
     pkg-config
+    installShellFiles
   ];
 
   buildInputs = [
@@ -45,6 +48,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   postInstall = ''
     install -D -m 444 ${udevRules} $out/etc/udev/rules.d/69-probe-rs.rules
+  ''
+  + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd probe-rs \
+      --bash <(SHELL=bash $out/bin/probe-rs complete install -m) \
+      --fish <(SHELL=fish $out/bin/probe-rs complete install -m) \
+      --zsh <(SHELL=zsh $out/bin/probe-rs complete install -m)
   '';
 
   checkFlags = [
diff --git a/pkgs/by-name/re/redumper/package.nix b/pkgs/by-name/re/redumper/package.nix
index 53c7185fd567..9e7eb75f491e 100644
--- a/pkgs/by-name/re/redumper/package.nix
+++ b/pkgs/by-name/re/redumper/package.nix
@@ -2,43 +2,66 @@
   lib,
   fetchFromGitHub,
   cmake,
+  ctestCheckHook,
   ninja,
   llvmPackages,
+  gtest,
+  versionCheckHook,
+  nix-update-script,
 }:
 
 # redumper is using C++ modules, this requires latest C++20 compiler and build tools
 llvmPackages.libcxxStdenv.mkDerivation (finalAttrs: {
   pname = "redumper";
-  version = "709";
+  version = "720";
 
   src = fetchFromGitHub {
     owner = "superg";
     repo = "redumper";
     tag = "b${finalAttrs.version}";
-    hash = "sha256-3J+/v8Rhu5yT+MgAxcNBiHLAPAcNWc/YJXxFMgOZnPs=";
+    hash = "sha256-Gl+BJV9yWFGHk5HZudre+YUaaqCYcQpT50oeDcc39ds=";
   };
 
+  patches = [
+    ./remove-static-linking.patch
+  ];
+
+  __structuredAttrs = true;
+
+  strictDeps = true;
+
   nativeBuildInputs = [
     cmake
+    ctestCheckHook
     ninja
     llvmPackages.clang-tools
   ];
 
-  env.NIX_CFLAGS_COMPILE = "-isystem ${llvmPackages.libcxx.dev}/include/c++/v1";
-
   # https://github.com/superg/redumper/blob/main/.github/workflows/cmake.yml
   cmakeFlags = [
-    "-DCMAKE_BUILD_WITH_INSTALL_RPATH=ON"
-    "-DREDUMPER_VERSION_BUILD=${finalAttrs.version}"
-    "-DREDUMPER_CLANG_LINK_OPTIONS=" # overrides the '-static' default
+    (lib.cmakeFeature "REDUMPER_VERSION_BUILD" "${finalAttrs.src.tag}")
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_GOOGLETEST" "${gtest.src}")
   ];
 
+  doCheck = true;
+
+  doInstallCheck = true;
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "b(.*)"
+    ];
+  };
+
   meta = {
     homepage = "https://github.com/superg/redumper";
     description = "Low level CD dumper utility";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [ hughobrien ];
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.unix;
     mainProgram = "redumper";
   };
 })
diff --git a/pkgs/by-name/re/redumper/remove-static-linking.patch b/pkgs/by-name/re/redumper/remove-static-linking.patch
new file mode 100644
index 000000000000..46e3e58b8809
--- /dev/null
+++ b/pkgs/by-name/re/redumper/remove-static-linking.patch
@@ -0,0 +1,44 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 2f5d66a..e437573 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -221,39 +221,8 @@ endif()
+ 
+ target_link_libraries(redumper ${libs})
+ 
+-if(REDUMPER_TARGET_LINUX)
+-    target_link_options(redumper PRIVATE "-static")
+-endif()
+-
+ install(TARGETS redumper DESTINATION "bin")
+ 
+-# bundle LLVM libc++ for C++20 support (system libc++ is too old, static linking not allowed on macOS)
+-if(REDUMPER_TARGET_MACOS)
+-    set_target_properties(redumper PROPERTIES INSTALL_RPATH "@executable_path/../lib")
+-    
+-    install(FILES
+-        "${LLVM_LIB_PATH}/c++/libc++.1.0.dylib"
+-        "${LLVM_LIB_PATH}/c++/libc++.1.dylib"
+-        "${LLVM_LIB_PATH}/c++/libc++abi.1.0.dylib"
+-        "${LLVM_LIB_PATH}/c++/libc++abi.1.dylib"
+-        "${LLVM_LIB_PATH}/libunwind.1.0.dylib"
+-        "${LLVM_LIB_PATH}/libunwind.1.dylib"
+-        DESTINATION "lib"
+-    )
+-    
+-    # fix install names after files are copied & re-sign binaries after modification (install_name_tool invalidates signatures)
+-    install(CODE "
+-        execute_process(COMMAND install_name_tool -change ${LLVM_LIB_PATH}/c++/libc++.1.dylib @rpath/libc++.1.dylib \${CMAKE_INSTALL_PREFIX}/bin/redumper)
+-        execute_process(COMMAND install_name_tool -id @rpath/libc++.1.dylib \${CMAKE_INSTALL_PREFIX}/lib/libc++.1.0.dylib)
+-        execute_process(COMMAND install_name_tool -id @rpath/libc++abi.1.dylib \${CMAKE_INSTALL_PREFIX}/lib/libc++abi.1.0.dylib)
+-        execute_process(COMMAND install_name_tool -id @rpath/libunwind.1.dylib \${CMAKE_INSTALL_PREFIX}/lib/libunwind.1.0.dylib)
+-        execute_process(COMMAND codesign --force --sign - \${CMAKE_INSTALL_PREFIX}/bin/redumper)
+-        execute_process(COMMAND codesign --force --sign - \${CMAKE_INSTALL_PREFIX}/lib/libc++.1.0.dylib)
+-        execute_process(COMMAND codesign --force --sign - \${CMAKE_INSTALL_PREFIX}/lib/libc++abi.1.0.dylib)
+-        execute_process(COMMAND codesign --force --sign - \${CMAKE_INSTALL_PREFIX}/lib/libunwind.1.0.dylib)
+-    ")
+-endif()
+-
+ # Windows 7 requires administrative access in order to access the disc drive
+ if(MSVC AND CMAKE_SYSTEM_VERSION VERSION_EQUAL "6.1")
+     set_target_properties(redumper PROPERTIES LINK_FLAGS "/MANIFESTUAC:\"level='requireAdministrator' uiAccess='false'\"")
diff --git a/pkgs/by-name/re/render-cli/package.nix b/pkgs/by-name/re/render-cli/package.nix
index cee6d46a0e31..41c9d9862c09 100644
--- a/pkgs/by-name/re/render-cli/package.nix
+++ b/pkgs/by-name/re/render-cli/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "render-cli";
-  version = "2.18.0";
+  version = "2.19.0";
 
   src = fetchFromGitHub {
     owner = "render-oss";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-S3XWxK40jIX5l1o4km5CJLcPqEp10hjKYb+iWZSNKck=";
+    hash = "sha256-v5kYPQtYO9YqsBbs57ypqMfwWMswdKcdbI2WfKyllHc=";
   };
 
   vendorHash = "sha256-0cOW8g9rhUbcBF/JfsYu8OJJhaDXAd37341GZeoCAVQ=";
diff --git a/pkgs/by-name/re/renderdoc/package.nix b/pkgs/by-name/re/renderdoc/package.nix
index e69d1581a1a2..73e4c2fdc868 100644
--- a/pkgs/by-name/re/renderdoc/package.nix
+++ b/pkgs/by-name/re/renderdoc/package.nix
@@ -12,9 +12,9 @@
   libpthread-stubs,
   makeWrapper,
   nix-update-script,
-  pcre,
+  pcre2,
   pkg-config,
-  python312Packages,
+  python3,
   qt5,
   stdenv,
   vulkan-loader,
@@ -24,6 +24,9 @@
 }:
 
 let
+  # forked from swig v3 in 2017
+  # primarily to include https://github.com/swig/swig/pull/251
+  # (cherry-picked as https://github.com/swig/swig/commit/8d79491a329825ad24294509fc6a0b0a0b8947c4)
   custom_swig = fetchFromGitHub {
     owner = "baldurk";
     repo = "swig";
@@ -58,16 +61,36 @@ stdenv.mkDerivation (finalAttrs: {
       revert = true;
     })
   ];
+  swig_patches = [
+    # use PCRE2 instead of PCRE
+    (fetchpatch {
+      name = "renderdoc-swig-pcre2-1.patch";
+      url = "https://src.fedoraproject.org/rpms/renderdoc/raw/19ce666d120a229e5c1ab62fc142610ab3b21b3c/f/renderdoc-swig-pcre2-1.patch";
+      hash = "sha256-xuqHu72vAbxFELNTfJT5SbQOsnG/ee++MZgpuEGLT/w=";
+    })
+    (fetchpatch {
+      name = "renderdoc-swig-pcre2-2.patch";
+      url = "https://src.fedoraproject.org/rpms/renderdoc/raw/19ce666d120a229e5c1ab62fc142610ab3b21b3c/f/renderdoc-swig-pcre2-2.patch";
+      hash = "sha256-LUm5Ekmccy4x+hR+iK49zJc75VxuhDhpNw8rkVnn4rc=";
+    })
+  ];
+  postPatch = ''
+    pushd ../swig
+    prePatch="" postPatch="" patches="$swig_patches" runPhase patchPhase
+    popd
+  '';
 
   buildInputs = [
     libxdmcp
     libpthread-stubs
-    python312Packages.pyside2
-    python312Packages.pyside2-tools
-    python312Packages.shiboken2
     qt5.qtbase
     qt5.qtsvg
     vulkan-loader
+    # TODO: make sure pyrenderdoc is installed properly
+    # TODO: unbreak shiboken2 on python>3.12
+    # python312Packages.pyside2
+    # python312Packages.pyside2-tools
+    # python312Packages.shiboken2
   ]
   ++ lib.optionals waylandSupport [
     wayland
@@ -80,9 +103,9 @@ stdenv.mkDerivation (finalAttrs: {
     bison
     cmake
     makeWrapper
-    pcre
+    pcre2
     pkg-config
-    python312Packages.python
+    python3
     qt5.qtx11extras
     qt5.wrapQtAppsHook
   ];
@@ -94,6 +117,10 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeFeature "BUILD_VERSION_DIST_CONTACT" "https://github.com/NixOS/nixpkgs/")
     (lib.cmakeBool "BUILD_VERSION_STABLE" true)
     (lib.cmakeBool "ENABLE_UNSUPPORTED_EXPERIMENTAL_POSSIBLY_BROKEN_WAYLAND" waylandSupport)
+    # TODO: build python bindings
+    # https://github.com/NixOS/nixpkgs/issues/525939
+    (lib.cmakeBool "ENABLE_PYRENDERDOC" false)
+    (lib.cmakeBool "QRENDERDOC_ENABLE_PYSIDE2" false)
   ];
 
   dontWrapQtApps = true;
@@ -101,7 +128,7 @@ stdenv.mkDerivation (finalAttrs: {
   strictDeps = true;
 
   postUnpack = ''
-    cp -r ${custom_swig} swig
+    cp -r ${finalAttrs.passthru.custom_swig} swig
     chmod -R +w swig
     patchShebangs swig/autogen.sh
   '';
@@ -136,7 +163,10 @@ stdenv.mkDerivation (finalAttrs: {
     addDriverRunpath $out/lib/librenderdoc.so
   '';
 
-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    inherit custom_swig;
+    updateScript = nix-update-script { };
+  };
 
   meta = {
     homepage = "https://renderdoc.org/";
diff --git a/pkgs/by-name/sa/saunafs/package.nix b/pkgs/by-name/sa/saunafs/package.nix
index 020242d73383..0fbec789c8db 100644
--- a/pkgs/by-name/sa/saunafs/package.nix
+++ b/pkgs/by-name/sa/saunafs/package.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "saunafs";
-  version = "5.9.0";
+  version = "5.10.0";
 
   src = fetchFromGitHub {
     owner = "leil-io";
     repo = "saunafs";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-OMUW5JJziW3C9R5gsnFTGnxwmVoXRTtu4aIlXfnVdME=";
+    hash = "sha256-5FeuzL7JiCuR2l7PjYTtsesXS0RaJmAMrTUKtCwKZxE=";
   };
 
   patches = [
diff --git a/pkgs/by-name/sh/showtime/package.nix b/pkgs/by-name/sh/showtime/package.nix
index d44b9a041d0a..1b6262e84aa9 100644
--- a/pkgs/by-name/sh/showtime/package.nix
+++ b/pkgs/by-name/sh/showtime/package.nix
@@ -69,13 +69,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
     export HOME="$TEMPDIR"
   '';
 
-  # HACK: To get rid of unreproducible __pycache__ created by pythonImportsCheck.
-  # See https://github.com/NixOS/nixpkgs/issues/469081
-  deletePycachePhase = ''
-    find $out/lib -type d -name __pycache__ -prune -exec rm -vr {} \;
-  '';
-  postPhases = [ "deletePycachePhase" ];
-
   passthru = {
     updateScript = gnome.updateScript {
       packageName = "showtime";
diff --git a/pkgs/by-name/sp/spacetimedb/package.nix b/pkgs/by-name/sp/spacetimedb/package.nix
index 911948f33a97..8ffbd583c9ac 100644
--- a/pkgs/by-name/sp/spacetimedb/package.nix
+++ b/pkgs/by-name/sp/spacetimedb/package.nix
@@ -15,16 +15,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "spacetimedb";
-  version = "2.2.0";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "clockworklabs";
     repo = "spacetimedb";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KlMkgxfsUoLJ4h05td62eKfqWl9fYQ61FTsA1COkQrQ=";
+    hash = "sha256-JEehx4UnvpuGneI049fQel+05JhNoPSFO5ZI2WBSqC4=";
   };
 
-  cargoHash = "sha256-csiDZKGLcorwVemK0g8Vi0+/Zq+b2UtC047ROrC/nOI=";
+  cargoHash = "sha256-aX45e9oHFM4aiRVNKYi6WJztaSRSpmLnyYI9oD7Pa+w=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/sy/syswatch/package.nix b/pkgs/by-name/sy/syswatch/package.nix
index f2c88b7f8fc8..6d94c8001b70 100644
--- a/pkgs/by-name/sy/syswatch/package.nix
+++ b/pkgs/by-name/sy/syswatch/package.nix
@@ -7,18 +7,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "syswatch";
-  version = "0.7.0";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "matthart1983";
     repo = "syswatch";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-93KSbhgobGqd29M+cwEr6b1NhrwKhM+nJbRWG/hnvag=";
+    hash = "sha256-9LEZ9DWp5H+ODiuE6A5Qzr/ozXQaXQ7TbDnJY8B8GD4=";
   };
 
   __structuredAttrs = true;
 
-  cargoHash = "sha256-BRmkznPCS8BTLxeHAVz4eBsJZoKdDsaPE2VWMiquMac=";
+  cargoHash = "sha256-dGobKfemSrZ+Y4haHrmLt7dqv9yOBDJ2k3XnZ9LkIlw=";
 
   nativeCheckInputs = [ versionCheckHook ];
 
diff --git a/pkgs/by-name/tm/tm/missing-string-header.patch b/pkgs/by-name/tm/tm/missing-string-header.patch
deleted file mode 100644
index 134102400a6d..000000000000
--- a/pkgs/by-name/tm/tm/missing-string-header.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-diff --git a/unix_client.c b/unix_client.c
-index 920910a..6d608fd 100644
---- a/unix_client.c
-+++ b/unix_client.c
-@@ -8,6 +8,7 @@
- #include <sys/socket.h>
- #include <unistd.h>
- #include <assert.h>
-+#include <string.h>
- 
- #include "main.h"
- #include "handlers.h"
-diff --git a/unix_server.c b/unix_server.c
-index 5cf93ed..d3c51c9 100644
---- a/unix_server.c
-+++ b/unix_server.c
-@@ -8,6 +8,7 @@
- #include <assert.h>
- #include <unistd.h>
- #include <stdio.h>
-+#include <string.h>
- #include <sys/un.h>
- #include <sys/socket.h>
- #include <sys/select.h>
diff --git a/pkgs/by-name/tm/tm/package.nix b/pkgs/by-name/tm/tm/package.nix
deleted file mode 100644
index 740e6e175892..000000000000
--- a/pkgs/by-name/tm/tm/package.nix
+++ /dev/null
@@ -1,35 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "tm";
-  version = "0.4.1";
-
-  src = fetchurl {
-    url = "https://vicerveza.homeunix.net/~viric/soft/tm/tm-${finalAttrs.version}.tar.gz";
-    hash = "sha256-OzibwDtpZK1f+lejRLiR/bz3ybJgSt2nI6hj+DZXxKA=";
-  };
-
-  makeFlags = [ "PREFIX=$(out)" ];
-
-  patches = [
-    # fix using strncpy and strlen without including string.h
-    ./missing-string-header.patch
-  ];
-
-  postPatch = ''
-    sed -i 's@/usr/bin/install@install@g ; s/gcc/cc/g' Makefile
-  '';
-
-  meta = {
-    description = "Terminal mixer - multiplexer for the i/o of terminal applications";
-    homepage = "http://vicerveza.homeunix.net/~viric/soft/tm";
-    license = lib.licenses.gpl2Plus;
-    maintainers = [ ];
-    platforms = lib.platforms.all;
-    mainProgram = "tm";
-  };
-})
diff --git a/pkgs/by-name/tr/triton-llvm/package.nix b/pkgs/by-name/tr/triton-llvm/package.nix
index 9f75c47099ec..1ede101acda8 100644
--- a/pkgs/by-name/tr/triton-llvm/package.nix
+++ b/pkgs/by-name/tr/triton-llvm/package.nix
@@ -68,7 +68,9 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "triton-llvm";
-  version = "22.0.0-unstable-2025-09-26"; # See https://github.com/llvm/llvm-project/blob/main/cmake/Modules/LLVMVersion.cmake
+  version = "23.0.0-unstable-2026-01-29"; # See https://github.com/llvm/llvm-project/blob/main/cmake/Modules/LLVMVersion.cmake
+
+  __structuredAttrs = true;
 
   outputs = [
     "out"
@@ -84,8 +86,8 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "llvm";
     repo = "llvm-project";
-    rev = "f6ded0be897e2878612dd903f7e8bb85448269e5";
-    hash = "sha256-T76zHZZ2bp3Ye9GTV+MgbKqMbtmMGElMFsWuCkiWqrM=";
+    rev = "ac5dc54d509169d387fcfd495d71853d81c46484";
+    hash = "sha256-tA1KcZqyPsgfxQs9tbNhX11oFcNGJefxWmfCpYqdI9M=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/vu/vulnix/package.nix b/pkgs/by-name/vu/vulnix/package.nix
index 0084cc01369a..62f4010142c4 100644
--- a/pkgs/by-name/vu/vulnix/package.nix
+++ b/pkgs/by-name/vu/vulnix/package.nix
@@ -9,7 +9,7 @@
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "vulnix";
   version = "1.12.4";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "nix-community";
@@ -33,6 +33,10 @@ python3Packages.buildPythonApplication (finalAttrs: {
     pytest-cov-stub
   ];
 
+  build-system = with python3Packages; [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     nix
   ]
@@ -41,7 +45,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
     colorama
     pyyaml
     requests
-    setuptools
     toml
     zodb
   ]);
diff --git a/pkgs/by-name/we/webdav/package.nix b/pkgs/by-name/we/webdav/package.nix
index 951144c12b26..69464f1982f9 100644
--- a/pkgs/by-name/we/webdav/package.nix
+++ b/pkgs/by-name/we/webdav/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "webdav";
-  version = "5.11.9";
+  version = "5.11.10";
 
   src = fetchFromGitHub {
     owner = "hacdias";
     repo = "webdav";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7+c8RcuXfEdbSD5+EbkTCEm8uFilkbBMGte+FIAygR0=";
+    hash = "sha256-OaaUROSjzgM99sQrnE8bSCdfGPYCJJ5frptogqsJMrM=";
   };
 
-  vendorHash = "sha256-HU3J5w1x4LyvEgTo+o307U1/dHivUpJbsX/VBOAkhhM=";
+  vendorHash = "sha256-/s93KMnfQ+eLFCXaE6GFU8rakCNNQv8cnfHF+teEDJQ=";
 
   __darwinAllowLocalNetworking = true;
 
diff --git a/pkgs/by-name/zk/zkfuse/package.nix b/pkgs/by-name/zk/zkfuse/package.nix
index 099614df6bcd..3751f1e4dda5 100644
--- a/pkgs/by-name/zk/zkfuse/package.nix
+++ b/pkgs/by-name/zk/zkfuse/package.nix
@@ -40,6 +40,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = {
+    description = "Utility to mount a Zookeeper instance as a file-system";
     platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [ ztzg ];
     license = lib.licenses.asl20;
diff --git a/pkgs/development/interpreters/elixir/1.20.nix b/pkgs/development/interpreters/elixir/1.20.nix
index f1a99ef40a4f..011b965cbe45 100644
--- a/pkgs/development/interpreters/elixir/1.20.nix
+++ b/pkgs/development/interpreters/elixir/1.20.nix
@@ -1,7 +1,7 @@
 import ./generic-builder.nix {
-  version = "1.20.0-rc.6";
-  hash = "sha256-U3zBeZ4U44jXwYJva2neb3Ll1dDpxvLSIR0Tg1HP33U=";
-  # https://hexdocs.pm/elixir/1.20.0-rc.6/compatibility-and-deprecations.html#between-elixir-and-erlang-otp
+  version = "1.20.0";
+  hash = "sha256-cTogrKyG2SkJFlnB43pwKiowf41eTHPTHbIS5f44b0Q=";
+  # https://hexdocs.pm/elixir/1.20.0/compatibility-and-deprecations.html#between-elixir-and-erlang-otp
   minimumOTPVersion = "27";
   maximumOTPVersion = "29";
 }
diff --git a/pkgs/development/python-modules/advantage-air/default.nix b/pkgs/development/python-modules/advantage-air/default.nix
index 78c12434e1ce..71546c8b92fd 100644
--- a/pkgs/development/python-modules/advantage-air/default.nix
+++ b/pkgs/development/python-modules/advantage-air/default.nix
@@ -3,20 +3,23 @@
   aiohttp,
   buildPythonPackage,
   fetchPypi,
+  setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "advantage-air";
   version = "0.4.4";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "advantage_air";
-    inherit version;
+    inherit (finalAttrs) version;
     hash = "sha256-4rRR9IxzH5EiYfWzWYeyCwoLB2LetBVyH7L3nkvp+gA=";
   };
 
-  propagatedBuildInputs = [ aiohttp ];
+  build-system = [ setuptools ];
+
+  dependencies = [ aiohttp ];
 
   # No tests
   doCheck = false;
@@ -29,4 +32,4 @@ buildPythonPackage rec {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ jamiemagee ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/aiodiscover/default.nix b/pkgs/development/python-modules/aiodiscover/default.nix
index d222735ca5cc..21ca19213e6c 100644
--- a/pkgs/development/python-modules/aiodiscover/default.nix
+++ b/pkgs/development/python-modules/aiodiscover/default.nix
@@ -5,6 +5,7 @@
   cached-ipaddress,
   fetchFromGitHub,
   ifaddr,
+  libredirect,
   netifaces,
   poetry-core,
   pyroute2,
@@ -15,14 +16,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "aiodiscover";
-  version = "3.2.3";
+  version = "3.3.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bdraco";
     repo = "aiodiscover";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GivEYa0/i/ufudYSHWQwYRhTEpzmwhlOyPHWH/JpdfU=";
+    hash = "sha256-QQwEYxflOzNN+J0lCIp+LzwB7m000PgZH8MSsKTUEMw=";
   };
 
   build-system = [ poetry-core ];
@@ -35,16 +36,19 @@ buildPythonPackage (finalAttrs: {
     pyroute2
   ];
 
+  pythonRelaxDeps = [ "aiodns" ];
+
   nativeCheckInputs = [
+    libredirect.hook
     pytest-asyncio
     pytest-cov-stub
     pytestCheckHook
   ];
 
-  disabledTests = [
-    # Tests require access to /etc/resolv.conf
-    "test_async_discover_hosts"
-  ];
+  preCheck = ''
+    echo "nameserver 127.0.0.1" > resolv.conf
+    export NIX_REDIRECTS=/etc/resolv.conf=$(realpath resolv.conf)
+  '';
 
   pythonImportsCheck = [ "aiodiscover" ];
 
diff --git a/pkgs/development/python-modules/asmog/default.nix b/pkgs/development/python-modules/asmog/default.nix
index bc39b9edba45..de2165d63e3f 100644
--- a/pkgs/development/python-modules/asmog/default.nix
+++ b/pkgs/development/python-modules/asmog/default.nix
@@ -4,19 +4,22 @@
   async-timeout,
   buildPythonPackage,
   fetchPypi,
+  setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "asmog";
   version = "0.0.6";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
-    sha256 = "14b8hdxcks6qyrqpp4mm77fvzznbskqn7fw9qgwgcqx81pg45iwk";
+    inherit (finalAttrs) pname version;
+    hash = "sha256-k8dC3g2oY/b4w4m7Y/HUy/6/3Tm1kntx9tjoyXqDaJE=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     aiohttp
     async-timeout
   ];
@@ -33,4 +36,4 @@ buildPythonPackage rec {
     license = with lib.licenses; [ asl20 ];
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/asyncio-throttle/default.nix b/pkgs/development/python-modules/asyncio-throttle/default.nix
index a5a32699dac3..ca456b9eb6ee 100644
--- a/pkgs/development/python-modules/asyncio-throttle/default.nix
+++ b/pkgs/development/python-modules/asyncio-throttle/default.nix
@@ -4,20 +4,23 @@
   fetchFromGitHub,
   pytestCheckHook,
   pytest-asyncio,
+  setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "asyncio-throttle";
   version = "1.0.2";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "hallazzang";
     repo = "asyncio-throttle";
-    rev = "v${version}";
-    sha256 = "1hsjcymdcm0hf4l68scf9n8j7ba89azgh96xhxrnyvwxfs5acnmv";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-u1qminadb29zh90k+L5KSK0jkU2OaWQocRBU1qpnUsM=";
   };
 
+  build-system = [ setuptools ];
+
   nativeCheckInputs = [
     pytest-asyncio
     pytestCheckHook
@@ -31,4 +34,4 @@ buildPythonPackage rec {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ hexa ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/atlassian-python-api/default.nix b/pkgs/development/python-modules/atlassian-python-api/default.nix
index 8941296b2eb8..b45eae544e2a 100644
--- a/pkgs/development/python-modules/atlassian-python-api/default.nix
+++ b/pkgs/development/python-modules/atlassian-python-api/default.nix
@@ -13,20 +13,23 @@
   six,
   typing-extensions,
   pytestCheckHook,
+  setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "atlassian-python-api";
   version = "4.0.7";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "atlassian-api";
     repo = "atlassian-python-api";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-8zfM/3apGMo6sTPA5ESu2SkgVOJUA09Wz/pGR12fA7c=";
   };
 
+  build-system = [ setuptools ];
+
   dependencies = [
     beautifulsoup4
     deprecated
@@ -47,8 +50,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python Atlassian REST API Wrapper";
     homepage = "https://github.com/atlassian-api/atlassian-python-api";
-    changelog = "https://github.com/atlassian-api/atlassian-python-api/releases/tag/${src.tag}";
+    changelog = "https://github.com/atlassian-api/atlassian-python-api/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/augeas/default.nix b/pkgs/development/python-modules/augeas/default.nix
index fe208bb26a78..1f0bb2cb80d2 100644
--- a/pkgs/development/python-modules/augeas/default.nix
+++ b/pkgs/development/python-modules/augeas/default.nix
@@ -7,19 +7,22 @@
   augeas,
   cffi,
   pkgs, # for libxml2
+  setuptools,
 }:
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "augeas";
   version = "1.2.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "hercules-team";
     repo = "python-augeas";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-Lq8ckra3sqN38zo1d5JsEq6U5TtLKRmqysoWNwR9J9A=";
   };
 
+  build-system = [ setuptools ];
+
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [
@@ -27,17 +30,17 @@ buildPythonPackage rec {
     pkgs.libxml2
   ];
 
-  propagatedBuildInputs = [ cffi ];
+  dependencies = [ cffi ];
 
   nativeCheckInputs = [ unittestCheckHook ];
 
   pythonImportsCheck = [ "augeas" ];
 
   meta = {
-    changelog = "https://github.com/hercules-team/python-augeas/releases/tag/v${version}";
+    changelog = "https://github.com/hercules-team/python-augeas/releases/tag/v${finalAttrs.version}";
     description = "Pure python bindings for augeas";
     homepage = "https://github.com/hercules-team/python-augeas";
     license = lib.licenses.lgpl2Plus;
     platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/development/python-modules/autograd-gamma/default.nix b/pkgs/development/python-modules/autograd-gamma/default.nix
index 0e38848d6f7d..62def06e6af1 100644
--- a/pkgs/development/python-modules/autograd-gamma/default.nix
+++ b/pkgs/development/python-modules/autograd-gamma/default.nix
@@ -5,21 +5,24 @@
   pytestCheckHook,
   autograd,
   scipy,
+  setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "autograd-gamma";
   version = "0.4.3";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "CamDavidsonPilon";
     repo = "autograd-gamma";
-    rev = "v${version}";
-    sha256 = "0v03gly5k3a1hzb54zpw6409m3riak49qd27hkq2f66ai42ivqz2";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-4uMdBYnKGCfwhEc0nMhUMY+aADH8flLWh0GNWTx9A2w=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     autograd
     scipy
   ];
@@ -34,4 +37,4 @@ buildPythonPackage rec {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ swflint ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/avion/default.nix b/pkgs/development/python-modules/avion/default.nix
index 13a670f3d05f..1135c20bd08e 100644
--- a/pkgs/development/python-modules/avion/default.nix
+++ b/pkgs/development/python-modules/avion/default.nix
@@ -6,12 +6,13 @@
   fetchPypi,
   pycryptodome,
   requests,
+  setuptools,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "avion";
   version = "0.10";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
@@ -24,7 +25,9 @@ buildPythonPackage (finalAttrs: {
       --replace "bluepy>==1.1.4" "bluepy>=1.1.4"
   '';
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     bluepy
     csrmesh
     pycryptodome
diff --git a/pkgs/development/python-modules/bitsandbytes/default.nix b/pkgs/development/python-modules/bitsandbytes/default.nix
index b814a9825022..1f63860b7934 100644
--- a/pkgs/development/python-modules/bitsandbytes/default.nix
+++ b/pkgs/development/python-modules/bitsandbytes/default.nix
@@ -9,6 +9,7 @@
   cmake,
 
   # build-system
+  ninja,
   scikit-build-core,
   setuptools,
 
@@ -121,6 +122,7 @@ buildPythonPackage (finalAttrs: {
   ];
 
   build-system = [
+    ninja
     scikit-build-core
     setuptools
   ];
diff --git a/pkgs/development/python-modules/blebox-uniapi/default.nix b/pkgs/development/python-modules/blebox-uniapi/default.nix
index 197784dc6e91..fd6ec9d5eaa2 100644
--- a/pkgs/development/python-modules/blebox-uniapi/default.nix
+++ b/pkgs/development/python-modules/blebox-uniapi/default.nix
@@ -10,16 +10,16 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "blebox-uniapi";
-  version = "2.5.3";
+  version = "2.5.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "blebox";
     repo = "blebox_uniapi";
-    tag = "v${version}";
-    hash = "sha256-DBkd8o2jOVCH3KqJ2FZ4qhJsSMb1UwqBO1ZXoTLsqEY=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-YiEOFxKqWVK7DzrSUvwzIvkyjSpTTFSuVh4pfz+lSg0=";
   };
 
   postPatch = ''
@@ -43,10 +43,10 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "blebox_uniapi" ];
 
   meta = {
-    changelog = "https://github.com/blebox/blebox_uniapi/blob/v${version}/HISTORY.rst";
+    changelog = "https://github.com/blebox/blebox_uniapi/blob/${finalAttrs.src.tag}/HISTORY.rst";
     description = "Python API for accessing BleBox smart home devices";
     homepage = "https://github.com/blebox/blebox_uniapi";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ dotlambda ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index 666b2bd27f00..9fa05c9295b2 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -358,13 +358,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "boto3-stubs";
-  version = "1.43.19";
+  version = "1.43.21";
   pyproject = true;
 
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit (finalAttrs) version;
-    hash = "sha256-0Wc9i9REkPu/OT6Gmo3cGPzYq0zrx/sq6/KYybtD+8s=";
+    hash = "sha256-PRmr3e6APfH3tDC2f2T80Llloe7reupzpzakya8ZqBw=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/cached-ipaddress/default.nix b/pkgs/development/python-modules/cached-ipaddress/default.nix
index 820d3dfe2448..9ceac5ab6c9d 100644
--- a/pkgs/development/python-modules/cached-ipaddress/default.nix
+++ b/pkgs/development/python-modules/cached-ipaddress/default.nix
@@ -11,16 +11,16 @@
   propcache,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "cached-ipaddress";
-  version = "1.1.1";
+  version = "1.1.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bdraco";
     repo = "cached-ipaddress";
-    tag = "v${version}";
-    hash = "sha256-VIIcScaZwd5BAidgG30edYsAQaFnqxEQX+F/t+HR278=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-+A1kMD1L2K+dAWrZJ96qJpx0udRGMWbWApyWtMrE7lk=";
   };
 
   build-system = [
@@ -42,8 +42,8 @@ buildPythonPackage rec {
   meta = {
     description = "Cache construction of ipaddress objects";
     homepage = "https://github.com/bdraco/cached-ipaddress";
-    changelog = "https://github.com/bdraco/cached-ipaddress/blob/${src.rev}/CHANGELOG.md";
+    changelog = "https://github.com/bdraco/cached-ipaddress/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/conduit/default.nix b/pkgs/development/python-modules/conduit/default.nix
index 9fd15ff2eea0..837eec0364d1 100644
--- a/pkgs/development/python-modules/conduit/default.nix
+++ b/pkgs/development/python-modules/conduit/default.nix
@@ -3,9 +3,18 @@
   stdenv,
   pkgs,
   buildPythonPackage,
-  setuptools,
-  numpy,
+
+  # build-system
+  cmake,
+  ninja,
   pip,
+  setuptools,
+
+  # nativeBuildInputs
+  openmpi,
+
+  # dependencies
+  numpy,
 
   mpiSupport ? false,
 }:
@@ -17,32 +26,36 @@ buildPythonPackage {
     pname
     version
     src
-    nativeBuildInputs
+    # nativeBuildInputs
     buildInputs
     ;
   pyproject = true;
+  __structuredAttrs = true;
 
-  # Needed for cmake to find openmpi
-  strictDeps = false;
-
-  postPatch = ''
-    substituteInPlace setup.py \
+  postPatch = (conduit.postPatch or "") + ''
+    substituteInPlace pyproject.toml \
       --replace-fail \
-        "'-j2'" \
-        "f'-j{os.environ.get(\"NIX_BUILD_CORES\")}'"
+        "cmake<=3.30.0" \
+        "cmake"
   '';
 
-  dontUseCmakeConfigure = true;
-
   env.ENABLE_MPI = mpiSupport;
 
   build-system = [
+    cmake
+    ninja
+    pip
     setuptools
   ];
+  dontUseCmakeConfigure = true;
+
+  nativeBuildInputs = conduit.nativeBuildInputs ++ [
+    # openmpi needs to be in nativeBuildInputs, otherwise cmake can't find it
+    openmpi
+  ];
 
   dependencies = [
     numpy
-    pip
   ];
 
   pythonImportsCheck = [ "conduit" ];
diff --git a/pkgs/development/python-modules/deep-gemm/default.nix b/pkgs/development/python-modules/deep-gemm/default.nix
index 6c873f09ea20..4946efaf98ef 100644
--- a/pkgs/development/python-modules/deep-gemm/default.nix
+++ b/pkgs/development/python-modules/deep-gemm/default.nix
@@ -2,6 +2,8 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  replaceVars,
+  symlinkJoin,
 
   # build-system
   setuptools,
@@ -47,6 +49,23 @@ buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
 
   patches = [
     ./use-system-libraries.patch
+
+    # DeepGEMM does JIT compilation and needs to access the NVIDIA compiler and some libraries at
+    # runtime.
+    # Instead of letting it search for the cuda toolkit on the host, hardcode the path to a custom
+    # closure.
+    (replaceVars ./patch-runtime-cuda-home-path.patch {
+      cuda_home = symlinkJoin {
+        name = "cuda-toolkit";
+        paths = with cudaPackages; [
+          (lib.getBin cuda_nvcc) # bin/nvcc, bin/ptxas, nvvm/, nvcc.profile
+          (lib.getBin cutlass) # include/cute, include/cutlass
+          (lib.getInclude cuda_cccl) # include/cuda/std/* (libcu++)
+          (lib.getInclude cuda_cudart) # include/cuda_runtime.h, cuda_bf16.h, cuda_fp8.h
+          (lib.getInclude cuda_cuobjdump) # bin/cuobjdump
+        ];
+      };
+    })
   ];
 
   env = optionalAttrs cudaSupport {
diff --git a/pkgs/development/python-modules/deep-gemm/patch-runtime-cuda-home-path.patch b/pkgs/development/python-modules/deep-gemm/patch-runtime-cuda-home-path.patch
new file mode 100644
index 000000000000..6391bdf0fae7
--- /dev/null
+++ b/pkgs/development/python-modules/deep-gemm/patch-runtime-cuda-home-path.patch
@@ -0,0 +1,27 @@
+diff --git a/deep_gemm/__init__.py b/deep_gemm/__init__.py
+index a4633ae..6508865 100644
+--- a/deep_gemm/__init__.py
++++ b/deep_gemm/__init__.py
+@@ -62,21 +62,7 @@ from .utils import *
+ 
+ # Initialize CPP modules
+ def _find_cuda_home() -> str:
+-    # TODO: reuse PyTorch API later
+-    # For some PyTorch versions, the original `_find_cuda_home` will initialize CUDA, which is incompatible with process forks
+-    cuda_home = os.environ.get('CUDA_HOME') or os.environ.get('CUDA_PATH')
+-    if cuda_home is None:
+-        # noinspection PyBroadException
+-        try:
+-            with open(os.devnull, 'w') as devnull:
+-                nvcc = subprocess.check_output(['which', 'nvcc'], stderr=devnull).decode().rstrip('\r\n')
+-                cuda_home = os.path.dirname(os.path.dirname(nvcc))
+-        except Exception:
+-            cuda_home = '/usr/local/cuda'
+-            if not os.path.exists(cuda_home):
+-                cuda_home = None
+-    assert cuda_home is not None
+-    return cuda_home
++    return "@cuda_home@"
+ 
+ 
+ deep_gemm_cpp.init(
diff --git a/pkgs/development/python-modules/doit/default.nix b/pkgs/development/python-modules/doit/default.nix
index bbd8018ee2d3..f44826346973 100644
--- a/pkgs/development/python-modules/doit/default.nix
+++ b/pkgs/development/python-modules/doit/default.nix
@@ -15,19 +15,20 @@
   pyflakes,
   configclass,
   mergedict,
+  setuptools,
 }:
 
 let
   doit = buildPythonPackage rec {
     pname = "doit";
-    version = "0.36.0";
-    format = "setuptools";
+    version = "0.37.0";
+    pyproject = true;
 
     disabled = !isPy3k;
 
     src = fetchPypi {
       inherit pname version;
-      hash = "sha256-cdB8zJUUyyL+WdmJmVd2ZeqrV+FvZE0EM2rgtLriNLw=";
+      hash = "sha256-08cuDkao+h3avqj4MHYkAt7gkMrzPDDCKVrHAQ248Jw=";
     };
 
     propagatedBuildInputs = [
@@ -38,6 +39,10 @@ let
     ++ lib.optional stdenv.hostPlatform.isLinux pyinotify
     ++ lib.optional stdenv.hostPlatform.isDarwin macfsevents;
 
+    build-system = [
+      setuptools
+    ];
+
     nativeCheckInputs = [
       configclass
       doit-py
diff --git a/pkgs/development/python-modules/executorch/default.nix b/pkgs/development/python-modules/executorch/default.nix
index c727a336c17e..16c5f2255d10 100644
--- a/pkgs/development/python-modules/executorch/default.nix
+++ b/pkgs/development/python-modules/executorch/default.nix
@@ -102,12 +102,6 @@ buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
 
       sed -i "1i #include <cstdint>" backends/apple/coreml/runtime/inmemoryfs/memory_buffer.hpp
       sed -i "1i #include <cstdint>" extension/llm/tokenizers/third-party/sentencepiece/src/sentencepiece_processor.h
-    ''
-    + ''
-      substituteInPlace extension/llm/tokenizers/test/test_python_bindings.py \
-        --replace-fail \
-          'self.assertEqual(pytorch_tokenizers.__version__, "0.1.0")' \
-          'self.assertEqual(pytorch_tokenizers.__version__, "${pytorch-tokenizers.version}")'
     '';
 
   env = {
diff --git a/pkgs/development/python-modules/fjaraskupan/default.nix b/pkgs/development/python-modules/fjaraskupan/default.nix
index 35936627991b..8b3f5adbbc98 100644
--- a/pkgs/development/python-modules/fjaraskupan/default.nix
+++ b/pkgs/development/python-modules/fjaraskupan/default.nix
@@ -9,16 +9,16 @@
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "fjaraskupan";
-  version = "2.3.3";
+  version = "2.3.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "elupus";
     repo = "fjaraskupan";
-    tag = version;
-    hash = "sha256-xu5u3hvtD1gbN1f1UuxDQVIHF5pyCOWVwUq36vAgW/Y=";
+    tag = finalAttrs.version;
+    hash = "sha256-0rJoUQYexB+4ehOXKa1aca401E7opDtdoBmIW/2uOOE=";
   };
 
   build-system = [ setuptools ];
@@ -38,8 +38,8 @@ buildPythonPackage rec {
   meta = {
     description = "Module for controlling Fjäråskupan kitchen fans";
     homepage = "https://github.com/elupus/fjaraskupan";
-    changelog = "https://github.com/elupus/fjaraskupan/releases/tag/${version}";
-    license = with lib.licenses; [ mit ];
+    changelog = "https://github.com/elupus/fjaraskupan/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/flash-attn-3/default.nix b/pkgs/development/python-modules/flash-attn-3/default.nix
new file mode 100644
index 000000000000..80afc2c37e68
--- /dev/null
+++ b/pkgs/development/python-modules/flash-attn-3/default.nix
@@ -0,0 +1,107 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  ninja,
+  setuptools,
+  torch,
+
+  # dependencies
+  einops,
+
+  # tests
+  pytestCheckHook,
+}:
+
+let
+  inherit (torch) cudaCapabilities cudaPackages cudaSupport;
+in
+buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
+  pname = "flash-attn-3";
+  version = "3.0.0-unstable-2026-06-02";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  # We fetch the vendored CUTLASS submodule rather than relying on `cudaPackages.cutlass`.
+  # FA3 reaches deep into private cute/cutlass internals and is likely to be incompatible with
+  # whatever version of cutlass we currently package.
+  # Upstream pins a specific submodule SHA that is often an unreleased commit on master, strictly
+  # between two tagged versions, so neither the previous nor the next stable tag will compile.
+  # Using the vendored submodule is the only way to guarantee a matching set of headers.
+  src = fetchFromGitHub {
+    owner = "Dao-AILab";
+    repo = "flash-attention";
+    rev = "b02b07e1a10238fe12831b80a8937ed59b1353a5";
+    hash = "sha256-LALX4lYioJLYssoQ0rJCC5M2Ij28wtP7ucpGkKIzmmg=";
+    fetchSubmodules = true;
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/hopper";
+
+  postPatch =
+    # The submodule is fetched by fetchFromGitHub, no need to update it at build time
+    ''
+      substituteInPlace setup.py \
+        --replace-fail \
+          'subprocess.run(["git", "submodule", "update", "--init", "../csrc/cutlass"])' \
+          'pass'
+    ''
+    # Prevent setup.py from downloading a custom NVCC version
+    + ''
+      substituteInPlace setup.py \
+        --replace-fail \
+          'if bare_metal_version >= Version("12.3") and bare_metal_version < Version("13.0") and bare_metal_version != Version("12.8"):' \
+          'if False:'
+    '';
+
+  preConfigure = ''
+    export MAX_JOBS="$NIX_BUILD_CORES"
+    export NVCC_THREADS=2
+  '';
+
+  env = {
+    FLASH_ATTENTION_FORCE_BUILD = "TRUE";
+    FLASH_ATTENTION_SKIP_CUDA_BUILD = "FALSE";
+
+    # 8.0;9.0;12.0
+    TORCH_CUDA_ARCH_LIST = lib.concatStringsSep ";" cudaCapabilities;
+  };
+
+  build-system = [
+    ninja
+    setuptools
+    torch
+  ];
+
+  nativeBuildInputs = [
+    cudaPackages.cuda_nvcc
+  ];
+
+  buildInputs = [
+    cudaPackages.cuda_cudart # cuda_runtime.h cuda_runtime_api.h
+  ];
+
+  dependencies = [
+    einops
+    torch
+  ];
+
+  pythonImportsCheck = [
+    "flash_attn_config"
+    "flash_attn_interface"
+  ];
+
+  # Tests require access to a physical GPU
+  doCheck = false;
+
+  meta = {
+    description = "Official implementation of FlashAttention-3";
+    homepage = "https://github.com/Dao-AILab/flash-attention/blob/main/hopper";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+    # Upstream requires either CUDA or ROCm. ROCm support is not (yet) supported in nixpkgs
+    broken = !cudaSupport;
+  };
+})
diff --git a/pkgs/development/python-modules/hg-commitsigs/default.nix b/pkgs/development/python-modules/hg-commitsigs/default.nix
deleted file mode 100644
index 84cda6e4325d..000000000000
--- a/pkgs/development/python-modules/hg-commitsigs/default.nix
+++ /dev/null
@@ -1,42 +0,0 @@
-{
-  lib,
-  fetchhg,
-  stdenv,
-  python,
-}:
-
-stdenv.mkDerivation {
-  pname = "hg-commitsigs";
-  # Latest tag is 11 years old.
-  version = "unstable-2021-01-08";
-
-  src = fetchhg {
-    url = "https://foss.heptapod.net/mercurial/commitsigs";
-    rev = "b53eb6862bff";
-    sha256 = "sha256-PS1OhC9MiVFD7WYlIn6FavD5TyhM50WoV6YagI2pLxU=";
-  };
-
-  # Not sure how the tests are supposed to be run, and they 10 years old...
-  doCheck = false;
-  dontBuild = true;
-
-  installPhase = ''
-    mkdir -p $out/${python.sitePackages}/hgext3rd/
-    install -D $src/commitsigs.py \
-               $out/${python.sitePackages}/hgext3rd/
-  '';
-
-  meta = {
-    description = "Automatic signing of changeset hashes";
-    longDescription = ''
-      This packages provides a Mercurial extension that lets you sign
-      the changeset hash when you commit.  The signature is embedded
-      directly in the changeset itself; there wont be any extra
-      commits.  Either GnuPG or OpenSSL can be used to sign the hashes.
-    '';
-    homepage = "https://foss.heptapod.net/mercurial/commitsigs";
-    maintainers = with lib.maintainers; [ yoctocell ];
-    license = lib.licenses.gpl2Plus;
-    platforms = lib.platforms.unix; # same as Mercurial
-  };
-}
diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index a9fe963f01d4..913344e46a7c 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202606021";
+  version = "0.1.202606031";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/MZUx/BgpDBFBAdJw8xQmgrcQKxSwq5tt9PHw5XZHMQ=";
+    hash = "sha256-fJ0fKvg5wVeHBPKvTemYp44JOoxmdqaAigzbRlS7xD8=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/jianpu-ly/default.nix b/pkgs/development/python-modules/jianpu-ly/default.nix
index c33fd5ab8aa6..22bdadfbec54 100644
--- a/pkgs/development/python-modules/jianpu-ly/default.nix
+++ b/pkgs/development/python-modules/jianpu-ly/default.nix
@@ -6,31 +6,31 @@
   lilypond,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "jianpu-ly";
-  version = "1.868";
+  version = "1.869";
   pyproject = true;
 
   src = fetchPypi {
-    inherit version;
+    inherit (finalAttrs) version;
     pname = "jianpu_ly";
-    hash = "sha256-Jm3r3c4o/rMdwiPlaIe33JEyb0S4yIr9kupxZal06eU=";
+    hash = "sha256-xTownx9NOAzQtXsuhgzzqqt+GvT2IYIxwCvZfDnIPeg=";
   };
 
-  dependencies = [ lilypond ];
-
   build-system = [ setuptools ];
 
+  dependencies = [ lilypond ];
+
   pythonImportsCheck = [ "jianpu_ly" ];
 
   # no tests in shipped with upstream
   doCheck = false;
 
   meta = {
-    homepage = "https://ssb22.user.srcf.net/mwrhome/jianpu-ly.html";
     description = "Assists with printing jianpu";
-    changelog = "https://github.com/ssb22/jianpu-ly/releases/tag/v${version}";
+    homepage = "https://ssb22.user.srcf.net/mwrhome/jianpu-ly.html";
+    changelog = "https://github.com/ssb22/jianpu-ly/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ ifurther ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/knx-frontend/default.nix b/pkgs/development/python-modules/knx-frontend/default.nix
index 9bb21e466955..69ccf7cde5f3 100644
--- a/pkgs/development/python-modules/knx-frontend/default.nix
+++ b/pkgs/development/python-modules/knx-frontend/default.nix
@@ -5,16 +5,16 @@
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "knx-frontend";
-  version = "2026.4.30.60856";
+  version = "2026.6.1.213802";
   pyproject = true;
 
   # TODO: source build, uses yarn.lock
   src = fetchPypi {
     pname = "knx_frontend";
-    inherit version;
-    hash = "sha256-ZviZoQY0ZlIgiiEKwsOpTRVoi8F1JPE1RqD8Nzozpr4=";
+    inherit (finalAttrs) version;
+    hash = "sha256-P3a2dPAaowvYzrUit0MAdNPjcTECkE8juMBAapLYtFs=";
   };
 
   build-system = [ setuptools ];
@@ -25,10 +25,10 @@ buildPythonPackage rec {
   doCheck = false;
 
   meta = {
-    changelog = "https://github.com/XKNX/knx-frontend/releases/tag/${version}";
+    changelog = "https://github.com/XKNX/knx-frontend/releases/tag/${finalAttrs.version}";
     description = "Home Assistant Panel for managing the KNX integration";
     homepage = "https://github.com/XKNX/knx-frontend";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ hexa ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/life360/default.nix b/pkgs/development/python-modules/life360/default.nix
index b12c11c20341..23c65457d11c 100644
--- a/pkgs/development/python-modules/life360/default.nix
+++ b/pkgs/development/python-modules/life360/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "life360";
-  version = "7.1.0";
+  version = "7.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pnbruckner";
     repo = "life360";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-D7ZtC9WrGTuU7cOs37P+y9zqOrOlfa919FVicejy6n4=";
+    hash = "sha256-ySa84lUyx8D7Dgg/hdZ4o/+Znn3CR0O9rdeXBrj/k5U=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/mistral-common/default.nix b/pkgs/development/python-modules/mistral-common/default.nix
index 18de3b8f6f5c..bda5944d02ab 100644
--- a/pkgs/development/python-modules/mistral-common/default.nix
+++ b/pkgs/development/python-modules/mistral-common/default.nix
@@ -38,14 +38,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "mistral-common";
-  version = "1.11.0";
+  version = "1.11.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mistralai";
     repo = "mistral-common";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DejbLY2i6Hp1J+spxMut5RKugj7rDyrZmp6v+5wqyWY=";
+    hash = "sha256-EXdZcBR61GNye8LqwIqRO8lP1lK6fqPJufWFO9XkkYQ=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index bd3fc35433b6..76018fe511bd 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -443,8 +443,8 @@ in
       "sha256-dXNkOcMonYrBh4yzeubd+v3mW42s9XpmpfvgbtgoJgY=";
 
   mypy-boto3-ec2 =
-    buildMypyBoto3Package "ec2" "1.43.14"
-      "sha256-4FPmtV6paCZOQ3rJW29d55RnB5TokCOzNhCgH03cIvo=";
+    buildMypyBoto3Package "ec2" "1.43.20"
+      "sha256-OGxCwLfDYlx43+HEuVHsrC59c67yTJ37ttOu4TWw3U0=";
 
   mypy-boto3-ec2-instance-connect =
     buildMypyBoto3Package "ec2-instance-connect" "1.43.0"
@@ -475,8 +475,8 @@ in
       "sha256-duU3LIeW3FNiplVmduZsNXBoDK7vbO6ecrBt1Y7C9rU=";
 
   mypy-boto3-elasticache =
-    buildMypyBoto3Package "elasticache" "1.43.0"
-      "sha256-6NjmoXMu9RDobyrdRWYVNPc6Q8JDLP+TzAsy2z+ELgk=";
+    buildMypyBoto3Package "elasticache" "1.43.20"
+      "sha256-wXJzvzlQXgqrJfI/IV/KVmIQ5etRFuld69+mvgsK0Og=";
 
   mypy-boto3-elasticbeanstalk =
     buildMypyBoto3Package "elasticbeanstalk" "1.43.0"
@@ -590,8 +590,8 @@ in
       "sha256-+DDeD9YWo98meLZU2Mzu5AE0S7HFg6kfxeUWUh9XcQA=";
 
   mypy-boto3-guardduty =
-    buildMypyBoto3Package "guardduty" "1.43.15"
-      "sha256-5/PHXiFoiGBM3uK6jm8g5L5Wrt3x0DoH1p+TAI4kC80=";
+    buildMypyBoto3Package "guardduty" "1.43.20"
+      "sha256-wTB+ajpXaGLWpM5vbMibB1q/PVejn3eK+v5Lfh57wqo=";
 
   mypy-boto3-health =
     buildMypyBoto3Package "health" "1.43.0"
@@ -630,8 +630,8 @@ in
       "sha256-F+4rmr2/nI1TQCFnMY0dPxAXlgN3IBSfiQaDGup5HSw=";
 
   mypy-boto3-iot =
-    buildMypyBoto3Package "iot" "1.43.17"
-      "sha256-/hR8GtbwvoVnseF0BQTcb8Jv8JIXcR0atxIcElZv1K4=";
+    buildMypyBoto3Package "iot" "1.43.20"
+      "sha256-ZARIC6yQVEkQ1ZtbM8HmQb7mHLQC/3o1PSLCD/KuC4o=";
 
   mypy-boto3-iot-data =
     buildMypyBoto3Package "iot-data" "1.43.17"
@@ -766,8 +766,8 @@ in
       "sha256-gYTCgaRwH3zKi6gg4MC8DUwXQT+jZO6lqc/vi+JUahU=";
 
   mypy-boto3-lambda =
-    buildMypyBoto3Package "lambda" "1.43.0"
-      "sha256-pY3ia1wTvlTeqzFyPumreqqSK+HfvQk9w6TKEsyFMVc=";
+    buildMypyBoto3Package "lambda" "1.43.20"
+      "sha256-wdYorfSAmlDVEFRlQxiujWu/OFbq6nKA2aZt1mv/isk=";
 
   mypy-boto3-lex-models =
     buildMypyBoto3Package "lex-models" "1.43.3"
@@ -1170,8 +1170,8 @@ in
       "sha256-T+JIJpHxD7IzAwq8yxgq6zbVMj/btpbhKnylMyfFvvU=";
 
   mypy-boto3-sagemaker =
-    buildMypyBoto3Package "sagemaker" "1.43.16"
-      "sha256-Jp+FHUC9ATqf7+Lz+j532i4NveXiATVUywXY3PZHTPw=";
+    buildMypyBoto3Package "sagemaker" "1.43.20"
+      "sha256-EAuXDoQfGv/Fk/nQfcWNt4WSHir9y0cF8vRr0yPcNqM=";
 
   mypy-boto3-sagemaker-a2i-runtime =
     buildMypyBoto3Package "sagemaker-a2i-runtime" "1.43.0"
@@ -1362,8 +1362,8 @@ in
       "sha256-fc0e8DEx/b6M3kPB4Y07qqqMayg2BGSQ69gkuhcrl9Y=";
 
   mypy-boto3-transcribe =
-    buildMypyBoto3Package "transcribe" "1.43.0"
-      "sha256-0hww0SSW03bUktNCr81f5C56U961ETH96Gn1VZwX1Iw=";
+    buildMypyBoto3Package "transcribe" "1.43.20"
+      "sha256-zk62JmlBT6nmRYoTZ3j7ThgbqjqTv0UOK3A+vZZlkRE=";
 
   mypy-boto3-transfer =
     buildMypyBoto3Package "transfer" "1.43.0"
diff --git a/pkgs/development/python-modules/plotnine/default.nix b/pkgs/development/python-modules/plotnine/default.nix
index 422cd9a5ce03..724a845abfe8 100644
--- a/pkgs/development/python-modules/plotnine/default.nix
+++ b/pkgs/development/python-modules/plotnine/default.nix
@@ -23,7 +23,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "plotnine";
-  version = "0.15.4";
+  version = "0.15.5";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -31,7 +31,7 @@ buildPythonPackage (finalAttrs: {
     owner = "has2k1";
     repo = "plotnine";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xZ3M9bBY5kL8Z2Fa5D+oxnU2HMvxbVKALTvsxDAHMuQ=";
+    hash = "sha256-o2yCZeYMIKpmJ7ekH4dCFZXnxyw7uN5rhXYehCNOOWI=";
   };
 
   build-system = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/pyautogui/default.nix b/pkgs/development/python-modules/pyautogui/default.nix
index 0180cf974966..57125a380d67 100644
--- a/pkgs/development/python-modules/pyautogui/default.nix
+++ b/pkgs/development/python-modules/pyautogui/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  setuptools,
   mouseinfo,
   pygetwindow,
   pymsgbox,
@@ -13,10 +14,10 @@
   xvfb-run,
   scrot,
 }:
-buildPythonPackage {
+buildPythonPackage (finalAttrs: {
   pname = "pyautogui";
   version = "0.9.53";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "asweigart";
@@ -25,22 +26,16 @@ buildPythonPackage {
     hash = "sha256-R9tcTqxUaqw63FLOGFRaO/Oz6kD7V6MPHdQ8A29NdXw=";
   };
 
-  nativeCheckInputs = [
-    xvfb-run
-    scrot
-  ];
-  checkPhase = ''
-    xvfb-run python -c 'import pyautogui'
-    # The tests depend on some specific things that xvfb cant provide, like keyboard and mouse
-    # xvfb-run python -m unittest tests.test_pyautogui
-  '';
-
   patches = [
     # https://github.com/asweigart/pyautogui/issues/598
     ./fix-locateOnWindow-and-xlib.patch
   ];
 
-  propagatedBuildInputs = [
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
     mouseinfo
     pygetwindow
     pymsgbox
@@ -51,10 +46,22 @@ buildPythonPackage {
     pytweening
   ];
 
+  nativeCheckInputs = [
+    xvfb-run
+    scrot
+  ];
+
+  checkPhase = ''
+    xvfb-run python -c 'import pyautogui'
+    # The tests depend on some specific things that xvfb cant provide, like keyboard and mouse
+    # xvfb-run python -m unittest tests.test_pyautogui
+  '';
+
   meta = {
     description = "PyAutoGUI lets Python control the mouse and keyboard, and other GUI automation tasks";
     homepage = "https://github.com/asweigart/pyautogui";
+    changelog = "https://github.com/asweigart/pyautogui/blob/${finalAttrs.src.rev}/CHANGES.txt";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ lucasew ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/python-qube-heatpump/default.nix b/pkgs/development/python-modules/python-qube-heatpump/default.nix
index eeacfeebd715..a73fa9986410 100644
--- a/pkgs/development/python-modules/python-qube-heatpump/default.nix
+++ b/pkgs/development/python-modules/python-qube-heatpump/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "python-qube-heatpump";
-  version = "1.10.0";
+  version = "1.11.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "MattieGit";
     repo = "python-qube-heatpump";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+voRl54hzKqtaps0HubOOQKuki4uIPlPPl31e6o6hXs=";
+    hash = "sha256-eHw1nlly95ne4XbMNB8su7TgbDEKMqUXYx9WQtUZo6Y=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/torch/source/default.nix b/pkgs/development/python-modules/torch/source/default.nix
index f547c1604476..1f2e754b9b91 100644
--- a/pkgs/development/python-modules/torch/source/default.nix
+++ b/pkgs/development/python-modules/torch/source/default.nix
@@ -3,7 +3,6 @@
   lib,
   fetchFromGitHub,
   fetchFromGitLab,
-  fetchpatch,
   git-unroll,
   buildPythonPackage,
   python,
@@ -48,7 +47,6 @@
   llvmPackages,
 
   # dependencies
-  astunparse,
   binutils,
   expecttest,
   filelock,
@@ -229,6 +227,9 @@ let
         rocm-smi
         clr.icd
         hipify
+        rocprofiler-sdk
+        rocprofiler-sdk.dev
+        amdsmi
       ]
       ++ lib.optionals (!vendorComposableKernel) [
         composable_kernel
@@ -282,8 +283,9 @@ in
 buildPythonPackage.override { inherit stdenv; } (finalAttrs: {
   pname = "torch";
   # Don't forget to update torch-bin to the same version.
-  version = "2.11.0";
+  version = "2.12.0";
   pyproject = true;
+  __structuredAttrs = true;
 
   outputs = [
     "out" # output standard python package
@@ -306,29 +308,6 @@ buildPythonPackage.override { inherit stdenv; } (finalAttrs: {
 
   patches = [
     ./clang19-template-warning.patch
-
-    # The GCC version upperbounds were wrong for cuda 12.8 and 12.9, which led downstream builds to
-    # illegitimately fail with:
-    #   RuntimeError: The current installed version of g++ (14.3.0) is greater than the maximum
-    #   required version by CUDA 12.9. Please make sure to use an adequate version of g++
-    #   (>=6.0.0, <14.0).
-    # TODO: remove at the next release
-    (fetchpatch {
-      name = "allow-gcc-14-with-cuda-12.8-9";
-      url = "https://github.com/pytorch/pytorch/commit/39565a7dcf8f93ea22cedeaa20088b24ff6d2634.patch";
-      hash = "sha256-Au5fVbs7i33d9c4Xj8koiBP7lGnsTGTaX4VlE2gAfy8=";
-    })
-
-    # pybind11 3.0.3 changes led to ambiguous deduction in some return types
-    # that used `py::make_tuple`, so the type is explicitly specified where
-    # needed.
-    # Merged pull request: https://github.com/pytorch/pytorch/pull/179277
-    # TODO: remove at the next release
-    (fetchpatch {
-      name = "pybind11-3.0.3-ambiguous-return-type.patch";
-      url = "https://github.com/pytorch/pytorch/commit/b248ebc17075c0c3ad2b2532970d2ada32b2cf94.patch";
-      hash = "sha256-HY5JFGNoroFsfuUOO5j6WNP6gMHWUcIJFmWLqV8PV94=";
-    })
   ]
   ++ lib.optionals cudaSupport [
     ./fix-cmake-cuda-toolkit.patch
@@ -402,13 +381,6 @@ buildPythonPackage.override { inherit stdenv; } (finalAttrs: {
       --replace-fail "list(APPEND ATen_HIP_INCLUDE \''${CMAKE_CURRENT_SOURCE_DIR}/../../../third_party/composable_kernel/include)" "" \
       --replace-fail "list(APPEND ATen_HIP_INCLUDE \''${CMAKE_CURRENT_SOURCE_DIR}/../../../third_party/composable_kernel/library/include)" ""
   ''
-  # Detection of NCCL version doesn't work particularly well when using the static binary.
-  + lib.optionalString cudaSupport ''
-    substituteInPlace cmake/Modules/FindNCCL.cmake \
-      --replace-fail \
-        'message(FATAL_ERROR "Found NCCL header version and library version' \
-        'message(WARNING "Found NCCL header version and library version'
-  ''
   # Remove PyTorch's FindCUDAToolkit.cmake and use CMake's default.
   # NOTE: Parts of pytorch rely on unmaintained FindCUDA.cmake with custom patches to support e.g.
   # newer architectures (sm_90a). We do want to delete vendored patches, but have to keep them
@@ -523,9 +495,9 @@ buildPythonPackage.override { inherit stdenv; } (finalAttrs: {
   cmakeFlags = [
     (lib.cmakeFeature "PYTHON_SIX_SOURCE_DIR" "${six.src}")
     # (lib.cmakeBool "CMAKE_FIND_DEBUG_MODE" true)
-    (lib.cmakeFeature "CUDAToolkit_VERSION" cudaPackages.cudaMajorMinorVersion)
   ]
   ++ lib.optionals cudaSupport [
+    (lib.cmakeFeature "CUDAToolkit_VERSION" cudaPackages.cudaMajorMinorVersion)
     # Unbreaks version discovery in enable_language(CUDA) when wrapping nvcc with ccache
     # Cf. https://gitlab.kitware.com/cmake/cmake/-/issues/26363
     (lib.cmakeFeature "CMAKE_CUDA_COMPILER_TOOLKIT_VERSION" cudaPackages.cudaMajorMinorVersion)
@@ -622,14 +594,12 @@ buildPythonPackage.override { inherit stdenv; } (finalAttrs: {
     "sympy"
   ];
   dependencies = [
-    astunparse
     expecttest
     filelock
     fsspec
     hypothesis
     jinja2
     networkx
-    ninja
     packaging
     psutil
     pyyaml
diff --git a/pkgs/development/python-modules/torch/source/src.nix b/pkgs/development/python-modules/torch/source/src.nix
index 40379b8456cb..393f4fb9de8f 100644
--- a/pkgs/development/python-modules/torch/source/src.nix
+++ b/pkgs/development/python-modules/torch/source/src.nix
@@ -4,7 +4,7 @@
   fetchFromGitHub,
   runCommand,
 }:
-assert version == "2.11.0";
+assert version == "2.12.0";
 rec {
   src_aiter = fetchFromGitHub {
     owner = "ROCm";
@@ -43,6 +43,12 @@ rec {
     hash = "sha256-IDUIuAvgCzWaHoTJUZrH15bqoVcP8bZk+Gs1Ae6/CpY=";
   };
   src_composable_kernel = fetchFromGitHub {
+    owner = "ROCm";
+    repo = "composable_kernel";
+    rev = "f1746955fdaf80a3414de814bf32437686dac347";
+    hash = "sha256-B/xNuBPUdjL1b+0IzRnaSXT2FKUo5cYwYcKqfKqJ8Eg=";
+  };
+  src_composable_kernel_aiter = fetchFromGitHub {
     owner = "ROCm";
     repo = "composable_kernel";
     rev = "fcc9372c009c8e0a23fece77b582da83b04a654f";
@@ -63,8 +69,8 @@ rec {
   src_cpp-httplib = fetchFromGitHub {
     owner = "yhirose";
     repo = "cpp-httplib";
-    rev = "bd95e67c234930cd6d6bb11309588c5462c63cec";
-    hash = "sha256-5q77ersAJnPPpVChvntnqEly1/ek2KfX2iukTPUbKHc=";
+    rev = "4d7c9a788de136071ccf0dd4e96239151e2adadb";
+    hash = "sha256-VXEhoxoQjGEuA2g/y6fDTA4LrPd4SggrS3aOjznDSvc=";
   };
   src_cpr = fetchFromGitHub {
     owner = "libcpr";
@@ -87,14 +93,14 @@ rec {
   src_cudnn-frontend = fetchFromGitHub {
     owner = "NVIDIA";
     repo = "cudnn-frontend";
-    rev = "b8c0656e6f6c84fc194f4d57329b55d609eff596";
-    hash = "sha256-G1WYxRCsg67umzOZ9W+JwXV6hfl5n2wtsH9KxVUccTU=";
+    rev = "a91f0e04dcea10515f0f776fc5a89535e316a9c8";
+    hash = "sha256-OOKdkjsVnWgrtcI7IMPSRi2YxtqF2YNV4Fd2rD9I1K8=";
   };
   src_cutlass = fetchFromGitHub {
     owner = "NVIDIA";
     repo = "cutlass";
-    rev = "0d2b201e8c1c4a03efa6e9c468161916e2334725";
-    hash = "sha256-2xgdS2P2tEI/4qcZv9qjCYHFbAcVayMdCDeJfIiQN4U=";
+    rev = "da5e086dab31d63815acafdac9a9c5893b1c69e2";
+    hash = "sha256-0q9Ad0Z6E/rO2PdM4uQc8H0E0qs9uKc3reHepiHhjEc=";
   };
   src_cutlass_fbgemm = fetchFromGitHub {
     owner = "jwfromm";
@@ -141,8 +147,8 @@ rec {
   src_flash-attention = fetchFromGitHub {
     owner = "Dao-AILab";
     repo = "flash-attention";
-    rev = "e2743ab5b3803bb672b16437ba98a3b1d4576c50";
-    hash = "sha256-ft3jPiKZDHzZvkGPI34l8/Hq9Rf2f6UjDPKGU2IYz+E=";
+    rev = "fec3a6a18460c1b40f097208d4c16fe8964a679d";
+    hash = "sha256-7yEFNM2lslkBA/9slblAbiK1PHKqKmo1MCFJYz2BOLk=";
   };
   src_flatbuffers = fetchFromGitHub {
     owner = "google";
@@ -243,7 +249,7 @@ rec {
   src_ideep = fetchFromGitHub {
     owner = "intel";
     repo = "ideep";
-    rev = "8e7ddd65df95f13e41f0a40c820c5f35ae4a0ea3";
+    rev = "e539e0f9774e2018f0d56fe865da66581f692e3d";
     hash = "sha256-AVSsugGYiQ4QOWMVaHj1hzlPTZmg65yrGMmrWytvUuM=";
   };
   src_ittapi = fetchFromGitHub {
@@ -273,8 +279,8 @@ rec {
   src_kineto = fetchFromGitHub {
     owner = "pytorch";
     repo = "kineto";
-    rev = "7a731b6ae01cfc2b1fc75d83a91f84e682e43fd7";
-    hash = "sha256-kKASzILEvFhXDWDqBiNh21VxhtdT506NYoEDVrtVcGU=";
+    rev = "b2103f78d13fde4937af010c0ef8e24313568bc5";
+    hash = "sha256-Ix5zulGaUPbLeVrrTm/EzcVWT4TkDYcBsQADAl4N7TA=";
   };
   src_kleidiai = fetchFromGitHub {
     owner = "ARM-software";
@@ -303,8 +309,8 @@ rec {
   src_mkl-dnn = fetchFromGitHub {
     owner = "intel";
     repo = "mkl-dnn";
-    rev = "f1d471933dc852f956fd05389f9313c7148783d5";
-    hash = "sha256-/e57voLBNun/2koTF3sEb0Z/nDjCwq9NJVk7TaTSvMY=";
+    rev = "03c022d3ffdcee958cfacbe720048e725fdf644c";
+    hash = "sha256-xJTllrKs6mPNM85ZqyHTHWKpVOtOghmg4ZRFAvQZ4WU=";
   };
   src_MSLK = fetchFromGitHub {
     owner = "meta-pytorch";
@@ -393,8 +399,8 @@ rec {
   src_pytorch = fetchFromGitHub {
     owner = "pytorch";
     repo = "pytorch";
-    rev = "v2.11.0";
-    hash = "sha256-eA/pRQiibLJCKDUkMvmGq4suhrz37i0x0Lc/sH3Ag8E=";
+    rev = "v2.12.0";
+    hash = "sha256-IyQs9CQbbpZYpd+8YhIj/ULjsIWu6gjkGrGSeMWqKvw=";
   };
   src_sleef = fetchFromGitHub {
     owner = "shibatch";
@@ -423,7 +429,7 @@ rec {
   src_aiter_recursive = runCommand "aiter" { } ''
     cp -r ${src_aiter} $out
     chmod u+w $out/3rdparty/composable_kernel
-    cp -r ${src_composable_kernel_recursive}/* $out/3rdparty/composable_kernel
+    cp -r ${src_composable_kernel_aiter_recursive}/* $out/3rdparty/composable_kernel
   '';
   src_asmjit_recursive = src_asmjit;
   src_benchmark_recursive = src_benchmark;
@@ -431,6 +437,7 @@ rec {
   src_civetweb_recursive = src_civetweb;
   src_clang-cindex-python3_recursive = src_clang-cindex-python3;
   src_composable_kernel_recursive = src_composable_kernel;
+  src_composable_kernel_aiter_recursive = src_composable_kernel_aiter;
   src_composable_kernel_fbgemm_MSLK_recursive = src_composable_kernel_fbgemm_MSLK;
   src_composable_kernel_flash-attention_recursive = src_composable_kernel_flash-attention;
   src_cpp-httplib_recursive = src_cpp-httplib;
diff --git a/pkgs/development/python-modules/torchcodec/default.nix b/pkgs/development/python-modules/torchcodec/default.nix
index a6213d827649..07ad8ff72b81 100644
--- a/pkgs/development/python-modules/torchcodec/default.nix
+++ b/pkgs/development/python-modules/torchcodec/default.nix
@@ -26,14 +26,15 @@
 
 buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
   pname = "torchcodec";
-  version = "0.11.1";
+  version = "0.14.0";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "meta-pytorch";
     repo = "torchcodec";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-aYQp9vEVQJgF1n/KsfnDvLQf5nD0/gsG+RAgVlhk7t8=";
+    hash = "sha256-eGof2Rk/dGYPlKVRSuJ+ZeeMh2u4K6/qXmROo187HTA=";
   };
 
   postPatch = ''
@@ -60,6 +61,9 @@ buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
   ]
   ++ lib.optionals cudaSupport [
     cudaPackages.cuda_nvcc
+  ]
+  ++ lib.optionals rocmSupport [
+    torch.rocmPackages.clr
   ];
 
   buildInputs = [
@@ -110,7 +114,15 @@ buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
   ];
 
   disabledTests =
-    lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
+    lib.optionals rocmSupport [
+      # HSA runtime logs topology error in sandbox breaking test that asserts no output
+      "test_python_logger"
+    ]
+    ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
+      # Fails in the sandbox:
+      # Error in cpuinfo: failed to parse the list of possible processors in /sys/devices/system/cpu/possible
+      "test_python_logger"
+
       # AssertionError: index 0
       "test_get_frames_played_at"
 
diff --git a/pkgs/development/python-modules/torchdata/default.nix b/pkgs/development/python-modules/torchdata/default.nix
index 0466f6b68e00..07c376e92679 100644
--- a/pkgs/development/python-modules/torchdata/default.nix
+++ b/pkgs/development/python-modules/torchdata/default.nix
@@ -56,18 +56,22 @@ buildPythonPackage (finalAttrs: {
     pytestCheckHook
   ];
 
-  disabledTests =
-    lib.optionals (pythonAtLeast "3.14") [
-      # _pickle.PicklingError: Can't pickle local object <...worker_set_affinity at 0x7ffbcfa1ba00>
-      "test_set_affinity_in_worker_init"
+  disabledTests = [
+    # Failing since torch 2.12.0 update
+    # AssertionError: Scalars are not equal! Expected 0 but got 1.
+    "test_get_worker_info"
+  ]
+  ++ lib.optionals (pythonAtLeast "3.14") [
+    # _pickle.PicklingError: Can't pickle local object <...worker_set_affinity at 0x7ffbcfa1ba00>
+    "test_set_affinity_in_worker_init"
 
-      # RuntimeError: DataLoader timed out after 5 seconds
-      "test_ind_worker_queue"
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      # RuntimeError: DataLoader timed out after 5 seconds
-      "test_ind_worker_queue"
-    ];
+    # RuntimeError: DataLoader timed out after 5 seconds
+    "test_ind_worker_queue"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    # RuntimeError: DataLoader timed out after 5 seconds
+    "test_ind_worker_queue"
+  ];
 
   meta = {
     description = "Iterative enhancement to the PyTorch torch.utils.data.DataLoader and torch.utils.data.Dataset/IterableDataset";
diff --git a/pkgs/development/python-modules/torchvision/default.nix b/pkgs/development/python-modules/torchvision/default.nix
index 945875ce3220..819647878540 100644
--- a/pkgs/development/python-modules/torchvision/default.nix
+++ b/pkgs/development/python-modules/torchvision/default.nix
@@ -28,14 +28,15 @@ let
 in
 buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
   pname = "torchvision";
-  version = "0.26.0";
+  version = "0.27.0";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "pytorch";
     repo = "vision";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-FOdDGY3v8yWBhtNo9tZP79/xwrc7AoIY5Y1ZABzWe6g=";
+    hash = "sha256-HOTD45xY7Gye1GI1+AsF3KmMUTAp1QlzHOUeBHvzv0A=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/triton/0003-nvidia-cudart-a-systempath.patch b/pkgs/development/python-modules/triton/0003-nvidia-cudart-a-systempath.patch
index da5ff0c9de7c..7f479cf967c6 100644
--- a/pkgs/development/python-modules/triton/0003-nvidia-cudart-a-systempath.patch
+++ b/pkgs/development/python-modules/triton/0003-nvidia-cudart-a-systempath.patch
@@ -1,18 +1,18 @@
 diff --git a/third_party/nvidia/backend/driver.c b/third_party/nvidia/backend/driver.c
-index bff09d8c1..a5c341711 100644
+index f51d7b37c1..8971588282 100644
 --- a/third_party/nvidia/backend/driver.c
 +++ b/third_party/nvidia/backend/driver.c
 @@ -1,4 +1,4 @@
 -#include "cuda.h"
 +#include <cuda.h>
  #include <dlfcn.h>
+ #include <stdalign.h>
  #include <stdbool.h>
- #include <stdlib.h>
 diff --git a/third_party/nvidia/backend/driver.py b/third_party/nvidia/backend/driver.py
-index 2b39fea29..3346eb954 100644
+index 21e9045b25..3660e32546 100644
 --- a/third_party/nvidia/backend/driver.py
 +++ b/third_party/nvidia/backend/driver.py
-@@ -12,7 +12,8 @@ from triton.backends.compiler import GPUTarget
+@@ -11,7 +11,8 @@ from triton.backends.compiler import GPUTarget
  from triton.backends.driver import GPUDriver
  
  dirname = os.path.dirname(os.path.realpath(__file__))
@@ -20,14 +20,5 @@ index 2b39fea29..3346eb954 100644
 +import shlex
 +include_dirs = [*shlex.split("@cudaToolkitIncludeDirs@"), os.path.join(dirname, "include")]
  libdevice_dir = os.path.join(dirname, "lib")
- libraries = ['cuda']
+ libraries = ['libcuda.so.1']
  PyCUtensorMap = None
-@@ -265,7 +266,7 @@ def make_launcher(constants, signature, tensordesc_meta):
-     params.append("&global_scratch")
-     params.append("&profile_scratch")
-     src = f"""
--#include \"cuda.h\"
-+#include <cuda.h>
- #include <dlfcn.h>
- #include <stdbool.h>
- #include <stdlib.h>
diff --git a/pkgs/development/python-modules/triton/0005-add-gcn5-gfx906-target.patch b/pkgs/development/python-modules/triton/0005-add-gcn5-gfx906-target.patch
deleted file mode 100644
index 6fcc6a22bc42..000000000000
--- a/pkgs/development/python-modules/triton/0005-add-gcn5-gfx906-target.patch
+++ /dev/null
@@ -1,131 +0,0 @@
-diff --git a/test/Conversion/amd/tritongpu_to_llvm.mlir b/test/Conversion/amd/tritongpu_to_llvm.mlir
-index 068e931a6..e651f7b0a 100644
---- a/test/Conversion/amd/tritongpu_to_llvm.mlir
-+++ b/test/Conversion/amd/tritongpu_to_llvm.mlir
-@@ -1,5 +1,6 @@
- // RUN: triton-opt %s -split-input-file --allocate-shared-memory --convert-triton-amdgpu-to-llvm=arch=gfx942 --convert-builtin-func-to-llvm | FileCheck %s
- // RUN: triton-opt %s -split-input-file --allocate-shared-memory --convert-triton-amdgpu-to-llvm=arch=gfx950 | FileCheck %s --check-prefix=GFX950
-+// RUN: triton-opt %s -split-input-file --allocate-shared-memory --convert-triton-amdgpu-to-llvm=arch=gfx906 | FileCheck %s --check-prefix=GFX906
- 
- module attributes {"ttg.num-ctas" = 1 : i32, "ttg.num-warps" = 4 : i32} {
-   // CHECK-LABEL: atomic_add_f32_scalar
-@@ -633,3 +634,27 @@ module attributes {"ttg.num-ctas" = 1 : i32, "ttg.num-warps" = 4 : i32, "ttg.thr
-     tt.return
-   }
- }
-+
-+// -----
-+
-+// GFX906-LABEL: v_dot_fp16_gfx906
-+#blocked = #ttg.blocked<{sizePerThread = [1, 1], threadsPerWarp = [8, 8], warpsPerCTA = [2, 2], order = [1, 0]}>
-+module attributes {"ttg.target" = "hip:gfx906", "ttg.num-ctas" = 1 : i32, "ttg.num-warps" = 4 : i32, "ttg.threads-per-warp" = 64 : i32} {
-+  tt.func @v_dot_fp16_gfx906(%arg0: tensor<16x16xf16, #ttg.dot_op<{opIdx = 0, parent = #blocked}>>, %arg1: tensor<16x16xf16, #ttg.dot_op<{opIdx = 1, parent = #blocked}>>, %arg2: tensor<16x16xf32, #blocked>) {
-+    // GFX906-COUNT-8: llvm.call_intrinsic "llvm.amdgcn.fdot2"
-+    %0 = tt.dot %arg0, %arg1, %arg2, inputPrecision = ieee : tensor<16x16xf16, #ttg.dot_op<{opIdx = 0, parent = #blocked}>> * tensor<16x16xf16, #ttg.dot_op<{opIdx = 1, parent = #blocked}>> -> tensor<16x16xf32, #blocked>
-+    tt.return
-+  }
-+}
-+
-+// -----
-+
-+// GFX906-LABEL: v_dot_i8_gfx906
-+#blocked = #ttg.blocked<{sizePerThread = [1, 1], threadsPerWarp = [8, 8], warpsPerCTA = [2, 2], order = [1, 0]}>
-+module attributes {"ttg.target" = "hip:gfx906", "ttg.num-ctas" = 1 : i32, "ttg.num-warps" = 4 : i32, "ttg.threads-per-warp" = 64 : i32} {
-+  tt.func @v_dot_i8_gfx906(%arg0: tensor<16x16xi8, #ttg.dot_op<{opIdx = 0, parent = #blocked}>>, %arg1: tensor<16x16xi8, #ttg.dot_op<{opIdx = 1, parent = #blocked}>>, %arg2: tensor<16x16xi32, #blocked>) {
-+    // GFX906-COUNT-4: llvm.call_intrinsic "llvm.amdgcn.sdot4"
-+    %0 = tt.dot %arg0, %arg1, %arg2, inputPrecision = ieee : tensor<16x16xi8, #ttg.dot_op<{opIdx = 0, parent = #blocked}>> * tensor<16x16xi8, #ttg.dot_op<{opIdx = 1, parent = #blocked}>> -> tensor<16x16xi32, #blocked>
-+    tt.return
-+  }
-+}
-diff --git a/third_party/amd/include/TritonAMDGPUToLLVM/TargetUtils.h b/third_party/amd/include/TritonAMDGPUToLLVM/TargetUtils.h
-index a689fe438..5d84110dc 100644
---- a/third_party/amd/include/TritonAMDGPUToLLVM/TargetUtils.h
-+++ b/third_party/amd/include/TritonAMDGPUToLLVM/TargetUtils.h
-@@ -8,6 +8,7 @@ namespace mlir::triton::AMD {
- // A list of ISA families we care about.
- enum class ISAFamily {
-   Unknown,
-+  GCN5_1,
-   CDNA1,
-   CDNA2,
-   CDNA3,
-diff --git a/third_party/amd/lib/TritonAMDGPUToLLVM/TargetInfo.cpp b/third_party/amd/lib/TritonAMDGPUToLLVM/TargetInfo.cpp
-index af7b4b1f7..01cacc9de 100644
---- a/third_party/amd/lib/TritonAMDGPUToLLVM/TargetInfo.cpp
-+++ b/third_party/amd/lib/TritonAMDGPUToLLVM/TargetInfo.cpp
-@@ -71,6 +71,7 @@ llvm::AMDGPU::GPUKind TargetInfo::getGPUKind() const {
- 
- int TargetInfo::getWarpSize() const {
-   switch (getISAFamily()) {
-+  case ISAFamily::GCN5_1:
-   case ISAFamily::CDNA1:
-   case ISAFamily::CDNA2:
-   case ISAFamily::CDNA3:
-@@ -335,10 +336,10 @@ bool TargetInfo::warpReduce(RewriterBase &rewriter, Location loc,
-     return true;
-   if (numLaneToReduce != getWarpSize())
-     return false;
--  if (isCDNA(getISAFamily()) && getISAFamily() == ISAFamily::CDNA1)
--    return false;
--  if (isRDNA(getISAFamily()) &&
--      llvm::is_contained({ISAFamily::RDNA1, ISAFamily::RDNA2}, getISAFamily()))
-+  // DPP warp reduce requires gfx90a+ (CDNA2+) or gfx11+ (RDNA3+).
-+  // Pre-CDNA2 GFX9 (gfx906/gfx908) and GFX10 (RDNA1/2) are excluded.
-+  auto v = getIsaVersion();
-+  if (!((v.Major == 9 && (v.Minor > 0 || v.Stepping >= 0xa)) || v.Major >= 11))
-     return false;
- 
-   Operation *reduxOp = op.getSingleCombiner();
-@@ -438,7 +439,7 @@ bool TargetInfo::warpReduce(RewriterBase &rewriter, Location loc,
-     buf = createDppReduxOpWithBoundCtrl(valType, buf, 1 + dppCtrlRowShr,
-                                         allRows, allBanks);
- 
--    if (isCDNA(getISAFamily())) {
-+    if (isCDNA(getISAFamily()) || getISAFamily() == ISAFamily::GCN5_1) {
-       // row_bcast:15 row_mask:0xa
-       buf = createDppReduxOpWithBoundCtrl(
-           valType, buf, static_cast<uint32_t>(DppCtrl::BCAST15), 0xa, allBanks);
-diff --git a/third_party/amd/lib/TritonAMDGPUToLLVM/TargetInfo.cpp.rej b/third_party/amd/lib/TritonAMDGPUToLLVM/TargetInfo.cpp.rej
-new file mode 100644
-index 000000000..b75ab8f11
---- /dev/null
-+++ b/third_party/amd/lib/TritonAMDGPUToLLVM/TargetInfo.cpp.rej
-@@ -0,0 +1,16 @@
-+diff a/third_party/amd/lib/TritonAMDGPUToLLVM/TargetInfo.cpp b/third_party/amd/lib/TritonAMDGPUToLLVM/TargetInfo.cpp	(rejected hunks)
-+@@ -395,10 +396,10 @@ bool TargetInfo::warpReduce(RewriterBase &rewriter, Location loc,
-+     return true;
-+   if (reduceLaneIdMask != (getWarpSize() - 1))
-+     return false;
-+-  if (isCDNA(getISAFamily()) && getISAFamily() == ISAFamily::CDNA1)
-+-    return false;
-+-  if (isRDNA(getISAFamily()) &&
-+-      llvm::is_contained({ISAFamily::RDNA1, ISAFamily::RDNA2}, getISAFamily()))
-++  // DPP warp reduce requires gfx90a+ (CDNA2+) or gfx11+ (RDNA3+).
-++  // Pre-CDNA2 GFX9 (gfx906/gfx908) and GFX10 (RDNA1/2) are excluded.
-++  auto v = getIsaVersion();
-++  if (!((v.Major == 9 && (v.Minor > 0 || v.Stepping >= 0xa)) || v.Major >= 11))
-+     return false;
-+
-+   Operation *reduxOp = op.getSingleCombiner();
-diff --git a/third_party/amd/lib/TritonAMDGPUToLLVM/TargetUtils.cpp b/third_party/amd/lib/TritonAMDGPUToLLVM/TargetUtils.cpp
-index b79841ab5..afb80d9fb 100644
---- a/third_party/amd/lib/TritonAMDGPUToLLVM/TargetUtils.cpp
-+++ b/third_party/amd/lib/TritonAMDGPUToLLVM/TargetUtils.cpp
-@@ -12,6 +12,9 @@ ISAFamily deduceISAFamily(llvm::StringRef arch) {
-   if (kind == llvm::AMDGPU::GK_GFX1250)
-     return ISAFamily::GFX1250;
- 
-+  if (kind == llvm::AMDGPU::GK_GFX906)
-+    return ISAFamily::GCN5_1;
-+
-   // CDNA ISA cases
-   switch (kind) {
-   case llvm::AMDGPU::GK_GFX950:
-@@ -41,6 +44,7 @@ ISAFamily deduceISAFamily(llvm::StringRef arch) {
- 
- bool supportsVDot(llvm::StringRef arch) {
-   switch (deduceISAFamily(arch)) {
-+  case AMD::ISAFamily::GCN5_1:
-   case AMD::ISAFamily::CDNA1:
-   case AMD::ISAFamily::CDNA2:
-   case AMD::ISAFamily::CDNA3:
diff --git a/pkgs/development/python-modules/triton/default.nix b/pkgs/development/python-modules/triton/default.nix
index cd81a8c6de0f..72e8df58f076 100644
--- a/pkgs/development/python-modules/triton/default.nix
+++ b/pkgs/development/python-modules/triton/default.nix
@@ -42,17 +42,21 @@
   cudaSupport ? config.cudaSupport,
 }:
 
-buildPythonPackage (finalAttrs: {
+let
+  effectiveStdenv = if cudaSupport then cudaPackages.backendStdenv else stdenv;
+in
+buildPythonPackage.override { stdenv = effectiveStdenv; } (finalAttrs: {
   pname = "triton";
-  version = "3.6.0";
+  version = "3.7.0";
   pyproject = true;
+  __structuredAttrs = true;
 
   # Remember to bump triton-llvm as well!
   src = fetchFromGitHub {
     owner = "triton-lang";
     repo = "triton";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JFSpQn+WsNnh7CAPlcpOcUp0nyKXNbJEANdXqmkt4Tc=";
+    hash = "sha256-FxbBY1lPq7765MqAPR7UljzPsmjOhKKbYExlKgeudew=";
   };
 
   patches = [
@@ -63,8 +67,9 @@ buildPythonPackage (finalAttrs: {
       libcudaStubsDir =
         if cudaSupport then "${lib.getOutput "stubs" cudaPackages.cuda_cudart}/lib/stubs" else null;
     })
-    # Backport of https://github.com/triton-lang/triton/pull/9628 (does not apply cleanly)
-    ./0005-add-gcn5-gfx906-target.patch
+
+    # Use our `cmakeFlags` instead and avoid downloading dependencies.
+    ./inject-nix-cmakeFlags.patch
   ]
   ++ lib.optionals cudaSupport [
     (replaceVars ./0003-nvidia-cudart-a-systempath.patch {
@@ -90,13 +95,6 @@ buildPythonPackage (finalAttrs: {
         --replace-fail 'yield ("triton.profiler", "third_party/proton/proton")' 'pass' \
         --replace-fail "curr_version.group(1) != version" "False"
     ''
-    # Use our `cmakeFlags` instead and avoid downloading dependencies
-    + ''
-      substituteInPlace setup.py \
-        --replace-fail \
-          "cmake_args.extend(thirdparty_cmake_args)" \
-          "cmake_args.extend(thirdparty_cmake_args + os.environ.get('cmakeFlags', \"\").split())"
-    ''
     # Don't fetch googletest
     + ''
       substituteInPlace cmake/AddTritonUnitTest.cmake \
@@ -104,6 +102,15 @@ buildPythonPackage (finalAttrs: {
         --replace-fail "include(GoogleTest)" "find_package(GTest REQUIRED)"
     ''
 
+    # Hardcode the CC path so Triton's runtime JIT compilation doesn't break
+    # in environments without a compiler in PATH.
+    + ''
+      substituteInPlace python/triton/runtime/build.py \
+        --replace-fail \
+          'cc = os.environ.get("CC")' \
+          'cc = os.environ.get("CC", "${lib.getExe' effectiveStdenv.cc "cc"}")'
+    ''
+
     # triton will try dlopening libcublas.so at runtime
     + lib.optionalString cudaSupport ''
       substituteInPlace third_party/nvidia/include/cublas_instance.h \
@@ -135,7 +142,7 @@ buildPythonPackage (finalAttrs: {
     # `find_package` is called with `NO_DEFAULT_PATH`
     # https://cmake.org/cmake/help/latest/command/find_package.html
     # https://github.com/triton-lang/triton/blob/c3c476f357f1e9768ea4e45aa5c17528449ab9ef/third_party/amd/CMakeLists.txt#L6
-    (lib.cmakeFeature "LLD_DIR" "${lib.getLib llvm}")
+    (lib.cmakeFeature "LLD_DIR" "${lib.getLib llvm}/lib/cmake/lld")
   ];
 
   buildInputs = [
@@ -159,14 +166,19 @@ buildPythonPackage (finalAttrs: {
       export MAX_JOBS="$NIX_BUILD_CORES"
     '';
 
+  # `examples/plugins` (an MLIR example dialect plugin and a unit-test helper lib) is built
+  # unconditionally with the Python module and shipped into `triton/plugins/`.
+  # It is unused at runtime and keeps a forbidden RPATH reference to the build directory, which
+  # fails the fixup phase.
+  postInstall = ''
+    rm -rf "$out/${python.sitePackages}/triton/plugins"
+  '';
+
   env = {
     TRITON_BUILD_PROTON = "OFF";
     TRITON_OFFLINE_BUILD = true;
   }
   // lib.optionalAttrs cudaSupport {
-    CC = lib.getExe' cudaPackages.backendStdenv.cc "cc";
-    CXX = lib.getExe' cudaPackages.backendStdenv.cc "c++";
-
     NIX_CFLAGS_COMPILE = toString [
       # Pybind11 started generating strange errors since python 3.12. Observed only in the CUDA branch.
       # https://gist.github.com/SomeoneSerge/7d390b2b1313957c378e99ed57168219#file-gistfile0-txt-L1042
@@ -206,7 +218,7 @@ buildPythonPackage (finalAttrs: {
   ];
 
   passthru = {
-    gpuCheck = stdenv.mkDerivation {
+    gpuCheck = effectiveStdenv.mkDerivation {
       pname = "triton-pytest";
       inherit (triton) version src;
 
@@ -370,7 +382,7 @@ buildPythonPackage (finalAttrs: {
               if os.environ.get("HOME", None) == "/homeless-shelter":
                 os.environ["HOME"] = os.environ.get("TMPDIR", "/tmp")
               if "CC" not in os.environ:
-                os.environ["CC"] = "${lib.getExe' cudaPackages.backendStdenv.cc "cc"}"
+                os.environ["CC"] = "${lib.getExe' effectiveStdenv.cc "cc"}"
               torch.manual_seed(0)
               size = 12345
               x = torch.rand(size, device='cuda')
diff --git a/pkgs/development/python-modules/triton/inject-nix-cmakeFlags.patch b/pkgs/development/python-modules/triton/inject-nix-cmakeFlags.patch
new file mode 100644
index 000000000000..7d0757107b6d
--- /dev/null
+++ b/pkgs/development/python-modules/triton/inject-nix-cmakeFlags.patch
@@ -0,0 +1,16 @@
+diff --git a/setup.py b/setup.py
+index d8e0860291..bc09dada5a 100644
+--- a/setup.py
++++ b/setup.py
+@@ -476,6 +476,11 @@ class CMakeBuild(build_ext):
+             cmake_args.append("-DLLVM_EXTERNAL_LIT=" + lit_dir)
+         cmake_args.extend(thirdparty_cmake_args)
+ 
++        import json
++
++        nix_attrs_json = json.load(open(os.environ["NIX_ATTRS_JSON_FILE"]))
++        cmake_args.extend(thirdparty_cmake_args + nix_attrs_json.get("cmakeFlags", []))
++
+         # configuration
+         cfg = get_build_type()
+         build_args = ["--config", cfg]
diff --git a/pkgs/development/rocm-modules/rocprofiler-sdk/0009-rocprofiler-sdk-guard-ompt-auto-start.patch b/pkgs/development/rocm-modules/rocprofiler-sdk/0009-rocprofiler-sdk-guard-ompt-auto-start.patch
new file mode 100644
index 000000000000..147d79483318
--- /dev/null
+++ b/pkgs/development/rocm-modules/rocprofiler-sdk/0009-rocprofiler-sdk-guard-ompt-auto-start.patch
@@ -0,0 +1,50 @@
+From 502d2df0ddd84f0f2fa718b9a02ee0f01f36dac1 Mon Sep 17 00:00:00 2001
+From: Luna Nova <git@lunnova.dev>
+Date: Tue, 2 Jun 2026 01:31:05 -0700
+Subject: [PATCH] [rocprofiler-sdk] don't auto-start OMPT tool before glog is
+ initialized
+
+The OpenMP runtime resolves its weak ompt_start_tool to the strong symbol we
+export and calls it during OpenMP init. That can fire from an unrelated
+library's constructor (observed: OpenBLAS calling omp_get_num_places) while
+librocprofiler-sdk is still being dlopen'd. init_logging() then dereferences
+glog's gflags FLAGS_vmodule, whose backing pointer is still null until glog's
+static initializers run, and the process segfaults on `import torch`.
+
+The init order is not reliably fixable from here: a dependency cycle among the
+ROCm libraries makes the loader run our constructors before libglog's, so a
+flag set by our own constructor does not imply glog is ready. Instead gate the
+tool start on glog itself, by testing whether gflags has populated FLAGS_vmodule
+yet; reading the raw pointer is safe even before construction. It is read via an
+asm label because the gflags header only exposes it as a reference, which the
+compiler assumes is never null. Declining (nullptr) when glog is not yet ready
+is a valid OMPT "no tool" response; deliberate profiling (rocprofv3 preloads the
+tool early, before such constructors) is unaffected.
+---
+ source/lib/rocprofiler-sdk/ompt.cpp | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/source/lib/rocprofiler-sdk/ompt.cpp b/source/lib/rocprofiler-sdk/ompt.cpp
+index a9ccc57..3231087 100644
+--- a/source/lib/rocprofiler-sdk/ompt.cpp
++++ b/source/lib/rocprofiler-sdk/ompt.cpp
+@@ -199,6 +199,8 @@ finalize_ompt()
+ }  // namespace ompt
+ }  // namespace rocprofiler
+
++extern void* const rocprofiler_glog_vmodule_flag asm("_ZN3fLS13FLAGS_vmoduleB5cxx11E");
++
+ extern "C" {
+
+ rocprofiler_status_t
+@@ -245,6 +247,8 @@ ompt_start_tool(unsigned int omp_version, const char* runtime_version) ROCPROFIL
+ ompt_start_tool_result_t*
+ ompt_start_tool(unsigned int omp_version, const char* runtime_version)
+ {
++    if(rocprofiler_glog_vmodule_flag == nullptr) return nullptr;
++
+     ::rocprofiler::registration::init_logging();
+     ::rocprofiler::registration::initialize();
+     return rocprofiler_ompt_start_tool(omp_version, runtime_version);
+--
+2.54.0
diff --git a/pkgs/development/rocm-modules/rocprofiler-sdk/default.nix b/pkgs/development/rocm-modules/rocprofiler-sdk/default.nix
index eef20eb51927..5806bc23c40f 100644
--- a/pkgs/development/rocm-modules/rocprofiler-sdk/default.nix
+++ b/pkgs/development/rocm-modules/rocprofiler-sdk/default.nix
@@ -135,6 +135,13 @@ stdenv.mkDerivation (finalAttrs: {
     ./0006-rocprofiler-sdk-allow-using-system-otf2-dependency.patch
     ./0007-rocprofiler-sdk-Allow-using-system-json-dependency.patch
     ./0008-rocprofiler-sdk-stop-manually-setting-warning-flags-.patch
+    # Prevent a segfault on `import torch` (and other consumers that link
+    # librocprofiler-sdk for tracing) when OpenMP auto-discovers our
+    # ompt_start_tool before glog is initialized. Upstream incidentally fixes
+    # this by dropping glog in rocm-systems d80117889b3f
+    # "[rocprofiler-sdk] Migrate from glog to Abseil Logging (#4668)", which
+    # is too invasive (40 files + new abseil submodule) to backport.
+    ./0009-rocprofiler-sdk-guard-ompt-auto-start.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index de3605e7cee4..0f6ae68c16d7 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -71,12 +71,12 @@ rec {
   bleeding_edge = selectHighestVersion latest beta;
 
   production = generic {
-    version = "595.71.05";
-    sha256_64bit = "sha256-NiA7iWC35JyKQva6H1hjzeNKBek9KyS3mK8G3YRva4I=";
-    sha256_aarch64 = "sha256-XzKloS00dFKTd4ATWkTIhm9eG/OzR/Sim6MboNZWPu8=";
-    openSha256 = "sha256-Lfz71QWKM6x/jD2B22SWpUi7/og30HRlXg1kL3EWzEw=";
-    settingsSha256 = "sha256-mXnf3jyvznfB3OfKd657rxv0rYHQb/dX/Riw/+N9EKU=";
-    persistencedSha256 = "sha256-Z/6IvEEa/XfZ5F5qoSIPvXJLGtscYVqjFxHZaN/M2Ts=";
+    version = "595.80";
+    sha256_64bit = "sha256-PVTIP+B/01c/8M66hXTAYTLg9T2Hy9u1gq43K7TF1Hg=";
+    sha256_aarch64 = "sha256-62uqbRsF+dizUqvXhBfmVFeV2gg4BH6f7kOta+uMMuk=";
+    openSha256 = "sha256-nonwYYPItHeMC/5Ox/TlWhjiddMPu4PLqNhgIg+bfW8=";
+    settingsSha256 = "sha256-AtzYTz7kbmj3vxmBQTC0eAjM3b2I259y1tdxq90n9YU=";
+    persistencedSha256 = "sha256-WL57kKFWeRW0oPktp6afkUb5Om9MCGAvKWctk5yiyIA=";
   };
 
   new_feature = generic {
diff --git a/pkgs/servers/home-assistant/custom-components/blitzortung/package.nix b/pkgs/servers/home-assistant/custom-components/blitzortung/package.nix
new file mode 100644
index 000000000000..3982a1142782
--- /dev/null
+++ b/pkgs/servers/home-assistant/custom-components/blitzortung/package.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  buildHomeAssistantComponent,
+  fetchFromGitHub,
+  paho-mqtt,
+  pytest-homeassistant-custom-component,
+  pytestCheckHook,
+}:
+
+buildHomeAssistantComponent (finalAttrs: {
+  owner = "mrk-its";
+  domain = "blitzortung";
+  version = "1.5.0";
+
+  src = fetchFromGitHub {
+    owner = "mrk-its";
+    repo = "homeassistant-blitzortung";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-hed7XBBV7LID12Md0FWA0KkAjEH0RB7MQ1XJOm0W3sw=";
+  };
+
+  dependencies = [
+    paho-mqtt
+  ];
+
+  nativeCheckInputs = [
+    pytest-homeassistant-custom-component
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # 2026.5.0 compat issue
+    "test_connect_with_server_stats"
+  ];
+
+  meta = {
+    description = "Custom Component for fetching lightning data from blitzortung.org";
+    homepage = "https://github.com/mrk-its/homeassistant-blitzortung";
+    changelog = "https://github.com/mrk-its/homeassistant-blitzortung/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ hexa ];
+  };
+})
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/tankerkoenig-card/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/tankerkoenig-card/package.nix
index eedc146d672c..f76b7515f4b4 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/tankerkoenig-card/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/tankerkoenig-card/package.nix
@@ -6,16 +6,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "tankerkoenig-card";
-  version = "1.7.2";
+  version = "1.7.3";
 
   src = fetchFromGitHub {
     owner = "timmaurice";
     repo = "lovelace-tankerkoenig-card";
     tag = finalAttrs.version;
-    hash = "sha256-XBgroe7DT8fAaRkwcI5VU69jt1NnPiTcbjQovmrc200=";
+    hash = "sha256-IKeMOgpjFbl4yV8soZPgLwkkfBXW9Y9igLmhwQmhUm8=";
   };
 
-  npmDepsHash = "sha256-Bcu0K4SSDUyYFgYqk1HdjJA6jJSAO7Z53sUOEihv2T4=";
+  npmDepsHash = "sha256-l/FxUoqim/wkbhURTBnD/8IK8gcLNS5JAQqbnxgoAfs=";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/weather-radar-card/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/weather-radar-card/package.nix
new file mode 100644
index 000000000000..8e1bfacc40e1
--- /dev/null
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/weather-radar-card/package.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "weather-radar-card";
+  version = "3.6.5";
+
+  src = fetchFromGitHub {
+    owner = "jpettitt";
+    repo = "weather-radar-card";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-D+aWTcUOVkt99mdl3q1VahJKXDBIbh6RX3psYsjnTLo=";
+  };
+
+  npmDepsFetcherVersion = 2;
+  npmFlags = [ "--legacy-peer-deps" ];
+  npmDepsHash = "sha256-S3PZOcKBseohCKOUSRFCQj6fAJTrZLRD5916iB35rrc=";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir $out
+    shopt -s extglob
+    cp -r dist/!(*.gz) $out/
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  __structuredAttrs = true;
+
+  meta = {
+    description = "Rrain radar card using the tiled images from RainViewer";
+    homepage = "https://github.com/jpettitt/weather-radar-card";
+    changelog = "https://github.com/jpettitt/weather-radar-card/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ hexa ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index fdae54306e9f..cc7501f1f5bb 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -454,6 +454,7 @@ mapAliases {
   charis-sil = throw "'charis-sil' has renamed to/replaced by 'charis'"; # Added 2025-12-01
   charmcraft = throw "charmcraft was removed in Sep 25 following removal of LXD from nixpkgs"; # Added 2025-09-18
   charybdis = throw "charybdis was removed since its upstream repo was archived in 2021"; # Added 2026-01-13
+  chatbox = throw "chatbox was removed for bundling a vastly end-of-life electron version"; # Added 2026-05-30
   chatgpt-retrieval-plugin = throw "chatgpt-retrieval-plugin has been removed because it has been marked as broken since at least November 2024."; # Added 2025-09-28
   chatmcp = throw "chatmcp has been removed, as it is unmaintained"; # Added 2026-04-09
   check-esxi-hardware = throw "'check-esxi-hardware' has been renamed to/replaced by 'nagiosPlugins.check_esxi_hardware'"; # Converted to throw 2025-10-27
@@ -2146,6 +2147,7 @@ mapAliases {
   tkimg = throw "'tkimg' has been renamed to/replaced by 'tclPackages.tkimg'"; # Converted to throw 2025-10-27
   tla = throw "'tla' has been removed as it is broken and unmaintained. Please use 'breezy' instead"; # Added 2026-04-23
   tlaplusToolbox = tlaplus-toolbox; # Added 2025-08-21
+  tm = throw "'tm' has been removed as it is broken and hasn't been maintained upstream since 2014"; # Added 2026-05-05
   tokyo-night-gtk = throw "'tokyo-night-gtk' has been renamed to/replaced by 'tokyonight-gtk-theme'"; # Converted to throw 2025-10-27
   tomcat_connectors = throw "'tomcat_connectors' has been renamed to/replaced by 'apacheHttpdPackages.mod_jk'"; # Converted to throw 2025-10-27
   tooling-language-server = deputy; # Added 2025-06-22
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 90876760dc05..19820e6e1839 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9953,6 +9953,7 @@ with pkgs;
   transmission_4-qt5 = transmission_4.override { enableQt5 = true; };
   transmission_4-qt6 = transmission_4.override { enableQt6 = true; };
   transmission_4-qt = transmission_4-qt5;
+  transmission_4-mac = transmission_4.override { enableMac = true; };
 
   tinywl = callPackage ../applications/window-managers/tinywl {
     wlroots = wlroots_0_20;
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index f038db61d384..00e471065732 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -257,6 +257,7 @@ mapAliases {
   HAP-python = throw "'HAP-python' has been renamed to/replaced by 'hap-python'"; # Converted to throw 2025-10-29
   hcs_utils = throw "'hcs_utils' has been renamed to/replaced by 'hcs-utils'"; # Converted to throw 2025-10-29
   heif-image-plugin = throw "heif-image-plugin has been removed due to lack of upstream maintenance and breakage. Use `pillow-heif` instead."; # added 2025-09-17
+  hg-commitsigs = throw "'hg-commitsigs' was removed because it was broken"; # Added 2026-04-25
   hglib = throw "'hglib' has been renamed to/replaced by 'python-hglib'"; # Converted to throw 2025-10-29
   hijri-converter = hijridate; # added 2025-08-07
   holistic-trace-analysis = throw "'holistic-trace-analysis' was removed because there is no such package on PyPI"; # added 2026-02-28
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index d3a64386d671..5fb16462b784 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5716,6 +5716,8 @@ self: super: with self; {
 
   flash-attn = callPackage ../development/python-modules/flash-attn { };
 
+  flash-attn-3 = callPackage ../development/python-modules/flash-attn-3 { };
+
   flash-attn-4 = callPackage ../development/python-modules/flash-attn-4 { };
 
   flash-linear-attention = callPackage ../development/python-modules/flash-linear-attention { };
@@ -7138,8 +7140,6 @@ self: super: with self; {
 
   hfst = callPackage ../development/python-modules/hfst { };
 
-  hg-commitsigs = callPackage ../development/python-modules/hg-commitsigs { };
-
   hg-evolve = callPackage ../development/python-modules/hg-evolve { };
 
   hg-git = callPackage ../development/python-modules/hg-git { };