diff --git a/pkgs/applications/editors/vscode/generic.nix b/pkgs/applications/editors/vscode/generic.nix
index 93329c9c52de..706924fa87b2 100644
--- a/pkgs/applications/editors/vscode/generic.nix
+++ b/pkgs/applications/editors/vscode/generic.nix
@@ -376,7 +376,7 @@ stdenv.mkDerivation (
           )
         }
         --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true --wayland-text-input-version=3}}"
-        --add-flags ${lib.escapeShellArg commandLineArgs}
+        --append-flags ${lib.escapeShellArg commandLineArgs}
       )
     '';
 
diff --git a/pkgs/applications/gis/qgis/unwrapped-ltr.nix b/pkgs/applications/gis/qgis/unwrapped-ltr.nix
index ee4d1b5a6364..5096d3568716 100644
--- a/pkgs/applications/gis/qgis/unwrapped-ltr.nix
+++ b/pkgs/applications/gis/qgis/unwrapped-ltr.nix
@@ -85,7 +85,7 @@ let
   ];
 in
 mkDerivation rec {
-  version = "3.44.10";
+  version = "3.44.11";
   pname = "qgis-ltr-unwrapped";
   outputs = [ "out" ] ++ lib.optional (!stdenv.hostPlatform.isDarwin) "man";
 
@@ -93,7 +93,7 @@ mkDerivation rec {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-wWLbnZpLIchm0NXuU7jEXCBctrI6G1z8iqf9R2YhS8Y=";
+    hash = "sha256-gWSl9OrRSxreQdKxKKDCOUWBE5uE2w3/ebW266LCWLI=";
   };
 
   passthru = {
diff --git a/pkgs/by-name/ap/apache-airflow/python-package.nix b/pkgs/by-name/ap/apache-airflow/python-package.nix
index 5dba14a2e683..e3cc15913a6f 100644
--- a/pkgs/by-name/ap/apache-airflow/python-package.nix
+++ b/pkgs/by-name/ap/apache-airflow/python-package.nix
@@ -88,355 +88,353 @@
 
   enabledProviders,
 }:
-let
-  version = "3.2.2";
+buildPythonPackage (
+  finalAttrs:
+  let
+    inherit (finalAttrs) src version;
 
-  src = fetchFromGitHub {
-    owner = "apache";
-    repo = "airflow";
-    tag = version;
-    hash = "sha256-nAFSLdcKmP2CNm3rx+/fwIsJnpju7wBl+fYWQV8p+sU=";
-  };
+    airflowUi = stdenv.mkDerivation (uiAttrs: {
+      pname = "airflow-ui-assets";
+      inherit src version;
+      sourceRoot = "${src.name}/airflow-core/src/airflow/ui";
 
-  pnpm = pnpm_10;
+      # vite build resolves "localhost" during the build, which the darwin
+      # sandbox blocks by default (getaddrinfo ENOTFOUND localhost).
+      __darwinAllowLocalNetworking = stdenv.hostPlatform.isDarwin;
 
-  airflowUi = stdenv.mkDerivation rec {
-    pname = "airflow-ui-assets";
-    inherit src version;
-    sourceRoot = "${src.name}/airflow-core/src/airflow/ui";
+      nativeBuildInputs = [
+        nodejs
+        pnpm_10
+        pnpmConfigHook
+      ];
 
-    # vite build resolves "localhost" during the build, which the darwin
-    # sandbox blocks by default (getaddrinfo ENOTFOUND localhost).
-    __darwinAllowLocalNetworking = stdenv.hostPlatform.isDarwin;
+      pnpmDeps = fetchPnpmDeps {
+        pname = "airflow-ui";
+        inherit src version;
+        pnpm = pnpm_10;
+        sourceRoot = uiAttrs.sourceRoot;
+        fetcherVersion = 3;
+        hash = "sha256-wJ2u+y3umecL4IeVW/29/yDgYZ77ffOBQLHeplD3XlQ=";
+      };
 
-    nativeBuildInputs = [
-      nodejs
-      pnpm
-      pnpmConfigHook
+      buildPhase = ''
+        pnpm install
+        pnpm build
+      '';
+
+      installPhase = ''
+        mkdir -p $out/share/airflow/ui
+        cp -r dist $out/share/airflow/ui/
+      '';
+    });
+
+    airflowSimpleAuthUi = stdenv.mkDerivation (simpleUiAttrs: {
+      pname = "airflow-simple-ui-assets";
+      inherit src version;
+      sourceRoot = "${src.name}/airflow-core/src/airflow/api_fastapi/auth/managers/simple/ui";
+
+      __darwinAllowLocalNetworking = stdenv.hostPlatform.isDarwin;
+
+      nativeBuildInputs = [
+        nodejs
+        pnpm_10
+        pnpmConfigHook
+      ];
+
+      pnpmDeps = fetchPnpmDeps {
+        pname = "simple-auth-manager-ui";
+        inherit src version;
+        pnpm = pnpm_10;
+        sourceRoot = simpleUiAttrs.sourceRoot;
+        fetcherVersion = 3;
+        hash = "sha256-AKaafmDjIlg4eFJT1JGyelXVjcId8f0iXTR3JK4ZMq0=";
+      };
+
+      buildPhase = ''
+        pnpm install
+        pnpm build
+      '';
+
+      installPhase = ''
+        mkdir -p $out/share/airflow/simple-ui
+        cp -r dist $out/share/airflow/simple-ui/
+      '';
+    });
+
+    requiredProviders = [
+      "common_compat"
+      "common_io"
+      "common_sql"
+      "smtp"
+      "standard"
     ];
 
-    pnpmDeps = fetchPnpmDeps {
-      pname = "airflow-ui";
-      inherit
-        sourceRoot
-        src
-        version
-        pnpm
-        ;
-      fetcherVersion = 3;
-      hash = "sha256-wJ2u+y3umecL4IeVW/29/yDgYZ77ffOBQLHeplD3XlQ=";
-    };
+    providers = import ./providers.nix;
 
-    buildPhase = ''
-      pnpm install
-      pnpm build
-    '';
+    buildProvider =
+      provider:
+      buildPythonPackage {
+        pname = "apache-airflow-providers-${provider}";
+        version = providers.${provider}.version;
+        pyproject = true;
 
-    installPhase = ''
-      mkdir -p $out/share/airflow/ui
-      cp -r dist $out/share/airflow/ui/
-    '';
-  };
+        inherit src;
+        sourceRoot = "${src.name}/providers/${lib.replaceStrings [ "_" ] [ "/" ] provider}";
 
-  airflowSimpleAuthUi = stdenv.mkDerivation rec {
-    pname = "airflow-simple-ui-assets";
-    inherit src version;
-    sourceRoot = "${src.name}/airflow-core/src/airflow/api_fastapi/auth/managers/simple/ui";
+        buildInputs = [ flit-core ];
 
-    __darwinAllowLocalNetworking = stdenv.hostPlatform.isDarwin;
+        dependencies = map (dep: python.pkgs.${dep}) providers.${provider}.deps;
 
-    nativeBuildInputs = [
-      nodejs
-      pnpm
-      pnpmConfigHook
-    ];
+        pythonRemoveDeps = [
+          "apache-airflow"
+        ];
 
-    pnpmDeps = fetchPnpmDeps {
-      pname = "simple-auth-manager-ui";
-      inherit
-        sourceRoot
-        src
-        version
-        pnpm
-        ;
-      fetcherVersion = 3;
-      hash = "sha256-AKaafmDjIlg4eFJT1JGyelXVjcId8f0iXTR3JK4ZMq0=";
-    };
+        pythonRelaxDeps = [
+          "flit-core"
+        ];
+      };
 
-    buildPhase = ''
-      pnpm install
-      pnpm build
-    '';
-
-    installPhase = ''
-      mkdir -p $out/share/airflow/simple-ui
-      cp -r dist $out/share/airflow/simple-ui/
-    '';
-  };
-
-  requiredProviders = [
-    "common_compat"
-    "common_io"
-    "common_sql"
-    "smtp"
-    "standard"
-  ];
-
-  providers = import ./providers.nix;
-
-  buildProvider =
-    provider:
-    buildPythonPackage {
-      pname = "apache-airflow-providers-${provider}";
-      version = providers.${provider}.version;
+    taskSdk = buildPythonPackage {
+      pname = "task-sdk";
+      inherit src version;
       pyproject = true;
 
-      inherit src;
-      sourceRoot = "${src.name}/providers/${lib.replaceStrings [ "_" ] [ "/" ] provider}";
+      sourceRoot = "${src.name}/task-sdk";
 
-      buildInputs = [ flit-core ];
+      postPatch = ''
+        # resolve cyclic dependency
+        sed -i -E 's/"apache-airflow-core[^"]+",//' pyproject.toml
 
-      dependencies = map (dep: python.pkgs.${dep}) providers.${provider}.deps;
+        # relax dependencies
+        sed -i -E 's/"hatchling==[^"]+"/"hatchling"/' pyproject.toml
+        sed -i -E 's/"packaging==[^"]+"/"packaging"/' pyproject.toml
+        sed -i -E 's/"trove-classifiers==[^"]+"/"trove-classifiers"/' pyproject.toml
+        sed -i -E 's/"pathspec==[^"]+"/"pathspec"/' pyproject.toml
 
-      pythonRemoveDeps = [
-        "apache-airflow"
+        # task-sdk needs config.yml from core subpackage
+        mkdir -p src/airflow/config_templates
+        cp ../airflow-core/src/airflow/config_templates/* src/airflow/config_templates/
+      '';
+
+      build-system = [
+        hatchling
       ];
 
-      pythonRelaxDeps = [
-        "flit-core"
+      dependencies = [
+        asgiref
+        attrs
+        babel
+        colorlog
+        fsspec
+        greenback
+        httpx
+        jinja2
+        jsonschema
+        methodtools
+        msgspec
+        pendulum
+        psutil
+        pydantic
+        pygtrie
+        python-dateutil
+        requests
+        retryhttp
+        structlog
+        tenacity
+        types-requests
       ];
     };
 
-  airflowCore = buildPythonPackage {
-    pname = "apache-airflow-core";
-    inherit src version;
+    airflowCore = buildPythonPackage {
+      pname = "apache-airflow-core";
+      inherit src version;
+      pyproject = true;
+
+      sourceRoot = "${src.name}/airflow-core";
+
+      postPatch = ''
+        # remove cyclic dependency
+        sed -i -E 's/"apache-airflow-task-sdk[^"]+",//' pyproject.toml
+
+        # relax dependencies
+        sed -i -E 's/"hatchling==[^"]+"/"hatchling"/' pyproject.toml
+        sed -i -E 's/"packaging==[^"]+"/"packaging"/' pyproject.toml
+        sed -i -E 's/"GitPython==[^"]+"/"GitPython"/' pyproject.toml
+        sed -i -E 's/"trove-classifiers==[^"]+"/"trove-classifiers"/' pyproject.toml
+        sed -i -E 's/"smmap==[^"]+"/"smmap"/' pyproject.toml
+        sed -i -E 's/"pathspec==[^"]+"/"pathspec"/' pyproject.toml
+
+        # Copy built UI assets
+        cp -r ${airflowUi}/share/airflow/ui/dist src/airflow/ui/
+        cp -r ${airflowSimpleAuthUi}/share/airflow/simple-ui/dist src/airflow/api_fastapi/auth/managers/simple/ui/
+      '';
+
+      build-system = [
+        gitdb
+        gitpython
+        hatchling
+        packaging
+        smmap
+        tomli
+        trove-classifiers
+      ];
+
+      dependencies = [
+        a2wsgi
+        aiosqlite
+        alembic
+        argcomplete
+        asgiref
+        attrs
+        cachetools
+        cadwyn
+        colorlog
+        cron-descriptor
+        croniter
+        cryptography
+        deprecated
+        dill
+        fastapi
+        httpx
+        importlib-metadata
+        itsdangerous
+        jinja2
+        jsonschema
+        lazy-object-proxy
+        libcst
+        linkify-it-py
+        lockfile
+        methodtools
+        msgspec
+        natsort
+        opentelemetry-api
+        opentelemetry-exporter-otlp
+        packaging
+        pathspec
+        pendulum
+        pluggy
+        psutil
+        pydantic
+        pygments
+        pygtrie
+        pyjwt
+        python-daemon
+        python-dateutil
+        python-slugify
+        pyyaml
+        requests
+        rich
+        rich-argparse
+        rich-click
+        setproctitle
+        sqlalchemy
+        sqlalchemy-jsonfield
+        sqlalchemy-utils
+        starlette
+        structlog
+        svcs
+        tabulate
+        taskSdk
+        tenacity
+        termcolor
+        typing-extensions
+        universal-pathlib
+        uuid6
+        uvicorn
+      ]
+      ++ (map buildProvider requiredProviders);
+
+      pythonRelaxDeps = [ "starlette" ];
+    };
+  in
+  {
+    pname = "apache-airflow";
+    version = "3.2.2";
+
+    strictDeps = true;
+    __structuredAttrs = true;
+
+    src = fetchFromGitHub {
+      owner = "apache";
+      repo = "airflow";
+      tag = finalAttrs.version;
+      hash = "sha256-nAFSLdcKmP2CNm3rx+/fwIsJnpju7wBl+fYWQV8p+sU=";
+    };
+
     pyproject = true;
 
-    sourceRoot = "${src.name}/airflow-core";
-
     postPatch = ''
-      # remove cyclic dependency
-      sed -i -E 's/"apache-airflow-task-sdk[^"]+",//' pyproject.toml
-
       # relax dependencies
       sed -i -E 's/"hatchling==[^"]+"/"hatchling"/' pyproject.toml
       sed -i -E 's/"packaging==[^"]+"/"packaging"/' pyproject.toml
-      sed -i -E 's/"GitPython==[^"]+"/"GitPython"/' pyproject.toml
       sed -i -E 's/"trove-classifiers==[^"]+"/"trove-classifiers"/' pyproject.toml
-      sed -i -E 's/"smmap==[^"]+"/"smmap"/' pyproject.toml
       sed -i -E 's/"pathspec==[^"]+"/"pathspec"/' pyproject.toml
-
-      # Copy built UI assets
-      cp -r ${airflowUi}/share/airflow/ui/dist src/airflow/ui/
-      cp -r ${airflowSimpleAuthUi}/share/airflow/simple-ui/dist src/airflow/api_fastapi/auth/managers/simple/ui/
     '';
 
+    nativeBuildInputs = [ writableTmpDirAsHomeHook ];
+
     build-system = [
       gitdb
       gitpython
       hatchling
       packaging
+      pathspec
+      pluggy
       smmap
       tomli
       trove-classifiers
     ];
 
     dependencies = [
-      a2wsgi
-      aiosqlite
-      alembic
-      argcomplete
-      asgiref
-      attrs
-      cachetools
-      cadwyn
-      colorlog
-      cron-descriptor
-      croniter
-      cryptography
-      deprecated
-      dill
-      fastapi
-      httpx
-      importlib-metadata
-      itsdangerous
-      jinja2
-      jsonschema
-      lazy-object-proxy
-      libcst
-      linkify-it-py
-      lockfile
-      methodtools
-      msgspec
-      natsort
-      opentelemetry-api
-      opentelemetry-exporter-otlp
-      packaging
-      pathspec
-      pendulum
-      pluggy
-      psutil
-      pydantic
-      pygments
-      pygtrie
-      pyjwt
-      python-daemon
-      python-dateutil
-      python-slugify
-      pyyaml
-      requests
-      rich
-      rich-argparse
-      rich-click
-      setproctitle
-      sqlalchemy
-      sqlalchemy-jsonfield
-      sqlalchemy-utils
-      starlette
-      structlog
-      svcs
-      tabulate
-      taskSdk
-      tenacity
-      termcolor
-      typing-extensions
-      universal-pathlib
-      uuid6
-      uvicorn
+      airflowCore # subpackage from airflow src
+      taskSdk # subpackage from airflow src
     ]
-    ++ (map buildProvider requiredProviders);
+    ++ (map buildProvider enabledProviders);
 
-    pythonRelaxDeps = [ "starlette" ];
-  };
-
-  taskSdk = buildPythonPackage {
-    pname = "task-sdk";
-    inherit src version;
-    pyproject = true;
-
-    sourceRoot = "${src.name}/task-sdk";
-
-    postPatch = ''
-      # resolve cyclic dependency
-      sed -i -E 's/"apache-airflow-core[^"]+",//' pyproject.toml
-
-      # relax dependencies
-      sed -i -E 's/"hatchling==[^"]+"/"hatchling"/' pyproject.toml
-      sed -i -E 's/"packaging==[^"]+"/"packaging"/' pyproject.toml
-      sed -i -E 's/"trove-classifiers==[^"]+"/"trove-classifiers"/' pyproject.toml
-      sed -i -E 's/"pathspec==[^"]+"/"pathspec"/' pyproject.toml
-
-      # task-sdk needs config.yml from core subpackage
-      mkdir -p src/airflow/config_templates
-      cp ../airflow-core/src/airflow/config_templates/* src/airflow/config_templates/
+    postInstall = ''
+      # Create a symlink to the airflow-core package
+      mkdir -p $out/bin
+      ln -s ${airflowCore}/bin/airflow $out/bin/airflow
     '';
 
-    build-system = [
-      hatchling
-    ];
+    installCheckPhase = ''
+      runHook preInstallCheck
 
-    dependencies = [
-      asgiref
-      attrs
-      babel
-      colorlog
-      fsspec
-      greenback
-      httpx
-      jinja2
-      jsonschema
-      methodtools
-      msgspec
-      pendulum
-      psutil
-      pydantic
-      pygtrie
-      python-dateutil
-      requests
-      retryhttp
-      structlog
-      tenacity
-      types-requests
-    ];
-  };
+      $out/bin/airflow version
+      $out/bin/airflow db reset -y
 
-in
-buildPythonPackage rec {
-  pname = "apache-airflow";
-  inherit src version;
-  pyproject = true;
+      runHook postInstallCheck
+    '';
 
-  postPatch = ''
-    # relax dependencies
-    sed -i -E 's/"hatchling==[^"]+"/"hatchling"/' pyproject.toml
-    sed -i -E 's/"packaging==[^"]+"/"packaging"/' pyproject.toml
-    sed -i -E 's/"trove-classifiers==[^"]+"/"trove-classifiers"/' pyproject.toml
-    sed -i -E 's/"pathspec==[^"]+"/"pathspec"/' pyproject.toml
-  '';
+    pythonImportsCheck = [
+      "airflow"
+    ]
+    ++ lib.concatMap (provider: providers.${provider}.imports) (requiredProviders ++ enabledProviders);
 
-  nativeBuildInputs = [ writableTmpDirAsHomeHook ];
+    passthru.updateScript = ./update.sh;
+    passthru.airflowUi = airflowUi;
+    passthru.airflowSimpleAuthUi = airflowSimpleAuthUi;
 
-  build-system = [
-    gitdb
-    gitpython
-    hatchling
-    packaging
-    pathspec
-    pluggy
-    smmap
-    tomli
-    trove-classifiers
-  ];
+    # Note on testing the web UI:
+    # You can (manually) test the web UI as follows:
+    #
+    #   nix shell .#apache-airflow
+    #   airflow version
+    #   airflow db reset  # WARNING: this will wipe any existing db state you might have!
+    #   airflow standalone
+    #
+    # Then navigate to the localhost URL using the credentials printed, try
+    # triggering the 'example_bash_operator' DAG and see if it reports success.
 
-  dependencies = [
-    airflowCore # subpackage from airflow src
-    taskSdk # subpackage from airflow src
-  ]
-  ++ (map buildProvider enabledProviders);
-
-  postInstall = ''
-    # Create a symlink to the airflow-core package
-    mkdir -p $out/bin
-    ln -s ${airflowCore}/bin/airflow $out/bin/airflow
-  '';
-
-  installCheckPhase = ''
-    runHook preInstallCheck
-
-    $out/bin/airflow version
-    $out/bin/airflow db reset -y
-
-    runHook postInstallCheck
-  '';
-
-  pythonImportsCheck = [
-    "airflow"
-  ]
-  ++ lib.concatMap (provider: providers.${provider}.imports) (requiredProviders ++ enabledProviders);
-
-  passthru.updateScript = ./update.sh;
-  passthru.airflowUi = airflowUi;
-  passthru.airflowSimpleAuthUi = airflowSimpleAuthUi;
-
-  # Note on testing the web UI:
-  # You can (manually) test the web UI as follows:
-  #
-  #   nix shell .#apache-airflow
-  #   airflow version
-  #   airflow db reset  # WARNING: this will wipe any existing db state you might have!
-  #   airflow standalone
-  #
-  # Then navigate to the localhost URL using the credentials printed, try
-  # triggering the 'example_bash_operator' DAG and see if it reports success.
-
-  meta = {
-    description = "Platform to programmatically author, schedule and monitor workflows";
-    homepage = "https://airflow.apache.org/";
-    changelog = "https://airflow.apache.org/docs/apache-airflow/${version}/release_notes.html";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [
-      taranarmo
-    ];
-    mainProgram = "airflow";
-  };
-}
+    meta = {
+      description = "Platform to programmatically author, schedule and monitor workflows";
+      homepage = "https://airflow.apache.org/";
+      changelog = "https://airflow.apache.org/docs/apache-airflow/${finalAttrs.version}/release_notes.html";
+      license = lib.licenses.asl20;
+      maintainers = with lib.maintainers; [
+        taranarmo
+      ];
+      mainProgram = "airflow";
+    };
+  }
+)
diff --git a/pkgs/by-name/aw/aws-lc/package.nix b/pkgs/by-name/aw/aws-lc/package.nix
index 82c9506c9ca5..1a41182017bd 100644
--- a/pkgs/by-name/aw/aws-lc/package.nix
+++ b/pkgs/by-name/aw/aws-lc/package.nix
@@ -11,13 +11,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "aws-lc";
-  version = "1.69.0";
+  version = "5.0.0";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-lc";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ykpPbMONAJK6rEANOn0O7JfIkXPSoPXs1Zr4Bv+eXqQ=";
+    hash = "sha256-Dvy6mzEfKgimxCGp7q2fPk9urBMJMU6gZmaZXwdZfWw=";
   };
 
   outputs = [
@@ -47,6 +47,11 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postCheck
   '';
 
+  postInstall = ''
+    moveToOutput lib/crypto/cmake "$dev"
+    moveToOutput lib/ssl/cmake "$dev"
+  '';
+
   env.NIX_CFLAGS_COMPILE = toString (
     lib.optionals stdenv.cc.isGNU [
       # Needed with GCC 12 but breaks on darwin (with clang)
diff --git a/pkgs/by-name/bl/blackfire/package.nix b/pkgs/by-name/bl/blackfire/package.nix
index 923a0e46d950..0652939fdc29 100644
--- a/pkgs/by-name/bl/blackfire/package.nix
+++ b/pkgs/by-name/bl/blackfire/package.nix
@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation rec {
   pname = "blackfire";
-  version = "2.29.7";
+  version = "2026.6.0";
 
   src =
     passthru.sources.${stdenv.hostPlatform.system}
@@ -60,23 +60,23 @@ stdenv.mkDerivation rec {
     sources = {
       "x86_64-linux" = fetchurl {
         url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire/blackfire_${version}_amd64.deb";
-        sha256 = "47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=";
+        hash = "sha256-JPhh7LNiLZXLN5iycNobZ/uJQjOhKqqYSw9P78+/BKk=";
       };
       "i686-linux" = fetchurl {
         url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire/blackfire_${version}_i386.deb";
-        sha256 = "47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=";
+        hash = "sha256-uoqUDJ/bexqaRlf5Y692OGm91W1ErlS8Q8/l9MlsHwU=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire/blackfire_${version}_arm64.deb";
-        sha256 = "47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=";
+        hash = "sha256-kL9s17Bnt8UYj3IiX2b7e3OWSsRLq5TSzdK6OdByD40=";
       };
       "aarch64-darwin" = fetchurl {
         url = "https://packages.blackfire.io/blackfire/${version}/blackfire-darwin_arm64.pkg.tar.gz";
-        sha256 = "TvxIm4plE7nnTIkJNfCzxzr2r0B2Aqlxdveb1M+sqL4=";
+        hash = "sha256-p9D87uaDVu25SG4cclmzaq9oKaFDlIy8/XLx3rHuIQ4=";
       };
       "x86_64-darwin" = fetchurl {
         url = "https://packages.blackfire.io/blackfire/${version}/blackfire-darwin_amd64.pkg.tar.gz";
-        sha256 = "oNDNIPBqvaARz9W967bxuvo2bpPORiHci3sryGqznsU=";
+        hash = "sha256-ppCSvk259NNlujl9olyRlmwRdNbLu/uRs+gq71S79B8=";
       };
     };
 
diff --git a/pkgs/by-name/cp/cpufetch/darwin-x86-sysctl.patch b/pkgs/by-name/cp/cpufetch/darwin-x86-sysctl.patch
new file mode 100644
index 000000000000..a5644516fd5c
--- /dev/null
+++ b/pkgs/by-name/cp/cpufetch/darwin-x86-sysctl.patch
@@ -0,0 +1,11 @@
+--- a/Makefile
++++ b/Makefile
+@@ -30,7 +30,7 @@
+ 			HEADERS += $(SRC_DIR)freq/freq.h
+ 			CFLAGS += -pthread
+ 		endif
+-		ifeq ($(os), FreeBSD)
++		ifneq (,$(filter $(os),FreeBSD Darwin))
+ 			SOURCE += $(SRC_COMMON)sysctl.c
+ 			HEADERS += $(SRC_COMMON)sysctl.h
+ 		endif
diff --git a/pkgs/by-name/cp/cpufetch/package.nix b/pkgs/by-name/cp/cpufetch/package.nix
index 9ccd5a422957..cd046f27b87a 100644
--- a/pkgs/by-name/cp/cpufetch/package.nix
+++ b/pkgs/by-name/cp/cpufetch/package.nix
@@ -20,6 +20,15 @@ stdenv.mkDerivation (finalAttrs: {
     installShellFiles
   ];
 
+  # Upstream Makefile bug: for x86 builds, sysctl.c is only added to
+  # SOURCE on FreeBSD even though cpuid.c calls get_sys_info_by_name
+  # (defined there) on darwin too. Without this the x86_64-darwin
+  # build fails to link with "Undefined symbols: _get_sys_info_by_name".
+  # Widen the conditional to cover Darwin alongside FreeBSD.
+  patches = lib.optionals stdenv.hostPlatform.isDarwin [
+    ./darwin-x86-sysctl.patch
+  ];
+
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/by-name/da/dashy-ui/package.nix b/pkgs/by-name/da/dashy-ui/package.nix
index dd69197b546b..5ec288bb0bec 100644
--- a/pkgs/by-name/da/dashy-ui/package.nix
+++ b/pkgs/by-name/da/dashy-ui/package.nix
@@ -17,16 +17,16 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "dashy-ui";
-  version = "4.2.2";
+  version = "4.3.3";
   src = fetchFromGitHub {
     owner = "lissy93";
     repo = "dashy";
     tag = finalAttrs.version;
-    hash = "sha256-8oShyf4TfHjPG/yxK1sbZA5gHyqOQYqfoUEDQlaJgU0=";
+    hash = "sha256-3uzitxmaFKWrB8NOEFs2eEOqqYDW9R8pH1VAMEutBKU=";
   };
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-5a2ypu6A4WOGdcm6HlvuzuCEgq3szd64zqTp/rmnjh4=";
+    hash = "sha256-5yYaOZk/SiR5vvM860JQkH3/TjVOFMnqwRlxxziKMr8=";
   };
 
   passthru = {
diff --git a/pkgs/by-name/dp/dprint/plugins/dprint-plugin-biome.nix b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-biome.nix
index 50b3d16f8e1e..667d62e97ce6 100644
--- a/pkgs/by-name/dp/dprint/plugins/dprint-plugin-biome.nix
+++ b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-biome.nix
@@ -1,7 +1,7 @@
 { mkDprintPlugin }:
 mkDprintPlugin {
   description = "Biome (JS/TS/JSON) wrapper plugin";
-  hash = "sha256-0zbtVqdL86r69ahRS61qJ2r7qUtRzfY1qO1FL+SWt+g=";
+  hash = "sha256-HX4IOjLOGiqacEPdoaGy6QWq7Va1SEOk0J7+U5Rz2QM=";
   initConfig = {
     configExcludes = [ "**/node_modules" ];
     configKey = "biome";
@@ -17,6 +17,6 @@ mkDprintPlugin {
   };
   pname = "dprint-plugin-biome";
   updateUrl = "https://plugins.dprint.dev/dprint/biome/latest.json";
-  url = "https://plugins.dprint.dev/biome-0.12.12.wasm";
-  version = "0.12.12";
+  url = "https://plugins.dprint.dev/biome-0.13.0.wasm";
+  version = "0.13.0";
 }
diff --git a/pkgs/by-name/dr/drafting-mono/package.nix b/pkgs/by-name/dr/drafting-mono/package.nix
index a08f50c5eb13..39a2745cc21f 100644
--- a/pkgs/by-name/dr/drafting-mono/package.nix
+++ b/pkgs/by-name/dr/drafting-mono/package.nix
@@ -2,11 +2,18 @@
   lib,
   stdenvNoCC,
   fetchFromGitHub,
+  installFonts,
 }:
+
 stdenvNoCC.mkDerivation {
   pname = "drafting-mono";
   version = "1.1-unstable-2024-06-04";
 
+  outputs = [
+    "out"
+    "webfont"
+  ];
+
   src = fetchFromGitHub {
     owner = "indestructible-type";
     repo = "Drafting";
@@ -14,14 +21,7 @@ stdenvNoCC.mkDerivation {
     hash = "sha256-J64mmDOzTV4MRuZO3MB2SSX5agCRjLDjXAPXuDfdlOM=";
   };
 
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/share/fonts/truetype
-    cp fonts/*/*.otf $out/share/fonts/truetype
-
-    runHook postInstall
-  '';
+  nativeBuildInputs = [ installFonts ];
 
   meta = {
     homepage = "https://indestructibletype.com/Drafting/";
diff --git a/pkgs/by-name/dx/dxmt/package.nix b/pkgs/by-name/dx/dxmt/package.nix
new file mode 100644
index 000000000000..2545292cb01b
--- /dev/null
+++ b/pkgs/by-name/dx/dxmt/package.nix
@@ -0,0 +1,132 @@
+{
+  lib,
+  stdenv,
+  pkgsCross,
+  fetchFromGitHub,
+  buildPackages,
+  cmake,
+  git,
+  python3,
+  meson,
+  ninja,
+  tinyxxd,
+  sqlite,
+  libz,
+  ncurses,
+  libxml2,
+  wine64,
+  darwin,
+  symlinkJoin,
+}:
+let
+  dxmt-llvm = stdenv.mkDerivation rec {
+    pname = "dxmt-llvm";
+    version = "15.0.7";
+
+    src = fetchFromGitHub {
+      owner = "llvm";
+      repo = "llvm-project";
+      tag = version;
+      hash = "sha256-wjuZQyXQ/jsmvy6y1aksCcEDXGBjuhpgngF3XQJ/T4s=";
+    };
+
+    nativeBuildInputs = [
+      cmake
+      git
+      ninja
+      python3
+    ];
+
+    cmakeFlags = [
+      "-DLLVM_ENABLE_ZSTD=OFF"
+      "-DLLVM_BUILD_TOOLS=Off"
+      "-S ../llvm"
+    ];
+  };
+  inherit (darwin) xcode;
+
+  dxmt = pkgsCross.mingwW64.stdenv.mkDerivation (finalAttrs: {
+    pname = "dxmt";
+    version = "0.80";
+
+    src = fetchFromGitHub {
+      owner = "3shain";
+      repo = "dxmt";
+      rev = "v${finalAttrs.version}";
+      hash = "sha256-HNSKqEYu8se8DyzwRbqfmHRRyBXyW6D5ddPaEdnkuL4=";
+      fetchSubmodules = true;
+    };
+
+    patches = [
+      ./winecrt0.patch
+    ];
+
+    postPatch = ''
+      substituteInPlace src/airconv/darwin/meson.build --replace-fail -lcurses -lncurses
+
+      sed -e "/find_program('xcrun')/d" \
+          -e "s,metalir_generator = generator(xcrun,metalir_generator = generator(find_program('${xcode}/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/metal')," \
+          -e "s,metallib_generator = generator(xcrun,metallib_generator = generator(find_program('${xcode}/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/metallib')," \
+          -e "s/'-sdk', 'macosx', 'metal\(lib\)\{0,1\}', //" \
+          -i meson.build
+    '';
+
+    nativeBuildInputs = [
+      meson
+      ninja
+      tinyxxd
+      buildPackages.stdenv.cc
+    ];
+
+    buildInputs = [
+      sqlite
+      libz
+      ncurses
+      libxml2
+    ];
+
+    mesonFlags = [
+      (lib.mesonOption "native_llvm_path" "${dxmt-llvm}")
+      (lib.mesonOption "wine_install_path" "${wine64}")
+    ];
+
+    preBuild = ''
+      export HOME=$TMPDIR
+    '';
+
+    __structuredAttrs = true;
+    strictDeps = true;
+
+    meta = {
+      description = "Metal-based translation layer for Direct3D 10/11";
+      homepage = "https://github.com/3shain/dxmt";
+      license = lib.licenses.mit;
+      maintainers = [ lib.maintainers.feyorsh ];
+      platforms = lib.platforms.windows;
+      hydraPlatforms = [ ];
+    };
+  });
+in
+symlinkJoin {
+  name = "dxmt-${dxmt.version}";
+
+  paths = [ dxmt ];
+
+  passthru = {
+    inherit dxmt;
+  };
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  meta = {
+    inherit (dxmt.meta)
+      description
+      homepage
+      maintainers
+      license
+      ;
+    platforms = [ "x86_64-darwin" ];
+    hydraPlatforms = [ ];
+  };
+}
diff --git a/pkgs/by-name/dx/dxmt/winecrt0.patch b/pkgs/by-name/dx/dxmt/winecrt0.patch
new file mode 100644
index 000000000000..f4d0830659bb
--- /dev/null
+++ b/pkgs/by-name/dx/dxmt/winecrt0.patch
@@ -0,0 +1,33 @@
+diff --git c/src/winemetal/meson.build i/src/winemetal/meson.build
+index 858d4b3..d937e29 100644
+--- c/src/winemetal/meson.build
++++ i/src/winemetal/meson.build
+@@ -26,8 +26,19 @@ elif wine_install_path != ''
+   if not wine_install_path.startswith('/')
+     wine_install_path = join_paths(meson.project_source_root(), wine_install_path)
+   endif
+-  lib_winecrt0 = cc.find_library('winecrt0', dirs : [ join_paths(wine_install_path,'lib/wine', windows_builtin_install_dir) ])
+-  lib_ntdll = cc.find_library('ntdll', dirs : [ join_paths(wine_install_path, 'lib/wine', windows_builtin_install_dir)], static: true)
++  winecrt0_unix_archive = custom_target(
++    'winecrt0_fixup',
++    output : 'libwinecrt0_fixed.a',
++    command : [
++      'sh', '-c',
++      'ar p "$1" unix_lib.o > unix_lib.o && ar crs "$2" unix_lib.o',
++      'sh',
++      join_paths(wine_install_path, 'lib/wine', windows_builtin_install_dir, 'libwinecrt0.a'),
++      '@OUTPUT@',
++    ],
++  )
++  lib_winecrt0 = declare_dependency(sources : winecrt0_unix_archive)
++  lib_ntdll = cc.find_library('ntdll', dirs : [ join_paths(wine_install_path, 'lib/wine', windows_builtin_install_dir)])
+   lib_dbghelp = cc.find_library('dbghelp', dirs : [ join_paths(wine_install_path, 'lib/wine', windows_builtin_install_dir) ])
+   winebuild = join_paths(wine_install_path, 'bin/winebuild')
+ else
+@@ -59,4 +70,4 @@ custom_target('postprocess_lib',
+ 
+ if cpu_family == 'x86_64' or cpu_family == 'aarch64'
+   subdir('unix')
+-endif
+\ No newline at end of file
++endif
diff --git a/pkgs/by-name/fe/feishu-cli/package.nix b/pkgs/by-name/fe/feishu-cli/package.nix
index 939523e02ce0..d6aa77693f32 100644
--- a/pkgs/by-name/fe/feishu-cli/package.nix
+++ b/pkgs/by-name/fe/feishu-cli/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "feishu-cli";
-  version = "1.29.0";
+  version = "1.32.0";
 
   src = fetchFromGitHub {
     owner = "riba2534";
     repo = "feishu-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-oaq0/+tUK2eWX+8BEGk/oAN4eIxZ9/qW6pildPxZPRw=";
+    hash = "sha256-kPA+t5PiIfIuskgL608J0JzmBELytO7GP13gSnkxoo8=";
   };
 
-  vendorHash = "sha256-HzyP2IZL+lNgf9n7A1681lfWcH6eAb6IrqPWvAsq25Q=";
+  vendorHash = "sha256-vRefU38o9Q4Q96aXoUXUggcRsfQePjlUrSsNERJH3YU=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/fy/fyne/package.nix b/pkgs/by-name/fy/fyne/package.nix
index b5f79e98b6ac..973634e06fa6 100644
--- a/pkgs/by-name/fy/fyne/package.nix
+++ b/pkgs/by-name/fy/fyne/package.nix
@@ -15,18 +15,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "fyne";
-  # This is the current latest version
-  # version "1.26.1" was a typo of "1.7.1" - maybe, don't "upgrade" to it
-  version = "1.7.1";
+  version = "1.7.2";
 
   src = fetchFromGitHub {
     owner = "fyne-io";
     repo = "tools";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-NmO0AtD2lJMBOnlgFm6dXRp6NWMuyAIlckYLHugeJ1Q=";
+    hash = "sha256-kLhh44zRYEPD6kwh+DHaRYidbV+YWq9Tc0yB3f290Z4=";
   };
 
-  vendorHash = "sha256-pTVl9NMqoLqRYrNFWSoagpELwbsW7t5kHYo+fEFQie0=";
+  vendorHash = "sha256-EzwSZDq3s74ohGk0s9NV5RwSFqlUA5AFM8DvKSZeXnM=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/ga/galaxy-buds-client/deps.json b/pkgs/by-name/ga/galaxy-buds-client/deps.json
index 98430195aa5b..98458540dc25 100644
--- a/pkgs/by-name/ga/galaxy-buds-client/deps.json
+++ b/pkgs/by-name/ga/galaxy-buds-client/deps.json
@@ -959,6 +959,11 @@
     "version": "0.21.2",
     "hash": "sha256-gaK/5aAummyin6ptnhaJbnA0ih4+2xADrtrLfFbHwYI="
   },
+  {
+    "pname": "Tmds.DBus.Protocol",
+    "version": "0.21.3",
+    "hash": "sha256-HVEIHSeSe29ergHxsNvWYu3o7Ai8VZKo09yFn+miTnI="
+  },
   {
     "pname": "Xaml.Behaviors.Avalonia",
     "version": "11.3.9",
diff --git a/pkgs/by-name/ga/galaxy-buds-client/package.nix b/pkgs/by-name/ga/galaxy-buds-client/package.nix
index b95111ba1fa9..666d47379a26 100644
--- a/pkgs/by-name/ga/galaxy-buds-client/package.nix
+++ b/pkgs/by-name/ga/galaxy-buds-client/package.nix
@@ -19,13 +19,13 @@
 
 buildDotnetModule rec {
   pname = "galaxy-buds-client";
-  version = "5.2.0";
+  version = "5.2.1";
 
   src = fetchFromGitHub {
     owner = "ThePBone";
     repo = "GalaxyBudsClient";
     tag = version;
-    hash = "sha256-rFaI5coTGuWoxM3QZyCBJdvwvR6LeB2jjvcJ3xXw5X8=";
+    hash = "sha256-jPVrSkf6Bybwc5glkxId5VeWkwLBoTjOzM3CCgO6h9I=";
   };
 
   projectFile = [ "GalaxyBudsClient/GalaxyBudsClient.csproj" ];
diff --git a/pkgs/by-name/gi/gitlab-runner/package.nix b/pkgs/by-name/gi/gitlab-runner/package.nix
index 3fd603a4ce6e..9dba84a426c7 100644
--- a/pkgs/by-name/gi/gitlab-runner/package.nix
+++ b/pkgs/by-name/gi/gitlab-runner/package.nix
@@ -12,16 +12,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gitlab-runner";
-  version = "18.11.3";
+  version = "19.0.0";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-runner";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/QMmBDZz6nWmc9hODS3yVe9iyNERbebGysZ1Z4B5Gw8=";
+    hash = "sha256-uScTzj4pSRtSFCMxoOR5KqipCbPknwnydPYG6xU5dOo=";
   };
 
-  vendorHash = "sha256-xEvvYAVIwHwQDd38P2i6GcgFqf8FPnflWh5IEqmWQdE=";
+  vendorHash = "sha256-QqqTkIgR9ca1dYQ32SG7C+SpEIA07Hlf8x3lVhZ5vRQ=";
 
   # For patchShebangs
   buildInputs = [ bash ];
diff --git a/pkgs/by-name/gp/gpaste/package.nix b/pkgs/by-name/gp/gpaste/package.nix
index f71819236b18..3935301cd1b7 100644
--- a/pkgs/by-name/gp/gpaste/package.nix
+++ b/pkgs/by-name/gp/gpaste/package.nix
@@ -20,11 +20,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gpaste";
-  version = "45.3";
+  version = "45.5";
 
   src = fetchurl {
     url = "https://www.imagination-land.org/files/gpaste/GPaste-${finalAttrs.version}.tar.xz";
-    hash = "sha256-UU8pw7bqEwg2Vh7S6GTx8swI/2IhlwjQgkGNZCzoMwc=";
+    hash = "sha256-seoPqmec9F4/zwmLjpAOUBBIVvLbFRMVPZ3jcloRrZE=";
   };
 
   patches = [
@@ -36,10 +36,6 @@ stdenv.mkDerivation (finalAttrs: {
   postPatch = ''
     substituteInPlace src/libgpaste/gpaste/gpaste-settings.c \
       --subst-var-by gschemasCompiled ${glib.makeSchemaPath (placeholder "out") "${finalAttrs.pname}-${finalAttrs.version}"}
-
-    substituteInPlace src/gnome-shell/metadata.json.in --replace-fail \
-      '"shell-version": [ "45", "46", "47", "48" ],' \
-      '"shell-version": [ "45", "46", "47", "48", "49" ],'
   '';
 
   nativeBuildInputs = [
@@ -90,5 +86,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.bsd2;
     platforms = lib.platforms.linux;
     teams = [ lib.teams.gnome ];
+    maintainers = with lib.maintainers; [ fabiob ];
   };
 })
diff --git a/pkgs/by-name/ho/homebank/package.nix b/pkgs/by-name/ho/homebank/package.nix
index 83f62f87bbe9..de3635b82153 100644
--- a/pkgs/by-name/ho/homebank/package.nix
+++ b/pkgs/by-name/ho/homebank/package.nix
@@ -13,10 +13,10 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "homebank";
-  version = "5.10";
+  version = "5.10.1";
   src = fetchurl {
     url = "https://www.gethomebank.org/public/sources/homebank-${finalAttrs.version}.tar.gz";
-    hash = "sha256-eD/Yuy67oJcT5dfBg9RU9KQ5PoKK9XY/dotIr6vFQ4Y=";
+    hash = "sha256-Z1EtMYjqRfkqb5Mm6CnBQq9a1QkwZwLzsEV6GrYR1Co=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ho/homepage-dashboard/package.nix b/pkgs/by-name/ho/homepage-dashboard/package.nix
index 9c2c1098ad27..fd2e91210a66 100644
--- a/pkgs/by-name/ho/homepage-dashboard/package.nix
+++ b/pkgs/by-name/ho/homepage-dashboard/package.nix
@@ -31,13 +31,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "homepage-dashboard";
-  version = "1.12.3";
+  version = "1.13.1";
 
   src = fetchFromGitHub {
     owner = "gethomepage";
     repo = "homepage";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/8JAFYi7CSRvxEvqb36TTTWUbcaIht++OgKV1rSBcmg=";
+    hash = "sha256-RKvBzHtxK/VNdSRoJSUiVmckG7jTTH75SEe6aX2xq1E=";
   };
 
   pnpmDeps = fetchPnpmDeps {
@@ -48,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
       ;
     pnpm = pnpm_10;
     fetcherVersion = 3;
-    hash = "sha256-suevJNExlktuuCXRYEi8603qrxeEPLYaYp9MO2hnLEk=";
+    hash = "sha256-xd7F39WBSAy3ozJjI12XB+oGvijSGHIMYwQhdpaO/l8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/libunibreak/package.nix b/pkgs/by-name/li/libunibreak/package.nix
index 12c8795e30af..5ad9b09d6aaf 100644
--- a/pkgs/by-name/li/libunibreak/package.nix
+++ b/pkgs/by-name/li/libunibreak/package.nix
@@ -5,28 +5,29 @@
   autoreconfHook,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libunibreak";
-  version = "6.1";
+  version = "7.0";
 
   src =
     let
-      rev_version = lib.replaceStrings [ "." ] [ "_" ] version;
+      rev_version = lib.replaceStrings [ "." ] [ "_" ] finalAttrs.version;
     in
     fetchFromGitHub {
       owner = "adah1972";
       repo = "libunibreak";
-      rev = "libunibreak_${rev_version}";
-      sha256 = "sha256-8yheb+XSvc1AqITjSutF+/4OWb4+7hweedKzhKJcE1Y=";
+      tag = "libunibreak_${rev_version}";
+      hash = "sha256-J+/L5pFudppf0l0Gk/6/Rwz5I59p9Aw11cUEPRPGP/8=";
     };
 
   nativeBuildInputs = [ autoreconfHook ];
 
   meta = {
     homepage = "https://github.com/adah1972/libunibreak";
+    changelog = "https://github.com/adah1972/libunibreak/blob/${finalAttrs.src.tag}/NEWS";
     description = "Implementation of line breaking and word breaking algorithms as in the Unicode standard";
     license = lib.licenses.zlib;
     platforms = lib.platforms.unix;
     maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/by-name/ma/material-design-icons/package.nix b/pkgs/by-name/ma/material-design-icons/package.nix
index 88c7e5768793..d44886ff0b97 100644
--- a/pkgs/by-name/ma/material-design-icons/package.nix
+++ b/pkgs/by-name/ma/material-design-icons/package.nix
@@ -3,31 +3,27 @@
   fetchFromGitHub,
   stdenvNoCC,
   nix-update-script,
+  installFonts,
 }:
 
-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "material-design-icons";
   version = "7.4.47";
 
+  outputs = [
+    "out"
+    "webfont"
+  ];
+
   src = fetchFromGitHub {
     owner = "Templarian";
     repo = "MaterialDesign-Webfont";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-7t3i3nPJZ/tRslLBfY+9kXH8TR145GC2hPFYJeMHRL8=";
     sparseCheckout = [ "fonts" ];
   };
 
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p "$out/share/fonts/"{eot,truetype,woff,woff2}
-    cp fonts/*.eot "$out/share/fonts/eot/"
-    cp fonts/*.ttf "$out/share/fonts/truetype/"
-    cp fonts/*.woff "$out/share/fonts/woff/"
-    cp fonts/*.woff2 "$out/share/fonts/woff2/"
-
-    runHook postInstall
-  '';
+  nativeBuildInputs = [ installFonts ];
 
   passthru.updateScript = nix-update-script { };
 
@@ -46,4 +42,4 @@ stdenvNoCC.mkDerivation rec {
       dixslyf
     ];
   };
-}
+})
diff --git a/pkgs/by-name/ne/netbox_4_5/plugins/netbox-contract/package.nix b/pkgs/by-name/ne/netbox_4_5/plugins/netbox-contract/package.nix
index ab4263a3e576..4e8111659dda 100644
--- a/pkgs/by-name/ne/netbox_4_5/plugins/netbox-contract/package.nix
+++ b/pkgs/by-name/ne/netbox_4_5/plugins/netbox-contract/package.nix
@@ -11,7 +11,7 @@
 }:
 buildPythonPackage (finalAttrs: {
   pname = "netbox-contract";
-  version = "2.4.5";
+  version = "2.4.6";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -21,7 +21,7 @@ buildPythonPackage (finalAttrs: {
     owner = "mlebreuil";
     repo = "netbox-contract";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+6dw8vPDNItZRfExL0C5ul2XghoToMHotEAH90B3CmE=";
+    hash = "sha256-e8DYjU2UtlWu044e4b5eJWOA/fXDRKLl5AVtaepG0sg=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/by-name/nu/nu-lint/package.nix b/pkgs/by-name/nu/nu-lint/package.nix
index 751b4c996a02..84f69553f2b5 100644
--- a/pkgs/by-name/nu/nu-lint/package.nix
+++ b/pkgs/by-name/nu/nu-lint/package.nix
@@ -8,16 +8,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "nu-lint";
-  version = "1.1.2";
+  version = "1.2.1";
 
   src = fetchFromCodeberg {
     owner = "wvhulle";
     repo = "nu-lint";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zALlwEEzk6IapnLbqn9v/HV5QC9dvJi7VzEWgCQJT2s=";
+    hash = "sha256-5YR1Cn9/psNswLVYtDZGmvoP9AwBANa0sPHN4eqcRhQ=";
   };
 
-  cargoHash = "sha256-l1vbNnKqFFOUUPQJZgNajNNGYAHtd7nozF7+YQmLN/k=";
+  cargoHash = "sha256-FA9C7Li4wtXvI8+jDTmdFjqsop6cvGNPByRpOfvQPzw=";
 
   nativeBuildInputs = lib.optionals stdenvNoCC.hostPlatform.isDarwin [
     # Avoids "couldn't find any valid shared libraries matching: ['libclang.dylib']" error on darwin in sandbox mode.
diff --git a/pkgs/by-name/op/openapi-changes/package.nix b/pkgs/by-name/op/openapi-changes/package.nix
index 4c8f38fabc0a..768e6071c96b 100644
--- a/pkgs/by-name/op/openapi-changes/package.nix
+++ b/pkgs/by-name/op/openapi-changes/package.nix
@@ -9,27 +9,50 @@
 
 buildGoModule (finalAttrs: {
   pname = "openapi-changes";
-  version = "0.0.78";
+  version = "0.2.6";
 
   src = fetchFromGitHub {
     owner = "pb33f";
     repo = "openapi-changes";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Ct4VyYFqdMmROg9SE/pFNOJozSkQtKpgktJVgvtW/HA=";
+    hash = "sha256-zPDZFJuru67rw4xFSa4tMucmHiin27a112wdCpIpjiQ=";
   };
 
-  # this test requires the `.git` of the project to be present
-  patchPhase = ''
-    rm git/read_local_test.go
-  '';
+  # skip tests that require a git repository and fail in the sandbox
+  checkFlags =
+    let
+      skippedTests = [
+        "TestResolveGitRefSource"
+        "TestLoadLeftRightCommits_UsesSafeDisplayLabels"
+        "TestLoadCommitsFromArgs_GitRefUsesLeftRightDispatch"
+        "TestReportCommand_GitRefUsesLeftRightMode"
+      ];
+    in
+    [
+      "-skip"
+      "^(${lib.concatStringsSep "|" skippedTests})$"
+    ];
 
   nativeBuildInputs = [ makeWrapper ];
 
+  nativeCheckInputs = [ git ];
+  __darwinAllowLocalNetworking = true;
+
+  # tests require a git repository
+  preCheck = ''
+    export HOME=$(mktemp -d)
+    git init
+    git config --global user.email "you@example.com"
+    git config --global user.name "Your Name"
+    git add .
+    git commit -m "initial commit"
+  '';
+
   postInstall = ''
     wrapProgram $out/bin/openapi-changes --prefix PATH : ${lib.makeBinPath [ git ]}
   '';
 
-  vendorHash = "sha256-bcQAXPw4x+oXx3L0vypbqp96nYdcjQo6M3yOwFbIdpg=";
+  vendorHash = "sha256-0Bu/UXE+EfPMEpyWh9etFCq6jpXHbRUoZOblu8T65HY=";
 
   passthru.updateScript = gitUpdater {
     rev-prefix = "v";
@@ -39,7 +62,7 @@ buildGoModule (finalAttrs: {
     description = "World's sexiest OpenAPI breaking changes detector";
     homepage = "https://pb33f.io/openapi-changes/";
     changelog = "https://github.com/pb33f/openapi-changes/releases/tag/v${finalAttrs.version}";
-    license = lib.licenses.gpl3;
+    license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ mguentner ];
   };
 })
diff --git a/pkgs/by-name/or/orca-slicer/package.nix b/pkgs/by-name/or/orca-slicer/package.nix
index cd4b0d4ff2d9..20e6d3947fa8 100644
--- a/pkgs/by-name/or/orca-slicer/package.nix
+++ b/pkgs/by-name/or/orca-slicer/package.nix
@@ -28,9 +28,7 @@
   hicolor-icon-theme,
   libsecret,
   libpng,
-  makeFontsConf,
   mpfr,
-  nanum,
   nlopt,
   opencascade-occt_7_6,
   openvdb,
@@ -60,12 +58,6 @@ let
           "--enable-secretstore"
         ];
       });
-
-  # Workaround for crash due to missing font
-  # https://github.com/OrcaSlicer/OrcaSlicer/issues/11641
-  fontsConf = makeFontsConf {
-    fontDirectories = [ nanum ];
-  };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "orca-slicer";
@@ -225,7 +217,6 @@ stdenv.mkDerivation (finalAttrs: {
         ]
       }"
       --set WEBKIT_DISABLE_COMPOSITING_MODE 1
-      --set FONTCONFIG_FILE "${fontsConf}"
       ${lib.optionalString withNvidiaGLWorkaround ''
         --set __GLX_VENDOR_LIBRARY_NAME mesa
         --set __EGL_VENDOR_LIBRARY_FILENAMES /run/opengl-driver/share/glvnd/egl_vendor.d/50_mesa.json
diff --git a/pkgs/by-name/os/ostrich-sans/package.nix b/pkgs/by-name/os/ostrich-sans/package.nix
index a31617e6bd4f..8638ae0bf775 100644
--- a/pkgs/by-name/os/ostrich-sans/package.nix
+++ b/pkgs/by-name/os/ostrich-sans/package.nix
@@ -2,12 +2,18 @@
   lib,
   fetchFromGitHub,
   stdenvNoCC,
+  installFonts,
 }:
 
 stdenvNoCC.mkDerivation {
   pname = "ostrich-sans";
   version = "2014-04-18";
 
+  outputs = [
+    "out"
+    "webfont"
+  ];
+
   src = fetchFromGitHub {
     owner = "theleagueof";
     repo = "ostrich-sans";
@@ -15,13 +21,7 @@ stdenvNoCC.mkDerivation {
     hash = "sha256-vvTNtl+fO2zWooH1EvCmO/dPYYgCkj8Ckg5xfg1gtnw=";
   };
 
-  installPhase = ''
-    runHook preInstall
-
-    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
-
-    runHook postInstall
-  '';
+  nativeBuildInputs = [ installFonts ];
 
   meta = {
     description = "Gorgeous modern sans-serif with a very long neck";
diff --git a/pkgs/by-name/pa/panache/package.nix b/pkgs/by-name/pa/panache/package.nix
index 16e2e3165873..9ee7b880bc32 100644
--- a/pkgs/by-name/pa/panache/package.nix
+++ b/pkgs/by-name/pa/panache/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "panache";
-  version = "2.49.0";
+  version = "2.51.0";
 
   src = fetchFromGitHub {
     owner = "jolars";
     repo = "panache";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7IrlArMcr1Ja7jQl4nMLtsPhfoCRTp9Vsap7aD/lyDs=";
+    hash = "sha256-+008xCfLMoMIMUZJuo7/+KSxeKZOH3jrXHVpLmBkjmY=";
   };
 
-  cargoHash = "sha256-/D1yiuTtxQ/NAjqXUAPHWkHsw/+cpiBlYy1UwJOyD+Q=";
+  cargoHash = "sha256-y9lX20k2GHuVyuZeIyGgKAoLM11u1mAkf5Y+Q1A1ArI=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/rh/rhodium-libre/package.nix b/pkgs/by-name/rh/rhodium-libre/package.nix
index 20e27c0945bc..f47214b2b7a0 100644
--- a/pkgs/by-name/rh/rhodium-libre/package.nix
+++ b/pkgs/by-name/rh/rhodium-libre/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenvNoCC,
   fetchFromGitHub,
+  installFonts,
 }:
 
 stdenvNoCC.mkDerivation rec {
@@ -15,14 +16,7 @@ stdenvNoCC.mkDerivation rec {
     hash = "sha256-YCQvUdjEAj4G71WCRCM0+NwiqRqwt1Ggeg9jb/oWEsY=";
   };
 
-  installPhase = ''
-    runHook preInstall
-
-    install -Dm444 -t $out/share/fonts/opentype/ RhodiumLibre-Regular.otf
-    install -Dm444 -t $out/share/fonts/truetype/ RhodiumLibre-Regular.ttf
-
-    runHook postInstall
-  '';
+  nativeBuildInputs = [ installFonts ];
 
   meta = {
     description = "F/OSS/Libre font for Latin and Devanagari";
diff --git a/pkgs/by-name/rs/rs-lxmf/package.nix b/pkgs/by-name/rs/rs-lxmf/package.nix
index 5de637e44fb5..3c3732e2a4ac 100644
--- a/pkgs/by-name/rs/rs-lxmf/package.nix
+++ b/pkgs/by-name/rs/rs-lxmf/package.nix
@@ -9,14 +9,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rs-lxmf";
-  version = "0.9.2";
+  version = "1.0.0";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "ratspeak";
     repo = "rsLXMF";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jba/uiQQUO3MdmF2+6AOtdbUXYW43yqplRFUGujN0Oo=";
+    hash = "sha256-fqSd+XZayW8mYdUF3MY/KjclvhfHtO1I4y1ot3EbdnA=";
   };
 
   postPatch = ''
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     done
   '';
 
-  cargoHash = "sha256-ReWw16r9cYIEzilzSsFXYap9ZGhk1mrUVl/bKkQMcVA=";
+  cargoHash = "sha256-Lv+mxsAtpzjd9tbMioZEH+7rvYVRiPYfD3icgQc+BrU=";
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
@@ -34,6 +34,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   passthru.updateScript = nix-update-script { };
 
   meta = {
+    changelog = "https://github.com/ratspeak/rsLXMF/releases/tag/${finalAttrs.src.tag}";
     description = "Rust implementation of LXMF for Reticulum";
     homepage = "https://github.com/ratspeak/rsLXMF";
     license = lib.licenses.agpl3Only;
diff --git a/pkgs/by-name/rs/rs-reticulum/package.nix b/pkgs/by-name/rs/rs-reticulum/package.nix
index 5d4ec797437e..61e756b442c1 100644
--- a/pkgs/by-name/rs/rs-reticulum/package.nix
+++ b/pkgs/by-name/rs/rs-reticulum/package.nix
@@ -11,17 +11,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rs-reticulum";
-  version = "0.9.4";
+  version = "1.0.0";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "ratspeak";
     repo = "rsReticulum";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9+Xn3fXcH+iTKh+SRh2CHLoK5N9Aqmk5cSXLQEmUYB0=";
+    hash = "sha256-CoA+HOcMkwmo7WUhXCLIwx4hMqLHFQqu6d1NOz1N2PY=";
   };
 
-  cargoHash = "sha256-uBYYK8RQ2+D51xUM51TY9K7WbYiw5oNaNouKn610YH0=";
+  cargoHash = "sha256-h8P2PuW3hiyQuvAHhat831dxBGSmV0rxDWB8lffZpac=";
 
   nativeBuildInputs = [
     pkg-config
@@ -41,6 +41,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   passthru.updateScript = nix-update-script { };
 
   meta = {
+    changelog = "https://github.com/ratspeak/rsReticulum/releases/tag/${finalAttrs.src.tag}";
     description = "Rust implementation of the Reticulum networking stack";
     homepage = "https://github.com/ratspeak/rsReticulum";
     license = lib.licenses.agpl3Only;
diff --git a/pkgs/by-name/sy/sysdig-cli-scanner/sysdig-cli-scanner.versions.nix b/pkgs/by-name/sy/sysdig-cli-scanner/sysdig-cli-scanner.versions.nix
index f81a4bcf12d0..99d554ff36e0 100644
--- a/pkgs/by-name/sy/sysdig-cli-scanner/sysdig-cli-scanner.versions.nix
+++ b/pkgs/by-name/sy/sysdig-cli-scanner/sysdig-cli-scanner.versions.nix
@@ -1,23 +1,23 @@
 {
-  version = "1.27.0";
+  version = "1.27.1";
 
   x86_64-linux = {
-    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.27.0/linux/amd64/sysdig-cli-scanner";
-    hash = "sha256-quUO6HDBKMefpugUlRSmQe2yA4ACNWsPo/NPyHSCCHQ=";
+    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.27.1/linux/amd64/sysdig-cli-scanner";
+    hash = "sha256-7YxZgSAhnTn0WfHvybxP16day1AHneX/zoG2Wuquq18=";
   };
 
   aarch64-linux = {
-    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.27.0/linux/arm64/sysdig-cli-scanner";
-    hash = "sha256-niPKBLEq/YCPDsoTT00ZHaL7O+a3T+1hQ4VH1tPzyJk=";
+    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.27.1/linux/arm64/sysdig-cli-scanner";
+    hash = "sha256-FNLYmrwn3+EJLVjCzPKRvNPWijQdCjF4RXuIB4Kryqs=";
   };
 
   x86_64-darwin = {
-    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.27.0/darwin/amd64/sysdig-cli-scanner";
-    hash = "sha256-g6mA7qhBBKLDfyF3XX1pO5Abr2nnnKR2VHyUjhdS3k0=";
+    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.27.1/darwin/amd64/sysdig-cli-scanner";
+    hash = "sha256-yNkA3BDd/S1Ml/bvosXvMA5zgy9mqL2rMXhotCo5cgE=";
   };
 
   aarch64-darwin = {
-    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.27.0/darwin/arm64/sysdig-cli-scanner";
-    hash = "sha256-2wkM3C7DCTpYwR0A5eFiUNZHTYq7WHZxRPFb7jSHwyU=";
+    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.27.1/darwin/arm64/sysdig-cli-scanner";
+    hash = "sha256-BsoVVd+bMpEU/5KeEGsyU9uE4RF1zxIdsnKorZO7AmA=";
   };
 }
diff --git a/pkgs/by-name/ti/tig/package.nix b/pkgs/by-name/ti/tig/package.nix
index a593723f6d6f..0142d364f284 100644
--- a/pkgs/by-name/ti/tig/package.nix
+++ b/pkgs/by-name/ti/tig/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tig";
-  version = "2.6.0";
+  version = "2.6.1";
 
   src = fetchFromGitHub {
     owner = "jonas";
     repo = "tig";
     rev = "tig-${finalAttrs.version}";
-    sha256 = "sha256-LJVK4y4C/TyM7sD/AZeHyavZ66SoeSh1y+hXnAAKMws=";
+    sha256 = "sha256-Zfmt2rpnH5sxiay1LAsXxvtvqvwEG4MbNI+p0GWJsMc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/un/unityhub/package.nix b/pkgs/by-name/un/unityhub/package.nix
index 6f4b55e58262..d183faafb7a6 100644
--- a/pkgs/by-name/un/unityhub/package.nix
+++ b/pkgs/by-name/un/unityhub/package.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "unityhub";
-  version = "3.18.0";
+  version = "3.18.2";
 
   src = fetchurl {
     url = "https://hub-dist.unity3d.com/artifactory/hub-debian-prod-local/pool/main/u/unity/unityhub_amd64/UnityHubSetup-${version}-amd64.deb";
-    hash = "sha256-JDkmF8ANvW0j5L+92prUcVFqDbUGXkxxUZPjtOqwDlk=";
+    hash = "sha256-4sluuD2g70X98N6Pk9lpC//IFpePpHZf/mowDbh0S8g=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/uu/uutils-findutils/package.nix b/pkgs/by-name/uu/uutils-findutils/package.nix
index 1292ced9cc60..7c00a3ed9748 100644
--- a/pkgs/by-name/uu/uutils-findutils/package.nix
+++ b/pkgs/by-name/uu/uutils-findutils/package.nix
@@ -1,7 +1,6 @@
 {
   lib,
   fetchFromGitHub,
-  fetchpatch2,
   rustPlatform,
   nix-update-script,
   versionCheckHook,
@@ -9,23 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "uutils-findutils";
-  version = "0.8.0";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "uutils";
     repo = "findutils";
     tag = finalAttrs.version;
-    hash = "sha256-i+ryTF2hlZFbyFft/769c800FkzL26E4snUsxU79sKY=";
+    hash = "sha256-ILMInyjOMYlgPxrOjvLoBfkcaZ4aj6GeA/jiGPpNjiI=";
   };
 
-  cargoPatches = [
-    (fetchpatch2 {
-      url = "https://github.com/uutils/findutils/commit/90845d95ceb12289a1b5ee50704ed66f2f7349c3.patch";
-      hash = "sha256-sCqOzfa3R45tXTK3N4344qb8YRmiW0o/lZwqHoBvgl8=";
-    })
-  ];
-
-  cargoHash = "sha256-TQRt1eecT500JaJB2P10T1yV+z2/T8cgTNtF9r5zQpg=";
+  cargoHash = "sha256-/rQTcyRXtluPKPuuZKn/qD/3U0PQLIqyq777/ww3q/0=";
 
   postInstall = ''
     rm $out/bin/testing-commandline
diff --git a/pkgs/by-name/vt/vt323/package.nix b/pkgs/by-name/vt/vt323/package.nix
index 5f7fb67da98a..cb6c5710ddf2 100644
--- a/pkgs/by-name/vt/vt323/package.nix
+++ b/pkgs/by-name/vt/vt323/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  installFonts,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -15,9 +16,10 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-Abq0/hU/BXJMxQxzhZG1SEGIZYt+qofuXwy5/A9byQ8=";
   };
 
-  installPhase = ''
-    mkdir -p $out/share/fonts/truetype
-    cp fonts/ttf/VT323-Regular.ttf $out/share/fonts/truetype
+  nativeBuildInputs = [ installFonts ];
+
+  preInstall = ''
+    rm -r old
   '';
 
   meta = {
diff --git a/pkgs/by-name/ya/yafc-ce/deps.json b/pkgs/by-name/ya/yafc-ce/deps.json
index b408392da3a5..8df2e60b7d7a 100644
--- a/pkgs/by-name/ya/yafc-ce/deps.json
+++ b/pkgs/by-name/ya/yafc-ce/deps.json
@@ -1,83 +1,78 @@
 [
   {
     "pname": "Google.OrTools",
-    "version": "9.11.4210",
-    "hash": "sha256-5mXPEJiry7s5JKfy+o+8Crq7KZIOJnKu4BjXFYEf2nw="
+    "version": "9.15.6755",
+    "hash": "sha256-aQ6e39XNUxeH2nLrpCg+Z0+JO2bPyiLwqL/JuDqa14w="
   },
   {
     "pname": "Google.OrTools.runtime.linux-arm64",
-    "version": "9.11.4210",
-    "hash": "sha256-Odd81OYE7nkpMCoeONzIP3KHYxYdXdvFcyh7qlhCXYg="
+    "version": "9.15.6755",
+    "hash": "sha256-Mri/1BAhSow+gQO9TsZVLXPcb4rIMtpPvAax7Q9q6Fw="
   },
   {
     "pname": "Google.OrTools.runtime.linux-x64",
-    "version": "9.11.4210",
-    "hash": "sha256-1Eq9oKZFU/NqRlEHleVBELiCAKaRlYLxRybYy4s+4RQ="
+    "version": "9.15.6755",
+    "hash": "sha256-4ig999cIuDAqBg7q9CGK1+LI97zF943anpU5ENZhz54="
   },
   {
     "pname": "Google.OrTools.runtime.osx-arm64",
-    "version": "9.11.4210",
-    "hash": "sha256-JoCCnE+ju8/b3Y82yCI3o8ZoEWV7DBns9/6ZJtpnEHY="
+    "version": "9.15.6755",
+    "hash": "sha256-BJC3fg1DRXQbcaf4uh8klCR0okbKMvQ12acGbGNGkC8="
   },
   {
     "pname": "Google.OrTools.runtime.osx-x64",
-    "version": "9.11.4210",
-    "hash": "sha256-yobJIJTTu716ciGgtESLtGjqsteWqE4LtbmAloCBfb4="
+    "version": "9.15.6755",
+    "hash": "sha256-5X4AUkD13l0y1TphzJNQqQcFhETxYikWJIo4iGNK2D4="
   },
   {
     "pname": "Google.OrTools.runtime.win-x64",
-    "version": "9.11.4210",
-    "hash": "sha256-v7InhZCf9jktUsXSvVwsc7REv4kPAfCvH8m3RiBBULs="
+    "version": "9.15.6755",
+    "hash": "sha256-8rTRvvKgL6HGFeS7peXNVnq9F0qOYR1Qtpqiw+GXm4E="
   },
   {
     "pname": "Google.Protobuf",
-    "version": "3.26.1",
-    "hash": "sha256-1tHxDuJwwvJWZ3H9ooPFAKuaJIthSdTDlmjHlxH/euc="
+    "version": "3.33.1",
+    "hash": "sha256-GKjiqDgV21LbVguaEJ//SSNuDI7zu7n0otEbYoJZUx8="
   },
   {
     "pname": "Microsoft.CodeAnalysis.Analyzers",
-    "version": "3.11.0",
-    "hash": "sha256-hQ2l6E6PO4m7i+ZsfFlEx+93UsLPo4IY3wDkNG11/Sw="
+    "version": "5.3.0-2.25625.1",
+    "hash": "sha256-W2CaLe+fpnD2/2VL6jPW/Ct17qOt4lGZKK2X8HU7MLI="
   },
   {
     "pname": "Microsoft.CodeAnalysis.Common",
-    "version": "4.14.0",
-    "hash": "sha256-ne/zxH3GqoGB4OemnE8oJElG5mai+/67ASaKqwmL2BE="
+    "version": "5.3.0",
+    "hash": "sha256-O5RVbqAWXL2FcCNtn+dPAVJ/5aiaxc8nQWojJSsx61w="
   },
   {
     "pname": "Microsoft.CodeAnalysis.CSharp",
-    "version": "4.14.0",
-    "hash": "sha256-5Mzj3XkYYLkwDWh17r1NEXSbXwwWYQPiOmkSMlgo1JY="
+    "version": "5.3.0",
+    "hash": "sha256-A3jxlZEyfgEn9unhoQqbOsA0wd/mA8aak6dRlu5mHIU="
   },
   {
     "pname": "Microsoft.CodeCoverage",
-    "version": "17.11.1",
-    "hash": "sha256-1dLlK3NGh88PuFYZiYpT+izA96etxhU3BSgixDgdtGA="
+    "version": "18.5.1",
+    "hash": "sha256-OnahMnRBbdlGSz+igNB0GaMS7PAppefPL1fWN1+cs0w="
   },
   {
     "pname": "Microsoft.NET.Test.Sdk",
-    "version": "17.11.1",
-    "hash": "sha256-0JUEucQ2lzaPgkrjm/NFLBTbqU1dfhvhN3Tl3moE6mI="
+    "version": "18.5.1",
+    "hash": "sha256-X69wQBKd5GvXfO7BaPWFcyrwfi/kZFVdH/axorIra5Y="
   },
   {
     "pname": "Microsoft.TestPlatform.ObjectModel",
-    "version": "17.11.1",
-    "hash": "sha256-5vX+vCzFY3S7xfMVIv8OlMMFtdedW9UIJzc0WEc+vm4="
+    "version": "18.5.1",
+    "hash": "sha256-CUuOoANj4lXhQAE1/265X6S+afmNxhpsICEIDqNzSXk="
   },
   {
     "pname": "Microsoft.TestPlatform.TestHost",
-    "version": "17.11.1",
-    "hash": "sha256-wSkY0H1fQAq0H3LcKT4u7Y5RzhAAPa6yueVN84g8HxU="
+    "version": "18.5.1",
+    "hash": "sha256-jtb74D0mqq7hu/nlCtV7IU2dXhviLrmGPER0ttdH2Dg="
   },
   {
     "pname": "Newtonsoft.Json",
-    "version": "13.0.1",
-    "hash": "sha256-K2tSVW4n4beRPzPu3rlVaBEMdGvWSv/3Q1fxaDh4Mjo="
-  },
-  {
-    "pname": "Newtonsoft.Json",
-    "version": "13.0.3",
-    "hash": "sha256-hy/BieY4qxBWVVsDqqOPaLy1QobiIapkbrESm6v2PHc="
+    "version": "13.0.4",
+    "hash": "sha256-8JCB1FdAW681qXP6DFDWvycu1oPyVoxaYgpJ2pUvZSk="
   },
   {
     "pname": "SDL2-CS.NetCore",
@@ -91,8 +86,8 @@
   },
   {
     "pname": "Serilog",
-    "version": "4.1.0",
-    "hash": "sha256-r89nJ5JE5uZlsRrfB8QJQ1byVVfCWQbySKQ/m9PYj0k="
+    "version": "4.2.0",
+    "hash": "sha256-7f3EpCsEbDxXgsuhE430KVI14p7oDUuCtwRpOCqtnbs="
   },
   {
     "pname": "Serilog.Enrichers.Thread",
@@ -101,13 +96,18 @@
   },
   {
     "pname": "Serilog.Sinks.Console",
-    "version": "6.0.0",
-    "hash": "sha256-QH8ykDkLssJ99Fgl+ZBFBr+RQRl0wRTkeccQuuGLyro="
+    "version": "6.1.1",
+    "hash": "sha256-CfIg4Us4kSMQAn6rU2rsAeE22g6MpFiZdhoZWySpZeY="
   },
   {
     "pname": "Serilog.Sinks.File",
-    "version": "6.0.0",
-    "hash": "sha256-KQmlUpG9ovRpNqKhKe6rz3XMLUjkBqjyQhEm2hV5Sow="
+    "version": "7.0.0",
+    "hash": "sha256-LxZYUoUPkCjIIVarJilnXnqQiMrFNJtoRilmzTNtUjo="
+  },
+  {
+    "pname": "SharpCompress",
+    "version": "0.49.1",
+    "hash": "sha256-o2IpO605TKJ2mJLKnxWBHtCFnFJPnRj6zMQJBCGgNGw="
   },
   {
     "pname": "System.Collections.Immutable",
@@ -115,9 +115,9 @@
     "hash": "sha256-+6q5VMeoc5bm4WFsoV6nBXA9dV5pa/O4yW+gOdi8yac="
   },
   {
-    "pname": "System.Reflection.Metadata",
-    "version": "1.6.0",
-    "hash": "sha256-JJfgaPav7UfEh4yRAQdGhLZF1brr0tUWPl6qmfNWq/E="
+    "pname": "System.IO.Hashing",
+    "version": "10.0.8",
+    "hash": "sha256-nsDMvCvAeKCyp566iEyp3JOWfQnTPgDU3dIFMg0iUL0="
   },
   {
     "pname": "System.Reflection.Metadata",
@@ -126,8 +126,8 @@
   },
   {
     "pname": "xunit",
-    "version": "2.9.2",
-    "hash": "sha256-h5+yTTfCmokCPy4lqdEw8RGzQlrlsQAW3Am0Jh0q7oo="
+    "version": "2.9.3",
+    "hash": "sha256-BPrpSbjlIB7PoH+ocCusqMDrMZgRQZSzeTeJzHK/I9c="
   },
   {
     "pname": "xunit.abstractions",
@@ -136,32 +136,32 @@
   },
   {
     "pname": "xunit.analyzers",
-    "version": "1.16.0",
-    "hash": "sha256-P5Bvl9hvHvF8KY1YWLg4tKiYxlfRnmHyL14jfSACDaU="
+    "version": "1.18.0",
+    "hash": "sha256-DOgamLnfi9Ua5IDm3JVm9MaOFbSSbmq5l8j2NPO3qd0="
   },
   {
     "pname": "xunit.assert",
-    "version": "2.9.2",
-    "hash": "sha256-EE6r526Q4cHn0Ourf1ENpXZ37Lj/P2uNvonHgpdcnq4="
+    "version": "2.9.3",
+    "hash": "sha256-vHYOde8bd10pOmr7iTAYNtPlqHzsJl4x3t1DDuYdDCA="
   },
   {
     "pname": "xunit.core",
-    "version": "2.9.2",
-    "hash": "sha256-zhjV1I5xh0RFckgTEK72tIkLxVl4CPmter2UB++oye8="
+    "version": "2.9.3",
+    "hash": "sha256-qkVQ8Jw/LZWmxirkPOwiry7bvZn3IuaRzu/sp2H8anw="
   },
   {
     "pname": "xunit.extensibility.core",
-    "version": "2.9.2",
-    "hash": "sha256-MQAC/4d67Nssu3R+pHPh6vHitBXQYxEEZkVVMGW720c="
+    "version": "2.9.3",
+    "hash": "sha256-mcpVX+m0R7F0ev9CaBnbai9gtu4GVcqijEuRqe89D0g="
   },
   {
     "pname": "xunit.extensibility.execution",
-    "version": "2.9.2",
-    "hash": "sha256-f+9UfoPyK3JIDhQSW0Yu9c4PGqUqZC96DMINCYi2i80="
+    "version": "2.9.3",
+    "hash": "sha256-2rxMs2Dt4cAcmOFMwP5Yd3RpP0BnmiL8cXlKysXY0jw="
   },
   {
     "pname": "xunit.runner.visualstudio",
-    "version": "2.8.2",
-    "hash": "sha256-UlfK348r8kJuraywfdCtpJJxHkv04wPNzpUaz4UM/60="
+    "version": "3.1.5",
+    "hash": "sha256-O5657884QGldszsEWQFCDRTXViFBmZ4GGC+4iU+usSQ="
   }
 ]
diff --git a/pkgs/by-name/ya/yafc-ce/package.nix b/pkgs/by-name/ya/yafc-ce/package.nix
index 222b29dd3b1b..27363b0a98cb 100644
--- a/pkgs/by-name/ya/yafc-ce/package.nix
+++ b/pkgs/by-name/ya/yafc-ce/package.nix
@@ -12,13 +12,13 @@ let
 in
 buildDotnetModule (finalAttrs: {
   pname = "yafc-ce";
-  version = "2.18.1";
+  version = "2.19.0";
 
   src = fetchFromGitHub {
     owner = "Yafc-CE";
     repo = "yafc-ce";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-MdaYAustOMFO2rim0o2FnEhFWINa9E1jEvIQS9SnEHY=";
+    hash = "sha256-O4ldYVfOgq+0lZ7xWtBATzx/xlmz3tydC+YX/fvVgY4=";
   };
 
   projectFile = [
diff --git a/pkgs/by-name/za/zapzap/package.nix b/pkgs/by-name/za/zapzap/package.nix
index e58289fcc58e..f151e271f559 100644
--- a/pkgs/by-name/za/zapzap/package.nix
+++ b/pkgs/by-name/za/zapzap/package.nix
@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "zapzap";
-  version = "6.5.0.0.1";
+  version = "6.5.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "rafatosta";
     repo = "zapzap";
     tag = finalAttrs.version;
-    hash = "sha256-rUIM7Mn4ctBr3kfwHHnr1a7tuPc5aKEJCnwfHe92thA=";
+    hash = "sha256-elSMrH62oKZ2F6W9gkormdUi60u0r7Yy3AYOm47vGcE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/zi/zilla-slab/package.nix b/pkgs/by-name/zi/zilla-slab/package.nix
index e53c46b601f2..6bfb4807a8ee 100644
--- a/pkgs/by-name/zi/zilla-slab/package.nix
+++ b/pkgs/by-name/zi/zilla-slab/package.nix
@@ -2,26 +2,25 @@
   lib,
   stdenvNoCC,
   fetchzip,
+  installFonts,
 }:
 
 stdenvNoCC.mkDerivation rec {
   pname = "zilla-slab";
   version = "1.002";
 
+  outputs = [
+    "out"
+    "webfont"
+  ];
+
   src = fetchzip {
     url = "https://github.com/mozilla/zilla-slab/releases/download/v${version}/Zilla-Slab-Fonts-v${version}.zip";
     stripRoot = false;
     hash = "sha256-yOHu+dSWlyI7w1N1teED9R1Fphso2bKAlYDC1KdqBCc=";
   };
 
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/share/fonts/truetype
-    cp -v zilla-slab/ttf/*.ttf $out/share/fonts/truetype/
-
-    runHook postInstall
-  '';
+  nativeBuildInputs = [ installFonts ];
 
   meta = {
     homepage = "https://github.com/mozilla/zilla-slab";
diff --git a/pkgs/by-name/zo/zotero/avoid-git.patch b/pkgs/by-name/zo/zotero/avoid-git.patch
index f0c6b4ffdeaf..dda5290a3ab2 100644
--- a/pkgs/by-name/zo/zotero/avoid-git.patch
+++ b/pkgs/by-name/zo/zotero/avoid-git.patch
@@ -1,16 +1,3 @@
-diff --git a/app/scripts/dir_build b/app/scripts/dir_build
-index 493288ad47..ccabb3722b 100755
---- a/app/scripts/dir_build
-+++ b/app/scripts/dir_build
-@@ -86,7 +86,7 @@ fi
- 
- CHANNEL="source"
- 
--hash=$(git -C "$ROOT_DIR" rev-parse --short HEAD)
-+hash="0000000000000000000000000000000000000000"
- 
- build_dir=$(mktemp -d)
- cleanup() { rm -rf "$build_dir"; }
 diff --git a/js-build/note-editor.js b/js-build/note-editor.js
 index 1435730342..6eebb10c50 100644
 --- a/js-build/note-editor.js
diff --git a/pkgs/by-name/zo/zotero/fix-x86_64-darwin.patch b/pkgs/by-name/zo/zotero/fix-x86_64-darwin.patch
new file mode 100644
index 000000000000..e8ffe53513a7
--- /dev/null
+++ b/pkgs/by-name/zo/zotero/fix-x86_64-darwin.patch
@@ -0,0 +1,13 @@
+diff --git a/app/mac/set-channel-prefs-channel b/app/mac/set-channel-prefs-channel
+index 2431837584..ab85d7e5c0 100755
+--- a/app/mac/set-channel-prefs-channel
++++ b/app/mac/set-channel-prefs-channel
+@@ -19,7 +19,7 @@ binary=$1
+ from_channel=$2
+ to_channel=$3
+ # `strings` has a 4-character minimum by default, but we need 3 for 'dev'
+-strings_cmd="strings -n 3"
++strings_cmd="strings -n 3 -arch all"
+
+ if [ ${#to_channel} -gt 7 ]; then
+        echo "Channel length cannot exceed 7 characters -- aborting" >&2
diff --git a/pkgs/by-name/zo/zotero/package.nix b/pkgs/by-name/zo/zotero/package.nix
index 92bdbb91bf22..438a9eee0f86 100644
--- a/pkgs/by-name/zo/zotero/package.nix
+++ b/pkgs/by-name/zo/zotero/package.nix
@@ -193,6 +193,7 @@ buildNpmPackage (finalAttrs: {
     ./js-build-fixes.patch
     ./avoid-xulrunner-fetch.patch
     ./build-fixes.patch
+    ./fix-x86_64-darwin.patch
   ];
 
   postPatch = ''
@@ -223,30 +224,48 @@ buildNpmPackage (finalAttrs: {
     done
   '';
 
-  buildPhase = ''
-    runHook preBuild
+  buildPhase =
+    let
+      zoteroArch =
+        platform:
+        if platform.isAarch64 then
+          "arm64"
+        else if platform.isx86_64 then
+          "x64"
+        else if platform.isx86_32 then
+          "i686"
+        else
+          platform.parsed.cpu.name;
+    in
+    ''
+      runHook preBuild
 
-    npm run build
+      npm run build
 
-    # Place firefox files at the right place.
-    # The correct firefox version can be found in zotero/app/config.sh at `GECKO_VERSION_LINUX`.
-    mkdir -p app/xulrunner/
-  ''
-  + lib.optionalString stdenv.targetPlatform.isDarwin ''
-    cp -r "${firefox-esr-140-unwrapped}/Applications/Firefox ESR.app" app/xulrunner/Firefox.app
-  ''
-  + lib.optionalString (!stdenv.targetPlatform.isDarwin) ''
-    cp -r "${firefox-esr-140-unwrapped}/lib/firefox" "app/xulrunner/firefox-${stdenv.targetPlatform.parsed.kernel.name}-${
-      lib.replaceString "aarch64" "arm64" stdenv.targetPlatform.parsed.cpu.name
-    }"
-  ''
-  + ''
-    chmod -R u+w app/xulrunner/
+      # Place firefox files at the right place.
+      # The correct firefox version can be found in zotero/app/config.sh at `GECKO_VERSION_LINUX`.
+      mkdir -p app/xulrunner/
+    ''
+    + lib.optionalString stdenv.targetPlatform.isDarwin ''
+      cp -r "${firefox-esr-140-unwrapped}/Applications/Firefox ESR.app" app/xulrunner/Firefox.app
+    ''
+    + lib.optionalString (!stdenv.targetPlatform.isDarwin) ''
+      cp -r "${firefox-esr-140-unwrapped}/lib/firefox" "app/xulrunner/firefox-${stdenv.targetPlatform.parsed.kernel.name}-${
+        lib.replaceString "aarch64" "arm64" stdenv.targetPlatform.parsed.cpu.name
+      }"
+    ''
+    + ''
+      chmod -R u+w app/xulrunner/
 
-    ./app/scripts/dir_build
+      build_dir=$(mktemp -d)
+      ./app/scripts/prepare_build -s ./build -o "$build_dir" -c release
+      ./app/build.sh -d "$build_dir" -c release -s \
+        ${
+          if stdenv.targetPlatform.isDarwin then "-p m" else "-p l -a ${zoteroArch stdenv.targetPlatform}"
+        }
 
-    runHook postBuild
-  '';
+      runHook postBuild
+    '';
 
   inherit doCheck;
   # Build with test support if `doCheck` is enabled.
diff --git a/pkgs/development/cuda-modules/packages/gdrcopy.nix b/pkgs/development/cuda-modules/packages/gdrcopy.nix
index 22afb890c603..1aeadb2ee6d5 100644
--- a/pkgs/development/cuda-modules/packages/gdrcopy.nix
+++ b/pkgs/development/cuda-modules/packages/gdrcopy.nix
@@ -22,13 +22,13 @@ backendStdenv.mkDerivation (finalAttrs: {
   # NOTE: Depends on the CUDA package set, so use cudaNamePrefix.
   name = "${cudaNamePrefix}-${finalAttrs.pname}-${finalAttrs.version}";
   pname = "gdrcopy";
-  version = "2.5.2";
+  version = "2.6";
 
   src = fetchFromGitHub {
     owner = "NVIDIA";
     repo = "gdrcopy";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KfdCiJE8q5MUYjI5qsZjeFmBm9jKfdSxtrlhmQRosns=";
+    hash = "sha256-Waq/Of0LcLDqyaWaU47lorJcG30CijcdTsvf9nMqgrg=";
   };
 
   outputs = [ "out" ];
diff --git a/pkgs/development/python-modules/biplist/default.nix b/pkgs/development/python-modules/biplist/default.nix
index 6128b19d823a..00c7cc807262 100644
--- a/pkgs/development/python-modules/biplist/default.nix
+++ b/pkgs/development/python-modules/biplist/default.nix
@@ -2,19 +2,24 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  setuptools,
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "biplist";
   version = "1.0.3";
-  format = "setuptools";
+  pyproject = true;
+
+  __structuredAttrs = true;
 
   src = fetchPypi {
-    inherit pname version;
-    sha256 = "1im45a9z7ryrfyp1v6i39qia5qagw6i1mhif0hl0praz9iv4j1ac";
+    inherit (finalAttrs) pname version;
+    hash = "sha256-TAVJdkxf5QsoBC7CGqLhT+GiIk4jmh2ud9nn85MqpMY=";
   };
 
+  build-system = [ setuptools ];
+
   nativeCheckInputs = [ pytestCheckHook ];
 
   disabledTests = [
@@ -40,4 +45,4 @@ buildPythonPackage rec {
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ siriobalmelli ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/font-v/default.nix b/pkgs/development/python-modules/font-v/default.nix
index fe71c42d2996..d678a528b055 100644
--- a/pkgs/development/python-modules/font-v/default.nix
+++ b/pkgs/development/python-modules/font-v/default.nix
@@ -6,22 +6,25 @@
   gitMinimal,
   gitpython,
   pytestCheckHook,
+  setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "font-v";
   version = "2.1.0";
-  format = "setuptools";
+  pyproject = true;
 
   # PyPI source tarballs omit tests, fetch from Github instead
   src = fetchFromGitHub {
     owner = "source-foundry";
     repo = "font-v";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-ceASyYcNul5aWPAPGajCQrqsQ3bN1sE+nMbCbj7f35w=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     fonttools
     gitpython
   ];
@@ -30,6 +33,7 @@ buildPythonPackage rec {
     gitMinimal
     pytestCheckHook
   ];
+
   preCheck = ''
     # Many tests assume they are running from a git checkout, although they
     # don't care which one. Create a dummy git repo to satisfy the tests:
@@ -38,6 +42,7 @@ buildPythonPackage rec {
     git config user.name Test
     git commit --allow-empty --message 'Dummy commit for tests'
   '';
+
   disabledTests = [
     # These tests assume they are actually running from a font-v git checkout,
     # so just skip them:
@@ -46,9 +51,10 @@ buildPythonPackage rec {
 
   meta = {
     description = "Python utility for manipulating font version headers";
+    changelog = "https://github.com/source-foundry/font-v/blob/v${finalAttrs.version}/CHANGELOG.md";
     mainProgram = "font-v";
     homepage = "https://github.com/source-foundry/font-v";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ danc86 ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/google-cloud-secret-manager/default.nix b/pkgs/development/python-modules/google-cloud-secret-manager/default.nix
index 40653a94c682..0d5ab5be94f9 100644
--- a/pkgs/development/python-modules/google-cloud-secret-manager/default.nix
+++ b/pkgs/development/python-modules/google-cloud-secret-manager/default.nix
@@ -13,13 +13,13 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-secret-manager";
-  version = "2.28.0";
+  version = "2.29.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_secret_manager";
     inherit version;
-    hash = "sha256-V2P0KkScJ1l/tC1A+pPixWsC2866DEHaIC+5foEMsng=";
+    hash = "sha256-7mQTOvj9s3gK/7ZexszxCrFaARPY7eujiGZfS+h84b4=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/llama-cloud/default.nix b/pkgs/development/python-modules/llama-cloud/default.nix
index d909e9f6a398..db6c820a0cd8 100644
--- a/pkgs/development/python-modules/llama-cloud/default.nix
+++ b/pkgs/development/python-modules/llama-cloud/default.nix
@@ -25,13 +25,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "llama-cloud";
-  version = "2.8.0";
+  version = "2.9.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "llama_cloud";
     inherit (finalAttrs) version;
-    hash = "sha256-7hPs2yySQ2PrECOkNhnb0HLhgsWW7VwpK4pclbAaDOU=";
+    hash = "sha256-yNRVw2Vdelkpn3N7lmhyEpRGi76LPyL3pAsbF16oUcU=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pipcl/default.nix b/pkgs/development/python-modules/pipcl/default.nix
index 227a4eb5f5da..44a11dfafd3f 100644
--- a/pkgs/development/python-modules/pipcl/default.nix
+++ b/pkgs/development/python-modules/pipcl/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pipcl";
-  version = "4";
+  version = "7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ArtifexSoftware";
     repo = "pipcl";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1dTjxMuOFWeK4L+m4dbllNVwV36MmhsICTplfEKIOxk=";
+    hash = "sha256-z7tDWRxEsA0CREP2bjeNYkoS9pgpHL0Cr3wcCyMPIeg=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pysdl3/default.nix b/pkgs/development/python-modules/pysdl3/default.nix
index dbe183eb4368..86d8d5d637a9 100644
--- a/pkgs/development/python-modules/pysdl3/default.nix
+++ b/pkgs/development/python-modules/pysdl3/default.nix
@@ -19,11 +19,11 @@
 let
   dochash =
     if stdenv.hostPlatform.isLinux then
-      "sha256-ldx6r0KKNl1mkohTkaEG4rawf4VjHeJvNUdPkmrAkYA="
+      "sha256-7Uc1kfbfizpRmAr5h3rpTX565wvbZfbbbYcJh9s96DY="
     else if stdenv.hostPlatform.isDarwin then
-      "sha256-ga0ebb9zIPI5+Qza8APs0kbCxUIxqCmXRO/R8uWASOg="
+      "sha256-gumVIn/st/mgdPpQA/BLZD0sI5qLf1EJRQ90rKLXjvQ="
     else if stdenv.hostPlatform.isWindows then
-      "sha256-bBwETA9/ph0zXVNad9zMkQvfq1MmFJ08tCV+mUPwlXQ="
+      "sha256-55Ti6HUzlptSf9ozaz0kmYMz+6EAcOcnZ0R64rZYISY="
     else
       throw "PySDL3 does not support ${stdenv.hostPlatform.uname.system}";
   lib_ext = stdenv.hostPlatform.extensions.sharedLibrary;
@@ -96,7 +96,10 @@ buildPythonPackage rec {
     description = "Pure Python wrapper for SDL3";
     homepage = "https://github.com/Aermoss/PySDL3";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ jansol ];
+    maintainers = with lib.maintainers; [
+      jansol
+      alfarel
+    ];
     platforms = [
       "aarch64-linux"
       "x86_64-linux"
diff --git a/pkgs/development/python-modules/pysmart/default.nix b/pkgs/development/python-modules/pysmart/default.nix
index b0500ba8b982..19c133de0789 100644
--- a/pkgs/development/python-modules/pysmart/default.nix
+++ b/pkgs/development/python-modules/pysmart/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "pysmart";
-  version = "1.4.2";
+  version = "1.4.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "truenas";
     repo = "py-SMART";
     tag = "v${version}";
-    hash = "sha256-h9FBAoNYLs5XvLxSajyktCCcNgiT7mIp472C+fbqZFA=";
+    hash = "sha256-A3SqSo7dUiHB3twlVxNb+7CWki1AZdxlYMQWDwCb9QQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/scalar-fastapi/default.nix b/pkgs/development/python-modules/scalar-fastapi/default.nix
index 78a68b2cc8e6..58349c71b6d4 100644
--- a/pkgs/development/python-modules/scalar-fastapi/default.nix
+++ b/pkgs/development/python-modules/scalar-fastapi/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
 
   # build-system
   setuptools,
@@ -23,14 +23,18 @@
 
 buildPythonPackage rec {
   pname = "scalar-fastapi";
-  version = "1.6.1";
+  version = "1.8.2";
   pyproject = true;
 
-  src = fetchPypi {
+  src = fetchFromGitHub {
+    owner = "scalar";
+    repo = "scalar";
     pname = "scalar_fastapi";
-    inherit version;
-    hash = "sha256-XTzJbw84TTiLWKuldqkDuQfjyY2sqxM5ByIQ6UbE8DM=";
+    # The commit changed integrations/fastapi/package.json which defines version number
+    rev = "0f4bd9da2706be09a8afba017465f55a62dc0975";
+    hash = "sha256-FvbRsLEfdG2fqg14xXG0K1nn8+qX/Co9Sy2EOM0DTlg=";
   };
+  sourceRoot = "${src.name}/integrations/fastapi";
 
   build-system = [
     setuptools
diff --git a/pkgs/development/python-modules/torchio/default.nix b/pkgs/development/python-modules/torchio/default.nix
index dae3f9f232a2..8f81347ae7d0 100644
--- a/pkgs/development/python-modules/torchio/default.nix
+++ b/pkgs/development/python-modules/torchio/default.nix
@@ -37,14 +37,14 @@
 
 buildPythonPackage rec {
   pname = "torchio";
-  version = "1.2.0";
+  version = "1.2.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TorchIO-project";
     repo = "torchio";
     tag = "v${version}";
-    hash = "sha256-GFHTVBt77zcJ3YSldHCpHCPG1MINpvAZWVibRfJRoWk=";
+    hash = "sha256-v9mAtwyglY5PsszrIzGSZJ+eEK3ED3v0slai7Vz9WjA=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/types-awscrt/default.nix b/pkgs/development/python-modules/types-awscrt/default.nix
index fd3c517e0442..b1a0125278fa 100644
--- a/pkgs/development/python-modules/types-awscrt/default.nix
+++ b/pkgs/development/python-modules/types-awscrt/default.nix
@@ -7,13 +7,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "types-awscrt";
-  version = "0.33.0";
+  version = "0.34.1";
   pyproject = true;
 
   src = fetchPypi {
     pname = "types_awscrt";
     inherit (finalAttrs) version;
-    hash = "sha256-gDvH5+L2FyoKvXHfZZM2j4L8IxJ8oV0ofzYOn8vTqXc=";
+    hash = "sha256-VZqgQlD2pBmmF9+3iPPhCQOq90cA7yPlIbZKQRuDuAM=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/os-specific/darwin/by-name/po/PowerManagement/package.nix b/pkgs/os-specific/darwin/by-name/po/PowerManagement/package.nix
index 16e9c572e629..5c64820839a0 100644
--- a/pkgs/os-specific/darwin/by-name/po/PowerManagement/package.nix
+++ b/pkgs/os-specific/darwin/by-name/po/PowerManagement/package.nix
@@ -20,7 +20,7 @@ in
 mkAppleDerivation {
   releaseName = "PowerManagement";
 
-  xcodeHash = "sha256-cjTF4dR6S55mLwp4GkQhkkNk9sMMKDc/5JTm46Z7/KE=";
+  xcodeHash = "sha256-06rCxqBUrYqBY7BDZ6s/vSoviUAmIbsQP1pfrvR2Gpk=";
 
   env.NIX_CFLAGS_COMPILE = "-I${privateHeaders}/include";
 
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/auto-entities/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/auto-entities/package.nix
index e2d79d248149..2f9ffa7c6451 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/auto-entities/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/auto-entities/package.nix
@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "auto-entities";
-  version = "2.4.0";
+  version = "2.4.1";
 
   src = fetchFromGitHub {
     owner = "Lint-Free-Technology";
     repo = "lovelace-auto-entities";
     tag = "v${version}";
-    hash = "sha256-2uZtL2w/KntBReF//3WTrHAQrYJO24jJYWJZ8/mpsIY=";
+    hash = "sha256-m8rR4IqB4k3ZJAJVR6A1lzCTutDdbuWBEIBd+6xIh6Y=";
   };
 
-  npmDepsHash = "sha256-UYpkIKr4/lAfvf+H09uZ8tksnucjpHWiWvWvPKfva2I=";
+  npmDepsHash = "sha256-jQfEUWlxavD4+RsfA1vQlwtkP0uAzNVs8aC93ccQcEk=";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/stdenv/generic/problems.nix b/pkgs/stdenv/generic/problems.nix
index 926075bd8229..0f03c393e384 100644
--- a/pkgs/stdenv/generic/problems.nix
+++ b/pkgs/stdenv/generic/problems.nix
@@ -48,6 +48,8 @@ rec {
     groupBy
     subtractLists
     genAttrs
+    concatMap
+    unique
     ;
 
   handlers = rec {
@@ -119,14 +121,16 @@ rec {
           allowBroken = config.allowBroken || builtins.getEnv "NIXPKGS_ALLOW_BROKEN" == "1";
 
           allowBrokenPredicate =
-            if config ? allowBrokenPredicate then
-              lib.warnIf (lib.oldestSupportedReleaseIsAtLeast 2605)
-                "config.allowBrokenPredicate is deprecated, use config.problems.handlers.myPackage.broken = \"warn\" for individual packages instead."
-                config.allowBrokenPredicate
-            else
-              x: false;
+            lib.warnIf (lib.oldestSupportedReleaseIsAtLeast 2605)
+              "config.allowBrokenPredicate is deprecated, use config.problems.handlers.myPackage.broken = \"warn\" for individual packages instead."
+              config.allowBrokenPredicate;
         in
-        attrs: attrs.meta.broken or false && !allowBroken && !allowBrokenPredicate attrs;
+        if allowBroken then
+          attrs: false
+        else if config ? allowBrokenPredicate then
+          attrs: attrs ? meta.broken && attrs.meta.broken && !allowBrokenPredicate attrs
+        else
+          attrs: attrs ? meta.broken && attrs.meta.broken;
       value.message = "This package is broken.";
     }
   ];
@@ -330,7 +334,10 @@ rec {
         };
       };
 
-    Returns both the structure itself for inspection and a function that can query it with very few allocations/lookups
+      Returns:
+      - the structure itself for inspection
+      - a function that can query the structure with very few allocations/lookups
+      - a list of problem kinds/names/packages that require handling
 
     This allows collapsing arbitrarily many problem handlers/matchers into a predictable structure that can be queried in a predictable and fast way
   */
@@ -352,6 +359,20 @@ rec {
           ) config.problems.handlers
         );
 
+      # Lookup table for all the kinds/names/packages that actually need to be
+      # handled
+      definedConstraints = listToAttrs (
+        map (ident: {
+          name = "${ident}s"; # plural
+          value = unique (
+            concatMap (
+              constraint:
+              optionals (constraint.${ident} != null && constraint.handler != "ignore") [ (constraint.${ident}) ]
+            ) constraints
+          );
+        }) identOrder
+      );
+
       getHandler =
         list:
         (foldl'
@@ -410,26 +431,27 @@ rec {
       switch = doLevel 0 constraints;
     in
     {
-      inherit switch;
+      inherit switch definedConstraints;
       handlerForProblem =
         if isString switch then
-          pname: name: kind:
+          kind: name: pname:
           switch
         else
-          pname: name: kind:
+          kind:
           let
-            switch' = switch.kindSpecific.${kind} or switch.kindFallback;
+            kindSwitch = switch.kindSpecific.${kind} or switch.kindFallback;
           in
-          if isString switch' then
-            switch'
+          if isString kindSwitch then
+            name: pname: kindSwitch
           else
+            name:
             let
-              switch'' = switch'.nameSpecific.${name} or switch'.nameFallback;
+              nameSwitch = kindSwitch.nameSpecific.${name} or kindSwitch.nameFallback;
             in
-            if isString switch'' then
-              switch''
+            if isString nameSwitch then
+              pname: nameSwitch
             else
-              switch''.packageSpecific.${pname} or switch''.packageFallback;
+              pname: nameSwitch.packageSpecific.${pname} or nameSwitch.packageFallback;
     };
 
   genCheckProblems =
@@ -438,44 +460,50 @@ rec {
       # This is here so that it gets cached for a (checkProblems config) thunk
       inherit (genHandlerSwitch config)
         handlerForProblem
+        definedConstraints
         ;
-      # Makes sure that automatic problems can cache with just config applied
-      automaticProblemsConfigCache = map (
-        problem: problem // { condition = problem.condition config; }
+
+      # All the problem kinds that actually need to be checked
+      configuredProblems = definedConstraints.kinds ++ definedConstraints.names;
+
+      # Filter out any problems that are always ignored in config.problems.
+      # Makes sure to cache the condition by appliny config, and the handler
+      # by applying the problem's kind and name
+      automaticProblemsConfigCache = concatMap (
+        problem:
+        optional (elem problem.kindName configuredProblems) {
+          condition = problem.condition config;
+          handler = handlerForProblem problem.kindName problem.kindName;
+        }
       ) automaticProblems;
     in
     attrs:
-    let
-      pname = getName attrs;
-      manualProblems = attrs.meta.problems or { };
-    in
     if
       # Fast path for when there's no problem that needs to be handled
-      # No automatic problems that needs handling
       all (
-        problem:
-        problem.condition attrs -> handlerForProblem pname problem.kindName problem.kindName == "ignore"
+        problem: problem.condition attrs -> problem.handler (getName attrs) == "ignore"
       ) automaticProblemsConfigCache
       && (
         # No manual problems
-        manualProblems == { }
+        !attrs ? meta.problems
         # Or all manual problems are ignored
-        || all (name: handlerForProblem pname name (manualProblems.${name}.kind or name) == "ignore") (
-          attrNames manualProblems
-        )
+        || all (
+          name: handlerForProblem (attrs.meta.problems.${name}.kind or name) name (getName attrs) == "ignore"
+        ) (attrNames attrs.meta.problems)
       )
     then
       null
     else
       # Slow path, only here we actually figure out which problems we need to handle
       let
+        pname = getName attrs;
         problems = attrs.meta.problems or { } // genAutomaticProblems config attrs;
         problemsToHandle = filter (v: v.handler != "ignore") (
           mapAttrsToList (name: problem: rec {
             inherit name;
             # Kind falls back to the name
             kind = problem.kind or name;
-            handler = handlerForProblem pname name kind;
+            handler = handlerForProblem kind name pname;
             inherit problem;
           }) problems
         );
diff --git a/pkgs/test/problems/unit.nix b/pkgs/test/problems/unit.nix
index 073ddaa12cfa..aef201508e63 100644
--- a/pkgs/test/problems/unit.nix
+++ b/pkgs/test/problems/unit.nix
@@ -2,10 +2,15 @@
 let
   p = import ../../stdenv/generic/problems.nix { inherit lib; };
 
+  genConstraintsTest = problems: expected: {
+    expr = (p.genHandlerSwitch { inherit problems; }).definedConstraints;
+    inherit expected;
+  };
+
   genHandlerTest =
     let
       slowReference =
-        config: package: name: kind:
+        config: kind: name: package:
         # Try to find an explicit handler
         (config.problems.handlers.${package} or { }).${name}
           # Fall back, iterating through the matchers
@@ -31,7 +36,7 @@ let
             map
               (
                 name:
-                map (kind: f package name kind) [
+                map (kind: f kind name package) [
                   "k1"
                   "k2"
                   "k3"
@@ -150,4 +155,84 @@ lib.runTests {
     ];
     handlers = { };
   };
+
+  testDefinedConstraintsEmpty =
+    genConstraintsTest
+      {
+        matchers = [ ];
+        handlers = { };
+      }
+      {
+        kinds = [ ];
+        names = [ ];
+        packages = [ ];
+      };
+
+  testDefinedConstraintsMatchers =
+    genConstraintsTest
+      {
+        handlers = { };
+        matchers = [
+          {
+            package = null;
+            name = null;
+            kind = "k1";
+            handler = "warn";
+          }
+          {
+            package = null;
+            name = null;
+            kind = "k2";
+            handler = "error";
+          }
+          {
+            package = null;
+            name = null;
+            kind = "k3";
+            handler = "ignore";
+          }
+          {
+            package = "p1";
+            name = "n1";
+            kind = null;
+            handler = "error";
+          }
+          {
+            package = "p2";
+            name = "n1";
+            kind = null;
+            handler = "warn";
+          }
+        ];
+      }
+      {
+        kinds = [
+          "k1"
+          "k2"
+        ];
+        names = [ "n1" ];
+        packages = [
+          "p1"
+          "p2"
+        ];
+      };
+
+  testDefinedConstraintsHandlers =
+    genConstraintsTest
+      {
+        matchers = [ ];
+        handlers.p1.n1 = "warn";
+        handlers.p1.n2 = "error";
+        handlers.p2.n3 = "ignore";
+      }
+      {
+        kinds = [ ];
+        names = [
+          "n1"
+          "n2"
+        ];
+        packages = [
+          "p1"
+        ];
+      };
 }
diff --git a/pkgs/tools/security/ghidra/extensions/findcrypt/default.nix b/pkgs/tools/security/ghidra/extensions/findcrypt/default.nix
index 94ce72957f02..e92972f9b99f 100644
--- a/pkgs/tools/security/ghidra/extensions/findcrypt/default.nix
+++ b/pkgs/tools/security/ghidra/extensions/findcrypt/default.nix
@@ -5,13 +5,13 @@
 }:
 buildGhidraExtension (finalAttrs: {
   pname = "findcrypt";
-  version = "3.1.8";
+  version = "3.1.9";
 
   src = fetchFromGitHub {
     owner = "antoniovazquezblanco";
     repo = "GhidraFindcrypt";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-2EXJ7tHDjM9LH+SGaRBx4zlK6OdGs+5ipQjsnafgwTQ=";
+    hash = "sha256-NpJx9F21wYvrgELwKjE4bqRAE3lvLwqXbvuCB0HmPgk=";
   };
 
   meta = {