diff --git a/.github/workflows/periodic-merge-24h.yml b/.github/workflows/periodic-merge-24h.yml
index c80f3212ed21..696089df9bc2 100644
--- a/.github/workflows/periodic-merge-24h.yml
+++ b/.github/workflows/periodic-merge-24h.yml
@@ -35,6 +35,10 @@ jobs:
             into: staging-next-25.11
           - from: staging-next-25.11
             into: staging-25.11
+          - from: master
+            into: staging-next-26.05
+          - from: staging-next-26.05
+            into: staging-26.05
           - name: merge-base(master,staging) → haskell-updates
             from: master staging
             into: haskell-updates
diff --git a/doc/build-helpers/testers.chapter.md b/doc/build-helpers/testers.chapter.md
index a7741e96562b..632b11ab12ea 100644
--- a/doc/build-helpers/testers.chapter.md
+++ b/doc/build-helpers/testers.chapter.md
@@ -129,6 +129,13 @@ It has two modes:
 
   Example: `{ "include_verbatim" = true; }`
 
+`extraArgs` (list of strings, optional) {#tester-lycheeLinkCheck-param-extraArgs}
+
+: Extra command line arguments to pass to the `lychee` invocation.
+  These are passed in both the offline (build) and [`online`](#tester-lycheeLinkCheck-return) modes.
+
+  Example: `[ "--format" "json" ]`
+
 `lychee` (derivation, optional) {#tester-lycheeLinkCheck-param-lychee}
 
 : The `lychee` package to use.
diff --git a/doc/release-notes/rl-2611.section.md b/doc/release-notes/rl-2611.section.md
new file mode 100644
index 000000000000..6f2246688d21
--- /dev/null
+++ b/doc/release-notes/rl-2611.section.md
@@ -0,0 +1,38 @@
+# Nixpkgs 26.11 (2026.11/??) {#sec-nixpkgs-release-26.11}
+
+## Highlights {#sec-nixpkgs-release-26.11-highlights}
+
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
+- Create the first release note entry in this section!
+
+## Backward Incompatibilities {#sec-nixpkgs-release-26.11-incompatibilities}
+
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
+- Create the first release note entry in this section!
+
+## Other Notable Changes {#sec-nixpkgs-release-26.11-notable-changes}
+
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
+- Create the first release note entry in this section!
+
+## Nixpkgs Library {#sec-nixpkgs-release-26.11-lib}
+
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
+### Breaking changes {#sec-nixpkgs-release-26.11-lib-breaking}
+
+- Create the first release note entry in this section!
+
+
+### Deprecations {#sec-nixpkgs-release-26.11-lib-deprecations}
+
+- Create the first release note entry in this section!
+
+
+### Additions and Improvements {#sec-nixpkgs-release-26.11-lib-additions-improvements}
+
+- Create the first release note entry in this section!
+
diff --git a/doc/style.css b/doc/style.css
index 7549ee2e1145..96b6979474db 100644
--- a/doc/style.css
+++ b/doc/style.css
@@ -325,8 +325,10 @@ div.appendix .important > :last-child {
 
 div.book .note,
 div.book .tip,
+div.book .important,
 div.appendix .note,
-div.appendix .tip {
+div.appendix .tip,
+div.appendix .important {
   color: var(--note-text-color);
   background: var(--note-background);
 }
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 32bcfcb0b586..69284f3e2d84 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -28309,6 +28309,12 @@
     githubId = 303489;
     name = "Manuel Bärenz";
   };
+  TurnrDev = {
+    email = "jaynicholasturner@gmail.com";
+    github = "TurnrDev";
+    githubId = 11667059;
+    name = "Jay Turner";
+  };
   tuxinaut = {
     email = "trash4you@tuxinaut.de";
     github = "tuxinaut";
@@ -29105,6 +29111,13 @@
     githubId = 5604643;
     name = "Mikhail Volkhov";
   };
+  vollate = {
+    name = "Vollate";
+    email = "uint44t@gmail.com";
+    github = "vollate";
+    githubId = 90166078;
+    keys = [ { fingerprint = "A5B9 B2C5 8C04 DCB6 A157  566A 9CDF DE55 0783 E7BB"; } ];
+  };
   vonfry = {
     email = "nixos@vonfry.name";
     github = "Vonfry";
diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
index 58dbae743c57..58bf43c64ee3 100644
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -262,6 +262,13 @@ of pulling the upstream container image from Docker Hub. If you want the old beh
 
 - Ethercalc and its associated module have been removed, as the package is unmaintained and cannot be installed from source with npm now.
 
+- `services.headplane` has been updated to 0.6.2, which introduces several changes to the configuration schema:
+  - `services.headplane.settings.oidc.redirect_uri` is deprecated. Use `services.headplane.settings.server.base_url` instead; the OIDC redirect URI is now automatically derived from it. Ensure `base_url` is the bare host URL without the `/admin` suffix.
+  - `services.headplane.settings.oidc.user_storage_file` is deprecated. Headplane 0.6.2 still accepts it to migrate the old JSON user database into the new internal SQL database.
+  - `services.headplane.settings.oidc.strict_validation` is deprecated and has no effect.
+  - `services.headplane.settings.oidc.token_endpoint_auth_method` now defaults to `null` (auto-detection), which typically falls back to `client_secret_basic`. Previous versions defaulted to `client_secret_post`.
+  - `services.headplane.settings.integration.agent.cache_ttl` is deprecated and has no effect in 0.6.2.
+
 - `services.immich` no longer supports pgvecto.rs since the package has been removed from nixpkgs.
   As a result, options `services.immich.database.enableVectors` and `services.immich.database.enableVectorchord` have been removed, and VectorChord is now always used.
   If you have not completed the migration yet, ensure you completely remove the extension from your database before upgrading by following the [migration guide](https://github.com/NixOS/nixpkgs/blob/nixos-25.11/nixos/modules/services/web-apps/immich.md#migrating-from-pgvecto-rs-to-vectorchord-pre-2511-installations-module-services-immich-vectorchord-migration).
diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
new file mode 100644
index 000000000000..c017279d73b5
--- /dev/null
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -0,0 +1,25 @@
+# Release 26.11 (2026.11/??) {#sec-release-26.11}
+
+## Highlights {#sec-release-26.11-highlights}
+
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
+- Create the first release note entry in this section!
+
+## New Modules {#sec-release-26.11-new-modules}
+
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
+- Create the first release note entry in this section!
+
+## Backward Incompatibilities {#sec-release-26.11-incompatibilities}
+
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
+- Create the first release note entry in this section!
+
+## Other Notable Changes {#sec-release-26.11-notable-changes}
+
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
+- Create the first release note entry in this section!
diff --git a/nixos/modules/services/misc/bazarr.nix b/nixos/modules/services/misc/bazarr.nix
index bfd708c8bbd4..e0c15f158133 100644
--- a/nixos/modules/services/misc/bazarr.nix
+++ b/nixos/modules/services/misc/bazarr.nix
@@ -72,6 +72,7 @@ in
         KillSignal = "SIGINT";
         SuccessExitStatus = "0 156";
       };
+      unitConfig.RequiresMountsFor = [ cfg.dataDir ];
     };
 
     networking.firewall = lib.mkIf cfg.openFirewall {
diff --git a/nixos/modules/services/misc/seerr.nix b/nixos/modules/services/misc/seerr.nix
index 8728371f1683..fc91fd8ba30d 100644
--- a/nixos/modules/services/misc/seerr.nix
+++ b/nixos/modules/services/misc/seerr.nix
@@ -75,6 +75,7 @@ in
         RemoveIPC = true;
         PrivateMounts = true;
       };
+      unitConfig.RequiresMountsFor = [ cfg.configDir ];
     };
 
     networking.firewall = lib.mkIf cfg.openFirewall {
diff --git a/nixos/modules/services/misc/servarr/prowlarr.nix b/nixos/modules/services/misc/servarr/prowlarr.nix
index 9682df2b161f..2ab36b5a881e 100644
--- a/nixos/modules/services/misc/servarr/prowlarr.nix
+++ b/nixos/modules/services/misc/servarr/prowlarr.nix
@@ -57,6 +57,7 @@ in
           ExecStart = "${lib.getExe cfg.package} -nobrowser -data=/var/lib/prowlarr";
           Restart = "on-failure";
         };
+        unitConfig.RequiresMountsFor = [ cfg.dataDir ];
       };
 
       tmpfiles.settings."10-prowlarr".${cfg.dataDir}.d = lib.mkIf isCustomDataDir {
diff --git a/nixos/modules/services/networking/headplane.nix b/nixos/modules/services/networking/headplane.nix
index 5fac2f04e37d..19e131fcab8d 100644
--- a/nixos/modules/services/networking/headplane.nix
+++ b/nixos/modules/services/networking/headplane.nix
@@ -64,6 +64,16 @@ in
                   description = "The port to listen on.";
                 };
 
+                base_url = mkOption {
+                  type = types.nullOr types.str;
+                  default = null;
+                  description = ''
+                    The base URL for Headplane. Used for OIDC redirect callback URL
+                    detection. Should not include the dashboard prefix (/admin).
+                  '';
+                  example = "https://headplane.example.com";
+                };
+
                 cookie_secret_path = mkOption {
                   type = types.nullOr types.path;
                   default = null;
@@ -84,16 +94,32 @@ in
                   '';
                 };
 
+                cookie_max_age = mkOption {
+                  type = types.ints.positive;
+                  default = 86400;
+                  description = "The maximum age of the session cookie in seconds.";
+                };
+
+                cookie_domain = mkOption {
+                  type = types.nullOr types.str;
+                  default = null;
+                  description = ''
+                    Restrict the cookie to a specific domain.
+                    This may not work as expected if not using a reverse proxy.
+                  '';
+                  example = "example.com";
+                };
+
                 data_path = mkOption {
                   type = types.path;
                   default = "/var/lib/headplane";
                   description = ''
                     The path to persist Headplane specific data.
                     All data going forward is stored in this directory, including the internal database and any cache related files.
-                    Data formats prior to 0.6.1 will automatically be migrated.
                   '';
                   example = "/var/lib/headplane";
                 };
+
               };
             };
             default = { };
@@ -185,6 +211,15 @@ in
                           '';
                         };
 
+                        pre_authkey_path = mkOption {
+                          type = types.nullOr types.path;
+                          default = null;
+                          description = ''
+                            Path to a file containing a Headscale pre-auth key for the agent.
+                          '';
+                          example = lib.literalExpression "config.sops.secrets.headplane_pre_authkey.path";
+                        };
+
                         executable_path = mkOption {
                           type = types.path;
                           readOnly = true;
@@ -195,36 +230,25 @@ in
                           '';
                         };
 
-                        pre_authkey_path = mkOption {
-                          type = types.nullOr types.path;
-                          default = null;
-                          description = ''
-                            Path to a file containing the agent preauth key.
-                            To connect to your Tailnet, you need to generate a pre-auth key.
-                            This can be done via the web UI or through the `headscale` CLI.
-                          '';
-                          example = lib.literalExpression "config.sops.secrets.agent_pre_authkey.path";
-                        };
-
                         host_name = mkOption {
                           type = types.str;
                           default = "headplane-agent";
-                          description = "Optionally change the name of the agent in the Tailnet";
+                          description = "Optionally change the name of the agent in the Tailnet.";
                         };
 
                         cache_ttl = mkOption {
-                          type = types.ints.positive;
-                          default = 180000;
+                          type = types.nullOr types.int;
+                          default = null;
                           description = ''
-                            How long to cache agent information (in milliseconds).
-                            If you want data to update faster, reduce the TTL, but this will increase the frequency of requests to Headscale.
+                            Deprecated cache TTL for the agent. This option is accepted
+                            by Headplane 0.6.2 but has no effect.
                           '';
                         };
 
                         cache_path = mkOption {
                           type = types.path;
                           default = "/var/lib/headplane/agent_cache.json";
-                          description = "Where to store the agent cache.";
+                          description = "The path to store the agent's cache.";
                         };
 
                         work_dir = mkOption {
@@ -271,6 +295,15 @@ in
             type = types.nullOr (
               types.submodule {
                 options = {
+                  enabled = mkOption {
+                    type = types.bool;
+                    default = true;
+                    description = ''
+                      Explicitly control OIDC availability.
+                      Set to false to define OIDC config without enabling it.
+                    '';
+                  };
+
                   issuer = mkOption {
                     type = types.str;
                     description = "URL to OpenID issuer.";
@@ -292,6 +325,16 @@ in
                     example = lib.literalExpression "config.sops.secrets.oidc_client_secret.path";
                   };
 
+                  headscale_api_key_path = mkOption {
+                    type = types.nullOr types.path;
+                    default = null;
+                    description = ''
+                      Path to a file containing the Headscale API key.
+                      Required for OIDC authentication.
+                    '';
+                    example = lib.literalExpression "config.sops.secrets.headscale_api_key.path";
+                  };
+
                   disable_api_key_login = mkOption {
                     type = types.bool;
                     default = false;
@@ -299,42 +342,47 @@ in
                   };
 
                   token_endpoint_auth_method = mkOption {
-                    type = types.enum [
-                      "client_secret_post"
-                      "client_secret_basic"
-                      "client_secret_jwt"
-                    ];
-                    default = "client_secret_post";
-                    description = "The token endpoint authentication method.";
-                  };
-
-                  headscale_api_key_path = mkOption {
-                    type = types.nullOr types.path;
+                    type = types.nullOr (
+                      types.enum [
+                        "client_secret_post"
+                        "client_secret_basic"
+                        "client_secret_jwt"
+                      ]
+                    );
                     default = null;
                     description = ''
-                      Path to a file containing the Headscale API key.
-                      Required when `services.headplane.settings.oidc` is set.
+                      The token endpoint authentication method.
+                      If not set, Headplane will auto-detect the best method
+                      and fall back to client_secret_basic.
+                    '';
+                  };
+
+                  use_pkce = mkOption {
+                    type = types.bool;
+                    default = false;
+                    description = ''
+                      Whether to use PKCE when authenticating users.
+                      Your OIDC provider must support PKCE and it must be enabled on the client.
                     '';
-                    example = lib.literalExpression "config.sops.secrets.headscale_api_key.path";
                   };
 
                   redirect_uri = mkOption {
                     type = types.nullOr types.str;
                     default = null;
                     description = ''
-                      This should point to your publicly accessible URL
-                      for your Headplane instance with /admin/oidc/callback.
+                      Deprecated OIDC redirect URI. Use services.headplane.settings.server.base_url
+                      instead; Headplane derives the callback URL from it.
                     '';
-                    example = "https://headscale.example.com/admin/oidc/callback";
+                    example = "https://headplane.example.com/admin/oidc/callback";
                   };
 
-                  user_storage_file = mkOption {
-                    type = types.path;
-                    default = "/var/lib/headplane/users.json";
+                  strict_validation = mkOption {
+                    type = types.nullOr types.bool;
+                    default = null;
                     description = ''
-                      Path to a file containing the users and their permissions for Headplane.
+                      Deprecated OIDC validation setting. This option is accepted
+                      by Headplane 0.6.2 but has no effect.
                     '';
-                    example = "/var/lib/headplane/users.json";
                   };
 
                   profile_picture_source = mkOption {
@@ -346,12 +394,6 @@ in
                     description = "Source for user profile pictures.";
                   };
 
-                  strict_validation = mkOption {
-                    type = types.bool;
-                    default = true;
-                    description = "Enable strict validation of OIDC configuration.";
-                  };
-
                   scope = mkOption {
                     type = types.str;
                     default = "openid email profile";
@@ -387,6 +429,16 @@ in
                     description = "Custom userinfo endpoint URL.";
                     example = "https://provider.example.com/userinfo";
                   };
+
+                  user_storage_file = mkOption {
+                    type = types.nullOr types.path;
+                    default = null;
+                    description = ''
+                      Deprecated path to the pre-0.6.2 JSON user database.
+                      Headplane uses this once to migrate users into its internal database.
+                    '';
+                    example = "/var/lib/headplane/users.json";
+                  };
                 };
               }
             );
@@ -400,6 +452,33 @@ in
   };
 
   config = mkIf cfg.enable {
+    warnings =
+      lib.optionals (cfg.settings.oidc != null && cfg.settings.oidc.redirect_uri != null) [
+        ''
+          services.headplane.settings.oidc.redirect_uri is deprecated by Headplane 0.6.2.
+          Use services.headplane.settings.server.base_url instead; Headplane derives
+          the OIDC callback URL from it.
+        ''
+      ]
+      ++ lib.optionals (cfg.settings.oidc != null && cfg.settings.oidc.strict_validation != null) [
+        ''
+          services.headplane.settings.oidc.strict_validation is deprecated and has no effect
+          in Headplane 0.6.2.
+        ''
+      ]
+      ++ lib.optionals (cfg.settings.oidc != null && cfg.settings.oidc.user_storage_file != null) [
+        ''
+          services.headplane.settings.oidc.user_storage_file is deprecated. Headplane 0.6.2
+          uses it only to migrate the pre-0.6.2 JSON user database into the internal database.
+        ''
+      ]
+      ++ lib.optionals (agentSettings != null && agentSettings.cache_ttl != null) [
+        ''
+          services.headplane.settings.integration.agent.cache_ttl is deprecated and has no
+          effect in Headplane 0.6.2.
+        ''
+      ];
+
     assertions = [
       {
         assertion = config.services.headscale.enable;
@@ -422,23 +501,20 @@ in
           via systemd `LoadCredential` or sops-nix.
         '';
       }
-      {
-        assertion =
-          cfg.settings.integration.agent == null
-          || !cfg.settings.integration.agent.enabled
-          || cfg.settings.integration.agent.pre_authkey_path != null;
-        message = ''
-          services.headplane.settings.integration.agent.pre_authkey_path must be set
-          when services.headplane.settings.integration.agent.enabled is true.
-        '';
-      }
       {
         assertion = cfg.settings.oidc == null || cfg.settings.oidc.headscale_api_key_path != null;
         message = ''
           services.headplane.settings.oidc.headscale_api_key_path must be set
           when services.headplane.settings.oidc is non-null. Headplane's OIDC
-          flow requires a Headscale API key to mint sessions; upstream config
-          validation rejects an OIDC block without it.
+          flow requires a Headscale API key to mint sessions.
+        '';
+      }
+      {
+        assertion =
+          agentSettings == null || !agentSettings.enabled || agentSettings.pre_authkey_path != null;
+        message = ''
+          services.headplane.settings.integration.agent.pre_authkey_path must be set
+          when the agent is enabled.
         '';
       }
     ];
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 48949e5e1571..46a8e953197b 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -727,6 +727,7 @@ in
     imports = [ ./hbase.nix ];
     _module.args.getPackage = pkgs: pkgs.hbase_2_5;
   };
+  headplane = runTest ./headplane.nix;
   headscale = runTest ./headscale.nix;
   healthchecks = runTest ./web-apps/healthchecks.nix;
   hedgedoc = runTest ./hedgedoc.nix;
diff --git a/nixos/tests/headplane.nix b/nixos/tests/headplane.nix
new file mode 100644
index 000000000000..331012b12fdd
--- /dev/null
+++ b/nixos/tests/headplane.nix
@@ -0,0 +1,69 @@
+{ lib, pkgs, ... }:
+let
+  cookieSecret = pkgs.writeText "cookie-secret" "01234567890123456789012345678901";
+  oidcClientSecret = pkgs.writeText "oidc-client-secret" "client-secret";
+  headscaleApiKey = pkgs.writeText "headscale-api-key" "headscale-api-key";
+in
+{
+  name = "headplane";
+  meta.maintainers = with lib.maintainers; [
+    igor-ramazanov
+    stealthbadger747
+  ];
+
+  nodes.machine = {
+    services.headscale = {
+      enable = true;
+      settings = {
+        server_url = "http://127.0.0.1";
+        ip_prefixes = [ "100.64.0.0/10" ];
+        dns = {
+          base_domain = "tailnet";
+          override_local_dns = false;
+        };
+      };
+    };
+    services.headplane = {
+      enable = true;
+      settings.server = {
+        cookie_secret_path = cookieSecret;
+        cookie_secure = false;
+        # Exercise the new 0.6.2 server-level options so the test fails
+        # if their option-name -> YAML-key mapping ever regresses.
+        base_url = "http://127.0.0.1:3000";
+        cookie_max_age = 3600;
+        cookie_domain = "127.0.0.1";
+      };
+      settings.oidc = {
+        enabled = false;
+        issuer = "https://provider.example.com/issuer-url";
+        client_id = "your-client-id";
+        client_secret_path = oidcClientSecret;
+        headscale_api_key_path = headscaleApiKey;
+        redirect_uri = "http://127.0.0.1:3000/admin/oidc/callback";
+        strict_validation = true;
+        user_storage_file = "/var/lib/headplane/users.json";
+      };
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("headscale.service")
+    machine.wait_for_unit("headplane.service")
+    machine.wait_until_succeeds("curl -sf http://127.0.0.1:3000/admin/login")
+
+    with subtest("rendered config contains new and deprecated-compatible options"):
+        config = machine.succeed("cat /etc/headplane/config.yaml")
+        for key in ["base_url:", "cookie_max_age:", "cookie_domain:", "redirect_uri:", "strict_validation:", "user_storage_file:"]:
+            assert key in config, f"{key} missing from rendered config"
+
+    with subtest("unsupported options are not rendered"):
+        config = machine.succeed("cat /etc/headplane/config.yaml")
+        for key in ["info_secret_path:", "subject_claims:", "allow_weak_rsa_keys:", "use_end_session:", "end_session_endpoint:", "post_logout_redirect_uri:"]:
+            assert key not in config, f"unsupported option {key} still rendered"
+
+    with subtest("session cookie is set on login page"):
+        machine.succeed("curl -sf -c /tmp/cj http://127.0.0.1:3000/admin/login")
+        machine.succeed("test -s /tmp/cj")
+  '';
+}
diff --git a/nixos/tests/prefect.nix b/nixos/tests/prefect.nix
index 0e2f1a36c687..c54a69f89e43 100644
--- a/nixos/tests/prefect.nix
+++ b/nixos/tests/prefect.nix
@@ -11,6 +11,7 @@ in
       {
         services.prefect = {
           enable = true;
+          baseUrl = "http://127.0.0.1";
         };
       };
   };
@@ -18,7 +19,7 @@ in
   testScript = ''
     machine.start()
     machine.wait_for_unit("prefect-server.service")
-    machine.wait_for_open_port("${mainPort}")
+    machine.wait_for_open_port(${mainPort})
   '';
 
   meta = with lib.maintainers; {
diff --git a/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix b/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
index d5229a8796b3..77324b96a488 100644
--- a/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
@@ -10,10 +10,13 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "tinymist";
     publisher = "myriad-dreamin";
-    version = "0.14.16";
-    hash = "sha256-R4tlQgtQaXIT6qiBg1RqQB0Usnsj0Ijs2Bhn2J1CQq4=";
+    inherit (tinymist) version;
+    hash = "sha256-EgLt/bF0pdWyfSxwTGSv2Z0GxCZ2cJ9+n3UnTWdD1LE=";
   };
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   nativeBuildInputs = [
     jq
     moreutils
diff --git a/pkgs/applications/emulators/libretro/cores/flycast.nix b/pkgs/applications/emulators/libretro/cores/flycast.nix
index b921e6a2f7bb..0daaae4873d5 100644
--- a/pkgs/applications/emulators/libretro/cores/flycast.nix
+++ b/pkgs/applications/emulators/libretro/cores/flycast.nix
@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "flycast";
-  version = "0-unstable-2026-05-01";
+  version = "0-unstable-2026-05-10";
 
   src = fetchFromGitHub {
     owner = "flyinghead";
     repo = "flycast";
-    rev = "744e9e4aa560d785000a2653ee3d291716aa2c0a";
-    hash = "sha256-gCFX8mWWWsSogaBDtbVx4hL/GiNk5YlsT2HP3LNY0zs=";
+    rev = "4be8a484665fb5684ccb780ed2165018a679c622";
+    hash = "sha256-kjQcKdxUMdUc+70OPzEtDeSKy/m2e0FyPDa4XR3nHmM=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index ca3331bc0da1..5119c7def0bf 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -101,11 +101,11 @@
     "vendorHash": "sha256-quoFrJbB1vjz+MdV+jnr7FPACHuUe5Gx9POLubD2IaM="
   },
   "baidubce_baiducloud": {
-    "hash": "sha256-Pdtt5XY0XbnEP8qmq0Y2xDS++IGFLBYmfR/BlUDOCbU=",
+    "hash": "sha256-MsnOxJ9FlX+rh7BGL1FkOVDfdPqwPZFDc4YeU33mqCE=",
     "homepage": "https://registry.terraform.io/providers/baidubce/baiducloud",
     "owner": "baidubce",
     "repo": "terraform-provider-baiducloud",
-    "rev": "v1.23.0",
+    "rev": "v1.23.1",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
diff --git a/pkgs/build-support/testers/lychee.nix b/pkgs/build-support/testers/lychee.nix
index 1cca3ead76f0..493ef3e880f9 100644
--- a/pkgs/build-support/testers/lychee.nix
+++ b/pkgs/build-support/testers/lychee.nix
@@ -37,21 +37,24 @@ let
       remap ? { },
       lychee ? deps.lychee,
       extraConfig ? { },
+      extraArgs ? [ ],
     }:
     stdenv.mkDerivation (finalAttrs: {
       name = "lychee-link-check";
+      __structuredAttrs = true;
       inherit site;
       nativeBuildInputs = [
         finalAttrs.passthru.lychee
         cacert
       ];
       configFile = (formats.toml { }).generate "lychee.toml" finalAttrs.passthru.config;
+      inherit extraArgs;
 
       # These can be overridden with overrideAttrs if needed.
       passthru = {
         inherit lychee remap;
         config = {
-          include_fragments = true;
+          include_fragments = "full";
         }
         // lib.optionalAttrs (finalAttrs.passthru.remap != { }) {
           remap = mapAttrsToList (
@@ -68,13 +71,13 @@ let
             site=${finalAttrs.site}
             configFile=${finalAttrs.configFile}
             echo Checking links on $site
-            exec lychee --config $configFile $site "$@"
+            exec lychee --config $configFile ${lib.escapeShellArgs extraArgs} $site "$@"
           '';
         };
       };
       buildCommand = ''
         echo Checking internal links on $site
-        lychee --offline --config $configFile $site
+        lychee --offline --config $configFile "''${extraArgs[@]}" $site
         touch $out
       '';
     });
diff --git a/pkgs/by-name/an/anda/package.nix b/pkgs/by-name/an/anda/package.nix
new file mode 100644
index 000000000000..e91fa0e1f19a
--- /dev/null
+++ b/pkgs/by-name/an/anda/package.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  libgit2,
+  openssl,
+  zlib,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "anda";
+  version = "0.5.4";
+
+  src = fetchFromGitHub {
+    owner = "FyraLabs";
+    repo = "anda";
+    tag = finalAttrs.version;
+    hash = "sha256-z+oYerTP0xJ4QuHtB7uH2nTVEqFsGb2FTpk2wNpMZKU=";
+  };
+
+  cargoHash = "sha256-uoDAfsHIAJsgcMljDqCHwaHvfVZYok2GsuG8y7N0NAg=";
+
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    libgit2
+    openssl
+    zlib
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "A modern Build/CI System";
+    homepage = "https://github.com/FyraLabs/anda";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ isabelroses ];
+    mainProgram = "anda";
+  };
+})
diff --git a/pkgs/by-name/ca/canaille/package.nix b/pkgs/by-name/ca/canaille/package.nix
index 691f2b09065e..abd22b77ef5b 100644
--- a/pkgs/by-name/ca/canaille/package.nix
+++ b/pkgs/by-name/ca/canaille/package.nix
@@ -2,6 +2,7 @@
   lib,
   python3,
   fetchFromGitLab,
+  fetchpatch2,
   openldap,
   nixosTests,
   postgresql,
@@ -22,6 +23,20 @@ python.pkgs.buildPythonApplication rec {
     hash = "sha256-hreEjMrD6mRapgrSDPRWcmqfLxfsOpK7dC8lHJkAY7Y=";
   };
 
+  patches = [
+    # Backport authlib 1.7 compatibility.
+    (fetchpatch2 {
+      url = "https://gitlab.com/yaal/canaille/-/commit/b356baa82109a7fdf61a8258572d199ffd3c9604.patch";
+      hash = "sha256-f5zJBtm9mJpWra5x4vr07eL9xe381lLFp3lfehc4Ypk=";
+    })
+    # Update OIDC tests for authlib 1.7 behavior.
+    (fetchpatch2 {
+      url = "https://gitlab.com/yaal/canaille/-/commit/c1b6d103ebf374cd6a21d9af8376c910c2d0d5d9.patch";
+      hash = "sha256-N9kxiKU6iwXq6cw6itZQHairSOgyDgwAVByj0NnxMqY=";
+      includes = [ "tests/oidc/*" ];
+    })
+  ];
+
   build-system = with python.pkgs; [
     hatchling
     babel
@@ -79,10 +94,18 @@ python.pkgs.buildPythonApplication rec {
     export SCHEMA="${openldap}/etc/schema"
   '';
 
+  # Cap xdist workers; concurrent slapd fixtures race the 10s bind window.
+  dontUsePytestXdist = true;
+  pytestFlags = [ "--numprocesses=4" ];
+
   disabledTests = [
     # Tries to use DNS resolution
     "test_send_new_email_error"
     "test_send_test_email_ssl"
+    # flaky: timing-sensitive intruder lockout retry window
+    "test_intruder_lockout_fail_second_attempt_then_succeed_in_third"
+    # requires external network for logo fetch
+    "test_mail_with_unreachable_external_logo"
   ];
 
   optional-dependencies = with python.pkgs; {
diff --git a/pkgs/by-name/cp/cpu-x/package.nix b/pkgs/by-name/cp/cpu-x/package.nix
index dc2f55303da9..70889d8a0758 100644
--- a/pkgs/by-name/cp/cpu-x/package.nix
+++ b/pkgs/by-name/cp/cpu-x/package.nix
@@ -18,7 +18,6 @@
   vulkan-loader,
   glfw,
   libxdmcp,
-  pcre,
   util-linux,
   libselinux,
   libsepol,
@@ -70,7 +69,6 @@ stdenv.mkDerivation (finalAttrs: {
     opencl-headers
     ocl-icd
     libxdmcp
-    pcre
     util-linux
     libselinux
     libsepol
diff --git a/pkgs/by-name/cs/csharp-ls/package.nix b/pkgs/by-name/cs/csharp-ls/package.nix
index 681092b9628d..e93012514bf2 100644
--- a/pkgs/by-name/cs/csharp-ls/package.nix
+++ b/pkgs/by-name/cs/csharp-ls/package.nix
@@ -29,7 +29,7 @@ buildDotnetGlobalTool (finalAttrs: {
     description = "Roslyn-based LSP language server for C#";
     mainProgram = "csharp-ls";
     homepage = "https://github.com/razzmatazz/csharp-language-server";
-    changelog = "https://github.com/razzmatazz/csharp-language-server/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/razzmatazz/csharp-language-server/releases/tag/${finalAttrs.version}";
     license = lib.licenses.mit;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ GaetanLepage ];
diff --git a/pkgs/by-name/di/diebahn/package.nix b/pkgs/by-name/di/diebahn/package.nix
index fcbc2bb435fd..f5be4e37152e 100644
--- a/pkgs/by-name/di/diebahn/package.nix
+++ b/pkgs/by-name/di/diebahn/package.nix
@@ -24,18 +24,18 @@
 
 stdenv.mkDerivation rec {
   pname = "diebahn";
-  version = "2.9.4";
+  version = "2.10.0";
 
   src = fetchFromGitLab {
     owner = "schmiddi-on-mobile";
     repo = "railway";
     tag = version;
-    hash = "sha256-eGXTBrzKd7dV74wAOzZV9UnIhuR/Xtb20fIWOjfPqtM=";
+    hash = "sha256-+HqCfuolnwQR/7yTITaQDoYcFQ8m82KA/uT+aubK/UM=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-YSki/pKhaKnUqyEMibpg/j06zR6E003AzRTK795NFQo=";
+    hash = "sha256-38ON9KZbF8JHbel2zPlyPOCxgDiBxG1psQLtNib6uLM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/em/emmylua-check/package.nix b/pkgs/by-name/em/emmylua-check/package.nix
index 7cb9f6c45f8d..a9158839db4a 100644
--- a/pkgs/by-name/em/emmylua-check/package.nix
+++ b/pkgs/by-name/em/emmylua-check/package.nix
@@ -11,6 +11,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
   pname = "emmylua_check";
   inherit (emmylua-ls) version src cargoHash;
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   nativeBuildInputs = [
     pkg-config
   ];
diff --git a/pkgs/by-name/em/emmylua-doc-cli/package.nix b/pkgs/by-name/em/emmylua-doc-cli/package.nix
index 6d5fb6330410..434a6e6e84fd 100644
--- a/pkgs/by-name/em/emmylua-doc-cli/package.nix
+++ b/pkgs/by-name/em/emmylua-doc-cli/package.nix
@@ -8,6 +8,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
   pname = "emmylua_doc_cli";
   inherit (emmylua-ls) version src cargoHash;
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   buildAndTestSubdir = "crates/emmylua_doc_cli";
 
   nativeInstallCheckInputs = [
diff --git a/pkgs/by-name/em/emmylua-ls/package.nix b/pkgs/by-name/em/emmylua-ls/package.nix
index 87d7fe1b8303..30e26e3a1a81 100644
--- a/pkgs/by-name/em/emmylua-ls/package.nix
+++ b/pkgs/by-name/em/emmylua-ls/package.nix
@@ -18,6 +18,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-2HC2BeT4x4QGjj2tKB0yM9Bh7zsQ/S0xX/KaJvlgq2o=";
   };
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   nativeBuildInputs = [
     pkg-config
   ];
diff --git a/pkgs/by-name/ev/evtx/package.nix b/pkgs/by-name/ev/evtx/package.nix
index 2ba74c7b3462..d5c40c00a27e 100644
--- a/pkgs/by-name/ev/evtx/package.nix
+++ b/pkgs/by-name/ev/evtx/package.nix
@@ -6,22 +6,29 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "evtx";
-  version = "0.10.0";
+  version = "0.11.2";
 
   src = fetchFromGitHub {
     owner = "omerbenamram";
     repo = "evtx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-v57lo1ggElGJD618ojuADspmhlZAMgmzD5DxEdtp2Ak=";
+    hash = "sha256-LVGw/u5xq+m96zSMPbQDpMnfMHq7FyQnzkmGMUMVgwM=";
   };
 
-  cargoHash = "sha256-qjlN10YS79S0JV2MPFB9SxPDUQnoVdqVf8kYpLt4w9g=";
+  cargoHash = "sha256-RnuWlfmzOZzOMfeKo8tv9I4elLQgpn9IbVa0EpYGnI0=";
 
   postPatch = ''
     # CLI tests will fail in the sandbox
     rm tests/test_cli_interactive.rs
   '';
 
+  checkFlags = [
+    "--skip=wevt_templates_research::wevt_dll_adtschema"
+    "--skip=wevt_templates_research::wevt_dll_lsasrv"
+    "--skip=wevt_templates_research::wevt_dll_services"
+    "--skip=wevt_templates_research::wevt_dll_wevtsvc"
+  ];
+
   meta = {
     description = "Parser for the Windows XML Event Log (EVTX) format";
     homepage = "https://github.com/omerbenamram/evtx";
diff --git a/pkgs/by-name/ga/gallery-dl/package.nix b/pkgs/by-name/ga/gallery-dl/package.nix
index e14efc3c0ab6..a7e3de1ed9e4 100644
--- a/pkgs/by-name/ga/gallery-dl/package.nix
+++ b/pkgs/by-name/ga/gallery-dl/package.nix
@@ -8,14 +8,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "gallery-dl";
-  version = "1.31.10";
+  version = "1.32.1";
   pyproject = true;
 
   src = fetchFromCodeberg {
     owner = "mikf";
     repo = "gallery-dl";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-npt9jbBBHgjURmayhNgkSTQZYLC1aysDR83dLOm2Z/s=";
+    hash = "sha256-5GVwCVpoxpC32VHh1Ju50bhtvwTmZQnuqEIPFu99njQ=";
   };
 
   build-system = [ python3Packages.setuptools ];
diff --git a/pkgs/by-name/gd/gdal/package.nix b/pkgs/by-name/gd/gdal/package.nix
index 353b44e4ed0d..b8800268e3b7 100644
--- a/pkgs/by-name/gd/gdal/package.nix
+++ b/pkgs/by-name/gd/gdal/package.nix
@@ -260,6 +260,10 @@ stdenv.mkDerivation (finalAttrs: {
     "gcore/vsis3.py"
     "gdrivers/gdalhttp.py"
     "gdrivers/wms.py"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    # Trace/BPT trap: 5 on macOS
+    "gcore/hdf4multidim.py"
   ];
   disabledTests = [
     # tests that attempt to make network requests
diff --git a/pkgs/by-name/gd/gdevelop/darwin.nix b/pkgs/by-name/gd/gdevelop/darwin.nix
index 0cbf9880c9e3..4b18cf7f7a38 100644
--- a/pkgs/by-name/gd/gdevelop/darwin.nix
+++ b/pkgs/by-name/gd/gdevelop/darwin.nix
@@ -18,7 +18,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://github.com/4ian/GDevelop/releases/download/v${version}/GDevelop-5-${version}-universal-mac.zip";
-    hash = "sha256-vCbvFeSKDujyUwvgYr974OXWU7jKUHOukffBDurS1ik=";
+    hash = "sha256-B/QyB6ZdyjIBBOOZG1nnVcXyqbPGyf56AndELzi3IZY=";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/by-name/gd/gdevelop/linux.nix b/pkgs/by-name/gd/gdevelop/linux.nix
index f1f9929facc7..6cbce1c80e5d 100644
--- a/pkgs/by-name/gd/gdevelop/linux.nix
+++ b/pkgs/by-name/gd/gdevelop/linux.nix
@@ -13,7 +13,7 @@ let
     if stdenv.hostPlatform.system == "x86_64-linux" then
       fetchurl {
         url = "https://github.com/4ian/GDevelop/releases/download/v${version}/GDevelop-5-${version}.AppImage";
-        hash = "sha256-SpX28ailaBpJ/ARyUVzzZ76Mf3GbTLvNpLiGHv17GQg=";
+        hash = "sha256-IRSg7/jj8QRvVYuHiYzci/mWrQ2lW6RJy9QdZs/guFI=";
       }
     else
       throw "${pname}-${version} is not supported on ${stdenv.hostPlatform.system}";
diff --git a/pkgs/by-name/gd/gdevelop/package.nix b/pkgs/by-name/gd/gdevelop/package.nix
index 518952b921a6..75cd81c69a39 100644
--- a/pkgs/by-name/gd/gdevelop/package.nix
+++ b/pkgs/by-name/gd/gdevelop/package.nix
@@ -4,7 +4,7 @@
   callPackage,
 }:
 let
-  version = "5.6.266";
+  version = "5.6.269";
   pname = "gdevelop";
   meta = {
     description = "Graphical Game Development Studio";
diff --git a/pkgs/by-name/gg/ggml/package.nix b/pkgs/by-name/gg/ggml/package.nix
index 9d28576a7b8d..fcff606fa304 100644
--- a/pkgs/by-name/gg/ggml/package.nix
+++ b/pkgs/by-name/gg/ggml/package.nix
@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ggml";
-  version = "0.10.1";
+  version = "0.11.0";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "ggml-org";
     repo = "ggml";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-fwENyDSRq6ecq0zKC4nnpJCs9X15et+JFTQKX4gLDng=";
+    hash = "sha256-T/dacPlHo7wy1+lMYQdTPd+7exNDuKvZNeuvPDbKJJ0=";
   };
 
   # The cmake package does not handle absolute CMAKE_INSTALL_LIBDIR and CMAKE_INSTALL_INCLUDEDIR
diff --git a/pkgs/by-name/gi/giada/package.nix b/pkgs/by-name/gi/giada/package.nix
index 8f9e3f2db030..f33e389cf511 100644
--- a/pkgs/by-name/gi/giada/package.nix
+++ b/pkgs/by-name/gi/giada/package.nix
@@ -30,13 +30,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "giada";
-  version = "1.3.1";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     owner = "monocasual";
     repo = "giada";
     tag = finalAttrs.version;
-    hash = "sha256-MIGDaZLSwSIIZ2vXYuhGur0Ya1HX2yhrhafAawqU/+A=";
+    hash = "sha256-/pcBQBu2/7fkXuu2N6aLokLXNzXQf7uZI6ePnHe1r2k=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/gi/gitkraken/package.nix b/pkgs/by-name/gi/gitkraken/package.nix
index 41f8c9b178d7..e52f42f0902d 100644
--- a/pkgs/by-name/gi/gitkraken/package.nix
+++ b/pkgs/by-name/gi/gitkraken/package.nix
@@ -56,24 +56,24 @@
 
 let
   pname = "gitkraken";
-  version = "12.1.0";
+  version = "12.1.1";
 
   throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";
 
   srcs = {
     x86_64-linux = fetchzip {
       url = "https://api.gitkraken.dev/releases/production/linux/x64/${version}/gitkraken-amd64.tar.gz";
-      hash = "sha256-HLo5cNkA59JBZ43Aea5W4vj2X4UDN0NtaB4VEjDQwvM=";
+      hash = "sha256-ADOoqHf0RV9MtG7MZUoSH1gzKBN4NwMq2ziiqb5cwnQ=";
     };
 
     x86_64-darwin = fetchzip {
       url = "https://api.gitkraken.dev/releases/production/darwin/x64/${version}/GitKraken-v${version}.zip";
-      hash = "sha256-SzGcT/2X4OXgtUqKCfE9UkKJsBCrKqj++vTdz2Rqfrc=";
+      hash = "sha256-YozqeIcfsRN+42aaX/UTSiwieDHTRvtls2d5dx9SYOk=";
     };
 
     aarch64-darwin = fetchzip {
       url = "https://api.gitkraken.dev/releases/production/darwin/arm64/${version}/GitKraken-v${version}.zip";
-      hash = "sha256-WYhSqRR0bHB1CKGbwSYHWvaCa/GpZCO6X4q6GMLuFpI=";
+      hash = "sha256-n+V/fV5HgN6WwzTPdU+iGwI/R6f0h9ILoVHAwrOaC90=";
     };
   };
 
@@ -88,6 +88,7 @@ let
     maintainers = with lib.maintainers; [
       nicolas-goudry
       Rishik-Y
+      TurnrDev
     ];
     mainProgram = "gitkraken";
   };
diff --git a/pkgs/by-name/gi/gitstatus/romkatv_libgit2.nix b/pkgs/by-name/gi/gitstatus/romkatv_libgit2.nix
index 095e39d6b413..b55ff0126953 100644
--- a/pkgs/by-name/gi/gitstatus/romkatv_libgit2.nix
+++ b/pkgs/by-name/gi/gitstatus/romkatv_libgit2.nix
@@ -1,4 +1,9 @@
-{ fetchFromGitHub, libgit2, ... }:
+{
+  lib,
+  fetchFromGitHub,
+  libgit2,
+  ...
+}:
 
 libgit2.overrideAttrs (oldAttrs: {
   pname = "romkatv_libgit2";
@@ -27,4 +32,6 @@ libgit2.overrideAttrs (oldAttrs: {
   # this is a heavy fork of the original libgit2
   # the original checkPhase does not work for this fork
   doCheck = false;
+
+  meta = lib.removeAttrs oldAttrs.meta [ "changelog" ];
 })
diff --git a/pkgs/by-name/go/go-exploitdb/package.nix b/pkgs/by-name/go/go-exploitdb/package.nix
index 973ad80e3898..c78fe12d0673 100644
--- a/pkgs/by-name/go/go-exploitdb/package.nix
+++ b/pkgs/by-name/go/go-exploitdb/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "go-exploitdb";
-  version = "0.7.0";
+  version = "0.7.2";
 
   src = fetchFromGitHub {
     owner = "vulsio";
     repo = "go-exploitdb";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-sPBFFhQ9z5ecJMnys9U7QDaBVSEKm9V8jka19d1Eafg=";
+    hash = "sha256-xL31IvWzIaYAaHw6h8bkuLOMSWC4ogszLfHSNmYvnX0=";
   };
 
-  vendorHash = "sha256-qWo2PfrvO/eWIf7DjTmbi0qETOg/6jrHZ3BdfugLyGc=";
+  vendorHash = "sha256-n6vUjcU8RxNOPzZaIOXy0CZZzJjwoWxdFlE9I0TNQ6s=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/gr/greenmask/package.nix b/pkgs/by-name/gr/greenmask/package.nix
index 12cf377cd0d8..41c00d5de92b 100644
--- a/pkgs/by-name/gr/greenmask/package.nix
+++ b/pkgs/by-name/gr/greenmask/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "greenmask";
-  version = "0.2.19";
+  version = "0.2.20";
 
   src = fetchFromGitHub {
     owner = "GreenmaskIO";
     repo = "greenmask";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-X/TfcXhjpY+nd5ThjY7CitvbtZMq35uwZ2yjkVYXw1k=";
+    hash = "sha256-SnljUU0GDtTlHKjbMeD7yZYh+IZM2zWuMk0wck0zJb0=";
   };
 
   vendorHash = "sha256-SB71/Tf9Bw8AlTYGXOaRR8sdiwx8l9wQba93p6vAbAk=";
diff --git a/pkgs/by-name/gr/groff/package.nix b/pkgs/by-name/gr/groff/package.nix
index 083b1493dcf6..a824d9a82f02 100644
--- a/pkgs/by-name/gr/groff/package.nix
+++ b/pkgs/by-name/gr/groff/package.nix
@@ -48,7 +48,8 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-dOKBl5W2r/QxrqyYPWOpyJaO6roqLrp9+LpMe0Hnz9g=";
   };
 
-  patches = [
+  patches = lib.optionals stdenv.isLinux [
+    # TODO: apply everywhere on rebuild
     # This revert a upstream refactor in continuous rendering mode, but this
     # causes a big performance regression for big manpages like
     # `man 5 configuration.nix`.
diff --git a/pkgs/by-name/gu/gui-for-singbox/frontend-runtime-path.patch b/pkgs/by-name/gu/gui-for-singbox/frontend-runtime-path.patch
new file mode 100644
index 000000000000..e4909b9aa0cf
--- /dev/null
+++ b/pkgs/by-name/gu/gui-for-singbox/frontend-runtime-path.patch
@@ -0,0 +1,91 @@
+diff -ruN a/src/constant/kernel.ts b/src/constant/kernel.ts
+--- a/src/constant/kernel.ts
++++ b/src/constant/kernel.ts
+@@ -300,9 +300,9 @@
+       'run',
+       '--disable-color',
+       '-c',
+-      '$APP_BASE_PATH/$CORE_BASE_PATH/config.json',
++      '$CORE_BASE_PATH/config.json',
+       '-D',
+-      '$APP_BASE_PATH/$CORE_BASE_PATH',
++      '$CORE_BASE_PATH',
+     ],
+   }
+ }
+diff -ruN a/src/stores/env.ts b/src/stores/env.ts
+--- a/src/stores/env.ts
++++ b/src/stores/env.ts
+@@ -15,6 +15,7 @@
+     appName: '',
+     appVersion: '',
+     basePath: '',
++    configPath: '',
+     appPath: '',
+     os: '' as OS,
+     arch: '',
+diff -ruN a/src/stores/kernelApi.ts b/src/stores/kernelApi.ts
+--- a/src/stores/kernelApi.ts
++++ b/src/stores/kernelApi.ts
+@@ -248,8 +248,12 @@
+   const runCoreProcess = (isAlpha: boolean) => {
+     return new Promise<number | void>((resolve, reject) => {
+       let output: string
++      const coreWorkingDirectory =
++        envStore.env.os === 'linux' && envStore.env.configPath
++          ? `${envStore.env.configPath}/${CoreWorkingDirectory}`
++          : CoreWorkingDirectory
+       const pid = ExecBackground(
+-        CoreWorkingDirectory + '/' + getKernelFileName(isAlpha),
++        coreWorkingDirectory + '/' + getKernelFileName(isAlpha),
+         getKernelRuntimeArgs(isAlpha),
+         (out) => {
+           output = out
+@@ -263,8 +267,9 @@
+           reject(output)
+         },
+         {
+-          PidFile: CorePidFilePath,
++          PidFile: coreWorkingDirectory + '/pid.txt',
+           StopOutputKeyword: CoreStopOutputKeyword,
++          WorkingDirectory: envStore.env.configPath || envStore.env.basePath,
+           Env: getKernelRuntimeEnv(isAlpha),
+         },
+       ).catch((e) => reject(e))
+diff -ruN a/src/types/app.d.ts b/src/types/app.d.ts
+--- a/src/types/app.d.ts
++++ b/src/types/app.d.ts
+@@ -19,6 +19,7 @@
+   appName: string
+   appVersion: string
+   basePath: string
++  configPath: string
+   appPath: string
+   os: OS
+   arch: string
+diff -ruN a/src/utils/helper.ts b/src/utils/helper.ts
+--- a/src/utils/helper.ts
++++ b/src/utils/helper.ts
+@@ -822,9 +822,21 @@
+ export const processMagicVariables = (str: string) => {
+   const { env } = useEnvStore()
+   let result = str
++  const coreBasePath =
++    env.os === 'linux' && env.configPath
++      ? `${env.configPath}/${CoreWorkingDirectory}`
++      : CoreWorkingDirectory
++
++  if (env.os === 'linux') {
++    result = result.replaceAll('$APP_BASE_PATH/$CORE_BASE_PATH', coreBasePath)
++    result = result.replaceAll(
++      `${env.basePath}/${CoreWorkingDirectory}`,
++      coreBasePath,
++    )
++  }
+   Object.entries({
+     $APP_BASE_PATH: env.basePath,
+-    $CORE_BASE_PATH: CoreWorkingDirectory,
++    $CORE_BASE_PATH: coreBasePath,
+   }).forEach(([source, target]) => {
+     result = result.replaceAll(source, target)
+   })
diff --git a/pkgs/by-name/gu/gui-for-singbox/package.nix b/pkgs/by-name/gu/gui-for-singbox/package.nix
index b0db33032e12..e259f199abde 100644
--- a/pkgs/by-name/gu/gui-for-singbox/package.nix
+++ b/pkgs/by-name/gu/gui-for-singbox/package.nix
@@ -5,11 +5,13 @@
   fetchFromGitHub,
   autoPatchelfHook,
   copyDesktopItems,
+  glib-networking,
   nodejs,
   pkg-config,
   pnpm_10,
   fetchPnpmDeps,
   pnpmConfigHook,
+  wrapGAppsHook3,
   wails,
   webkitgtk_4_1,
   makeDesktopItem,
@@ -18,20 +20,20 @@
 
 let
   pname = "gui-for-singbox";
-  version = "1.21.0";
+  version = "1.23.2";
 
   src = fetchFromGitHub {
     owner = "GUI-for-Cores";
     repo = "GUI.for.SingBox";
     tag = "v${version}";
-    hash = "sha256-IGsH8QHoj2CvrSEc9eIisxySXQkjPSDBXsCPOXqANVM=";
+    hash = "sha256-CEJ0yzF2smBlLgZ4EH5UWV4Pc4vA2ZH80TjoudUKWZM=";
   };
 
   metaCommon = {
     homepage = "https://github.com/GUI-for-Cores/GUI.for.SingBox";
     hydraPlatforms = [ ]; # https://gui-for-cores.github.io/guide/#note
     license = with lib.licenses; [ gpl3Plus ];
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ vollate ];
   };
 
   frontend = stdenv.mkDerivation (finalAttrs: {
@@ -39,6 +41,8 @@ let
 
     sourceRoot = "${finalAttrs.src.name}/frontend";
 
+    patches = [ ./frontend-runtime-path.patch ];
+
     nativeBuildInputs = [
       nodejs
       pnpmConfigHook
@@ -53,8 +57,8 @@ let
         sourceRoot
         ;
       pnpm = pnpm_10;
-      fetcherVersion = 2;
-      hash = "sha256-dWqwEnXPT+5N+36szm4AF1ChM9M6UJltct+EtQAofGQ=";
+      fetcherVersion = 3;
+      hash = "sha256-m9Rmc9Ww4jb2aQ+RXOwF71daZ6puspdMM/xidnk/YHs=";
     };
 
     buildPhase = ''
@@ -85,22 +89,20 @@ buildGo126Module {
 
   patches = [ ./xdg-path-and-restart-patch.patch ];
 
-  # As we need the $out reference, we can't use `replaceVars` here.
-  postPatch = ''
-    substituteInPlace bridge/bridge.go \
-      --subst-var out
-  '';
-
-  vendorHash = "sha256-EeIxt0BzSaZh1F38btUXN9kAvj12nlqEerVgWVGkiuk=";
+  vendorHash = "sha256-9uWrctbQ+vujb1Q8zT7Bv7rVyNY1rCM577c9caOKRNo=";
 
   nativeBuildInputs = [
     autoPatchelfHook
     copyDesktopItems
     pkg-config
     wails
+    wrapGAppsHook3
   ];
 
-  buildInputs = [ webkitgtk_4_1 ];
+  buildInputs = [
+    glib-networking
+    webkitgtk_4_1
+  ];
 
   preBuild = ''
     cp -r ${frontend} frontend/dist
diff --git a/pkgs/by-name/gu/gui-for-singbox/xdg-path-and-restart-patch.patch b/pkgs/by-name/gu/gui-for-singbox/xdg-path-and-restart-patch.patch
index b5d9ed7175c1..f2cdd3b28229 100644
--- a/pkgs/by-name/gu/gui-for-singbox/xdg-path-and-restart-patch.patch
+++ b/pkgs/by-name/gu/gui-for-singbox/xdg-path-and-restart-patch.patch
@@ -1,6 +1,15 @@
+diff -ruN a/bridge/bridge.go b/bridge/bridge.go
 --- a/bridge/bridge.go
 +++ b/bridge/bridge.go
-@@ -93,7 +93,10 @@
+@@ -50,6 +50,7 @@
+ 
+ 	Env.BasePath = filepath.ToSlash(filepath.Dir(exePath))
+ 	Env.AppName = filepath.Base(exePath)
++	Env.ConfigPath = filepath.ToSlash(GetConfigPath())
+ 
+ 	if slices.Contains(os.Args, "tasksch") {
+ 		Env.FromTaskSch = true
+@@ -93,7 +94,10 @@
  
  func (a *App) RestartApp() FlagResult {
  	log.Printf("RestartApp")
@@ -12,3 +21,64 @@
  
  	cmd := exec.Command(exePath)
  	SetCmdWindowHidden(cmd)
+@@ -116,6 +120,7 @@
+ 		AppName:      Env.AppName,
+ 		AppVersion:   Env.AppVersion,
+ 		BasePath:     Env.BasePath,
++		ConfigPath:   Env.ConfigPath,
+ 		OS:           Env.OS,
+ 		ARCH:         Env.ARCH,
+ 		IsPrivileged: Env.IsPrivileged,
+@@ -258,7 +263,7 @@
+ }
+ 
+ func loadConfig() {
+-	b, err := os.ReadFile(Env.BasePath + "/data/user.yaml")
++	b, err := os.ReadFile(GetPath("data/user.yaml"))
+ 	if err == nil {
+ 		yaml.Unmarshal(b, &Config)
+ 	}
+diff -ruN a/bridge/types.go b/bridge/types.go
+--- a/bridge/types.go
++++ b/bridge/types.go
+@@ -21,6 +21,7 @@
+ 	AppName      string `json:"appName"`
+ 	AppVersion   string `json:"appVersion"`
+ 	BasePath     string `json:"basePath"`
++	ConfigPath   string `json:"configPath"`
+ 	OS           string `json:"os"`
+ 	ARCH         string `json:"arch"`
+ 	IsPrivileged bool   `json:"isPrivileged"`
+diff -ruN a/bridge/utils.go b/bridge/utils.go
+--- a/bridge/utils.go
++++ b/bridge/utils.go
+@@ -13,7 +13,29 @@
+ 	"golang.org/x/text/encoding/simplifiedchinese"
+ )
+ 
++func GetConfigPath() string {
++	if Env.OS == "linux" {
++		if xdgConfigHome := os.Getenv("XDG_CONFIG_HOME"); xdgConfigHome != "" {
++			return filepath.Join(xdgConfigHome, "GUI.for.SingBox")
++		}
++		if userConfigDir, err := os.UserConfigDir(); err == nil {
++			return filepath.Join(userConfigDir, "GUI.for.SingBox")
++		}
++	}
++
++	return Env.BasePath
++}
++
+ func GetPath(path string) string {
++	if Env.OS == "linux" && !filepath.IsAbs(path) {
++		cleanPath := filepath.ToSlash(filepath.Clean(path))
++		if cleanPath == "data" {
++			path = filepath.Join(GetConfigPath(), "data")
++		} else if strings.HasPrefix(cleanPath, "data/") {
++			path = filepath.Join(GetConfigPath(), cleanPath)
++		}
++	}
++
+ 	if !filepath.IsAbs(path) {
+ 		path = filepath.Join(Env.BasePath, path)
+ 	}
diff --git a/pkgs/by-name/he/headplane-agent/package.nix b/pkgs/by-name/he/headplane-agent/package.nix
index a645d2e576f8..d821e5b94218 100644
--- a/pkgs/by-name/he/headplane-agent/package.nix
+++ b/pkgs/by-name/he/headplane-agent/package.nix
@@ -7,13 +7,13 @@ buildGoModule (finalAttrs: {
   pname = "headplane-agent";
   __structuredAttrs = true;
   # Note, if you are upgrading this, you should upgrade headplane at the same time
-  version = "0.6.1";
+  version = "0.6.2";
 
   src = fetchFromGitHub {
     owner = "tale";
     repo = "headplane";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hsrnmEwKXJlPjV4aIfmS6GAE414ArVRGoPPpZGmV0x4=";
+    hash = "sha256-2C/Pn2M2aHADtoljSFg9hz6xOaZp6IRI77jjy+LDAgw=";
   };
 
   vendorHash = "sha256-MvrqKMD+A+qBZmzQv+T9920U5uJop+pjfJpZdm2ZqEA=";
diff --git a/pkgs/by-name/he/headplane/package.nix b/pkgs/by-name/he/headplane/package.nix
index bb42ab31bcee..a596e5918356 100644
--- a/pkgs/by-name/he/headplane/package.nix
+++ b/pkgs/by-name/he/headplane/package.nix
@@ -3,8 +3,10 @@
   fetchFromGitHub,
   fetchPnpmDeps,
   git,
+  headplane-agent,
   lib,
   makeWrapper,
+  nixosTests,
   nodejs_22,
   pnpm_10,
   pnpmConfigHook,
@@ -13,13 +15,13 @@
 let
   pname = "headplane";
   # Note, if you are upgrading this, you should upgrade headplane-agent at the same time
-  version = "0.6.1";
-  pnpmDepsHash = "sha256-AYfEL3HSRg87I+Y0fkLthFSDWgHTg5u0DBpzn6KBn1Q=";
+  version = "0.6.2";
+  pnpmDepsHash = "sha256-CsmffCo9Se/4oiOqbcuhjPMuGmR2GL+YfcyWgzBTAh8=";
   src = fetchFromGitHub {
     owner = "tale";
     repo = "headplane";
     tag = "v${version}";
-    hash = "sha256-hsrnmEwKXJlPjV4aIfmS6GAE414ArVRGoPPpZGmV0x4=";
+    hash = "sha256-2C/Pn2M2aHADtoljSFg9hz6xOaZp6IRI77jjy+LDAgw=";
   };
 
   headplaneSshWasm = buildGoModule {
@@ -104,6 +106,11 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  passthru = {
+    agent = headplane-agent;
+    tests = { inherit (nixosTests) headplane; };
+  };
+
   meta = {
     description = "Feature-complete Web UI for Headscale";
     homepage = "https://github.com/tale/headplane";
diff --git a/pkgs/by-name/ht/html2pdf/package.nix b/pkgs/by-name/ht/html2pdf/package.nix
index cc07d2c5fb53..f92ee0545bbd 100644
--- a/pkgs/by-name/ht/html2pdf/package.nix
+++ b/pkgs/by-name/ht/html2pdf/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "html2pdf";
-  version = "0.8.2";
+  version = "0.8.3";
 
   src = fetchFromGitHub {
     owner = "ilaborie";
     repo = "html2pdf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Z1fb7pDjawMIhJgl4ao2VoV6zpfcGy/48Dt7JtIxgJo=";
+    hash = "sha256-JtBgM95BvCJQwF89+PXkCEdrFDlD+hdceTtI5t6KnUQ=";
   };
 
-  cargoHash = "sha256-T5A2b7Qcg8dQKndaD8P5RAutBZeINOqIBUHR2VDOeo0=";
+  cargoHash = "sha256-65do3FDEpGeNX/u9KS+F5yigwBfgVNUBhZImjbWFydU=";
 
   # Avoiding "rustfmt not found" error in auto_generate_cdp.
   # ref: https://github.com/mdrokz/auto_generate_cdp/pull/8
diff --git a/pkgs/by-name/hu/hunspell/dictionaries.nix b/pkgs/by-name/hu/hunspell/dictionaries.nix
index c24e5e356ead..1fa3ea9a7839 100644
--- a/pkgs/by-name/hu/hunspell/dictionaries.nix
+++ b/pkgs/by-name/hu/hunspell/dictionaries.nix
@@ -194,7 +194,7 @@ let
     }:
     mkDict rec {
       inherit src srcFileName dictFileName;
-      version = "2020.12.07";
+      version = "2026.02.25";
       pname = "hunspell-dict-${shortName}-wordlist";
       srcReadmeFile = "README_" + srcFileName + ".txt";
       readmeFile = "README_" + dictFileName + ".txt";
@@ -376,8 +376,8 @@ rec {
     srcFileName = "en_US";
     dictFileName = "en_US";
     src = fetchurl {
-      url = "mirror://sourceforge/wordlist/speller/2018.04.16/hunspell-en_US-2020.12.07.zip";
-      hash = "sha256-YWNIrWRacW2RyKZkUGXnEPFendo//vYM337IpOJ5da8=";
+      url = "mirror://sourceforge/wordlist/speller/2026.02.25/hunspell-en_US-2026.02.25.zip";
+      hash = "sha256-rI5zMQ6VHYjFLCzyulTOrKNPhIaoFjCsinXcX5MRefk=";
     };
   };
 
@@ -388,8 +388,8 @@ rec {
     srcFileName = "en_US-large";
     dictFileName = "en_US";
     src = fetchurl {
-      url = "mirror://sourceforge/wordlist/speller/2018.04.16/hunspell-en_US-large-2020.12.07.zip";
-      hash = "sha256-WpNhcxL/t8zMVMj9ij5nEusOnNSmnx01i4LrTTUgcrc=";
+      url = "mirror://sourceforge/wordlist/speller/2026.02.25/hunspell-en_US-large-2026.02.25.zip";
+      hash = "sha256-BqtaKhLCkDPxAJiNOwpeU9ytQL8kc8y3gnBhnR2pkyE=";
     };
   };
 
@@ -400,8 +400,8 @@ rec {
     srcFileName = "en_CA";
     dictFileName = "en_CA";
     src = fetchurl {
-      url = "mirror://sourceforge/wordlist/speller/2018.04.16/hunspell-en_CA-2020.12.07.zip";
-      hash = "sha256-/2uR5O12g0jGGufDJuhIBZgQ+kOl1gHfaz9FrZwO9b8=";
+      url = "mirror://sourceforge/wordlist/speller/2026.02.25/hunspell-en_CA-2026.02.25.zip";
+      hash = "sha256-Kf4AUECMNWFPIr6oQzi0JWliyJ9e8l2sUDgyW8uG9CQ=";
     };
   };
 
@@ -412,8 +412,8 @@ rec {
     srcFileName = "en_CA-large";
     dictFileName = "en_CA";
     src = fetchurl {
-      url = "mirror://sourceforge/wordlist/speller/2018.04.16/hunspell-en_CA-large-2020.12.07.zip";
-      hash = "sha256-RjRIkIb2QDeveqpLyo1s4X90QrZiYylW5d1MCU+Hvuo=";
+      url = "mirror://sourceforge/wordlist/speller/2026.02.25/hunspell-en_CA-large-2026.02.25.zip";
+      hash = "sha256-tLe/SniF3hw1+hs6poMXIJr6WPBNYOigfhJGk0hcWeM=";
     };
   };
 
@@ -424,8 +424,8 @@ rec {
     srcFileName = "en_AU";
     dictFileName = "en_AU";
     src = fetchurl {
-      url = "mirror://sourceforge/wordlist/speller/2020.12.07/hunspell-en_AU-2020.12.07.zip";
-      hash = "sha256-3CBVfEiuGXl4Tnn65vll6ZnI2y6aD4RjSOcAV/znglQ=";
+      url = "mirror://sourceforge/wordlist/speller/2026.02.25/hunspell-en_AU-2026.02.25.zip";
+      hash = "sha256-+FRxWTuXRPZCmMAtB/ti1Ykmv4H7XkVS4rrGRb+kAeA=";
     };
   };
 
@@ -436,8 +436,8 @@ rec {
     srcFileName = "en_AU-large";
     dictFileName = "en_AU";
     src = fetchurl {
-      url = "mirror://sourceforge/wordlist/speller/2018.04.16/hunspell-en_AU-large-2020.12.07.zip";
-      hash = "sha256-SW5HeuewGMe+Ng5gqqL5jn8cl8eJLfk7JFcRJCTGHjE=";
+      url = "mirror://sourceforge/wordlist/speller/2026.02.25/hunspell-en_AU-large-2026.02.25.zip";
+      hash = "sha256-RqJliD0dAciJtxc7ocq64MqRWqQD1qL5PO5MxmEIfbQ=";
     };
   };
 
@@ -448,8 +448,8 @@ rec {
     srcFileName = "en_GB-ise";
     dictFileName = "en_GB";
     src = fetchurl {
-      url = "mirror://sourceforge/wordlist/speller/2018.04.16/hunspell-en_GB-ise-2020.12.07.zip";
-      hash = "sha256-LO1LLsnRiMO1QNu3W1FD9luZDa8XQ3dYcm/x+rXwGtM=";
+      url = "mirror://sourceforge/wordlist/speller/2026.02.25/hunspell-en_GB-ise-2026.02.25.zip";
+      hash = "sha256-1vu5GueCTFL7AvdNe8LNkJLxMPrsYPQjJqWUN/pyR6M=";
     };
   };
 
@@ -460,8 +460,8 @@ rec {
     srcFileName = "en_GB-ize";
     dictFileName = "en_GB";
     src = fetchurl {
-      url = "mirror://sourceforge/wordlist/speller/2018.04.16/hunspell-en_GB-ize-2020.12.07.zip";
-      hash = "sha256-hpt0nsmAW4fNBfQzB/IJmGUTMbWqWwRQZBOvDC3y8jE=";
+      url = "mirror://sourceforge/wordlist/speller/2026.02.25/hunspell-en_GB-ize-2026.02.25.zip";
+      hash = "sha256-xb3ZL8HiHadQOTn+QTnzbyjwHBisNeL8kLUmobe/sJk=";
     };
   };
 
@@ -472,8 +472,8 @@ rec {
     srcFileName = "en_GB-large";
     dictFileName = "en_GB";
     src = fetchurl {
-      url = "mirror://sourceforge/wordlist/speller/2018.04.16/hunspell-en_GB-large-2020.12.07.zip";
-      hash = "sha256-+GvrdyKMc3yMaUaP/E6gZ1EocieIabmKXT7BjxJRB70=";
+      url = "mirror://sourceforge/wordlist/speller/2026.02.25/hunspell-en_GB-large-2026.02.25.zip";
+      hash = "sha256-cEpJQ4o6nU8RzXbbQzprIwuc6HcO4T+ihwAFLEUX3cE=";
     };
   };
 
diff --git a/pkgs/by-name/it/itgmania/themes/digital-dance.nix b/pkgs/by-name/it/itgmania/themes/digital-dance.nix
index f0144e4acd46..b3046c29c44d 100644
--- a/pkgs/by-name/it/itgmania/themes/digital-dance.nix
+++ b/pkgs/by-name/it/itgmania/themes/digital-dance.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "digital-dance";
-  version = "1.1.3-unstable-2026-04-29";
+  version = "1.1.3-unstable-2026-05-09";
 
   src = fetchFromCodeberg {
     owner = "JNero";
     repo = "Digital-Dance-ITGMania";
-    rev = "a26bc9f19be8b899ed5af35c01cdd21fe48ec94f";
-    hash = "sha256-4A87hM+yG6mKfYdC2fZ5lhSDVVH4FPtXStkjC95CcLs=";
+    rev = "aca637dc8f2b47a254bead472da6129f28fa55fd";
+    hash = "sha256-uKweTqF4q0YsOIOpEi5v+N60YvctDF9stcP+GYlUuO4=";
   };
 
   postInstall = ''
diff --git a/pkgs/by-name/it/itgmania/themes/itg3encore.nix b/pkgs/by-name/it/itgmania/themes/itg3encore.nix
index 1056080e6860..836834e97366 100644
--- a/pkgs/by-name/it/itgmania/themes/itg3encore.nix
+++ b/pkgs/by-name/it/itgmania/themes/itg3encore.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "itg3encore";
-  version = "0-unstable-2026-04-29";
+  version = "0-unstable-2026-05-10";
 
   src = fetchFromGitHub {
     owner = "DarkBahamut162";
     repo = "itg3encore";
-    rev = "87ef7392f84acf3c05c03749714a8f9cd893a34e";
-    hash = "sha256-4wHDin/Nphd/BLP4HYsRQDZDWYhMRddv1D44q6Yvhto=";
+    rev = "92fa3cb3234e466891606a047e4d2d104839581b";
+    hash = "sha256-tnb9uGu4VaXlNh9QRbPtCKHS2GWmfFBOMe8/uW9hA0Q=";
   };
 
   postInstall = ''
diff --git a/pkgs/by-name/li/libgit2/package.nix b/pkgs/by-name/li/libgit2/package.nix
index 20655c7b77e1..bfac9149df06 100644
--- a/pkgs/by-name/li/libgit2/package.nix
+++ b/pkgs/by-name/li/libgit2/package.nix
@@ -22,7 +22,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libgit2";
-  version = "1.9.2";
+  version = "1.9.3";
   # also check the following packages for updates: python3Packages.pygit2 and libgit2-glib
 
   outputs = [
@@ -34,8 +34,8 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "libgit2";
     repo = "libgit2";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-TCeEh8DpVoxpF/HkahxM3ONDjawAkIiMo6S7ogG3fLg=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-nJrRdPs86oGNL4W2CJb16oSUgfzYr9A2i5sw9BAehME=";
   };
 
   cmakeFlags = [
@@ -96,6 +96,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   meta = {
+    changelog = "https://github.com/libgit2/libgit2/releases/tag/${finalAttrs.src.tag}";
     description = "Linkable library implementation of Git that you can use in your application";
     mainProgram = "git2";
     homepage = "https://libgit2.org/";
diff --git a/pkgs/by-name/li/lix-diff/package.nix b/pkgs/by-name/li/lix-diff/package.nix
index 19ad58b5f7a1..e516e9462618 100644
--- a/pkgs/by-name/li/lix-diff/package.nix
+++ b/pkgs/by-name/li/lix-diff/package.nix
@@ -6,16 +6,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lix-diff";
-  version = "1.5.0";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "tgirlcloud";
     repo = "lix-diff";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-x2Ec3Pm80IvTzl3gw0mwWRbW1nLZ2V70KegahSDNwH0=";
+    hash = "sha256-mURA7fZ9RAhVtOx+gnEeJI48tyvi+zbKE+xUs5UMPY4=";
   };
 
-  cargoHash = "sha256-1HjmS5wvlX4gGf6AZQnN+37Y3Nf8HVSOHWG2kZCVg1Y=";
+  cargoHash = "sha256-yOVJjn/DaHDsBeSMKJ0bmav+I5JLa9HqII5RKFpc5Hw=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/lu/lux-cli/package.nix b/pkgs/by-name/lu/lux-cli/package.nix
index 488648849021..4bb85d741c10 100644
--- a/pkgs/by-name/lu/lux-cli/package.nix
+++ b/pkgs/by-name/lu/lux-cli/package.nix
@@ -18,18 +18,18 @@
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lux-cli";
 
-  version = "0.28.6";
+  version = "0.29.0";
 
   src = fetchFromGitHub {
     owner = "lumen-oss";
     repo = "lux";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-AzERusMBjc1pQbG1Sbu9LijfVIaWhXetm0LbGTmDYx8=";
+    hash = "sha256-jQkqWngHLHf0myzy7PjiNQFEI0/cq9FZQNst3BzIexs=";
   };
 
   buildAndTestSubdir = "lux-cli";
 
-  cargoHash = "sha256-JbSTMFRbj4y3DeTF54eRXPTRQGOg2A8bK/coFEWbOgs=";
+  cargoHash = "sha256-+geQjo/hvx+ZtF2n2bWfQZMbAI6zPgbDAVH2TZbrKQc=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/by-name/ly/lychee/package.nix b/pkgs/by-name/ly/lychee/package.nix
index a03a270d632c..523513c1e1e5 100644
--- a/pkgs/by-name/ly/lychee/package.nix
+++ b/pkgs/by-name/ly/lychee/package.nix
@@ -16,7 +16,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lychee";
-  version = "0.23.0";
+  version = "0.24.1";
 
   src = fetchFromGitHub {
     owner = "lycheeverse";
@@ -31,10 +31,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
           '("cargo:rustc-env=GIT_DATE={}", "'$GIT_DATE'")'
       rm -rf $out/.git
     '';
-    hash = "sha256-Rfdys16a4N6B3NsmPsB3OpKjLGElFYvd4UtiRipy8iQ=";
+    hash = "sha256-lknj0uTIWYwDm3PA/Q8paVxRn+B9qvfllYUjnp7I4jI=";
   };
 
-  cargoHash = "sha256-5KL/PmBSU8xkOE9/w7uUBkJSOBPsj3Z4o/2VmzA/f3Q=";
+  cargoHash = "sha256-ivLx48qbagjw5zGkYC+ygK83p8q110iEn2YEfUjTFHs=";
 
   nativeBuildInputs = [
     installShellFiles
@@ -45,6 +45,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
   postFixup = lib.optionalString canRun ''
     ${lychee} --generate man > lychee.1
     installManPage lychee.1
+
+    installShellCompletion --cmd lychee \
+      --bash <(${lychee} --generate complete-bash) \
+      --fish <(${lychee} --generate complete-fish) \
+      --zsh <(${lychee} --generate complete-zsh)
   '';
 
   cargoTestFlags = [
diff --git a/pkgs/by-name/ly/lychee/tests/fail-emptyDirectory.nix b/pkgs/by-name/ly/lychee/tests/fail-emptyDirectory.nix
index e59fc9852fa9..d375679d8bca 100644
--- a/pkgs/by-name/ly/lychee/tests/fail-emptyDirectory.nix
+++ b/pkgs/by-name/ly/lychee/tests/fail-emptyDirectory.nix
@@ -2,6 +2,7 @@
   runCommand,
   testers,
   emptyDirectory,
+  jq,
 }:
 let
   sitePkg = runCommand "site" { } ''
@@ -19,14 +20,30 @@ let
       # cannot check URI: InvalidUrlRemap("The remapping pattern must produce a valid URL, but it is not: /nix/store/4d0ix...empty-directory/foo
       "https://example.com" = emptyDirectory;
     };
+    extraArgs = [
+      "--format"
+      "json"
+      "--output"
+      "${placeholder "out"}"
+    ];
   };
 
   failure = testers.testBuildFailure check;
 in
-runCommand "link-check-fail" { inherit failure; } ''
-  # The details of the message might change, but we have to make sure the
-  # correct error is reported, so that we know it's not something else that
-  # went wrong.
-  grep 'empty-directory/foo.*Cannot find file' $failure/testBuildFailure.log >/dev/null
-  touch $out
-''
+runCommand "link-check-fail"
+  {
+    nativeBuildInputs = [ jq ];
+    inherit failure;
+  }
+  ''
+    # The details of the message might change, but we have to make sure the
+    # correct error is reported, so that we know it's not something else that
+    # went wrong.
+    jq -e '.error_map | to_entries[] | .value[] | select(.url | test("empty-directory/foo")) | .status.text | test("File not found")' $failure/result > /dev/null || {
+      echo Lychee output:
+      jq . $failure/result
+      echo 'Did not find expected error in JSON output. Adjust test if behavior is acceptable. It should find the broken link to non-existent `foo`.'
+      exit 1
+    }
+    touch $out
+  ''
diff --git a/pkgs/by-name/ly/lychee/tests/network.nix b/pkgs/by-name/ly/lychee/tests/network.nix
index dcaebe7450d5..9ed8e4b8e260 100644
--- a/pkgs/by-name/ly/lychee/tests/network.nix
+++ b/pkgs/by-name/ly/lychee/tests/network.nix
@@ -14,10 +14,21 @@ let
   check = config.node.pkgs.testers.lycheeLinkCheck {
     site = sitePkg;
   };
+  checkJson = config.node.pkgs.testers.lycheeLinkCheck {
+    site = sitePkg;
+    extraArgs = [
+      "--format"
+      "json"
+    ];
+  };
 in
 {
   name = "testers-lychee-link-check-run";
-  nodes.client = { ... }: { };
+  nodes.client =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [ pkgs.jq ];
+    };
   nodes.example = {
     networking.firewall.allowedTCPPorts = [ 80 ];
     services.nginx = {
@@ -44,28 +55,34 @@ in
         curl --fail -v http://example
     """)
 
-    # FAILURE CASE
+    # TEST CASES
 
-    client.succeed("""
-        exec 1>&2
-        r=0
-        ${lib.getExe check.online} || {
-          r=$?
-        }
-        if [[ $r -ne 2 ]]; then
-            echo "lycheeLinkCheck unexpected exit code $r"
-            exit 1
-        fi
-    """)
+    with subtest("online check detects broken links"):
+        client.succeed("""
+            exec 1>&2
+            r=0
+            ${lib.getExe check.online} || {
+              r=$?
+            }
+            if [[ $r -ne 2 ]]; then
+                echo "lycheeLinkCheck unexpected exit code $r"
+                exit 1
+            fi
+        """)
 
-    # SUCCESS CASE
+    with subtest("online check succeeds when links are fixed"):
+        example.succeed("""
+            echo '<h1>foo</h1>' > /var/www/example/foo.html
+        """)
 
-    example.succeed("""
-        echo '<h1>foo</h1>' > /var/www/example/foo.html
-    """)
+        client.succeed("""
+            ${lib.getExe check.online}
+        """)
 
-    client.succeed("""
-        ${lib.getExe check.online}
-    """)
+    with subtest("extraArgs are passed to the online wrapper"):
+        client.succeed("""
+            ${lib.getExe checkJson.online} --output /tmp/lychee.json
+            jq -e .total /tmp/lychee.json
+        """)
   '';
 }
diff --git a/pkgs/by-name/mi/misconfig-mapper/package.nix b/pkgs/by-name/mi/misconfig-mapper/package.nix
index 0e5ba9973406..41ab919dcb3f 100644
--- a/pkgs/by-name/mi/misconfig-mapper/package.nix
+++ b/pkgs/by-name/mi/misconfig-mapper/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "misconfig-mapper";
-  version = "1.15.5";
+  version = "1.16.0";
 
   src = fetchFromGitHub {
     owner = "intigriti";
     repo = "misconfig-mapper";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-FZN/FGp2hQWaO0OnRzSmHx10Wb2rvhC6MpX/q97N/uQ=";
+    hash = "sha256-WHVNUdzYDC3vV1UDYSAHkwWUlfBvMg1OCh/BwE7shWE=";
   };
 
-  vendorHash = "sha256-eQetkCrVlYtiXezFzj35TnYAt6tntzUuJHqRvWEkuC4=";
+  vendorHash = "sha256-jM+td4OUDK7Z4zZy/w0foupQMYpFhOTIefSUoovgEeE=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ne/nerdctl/package.nix b/pkgs/by-name/ne/nerdctl/package.nix
index a006c0956b13..cc520bd2c1c8 100644
--- a/pkgs/by-name/ne/nerdctl/package.nix
+++ b/pkgs/by-name/ne/nerdctl/package.nix
@@ -14,16 +14,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "nerdctl";
-  version = "2.2.2";
+  version = "2.3.0";
 
   src = fetchFromGitHub {
     owner = "containerd";
     repo = "nerdctl";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Xf4Nit8egVYk5EhPrazgu/xC8LvKT5U2eLIwUjqvFEs=";
+    hash = "sha256-DCAgxqjJruoSTTZqWKOrz/6ZbOubGi4B7tdf2Kg/UGc=";
   };
 
-  vendorHash = "sha256-f/fm4lrt4d1kjwHAyVwkyqalApozOAlAT8WQ/qMtGdI=";
+  vendorHash = "sha256-gOpzsPq0w+85KKa3QMKb+rWuRSfbCFECfHB3PadJNE8=";
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/by-name/nq/nqptp/package.nix b/pkgs/by-name/nq/nqptp/package.nix
index 7f72e76c1885..932300f87e46 100644
--- a/pkgs/by-name/nq/nqptp/package.nix
+++ b/pkgs/by-name/nq/nqptp/package.nix
@@ -8,14 +8,14 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "1.2.6";
+  version = "1.2.7";
   pname = "nqptp";
 
   src = fetchFromGitHub {
     owner = "mikebrady";
     repo = "nqptp";
     tag = finalAttrs.version;
-    hash = "sha256-bU7eTNnPhBA+XTW0SCps/iUCGuxObnv72/Lm+yKEgao=";
+    hash = "sha256-A87sIwn8NgfUGiCsCq/iiwcqnkfZtLbE9LrjLiWiiWc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/oc/oci-cli/package.nix b/pkgs/by-name/oc/oci-cli/package.nix
index 220c7c292dbb..de12c9c98be7 100644
--- a/pkgs/by-name/oc/oci-cli/package.nix
+++ b/pkgs/by-name/oc/oci-cli/package.nix
@@ -26,14 +26,14 @@ in
 
 py.pkgs.buildPythonApplication (finalAttrs: {
   pname = "oci-cli";
-  version = "3.81.0";
+  version = "3.81.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "oracle";
     repo = "oci-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8fZxGvgk46BDeNraEfzA4V/Lptk4QpjlZ+2mvfsWMb0=";
+    hash = "sha256-c4aWIgJ3LJ2a+e6mXJif112oIhEmU//zPYQQguOmqhU=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/by-name/os/osmium/package.nix b/pkgs/by-name/os/osmium/package.nix
index b36d9ad1aeff..f089ea9b23b8 100644
--- a/pkgs/by-name/os/osmium/package.nix
+++ b/pkgs/by-name/os/osmium/package.nix
@@ -112,7 +112,7 @@ stdenv.mkDerivation rec {
       ];
       text = ''
         version="$(curl -s https://updater.osmium.chat/alpha-linux.yml | yq .version)"
-        update-source-version osmium "${version}"
+        update-source-version osmium "$version"
       '';
     });
   };
diff --git a/pkgs/by-name/pa/panache/package.nix b/pkgs/by-name/pa/panache/package.nix
index 58a3ceb9c12b..92033048dfcf 100644
--- a/pkgs/by-name/pa/panache/package.nix
+++ b/pkgs/by-name/pa/panache/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "panache";
-  version = "2.41.1";
+  version = "2.45.0";
 
   src = fetchFromGitHub {
     owner = "jolars";
     repo = "panache";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-creORKgAByvWK6yH1WT/zRlFKStY85eUq8WJottaUCM=";
+    hash = "sha256-IBWZmDqbDt4zf2wL6hVhWGq+JAwte+NO90jUvVtr/YE=";
   };
 
-  cargoHash = "sha256-xReCjJ1eLdzw/LyLVU62RKSyjBBrenCR4YTmt52C2ls=";
+  cargoHash = "sha256-vXSVNPc4h3yAAdWxVg9/7Fkxq6PXEjDcWGjFj6FREEI=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/pr/prefect/package.nix b/pkgs/by-name/pr/prefect/package.nix
index c23de54e11c9..3665acfe6825 100644
--- a/pkgs/by-name/pr/prefect/package.nix
+++ b/pkgs/by-name/pr/prefect/package.nix
@@ -1,207 +1 @@
-{
-  lib,
-  python3Packages,
-  fetchPypi,
-  nixosTests,
-  nix-update-script,
-}:
-
-python3Packages.buildPythonApplication rec {
-  pname = "prefect";
-  version = "3.5.0";
-  pyproject = true;
-
-  # Trying to install from source is challenging
-  # the packaging is using versioningit and looking for
-  # .git directory
-  # Source will be missing sdist, uv.lock, ui artefacts ...
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-BazzO+gR/mLcx+tlysPMJzcqmctUU0LSYL0YMZMyVrg=";
-  };
-
-  pythonRelaxDeps = [
-    "websockets"
-    "typer"
-  ];
-
-  build-system = with python3Packages; [
-    hatchling
-    versioningit
-  ];
-
-  dependencies =
-    with python3Packages;
-    [
-      aiosqlite
-      alembic
-      apprise
-      asyncpg
-      click
-      cryptography
-      dateparser
-      docker
-      graphviz
-      jinja2
-      jinja2-humanize-extension
-      humanize
-      pytz
-      readchar
-      sqlalchemy
-      typer
-      # client dependencies
-      anyio
-      asgi-lifespan
-      cachetools
-      cloudpickle
-      coolname
-      exceptiongroup
-      fastapi
-      fsspec
-      # graphviz already included
-      griffe
-      httpcore
-      httpx
-      jsonpatch
-      jsonschema
-      opentelemetry-api
-      orjson
-      packaging
-      pathspec
-      pendulum
-      pluggy
-      prometheus-client
-      pydantic
-      pydantic-core
-      pydantic-extra-types
-      pydantic-settings
-      python-dateutil
-      python-slugify
-      python-socks
-      pyyaml
-      rfc3339-validator
-      rich
-      ruamel-yaml
-      semver
-      sniffio
-      toml
-      typing-extensions
-      ujson
-      uvicorn
-      websockets
-      whenever
-      uv
-      semver
-    ]
-    ++ sqlalchemy.optional-dependencies.asyncio
-    ++ httpx.optional-dependencies.http2;
-
-  optional-dependencies = with python3Packages; {
-    aws = [
-      # prefect-aws
-    ];
-    azure = [
-      # prefect-azure
-    ];
-    bitbucket = [
-      # prefect-bitbucket
-    ];
-    dask = [
-      # prefect-dask
-    ];
-    databricks = [
-      # prefect-databricks
-    ];
-    dbt = [
-      # prefect-dbt
-    ];
-    docker = [
-      # prefect-docker
-    ];
-    email = [
-      # prefect-email
-    ];
-    gcp = [
-      # prefect-gcp
-    ];
-    github = [
-      # prefect-github
-    ];
-    gitlab = [
-      # prefect-gitlab
-    ];
-    kubernetes = [
-      # prefect-kubernetes
-    ];
-    otel = [
-      opentelemetry-distro
-      opentelemetry-exporter-otlp
-      opentelemetry-instrumentation
-      opentelemetry-instrumentation-logging
-      opentelemetry-test-utils
-    ];
-    ray = [
-      # prefect-ray
-    ];
-    redis = [
-      # prefect-redis
-    ];
-    shell = [
-      # prefect-shell
-    ];
-    slack = [
-      # prefect-slack
-    ];
-    snowflake = [
-      # prefect-snowflake
-    ];
-    sqlalchemy = [
-      # prefect-sqlalchemy
-    ];
-  };
-
-  makeWrapperArgs = [
-    # Add the installed directories to the python path so the worker can find them
-    "--prefix PYTHONPATH : ${python3Packages.makePythonPath dependencies}"
-    "--prefix PYTHONPATH : $out/${python3Packages.python.sitePackages}"
-  ];
-
-  passthru.tests = {
-    inherit (nixosTests) prefect;
-
-    updateScript = nix-update-script {
-      extraArgs = [
-        # avoid pre‐releases
-        "--version-regex"
-        "^(\\d+\\.\\d+\\.\\d+)$"
-      ];
-    };
-  };
-
-  # Tests are not included in the pypi source
-  doCheck = false;
-  # nativeCheckInputs = (
-  #   with python3Packages;
-  #   [
-  #     pytestCheckHook
-  #     pytest-asyncio
-  #     pytest-cov
-  #     pytest-env
-  #     # pytest-flakefinder
-  #     pytest-mypy-plugins
-  #     pytest-timeout
-  #     pytest-xdist
-  #   ]
-  # );
-
-  meta = {
-    description = "Workflow orchestration framework for building resilient data pipelines in Python";
-    homepage = "https://github.com/PrefectHQ/prefect";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [
-      happysalada
-      mrmebelman
-    ];
-    mainProgram = "prefect";
-  };
-}
+{ python3Packages }: python3Packages.toPythonApplication python3Packages.prefect
diff --git a/pkgs/by-name/re/renode-dts2repl/package.nix b/pkgs/by-name/re/renode-dts2repl/package.nix
index 965e88e98b92..ddf0fb45e802 100644
--- a/pkgs/by-name/re/renode-dts2repl/package.nix
+++ b/pkgs/by-name/re/renode-dts2repl/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication {
   pname = "renode-dts2repl";
-  version = "0-unstable-2026-04-30";
+  version = "0-unstable-2026-05-05";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "antmicro";
     repo = "dts2repl";
-    rev = "6a1339b59a0ba5823c812f96d8fcc44c7691660f";
-    hash = "sha256-bMPdMJbxzk+/DYgU4lminLjuWEB5nhvxFU9FlO3UcqE=";
+    rev = "3137db4ec2c85749cfc57bf05b460529d4e52a94";
+    hash = "sha256-PHtt31DGvOWgutgqbBcOr2vjdvnjaJmCTpRbHtx8MJw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/so/sone/package.nix b/pkgs/by-name/so/sone/package.nix
index f0b13accff4b..2ee76a73c3a6 100644
--- a/pkgs/by-name/so/sone/package.nix
+++ b/pkgs/by-name/so/sone/package.nix
@@ -22,21 +22,21 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "sone";
-  version = "0.14.1";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "lullabyX";
     repo = "sone";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8vdpEjo2UP3vh/PL8+lhLPDfuHeI9kI2/AQvVsWlR1w=";
+    hash = "sha256-QxA9ab/BVmYvsZb++ykWZ80TDpIMWQb5LJazdUab+pM=";
   };
 
-  cargoHash = "sha256-zsEO/YnipPNm7TSWcM3tQ+oOF8M5VK5BiUMhsvPcGwQ=";
+  cargoHash = "sha256-zWW/x92/HAa6AsXe0fIQmQrGKtsR2sX/vyG7uwsl3Bc=";
 
   npmDeps = fetchNpmDeps {
     name = "${finalAttrs.pname}-npm-deps-${finalAttrs.version}";
     inherit (finalAttrs) src;
-    hash = "sha256-EOmoryKKWCttpOpIAOpdIz7yOA5hm/Hg1WFbcXWr5tc=";
+    hash = "sha256-MORNCIA/LC6DTNUqXvKk4hHnoKDZEC+poANcNOHQPyM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/st/stackit-cli/package.nix b/pkgs/by-name/st/stackit-cli/package.nix
index beee09671db1..19aaa773b7a3 100644
--- a/pkgs/by-name/st/stackit-cli/package.nix
+++ b/pkgs/by-name/st/stackit-cli/package.nix
@@ -12,16 +12,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "stackit-cli";
-  version = "0.61.0";
+  version = "0.62.0";
 
   src = fetchFromGitHub {
     owner = "stackitcloud";
     repo = "stackit-cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-kuo0Fj/LgkbTLp+F6xvPUOS5vabjigwX4fVWLQVwO2I=";
+    hash = "sha256-vgG2F2fI8whwAoHKU5f+LEeI+mmJ2oPzObwtmKSrsoo=";
   };
 
-  vendorHash = "sha256-NYvqQVDqSV5wyQGEkoAHnT0i+iNF6DKIYIwyiYY5G6M=";
+  vendorHash = "sha256-7Zxxom+RJJ4cjQ8Knl/96MUMRrQp3P4wQjSNUccLTYw=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/ta/tasks/package.nix b/pkgs/by-name/ta/tasks/package.nix
index 9605b7ad2df6..110552f449e8 100644
--- a/pkgs/by-name/ta/tasks/package.nix
+++ b/pkgs/by-name/ta/tasks/package.nix
@@ -13,16 +13,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tasks";
-  version = "0.2.0";
+  version = "0.2.4";
+
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "cosmic-utils";
     repo = "tasks";
     tag = finalAttrs.version;
-    hash = "sha256-R8wXIw9Gn4uyLoXxyjp/bcK8vK7NkG/chcHe8LtTvo8=";
+    hash = "sha256-u8TYKXFbrF2fseMNGNOBAkgCA53af5gi1PDKS2FIE5I=";
   };
 
-  cargoHash = "sha256-iJutA18TvsWJceacfhzfEQa5zaQBMVC7fmtF1uPN3sQ=";
+  cargoHash = "sha256-96uk8tQgvDbgZTC0ypzWRmWNToCUGnVefPyhI69nxxs=";
 
   nativeBuildInputs = [
     libcosmicAppHook
diff --git a/pkgs/by-name/tf/tfmigrate/package.nix b/pkgs/by-name/tf/tfmigrate/package.nix
index 33d7e793a7ef..c8c19af521eb 100644
--- a/pkgs/by-name/tf/tfmigrate/package.nix
+++ b/pkgs/by-name/tf/tfmigrate/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "tfmigrate";
-  version = "0.4.4";
+  version = "0.4.5";
 
   src = fetchFromGitHub {
     owner = "minamijoyo";
     repo = "tfmigrate";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-633b7VZ0/JNWuBh0C9CtbG5XdgTD2zLuotBbgv0a2e8=";
+    hash = "sha256-NXsAwJTIVlgSC+RdumXsfHIjXfNm37PjLrEWaf+85aM=";
   };
 
   vendorHash = "sha256-TqZi5NZ+4eSzq98/ZM4Gab7Sud7bz1DNHrp5nGaGHDE=";
diff --git a/pkgs/by-name/ti/tigerbeetle/package.nix b/pkgs/by-name/ti/tigerbeetle/package.nix
index 27e110de1cc1..f3dd3a8a1107 100644
--- a/pkgs/by-name/ti/tigerbeetle/package.nix
+++ b/pkgs/by-name/ti/tigerbeetle/package.nix
@@ -10,14 +10,14 @@ let
   platform =
     if stdenvNoCC.hostPlatform.isDarwin then "universal-macos" else stdenvNoCC.hostPlatform.system;
   hash = builtins.getAttr platform {
-    "universal-macos" = "sha256-TkgrZQNlgB039sVlqOST0oEzwpk7d04ujrw5GM+Hemo=";
-    "x86_64-linux" = "sha256-tzN5BB1jNAuQi6cLEoRylflAJZgd7WhQ8QV+bx276jM=";
-    "aarch64-linux" = "sha256-Ny+N9k6J6++yhBGeMVbIG6Mh5H048Lf+2iCja/2pVOU=";
+    "universal-macos" = "sha256-1Zn/JeRCwLH1kC+sZGNdez2Um6VZgEvCf4BwbWTfMSs=";
+    "x86_64-linux" = "sha256-T2CjzbpxfOPYgJpAqOqcID1pvGW7FJFpRk6/hdgKiOk=";
+    "aarch64-linux" = "sha256-Y4UsPOno5bfWGHYh2BwV2L9xLiFjv/wuVAW+FSevuV8=";
   };
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tigerbeetle";
-  version = "0.17.2";
+  version = "0.17.3";
 
   src = fetchzip {
     url = "https://github.com/tigerbeetle/tigerbeetle/releases/download/${finalAttrs.version}/tigerbeetle-${platform}.zip";
diff --git a/pkgs/by-name/ti/tinymist/package.nix b/pkgs/by-name/ti/tinymist/package.nix
index 188e1f452d63..f02221ed9ea8 100644
--- a/pkgs/by-name/ti/tinymist/package.nix
+++ b/pkgs/by-name/ti/tinymist/package.nix
@@ -15,16 +15,18 @@ rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tinymist";
   # Please update the corresponding vscode extension when updating
   # this derivation.
-  version = "0.14.16";
+  version = "0.14.18";
+
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "Myriad-Dreamin";
     repo = "tinymist";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Lcv/yAH+4LlzaFhTk5GA3WHxm8gHWO+7560zolTCIIM=";
+    hash = "sha256-udA5W6AhK11zuFmfedDueRY01Rr2ZXmbN5DrIcuvbVo=";
   };
 
-  cargoHash = "sha256-D9G08K2rp0uBFz+1LktdH8thGNpzaTD2QCCV2P3Hl9M=";
+  cargoHash = "sha256-L+U47ZYtU51wRjDD1lMyxoYaKZIUnyuZ0C885YnBauA=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/ty/ty/package.nix b/pkgs/by-name/ty/ty/package.nix
index ad3b51b0bb6a..0d9f6920c364 100644
--- a/pkgs/by-name/ty/ty/package.nix
+++ b/pkgs/by-name/ty/ty/package.nix
@@ -17,14 +17,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ty";
-  version = "0.0.34";
+  version = "0.0.35";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "ty";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-pLe25JRy6xrFVuNCQKwp9k3Mvc4pfYKF6Xi17yMgSzw=";
+    hash = "sha256-ce3v/ZUlMNMGlikWSriGybScUrRharFswq5Z47dTtKY=";
   };
 
   # For Darwin platforms, remove the integration test for file notifications,
@@ -38,7 +38,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoBuildFlags = [ "--package=ty" ];
 
-  cargoHash = "sha256-A/oJeFIY/+Pu9jYp3hwGwkSAXfF0VLTHKGP48wsnheo=";
+  cargoHash = "sha256-9/4+cK7BdJbXQKK7xC9MMfqARlivbuyYZ8j02srakxU=";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = [ rust-jemalloc-sys ];
diff --git a/pkgs/by-name/wa/wayscriber/package.nix b/pkgs/by-name/wa/wayscriber/package.nix
index 60e0f17b276e..4ddfa8db0296 100644
--- a/pkgs/by-name/wa/wayscriber/package.nix
+++ b/pkgs/by-name/wa/wayscriber/package.nix
@@ -10,20 +10,20 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wayscriber";
-  version = "0.9.16";
+  version = "0.9.17";
 
   src = fetchFromGitHub {
     owner = "devmobasa";
     repo = "wayscriber";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gfWvepANARgXXdpTRdAr9zZNfAxwi9icEbvP3AMFsUI=";
+    hash = "sha256-ylvZ+U8et9McvZrHsJFLoWWAtruQnKMk/5lg4uCw/rg=";
   };
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     pango
     libxkbcommon
   ];
-  cargoHash = "sha256-SqTWkbuW2Dy/e5oCr7G7m/T5/kLpf+ZPKxXKPDeRX9U=";
+  cargoHash = "sha256-/q4ux2MXDfrqbUfO1M2lykpDl03MTnVS4ottxSgDFEQ=";
   passthru.updateScript = nix-update-script { };
 
   meta = {
diff --git a/pkgs/by-name/xd/xdp-tools/package.nix b/pkgs/by-name/xd/xdp-tools/package.nix
index 55284f9c2bab..1e5e8067a0a0 100644
--- a/pkgs/by-name/xd/xdp-tools/package.nix
+++ b/pkgs/by-name/xd/xdp-tools/package.nix
@@ -74,6 +74,8 @@ stdenv.mkDerivation (finalAttrs: {
     "LIBDIR=$(lib)/lib"
   ];
 
+  enableParallelBuilding = true;
+
   postInstall = ''
     # Note that even the static libxdp would refer to BPF_OBJECT_DIR ?=$(LIBDIR)/bpf
     rm "$lib"/lib/*.a
diff --git a/pkgs/by-name/zf/zfs-replicate/package.nix b/pkgs/by-name/zf/zfs-replicate/package.nix
index 132a668bf229..c0ee00252530 100644
--- a/pkgs/by-name/zf/zfs-replicate/package.nix
+++ b/pkgs/by-name/zf/zfs-replicate/package.nix
@@ -8,14 +8,15 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "zfs_replicate";
-  version = "4.0.0";
+  version = "4.1.0";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "alunduil";
     repo = "zfs-replicate";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VajMSoFZ4SQXpuF1Lo6S9IhxvspCfUwpNw5zg16uA3M=";
+    hash = "sha256-7UoFx2XtadsQqavR5BTwbylaDksWSRxy5o+2hCOzfBw=";
   };
 
   # For compression to work, both local and remote systems must have lz4 installed.
@@ -42,8 +43,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
     pytestCheckHook
   ];
 
-  doCheck = true;
-
   disabledTestPaths = lib.optionals stdenv.hostPlatform.isDarwin [
     # AssertionError: Expected SystemExit or FileNotFoundError
     "zfs_test/replicate_test/cli_test/main_test.py"
diff --git a/pkgs/by-name/zl/zlint/package.nix b/pkgs/by-name/zl/zlint/package.nix
index ff92681b975e..b54b32677997 100644
--- a/pkgs/by-name/zl/zlint/package.nix
+++ b/pkgs/by-name/zl/zlint/package.nix
@@ -7,18 +7,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "zlint";
-  version = "3.6.8";
+  version = "3.7.0";
 
   src = fetchFromGitHub {
     owner = "zmap";
     repo = "zlint";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Mi7ySXVqnL/LVi4YS1r4hBcM/JrjThJEkw3+1k1vjRQ=";
+    hash = "sha256-e12GMbUsZFm0yPD4yh+kuK47YKvDC+VcSfth2radyUk=";
   };
 
   modRoot = "v3";
 
-  vendorHash = "sha256-AdJxcJ/qjY6lzoK4PGNjR+7lYAypgCOk6Nt5sqP+ayA=";
+  vendorHash = "sha256-7g/97DjtXOsWFguWeYi7jLe7xeW1sfY0BrQxYbtIZyM=";
 
   excludedPackages = [
     "cmd/genTestCerts"
diff --git a/pkgs/by-name/zs/zsh-completion-sync/package.nix b/pkgs/by-name/zs/zsh-completion-sync/package.nix
index 5d309f3cb4c0..fde4c3bb8522 100644
--- a/pkgs/by-name/zs/zsh-completion-sync/package.nix
+++ b/pkgs/by-name/zs/zsh-completion-sync/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "zsh-completion-sync";
-  version = "0.3.3";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "BronzeDeer";
     repo = "zsh-completion-sync";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-GTW4nLVW1/09aXNnZJuKs12CoalzWGKB79VsQ2a2Av4=";
+    sha256 = "sha256-GMZ0W8d0Qd5EhrwA/SkeOqDzoUchxDermcTR0iKYP8M=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/coq-modules/trakt/default.nix b/pkgs/development/coq-modules/trakt/default.nix
index c0de83cdab4e..786ab879f697 100644
--- a/pkgs/development/coq-modules/trakt/default.nix
+++ b/pkgs/development/coq-modules/trakt/default.nix
@@ -10,6 +10,7 @@
 mkCoqDerivation {
   pname = "trakt";
   owner = "ecranceMERCE";
+  opam-name = "rocq-trakt";
 
   release."1.0".sha256 = "sha256-Qhw5fWFYxUFO2kIWWz/og+4fuy9aYG27szfNk3IglhY=";
   release."1.1".sha256 = "sha256-JmrtM9WcT8Bfy0WZCw8xdubuMomyXmfLXJwpnCNrvsg=";
@@ -42,6 +43,8 @@ mkCoqDerivation {
     stdlib
   ];
 
+  useDuneifVersion = v: v != null && (v == "dev" || lib.versions.isGt "1.2.1" v);
+
   meta = {
     description = "Generic goal preprocessing tool for proof automation tactics in Coq";
     maintainers = with lib.maintainers; [ siraben ];
diff --git a/pkgs/development/python-modules/aiogram/default.nix b/pkgs/development/python-modules/aiogram/default.nix
index 6202c02c770b..794258dc934a 100644
--- a/pkgs/development/python-modules/aiogram/default.nix
+++ b/pkgs/development/python-modules/aiogram/default.nix
@@ -28,14 +28,14 @@
 
 buildPythonPackage rec {
   pname = "aiogram";
-  version = "3.27.0";
+  version = "3.28.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aiogram";
     repo = "aiogram";
     tag = "v${version}";
-    hash = "sha256-asMTUfC2hRL8vSmv+q86kKzVNFrT5Nk9pGkSjrFsMuo=";
+    hash = "sha256-jy0OOeDiDh2ff3wIR6mYc8P8dOIgVeK0WVQYeug4yEI=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/amplitude-analytics/default.nix b/pkgs/development/python-modules/amplitude-analytics/default.nix
new file mode 100644
index 000000000000..0f506a7e5322
--- /dev/null
+++ b/pkgs/development/python-modules/amplitude-analytics/default.nix
@@ -0,0 +1,36 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytestCheckHook,
+
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "amplitude-analytics";
+  version = "1.2.3";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "amplitude";
+    repo = "Amplitude-Python";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-on4TJPiPyznYkBeJsTd7W59KhN7UaSX5+XJaSjkqFaE=";
+  };
+
+  build-system = [ setuptools ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "amplitude" ];
+
+  meta = {
+    description = "Official Amplitude backend Python SDK for server-side instrumentation";
+    homepage = "https://github.com/amplitude/Amplitude-Python";
+    downloadPage = "https://github.com/amplitude/Amplitude-Python/releases";
+    changelog = "https://github.com/amplitude/Amplitude-Python/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ prince213 ];
+  };
+})
diff --git a/pkgs/development/python-modules/burner-redis/default.nix b/pkgs/development/python-modules/burner-redis/default.nix
new file mode 100644
index 000000000000..c8ffe4e2c8dc
--- /dev/null
+++ b/pkgs/development/python-modules/burner-redis/default.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytestCheckHook,
+  rustPlatform,
+
+  pytest-asyncio,
+  redis,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "burner-redis";
+  version = "0.1.6";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "prefectlabs";
+    repo = "burner-redis";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-soXwXxo8vVGEEM5iDNFa86zlPA+e74b+AS9diUoOdME=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-0qdmcoRje7OkHnGhO8CaR/g38yL9K8Jc+1KjfW4xPTQ=";
+  };
+
+  nativeBuildInputs = [
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+  ];
+
+  pythonImportsCheck = [ "burner_redis" ];
+
+  doCheck = true;
+  nativeCheckInputs = [
+    pytestCheckHook
+
+    pytest-asyncio
+    redis
+  ];
+
+  meta = {
+    description = "Embedded, in-process Redis-compatible database";
+    homepage = "https://github.com/prefectlabs/burner-redis";
+    downloadPage = "https://github.com/prefectlabs/burner-redis/releases";
+    changelog = "https://github.com/prefectlabs/burner-redis/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ prince213 ];
+  };
+})
diff --git a/pkgs/development/python-modules/esp-idf-size/default.nix b/pkgs/development/python-modules/esp-idf-size/default.nix
index 4484902d066a..12e8bf409b04 100644
--- a/pkgs/development/python-modules/esp-idf-size/default.nix
+++ b/pkgs/development/python-modules/esp-idf-size/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "esp-idf-size";
-  version = "2.2.0";
+  version = "2.2.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "espressif";
     repo = "esp-idf-size";
     tag = "v${version}";
-    hash = "sha256-tiNk1yh8FPwLEKAw+h+Lp5n0aY/FpTwqZjtAQtZK6eY=";
+    hash = "sha256-kjGO9uLj7/k8WCH6mARFOI4r8IhH/urGKR/23waaOFo=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/fakeredis/default.nix b/pkgs/development/python-modules/fakeredis/default.nix
index f2cb17ddb590..74e0f892129b 100644
--- a/pkgs/development/python-modules/fakeredis/default.nix
+++ b/pkgs/development/python-modules/fakeredis/default.nix
@@ -2,30 +2,32 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  pytestCheckHook,
+  redisTestHook,
+
+  hatchling,
   hypothesis,
   jsonpath-ng,
   lupa,
-  hatchling,
+  numpy,
   pyprobables,
   pytest-asyncio,
   pytest-mock,
-  pytestCheckHook,
   redis,
-  redisTestHook,
   sortedcontainers,
   valkey,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "fakeredis";
-  version = "2.33.0";
+  version = "2.35.1";
   pyproject = true;
 
   src = fetchFromGitHub {
-    owner = "dsoftwareinc";
+    owner = "cunla";
     repo = "fakeredis-py";
-    tag = "v${version}";
-    hash = "sha256-uvbvrziVdoa/ip8MbZG8GcpN1FoINxUV+SDVRmg78Qs=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-euhWKXFERpRoXX7G81ffAygt5e1mt7uy9Y9zAGacu38=";
   };
 
   build-system = [ hatchling ];
@@ -42,6 +44,10 @@ buildPythonPackage rec {
     cf = [ pyprobables ];
     probabilistic = [ pyprobables ];
     valkey = [ valkey ];
+    vectorset = [
+      jsonpath-ng
+      numpy
+    ];
   };
 
   nativeCheckInputs = [
@@ -58,23 +64,8 @@ buildPythonPackage rec {
   disabledTestMarks = [ "slow" ];
 
   disabledTests = [
-    "test_init_args" # AttributeError: module 'fakeredis' has no attribute 'FakeValkey'
-    "test_async_init_kwargs" # AttributeError: module 'fakeredis' has no attribute 'FakeAsyncValkey'"
-
     # redis.exceptions.ResponseError: unknown command 'evalsha'
     "test_async_lock"
-
-    # AssertionError: assert [0, b'1'] == [0, 1.0]
-    "test_zrank_redis7_2"
-    "test_zrevrank_redis7_2"
-
-    # KeyError: 'tot-mem'
-    "test_acl_log_auth_exist"
-    "test_acl_log_invalid_channel"
-    "test_acl_log_invalid_key"
-    "test_client_id"
-    "test_client_info"
-    "test_client_list"
   ];
 
   preCheck = ''
@@ -83,9 +74,9 @@ buildPythonPackage rec {
 
   meta = {
     description = "Fake implementation of Redis API";
-    homepage = "https://github.com/dsoftwareinc/fakeredis-py";
-    changelog = "https://github.com/cunla/fakeredis-py/releases/tag/${src.tag}";
+    homepage = "https://github.com/cunla/fakeredis-py";
+    changelog = "https://github.com/cunla/fakeredis-py/releases/tag/${finalAttrs.src.tag}";
     license = with lib.licenses; [ bsd3 ];
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/llama-index-vector-stores-qdrant/default.nix b/pkgs/development/python-modules/llama-index-vector-stores-qdrant/default.nix
index 485bc8392781..ee42db423b63 100644
--- a/pkgs/development/python-modules/llama-index-vector-stores-qdrant/default.nix
+++ b/pkgs/development/python-modules/llama-index-vector-stores-qdrant/default.nix
@@ -10,13 +10,13 @@
 
 buildPythonPackage rec {
   pname = "llama-index-vector-stores-qdrant";
-  version = "0.10.0";
+  version = "0.10.1";
   pyproject = true;
 
   src = fetchPypi {
     pname = "llama_index_vector_stores_qdrant";
     inherit version;
-    hash = "sha256-FzhV/4L//t2lskwlYfim3NnaJDGBQxiN6FRw9mZ6hOo=";
+    hash = "sha256-/vTKhBHD4zY2qrz4g5Qf3nqdbeqkUlTugGJ/LQ/79VE=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/nodriver/default.nix b/pkgs/development/python-modules/nodriver/default.nix
index fa728fcda1d2..8dd60efd35ce 100644
--- a/pkgs/development/python-modules/nodriver/default.nix
+++ b/pkgs/development/python-modules/nodriver/default.nix
@@ -18,6 +18,11 @@ buildPythonPackage rec {
     hash = "sha256-SsjNiLavEzwm3BV/t49asXRipZtKDaMwTjrxK75LQ0M=";
   };
 
+  patches = [
+    # https://github.com/ultrafunkamsterdam/nodriver/pull/36
+    ./python-3.14-network-py-encoding.patch
+  ];
+
   dependencies = [
     deprecated
     mss
diff --git a/pkgs/development/python-modules/nodriver/python-3.14-network-py-encoding.patch b/pkgs/development/python-modules/nodriver/python-3.14-network-py-encoding.patch
new file mode 100644
index 000000000000..7c1d18787ab8
--- /dev/null
+++ b/pkgs/development/python-modules/nodriver/python-3.14-network-py-encoding.patch
@@ -0,0 +1,11 @@
+--- a/nodriver/cdp/network.py
++++ b/nodriver/cdp/network.py
+@@ -1362,7 +1362,7 @@
+     #: Cookie expiration date as the number of seconds since the UNIX epoch.
+     #: The value is set to -1 if the expiry date is not set.
+     #: The value can be null for values that cannot be represented in
+-    #: JSON (�Inf).
++    #: JSON (±Inf).
+     expires: typing.Optional[float] = None
+ 
+     #: Cookie SameSite type.
diff --git a/pkgs/development/python-modules/pipcl/default.nix b/pkgs/development/python-modules/pipcl/default.nix
new file mode 100644
index 000000000000..227a4eb5f5da
--- /dev/null
+++ b/pkgs/development/python-modules/pipcl/default.nix
@@ -0,0 +1,34 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "pipcl";
+  version = "4";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "ArtifexSoftware";
+    repo = "pipcl";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-1dTjxMuOFWeK4L+m4dbllNVwV36MmhsICTplfEKIOxk=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  pythonImportsCheck = [
+    "pipcl"
+  ];
+
+  meta = {
+    description = "Python packaging operations for use by a `setup.py";
+    homepage = "https://github.com/ArtifexSoftware/pipcl";
+    license = lib.licenses.agpl3Plus;
+    maintainers = with lib.maintainers; [ sarahec ];
+  };
+})
diff --git a/pkgs/development/python-modules/prefect/default.nix b/pkgs/development/python-modules/prefect/default.nix
new file mode 100644
index 000000000000..900f3de319e8
--- /dev/null
+++ b/pkgs/development/python-modules/prefect/default.nix
@@ -0,0 +1,305 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  nixosTests,
+  nix-update-script,
+  pytestCheckHook,
+  pythonAtLeast,
+  pythonOlder,
+  replaceVars,
+  writableTmpDirAsHomeHook,
+  writeShellScriptBin,
+
+  aiosqlite,
+  alembic,
+  amplitude-analytics,
+  anyio,
+  apprise,
+  asgi-lifespan,
+  asyncpg,
+  boto3,
+  cachetools,
+  click,
+  cloudpickle,
+  coolname,
+  cryptography,
+  cyclopts,
+  dateparser,
+  docker,
+  exceptiongroup,
+  fastapi,
+  fsspec,
+  graphviz,
+  griffe,
+  hatchling,
+  httpcore,
+  httpx,
+  humanize,
+  jinja2-humanize-extension,
+  jinja2,
+  jsonpatch,
+  jsonschema,
+  moto,
+  numpy,
+  opentelemetry-api,
+  opentelemetry-distro,
+  opentelemetry-exporter-otlp,
+  opentelemetry-instrumentation,
+  opentelemetry-instrumentation-logging,
+  opentelemetry-instrumentation-system-metrics,
+  opentelemetry-sdk,
+  opentelemetry-test-utils,
+  orjson,
+  packaging,
+  pathspec,
+  pendulum,
+  pluggy,
+  prometheus-client,
+  pydantic-core,
+  pydantic-extra-types,
+  pydantic-settings,
+  pydantic,
+  pydocket,
+  pytest-asyncio,
+  pytest-env,
+  pytest-timeout,
+  pytest-xdist,
+  python-dateutil,
+  python-on-whales,
+  python-slugify,
+  pytz,
+  pyyaml,
+  readchar,
+  respx,
+  rfc3339-validator,
+  rich,
+  ruamel-yaml-clib,
+  ruamel-yaml,
+  semver,
+  sniffio,
+  sqlalchemy,
+  toml,
+  typing-extensions,
+  uv,
+  uvicorn,
+  versioningit,
+  watchfiles,
+  websockets,
+  whenever,
+  yamllint,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "prefect";
+  version = "3.7.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "PrefectHQ";
+    repo = "prefect";
+    tag = finalAttrs.version;
+    hash = "sha256-AfiXH9u6W6UpE8hepNzPGIm1cxC+5RonhtBYWMu2IaQ=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail \
+        'default-version = "3.6.24+nogit"' \
+        'default-version = "${finalAttrs.version}"'
+  ''
+  + lib.optionalString finalAttrs.doCheck ''
+    substituteInPlace src/prefect/__init__.py \
+      --replace-fail \
+        '__development_base_path__: pathlib.Path = __module_path__.parents[1]' \
+        '__development_base_path__: pathlib.Path = pathlib.Path("${finalAttrs.src}")'
+  '';
+
+  # versioningit: NotVCSError: Git not installed; assuming this isn't a Git repository
+  nativeBuildInputs = [
+    (writeShellScriptBin "git" "false")
+  ];
+
+  build-system = [
+    hatchling
+    versioningit
+  ];
+
+  dependencies = [
+    aiosqlite
+    alembic
+    apprise
+    asyncpg
+    click
+    cryptography
+    cyclopts
+    dateparser
+    docker
+    jinja2
+    jinja2-humanize-extension
+    pytz
+    readchar
+    sqlalchemy
+    # client dependencies
+    amplitude-analytics
+    anyio
+    asgi-lifespan
+    cachetools
+    cloudpickle
+    coolname
+    exceptiongroup
+    fastapi
+    fsspec
+    graphviz
+    griffe
+    httpcore
+    httpx
+    humanize
+    jsonpatch
+    jsonschema
+    opentelemetry-api
+    orjson
+    packaging
+    pathspec
+    pluggy
+    prometheus-client
+    pydantic
+    pydantic-core
+    pydantic-extra-types
+    pydantic-settings
+    pydocket
+    python-dateutil
+    python-slugify
+    pyyaml
+    rfc3339-validator
+    rich
+    ruamel-yaml
+    ruamel-yaml-clib
+    semver
+    sniffio
+    toml
+    typing-extensions
+    uvicorn
+    websockets
+  ]
+  ++ sqlalchemy.optional-dependencies.asyncio
+  ++ httpx.optional-dependencies.http2
+  ++ lib.optional (pythonOlder "3.13") pendulum
+  ++ lib.optional (pythonAtLeast "3.13") whenever;
+
+  optional-dependencies = {
+    aws = [
+      # prefect-aws
+    ];
+    azure = [
+      # prefect-azure
+    ];
+    bitbucket = [
+      # prefect-bitbucket
+    ];
+    buildx = [
+      python-on-whales
+    ];
+    bundles = [
+      uv
+    ];
+    dask = [
+      # prefect-dask
+    ];
+    databricks = [
+      # prefect-databricks
+    ];
+    dbt = [
+      # prefect-dbt
+    ];
+    docker = [
+      # prefect-docker
+    ];
+    email = [
+      # prefect-email
+    ];
+    gcp = [
+      # prefect-gcp
+    ];
+    github = [
+      # prefect-github
+    ];
+    gitlab = [
+      # prefect-gitlab
+    ];
+    kubernetes = [
+      # prefect-kubernetes
+    ];
+    otel = [
+      opentelemetry-distro
+      opentelemetry-exporter-otlp
+      opentelemetry-instrumentation
+      opentelemetry-instrumentation-logging
+      opentelemetry-instrumentation-system-metrics
+      opentelemetry-test-utils
+    ];
+    ray = [
+      # prefect-ray
+    ];
+    redis = [
+      # prefect-redis
+    ];
+    shell = [
+      # prefect-shell
+    ];
+    slack = [
+      # prefect-slack
+    ];
+    snowflake = [
+      # prefect-snowflake
+    ];
+    sqlalchemy = [
+      # prefect-sqlalchemy
+    ];
+  };
+
+  passthru.tests = {
+    inherit (nixosTests) prefect;
+
+    updateScript = nix-update-script {
+      extraArgs = [
+        # avoid pre‐releases
+        "--version-regex"
+        "^(\\d+\\.\\d+\\.\\d+)$"
+      ];
+    };
+  };
+
+  # FIXME: build killed at ~30%
+  doCheck = false;
+  nativeCheckInputs = [
+    pytestCheckHook
+    writableTmpDirAsHomeHook
+
+    boto3
+    moto
+    numpy
+    opentelemetry-sdk
+    opentelemetry-test-utils
+    pytest-asyncio
+    pytest-env
+    pytest-timeout
+    pytest-xdist
+    respx
+    uv
+    uvicorn
+    watchfiles
+    yamllint
+  ];
+
+  meta = {
+    description = "Workflow orchestration framework for building resilient data pipelines in Python";
+    homepage = "https://github.com/PrefectHQ/prefect";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
+      happysalada
+      mrmebelman
+    ];
+    mainProgram = "prefect";
+  };
+})
diff --git a/pkgs/development/python-modules/pydocket/default.nix b/pkgs/development/python-modules/pydocket/default.nix
index 0bbd557b70de..256562709b55 100644
--- a/pkgs/development/python-modules/pydocket/default.nix
+++ b/pkgs/development/python-modules/pydocket/default.nix
@@ -2,17 +2,18 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  pytestCheckHook,
 
   # build-system
   hatch-vcs,
   hatchling,
 
   # dependencies
+  burner-redis,
   cloudpickle,
-  fakeredis,
+  cronsim,
   opentelemetry-api,
-  opentelemetry-exporter-prometheus,
-  opentelemetry-instrumentation,
+  opentelemetry-sdk,
   prometheus-client,
   py-key-value-aio,
   python-json-logger,
@@ -20,18 +21,25 @@
   rich,
   typer,
   typing-extensions,
+  uncalled-for,
+
+  docker,
+  pytest-asyncio,
+  pytest-cov,
+  pytest-timeout,
+  pytest-xdist,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "pydocket";
-  version = "0.17.1";
+  version = "0.20.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "chrisguidry";
     repo = "docket";
     tag = finalAttrs.version;
-    hash = "sha256-p3FqIHulsBxI7oyiahEruARXBuA2QAYdQeVh83OFHbg=";
+    hash = "sha256-QCx1tpiMkyIveay3OwnjcTRb8pTJNcTjOyor59oYHqQ=";
   };
 
   build-system = [
@@ -39,17 +47,11 @@ buildPythonPackage (finalAttrs: {
     hatchling
   ];
 
-  pythonRelaxDeps = [
-    "fakeredis"
-    "opentelemetry-exporter-prometheus"
-    "opentelemetry-instrumentation"
-  ];
   dependencies = [
+    burner-redis
     cloudpickle
-    fakeredis
+    cronsim
     opentelemetry-api
-    opentelemetry-exporter-prometheus
-    opentelemetry-instrumentation
     prometheus-client
     py-key-value-aio
     python-json-logger
@@ -57,15 +59,31 @@ buildPythonPackage (finalAttrs: {
     rich
     typer
     typing-extensions
+    uncalled-for
   ]
-  ++ fakeredis.optional-dependencies.lua
   ++ py-key-value-aio.optional-dependencies.memory
   ++ py-key-value-aio.optional-dependencies.redis;
 
+  optional-dependencies = {
+    metrics = [
+      opentelemetry-sdk
+    ];
+  };
+
   pythonImportsCheck = [ "docket" ];
 
   # All tests require internet access
   doCheck = false;
+  nativeCheckInputs = [
+    pytestCheckHook
+
+    docker
+    opentelemetry-sdk
+    pytest-asyncio
+    pytest-cov
+    pytest-timeout
+    pytest-xdist
+  ];
 
   meta = {
     description = "Distributed background task system for Python";
diff --git a/pkgs/development/python-modules/pymupdf/default.nix b/pkgs/development/python-modules/pymupdf/default.nix
index 58f4da5afd4a..a087c6442d91 100644
--- a/pkgs/development/python-modules/pymupdf/default.nix
+++ b/pkgs/development/python-modules/pymupdf/default.nix
@@ -8,6 +8,7 @@
 
   # build-system
   libclang,
+  pipcl,
   psutil,
   setuptools,
   swig,
@@ -44,14 +45,14 @@ let
 in
 buildPythonPackage (finalAttrs: {
   pname = "pymupdf";
-  version = "1.27.2.2";
+  version = "1.27.2.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pymupdf";
     repo = "PyMuPDF";
     tag = finalAttrs.version;
-    hash = "sha256-o70IMa64jjX+b83uW4gISOiNrWtefQ8nc8Z99DfqrQI=";
+    hash = "sha256-KeddkzRkJ/tcINftYrx/BY0Z3WUaTU9iBqL5UorvclU=";
   };
 
   patches = [
@@ -75,6 +76,7 @@ buildPythonPackage (finalAttrs: {
 
   build-system = [
     libclang
+    pipcl
     swig
     setuptools
   ];
@@ -151,6 +153,76 @@ buildPythonPackage (finalAttrs: {
     # Trace/BPT trap: 5 when getting widget options
     "tests/test_4505.py"
     "tests/test_widgets.py"
+
+    # Tests memory usage which is machine-dependent
+    # AssertionError: r1=403619840 r2=382353408 r=0.947310736756647.
+    "tests/test_memory.py::test_4090"
+
+    # https://github.com/pymupdf/PyMuPDF/issues/4988 triggered by
+    # https://github.com/swig/swig/issues/3279
+    "tests/test_font.py::test_load_system_font"
+    "tests/test_general.py::test_add_ink_annot"
+    "tests/test_general.py::test_2533"
+    "tests/test_general.py::test_2506"
+    "tests/test_general.py::test_2093"
+    "tests/test_general.py::test_2430"
+    "tests/test_general.py::test_2553"
+    "tests/test_general.py::test_2736"
+    "tests/test_general.py::test_subset_fonts"
+    "tests/test_general.py::test_2957_2"
+    "tests/test_general.py::test_707560"
+    "tests/test_general.py::test_3140"
+    "tests/test_general.py::test_3654"
+    "tests/test_general.py::test_3624"
+    "tests/test_general.py::test_4415"
+    "tests/test_general.py::test_4496"
+    "tests/test_general.py::test_4590"
+    "tests/test_general.py::test_4712"
+    "tests/test_general.py::test_4712m"
+    "tests/test_general.py::test_4902"
+    "tests/test_imagebbox.py::test_bboxlog"
+    "tests/test_imagebbox.py::test_image_bbox"
+    "tests/test_insertpdf.py::test_issue1417_insertpdf_in_loop"
+    "tests/test_mupdf_regressions.py::test_707673"
+    "tests/test_mupdf_regressions.py::test_3376"
+    "tests/test_nonpdf.py::test_pageids"
+    "tests/test_objectstreams.py::test_objectstream1"
+    "tests/test_objectstreams.py::test_objectstream2"
+    "tests/test_objectstreams.py::test_objectstream3"
+    "tests/test_pagedelete.py::test_3094"
+    "tests/test_pixmap.py::test_pdfpixmap"
+    "tests/test_pixmap.py::test_3854"
+    "tests/test_pixmap.py::test_4155"
+    "tests/test_pixmap.py::test_4699"
+    "tests/test_remove-rotation.py::test_remove_rotation"
+    "tests/test_spikes.py::test_spikes"
+    "tests/test_story.py::test_story"
+    "tests/test_story.py::test_2753"
+    "tests/test_story.py::test_fit_springer"
+    "tests/test_story.py::test_write_stabilized_with_links"
+    "tests/test_story.py::test_3813"
+    "tests/test_tables.py::test_2979"
+    "tests/test_tables.py::test_strict_lines"
+    "tests/test_tables.py::test_3148"
+    "tests/test_tables.py::test_battery_file"
+    "tests/test_tables.py::test_dotted_grid"
+    "tests/test_textbox.py::test_textbox4"
+    "tests/test_textbox.py::test_2637"
+    "tests/test_textbox.py::test_htmlbox1"
+    "tests/test_textbox.py::test_htmlbox2"
+    "tests/test_textbox.py::test_htmlbox3"
+    "tests/test_textbox.py::test_3559"
+    "tests/test_textbox.py::test_3916"
+    "tests/test_textbox.py::test_4613"
+    "tests/test_textextract.py::test_extract4"
+    "tests/test_textextract.py::test_3197"
+    "tests/test_textextract.py::test_3705"
+    "tests/test_textextract.py::test_4147"
+    "tests/test_textextract.py::test_4179"
+    "tests/test_textextract.py::test_extendable_textpage"
+    "tests/test_textextract.py::test_4503"
+    "tests/test_toc.py::test_simple_toc"
+    "tests/test_toc.py::test_3400"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/pytest-asyncio-cooperative/default.nix b/pkgs/development/python-modules/pytest-asyncio-cooperative/default.nix
index b77d0c6daf98..86ae99c77e9c 100644
--- a/pkgs/development/python-modules/pytest-asyncio-cooperative/default.nix
+++ b/pkgs/development/python-modules/pytest-asyncio-cooperative/default.nix
@@ -29,6 +29,9 @@ buildPythonPackage rec {
     "test_session_scope_gen"
     "test_session_scope_async_gen"
     "test_retry"
+    # pytester outcomes shift under pytest 9 (warning -> error)
+    "test_fixture_nested_exception"
+    "test_shared_fixture_caching"
   ];
 
   pythonImportsCheck = [ "pytest_asyncio_cooperative" ];
diff --git a/pkgs/development/python-modules/python-redis-lock/default.nix b/pkgs/development/python-modules/python-redis-lock/default.nix
index 3e95435f23f2..8d0ac61711c4 100644
--- a/pkgs/development/python-modules/python-redis-lock/default.nix
+++ b/pkgs/development/python-modules/python-redis-lock/default.nix
@@ -4,8 +4,7 @@
   buildPythonPackage,
   setuptools,
   eventlet,
-  fetchPypi,
-  fetchpatch,
+  fetchFromGitHub,
   gevent,
   pkgs,
   process-tests,
@@ -16,13 +15,15 @@
 
 buildPythonPackage rec {
   pname = "python-redis-lock";
-  version = "4.0.0";
+  version = "4.0.1";
 
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-Sr0Lz0kTasrWZye/VIbdJJQHjKVeSe+mk/eUB3MZCRo=";
+  src = fetchFromGitHub {
+    owner = "ionelmc";
+    repo = "python-redis-lock";
+    tag = "v${version}";
+    hash = "sha256-KlmVRglglvj3EuX1m2sLqd/yZeU7CjeRxSUJ/cT4ww4=";
   };
 
   # Fix django tests
@@ -32,11 +33,6 @@ buildPythonPackage rec {
   '';
 
   patches = [
-    # https://github.com/ionelmc/python-redis-lock/pull/119
-    (fetchpatch {
-      url = "https://github.com/ionelmc/python-redis-lock/commit/ae404b7834990b833c1f0f703ec8fbcfecd201c2.patch";
-      hash = "sha256-Fo43+pCtnrEMxMdEEdo0YfJGkBlhhH0GjYNgpZeHF3U=";
-    })
     ./test_signal_expiration_increase_sleep.patch
   ];
 
diff --git a/pkgs/development/python-modules/rstcheck-core/default.nix b/pkgs/development/python-modules/rstcheck-core/default.nix
index 912d1b52c390..b883214e1efe 100644
--- a/pkgs/development/python-modules/rstcheck-core/default.nix
+++ b/pkgs/development/python-modules/rstcheck-core/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "rstcheck-core";
-  version = "1.2.2";
+  version = "1.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "rstcheck";
     repo = "rstcheck-core";
     tag = "v${version}";
-    hash = "sha256-D17I6pncTnrRjA/vt4lt/Bfkko3Lx58Xyti3sM0sC3s=";
+    hash = "sha256-ZQgbraIQgfhJM4JYfZjPZcMswOddGQb8pdHjTBo53jk=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/transformer-engine/cuda-libs-paths.patch b/pkgs/development/python-modules/transformer-engine/cuda-libs-paths.patch
index bdf80680acbb..49ddd0553f49 100644
--- a/pkgs/development/python-modules/transformer-engine/cuda-libs-paths.patch
+++ b/pkgs/development/python-modules/transformer-engine/cuda-libs-paths.patch
@@ -1,8 +1,8 @@
 diff --git a/transformer_engine/common/__init__.py b/transformer_engine/common/__init__.py
-index 02388d2e..f2eb337c 100644
+index 40933f17..f2eb337c 100644
 --- a/transformer_engine/common/__init__.py
 +++ b/transformer_engine/common/__init__.py
-@@ -239,117 +239,7 @@ def _get_sys_extension() -> str:
+@@ -239,119 +239,7 @@ def _get_sys_extension() -> str:
  def _nvidia_cudart_include_dir() -> str:
      """Returns the include directory for cuda_runtime.h if exists in python environment."""
  
@@ -12,11 +12,13 @@ index 02388d2e..f2eb337c 100644
 -        return ""
 -
 -    # Installing some nvidia-* packages, like nvshmem, create nvidia name, so "import nvidia"
--    # above doesn't through. However, they don't set "__file__" attribute.
--    if nvidia.__file__ is None:
--        return ""
+-    # above doesn't throw. However, they don't set "__file__" attribute.
+-    if nvidia.__file__ is not None:
+-        nvidia_root = Path(nvidia.__file__).parent
+-    else:
+-        nvidia_root = Path(nvidia.__path__[0])  # namespace package
 -
--    include_dir = Path(nvidia.__file__).parent / "cuda_runtime"
+-    include_dir = nvidia_root / "cuda_runtime"
 -    return str(include_dir) if include_dir.exists() else ""
 -
 -
@@ -121,7 +123,7 @@ index 02388d2e..f2eb337c 100644
  
  
  @functools.lru_cache(maxsize=None)
-@@ -364,18 +254,9 @@ if "NVTE_PROJECT_BUILDING" not in os.environ or bool(int(os.getenv("NVTE_RELEASE
+@@ -366,18 +254,9 @@ if "NVTE_PROJECT_BUILDING" not in os.environ or bool(int(os.getenv("NVTE_RELEASE
      # `_load_cuda_library` is used for packages that must be loaded
      # during runtime. Both system and pypi packages are searched
      # and an error is thrown if not found.
diff --git a/pkgs/development/python-modules/transformer-engine/default.nix b/pkgs/development/python-modules/transformer-engine/default.nix
index 9a29b6b75e4b..0e9fb9c59588 100644
--- a/pkgs/development/python-modules/transformer-engine/default.nix
+++ b/pkgs/development/python-modules/transformer-engine/default.nix
@@ -77,8 +77,9 @@ let
 in
 buildPythonPackage.override { stdenv = backendStdenv; } (finalAttrs: {
   pname = "transformer-engine";
-  version = "2.12";
+  version = "2.14";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "NVIDIA";
@@ -86,7 +87,7 @@ buildPythonPackage.override { stdenv = backendStdenv; } (finalAttrs: {
     tag = "v${finalAttrs.version}";
     # Their CMakeLists.txt does not easily let us inject dependencies
     fetchSubmodules = true;
-    hash = "sha256-/e11kacSYPKdjVEKAo3x/CarzKhO3tiTsMjYWLzHbls=";
+    hash = "sha256-yxcUn75blB5ssEqGXZFDUrBv2/WM8yzumJCt5olV5Po=";
   };
 
   patches =
@@ -102,8 +103,8 @@ buildPythonPackage.override { stdenv = backendStdenv; } (finalAttrs: {
       # https://github.com/NVIDIA/TransformerEngine/pull/2832
       (fetchpatch {
         name = "fix-cuda-arch-cmake-logic";
-        url = "https://github.com/GaetanLepage/TransformerEngine/commit/a3cf63e0d03dd9af1d494854949387f1ae677bf0.patch";
-        hash = "sha256-g2aIF0fROsExEjuNiyI62/rrCOXYyOjyQIOn6rCrUyI=";
+        url = "https://github.com/NVIDIA/TransformerEngine/commit/fca261ecd09c318d22e7eeebda79632eed8cb9e4.patch";
+        hash = "sha256-nph01cIfmjN7RUFZif5ORoz29CEHWwetiHMEZVnnOyY=";
       })
     ]
     ++ optionals withNvshmem [
@@ -118,8 +119,8 @@ buildPythonPackage.override { stdenv = backendStdenv; } (finalAttrs: {
       # https://github.com/NVIDIA/TransformerEngine/pull/2835
       (fetchpatch {
         name = "fix-jax-extension-build-with-mpi";
-        url = "https://github.com/GaetanLepage/TransformerEngine/commit/f68cd3cab34972a899ad0069e2c4ee806e8bc6fb.patch";
-        hash = "sha256-u0ljg1FwY0QjR+ETswpzWV+Sbv00JHI5CSrNQ/9zsuA=";
+        url = "https://github.com/NVIDIA/TransformerEngine/commit/2dd31bb849e83cce51c7d169db883862063d3a95.patch";
+        hash = "sha256-QSRMetseYPGGZCgGkS9rIj9nJdazCD4hv2IgPc+ClSM=";
       })
     ];
 
diff --git a/pkgs/development/python-modules/uncalled-for/default.nix b/pkgs/development/python-modules/uncalled-for/default.nix
index 7c426ae9ecce..40667a22fd56 100644
--- a/pkgs/development/python-modules/uncalled-for/default.nix
+++ b/pkgs/development/python-modules/uncalled-for/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "uncalled-for";
-  version = "0.3.1";
+  version = "0.3.2";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -25,7 +25,7 @@ buildPythonPackage (finalAttrs: {
     owner = "chrisguidry";
     repo = "uncalled-for";
     tag = finalAttrs.version;
-    hash = "sha256-+akXLsfto3FNbkpsPPwN1DQmvu3BpTafRbqLmLwtqek=";
+    hash = "sha256-5jFMlynYaxd83SQiZ1uPs1whWFgKP4y6s473TplH4iI=";
   };
 
   build-system = [
diff --git a/pkgs/kde/frameworks/extra-cmake-modules/default.nix b/pkgs/kde/frameworks/extra-cmake-modules/default.nix
index 573c3be94233..e76bd3a6958a 100644
--- a/pkgs/kde/frameworks/extra-cmake-modules/default.nix
+++ b/pkgs/kde/frameworks/extra-cmake-modules/default.nix
@@ -1,4 +1,5 @@
 {
+  lib,
   mkKdeDerivation,
   python3,
 }:
@@ -18,4 +19,7 @@ mkKdeDerivation {
   ];
 
   setupHook = ./ecm-hook.sh;
+
+  # Pure CMake macros, also used by non-KDE packages on all platforms.
+  meta.platforms = lib.platforms.all;
 }
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 7ede2b1b8db3..cc7186fb0960 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,7 +1,7 @@
 {
     "testing": {
-        "version": "7.1-rc2",
-        "hash": "sha256:10021wpq8pqss25d2y2rhxps88vf8akx8p4xgcx5s5xhk9bfabzw",
+        "version": "7.1-rc3",
+        "hash": "sha256:0gzk6hc880zzy63kpppqi2h347az671sg0wa0nlksyi8acg91wxm",
         "lts": false
     },
     "6.1": {
@@ -30,13 +30,13 @@
         "lts": true
     },
     "6.18": {
-        "version": "6.18.28",
-        "hash": "sha256:0x3vsz25ci192zcv1vmi1lnbdmpafvzbzcja1fighv2qhfa7hq7k",
+        "version": "6.18.29",
+        "hash": "sha256:0g584ak8p9nqxysn8d1qzxbp1asfd39hqy9np35gri9v3xdsfgn3",
         "lts": true
     },
     "7.0": {
-        "version": "7.0.5",
-        "hash": "sha256:0g5c732144ig8rk2nrlsbwdh88q5ghi3n1n6c3y9jlv7q6hv0pwn",
+        "version": "7.0.6",
+        "hash": "sha256:08vm18wx6399phzgr3wz94yga3ab4fyca79445ygvbspm904996b",
         "lts": false
     }
 }
diff --git a/pkgs/servers/home-assistant/custom-components/battery_notes/package.nix b/pkgs/servers/home-assistant/custom-components/battery_notes/package.nix
index 387e6e24dfda..900324fc1c0e 100644
--- a/pkgs/servers/home-assistant/custom-components/battery_notes/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/battery_notes/package.nix
@@ -7,13 +7,13 @@
 buildHomeAssistantComponent rec {
   owner = "andrew-codechimp";
   domain = "battery_notes";
-  version = "3.4.5";
+  version = "3.4.6";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "HA-Battery-Notes";
     tag = version;
-    hash = "sha256-amMrXBTkDZAeMjGScdXMyTZFm90o5jN3VbR2PTydgZA=";
+    hash = "sha256-KcMQLwIm0rr5cEAKLXte/F/Iar3qnznDv76S+bsX9Ok=";
   };
 
   # has no tests
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index a35270d15bcf..ac9d67a30e14 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -736,6 +736,8 @@ self: super: with self; {
 
   ament-package = callPackage ../development/python-modules/ament-package { };
 
+  amplitude-analytics = callPackage ../development/python-modules/amplitude-analytics { };
+
   amply = callPackage ../development/python-modules/amply { };
 
   amqp = callPackage ../development/python-modules/amqp { };
@@ -2407,6 +2409,8 @@ self: super: with self; {
 
   bundlewrap-teamvault = callPackage ../development/python-modules/bundlewrap-teamvault { };
 
+  burner-redis = callPackage ../development/python-modules/burner-redis { };
+
   busylight-core = callPackage ../development/python-modules/busylight-core { };
 
   busylight-for-humans = callPackage ../development/python-modules/busylight-for-humans { };
@@ -12606,6 +12610,8 @@ self: super: with self; {
 
   pip-tools = callPackage ../development/python-modules/pip-tools { };
 
+  pipcl = callPackage ../development/python-modules/pipcl { };
+
   pipdate = callPackage ../development/python-modules/pipdate { };
 
   pipdeptree = callPackage ../development/python-modules/pipdeptree { };
@@ -12929,7 +12935,7 @@ self: super: with self; {
 
   precisely = callPackage ../development/python-modules/precisely { };
 
-  prefect = toPythonModule pkgs.prefect;
+  prefect = callPackage ../development/python-modules/prefect { };
 
   prefixed = callPackage ../development/python-modules/prefixed { };