diff --git a/lib/licenses/licenses.nix b/lib/licenses/licenses.nix
index be6156e37c28..5e7460330087 100644
--- a/lib/licenses/licenses.nix
+++ b/lib/licenses/licenses.nix
@@ -475,6 +475,11 @@ lib.mapAttrs mkLicense (
       fullName = "CeCILL-C Free Software License Agreement";
     };
 
+    cfitsio = {
+      spdxId = "CFITSIO";
+      fullName = "CFITSIO License";
+    };
+
     classpathException20 = {
       spdxId = "Classpath-exception-2.0";
       fullName = "Classpath exception 2.0";
diff --git a/lib/trivial.nix b/lib/trivial.nix
index fcd9a8791dcf..fd48a0456b66 100644
--- a/lib/trivial.nix
+++ b/lib/trivial.nix
@@ -1101,11 +1101,10 @@ in
     ```
   */
   functionArgs =
-    f:
-    if f ? __functor then
-      f.__functionArgs or (functionArgs (f.__functor f))
-    else
-      builtins.functionArgs f;
+    let
+      functionArgs = builtins.functionArgs;
+    in
+    f: if f ? __functor then f.__functionArgs or (functionArgs (f.__functor f)) else functionArgs f;
 
   /**
     Check whether something is a function or something
@@ -1123,7 +1122,11 @@ in
     isFunction : Any -> Bool
     ```
   */
-  isFunction = f: builtins.isFunction f || (f ? __functor && isFunction (f.__functor f));
+  isFunction =
+    let
+      isFunction = builtins.isFunction;
+    in
+    f: isFunction f || (f ? __functor && isFunction (f.__functor f));
 
   /**
     `mirrorFunctionArgs f g` creates a new function `g'` with the same behavior as `g` (`g' x == g x`)
diff --git a/nixos/modules/tasks/filesystems/bcachefs.nix b/nixos/modules/tasks/filesystems/bcachefs.nix
index 481773991206..bb338bc992c9 100644
--- a/nixos/modules/tasks/filesystems/bcachefs.nix
+++ b/nixos/modules/tasks/filesystems/bcachefs.nix
@@ -273,6 +273,10 @@ in
           "bcachefs" = "${cfg.package}/bin/bcachefs";
           "mount.bcachefs" = "${cfg.package}/bin/mount.bcachefs";
         };
+        boot.initrd.systemd.storePaths = [
+          # Used by the ExecStart= in bcachefs-wait-devices@.service.
+          "${cfg.package}/sbin/bcachefs"
+        ];
         boot.initrd.extraUtilsCommands = lib.mkIf (!config.boot.initrd.systemd.enable) ''
           copy_bin_and_libs ${cfg.package}/bin/bcachefs
           copy_bin_and_libs ${cfg.package}/bin/mount.bcachefs
@@ -285,6 +289,7 @@ in
           commonFunctions + lib.concatStrings (lib.mapAttrsToList openCommand bootFs)
         );
 
+        boot.initrd.systemd.packages = [ cfg.package ];
         boot.initrd.systemd.services = lib.mapAttrs' (mkUnits "/sysroot") bootFs;
       })
 
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 0f566310a4c4..4e02b29c2c77 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -968,13 +968,13 @@
     "vendorHash": "sha256-OAd8SeTqTrH0kMoM2LsK3vM2PI23b3gl57FaJYM9hM0="
   },
   "newrelic_newrelic": {
-    "hash": "sha256-m8KZQUmDyMTR3S1BC5nmo15j5TUDV3ZZsy4hg16VZlc=",
+    "hash": "sha256-UByjO3/TE/b3kncFVMuTpWvTfC5Oof+Z5+9KdOEs7JU=",
     "homepage": "https://registry.terraform.io/providers/newrelic/newrelic",
     "owner": "newrelic",
     "repo": "terraform-provider-newrelic",
-    "rev": "v3.87.1",
+    "rev": "v3.87.3",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-W/a04lDiPVh/tkcWz9eJp/pupI46cXxqukdv1h17xYY="
+    "vendorHash": "sha256-2nDiNYX8iwu4u5gaaIYJC8a/Jw/MBdTgNxmyw+RLB+c="
   },
   "ns1-terraform_ns1": {
     "hash": "sha256-MX/Wd9Lztjn7uwDzJjs4bsSSp0PFzUgsu4jXke9jHL8=",
diff --git a/pkgs/applications/networking/instant-messengers/gajim/default.nix b/pkgs/applications/networking/instant-messengers/gajim/default.nix
index 6026917dedbe..881228e04072 100644
--- a/pkgs/applications/networking/instant-messengers/gajim/default.nix
+++ b/pkgs/applications/networking/instant-messengers/gajim/default.nix
@@ -43,14 +43,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gajim";
-  version = "2.4.5";
+  version = "2.4.6";
 
   src = fetchFromGitLab {
     domain = "dev.gajim.org";
     owner = "gajim";
     repo = "gajim";
     tag = version;
-    hash = "sha256-5daPMlC2Ejfi5UXsRLaLWwEZHHEC0szbfkqavIisoUQ=";
+    hash = "sha256-QHfJ52uMDlE/rqqy7y2JIQLMOPaTp7eh4DEsPLBx6p8=";
   };
 
   pyproject = true;
diff --git a/pkgs/by-name/bi/bitrise/package.nix b/pkgs/by-name/bi/bitrise/package.nix
index d8b09698aee7..c0b20a3222f8 100644
--- a/pkgs/by-name/bi/bitrise/package.nix
+++ b/pkgs/by-name/bi/bitrise/package.nix
@@ -6,13 +6,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "bitrise";
-  version = "2.39.5";
+  version = "2.40.0";
 
   src = fetchFromGitHub {
     owner = "bitrise-io";
     repo = "bitrise";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-2AT6coAJFXt0eZicXABojGOHay2oU7pe70IKJX/dyk8=";
+    hash = "sha256-jY1aJAk3O7jAfQAYPpQIgUD+CMxcBAggE0bvWeAEgDk=";
   };
 
   # many tests rely on writable $HOME/.bitrise and require network access
diff --git a/pkgs/by-name/bi/bitwarden-desktop/package.nix b/pkgs/by-name/bi/bitwarden-desktop/package.nix
index 1409c8e06c67..625f84e55eff 100644
--- a/pkgs/by-name/bi/bitwarden-desktop/package.nix
+++ b/pkgs/by-name/bi/bitwarden-desktop/package.nix
@@ -33,13 +33,13 @@ let
 in
 buildNpmPackage' rec {
   pname = "bitwarden-desktop";
-  version = "2026.2.1";
+  version = "2026.3.1";
 
   src = fetchFromGitHub {
     owner = "bitwarden";
     repo = "clients";
     rev = "desktop-v${version}";
-    hash = "sha256-BiL9ugimdDKIzIoehGqdBfJkTOjbOMl8XV+0g/aGS/k=";
+    hash = "sha256-ecaCHk04N9h0RP8gK0o+MLgYS6Linsqi7AaC86hwQ3U=";
   };
 
   patches = [
@@ -55,6 +55,10 @@ buildNpmPackage' rec {
   ];
 
   postPatch = ''
+    # https://github.com/bitwarden/clients/pull/20480
+    substituteInPlace package-lock.json apps/desktop/desktop_native/napi/package.json \
+      --replace-fail '"@napi-rs/cli": "3.5.1"' '"@napi-rs/cli": "3.2.0"'
+
     # remove code under unfree license
     rm -r bitwarden_license
 
@@ -79,12 +83,9 @@ buildNpmPackage' rec {
     "--legacy-peer-deps"
   ];
 
-  npmRebuildFlags = [
-    # FIXME one of the esbuild versions fails to download @esbuild/linux-x64
-    "--ignore-scripts"
-  ];
   npmWorkspace = "apps/desktop";
-  npmDepsHash = "sha256-S34Lxr9dH9wjBmpDYA530z2/HiY4D4b/3rswWDqsrFU=";
+  npmDepsFetcherVersion = 2;
+  npmDepsHash = "sha256-1t4CSd1NDC1medTTFHSzX9ZkgHqPG2L//yjaloH47z0=";
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit
@@ -94,7 +95,7 @@ buildNpmPackage' rec {
       cargoRoot
       patches
       ;
-    hash = "sha256-qK7cwrTzGKgHdaxaGcpR6bKJP/Tai2F+KFLu/PI6qqA=";
+    hash = "sha256-d9Iv7OekHOteH1lyAuyj/EzfU/KSCW6ATx83foOW3IE=";
   };
   cargoRoot = "apps/desktop/desktop_native";
 
@@ -165,7 +166,11 @@ buildNpmPackage' rec {
   ];
 
   checkFlags = [
+    # fails in zbus
     "--skip=password::password::tests::test"
+    # requires some debug feature to be enabled
+    "--skip=storage::serialization::tests::test_keydata_from_corrupted_bytes"
+    "--skip=storage::serialization::tests::test_keydata_from_empty_bytes"
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     "--skip=clipboard::tests::test_write_read"
diff --git a/pkgs/by-name/cf/cfitsio/package.nix b/pkgs/by-name/cf/cfitsio/package.nix
index fea31a4e330d..8fa03db0bf78 100644
--- a/pkgs/by-name/cf/cfitsio/package.nix
+++ b/pkgs/by-name/cf/cfitsio/package.nix
@@ -73,7 +73,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   meta = {
-    homepage = "https://heasarc.gsfc.nasa.gov/fitsio/";
+    homepage = "https://heasarc.gsfc.nasa.gov/docs/software/fitsio/";
     description = "Library for reading and writing FITS data files";
     longDescription = ''
       CFITSIO is a library of C and Fortran subroutines for reading and
@@ -85,7 +85,7 @@ stdenv.mkDerivation (finalAttrs: {
       FITS files.
     '';
     changelog = "https://heasarc.gsfc.nasa.gov/FTP/software/fitsio/c/docs/changes.txt";
-    license = lib.licenses.mit;
+    license = lib.licenses.cfitsio;
     maintainers = with lib.maintainers; [
       returntoreality
       xbreak
diff --git a/pkgs/by-name/dp/dprint/plugins/dprint-plugin-biome.nix b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-biome.nix
index 25b86d598cac..0bcf9e5f4371 100644
--- a/pkgs/by-name/dp/dprint/plugins/dprint-plugin-biome.nix
+++ b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-biome.nix
@@ -1,7 +1,7 @@
 { mkDprintPlugin }:
 mkDprintPlugin {
   description = "Biome (JS/TS/JSON) wrapper plugin";
-  hash = "sha256-ccPkzEV0Gtzi6iKq6oIREvIccEFvHec06XxoUWufDZc=";
+  hash = "sha256-k+o4eiLwzoCF6MPX0dEn/3modSwvFYFuzMe47cdJWo8=";
   initConfig = {
     configExcludes = [ "**/node_modules" ];
     configKey = "biome";
@@ -17,6 +17,6 @@ mkDprintPlugin {
   };
   pname = "dprint-plugin-biome";
   updateUrl = "https://plugins.dprint.dev/dprint/biome/latest.json";
-  url = "https://plugins.dprint.dev/biome-0.12.10.wasm";
-  version = "0.12.10";
+  url = "https://plugins.dprint.dev/biome-0.12.11.wasm";
+  version = "0.12.11";
 }
diff --git a/pkgs/by-name/fi/firebase-tools/package.nix b/pkgs/by-name/fi/firebase-tools/package.nix
index 5c6a6b1f6dc7..990743c533c3 100644
--- a/pkgs/by-name/fi/firebase-tools/package.nix
+++ b/pkgs/by-name/fi/firebase-tools/package.nix
@@ -11,17 +11,17 @@
 
 buildNpmPackage rec {
   pname = "firebase-tools";
-  version = "15.17.0";
+  version = "15.18.0";
   nodejs = nodejs_22;
 
   src = fetchFromGitHub {
     owner = "firebase";
     repo = "firebase-tools";
     tag = "v${version}";
-    hash = "sha256-rj3EeqdgERZnTLMoAMNWoG1FAX/4IcRmDk7+PsFpBXA=";
+    hash = "sha256-bsCBDiHOkov3OgjGy29wmZVXDBX6AmH34wNYOPve6uI=";
   };
 
-  npmDepsHash = "sha256-J0sPjtPd+T4DbcxHAyUh6RKCxnC5SxgrX3VfDlz3AQA=";
+  npmDepsHash = "sha256-qJezxPI1ao6/G4Ku7qjOFbdEaJohAH+7DWeP9QY/jOs=";
 
   # No more package-lock.json in upstream src
   postPatch = ''
diff --git a/pkgs/by-name/ho/homebridge/package.nix b/pkgs/by-name/ho/homebridge/package.nix
index 43a82b3e2957..afc14f348b94 100644
--- a/pkgs/by-name/ho/homebridge/package.nix
+++ b/pkgs/by-name/ho/homebridge/package.nix
@@ -6,16 +6,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "homebridge";
-  version = "2.0.1";
+  version = "2.0.2";
 
   src = fetchFromGitHub {
     owner = "homebridge";
     repo = "homebridge";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JHeyyPh2ePIrUhqfo1Cb4pNf+lB3ldE6NR0OunbLuKk=";
+    hash = "sha256-bs7h9qHAWPNEqomTbit2LBtM5yLHQnFLjCMJ/ybHxHU=";
   };
 
-  npmDepsHash = "sha256-zJ9WPnhtC0rnyT5dqPfC/eg+TRlKlDDQW3XYx67pl5s=";
+  npmDepsHash = "sha256-/1mIwWFa6L7bLao0/Q3I+nniVt5crVa8ufuvkYeoJUY=";
 
   meta = {
     description = "Lightweight emulator of iOS HomeKit API";
diff --git a/pkgs/by-name/iw/iwe/package.nix b/pkgs/by-name/iw/iwe/package.nix
index fac827819b3d..0c482f107696 100644
--- a/pkgs/by-name/iw/iwe/package.nix
+++ b/pkgs/by-name/iw/iwe/package.nix
@@ -8,16 +8,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "iwe";
-  version = "0.0.70";
+  version = "0.1.3";
 
   src = fetchFromGitHub {
     owner = "iwe-org";
     repo = "iwe";
     tag = "iwe-v${finalAttrs.version}";
-    hash = "sha256-ehRth5vBUjswn9oM97WuMYvHs0LohXBwrdN23VRELa0=";
+    hash = "sha256-2mFCujePThwqOnXNF9x1Hyv9KRme44gtTcy8frziNXo=";
   };
 
-  cargoHash = "sha256-rQre02fRRcf0FCmRpWh1UHsvCpp/iLqCA4QHvSZYBwA=";
+  cargoHash = "sha256-8l7cTW8riEa1nFjftc5lnEQcY9gz4dYli9FQBZ5SFT8=";
 
   cargoBuildFlags = [
     "--package=iwe"
diff --git a/pkgs/by-name/ko/kord/package.nix b/pkgs/by-name/ko/kord/package.nix
index 941f0d767ba4..0d0cec62fd1a 100644
--- a/pkgs/by-name/ko/kord/package.nix
+++ b/pkgs/by-name/ko/kord/package.nix
@@ -22,7 +22,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     sha256 = "sha256-CeMh6yB4fGoxtGLbkQe4OMMvBM0jesyP+8JtU5kCP84=";
   };
 
-  cargoHash = "sha256-DpZsi2eIhuetHnLLYGAvv871mbPfAIUevqBLaV8ljGA=";
+  cargoHash = "sha256-ciam95rUUh9iKmhTadqWCy1rU4otuRiQkWg0lGRHzng=";
+
+  cargoPatches = [
+    # bump coreaudio-sys past 0.2.11; bindgen 0.61 panics on apple-sdk-14 anonymous enums
+    ./update-coreaudio-sys.patch
+  ];
 
   patches = [
     # Fixes build issues due to refactored Rust compiler feature annotations.
@@ -35,6 +40,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
     })
   ];
 
+  # concat_idents feature gate was removed in rust 1.90; never invoked here.
+  postPatch = ''
+    substituteInPlace src/lib.rs --replace-fail '#![feature(concat_idents)]' ""
+  '';
+
   nativeBuildInputs =
     lib.optionals stdenv.hostPlatform.isLinux [ pkg-config ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [ rustPlatform.bindgenHook ];
diff --git a/pkgs/by-name/ko/kord/update-coreaudio-sys.patch b/pkgs/by-name/ko/kord/update-coreaudio-sys.patch
new file mode 100644
index 000000000000..f047422c7a34
--- /dev/null
+++ b/pkgs/by-name/ko/kord/update-coreaudio-sys.patch
@@ -0,0 +1,455 @@
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -1,6 +1,6 @@
+ # This file is automatically @generated by Cargo.
+ # It is not intended for manual editing.
+-version = 3
++version = 4
+ 
+ [[package]]
+ name = "adler"
+@@ -47,7 +47,7 @@
+ checksum = "8512c9117059663fb5606788fbca3619e2a91dac0e3fe516242eab1fa6be5e44"
+ dependencies = [
+  "alsa-sys",
+- "bitflags",
++ "bitflags 1.3.2",
+  "libc",
+  "nix",
+ ]
+@@ -106,7 +106,7 @@
+ dependencies = [
+  "proc-macro2",
+  "quote",
+- "syn",
++ "syn 1.0.109",
+ ]
+ 
+ [[package]]
+@@ -148,22 +148,20 @@
+ 
+ [[package]]
+ name = "bindgen"
+-version = "0.61.0"
++version = "0.70.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "8a022e58a142a46fea340d68012b9201c094e93ec3d033a944a24f8fd4a4f09a"
++checksum = "f49d8fed880d473ea71efb9bf597651e77201bdd4893efe54c9e5d65ae04ce6f"
+ dependencies = [
+- "bitflags",
++ "bitflags 2.11.1",
+  "cexpr",
+  "clang-sys",
+- "lazy_static",
+- "lazycell",
+- "peeking_take_while",
++ "itertools",
+  "proc-macro2",
+  "quote",
+  "regex",
+  "rustc-hash",
+  "shlex",
+- "syn",
++ "syn 2.0.12",
+ ]
+ 
+ [[package]]
+@@ -173,6 +171,12 @@
+ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+ 
+ [[package]]
++name = "bitflags"
++version = "2.11.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3"
++
++[[package]]
+ name = "block-buffer"
+ version = "0.10.4"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+@@ -265,7 +269,7 @@
+ dependencies = [
+  "proc-macro2",
+  "quote",
+- "syn",
++ "syn 1.0.109",
+ ]
+ 
+ [[package]]
+@@ -325,7 +329,7 @@
+ dependencies = [
+  "proc-macro2",
+  "quote",
+- "syn",
++ "syn 1.0.109",
+ ]
+ 
+ [[package]]
+@@ -464,7 +468,7 @@
+ dependencies = [
+  "ansi_term",
+  "atty",
+- "bitflags",
++ "bitflags 1.3.2",
+  "strsim 0.8.0",
+  "textwrap",
+  "unicode-width",
+@@ -477,7 +481,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "c3d7ae14b20b94cb02149ed21a86c423859cbe18dc7ed69845cace50e52b40a5"
+ dependencies = [
+- "bitflags",
++ "bitflags 1.3.2",
+  "clap_derive",
+  "clap_lex",
+  "is-terminal",
+@@ -496,7 +500,7 @@
+  "proc-macro-error",
+  "proc-macro2",
+  "quote",
+- "syn",
++ "syn 1.0.109",
+ ]
+ 
+ [[package]]
+@@ -639,7 +643,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "2581bbab3b8ffc6fcbd550bf46c355135d16e9ff2a6ea032ad6b9bf1d7efe4fb"
+ dependencies = [
+- "bitflags",
++ "bitflags 1.3.2",
+  "core-foundation",
+  "core-graphics-types",
+  "foreign-types",
+@@ -652,7 +656,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "3a68b68b3446082644c91ac778bf50cd4104bfb002b5a6a7c44cca5a2c70788b"
+ dependencies = [
+- "bitflags",
++ "bitflags 1.3.2",
+  "core-foundation",
+  "foreign-types",
+  "libc",
+@@ -676,16 +680,16 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "cb17e2d1795b1996419648915df94bc7103c28f7b48062d7acf4652fc371b2ff"
+ dependencies = [
+- "bitflags",
++ "bitflags 1.3.2",
+  "core-foundation-sys 0.6.2",
+  "coreaudio-sys",
+ ]
+ 
+ [[package]]
+ name = "coreaudio-sys"
+-version = "0.2.11"
++version = "0.2.16"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "1a9444b94b8024feecc29e01a9706c69c1e26bfee480221c90764200cfd778fb"
++checksum = "2ce857aa0b77d77287acc1ac3e37a05a8c95a2af3647d23b15f263bdaeb7562b"
+ dependencies = [
+  "bindgen",
+ ]
+@@ -800,7 +804,7 @@
+ checksum = "6d2301688392eb071b0bf1a37be05c469d3cc4dbbd95df672fe28ab021e6a096"
+ dependencies = [
+  "quote",
+- "syn",
++ "syn 1.0.109",
+ ]
+ 
+ [[package]]
+@@ -827,7 +831,7 @@
+  "proc-macro2",
+  "quote",
+  "scratch",
+- "syn",
++ "syn 1.0.109",
+ ]
+ 
+ [[package]]
+@@ -844,7 +848,7 @@
+ dependencies = [
+  "proc-macro2",
+  "quote",
+- "syn",
++ "syn 1.0.109",
+ ]
+ 
+ [[package]]
+@@ -868,7 +872,7 @@
+  "proc-macro2",
+  "quote",
+  "strsim 0.9.3",
+- "syn",
++ "syn 1.0.109",
+ ]
+ 
+ [[package]]
+@@ -879,7 +883,7 @@
+ dependencies = [
+  "darling_core",
+  "quote",
+- "syn",
++ "syn 1.0.109",
+ ]
+ 
+ [[package]]
+@@ -896,7 +900,7 @@
+ dependencies = [
+  "proc-macro2",
+  "quote",
+- "syn",
++ "syn 1.0.109",
+ ]
+ 
+ [[package]]
+@@ -907,7 +911,7 @@
+ dependencies = [
+  "proc-macro2",
+  "quote",
+- "syn",
++ "syn 1.0.109",
+ ]
+ 
+ [[package]]
+@@ -1075,7 +1079,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "21fe28504d371085fae9ac7a3450f0b289ab71e07c8e57baa3fb68b9e57d6ce5"
+ dependencies = [
+- "bitflags",
++ "bitflags 1.3.2",
+  "byteorder",
+  "core-foundation",
+  "core-graphics",
+@@ -1195,7 +1199,7 @@
+ dependencies = [
+  "proc-macro2",
+  "quote",
+- "syn",
++ "syn 1.0.109",
+ ]
+ 
+ [[package]]
+@@ -1463,6 +1467,15 @@
+ ]
+ 
+ [[package]]
++name = "itertools"
++version = "0.13.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "413ee7dfc52ee1a4949ceeb7dbc8a33f2d6c088194d9f922fb8318faf1f01186"
++dependencies = [
++ "either",
++]
++
++[[package]]
+ name = "itoa"
+ version = "1.0.6"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+@@ -1570,12 +1583,6 @@
+ checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+ 
+ [[package]]
+-name = "lazycell"
+-version = "1.3.0"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
+-
+-[[package]]
+ name = "libc"
+ version = "0.2.140"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+@@ -1757,7 +1764,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "451422b7e4718271c8b5b3aadf5adedba43dc76312454b387e98fae0fc951aa0"
+ dependencies = [
+- "bitflags",
++ "bitflags 1.3.2",
+  "jni-sys",
+  "ndk-sys",
+  "num_enum",
+@@ -1786,7 +1793,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "fa52e972a9a719cecb6864fb88568781eb706bac2cd1d4f04a648542dbf78069"
+ dependencies = [
+- "bitflags",
++ "bitflags 1.3.2",
+  "cfg-if 1.0.0",
+  "libc",
+ ]
+@@ -1824,7 +1831,7 @@
+ dependencies = [
+  "proc-macro2",
+  "quote",
+- "syn",
++ "syn 1.0.109",
+ ]
+ 
+ [[package]]
+@@ -1886,7 +1893,7 @@
+  "proc-macro-crate",
+  "proc-macro2",
+  "quote",
+- "syn",
++ "syn 1.0.109",
+ ]
+ 
+ [[package]]
+@@ -1901,7 +1908,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "288bd66a5a56d8c97b178412b328419b3fdec261c0cbc4628ddc49cc16db8fc6"
+ dependencies = [
+- "bitflags",
++ "bitflags 1.3.2",
+  "libloading",
+  "nvml-wrapper-sys",
+  "static_assertions",
+@@ -2059,12 +2066,6 @@
+ ]
+ 
+ [[package]]
+-name = "peeking_take_while"
+-version = "0.1.2"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "19b17cddbe7ec3f8bc800887bab5e717348c95ea2ca0b1bf0837fb964dc67099"
+-
+-[[package]]
+ name = "percent-encoding"
+ version = "2.2.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+@@ -2100,7 +2101,7 @@
+  "pest_meta",
+  "proc-macro2",
+  "quote",
+- "syn",
++ "syn 1.0.109",
+ ]
+ 
+ [[package]]
+@@ -2184,7 +2185,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "5d708eaf860a19b19ce538740d2b4bdeeb8337fa53f7738455e706623ad5c638"
+ dependencies = [
+- "bitflags",
++ "bitflags 1.3.2",
+  "crc32fast",
+  "flate2",
+  "miniz_oxide",
+@@ -2242,7 +2243,7 @@
+  "proc-macro-error-attr",
+  "proc-macro2",
+  "quote",
+- "syn",
++ "syn 1.0.109",
+  "version_check",
+ ]
+ 
+@@ -2361,7 +2362,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "fb5a58c1855b4b6819d59012155603f0b22ad30cad752600aadfcb695265519a"
+ dependencies = [
+- "bitflags",
++ "bitflags 1.3.2",
+ ]
+ 
+ [[package]]
+@@ -2462,7 +2463,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "fd5c6ff11fecd55b40746d1995a02f2eb375bf8c00d192d521ee09f42bef37bc"
+ dependencies = [
+- "bitflags",
++ "bitflags 1.3.2",
+  "errno",
+  "io-lifetimes",
+  "libc",
+@@ -2564,7 +2565,7 @@
+ dependencies = [
+  "proc-macro2",
+  "quote",
+- "syn",
++ "syn 1.0.109",
+ ]
+ 
+ [[package]]
+@@ -2699,7 +2700,7 @@
+  "proc-macro-error",
+  "proc-macro2",
+  "quote",
+- "syn",
++ "syn 1.0.109",
+ ]
+ 
+ [[package]]
+@@ -2748,7 +2749,7 @@
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "55a0846e7a2c9a8081ff799fc83a975170417ad2a143f644a77ec2e3e82a2b73"
+ dependencies = [
+- "bitflags",
++ "bitflags 1.3.2",
+  "lazy_static",
+  "log",
+  "symphonia-core",
+@@ -2814,7 +2815,7 @@
+ checksum = "6b9567e2d8a5f866b2f94f5d366d811e0c6826babcff6d37de9e1a6690d38869"
+ dependencies = [
+  "arrayvec",
+- "bitflags",
++ "bitflags 1.3.2",
+  "bytemuck",
+  "lazy_static",
+  "log",
+@@ -2903,6 +2904,17 @@
+ ]
+ 
+ [[package]]
++name = "syn"
++version = "2.0.12"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "79d9531f94112cfc3e4c8f5f02cb2b58f72c97b7efd85f70203cc6d8efda5927"
++dependencies = [
++ "proc-macro2",
++ "quote",
++ "unicode-ident",
++]
++
++[[package]]
+ name = "tch"
+ version = "0.11.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+@@ -2975,7 +2987,7 @@
+ dependencies = [
+  "proc-macro2",
+  "quote",
+- "syn",
++ "syn 1.0.109",
+ ]
+ 
+ [[package]]
+@@ -3253,7 +3265,7 @@
+  "once_cell",
+  "proc-macro2",
+  "quote",
+- "syn",
++ "syn 1.0.109",
+  "wasm-bindgen-shared",
+ ]
+ 
+@@ -3287,7 +3299,7 @@
+ dependencies = [
+  "proc-macro2",
+  "quote",
+- "syn",
++ "syn 1.0.109",
+  "wasm-bindgen-backend",
+  "wasm-bindgen-shared",
+ ]
+@@ -3493,7 +3505,7 @@
+  "darling",
+  "proc-macro2",
+  "quote",
+- "syn",
++ "syn 1.0.109",
+ ]
+ 
+ [[package]]
diff --git a/pkgs/by-name/li/lint-staged/package.nix b/pkgs/by-name/li/lint-staged/package.nix
index 723135eb39e9..0ef2d8a853b1 100644
--- a/pkgs/by-name/li/lint-staged/package.nix
+++ b/pkgs/by-name/li/lint-staged/package.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "lint-staged";
-  version = "17.0.2";
+  version = "17.0.4";
 
   src = fetchFromGitHub {
     owner = "okonet";
     repo = "lint-staged";
     rev = "v${version}";
-    hash = "sha256-6WlTa1QFQU3lzAv3y9GgJi4FtfFvpnSvDgzyy38TbeQ=";
+    hash = "sha256-E0qShnB3zVz7oL+qPzPzLhEJ9PQDlMc4+L4vpD2enI8=";
   };
 
-  npmDepsHash = "sha256-Ew4nR9G/YqIY5LpEajGyE+wmn+8gHiNPFV4woVkffr8=";
+  npmDepsHash = "sha256-KYltk2z/1nTnaLroTErIu6eTyofvWp/wC1awEf0Ryg0=";
 
   dontNpmBuild = true;
 
diff --git a/pkgs/by-name/ma/mailpit/package.nix b/pkgs/by-name/ma/mailpit/package.nix
index 2f83a2a169dd..4af3b4aa66d8 100644
--- a/pkgs/by-name/ma/mailpit/package.nix
+++ b/pkgs/by-name/ma/mailpit/package.nix
@@ -83,13 +83,15 @@ buildGoModule (finalAttrs: {
 
   passthru = {
     tests = {
-      inherit (nixosTests) mailpit;
       # cannot use versionCheckHook due to the extra --no-release-check flag
       # for workarounds and other solutions see https://github.com/NixOS/nixpkgs/pull/486143#discussion_r2754533347
       version = testers.testVersion {
         package = mailpit;
         command = "mailpit version --no-release-check";
       };
+    }
+    // lib.optionalAttrs (!stdenv.hostPlatform.isDarwin) {
+      inherit (nixosTests) mailpit;
     };
 
     updateScript = {
diff --git a/pkgs/by-name/ma/mailpit/source.nix b/pkgs/by-name/ma/mailpit/source.nix
index 5b19c38381bf..bb8737aef7fe 100644
--- a/pkgs/by-name/ma/mailpit/source.nix
+++ b/pkgs/by-name/ma/mailpit/source.nix
@@ -1,6 +1,6 @@
 {
-  version = "1.29.7";
-  hash = "sha256-nd52Kf7wRJXSrLPgrYQ5VjUWFARObRRAJe3nIW19wZU=";
-  npmDepsHash = "sha256-s71BVJpim593GknE1XyBCb4sQwY8fKpAH7q/e/0Nmg0=";
-  vendorHash = "sha256-mGlzb4Q6nWew13Io8fAtR+3u4w1vjj4ssUaBJ9sjz6A=";
+  version = "1.30.0";
+  hash = "sha256-lUynHDFfbX9BxwTdREbgAMil7S3+vwAl05myzMEWgGQ=";
+  npmDepsHash = "sha256-snWhjSy9au81bJZwjh/KVvchjEaJJ05HYhyh3V8/Y5g=";
+  vendorHash = "sha256-LMjS0YxRTvHZ8U10BOST/5Zthqhoi5OxngWWB+2CSeQ=";
 }
diff --git a/pkgs/by-name/mu/music-assistant-desktop/package.nix b/pkgs/by-name/mu/music-assistant-desktop/package.nix
new file mode 100644
index 000000000000..7f425820f709
--- /dev/null
+++ b/pkgs/by-name/mu/music-assistant-desktop/package.nix
@@ -0,0 +1,109 @@
+{
+  lib,
+  stdenv,
+  rustPlatform,
+
+  fetchFromGitHub,
+  fetchYarnDeps,
+
+  # nativeBuildInputs
+  cargo-tauri,
+  nodejs,
+  pkg-config,
+  yarnBuildHook,
+  yarnConfigHook,
+  yarnInstallHook,
+  wrapGAppsHook3,
+
+  # buildInputs
+  openssl,
+  alsa-lib,
+  atk,
+  dbus,
+  glib-networking,
+  libappindicator-gtk3,
+  llvmPackages,
+  pulseaudio,
+  gtk3,
+  webkitgtk_4_1,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "music-assistant-desktop";
+  version = "0.3.6";
+
+  src = fetchFromGitHub {
+    owner = "music-assistant";
+    repo = "desktop-app";
+    tag = finalAttrs.version;
+    hash = "sha256-GL9Cpk6NDhRV0npVXwGjR3Dm0H/uo9cD4ebaI751VLM=";
+  };
+
+  # hide update feature
+  postPatch = ''
+    substituteInPlace src-tauri/src/lib.rs \
+      --replace-fail \
+        "let update =" \
+        "// let update =" \
+      --replace-fail \
+        "&update," \
+        "// &update," \
+  '';
+
+  cargoRoot = "src-tauri";
+  buildAndTestSubdir = finalAttrs.cargoRoot;
+
+  cargoHash = "sha256-rd0kvUTAi4fOh3hxCY1cmkkLWsxNPxVmPVzB9uEv/8c=";
+
+  yarnOfflineCache = fetchYarnDeps {
+    yarnLock = finalAttrs.src + "/yarn.lock";
+    hash = "sha256-dOJ5ETRodpnuaI+L2wckNU0XANUcjqzvdqw/cd5sJC4=";
+  };
+
+  nativeBuildInputs = [
+    cargo-tauri.hook
+    nodejs
+    pkg-config
+    yarnBuildHook
+    yarnConfigHook
+    yarnInstallHook
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [ wrapGAppsHook3 ];
+
+  buildInputs = [
+    openssl
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    alsa-lib
+    atk
+    dbus
+    glib-networking
+    libappindicator-gtk3
+    pulseaudio
+    gtk3
+    webkitgtk_4_1
+  ];
+
+  preFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
+    gappsWrapperArgs+=(
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ libappindicator-gtk3 ]}"
+    )
+  '';
+
+  env = {
+    # `LIBCLANG_PATH` is needed to build `coreaudio-sys` on darwin
+    LIBCLANG_PATH = lib.optionalString stdenv.hostPlatform.isDarwin "${lib.getLib llvmPackages.libclang}/lib";
+  };
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  meta = {
+    description = "Official companion desktop app for Music Assistant";
+    homepage = "https://github.com/music-assistant/desktop-app";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ nim65s ];
+    mainProgram = "music-assistant-companion";
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/by-name/om/omnictl/package.nix b/pkgs/by-name/om/omnictl/package.nix
index 0149f028048e..bd5941f7c637 100644
--- a/pkgs/by-name/om/omnictl/package.nix
+++ b/pkgs/by-name/om/omnictl/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "omnictl";
-  version = "1.7.1";
+  version = "1.7.3";
 
   src = fetchFromGitHub {
     owner = "siderolabs";
     repo = "omni";
     rev = "v${version}";
-    hash = "sha256-3nqyhJnJgOyegLtJchqoo6BtGbvvRaGxwo28Ef1gb4k=";
+    hash = "sha256-c2dYVXYH12YAvfxiCA1Rl/9y/FD7fMBEBQvvc4TmBYA=";
   };
 
-  vendorHash = "sha256-6Yy/qEcZb4nheCplXmYo65NUJzImEQpRW/+g0rA3VW4=";
+  vendorHash = "sha256-QstTh4deaanljpFm6zEkm6ykGhUeTjK3Az9w8JROiWY=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/op/open-policy-agent/package.nix b/pkgs/by-name/op/open-policy-agent/package.nix
index 5182077189b4..13e3b8758f3b 100644
--- a/pkgs/by-name/op/open-policy-agent/package.nix
+++ b/pkgs/by-name/op/open-policy-agent/package.nix
@@ -14,13 +14,13 @@ assert
 
 buildGoModule (finalAttrs: {
   pname = "open-policy-agent";
-  version = "1.16.0";
+  version = "1.16.2";
 
   src = fetchFromGitHub {
     owner = "open-policy-agent";
     repo = "opa";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mZpD0hkrm74HzIVM+xcp55nADi/+oOiJ9/WPIyWsmAg=";
+    hash = "sha256-f9t/BB0ldSUTaApjM75W9nw7jRC8Hp1t/KFRM/ky67s=";
   };
 
   vendorHash = "sha256-m+Mb2Llny7O9cfn8Js7MEaeYM9zC/CwWBAuliWE7G1E=";
diff --git a/pkgs/by-name/py/pyrefly/fix-cargo-lock.patch b/pkgs/by-name/py/pyrefly/fix-cargo-lock.patch
new file mode 100644
index 000000000000..4f02e23011f3
--- /dev/null
+++ b/pkgs/by-name/py/pyrefly/fix-cargo-lock.patch
@@ -0,0 +1,12 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index c8c39e9617888199b86fa7c0273c0edebc85df2f..ea5e7b7e633a2de582a7b013a32a6eb6b166e2db 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -2866,6 +2866,7 @@ dependencies = [
+ name = "rustversion"
+ version = "1.0.22"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
+ 
+ [[package]]
+ name = "ryu"
diff --git a/pkgs/by-name/py/pyrefly/package.nix b/pkgs/by-name/py/pyrefly/package.nix
index 7689d016264b..3997c0ec9577 100644
--- a/pkgs/by-name/py/pyrefly/package.nix
+++ b/pkgs/by-name/py/pyrefly/package.nix
@@ -10,17 +10,22 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "pyrefly";
-  version = "0.63.1";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "pyrefly";
     tag = finalAttrs.version;
-    hash = "sha256-BP3I+/YUkgURIQBptHieuHPrdkiJ/H08arL2QZ3jhZ4=";
+    hash = "sha256-S3phcTwZlG9VBHdYzcbsLzj0uqBUDy4Xfy/tlp3AQZg=";
   };
 
   buildAndTestSubdir = "pyrefly";
-  cargoHash = "sha256-41EaxJ2VsIkAe9OsV5zUfkxGBxACxmWoM1Imqoah8mI=";
+
+  cargoPatches = [
+    # https://github.com/facebook/pyrefly/issues/3383
+    ./fix-cargo-lock.patch
+  ];
+  cargoHash = "sha256-OfbPPANsAhrp2MbzDEHGRLWWmUkbMMGKR5B4R6lXdE4=";
 
   buildInputs = [ rust-jemalloc-sys ];
 
diff --git a/pkgs/by-name/sp/spamassassin/package.nix b/pkgs/by-name/sp/spamassassin/package.nix
index e4f44f650320..0a2031455183 100644
--- a/pkgs/by-name/sp/spamassassin/package.nix
+++ b/pkgs/by-name/sp/spamassassin/package.nix
@@ -97,6 +97,9 @@ perlPackages.buildPerlPackage rec {
     mkdir -p $HOME
     mkdir t/log  # pre-create to avoid race conditions
 
+    #401737: Sometimes we get: Failed tests:  2, 4-5, 7-9
+    rm t/spamd_ssl.t
+
     # https://bz.apache.org/SpamAssassin/show_bug.cgi?id=8068
     checkFlagsArray+=(TEST_FILES='$(shell find t -name *.t -not -name spamd_ssl_accept_fail.t)')
   '';
diff --git a/pkgs/development/compilers/llvm/default.nix b/pkgs/development/compilers/llvm/default.nix
index c4157e9d66fe..24277a2ec882 100644
--- a/pkgs/development/compilers/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/default.nix
@@ -28,9 +28,9 @@ let
     "21.1.8".officialRelease.sha256 = "sha256-pgd8g9Yfvp7abjCCKSmIn1smAROjqtfZaJkaUkBSKW0=";
     "22.1.5".officialRelease.sha256 = "sha256-eunfMOH+HVpefZJ+CG7hXDoM+pi6iYvHpD3DoSAsjoE=";
     "23.0.0-git".gitRelease = {
-      rev = "084a5acf5a076aa32c04cbcdca25c27fc75d8e6d";
-      rev-version = "23.0.0-unstable-2026-05-10";
-      sha256 = "sha256-xSyanVzsHokSrxhixUW3ovREeojTX7pedlBoaFpbtXQ=";
+      rev = "e9122d11ff92f2f343668cc759081496a130a943";
+      rev-version = "23.0.0-unstable-2026-05-17";
+      sha256 = "sha256-dnfnxQJ6Ye3wW3FOqZbaY0t/vuSapqc8c85oItGD4D8=";
     };
   }
   // llvmVersions;
diff --git a/pkgs/development/ocaml-modules/dockerfile/default.nix b/pkgs/development/ocaml-modules/dockerfile/default.nix
index 5ef6e3835ad6..6f354a16c5f6 100644
--- a/pkgs/development/ocaml-modules/dockerfile/default.nix
+++ b/pkgs/development/ocaml-modules/dockerfile/default.nix
@@ -10,13 +10,13 @@
 
 buildDunePackage (finalAttrs: {
   pname = "dockerfile";
-  version = "8.3.4";
+  version = "8.3.9";
 
   src = fetchFromGitHub {
     owner = "ocurrent";
     repo = "ocaml-dockerfile";
     tag = finalAttrs.version;
-    hash = "sha256-q8yzuRkGVe/t0N0HFLFqOPNyvWSxf4WHApZVk1CG1qw=";
+    hash = "sha256-O2+kjQnjKSYFZM28RwAUTnNlvEW2CrfdMjT9J8LcPcc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/ocaml-modules/ocb-stubblr/default.nix b/pkgs/development/ocaml-modules/ocb-stubblr/default.nix
index b7b93ebd5e5a..3ca59f130788 100644
--- a/pkgs/development/ocaml-modules/ocb-stubblr/default.nix
+++ b/pkgs/development/ocaml-modules/ocb-stubblr/default.nix
@@ -11,12 +11,12 @@
 
 stdenv.mkDerivation rec {
   pname = "ocaml${ocaml.version}-ocb-stubblr";
-  version = "0.1.0";
+  version = "0.1.1";
 
   src = fetchzip {
     url = "https://github.com/pqwy/ocb-stubblr/releases/download/v${version}/ocb-stubblr-${version}.tbz";
     name = "src.tar.bz";
-    sha256 = "0hpds1lkq4j8wgslv7hnirgfrjmqi36h5rarpw9mwf24gfp5ays2";
+    hash = "sha256-Zd9a2EFT5j944xCFmWD4Td21VB7uGHZoNE4yvgfI9y0=";
   };
 
   patches = [ ./pkg-config.patch ];
diff --git a/pkgs/development/ocaml-modules/ocb-stubblr/pkg-config.patch b/pkgs/development/ocaml-modules/ocb-stubblr/pkg-config.patch
index d86b3f8da9f1..2be484974d4e 100644
--- a/pkgs/development/ocaml-modules/ocb-stubblr/pkg-config.patch
+++ b/pkgs/development/ocaml-modules/ocb-stubblr/pkg-config.patch
@@ -1,6 +1,6 @@
---- a/src/ocb_stubblr.ml	1970-01-01 00:00:01.000000000 +0000
-+++ b/src/ocb_stubblr.ml	2016-12-04 11:10:10.000000000 +0000
-@@ -31,20 +31,9 @@
+--- a/src/ocb_stubblr.ml
++++ b/src/ocb_stubblr.ml
+@@ -31,21 +31,8 @@
  
    (* XXX Would be nice to move pkg-config results to a build artefact. *)
  
@@ -12,8 +12,10 @@
 -  let var = "PKG_CONFIG_PATH"
 -
 -  let path () =
--    Lazy.force opam_prefix / "lib" / "pkgconfig" ::
--      (try [Sys.getenv var] with Not_found -> []) |> String.concat ~sep:":"
+-    let opam = Lazy.force opam_prefix
+-    and rest = try [Sys.getenv var] with Not_found -> [] in
+-    opam/"lib"/"pkgconfig" :: opam/"share"/"pkgconfig" :: rest
+-      |> String.concat ~sep:":"
 -
    let run ~flags package =
 -    let cmd = strf "%s=%s pkg-config %s %s 2>/dev/null"
@@ -22,4 +24,3 @@
 +              package (String.concat ~sep:" " flags) in
      try `Res (run_and_read cmd) with Failure _ -> `Nonexistent
  end
- 
diff --git a/pkgs/development/python-modules/aioamazondevices/default.nix b/pkgs/development/python-modules/aioamazondevices/default.nix
index 5072a31cd6cb..5aebb9f9f0fb 100644
--- a/pkgs/development/python-modules/aioamazondevices/default.nix
+++ b/pkgs/development/python-modules/aioamazondevices/default.nix
@@ -1,10 +1,9 @@
 {
   aiohttp,
-  anyio,
   beautifulsoup4,
   buildPythonPackage,
-  colorlog,
   fetchFromGitHub,
+  httpx,
   langcodes,
   lib,
   orjson,
@@ -16,27 +15,27 @@
 
 buildPythonPackage rec {
   pname = "aioamazondevices";
-  version = "13.4.3";
+  version = "13.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "chemelli74";
     repo = "aioamazondevices";
     tag = "v${version}";
-    hash = "sha256-AH5edWwVEMo/TpnVbcOEC/oYI4DOQ5nqFfoFKeoI3Ok=";
+    hash = "sha256-+71t47H4/idWeef8Nf+4TVHB0xEe5mWCQ271ECm3jOg=";
   };
 
   build-system = [ poetry-core ];
 
   dependencies = [
     aiohttp
-    anyio
     beautifulsoup4
-    colorlog
+    httpx
     langcodes
     orjson
     python-dateutil
-  ];
+  ]
+  ++ httpx.optional-dependencies.http2;
 
   pythonImportsCheck = [ "aioamazondevices" ];
 
diff --git a/pkgs/development/python-modules/mirakuru/default.nix b/pkgs/development/python-modules/mirakuru/default.nix
index dc4aeeb39041..e7c105adca1b 100644
--- a/pkgs/development/python-modules/mirakuru/default.nix
+++ b/pkgs/development/python-modules/mirakuru/default.nix
@@ -25,6 +25,11 @@ buildPythonPackage rec {
     hash = "sha256-3WyjvHxr+6kG+cLSCEZkHoA70mSoT66ubmp0W9g2yJM=";
   };
 
+  postPatch = ''
+    substituteInPlace tests/executors/test_output_executor_regression_issue_98.py \
+      --replace-fail "timeout=15," "timeout=60,"
+  '';
+
   build-system = [ setuptools ];
 
   dependencies = [ psutil ];
diff --git a/pkgs/development/tools/ocaml/camlp5/default.nix b/pkgs/development/tools/ocaml/camlp5/default.nix
index 38fd24135427..72cdbe9d8e10 100644
--- a/pkgs/development/tools/ocaml/camlp5/default.nix
+++ b/pkgs/development/tools/ocaml/camlp5/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation (
   in
   {
 
-    version = if lib.versionAtLeast ocaml.version "4.12" && !legacy then "8.04.00" else "7.14";
+    version = if lib.versionAtLeast ocaml.version "4.12" && !legacy then "8.05.00" else "7.14";
 
     pname = "ocaml${ocaml.version}-camlp5";
 
@@ -35,7 +35,7 @@ stdenv.mkDerivation (
           "rel${builtins.replaceStrings [ "." ] [ "" ] finalAttrs.version}";
       hash =
         {
-          "8.04.00" = "sha256-5IQVGm/tqEzXmZmSYGbGqX+KN9nQLQgw+sBP+F2keXo=";
+          "8.05.00" = "sha256-Y7d72gAxtyAQOIvLGua6Pib+FCoeMlbRYa9vzc+9hRo=";
           "8.03.2" = "sha256-nz+VfGR/6FdBvMzPPpVpviAXXBWNqM3Ora96Yzx964o=";
           "7.14" = "sha256-/ORtS0uc/GN+g3y6N5ftjL4OBSqV6iswLRbfpeNCprU=";
         }
@@ -81,7 +81,7 @@ stdenv.mkDerivation (
 
     meta = {
       broken =
-        lib.versionAtLeast ocaml.version "5.04" && !lib.versionAtLeast finalAttrs.version "8.04.00";
+        lib.versionAtLeast ocaml.version "5.04" && !lib.versionAtLeast finalAttrs.version "8.05.00";
       description = "Preprocessor-pretty-printer for OCaml";
       longDescription = ''
         Camlp5 is a preprocessor and pretty-printer for OCaml programs.
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 04fcd61b297a..6ab5cfa0a397 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -18,7 +18,7 @@ in
 buildLinux (
   args
   // rec {
-    version = "7.0.8";
+    version = "7.0.9";
     pname = "linux-zen";
     modDirVersion = lib.versions.pad 3 "${version}-${suffix}";
     isZen = true;
@@ -27,7 +27,7 @@ buildLinux (
       owner = "zen-kernel";
       repo = "zen-kernel";
       rev = "v${version}-${suffix}";
-      sha256 = "xuzWN+GvsY/EiIwKd+QgUsRVVkM7KQb3i11oyhy2KaQ=";
+      sha256 = "vu6rRldDBp/N6kkMzZEgz9aMsGa/VWPdnkZTCF/Yobo=";
     };
 
     # This is based on the following source:
diff --git a/pkgs/os-specific/linux/nullfs/default.nix b/pkgs/os-specific/linux/nullfsvfs/default.nix
similarity index 81%
rename from pkgs/os-specific/linux/nullfs/default.nix
rename to pkgs/os-specific/linux/nullfsvfs/default.nix
index c289c63f3a88..ee9b4ab0ab0e 100644
--- a/pkgs/os-specific/linux/nullfs/default.nix
+++ b/pkgs/os-specific/linux/nullfsvfs/default.nix
@@ -6,14 +6,14 @@
   kernelModuleMakeFlags,
 }:
 stdenv.mkDerivation rec {
-  pname = "nullfs";
-  version = "0.22";
+  pname = "nullfsvfs";
+  version = "0.26";
 
   src = fetchFromGitHub {
     owner = "abbbi";
     repo = "nullfsvfs";
     rev = "v${version}";
-    sha256 = "sha256-UJubWx5QfzLAiYTN1BPaziT3gKsTI0OVCmcuwKX3Gp0=";
+    sha256 = "sha256-gEvkl8IKekuiQjY+TVaC72vJ310k2A/kXfR5mxdvPpc=";
   };
 
   hardeningDisable = [ "pic" ];
@@ -33,8 +33,8 @@ stdenv.mkDerivation rec {
 
   installPhase = ''
     runHook preInstall
-    mkdir -p "$out/lib/modules/${kernel.modDirVersion}/kernel/fs/nullfs/"
-    install -p -m 644 nullfs.ko $out/lib/modules/${kernel.modDirVersion}/kernel/fs/nullfs/
+    mkdir -p "$out/lib/modules/${kernel.modDirVersion}/kernel/fs/nullfsvfs/"
+    install -p -m 644 nullfsvfs.ko $out/lib/modules/${kernel.modDirVersion}/kernel/fs/nullfsvfs/
     runHook postInstall
   '';
 
diff --git a/pkgs/servers/home-assistant/custom-components/browser-mod/package.nix b/pkgs/servers/home-assistant/custom-components/browser-mod/package.nix
index 0b6ee61243eb..4f6912a79dcd 100644
--- a/pkgs/servers/home-assistant/custom-components/browser-mod/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/browser-mod/package.nix
@@ -10,13 +10,13 @@
 buildHomeAssistantComponent rec {
   owner = "thomasloven";
   domain = "browser_mod";
-  version = "2.13.2";
+  version = "2.13.3";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "hass-browser_mod";
     tag = "v${version}";
-    hash = "sha256-A0FxgLwm8MWFulFLL6qQmWd4DndMxg6zwqLfc/5WCbU=";
+    hash = "sha256-Q7+9pcV9vZ+PPXjlOezcDPtzcekXqBHgPJSwh5n9ruE=";
   };
 
   nativeBuildInputs = [
@@ -27,7 +27,7 @@ buildHomeAssistantComponent rec {
 
   npmDeps = fetchNpmDeps {
     inherit src;
-    hash = "sha256-eSyHX36QeNDPUnvq13bUsO1utn4oZO3Przeoa75MoVk=";
+    hash = "sha256-MeB1NgQM8HvQF42AaE1XkIt0aODVACO8a0wtUFOqVW8=";
   };
 
   npmBuildScript = "build";
diff --git a/pkgs/servers/http/tomcat/default.nix b/pkgs/servers/http/tomcat/default.nix
index 1e0ce698e8af..43f6f752704f 100644
--- a/pkgs/servers/http/tomcat/default.nix
+++ b/pkgs/servers/http/tomcat/default.nix
@@ -60,17 +60,17 @@ let
 in
 {
   tomcat9 = common {
-    version = "9.0.117";
-    hash = "sha256-90oLBh4rAGjsKhel4BwlCFH28w82LIEnIJoqbveVKyk=";
+    version = "9.0.118";
+    hash = "sha256-L9Me+dqZKbh4mX9zHPJVNv6sV0FhwC2TmXJ0ccfEBrI=";
   };
 
   tomcat10 = common {
-    version = "10.1.54";
-    hash = "sha256-X81S45HmNDDbqr6RdqvWsLyXmpnsQr7ujtW/pBVuFeE=";
+    version = "10.1.55";
+    hash = "sha256-l4oNCJA0XuxSo4yWcKjhEtTMjPjLEO9B0F1rcXiFdJU=";
   };
 
   tomcat11 = common {
-    version = "11.0.21";
-    hash = "sha256-mJAzZQx9iAN34CYwe2qwtR3q/p6OoOOY6tA4zPpidW0=";
+    version = "11.0.22";
+    hash = "sha256-c9I5Iy8U394ieOjZMfdn7UVK7ZsBjk1wodQEwlebWZg=";
   };
 }
diff --git a/pkgs/servers/samba/4.x.nix b/pkgs/servers/samba/4.x.nix
index 031109d4ef7c..69df70b61d3e 100644
--- a/pkgs/servers/samba/4.x.nix
+++ b/pkgs/servers/samba/4.x.nix
@@ -205,6 +205,13 @@ stdenv.mkDerivation (finalAttrs: {
 
     patchShebangs ./buildtools/bin
   ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    # The discard_const macro casts through uintptr_t, which newer clang
+    # rejects as non-constant in static initializers. Use a direct cast.
+    substituteInPlace lib/replace/replace.h --replace-fail \
+      '#define discard_const(ptr) ((void *)((uintptr_t)(ptr)))' \
+      '#define discard_const(ptr) ((void *)(ptr))'
+  ''
   + lib.optionalString isCross ''
     substituteInPlace wscript source3/wscript nsswitch/wscript_build lib/replace/wscript source4/ntvfs/sysdep/wscript_configure --replace-fail 'sys.platform' '"${stdenv.hostPlatform.parsed.kernel.name}"'
   '';
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index fb5e3498c376..fe8ebd43504f 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -621,7 +621,7 @@ in
 
         drbd = callPackage ../os-specific/linux/drbd/driver.nix { };
 
-        nullfs = callPackage ../os-specific/linux/nullfs { };
+        nullfsvfs = callPackage ../os-specific/linux/nullfsvfs { };
 
         msi-ec = callPackage ../os-specific/linux/msi-ec { };
 
@@ -647,6 +647,7 @@ in
         system76-power = lib.warnOnInstantiate "kernelPackages.system76-power is now pkgs.system76-power" pkgs.system76-power; # Added 2024-10-16
         system76-scheduler = lib.warnOnInstantiate "kernelPackages.system76-scheduler is now pkgs.system76-scheduler" pkgs.system76-scheduler; # Added 2024-10-16
         tuxedo-keyboard = self.tuxedo-drivers; # Added 2024-09-28
+        nullfs = self.nullfsvfs; # Added 2026-05-16
         phc-intel = throw "phc-intel drivers are no longer supported by any kernel >=4.17"; # added 2025-07-18
         prl-tools = throw "Parallel Tools no longer provide any kernel module, please use pkgs.prl-tools instead."; # added 2025-10-04
         nvidia_dc_565 = throw "nvidiaPackages.dc_565 has reached end of life, see https://endoflife.date/nvidia"; # added 2026-02-10