diff --git a/ci/OWNERS b/ci/OWNERS
index c65f8e26355a..1fcb0423e1e4 100644
--- a/ci/OWNERS
+++ b/ci/OWNERS
@@ -321,6 +321,11 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /nixos/tests/kea.nix @mweinelt
 /nixos/tests/knot.nix @mweinelt
 
+# Web servers
+/doc/packages/nginx.section.md @leona-ya @Ma27
+/pkgs/servers/http/nginx/ @helsinki-Jo @leona-ya @Ma27
+/nixos/modules/services/web-servers/nginx/ @leona-ya @Ma27
+
 # D
 /pkgs/build-support/dlang @jtbx @TomaSajt
 
diff --git a/doc/release-notes/rl-2605.section.md b/doc/release-notes/rl-2605.section.md
index a4a436186729..467ddedbef80 100644
--- a/doc/release-notes/rl-2605.section.md
+++ b/doc/release-notes/rl-2605.section.md
@@ -380,6 +380,8 @@
 
 - `collabora-desktop` The desktop version of Collabora Office is now available, package version `25.05.9.2-2`.
 
+- The `services.geoserver` NixOS module has been added to allow running [Geoserver](https://geoserver.org/) as a service.
+
 - `fetchPnpmDeps` and `pnpmConfigHook` were added as top-level attributes, replacing the now deprecated `pnpm.fetchDeps` and `pnpm.configHook` attributes.
 
 - `fetchPnpmDeps`' `fetcherVersion = 1` and `fetcherVersion = 2` are deprecated
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 3b5e3f4959cf..5b6ac0789ade 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -1907,6 +1907,12 @@
     githubId = 81317317;
     name = "Anna Aurora";
   };
+  anned20 = {
+    email = "annedouwe@bouma.tech";
+    github = "anned20";
+    githubId = 6921250;
+    name = "Anne Douwe Bouma";
+  };
   anninzy = {
     github = "anninzy";
     githubId = 143312793;
@@ -3945,6 +3951,12 @@
     githubId = 140968250;
     keys = [ { fingerprint = "8321 ED3A 8DB9 99A5 1F3B  F80F F268 2914 EA42 DE26"; } ];
   };
+  bpmct = {
+    name = "Ben Potter";
+    email = "ben@coder.com";
+    github = "bpmct";
+    githubId = 22407953;
+  };
   Br1ght0ne = {
     name = "Oleksii Filonenko";
     email = "nixpkgs@brightone.cloud";
@@ -6807,6 +6819,12 @@
     github = "developer-guy";
     githubId = 16693043;
   };
+  developmentcats = {
+    name = "Christofer";
+    email = "christofer@coder.com";
+    github = "DevelopmentCats";
+    githubId = 176868952;
+  };
   devhell = {
     email = ''"^"@regexmail.net'';
     github = "devhell";
@@ -6849,6 +6867,12 @@
     github = "dfithian";
     githubId = 8409320;
   };
+  dfjay = {
+    email = "github@dfjay.com";
+    name = "Pavel Yozhikov";
+    github = "dfjay";
+    githubId = 41841630;
+  };
   dflores = {
     email = "dflores.country455@passinbox.com";
     name = "David Flores";
@@ -7915,6 +7939,11 @@
     githubId = 183738665;
     name = "Marcell Tóth";
   };
+  ELHart05 = {
+    name = "Okba Allaoua";
+    github = "ELHart05";
+    githubId = 96151694;
+  };
   eliandoran = {
     email = "contact@eliandoran.me";
     name = "Elian Doran";
@@ -8710,6 +8739,12 @@
     name = "Fábio Batista";
     keys = [ { fingerprint = "D2D8 69D8 5EEC 30AD D327  B4A5 6CD5 5257 DB01 8B72"; } ];
   };
+  FabricSoul = {
+    name = "FabricSoul";
+    github = "FabricSoul";
+    githubId = 114606360;
+    email = "fabric.soul7@gmail.com";
+  };
   fallenbagel = {
     name = "fallenbagel";
     github = "fallenbagel";
@@ -12826,6 +12861,11 @@
     name = "Jonathan Hult";
     keys = [ { fingerprint = "DEE7 054C 5D43 ABEA C0F9  8BE4 3512 C8F8 2E2F 2A16"; } ];
   };
+  jiamingc = {
+    name = "Jiaming Chen";
+    github = "jiamingc";
+    githubId = 21327067;
+  };
   jiegec = {
     name = "Jiajie Chen";
     email = "c@jia.je";
@@ -14407,6 +14447,12 @@
     githubId = 691290;
     name = "Keshav Kini";
   };
+  kinnrai = {
+    email = "me@kinnrai.com";
+    github = "kinnrai";
+    githubId = 72676584;
+    name = "kinnrai";
+  };
   kintrix = {
     email = "kintrix007@proton.me";
     github = "kintrix007";
@@ -21744,6 +21790,12 @@
     githubId = 2997905;
     name = "Petr Hodina";
   };
+  phorcys420 = {
+    name = "Adele";
+    email = "adele@coder.com";
+    github = "phorcys420";
+    githubId = 57866459;
+  };
   photex = {
     email = "photex@gmail.com";
     github = "photex";
@@ -29936,6 +29988,12 @@
     name = "Edward";
     keys = [ { fingerprint = "0BC2F3C6AE5D73DAE870CB0E8AE4DE0EFB6CC443"; } ];
   };
+  WiredMic = {
+    name = "Rasmus Enevoldsen";
+    github = "WiredMic";
+    githubId = 111731519;
+    email = "rasmus@enev.dk";
+  };
   wirew0rm = {
     email = "alex@wirew0rm.de";
     github = "wirew0rm";
@@ -30996,6 +31054,11 @@
     githubId = 25164338;
     keys = [ { fingerprint = "065A 0A98 FE61 E1C1 41B0  AFE7 64FA BC62 F457 2875"; } ];
   };
+  zehuajun = {
+    github = "zehuajun";
+    githubId = 87254340;
+    name = "zehuajun";
+  };
   zelkourban = {
     name = "zelkourban";
     email = "zelo.urban@gmail.com";
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 5d23788ca4a0..a889f8cabc1f 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1668,6 +1668,7 @@
   ./services/web-apps/froide-govplan.nix
   ./services/web-apps/galene.nix
   ./services/web-apps/gancio.nix
+  ./services/web-apps/geoserver.nix
   ./services/web-apps/gerrit.nix
   ./services/web-apps/glance.nix
   ./services/web-apps/glitchtip.nix
diff --git a/nixos/modules/services/misc/ntfy-sh.nix b/nixos/modules/services/misc/ntfy-sh.nix
index 8e10576f54e4..69919c83e779 100644
--- a/nixos/modules/services/misc/ntfy-sh.nix
+++ b/nixos/modules/services/misc/ntfy-sh.nix
@@ -103,6 +103,7 @@ in
           ExecStart = "${cfg.package}/bin/ntfy serve -c ${configuration}";
           User = cfg.user;
           StateDirectory = "ntfy-sh";
+          RuntimeDirectory = "ntfy-sh";
 
           DynamicUser = true;
           AmbientCapabilities = "CAP_NET_BIND_SERVICE";
diff --git a/nixos/modules/services/networking/epmd.nix b/nixos/modules/services/networking/epmd.nix
index 08e9400702da..0d92a4586fe4 100644
--- a/nixos/modules/services/networking/epmd.nix
+++ b/nixos/modules/services/networking/epmd.nix
@@ -21,7 +21,7 @@ in
         Erlang computations.
       '';
     };
-    package = lib.mkPackageOption pkgs "erlang" { };
+    package = lib.mkPackageOption pkgs [ "beamPackages" "erlang" ] { };
     listenStream = lib.mkOption {
       type = oneOf [
         str
diff --git a/nixos/modules/services/web-apps/geoserver.nix b/nixos/modules/services/web-apps/geoserver.nix
new file mode 100644
index 000000000000..578c6d69c9bc
--- /dev/null
+++ b/nixos/modules/services/web-apps/geoserver.nix
@@ -0,0 +1,81 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+with lib;
+
+let
+
+  cfg = config.services.geoserver;
+
+in
+{
+  options = {
+    services.geoserver = {
+      enable = mkEnableOption "Geoserver service";
+
+      package = lib.mkPackageOption pkgs "geoserver" { };
+
+      user = mkOption {
+        type = types.str;
+        default = "geoserver";
+        description = "The (system) user that will run the service.";
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = "geoserver";
+        description = "The user's group.";
+      };
+
+      jvmOpts = mkOption {
+        type = types.lines;
+        default = "";
+        description = "Any options passed to the JVM via the `JAVA_OPTS` environment variable. See [startup.sh](https://github.com/geoserver/geoserver/blob/main/src/release/bin/startup.sh) for details.";
+      };
+
+      jettyOpts = mkOption {
+        type = types.lines;
+        default = "";
+        example = "jetty.http.port=1234";
+        description = "Any options passed to the Jetty web server via the `JETTY_OPTS` environment variable. See [startup.sh](https://github.com/geoserver/geoserver/blob/main/src/release/bin/startup.sh) for details.";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    users.users."${cfg.user}" = {
+      group = cfg.group;
+      isSystemUser = true;
+    };
+    users.groups."${cfg.group}" = { };
+
+    systemd.services.geoserver = {
+      description = "Geoserver";
+
+      wantedBy = [ "multi-user.target" ];
+
+      environment = {
+        GEOSERVER_HOME = "${cfg.package}/share/geoserver";
+        GEOSERVER_DATA_DIR = "/var/lib/geoserver";
+        JAVA_OPTS = "${cfg.jvmOpts}";
+        JETTY_OPTS = "${cfg.jettyOpts}";
+      };
+
+      serviceConfig = {
+        ExecStart = "${cfg.package}/bin/geoserver-startup";
+        User = cfg.user;
+        Group = cfg.group;
+        NoNewPrivileges = true;
+        ProtectHome = true; # true=deny access to /home, /root, /run/user
+        StateDirectory = "geoserver";
+      };
+    };
+  };
+
+  meta.teams = [ lib.teams.geospatial ];
+}
diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index c213aaf652ea..e80013158b59 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -1757,4 +1757,8 @@ in
       postrotate = "[ ! -f /var/run/nginx/nginx.pid ] || kill -USR1 `cat /var/run/nginx/nginx.pid`";
     };
   };
+  meta.maintainers = [
+    lib.maintainers.leona
+    lib.maintainers.ma27
+  ];
 }
diff --git a/nixos/tests/geoserver.nix b/nixos/tests/geoserver.nix
index 9f1369ecb95e..06bc8ec5a54c 100644
--- a/nixos/tests/geoserver.nix
+++ b/nixos/tests/geoserver.nix
@@ -28,59 +28,86 @@ in
       {
         virtualisation.diskSize = 2 * 1024;
 
+        # The VM has several Geoserver package installations. They can't be run
+        # in parallel but are launched sequentially during the test run.
+        # Context managers (see below) are used to start/stop them selectively.
         environment.systemPackages = [
           geoserver
-          geoserverWithImporterExtension
           geoserverWithAllExtensions
         ];
+
+        services.geoserver = {
+          enable = true;
+          jettyOpts = "jetty.http.port=8090";
+          package = geoserverWithImporterExtension;
+        };
+        systemd.services.geoserver.wantedBy = lib.mkForce [ ]; # do not start the service at boot
       };
   };
 
   testScript = ''
     from contextlib import contextmanager
 
-    curl_cmd = "curl --fail --connect-timeout 2"
-    curl_cmd_rest = f"{curl_cmd} -u admin:geoserver -X GET"
-    base_url = "http://localhost:8080/geoserver"
+    CURL_CMD = "curl --fail --connect-timeout 2"
+    CURL_CMD_REST = f"{CURL_CMD} -u admin:geoserver -X GET"
+    BASE_URL_PKG = "http://localhost:8080/geoserver"
+    BASE_URL_SERVICE = "http://localhost:8090/geoserver"
     log_file = "./log.txt"
 
     @contextmanager
-    def running_geoserver(pkg):
+    def running_geoserver_pkg(pkg):
       try:
         print(f"Launching geoserver from {pkg}...")
         machine.execute(f"{pkg}/bin/geoserver-startup > {log_file} 2>&1 &")
-        machine.wait_until_succeeds(f"{curl_cmd} {base_url} 2>&1", timeout=60)
+        machine.wait_until_succeeds(f"{CURL_CMD} {BASE_URL_PKG} 2>&1", timeout=60)
         yield
       finally:
         # We need to wait a little bit to make sure the server is properly
         # shutdown before launching a new instance.
         machine.execute(f"{pkg}/bin/geoserver-shutdown; sleep 1")
 
+    @contextmanager
+    def running_geoserver_service():
+      service_name = "geoserver"
+      try:
+        print(f"Launching service {service_name}...")
+        machine.execute(f"systemctl start {service_name} > tee {log_file} 2>&1")
+        machine.wait_until_succeeds(f"{CURL_CMD} {BASE_URL_SERVICE} 2>&1", timeout=60)
+        yield
+      finally:
+        # We need to wait a little bit to make sure the server is properly
+        # shutdown before launching a new instance.
+        machine.execute(f"systemctl stop {service_name}; sleep 1")
+
     start_all()
 
-    with running_geoserver("${geoserver}"):
-      machine.succeed(f"{curl_cmd} {base_url}/ows?service=WMS&version=1.3.0&request=GetCapabilities")
+    with subtest("A standalone Geoserver installation without extensions can be started."):
+      with running_geoserver_pkg("${geoserver}"):
+        machine.succeed(f"{CURL_CMD} {BASE_URL_PKG}/ows?service=WMS&version=1.3.0&request=GetCapabilities")
 
-      # No extensions yet.
-      machine.fail(f"{curl_cmd_rest} {base_url}/rest/imports")
-      machine.fail(f"{curl_cmd_rest} {base_url}/rest/monitor/requests.csv")
+        # No extensions yet.
+        machine.fail(f"{CURL_CMD_REST} {BASE_URL_PKG}/rest/imports")
+        machine.fail(f"{CURL_CMD_REST} {BASE_URL_PKG}/rest/monitor/requests.csv")
 
+    with subtest("A standalone Geoserver installation with numerous extensions can be started."):
+      with running_geoserver_pkg("${geoserverWithAllExtensions}"):
+        machine.succeed(f"{CURL_CMD_REST} {BASE_URL_PKG}/rest/imports")
+        machine.succeed(f"{CURL_CMD_REST} {BASE_URL_PKG}/rest/monitor/requests.csv")
+        _, stdout = machine.execute(f"cat {log_file}")
+        print(stdout.replace("\\n", "\n"))
+        assert "GDAL Native Library loaded" in stdout, "gdal"
+        assert "org.geotools.imageio.netcdf.utilities.NetCDFUtilities" in stdout, "netcdf"
+        assert "Unable to load library 'netcdf'" not in stdout, "netcdf"
 
-    with running_geoserver("${geoserverWithImporterExtension}"):
-      machine.succeed(f"{curl_cmd_rest} {base_url}/rest/imports")
-      machine.fail(f"{curl_cmd_rest} {base_url}/rest/monitor/requests.csv")
+        # libjpeg-turbo is disabled as of 2.28.1.
+        # assert "The turbo jpeg encoder is available for usage" in stdout, "libjpeg-turbo"
 
-    with running_geoserver("${geoserverWithAllExtensions}"):
-      machine.succeed(f"{curl_cmd_rest} {base_url}/rest/imports")
-      machine.succeed(f"{curl_cmd_rest} {base_url}/rest/monitor/requests.csv")
-      _, stdout = machine.execute(f"cat {log_file}")
-      print(stdout.replace("\\n", "\n"))
-      assert "GDAL Native Library loaded" in stdout, "gdal"
-      assert "org.geotools.imageio.netcdf.utilities.NetCDFUtilities" in stdout, "netcdf"
-      assert "Unable to load library 'netcdf'" not in stdout, "netcdf"
+    with subtest("Geoserver can be run as a service. Some Extensions are available."):
+      with running_geoserver_service():
+        # Only the importer extension is available.
+        machine.succeed(f"{CURL_CMD_REST} {BASE_URL_SERVICE}/rest/imports")
+        machine.fail(f"{CURL_CMD_REST} {BASE_URL_SERVICE}/rest/monitor/requests.csv")
 
-      # libjpeg-turbo is disabled as of 2.28.1.
-      # assert "The turbo jpeg encoder is available for usage" in stdout, "libjpeg-turbo"
 
   '';
 }
diff --git a/pkgs/applications/editors/vscode/extensions/asciidoctor.asciidoctor-vscode/commands-abspath.patch b/pkgs/applications/editors/vscode/extensions/asciidoctor.asciidoctor-vscode/commands-abspath.patch
index fc3b7fd177eb..f8e24a309940 100644
--- a/pkgs/applications/editors/vscode/extensions/asciidoctor.asciidoctor-vscode/commands-abspath.patch
+++ b/pkgs/applications/editors/vscode/extensions/asciidoctor.asciidoctor-vscode/commands-abspath.patch
@@ -1,13 +1,11 @@
-diff --git a/package.json b/package.json
-index 7ab70e8..2ebe541 100644
 --- a/package.json
 +++ b/package.json
 @@ -437,7 +437,7 @@
- 					},
- 					"asciidoc.asciidoctorpdf_command": {
- 						"type": "string",
--						"default": "asciidoctor-pdf",
-+						"default": "@ASCIIDOCTOR_PDF_BIN@",
- 						"markdownDescription": "%asciidoc.asciidoctorpdf_command.desc%",
- 						"markdownDeprecationMessage": "%asciidoc.asciidoctorpdf_command.deprecationMessage%",
- 						"scope": "resource"
+           },
+           "asciidoc.asciidoctorpdf_command": {
+             "type": "string",
+-            "default": "asciidoctor-pdf",
++            "default": "@ASCIIDOCTOR_PDF_BIN@",
+             "markdownDescription": "%asciidoc.asciidoctorpdf_command.desc%",
+             "markdownDeprecationMessage": "%asciidoc.asciidoctorpdf_command.deprecationMessage%",
+             "scope": "resource"
diff --git a/pkgs/applications/editors/vscode/extensions/asciidoctor.asciidoctor-vscode/default.nix b/pkgs/applications/editors/vscode/extensions/asciidoctor.asciidoctor-vscode/default.nix
index 3f7dabf2e256..19205609d398 100644
--- a/pkgs/applications/editors/vscode/extensions/asciidoctor.asciidoctor-vscode/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/asciidoctor.asciidoctor-vscode/default.nix
@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "asciidoctor-vscode";
     publisher = "asciidoctor";
-    version = "3.4.2";
-    hash = "sha256-HG3y7999xeE1erQZCnBgUPj/aC0Kwyn20PEZR9gKrxY=";
+    version = "3.4.5";
+    hash = "sha256-X7njFSqfb45l6ZTr7GDS3At6DMHyvBT41JoghOeVjwI=";
   };
 
   patches = [
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index d0fa89d506e6..3d39aa388834 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -4811,6 +4811,22 @@ let
         };
       };
 
+      tomblind.local-lua-debugger-vscode = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "local-lua-debugger-vscode";
+          publisher = "tomblind";
+          version = "0.3.3";
+          hash = "sha256-7uZHbhOa/GT9F7+xikaxuQXIGzre1q1uWTWaTJhi2UA=";
+        };
+        meta = {
+          changelog = "https://github.com/tomblind/local-lua-debugger-vscode/blob/master/CHANGELOG.md";
+          description = "Simple Lua debugger for Visual Studio Code which requires no additional dependencies";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=tomblind.local-lua-debugger-vscode";
+          homepage = "https://github.com/tomblind/local-lua-debugger-vscode";
+          license = lib.licenses.mit;
+        };
+      };
+
       tsandall.opa = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "opa";
diff --git a/pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix b/pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix
index bdc76f293079..8adc874592ba 100644
--- a/pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix
+++ b/pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-pce-fast";
-  version = "0-unstable-2026-05-22";
+  version = "0-unstable-2026-06-26";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-pce-fast-libretro";
-    rev = "b4de121a733a57ce825a7fd7543206ca96af8a18";
-    hash = "sha256-0V6w9F2T2ROkPvH6K5mKltblogn9mAtvb/JGrWMk4CQ=";
+    rev = "4727b96c10f50405167d98d364844469307fcc41";
+    hash = "sha256-1eA4uBm7BHOQioTQqdglEtosPNZ24qI58FcJ+J7TC+o=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/networking/instant-messengers/gajim/default.nix b/pkgs/applications/networking/instant-messengers/gajim/default.nix
index d5fe7bb3f3c5..25aed76f8a18 100644
--- a/pkgs/applications/networking/instant-messengers/gajim/default.nix
+++ b/pkgs/applications/networking/instant-messengers/gajim/default.nix
@@ -25,7 +25,6 @@
   gst-libav,
   gst-plugins-good,
   libnice,
-  enableE2E ? true,
   enableSecrets ? true,
   libsecret,
   enableRST ? true,
@@ -43,14 +42,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gajim";
-  version = "2.4.6";
+  version = "2.4.7";
 
   src = fetchFromGitLab {
     domain = "dev.gajim.org";
     owner = "gajim";
     repo = "gajim";
     tag = version;
-    hash = "sha256-QHfJ52uMDlE/rqqy7y2JIQLMOPaTp7eh4DEsPLBx6p8=";
+    hash = "sha256-tZ1+DRVCzwaWeur9mwc/zE34H2xdqk96upqWfqNTl3g=";
   };
 
   pyproject = true;
@@ -115,12 +114,9 @@ python3.pkgs.buildPythonApplication rec {
       httpx
       h2
       truststore
+      pysequoia
     ]
     ++ httpx.optional-dependencies.socks
-    ++ lib.optionals enableE2E [
-      pycrypto
-      python-gnupg
-    ]
     ++ lib.optional enableRST docutils
     ++ extraPythonPackages python3.pkgs;
 
diff --git a/pkgs/by-name/au/authentik/package.nix b/pkgs/by-name/au/authentik/package.nix
index fef159aa3c62..f1a75fdd3fea 100644
--- a/pkgs/by-name/au/authentik/package.nix
+++ b/pkgs/by-name/au/authentik/package.nix
@@ -190,7 +190,7 @@ let
     outputHash =
       {
         "aarch64-linux" = "sha256-41xZEfLul92vJATZqyVnd7Pp++NzLL/u8NeJJPHpXrw=";
-        "x86_64-linux" = "sha256-FpfOl6wNCgXLg86+vbjnYkcOnpaOZBCNxJiFDRT5W3s=";
+        "x86_64-linux" = "sha256-p6xjAinU2Isl/uYgoJuacqHN7jBnbWam40J6AQudbtQ=";
       }
       .${stdenvNoCC.hostPlatform.system} or (throw "authentik-webui-deps: unsupported host platform");
     outputHashMode = "recursive";
diff --git a/pkgs/by-name/az/azure-cli/extensions-manual.nix b/pkgs/by-name/az/azure-cli/extensions-manual.nix
index 55001df3cdea..4b289cedf94e 100644
--- a/pkgs/by-name/az/azure-cli/extensions-manual.nix
+++ b/pkgs/by-name/az/azure-cli/extensions-manual.nix
@@ -125,9 +125,9 @@
 
   azure-devops = mkAzExtension rec {
     pname = "azure-devops";
-    version = "1.0.4";
+    version = "1.0.5";
     url = "https://github.com/Azure/azure-cli-extensions/releases/download/azure-devops-${version}/azure_devops-${version}-py2.py3-none-any.whl";
-    hash = "sha256-MYW8CnDfBnBi/dfOgSsI+yT605M8uSxvfjEkEdqYVSo=";
+    hash = "sha256-uzgGU9/EJ7eaQ3HYajEuKRKGcMGW/jQPxGSt/Zgo2rQ=";
     description = "Tools for managing Azure DevOps";
     propagatedBuildInputs = with python3Packages; [ distro ];
     meta.maintainers = with lib.maintainers; [ katexochen ];
diff --git a/pkgs/by-name/bi/bitbox/package.nix b/pkgs/by-name/bi/bitbox/package.nix
index 630125e4d72b..c8796f2e0c59 100644
--- a/pkgs/by-name/bi/bitbox/package.nix
+++ b/pkgs/by-name/bi/bitbox/package.nix
@@ -21,14 +21,14 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "bitbox";
-  version = "4.50.1";
+  version = "4.51.0";
 
   src = fetchFromGitHub {
     owner = "BitBoxSwiss";
     repo = "bitbox-wallet-app";
     tag = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-ZK1US/RF67QPyV0xRVIw4mecNZM/82GhWvjhJ47rKHU=";
+    hash = "sha256-/S+UIYSntUb0fyR6T/Egj6LX9TCI1l0h8gPHMntiTYU=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/bo/boat-cli/package.nix b/pkgs/by-name/bo/boat-cli/package.nix
new file mode 100644
index 000000000000..a480cdb8be70
--- /dev/null
+++ b/pkgs/by-name/bo/boat-cli/package.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  fetchFromGitHub,
+  writableTmpDirAsHomeHook,
+  rustPlatform,
+  sqlite,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "boat-cli";
+  version = "0.9.1";
+
+  src = fetchFromGitHub {
+    owner = "coko7";
+    repo = "boat-cli";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-+QhW7QWBoDzSNzkHotNLg/dnolSd3uK/IcDPnzVKBbI=";
+  };
+
+  cargoHash = "sha256-rfZbOeOoBWMp232vXVeKtQz3LP5IloIBZS0OWkN8Fys=";
+
+  nativeBuildInputs = [
+    writableTmpDirAsHomeHook
+  ];
+
+  buildInputs = [
+    sqlite
+  ];
+
+  __structuredAttrs = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Basic Opinionated Activity Tracker, a command line interface inspired by bartib.";
+    homepage = "https://github.com/coko7/boat-cli";
+    changelog = "https://github.com/coko7/boat-cli/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ tgi74 ];
+    mainProgram = "boat";
+  };
+})
diff --git a/pkgs/by-name/ce/censor/package.nix b/pkgs/by-name/ce/censor/package.nix
index 5b7b03b6ff40..f75d73689274 100644
--- a/pkgs/by-name/ce/censor/package.nix
+++ b/pkgs/by-name/ce/censor/package.nix
@@ -13,14 +13,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "censor";
-  version = "0.7.1";
+  version = "0.7.2";
   pyproject = false;
 
   src = fetchFromCodeberg {
     owner = "censor";
     repo = "Censor";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wimLSoejojVBdHnuzLxOW4QssJZpK0GTp64oIvtSqBk=";
+    hash = "sha256-444EGJCNnRRkuTzm4HdapUvwphx9EavxeyAI0Sxh8G8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/co/coder/package.nix b/pkgs/by-name/co/coder/package.nix
index aa8641fcaf58..a56a65e02e57 100644
--- a/pkgs/by-name/co/coder/package.nix
+++ b/pkgs/by-name/co/coder/package.nix
@@ -102,8 +102,11 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     license = lib.licenses.agpl3Only;
     mainProgram = "coder";
     maintainers = with lib.maintainers; [
+      bpmct
+      developmentcats
       ghuntley
       kylecarbs
+      phorcys420
     ];
   };
 
diff --git a/pkgs/by-name/cp/cpat/format-security.patch b/pkgs/by-name/cp/cpat/format-security.patch
new file mode 100644
index 000000000000..d5c2eda85a99
--- /dev/null
+++ b/pkgs/by-name/cp/cpat/format-security.patch
@@ -0,0 +1,44 @@
+diff --git a/src/cpat.c b/src/cpat.c
+index 4bb5dec..6aeeca3 100644
+--- a/src/cpat.c
++++ b/src/cpat.c
+@@ -126,10 +126,10 @@ pager(char *title,char* text,int num_phrases, char **phrases)
+ 
+     /* Add title and header lines */
+     wattron(outer,A_UNDERLINE);
+-    mvwprintw(outer,2,4,title);
++    mvwprintw(outer,2,4,"%s",title);
+     xtermtitle(title);
+     wattroff(outer,A_UNDERLINE);
+-    for (i = 0;i < num_phrases;i++) mvwprintw(outer,4+i,4,phrases[i]);
++    for (i = 0;i < num_phrases;i++) mvwprintw(outer,4+i,4,"%s",phrases[i]);
+     wrefresh(outer);
+ 
+     /* Values for inner window */
+@@ -244,10 +244,10 @@ d                    Scroll forward half a page\n\
+ q                    Exit pager",-1,NULL);
+                     box(outer,0,0);
+                     wattron(outer,A_UNDERLINE);
+-                    mvwprintw(outer,2,4,title);
++                    mvwprintw(outer,2,4,"%s",title);
+                     xtermtitle(title);
+                     wattroff(outer,A_UNDERLINE);
+-                    for (i = 0;i < num_phrases;i++) mvwprintw(outer,4+i,4,phrases[i]);
++                    for (i = 0;i < num_phrases;i++) mvwprintw(outer,4+i,4,"%s",phrases[i]);
+                     wrefresh(outer);
+                     prev_line = -1; /* force page refresh */
+                     break;
+@@ -354,11 +354,11 @@ menu(char *title,char **queries,int num_queries,
+     box(outer, 0, 0);
+ 
+     wattron(outer,A_UNDERLINE);
+-    mvwprintw(outer,title_y,4,title);
++    mvwprintw(outer,title_y,4,"%s",title);
+     xtermtitle(title);
+     wattroff(outer,A_UNDERLINE);
+     for (i = 0;i < num_phrases;i++) 
+-        mvwprintw(outer,phrases_y+i,6,phrases[i]);
++        mvwprintw(outer,phrases_y+i,6,"%s",phrases[i]);
+     wrefresh(outer);
+ 
+     input = newwin(inner_h,inner_w,inner_y,inner_x);
diff --git a/pkgs/by-name/cp/cpat/package.nix b/pkgs/by-name/cp/cpat/package.nix
new file mode 100644
index 000000000000..f8c4e312bcc7
--- /dev/null
+++ b/pkgs/by-name/cp/cpat/package.nix
@@ -0,0 +1,32 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  ncurses,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "cpat";
+  version = "1.4.2";
+
+  src = fetchurl {
+    url = "https://downloads.sourceforge.net/project/cpat/v1.4.2/cpat-${finalAttrs.version}.tar.gz";
+    hash = "sha256-viVbaU21tI4lU+0WoSzRW81aUPzCIkJKjJR/BPEFO2c=";
+  };
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  patches = [ ./format-security.patch ];
+
+  buildInputs = [ ncurses ];
+
+  meta = {
+    description = "A curses based card games application";
+    homepage = "https://sourceforge.net/projects/cpat/";
+    mainProgram = "cpat";
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ castorNova2 ];
+  };
+})
diff --git a/pkgs/by-name/ct/ctranslate2/package.nix b/pkgs/by-name/ct/ctranslate2/package.nix
index 812a6d88286f..35e175647aaf 100644
--- a/pkgs/by-name/ct/ctranslate2/package.nix
+++ b/pkgs/by-name/ct/ctranslate2/package.nix
@@ -51,6 +51,13 @@ stdenv'.mkDerivation (finalAttrs: {
         'CMAKE_MINIMUM_REQUIRED(VERSION 3.10 FATAL_ERROR)'
 
     sed -e '1i #include <cstdint>' -i third_party/cxxopts/include/cxxopts.hpp
+
+    # Prevent setting the default nvcc arch flags, which can be
+    # ones that don't work with the current CUDA version
+    substituteInPlace CMakeLists.txt \
+      --replace-fail \
+        'list(APPEND CUDA_NVCC_FLAGS ''${ARCH_FLAGS})' \
+        ""
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/cu/cup-docker-noserver/package.nix b/pkgs/by-name/cu/cup-docker-noserver/package.nix
deleted file mode 100644
index 64597c39dbe4..000000000000
--- a/pkgs/by-name/cu/cup-docker-noserver/package.nix
+++ /dev/null
@@ -1,7 +0,0 @@
-{
-  cup-docker,
-}:
-
-cup-docker.override {
-  withServer = false;
-}
diff --git a/pkgs/by-name/cu/cup-docker/package.nix b/pkgs/by-name/cu/cup-docker/package.nix
deleted file mode 100644
index 03695438dbe4..000000000000
--- a/pkgs/by-name/cu/cup-docker/package.nix
+++ /dev/null
@@ -1,91 +0,0 @@
-{
-  rustPlatform,
-  fetchFromGitHub,
-  lib,
-  stdenvNoCC,
-  bun,
-  nodejs-slim_latest,
-  nix-update-script,
-  withServer ? true,
-}:
-rustPlatform.buildRustPackage (finalAttrs: {
-  pname = "cup-docker";
-  version = "3.5.1";
-
-  src = fetchFromGitHub {
-    owner = "sergi0g";
-    repo = "cup";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-l7TQwCzQNwrsM+xRcRcQaxIsnd8SVzrqEMwIoZGVBR0=";
-  };
-
-  web = stdenvNoCC.mkDerivation (finalAttrsWeb: {
-    pname = "cup-docker-web";
-    inherit (finalAttrs) version src;
-    impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [
-      "GIT_PROXY_COMMAND"
-      "SOCKS_SERVER"
-    ];
-    sourceRoot = "${finalAttrsWeb.src.name}/web";
-    nativeBuildInputs = [
-      bun
-      nodejs-slim_latest
-    ];
-    configurePhase = ''
-      runHook preConfigure
-      bun install --no-progress --frozen-lockfile
-      substituteInPlace node_modules/.bin/{vite,tsc} \
-        --replace-fail "/usr/bin/env node" "${nodejs-slim_latest}/bin/node"
-      runHook postConfigure
-    '';
-    buildPhase = ''
-      runHook preBuild
-      bun run build
-      runHook postBuild
-    '';
-    installPhase = ''
-      runHook preInstall
-      mkdir -p $out/dist
-      cp -R ./dist $out
-      runHook postInstall
-    '';
-    outputHash = "sha256-uLsWppRabaI7JSHYf3YsEvf0Y36kU/iuNXnDXd+6AXY=";
-    outputHashAlgo = "sha256";
-    outputHashMode = "recursive";
-  });
-
-  cargoHash = "sha256-1VSbv6lDRRLZIu7hYrAqzQmvxcuhnPU0rcWfg7Upcm4=";
-
-  buildNoDefaultFeatures = true;
-  buildFeatures = [
-    "cli"
-  ]
-  ++ lib.optional withServer [
-    "server"
-  ];
-
-  preConfigure = lib.optionalString withServer ''
-    cp -r ${finalAttrs.web}/dist src/static
-  '';
-
-  passthru = {
-    updateScript = nix-update-script {
-      extraArgs = [
-        "--subpackage"
-        "web"
-      ];
-    };
-  };
-
-  meta = {
-    description = "Lightweight way to check for container image updates. written in Rust";
-    homepage = "https://cup.sergi0g.dev";
-    license = lib.licenses.agpl3Only;
-    platforms = lib.platforms.all;
-    changelog = "https://github.com/sergi0g/cup/releases";
-    mainProgram = "cup";
-    maintainers = with lib.maintainers; [
-      kuflierl
-    ];
-  };
-})
diff --git a/pkgs/by-name/cu/curlconverter/package.nix b/pkgs/by-name/cu/curlconverter/package.nix
new file mode 100644
index 000000000000..776502e846d9
--- /dev/null
+++ b/pkgs/by-name/cu/curlconverter/package.nix
@@ -0,0 +1,31 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+}:
+buildNpmPackage (final: {
+  pname = "curlconverter";
+  version = "4.12.0";
+
+  src = fetchFromGitHub {
+    owner = "curlconverter";
+    repo = "curlconverter";
+    tag = "v${final.version}";
+    hash = "sha256-eJ8D5HkYSkWqQt/4UTv6/X6coLwcODde6xGEPQXgJRo=";
+  };
+
+  npmDepsHash = "sha256-UIbMvw8hkZxtSGInV2+Fjm4DZahrdGtSxi0Unhb5lh8=";
+
+  # Prevent the dependency tree-sitter-cli from running its install script, which has an impure network request: https://github.com/tree-sitter/tree-sitter/blob/fd77bda97a0ca05d124590833312e4103f985543/crates/cli/npm/install.js#L63
+  npmFlags = [ "--ignore-scripts" ];
+
+  npmBuildScript = "compile";
+
+  meta = {
+    description = "Convert curl commands to Python, JavaScript and more";
+    homepage = "https://curlconverter.com/";
+    license = lib.licenses.mit;
+    mainProgram = "curlconverter";
+    maintainers = with lib.maintainers; [ jiamingc ];
+  };
+})
diff --git a/pkgs/by-name/db/dbcsr/package.nix b/pkgs/by-name/db/dbcsr/package.nix
index 3021ba446435..8024f9c45ea4 100644
--- a/pkgs/by-name/db/dbcsr/package.nix
+++ b/pkgs/by-name/db/dbcsr/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dbcsr";
-  version = "2.9.1";
+  version = "2.10.0";
 
   src = fetchFromGitHub {
     owner = "cp2k";
     repo = "dbcsr";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-F6EvpsPAJJvmEZQKJDW2Mk4Yo8VsQCD4CE2IqxpjyN8=";
+    hash = "sha256-BgZmc81TzgU3ifv4RHh2pfjbkUyxMIIpBrHCtnLF3p0=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/fa/fable/package.nix b/pkgs/by-name/fa/fable/package.nix
index 3660d752767b..455440fcb633 100644
--- a/pkgs/by-name/fa/fable/package.nix
+++ b/pkgs/by-name/fa/fable/package.nix
@@ -23,7 +23,7 @@ buildDotnetGlobalTool (finalAttrs: {
     homepage = "https://github.com/fable-compiler/fable";
     changelog = "https://github.com/fable-compiler/fable/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
     maintainers = with lib.maintainers; [
       anpin
       mdarocha
diff --git a/pkgs/by-name/fa/fakeroot/package.nix b/pkgs/by-name/fa/fakeroot/package.nix
index 993c57aab87f..8ff043709eb9 100644
--- a/pkgs/by-name/fa/fakeroot/package.nix
+++ b/pkgs/by-name/fa/fakeroot/package.nix
@@ -1,27 +1,29 @@
 {
   lib,
-  coreutils,
   stdenv,
   fetchFromGitLab,
-  fetchpatch,
-  getopt,
-  libcap,
-  gnused,
-  nixosTests,
-  testers,
   autoreconfHook,
   po4a,
+  libcap,
+  getopt,
+  gnused,
+  coreutils,
+  versionCheckHook,
+  nixosTests,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   version = "1.38.1";
   pname = "fakeroot";
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   src = fetchFromGitLab {
+    domain = "salsa.debian.org";
     owner = "clint";
     repo = "fakeroot";
-    rev = "upstream/${finalAttrs.version}";
-    domain = "salsa.debian.org";
+    tag = "upstream/${finalAttrs.version}";
     hash = "sha256-sAzXeONjDT753lbu7amQY6yXpaTNCa4wFOzB01SRbCs=";
   };
 
@@ -34,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
     autoreconfHook
     po4a
   ];
-  buildInputs = lib.optional stdenv.hostPlatform.isLinux libcap;
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ libcap ];
 
   postUnpack = ''
     sed -i \
@@ -52,11 +54,11 @@ stdenv.mkDerivation (finalAttrs: {
     popd
   '';
 
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
   passthru = {
     tests = {
-      version = testers.testVersion {
-        package = finalAttrs.finalPackage;
-      };
       # A lightweight *unit* test that exercises fakeroot and fakechroot together:
       nixos-etc = nixosTests.etc.test-etc-fakeroot;
     };
diff --git a/pkgs/by-name/gf/gfan/gfan-0.7-macos.patch b/pkgs/by-name/gf/gfan/gfan-0.7-macos.patch
new file mode 100644
index 000000000000..9a1bfe31e30e
--- /dev/null
+++ b/pkgs/by-name/gf/gfan/gfan-0.7-macos.patch
@@ -0,0 +1,139 @@
+diff --git a/src/app_components.cpp b/src/app_components.cpp
+index 407c23e..8fc0d86 100644
+--- a/src/app_components.cpp
++++ b/src/app_components.cpp
+@@ -162,7 +162,6 @@ void connectedComponentsOfSlices(PostComplex<mvtyp>& pc, bool saveNoncomets, boo
+   */
+   if (potentialsOutputAndStop) {
+     std::for_each(
+-		  std::execution::seq, 
+ 		  potentials.begin(),
+ 		  potentials.end(),
+ 		  [](Rational p)
+@@ -180,7 +179,6 @@ void connectedComponentsOfSlices(PostComplex<mvtyp>& pc, bool saveNoncomets, boo
+ 		  });
+   } else {
+     std::for_each(
+-		  std::execution::par,//fails to trigger parallelism
+ 		  potentials.begin(),
+ 		  potentials.end(),
+ 		  [pc,minConePotential,maxConePotential,saveNoncomets](Rational p)
+diff --git a/src/gfanlib_circuittableint.h b/src/gfanlib_circuittableint.h
+index 2b5ced4..d53fbec 100644
+--- a/src/gfanlib_circuittableint.h
++++ b/src/gfanlib_circuittableint.h
+@@ -25,6 +25,7 @@ namespace gfan{
+   template<typename> struct MyMakeUnsigned;
+   template <> struct MyMakeUnsigned<int>{typedef unsigned int type;};
+   template <> struct MyMakeUnsigned<long int>{typedef unsigned long int type;};
++  template <> struct MyMakeUnsigned<long long int>{typedef unsigned long long int type;};
+   template <> struct MyMakeUnsigned<__int128>{typedef unsigned __int128 type;};
+
+   class MVMachineIntegerOverflow: public std::exception
+@@ -92,6 +93,15 @@ static std::string toStr(__uint32_t b)
+        return s.str();
+ }
+
++#ifndef _64BITLONGINT
++static std::string toStr(long int b)
++{
++       std::stringstream s;
++       s<<b;
++       return s.str();
++}
++#endif
++
+ class my256s{
+ public:
+        __int128_t lo,hi;
+@@ -213,6 +221,10 @@ static __int128_t extMul(long int a, long int b)
+ {
+        return ((__int128_t)a)*((__int128_t)b);
+ }
++static __int128_t extMul(long long int a, long long int b)
++{
++       return ((__int128_t)a)*((__int128_t)b);
++}
+
+ static __uint128_t unsignedProd64(uint64_t x,uint64_t y)
+ {
+diff --git a/src/gfanlib_memoryresource.cpp b/src/gfanlib_memoryresource.cpp
+index 238a9f8..515f116 100644
+--- a/src/gfanlib_memoryresource.cpp
++++ b/src/gfanlib_memoryresource.cpp
+@@ -10,7 +10,7 @@
+ StackResource stackResource(10160000);
+ StackResource stackResource2(10160000);
+ 
+-std::string memoryResourceToString(const std::experimental::pmr::memory_resource *mr)
++std::string memoryResourceToString(const std::pmr::memory_resource *mr)
+ {
+ 	if(get_default_resource()==mr)
+ 	{
+diff --git a/src/gfanlib_memoryresource.h b/src/gfanlib_memoryresource.h
+index 3eb9e2c..74a5c64 100644
+--- a/src/gfanlib_memoryresource.h
++++ b/src/gfanlib_memoryresource.h
+@@ -6,9 +6,9 @@
+  *      Author: anders
+  */
+ 
+-#include <experimental/memory_resource>
++#include <memory_resource>
+ #include <iostream>
+-#include <experimental/vector>
++#include <vector>
+ #include <assert.h>
+ 
+ 
+@@ -42,9 +42,9 @@ void test() {
+ 
+ template<typename a>
+ //using std::experimental::pmr pmr;
+-using pmrvector=std::experimental::pmr::vector<a>;
+-typedef std::experimental::pmr::memory_resource MR; //Maybe this should be polymorphic_allocator<byte> instead - at least for the constructors using these
+-using std::experimental::pmr::get_default_resource;
++using pmrvector=std::pmr::vector<a>;
++typedef std::pmr::memory_resource MR; //Maybe this should be polymorphic_allocator<byte> instead - at least for the constructors using these
++using std::pmr::get_default_resource;
+ 
+ //DELETE
+ class ResourceWrapper: public MR{
+@@ -76,7 +76,7 @@ public:
+ 	}
+ };
+ 
+-class StackResource: public std::experimental::pmr::memory_resource{
++class StackResource: public std::pmr::memory_resource{
+   /*
+    *
+    * Layout of memory
+@@ -98,7 +98,7 @@ class StackResource: public std::experimental::pmr::memory_resource{
+ 	The header is 4 byte aligned, while the alignment of each block is specified at allocation.
+    */
+ public:
+-  std::experimental::pmr::vector<char> mem;
++  std::pmr::vector<char> mem;
+   int topHeader;
+   int nbytes;
+   memory_resource* parentResource;
+@@ -124,8 +124,8 @@ public:
+ 	  return (firstPossible+((align-1)|(minimumAlignment-1)))& ~((align-1)|(minimumAlignment-1));
+   }
+   StackResource(int nbytes_,
+-		memory_resource* parentResource_=std::experimental::pmr::new_delete_resource(),
+-		memory_resource* fallBackResource_=std::experimental::pmr::null_memory_resource()):
++		memory_resource* parentResource_=std::pmr::new_delete_resource(),
++		memory_resource* fallBackResource_=std::pmr::null_memory_resource()):
+ 	topHeader(0),
+     nbytes(nbytes_),
+     mem(nbytes_,parentResource_),
+@@ -254,7 +254,7 @@ public:
+ };
+ 
+ 
+-std::string memoryResourceToString(const std::experimental::pmr::memory_resource *mr);
++std::string memoryResourceToString(const std::pmr::memory_resource *mr);
+ 
+ // DELETE?
+ class ResourceInvariant
diff --git a/pkgs/by-name/gf/gfan/package.nix b/pkgs/by-name/gf/gfan/package.nix
index 9ca8ed038811..8b6bce850f2f 100644
--- a/pkgs/by-name/gf/gfan/package.nix
+++ b/pkgs/by-name/gf/gfan/package.nix
@@ -9,22 +9,19 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "gfan";
-  version = "0.6.2";
+  version = "0.7";
 
   src = fetchurl {
     url = "https://home.math.au.dk/jensen/software/gfan/gfan${finalAttrs.version}.tar.gz";
-    sha256 = "02pihqb1lb76a0xbfwjzs1cd6ay3ldfxsm8dvsbl6qs3vkjxax56";
+    sha256 = "sha256-q4M3V+Hk1KmGYvSqaROUAT6poib2QWuPhWU1bW/MmJ4=";
   };
 
   patches = [
     ./gfan-0.6.2-cddlib-prefix.patch
     (fetchpatch {
-      # removes dead code with invalid member reference in gfanlib
-      name = "clang-19.patch";
-      url = "https://github.com/Singular/Singular/commit/d3f73432d73ac0dd041af83cb35301498e9b57d9.patch";
-      stripLen = 2;
-      extraPrefix = "src/";
-      hash = "sha256-jPGMYx/GOFV7Tk3CqaRWeX/UHkzjeL57eZj4r40s8/g=";
+      name = "cstdint.patch";
+      url = "https://salsa.debian.org/math-team/gfan/-/raw/6bb6bc3dd517b3c26fbcb76bfdc47f04d1978007/debian/patches/cstdint.patch";
+      hash = "sha256-ALD8Exe2SW8TZg0hIfhvUuiEbbT3Sk7v+oLnNsYA8hs=";
     })
   ]
   ++ lib.optionals (stdenv.cc.isClang) [
@@ -33,17 +30,17 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://raw.githubusercontent.com/sagemath/sage/eea1f59394a5066e9acd8ae39a90302820914ee3/build/pkgs/gfan/patches/nodel.patch";
       sha256 = "sha256-RrncSgFyrBIk/Bwe3accxiJ2rpOSJKQ84cV/uBvQsDc=";
     })
+  ]
+  ++ lib.optionals (stdenv.hostPlatform.isDarwin) [
+    # On MacOS, we need to adress differences in int64_t types and remove the
+    # "experimental/" library and namespace prefixes as well as references to
+    # std::execution.
+    ./gfan-0.7-macos.patch
   ];
 
-  # This test assumes that our implementation of sort behaves identically to the
-  # one used during development, which is not necessarily the case; update the
-  # expected result to be sorted using our copy of sort.
-  postPatch = ''
-    sort testsuite/0008PolynomialSetUnion/output -o testsuite/0008PolynomialSetUnion/output
-    sort testsuite/0008PolynomialSetUnion/outputNew -o testsuite/0008PolynomialSetUnion/outputNew
-  ''
-  + lib.optionalString stdenv.cc.isClang ''
-    substituteInPlace Makefile --replace "-fno-guess-branch-probability" ""
+  postPatch = lib.optionalString stdenv.cc.isClang ''
+    substituteInPlace Makefile --replace-fail "-fno-guess-branch-probability" "" \
+      --replace-fail "-finline-limit=1000" ""
 
     for f in $(find -name "*.h" -or -name "*.cpp"); do
         substituteInPlace "$f" --replace-quiet "log2" "_log2"
@@ -60,6 +57,7 @@ stdenv.mkDerivation (finalAttrs: {
     mpir
     cddlib
   ];
+  enableParallelBuilding = true;
   hardeningDisable = [ "libcxxhardeningfast" ];
 
   doCheck = true;
@@ -72,7 +70,12 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Software package for computing Gröbner fans and tropical varieties";
-    license = lib.licenses.gpl2;
+    license =
+      with lib.licenses;
+      OR [
+        gpl2
+        gpl3
+      ];
     maintainers = [ lib.maintainers.raskin ];
     platforms = lib.platforms.unix;
     homepage = "http://home.math.au.dk/jensen/software/gfan/gfan.html";
diff --git a/pkgs/by-name/gh/ghorg/package.nix b/pkgs/by-name/gh/ghorg/package.nix
index 5115f59acb52..c11ff85a8680 100644
--- a/pkgs/by-name/gh/ghorg/package.nix
+++ b/pkgs/by-name/gh/ghorg/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "ghorg";
-  version = "1.11.10";
+  version = "1.11.12";
 
   src = fetchFromGitHub {
     owner = "gabrie30";
     repo = "ghorg";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-LgbvCXmyiNBGTY+IYBWNGThtc00AC2rXelYG8PAFdOg=";
+    sha256 = "sha256-KOXUbjaw1TL6Q/fRXTU5fFkxgs1jJ5GcKbn7VVbAipY=";
   };
 
   doCheck = false;
diff --git a/pkgs/by-name/gi/giph/package.nix b/pkgs/by-name/gi/giph/package.nix
index f1fba37b2cb2..0be11bef8b16 100644
--- a/pkgs/by-name/gi/giph/package.nix
+++ b/pkgs/by-name/gi/giph/package.nix
@@ -2,7 +2,7 @@
   stdenvNoCC,
   lib,
   fetchFromGitHub,
-  ffmpeg,
+  ffmpeg-full,
   xdotool,
   slop,
   libnotify,
@@ -33,7 +33,7 @@ stdenvNoCC.mkDerivation rec {
     wrapProgram $out/bin/giph \
       --prefix PATH : ${
         lib.makeBinPath [
-          ffmpeg
+          ffmpeg-full
           xdotool
           libnotify
           slop
diff --git a/pkgs/by-name/go/gogup/package.nix b/pkgs/by-name/go/gogup/package.nix
index 8f2baa1d7228..25e7a046dafc 100644
--- a/pkgs/by-name/go/gogup/package.nix
+++ b/pkgs/by-name/go/gogup/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gogup";
-  version = "1.3.0";
+  version = "1.7.1";
 
   src = fetchFromGitHub {
     owner = "nao1215";
     repo = "gup";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-h7hozN4ggDqEqu2KlQpBEttT7j8JKW+4J4NyM+ftK2M=";
+    hash = "sha256-XRwYvXrg6sF15mvRpldru+mNBu1qKzntoLnhx5+CtOk=";
   };
 
-  vendorHash = "sha256-GbeyuZNpT3wqy52sk0B/9wrab906/E4ds06vQ5tHK7c=";
+  vendorHash = "sha256-uvyt/JVHX/R44NOZ8Hl0Jwzge9v3bph/Jy9kX4vNReQ=";
   doCheck = false;
 
   ldflags = [
diff --git a/pkgs/by-name/go/goldendict-ng/package.nix b/pkgs/by-name/go/goldendict-ng/package.nix
index cc7ccf2f2a97..f02b18b6aac3 100644
--- a/pkgs/by-name/go/goldendict-ng/package.nix
+++ b/pkgs/by-name/go/goldendict-ng/package.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "goldendict-ng";
-  version = "26.6.0";
+  version = "26.6.1";
 
   src = fetchFromGitHub {
     owner = "xiaoyifang";
     repo = "goldendict-ng";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gV1nDKKRCN8p+B9dZ28uzzvYEbKDB58h+fMyQ44nOXU=";
+    hash = "sha256-iWKgOgTTkvrnphPhoWxY8ij+ClVVy3G84V+e+XcsoME=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/gq/gqlgen/package.nix b/pkgs/by-name/gq/gqlgen/package.nix
index caf661043bc9..2e450544bb68 100644
--- a/pkgs/by-name/gq/gqlgen/package.nix
+++ b/pkgs/by-name/gq/gqlgen/package.nix
@@ -6,7 +6,7 @@
 }:
 
 let
-  version = "0.17.91";
+  version = "0.17.93";
 in
 buildGoModule {
   pname = "gqlgen";
@@ -16,10 +16,10 @@ buildGoModule {
     owner = "99designs";
     repo = "gqlgen";
     tag = "v${version}";
-    hash = "sha256-z4VCso3IxV8R9ov9qeyO9UH7DqExe1ybJF6eTaV7odI=";
+    hash = "sha256-F2tbigASufl+Zqq0mKP6S9pFHyia2IADjofI8KAit5s=";
   };
 
-  vendorHash = "sha256-jOwBUeDPOctjeJGIEH7TxcNWX4jF/j1DyNk+FKrLQMQ=";
+  vendorHash = "sha256-6tU6aHbEI91u+s3/QoOdxu0zoYD3UefvV+NGgBAuBxE=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/ha/hasciicam/package.nix b/pkgs/by-name/ha/hasciicam/package.nix
new file mode 100644
index 000000000000..ed85132e622f
--- /dev/null
+++ b/pkgs/by-name/ha/hasciicam/package.nix
@@ -0,0 +1,63 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  pkg-config,
+  SDL2,
+  libx11,
+  ncurses,
+  nix-update-script,
+  enableSDL ? true,
+  enableGUI ? true,
+  enableX11 ? stdenv.hostPlatform.isLinux,
+  enableCurses ? true,
+  enableTests ? true,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "hasciicam";
+  version = "2.5.0";
+
+  src = fetchFromGitHub {
+    owner = "dyne";
+    repo = "hasciicam";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-agwNuIxO+o4HHkjd3TikYuVNgO0vlDPikcZoLDVLCUc=";
+  };
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs =
+    lib.optionals enableSDL [ SDL2 ]
+    ++ lib.optionals enableX11 [ libx11 ]
+    ++ lib.optionals enableCurses [ ncurses ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "HASCIICAM_ENABLE_TESTS" enableTests)
+    (lib.cmakeBool "HASCIICAM_ENABLE_SDL" enableSDL)
+    (lib.cmakeBool "HASCIICAM_ENABLE_GUI" enableGUI)
+    (lib.cmakeBool "HASCIICAM_ENABLE_X11" enableX11)
+    (lib.cmakeBool "HASCIICAM_ENABLE_CURSES" enableCurses)
+  ];
+
+  doCheck = enableTests;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "ASCII art webcam and video viewer";
+    homepage = "https://github.com/dyne/hasciicam";
+    changelog = "https://github.com/dyne/hasciicam/releases/tag/v${finalAttrs.version}";
+    mainProgram = "hasciicam";
+    platforms = lib.platforms.unix;
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ castorNova2 ];
+  };
+})
diff --git a/pkgs/by-name/he/herdr/package.nix b/pkgs/by-name/he/herdr/package.nix
index 8b6971264498..324b3b3f2f58 100644
--- a/pkgs/by-name/he/herdr/package.nix
+++ b/pkgs/by-name/he/herdr/package.nix
@@ -8,7 +8,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "herdr";
-  version = "0.7.0";
+  version = "0.7.1";
 
   __structuredAttrs = true;
 
@@ -16,10 +16,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "ogulcancelik";
     repo = "herdr";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DjCSwhRMBRE9lSvjpX6m8IpoEgUbOP1jcmeXMlQlSQY=";
+    hash = "sha256-/WnsUO1DuSmBfVo8LCFaDJEZvSrYnJZPyRNqASbPzV8=";
   };
 
-  cargoHash = "sha256-NHVSdXlGsqhI/Mij28TvdW0f6IKOglNgpBNb2sFXocI=";
+  cargoHash = "sha256-enVFwIGTM7oBg3teWC6MO/bdT/jDIKbaxKq4jE9E0aw=";
 
   zigDeps = zig_0_15.fetchDeps {
     inherit (finalAttrs) pname version;
diff --git a/pkgs/by-name/ho/homepage-dashboard/package.nix b/pkgs/by-name/ho/homepage-dashboard/package.nix
index fd2e91210a66..b958398961f6 100644
--- a/pkgs/by-name/ho/homepage-dashboard/package.nix
+++ b/pkgs/by-name/ho/homepage-dashboard/package.nix
@@ -31,13 +31,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "homepage-dashboard";
-  version = "1.13.1";
+  version = "1.13.2";
 
   src = fetchFromGitHub {
     owner = "gethomepage";
     repo = "homepage";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-RKvBzHtxK/VNdSRoJSUiVmckG7jTTH75SEe6aX2xq1E=";
+    hash = "sha256-d6NNtaThDfVErGx7fFdqLdjx4UZXMN6CZUBpMZFZYhQ=";
   };
 
   pnpmDeps = fetchPnpmDeps {
@@ -48,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
       ;
     pnpm = pnpm_10;
     fetcherVersion = 3;
-    hash = "sha256-xd7F39WBSAy3ozJjI12XB+oGvijSGHIMYwQhdpaO/l8=";
+    hash = "sha256-jAcAbi++Wbyi07YdPuIhDAeNT4fJVAIxp51boD30x3k=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/in/instant-space-switcher/package.nix b/pkgs/by-name/in/instant-space-switcher/package.nix
new file mode 100644
index 000000000000..25297ba3a848
--- /dev/null
+++ b/pkgs/by-name/in/instant-space-switcher/package.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  undmg,
+  nix-update-script,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "instant-space-switcher";
+  version = "2.0";
+
+  src = fetchurl {
+    url = "https://github.com/jurplel/InstantSpaceSwitcher/releases/download/v${finalAttrs.version}/InstantSpaceSwitcher-${finalAttrs.version}.dmg";
+    hash = "sha256-48DH2Hu/XhLPr8jP2ArmLJLFbJmIupkrlqlFOsNnL7g=";
+  };
+
+  nativeBuildInputs = [ undmg ];
+
+  sourceRoot = ".";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/Applications" "$out/bin"
+    cp -R InstantSpaceSwitcher.app "$out/Applications/"
+    ln -s "$out/Applications/InstantSpaceSwitcher.app/Contents/MacOS/ISSCli" "$out/bin/isscli"
+
+    runHook postInstall
+  '';
+
+  dontBuild = true;
+  dontFixup = true;
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Native instant workspace switching on macOS. No more waiting for animations";
+    homepage = "https://github.com/jurplel/InstantSpaceSwitcher";
+    changelog = "https://github.com/jurplel/InstantSpaceSwitcher/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    platforms = lib.platforms.darwin;
+    mainProgram = "isscli";
+    maintainers = with lib.maintainers; [ myzel394 ];
+  };
+})
diff --git a/pkgs/by-name/ja/jan/package.nix b/pkgs/by-name/ja/jan/package.nix
index 027ddfd7cea1..80c0c89f5688 100644
--- a/pkgs/by-name/ja/jan/package.nix
+++ b/pkgs/by-name/ja/jan/package.nix
@@ -12,16 +12,16 @@
 
 let
   pname = "Jan";
-  version = "0.7.9";
+  version = "0.8.2";
 
   darwin-src = fetchzip {
     url = "https://github.com/janhq/jan/releases/download/v${version}/jan-mac-universal-${version}.zip";
-    hash = "sha256-3SN/yZr40Zp6Oa3rDUnum1m7dwK8jbe6Bxx9iSHDM9U=";
+    hash = "sha256-DUyPMsy9POcxY5OyQu1IBAijTbUZACQB87j0CQDrw8A=";
   };
 
   linux-src = fetchurl {
     url = "https://github.com/janhq/jan/releases/download/v${version}/jan_${version}_amd64.AppImage";
-    hash = "sha256-SMcjig6J/HCpLthT8dHC6yED6uuHyaTG/xLnUIlZHP8=";
+    hash = "sha256-OWg8P4g2g+LVJU+SnjajG2cqWnzl5X2fjqTGkIC3kAY=";
   };
 
   appimageContents = appimageTools.extractType2 {
@@ -35,7 +35,7 @@ let
     homepage = "https://github.com/janhq/jan";
     license = lib.licenses.asl20;
     mainProgram = "Jan";
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ dfjay ];
     platforms =
       lib.platforms.darwin
       ++ (with lib.systems.inspect; patternLogicalAnd patterns.isLinux patterns.isx86_64);
diff --git a/pkgs/by-name/ke/kermit/package.nix b/pkgs/by-name/ke/kermit/package.nix
index 71f295c4d16c..1b5781283f04 100644
--- a/pkgs/by-name/ke/kermit/package.nix
+++ b/pkgs/by-name/ke/kermit/package.nix
@@ -39,7 +39,8 @@ stdenv.mkDerivation {
     make -f makefile install
   '';
 
-  env.NIX_CFLAGS_COMPILE = "-Wno-implicit-function-declaration -Wno-implicit-int";
+  # Old K&R C sources fail under GCC 14+ default C standard (e.g. dosexp prototypes).
+  env.NIX_CFLAGS_COMPILE = "-std=gnu89 -Wno-implicit-function-declaration -Wno-implicit-int";
 
   meta = {
     homepage = "https://www.kermitproject.org/ck90.html";
diff --git a/pkgs/by-name/ko/koodo-reader/package.nix b/pkgs/by-name/ko/koodo-reader/package.nix
index 29d3aecc989a..75319900ee1b 100644
--- a/pkgs/by-name/ko/koodo-reader/package.nix
+++ b/pkgs/by-name/ko/koodo-reader/package.nix
@@ -70,6 +70,12 @@ stdenv.mkDerivation (finalAttrs: {
     export npm_config_nodedir=${nodejs-slim}
     npm rebuild --verbose cpu-features
 
+    # register-scheme is an optional dependency of discord-rpc that fails to compile on modern macOS/Electron
+    # and is not required for the application's core functionality.
+    ${lib.optionalString stdenv.hostPlatform.isDarwin ''
+      rm -rf node_modules/register-scheme
+    ''}
+
     export npm_config_nodedir=${electron.headers}
     # Explicitly set identity to null to avoid signing on darwin
     yarn --offline run electron-builder --dir \
diff --git a/pkgs/by-name/la/lark-cli/package.nix b/pkgs/by-name/la/lark-cli/package.nix
new file mode 100644
index 000000000000..e485d848a2e1
--- /dev/null
+++ b/pkgs/by-name/la/lark-cli/package.nix
@@ -0,0 +1,74 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  fetchurl,
+  runCommand,
+  jq,
+  testers,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "lark-cli";
+  version = "1.0.58";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "larksuite";
+    repo = "cli";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-MqaxcmzX/79vM2EI8wD4ZAFsUfqWvPAovlpmuDP1IWU=";
+  };
+
+  vendorHash = "sha256-M0/Y62Y+M/P1B/YIDjX5bEyB/GKihCWQakTWVd7zvBg=";
+
+  subPackages = [ "." ];
+
+  postPatch =
+    let
+      metaDataRaw = fetchurl {
+        name = "meta_dataraw.json";
+        url = "https://web.archive.org/web/20260626061256/https://open.feishu.cn/api/tools/open/api_definition?protocol=meta&client_version=v${finalAttrs.version}";
+        hash = "sha256-W6KOtDW6gkZIqGa0A5QL0rVjVkRjM+gwW4S3AddPN1M=";
+      };
+
+      metaData =
+        runCommand "meta_data.json"
+          {
+            nativeBuildInputs = [ jq ];
+          }
+          ''
+            jq '.data' ${metaDataRaw} > $out
+          '';
+    in
+    ''
+      cp ${metaData} internal/registry/meta_data.json
+    '';
+
+  postInstall = ''
+    mv $out/bin/cli $out/bin/lark-cli
+  '';
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/larksuite/cli/internal/build.Version=v${finalAttrs.version}"
+    "-X github.com/larksuite/cli/internal/build.Date=2026-06-01"
+  ];
+
+  passthru.tests.version = testers.testVersion {
+    package = finalAttrs.finalPackage;
+    command = "lark-cli --version";
+    version = "v${finalAttrs.version}";
+  };
+
+  meta = {
+    description = "The official CLI for Lark/Feishu open platform";
+    homepage = "https://github.com/larksuite/cli";
+    changelog = "https://github.com/larksuite/cli/releases/tag/v${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ zehuajun ];
+    mainProgram = "lark-cli";
+  };
+})
diff --git a/pkgs/by-name/li/libreswan/package.nix b/pkgs/by-name/li/libreswan/package.nix
index c8cf909e1896..2295de6ae0d1 100644
--- a/pkgs/by-name/li/libreswan/package.nix
+++ b/pkgs/by-name/li/libreswan/package.nix
@@ -51,11 +51,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "libreswan";
-  version = "5.3";
+  version = "5.3.1";
 
   src = fetchurl {
     url = "https://download.libreswan.org/libreswan-${version}.tar.gz";
-    hash = "sha256-wdNQw/Mpb9IbnbB5TiPT8xmykviAv4F4uC71xjkcYMA=";
+    hash = "sha256-4/DlHYtkK/aTpqjMbx5ip2TP9BgKAjvzx+QtQ6Yt/p4=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/li/liquidsoap/package.nix b/pkgs/by-name/li/liquidsoap/package.nix
index a67ec71124cc..56a6d390222b 100644
--- a/pkgs/by-name/li/liquidsoap/package.nix
+++ b/pkgs/by-name/li/liquidsoap/package.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "savonet";
     repo = "liquidsoap";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-aNsN65phkfFM7OD4oCMl0wP3quvUquHR325DDVIqs/M=";
+    hash = "sha256-9H0+si3JRw+NIBMWREHm4zzm4D4Asjoi6JbsJqJEpN0=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/ne/nezha-theme-nazhua/package.nix b/pkgs/by-name/ne/nezha-theme-nazhua/package.nix
index 307939677eb6..63453cf78be9 100644
--- a/pkgs/by-name/ne/nezha-theme-nazhua/package.nix
+++ b/pkgs/by-name/ne/nezha-theme-nazhua/package.nix
@@ -1,38 +1,22 @@
 {
   lib,
-  stdenvNoCC,
+  buildNpmPackage,
   fetchFromGitHub,
-  yarnConfigHook,
-  yarnBuildHook,
-  yarnInstallHook,
-  fetchYarnDeps,
-  nodejs,
   nix-update-script,
 }:
 
-stdenvNoCC.mkDerivation (finalAttrs: {
+buildNpmPackage (finalAttrs: {
   pname = "nezha-theme-nazhua";
-  version = "0.8.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "hi2shark";
     repo = "nazhua";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kXiFvVSwOXn/MDwQIBmN+1wp8wO4P9hw1zcYcTBHmXA=";
+    hash = "sha256-lyrkWJDMMMellM8lIaZMvxXJT54gjjP4gnwxMcytrdA=";
   };
 
-  yarnOfflineCache = fetchYarnDeps {
-    yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-/CQsG3iQdPyKHdApeMzq4w90NsMBdLXUP2lya8vtK5Q=";
-  };
-
-  nativeBuildInputs = [
-    yarnConfigHook
-    yarnBuildHook
-    yarnInstallHook
-    # Needed for executing package.json scripts
-    nodejs
-  ];
+  npmDepsHash = "sha256-V+fdXp2QevPRYQQ4j5w9OQro6w3qnyi7imhgzGdUiVs=";
 
   # Copied from .github/workflows/release.yml
   env = {
diff --git a/pkgs/by-name/pg/pgrok/package.nix b/pkgs/by-name/pg/pgrok/package.nix
index 7a8bef55ef44..e0870337fd64 100644
--- a/pkgs/by-name/pg/pgrok/package.nix
+++ b/pkgs/by-name/pg/pgrok/package.nix
@@ -4,24 +4,21 @@
   fetchFromGitHub,
   nix-update-script,
   nodejs,
-  pnpm_9,
+  pnpm_11,
   fetchPnpmDeps,
   pnpmConfigHook,
 }:
 
-let
+buildGoModule (finalAttrs: {
   pname = "pgrok";
   version = "1.7.0";
+
   src = fetchFromGitHub {
     owner = "pgrok";
     repo = "pgrok";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-uMHeVxAGmAEIOfCK9SEFsL7GZZIUNMYdoV8XeHjXmWc=";
   };
-in
-
-buildGoModule {
-  inherit pname version src;
 
   outputs = [
     "out"
@@ -31,7 +28,7 @@ buildGoModule {
   nativeBuildInputs = [
     nodejs
     pnpmConfigHook
-    pnpm_9
+    pnpm_11
   ];
 
   postPatch = ''
@@ -47,14 +44,14 @@ buildGoModule {
   '';
 
   env.pnpmDeps = fetchPnpmDeps {
-    inherit
+    inherit (finalAttrs)
       pname
       version
       src
       ;
-    pnpm = pnpm_9;
-    fetcherVersion = 3;
-    hash = "sha256-O3bDxnxeRO20FsRNpgXfz4UweYJmeU6zgrrPJ05fgWo=";
+    pnpm = pnpm_11;
+    fetcherVersion = 4;
+    hash = "sha256-8CLAtxqNgcVIUw4RKAy6jKlErmkgZYyVYFdrD+jyfAA=";
   };
 
   vendorHash = "sha256-fhyyyXHUJsIWiCZbqtLZZRuIG9hb0LAkSo7lKW0i8Sk";
@@ -62,7 +59,7 @@ buildGoModule {
   ldflags = [
     "-s"
     "-w"
-    "-X main.version=${version}"
+    "-X main.version=${finalAttrs.version}"
     "-X main.commit=unknown"
     "-X main.date=unknown"
   ];
@@ -93,4 +90,4 @@ buildGoModule {
     maintainers = with lib.maintainers; [ tbutter ];
     mainProgram = "pgrok";
   };
-}
+})
diff --git a/pkgs/by-name/pi/pika-backup/package.nix b/pkgs/by-name/pi/pika-backup/package.nix
index 597a469d1a10..e94043b23b9a 100644
--- a/pkgs/by-name/pi/pika-backup/package.nix
+++ b/pkgs/by-name/pi/pika-backup/package.nix
@@ -24,19 +24,19 @@
 
 stdenv.mkDerivation rec {
   pname = "pika-backup";
-  version = "0.8.2";
+  version = "0.8.3";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = "pika-backup";
     tag = version;
-    hash = "sha256-02ChjIXjTos3jm6UR37tFWhRlUvyh/1r6zLsd6fQsyc=";
+    hash = "sha256-oM59t0oJzW7EyvcGoEwrokhxk+inxMLznf4Z2IEg3ig=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-e6hep/aTpC5HDI/UoSJONGZRP3rjA2eVh9G4DE3HJpE=";
+    hash = "sha256-CWyZYnurIWiGzfUpa7OgmLU/CVRiAGbgFM0+frRfi9c=";
   };
 
   patches = [
diff --git a/pkgs/by-name/po/positron-bin/package.nix b/pkgs/by-name/po/positron-bin/package.nix
index 394eecb4b7f2..2ad6f3244b12 100644
--- a/pkgs/by-name/po/positron-bin/package.nix
+++ b/pkgs/by-name/po/positron-bin/package.nix
@@ -22,29 +22,32 @@
   libxcomposite,
   libx11,
   libxkbfile,
+  libsecret,
+  webkitgtk_4_1,
 }:
 let
   pname = "positron-bin";
-  version = "2026.02.1-5";
+  version = "2026.06.0-211";
 in
 stdenv.mkDerivation {
+  dontFixup = stdenv.hostPlatform.isDarwin;
   inherit version pname;
 
   src =
     if stdenv.hostPlatform.isDarwin then
       fetchurl {
         url = "https://cdn.posit.co/positron/releases/mac/arm64/Positron-${version}-arm64.dmg";
-        hash = "sha256-wQ/ctA9q8i5hyi86VKF8cC/mDHVU1DRt1vnFBKdAAJI=";
+        hash = "sha256-XzkYclZtF7oyYtdKeTqiAAcQInVEsuP8uL6TAq+rlpg=";
       }
     else if stdenv.hostPlatform.system == "aarch64-linux" then
       fetchurl {
         url = "https://cdn.posit.co/positron/releases/deb/arm64/Positron-${version}-arm64.deb";
-        hash = "sha256-AW4jueFtdvrmIAm+d5/qjyViaSpue51dbyU4NYs3vaE=";
+        hash = "sha256-dH8kcXUuT3RKSNIjbIu/cFAUsv289gbjMmG8JDTSoj0=";
       }
     else
       fetchurl {
         url = "https://cdn.posit.co/positron/releases/deb/x86_64/Positron-${version}-x64.deb";
-        hash = "sha256-aTVzJCsMARXciasGv7l/syFb3V81Ii6gVl6sBrEPFzM=";
+        hash = "sha256-YvnweVTKAvxZTR5/FY1VWt03Gx4LFa2faL+Z0AYCtpY=";
       };
 
   buildInputs = [
@@ -64,6 +67,8 @@ stdenv.mkDerivation {
     libxcomposite
     libxdamage
     libxkbfile
+    libsecret
+    webkitgtk_4_1
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     blas
@@ -89,15 +94,14 @@ stdenv.mkDerivation {
     if stdenv.hostPlatform.isDarwin then
       ''
         runHook preInstall
-        mkdir -p "$out/Applications" "$out/bin"
-        cp -r . "$out/Applications/Positron.app"
+        mkdir -p "$out/Applications/Positron.app" "$out/bin"
+        cp -r Positron.app/. "$out/Applications/Positron.app"
 
         # Positron will use the system version of BLAS if we don't provide the nix version.
-        wrapProgram "$out/Applications/Positron.app/Contents/Resources/app/bin/code" \
+        makeShellWrapper "$out/Applications/Positron.app/Contents/Resources/app/bin/code" "$out/bin/positron" \
           --prefix DYLD_INSERT_LIBRARIES : "${lib.makeLibraryPath [ blas ]}/libblas.dylib" \
           --add-flags "--disable-updates"
 
-        ln -s "$out/Applications/Positron.app/Contents/Resources/app/bin/code" "$out/bin/positron"
         runHook postInstall
       ''
     else
diff --git a/pkgs/by-name/pv/pvzge/package.nix b/pkgs/by-name/pv/pvzge/package.nix
index 41d5aa55c4c8..51c61d1b69f3 100644
--- a/pkgs/by-name/pv/pvzge/package.nix
+++ b/pkgs/by-name/pv/pvzge/package.nix
@@ -14,13 +14,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "pvzge";
-  version = "0.9.3";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "Gzh0821";
     repo = "pvzge_web";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QFHWTTwvhtVzcApehPfYCpFHjLXmq9SZcbBSc0eSkpM=";
+    hash = "sha256-sirarRJyQUHk8Fx3B9uXJjCqgRXX+SYqxpj+/N8v7y8=";
   };
 
   iconSrc = fetchurl {
diff --git a/pkgs/by-name/qe/qemu/package.nix b/pkgs/by-name/qe/qemu/package.nix
index 34d22a285da4..5bd6c6e0f8c7 100644
--- a/pkgs/by-name/qe/qemu/package.nix
+++ b/pkgs/by-name/qe/qemu/package.nix
@@ -32,6 +32,7 @@
   libslirp,
   libcbor,
   darwin,
+  apple-sdk_15,
   guestAgentSupport ?
     (with stdenv.hostPlatform; isLinux || isNetBSD || isOpenBSD || isSunOS || isWindows) && !minimal,
   numaSupport ? stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isAarch32 && !minimal,
@@ -251,7 +252,8 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals canokeySupport [ canokey-qemu ]
   ++ lib.optionals u2fEmuSupport [ libu2f-emu ]
   ++ lib.optionals capstoneSupport [ capstone ]
-  ++ lib.optionals valgrindSupport [ valgrind-light ];
+  ++ lib.optionals valgrindSupport [ valgrind-light ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ apple-sdk_15 ];
 
   dontUseMesonConfigure = true; # meson's configurePhase isn't compatible with qemu build
   dontAddStaticConfigureFlags = true;
diff --git a/pkgs/by-name/rn/rnmon/package.nix b/pkgs/by-name/rn/rnmon/package.nix
new file mode 100644
index 000000000000..b14cb478278c
--- /dev/null
+++ b/pkgs/by-name/rn/rnmon/package.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "rnmon";
+  version = "0.3.4";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "lbatalha";
+    repo = "rnmon";
+    tag = finalAttrs.version;
+    hash = "sha256-3ou2F8ePKzh6g63X0l9iX1fTSVe9misGBkPlCUEWpiU=";
+  };
+
+  build-system = [
+    python3Packages.hatchling
+  ];
+
+  dependencies = with python3Packages; [
+    pyyaml
+    requests
+    rns
+  ];
+
+  pythonImportsCheck = [
+    "rnmon"
+  ];
+
+  # No tests in the repository
+  doCheck = false;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "RNS Monitoring Agent";
+    homepage = "https://github.com/lbatalha/rnmon";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ drupol ];
+    mainProgram = "rnmon";
+  };
+})
diff --git a/pkgs/by-name/sd/sdl3-shadercross/package.nix b/pkgs/by-name/sd/sdl3-shadercross/package.nix
index 0f7cd5219f88..1205f68d1220 100644
--- a/pkgs/by-name/sd/sdl3-shadercross/package.nix
+++ b/pkgs/by-name/sd/sdl3-shadercross/package.nix
@@ -13,7 +13,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sdl3-shadercross";
-  version = "0-unstable-2026-06-15";
+  version = "0-unstable-2026-06-26";
 
   outputs = [
     "out"
@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "libsdl-org";
     repo = "SDL_shadercross";
-    rev = "9a461644308366b50f0c364069d762be8e3b3443";
+    rev = "e55cf5e31ced6f3d1be5cc6d0c50e99384f9f4ba";
     hash = "sha256-oKetmnMb+SeRlscWmzGln6nR1M7fBkgybFlB1bh1Cos=";
   };
 
diff --git a/pkgs/by-name/sp/spellchecker-cli/package.nix b/pkgs/by-name/sp/spellchecker-cli/package.nix
new file mode 100644
index 000000000000..d0ca76d7b009
--- /dev/null
+++ b/pkgs/by-name/sp/spellchecker-cli/package.nix
@@ -0,0 +1,49 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  fetchYarnDeps,
+  yarnConfigHook,
+  yarnBuildHook,
+  yarnInstallHook,
+  nodejs,
+  nix-update-script,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "spellchecker-cli";
+  version = "7.0.3";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "tbroadley";
+    repo = "spellchecker-cli";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-4rKUxXsZKsRDhMV0HL39yQyVNI0negCg97KsI+77oI4=";
+  };
+
+  yarnOfflineCache = fetchYarnDeps {
+    yarnLock = finalAttrs.src + "/yarn.lock";
+    hash = "sha256-GWIjk8eV2yYwsAfe7IY2mjO/dk9mb4vXEOvp68y4eMk=";
+  };
+
+  nativeBuildInputs = [
+    yarnConfigHook
+    yarnBuildHook
+    yarnInstallHook
+    nodejs
+  ];
+
+  yarnBuildScript = "prepack";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "A command-line tool for spellchecking files";
+    homepage = "https://www.npmjs.com/package/spellchecker-cli";
+    mainProgram = "spellchecker";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ WiredMic ];
+  };
+})
diff --git a/pkgs/by-name/st/statix/package.nix b/pkgs/by-name/st/statix/package.nix
index e5e62037af51..22a67ec576c7 100644
--- a/pkgs/by-name/st/statix/package.nix
+++ b/pkgs/by-name/st/statix/package.nix
@@ -8,16 +8,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "statix";
-  version = "0.5.8-unstable-2026-06-22";
+  version = "0.5.8-unstable-2026-06-28";
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "molybdenumsoftware";
     repo = "statix";
-    rev = "5d23643fcb0aea7372f7b598b3edb3e2bd8adf83";
-    hash = "sha256-woMMDcjiFgcbRt3Ywb5cOPv2P8S4+NqC6W6i8q1j4rU=";
+    rev = "964eee9bd0ef445838e32d38d097be0f0d4a2273";
+    hash = "sha256-V3AacP6DHq9WIZJZvFCPSqe0/VjwKFROUNblJxxPXxI=";
   };
 
-  cargoHash = "sha256-p3A88MMt3GkcC1shCNC8DmiXQCMXrWd+hA36D7VRZOE=";
+  cargoHash = "sha256-8iV21qkzXgzCfq9P+VVsuNC3M5MtIkflr6PtCu3FkoQ=";
 
   buildFeatures = lib.optional withJson "json";
 
diff --git a/pkgs/by-name/sw/swipeaerospace/package.nix b/pkgs/by-name/sw/swipeaerospace/package.nix
new file mode 100644
index 000000000000..9566311cf313
--- /dev/null
+++ b/pkgs/by-name/sw/swipeaerospace/package.nix
@@ -0,0 +1,174 @@
+{
+  actool,
+  darwin,
+  fetchFromGitHub,
+  lib,
+  nix-update-script,
+  swiftPackages,
+}:
+
+let
+  inherit (swiftPackages) stdenv swift;
+
+  blueSocket = stdenv.mkDerivation (finalAttrs: {
+    pname = "blue-socket";
+    version = "2.0.4";
+
+    strictDeps = true;
+    __structuredAttrs = true;
+
+    src = fetchFromGitHub {
+      owner = "Kitura";
+      repo = "BlueSocket";
+      tag = finalAttrs.version;
+      hash = "sha256-Bru14uTGvmAeRLjbFYhWKfRjQcj5cZzp9jzyg5o7EHs=";
+    };
+
+    nativeBuildInputs = [
+      swift
+      darwin.autoSignDarwinBinariesHook
+    ];
+
+    dontConfigure = true;
+
+    buildPhase = ''
+      runHook preBuild
+
+      buildDir="$PWD/build"
+      mkdir -p "$buildDir"
+
+      swiftc \
+        -O \
+        -swift-version 5 \
+        -emit-library \
+        -emit-module \
+        -module-name Socket \
+        -emit-module-path "$buildDir/Socket.swiftmodule" \
+        -Xlinker -install_name -Xlinker "$out/lib/swift/libSocket.dylib" \
+        Sources/Socket/*.swift \
+        -o "$buildDir/libSocket.dylib"
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p "$out/lib/swift"
+      cp build/libSocket.dylib "$out/lib/swift/"
+      cp build/Socket.* "$out/lib/swift/"
+
+      runHook postInstall
+    '';
+  });
+
+  infoPlist =
+    version:
+    lib.generators.toPlist { escape = true; } {
+      CFBundleDevelopmentRegion = "en";
+      CFBundleDisplayName = "SwipeAeroSpace";
+      CFBundleExecutable = "SwipeAeroSpace";
+      CFBundleIconFile = "AppIcon";
+      CFBundleIconName = "AppIcon";
+      CFBundleIdentifier = "club.mediosz.SwipeAeroSpace";
+      CFBundleInfoDictionaryVersion = "6.0";
+      CFBundleName = "SwipeAeroSpace";
+      CFBundlePackageType = "APPL";
+      CFBundleShortVersionString = version;
+      CFBundleSupportedPlatforms = [ "MacOSX" ];
+      CFBundleVersion = "18";
+      LSApplicationCategoryType = "public.app-category.developer-tools";
+      LSMinimumSystemVersion = "13.5";
+      LSUIElement = true;
+      NSHumanReadableCopyright = "©Tricster";
+    };
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "swipeaerospace";
+  version = "0.3.1";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "MediosZ";
+    repo = "SwipeAeroSpace";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-468QGWjbRtA9Fml6jjeJZBTCUEp227cQPckqwyLK0dM=";
+  };
+
+  # Keep SettingsView unchanged, but open it through a regular WindowGroup.
+  # @Environment(\.openSettings) does not compile with nixpkgs' SwiftUI SDK.
+  patches = [ ./settings-window.patch ];
+
+  nativeBuildInputs = [
+    swift
+    actool
+    darwin.autoSignDarwinBinariesHook
+  ];
+
+  buildInputs = [ blueSocket ];
+
+  dontConfigure = true;
+
+  buildPhase = ''
+    runHook preBuild
+
+    buildDir="$PWD/build"
+    mkdir -p "$buildDir"
+
+    swiftFiles=()
+    while IFS= read -r -d "" f; do
+      swiftFiles+=("$f")
+    done < <(find SwipeAeroSpace -name '*.swift' -print0)
+
+    swiftc \
+      -O \
+      -swift-version 5 \
+      -parse-as-library \
+      -module-name SwipeAeroSpace \
+      -Xlinker -platform_version -Xlinker macos -Xlinker 13.5 -Xlinker 26.0 \
+      -framework AppKit \
+      -framework Cocoa \
+      -framework SwiftUI \
+      -framework ServiceManagement \
+      -lSocket \
+      "''${swiftFiles[@]}" \
+      -o "$buildDir/SwipeAeroSpace"
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    app="$out/Applications/SwipeAeroSpace.app"
+    mkdir -p "$app/Contents/"{MacOS,Resources}
+
+    cp build/SwipeAeroSpace "$app/Contents/MacOS/SwipeAeroSpace"
+    printf '%s' ${lib.escapeShellArg (infoPlist finalAttrs.version)} > "$app/Contents/Info.plist"
+    printf 'APPL????' > "$app/Contents/PkgInfo"
+
+    actool --compile "$app/Contents/Resources" \
+      --platform macosx \
+      --minimum-deployment-target 13.5 \
+      --app-icon AppIcon \
+      --output-partial-info-plist /dev/null \
+      SwipeAeroSpace/Assets.xcassets
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Switch AeroSpace workspaces by swiping";
+    homepage = "https://github.com/MediosZ/SwipeAeroSpace";
+    license = with lib.licenses; [
+      asl20
+      mit
+    ];
+    maintainers = with lib.maintainers; [ kinnrai ];
+    platforms = lib.platforms.darwin;
+  };
+})
diff --git a/pkgs/by-name/sw/swipeaerospace/settings-window.patch b/pkgs/by-name/sw/swipeaerospace/settings-window.patch
new file mode 100644
index 000000000000..a70bb1b31375
--- /dev/null
+++ b/pkgs/by-name/sw/swipeaerospace/settings-window.patch
@@ -0,0 +1,36 @@
+--- a/SwipeAeroSpace/SwipeAeroSpaceApp.swift
++++ b/SwipeAeroSpace/SwipeAeroSpaceApp.swift
+@@ -10,10 +10,0 @@ import SwiftUI
+-@available(macOS 14.0, *)
+-struct SettingsButton: View {
+-    @Environment(\.openSettings) private var openSettings
+-
+-    var body: some View {
+-        Button("Settings") {
+-            openSettings()
+-        }
+-    }
+-}
+@@ -64,16 +54,4 @@ struct SwipeAeroSpaceApp: App {
+-            if #available(macOS 14.0, *) {
+-                SettingsButton()
+-            } else {
+-                Button(
+-                    action: {
+-                        NSApp.sendAction(
+-                            Selector(("showSettingsWindow:")),
+-                            to: nil,
+-                            from: nil
+-                        )
+-                    },
+-                    label: {
+-                        Text("Settings")
+-                    }
+-                )
++            Button("Settings") {
++                NSApp.activate(ignoringOtherApps: true)
++                openWindow(id: "settings")
+             }
+@@ -92 +70 @@ struct SwipeAeroSpaceApp: App {
+-        Settings {
++        WindowGroup(id: "settings") {
diff --git a/pkgs/by-name/sy/syncpack/package.nix b/pkgs/by-name/sy/syncpack/package.nix
new file mode 100644
index 000000000000..94e7c34c20c4
--- /dev/null
+++ b/pkgs/by-name/sy/syncpack/package.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "syncpack";
+  version = "15.3.2";
+
+  src = fetchFromGitHub {
+    owner = "JamieMason";
+    repo = "syncpack";
+    tag = finalAttrs.version;
+    hash = "sha256-hpTVubKPuRtVxjaWetpFaK71UJXMAfOvWCZ4SqgOi0Y=";
+  };
+
+  cargoHash = "sha256-sjHyifhKU7FxwxrrAPuMwcUEw0lDGV83mOxXzLZul88=";
+
+  __structuredAttrs = true;
+
+  # This test asserts that a nested .gitignore excludes a build directory, but
+  # the `ignore` crate only applies gitignore rules inside a real git repository.
+  # The sandbox builds from a source tarball with no .git, so it is skipped here.
+  checkFlags = [
+    "--skip=issue_334_nested_gitignore_excludes_build_directory"
+  ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  meta = {
+    description = "Consistent dependency versions in large JavaScript monorepos";
+    homepage = "https://syncpack.dev";
+    changelog = "https://github.com/JamieMason/syncpack/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ELHart05 ];
+    mainProgram = "syncpack";
+  };
+})
diff --git a/pkgs/by-name/ta/talosctl/package.nix b/pkgs/by-name/ta/talosctl/package.nix
index 9ecd50659267..42acc5a2119a 100644
--- a/pkgs/by-name/ta/talosctl/package.nix
+++ b/pkgs/by-name/ta/talosctl/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "talosctl";
-  version = "1.13.4";
+  version = "1.13.5";
 
   src = fetchFromGitHub {
     owner = "siderolabs";
     repo = "talos";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jcBRAixpdfbzOfCc7BjyDScWPsrW9Mc7A8vGLyN1f68=";
+    hash = "sha256-woMLG4m7snKD3naTZWYEu78zC/eK5lDxd+uLyXdkzMo=";
   };
 
-  vendorHash = "sha256-dbuPRXAz+YOxmhEdd1R3R5rOAiNn9TOEeDavL+40MV4=";
+  vendorHash = "sha256-98jQJ7M/3ki5L6YQAxtk3bBnixfXhLX4WXY7DN4hsQ4=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/te/teamtype/package.nix b/pkgs/by-name/te/teamtype/package.nix
index e3cc9c0df571..0cc194af9771 100644
--- a/pkgs/by-name/te/teamtype/package.nix
+++ b/pkgs/by-name/te/teamtype/package.nix
@@ -5,6 +5,8 @@
   versionCheckHook,
   installShellFiles,
   nix-update-script,
+  pkg-config,
+  libgit2,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -22,7 +24,18 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoHash = "sha256-OIOffnCC9PlT/SXPOuTnKx3feZnkHP+jzbQIJWX0tzk=";
 
-  nativeBuildInputs = [ installShellFiles ];
+  nativeBuildInputs = [
+    installShellFiles
+    pkg-config
+  ];
+
+  buildInputs = [
+    libgit2
+  ];
+
+  env = {
+    LIBGIT2_NO_VENDOR = 1;
+  };
 
   postInstall = ''
     installManPage \
@@ -50,8 +63,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
     mainProgram = "teamtype";
     teams = [ lib.teams.ngi ];
     maintainers = with lib.maintainers; [
-      prince213
+      alerque
       ethancedwards8
+      prince213
     ];
   };
 })
diff --git a/pkgs/by-name/te/texlyre/package.nix b/pkgs/by-name/te/texlyre/package.nix
new file mode 100644
index 000000000000..85754754ff66
--- /dev/null
+++ b/pkgs/by-name/te/texlyre/package.nix
@@ -0,0 +1,107 @@
+{
+  lib,
+  xsel,
+  serve,
+  fetchzip,
+  stdenvNoCC,
+  makeWrapper,
+  buildNpmPackage,
+  fetchFromGitHub,
+
+  baseUrl ? "/",
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "texlyre";
+  version = "0.9.0";
+
+  src = fetchFromGitHub {
+    owner = "TeXlyre";
+    repo = "texlyre";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-sUyQYtTuE5bNEqxDw9DYT0KRiww7PmGnQ7CYt60EbSc=";
+  };
+
+  npmDepsHash = "sha256-bOhK7kQWY3QYri9S+WoD8VyZXTGK5gcK/ixpGeeP4hg=";
+
+  postPatch = ''
+    sed -i 's/"version": ".*"/"version": "${finalAttrs.version}"/' package.json
+
+    substituteInPlace texlyre.config.ts \
+      --replace-fail "baseUrl: '/texlyre/'" "baseUrl: '${baseUrl}'"
+
+    # disable downloading assets
+    substituteInPlace scripts/setup-assets.cjs \
+      --replace-fail "await downloadCoreAssets();" ""
+  '';
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  __structuredAttrs = true;
+
+  preBuild = ''
+    # put core assets in place
+    mkdir -p public/core
+    cp -r ${finalAttrs.passthru.drawioEmbed}/drawio-embed public/core/drawio-embed
+    cp -r ${finalAttrs.passthru.busytexAssets} public/core/busytex
+
+    npm run generate:configs
+  '';
+
+  doCheck = true;
+  checkPhase = ''
+    runHook preCheck
+    npm run test:check
+    runHook postCheck
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mv dist $out
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    makeWrapper ${lib.getExe serve} $out/bin/texlyre \
+      --prefix PATH : ${lib.makeBinPath [ xsel ]} \
+      --chdir $out
+  '';
+
+  passthru = {
+    updateScript = ./update.sh;
+    drawioEmbed = stdenvNoCC.mkDerivation (finalAttrs: {
+      pname = "drawio-embed";
+      version = "30.2.2";
+      src = fetchFromGitHub {
+        owner = "TeXlyre";
+        repo = "drawio-embed-mirror";
+        tag = "v${finalAttrs.version}";
+        hash = "sha256-bdOhviJl0P/+GSJKaHMbGoPf+uEhoX5GeyY6bGBOpCg=";
+      };
+      dontBuild = true;
+      installPhase = "cp -a . $out";
+    });
+    busytexAssets = stdenvNoCC.mkDerivation (finalAttrs: {
+      pname = "busytex-assets";
+      version = "1.1.1";
+      src = fetchFromGitHub {
+        owner = "TeXlyre";
+        repo = "texlyre-busytex";
+        tag = "assets-v${finalAttrs.version}";
+        hash = "sha256-vlLoJw5EX6x3nTQvBC8hntDa5QKtY46eJSxJLJzs4EE=";
+      };
+      dontBuild = true;
+      installPhase = "cp -a . $out";
+    });
+  };
+
+  meta = {
+    changelog = "https://github.com/TeXlyre/texlyre/releases/tag/${finalAttrs.src.rev}";
+    description = "Local-first LaTeX & Typst web editor with real-time collaboration & offline support";
+    homepage = "https://github.com/TeXlyre/texlyre";
+    license = lib.licenses.agpl3Only;
+    platforms = lib.platforms.all;
+    mainProgram = "texlyre";
+    teams = with lib.teams; [ ngi ];
+  };
+})
diff --git a/pkgs/by-name/te/texlyre/update.sh b/pkgs/by-name/te/texlyre/update.sh
new file mode 100755
index 000000000000..047ce9fde425
--- /dev/null
+++ b/pkgs/by-name/te/texlyre/update.sh
@@ -0,0 +1,19 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix-update jq gitMinimal
+
+set -euo pipefail
+
+nix-update texlyre
+
+PKG_DIR=$(realpath "$(dirname "$0")")
+NIXPKGS_ROOT="$(git rev-parse --show-toplevel)"
+SRC_DIR=$(nix-build -E "(import \"$NIXPKGS_ROOT\" {}).texlyre.src" --no-out-link)
+ASSETS_SCRIPT="$SRC_DIR/scripts/download-core-assets.cjs"
+
+DRAWIO_VERSION=$(grep -A 2 "name: 'drawio-embed'" "$ASSETS_SCRIPT" | grep "version:" | cut -d "'" -f 2 | sed 's/^v//')
+BUSYTEX_VERSION=$(grep -A 2 "name: 'texlyre-busytex'" "$ASSETS_SCRIPT" | grep "version:" | cut -d "'" -f 2 | sed 's/^v//')
+
+echo "Updating: drawio-embed=$DRAWIO_VERSION, busytex=$BUSYTEX_VERSION"
+
+nix-update texlyre.passthru.drawioEmbed --version "$DRAWIO_VERSION"
+nix-update texlyre.passthru.busytexAssets --version "$BUSYTEX_VERSION"
diff --git a/pkgs/by-name/tm/tmux/package.nix b/pkgs/by-name/tm/tmux/package.nix
index edc21ddf934f..9f479fa366aa 100644
--- a/pkgs/by-name/tm/tmux/package.nix
+++ b/pkgs/by-name/tm/tmux/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   autoreconfHook,
   bison,
   libevent,
@@ -18,12 +17,15 @@
   libutempter,
   withSixel ? true,
   versionCheckHook,
-  nix-update-script,
+  common-updater-scripts,
+  writeShellScript,
+  curl,
+  jq,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tmux";
-  version = "3.6a";
+  version = "3.7";
 
   outputs = [
     "out"
@@ -34,20 +36,9 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "tmux";
     repo = "tmux";
     tag = finalAttrs.version;
-    hash = "sha256-VwOyR9YYhA/uyVRJbspNrKkJWJGYFFktwPnnwnIJ97s=";
+    hash = "sha256-dgqI1jZjnluN/F/AjngzcaMy3TgudmkvDT336YlhGZM=";
   };
 
-  patches = [
-    # Fix NULL pointer dereference in control_write() when a control-mode
-    # client is notified before control_state has been allocated.
-    # https://github.com/tmux/tmux/issues/4980
-    (fetchpatch {
-      name = "tmux-control-notify-uninitialized.patch";
-      url = "https://github.com/tmux/tmux/commit/e5a2a25fafb8ee107c230d8acad694f6b635f8bb.patch";
-      hash = "sha256-UPbhMNnH1WJwTH/LVwjVonTqvNhyuniUrYm7iLVkCfg=";
-    })
-  ];
-
   nativeBuildInputs = [
     pkg-config
     autoreconfHook
@@ -99,7 +90,10 @@ stdenv.mkDerivation (finalAttrs: {
           ln -sv ${ncurses}/share/terminfo/t/{tmux,tmux-256color,tmux-direct} $out/share/terminfo/t
         ''
     );
-    updateScript = nix-update-script { };
+    updateScript = writeShellScript "update-tmux" ''
+      latest=$(${lib.getExe curl} --silent ''${GITHUB_TOKEN:+--header "Authorization: Bearer $GITHUB_TOKEN"} https://api.github.com/repos/tmux/tmux/releases/latest | ${lib.getExe jq} -r .tag_name)
+      ${lib.getExe' common-updater-scripts "update-source-version"} tmux "$latest"
+    '';
   };
 
   meta = {
diff --git a/pkgs/by-name/vi/vimhjkl/package.nix b/pkgs/by-name/vi/vimhjkl/package.nix
new file mode 100644
index 000000000000..8ae06e3c9d42
--- /dev/null
+++ b/pkgs/by-name/vi/vimhjkl/package.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "vimhjkl";
+  version = "0.5.1";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "S-Sigdel";
+    repo = "vimhjkl";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-1Hh6bXuuK3udixgU32yFWkBa9NA3Z7kqI50ynSGCZ+o=";
+  };
+
+  build-system = [
+    python3Packages.uv-build
+  ];
+
+  pythonImportsCheck = [
+    "vimhjkl"
+  ];
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "uv_build>=0.11,<0.12" "uv_build"
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Learn vim from your terminal with spaced repetition";
+    homepage = "https://github.com/S-Sigdel/vimhjkl";
+    changelog = "https://github.com/S-Sigdel/vimhjkl/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ MoritzBoehme ];
+    mainProgram = "vimhjkl";
+  };
+})
diff --git a/pkgs/by-name/we/wealthfolio/package.nix b/pkgs/by-name/we/wealthfolio/package.nix
index e56f5a9bfe32..b47f98484b7e 100644
--- a/pkgs/by-name/we/wealthfolio/package.nix
+++ b/pkgs/by-name/we/wealthfolio/package.nix
@@ -19,20 +19,20 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "wealthfolio";
-  version = "3.5.2";
+  version = "3.5.3";
 
   src = fetchFromGitHub {
     owner = "afadil";
     repo = "wealthfolio";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-WU87VmnbzUno1CmIVwBLYjmTZybM4qSuRmBH/2n/Tfo=";
+    hash = "sha256-9dE0IQtDUcveZk2eWu9+UDpAYPgk/LbY+jsTNH3N9hg=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) src pname version;
     pnpm = pnpm_10;
     fetcherVersion = 4;
-    hash = "sha256-EDnHlaW3Ad32N8wl38ryo6pYvKU2T1OH6IkOuTLI7Vs=";
+    hash = "sha256-ELOwrrRHmHAMZg6K+5MWXdUj/gyNNBgMl6OY11zxbB4=";
   };
 
   cargoRoot = ".";
@@ -45,7 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
       src
       cargoRoot
       ;
-    hash = "sha256-KoS2EouZ0Uf3cijUUOpwYBYEjEB5VxIArU1CuCji2+I=";
+    hash = "sha256-P93AAivBXWBLik8M/DNUWyKXVsq7ttvX3DpiXwaDL2I=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/wi/wiimms-iso-tools/package.nix b/pkgs/by-name/wi/wiimms-iso-tools/package.nix
index 703cbbf37f56..0cb2050214f2 100644
--- a/pkgs/by-name/wi/wiimms-iso-tools/package.nix
+++ b/pkgs/by-name/wi/wiimms-iso-tools/package.nix
@@ -5,7 +5,8 @@
   fetchpatch,
   zlib,
   ncurses,
-  fuse,
+  fuse3,
+  versionCheckHook,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -20,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     zlib
     ncurses
-    fuse
+    fuse3
   ];
 
   patches = [
@@ -50,6 +51,12 @@ stdenv.mkDerivation (finalAttrs: {
     ./install.sh --no-sudo
   '';
 
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgram = "${placeholder "out"}/bin/wit";
+
   meta = {
     homepage = "https://wit.wiimm.de";
     description = "Set of command line tools to manipulate Wii and GameCube ISO images and WBFS containers";
diff --git a/pkgs/by-name/xa/xadrian/package.nix b/pkgs/by-name/xa/xadrian/package.nix
new file mode 100644
index 000000000000..587f43785b94
--- /dev/null
+++ b/pkgs/by-name/xa/xadrian/package.nix
@@ -0,0 +1,111 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  jdk8,
+  makeWrapper,
+  makeBinaryWrapper,
+  makeDesktopItem,
+  copyDesktopItems,
+  unzip,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "xadrian";
+  version = "1.5.1";
+
+  # The source release (tag xadrian-1.5.1) cannot be built: it depends on
+  # de.ailis:oneinstance, which was only published to nexus.ailis.de (now
+  # offline) and is not on Maven Central. The upstream release instead ships
+  # prebuilt, self-contained artifacts, which we repackage here.
+  src =
+    if stdenvNoCC.hostPlatform.isDarwin then
+      fetchurl {
+        url = "https://github.com/kayahr/xadrian/releases/download/xadrian-${finalAttrs.version}/xadrian-${finalAttrs.version}-macosx.zip";
+        hash = "sha256-nCkhlC/nrTxCMd2jO+avkFlXD98a+rFvD6uoCfcZ3PU=";
+      }
+    else
+      fetchurl {
+        url = "https://github.com/kayahr/xadrian/releases/download/xadrian-${finalAttrs.version}/xadrian-${finalAttrs.version}-unix.tar.bz2";
+        hash = "sha256-MVWvYbI9V9s0CbmM6DXmWZEu0kdn9ZIpNcnJZhkDsjU=";
+      };
+
+  sourceRoot = if stdenvNoCC.hostPlatform.isDarwin then "." else "xadrian-${finalAttrs.version}";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  # Xadrian must run on a Java 8 runtime: it uses javax.xml.bind (JAXB), which
+  # was bundled in the JDK only through Java 8 and removed in Java 11+.
+  nativeBuildInputs = [
+    unzip
+  ]
+  # A macOS .app's CFBundleExecutable must be a real binary, so use
+  # makeBinaryWrapper on Darwin; makeWrapper's shell script is fine elsewhere.
+  ++ lib.optionals stdenvNoCC.hostPlatform.isDarwin [ makeBinaryWrapper ]
+  ++ lib.optionals (!stdenvNoCC.hostPlatform.isDarwin) [
+    makeWrapper
+    copyDesktopItems
+  ];
+
+  desktopItems = lib.optionals (!stdenvNoCC.hostPlatform.isDarwin) [
+    (makeDesktopItem {
+      name = "xadrian";
+      desktopName = "Xadrian";
+      exec = "xadrian";
+      icon = "xadrian";
+      comment = finalAttrs.meta.description;
+      categories = [ "Game" ];
+      startupWMClass = "Xadrian";
+    })
+  ];
+
+  installPhase = ''
+    runHook preInstall
+  ''
+  + (
+    if stdenvNoCC.hostPlatform.isDarwin then
+      ''
+        mkdir -p $out/Applications
+        cp -R Xadrian.app $out/Applications/
+        appdir=$out/Applications/Xadrian.app
+        chmod -R u+w "$appdir"
+
+        # The bundled JavaApplicationStub is Apple's long-removed Java 6
+        # launcher (no arm64, broken on modern macOS); replace it with a JRE
+        # wrapper so the .app actually launches.
+        rm -f "$appdir/Contents/MacOS/JavaApplicationStub"
+        makeWrapper ${jdk8}/bin/java "$appdir/Contents/MacOS/JavaApplicationStub" \
+          --add-flags "-jar $appdir/Contents/Resources/Java/xadrian.jar"
+
+        makeWrapper ${jdk8}/bin/java $out/bin/xadrian \
+          --add-flags "-jar $appdir/Contents/Resources/Java/xadrian.jar"
+      ''
+    else
+      ''
+        # Keep the jars co-located so xadrian.jar's relative Class-Path resolves.
+        install -Dm644 -t $out/share/xadrian lib/*.jar
+
+        # The application icon is embedded in the jar.
+        unzip -p $out/share/xadrian/xadrian.jar de/ailis/xadrian/images/xadrian-64.png \
+          > xadrian.png
+        install -Dm644 xadrian.png $out/share/icons/hicolor/64x64/apps/xadrian.png
+
+        makeWrapper ${jdk8}/bin/java $out/bin/xadrian \
+          --add-flags "-jar $out/share/xadrian/xadrian.jar"
+      ''
+  )
+  + ''
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Factory complex calculator for X3: Terran Conflict and X3: Albion Prelude";
+    homepage = "https://github.com/kayahr/xadrian";
+    license = lib.licenses.mit;
+    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
+    maintainers = with lib.maintainers; [ FabricSoul ];
+    mainProgram = "xadrian";
+    platforms = jdk8.meta.platforms;
+  };
+})
diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index 2eb7ee0ea3b2..b75d09f0f2c6 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -98,7 +98,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "1.7.2";
+  version = "1.8.2";
 
   outputs = [
     "out"
@@ -111,7 +111,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-f4CxfUsOEZQIIf0+v+3nXH4zlM3mPy/eZyzXG1ayiVc=";
+    hash = "sha256-j8CwQnVBHvc//4O2N55+4AAAhcARNHGEcccUoSHK8d4=";
   };
 
   postPatch = ''
@@ -134,7 +134,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail 'builder.include(&glib_path_config);' 'builder.include("${lib.getLib glib}/lib/glib-2.0/include");'
   '';
 
-  cargoHash = "sha256-QTnDiNFrBl8E6BgFL1HjoJhGfMBUzOoMimkyKdwUcks=";
+  cargoHash = "sha256-zTAIGL5cmswjRqaBgEN+aiyAXMMY9OYZ2bfd6sd1c4Y=";
 
   __structuredAttrs = true;
 
diff --git a/pkgs/by-name/zi/zigdoc/package.nix b/pkgs/by-name/zi/zigdoc/package.nix
new file mode 100644
index 000000000000..52bb35b5948d
--- /dev/null
+++ b/pkgs/by-name/zi/zigdoc/package.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  zig_0_16,
+}:
+
+let
+  zig = zig_0_16;
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "zigdoc";
+  version = "0.5.1";
+
+  src = fetchFromGitHub {
+    owner = "rockorager";
+    repo = "zigdoc";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-OC84SxB0N+QbyXGAfdHDSWde16IwdCkIPbU699wnvY0=";
+  };
+
+  nativeBuildInputs = [ zig.hook ];
+
+  strictDeps = true;
+
+  __structuredAttrs = true;
+
+  meta = {
+    homepage = "https://github.com/rockorager/zigdoc";
+    description = "CLI tool to view documentation for zig library symbols";
+    changelog = "https://github.com/rockorager/zigdoc/releases";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ddogfoodd ];
+    mainProgram = "zigdoc";
+    inherit (zig.meta) platforms;
+  };
+})
diff --git a/pkgs/development/compilers/llvm/default.nix b/pkgs/development/compilers/llvm/default.nix
index b0ff8ca92f8c..88d30f1b5aec 100644
--- a/pkgs/development/compilers/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/default.nix
@@ -28,9 +28,9 @@ let
     "21.1.8".officialRelease.sha256 = "sha256-pgd8g9Yfvp7abjCCKSmIn1smAROjqtfZaJkaUkBSKW0=";
     "22.1.8".officialRelease.sha256 = "sha256-SF7wFuh4kXZTytpdgX7vUZItKtRobnVICm+ixze4iG0=";
     "23.0.0-git".gitRelease = {
-      rev = "d1744cf76fbea0c407c5e793a380ffca4e5829be";
-      rev-version = "23.0.0-unstable-2026-06-21";
-      sha256 = "sha256-gtfU3pO3xiZtxz/iRmkWnaEx/DEomkOi9r6jsCbLOgQ=";
+      rev = "4050d7a96903eec615c57e1d3d6f3c824096244c";
+      rev-version = "23.0.0-unstable-2026-06-28";
+      sha256 = "sha256-UAqDlH9F/GZ9O9VGiOyP5shuVTIC3SeSstyH5ZWDfAM=";
     };
   }
   // llvmVersions;
diff --git a/pkgs/development/python-modules/airos/default.nix b/pkgs/development/python-modules/airos/default.nix
index fad43abef05d..14adc63dab3c 100644
--- a/pkgs/development/python-modules/airos/default.nix
+++ b/pkgs/development/python-modules/airos/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "airos";
-  version = "0.6.8";
+  version = "0.6.9";
   pyproject = true;
 
   disabled = pythonOlder "3.13";
@@ -23,7 +23,7 @@ buildPythonPackage (finalAttrs: {
     owner = "CoMPaTech";
     repo = "python-airos";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TTEhZ0KJaWM7eyD3Kk646X5rEMIquLte41XqnTeO3lI=";
+    hash = "sha256-/A9bP7wc+N0Jz/jJLvKHqVPjF3ddHjVKWlSN8tqGHIw=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/ocrmypdf/default.nix b/pkgs/development/python-modules/ocrmypdf/default.nix
index 98ba94f12e21..33cebeede2e8 100644
--- a/pkgs/development/python-modules/ocrmypdf/default.nix
+++ b/pkgs/development/python-modules/ocrmypdf/default.nix
@@ -32,7 +32,7 @@
 
 buildPythonPackage rec {
   pname = "ocrmypdf";
-  version = "17.7.0";
+  version = "17.7.1";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -45,7 +45,7 @@ buildPythonPackage rec {
     postFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    hash = "sha256-3WBqXrt1u7Xl1JJAKUHC3C5arCfCEsrYglIOfMrUx9g=";
+    hash = "sha256-LHNaWpnx11EGKvmudicMFCQJzTQMB2+Rz5JgHJN7lFk=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/ocrmypdf/use-pillow-heif.patch b/pkgs/development/python-modules/ocrmypdf/use-pillow-heif.patch
index 0137ea02453d..cbd4cd9b88e1 100644
--- a/pkgs/development/python-modules/ocrmypdf/use-pillow-heif.patch
+++ b/pkgs/development/python-modules/ocrmypdf/use-pillow-heif.patch
@@ -1,22 +1,22 @@
 diff --git a/pyproject.toml b/pyproject.toml
-index 2caa0e75..f6fcf60a 100644
+index 7be62275..0b70ad88 100644
 --- a/pyproject.toml
 +++ b/pyproject.toml
-@@ -16,7 +16,7 @@ dependencies = [
+@@ -17,7 +17,7 @@ dependencies = [
    "img2pdf>=0.5",
    "packaging>=20",
-   "pdfminer.six>=20220319",
+   "pdfminer.six>=20260107",  # fixes parsing of tokens split across the read buffer/streams (gh #1361)
 -  "pi-heif",                # Heif image format - maintainers: if this is removed, it will NOT break
 +  "pillow-heif",                # Heif image format - maintainers: if this is removed, it will NOT break
    "pikepdf>=10",
    "Pillow>=10.0.1",
    "pluggy>=1",
 diff --git a/src/ocrmypdf/_pipeline.py b/src/ocrmypdf/_pipeline.py
-index 90524d58..0be5a0f8 100644
+index 161d77df..1ec03a12 100644
 --- a/src/ocrmypdf/_pipeline.py
 +++ b/src/ocrmypdf/_pipeline.py
-@@ -42,7 +42,7 @@ from ocrmypdf.pdfinfo import Colorspace, Encoding, PageInfo, PdfInfo
- from ocrmypdf.pluginspec import OrientationConfidence
+@@ -49,7 +49,7 @@ from ocrmypdf.pdfinfo import Colorspace, Encoding, FloatRect, Ink, PageInfo, Pdf
+ from ocrmypdf.pluginspec import GhostscriptRasterDevice, OrientationConfidence
  
  try:
 -    from pi_heif import register_heif_opener
diff --git a/pkgs/development/python-modules/pybase62/default.nix b/pkgs/development/python-modules/pybase62/default.nix
index 3b9cc45ed37b..6971f9e39c70 100644
--- a/pkgs/development/python-modules/pybase62/default.nix
+++ b/pkgs/development/python-modules/pybase62/default.nix
@@ -18,7 +18,7 @@ buildPythonPackage (finalAttrs: {
     owner = "suminb";
     repo = "base62";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/H16MT3mKCdXItoeOn1LWTHlgWmtwJdQHUaCp18eMz0=";
+    hash = "sha256-7N/SGJAVwJOy1ObijA2s9XMrqMMb2SUMJaN72ITUrOM=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/python-jsonpath/default.nix b/pkgs/development/python-modules/python-jsonpath/default.nix
index 587425be0b6a..b800f247eec1 100644
--- a/pkgs/development/python-modules/python-jsonpath/default.nix
+++ b/pkgs/development/python-modules/python-jsonpath/default.nix
@@ -7,17 +7,17 @@
   regex,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "python-jsonpath";
-  version = "2.0.2";
+  version = "2.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jg-rp";
     repo = "python-jsonpath";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-eVypnFeqFW2WJfCinWXJulVtxaFpNomK2tZNbmxsxrY=";
+    hash = "sha256-2AV+X3Vs+pYi3Iv7zy9/nXna5PgrofHmrH0xyaumZWk=";
   };
 
   build-system = [ hatchling ];
@@ -34,13 +34,13 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     pytestCheckHook
   ]
-  ++ optional-dependencies.strict;
+  ++ finalAttrs.passthru.optional-dependencies.strict;
 
   meta = {
-    changelog = "https://github.com/jg-rp/python-jsonpath/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/jg-rp/python-jsonpath/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     description = "Flexible JSONPath engine for Python with JSON Pointer and JSON Patch";
     homepage = "https://github.com/jg-rp/python-jsonpath";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.dotlambda ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index 785a917fcf0d..75c66680de00 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -101,7 +101,17 @@ buildPythonPackage (finalAttrs: {
   ];
 
   disabledTests =
-    lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
+    [
+      # precision issues on at least some x86_64 and aarch64
+      # see: https://github.com/scipy/scipy/issues/25488
+      "test_nyquist"
+    ]
+    ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
+      # more flakiness
+      # see: https://github.com/scipy/scipy/issues/25522
+      "test_convergence"
+    ]
+    ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
       # The following tests are broken on aarch64-darwin with newer compilers and library versions.
       # See https://github.com/scipy/scipy/issues/18308
       "test_a_b_neg_int_after_euler_hypergeometric_transformation"
diff --git a/pkgs/development/tools/analysis/tflint-plugins/tflint-ruleset-aws.nix b/pkgs/development/tools/analysis/tflint-plugins/tflint-ruleset-aws.nix
index 039114f5df18..19e3046ab7f9 100644
--- a/pkgs/development/tools/analysis/tflint-plugins/tflint-ruleset-aws.nix
+++ b/pkgs/development/tools/analysis/tflint-plugins/tflint-ruleset-aws.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "tflint-ruleset-aws";
-  version = "0.47.0";
+  version = "0.48.0";
 
   src = fetchFromGitHub {
     owner = "terraform-linters";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-QHAa8kbTZRSS5qLpX5zk4Fcal2Ah6yXv6satwfNFVLo=";
+    hash = "sha256-mcFsjn/lj2pkecI1BVaUwv8Zv11OSN+EIDYGuxrtfrQ=";
   };
 
-  vendorHash = "sha256-+FxNOrC5iYVb+PPIPTClXmnPTrm7hqT+VLrgcBHWWD4=";
+  vendorHash = "sha256-VWZkNtvlOqF6DX2duFih4nFGrxBAfeIIbtc+9hTiUJo=";
 
   postPatch = ''
     # some automation for creating new releases on GitHub, which we don't need
diff --git a/pkgs/misc/tmux-plugins/default.nix b/pkgs/misc/tmux-plugins/default.nix
index c4ae37f164e1..880c4d7f04e5 100644
--- a/pkgs/misc/tmux-plugins/default.nix
+++ b/pkgs/misc/tmux-plugins/default.nix
@@ -1363,6 +1363,25 @@ in
     };
   };
 
+  tmux-tpad = mkTmuxPlugin {
+    pluginName = "tmux-tpad";
+    rtpFilePath = "tpad.tmux";
+    version = "0.3.0";
+    src = fetchFromGitHub {
+      owner = "Subbeh";
+      repo = "tmux-tpad";
+      rev = "v0.3.0";
+      hash = "sha256-w1eNg6n5JEWcKT7hCr3nFPe01kW3PwGBx8sdtfFojvk=";
+    };
+    meta = {
+      homepage = "https://github.com/Subbeh/tmux-tpad";
+      description = "Tmux scratchpad plugin";
+      license = lib.licenses.mit;
+      platforms = lib.platforms.unix;
+      maintainers = with lib.maintainers; [ anned20 ];
+    };
+  };
+
   tmux-window-name = mkTmuxPlugin {
     pluginName = "tmux-window-name";
     version = "2024-03-08";
diff --git a/pkgs/servers/home-assistant/custom-components/gtfs-realtime/package.nix b/pkgs/servers/home-assistant/custom-components/gtfs-realtime/package.nix
index 95723865bbf0..069999fd5ada 100644
--- a/pkgs/servers/home-assistant/custom-components/gtfs-realtime/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/gtfs-realtime/package.nix
@@ -12,13 +12,13 @@
 buildHomeAssistantComponent rec {
   owner = "bcpearce";
   domain = "gtfs_realtime";
-  version = "0.4.7";
+  version = "0.4.8";
 
   src = fetchFromGitHub {
     owner = "bcpearce";
     repo = "homeassistant-gtfs-realtime";
     tag = version;
-    hash = "sha256-swqq2KY12EuDUnhnZ0zU8uIla7jvKLzvySnXU+vg/Jg=";
+    hash = "sha256-rf11yej0IsB3Og5D4n4iAsehWODJcjC930RzcGCsIT4=";
   };
 
   dependencies = [ gtfs-station-stop ];
diff --git a/pkgs/servers/home-assistant/custom-components/indego/package.nix b/pkgs/servers/home-assistant/custom-components/indego/package.nix
index bc1567546d72..a9ac46209bdb 100644
--- a/pkgs/servers/home-assistant/custom-components/indego/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/indego/package.nix
@@ -8,13 +8,13 @@
 buildHomeAssistantComponent rec {
   owner = "sander1988";
   domain = "indego";
-  version = "5.8.0";
+  version = "6.0.0";
 
   src = fetchFromGitHub {
     owner = "sander1988";
     repo = "Indego";
     tag = version;
-    hash = "sha256-yVzKHmxRWCsCcYu/HHwnEh3u9BDi3CngPk85sc/vIJo=";
+    hash = "sha256-pjkrodMFv8ZiSxmAK/JXuQbj6dfdkBf0FmhSMchTjsI=";
   };
 
   dependencies = [ pyindego ];
diff --git a/pkgs/servers/http/nginx/generic.nix b/pkgs/servers/http/nginx/generic.nix
index 019261aecfcb..217cff7cff3f 100644
--- a/pkgs/servers/http/nginx/generic.nix
+++ b/pkgs/servers/http/nginx/generic.nix
@@ -315,9 +315,9 @@ stdenv.mkDerivation {
         broken = lib.any (m: m.meta.broken or false) modules;
         platforms = lib.platforms.all;
         maintainers = with lib.maintainers; [
-          das_j
-          fpletz
           helsinki-Jo
+          ma27
+          leona
         ];
       };
 }
diff --git a/pkgs/servers/nextcloud/packages/32.json b/pkgs/servers/nextcloud/packages/32.json
index 2ac439f8d728..1f2d453165f6 100644
--- a/pkgs/servers/nextcloud/packages/32.json
+++ b/pkgs/servers/nextcloud/packages/32.json
@@ -40,9 +40,9 @@
     ]
   },
   "contacts": {
-    "hash": "sha256-F2FomaYzrpOBvD2sxKjV7prGN+INKP8eJO2t/Z0J9YE=",
-    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v8.3.13/contacts-v8.3.13.tar.gz",
-    "version": "8.3.13",
+    "hash": "sha256-+13qOi3veMZ+QUN8G78a073u8MDgMfaR3HBu6eiEWYQ=",
+    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v8.3.14/contacts-v8.3.14.tar.gz",
+    "version": "8.3.14",
     "description": "The Nextcloud contacts app is a user interface for Nextcloud's CardDAV server. Easily sync contacts from various devices with your Nextcloud and edit them online.\n\n* 🚀 **Integration with other Nextcloud apps!** Currently Mail and Calendar – more to come.\n* 🎉 **Never forget a birthday!** You can sync birthdays and other recurring events with your Nextcloud Calendar.\n* 👥 **Sharing of Adressbooks!** You want to share your contacts with your friends or coworkers? No problem!\n* 🙈 **We’re not reinventing the wheel!** Based on the great and open SabreDAV library.",
     "homepage": "https://github.com/nextcloud/contacts#readme",
     "licenses": [
@@ -70,9 +70,9 @@
     ]
   },
   "dav_push": {
-    "hash": "sha256-tSLsSgPHdpfcKPzJubwchBqQykLf9WV/mXfKKM2CSxs=",
-    "url": "https://github.com/bitfireAT/nc_ext_dav_push/releases/download/v1.0.1/dav_push.tar.gz",
-    "version": "1.0.1",
+    "hash": "sha256-OafUgG58+LsxibS/9aZjiOkdQcBV34xE6cmO9IkHMUo=",
+    "url": "https://github.com/bitfireAT/nc_ext_dav_push/releases/download/v1.0.2/dav_push.tar.gz",
+    "version": "1.0.2",
     "description": "In proprietary environments, changes in events and contacts are nowadays usually pushed to other clients so that they can update their views almost in real-time.\n\nWebDAV however (and in this context, especially CalDAV and CardDAV) doesn't currently support push notifications of clients when a collection has changed. So clients have to periodically ask the server for changes. This causes unnecessary delays and battery usage.\n\nThe WebDAV-Push standard, which is currently in development, wants to solve this problem with an open protocol, too.\n\nThis is the server part of these efforts to draft a standard and provide a working implementation (server + client) in order to demonstrate it.\n\n\nThe current WebDAV-Push draft is provided by [@bitfireAT](https://github.com/bitfireAT).\n          \nThis Nextcloud extension has been developed by [@verdigado](https://github.com/verdigado).",
     "homepage": "",
     "licenses": [
@@ -260,9 +260,9 @@
     ]
   },
   "notes": {
-    "hash": "sha256-Rdq91a2xH7JGzjBYj6D08j8EjaPndJKug7KY5Qki3UY=",
-    "url": "https://github.com/nextcloud-releases/notes/releases/download/v5.0.1/notes-v5.0.1.tar.gz",
-    "version": "5.0.1",
+    "hash": "sha256-G/npepK65ZAaF8k2ZsSsDzbd/mjGnKpdI2ixi+avf9w=",
+    "url": "https://github.com/nextcloud-releases/notes/releases/download/v5.0.2/notes-v5.0.2.tar.gz",
+    "version": "5.0.2",
     "description": "The Notes app is a distraction free notes taking app for [Nextcloud](https://www.nextcloud.com/). It provides categories for better organization and supports formatting using [Markdown](https://en.wikipedia.org/wiki/Markdown) syntax. Notes are saved as files in your Nextcloud, so you can view and edit them with every Nextcloud client. Furthermore, a separate [REST API](https://github.com/nextcloud/notes/blob/master/docs/api/README.md) allows for an easy integration into apps ([Android](https://github.com/nextcloud/notes-android), [iOS](https://github.com/nextcloud/notes-ios), as well as [3rd-party apps](https://github.com/nextcloud/notes/wiki#3rd-party-clients) which allow convenient access to your Nextcloud notes). Further features include marking notes as favorites.",
     "homepage": "https://github.com/nextcloud/notes",
     "licenses": [
@@ -320,9 +320,9 @@
     ]
   },
   "previewgenerator": {
-    "hash": "sha256-i2Z/kOEi1e3SoNj5zs3CyDHeRTAGYpuCzH5zybDQ38A=",
-    "url": "https://github.com/nextcloud-releases/previewgenerator/releases/download/v5.13.0/previewgenerator-v5.13.0.tar.gz",
-    "version": "5.13.0",
+    "hash": "sha256-ip4gqIP2ciT45zlHr7R22YCb15kawM2S1/r87b5lyoc=",
+    "url": "https://github.com/nextcloud-releases/previewgenerator/releases/download/v5.14.0/previewgenerator-v5.14.0.tar.gz",
+    "version": "5.14.0",
     "description": "The Preview Generator app allows admins to pre-generate previews. The app listens to edit events and stores this information. Once a cron job is triggered it will generate start preview generation. This means that you can better utilize your system by pre-generating previews when your system is normally idle and thus putting less load on your machine when the requests are actually served.\n\nThe app does not replace on demand preview generation so if a preview is requested before it is pre-generated it will still be shown.\nThe first time you install this app, before using a cron job, you properly want to generate all previews via:\n**occ preview:generate-all -vvv**\n\nThe preview queue will be processed automatically by a background job if the system cron background job mode is configured in Nextcloud. Additionally, you may run **occ preview:pre-generate -vvv** to a process the queue of pending previews immediately.",
     "homepage": "https://github.com/nextcloud/previewgenerator",
     "licenses": [
@@ -390,9 +390,9 @@
     ]
   },
   "spreed": {
-    "hash": "sha256-BQFS9Dq3nk+7a2HT85tIXwaEaKXEmIuycM3JEeXuSTE=",
-    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v22.0.13/spreed-v22.0.13.tar.gz",
-    "version": "22.0.13",
+    "hash": "sha256-uBvz8qpJ/PDseSDLp4aWAmTlDIOtoGWAXRouYdqU3Yc=",
+    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v22.0.14/spreed-v22.0.14.tar.gz",
+    "version": "22.0.14",
     "description": "Chat, video & audio-conferencing using WebRTC\n\n* 💬 **Chat** Nextcloud Talk comes with a simple text chat, allowing you to share or upload files from your Nextcloud Files app or local device and mention other participants.\n* 👥 **Private, group, public and password protected calls!** Invite someone, a whole group or send a public link to invite to a call.\n* 🌐 **Federated chats** Chat with other Nextcloud users on their servers\n* 💻 **Screen sharing!** Share your screen with the participants of your call.\n* 🚀 **Integration with other Nextcloud apps** like Files, Calendar, User status, Dashboard, Flow, Maps, Smart picker, Contacts, Deck, and many more.\n* 🌉 **Sync with other chat solutions** With [Matterbridge](https://github.com/42wim/matterbridge/) being integrated in Talk, you can easily sync a lot of other chat solutions to Nextcloud Talk and vice-versa.",
     "homepage": "https://github.com/nextcloud/spreed",
     "licenses": [
diff --git a/pkgs/servers/nextcloud/packages/33.json b/pkgs/servers/nextcloud/packages/33.json
index f8118f92fa10..3de3fbb4b9cb 100644
--- a/pkgs/servers/nextcloud/packages/33.json
+++ b/pkgs/servers/nextcloud/packages/33.json
@@ -40,9 +40,9 @@
     ]
   },
   "contacts": {
-    "hash": "sha256-XrXzGAJe+Zu3pon7sDbBbV73u2fKKD4fdfN24X6QdIM=",
-    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v8.7.1/contacts-v8.7.1.tar.gz",
-    "version": "8.7.1",
+    "hash": "sha256-L0ro4VoU1GDMcs1m7qGns+S8y5+n1Q0oQ5EO1ojdLr0=",
+    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v8.7.2/contacts-v8.7.2.tar.gz",
+    "version": "8.7.2",
     "description": "The Nextcloud contacts app is a user interface for Nextcloud's CardDAV server. Easily sync contacts from various devices with your Nextcloud and edit them online.\n\n* 🚀 **Integration with other Nextcloud apps!** Currently Mail and Calendar – more to come.\n* 🎉 **Never forget a birthday!** You can sync birthdays and other recurring events with your Nextcloud Calendar.\n* 👥 **Sharing of Adressbooks!** You want to share your contacts with your friends or coworkers? No problem!\n* 🙈 **We’re not reinventing the wheel!** Based on the great and open SabreDAV library.",
     "homepage": "https://github.com/nextcloud/contacts#readme",
     "licenses": [
@@ -70,9 +70,9 @@
     ]
   },
   "dav_push": {
-    "hash": "sha256-tSLsSgPHdpfcKPzJubwchBqQykLf9WV/mXfKKM2CSxs=",
-    "url": "https://github.com/bitfireAT/nc_ext_dav_push/releases/download/v1.0.1/dav_push.tar.gz",
-    "version": "1.0.1",
+    "hash": "sha256-OafUgG58+LsxibS/9aZjiOkdQcBV34xE6cmO9IkHMUo=",
+    "url": "https://github.com/bitfireAT/nc_ext_dav_push/releases/download/v1.0.2/dav_push.tar.gz",
+    "version": "1.0.2",
     "description": "In proprietary environments, changes in events and contacts are nowadays usually pushed to other clients so that they can update their views almost in real-time.\n\nWebDAV however (and in this context, especially CalDAV and CardDAV) doesn't currently support push notifications of clients when a collection has changed. So clients have to periodically ask the server for changes. This causes unnecessary delays and battery usage.\n\nThe WebDAV-Push standard, which is currently in development, wants to solve this problem with an open protocol, too.\n\nThis is the server part of these efforts to draft a standard and provide a working implementation (server + client) in order to demonstrate it.\n\n\nThe current WebDAV-Push draft is provided by [@bitfireAT](https://github.com/bitfireAT).\n          \nThis Nextcloud extension has been developed by [@verdigado](https://github.com/verdigado).",
     "homepage": "",
     "licenses": [
@@ -260,9 +260,9 @@
     ]
   },
   "notes": {
-    "hash": "sha256-xiAXy7CenYNVxgu9KvVTH3XCJjLpRqqxXv+YUsOab90=",
-    "url": "https://github.com/nextcloud-releases/notes/releases/download/v6.0.0/notes-v6.0.0.tar.gz",
-    "version": "6.0.0",
+    "hash": "sha256-/54d/UfkYLSPt8Coi4/zcheZx8mKXW34CIrvFEfYFLI=",
+    "url": "https://github.com/nextcloud-releases/notes/releases/download/v6.0.1/notes-v6.0.1.tar.gz",
+    "version": "6.0.1",
     "description": "The Notes app is a distraction free notes taking app for [Nextcloud](https://www.nextcloud.com/). It provides categories for better organization and supports formatting using [Markdown](https://en.wikipedia.org/wiki/Markdown) syntax. Notes are saved as files in your Nextcloud, so you can view and edit them with every Nextcloud client. Furthermore, a separate [REST API](https://github.com/nextcloud/notes/blob/master/docs/api/README.md) allows for an easy integration into apps ([Android](https://github.com/nextcloud/notes-android), [iOS](https://github.com/nextcloud/notes-ios), as well as [3rd-party apps](https://github.com/nextcloud/notes/wiki#3rd-party-clients) which allow convenient access to your Nextcloud notes). Further features include marking notes as favorites.",
     "homepage": "https://github.com/nextcloud/notes",
     "licenses": [
@@ -320,9 +320,9 @@
     ]
   },
   "previewgenerator": {
-    "hash": "sha256-i2Z/kOEi1e3SoNj5zs3CyDHeRTAGYpuCzH5zybDQ38A=",
-    "url": "https://github.com/nextcloud-releases/previewgenerator/releases/download/v5.13.0/previewgenerator-v5.13.0.tar.gz",
-    "version": "5.13.0",
+    "hash": "sha256-ip4gqIP2ciT45zlHr7R22YCb15kawM2S1/r87b5lyoc=",
+    "url": "https://github.com/nextcloud-releases/previewgenerator/releases/download/v5.14.0/previewgenerator-v5.14.0.tar.gz",
+    "version": "5.14.0",
     "description": "The Preview Generator app allows admins to pre-generate previews. The app listens to edit events and stores this information. Once a cron job is triggered it will generate start preview generation. This means that you can better utilize your system by pre-generating previews when your system is normally idle and thus putting less load on your machine when the requests are actually served.\n\nThe app does not replace on demand preview generation so if a preview is requested before it is pre-generated it will still be shown.\nThe first time you install this app, before using a cron job, you properly want to generate all previews via:\n**occ preview:generate-all -vvv**\n\nThe preview queue will be processed automatically by a background job if the system cron background job mode is configured in Nextcloud. Additionally, you may run **occ preview:pre-generate -vvv** to a process the queue of pending previews immediately.",
     "homepage": "https://github.com/nextcloud/previewgenerator",
     "licenses": [
@@ -390,9 +390,9 @@
     ]
   },
   "spreed": {
-    "hash": "sha256-D/S4OCkpWm9DqGZlTSfWGnVIsAWfcdlFX8mCQ6M6qjk=",
-    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v23.0.6/spreed-v23.0.6.tar.gz",
-    "version": "23.0.6",
+    "hash": "sha256-1oIezD9c7DPPGlFXfKrt/+3ohQpcD+JiKKArRXiDRYM=",
+    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v23.0.7/spreed-v23.0.7.tar.gz",
+    "version": "23.0.7",
     "description": "Chat, video & audio-conferencing using WebRTC\n\n* 💬 **Chat** Nextcloud Talk comes with a simple text chat, allowing you to share or upload files from your Nextcloud Files app or local device and mention other participants.\n* 👥 **Private, group, public and password protected calls!** Invite someone, a whole group or send a public link to invite to a call.\n* 🌐 **Federated chats** Chat with other Nextcloud users on their servers\n* 💻 **Screen sharing!** Share your screen with the participants of your call.\n* 🚀 **Integration with other Nextcloud apps** like Files, Calendar, User status, Dashboard, Flow, Maps, Smart picker, Contacts, Deck, and many more.\n* 🌉 **Sync with other chat solutions** With [Matterbridge](https://github.com/42wim/matterbridge/) being integrated in Talk, you can easily sync a lot of other chat solutions to Nextcloud Talk and vice-versa.",
     "homepage": "https://github.com/nextcloud/spreed",
     "licenses": [
diff --git a/pkgs/tools/misc/coreboot-utils/default.nix b/pkgs/tools/misc/coreboot-utils/default.nix
index 0c0969c71f1e..2299dc508689 100644
--- a/pkgs/tools/misc/coreboot-utils/default.nix
+++ b/pkgs/tools/misc/coreboot-utils/default.nix
@@ -17,7 +17,7 @@
 }:
 
 let
-  version = "26.03";
+  version = "26.06";
 
   commonMeta = {
     description = "Various coreboot-related tools";
@@ -47,7 +47,7 @@ let
         src = fetchgit {
           url = "https://review.coreboot.org/coreboot";
           rev = finalAttrs.version;
-          hash = "sha256-gaJ9AP7g0KxOzZfg1dyNatC8/pl83pypeq5Lg+Qp1ys=";
+          hash = "sha256-rL9txaDXUzjkC2ioYmunoNq2+9rz9wpEJ7z3GZrqOH4=";
         };
 
         enableParallelBuilding = true;
diff --git a/pkgs/tools/misc/tdarr/common.nix b/pkgs/tools/misc/tdarr/common.nix
index b3d7c2e51bdc..06057ded501e 100644
--- a/pkgs/tools/misc/tdarr/common.nix
+++ b/pkgs/tools/misc/tdarr/common.nix
@@ -6,7 +6,7 @@
   makeWrapper,
   copyDesktopItems,
   makeDesktopItem,
-  ffmpeg,
+  jellyfin-ffmpeg,
   handbrake,
   mkvtoolnix,
   ccextractor,
@@ -24,6 +24,7 @@
   tesseract4,
   perl,
   apprise,
+  openssl,
 }:
 {
   pname,
@@ -51,7 +52,7 @@ let
 
   binPath = lib.makeBinPath (
     [
-      ffmpeg
+      jellyfin-ffmpeg
       mkvtoolnix
     ]
     ++ includeInPath
@@ -77,10 +78,10 @@ let
       ''_cfg="$rootDataPath/configs/${componentName}_Config.json"; if [ -f "$_cfg" ]; then grep -q ffprobePath "$_cfg" || sed -i '1s/{/{"ffprobePath":"",/' "$_cfg"; else printf '{"ffprobePath":""}' > "$_cfg"; fi''
       "--set-default"
       "ffmpegPath"
-      "${ffmpeg}/bin/ffmpeg"
+      "${jellyfin-ffmpeg}/bin/ffmpeg"
       "--set-default"
       "ffprobePath"
-      "${ffmpeg}/bin/ffprobe"
+      "${jellyfin-ffmpeg}/bin/ffprobe"
       "--set-default"
       "mkvpropeditPath"
       "${mkvtoolnix}/bin/mkvpropedit"
@@ -100,7 +101,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   inherit pname;
-  version = "2.78.01";
+  version = "2.81.01";
 
   src = fetchzip {
     url = "https://storage.tdarr.io/versions/${finalAttrs.version}/${platform}/${componentName}.zip";
@@ -129,6 +130,7 @@ stdenv.mkDerivation (finalAttrs: {
     libxcursor
     libxfixes
     apprise
+    openssl
   ];
 
   postPatch = ''
diff --git a/pkgs/tools/misc/tdarr/node.nix b/pkgs/tools/misc/tdarr/node.nix
index eefa4530f5d3..f6b14934763f 100644
--- a/pkgs/tools/misc/tdarr/node.nix
+++ b/pkgs/tools/misc/tdarr/node.nix
@@ -5,10 +5,10 @@ callPackage ./common.nix { } {
   component = "node";
 
   hashes = {
-    linux_x64 = "sha256-5wxf5E1M1bBXrv8/cBUZ7Edg90TnxY6UeXZpmkyJC0U=";
-    linux_arm64 = "sha256-jnrXHv5/u9YaMCwKy5QzcilRdEE60PQtTTMhoVsMGKw=";
-    darwin_x64 = "sha256-Ri4lop0XyE2oFUn74ZIx1UMhf/wVILnlwlRlIHzwr/A=";
-    darwin_arm64 = "sha256-ZSMsngeJM6QX0Z0J0ARH8Jo7NcH3CMwn9/Rk11VU3k8=";
+    linux_x64 = "sha256-hF4W72VEWAryCoLZecrwdT98iN3sARaPWJnEApFeHCw=";
+    linux_arm64 = "sha256-wJ3fZLJKUHama1P6YTslTb3fiYI4qjGm5VdHKGcG8k4=";
+    darwin_x64 = "sha256-cL6REyGqwFemXLMkgAXy9PTS0j7maT1lBNzckTL4Ez0=";
+    darwin_arm64 = "sha256-0LFTw4fbdFXcEYGVk1C1UOVRAh/MfGctFzfKB/mr6lM=";
   };
 
   includeInPath = [ ccextractor ];
diff --git a/pkgs/tools/misc/tdarr/server.nix b/pkgs/tools/misc/tdarr/server.nix
index b07c443c2176..5da81ebb81c6 100644
--- a/pkgs/tools/misc/tdarr/server.nix
+++ b/pkgs/tools/misc/tdarr/server.nix
@@ -5,10 +5,10 @@ callPackage ./common.nix { } {
   component = "server";
 
   hashes = {
-    linux_x64 = "sha256-biFiDQNDbPtqWHMi0JkuYGaX+Y9aNoXdYd+WwILJ3lo=";
-    linux_arm64 = "sha256-KmG2hHiR7aKDS2qJ/fN8T3pppt6wNaVp4ZGaanxqPYU=";
-    darwin_x64 = "sha256-buDJ2OnjjYSZi/vwPL35TYTYdJq7Xg9VckCP/DSpNEU=";
-    darwin_arm64 = "sha256-CDuajhnC/KdyCqtHmqV1oXmXmqU6RksQc/VVJtc0p10=";
+    linux_x64 = "sha256-iTxbPJ1XmmGInpCz4cbwnW8u5uV3DpMyXGMuKmGXOlc=";
+    linux_arm64 = "sha256-G3jK5pqKMKiciajaMku9S/q7upWcxmfXwZQ1tWhGaDg=";
+    darwin_x64 = "sha256-xnOI47sMZlTJNkTFrQCsioLQsjeOCVu1RZLgpoiRhTU=";
+    darwin_arm64 = "sha256-wRuTyUmRWYEMMCgScr+yTbsU1VSXypz9T8WhgyZE2TM=";
   };
 
   includeInPath = [ ccextractor ];
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index dbc7b7f19438..5e95fa15ab10 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -611,6 +611,8 @@ mapAliases {
   cudaPackages_12_3 = throw "CUDA 12.3 has been removed from Nixpkgs, as it is unmaintained upstream and depends on unsupported compilers"; # Added 2025-08-08
   cudaPackages_12_4 = throw "CUDA 12.4 has been removed from Nixpkgs, as it is unmaintained upstream and depends on unsupported compilers"; # Added 2025-08-08
   cudaPackages_12_5 = throw "CUDA 12.5 has been removed from Nixpkgs, as it is unmaintained upstream and depends on unsupported compilers"; # Added 2025-08-08
+  cup-docker = throw "'cup-docker' has been removed, due to being orphaned and packaged in an unreproducible manner"; # Added 2026-06-27
+  cup-docker-noserver = throw "'cup-docker-noserver' has been removed, due to being orphaned and packaged in an unreproducible manner"; # Added 2026-06-27
   cups-kyodialog3 = throw "'cups-kyodialog3' has been renamed to/replaced by 'cups-kyodialog'"; # Converted to throw 2025-10-27
   cura = throw "'cura' has been removed, as it was unmaintained in nixpkgs"; # Added 2026-05-22
   curaengine = throw "'curaengine' has been removed, as it was unmaintained in nixpkgs"; # Added 2026-05-22