diff --git a/ci/eval/attrpaths.nix b/ci/eval/attrpaths.nix
deleted file mode 100644
index ff1bdabbb350..000000000000
--- a/ci/eval/attrpaths.nix
+++ /dev/null
@@ -1,85 +0,0 @@
-# This expression will, as efficiently as possible, dump a
-# *superset* of all attrpaths of derivations which might be
-# part of a release on *any* platform.
-#
-# This expression runs single-threaded under all current Nix
-# implementations, but much faster and with much less memory
-# used than ./outpaths.nix itself.
-#
-# Once you have the list of attrnames you can split it up into
-# $NUM_CORES batches and evaluate the outpaths separately for each
-# batch, in parallel.
-#
-# To dump the attrnames:
-#
-#   nix-instantiate --eval --strict --json ci/eval/attrpaths.nix -A names
-#
-{
-  lib ? import (path + "/lib"),
-  trace ? false,
-  path ? ./../..,
-  extraNixpkgsConfigJson ? "{}",
-}:
-let
-
-  # TODO: Use mapAttrsToListRecursiveCond when this PR lands:
-  # https://github.com/NixOS/nixpkgs/pull/395160
-  justAttrNames =
-    path: value:
-    let
-      result =
-        if path == [ "AAAAAASomeThingsFailToEvaluate" ] || !(lib.isAttrs value) then
-          [ ]
-        else if lib.isDerivation value then
-          [ path ]
-        else
-          lib.pipe value [
-            (lib.mapAttrsToList (
-              name: value:
-              lib.addErrorContext "while evaluating package set attribute path '${
-                lib.showAttrPath (path ++ [ name ])
-              }'" (justAttrNames (path ++ [ name ]) value)
-            ))
-            lib.concatLists
-          ];
-    in
-    lib.traceIf trace "** ${lib.showAttrPath path}" result;
-
-  outpaths = import ./outpaths.nix {
-    inherit path;
-    extraNixpkgsConfig = builtins.fromJSON extraNixpkgsConfigJson;
-    attrNamesOnly = true;
-  };
-
-  paths = [
-    # Some of the following are based on variants, which are disabled with `attrNamesOnly = true`.
-    # Until these have been removed from release.nix / hydra, we manually add them to the list.
-    [
-      "pkgsLLVM"
-      "stdenv"
-    ]
-    [
-      "pkgsArocc"
-      "stdenv"
-    ]
-    [
-      "pkgsZig"
-      "stdenv"
-    ]
-    [
-      "pkgsStatic"
-      "stdenv"
-    ]
-    [
-      "pkgsMusl"
-      "stdenv"
-    ]
-  ]
-  ++ justAttrNames [ ] outpaths;
-
-  names = map lib.showAttrPath paths;
-
-in
-{
-  inherit paths names;
-}
diff --git a/ci/eval/chunk.nix b/ci/eval/chunk.nix
index e1759c2c6615..9bea26ce3180 100644
--- a/ci/eval/chunk.nix
+++ b/ci/eval/chunk.nix
@@ -2,8 +2,8 @@
 {
   lib ? import ../../lib,
   path ? ../..,
-  # The file containing all available attribute paths, which are split into chunks here
-  attrpathFile,
+  # The file containing the preEval result
+  preEvalFile,
   chunkSize,
   myChunk,
   includeBroken,
@@ -12,12 +12,13 @@
 }:
 
 let
-  attrpaths = lib.importJSON attrpathFile;
-  myAttrpaths = lib.sublist (chunkSize * myChunk) chunkSize attrpaths;
+  preEvalResult = lib.importJSON preEvalFile;
+  myAttrpaths = lib.sublist (chunkSize * myChunk) chunkSize preEvalResult.paths;
 
   unfiltered = import ./outpaths.nix {
     inherit path;
     inherit includeBroken systems;
+    inherit (preEvalResult) attrPathsDisallowedForInternalUse;
     extraNixpkgsConfig = builtins.fromJSON extraNixpkgsConfigJson;
   };
 
diff --git a/ci/eval/default.nix b/ci/eval/default.nix
index 2e8bec41ca5d..547fcf1f26be 100644
--- a/ci/eval/default.nix
+++ b/ci/eval/default.nix
@@ -38,7 +38,7 @@ let
       fileset = unions (
         map (lib.path.append ../..) [
           ".version"
-          "ci/eval/attrpaths.nix"
+          "ci/eval/pre-eval.nix"
           "ci/eval/chunk.nix"
           "ci/eval/outpaths.nix"
           "default.nix"
@@ -56,11 +56,11 @@ let
     builtins.readFile ../../pkgs/top-level/release-supported-systems.json
   );
 
-  attrpathsSuperset =
+  preEval =
     {
       evalSystem,
     }:
-    runCommand "attrpaths-superset.json"
+    runCommand "pre-eval"
       {
         src = nixpkgs;
         # Don't depend on -dev outputs to reduce closure size for CI.
@@ -73,15 +73,15 @@ let
         export NIX_STATE_DIR=$(mktemp -d)
         mkdir $out
         export GC_INITIAL_HEAP_SIZE=4g
-        command time -f "Attribute eval done [%MKB max resident, %Es elapsed] %C" \
+        command time -f "Pre-eval done [%MKB max resident, %Es elapsed] %C" \
           nix-instantiate --eval --strict --json --show-trace \
-            "$src/ci/eval/attrpaths.nix" \
-            -A paths \
+            "$src/ci/eval/pre-eval.nix" \
+            -A result \
             -I "$src" \
             --argstr extraNixpkgsConfigJson ${lib.escapeShellArg (builtins.toJSON extraNixpkgsConfig)} \
             --option restrict-eval true \
             --option allow-import-from-derivation false \
-            --option eval-system "${evalSystem}" > $out/paths.json
+            --option eval-system "${evalSystem}" > $out/result.json
       '';
 
   singleSystem =
@@ -90,8 +90,8 @@ let
       # Note that this is intentionally not called `system`,
       # because `--argstr system` would only be passed to the ci/default.nix file!
       evalSystem ? builtins.currentSystem,
-      # The path to the `paths.json` file from `attrpathsSuperset`
-      attrpathFile ? "${attrpathsSuperset { inherit evalSystem; }}/paths.json",
+      # The path to the `result.json` file from `preEval`
+      preEvalFile ? "${preEval { inherit evalSystem; }}/result.json",
     }:
     let
       singleChunk = writeShellScript "single-chunk" ''
@@ -121,12 +121,12 @@ let
           --show-trace \
           --arg chunkSize "$chunkSize" \
           --arg myChunk "$myChunk" \
-          --arg attrpathFile "${attrpathFile}" \
+          --arg preEvalFile "${preEvalFile}" \
           --arg systems "[ \"$system\" ]" \
           --arg includeBroken ${lib.boolToString includeBroken} \
           --argstr extraNixpkgsConfigJson ${lib.escapeShellArg (builtins.toJSON extraNixpkgsConfig)} \
           -I ${nixpkgs} \
-          -I ${attrpathFile} \
+          -I ${preEvalFile} \
           > "$outputDir/result/$myChunk" \
           2> "$outputDir/stderr/$myChunk"
         exitCode=$?
@@ -164,7 +164,7 @@ let
         echo "System: $evalSystem"
         cores=$NIX_BUILD_CORES
         echo "Cores: $cores"
-        attrCount=$(jq length "${attrpathFile}")
+        attrCount=$(jq '.paths | length' "${preEvalFile}")
         echo "Attribute count: $attrCount"
         echo "Chunk size: $chunkSize"
         # Same as `attrCount / chunkSize` but rounded up
@@ -316,7 +316,7 @@ let
 in
 {
   inherit
-    attrpathsSuperset
+    preEval
     singleSystem
     diff
     combine
diff --git a/ci/eval/outpaths.nix b/ci/eval/outpaths.nix
index afbce48f3321..512290ce450a 100755
--- a/ci/eval/outpaths.nix
+++ b/ci/eval/outpaths.nix
@@ -6,7 +6,7 @@
   includeBroken ? true, # set this to false to exclude meta.broken packages from the output
   path ? ./../..,
 
-  # used by ./attrpaths.nix
+  # used by ./pre-eval.nix
   attrNamesOnly ? false,
 
   # Set this to `null` to build for builtins.currentSystem only
@@ -14,6 +14,8 @@
     builtins.readFile (path + "/pkgs/top-level/release-supported-systems.json")
   ),
 
+  attrPathsDisallowedForInternalUse ? [ ],
+
   # Customize the config used to evaluate nixpkgs
   extraNixpkgsConfig ? { },
 }:
@@ -35,6 +37,22 @@ let
             allowVariants = !attrNamesOnly;
             checkMeta = true;
 
+            # We don't need to care about problems being caught using the
+            # standard mechanism, because any problems whose kind is not
+            # nixpkgsInternalUseAllowed cause the corresponding attributes to
+            # be disallowed entirely for internal use with
+            # attrPathsDisallowedForInternalUse, see also ./pre-eval.nix
+            problems.matchers = lib.mkForce [
+              # We only need to set the broken handler to error, so that CI
+              # doesn't evaluate those. No reason it couldn't evaluate them
+              # afaik, but this is how it's been before.
+              {
+                kind = "broken";
+                handler = "error";
+              }
+            ];
+            inherit attrPathsDisallowedForInternalUse;
+
             # Silence the `x86_64-darwin` deprecation warning.
             allowDeprecatedx86_64Darwin = true;
 
diff --git a/ci/eval/pre-eval.nix b/ci/eval/pre-eval.nix
new file mode 100644
index 000000000000..eff8204a7bd5
--- /dev/null
+++ b/ci/eval/pre-eval.nix
@@ -0,0 +1,128 @@
+# This file does a fast pre-evaluation of Nixpkgs to determine:
+# - paths: A *superset* of all attrpaths of derivations which might be part of a release on *any* platform.
+# - attrPathsDisallowedForInternalUse: Attribute paths whose meta.problems has problems whose kinds should not be used internally in Nixpkgs
+#
+# This expression runs single-threaded under all current Nix
+# implementations, but much faster and with much less memory
+# used than ./outpaths.nix itself.
+#
+# Once you have the list of attrnames you can split it up into
+# $NUM_CORES batches and evaluate the outpaths separately for each
+# batch, in parallel.
+#
+# To dump the result:
+#
+#   nix-instantiate --eval --strict --json ci/eval/pre-eval.nix -A result
+#
+{
+  lib ? import (path + "/lib"),
+  trace ? false,
+  path ? ./../..,
+  extraNixpkgsConfigJson ? "{}",
+}:
+let
+
+  # TODO: Use mapAttrsToListRecursiveCond when this PR lands:
+  # https://github.com/NixOS/nixpkgs/pull/395160
+  listAttrs =
+    path: value:
+    let
+      result =
+        if path == [ "AAAAAASomeThingsFailToEvaluate" ] || !(lib.isAttrs value) then
+          [ ]
+        else if lib.isDerivation value then
+          [
+            {
+              inherit path value;
+            }
+          ]
+        else
+          lib.pipe value [
+            (lib.mapAttrsToList (
+              name: value:
+              lib.addErrorContext "while evaluating package set attribute path '${
+                lib.showAttrPath (path ++ [ name ])
+              }'" (listAttrs (path ++ [ name ]) value)
+            ))
+            lib.concatLists
+          ];
+    in
+    lib.traceIf trace "** ${lib.showAttrPath path}" result;
+
+  outpaths = import ./outpaths.nix {
+    inherit path;
+    extraNixpkgsConfig = builtins.fromJSON extraNixpkgsConfigJson;
+    attrNamesOnly = true;
+  };
+
+  list =
+    map
+      (path: {
+        inherit path;
+        # This looks a bit weird, but the only reason we care about this value
+        # is for the meta.problems check below, and stdenv's certainly don't
+        # have any problems, so this is fine :)
+        value = { };
+      })
+      [
+        # Some of the following are based on variants, which are disabled with `attrNamesOnly = true`.
+        # Until these have been removed from release.nix / hydra, we manually add them to the list.
+        [
+          "pkgsLLVM"
+          "stdenv"
+        ]
+        [
+          "pkgsArocc"
+          "stdenv"
+        ]
+        [
+          "pkgsZig"
+          "stdenv"
+        ]
+        [
+          "pkgsStatic"
+          "stdenv"
+        ]
+        [
+          "pkgsMusl"
+          "stdenv"
+        ]
+      ]
+    ++ listAttrs [ ] outpaths;
+  paths = map (attrs: attrs.path) list;
+  names = map lib.showAttrPath paths;
+
+  inherit (import ../../pkgs/stdenv/generic/problems.nix { inherit lib; })
+    disallowNixpkgsInternalUseKinds
+    ;
+
+  # Determine the list of attributes whose packages have any meta.problems
+  # with a kind that's disallowed from internal Nixpkgs use
+  attrPathsDisallowedForInternalUse = lib.pipe list [
+    (lib.map (
+      attrs:
+      attrs
+      // {
+        problematicProblems = builtins.tryEval (
+          lib.filterAttrs (name: problem: disallowNixpkgsInternalUseKinds ? ${problem.kind}) (
+            attrs.value.meta.problems or { }
+          )
+        );
+      }
+    ))
+    (lib.filter (attrs: attrs.problematicProblems.success && attrs.problematicProblems.value != { }))
+    (lib.map (attrs: {
+      attrPath = attrs.path;
+      reason = "it has certain meta.problems whose kinds are disallowed: ${
+        lib.generators.toPretty { } attrs.problematicProblems.value
+      }";
+    }))
+  ];
+in
+{
+  # TODO: Do we still need these? Probably not
+  inherit paths names;
+  result = {
+    inherit paths attrPathsDisallowedForInternalUse;
+  };
+}
diff --git a/doc/languages-frameworks/neovim.section.md b/doc/languages-frameworks/neovim.section.md
index b131e65a0e59..e0c22d8ccba5 100644
--- a/doc/languages-frameworks/neovim.section.md
+++ b/doc/languages-frameworks/neovim.section.md
@@ -248,6 +248,43 @@ You can install the standalone parsers and queries directly without installing `
 })
 ```
 
+### Treesitter setup using WASM parsers and queries {#neovim-plugin-treesitter-wasm}
+
+Neovim can load WASM parsers when it is built with Wasmtime support.
+In nixpkgs, WASM parser plugins are available from the `wasi32` cross package set:
+
+```nix
+(pkgs.wrapNeovim (pkgs.neovim-unwrapped.override { wasmSupport = true; }) {
+  configure = {
+    packages.myPlugins =
+      with pkgs.pkgsCross.wasi32.vimPlugins;
+      let
+        # Select the grammars you need
+        treesitter-grammars = with nvim-treesitter-parsers; [
+          nix
+          python
+        ];
+        # Queries are needed for treesitter based syntax highlighting and folds.
+        treesitter-queries = map (p: p.associatedQuery) treesitter-grammars;
+      in
+      {
+        start = [
+          # regular plugins
+        ]
+        ++ treesitter-grammars
+        ++ treesitter-queries;
+      };
+  };
+})
+```
+
+Do not install both native and WASM parsers for the same language.
+For example, installing both `pkgs.vimPlugins.nvim-treesitter-parsers.nix` and
+`pkgs.pkgsCross.wasi32.vimPlugins.nvim-treesitter-parsers.nix` is invalid because Neovim
+loads the first `parser/nix.*` found on `runtimepath`.
+
+Use `:checkhealth vim.treesitter` to verify Nix-managed WASM parsers.
+
 You can enable treesitter features for installed grammars in a `FileType` autocommand
 or in an `ftplugin/<language>.lua` script, e.g.
 
diff --git a/doc/redirects.json b/doc/redirects.json
index 992e6cfcac87..cf6ab6a33842 100644
--- a/doc/redirects.json
+++ b/doc/redirects.json
@@ -224,6 +224,9 @@
   "neovim-luarocks-based-plugins": [
     "index.html#neovim-luarocks-based-plugins"
   ],
+  "neovim-plugin-treesitter-wasm": [
+    "index.html#neovim-plugin-treesitter-wasm"
+  ],
   "nixpkgs-manual": [
     "index.html#nixpkgs-manual"
   ],
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index afcc1774d0dd..f5433d6b9046 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -4396,6 +4396,13 @@
     githubId = 48105979;
     name = "Caitlin Davitt";
   };
+  cakeforcat = {
+    email = "julia@cakeforcat.dev";
+    github = "cakeforcat";
+    githubId = 37912991;
+    name = "Julia Czarny";
+    matrix = "@cakeforcat:matrix.org";
+  };
   calavera = {
     email = "david.calavera@gmail.com";
     github = "calavera";
diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index 1e5808da6a35..32f2bab23a62 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -22,6 +22,8 @@
 
 - [Stump](https://www.stumpapp.dev/), a free and open source comics, manga and digital book server with OPDS support. Available as [services.stump](#opt-services.stump.enable).
 
+- [Freescout](https://freescout.net/), a free, open source Helpdesk and shared mailbox. Available as [services.freescout](#opt-services.freescout.enable).
+
 - [FlapAlerted](https://github.com/Kioubit/FlapAlerted), detects BGP flapping events and provides statistics based on BGP update messages. Available as [services.flap-alerted](#opt-services.flap-alerted.enable).
 
 - [Unpackerr](https://unpackerr.zip), extracts downloads for Radarr, Sonarr, Lidarr, Readarr, and/or a Watch folder. Available as [services.unpackerr](#opt-services.unpackerr.enable).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index a9dcefebf99f..2d6baa7ef0db 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1664,6 +1664,7 @@
   ./services/web-apps/firefly-iii.nix
   ./services/web-apps/flarum.nix
   ./services/web-apps/fluidd.nix
+  ./services/web-apps/freescout.nix
   ./services/web-apps/freshrss.nix
   ./services/web-apps/froide-govplan.nix
   ./services/web-apps/galene.nix
diff --git a/nixos/modules/services/web-apps/freescout.nix b/nixos/modules/services/web-apps/freescout.nix
new file mode 100644
index 000000000000..7c1339604c5f
--- /dev/null
+++ b/nixos/modules/services/web-apps/freescout.nix
@@ -0,0 +1,487 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+
+let
+  # Simple alias variables
+  user = "freescout";
+  group = user;
+  cfg = config.services.freescout;
+  datadir = "/var/lib/freescout";
+  cachedir = "/var/cache/freescout";
+  fpmService = "phpfpm-${user}";
+
+  # Generated config and more complex templates / default variables
+  autoDb = if !cfg.databaseSetup.enable then false else cfg.databaseSetup.kind;
+  dbService = lib.optional (autoDb != false) (
+    if autoDb == "mysql" then "mysql.service" else "postgresql.service"
+  );
+  db_config = lib.optionalAttrs (autoDb != false) (
+    if autoDb == "mysql" then
+      {
+        DB_CONNECTION = "mysql";
+        DB_HOST = "";
+        DB_SOCKET = "/run/mysqld/mysqld.sock";
+        DB_USERNAME = user;
+        DB_DATABASE = user;
+      }
+    else
+      {
+        DB_CONNECTION = "pgsql";
+        DB_HOST = "/run/postgresql";
+        DB_DATABASE = user;
+        DB_USERNAME = user;
+      }
+  );
+
+  raw_config = {
+    APP_ENV = "production";
+    APP_FORCE_HTTPS = true;
+    APP_URL = "https://${cfg.domain}";
+    APP_TIMEZONE = config.time.timeZone;
+    APP_DISABLE_UPDATING = true;
+  }
+  // cfg.settings
+  // db_config;
+  app_config = dropNull raw_config;
+  baseService = {
+    path = [
+      pkgs.ps
+      artisanWrapped
+    ];
+    requires = [
+      # Using requires (instead of wants) since a failing config
+      # is indeed critical and should not allow this service to continue
+      "freescout-setup.service"
+    ]
+    ++ dbService;
+    serviceConfig = {
+      User = user;
+      Group = group;
+    };
+  };
+
+  # Custom built packages / files / scripts
+  phpPackage = cfg.phpPackage.buildEnv {
+    # As of php8.5 opcache is required and automatically compiled in and thus is not available in
+    # all anymore. To keep compatibility with older versions, still add if available.
+    extensions =
+      { all, enabled }: enabled ++ [ all.iconv ] ++ (lib.optional (all ? opcache) all.opcache);
+    # Don't log anything because we are not sure, if this may leak secrets
+    # Logging can be increased, if we have time to check the logging library
+    extraConfig = ''
+      error_reporting = 0
+    '';
+  };
+
+  package = cfg.package.overrideAttrs (prev: {
+    pname = "${prev.pname}-${cfg.domain}";
+    postInstall = prev.postInstall or "" + ''
+      ln -s ${datadir} $out/share/freescout/data
+    '';
+  });
+
+  artisanWrapped = pkgs.writeShellApplication {
+    name = "artisan-wrapped";
+    runtimeInputs = with pkgs; [
+      util-linux
+    ];
+    text = ''
+      cd ${datadir}
+      _runuser='exec'
+      if [[ "$USER" != ${user} ]]; then
+        _runuser='exec runuser --user ${user}'
+      fi
+      ''${_runuser} ${lib.getExe phpPackage} ${package}/share/freescout/artisan "$@"
+    '';
+  };
+  configFile = mkEnvFile "freescout.env" app_config;
+  allSecrets = lib.catAttrs "_secret" (lib.collect isSecret app_config);
+
+  configSetupScript = pkgs.writeShellScript "freescout-config-setup" ''
+    set -o errexit -o pipefail -o nounset -o errtrace
+    shopt -s inherit_errexit
+    PATH=${lib.makeBinPath [ pkgs.replace-secret ]}:$PATH
+    cp ${configFile} "/tmp/raw.env";
+    ${mkSecretsReplacement "/tmp/raw.env" allSecrets}
+    install -T --mode 400 -o ${user} -g ${group} "/tmp/raw.env" "${datadir}/.env"
+    rm "/tmp/raw.env"
+  '';
+
+  freescoutSetupScript =
+    let
+      rwPaths = [
+        "storage/app"
+        "storage/framework"
+        "storage/framework/sessions"
+        "storage/framework/views"
+        "storage/framework/cache/data"
+        "storage/logs"
+        "bootstrap/cache"
+        "public/css/builds"
+        "public/js/builds"
+        "Modules"
+        "public/modules"
+      ];
+    in
+    ''
+      set -x
+      umask 027
+      # Working arround https://github.com/freescout-helpdesk/freescout/issues/2547
+      # and having to manually clear cache when migrating from something around
+      # ~1.8.159 (╯°□°)╯︵ ┻━┻
+      # See: https://github.com/freescout-help-desk/freescout/issues/4366#issuecomment-2495993397
+      rm -f ${datadir}/bootstrap/cache.php ${datadir}/bootstrap/cache/{config,packages,services}.php
+
+      ln -sf "${artisanWrapped}/bin/artisan-wrapped" "${datadir}/artisan"
+      ${lib.concatMapStringsSep "\n" (p: "mkdir -p ${datadir}/${p}") rwPaths}
+
+      # Migrate database and stuff
+      # This does migrate, cache:clear, queue:restart
+      ${lib.getExe artisanWrapped} freescout:after-app-update
+    '';
+
+  # Helper functions
+  isSecret = v: lib.isAttrs v && v ? _secret && lib.strings.isConvertibleWithToString v._secret;
+  hashSecret = p: builtins.hashString "sha256" (toString p);
+  dropNull = lib.filterAttrsRecursive (
+    _: v:
+    !lib.elem v [
+      null
+      [ ]
+      { }
+    ]
+  );
+  mkEnvVars = lib.generators.toKeyValue {
+    mkKeyValue =
+      k: v:
+      let
+        value =
+          with builtins;
+          if isInt v then
+            toString v
+          else if isString v then
+            v
+          else if isBool v then
+            lib.boolToString v
+          else if isSecret v then
+            hashSecret v._secret
+          else
+            throw "freescout: ${k} has unsupported type ${typeOf v}: ${(lib.generators.toPretty { }) v}";
+      in
+      "${k}=${value}";
+  };
+  mkEnvFile = fname: values: pkgs.writeText fname (mkEnvVars values);
+  mkSecretsReplacement =
+    filePath:
+    lib.concatMapStringsSep "\n" (
+      sp:
+      "replace-secret ${
+        lib.escapeShellArgs [
+          (hashSecret sp)
+          sp
+        ]
+      } ${filePath}"
+    );
+in
+{
+  options.services.freescout = with lib; {
+    enable = mkEnableOption "FreeScout helpdesk application";
+
+    package = mkPackageOption pkgs "freescout" { };
+
+    phpPackage = mkOption {
+      type = types.package;
+      default = pkgs.php;
+      description = "The php package to use";
+      defaultText = literalExpression "pkgs.php";
+    };
+
+    domain = mkOption {
+      type = types.str;
+      description = "Domain the freescout installation will run under";
+      example = "support.mydomain.net";
+    };
+
+    settings = mkOption {
+      type = with types; attrsOf anything;
+      apply = mapAttrs' (
+        k: v: {
+          name = toUpper k;
+          value = v;
+        }
+      );
+      default = { };
+      description = ''
+        Settings to be set in the `.env` file. See
+        <https://github.com/freescout-help-desk/freescout/blob/master/.env.example>
+        for reference on available environment variables.
+
+        Will be merged with the shown defaults.
+      '';
+      defaultText = lib.literalExpression ''
+        {
+          APP_ENV = "production";
+          APP_FORCE_HTTPS = true;
+          APP_URL = "https://''${config.services.freescout.domain}";
+          APP_TIMEZONE = config.time.timeZone;
+          APP_DISABLE_UPDATING = true;
+        }
+      '';
+      example = lib.literalExpression ''
+        {
+          # NOTE: MUST be 256 bits (32 bytes) in length, the form of base64:<base64 encoded key> is recommended.
+          # You can generate a valid one using `echo "base64:$(openssl rand -base64 32)"`
+          APP_KEY_FILE = "/run/secret/freescout/app_key";
+          DB_CONNECTION = "mysql";
+          DB_HOST = "localhost";
+          DB_PORT = 3306;
+          DB_DATABASE = "freescout";
+          DB_USERNAME = "freescout";
+          DB_PASSWORD._secret = "/run/secret/freescout/db_pass";
+        }
+      '';
+    };
+
+    poolConfig = mkOption {
+      type =
+        with types;
+        attrsOf (oneOf [
+          str
+          int
+          bool
+        ]);
+      default = {
+        "pm" = "ondemand";
+        "pm.max_children" = 32;
+        "pm.process_idle_timeout" = "120s";
+        "pm.max_requests" = 500;
+      };
+      description = ''
+        Options for the freescout PHP pool. See the documentation on `php-fpm.conf`
+        for details on configuration directives.
+      '';
+    };
+
+    databaseSetup = {
+      enable = mkOption {
+        type = types.bool;
+        description = "Whether to enable automatic database setup and configuration";
+        default = true;
+      };
+
+      kind = mkOption {
+        type = types.enum [
+          "mysql"
+          "pgsql"
+        ];
+        default = "pgsql";
+        example = "mysql";
+        description = "Type of database to automatically set up";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = (app_config ? "APP_KEY" || app_config ? "APP_KEY_FILE");
+        message = "`services.freescout.settings.APP_KEY_FILE` is required!";
+      }
+    ];
+
+    warnings =
+      lib.optional (app_config ? "APP_KEY" && lib.isString app_config.APP_KEY)
+        "`services.freescout.settings.APP_KEY` will be stored in the world readable nix store. Use `APP_KEY._secret` or `APP_KEY_FILE` instead!";
+
+    users.users.${user} = {
+      inherit group;
+      isSystemUser = true;
+      createHome = true;
+      home = datadir;
+      homeMode = "750";
+    };
+    users.users.${config.services.nginx.user}.extraGroups = [ group ];
+    users.groups.${group} = { };
+
+    services.postgresql = lib.mkIf (autoDb == "pgsql") {
+      enable = true;
+      ensureUsers = [
+        {
+          name = user;
+          ensureDBOwnership = true;
+        }
+      ];
+      ensureDatabases = [
+        app_config.DB_DATABASE
+      ];
+    };
+
+    services.mysql = lib.mkIf (autoDb == "mysql") {
+      enable = true;
+      package = lib.mkDefault pkgs.mariadb;
+      ensureUsers = [
+        {
+          name = user;
+          ensurePermissions = {
+            "${app_config.DB_DATABASE}.*" = "ALL PRIVILEGES";
+          };
+        }
+      ];
+      ensureDatabases = [
+        app_config.DB_DATABASE
+      ];
+    };
+
+    services.phpfpm.pools.${user} = {
+      inherit phpPackage user group;
+
+      phpOptions = ''
+        display_errors = On
+        display_startup_errors = On
+      '';
+      settings = {
+        "listen.owner" = user;
+        "listen.group" = config.services.nginx.group;
+        "catch_workers_output" = true;
+      }
+      // cfg.poolConfig;
+    };
+
+    systemd.services.${fpmService} = {
+      # Somehow the webinterface shows
+      inherit (baseService) path;
+    };
+
+    systemd.services.freescout-setup = lib.recursiveUpdate baseService {
+      description = "Preparational tasks for freescout";
+      requires = dbService;
+      wantedBy = [ "multi-user.target" ];
+      after = dbService;
+      script = freescoutSetupScript;
+      serviceConfig = {
+        PrivateTmp = true;
+        Type = "oneshot";
+        RemainAfterExit = true;
+        ExecStartPre = "+${configSetupScript}";
+      };
+    };
+
+    # This needs to be manually started again and again
+    # Freescout has its own scheduler built in to ensure tasks run at the desired frequency
+    # --no-interaction makes sure, that the queue worker is not executed.
+    # This is needed, because otherweise the queue worker process would continue running
+    # thus block further schedule invocations until the queue worker terminates.
+    # See https://github.com/freescout-help-desk/freescout/blob/74fa4b7d4f8288f8d3fb1d343308d3289c4d72e2/app/Console/Kernel.php#L195-L267
+    systemd.services."freescout-schedule-run" = baseService // {
+      startAt = "minutely";
+      script = "${lib.getExe artisanWrapped} schedule:run --no-interaction";
+    };
+
+    # This is both long-running but also stops quite frequently.
+    # Seeing job restart counts in the thousands here is normal.
+    systemd.services."freescout-queue" = lib.recursiveUpdate baseService {
+      # Copying the output to storage/logs because it makes
+      # debugging connection issues easier for the user.
+      script = ''
+        ${lib.getExe artisanWrapped} \
+          queue:work \
+          --queue emails,default \
+          --sleep=5 \
+          -vv \
+          --tries=20 \
+          | tee -a ${datadir}/storage/logs/queue-jobs.log
+      '';
+      serviceConfig = {
+        RestartSec = "15s";
+        RuntimeMaxSec = "1h";
+        Restart = "always";
+      };
+      wantedBy = [ "multi-user.target" ];
+      after = [ "freescout-setup.service" ] ++ dbService;
+    };
+
+    services.nginx = {
+      enable = true;
+      virtualHosts.${cfg.domain} =
+        let
+          vhostCfg = config.services.nginx.virtualHosts.${cfg.domain};
+          optSsl = lib.optionalString (vhostCfg.forceSSL || vhostCfg.onlySSL) "fastcgi_param HTTPS on;";
+        in
+        {
+          root = lib.mkForce "${package}/share/freescout/public";
+
+          locations = {
+            "/" = {
+              index = "index.php";
+              tryFiles = "$uri $uri/ /index.php$is_args$args";
+
+              extraConfig = ''
+                # Defeats E-Mail open tracking or possibly "real" exploits
+                add_header X-XSS-Protection "1; mode=block" always;
+                add_header X-Content-Type-Options "nosniff" always;
+                add_header Referrer-Policy "no-referrer-when-downgrade" always;
+                add_header Content-Security-Policy "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'";
+              '';
+            };
+
+            "~ \\.php$" = {
+              tryFiles = "$uri $uri/ =404";
+              extraConfig = ''
+                fastcgi_index index.php;
+                include ${pkgs.nginx}/conf/fastcgi_params;
+                fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+                fastcgi_pass unix:${config.services.phpfpm.pools.${user}.socket};
+                ${optSsl}
+
+                # Defeats E-Mail open tracking or possibly "real" exploits
+                add_header X-XSS-Protection "1; mode=block" always;
+                add_header X-Content-Type-Options "nosniff" always;
+                add_header Referrer-Policy "no-referrer-when-downgrade" always;
+                add_header Content-Security-Policy "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'";
+              '';
+            };
+
+            "~* ^/storage/attachment/" = {
+              tryFiles = "$uri $uri/ /index.php?$query_string";
+              extraConfig = ''
+                expires 1M;
+                access_log off;
+              '';
+            };
+
+            "~* ^/(?:css|js)/.*\\.(?:css|js)$".extraConfig = ''
+              expires 2d;
+              access_log off;
+              add_header Cache-Control "public, must-revalidate";
+              # Defeats E-Mail open tracking or possibly "real" exploits
+              add_header X-XSS-Protection "1; mode=block" always;
+              add_header X-Content-Type-Options "nosniff" always;
+              add_header Referrer-Policy "no-referrer-when-downgrade" always;
+              add_header Content-Security-Policy "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'";
+            '';
+
+            "~* ^/(?:css|fonts|img|installer|js|modules)$".extraConfig = ''
+              expires 1M;
+              access_log off;
+              add_header Cache-Control "public, must-revalidate";
+            '';
+
+            "~ /\\.".extraConfig = ''
+              deny all;
+            '';
+            "^~ /(css|js)/builds/".root = "${cachedir}/public/";
+            "^~ /storage/app/attachment/" = {
+              alias = "${datadir}/storage/app/attachment/";
+              extraConfig = ''
+                internal;
+              '';
+            };
+          };
+        };
+    };
+  };
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 378db6403e12..ab8e486ca8cc 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -630,6 +630,9 @@ in
     forgejoPackage = pkgs.forgejo-lts;
   };
   freenet = runTest ./freenet.nix;
+  freescout = import ./freescout {
+    inherit runTest;
+  };
   freeswitch = runTest ./freeswitch.nix;
   freetube = discoverTests (import ./freetube.nix);
   freshrss = import ./freshrss { inherit runTest; };
diff --git a/nixos/tests/freescout/default.nix b/nixos/tests/freescout/default.nix
new file mode 100644
index 000000000000..603f61131432
--- /dev/null
+++ b/nixos/tests/freescout/default.nix
@@ -0,0 +1,5 @@
+{ runTest }:
+{
+  integration = runTest ./integration.nix;
+  upgrade = runTest ./upgrade.nix;
+}
diff --git a/nixos/tests/freescout/integration.nix b/nixos/tests/freescout/integration.nix
new file mode 100644
index 000000000000..57d28f032c3a
--- /dev/null
+++ b/nixos/tests/freescout/integration.nix
@@ -0,0 +1,195 @@
+# This tests runs freescout and performs the following tests:
+# - Create amin user via the CLI
+# - Create mailbox, configured for sending and receiving
+# - Test if receiving, sending and notifications work
+{ pkgs, lib, ... }:
+
+let
+  mailDomain = "freemail.local";
+  freescoutDomain = "freescout.local";
+  sendInitial = pkgs.writeShellScriptBin "send-initial" ''
+    exec ${pkgs.dovecot}/libexec/dovecot/deliver -d freescout <<MAIL
+    From: root@localhost
+    To: freescout@localhost
+    Subject: Hello NixOS!
+    Message-ID: initialtestmail-$(date +%s)@localhost
+
+    I am just a test E-Mail to see if freescout is (somewhat) working.
+    MAIL
+  '';
+
+  keyFile = pkgs.writeText "freescout-app-key" "base64:J8ZgK5LZkhVKpmZvjjA700sNL7+Y6aQTus8ZnUNNAaE=";
+
+  baseTestNode =
+    {
+      config,
+      ...
+    }:
+    {
+      virtualisation.memorySize = 1024;
+      environment.systemPackages = with pkgs; [
+        curl
+        sendInitial
+        jq
+      ];
+
+      networking.firewall.allowedTCPPorts = [
+        80
+        8025
+      ];
+      networking.extraHosts = ''
+        127.0.0.1 ${mailDomain} ${freescoutDomain}
+      '';
+
+      services.mailhog = {
+        enable = true;
+        setSendmail = false;
+      };
+
+      users.users.alice = {
+        isNormalUser = true;
+        description = "Alice Foobar";
+        password = "foobar";
+        uid = 1000;
+      };
+
+      users.users.bob = {
+        isNormalUser = true;
+        description = "Bob Foobar";
+        password = "foobar";
+      };
+
+      # Taken from from the parsedmarc.nix test
+      services.postfix.enable = true;
+      services.dovecot2 = {
+        enable = true;
+        settings = {
+          dovecot_config_version = "2.4.4";
+          dovecot_storage_version = "2.4.4";
+          mail_uid = "vmail";
+          mail_gid = "vmail";
+          protocols = [
+            "imap"
+            "lmtp"
+          ];
+          mail_driver = "maildir";
+          mail_home = "${config.services.postfix.settings.main.mail_spool_directory}/{user}";
+          "passdb static" = {
+            fields = {
+              nopassword = true;
+              allow_nets = "local,0.0.0.0/0,::/0";
+            };
+          };
+        };
+      };
+      users.users.freescout = {
+        password = "foobar2342";
+      };
+
+      services.freescout = {
+        enable = true;
+        domain = freescoutDomain;
+        settings = {
+          APP_KEY._secret = toString keyFile;
+          APP_FORCE_HTTPS = false;
+          APP_URL = "http://${freescoutDomain}";
+          APP_REMOTE_HOST_WHITE_LIST = "localhost,127.0.0.1,::1";
+          APP_DEBUG = true;
+        };
+      };
+    };
+
+  mkNode =
+    dbType:
+    { config, pkgs, ... }:
+    {
+      imports = [
+        baseTestNode
+      ];
+      services.freescout.databaseSetup = {
+        enable = true;
+        kind = dbType;
+      };
+    };
+in
+{
+  name = "freescout-integration";
+  meta.maintainers = with lib.maintainers; [
+    e1mo
+  ];
+
+  nodes = {
+    # This may lead to duplicate tests, but ensures that
+    # it's always tested on the current default version
+    # even if the tests are not updated
+    freescout_pgsql = mkNode "pgsql";
+
+    # Same as the freescout_pgsql_default node
+    freescout_mysql = mkNode "mysql";
+  };
+
+  testScript = ''
+    start_all()
+
+    for machine in [freescout_pgsql]:
+      machine.wait_for_unit("postgresql")
+
+    for machine in [freescout_mysql]:
+      machine.wait_for_unit("mysql")
+
+    all=[
+      freescout_pgsql,
+      freescout_mysql
+    ]
+
+    for machine in all:
+      machine.wait_for_unit("nginx")
+      machine.wait_for_unit("dovecot")
+      machine.wait_for_unit("mailhog")
+      machine.wait_for_open_port(1025)
+      machine.wait_for_open_port(8025)
+      machine.wait_for_unit("freescout-setup")
+
+      with subtest("Login works"):
+        machine.succeed("/var/lib/freescout/artisan freescout:create-user --role=admin --firstName=Xenia --lastName=TheFox --email xenia@${freescoutDomain} --no-interaction --password=foo | grep 'User created with id'")
+        token=machine.succeed("curl -fsSL --cookie-jar cjar 'http://${freescoutDomain}/login' | grep -Po '(?<= name=\"_token\" value=\")(\\w+)(?=\")'").strip()
+        data=f"email=xenia%40${freescoutDomain}&password=foo&_token={token}&remember=on"
+        machine.succeed(f"curl -sSfX POST --cookie-jar cjar --cookie cjar --data-raw '{data}' 'http://${freescoutDomain}/login' | grep 'Redirecting to'")
+        machine.succeed("curl -fsSL --cookie-jar cjar --cookie cjar 'http://${freescoutDomain}' | grep 'Dashboard'")
+        # Enable all (most except following) notifications
+        to_enable=list(range(1, 9))
+        enable_data="&".join(map(lambda n: "subscriptions%5B1%5D%5B%5D=" + str(n), range(1,9)))
+        data=f"_token={token}&{enable_data}"
+        machine.succeed(f"curl -sSfX POST --cookie-jar cjar --cookie cjar --data-raw '{data}' 'http://${freescoutDomain}/users/notifications/1'")
+
+      with subtest("Create and edit Mailbox"):
+        data=f"email=freescout%40${mailDomain}&name=Test+Mailbox&_token={token}"
+        machine.succeed(f"curl -sSfX POST --cookie-jar cjar --cookie cjar --data-raw '{data}' 'http://${freescoutDomain}/mailbox/new'")
+        machine.succeed("curl -fsSL --cookie-jar cjar --cookie cjar 'http://${freescoutDomain}' | grep 'Test Mailbox'")
+        machine.succeed("curl -sSf --cookie-jar cjar --cookie cjar 'http://${freescoutDomain}/mailbox/1' | grep 'freescout@${mailDomain}'")
+        data=f"out_method=3&out_server=localhost&out_port=1025&out_username=&out_password=&out_encryption=1&_token={token}"
+        machine.succeed(f"curl -sSfX POST --cookie-jar cjar --cookie cjar --data-raw '{data}' 'http://${freescoutDomain}/mailbox/connection-settings/1/outgoing'")
+        data=f"&in_protocol=1&in_server=localhost&in_port=143&in_username=freescout&in_password=super_secret&in_encryption=1&in_imap_folders%5B%5D=INBOX&imap_sent_folder=&_token={token}"
+        machine.succeed(f"curl -fsSX POST --cookie-jar cjar --cookie cjar --data-raw '{data}' 'http://${freescoutDomain}/mailbox/connection-settings/1/incoming'")
+        data="&action=fetch_test&mailbox_id=1"
+        machine.succeed(f"test $(curl -sSfX POST --cookie-jar cjar --cookie cjar -H 'X-CSRF-TOKEN: {token}' --data-raw '{data}' 'http://${freescoutDomain}/mailbox/ajax' | jq -r '.status') = 'success'")
+
+      with subtest("Send E-Mails"):
+        machine.succeed("send-initial")
+
+    # Doing a second loop so that we won't have to wait that much
+    for machine in all:
+      with subtest("E-Mails ae received"):
+        machine.wait_until_succeeds("curl -sSf --cookie-jar cjar --cookie cjar 'http://${freescoutDomain}/mailbox/1' | grep 'Hello NixOS'", timeout=180)
+        # Notifactions to users are being sent
+
+    for machine in all:
+      with subtest("Notifications are sent"):
+        machine.wait_until_succeeds("test $(curl -sSf http://127.0.0.1:8025/api/v2/messages | jq '.total') -eq 1", timeout=180)
+        machine.succeed("curl -sSf http://127.0.0.1:8025/api/v2/messages | jq '.items[].Content.Headers[\"X-FreeScout-Mail-Type\"] | .[0]'")
+
+      with subtest("Ensure vars are being generated"):
+        machine.succeed("curl -sSf 'http://${freescoutDomain}/'")
+        machine.succeed("curl -sSf 'http://${freescoutDomain}/storage/js/vars.js'")
+  '';
+}
diff --git a/nixos/tests/freescout/upgrade.nix b/nixos/tests/freescout/upgrade.nix
new file mode 100644
index 000000000000..397788710bf1
--- /dev/null
+++ b/nixos/tests/freescout/upgrade.nix
@@ -0,0 +1,94 @@
+# This tests checks, wether upgrading between versions works fine
+# In the past, there have been releases that would require manual deletion of specific
+# cache files, otherwise bricking the installation.
+# This test should catch similar instances in the future.
+# The oldFreescoutVersion may need a bump from time to time as there may be incompatibilities
+# with up-to-date databases on older freescout versions.
+{
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  freescoutDomain = "freescout.local";
+
+  oldFreescoutVersion = pkgs.freescout.overrideAttrs (oa: rec {
+    version = "1.8.220";
+    src = pkgs.fetchFromGitHub {
+      owner = "freescout-help-desk";
+      repo = "freescout";
+      tag = version;
+      hash = "sha256-bOkazBcd9EKzQdZZA6YMn4+UNYhpDFV9hDMHR5kXke0=";
+    };
+  });
+  newFreescoutVersion = pkgs.freescout;
+in
+{
+  name = "freescout-upgrade";
+  meta.maintainers = with lib.maintainers; [
+    e1mo
+  ];
+
+  nodes.machine =
+    { config, lib, ... }:
+    {
+      networking.extraHosts = ''
+        127.0.0.1 ${freescoutDomain}
+      '';
+      virtualisation.memorySize = 1024;
+      environment.systemPackages = with pkgs; [
+        curl
+        jq
+      ];
+      services.freescout = {
+        package = oldFreescoutVersion;
+        enable = true;
+        domain = freescoutDomain;
+        settings = {
+          APP_KEY = "base64:J8ZgK5LZkhVKpmZvjjA700sNL7+Y6aQTus8ZnUNNAaE=";
+          APP_FORCE_HTTPS = false;
+          APP_URL = "http://${freescoutDomain}:8888";
+          APP_DEBUG = true;
+        };
+        databaseSetup = {
+          enable = true;
+          kind = "pgsql";
+        };
+      };
+      specialisation.upgrade.configuration.services.freescout.package = lib.mkForce newFreescoutVersion;
+    };
+
+  testScript =
+    { nodes, ... }:
+    let
+      oldVersion = nodes.machine.services.freescout.package.version;
+      newVersion = nodes.machine.specialisation.upgrade.configuration.services.freescout.package.version;
+    in
+    ''
+      machine.start()
+      machine.wait_for_unit("nginx")
+      machine.wait_for_unit("postgresql")
+      machine.wait_for_unit("freescout-setup")
+
+      with subtest("Create user and log in"):
+        # Create uesr
+        machine.succeed("/var/lib/freescout/artisan freescout:create-user --role=admin --firstName=Xenia --lastName=TheFox --email xenia@${freescoutDomain} --no-interaction --password=foo | grep 'User created with id'")
+        # Obtain CSRF token
+        token=machine.succeed("curl -fsSL --cookie-jar cjar 'http://${freescoutDomain}/login' | grep -Po '(?<= name=\"_token\" value=\")(\w+)(?=\")'").strip()
+        # Actually log in
+        data=f"email=xenia%40${freescoutDomain}&password=foo&_token={token}&remember=on"
+        machine.succeed(f"curl -sSfX POST --cookie-jar cjar --cookie cjar --data-raw '{data}' 'http://${freescoutDomain}/login' | grep 'Redirecting to'")
+
+      with subtest("Check old API version"):
+        machine.succeed("curl -fsSL --cookie-jar cjar --cookie cjar 'http://${freescoutDomain}/system/status' | grep ${oldVersion}")
+
+      machine.execute("${nodes.machine.system.build.toplevel}/specialisation/upgrade/bin/switch-to-configuration test >&2")
+
+      machine.wait_for_unit("nginx")
+      machine.wait_for_unit("freescout-setup")
+
+      with subtest("Check new API version"):
+        machine.succeed("curl -fsSL --cookie-jar cjar --cookie cjar 'http://${freescoutDomain}/system/status' | grep ${newVersion}")
+    '';
+}
diff --git a/pkgs/applications/editors/sublime/4/common.nix b/pkgs/applications/editors/sublime/4/common.nix
index 1e93b6a0d41e..e6422c8f370c 100644
--- a/pkgs/applications/editors/sublime/4/common.nix
+++ b/pkgs/applications/editors/sublime/4/common.nix
@@ -230,13 +230,11 @@ stdenv.mkDerivation (finalAttrs: {
       "aarch64-linux"
       "x86_64-linux"
     ];
-    # FIXME: gated behind allowAliases to workaround https://github.com/NixOS/nixpkgs/issues/523712
-    problems =
-      lib.optionalAttrs config.allowAliases {
-        removal.message = "We have removed Python 3.3 package support ahead of upstream schedule but if you do not use any old packages, this should just work.";
-      }
-      // lib.optionalAttrs (lib.versionOlder buildVersion "4205") {
-        broken.message = "Packages, including core ones, do not run without plug-in host depending on insecure OpenSSL.";
-      };
+    problems = {
+      removal.message = "We have removed Python 3.3 package support ahead of upstream schedule but if you do not use any old packages, this should just work.";
+    }
+    // lib.optionalAttrs (lib.versionOlder buildVersion "4205") {
+      broken.message = "Packages, including core ones, do not run without plug-in host depending on insecure OpenSSL.";
+    };
   };
 })
diff --git a/pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix b/pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix
index 18f312fc37fc..f5b77015390c 100644
--- a/pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix
@@ -9,15 +9,15 @@
   vimPlugins,
   vimUtils,
   makeWrapper,
-  pkgs,
+  perl,
 }:
 let
-  version = "0.0.27-unstable-2026-03-11";
+  version = "release-v0.1";
   src = fetchFromGitHub {
     owner = "yetone";
     repo = "avante.nvim";
-    rev = "9a7793461549939f1d52b2b309a1aa44680170c8";
-    hash = "sha256-EEkAoufj29P46RIUrRNG0xJL9Wu4X7LZCS1fer4/nZQ=";
+    rev = "2033b42ab72fb9f27b35769f9cb7a9f4f1993db4";
+    hash = "sha256-Ql/17DSHpBVbihUHssyZe3MGC5fgasbjgxdABp8xk24=";
   };
   avante-nvim-lib = rustPlatform.buildRustPackage {
     pname = "avante-nvim-lib";
@@ -28,7 +28,7 @@ let
     nativeBuildInputs = [
       pkg-config
       makeWrapper
-      pkgs.perl
+      perl
     ];
 
     buildInputs = [
@@ -66,15 +66,12 @@ vimUtils.buildVimPlugin {
       ext = stdenv.hostPlatform.extensions.sharedLibrary;
     in
     ''
-      mkdir -p $out/build
-      cp ${avante-nvim-lib}/lib/libavante_repo_map${ext} $out/build/avante_repo_map${ext}
-      cp ${avante-nvim-lib}/lib/libavante_templates${ext} $out/build/avante_templates${ext}
-      cp ${avante-nvim-lib}/lib/libavante_tokenizers${ext} $out/build/avante_tokenizers${ext}
-      cp ${avante-nvim-lib}/lib/libavante_html2md${ext} $out/build/avante_html2md${ext}
-
-      # Fixes PKCE auth flows not finding libcrypto
-      substituteInPlace "$out/lua/avante/auth/pkce.lua" \
-        --replace-fail 'pcall(ffi.load, "crypto")' 'pcall(ffi.load, "${lib.getLib openssl}/lib/libcrypto${ext}")'
+      # place dynamic shared libraries directly into lua/ for native C-module discovery
+      mkdir -p $out/lua
+      cp ${avante-nvim-lib}/lib/libavante_repo_map${ext} $out/lua/avante_repo_map${ext}
+      cp ${avante-nvim-lib}/lib/libavante_templates${ext} $out/lua/avante_templates${ext}
+      cp ${avante-nvim-lib}/lib/libavante_tokenizers${ext} $out/lua/avante_tokenizers${ext}
+      cp ${avante-nvim-lib}/lib/libavante_html2md${ext} $out/lua/avante_html2md${ext}
     '';
 
   passthru = {
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index d1af16efd0a4..bbaef26e8f88 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -2031,8 +2031,8 @@ let
         mktplcRef = {
           name = "gleam";
           publisher = "gleam";
-          version = "2.12.2";
-          hash = "sha256-41HgkDcgyStJtyeE0x1H9rFOZ18imcKF7XQixDOmurE=";
+          version = "2.13.0";
+          hash = "sha256-eCiBbdKMeXcRS4kyI2rH1iAT0CmQmo2SybeW+Y7FRio=";
         };
         meta = {
           description = "Support for the Gleam programming language";
diff --git a/pkgs/applications/editors/vscode/extensions/tombi-toml.tombi/default.nix b/pkgs/applications/editors/vscode/extensions/tombi-toml.tombi/default.nix
index 9b038ff6946e..5a35b4cf4207 100644
--- a/pkgs/applications/editors/vscode/extensions/tombi-toml.tombi/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/tombi-toml.tombi/default.nix
@@ -7,19 +7,19 @@
 let
   supported = {
     x86_64-linux = {
-      hash = "sha256-8KZE2+kpzU7fRRBsroZtCnJyPyUHPuysZrggZojpG98=";
+      hash = "sha256-YLic8tKnb6WSx4rdwTu8B2ybfjoSbXc+QfEZ0Vc4umo=";
       arch = "linux-x64";
     };
     x86_64-darwin = {
-      hash = "sha256-Zf/O2KRDlzCi4qWnmT5CctagjJoLiNgZfnh5+gQWRAA=";
+      hash = "sha256-nbftXgjEAxGfT4sfTjd+bp+Ti/rWJGHLkaSXQWlRGBM=";
       arch = "darwin-x64";
     };
     aarch64-linux = {
-      hash = "sha256-zN49L+gLrLNL7XM3+POgBgSX64IMUYtNZ54+i8lpLqE=";
+      hash = "sha256-FG6OIoeeDenMbgwM/ZE8YyTySt/XcoFJj1RxvlrPsXc=";
       arch = "linux-arm64";
     };
     aarch64-darwin = {
-      hash = "sha256-vTf86rNeS/97//1D2e1h5DpnAFb1cceIuF5XyCCq520=";
+      hash = "sha256-FW+pmz8YTw6pYxx1x3UsT3Dtp00GT804MJX4HBarMZo=";
       arch = "darwin-arm64";
     };
   };
@@ -34,7 +34,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = base // {
     name = "tombi";
     publisher = "tombi-toml";
-    version = "1.1.3";
+    version = "1.1.5";
   };
   meta = {
     description = "TOML Language Server";
diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index fc3ece2ce796..c87e4a647a90 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -1,10 +1,10 @@
 {
   "chromium": {
-    "version": "149.0.7827.196",
+    "version": "149.0.7827.200",
     "chromedriver": {
-      "version": "149.0.7827.197",
-      "hash_darwin": "sha256-tN7s6s/pbfAGRCMcoT3QWYHD8QRq2gcHfFSXoSG9V5Y=",
-      "hash_darwin_aarch64": "sha256-DZ8CZ4Obp67Zo2m4iyqUnShyhTK8+/75cJ/WmZZqQhE="
+      "version": "149.0.7827.201",
+      "hash_darwin": "sha256-MHCcid+7wdYm8uIdrUIlXrk8ADHNUUXzPyMPFGP98WY=",
+      "hash_darwin_aarch64": "sha256-Gwmdo9qNyV/BnCj18f0BFpNgDf28e8vjNF98e5/vVjQ="
     },
     "deps": {
       "depot_tools": {
@@ -21,8 +21,8 @@
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "43eb30368c6ca3d14d540487954abb2780aeae3a",
-        "hash": "sha256-pwSfASgR4SiQTJBERhOVyR8mANYJk67f+u2pmCCW6ko=",
+        "rev": "c35c164b1b6d1adca9eddf914ed6d0d0743dba6a",
+        "hash": "sha256-b2gBRUzRjqVZEb/tWUL1JF6Afq5gHJ3aOM02My1FyYU=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -823,7 +823,7 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "149.0.7827.196",
+    "version": "149.0.7827.200",
     "deps": {
       "depot_tools": {
         "rev": "45dedc4c3b87c982fd846b3dc599b233ed3aff90",
@@ -835,16 +835,16 @@
         "hash": "sha256-oFs7fZAZEs/gQ7X1A4uigo9+Y+iEN9sMMQYwAjEuD04="
       },
       "ungoogled-patches": {
-        "rev": "149.0.7827.196-1",
-        "hash": "sha256-nRcMTP+su+mFP/JkyLBIDrG+dKYhvPANFw0Y8qVWzrA="
+        "rev": "149.0.7827.200-1",
+        "hash": "sha256-D7c1ToAoUzAMpXoe60YPimRqe6/LRe0T95TduXUeTFo="
       },
       "npmHash": "sha256-pF0JtwFpPC4/fodbhSJnQKkczA9WlDg4VqEAy9aDVLg="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "43eb30368c6ca3d14d540487954abb2780aeae3a",
-        "hash": "sha256-pwSfASgR4SiQTJBERhOVyR8mANYJk67f+u2pmCCW6ko=",
+        "rev": "c35c164b1b6d1adca9eddf914ed6d0d0743dba6a",
+        "hash": "sha256-b2gBRUzRjqVZEb/tWUL1JF6Afq5gHJ3aOM02My1FyYU=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index f685488c497c..dcc45bb855cc 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1067,11 +1067,11 @@
     "vendorHash": null
   },
   "ovh_ovh": {
-    "hash": "sha256-rNJ6ibD8VbvUopKYc6Ao6I7lJqTw6gw8A71YzW8OYJE=",
+    "hash": "sha256-JaZdCten+5mV8aKCRhkoifqP4EwNrytK25TLJl1eQjQ=",
     "homepage": "https://registry.terraform.io/providers/ovh/ovh",
     "owner": "ovh",
     "repo": "terraform-provider-ovh",
-    "rev": "v2.14.0",
+    "rev": "v2.15.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
diff --git a/pkgs/by-name/ab/ab-av1/package.nix b/pkgs/by-name/ab/ab-av1/package.nix
index 04446daddba3..63c70c0afbb2 100644
--- a/pkgs/by-name/ab/ab-av1/package.nix
+++ b/pkgs/by-name/ab/ab-av1/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ab-av1";
-  version = "0.11.3";
+  version = "0.11.4";
 
   src = fetchFromGitHub {
     owner = "alexheretic";
     repo = "ab-av1";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lLZAECwF8V19Qx/FugbjLeVns7lhVlwWDTK9cdYb0xo=";
+    hash = "sha256-830STu0YfEhsYr4EU3ATF6kgH5J/tUEhm4b47VOwMEQ=";
   };
 
-  cargoHash = "sha256-AONJz1BoDi6weHT7W9DmzwoPW5khfgYjDqLNl7OM5bY=";
+  cargoHash = "sha256-mKtP+QoG0MjbBB4kMLlioyxshlgVyhqLH4C5GKx9Hes=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/al/alot/package.nix b/pkgs/by-name/al/alot/package.nix
index 1651b1bfe8eb..96edc5a08021 100644
--- a/pkgs/by-name/al/alot/package.nix
+++ b/pkgs/by-name/al/alot/package.nix
@@ -44,7 +44,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   dependencies = with python3Packages; [
     configobj
-    gpgme
+    gpg
     notmuch2
     python-magic
     standard-mailcap
diff --git a/pkgs/by-name/an/ansible-doctor/package.nix b/pkgs/by-name/an/ansible-doctor/package.nix
index 3cc838470589..b6c841af5d96 100644
--- a/pkgs/by-name/an/ansible-doctor/package.nix
+++ b/pkgs/by-name/an/ansible-doctor/package.nix
@@ -9,14 +9,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "ansible-doctor";
-  version = "8.3.2";
+  version = "8.3.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "thegeeklab";
     repo = "ansible-doctor";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Asp26tGyzFPOCLESXe2Je4i+0u8OGX2GSaGy/cQC3AI=";
+    hash = "sha256-3xdMTuy6Rtb2VwfzN6SV73UZmp+9fmU9SfPySHCayJg=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/ap/apko/package.nix b/pkgs/by-name/ap/apko/package.nix
index ec91f8342083..977425e49764 100644
--- a/pkgs/by-name/ap/apko/package.nix
+++ b/pkgs/by-name/ap/apko/package.nix
@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "apko";
-  version = "1.2.17";
+  version = "1.2.19";
 
   src = fetchFromGitHub {
     owner = "chainguard-dev";
     repo = "apko";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6Z+1LpgvdRpcy2PmgSFeKHuMLh3jeA03KhfS2j2AhKQ=";
+    hash = "sha256-Iia0U/oibPuUYC3adeXvL5m4nhEPHqBvHw7J7Uxn88s=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -29,7 +29,7 @@ buildGoModule (finalAttrs: {
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  vendorHash = "sha256-K2fqDAzex0EgrGPK5I4Bp5oqmIOnnuI1sztlySrX1Pc=";
+  vendorHash = "sha256-vYUxwtqGUDbJhbhlajPtlUZKD4TKreHEGR1dCSuSiA4=";
 
   excludedPackages = [
     "internal/gen-jsonschema"
diff --git a/pkgs/by-name/at/atlantis/package.nix b/pkgs/by-name/at/atlantis/package.nix
index d7cbb985ef41..0a6a212f3298 100644
--- a/pkgs/by-name/at/atlantis/package.nix
+++ b/pkgs/by-name/at/atlantis/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "atlantis";
-  version = "0.44.0";
+  version = "0.44.1";
 
   src = fetchFromGitHub {
     owner = "runatlantis";
     repo = "atlantis";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ZHd/RSzFXbcZ7324Bbgtx681zwdHi5xYgqVlTR4glHY=";
+    hash = "sha256-CMMsW0VFUi5c2AsuvH5uxggzJ3wD1k24Zrk4tjlBczo=";
   };
 
   ldflags = [
diff --git a/pkgs/by-name/ba/basalt/package.nix b/pkgs/by-name/ba/basalt/package.nix
index aeed0a7d20cc..79ba8402ca3d 100644
--- a/pkgs/by-name/ba/basalt/package.nix
+++ b/pkgs/by-name/ba/basalt/package.nix
@@ -7,16 +7,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "basalt";
-  version = "0.12.4";
+  version = "0.12.6";
 
   src = fetchFromGitHub {
     owner = "erikjuhani";
     repo = "basalt";
     tag = "basalt/v${finalAttrs.version}";
-    hash = "sha256-fijpPGPeF3f81WMWj1tIc0ht8hUIubAe19ja3iBNOh0=";
+    hash = "sha256-MlKrVxNU9PNakIA9hiv5ll7ImkPDekQnassWFO/smkE=";
   };
 
-  cargoHash = "sha256-jY3EDM+jYwCsMpd5cA5WKzmhdS4rVCLz3h5gfshzhOQ=";
+  cargoHash = "sha256-sTU0AUwR5xdnqLvrRycxuMk+KNcsEcYU3XvyODKT1Ns=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
diff --git a/pkgs/by-name/bi/bitwarden-cli/package.nix b/pkgs/by-name/bi/bitwarden-cli/package.nix
index ceb1c97e11c0..41ba4499b0eb 100644
--- a/pkgs/by-name/bi/bitwarden-cli/package.nix
+++ b/pkgs/by-name/bi/bitwarden-cli/package.nix
@@ -14,31 +14,24 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "bitwarden-cli";
-  version = "2026.5.0";
+  version = "2026.6.0";
 
   src = fetchFromGitHub {
     owner = "bitwarden";
     repo = "clients";
     tag = "cli-v${finalAttrs.version}";
-    hash = "sha256-R00wt5W4kKmFIODEaGoUqDwfGyHH/2PpiRaC8Gq3d88=";
+    hash = "sha256-JIIis3wW0cU33ovRQfJi3HlB2YdLZ5IPvueq1dGFbas=";
   };
 
   postPatch = ''
     # remove code under unfree license
     rm -r bitwarden_license
-
-    # Upstream cli-v2026.4.1 bumps @napi-rs/cli to 3.5.1 in the desktop workspace,
-    # but the root lockfile still points that entry at 3.2.0.
-    substituteInPlace package-lock.json \
-      --replace-fail \
-      $'    "apps/desktop/node_modules/@napi-rs/cli": {\n      "version": "3.2.0",\n      "resolved": "https://registry.npmjs.org/@napi-rs/cli/-/cli-3.2.0.tgz",\n      "integrity": "sha512-heyXt/9OBPv/WrTFW2+PxIMzH6MCeqP9ZsvOg0LN6pLngBnszcxFsdhCAh5I6sddzQsvru53zj59GUzvmpWk8Q==",' \
-      $'    "apps/desktop/node_modules/@napi-rs/cli": {\n      "version": "3.5.1",\n      "resolved": "https://registry.npmjs.org/@napi-rs/cli/-/cli-3.5.1.tgz",\n      "integrity": "sha512-XBfLQRDcB3qhu6bazdMJsecWW55kR85l5/k0af9BIBELXQSsCFU0fzug7PX8eQp6vVdm7W/U3z6uP5WmITB2Gw==",'
   '';
 
   nodejs = nodejs_22;
   npmDepsFetcherVersion = 2;
 
-  npmDepsHash = "sha256-SU4HjfNshjRwa8mXPnmG2xVIwYkbQ7g8j3NZ43Ap76k=";
+  npmDepsHash = "sha256-sXFSjQw9iM5Ye03BX+ZzpDfeAyLTJoG/k46NiI3O8+A=";
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     perl
diff --git a/pkgs/by-name/bu/buildkit/package.nix b/pkgs/by-name/bu/buildkit/package.nix
index 247a267aa1a3..f84d146ccf31 100644
--- a/pkgs/by-name/bu/buildkit/package.nix
+++ b/pkgs/by-name/bu/buildkit/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "buildkit";
-  version = "0.31.0";
+  version = "0.31.1";
 
   src = fetchFromGitHub {
     owner = "moby";
     repo = "buildkit";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-mTYNyz2H980l7/Vcyf9wnEgmi2j6S63C9ZcwOaK/+YY=";
+    hash = "sha256-lpcbCPsnvwMULeZgo1eQ0AqlfsyOMO/7b3ZOCoVTDKk=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/ca/caerbannog/package.nix b/pkgs/by-name/ca/caerbannog/package.nix
index 0ddb78a0006c..48b662b2fba8 100644
--- a/pkgs/by-name/ca/caerbannog/package.nix
+++ b/pkgs/by-name/ca/caerbannog/package.nix
@@ -47,7 +47,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
   propagatedBuildInputs = with python3.pkgs; [
     anytree
     fuzzyfinder
-    gpgme
+    gpg
     pygobject3
   ];
 
diff --git a/pkgs/by-name/ca/castsponsorskip/package.nix b/pkgs/by-name/ca/castsponsorskip/package.nix
index 0635a3dfade5..457c3f36e7d4 100644
--- a/pkgs/by-name/ca/castsponsorskip/package.nix
+++ b/pkgs/by-name/ca/castsponsorskip/package.nix
@@ -30,6 +30,7 @@ buildGoModule (finalAttrs: {
   meta = {
     description = "Skip YouTube sponsorships (and sometimes ads) on all local Google Cast devices";
     homepage = "https://github.com/gabe565/CastSponsorSkip";
+    mainProgram = "castsponsorskip";
     changelog = "https://github.com/gabe565/CastSponsorSkip/releases";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
diff --git a/pkgs/by-name/co/code-cursor/sources.json b/pkgs/by-name/co/code-cursor/sources.json
index 91befbf0b3e7..61e4c4c2969a 100644
--- a/pkgs/by-name/co/code-cursor/sources.json
+++ b/pkgs/by-name/co/code-cursor/sources.json
@@ -1,22 +1,22 @@
 {
-  "version": "3.7.42",
+  "version": "3.9.8",
   "vscodeVersion": "1.105.1",
   "sources": {
     "x86_64-linux": {
-      "url": "https://downloads.cursor.com/production/5702c9cfca656d8710fad58402fe37f14345e3ac/linux/x64/Cursor-3.7.42-x86_64.AppImage",
-      "hash": "sha256-o7c220esGj2qrLDt88zQ+XpAMbhJGoky5iNFB/qhvtU="
+      "url": "https://downloads.cursor.com/production/4aa8ff1b7877ed7bd01bcba308698f71a6735380/linux/x64/Cursor-3.9.8-x86_64.AppImage",
+      "hash": "sha256-xcyFowrW5yzIDCwbFGmpDRSNa3OUXsHwpLkbyNcSzqM="
     },
     "aarch64-linux": {
-      "url": "https://downloads.cursor.com/production/5702c9cfca656d8710fad58402fe37f14345e3ac/linux/arm64/Cursor-3.7.42-aarch64.AppImage",
-      "hash": "sha256-PjVgVemRY66zY/gXcgYCVzSwkC5aCJeMsNreceQzWI4="
+      "url": "https://downloads.cursor.com/production/4aa8ff1b7877ed7bd01bcba308698f71a6735380/linux/arm64/Cursor-3.9.8-aarch64.AppImage",
+      "hash": "sha256-ZhRMvfJkt8NZT45tYxfO2gBFaVw6hR2nVeRzmrxQfeE="
     },
     "x86_64-darwin": {
-      "url": "https://downloads.cursor.com/production/5702c9cfca656d8710fad58402fe37f14345e3ac/darwin/x64/Cursor-darwin-x64.dmg",
-      "hash": "sha256-AiS0Iswdp8DAZV6cFA7uIYSE24ystuqJRz0YGJkkmDE="
+      "url": "https://downloads.cursor.com/production/4aa8ff1b7877ed7bd01bcba308698f71a6735380/darwin/x64/Cursor-darwin-x64.dmg",
+      "hash": "sha256-IOQsZQAncDgZGEnCZWg/LQqD/PquFifBmuk2hnJ1L/s="
     },
     "aarch64-darwin": {
-      "url": "https://downloads.cursor.com/production/5702c9cfca656d8710fad58402fe37f14345e3ac/darwin/arm64/Cursor-darwin-arm64.dmg",
-      "hash": "sha256-e6VrLs/tj+FkEbUJN4RpQKNAbWCS/mEo1drVQFErXU0="
+      "url": "https://downloads.cursor.com/production/4aa8ff1b7877ed7bd01bcba308698f71a6735380/darwin/arm64/Cursor-darwin-arm64.dmg",
+      "hash": "sha256-GxpBKyx0Yo3e8AUS9Oxei/hHm1m3JdxMKjX7qAxUGm4="
     }
   }
 }
diff --git a/pkgs/by-name/cr/cruise/package.nix b/pkgs/by-name/cr/cruise/package.nix
index 087e97b4feef..eed715ca09a6 100644
--- a/pkgs/by-name/cr/cruise/package.nix
+++ b/pkgs/by-name/cr/cruise/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "cruise";
-  version = "1.1.0";
+  version = "2.2.2";
 
   src = fetchFromGitHub {
     owner = "NucleoFusion";
     repo = "cruise";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0xIugbLlKlMODbMvsFzQXjKNNGY61tF4P/0loPlfs6o=";
+    hash = "sha256-AhLSzynNvtHK3URTd1034/2ToGcJUDp7rGMtr3kyees=";
   };
 
   vendorHash = "sha256-Zx1rZl5ljlsBNV1eQKPtQ+SgJV9l5rS8hwBe8nX9dYQ=";
@@ -23,7 +23,7 @@ buildGoModule (finalAttrs: {
   meta = {
     description = "TUI for managing Docker containers, images, volumes, networks, and more";
     homepage = "https://github.com/NucleoFusion/cruise";
-    license = lib.licenses.mit;
+    license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ greatnatedev ];
     mainProgram = "cruise";
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/di/diesel-cli/package.nix b/pkgs/by-name/di/diesel-cli/package.nix
index fd6db582ecc7..3cc982696725 100644
--- a/pkgs/by-name/di/diesel-cli/package.nix
+++ b/pkgs/by-name/di/diesel-cli/package.nix
@@ -27,15 +27,15 @@ assert lib.assertMsg (lib.elem true [
 
 rustPlatform.buildRustPackage rec {
   pname = "diesel-cli";
-  version = "2.3.9";
+  version = "2.3.10";
 
   src = fetchCrate {
     inherit version;
     crateName = "diesel_cli";
-    hash = "sha256-aFve5n38EO7cqfYcb0AIEbOfY+Xs3oXlUIkNJdBxXr4=";
+    hash = "sha256-ePoFjIzLUQ4GpPIObhIsg0NvvM1VcVf++IDdTI3XjXw=";
   };
 
-  cargoHash = "sha256-TAkZLwVaMvopkbh9kPvIhEHckQom+k8rkVNut7a31do=";
+  cargoHash = "sha256-lGVUxYrZ81YvJncGGw7VQ8bl74aYOyHsEKDIMCwc7lw=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/di/dix/package.nix b/pkgs/by-name/di/dix/package.nix
index 7db7dadc9143..efc2a406dd28 100644
--- a/pkgs/by-name/di/dix/package.nix
+++ b/pkgs/by-name/di/dix/package.nix
@@ -7,7 +7,7 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "dix";
-  version = "2.0.1";
+  version = "2.1.0";
 
   __structuredAttrs = true;
 
@@ -15,10 +15,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "manic-systems";
     repo = "dix";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KTlFgBEVKJIXymfN2UU8hvGM71PYRcNgJ1XWUmG2AI4=";
+    hash = "sha256-+9I6WuPOc8Lj7NAxe19phlFiDypGQywopZ3dZK9d6F4=";
   };
 
-  cargoHash = "sha256-pNkSdsxOpv0E/xXs7tMg2vtP0PBU7p8fh3H4IX/u5k4=";
+  cargoHash = "sha256-k/of0KX2wBWh/etybbKn81O5UgJF0ylc2fl+HK8uIRQ=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
diff --git a/pkgs/by-name/ds/ds4u/package.nix b/pkgs/by-name/ds/ds4u/package.nix
new file mode 100644
index 000000000000..2396f5a873fc
--- /dev/null
+++ b/pkgs/by-name/ds/ds4u/package.nix
@@ -0,0 +1,108 @@
+{
+  lib,
+  fetchFromGitea,
+  rustPlatform,
+  pkg-config,
+  systemd,
+  hidapi,
+  openssl,
+  libxkbcommon,
+  alsa-lib,
+  vulkan-loader,
+  wayland,
+  libx11,
+  libxcursor,
+  libxi,
+  copyDesktopItems,
+  makeDesktopItem,
+  autoPatchelfHook,
+  udevCheckHook,
+  writeText,
+  nix-update-script,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "ds4u";
+  version = "0.1.1";
+  __structuredAttrs = true;
+
+  src = fetchFromGitea {
+    domain = "git.yokai.digital";
+    owner = "deadYokai";
+    repo = "ds4u";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-q8NbpFbrYMtE56CnnjScbMewHCTxaxMih8/I9dspb+o=";
+  };
+
+  cargoHash = "sha256-KjNHX3S+XFUsngX8Od3HtI0IvpAyMp5TB6TVkCkl8Gc=";
+
+  nativeBuildInputs = [
+    pkg-config
+    copyDesktopItems
+    autoPatchelfHook
+  ];
+
+  buildInputs = [
+    alsa-lib
+    libxkbcommon
+    vulkan-loader
+    wayland
+    libx11
+    libxcursor
+    libxi
+    openssl
+    systemd
+    hidapi
+  ];
+
+  # autoPatchelfHook doesnt find these automatically using dlopen
+  appendRunpaths = [ (lib.makeLibraryPath finalAttrs.buildInputs) ];
+
+  udevRules = writeText "ds4u.rules" ''
+    SUBSYSTEM=="hidraw", ATTRS{idVendor}=="054c", ATTRS{idProduct}=="0ce6", MODE="0664", GROUP="input", TAG+="uaccess"
+    SUBSYSTEM=="hidraw", ATTRS{idVendor}=="054c", ATTRS{idProduct}=="0df2", MODE="0664", GROUP="input", TAG+="uaccess"
+  '';
+
+  preInstall = ''
+    # desktop icon install
+    install -Dm644 $src/assets/icon.svg $out/share/icons/hicolor/scalable/apps/ds4u.svg
+    # udev rules
+    install -Dm644 ${finalAttrs.udevRules} -D $out/lib/udev/rules.d/70-ds4u.rules
+  '';
+
+  nativeInstallCheckInputs = [ udevCheckHook ];
+  doInstallCheck = true;
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "ds4u";
+      desktopName = "DS4U";
+      comment = finalAttrs.meta.description;
+      exec = "ds4u";
+      icon = "ds4u";
+      terminal = false;
+      type = "Application";
+      categories = [
+        "Utility"
+        "Settings"
+        "Game"
+      ];
+      keywords = [
+        "controller"
+        "dualsense"
+        "ps5"
+        "gamepad"
+      ];
+    })
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "DualSense controller manager for Linux";
+    homepage = "https://git.yokai.digital/deadYokai/ds4u";
+    license = lib.licenses.mit;
+    mainProgram = "ds4u";
+    maintainers = with lib.maintainers; [ cakeforcat ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/fa/factorio/versions.json b/pkgs/by-name/fa/factorio/versions.json
index 2e0208d73e3c..f2b6cbf32025 100644
--- a/pkgs/by-name/fa/factorio/versions.json
+++ b/pkgs/by-name/fa/factorio/versions.json
@@ -3,99 +3,99 @@
     "alpha": {
       "experimental": {
         "candidateHashFilenames": [
-          "factorio_linux_2.0.76.tar.xz"
+          "factorio_linux_2.1.8.tar.xz"
         ],
-        "name": "factorio_alpha_x64-2.0.76.tar.xz",
+        "name": "factorio_alpha_x64-2.1.8.tar.xz",
         "needsAuth": true,
-        "sha256": "b1e50891bdc69cce3fdaee4f840cbe4658e18d465309ac87915b6fc41900754c",
+        "sha256": "307016173b824ddfa1a1be4067526273f3aafe6dc8a9c49aff7b2250c466b0b0",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.76/alpha/linux64",
-        "version": "2.0.76"
+        "url": "https://factorio.com/get-download/2.1.8/alpha/linux64",
+        "version": "2.1.8"
       },
       "stable": {
         "candidateHashFilenames": [
-          "factorio_linux_2.0.76.tar.xz"
+          "factorio_linux_2.0.77.tar.xz"
         ],
-        "name": "factorio_alpha_x64-2.0.76.tar.xz",
+        "name": "factorio_alpha_x64-2.0.77.tar.xz",
         "needsAuth": true,
-        "sha256": "b1e50891bdc69cce3fdaee4f840cbe4658e18d465309ac87915b6fc41900754c",
+        "sha256": "2e7c26d999c140335abb82c5e642cdd4c98db559633562d7ad9844aff4f273ff",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.76/alpha/linux64",
-        "version": "2.0.76"
+        "url": "https://factorio.com/get-download/2.0.77/alpha/linux64",
+        "version": "2.0.77"
       }
     },
     "demo": {
       "experimental": {
         "candidateHashFilenames": [
-          "factorio-demo_linux_2.0.76.tar.xz"
+          "factorio-demo_linux_2.0.77.tar.xz"
         ],
-        "name": "factorio_demo_x64-2.0.76.tar.xz",
+        "name": "factorio_demo_x64-2.0.77.tar.xz",
         "needsAuth": false,
-        "sha256": "d5caee49636290b678d35adc59d2fc80ecbdbad8bf420731f1317971c89f941b",
+        "sha256": "f2fc889de1924b551cf52ca2ce2c73251f9c20ee2ae38cc8e973415baffef2a1",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.76/demo/linux64",
-        "version": "2.0.76"
+        "url": "https://factorio.com/get-download/2.0.77/demo/linux64",
+        "version": "2.0.77"
       },
       "stable": {
         "candidateHashFilenames": [
-          "factorio-demo_linux_2.0.76.tar.xz"
+          "factorio-demo_linux_2.0.77.tar.xz"
         ],
-        "name": "factorio_demo_x64-2.0.76.tar.xz",
+        "name": "factorio_demo_x64-2.0.77.tar.xz",
         "needsAuth": false,
-        "sha256": "d5caee49636290b678d35adc59d2fc80ecbdbad8bf420731f1317971c89f941b",
+        "sha256": "f2fc889de1924b551cf52ca2ce2c73251f9c20ee2ae38cc8e973415baffef2a1",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.76/demo/linux64",
-        "version": "2.0.76"
+        "url": "https://factorio.com/get-download/2.0.77/demo/linux64",
+        "version": "2.0.77"
       }
     },
     "expansion": {
       "experimental": {
         "candidateHashFilenames": [
-          "factorio-space-age_linux_2.0.76.tar.xz"
+          "factorio-space-age_linux_2.1.8.tar.xz"
         ],
-        "name": "factorio_expansion_x64-2.0.76.tar.xz",
+        "name": "factorio_expansion_x64-2.1.8.tar.xz",
         "needsAuth": true,
-        "sha256": "dc24bbbc1b6a619e4425d9a720bcfafce3463d908ab369a6cd1bee1a99332b4f",
+        "sha256": "92ec753d96eab63fc60f45ac45259a9427268f74bab0c15b63263f10aae0e786",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.76/expansion/linux64",
-        "version": "2.0.76"
+        "url": "https://factorio.com/get-download/2.1.8/expansion/linux64",
+        "version": "2.1.8"
       },
       "stable": {
         "candidateHashFilenames": [
-          "factorio-space-age_linux_2.0.76.tar.xz"
+          "factorio-space-age_linux_2.0.77.tar.xz"
         ],
-        "name": "factorio_expansion_x64-2.0.76.tar.xz",
+        "name": "factorio_expansion_x64-2.0.77.tar.xz",
         "needsAuth": true,
-        "sha256": "dc24bbbc1b6a619e4425d9a720bcfafce3463d908ab369a6cd1bee1a99332b4f",
+        "sha256": "068cd4778459569cb46e8a8acde1c404969ad533d7e479789af9fce0d29f10a4",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.76/expansion/linux64",
-        "version": "2.0.76"
+        "url": "https://factorio.com/get-download/2.0.77/expansion/linux64",
+        "version": "2.0.77"
       }
     },
     "headless": {
       "experimental": {
         "candidateHashFilenames": [
-          "factorio-headless_linux_2.0.76.tar.xz",
-          "factorio_headless_x64_2.0.76.tar.xz"
+          "factorio-headless_linux_2.1.8.tar.xz",
+          "factorio_headless_x64_2.1.8.tar.xz"
         ],
-        "name": "factorio_headless_x64-2.0.76.tar.xz",
+        "name": "factorio_headless_x64-2.1.8.tar.xz",
         "needsAuth": false,
-        "sha256": "ef3663f66146d76342f7c09a3f743792636f8cd95c39ea26cfca5bd2e0e92430",
+        "sha256": "16b122cd5f48118cd44bcaf1d27fd933aea60b9902bbd426fd26359440759f12",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.76/headless/linux64",
-        "version": "2.0.76"
+        "url": "https://factorio.com/get-download/2.1.8/headless/linux64",
+        "version": "2.1.8"
       },
       "stable": {
         "candidateHashFilenames": [
-          "factorio-headless_linux_2.0.76.tar.xz",
-          "factorio_headless_x64_2.0.76.tar.xz"
+          "factorio-headless_linux_2.0.77.tar.xz",
+          "factorio_headless_x64_2.0.77.tar.xz"
         ],
-        "name": "factorio_headless_x64-2.0.76.tar.xz",
+        "name": "factorio_headless_x64-2.0.77.tar.xz",
         "needsAuth": false,
-        "sha256": "ef3663f66146d76342f7c09a3f743792636f8cd95c39ea26cfca5bd2e0e92430",
+        "sha256": "c4efc11529f74d37c96933e291e0db73fd9f5aa4738913d9301b24680b3e947f",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.76/headless/linux64",
-        "version": "2.0.76"
+        "url": "https://factorio.com/get-download/2.0.77/headless/linux64",
+        "version": "2.0.77"
       }
     }
   }
diff --git a/pkgs/by-name/fr/freescout/0001-settings-catch-unwritable-.env.patch b/pkgs/by-name/fr/freescout/0001-settings-catch-unwritable-.env.patch
new file mode 100644
index 000000000000..ff9616206f24
--- /dev/null
+++ b/pkgs/by-name/fr/freescout/0001-settings-catch-unwritable-.env.patch
@@ -0,0 +1,30 @@
+From 1c749a3610fb423e50260a2c807b44a94ef4c69d Mon Sep 17 00:00:00 2001
+From: Nina Fromm <git@e1mo.de>
+Date: Thu, 25 Jun 2026 16:23:00 +0200
+Subject: [PATCH] settings: catch unwritable .env
+
+---
+ app/Misc/Helper.php | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/app/Misc/Helper.php b/app/Misc/Helper.php
+index 2d647b89..3fc2ef84 100644
+--- a/app/Misc/Helper.php
++++ b/app/Misc/Helper.php
+@@ -1172,7 +1172,12 @@ class Helper
+                 $contents = $contents."\n{$key}={$value}\n";
+             }
+         }
+-        \File::put($env_path, $contents);
++        try {
++          \File::put($env_path, $contents);
++        } catch (\Exception $e) {
++          \Helper::logException($e, 'Error updating ' . $key  .' in .env file: ');
++          \Session::flash('flash_error_unescaped', "Unable to write settings to <code>$env_path</code>: " . $e->getMessage());
++        }
+     }
+ 
+     /**
+-- 
+2.53.0
+
diff --git a/pkgs/by-name/fr/freescout/package.nix b/pkgs/by-name/fr/freescout/package.nix
new file mode 100644
index 000000000000..4b4b31d90954
--- /dev/null
+++ b/pkgs/by-name/fr/freescout/package.nix
@@ -0,0 +1,65 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  nixosTests,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  preferLocalBuild = true;
+  pname = "freescout";
+  version = "1.8.225";
+
+  src = fetchFromGitHub {
+    owner = "freescout-help-desk";
+    repo = "freescout";
+    tag = finalAttrs.version;
+    hash = "sha256-kXZ6bjF36YO1p6q+KTugnBO+KxqQZci5O0RNM7lqecQ=";
+  };
+
+  patches = [
+    ./0001-settings-catch-unwritable-.env.patch
+  ];
+
+  prePatch = ''
+    rm -rf storage
+    rm bootstrap/cache/.gitignore
+    rm public/{css,js}/builds/.htaccess
+    rm {Modules,public/modules}/.gitkeep
+    rmdir Modules public/modules bootstrap/cache public/{css,js}/builds
+    ln -rs data/.env .env
+    ln -rs data/storage storage
+    ln -rs data/bootstrap/cache bootstrap/cache
+    ln -rs data/storage/app/public public/storage
+    ln -rs data/public/css/builds public/css/builds
+    ln -rs data/public/js/builds public/js/builds
+    ln -rs data/Modules Modules
+    ln -rs data/public/modules public/modules
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/freescout
+    cp -ar . $out/share/freescout
+    chmod +x $out/share/freescout/artisan
+
+    runHook postInstall
+  '';
+
+  passthru.tests = {
+    inherit (nixosTests) freescout;
+  };
+
+  # Because freescout is searching for some folders only relative to it's own source location, we need to have the symlinks to the actual locations in here
+  dontCheckForBrokenSymlinks = true;
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  meta = with lib; {
+    description = "Free self-hosted help desk & shared mailbox";
+    license = licenses.agpl3Only;
+    homepage = "https://freescout.net/";
+    platforms = platforms.all;
+    maintainers = with maintainers; [ e1mo ];
+  };
+})
diff --git a/pkgs/by-name/gg/ggshield/package.nix b/pkgs/by-name/gg/ggshield/package.nix
index a7b8562d06d4..a7ab96e14f37 100644
--- a/pkgs/by-name/gg/ggshield/package.nix
+++ b/pkgs/by-name/gg/ggshield/package.nix
@@ -5,49 +5,34 @@
   python3,
 }:
 
-let
-  py = python3.override {
-    packageOverrides = self: super: {
-
-      # Doesn't support latest marshmallow
-      marshmallow = super.marshmallow.overridePythonAttrs (oldAttrs: rec {
-        version = "3.26.2";
-        src = fetchFromGitHub {
-          owner = "marshmallow-code";
-          repo = "marshmallow";
-          tag = version;
-          hash = "sha256-ioe+aZHOW8r3wF3UknbTjAP0dEggd/NL9PTkPVQ46zM=";
-        };
-      });
-    };
-  };
-in
-
-py.pkgs.buildPythonApplication (finalAttrs: {
+python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "ggshield";
-  version = "1.50.4";
+  version = "1.52.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "GitGuardian";
     repo = "ggshield";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wwGj7i1GoxNzdfUhcL7mulgQAPtz5WhbT67hgbcMxpo=";
+    hash = "sha256-bz3R1ylmkaYF3Wt/ylzeE2IsWKvZ8bmoF39Xu4tVzFU=";
   };
 
   pythonRelaxDeps = true;
 
-  build-system = with py.pkgs; [ hatchling ];
+  build-system = with python3.pkgs; [ hatchling ];
 
-  dependencies = with py.pkgs; [
+  dependencies = with python3.pkgs; [
     charset-normalizer
     click
+    configupdater
     cryptography
+    filelock
     keyring
     marshmallow
     marshmallow-dataclass
     notify-py
     oauthlib
+    packaging
     platformdirs
     pygitguardian
     pyjwt
@@ -56,6 +41,7 @@ py.pkgs.buildPythonApplication (finalAttrs: {
     requests
     rich
     sigstore
+    tomli
     truststore
     typing-extensions
     urllib3
@@ -64,7 +50,7 @@ py.pkgs.buildPythonApplication (finalAttrs: {
   nativeCheckInputs = [
     git
   ]
-  ++ (with py.pkgs; [
+  ++ (with python3.pkgs; [
     jsonschema
     pyfakefs
     pytest-factoryboy
@@ -100,6 +86,8 @@ py.pkgs.buildPythonApplication (finalAttrs: {
     "test_generate_files_from_paths"
     # Nixpkgs issue
     "test_get_file_sha_in_ref"
+    # Generated hooks config references pytest binary, instead of ggshield CLI. Odd!
+    "test_install_cursor_local_fresh"
   ];
 
   meta = {
diff --git a/pkgs/by-name/gi/gitte/package.nix b/pkgs/by-name/gi/gitte/package.nix
index 6d441da9c7d2..301d404677d9 100644
--- a/pkgs/by-name/gi/gitte/package.nix
+++ b/pkgs/by-name/gi/gitte/package.nix
@@ -22,7 +22,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "gitte";
-  version = "0.8.0";
+  version = "0.8.1";
 
   __structuredAttrs = true;
 
@@ -30,12 +30,12 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "ckruse";
     repo = "Gitte";
     tag = finalAttrs.version;
-    hash = "sha256-niVICk2RtDFA0/NK4cP+CU4uII/LcYjB+ZV60IHmr40=";
+    hash = "sha256-c7GhPn7/0PzRTYQbhfvlSUMJqHs4dRqeWRMBJG2eqdc=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-hJlO4GXPg6LWBCSKTQAwAawgWwN+OckvV2t9svTsaj4=";
+    hash = "sha256-yR4MYQJQMjqEs++8RhQwDV+h/blSVgFqrGYUfrPUGOg=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/gn/gnome-keysign/package.nix b/pkgs/by-name/gn/gnome-keysign/package.nix
index e4043556cab8..4788899abe4e 100644
--- a/pkgs/by-name/gn/gnome-keysign/package.nix
+++ b/pkgs/by-name/gn/gnome-keysign/package.nix
@@ -52,7 +52,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
 
   propagatedBuildInputs = with python3.pkgs; [
     dbus-python
-    gpgme
+    gpg
     magic-wormhole
     pygobject3
     pybluez
diff --git a/pkgs/by-name/go/gollama/package.nix b/pkgs/by-name/go/gollama/package.nix
index b1ff1574cd1e..2b6cee4cc1e3 100644
--- a/pkgs/by-name/go/gollama/package.nix
+++ b/pkgs/by-name/go/gollama/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gollama";
-  version = "2.0.4";
+  version = "2.0.5";
 
   src = fetchFromGitHub {
     owner = "sammcj";
     repo = "gollama";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-unvnFKkEWJnyzuNz8zekB8ZSXP/dUqv24qgyhkP3kkY=";
+    hash = "sha256-LjgQSV7Z2apcdIaxk9NU7AdlPJPlt7CQ/q9nID9Px5w=";
   };
 
-  vendorHash = "sha256-t7Kl6WnS8vvLyvKzkDswv0yOaeTE3IgZCNAC3dD8euU=";
+  vendorHash = "sha256-xpAAtJIJtETbDYwieLBI7L79SedeAOmYnHL9zq6l7Rs=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/go/govulncheck/package.nix b/pkgs/by-name/go/govulncheck/package.nix
index 727ce3bb20be..6d488e754eb3 100644
--- a/pkgs/by-name/go/govulncheck/package.nix
+++ b/pkgs/by-name/go/govulncheck/package.nix
@@ -8,13 +8,13 @@
 
 buildGoLatestModule (finalAttrs: {
   pname = "govulncheck";
-  version = "1.4.0";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "golang";
     repo = "vuln";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-XiwWe/BDM9aVf5A5iZFrY57bZ8N+6iCrLL170U9ipVM=";
+    hash = "sha256-Bd1YLR0grKXrvvWxDzDG2ZZ1moqY1EA9NyOtp0eBegk=";
   };
 
   patches = [
@@ -24,7 +24,7 @@ buildGoLatestModule (finalAttrs: {
     })
   ];
 
-  vendorHash = "sha256-ajTRmrzFf+P2aXN9oVN0oXfxocS22LDPxl2mxY9wGcs=";
+  vendorHash = "sha256-9daNbbrw0ZVw2aWPkMEGgIA6rhiEkL3OlhYGWUSplQw=";
 
   subPackages = [
     "cmd/govulncheck"
diff --git a/pkgs/by-name/in/infrastructure-agent/package.nix b/pkgs/by-name/in/infrastructure-agent/package.nix
index 94ab833a7d90..b75c0af5b860 100644
--- a/pkgs/by-name/in/infrastructure-agent/package.nix
+++ b/pkgs/by-name/in/infrastructure-agent/package.nix
@@ -6,13 +6,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "infrastructure-agent";
-  version = "1.76.2";
+  version = "1.77.0";
 
   src = fetchFromGitHub {
     owner = "newrelic";
     repo = "infrastructure-agent";
     rev = finalAttrs.version;
-    hash = "sha256-r42ochCVPAreDW+ZVeb/zrh8QwDmQL2xXytsZb6PcuU=";
+    hash = "sha256-QgyQ5fP8yIgmqHqLRn927pRmngOeKcdSaxXLDkcIwqI=";
   };
 
   vendorHash = "sha256-+ajMZ+kZ+m1vxyAfM+zvzTfcwkN63agdGoXPTNPC2i0=";
diff --git a/pkgs/by-name/je/jellyfin-ffmpeg/package.nix b/pkgs/by-name/je/jellyfin-ffmpeg/package.nix
index 0b5e59a90e85..e6afd9c8c03e 100644
--- a/pkgs/by-name/je/jellyfin-ffmpeg/package.nix
+++ b/pkgs/by-name/je/jellyfin-ffmpeg/package.nix
@@ -38,7 +38,10 @@ in
       changelog = "https://github.com/jellyfin/jellyfin-ffmpeg/releases/tag/v${version}";
       description = "${old.meta.description} (Jellyfin fork)";
       homepage = "https://github.com/jellyfin/jellyfin-ffmpeg";
-      maintainers = with lib.maintainers; [ justinas ];
+      maintainers = with lib.maintainers; [
+        dotlambda
+        justinas
+      ];
       pkgConfigModules = [ "libavutil" ];
     };
   })
diff --git a/pkgs/by-name/ki/kicad/versions.nix b/pkgs/by-name/ki/kicad/versions.nix
index 8bd94642dbd5..db49d0a36608 100644
--- a/pkgs/by-name/ki/kicad/versions.nix
+++ b/pkgs/by-name/ki/kicad/versions.nix
@@ -3,23 +3,23 @@
 {
   "kicad" = {
     kicadVersion = {
-      version = "10.0.3";
+      version = "10.0.4";
       src = {
-        rev = "1d69e55fc60915f8f1569c9f6522d9b0fb5a0ba8";
-        sha256 = "0ldaj072x16452xw2wszbk20g932rz36zappjrxc4m6ygx298aa3";
+        rev = "314f59e84469aa2db16a36740c891781c8a09fd8";
+        sha256 = "1dp2rcblpz1i5hzrv5kb7cq91agha5msm2slhny3gf8x0gbzmawq";
       };
     };
     libVersion = {
-      version = "10.0.3";
+      version = "10.0.4";
       libSources = {
-        symbols.rev = "299c330ab364cfc3989d1ab6e82f1eabb9ddd915";
-        symbols.sha256 = "05h8dbygch2kp4s5ikspxngwv999j7jwsiwm4pzwwcrir7dqzdfl";
-        templates.rev = "a7e1a3ae6255d8d9aaff13e58adf3a0d78cb90c9";
+        symbols.rev = "5a6700bbb3f2a3b05d123a1a1af770cfbb5bc7d3";
+        symbols.sha256 = "1ns0lg360h3h55w2xv5lyj0qzy6nc1cr02vll95c0vma34rc1qwa";
+        templates.rev = "32bcda122df6ae76b221155c641de3656904e786";
         templates.sha256 = "0zs29zn8qjgxv0w1vyr8yxmj02m8752zagn4vcraqgik46dwg2id";
-        footprints.rev = "fe0ca39d34a10036f2b6ccb9749a39bc3fa7af95";
-        footprints.sha256 = "0wdzsn7z11wc5yskk576a4a6qfagsvw0y6r034inxrnfc32aiah9";
-        packages3d.rev = "c955b94c7bdeffd94b06bac86d94588a9be03afe";
-        packages3d.sha256 = "01nbjcs3890hyfmafc623ldmfi9n8sjr5m0wripz5fq5fjdnzqxl";
+        footprints.rev = "12095f926a3c5c37d9573ebab0c67c9eed71812f";
+        footprints.sha256 = "15cz4lh6dzqdl2cc9nqnpa8bd73h5p33vnvmc4l68js5wqlsyba1";
+        packages3d.rev = "9484cb1a4e193898c3f86e0cf69146bcc6e8053d";
+        packages3d.sha256 = "0mkc9km540n6ri5is4fjw5abv8afidwj9q7fmbs66l6kx1z3lxky";
       };
     };
   };
diff --git a/pkgs/by-name/lc/lcevcdec/package.nix b/pkgs/by-name/lc/lcevcdec/package.nix
index 553d15b0b285..ac235b1e5d4e 100644
--- a/pkgs/by-name/lc/lcevcdec/package.nix
+++ b/pkgs/by-name/lc/lcevcdec/package.nix
@@ -1,4 +1,5 @@
 {
+  cctools,
   cmake,
   fetchFromGitHub,
   git,
@@ -46,6 +47,9 @@ stdenv.mkDerivation (finalAttrs: {
     git
     pkg-config
     python3
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    cctools.libtool
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/li/libation/package.nix b/pkgs/by-name/li/libation/package.nix
index 334b5c9ea34a..b193933658b1 100644
--- a/pkgs/by-name/li/libation/package.nix
+++ b/pkgs/by-name/li/libation/package.nix
@@ -16,13 +16,13 @@
 
 buildDotnetModule rec {
   pname = "libation";
-  version = "13.4.5";
+  version = "13.5.0";
 
   src = fetchFromGitHub {
     owner = "rmcrackan";
     repo = "Libation";
     tag = "v${version}";
-    hash = "sha256-t4Fz7aqQg1WPqSKvvVbSx45M6+UNGXacFHXGjzNW67A=";
+    hash = "sha256-KF7iFvVRmsWFMkFiVE4QosQmpqYeFx7yqIw7u0Cf80o=";
   };
 
   sourceRoot = "${src.name}/Source";
diff --git a/pkgs/by-name/lu/luau/package.nix b/pkgs/by-name/lu/luau/package.nix
index 6d29fa4864c2..1db53fb43d0c 100644
--- a/pkgs/by-name/lu/luau/package.nix
+++ b/pkgs/by-name/lu/luau/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "luau";
-  version = "0.725";
+  version = "0.726";
 
   src = fetchFromGitHub {
     owner = "luau-lang";
     repo = "luau";
     tag = finalAttrs.version;
-    hash = "sha256-zRoB1psMrZRt8mLoaReyc0hvhRBPAotC1LmDNTYGLjA=";
+    hash = "sha256-DAKyA8/ERX2AJ/XQDABOoI+cQCSW3PKnBpJkwS8IBdI=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/ma/matio/package.nix b/pkgs/by-name/ma/matio/package.nix
index 9cc0c0cf155a..df8dae915720 100644
--- a/pkgs/by-name/ma/matio/package.nix
+++ b/pkgs/by-name/ma/matio/package.nix
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "matio";
-  version = "1.5.29";
+  version = "1.5.30";
 
   src = fetchurl {
     url = "mirror://sourceforge/matio/matio-${finalAttrs.version}.tar.gz";
-    hash = "sha256-2eX3ovLFlO/xX1UONHKbAZkc3VoCilWL6M5ZWzIjOvs=";
+    hash = "sha256-i9O5R3BC7MAN1xwEdi+lhGjhTMzDL9jGgmwtoei8MQc=";
   };
 
   configureFlags = [ "ac_cv_va_copy=1" ];
diff --git a/pkgs/by-name/mo/mousam/package.nix b/pkgs/by-name/mo/mousam/package.nix
index 264d5dd5657c..6ae21ef082b4 100644
--- a/pkgs/by-name/mo/mousam/package.nix
+++ b/pkgs/by-name/mo/mousam/package.nix
@@ -13,7 +13,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "mousam";
-  version = "1.4.2";
+  version = "2.0.2";
   # built with meson, not a python format
   pyproject = false;
 
@@ -21,7 +21,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "amit9838";
     repo = "mousam";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-V2R5XfkuaJ4fjgOhoTNZVk4FqKlCJqum7A2NsPISgM8=";
+    hash = "sha256-3x4bi3P8zw+A+MUaBd4ByESrzCEP21Qa9CLaUYGARew=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/op/opkssh/package.nix b/pkgs/by-name/op/opkssh/package.nix
index 1f583c50b702..9d45a4b6b3e8 100644
--- a/pkgs/by-name/op/opkssh/package.nix
+++ b/pkgs/by-name/op/opkssh/package.nix
@@ -8,18 +8,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "opkssh";
-  version = "0.14.0";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "openpubkey";
     repo = "opkssh";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-XvA5J4v3+QESJZIaZUdvPmCD/q92ifHlzI3Ejmt1pls=";
+    hash = "sha256-COACiBNXHEpzZyGGYmz0uj0ubzYJFRabAEku2qOjLcg=";
   };
 
   ldflags = [ "-X main.Version=${finalAttrs.version}" ];
 
-  vendorHash = "sha256-ASa4jXhLdCs+YTP65nkMsQErg22sbl8g0RgzfSFr67A=";
+  vendorHash = "sha256-aRWu4yB83hBKtW78MVMg7l8iSzHdLgnYgskgt32tiLw=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/by-name/ou/oui/package.nix b/pkgs/by-name/ou/oui/package.nix
index ded93ea16c97..7e7506a684c8 100644
--- a/pkgs/by-name/ou/oui/package.nix
+++ b/pkgs/by-name/ou/oui/package.nix
@@ -2,20 +2,29 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  nix-update-script,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "oui";
-  version = "0.1.8";
+  version = "2.0.6";
 
   src = fetchFromGitHub {
     owner = "thatmattlove";
     repo = "oui";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-RLm8V2fLFvOwjnnq16ZmhwVdtgXPaehan7JTX3Xz30w=";
+    hash = "sha256-fNG20pryfs6bDjeexpf8UlevHatY6zdvGCHSFrfz8io=";
   };
 
-  vendorHash = "sha256-TLVw4tnfvgK2h/Xj5LNNjDG4WQ83Bw8yBhZc16Tjmws=";
+  vendorHash = "sha256-EOu9imj0YwYhHX7ZzE9BzhkoDitC5AHjlwoWmQs0Rj4=";
+
+  checkFlags = [
+    # These tests require live IEEE network access, a local PostgreSQL server,
+    # and a writable home directory.
+    "-skip=^Test_(CollectAll|New)$"
+  ];
+
+  passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "MAC Address CLI Toolkit";
diff --git a/pkgs/by-name/pr/prismlauncher/package.nix b/pkgs/by-name/pr/prismlauncher/package.nix
index 785832d4e178..751a34c520e5 100644
--- a/pkgs/by-name/pr/prismlauncher/package.nix
+++ b/pkgs/by-name/pr/prismlauncher/package.nix
@@ -27,6 +27,7 @@
   symlinkJoin,
   udev,
   vulkan-loader,
+  wayland,
   wrapGAppsHook3,
   xrandr,
 
@@ -103,6 +104,7 @@ symlinkJoin {
         libxext
         libxrandr
         libxxf86vm
+        wayland
 
         udev # oshi
 
diff --git a/pkgs/by-name/pr/prometheus-pgbouncer-exporter/package.nix b/pkgs/by-name/pr/prometheus-pgbouncer-exporter/package.nix
index ad0c5b606d4a..2a0d576150a0 100644
--- a/pkgs/by-name/pr/prometheus-pgbouncer-exporter/package.nix
+++ b/pkgs/by-name/pr/prometheus-pgbouncer-exporter/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "pgbouncer-exporter";
-  version = "0.12.0";
+  version = "0.12.1";
 
   src = fetchFromGitHub {
     owner = "prometheus-community";
     repo = "pgbouncer_exporter";
     rev = "v${version}";
-    hash = "sha256-Kt3eM8CxDOTWgMppAs+ajt4RL6Q/7jMcKYQIFzlRW8g=";
+    hash = "sha256-P82ek6+OcvRd1dIuqkfqU4DEmOtHVkSfN5atLansCK4=";
   };
 
-  vendorHash = "sha256-h9IJAjTCSKrREolo4DVOzULguz4gj6UbkFSR9yuivQY=";
+  vendorHash = "sha256-wKb5/phioGYLthgFVlh0OkVzJyPynAl2G9v89550k6M=";
 
   meta = {
     description = "Prometheus exporter for PgBouncer";
diff --git a/pkgs/by-name/pr/prometheus-smokeping-prober/package.nix b/pkgs/by-name/pr/prometheus-smokeping-prober/package.nix
index a28e0517ae62..a8023d07a5b7 100644
--- a/pkgs/by-name/pr/prometheus-smokeping-prober/package.nix
+++ b/pkgs/by-name/pr/prometheus-smokeping-prober/package.nix
@@ -7,7 +7,7 @@
 
 buildGoModule rec {
   pname = "smokeping_prober";
-  version = "0.11.0";
+  version = "0.12.0";
 
   ldflags =
     let
@@ -31,9 +31,9 @@ buildGoModule rec {
     owner = "SuperQ";
     repo = "smokeping_prober";
     rev = "v${version}";
-    sha256 = "sha256-h0HpxfYYfDY+dkKOBTBs3fFGY7td1YsL8b/NY6aJY/w=";
+    sha256 = "sha256-bFKJkqeuVS4z4jylJ67UgL6OPyi/JbowMKn5/Feu6lM=";
   };
-  vendorHash = "sha256-On5Xpn9V1XeyyGfy7xA1MwV4gO6GMcdine1f4tDZPJ4=";
+  vendorHash = "sha256-rNk9mCVpc2N+lLAarDenmOLy00swS1rkTNxMy62wR+k=";
 
   doCheck = true;
 
diff --git a/pkgs/by-name/pr/proton-ge-bin/package.nix b/pkgs/by-name/pr/proton-ge-bin/package.nix
index fff2f46e3030..ec4f37eb44d3 100644
--- a/pkgs/by-name/pr/proton-ge-bin/package.nix
+++ b/pkgs/by-name/pr/proton-ge-bin/package.nix
@@ -9,11 +9,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "proton-ge-bin";
-  version = "GE-Proton10-34";
+  version = "GE-Proton11-1";
 
   src = fetchzip {
     url = "https://github.com/GloriousEggroll/proton-ge-custom/releases/download/${finalAttrs.version}/${finalAttrs.version}.tar.gz";
-    hash = "sha256-lzPsYYcrp5NoT3B0WFj3o10Z7tXx7xva1wEP3edeuqM=";
+    hash = "sha256-I7SSvzQQ/NqdvwjpJ9IFFtAaTS+rgHUyXx0us1vIOnw=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/qo/qovery-cli/package.nix b/pkgs/by-name/qo/qovery-cli/package.nix
index b83430db3356..60c9f5d0b35a 100644
--- a/pkgs/by-name/qo/qovery-cli/package.nix
+++ b/pkgs/by-name/qo/qovery-cli/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "qovery-cli";
-  version = "1.165.0";
+  version = "1.166.0";
 
   src = fetchFromGitHub {
     owner = "Qovery";
     repo = "qovery-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QaJ0AP1LD1Z+cjzcFjphmZ/EbAOyzTEt7OJWGbIfc9c=";
+    hash = "sha256-orNVII6Y82YVtgEKpQnEpNXVWsg6P3sHluW1FGU20DA=";
   };
 
-  vendorHash = "sha256-nvJd4e71zP6cxkojHhfNGxUQgC0qIMYF6aCmZycnap0=";
+  vendorHash = "sha256-fZqzHJa5VFC1z5ZaHCXNyIKbwLjb3pSEb9FHs4YhWZg=";
 
   env.CGO_ENABLED = 0;
 
diff --git a/pkgs/by-name/re/redmine/Gemfile b/pkgs/by-name/re/redmine/Gemfile
index 755975b9e9f1..cf30bf9e288f 100644
--- a/pkgs/by-name/re/redmine/Gemfile
+++ b/pkgs/by-name/re/redmine/Gemfile
@@ -2,7 +2,7 @@ source 'https://rubygems.org'
 
 ruby '>= 3.2.0', '< 3.5.0'
 
-gem 'rails', '7.2.3'
+gem 'rails', '7.2.3.1'
 gem 'rouge', '~> 4.5'
 gem 'mini_mime', '~> 1.1.0'
 gem "actionpack-xml_parser"
diff --git a/pkgs/by-name/re/redmine/Gemfile.lock b/pkgs/by-name/re/redmine/Gemfile.lock
index f2d477827f8f..5a4881050674 100644
--- a/pkgs/by-name/re/redmine/Gemfile.lock
+++ b/pkgs/by-name/re/redmine/Gemfile.lock
@@ -1,29 +1,29 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    actioncable (7.2.3)
-      actionpack (= 7.2.3)
-      activesupport (= 7.2.3)
+    actioncable (7.2.3.1)
+      actionpack (= 7.2.3.1)
+      activesupport (= 7.2.3.1)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
       zeitwerk (~> 2.6)
-    actionmailbox (7.2.3)
-      actionpack (= 7.2.3)
-      activejob (= 7.2.3)
-      activerecord (= 7.2.3)
-      activestorage (= 7.2.3)
-      activesupport (= 7.2.3)
+    actionmailbox (7.2.3.1)
+      actionpack (= 7.2.3.1)
+      activejob (= 7.2.3.1)
+      activerecord (= 7.2.3.1)
+      activestorage (= 7.2.3.1)
+      activesupport (= 7.2.3.1)
       mail (>= 2.8.0)
-    actionmailer (7.2.3)
-      actionpack (= 7.2.3)
-      actionview (= 7.2.3)
-      activejob (= 7.2.3)
-      activesupport (= 7.2.3)
+    actionmailer (7.2.3.1)
+      actionpack (= 7.2.3.1)
+      actionview (= 7.2.3.1)
+      activejob (= 7.2.3.1)
+      activesupport (= 7.2.3.1)
       mail (>= 2.8.0)
       rails-dom-testing (~> 2.2)
-    actionpack (7.2.3)
-      actionview (= 7.2.3)
-      activesupport (= 7.2.3)
+    actionpack (7.2.3.1)
+      actionview (= 7.2.3.1)
+      activesupport (= 7.2.3.1)
       cgi
       nokogiri (>= 1.8.5)
       racc
@@ -36,36 +36,36 @@ GEM
     actionpack-xml_parser (2.0.1)
       actionpack (>= 5.0)
       railties (>= 5.0)
-    actiontext (7.2.3)
-      actionpack (= 7.2.3)
-      activerecord (= 7.2.3)
-      activestorage (= 7.2.3)
-      activesupport (= 7.2.3)
+    actiontext (7.2.3.1)
+      actionpack (= 7.2.3.1)
+      activerecord (= 7.2.3.1)
+      activestorage (= 7.2.3.1)
+      activesupport (= 7.2.3.1)
       globalid (>= 0.6.0)
       nokogiri (>= 1.8.5)
-    actionview (7.2.3)
-      activesupport (= 7.2.3)
+    actionview (7.2.3.1)
+      activesupport (= 7.2.3.1)
       builder (~> 3.1)
       cgi
       erubi (~> 1.11)
       rails-dom-testing (~> 2.2)
       rails-html-sanitizer (~> 1.6)
-    activejob (7.2.3)
-      activesupport (= 7.2.3)
+    activejob (7.2.3.1)
+      activesupport (= 7.2.3.1)
       globalid (>= 0.3.6)
-    activemodel (7.2.3)
-      activesupport (= 7.2.3)
-    activerecord (7.2.3)
-      activemodel (= 7.2.3)
-      activesupport (= 7.2.3)
+    activemodel (7.2.3.1)
+      activesupport (= 7.2.3.1)
+    activerecord (7.2.3.1)
+      activemodel (= 7.2.3.1)
+      activesupport (= 7.2.3.1)
       timeout (>= 0.4.0)
-    activestorage (7.2.3)
-      actionpack (= 7.2.3)
-      activejob (= 7.2.3)
-      activerecord (= 7.2.3)
-      activesupport (= 7.2.3)
+    activestorage (7.2.3.1)
+      actionpack (= 7.2.3.1)
+      activejob (= 7.2.3.1)
+      activerecord (= 7.2.3.1)
+      activesupport (= 7.2.3.1)
       marcel (~> 1.0)
-    activesupport (7.2.3)
+    activesupport (7.2.3.1)
       base64
       benchmark (>= 0.3)
       bigdecimal
@@ -74,18 +74,20 @@ GEM
       drb
       i18n (>= 1.6, < 2)
       logger (>= 1.4.2)
-      minitest (>= 5.1)
+      minitest (>= 5.1, < 6)
       securerandom (>= 0.3)
       tzinfo (~> 2.0, >= 2.0.5)
-    addressable (2.8.9)
+    addressable (2.9.0)
       public_suffix (>= 2.0.2, < 8.0)
     ast (2.4.3)
+    auth-sanitizer (0.2.1)
+      version_gem (~> 1.1, >= 1.1.10)
     base64 (0.3.0)
-    bcrypt (3.1.21)
+    bcrypt (3.1.22)
     benchmark (0.5.0)
-    bigdecimal (4.0.1)
+    bigdecimal (4.1.2)
     builder (3.3.0)
-    bullet (8.1.0)
+    bullet (8.1.3)
       activesupport (>= 3.0.0)
       uniform_notifier (~> 1.11)
     bundle-audit (0.2.0)
@@ -106,10 +108,10 @@ GEM
     chunky_png (1.4.0)
     commonmarker (2.3.2)
       rb_sys (~> 0.9)
-    concurrent-ruby (1.3.6)
+    concurrent-ruby (1.3.7)
     connection_pool (3.0.2)
     crass (1.0.6)
-    css_parser (1.21.1)
+    css_parser (2.2.0)
       addressable
     csv (3.3.5)
     date (3.5.1)
@@ -120,18 +122,18 @@ GEM
     domain_name (0.6.20240107)
     doorkeeper (5.8.2)
       railties (>= 5)
-    doorkeeper-i18n (5.2.8)
+    doorkeeper-i18n (5.2.9)
       doorkeeper (>= 5.2)
     drb (2.2.3)
-    erb (6.0.2)
+    erb (6.0.4)
     erubi (1.13.1)
-    faraday (2.14.1)
+    faraday (2.14.3)
       faraday-net_http (>= 2.0, < 3.5)
       json
       logger
-    faraday-net_http (3.4.2)
+    faraday-net_http (3.4.4)
       net-http (~> 0.5)
-    ffi (1.17.3)
+    ffi (1.17.4)
     globalid (1.3.0)
       activesupport (>= 6.1)
     hashie (5.1.0)
@@ -141,7 +143,7 @@ GEM
       nokogiri (>= 1.4)
     htmlentities (4.4.2)
     http-accept (1.7.0)
-    http-cookie (1.1.0)
+    http-cookie (1.1.6)
       domain_name (~> 0.5)
     i18n (1.14.8)
       concurrent-ruby (~> 1.0)
@@ -150,13 +152,13 @@ GEM
       activesupport (>= 6.0.0)
       railties (>= 6.0.0)
     io-console (0.8.2)
-    irb (1.17.0)
+    irb (1.18.0)
       pp (>= 0.6.0)
       prism (>= 1.3.0)
       rdoc (>= 4.0.0)
       reline (>= 0.4.2)
-    json (2.19.1)
-    jwt (3.1.2)
+    json (2.19.9)
+    jwt (3.2.0)
       base64
     language_server-protocol (3.17.0.5)
     lint_roller (1.1.0)
@@ -165,7 +167,7 @@ GEM
       rb-fsevent (~> 0.10, >= 0.10.3)
       rb-inotify (~> 0.9, >= 0.9.10)
     logger (1.7.0)
-    loofah (2.25.0)
+    loofah (2.25.1)
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
     mail (2.8.1)
@@ -173,12 +175,12 @@ GEM
       net-imap
       net-pop
       net-smtp
-    marcel (1.1.0)
+    marcel (1.2.1)
     matrix (0.4.3)
     mime-types (3.7.0)
       logger
       mime-types-data (~> 3.2025, >= 3.2025.0507)
-    mime-types-data (3.2026.0303)
+    mime-types-data (3.2026.0414)
     mini_magick (5.2.0)
       benchmark
       logger
@@ -187,13 +189,13 @@ GEM
     minitest (5.27.0)
     mocha (3.1.0)
       ruby2_keywords (>= 0.0.5)
-    multi_xml (0.8.1)
+    multi_xml (0.9.1)
       bigdecimal (>= 3.1, < 5)
     mysql2 (0.5.7)
       bigdecimal
     net-http (0.9.1)
       uri (>= 0.11.1)
-    net-imap (0.5.13)
+    net-imap (0.5.15)
       date
       net-protocol
     net-ldap (0.17.1)
@@ -205,19 +207,20 @@ GEM
       net-protocol
     netrc (0.11.0)
     nio4r (2.7.5)
-    nokogiri (1.19.1)
+    nokogiri (1.19.3)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
-    oauth2 (2.0.18)
+    oauth2 (2.0.23)
+      auth-sanitizer (~> 0.2, >= 0.2.1)
       faraday (>= 0.17.3, < 4.0)
       jwt (>= 1.0, < 4.0)
       logger (~> 1.2)
       multi_xml (~> 0.5)
       rack (>= 1.2, < 4)
-      snaky_hash (~> 2.0, >= 2.0.3)
-      version_gem (~> 1.1, >= 1.1.9)
-    parallel (1.27.0)
-    parser (3.3.10.2)
+      snaky_hash (~> 2.0, >= 2.0.6)
+      version_gem (~> 1.1, >= 1.1.11)
+    parallel (1.28.0)
+    parser (3.3.11.1)
       ast (~> 2.4.1)
       racc
     pg (1.5.9)
@@ -230,35 +233,35 @@ GEM
       activesupport (>= 7.0.0)
       rack
       railties (>= 7.0.0)
-    psych (5.3.1)
+    psych (5.4.0)
       date
       stringio
     public_suffix (7.0.5)
-    puma (7.2.0)
+    puma (8.0.2)
       nio4r (~> 2.0)
     racc (1.8.1)
-    rack (3.2.5)
-    rack-session (2.1.1)
+    rack (3.2.6)
+    rack-session (2.1.2)
       base64 (>= 0.1.0)
       rack (>= 3.0.0)
     rack-test (2.2.0)
       rack (>= 1.3)
     rackup (2.3.1)
       rack (>= 3)
-    rails (7.2.3)
-      actioncable (= 7.2.3)
-      actionmailbox (= 7.2.3)
-      actionmailer (= 7.2.3)
-      actionpack (= 7.2.3)
-      actiontext (= 7.2.3)
-      actionview (= 7.2.3)
-      activejob (= 7.2.3)
-      activemodel (= 7.2.3)
-      activerecord (= 7.2.3)
-      activestorage (= 7.2.3)
-      activesupport (= 7.2.3)
+    rails (7.2.3.1)
+      actioncable (= 7.2.3.1)
+      actionmailbox (= 7.2.3.1)
+      actionmailer (= 7.2.3.1)
+      actionpack (= 7.2.3.1)
+      actiontext (= 7.2.3.1)
+      actionview (= 7.2.3.1)
+      activejob (= 7.2.3.1)
+      activemodel (= 7.2.3.1)
+      activerecord (= 7.2.3.1)
+      activestorage (= 7.2.3.1)
+      activesupport (= 7.2.3.1)
       bundler (>= 1.15.0)
-      railties (= 7.2.3)
+      railties (= 7.2.3.1)
     rails-dom-testing (2.3.0)
       activesupport (>= 5.0.0)
       minitest
@@ -266,9 +269,9 @@ GEM
     rails-html-sanitizer (1.7.0)
       loofah (~> 2.25)
       nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
-    railties (7.2.3)
-      actionpack (= 7.2.3)
-      activesupport (= 7.2.3)
+    railties (7.2.3.1)
+      actionpack (= 7.2.3.1)
+      activesupport (= 7.2.3.1)
       cgi
       irb (~> 1.13)
       rackup (>= 1.0.0)
@@ -277,13 +280,13 @@ GEM
       tsort (>= 0.2)
       zeitwerk (~> 2.6)
     rainbow (3.1.1)
-    rake (13.3.1)
-    rake-compiler-dock (1.11.0)
+    rake (13.4.2)
+    rake-compiler-dock (1.12.0)
     rb-fsevent (0.11.2)
     rb-inotify (0.11.1)
       ffi (~> 1.0)
-    rb_sys (0.9.124)
-      rake-compiler-dock (= 1.11.0)
+    rb_sys (0.9.128)
+      rake-compiler-dock (= 1.12.0)
     rbpdf (1.21.4)
       htmlentities
       rbpdf-font (~> 1.19.0)
@@ -292,7 +295,7 @@ GEM
       erb
       psych (>= 4.0.0)
       tsort
-    regexp_parser (2.11.3)
+    regexp_parser (2.12.0)
     reline (0.6.3)
       io-console (~> 0.5)
     requestjs-rails (0.0.14)
@@ -303,8 +306,8 @@ GEM
       mime-types (>= 1.16, < 4.0)
       netrc (~> 0.8)
     rexml (3.4.4)
-    roadie (5.2.1)
-      css_parser (~> 1.4)
+    roadie (5.3.0)
+      css_parser (>= 1.4, < 3.0)
       nokogiri (~> 1.15)
     roadie-rails (3.3.0)
       railties (>= 5.1, < 8.1)
@@ -346,7 +349,7 @@ GEM
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
     securerandom (0.4.1)
-    selenium-webdriver (4.41.0)
+    selenium-webdriver (4.45.0)
       base64 (~> 0.2)
       logger (~> 1.4)
       rexml (~> 3.2, >= 3.2.5)
@@ -358,7 +361,7 @@ GEM
       simplecov_json_formatter (~> 0.1)
     simplecov-html (0.13.2)
     simplecov_json_formatter (0.1.4)
-    snaky_hash (2.0.3)
+    snaky_hash (2.0.6)
       hashie (>= 0.1.0, < 6)
       version_gem (>= 1.1.8, < 3)
     sqlite3 (2.5.0)
@@ -384,10 +387,10 @@ GEM
     uniform_notifier (1.18.0)
     uri (1.1.1)
     useragent (0.16.11)
-    version_gem (1.1.9)
+    version_gem (1.1.12)
     webrick (1.9.2)
     websocket (1.2.11)
-    websocket-driver (0.8.0)
+    websocket-driver (0.8.1)
       base64
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.5)
@@ -396,8 +399,8 @@ GEM
       zeitwerk (>= 2.7)
     xpath (3.2.0)
       nokogiri (~> 1.8)
-    yard (0.9.38)
-    zeitwerk (2.7.5)
+    yard (0.9.44)
+    zeitwerk (2.8.2)
 
 PLATFORMS
   ruby
@@ -436,7 +439,7 @@ DEPENDENCIES
   propshaft (~> 1.1.0)
   puma
   rack (>= 3.1.3)
-  rails (= 7.2.3)
+  rails (= 7.2.3.1)
   rails-dom-testing (>= 2.3.0)
   rbpdf (~> 1.21.4)
   requestjs-rails (~> 0.0.13)
@@ -462,7 +465,7 @@ DEPENDENCIES
   yard
 
 RUBY VERSION
-   ruby 3.3.10p183
+   ruby 3.4.9p82
 
 BUNDLED WITH
    2.7.2
diff --git a/pkgs/by-name/re/redmine/gemset.nix b/pkgs/by-name/re/redmine/gemset.nix
index 5d9ec4e70b2a..b8b1c5989d7e 100644
--- a/pkgs/by-name/re/redmine/gemset.nix
+++ b/pkgs/by-name/re/redmine/gemset.nix
@@ -11,10 +11,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1yfl7blz9zlww0al921kmyqsmsx8gdphqjnszp5fgpzi8nr1fpg1";
+      sha256 = "0g5kbrqvhwlliyrzd2bhc3kdiqm58df0x3w716bs0ygwyjil1gyk";
       type = "gem";
     };
-    version = "7.2.3";
+    version = "7.2.3.1";
   };
   actionmailbox = {
     dependencies = [
@@ -29,10 +29,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0pjdrdlv14mzq24qx95hpxhfza0k72qc3qymaa6x1wihqfkz1fqn";
+      sha256 = "0hf59r6sk0qb5va0ga549rbadcb5n1a2ry8nlkszzcksr6039rx4";
       type = "gem";
     };
-    version = "7.2.3";
+    version = "7.2.3.1";
   };
   actionmailer = {
     dependencies = [
@@ -47,10 +47,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1f4axhrdhk9z3hjv6xzxqyj7c3y17mn7kz1li1fv5lm6aaw4dmk8";
+      sha256 = "0rq4aan18y6gwziabnj1q1486349k1v1i5m7ysv206pqqpavcy7m";
       type = "gem";
     };
-    version = "7.2.3";
+    version = "7.2.3.1";
   };
   actionpack = {
     dependencies = [
@@ -70,10 +70,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1kq7fbgb5yfsjd1na2ghc7assk18ca24kbvsx90p0xwm8v3f851a";
+      sha256 = "1jp4w493wvfh9246wxk7g00m1a3vmzkvs0rznq62fwvjjdzzwsmn";
       type = "gem";
     };
-    version = "7.2.3";
+    version = "7.2.3.1";
   };
   actionpack-xml_parser = {
     dependencies = [
@@ -102,10 +102,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0ds0m7qp55qkprhdkzpxrvbfiam95s58xj7555hf5d5pnzpxkzx6";
+      sha256 = "1qs350j3zm7sd6xxn61d93mv3lx1ravbjqja12c7nd7a0zs1h52v";
       type = "gem";
     };
-    version = "7.2.3";
+    version = "7.2.3.1";
   };
   actionview = {
     dependencies = [
@@ -120,10 +120,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1cpc91crvavdgvc3jqj1nqr9q6s581bm64894pbh8f5l85x7shhz";
+      sha256 = "0z7zy6ibfpsdj9jbdm54bx3ws4dszcq7qa564jn645rr8dlbh6fy";
       type = "gem";
     };
-    version = "7.2.3";
+    version = "7.2.3.1";
   };
   activejob = {
     dependencies = [
@@ -134,10 +134,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1c7zwmhkg9fpkl2isiggs9b2xbf8jf0hhbvmjfgbcrz25m3n8jg4";
+      sha256 = "1n3fiwm1x3dxwj36n9pspd2bgffyw28ys9yd36hjvf3iwdy25i0b";
       type = "gem";
     };
-    version = "7.2.3";
+    version = "7.2.3.1";
   };
   activemodel = {
     dependencies = [ "activesupport" ];
@@ -145,10 +145,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1nrr8w3hxkssgx13bcph8lb876hg57w01fbapy7fj4ijp6p6dbxv";
+      sha256 = "1l60a6mqx1wgp15ki1cp68djci0czgrikpydii5bd877hndqdq9r";
       type = "gem";
     };
-    version = "7.2.3";
+    version = "7.2.3.1";
   };
   activerecord = {
     dependencies = [
@@ -160,10 +160,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1mx087zngip62400z44p969l6fja1fjxliq6kym6npzbii3vgb3g";
+      sha256 = "0pd0f1hy6rvyanmrklqir33xq0jb2my4jajz7hc38nysfpi175dq";
       type = "gem";
     };
-    version = "7.2.3";
+    version = "7.2.3.1";
   };
   activestorage = {
     dependencies = [
@@ -177,10 +177,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0bya6k7i8s6538fa4j2c0a0xrf6kggg8mhrwnkkqj356zaxj452c";
+      sha256 = "1azzbpfp726yigwzmj8g2jji149wisnwrgb86zix6mk25sj4w8hb";
       type = "gem";
     };
-    version = "7.2.3";
+    version = "7.2.3.1";
   };
   activesupport = {
     dependencies = [
@@ -204,10 +204,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "043vbilaw855c91n5l7g0k0wxj63kngj911685qy74xc1mvwjxan";
+      sha256 = "0d6bhg9cim83g8cypjd7cms45ng4p9ga69v26i3vp823d98yvsqi";
       type = "gem";
     };
-    version = "7.2.3";
+    version = "7.2.3.1";
   };
   addressable = {
     dependencies = [ "public_suffix" ];
@@ -218,10 +218,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "11ali533wx91fh93xlk88gjqq8w0p7kxw09nlh41hwc9wv5ly5fc";
+      sha256 = "1by7h2lwziiblizpd5yx87jsq8ppdhzvwf08ga34wzqgcv1nmpvz";
       type = "gem";
     };
-    version = "2.8.9";
+    version = "2.9.0";
   };
   ast = {
     groups = [
@@ -236,6 +236,20 @@
     };
     version = "2.4.3";
   };
+  auth-sanitizer = {
+    dependencies = [ "version_gem" ];
+    groups = [
+      "default"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0xy5gjb12kv6zjn4zyd16yfv4bygd02ykbr6cz10d6sqyw0wyzci";
+      type = "gem";
+    };
+    version = "0.2.1";
+  };
   base64 = {
     groups = [
       "default"
@@ -255,10 +269,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1krd99p9828n07rcjjms56jaqv7v6s9pn7y6bppcfhhaflyn2r2r";
+      sha256 = "0clhya4p8lhjj7hp31inp321wgzb0b5wbwppmya5sw1dikl7400z";
       type = "gem";
     };
-    version = "3.1.21";
+    version = "3.1.22";
   };
   benchmark = {
     groups = [
@@ -284,10 +298,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "19y406nx17arzsbc515mjmr6k5p59afprspa1k423yd9cp8d61wb";
+      sha256 = "1g9zi8c4i7g8zz0c3hxrw6mblrjvgn7akys60clb9si7c1k1gljk";
       type = "gem";
     };
-    version = "4.0.1";
+    version = "4.1.2";
   };
   builder = {
     groups = [ "default" ];
@@ -308,10 +322,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1zwq7g98c1mdigahb50c980a0fcc4ib1m9ivmgf3f8gc6qk7wjv0";
+      sha256 = "1jy7yfn94acbcn23g9zh48b8j9jphwcqgr2vfy013zi4fd93q5n8";
       type = "gem";
     };
-    version = "8.1.0";
+    version = "8.1.3";
   };
   bundle-audit = {
     dependencies = [ "bundler-audit" ];
@@ -398,10 +412,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1aymcakhzl83k77g2f2krz07bg1cbafbcd2ghvwr4lky3rz86mkb";
+      sha256 = "1c2i64xsd35vijnb50rxb70g508s0x674xi0qpyyb8jy7bncl4j4";
       type = "gem";
     };
-    version = "1.3.6";
+    version = "1.3.7";
   };
   connection_pool = {
     groups = [
@@ -433,10 +447,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1izp5vna86s7xivqzml4nviy01bv76arrd5is8wkncwp1by3zzbc";
+      sha256 = "09b3zwmx95jhdp3da6qx9w0d6s2yfpxjjip55wpwny5wsx3v5l93";
       type = "gem";
     };
-    version = "1.21.1";
+    version = "2.2.0";
   };
   csv = {
     groups = [ "default" ];
@@ -522,10 +536,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0lpmvaglypxlmaiqv4sjrf1b1sc8f589cv7xq3rr4j26vw0lf1g4";
+      sha256 = "195l8nfay1yb4igg348mjffikvh1m16b4899gyzz7ysgwkx3m9yy";
       type = "gem";
     };
-    version = "5.2.8";
+    version = "5.2.9";
   };
   drb = {
     groups = [
@@ -550,10 +564,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0ar4nmvk1sk7drjigqyh9nnps3mxg625b8chfk42557p8i6jdrlz";
+      sha256 = "1ncmbdjf2bwmk0jf5cxywns9zbxyfiy4h4p3pzi7yddyjhv81qrq";
       type = "gem";
     };
-    version = "6.0.2";
+    version = "6.0.4";
   };
   erubi = {
     groups = [ "default" ];
@@ -578,10 +592,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "077n5ss3z3ds4vj54w201kd12smai853dp9c9n7ii7g3q7nwwg54";
+      sha256 = "0y7j6yzv07zggic6g0p2v1ivnvkzsbqjnfdl4215qqb6cxz290hq";
       type = "gem";
     };
-    version = "2.14.1";
+    version = "2.14.3";
   };
   faraday-net_http = {
     dependencies = [ "net-http" ];
@@ -592,10 +606,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0v4hfmc7d4lrqqj2wl366rm9551gd08zkv2ppwwnjlnkc217aizi";
+      sha256 = "125m3qri52vwh5v9dhq0dkqxf8629cxrf99yyc01pva72wasyy0f";
       type = "gem";
     };
-    version = "3.4.2";
+    version = "3.4.4";
   };
   ffi = {
     groups = [
@@ -622,10 +636,10 @@
     ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0k1xaqw2jk13q3ss7cnyvkp8fzp75dk4kazysrxgfd1rpgvkk7qf";
+      sha256 = "1kqasqvy8d7r09ri4n6bkdwbk63j7afd9ilsw34nzlgh0qp69ldw";
       type = "gem";
     };
-    version = "1.17.3";
+    version = "1.17.4";
   };
   globalid = {
     dependencies = [ "activesupport" ];
@@ -698,10 +712,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "06dvmngd4hwrr6k774i1h6c50h2l8nww9f1id0wvrvi72l6yd99q";
+      sha256 = "1aga7z4p0dka4zcqw9i05wa4ab1q7h7cgnj328ldqqfycjz84jxs";
       type = "gem";
     };
-    version = "1.1.0";
+    version = "1.1.6";
   };
   i18n = {
     dependencies = [ "concurrent-ruby" ];
@@ -762,10 +776,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1bishrxfn2anwlagw8rzly7i2yicjnr947f48nh638yqjgdlv30n";
+      sha256 = "1qs8a9vprg7s8krgq4s0pygr91hclqqyz98ik15p0m1sf2h5956y";
       type = "gem";
     };
-    version = "1.17.0";
+    version = "1.18.0";
   };
   json = {
     groups = [
@@ -775,10 +789,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0b888h9v2y4aasi9aapxqimiaj1i1csk56l22dczigs8kv2zv56x";
+      sha256 = "16mp8vzgxa8nsa81np042za453j8b0ihpjkf666s7byxrnvjb44v";
       type = "gem";
     };
-    version = "2.19.1";
+    version = "2.19.9";
   };
   jwt = {
     dependencies = [ "base64" ];
@@ -789,10 +803,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0dfm4bhl4fzn076igh0bmh2v1vphcrxdv6ldc46hdd3bkbqr2sdg";
+      sha256 = "1mqps8z4ly74hpksfajcfamqk1wb79biy187pn10knmi6zzb26al";
       type = "gem";
     };
-    version = "3.1.2";
+    version = "3.2.0";
   };
   language_server-protocol = {
     groups = [
@@ -859,10 +873,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1rk0n13c9nmk8di2x5gqk5r04vf8bkp7ff6z0b44wsmc7fndfpnz";
+      sha256 = "011fdngxzr1p9dq2hxqz7qq1glj2g44xnhaadjqlf48cplywfdnl";
       type = "gem";
     };
-    version = "2.25.0";
+    version = "2.25.1";
   };
   mail = {
     dependencies = [
@@ -885,10 +899,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1vhb1sbzlq42k2pzd9v0w5ws4kjx184y8h4d63296bn57jiwzkzx";
+      sha256 = "17w53z6vka8ddmxvi936biqv443d5yg0503wj7xfmy9j1qvfjy0n";
       type = "gem";
     };
-    version = "1.1.0";
+    version = "1.2.1";
   };
   matrix = {
     groups = [
@@ -928,10 +942,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "09627cnx432528j7j73711fbd0r30ri0lfsh9dfiki94b3gg2jhn";
+      sha256 = "1k28j6ww8rf43r5i8278jvm2cq3pnzsvqm7yqpb4p93kadjlq726";
       type = "gem";
     };
-    version = "3.2026.0303";
+    version = "3.2026.0414";
   };
   mini_magick = {
     dependencies = [
@@ -1008,10 +1022,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0nnzdswa9l6w8k5ndgbv5al9f0jkg14dqwzyic4fjd5c1cls1nxd";
+      sha256 = "0msflv26i6i3jr9w761k4qdl7cp9zbhymjkn57b1w90pkjsndrvw";
       type = "gem";
     };
-    version = "0.8.1";
+    version = "0.9.1";
   };
   mysql2 = {
     dependencies = [ "bigdecimal" ];
@@ -1047,10 +1061,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1c9p0r2z6j14g0vi323r6x4cs6w87xjvphlkxf7x63h2wsscgc7d";
+      sha256 = "0506bhwr62szwcagcvxayhwz0d20k5ax1sh742va3mjnnkqcfkgn";
       type = "gem";
     };
-    version = "0.5.13";
+    version = "0.5.15";
   };
   net-ldap = {
     groups = [ "ldap" ];
@@ -1134,13 +1148,14 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1lss1nh526n3h1qsig2kjchi8vlsjwc8pdjpplm1f2yz6rzk52sr";
+      sha256 = "1s30b7h7qpyim30m8060xs415mbr3ci7i5hdg09chh1aqfx2qcbq";
       type = "gem";
     };
-    version = "1.19.1";
+    version = "1.19.3";
   };
   oauth2 = {
     dependencies = [
+      "auth-sanitizer"
       "faraday"
       "jwt"
       "logger"
@@ -1153,10 +1168,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "11rj80dgjz05x5xx93y4bfk9rcn7fl56srj8fgqn7ffzf3j13kxs";
+      sha256 = "0k428i1mlk6g7c054iks86g2h4h2p1y0mg2l3g6w84gd9l8604g6";
       type = "gem";
     };
-    version = "2.0.18";
+    version = "2.0.23";
   };
   parallel = {
     groups = [
@@ -1166,10 +1181,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0c719bfgcszqvk9z47w2p8j2wkz5y35k48ywwas5yxbbh3hm3haa";
+      sha256 = "0w697335hi5dk5ay9kyn53399sy87y8v0y6ij93m5wmshhadxrik";
       type = "gem";
     };
-    version = "1.27.0";
+    version = "1.28.0";
   };
   parser = {
     dependencies = [
@@ -1183,10 +1198,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0mwk9syajzdradzqzp3agf03d0cazqwbfd1439nxpkmxli5chq3g";
+      sha256 = "0m2xqvn1la62hji1mn04y59giikww95p2hs0r4y2rrz3mdxcwyni";
       type = "gem";
     };
-    version = "3.3.10.2";
+    version = "3.3.11.1";
   };
   pg = {
     groups = [ "default" ];
@@ -1270,10 +1285,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0x0r3gc66abv8i4dw0x0370b5hrshjfp6kpp7wbp178cy775fypb";
+      sha256 = "1dx5bc3s1mb1i53np4cdkypg7ccygnvagr3hglyndbqilrljvxql";
       type = "gem";
     };
-    version = "5.3.1";
+    version = "5.4.0";
   };
   public_suffix = {
     groups = [
@@ -1294,10 +1309,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1a3jd9qakasizrf7dkq5mqv51fjf02r2chybai2nskjaa6mz93mz";
+      sha256 = "1yw6nvkvddriacmva8hm0za0961d6j96dm7zm6748rmyzcfqgvf8";
       type = "gem";
     };
-    version = "7.2.0";
+    version = "8.0.2";
   };
   racc = {
     groups = [
@@ -1321,10 +1336,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1lyn3rh71rlf50p44xmsbha0pip4c95004j8kc9pm7xpq1s0kgac";
+      sha256 = "1hhjy9gcp52dzij05gmidqac8g28ski5xm67prwmdqmjfcgqxmsy";
       type = "gem";
     };
-    version = "3.2.5";
+    version = "3.2.6";
   };
   rack-session = {
     dependencies = [
@@ -1335,10 +1350,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1sg4laz2qmllxh1c5sqlj9n1r7scdn08p3m4b0zmhjvyx9yw0v8b";
+      sha256 = "1s7zcxlmg88a6dam4aqbgk9xkpy6dkdfqmmcszkkliy3q3w38m2r";
       type = "gem";
     };
-    version = "2.1.1";
+    version = "2.1.2";
   };
   rack-test = {
     dependencies = [ "rack" ];
@@ -1384,10 +1399,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1zwvc2fa0hm27ygfz1yc2bs52h4wzj1nhpv6cip6g28i2gmi564s";
+      sha256 = "155skqkjrckvzj1qy37lrnafrillc47qhf3l80g3zvw100ba1h4n";
       type = "gem";
     };
-    version = "7.2.3";
+    version = "7.2.3.1";
   };
   rails-dom-testing = {
     dependencies = [
@@ -1434,10 +1449,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "08h44mkf91861agp7xw778gqpf5mppydsfgphgkj7wp6pyk11c3f";
+      sha256 = "0np1m8xqb4wbzwpg66yjnqjban0di92lbjzcrgnwwhq2w4z3k8xf";
       type = "gem";
     };
-    version = "7.2.3";
+    version = "7.2.3.1";
   };
   rainbow = {
     groups = [
@@ -1457,20 +1472,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "175iisqb211n0qbfyqd8jz2g01q6xj038zjf4q0nm8k6kz88k7lc";
+      sha256 = "009p524zl0p0kfa65nii8wdmaigkmawv9pbvlcffky7islmmp0nb";
       type = "gem";
     };
-    version = "13.3.1";
+    version = "13.4.2";
   };
   rake-compiler-dock = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1hpq52ab86s70yv5hk56f0z14izhh59af95nlv73bsrksln1zdga";
+      sha256 = "08w033c3p25wr0zwbgx0b4mb4ha5kqd4j0ydmx9j0gcgfg10acpi";
       type = "gem";
     };
-    version = "1.11.0";
+    version = "1.12.0";
   };
   rb-fsevent = {
     groups = [
@@ -1505,10 +1520,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1rvshyirm32lzf2sggcrhvz5hi828s3rznmkchvzgshjgdapcd2i";
+      sha256 = "1z9q0l9l5r210jsmcmq3lxd4fr0j5lv348kn33g9a62fdm6izf4s";
       type = "gem";
     };
-    version = "0.9.124";
+    version = "0.9.128";
   };
   rbpdf = {
     dependencies = [
@@ -1561,10 +1576,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "192mzi0wgwl024pwpbfa6c2a2xlvbh3mjd75a0sakdvkl60z64ya";
+      sha256 = "1fwfw26a32rps78920nn29shqg2zmqv72i89j1fap41isshida9m";
       type = "gem";
     };
-    version = "2.11.3";
+    version = "2.12.0";
   };
   reline = {
     dependencies = [ "io-console" ];
@@ -1630,10 +1645,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1mh1a0m0i0xrm20nry4d3gf0q5kbmm5lp15n52r93gcjwwfgd974";
+      sha256 = "1jlzxlq52qbsacxkz4gny988j2pcip73ydp1fg9s1q98ra4h6554";
       type = "gem";
     };
-    version = "5.2.1";
+    version = "5.3.0";
   };
   roadie-rails = {
     dependencies = [
@@ -1843,10 +1858,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "08nxpr0lxn95ml19n0vy6dnw1gnhq9n1b0za5h18dwawsly1ghfd";
+      sha256 = "1lg22fmcalwnzgnanswn5g7vc24wmancnvbyf1ynzb46vyj6bb7c";
       type = "gem";
     };
-    version = "4.41.0";
+    version = "4.45.0";
   };
   simplecov = {
     dependencies = [
@@ -1901,10 +1916,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0mnllrwhs7psw6xxs8x5yx85k12qjfdgs8zs0bxm70bfascx58r5";
+      sha256 = "0jk50mjq69065ygdhkhbmxp9k2c7knizhp022ysq5xfyikjclqrn";
       type = "gem";
     };
-    version = "2.0.3";
+    version = "2.0.6";
   };
   sqlite3 = {
     dependencies = [ "mini_portile2" ];
@@ -2105,10 +2120,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "195r5qylwxwqbllnpli9c2pzin0lky6h3fw912h88g2lmri0j6hc";
+      sha256 = "0gfv1qxfn202xffasw2mrrrf2jkdp6hsps0177k9fyc0fwb6k3xp";
       type = "gem";
     };
-    version = "1.1.9";
+    version = "1.1.12";
   };
   webrick = {
     groups = [ "default" ];
@@ -2142,10 +2157,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0qj9dmkmgahmadgh88kydb7cv15w13l1fj3kk9zz28iwji5vl3gd";
+      sha256 = "15idgibqpdaj97f734drx8a7k1jcc8wvxlk2nbafac72ihikicjs";
       type = "gem";
     };
-    version = "0.8.0";
+    version = "0.8.1";
   };
   websocket-extensions = {
     groups = [ "default" ];
@@ -2190,19 +2205,19 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "03q1hf12csqy5q2inafzi44179zaq9n5yrb0k2j2llqhzcmbh7vj";
+      sha256 = "0a3zi3v7qjm7lm4yp9z2sm959533k543sc4z0ixqik8wcfdpw27b";
       type = "gem";
     };
-    version = "0.9.38";
+    version = "0.9.44";
   };
   zeitwerk = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1pbkiwwla5gldgb3saamn91058nl1sq1344l5k36xsh9ih995nnq";
+      sha256 = "04hx33lsnp4q0qf8982mz0acs1dap5s2bsmihi0n0g08249sc4kj";
       type = "gem";
     };
-    version = "2.7.5";
+    version = "2.8.2";
   };
 }
diff --git a/pkgs/by-name/re/redmine/package.nix b/pkgs/by-name/re/redmine/package.nix
index 90b099494bb2..aacda5507597 100644
--- a/pkgs/by-name/re/redmine/package.nix
+++ b/pkgs/by-name/re/redmine/package.nix
@@ -15,7 +15,7 @@
 }:
 
 let
-  version = "6.1.2";
+  version = "6.1.3";
   rubyEnv = bundlerEnv {
     name = "redmine-env-${version}";
 
@@ -69,7 +69,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://www.redmine.org/releases/redmine-${finalAttrs.version}.tar.gz";
-    hash = "sha256-k46XXoCMz7Sw3LrYtC8Cqs8Mqe8VSRw4xa9HVnQMzwg=";
+    hash = "sha256-YdswCMf9GKOvxVntZW/Tj9+N+CIKxpWYsxkJUYMZC3o=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/re/rescrobbled/package.nix b/pkgs/by-name/re/rescrobbled/package.nix
index f1785f67a45b..08a70e8342a9 100644
--- a/pkgs/by-name/re/rescrobbled/package.nix
+++ b/pkgs/by-name/re/rescrobbled/package.nix
@@ -11,16 +11,16 @@
 rustPlatform.buildRustPackage (finalAttrs: {
 
   pname = "rescrobbled";
-  version = "0.9.1";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "InputUsername";
     repo = "rescrobbled";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-pk8eWq3GOF0f6Xvt4VJezxW+vWnfk7W0sKn+Yvd7PHs=";
+    hash = "sha256-q8zxv4fSk+rUG4zQkZFNgkqSU3+FqgTzJzzjeSHy3Io=";
   };
 
-  cargoHash = "sha256-EpQoi/pPIJN5sOZic/J8A3Co4o27Gi2SW/OaZHBFU2Y=";
+  cargoHash = "sha256-pWdA48WqcNd9/daZE7gyoGTkH01i3MBv1SMGdfE2ZS0=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/re/reticulated/package.nix b/pkgs/by-name/re/reticulated/package.nix
index 798e02fca3c6..417a86f40c50 100644
--- a/pkgs/by-name/re/reticulated/package.nix
+++ b/pkgs/by-name/re/reticulated/package.nix
@@ -7,15 +7,15 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "reticulated";
-  version = "1.0.2";
+  version = "1.0.3";
   pyproject = true;
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "RFnexus";
     repo = "reticulated";
-    tag = finalAttrs.version;
-    hash = "sha256-55eK9AObUw8JLn4sNC5O8dNrfscwTwQpkVQAR+O9Lcw=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-02vdSKAEb59VucoDe5M+uSiNdyMybfQnhCr+LzGyNT0=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/si/signal-desktop/package.nix b/pkgs/by-name/si/signal-desktop/package.nix
index bb9fa6b38835..003cf64b05bf 100644
--- a/pkgs/by-name/si/signal-desktop/package.nix
+++ b/pkgs/by-name/si/signal-desktop/package.nix
@@ -3,7 +3,7 @@
   stdenv,
   lib,
   nodejs_24,
-  pnpm_10_29_2,
+  pnpm_10,
   node-gyp,
   fetchPnpmDeps,
   pnpmConfigHook,
@@ -32,7 +32,7 @@ assert lib.warnIf (commandLineArgs != "")
   true;
 let
   nodejs = nodejs_24;
-  pnpm = pnpm_10_29_2;
+  pnpm = pnpm_10;
   electron = electron_42;
 
   libsignal-node = callPackage ./libsignal-node.nix { inherit nodejs; };
diff --git a/pkgs/by-name/sk/skeema/package.nix b/pkgs/by-name/sk/skeema/package.nix
index 88e37a9e7220..54582ef38b63 100644
--- a/pkgs/by-name/sk/skeema/package.nix
+++ b/pkgs/by-name/sk/skeema/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "skeema";
-  version = "1.13.2";
+  version = "1.14.0";
 
   src = fetchFromGitHub {
     owner = "skeema";
     repo = "skeema";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Gy+AYjUEi3wvXX9j5jCOs7/Qk0bgIt20cjY+SSP+uQI=";
+    hash = "sha256-xcGHzsVV3rn8l7oYu+RD4njyI1KW/fU9iGdwZW7W5PA=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/sp/spacectl/package.nix b/pkgs/by-name/sp/spacectl/package.nix
index 88cd3f3da1bc..63aa4e8c8a3b 100644
--- a/pkgs/by-name/sp/spacectl/package.nix
+++ b/pkgs/by-name/sp/spacectl/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "spacectl";
-  version = "1.22.0";
+  version = "1.23.0";
 
   src = fetchFromGitHub {
     owner = "spacelift-io";
     repo = "spacectl";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-2wy5I3wmBtp239gdcL8s+SuXWajx9EB+s3xBYxy55ok=";
+    hash = "sha256-9YhA1clYaPbrY/kAS51Qo20EDPSPOKwN5iLUUJ4sE60=";
   };
 
-  vendorHash = "sha256-+ahiiboLKu/LazJzsxoE39hbF73TSuguPkKCSS7m2BA=";
+  vendorHash = "sha256-1ue5NHt/+QCtmzwQder6H7WqRBJ42on53ixuD+wiZpg=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/sp/spicedb/package.nix b/pkgs/by-name/sp/spicedb/package.nix
index 6ada61c54527..ad6e3d4e6090 100644
--- a/pkgs/by-name/sp/spicedb/package.nix
+++ b/pkgs/by-name/sp/spicedb/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "spicedb";
-  version = "1.53.0";
+  version = "1.54.0";
 
   src = fetchFromGitHub {
     owner = "authzed";
     repo = "spicedb";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kmhLvHPqHqSFkfUx9pr52Vvz+YgCPwknHqSY4zpVPtI=";
+    hash = "sha256-A07AHCfXZtd5Z71jRxIx6oIipCFskPzYtgSHv21zKpE=";
   };
 
-  vendorHash = "sha256-G3isae85B6Js6H7XFAJ+v00caBV4+PO9IPCpHXzkBOs=";
+  vendorHash = "sha256-VZYkS1UQ7w/BUYFF8FrjgsnYn7sNexNVczmrMvYERGY=";
 
   ldflags = [
     "-X 'github.com/jzelinskie/cobrautil/v2.Version=${finalAttrs.src.tag}'"
diff --git a/pkgs/by-name/st/stalwart_0_16/package.nix b/pkgs/by-name/st/stalwart_0_16/package.nix
index e8b34a58fa09..15e972e1f299 100644
--- a/pkgs/by-name/st/stalwart_0_16/package.nix
+++ b/pkgs/by-name/st/stalwart_0_16/package.nix
@@ -64,7 +64,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
   cargoHash = "sha256-HVS89Wtjb2nIdyygP8bPRbVhyMRnJlZDfoCQqiMdVe0=";
 
   env = {
+    # https://docs.rs/openssl/latest/openssl/#manual
     OPENSSL_NO_VENDOR = true;
+    OPENSSL_DIR = lib.getDev openssl;
+    OPENSSL_LIB_DIR = "${lib.getLib openssl}/lib";
     ZSTD_SYS_USE_PKG_CONFIG = true;
     ROCKSDB_INCLUDE_DIR = "${rocksdb}/include";
     ROCKSDB_LIB_DIR = "${rocksdb}/lib";
diff --git a/pkgs/by-name/t3/t3code/package.nix b/pkgs/by-name/t3/t3code/package.nix
index 166256dbb0c4..ce49b88959fd 100644
--- a/pkgs/by-name/t3/t3code/package.nix
+++ b/pkgs/by-name/t3/t3code/package.nix
@@ -189,7 +189,7 @@ stdenv.mkDerivation (
 
       find "$out"/libexec/t3code -xtype l -delete
 
-      makeWrapper ${lib.getExe nodejs} "$out"/bin/t3code \
+      makeWrapper ${lib.getExe nodejs} "$out"/bin/t3 \
         --add-flags "$out"/libexec/t3code/apps/server/dist/bin.mjs ${runtimePathWrapperArgs}
 
       makeWrapper ${lib.getExe electron} "$out"/bin/t3code-desktop \
@@ -220,7 +220,7 @@ stdenv.mkDerivation (
 
     postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
       for shell in bash fish zsh; do
-        installShellCompletion --cmd t3code --"$shell" <("$out/bin/t3code" --completions "$shell")
+        installShellCompletion --cmd t3 --"$shell" <("$out/bin/t3" --completions "$shell")
       done
     '';
 
diff --git a/pkgs/by-name/ta/tanka/package.nix b/pkgs/by-name/ta/tanka/package.nix
index f94d8485d606..b2a800d4de47 100644
--- a/pkgs/by-name/ta/tanka/package.nix
+++ b/pkgs/by-name/ta/tanka/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "tanka";
-  version = "0.37.3";
+  version = "0.37.4";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "tanka";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-C1Tg3ruitMa3t7FA74m73oL+kd7AvPGvnA66/x9VOpw=";
+    sha256 = "sha256-quj1fZ5FeiH9KBO+rmHUYaXVkASWFBbj6Q6C9+vZsOk=";
   };
 
-  vendorHash = "sha256-nEiHJgEnq3KrPO0geNAz7NIp7tvCvtAUF8eNeP7NjPM=";
+  vendorHash = "sha256-p9MGbZudHBiOfHc6qxBVVl/IGlCjwUbSDLW0lktKCGM=";
 
   doCheck = false;
   # Required for versions >= 0.28 as they introduce a gowork.sum file. This is only used for tests so we can safely disable GOWORK
diff --git a/pkgs/by-name/ta/taskflow/add-pkg-config-support.patch b/pkgs/by-name/ta/taskflow/add-pkg-config-support.patch
deleted file mode 100644
index 3eb447d6d3bb..000000000000
--- a/pkgs/by-name/ta/taskflow/add-pkg-config-support.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 063fd793..99998a6b 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -377,3 +377,13 @@ install(
-   DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/${PROJECT_NAME}
- )
- 
-+
-+# -----------------------------------------------------------------------------
-+# pkg-config
-+# -----------------------------------------------------------------------------
-+
-+configure_file(taskflow.pc.in taskflow.pc @ONLY)
-+install(
-+  FILES ${CMAKE_CURRENT_BINARY_DIR}/taskflow.pc
-+  DESTINATION ${CMAKE_INSTALL_LIBDIR}/pkgconfig
-+)
-diff --git a/taskflow.pc.in b/taskflow.pc.in
-new file mode 100644
-index 00000000..fc649288
---- /dev/null
-+++ b/taskflow.pc.in
-@@ -0,0 +1,7 @@
-+prefix=@CMAKE_INSTALL_PREFIX@
-+includedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@
-+
-+Name: Taskflow
-+Description: A General-purpose Task-parallel Programming System
-+Version: @PROJECT_VERSION@
-+Cflags: -I${includedir}
diff --git a/pkgs/by-name/ta/taskflow/package.nix b/pkgs/by-name/ta/taskflow/package.nix
index 65471bef8a46..c7c88ff60060 100644
--- a/pkgs/by-name/ta/taskflow/package.nix
+++ b/pkgs/by-name/ta/taskflow/package.nix
@@ -10,32 +10,19 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "taskflow";
-  version = "4.0.0";
+  version = "4.1.0";
 
   src = fetchFromGitHub {
     owner = "taskflow";
     repo = "taskflow";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cWnKA6tCsKRfkleBJ38NRP2ciJu4sHtyTS8y5bBTfcA=";
+    hash = "sha256-IxorLV5qQ8veFiwRka8k5oMR51KTUn10MbCIYNVToLk=";
   };
 
   patches = [
     (replaceVars ./unvendor-doctest.patch {
       inherit doctest;
     })
-
-    # https://github.com/taskflow/taskflow/pull/785
-    # TODO: remove when updating to the next release
-    (fetchpatch {
-      name = "fix-brace-init-with-explicit-constructor-for-GCC-15";
-      url = "https://github.com/taskflow/taskflow/commit/de7dfe30594cd1f98398095b970a8320734a2382.patch";
-      hash = "sha256-Ecl7dFvf2HDslv/5IHR5J2PYcRCN3EA4GahxOzcUS4g=";
-    })
-
-    # Vendored from #786 as it does not apply cleanly on top of v0.4.0
-    # https://github.com/taskflow/taskflow/pull/786
-    # TODO: remove when updating to the next release
-    ./add-pkg-config-support.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/by-name/te/teleport_17/package.nix b/pkgs/by-name/te/teleport_17/package.nix
index e70b5709bfeb..2cb02d9f5f87 100644
--- a/pkgs/by-name/te/teleport_17/package.nix
+++ b/pkgs/by-name/te/teleport_17/package.nix
@@ -7,11 +7,11 @@
 }:
 
 buildTeleport {
-  version = "17.7.24";
-  hash = "sha256-45vaxznxRfa4X/V7hZsQKVIWvbVG8F2cEQN19xp4WQg=";
+  version = "17.7.25";
+  hash = "sha256-IrelrkTvOBcTkO7cHf572MU5KkOQq3we53dgFsDCSRo=";
   vendorHash = "sha256-ERwCdWdp230wkqsRUCnd1hbO4PqXo+gDPsoGbxQqt04=";
-  cargoHash = "sha256-cDcDfptq8z0pwjImuAovv/5XwoaPb/ostyxkyNEbkRM=";
-  pnpmHash = "sha256-hk9DI3GSBm2XttCYCi5kjhEhUMm5ToRQcbT+RYI+S2Q=";
+  cargoHash = "sha256-BE/TBZoOaB3Th14E+t3qJ+0Uww56TtRA1sRQ+usFo+Y=";
+  pnpmHash = "sha256-TARwHswSWbKk2eoyynuaOm7pvt2CwbjtklqnM+9/YXM=";
 
   wasm-bindgen-cli = wasm-bindgen-cli_0_2_95;
   inherit buildGoModule withRdpClient extPatches;
diff --git a/pkgs/by-name/te/teleport_18/package.nix b/pkgs/by-name/te/teleport_18/package.nix
index 71fb509ee77e..bb5fb0572db2 100644
--- a/pkgs/by-name/te/teleport_18/package.nix
+++ b/pkgs/by-name/te/teleport_18/package.nix
@@ -7,11 +7,11 @@
 }:
 
 buildTeleport {
-  version = "18.8.3";
-  hash = "sha256-DHPOWIvzBCOT3GU0YHBtG46ctB0Nh8XwSmpl9vgCET8=";
-  vendorHash = "sha256-0+fIoprAQyoom9xBpXGiEgmE4dWktcqlZQOzkRXYlKo=";
-  pnpmHash = "sha256-8FlC9Sm12A5kfS9X0qYDNJOePZjeJU7LDTRlWUIEneA=";
-  cargoHash = "sha256-IX0HCeCosXCe/oTYa8PImemf9op2AeagSnl44uBnSbM=";
+  version = "18.9.1";
+  hash = "sha256-FIPExc8tMoPXfWc7pQjwQRkxmiQEOxdkYgWS0GejQuk=";
+  vendorHash = "sha256-BlQhypAoK85ID0pgmXbUboks88qjSg3p5E8qxyTIc9M=";
+  pnpmHash = "sha256-ZGbuBMPwC3u/2qDTVLH2InOGVc94Vq0i3AKHMsOwq3k=";
+  cargoHash = "sha256-KbmacTEOElmboHMK6YxWGC0brlDsX7kcvpaOOZmuops=";
 
   wasm-bindgen-cli = wasm-bindgen-cli_0_2_99;
   buildGoModule = buildGo125Module;
diff --git a/pkgs/by-name/te/temporal-cli/package.nix b/pkgs/by-name/te/temporal-cli/package.nix
index 9216ea6e34dd..88feaede9fb2 100644
--- a/pkgs/by-name/te/temporal-cli/package.nix
+++ b/pkgs/by-name/te/temporal-cli/package.nix
@@ -11,16 +11,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "temporal-cli";
-  version = "1.7.1";
+  version = "1.7.2";
 
   src = fetchFromGitHub {
     owner = "temporalio";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8e6sBlUC+N4P7FO4EOtc7sDzSAZwDovN+cGpV+rWObs=";
+    hash = "sha256-HlG/zBfyd120ENERqdpfPuHPwu84bWijzoE4tEOsOeE=";
   };
 
-  vendorHash = "sha256-N9K05Kcb0YaQO7M9gR22QzAOzbmgEhIqADcAESqYtQ8=";
+  vendorHash = "sha256-GI+rLSCwBRcZytbJsxqCL1+3p5/UbCvTxUHn2ele3+c=";
 
   __structuredAttrs = true;
 
diff --git a/pkgs/by-name/tr/tree-sitter/grammars/README.md b/pkgs/by-name/tr/tree-sitter/grammars/README.md
index 8d4ba768536e..9445f68494cb 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/README.md
+++ b/pkgs/by-name/tr/tree-sitter/grammars/README.md
@@ -109,6 +109,18 @@ This includes build-related flags and metadata.
 }
 ```
 
+## Building WebAssembly Parsers
+
+`buildGrammar` builds a native `$out/parser`.
+To build grammars as WebAssembly instead, use the `wasi32` cross package set, which installs `$out/parser.wasm`:
+
+```nix
+pkgsCross.wasi32.tree-sitter.builtGrammars.tree-sitter-nix
+```
+
+The Wasm build compiles `parser.c` and a C `scanner.c`.
+Grammars with C++ external scanners are rejected; use the native `buildGrammar` for those.
+
 ## Updating
 
 All grammar sources have a default update script defined.
diff --git a/pkgs/by-name/tr/tree-sitter/grammars/build-grammar.nix b/pkgs/by-name/tr/tree-sitter/grammars/build-grammar.nix
index 4694916fbc6f..a0795c617d6d 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/build-grammar.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/build-grammar.nix
@@ -16,6 +16,11 @@
   ...
 }@args:
 
+let
+  isWasi = stdenv.hostPlatform.isWasi;
+  parserOutput = if isWasi then "parser.wasm" else "parser";
+  exportSymbol = "tree_sitter_${lib.replaceStrings [ "-" ] [ "_" ] language}";
+in
 stdenv.mkDerivation (
   {
     pname = "tree-sitter-${language}";
@@ -32,11 +37,18 @@ stdenv.mkDerivation (
 
     CFLAGS = [
       "-Isrc"
-      "-O2"
+      # Match upstream `tree-sitter build --wasm`
+      (if isWasi then "-Os" else "-O2")
+    ]
+    ++ lib.optionals isWasi [
+      "-fvisibility=hidden"
     ];
     CXXFLAGS = [
       "-Isrc"
-      "-O2"
+      (if isWasi then "-Os" else "-O2")
+    ]
+    ++ lib.optionals isWasi [
+      "-fvisibility=hidden"
     ];
 
     stripDebugList = [ "parser" ];
@@ -90,25 +102,44 @@ stdenv.mkDerivation (
       tree-sitter generate
     '';
 
-    # When both scanner.{c,cc} exist, we should not link both since they may be the same but in
-    # different languages. Just randomly prefer C++ if that happens.
-    buildPhase = ''
-      runHook preBuild
-      if [[ -e src/scanner.cc ]]; then
-        $CXX -fPIC -c src/scanner.cc -o scanner.o $CXXFLAGS
-      elif [[ -e src/scanner.c ]]; then
-        $CC -fPIC -c src/scanner.c -o scanner.o $CFLAGS
-      fi
-      $CC -fPIC -c src/parser.c -o parser.o $CFLAGS
-      rm -rf parser
-      $CXX -shared -o parser *.o
-      runHook postBuild
-    '';
+    buildPhase =
+      if isWasi then
+        ''
+          runHook preBuild
+          if [[ -e src/scanner.cc || -e src/scanner.cpp ]]; then
+            nixErrorLog "tree-sitter wasm grammars only support C external scanners"
+            exit 1
+          fi
+          if [[ -e src/scanner.c ]]; then
+            $CC -fPIC -c src/scanner.c -o scanner.o $CFLAGS
+          fi
+          $CC -fPIC -c src/parser.c -o parser.o $CFLAGS
+          rm -rf parser.wasm
+          $CC -shared -o parser.wasm *.o \
+            -Wl,--export=${exportSymbol} \
+            -Wl,--allow-undefined \
+            -Wl,--no-entry \
+            -nostdlib
+          runHook postBuild
+        ''
+      else
+        ''
+          runHook preBuild
+          if [[ -e src/scanner.cc ]]; then
+            $CXX -fPIC -c src/scanner.cc -o scanner.o $CXXFLAGS
+          elif [[ -e src/scanner.c ]]; then
+            $CC -fPIC -c src/scanner.c -o scanner.o $CFLAGS
+          fi
+          $CC -fPIC -c src/parser.c -o parser.o $CFLAGS
+          rm -rf parser
+          $CXX -shared -o parser *.o
+          runHook postBuild
+        '';
 
     installPhase = ''
       runHook preInstall
       mkdir $out
-      mv parser $out/
+      mv ${parserOutput} $out/
       if [[ -f tree-sitter.json ]]; then
         cp tree-sitter.json $out/
       fi
diff --git a/pkgs/by-name/tr/tree-sitter/grammars/default.nix b/pkgs/by-name/tr/tree-sitter/grammars/default.nix
index da1c049d0d7e..237e0fd99c6a 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/default.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/default.nix
@@ -6,13 +6,14 @@
   fetchpatch,
   fetchFromCodeberg,
   nix-update-script,
+  stdenv,
 }:
 
 let
   /**
     Set of grammar sources. See ./grammar-sources.nix to define a new grammar.
   */
-  grammar-sources = import ./grammar-sources.nix { inherit lib fetchpatch; };
+  grammar-sources = import ./grammar-sources.nix { inherit lib fetchpatch stdenv; };
 
   /**
     Parse a flakeref style string to { type, owner, repo, ref }
diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index 52cda04c8c80..3b3bc22c085e 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -1,4 +1,8 @@
-{ fetchpatch, lib }:
+{
+  fetchpatch,
+  lib,
+  stdenv,
+}:
 
 {
 
@@ -1757,6 +1761,8 @@
     url = "github:nvim-neorg/tree-sitter-norg";
     hash = "sha256-z3h5qMuNKnpQgV62xZ02F5vWEq4VEnm5lxwEnIFu+Rw=";
     meta = {
+      # Uses a C++ external scanner, unsupported by the WASM grammar build.
+      broken = stdenv.hostPlatform.isWasi;
       license = lib.licenses.mit;
     };
   };
diff --git a/pkgs/by-name/tr/tree-sitter/package.nix b/pkgs/by-name/tr/tree-sitter/package.nix
index a456828b16b2..cc4522b35f21 100644
--- a/pkgs/by-name/tr/tree-sitter/package.nix
+++ b/pkgs/by-name/tr/tree-sitter/package.nix
@@ -10,6 +10,7 @@
   nix-update-script,
   which,
   rustPlatform,
+  runCommand,
   emscripten,
   openssl,
   pkg-config,
@@ -60,6 +61,7 @@ let
       fetchFromSourcehut
       fetchFromCodeberg
       fetchpatch
+      stdenv
       ;
   };
 
@@ -112,6 +114,8 @@ let
 
   allGrammars = lib.filter (p: !(p.meta.broken or false)) (lib.attrValues builtGrammars);
 
+  isWasi = stdenv.hostPlatform.isWasi;
+
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tree-sitter";
@@ -246,6 +250,19 @@ rustPlatform.buildRustPackage (finalAttrs: {
     tests = {
       # make sure all grammars build
       builtGrammars = lib.recurseIntoAttrs builtGrammars;
+    }
+    // lib.optionalAttrs isWasi {
+      wasmGrammar =
+        let
+          grammar = builtGrammars.tree-sitter-nix;
+        in
+        runCommand "tree-sitter-wasm-grammar-test" { } ''
+          test -f ${grammar}/parser.wasm
+          # WebAssembly binaries start with "\0asm".
+          test "$(od -An -tx1 -N4 ${grammar}/parser.wasm | tr -d ' \n')" = "0061736d"
+          test ! -e ${grammar}/parser
+          touch $out
+        '';
     };
   };
 
diff --git a/pkgs/by-name/uu/uutils-tar/package.nix b/pkgs/by-name/uu/uutils-tar/package.nix
index ca9bb5bb2386..47f69c0a9fbd 100644
--- a/pkgs/by-name/uu/uutils-tar/package.nix
+++ b/pkgs/by-name/uu/uutils-tar/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "uutils-tar";
-  version = "0-unstable-2026-06-15";
+  version = "0-unstable-2026-06-23";
 
   src = fetchFromGitHub {
     owner = "uutils";
     repo = "tar";
-    rev = "4c1c362e5766760b7ffc120f0ccf25a5344122c5";
-    hash = "sha256-oLa9KGqcSay3u6Jt3BMNz/evwS3g7u627qOhlqR+1Eg=";
+    rev = "ad4e2e31cc9547868dc9137c882db0ea45f89d32";
+    hash = "sha256-p4dkjLwV8SUDGx/atIajYW19+eDgC0AGlHzFOoVHFlA=";
   };
 
-  cargoHash = "sha256-xZqRhBq5zhCvJ6/qAXYNsylFpph6EiPobH0SuWHCtes=";
+  cargoHash = "sha256-aY0dJaYmpQkeFUcYJDnknwEdopa0Sf1hs4Yux+bSBDo=";
 
   cargoBuildFlags = [ "--workspace" ];
 
diff --git a/pkgs/by-name/ve/vencord/package.nix b/pkgs/by-name/ve/vencord/package.nix
index 866e5c01d1b3..bb443fed5f0e 100644
--- a/pkgs/by-name/ve/vencord/package.nix
+++ b/pkgs/by-name/ve/vencord/package.nix
@@ -22,13 +22,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "vencord";
-  version = "1.14.13";
+  version = "1.14.15";
 
   src = fetchFromGitHub {
     owner = "Vendicated";
     repo = "Vencord";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Xqk/akTa/NcHjSm6h77y6Fkvq7ayBcR0w0HG0Hwfkf8=";
+    hash = "sha256-jQeLZa1rpKDkzWSpAqOa8snGRKLpv9xf9cwJ6hUwMzA=";
   };
 
   patches = [ ./fix-deps.patch ];
@@ -46,8 +46,8 @@ stdenv.mkDerivation (finalAttrs: {
       postPatch
       ;
     inherit pnpm;
-    fetcherVersion = 3;
-    hash = "sha256-hk1rnNog5xvuIVI0M1ZJ5xrEuk0zcBiYsbROUycdi+A=";
+    fetcherVersion = 4;
+    hash = "sha256-pm5f6bGm07pzNCqpDHRyKFnuX2ZTE5w9BtJu5xXPHiI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/vu/vunnel/package.nix b/pkgs/by-name/vu/vunnel/package.nix
index 6fe7970d6090..ad000583b879 100644
--- a/pkgs/by-name/vu/vunnel/package.nix
+++ b/pkgs/by-name/vu/vunnel/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "vunnel";
-  version = "0.60.0";
+  version = "0.61.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = "vunnel";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CnWD021r5I9xH1YRp5RO520hq8eIHPJcPomq/UiJ9gA=";
+    hash = "sha256-rxA+BVu+TkegZ6RXirzlxPxpURXdFT6KvSNSPPlef7U=";
     leaveDotGit = true;
   };
 
diff --git a/pkgs/by-name/wa/wayback-machine-archiver/package.nix b/pkgs/by-name/wa/wayback-machine-archiver/package.nix
index cee762eee845..8a9d8bd414bd 100644
--- a/pkgs/by-name/wa/wayback-machine-archiver/package.nix
+++ b/pkgs/by-name/wa/wayback-machine-archiver/package.nix
@@ -1,43 +1,41 @@
 {
   lib,
-  python3,
+  python3Packages,
   fetchFromGitHub,
 }:
 
-python3.pkgs.buildPythonApplication (finalAttrs: {
+python3Packages.buildPythonApplication (finalAttrs: {
   pname = "wayback-machine-archiver";
-  version = "1.9.1";
+  version = "3.5.2";
   pyproject = true;
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "agude";
     repo = "wayback-machine-archiver";
-    rev = "v${finalAttrs.version}";
-    sha256 = "0dnnqx507gpj8wsx6f2ivfmha969ydayiqsvxh23p9qcixw9257x";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-LUWPc1wMSpBIdaje/pbmQYHTrYog/9UiphMY1fzxgPc=";
   };
 
-  build-system = with python3.pkgs; [
-    setuptools
-    pypandoc
+  build-system = with python3Packages; [ setuptools ];
+
+  dependencies = with python3Packages; [
+    requests
+    python-dotenv
   ];
 
-  dependencies = with python3.pkgs; [ requests ];
-
-  nativeCheckInputs = with python3.pkgs; [
+  nativeCheckInputs = with python3Packages; [
     pytestCheckHook
     requests-mock
   ];
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace-fail \"pytest-runner\", ""
-  '';
-
   pythonImportsCheck = [ "wayback_machine_archiver" ];
 
   meta = {
     description = "Python script to submit web pages to the Wayback Machine for archiving";
     homepage = "https://github.com/agude/wayback-machine-archiver";
+    changelog = "https://github.com/agude/wayback-machine-archiver/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ dandellion ];
     mainProgram = "archiver";
diff --git a/pkgs/by-name/we/werf/package.nix b/pkgs/by-name/we/werf/package.nix
index f23576bdbbd3..d155117d3932 100644
--- a/pkgs/by-name/we/werf/package.nix
+++ b/pkgs/by-name/we/werf/package.nix
@@ -10,17 +10,17 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "werf";
-  version = "2.70.0";
+  version = "2.72.1";
 
   src = fetchFromGitHub {
     owner = "werf";
     repo = "werf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3Oe/IjmzD7+LE6OVLACDgknrl4cb9yJ/lDvKBjrvFNQ=";
+    hash = "sha256-6CspoMRKPf20zQrmgD2RO6xMnTuyvM56AElKvMNNUM0=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-iMoR38Qb2utzdkhKUrCQ0Ohm8f6jdYTuLkeMhCLqvN4=";
+  vendorHash = "sha256-Ot2P417uqtdpxBd46NelxThF4Ca7krIInVfJ4OxnTRI=";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs =
diff --git a/pkgs/by-name/xr/xray/package.nix b/pkgs/by-name/xr/xray/package.nix
index 326d1b985367..4ebd26870f5b 100644
--- a/pkgs/by-name/xr/xray/package.nix
+++ b/pkgs/by-name/xr/xray/package.nix
@@ -5,11 +5,9 @@
   buildGo126Module,
   makeWrapper,
   nix-update-script,
-  v2ray-geoip,
-  v2ray-domain-list-community,
+  v2ray-rules-dat,
   assets ? [
-    v2ray-geoip
-    v2ray-domain-list-community
+    v2ray-rules-dat
   ],
 }:
 
diff --git a/pkgs/by-name/za/zammad/gemset.nix b/pkgs/by-name/za/zammad/gemset.nix
index 569ee406bec6..5c5028458e80 100644
--- a/pkgs/by-name/za/zammad/gemset.nix
+++ b/pkgs/by-name/za/zammad/gemset.nix
@@ -798,10 +798,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1aymcakhzl83k77g2f2krz07bg1cbafbcd2ghvwr4lky3rz86mkb";
+      sha256 = "1c2i64xsd35vijnb50rxb70g508s0x674xi0qpyyb8jy7bncl4j4";
       type = "gem";
     };
-    version = "1.3.6";
+    version = "1.3.7";
   };
   connection_pool = {
     groups = [
@@ -1355,10 +1355,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1b930ag8nh99v8n9645ac1wcah9fx0mclbp323q4i1ly9acvkk3k";
+      sha256 = "0y7j6yzv07zggic6g0p2v1ivnvkzsbqjnfdl4215qqb6cxz290hq";
       type = "gem";
     };
-    version = "2.14.2";
+    version = "2.14.3";
   };
   faraday-follow_redirects = {
     dependencies = [ "faraday" ];
@@ -1815,10 +1815,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1anz6a6n33x4s3906s0bz6x161kk1ns3h7xxsn3rpxkfsw7k2m33";
+      sha256 = "16mp8vzgxa8nsa81np042za453j8b0ihpjkf666s7byxrnvjb44v";
       type = "gem";
     };
-    version = "2.19.8";
+    version = "2.19.9";
   };
   json-jwt = {
     dependencies = [
@@ -2325,10 +2325,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1s30b7h7qpyim30m8060xs415mbr3ci7i5hdg09chh1aqfx2qcbq";
+      sha256 = "1d9safb4dly6qmc2g06444l0zifby52yy6j1a5fa1g4j3ihm3jah";
       type = "gem";
     };
-    version = "1.19.3";
+    version = "1.19.4";
   };
   nori = {
     dependencies = [ "bigdecimal" ];
diff --git a/pkgs/by-name/za/zammad/package.nix b/pkgs/by-name/za/zammad/package.nix
index 0edc3b7e1938..ea0355f1e752 100644
--- a/pkgs/by-name/za/zammad/package.nix
+++ b/pkgs/by-name/za/zammad/package.nix
@@ -23,7 +23,7 @@
 
 let
   pname = "zammad";
-  version = "7.1.0";
+  version = "7.1.1";
 
   src = applyPatches {
     src = fetchFromGitHub (lib.importJSON ./source.json);
diff --git a/pkgs/by-name/za/zammad/source.json b/pkgs/by-name/za/zammad/source.json
index 7d0628d23c2e..e2115200a444 100644
--- a/pkgs/by-name/za/zammad/source.json
+++ b/pkgs/by-name/za/zammad/source.json
@@ -1,8 +1,8 @@
 {
   "owner": "zammad",
   "repo": "zammad",
-  "rev": "ecbb861ce33908e4b52bb2c78d816a0eef69e6a6",
-  "hash": "sha256-5mK120Oo8LEIA7yY9erc57WRUeCwzsIamTiAxPgePIQ=",
+  "rev": "cdd01e9160ec4b90e869ccf4aa3d99eb223032e7",
+  "hash": "sha256-BCrvhH5pgqG2jM3qE4NmtHXzKuSELHhI0QU3KIXUbMo=",
   "fetchSubmodules": true
 }
 
diff --git a/pkgs/by-name/ze/zensical/package.nix b/pkgs/by-name/ze/zensical/package.nix
index 885e498be641..d6b758b881e8 100644
--- a/pkgs/by-name/ze/zensical/package.nix
+++ b/pkgs/by-name/ze/zensical/package.nix
@@ -8,7 +8,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "zensical";
-  version = "0.0.45";
+  version = "0.0.46";
   pyproject = true;
 
   # We fetch from PyPi, because GitHub repo does not contain all sources.
@@ -16,12 +16,12 @@ python3Packages.buildPythonApplication (finalAttrs: {
   # We could combine sources, but then nix-update won't work.
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-MVvOSrBHAzjdNYit04+zJfhAhWw3VyLmgCvVigZEYmY=";
+    hash = "sha256-PsIfT7HnjNfA1rB64zawR3Die6Ag2rxFeyeQ5dNPGXg=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-f2CNYnHLZrffyMw/lZq/cVb5sB1+CfZzlAtQUMvlwqE=";
+    hash = "sha256-RNd7C6dRfH59ah2rbwYuwJGU+mDZKqXUwFX8+NfLkgY=";
   };
 
   nativeBuildInputs = with rustPlatform; [
diff --git a/pkgs/by-name/ze/zeyple/package.nix b/pkgs/by-name/ze/zeyple/package.nix
index dabdc8618f52..3b9dd290e361 100644
--- a/pkgs/by-name/ze/zeyple/package.nix
+++ b/pkgs/by-name/ze/zeyple/package.nix
@@ -23,7 +23,7 @@ python3Packages.buildPythonApplication {
       --replace-fail 'from configparser import SafeConfigParser' 'from configparser import ConfigParser as SafeConfigParser'
   '';
 
-  propagatedBuildInputs = [ python3Packages.gpgme ];
+  propagatedBuildInputs = [ python3Packages.gpg ];
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/development/python-modules/aioamazondevices/default.nix b/pkgs/development/python-modules/aioamazondevices/default.nix
index 1485a7b4fe7b..33b50271220e 100644
--- a/pkgs/development/python-modules/aioamazondevices/default.nix
+++ b/pkgs/development/python-modules/aioamazondevices/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "aioamazondevices";
-  version = "14.1.3";
+  version = "14.1.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "chemelli74";
     repo = "aioamazondevices";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-MUPj3smDMOCV+g1cC6YKWSGYvB1UD8OKzlil61H4rZg=";
+    hash = "sha256-54nlWZGLYTHbieVtYqUyP1Y3VZ98NhDEnmSzx+cPfJQ=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/aioecowitt/default.nix b/pkgs/development/python-modules/aioecowitt/default.nix
index 1e6f5b5a6bfc..81f42e2bc72e 100644
--- a/pkgs/development/python-modules/aioecowitt/default.nix
+++ b/pkgs/development/python-modules/aioecowitt/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "aioecowitt";
-  version = "2025.9.2";
+  version = "2026.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "home-assistant-libs";
     repo = "aioecowitt";
     tag = version;
-    hash = "sha256-lQ2t8u3+sk8wnNfCZs2yhe9nsZwiGBHXPDz95egacsI=";
+    hash = "sha256-xnF2Zn0XfV7elYGPCfY0WKzmDyFKXU3yh6Bab7llbzw=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/alibabacloud-credentials-api/default.nix b/pkgs/development/python-modules/alibabacloud-credentials-api/default.nix
index dfd6acf241bc..f4b886370051 100644
--- a/pkgs/development/python-modules/alibabacloud-credentials-api/default.nix
+++ b/pkgs/development/python-modules/alibabacloud-credentials-api/default.nix
@@ -7,12 +7,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "alibabacloud-credentials-api";
-  version = "1.0.0";
+  version = "1.0.1";
   pyproject = true;
 
   src = fetchPypi {
-    inherit (finalAttrs) pname version;
-    hash = "sha256-jDQAONkE8CGNchSo9AiMMZEr/PJ5ryy8fZvkiXqX3S8=";
+    pname = "alibabacloud_credentials_api";
+    inherit (finalAttrs) version;
+    hash = "sha256-jqBmimVY9pVrjSCy5WHRmoDqKcIs9WowBNQ0skqYGzY=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/alibabacloud-gateway-spi/default.nix b/pkgs/development/python-modules/alibabacloud-gateway-spi/default.nix
index c10f0691555b..eaeca6fb43a8 100644
--- a/pkgs/development/python-modules/alibabacloud-gateway-spi/default.nix
+++ b/pkgs/development/python-modules/alibabacloud-gateway-spi/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "alibabacloud-gateway-spi";
-  version = "0.0.3";
+  version = "0.0.4";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -16,7 +16,7 @@ buildPythonPackage (finalAttrs: {
   src = fetchPypi {
     pname = "alibabacloud_gateway_spi";
     inherit (finalAttrs) version;
-    hash = "sha256-ENHFOj/F+HkV+9a0mFuYM4p3bptEoCY/VmQ8UEgiO4s=";
+    hash = "sha256-c9biDWW1Tu0m2JwZZA06dXLhjEXsraYn+Ab12+jtITA=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/badsecrets/default.nix b/pkgs/development/python-modules/badsecrets/default.nix
index 734a80b35e4d..69fafd23c523 100644
--- a/pkgs/development/python-modules/badsecrets/default.nix
+++ b/pkgs/development/python-modules/badsecrets/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "badsecrets";
-  version = "1.2.0";
+  version = "1.2.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "blacklanternsecurity";
     repo = "badsecrets";
     tag = finalAttrs.version;
-    hash = "sha256-fhRQvVb+JUP1DyTMAV7leIAKD/L4kRhGFYtD78cYABI=";
+    hash = "sha256-I0CyY8FVFFPRBK04zZ1v2WSv4ovRATZmAWLGwE0Q4pQ=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/banks/default.nix b/pkgs/development/python-modules/banks/default.nix
index a3dd269437bc..c4bc1a3f1d80 100644
--- a/pkgs/development/python-modules/banks/default.nix
+++ b/pkgs/development/python-modules/banks/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "banks";
-  version = "2.4.3";
+  version = "2.4.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "masci";
     repo = "banks";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6B/jbvW+nfsruPJMk+z5SP2LS85MYOlmMpBYHypUOHA=";
+    hash = "sha256-LlUVwGCcY/CA0XTjpppv6QNnyagDZR6+SaRfkyHVBw4=";
   };
 
   env.SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
diff --git a/pkgs/development/python-modules/cyscale/default.nix b/pkgs/development/python-modules/cyscale/default.nix
index 61b0c62a7d45..b47e6c501615 100644
--- a/pkgs/development/python-modules/cyscale/default.nix
+++ b/pkgs/development/python-modules/cyscale/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "cyscale";
-  version = "0.4.0";
+  version = "0.5.0";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -19,7 +19,7 @@ buildPythonPackage (finalAttrs: {
     owner = "latent-to";
     repo = "cyscale";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QkIyb00/KIVicdX/k3UhjGSvcwQ+yxcSAkMlC7tVpLM=";
+    hash = "sha256-/Jhg7n28rjiNyuthX9cCbOtpyfPp0xgBaUpiZ1pBxRA=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/dulwich/default.nix b/pkgs/development/python-modules/dulwich/default.nix
index 734517b5f0bd..e553dbb15dc7 100644
--- a/pkgs/development/python-modules/dulwich/default.nix
+++ b/pkgs/development/python-modules/dulwich/default.nix
@@ -9,7 +9,7 @@
   git,
   glibcLocales,
   gnupg,
-  gpgme,
+  gpg,
   merge3,
   nix-update-script,
   openssh,
@@ -61,7 +61,7 @@ buildPythonPackage (finalAttrs: {
     https = [ urllib3 ];
     merge = [ merge3 ];
     pgp = [
-      gpgme
+      gpg
       gnupg
     ];
     paramiko = [ paramiko ];
diff --git a/pkgs/development/python-modules/exa-py/default.nix b/pkgs/development/python-modules/exa-py/default.nix
index 2566261e5276..ba44908b4516 100644
--- a/pkgs/development/python-modules/exa-py/default.nix
+++ b/pkgs/development/python-modules/exa-py/default.nix
@@ -20,14 +20,11 @@
   pytest-cov-stub,
   pytest-mock,
   pytestCheckHook,
-
-  # passthru
-  unstableGitUpdater,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "exa-py";
-  version = "2.13.1-unstable-2026-06-03";
+  version = "2.14.0";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -35,8 +32,8 @@ buildPythonPackage (finalAttrs: {
   src = fetchFromGitHub {
     owner = "exa-labs";
     repo = "exa-py";
-    rev = "42fde906ecd069c15ad4888e1585b395a0db7edf";
-    hash = "sha256-6o4SKAeP5q+57LCbbw5vP7r/dEA1HiQNa9CkopbTlxg=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-pL5d79KdKlfv4l/M7PF8fs0gUEk4DYEKPm8PJ+pwFMc=";
   };
 
   build-system = [
@@ -66,11 +63,10 @@ buildPythonPackage (finalAttrs: {
 
   pytestFlags = [ "tests/" ];
 
-  passthru.updateScript = unstableGitUpdater { };
-
   meta = {
     description = "Official Python SDK for Exa, the web search API for AI";
     homepage = "https://github.com/exa-labs/exa-py/";
+    changelog = "https://github.com/exa-labs/exa-py/releases/tag/v${finalAttrs.version}";
     maintainers = with lib.maintainers; [ ethancedwards8 ];
     license = lib.licenses.mit;
   };
diff --git a/pkgs/development/python-modules/geotorch/default.nix b/pkgs/development/python-modules/geotorch/default.nix
index 12c4e14c5941..68f3502308de 100644
--- a/pkgs/development/python-modules/geotorch/default.nix
+++ b/pkgs/development/python-modules/geotorch/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "geotorch";
-  version = "0.3.0";
+  version = "0.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lezcano";
     repo = "geotorch";
     tag = version;
-    hash = "sha256-kkn0PZzQRodXCeX3RcajVvrp1TrhSVgKYwyJGAMuvLM=";
+    hash = "sha256-mMVgN8ZmedSz5VxAAE7vdvmZXiP5y3GkO60o5hCSHn8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-org-policy/default.nix b/pkgs/development/python-modules/google-cloud-org-policy/default.nix
index 15ded2114cd0..a7a5f5428047 100644
--- a/pkgs/development/python-modules/google-cloud-org-policy/default.nix
+++ b/pkgs/development/python-modules/google-cloud-org-policy/default.nix
@@ -12,13 +12,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "google-cloud-org-policy";
-  version = "1.17.0";
+  version = "1.18.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_org_policy";
     inherit (finalAttrs) version;
-    hash = "sha256-93GJ7n9loo83VfhV9xC4tnuYYuKmtqk7B15vnak7/yA=";
+    hash = "sha256-QeMwz8gzhj0QprX1/6oqEtD+Lwj6A9YZ+qrXRK6Nkis=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-redis/default.nix b/pkgs/development/python-modules/google-cloud-redis/default.nix
index 5fc0a98412f3..5099d3b414f8 100644
--- a/pkgs/development/python-modules/google-cloud-redis/default.nix
+++ b/pkgs/development/python-modules/google-cloud-redis/default.nix
@@ -12,13 +12,13 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-redis";
-  version = "2.21.0";
+  version = "2.22.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_redis";
     inherit version;
-    hash = "sha256-6ulUf+zR5wLWoc5wHGgZ1Rp+bEjNUmdZlIRXx+EkEUI=";
+    hash = "sha256-EFysFdIdh87u5BhHYY8A6mzKqjYLiws/0uQveaI9CGg=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-videointelligence/default.nix b/pkgs/development/python-modules/google-cloud-videointelligence/default.nix
index 5173483e2350..bd8325d2d9b9 100644
--- a/pkgs/development/python-modules/google-cloud-videointelligence/default.nix
+++ b/pkgs/development/python-modules/google-cloud-videointelligence/default.nix
@@ -12,15 +12,15 @@
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "google-cloud-videointelligence";
-  version = "2.19.0";
+  version = "2.20.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_videointelligence";
-    inherit version;
-    hash = "sha256-ezIMGKBHWwjd6bYKD7/fiRUyDCCWYVn62AtVlAidVh4=";
+    inherit (finalAttrs) version;
+    hash = "sha256-5EktMzhD8EAZG0cw/1igpK6hAINQBTh5vEBY3fYtqKA=";
   };
 
   build-system = [ setuptools ];
@@ -60,8 +60,8 @@ buildPythonPackage rec {
   meta = {
     description = "Google Cloud Video Intelligence API client library";
     homepage = "https://github.com/googleapis/google-cloud-python/tree/main/packages/google-cloud-videointelligence";
-    changelog = "https://github.com/googleapis/google-cloud-python/blob/google-cloud-videointelligence-v${version}/packages/google-cloud-videointelligence/CHANGELOG.md";
+    changelog = "https://github.com/googleapis/google-cloud-python/blob/google-cloud-videointelligence-v${finalAttrs.version}/packages/google-cloud-videointelligence/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/gpgme/default.nix b/pkgs/development/python-modules/gpg/default.nix
similarity index 98%
rename from pkgs/development/python-modules/gpgme/default.nix
rename to pkgs/development/python-modules/gpg/default.nix
index 1aa561bee793..6e2f0991315b 100644
--- a/pkgs/development/python-modules/gpgme/default.nix
+++ b/pkgs/development/python-modules/gpg/default.nix
@@ -11,7 +11,7 @@
 }:
 
 buildPythonPackage rec {
-  pname = "gpgme";
+  pname = "gpg";
   version = "2.0.0";
   pyproject = true;
 
diff --git a/pkgs/development/python-modules/ida-hcli/default.nix b/pkgs/development/python-modules/ida-hcli/default.nix
index 2c2d7cd64819..aa8e33bf764b 100644
--- a/pkgs/development/python-modules/ida-hcli/default.nix
+++ b/pkgs/development/python-modules/ida-hcli/default.nix
@@ -27,7 +27,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "ida-hcli";
-  version = "0.18.2";
+  version = "0.18.3";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -36,7 +36,7 @@ buildPythonPackage (finalAttrs: {
     owner = "HexRaysSA";
     repo = "ida-hcli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rxeu9vAH4O80wjmLvHREOL0MhKpUEilU04S5KqN5/IQ=";
+    hash = "sha256-5ymjKms3qtprIwd81PpmXgewDi4jSLlblgD/9b8Kzt8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/itables/default.nix b/pkgs/development/python-modules/itables/default.nix
index b367545cb49b..adb7eca7b2ce 100644
--- a/pkgs/development/python-modules/itables/default.nix
+++ b/pkgs/development/python-modules/itables/default.nix
@@ -31,7 +31,7 @@
 
 buildPythonPackage rec {
   pname = "itables";
-  version = "2.8.0";
+  version = "2.8.1";
 
   # itables has 4 different node packages, each with their own
   # package-lock.json, and partially depending on each other.
@@ -39,7 +39,7 @@ buildPythonPackage rec {
   # the source tarball from pypi, which includes the javascript bundle already.
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-uDJfvb0GEATyHqYkJZROXnGmTCpkhJlk4KSwAM3nA2I=";
+    hash = "sha256-Vix9cW1mfz+vh//hBEoZdHo7Ix7mqncl62+QjKoYxCk=";
   };
 
   pyproject = true;
diff --git a/pkgs/development/python-modules/node-semver/default.nix b/pkgs/development/python-modules/node-semver/default.nix
index f10de9353862..a802c02e0ee9 100644
--- a/pkgs/development/python-modules/node-semver/default.nix
+++ b/pkgs/development/python-modules/node-semver/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "node-semver";
-  version = "0.9.0";
+  version = "0.9.1";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "podhmo";
     repo = "python-node-semver";
     tag = version;
-    hash = "sha256-Ncl+RUvy9G9lF3EzLz2HfiDB02tEgAlZ34Wbn4mlF6Y=";
+    hash = "sha256-akeFBF0za4DjcYfR4/M06D5M19o+4xqfyuG74FPSDBU=";
   };
 
   nativeCheckInputs = [ pytestCheckHook ];
diff --git a/pkgs/development/python-modules/playwrightcapture/default.nix b/pkgs/development/python-modules/playwrightcapture/default.nix
index ad55a96b3d7e..a1458505117d 100644
--- a/pkgs/development/python-modules/playwrightcapture/default.nix
+++ b/pkgs/development/python-modules/playwrightcapture/default.nix
@@ -24,16 +24,16 @@
   w3lib,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "playwrightcapture";
-  version = "1.39.12";
+  version = "1.40.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Lookyloo";
     repo = "PlaywrightCapture";
-    tag = "v${version}";
-    hash = "sha256-k+mzrgw4BvTGmjp/j521BQKwnaHrcNrr/9U2mgzsf8E=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-H1zxPsLF6D8CJ89+WeRYKj4SXNVTCCd7AV5BW7Zcm4k=";
   };
 
   pythonRelaxDeps = [
@@ -84,8 +84,8 @@ buildPythonPackage rec {
   meta = {
     description = "Capture a URL with Playwright";
     homepage = "https://github.com/Lookyloo/PlaywrightCapture";
-    changelog = "https://github.com/Lookyloo/PlaywrightCapture/releases/tag/${src.tag}";
+    changelog = "https://github.com/Lookyloo/PlaywrightCapture/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/pygitguardian/default.nix b/pkgs/development/python-modules/pygitguardian/default.nix
index 64d46ce9d32f..51cccda9e2e1 100644
--- a/pkgs/development/python-modules/pygitguardian/default.nix
+++ b/pkgs/development/python-modules/pygitguardian/default.nix
@@ -15,21 +15,16 @@
 
 buildPythonPackage rec {
   pname = "pygitguardian";
-  version = "1.30.0";
+  version = "1.32.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "GitGuardian";
     repo = "py-gitguardian";
     tag = "v${version}";
-    hash = "sha256-8kKTqthpkH3A5secb8TqbM+/twA77R81y80MOPNQZPA=";
+    hash = "sha256-f8DkRwgtwaB5R78zklAI0ZvA2gfSwsHFOS3IgDgcEEo=";
   };
 
-  pythonRelaxDeps = [
-    "marshmallow-dataclass"
-    "setuptools"
-  ];
-
   build-system = [ pdm-backend ];
 
   dependencies = [
@@ -53,10 +48,8 @@ buildPythonPackage rec {
   meta = {
     description = "Library to access the GitGuardian API";
     homepage = "https://github.com/GitGuardian/py-gitguardian";
-    changelog = "https://github.com/GitGuardian/py-gitguardian/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/GitGuardian/py-gitguardian/blob/${src.rev}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
-    # https://github.com/GitGuardian/py-gitguardian/issues/167
-    broken = lib.versionAtLeast marshmallow.version "4";
   };
 }
diff --git a/pkgs/development/python-modules/pygpgme/default.nix b/pkgs/development/python-modules/pygpgme/default.nix
index 0b3e07ee068c..f04f0898c6b7 100644
--- a/pkgs/development/python-modules/pygpgme/default.nix
+++ b/pkgs/development/python-modules/pygpgme/default.nix
@@ -2,7 +2,7 @@
   lib,
   buildPythonPackage,
   fetchurl,
-  gpgme,
+  gpg,
   isPyPy,
   pythonAtLeast,
 }:
@@ -24,7 +24,7 @@ buildPythonPackage rec {
   # error: invalid command 'test'
   doCheck = false;
 
-  propagatedBuildInputs = [ gpgme ];
+  propagatedBuildInputs = [ gpg ];
 
   meta = {
     homepage = "https://launchpad.net/pygpgme";
diff --git a/pkgs/development/python-modules/pyswitchbot/default.nix b/pkgs/development/python-modules/pyswitchbot/default.nix
index 3cb0deac7894..4d0c44cfec49 100644
--- a/pkgs/development/python-modules/pyswitchbot/default.nix
+++ b/pkgs/development/python-modules/pyswitchbot/default.nix
@@ -1,30 +1,31 @@
 {
   lib,
   aiohttp,
-  bleak,
   bleak-retry-connector,
+  bleak,
   buildPythonPackage,
   cryptography,
   fetchFromGitHub,
+  poetry-core,
   pyopenssl,
   pytest-asyncio,
+  pytest-cov-stub,
   pytestCheckHook,
-  setuptools,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "pyswitchbot";
-  version = "2.2.0";
+  version = "2.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Danielhiversen";
     repo = "pySwitchbot";
     tag = finalAttrs.version;
-    hash = "sha256-uBHDOAitnVTFGuwzz9at0X6Mr54feMeKiFG/9CqIN4g=";
+    hash = "sha256-sJM7keXUdDC/qaeZSP8DAVzy/15/ilz/53CZE+KgB9Y=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [ poetry-core ];
 
   dependencies = [
     aiohttp
@@ -36,6 +37,7 @@ buildPythonPackage (finalAttrs: {
 
   nativeCheckInputs = [
     pytest-asyncio
+    pytest-cov-stub
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/pyvlx/default.nix b/pkgs/development/python-modules/pyvlx/default.nix
index 7808b5486e57..f9755c505da3 100644
--- a/pkgs/development/python-modules/pyvlx/default.nix
+++ b/pkgs/development/python-modules/pyvlx/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pyvlx";
-  version = "0.2.35";
+  version = "0.2.36";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Julius2342";
     repo = "pyvlx";
     tag = finalAttrs.version;
-    hash = "sha256-NdS1Arx2XaHCltpE3VPwghRTGQcskUmXoEuauyAmMUU=";
+    hash = "sha256-Kmwbw9hUryeSvdJ9ru0zGYaEN3ZKtAbuakLASzTDH2g=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/rapidfuzz/default.nix b/pkgs/development/python-modules/rapidfuzz/default.nix
index 64d39f70ac98..70dd56e9c192 100644
--- a/pkgs/development/python-modules/rapidfuzz/default.nix
+++ b/pkgs/development/python-modules/rapidfuzz/default.nix
@@ -3,6 +3,7 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch,
   clang-tools,
   cmake,
   cython,
@@ -28,6 +29,15 @@ buildPythonPackage rec {
     hash = "sha256-wF7eeSD6GQfN0EOwDvrgjMqN5u2wxXFlktQS7nIKgkU=";
   };
 
+  patches = [
+    (fetchpatch {
+      # https://github.com/rapidfuzz/RapidFuzz/pull/486
+      name = "support-taskflow-4.1.0.patch";
+      url = "https://github.com/rapidfuzz/RapidFuzz/commit/76fa54bf8c3f2d24879ca1966ea98bbba7b3c9d6.patch";
+      hash = "sha256-hJZtYNLSqK5NgcBAcvrf9NPh3Z0+pSlyy0W+uJ96kBQ=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace-fail "Cython >=3.1.6, <3.3.0" "Cython >=3.1.6"
diff --git a/pkgs/development/python-modules/synchronicity/default.nix b/pkgs/development/python-modules/synchronicity/default.nix
index 6285888a6def..6159c5869090 100644
--- a/pkgs/development/python-modules/synchronicity/default.nix
+++ b/pkgs/development/python-modules/synchronicity/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "synchronicity";
-  version = "0.12.4";
+  version = "0.12.5";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -32,7 +32,7 @@ buildPythonPackage (finalAttrs: {
     owner = "modal-labs";
     repo = "synchronicity";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Ny2TdzNJYNV02cFQoxY0HlfeQAy3Ewea+NusL6l5tSg=";
+    hash = "sha256-npn6SX3NV0Vcq305zyi0jEFGpdyoTESpnDTyuf+WKsQ=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index 198621e34494..107cb41190a8 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "tencentcloud-sdk-python";
-  version = "3.1.122";
+  version = "3.1.123";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = finalAttrs.version;
-    hash = "sha256-7d8WdODzOG+zkz+Y9f2OpdL2z5i12QZFOzOpGrVGUXY=";
+    hash = "sha256-rX55rckAb3+rVobAKc3arWU99njl2VLEXYdLcdNI+5g=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/transformer-engine/default.nix b/pkgs/development/python-modules/transformer-engine/default.nix
index 6a656dd359d8..db8647113d7e 100644
--- a/pkgs/development/python-modules/transformer-engine/default.nix
+++ b/pkgs/development/python-modules/transformer-engine/default.nix
@@ -80,7 +80,7 @@ let
 in
 buildPythonPackage.override { stdenv = backendStdenv; } (finalAttrs: {
   pname = "transformer-engine";
-  version = "2.16";
+  version = "2.16.1";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -90,7 +90,7 @@ buildPythonPackage.override { stdenv = backendStdenv; } (finalAttrs: {
     tag = "v${finalAttrs.version}";
     # Their CMakeLists.txt does not easily let us inject dependencies
     fetchSubmodules = true;
-    hash = "sha256-PUs/qIdF894232GmdjLsDD2rzU5NPTt/u20v93yZTog=";
+    hash = "sha256-jYQZwgBedpCALhXYw2qH7PwIoSz6ttUje78xjdF+CYc=";
   };
 
   patches = optionals cudaSupport [
diff --git a/pkgs/development/python-modules/tyro/default.nix b/pkgs/development/python-modules/tyro/default.nix
index 041bc378ba88..44a0d6cc1ded 100644
--- a/pkgs/development/python-modules/tyro/default.nix
+++ b/pkgs/development/python-modules/tyro/default.nix
@@ -25,14 +25,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "tyro";
-  version = "1.0.13";
+  version = "1.0.15";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "brentyi";
     repo = "tyro";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Ux0bAF96KGhsy9b7NvybJpMKQP2G6BsQwnew0c44tXM=";
+    hash = "sha256-mnYVinyys21BjHRhwOLjc3n8mShH2+krEK0dK0VBWp4=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/udtools/default.nix b/pkgs/development/python-modules/udtools/default.nix
index 5f85c78baf29..80fdab794762 100644
--- a/pkgs/development/python-modules/udtools/default.nix
+++ b/pkgs/development/python-modules/udtools/default.nix
@@ -5,6 +5,7 @@
   fetchFromGitHub,
   python,
   setuptools,
+  pytestCheckHook,
   # dependencies
   regex,
   udapi,
@@ -12,14 +13,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "udtools";
-  version = "0.2.7";
+  version = "0.2.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "UniversalDependencies";
     repo = "tools";
     tag = "py${finalAttrs.version}";
-    hash = "sha256-P1gx6JRq1oWCXzB2uO/eCrw8ZgJ+0Y/0cvlLtj+X7SY=";
+    hash = "sha256-PeMIjxHU99HHNwT/D6UiS5HqxXj66ngRTYfA1xn9uOw=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/udtools";
@@ -31,9 +32,8 @@ buildPythonPackage (finalAttrs: {
     regex
   ];
 
-  # pycheck tests are not enabled because they try to import packages/types
-  # that I can't seem to find anywhere on the internet.
-  # https://github.com/UniversalDependencies/tools/issues/158
+  nativeCheckInputs = [ pytestCheckHook ];
+
   pythonImportsCheck = [ "udtools" ];
 
   passthru.updateScript = nix-update-script {
diff --git a/pkgs/development/python-modules/xstatic-bootstrap/default.nix b/pkgs/development/python-modules/xstatic-bootstrap/default.nix
index 1e1933d4412f..47d84b74a5f6 100644
--- a/pkgs/development/python-modules/xstatic-bootstrap/default.nix
+++ b/pkgs/development/python-modules/xstatic-bootstrap/default.nix
@@ -2,26 +2,33 @@
   buildPythonPackage,
   lib,
   fetchPypi,
+  setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "xstatic-bootstrap";
   version = "5.3.8.0";
-  format = "setuptools";
+  pyproject = true;
+
+  __structuredAttrs = true;
 
   src = fetchPypi {
     pname = "xstatic_bootstrap";
-    inherit version;
+    inherit (finalAttrs) version;
     hash = "sha256-BPXMlbvlQ40ehR0GxMoa1/hL02oJtN5aH1S1JOhQaFk=";
   };
 
+  build-system = [ setuptools ];
+
   # no tests implemented
   doCheck = false;
 
+  pythonImportsCheck = [ "xstatic.pkg.bootstrap" ];
+
   meta = {
     homepage = "https://getbootstrap.com";
     description = "Bootstrap packaged static files for python";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ makefu ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/xstatic-jquery-file-upload/default.nix b/pkgs/development/python-modules/xstatic-jquery-file-upload/default.nix
index 9c98ffcb4e2c..467cf4247db4 100644
--- a/pkgs/development/python-modules/xstatic-jquery-file-upload/default.nix
+++ b/pkgs/development/python-modules/xstatic-jquery-file-upload/default.nix
@@ -2,29 +2,36 @@
   buildPythonPackage,
   lib,
   fetchPypi,
+  setuptools,
   xstatic-jquery,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "xstatic-jquery-file-upload";
   version = "10.31.0.1";
-  format = "setuptools";
+  pyproject = true;
+
+  __structuredAttrs = true;
 
   src = fetchPypi {
     pname = "XStatic-jQuery-File-Upload";
-    inherit version;
-    sha256 = "7d716f26aca14732c35c54f0ba6d38187600ab472fc98a91d972d12c5a70db27";
+    inherit (finalAttrs) version;
+    hash = "sha256-fXFvJqyhRzLDXFTwum04GHYAq0cvyYqR2XLRLFpw2yc=";
   };
 
+  build-system = [ setuptools ];
+
   # no tests implemented
   doCheck = false;
 
-  propagatedBuildInputs = [ xstatic-jquery ];
+  dependencies = [ xstatic-jquery ];
+
+  pythonImportsCheck = [ "xstatic.pkg.jquery_file_upload" ];
 
   meta = {
-    homepage = "https://plugins.jquery.com/project/jQuery-File-Upload";
+    homepage = "https://github.com/blueimp/jQuery-File-Upload";
     description = "jquery-file-upload packaged static files for python";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ makefu ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/xstatic-jquery-ui/default.nix b/pkgs/development/python-modules/xstatic-jquery-ui/default.nix
index 018ceccc13b2..56ef542084f1 100644
--- a/pkgs/development/python-modules/xstatic-jquery-ui/default.nix
+++ b/pkgs/development/python-modules/xstatic-jquery-ui/default.nix
@@ -2,24 +2,31 @@
   buildPythonPackage,
   lib,
   fetchPypi,
+  setuptools,
   xstatic-jquery,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "xstatic-jquery-ui";
   version = "1.13.0.1";
-  format = "setuptools";
+  pyproject = true;
+
+  __structuredAttrs = true;
 
   src = fetchPypi {
     pname = "XStatic-jquery-ui";
-    inherit version;
-    sha256 = "3697e5f0ef355b8f4a1c724221592683c2db031935cbb57b46224eef474bd294";
+    inherit (finalAttrs) version;
+    hash = "sha256-Npfl8O81W49KHHJCIVkmg8LbAxk1y7V7RiJO70dL0pQ=";
   };
 
+  build-system = [ setuptools ];
+
   # no tests implemented
   doCheck = false;
 
-  propagatedBuildInputs = [ xstatic-jquery ];
+  dependencies = [ xstatic-jquery ];
+
+  pythonImportsCheck = [ "xstatic.pkg.jquery_ui" ];
 
   meta = {
     homepage = "https://jqueryui.com/";
@@ -27,4 +34,4 @@ buildPythonPackage rec {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ makefu ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/xstatic-pygments/default.nix b/pkgs/development/python-modules/xstatic-pygments/default.nix
index 578b91ca3577..3a1b3fc58576 100644
--- a/pkgs/development/python-modules/xstatic-pygments/default.nix
+++ b/pkgs/development/python-modules/xstatic-pygments/default.nix
@@ -2,19 +2,24 @@
   buildPythonPackage,
   lib,
   fetchPypi,
+  setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "xstatic-pygments";
   version = "2.9.0.1";
-  format = "setuptools";
+  pyproject = true;
+
+  __structuredAttrs = true;
 
   src = fetchPypi {
     pname = "XStatic-Pygments";
-    inherit version;
-    sha256 = "082c1e9fe606fbbef474f78b6fdb19e9a2efcc7a9b7d94163cf66f7bfae75762";
+    inherit (finalAttrs) version;
+    hash = "sha256-CCwen+YG+770dPeLb9sZ6aLvzHqbfZQWPPZve/rnV2I=";
   };
 
+  build-system = [ setuptools ];
+
   # no tests implemented
   doCheck = false;
 
@@ -24,4 +29,4 @@ buildPythonPackage rec {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ makefu ];
   };
-}
+})
diff --git a/pkgs/development/tools/pnpm/default.nix b/pkgs/development/tools/pnpm/default.nix
index cb7d3131e6c5..f81d2861f3eb 100644
--- a/pkgs/development/tools/pnpm/default.nix
+++ b/pkgs/development/tools/pnpm/default.nix
@@ -26,8 +26,8 @@ let
       hash = "sha256-WOFDJYhx31FYm2UcBiBdq+xIdmpdu6PCWZm2m1C+WY4=";
     };
     "11" = {
-      version = "11.8.0";
-      hash = "sha256-HpY6XEylFoVQugP8TujYc6dysHK3/OY7SP/yfXIOLpg=";
+      version = "11.9.0";
+      hash = "sha256-K1Z6pmAmI4B4rC4KM77D/r1g6WKYeqxpdFbzGAgZsoc=";
     };
   };
 
diff --git a/pkgs/kde/default.nix b/pkgs/kde/default.nix
index e97e6d866a7d..217405da9e33 100644
--- a/pkgs/kde/default.nix
+++ b/pkgs/kde/default.nix
@@ -5,7 +5,6 @@
   fetchurl,
   qt6Packages,
   cmark,
-  gpgme,
   taglib,
   wayland-protocols,
   wayland,
diff --git a/pkgs/os-specific/bsd/openbsd/default.nix b/pkgs/os-specific/bsd/openbsd/default.nix
index aa12d73079b6..c49f1b3e807a 100644
--- a/pkgs/os-specific/bsd/openbsd/default.nix
+++ b/pkgs/os-specific/bsd/openbsd/default.nix
@@ -20,7 +20,7 @@ makeScopeWithSplicing' {
       directory = ./pkgs;
     }
     // {
-      version = "7.5";
+      version = "7.9";
 
       stdenvLibcMinimal = stdenvNoLibc.override (old: {
         cc = old.cc.override {
diff --git a/pkgs/os-specific/bsd/openbsd/pkgs/libcMinimal/package.nix b/pkgs/os-specific/bsd/openbsd/pkgs/libcMinimal/package.nix
index 52c2d56c00d3..c4cfab61fec7 100644
--- a/pkgs/os-specific/bsd/openbsd/pkgs/libcMinimal/package.nix
+++ b/pkgs/os-specific/bsd/openbsd/pkgs/libcMinimal/package.nix
@@ -60,6 +60,7 @@ mkDerivation {
   env.NIX_CFLAGS_COMPILE = toString [
     "-B${csu}/lib"
     "-Wno-error"
+    "-fno-builtin"
   ];
 
   # Suppress lld >= 16 undefined version errors
@@ -73,6 +74,11 @@ mkDerivation {
     "LIBC_TAGS=no"
   ];
 
+  # -fret-clean requires OpenBSD-specific patches to the compiler.
+  postPatch = ''
+    find . -type f -exec sed -i 's/-fret-clean//g' {} \;
+  '';
+
   postInstall = ''
     pushd ${include}
     find include -type d -exec mkdir -p "$dev/{}" ';'
diff --git a/pkgs/os-specific/bsd/openbsd/pkgs/rtld/package.nix b/pkgs/os-specific/bsd/openbsd/pkgs/rtld/package.nix
index 58fd1fd8ebd4..8e6a1478f1f9 100644
--- a/pkgs/os-specific/bsd/openbsd/pkgs/rtld/package.nix
+++ b/pkgs/os-specific/bsd/openbsd/pkgs/rtld/package.nix
@@ -17,6 +17,13 @@ mkDerivation {
 
   NIX_CFLAGS_COMPILE = "-Wno-error";
 
+  makeFlags = [ "STACK_PROTECTOR=1" ];
+
+  # -fret-clean requires OpenBSD-specific patches to the compiler.
+  postPatch = ''
+    find . -type f -exec sed -i 's/-fret-clean//g' {} \;
+  '';
+
   # DESTDIR is overridden in bsdSetupHook, just fixup afterwards
   postInstall = ''
     mv $out/bin $out/libexec
diff --git a/pkgs/os-specific/bsd/openbsd/pkgs/source.nix b/pkgs/os-specific/bsd/openbsd/pkgs/source.nix
index a92dfbd2b221..e770df9ce9fd 100644
--- a/pkgs/os-specific/bsd/openbsd/pkgs/source.nix
+++ b/pkgs/os-specific/bsd/openbsd/pkgs/source.nix
@@ -7,6 +7,6 @@
 fetchcvs {
   cvsRoot = "anoncvs@anoncvs.fr.openbsd.org/cvs";
   module = "src";
-  tag = "OPENBSD_${lib.replaceStrings [ "." ] [ "_" ] version}-RELEASE";
-  sha256 = "sha256-hzdATew6h/FQV72SWtg3YvUXdPoGjm2SoUS7m3c3fSU=";
+  tag = "OPENBSD_${lib.replaceStrings [ "." ] [ "_" ] version}_BASE";
+  sha256 = "sha256-n6pkgjCvqAGpZzLZnsO8FT7HMtBH3i7SLfhFBqQ9jmE=";
 }
diff --git a/pkgs/servers/home-assistant/custom-components/miraie/package.nix b/pkgs/servers/home-assistant/custom-components/miraie/package.nix
index 92d11cb020b0..329c83391ddb 100644
--- a/pkgs/servers/home-assistant/custom-components/miraie/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/miraie/package.nix
@@ -10,13 +10,13 @@
 buildHomeAssistantComponent rec {
   owner = "rkzofficial";
   domain = "miraie";
-  version = "1.1.6";
+  version = "1.1.7";
 
   src = fetchFromGitHub {
     owner = "rkzofficial";
     repo = "ha-miraie-ac";
     tag = "v${version}";
-    hash = "sha256-5VpLfTKOLdx8P693jaW4o79CH2NKkgkgl7ai+I6JRQs=";
+    hash = "sha256-MYSxBtNvJQmnrtFszL41OFcvv2LKPTpTkbvUKLiqpzs=";
   };
 
   dependencies = [
diff --git a/pkgs/servers/sql/postgresql/ext/pgvector.nix b/pkgs/servers/sql/postgresql/ext/pgvector.nix
index d1bd5ec9e544..9998466e704a 100644
--- a/pkgs/servers/sql/postgresql/ext/pgvector.nix
+++ b/pkgs/servers/sql/postgresql/ext/pgvector.nix
@@ -7,13 +7,13 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "pgvector";
-  version = "0.8.2";
+  version = "0.8.3";
 
   src = fetchFromGitHub {
     owner = "pgvector";
     repo = "pgvector";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TLPlH+amFdeI2pEsUZuvoQ1JA0sCMiIAWdkgqGBo4mI=";
+    hash = "sha256-Tpa+OGau8RRMVgWQiAwjL3ez72hx6J+01yVvuCj7zVU=";
   };
 
   meta = {
diff --git a/pkgs/shells/fish/plugins/hydro.nix b/pkgs/shells/fish/plugins/hydro.nix
index 955fd3ce6c3c..11a956e4e001 100644
--- a/pkgs/shells/fish/plugins/hydro.nix
+++ b/pkgs/shells/fish/plugins/hydro.nix
@@ -7,13 +7,13 @@
 
 buildFishPlugin {
   pname = "hydro";
-  version = "0-unstable-2025-12-31";
+  version = "0-unstable-2026-02-24";
 
   src = fetchFromGitHub {
     owner = "jorgebucaran";
     repo = "hydro";
-    rev = "24bb2375e3cb29c71ab790c8cfe98b9069de80c3";
-    hash = "sha256-8ixve1ws80q5jNdKoooL25Lk7qopVitCMVTucW490fU=";
+    rev = "f130b55ee3eaf099eccf588e2a62e5447068d120";
+    hash = "sha256-Dfq974KpD1mtQKznIlkXfZfDnSF/4MfLTA18Ak0LADE=";
   };
 
   passthru.updateScript = unstableGitUpdater { };
diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix
index 780e98ed3adc..049be19b4e6a 100644
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@@ -49,6 +49,7 @@ let
   inherit (import ./problems.nix { inherit lib; })
     problemsType
     genCheckProblems
+    completeMetaProblems
     ;
   checkProblems = genCheckProblems config;
 
@@ -670,6 +671,8 @@ let
       unsupported = hasUnsupportedPlatform' attrs;
       insecure = isMarkedInsecure attrs;
 
+      problems = completeMetaProblems config attrs;
+
       available =
         validity.valid != "no"
         && ((config.checkMetaRecursively or false) -> all (d: d.meta.available or true) references);
diff --git a/pkgs/stdenv/generic/problems.nix b/pkgs/stdenv/generic/problems.nix
index a60a9632194c..887242e53684 100644
--- a/pkgs/stdenv/generic/problems.nix
+++ b/pkgs/stdenv/generic/problems.nix
@@ -72,68 +72,81 @@ rec {
     max = a: b: if lessThan a b then b else a;
   };
 
-  # TODO: Combine this and automaticProblems into a `{ removal = { manual = true; ... }; ... }` structure for less error-prone changes
-  kinds = rec {
-    # Automatic and manual problem kinds
-    known = map (problem: problem.kindName) automaticProblems ++ manual;
-    # Problem kinds that are currently allowed to be specified in `meta.problems`
-    manual = [
-      "removal"
-      "deprecated"
-      "broken"
-    ];
-    # Problem kinds that are currently only allowed to be specified once
-    unique = [
-      "removal"
-    ];
+  kinds = {
+    maintainerless = {
+      manualAllowed = false;
+      isUnique = false;
+      nixpkgsInternalUseAllowed = true;
+      automatic = {
+        condition =
+          # To get usable output, we want to avoid flagging "internal" derivations.
+          # Because we do not have a way to reliably decide between internal or
+          # external derivation, some heuristics are required to decide.
+          #
+          # If `outputHash` is defined, the derivation is a FOD, such as the output of a fetcher.
+          # If `description` is not defined, the derivation is probably not a package.
+          # Simply checking whether `meta` is defined is insufficient,
+          # as some fetchers and trivial builders do define meta.
+          config: attrs:
+          # Order of checks optimised for short-circuiting the common case of having maintainers
+          (attrs.meta.maintainers or [ ] == [ ])
+          && (attrs.meta.teams or [ ] == [ ])
+          && (!attrs ? outputHash)
+          && (attrs ? meta.description);
+        value.message = "This package has no declared maintainer, i.e. an empty `meta.maintainers` and `meta.teams` attribute.";
+      };
+    };
+    broken = {
+      manualAllowed = true;
+      isUnique = false;
+      nixpkgsInternalUseAllowed = true;
+      automatic = {
+        condition =
+          config:
+          let
+            # TODO: Consider deprecating this or making it generic for all problems
+            allowBroken = config.allowBroken || builtins.getEnv "NIXPKGS_ALLOW_BROKEN" == "1";
 
-    # Same thing but a set with null values (comes in handy at times)
-    manual' = genAttrs manual (k: null);
-    unique' = genAttrs unique (k: null);
+            allowBrokenPredicate =
+              lib.warnIf (lib.oldestSupportedReleaseIsAtLeast 2605)
+                "config.allowBrokenPredicate is deprecated, use config.problems.handlers.myPackage.broken = \"warn\" for individual packages instead."
+                config.allowBrokenPredicate;
+          in
+          if allowBroken then
+            attrs: false
+          else if config ? allowBrokenPredicate then
+            attrs: attrs ? meta.broken && attrs.meta.broken && !allowBrokenPredicate attrs
+          else
+            attrs: attrs ? meta.broken && attrs.meta.broken;
+        value.message = "This package is broken.";
+      };
+    };
+    removal = {
+      manualAllowed = true;
+      isUnique = true;
+      nixpkgsInternalUseAllowed = false;
+      automatic = null;
+    };
+    deprecated = {
+      manualAllowed = true;
+      isUnique = false;
+      nixpkgsInternalUseAllowed = false;
+      automatic = null;
+    };
   };
 
-  automaticProblems = [
-    {
-      kindName = "maintainerless";
-      condition =
-        # To get usable output, we want to avoid flagging "internal" derivations.
-        # Because we do not have a way to reliably decide between internal or
-        # external derivation, some heuristics are required to decide.
-        #
-        # If `outputHash` is defined, the derivation is a FOD, such as the output of a fetcher.
-        # If `description` is not defined, the derivation is probably not a package.
-        # Simply checking whether `meta` is defined is insufficient,
-        # as some fetchers and trivial builders do define meta.
-        config: attrs:
-        # Order of checks optimised for short-circuiting the common case of having maintainers
-        (attrs.meta.maintainers or [ ] == [ ])
-        && (attrs.meta.teams or [ ] == [ ])
-        && (!attrs ? outputHash)
-        && (attrs ? meta.description);
-      value.message = "This package has no declared maintainer, i.e. an empty `meta.maintainers` and `meta.teams` attribute.";
-    }
-    {
-      kindName = "broken";
-      condition =
-        config:
-        let
-          # TODO: Consider deprecating this or making it generic for all problems
-          allowBroken = config.allowBroken || builtins.getEnv "NIXPKGS_ALLOW_BROKEN" == "1";
+  # Problem kinds that are currently allowed to be specified in `meta.problems`
+  manualKinds = lib.filterAttrs (name: value: value.manualAllowed) kinds;
+  # Problem kinds that are currently only allowed to be specified once
+  uniqueKinds = lib.filterAttrs (name: value: value.isUnique) kinds;
 
-          allowBrokenPredicate =
-            lib.warnIf (lib.oldestSupportedReleaseIsAtLeast 2605)
-              "config.allowBrokenPredicate is deprecated, use config.problems.handlers.myPackage.broken = \"warn\" for individual packages instead."
-              config.allowBrokenPredicate;
-        in
-        if allowBroken then
-          attrs: false
-        else if config ? allowBrokenPredicate then
-          attrs: attrs ? meta.broken && attrs.meta.broken && !allowBrokenPredicate attrs
-        else
-          attrs: attrs ? meta.broken && attrs.meta.broken;
-      value.message = "This package is broken.";
-    }
-  ];
+  disallowNixpkgsInternalUseKinds = lib.filterAttrs (
+    name: value: !value.nixpkgsInternalUseAllowed
+  ) kinds;
+
+  automaticProblems = lib.mapAttrsToList (name: value: value.automatic // { kindName = name; }) (
+    lib.filterAttrs (name: value: value.automatic != null) kinds
+  );
 
   genAutomaticProblems =
     config: attrs:
@@ -148,7 +161,7 @@ rec {
     let
       types = lib.types;
       handlerType = types.enum handlers.levels;
-      problemKindType = types.enum kinds.known;
+      problemKindType = types.enum (attrNames kinds);
     in
     {
       handlers = lib.mkOption {
@@ -250,7 +263,8 @@ rec {
         record
         enum
         ;
-      kindType = enum kinds.manual;
+      # While we should only allow manual kinds, we need to allow `meta.problems = otherPackage.meta.problems`, which includes automatic ones as well
+      kindType = enum (attrNames kinds);
       subRecord = record {
         kind = kindType;
         message = str;
@@ -270,7 +284,7 @@ rec {
             let
               kindGroups = groupBy (kind: kind) (mapAttrsToList (name: problem: problem.kind or name) v);
             in
-            all (kind: kinds.manual' ? ${kind} && (kinds.unique' ? ${kind} -> length kindGroups.${kind} == 1)) (
+            all (kind: kinds ? ${kind} && (uniqueKinds ? ${kind} -> length kindGroups.${kind} == 1)) (
               attrNames kindGroups
             )
           );
@@ -294,14 +308,14 @@ rec {
           ++ concatLists (
             mapAttrsToList (
               kind: kindGroup:
-              optionals (!kinds.manual' ? ${kind}) (
+              optionals (!kinds ? ${kind}) (
                 map (
                   el:
                   "${ctx}.${el.name}: Problem kind ${kind}, inferred from the problem name, is invalid; expected ${kindType.name}. You can specify an explicit problem kind with `${ctx}.${el.name}.kind`"
                 ) (filter (el: !el.explicit) kindGroup)
               )
               ++
-                optional (kinds.unique' ? ${kind} && length kindGroup > 1)
+                optional (uniqueKinds ? ${kind} && length kindGroup > 1)
                   "${ctx}: Problem kind ${kind} should be unique, but is used for these problems: ${
                     concatMapStringsSep ", " (el: el.name) kindGroup
                   }"
@@ -510,6 +524,12 @@ rec {
       in
       processProblems pname problemsToHandle;
 
+  completeMetaProblems =
+    config: attrs:
+    mapAttrs (name: problem: { kind = name; } // problem) (
+      (attrs.meta.problems or { }) // genAutomaticProblems config attrs
+    );
+
   processProblems =
     pname: problemsToHandle:
     let
diff --git a/pkgs/test/problems/cases/invalid-kind-error/expected-stderr b/pkgs/test/problems/cases/invalid-kind-error/expected-stderr
index 07c5a38e1bcb..6fdf2b1d04b1 100644
--- a/pkgs/test/problems/cases/invalid-kind-error/expected-stderr
+++ b/pkgs/test/problems/cases/invalid-kind-error/expected-stderr
@@ -1,4 +1,4 @@
 (stack trace truncated; use '--show-trace' to show the full, detailed trace)
 
 error: Refusing to evaluate package 'a-0' in /nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-default.nix:11 because it has an invalid meta attrset:
-  - a.meta.problems.invalid: Problem kind invalid, inferred from the problem name, is invalid; expected enum<removal,deprecated,broken>. You can specify an explicit problem kind with `a.meta.problems.invalid.kind`
+  - a.meta.problems.invalid: Problem kind invalid, inferred from the problem name, is invalid; expected enum<broken,deprecated,removal>. You can specify an explicit problem kind with `a.meta.problems.invalid.kind`
diff --git a/pkgs/top-level/config.nix b/pkgs/top-level/config.nix
index f2066315efb5..de13c0a29993 100644
--- a/pkgs/top-level/config.nix
+++ b/pkgs/top-level/config.nix
@@ -58,6 +58,34 @@ let
       internal = true;
     };
 
+    attrPathsDisallowedForInternalUse = mkOption {
+      type = types.listOf (
+        types.submodule {
+          options.attrPath = lib.mkOption {
+            type = types.listOf types.str;
+            description = ''
+              Attribute path to disallow.
+            '';
+          };
+          options.reason = lib.mkOption {
+            type = types.nullOr types.str;
+            default = null;
+            example = /* because */ "it's dangerous.";
+            description = ''
+              Reason for it being disallowed.
+            '';
+          };
+        }
+      );
+      internal = true;
+      default = [ ];
+      description = ''
+        List of attribute paths that may not be used by other packages in Nixpkgs.
+
+        Should usually only be defined by Nixpkgs CI.
+      '';
+    };
+
     # Config options
 
     warnUndeclaredOptions = mkOption {
diff --git a/pkgs/top-level/default.nix b/pkgs/top-level/default.nix
index 443496f650fb..4e19941441da 100644
--- a/pkgs/top-level/default.nix
+++ b/pkgs/top-level/default.nix
@@ -214,7 +214,29 @@ let
       ;
   };
 
-  pkgs = boot stages;
+  fixedPoint = boot stages;
+
+  pkgs =
+    # Generally only set by CI, don't want to cause a performance hit for users
+    if config.attrPathsDisallowedForInternalUse == [ ] then
+      fixedPoint
+    else
+      # See ./stage.nix, which replaced config.attrPathsDisallowedForInternalUse with aborts.
+      # We replace these attribute paths with their original derivations again,
+      # because CI would just error out from the aborting attributes themselves.
+      # Internally all packages still see the aborting attributes if used as dependencies,
+      # because we do this here after the fixed-point is calculated.
+      # Note that we don't want to remove the attributes entirely like what aliases.nix does,
+      # because unlike aliases, CI still needs to check the packages to evaluate at all,
+      # which it wouldn't if they're removed entirely.
+      lib.updateManyAttrsByPath
+        (map (attrs: {
+          path = attrs.attrPath;
+          update =
+            _:
+            lib.getAttrFromPath attrs.attrPath fixedPoint.__internalBeforeInternallyDisallowedAttrPathsOverlay;
+        }) config.attrPathsDisallowedForInternalUse)
+        (removeAttrs fixedPoint [ "__internalBeforeInternallyDisallowedAttrPathsOverlay" ]);
 
 in
 checked pkgs
diff --git a/pkgs/top-level/nixpkgs-basic-release-checks.nix b/pkgs/top-level/nixpkgs-basic-release-checks.nix
index 1c7e60655985..e10d6f5e1ed2 100644
--- a/pkgs/top-level/nixpkgs-basic-release-checks.nix
+++ b/pkgs/top-level/nixpkgs-basic-release-checks.nix
@@ -56,7 +56,7 @@ pkgs.runCommand "nixpkgs-release-checks"
           set -x
           nix-env -f $src \
               --show-trace --argstr system "$platform" \
-              --arg config '{ allowAliases = false; allowDeprecatedx86_64Darwin = true; }' \
+              --arg config '{ lib, pkgs }: { problems.matchers = lib.mkForce [ ]; allowAliases = false; allowDeprecatedx86_64Darwin = true; }' \
               --option lint-url-literals fatal \
               -qa --drv-path --system-filter \* --system \
               "''${opts[@]}" 2> eval-warnings.log > packages1
@@ -72,7 +72,7 @@ pkgs.runCommand "nixpkgs-release-checks"
 
         nix-env -f $src2 \
             --show-trace --argstr system "$platform" \
-            --arg config '{ allowAliases = false; allowDeprecatedx86_64Darwin = true; }' \
+            --arg config '{ lib, pkgs }: { problems.matchers = lib.mkForce [ ]; allowAliases = false; allowDeprecatedx86_64Darwin = true; }' \
             --option lint-url-literals fatal \
             -qa --drv-path --system-filter \* --system \
             "''${opts[@]}" > packages2
@@ -95,7 +95,7 @@ pkgs.runCommand "nixpkgs-release-checks"
 
         nix-env -f $src \
             --show-trace --argstr system "$platform" \
-            --arg config '{ allowAliases = false; allowDeprecatedx86_64Darwin = true; }' \
+            --arg config '{ lib, pkgs }: { problems.matchers = lib.mkForce [ ]; allowAliases = false; allowDeprecatedx86_64Darwin = true; }' \
             --option lint-url-literals fatal \
             -qa --drv-path --system-filter \* --system --meta --xml \
             "''${opts[@]}" > /dev/null
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index d9b4213be09b..ef060c43c5ef 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -251,6 +251,7 @@ mapAliases {
   googleapis_common_protos = throw "'googleapis_common_protos' has been renamed to/replaced by 'googleapis-common-protos'"; # Converted to throw 2025-10-29
   gotrue = throw "'gotrue' has been replaced by 'supabase-auth'"; # Added 2026-03-08
   gpapi = throw "'gpapi' has been superseded by google-api-python-client"; # Added 2025-11-09
+  gpgme = gpg; # added 2026-06-26
   gplaycli = throw "'gplaycli' has been removed as it was broken and lacked maintenance"; # Added 2025-11-09
   gpy = throw "'gpy' has been removed as it is based on 'paramz', which was removed"; # added 2025-11-10
   gradient_statsd = throw "'gradient_statsd' has been renamed to/replaced by 'gradient-statsd'"; # Converted to throw 2025-10-29
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 9d69c24741f6..9cebce9c388d 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6789,7 +6789,7 @@ self: super: with self; {
     inherit (pkgs) libxc;
   };
 
-  gpgme = callPackage ../development/python-modules/gpgme { inherit (pkgs) gpgme; };
+  gpg = callPackage ../development/python-modules/gpg { inherit (pkgs) gpgme; };
 
   gphoto2 = callPackage ../development/python-modules/gphoto2 { };
 
diff --git a/pkgs/top-level/release-cross.nix b/pkgs/top-level/release-cross.nix
index cc0ab49a8c40..13fda84028dd 100644
--- a/pkgs/top-level/release-cross.nix
+++ b/pkgs/top-level/release-cross.nix
@@ -121,6 +121,9 @@ let
     gmp = nativePlatforms;
     boehmgc = nativePlatforms;
     hello = nativePlatforms;
+    tree-sitter.builtGrammars =
+      mapAttrs (_: _: nativePlatforms)
+        (pkgsForCross systems.examples.wasi32 (builtins.head supportedSystems)).tree-sitter.builtGrammars;
     zlib = nativePlatforms;
   };
 
diff --git a/pkgs/top-level/stage.nix b/pkgs/top-level/stage.nix
index 4b0abd0361c6..bc50a3f24247 100644
--- a/pkgs/top-level/stage.nix
+++ b/pkgs/top-level/stage.nix
@@ -309,6 +309,32 @@ let
     };
   };
 
+  # Replaces the attributes in config.attrPathsDisallowedForInternalUse with aborts.
+  # Not throws because those would be ignored by nix-env, which is what CI uses to evaluate everything
+  # See also ./default.nix, where these attributes are added back again so they're still checked by CI
+  internallyDisallowedAttrPathsOverlay =
+    final: prev:
+    # Generally only set by CI, don't want to cause a performance hit for users
+    if config.attrPathsDisallowedForInternalUse == [ ] then
+      { }
+    else
+      {
+        # So that ./default.nix can add them back again outside the fixed point
+        # Don't use this in packages!
+        __internalBeforeInternallyDisallowedAttrPathsOverlay = prev;
+      }
+      // lib.updateManyAttrsByPath (map (
+        { attrPath, reason }:
+        {
+          path = attrPath;
+          update =
+            _:
+            abort "${lib.concatStringsSep "." attrPath} is disallowed from being used within Nixpkgs${
+              lib.optionalString (reason != null) ", because ${reason}"
+            }";
+        }
+      ) config.attrPathsDisallowedForInternalUse) prev;
+
   # The complete chain of package set builders, applied from top to bottom.
   # stdenvOverlays must be last as it brings package forward from the
   # previous bootstrapping phases which have already been overlaid.
@@ -324,6 +350,7 @@ let
       aliases
       variants
       configOverrides
+      internallyDisallowedAttrPathsOverlay
     ]
     ++ overlays
     ++ [