diff --git a/ci/default.nix b/ci/default.nix
index 6aa80f977901..06fa75bbc38f 100644
--- a/ci/default.nix
+++ b/ci/default.nix
@@ -70,7 +70,7 @@ rec {
   };
   parse = pkgs.lib.recurseIntoAttrs {
     nix_latest = pkgs.callPackage ./parse.nix { nix = pkgs.nixVersions.latest; };
-    nix_2_28 = pkgs.callPackage ./parse.nix { nix = pkgs.nixVersions.nix_2_28; };
+    stable = pkgs.callPackage ./parse.nix { nix = pkgs.nixVersions.stable; };
     lix = pkgs.callPackage ./parse.nix { nix = pkgs.lix; };
     lix_latest = pkgs.callPackage ./parse.nix { nix = pkgs.lixPackageSets.latest.lix; };
   };
diff --git a/ci/pinned.json b/ci/pinned.json
index fc034a85bccf..0b3d817d1b06 100644
--- a/ci/pinned.json
+++ b/ci/pinned.json
@@ -9,9 +9,9 @@
       },
       "branch": "nixpkgs-unstable",
       "submodules": false,
-      "revision": "8c91a71d13451abc40eb9dae8910f972f979852f",
-      "url": "https://github.com/NixOS/nixpkgs/archive/8c91a71d13451abc40eb9dae8910f972f979852f.tar.gz",
-      "hash": "sha256-fnzKKPvS+oieI/pTzotA5tkoM47EB1NpaBcgk4R97hE="
+      "revision": "6edbf1a6a03e75886a6609c088801a0856449e88",
+      "url": "https://github.com/NixOS/nixpkgs/archive/6edbf1a6a03e75886a6609c088801a0856449e88.tar.gz",
+      "hash": "sha256-0lkauQbtrljJqwtzTCILPAiHAJyMvn6XDo264moDv30="
     }
   },
   "version": 8
diff --git a/ci/update-pinned.sh b/ci/update-pinned.sh
index 69ba7df9131d..51c99b0da98d 100755
--- a/ci/update-pinned.sh
+++ b/ci/update-pinned.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p npins -I nixpkgs=../
+#!nix-shell -i bash -E 'with import ../. {}; mkShell { packages = [ npins ]; }'
 
 set -euo pipefail
 
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index b173625d8611..6632e685f469 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -411,8 +411,8 @@
   };
   aaravrav = {
     name = "aaravrav";
-    github = "Aarav";
-    githubId = 3279912;
+    github = "aaravrav";
+    githubId = 37036762;
   };
   aarnphm = {
     email = "contact@aarnphm.xyz";
diff --git a/nixos/modules/services/web-apps/cloudlog.nix b/nixos/modules/services/web-apps/cloudlog.nix
index bafe5420d7f7..8b750aaacfc5 100644
--- a/nixos/modules/services/web-apps/cloudlog.nix
+++ b/nixos/modules/services/web-apps/cloudlog.nix
@@ -62,17 +62,14 @@ let
       ln -s ${configFile} $out/application/config/config.php
       ln -s ${dbFile} $out/application/config/database.php
 
+      # make a copy of the original assets/json to prime the datadir
+      cp -a "$out/assets/json/" "$out/assets/json.original/"
+
       # link writable directories
-      for directory in updates uploads backup logbook; do
+      for directory in updates uploads backup logbook assets/qslcard images/eqsl_card_images assets/sstvimages assets/json; do
         rm -rf $out/$directory
         ln -s ${cfg.dataDir}/$directory $out/$directory
       done
-
-      # link writable asset files
-      for asset in dok sota wwff; do
-        rm -rf $out/assets/json/$asset.txt
-        ln -s ${cfg.dataDir}/assets/json/$asset.txt $out/assets/json/$asset.txt
-      done
     '';
   };
 in
@@ -503,13 +500,26 @@ in
           group = config.services.nginx.group;
         in
         [
-          "d ${cfg.dataDir}                0750 ${cfg.user} ${group} - -"
-          "d ${cfg.dataDir}/updates        0750 ${cfg.user} ${group} - -"
-          "d ${cfg.dataDir}/uploads        0750 ${cfg.user} ${group} - -"
-          "d ${cfg.dataDir}/backup         0750 ${cfg.user} ${group} - -"
-          "d ${cfg.dataDir}/logbook        0750 ${cfg.user} ${group} - -"
-          "d ${cfg.dataDir}/assets/json    0750 ${cfg.user} ${group} - -"
-          "d ${cfg.dataDir}/assets/qslcard 0750 ${cfg.user} ${group} - -"
+          "d ${cfg.dataDir}                         0750 ${cfg.user} ${group} - -"
+          "d ${cfg.dataDir}/updates                 0750 ${cfg.user} ${group} - -"
+          "d ${cfg.dataDir}/uploads                 0750 ${cfg.user} ${group} - -"
+          "d ${cfg.dataDir}/backup                  0750 ${cfg.user} ${group} - -"
+          "d ${cfg.dataDir}/logbook                 0750 ${cfg.user} ${group} - -"
+          "d ${cfg.dataDir}/assets                  0750 ${cfg.user} ${group} - -"
+          "d ${cfg.dataDir}/assets/json             0750 ${cfg.user} ${group} - -"
+          "d ${cfg.dataDir}/assets/qslcard          0750 ${cfg.user} ${group} - -"
+          "d ${cfg.dataDir}/assets/sstvimages       0750 ${cfg.user} ${group} - -"
+          "d ${cfg.dataDir}/images                  0750 ${cfg.user} ${group} - -"
+          "d ${cfg.dataDir}/images/eqsl_card_images 0750 ${cfg.user} ${group} - -"
+          "C ${cfg.dataDir}/assets/json/dok.txt                              0640 ${cfg.user} ${group} - ${package}/assets/json.original/dok.txt"
+          "C ${cfg.dataDir}/assets/json/pota.txt                             0640 ${cfg.user} ${group} - ${package}/assets/json.original/pota.txt"
+          "C ${cfg.dataDir}/assets/json/satellite_data.json                  0640 ${cfg.user} ${group} - ${package}/assets/json.original/satellite_data.json"
+          "C ${cfg.dataDir}/assets/json/sota.txt                             0640 ${cfg.user} ${group} - ${package}/assets/json.original/sota.txt"
+          "C ${cfg.dataDir}/assets/json/US_counties.csv                      0640 ${cfg.user} ${group} - ${package}/assets/json.original/US_counties.csv"
+          "C ${cfg.dataDir}/assets/json/us_national_parksontheair.csv        0640 ${cfg.user} ${group} - ${package}/assets/json.original/us_national_parksontheair.csv"
+          "C ${cfg.dataDir}/assets/json/WABSquares.geojson                   0640 ${cfg.user} ${group} - ${package}/assets/json.original/WABSquares.geojson"
+          "C ${cfg.dataDir}/assets/json/wwff.txt                             0640 ${cfg.user} ${group} - ${package}/assets/json.original/wwff.txt"
+          "C+ ${cfg.dataDir}/assets/json/datatables_languages                0750 ${cfg.user} ${group} - ${package}/assets/json.original/datatables_languages"
         ];
     };
 
diff --git a/nixos/modules/services/web-apps/lasuite-meet.nix b/nixos/modules/services/web-apps/lasuite-meet.nix
index 421af1596483..b2a3c4fe60d8 100644
--- a/nixos/modules/services/web-apps/lasuite-meet.nix
+++ b/nixos/modules/services/web-apps/lasuite-meet.nix
@@ -36,48 +36,62 @@ let
       toString value
   ) cfg.settings;
 
-  commonServiceConfig = {
-    RuntimeDirectory = "lasuite-meet";
-    StateDirectory = "lasuite-meet";
-    WorkingDirectory = "/var/lib/lasuite-meet";
+  commonSystemdConfig = {
+    after = [
+      "network.target"
+    ]
+    ++ (optional cfg.postgresql.createLocally "postgresql.service")
+    ++ (optional cfg.redis.createLocally "redis-lasuite-meet.service");
 
-    User = "lasuite-meet";
-    DynamicUser = true;
-    SupplementaryGroups = mkIf cfg.redis.createLocally [
-      config.services.redis.servers.lasuite-meet.group
-    ];
-    # hardening
-    AmbientCapabilities = "";
-    CapabilityBoundingSet = [ "" ];
-    DevicePolicy = "closed";
-    LockPersonality = true;
-    NoNewPrivileges = true;
-    PrivateDevices = true;
-    PrivateTmp = true;
-    PrivateUsers = true;
-    ProcSubset = "pid";
-    ProtectClock = true;
-    ProtectControlGroups = true;
-    ProtectHome = true;
-    ProtectHostname = true;
-    ProtectKernelLogs = true;
-    ProtectKernelModules = true;
-    ProtectKernelTunables = true;
-    ProtectProc = "invisible";
-    ProtectSystem = "strict";
-    RemoveIPC = true;
-    RestrictAddressFamilies = [
-      "AF_INET"
-      "AF_INET6"
-      "AF_UNIX"
-    ];
-    RestrictNamespaces = true;
-    RestrictRealtime = true;
-    RestrictSUIDSGID = true;
-    SystemCallArchitectures = "native";
-    MemoryDenyWriteExecute = true;
-    EnvironmentFile = optional (cfg.environmentFile != null) cfg.environmentFile;
-    UMask = "0077";
+    wants =
+      (optional cfg.postgresql.createLocally "postgresql.service")
+      ++ (optional cfg.redis.createLocally "redis-lasuite-meet.service");
+
+    environment = pythonEnvironment;
+
+    serviceConfig = {
+      RuntimeDirectory = "lasuite-meet";
+      StateDirectory = "lasuite-meet";
+      WorkingDirectory = "/var/lib/lasuite-meet";
+
+      User = "lasuite-meet";
+      DynamicUser = true;
+      SupplementaryGroups = mkIf cfg.redis.createLocally [
+        config.services.redis.servers.lasuite-meet.group
+      ];
+      # hardening
+      AmbientCapabilities = "";
+      CapabilityBoundingSet = [ "" ];
+      DevicePolicy = "closed";
+      LockPersonality = true;
+      NoNewPrivileges = true;
+      PrivateDevices = true;
+      PrivateTmp = true;
+      PrivateUsers = true;
+      ProcSubset = "pid";
+      ProtectClock = true;
+      ProtectControlGroups = true;
+      ProtectHome = true;
+      ProtectHostname = true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
+      ProtectProc = "invisible";
+      ProtectSystem = "strict";
+      RemoveIPC = true;
+      RestrictAddressFamilies = [
+        "AF_INET"
+        "AF_INET6"
+        "AF_UNIX"
+      ];
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      SystemCallArchitectures = "native";
+      MemoryDenyWriteExecute = true;
+      EnvironmentFile = optional (cfg.environmentFile != null) cfg.environmentFile;
+      UMask = "0077";
+    };
   };
 in
 {
@@ -342,74 +356,54 @@ in
   };
 
   config = mkIf cfg.enable {
-    systemd.services.lasuite-meet = {
-      description = "Meet from SuiteNumérique";
-      after = [
-        "network.target"
-      ]
-      ++ (optional cfg.postgresql.createLocally "postgresql.service")
-      ++ (optional cfg.redis.createLocally "redis-lasuite-meet.service");
+    systemd.services.lasuite-meet = lib.mkMerge [
+      {
+        description = "Meet from SuiteNumérique";
 
-      wants =
-        (optional cfg.postgresql.createLocally "postgresql.service")
-        ++ (optional cfg.redis.createLocally "redis-lasuite-meet.service");
+        wantedBy = [ "multi-user.target" ];
 
-      wantedBy = [ "multi-user.target" ];
-
-      preStart = ''
-        if [ ! -f .version ]; then
-          touch .version
-        fi
-
-        ${optionalString (cfg.secretKeyPath == null) ''
-          if [[ ! -f /var/lib/lasuite-meet/django_secret_key ]]; then
-            (
-              umask 0377
-              tr -dc A-Za-z0-9 < /dev/urandom | head -c64 | ${pkgs.moreutils}/bin/sponge /var/lib/lasuite-meet/django_secret_key
-            )
+        preStart = ''
+          if [ ! -f .version ]; then
+            touch .version
           fi
-        ''}
-        if [ "${cfg.package.version}" != "$(cat .version)" ]; then
-          ${getExe cfg.package} migrate
-          echo -n "${cfg.package.version}" > .version
-        fi
-      '';
 
-      environment = pythonEnvironment;
+          ${optionalString (cfg.secretKeyPath == null) ''
+            if [[ ! -f /var/lib/lasuite-meet/django_secret_key ]]; then
+              (
+                umask 0377
+                tr -dc A-Za-z0-9 < /dev/urandom | head -c64 | ${pkgs.moreutils}/bin/sponge /var/lib/lasuite-meet/django_secret_key
+              )
+            fi
+          ''}
+          if [ "${cfg.package.version}" != "$(cat .version)" ]; then
+            ${getExe cfg.package} migrate
+            echo -n "${cfg.package.version}" > .version
+          fi
+        '';
 
-      serviceConfig = {
-        BindReadOnlyPaths = "${cfg.package}/share/static:/var/lib/lasuite-meet/static";
+        serviceConfig = {
+          BindReadOnlyPaths = "${cfg.package}/share/static:/var/lib/lasuite-meet/static";
 
-        ExecStart = utils.escapeSystemdExecArgs (
-          [
-            (lib.getExe' cfg.package "gunicorn")
-            "--bind=${cfg.bind}"
-          ]
-          ++ cfg.gunicorn.extraArgs
-          ++ [ "meet.wsgi:application" ]
-        );
+          ExecStart = utils.escapeSystemdExecArgs (
+            [
+              (lib.getExe' cfg.package "gunicorn")
+              "--bind=${cfg.bind}"
+            ]
+            ++ cfg.gunicorn.extraArgs
+            ++ [ "meet.wsgi:application" ]
+          );
+        };
       }
-      // commonServiceConfig;
-    };
+      commonSystemdConfig
+    ];
 
-    systemd.services.lasuite-meet-celery = {
-      description = "Meet Celery broker from SuiteNumérique";
-      after = [
-        "network.target"
-      ]
-      ++ (optional cfg.postgresql.createLocally "postgresql.service")
-      ++ (optional cfg.redis.createLocally "redis-lasuite-meet.service");
+    systemd.services.lasuite-meet-celery = lib.mkMerge [
+      {
+        description = "Meet Celery broker from SuiteNumérique";
 
-      wants =
-        (optional cfg.postgresql.createLocally "postgresql.service")
-        ++ (optional cfg.redis.createLocally "redis-lasuite-meet.service");
+        wantedBy = [ "multi-user.target" ];
 
-      wantedBy = [ "multi-user.target" ];
-
-      environment = pythonEnvironment;
-
-      serviceConfig = {
-        ExecStart = utils.escapeSystemdExecArgs (
+        serviceConfig.ExecStart = utils.escapeSystemdExecArgs (
           [ (lib.getExe' cfg.package "celery") ]
           ++ cfg.celery.extraArgs
           ++ [
@@ -418,8 +412,26 @@ in
           ]
         );
       }
-      // commonServiceConfig;
-    };
+      commonSystemdConfig
+    ];
+
+    systemd.services.lasuite-meet-clean-pending-files = lib.mkMerge [
+      {
+        description = "Scheduled job to clean up pending uploads from LaSuite Meet";
+        startAt = "daily";
+        serviceConfig.ExecStart = "${getExe cfg.package} clean_pending_files";
+      }
+      commonSystemdConfig
+    ];
+
+    systemd.services.lasuite-meet-purge-deleted-files = lib.mkMerge [
+      {
+        description = "Scheduled job to purge deleted files from LaSuite Meet";
+        startAt = "daily";
+        serviceConfig.ExecStart = "${getExe cfg.package} purge_deleted_files";
+      }
+      commonSystemdConfig
+    ];
 
     services.postgresql = mkIf cfg.postgresql.createLocally {
       enable = true;
diff --git a/nixos/tests/web-apps/immich.nix b/nixos/tests/web-apps/immich.nix
index 406b51600c4e..bf8df063fa63 100644
--- a/nixos/tests/web-apps/immich.nix
+++ b/nixos/tests/web-apps/immich.nix
@@ -8,7 +8,7 @@
       # These tests need a little more juice
       virtualisation = {
         cores = 2;
-        memorySize = 2048;
+        memorySize = 4096;
         diskSize = 4096;
       };
 
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/ghostel/package.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/ghostel/package.nix
index e16b1fce0dc6..22ff6038d4c8 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/ghostel/package.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/ghostel/package.nix
@@ -14,13 +14,13 @@ let
 
   pname = "ghostel";
 
-  version = "0.39.0-unstable-2026-06-26";
+  version = "0.41.0-unstable-2026-07-05";
 
   src = fetchFromGitHub {
     owner = "dakra";
     repo = "ghostel";
-    rev = "92bfcc57dc85f254ce95dcb51dbdd2411fea5f02";
-    hash = "sha256-havDs3fZENB/ozMWWKQkdsyHUIBIeewmrjL+3xJKM94=";
+    rev = "f77efee9172854abc08652637d23adc26faa25a2";
+    hash = "sha256-6ME+aStZ9X1pkTr0uwwhrJXEHu/uLStPHsKtbudXl9I=";
   };
 
   module = stdenv.mkDerivation (finalAttrs: {
@@ -29,7 +29,7 @@ let
     deps = zig.fetchDeps {
       inherit (finalAttrs) src pname version;
       fetchAll = true;
-      hash = "sha256-CTsG3dXu3DECDbklBAtr2fYou82WNvQ1Q3JET0TmuyM=";
+      hash = "sha256-lFU0ywNyP1q2NL9MkIfWciH03VAA/Act5dGYAV4V7EY=";
     };
 
     nativeBuildInputs = [ zig ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ xcbuild ];
@@ -48,19 +48,6 @@ let
 
     zigBuildFlags = finalAttrs.zigCheckFlags;
 
-    postPatch = ''
-      # https://github.com/dakra/ghostel/issues/446
-      substituteInPlace build.zig \
-        --replace-fail 'addInstallFile(version_file, "../ghostel-module.version")' \
-                       'addInstallFile(version_file, "ghostel-module.version")'
-
-      # remove copy_step
-      substituteInPlace build.zig \
-        --replace-fail 'b.getInstallStep().dependOn(&copy_step.step);' ' ' \
-        --replace-fail 'const copy_step = b.addInstallFile' \
-                       '_ = b.addInstallFile'
-    '';
-
     postConfigure = ''
       cp -rLT ${finalAttrs.deps} "$ZIG_GLOBAL_CACHE_DIR/p"
       chmod -R u+w "$ZIG_GLOBAL_CACHE_DIR/p"
@@ -77,7 +64,7 @@ melpaBuild {
   '';
 
   preBuild = ''
-    install ${module}/lib/libghostel-module${libExt} ghostel-module${libExt}
+    install ${module}/ghostel-module${libExt} ghostel-module${libExt}
     install --mode=444 ${module}/ghostel-module.version ghostel-module.version
   '';
 
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/tsc/package.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/tsc/package.nix
index 35e9335e4e5f..287631bea6ae 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/tsc/package.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/tsc/package.nix
@@ -12,16 +12,16 @@ let
 
   tsc-dyn = rustPlatform.buildRustPackage (finalAttrs: {
     pname = "tsc-dyn";
-    version = "0.18.0";
+    version = "0.19.4";
 
     src = fetchFromGitHub {
       owner = "emacs-tree-sitter";
       repo = "emacs-tree-sitter";
       tag = finalAttrs.version;
-      hash = "sha256-LrakDpP3ZhRQqz47dPcyoQnu5lROdaNlxGaQfQT6u+k=";
+      hash = "sha256-7B9Q8ke8gY9cFIAjpyH21P240goKUEKgppfqP3PSxYA=";
     };
 
-    cargoHash = "sha256-Tua3ZFfSyWVYXU9mPLWXE6ejGlXowTNe3nvZBaicmSQ=";
+    cargoHash = "sha256-mjR8PehbhY1o/5L2l/OMh/NwjjmQXErPHh00cAD94pw=";
 
     sourceRoot = "${finalAttrs.src.name}/core";
 
diff --git a/pkgs/applications/editors/vim/plugins/non-generated/meson/default.nix b/pkgs/applications/editors/vim/plugins/non-generated/meson/default.nix
index cc81c6815cb9..c442bb136623 100644
--- a/pkgs/applications/editors/vim/plugins/non-generated/meson/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/meson/default.nix
@@ -8,11 +8,9 @@ vimUtils.buildVimPlugin {
   preInstall = "cd data/syntax-highlighting/vim";
 
   meta = {
+    description = "Vim plugin for meson providing syntax highlighting";
     inherit (meson.meta)
       homepage
-      description
-      mainProgram
-      longDescription
       license
       platforms
       ;
diff --git a/pkgs/applications/emulators/libretro/cores/opera.nix b/pkgs/applications/emulators/libretro/cores/opera.nix
index 227d42278623..b1c2a0b39b02 100644
--- a/pkgs/applications/emulators/libretro/cores/opera.nix
+++ b/pkgs/applications/emulators/libretro/cores/opera.nix
@@ -6,13 +6,13 @@
 }:
 mkLibretroCore {
   core = "opera";
-  version = "0-unstable-2026-06-19";
+  version = "0-unstable-2026-06-28";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "opera-libretro";
-    rev = "eb3a9162e99a71da221107aa58e7650fd076bbca";
-    hash = "sha256-swFdGY8ScsQG/8E/JWzGRL80jdMVzsr1BJ+UAisSJ9g=";
+    rev = "340f9e9014c292fc47a8844a871a71dafe072b6d";
+    hash = "sha256-geBK8RIlaRcWn4CDzVl3pjK0WOFQcMZl7zFMXE2oZNo=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/emulators/libretro/cores/prboom.nix b/pkgs/applications/emulators/libretro/cores/prboom.nix
index 20ad06e03cc6..907e3f47386f 100644
--- a/pkgs/applications/emulators/libretro/cores/prboom.nix
+++ b/pkgs/applications/emulators/libretro/cores/prboom.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "prboom";
-  version = "0-unstable-2026-06-15";
+  version = "0-unstable-2026-07-01";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "libretro-prboom";
-    rev = "b760de6a1eb1bfcd7833c5b677ff9170d104302f";
-    hash = "sha256-JZrQbhntCGV4WIktUbtVXCSGAEmh9gTPn+tLiMyt6ZY=";
+    rev = "141978db577b52cb943641629401776e49ccbbe6";
+    hash = "sha256-USRBq+h2HAoDIdYVd47wGLEnUzJAEOvikuvSNTHpboI=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/emulators/libretro/cores/stella2014.nix b/pkgs/applications/emulators/libretro/cores/stella2014.nix
index 6c7c4a2f6ba4..863d375c6617 100644
--- a/pkgs/applications/emulators/libretro/cores/stella2014.nix
+++ b/pkgs/applications/emulators/libretro/cores/stella2014.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "stella2014";
-  version = "0-unstable-2026-04-12";
+  version = "0-unstable-2026-07-04";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "stella2014-libretro";
-    rev = "eed47e154d1bbda3305e9ef2d486b6710c8973f4";
-    hash = "sha256-QpPjVnFCkn6xlB7LxpE6bsNfYe3HSsEKUjqmEf2yTvA=";
+    rev = "8ddf2146ed2d2053cff9df64192f920e57709629";
+    hash = "sha256-VDywbP7PhcQPHhu/KMvV1LlI/iOGjMzRooqvoT+Tnxc=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index 54505dafcac0..c953bf906617 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -420,18 +420,18 @@ in
 
   docker_29 =
     let
-      version = "29.6.0";
+      version = "29.6.1";
     in
     callPackage dockerGen {
       inherit version;
       cliRev = "v${version}";
-      cliHash = "sha256-2JTiqvrIYhpwbEgU+5DnmlHpaf8Re1vYPkySs93sKZU=";
+      cliHash = "sha256-cpK2UMRP/WXHsehG9Sq5UJAjhMesmXTrhe00y4RMRZc=";
       mobyRev = "docker-v${version}";
-      mobyHash = "sha256-xr3+RZANLP4IkLv26/7znXnTCOm/5Gm7k6WBaOlZfQk=";
+      mobyHash = "sha256-gv+mea9X5TYDWN3IBRpmw0+R2waGxCiubdatNTeUQZI=";
       runcRev = "v1.3.6";
       runcHash = "sha256-cBMYZOElWHQ4OkF2NlYJSZrlW4833WD8CRJRkkXeKJc=";
-      containerdRev = "v2.2.4";
-      containerdHash = "sha256-F0lw7zh4V9JlFQGkE4RNT1VLX8WWLgZAAvbP12jnRMw=";
+      containerdRev = "v2.2.5";
+      containerdHash = "sha256-3ui+0AjEU6H4VHYwF3G85ggVMUdONCLJ5KfciFasmkk=";
       tiniRev = "369448a167e8b3da4ca5bca0b3307500c3371828";
       tiniHash = "sha256-jCBNfoJAjmcTJBx08kHs+FmbaU82CbQcf0IVjd56Nuw=";
     };
diff --git a/pkgs/applications/window-managers/evilwm/default.nix b/pkgs/applications/window-managers/evilwm/default.nix
index 832f7306bb6e..11bbebb5dcd6 100644
--- a/pkgs/applications/window-managers/evilwm/default.nix
+++ b/pkgs/applications/window-managers/evilwm/default.nix
@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation rec {
   pname = "evilwm";
-  version = "1.4.3";
+  version = "1.5";
 
   src = fetchurl {
     url = "https://www.6809.org.uk/evilwm/evilwm-${version}.tar.gz";
-    sha256 = "sha256-1ZRbILEskdskEvrA29o/ucPsjeu44bEJg4mSsrG75dQ=";
+    sha256 = "sha256-YQSFJBPm1QZpNh3K3aWiXTnisrDJWmOEAiyQWVeidA8=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/ar/ariang/package.nix b/pkgs/by-name/ar/ariang/package.nix
index 45ec0b597869..1aeb512c61ce 100644
--- a/pkgs/by-name/ar/ariang/package.nix
+++ b/pkgs/by-name/ar/ariang/package.nix
@@ -1,6 +1,7 @@
 {
   lib,
   fetchFromGitHub,
+  nodejs_22,
   buildNpmPackage,
   copyDesktopItems,
   imagemagick,
@@ -19,6 +20,8 @@ buildNpmPackage rec {
     hash = "sha256-u4MnjGMvnnb9EGHwK2QYpW7cuX1e1+6z2/1X1baR8iA=";
   };
 
+  nodejs = nodejs_22;
+
   npmDepsHash = "sha256-kxoSEdM8H7M9s6U2dtCdfuvqVROEk35jAkO7MgyVVRg=";
 
   makeCacheWritable = true;
diff --git a/pkgs/by-name/av/avdl/package.nix b/pkgs/by-name/av/avdl/package.nix
index 73fc9d463746..a9ef6507d626 100644
--- a/pkgs/by-name/av/avdl/package.nix
+++ b/pkgs/by-name/av/avdl/package.nix
@@ -6,17 +6,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "avdl";
-  version = "0.1.9+1.12.1";
+  version = "0.1.10+1.12.1";
 
   src = fetchFromGitHub {
     owner = "jonhoo";
     repo = "avdl";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-HfcDSv3RzmoFbwt7iAP/UXdeJupfng8oeaeerUwW1Ik=";
+    hash = "sha256-DGRBLXE8YMZs1fBBuTtUuhsc490IJB3G9Khddk3l8gw=";
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-5ftBXywOUQKzIwjaQVHtxO/6A1bb1jGZAxYYY7GttCg=";
+  cargoHash = "sha256-wTiQ1Ssn6Q1ZjR52a4+qyDrQqVUcP+/4paOjKKPJuII=";
 
   meta = {
     description = "Rust port of avro-tools' IDL tooling";
diff --git a/pkgs/by-name/ba/bazarr/package.nix b/pkgs/by-name/ba/bazarr/package.nix
index f029fa8f1453..fcb85a166a8b 100644
--- a/pkgs/by-name/ba/bazarr/package.nix
+++ b/pkgs/by-name/ba/bazarr/package.nix
@@ -17,11 +17,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "bazarr";
-  version = "1.5.6";
+  version = "1.6.0";
 
   src = fetchzip {
     url = "https://github.com/morpheus65535/bazarr/releases/download/v${version}/bazarr.zip";
-    hash = "sha256-S3idNH9Wm9f6aNj69dERmeks1rLvUeQJYFebXa5cWQo=";
+    hash = "sha256-LRcc2wg5u260yl3A7rRwBfldl6WOyvF2T9NKGTKabfw=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/ca/cargo-feature-combinations/package.nix b/pkgs/by-name/ca/cargo-feature-combinations/package.nix
index 8c8d78496239..d7d52def6bcc 100644
--- a/pkgs/by-name/ca/cargo-feature-combinations/package.nix
+++ b/pkgs/by-name/ca/cargo-feature-combinations/package.nix
@@ -9,16 +9,16 @@ rustPlatform.buildRustPackage (finalAttrs: {
   __structuredAttrs = true;
 
   pname = "cargo-feature-combinations";
-  version = "0.0.54";
+  version = "0.2.3";
 
   src = fetchFromGitHub {
     owner = "romnn";
     repo = "cargo-feature-combinations";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-SgVwgG7lNFrDMH1t9yvYTTm7pQth2hcEAjwMuRkC5Kg=";
+    hash = "sha256-5QQrWdq1jTGUCnzZkzJ2WzJRpxhRtaZMLpgCIktaiPc=";
   };
 
-  cargoHash = "sha256-S0I2itkyAhZwk+S/k/Sr3bpENpIQNHSaJwVpA8rvQ+E=";
+  cargoHash = "sha256-PMZGYxdB9cbWLVtvfRtWsRqVwJWayPbrdhpKvxmq3dM=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/co/copilot-language-server/package.nix b/pkgs/by-name/co/copilot-language-server/package.nix
index cadc8f9ad0cc..851e409fad4b 100644
--- a/pkgs/by-name/co/copilot-language-server/package.nix
+++ b/pkgs/by-name/co/copilot-language-server/package.nix
@@ -10,11 +10,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "copilot-language-server";
-  version = "1.513.0";
+  version = "1.517.0";
 
   src = fetchzip {
     url = "https://github.com/github/copilot-language-server-release/releases/download/${finalAttrs.version}/copilot-language-server-js-${finalAttrs.version}.zip";
-    hash = "sha256-wVibxZjUW6BX4YhdYlyE0/zp0fst2H/XmmqZLqxGXH8=";
+    hash = "sha256-BzvUARAI8DOEYHPMavJdtSkr+ZCj/E+mM9wQtmEGyjY=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/ct/ctranslate2/package.nix b/pkgs/by-name/ct/ctranslate2/package.nix
index 812a6d88286f..dbc3c7b237a2 100644
--- a/pkgs/by-name/ct/ctranslate2/package.nix
+++ b/pkgs/by-name/ct/ctranslate2/package.nix
@@ -28,14 +28,14 @@ let
 in
 stdenv'.mkDerivation (finalAttrs: {
   pname = "ctranslate2";
-  version = "4.8.0";
+  version = "4.8.1";
 
   src = fetchFromGitHub {
     owner = "OpenNMT";
     repo = "CTranslate2";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-Z7Gq+kXIfMdZs48WeptRGXhXnLfehegAwTtQpTbPM4U=";
+    hash = "sha256-+82u+w08wGX0oh1wBaH/epI2IH7lxbvMThJEoGt0Kvk=";
   };
 
   # Fix CMake 4 compatibility
diff --git a/pkgs/by-name/dc/dcp/package.nix b/pkgs/by-name/dc/dcp/package.nix
index 616d7c9002de..6dffa4736f19 100644
--- a/pkgs/by-name/dc/dcp/package.nix
+++ b/pkgs/by-name/dc/dcp/package.nix
@@ -15,13 +15,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "dcp";
-  version = "0.25.1";
+  version = "0.25.2";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "dcp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mWTGwM1y5zGd610N6Mg3Q3o2Lqf4ANdCWTjNNG/3dBg=";
+    hash = "sha256-afQa5arDC9GD0jzzKBSc+zHrNmHpn91HdcWDeFzpbzQ=";
   };
 
   vendorHash = "sha256-hcuVUUr3kr3iBmSEhHy365LIWGGLFTYnBRa5jnt7kPw=";
diff --git a/pkgs/by-name/dp/dprint/package.nix b/pkgs/by-name/dp/dprint/package.nix
index d8aca72dd913..00d6545bc097 100644
--- a/pkgs/by-name/dp/dprint/package.nix
+++ b/pkgs/by-name/dp/dprint/package.nix
@@ -12,7 +12,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "dprint";
-  version = "0.54.0";
+  version = "0.55.1";
 
   # Prefer repository rather than crate here
   #   - They have Cargo.lock in the repository
@@ -21,10 +21,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "dprint";
     repo = "dprint";
     tag = finalAttrs.version;
-    hash = "sha256-dNs2LQeEndeXS8xR9SXVFWT9PS+haB9SDZ+3PUPkFjg=";
+    hash = "sha256-OXXLpKgP2cUuPl7ikgZVPFgJiLY0Zy8MmBkz8Kp2+XM=";
   };
 
-  cargoHash = "sha256-fmbO14eTObK1cZu9gDls25KRmzAJPGiqQ8uURGD2vV0=";
+  cargoHash = "sha256-IDxJPicTq0/7LI/07QfJrteaKAHDoeKdzpbEv871xxE=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/fa/fastfetch-unwrapped/package.nix b/pkgs/by-name/fa/fastfetch-unwrapped/package.nix
index 858384e50fae..3fe6b67b2fa9 100644
--- a/pkgs/by-name/fa/fastfetch-unwrapped/package.nix
+++ b/pkgs/by-name/fa/fastfetch-unwrapped/package.nix
@@ -47,7 +47,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fastfetch-unwrapped";
-  version = "2.65.1";
+  version = "2.65.2";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -56,7 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "fastfetch-cli";
     repo = "fastfetch";
     tag = finalAttrs.version;
-    hash = "sha256-fr/FyGcURlauCLIAYHGhtmsJqbbPe+Hg3ObyRtYR5wk=";
+    hash = "sha256-yRKxETZEIlpl42y+adp9wpQhD6ZDebdfGj4SL1zxr3w=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/fa/fatsort/package.nix b/pkgs/by-name/fa/fatsort/package.nix
index 25f877dcba63..1af3b96ab23b 100644
--- a/pkgs/by-name/fa/fatsort/package.nix
+++ b/pkgs/by-name/fa/fatsort/package.nix
@@ -7,12 +7,12 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "1.6.5.640";
+  version = "1.7.679";
   pname = "fatsort";
 
   src = fetchurl {
     url = "mirror://sourceforge/fatsort/fatsort-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-Yw7OVtnrOlVSSvCuw6reeFQ2DrqUkXKmz7R2jLj75C4=";
+    sha256 = "sha256-EBL1UTgmOdaeGU6r++mTQu3nyFaxzWeIKH+d/UvY0SI=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/fi/firezone-gateway/package.nix b/pkgs/by-name/fi/firezone-gateway/package.nix
index 0cd89a809b4c..e8031b677e6a 100644
--- a/pkgs/by-name/fi/firezone-gateway/package.nix
+++ b/pkgs/by-name/fi/firezone-gateway/package.nix
@@ -6,15 +6,15 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "firezone-gateway";
-  version = "1.4.18";
+  version = "1.5.2";
   src = fetchFromGitHub {
     owner = "firezone";
     repo = "firezone";
     tag = "gateway-${finalAttrs.version}";
-    hash = "sha256-vxOFca6yO9AvgIJwizhaNlOjOvV00+ckQfXIJ17ASq4=";
+    hash = "sha256-bfLPOhxv0xfnU3Q1zZWbhqvNe9Hav2RgF/ESMk81F4I=";
   };
 
-  cargoHash = "sha256-8YftVt72JpmxWB/WvOPpduE0/QgYvQhSuFRmsFth2iU=";
+  cargoHash = "sha256-oOJ/UkamQrlWjAz2A4oObdBssHH9iJWN2BHFgMPOxck=";
   sourceRoot = "${finalAttrs.src.name}/rust";
   buildAndTestSubdir = "gateway";
   env.RUSTFLAGS = "--cfg system_certs";
diff --git a/pkgs/by-name/fi/firezone-headless-client/package.nix b/pkgs/by-name/fi/firezone-headless-client/package.nix
index 877f40279af8..7d80fc1e0f50 100644
--- a/pkgs/by-name/fi/firezone-headless-client/package.nix
+++ b/pkgs/by-name/fi/firezone-headless-client/package.nix
@@ -6,15 +6,15 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "firezone-headless-client";
-  version = "1.5.5";
+  version = "1.5.6";
   src = fetchFromGitHub {
     owner = "firezone";
     repo = "firezone";
     tag = "headless-client-${finalAttrs.version}";
-    hash = "sha256-Lo5iUXlpAecglr0uohOdsefeaDQZor2YoF0O99CxvEo=";
+    hash = "sha256-yEceZJBqSF35herNjbqFHKaIoFJwbkDN28wlxFa1UbU=";
   };
 
-  cargoHash = "sha256-1e2uqxZFDbtcQREB0s2jxfSFgs/hnPxTlUGFeK5L9yw=";
+  cargoHash = "sha256-3V2eMxUtNcnWsh7cYA5Wf979sKmFl7bjwwrqwcfW4tI=";
   sourceRoot = "${finalAttrs.src.name}/rust";
   buildAndTestSubdir = "headless-client";
   env.RUSTFLAGS = "--cfg system_certs";
diff --git a/pkgs/by-name/fl/flintlock/package.nix b/pkgs/by-name/fl/flintlock/package.nix
index a7ec82cf2afb..f8be779f5ec8 100644
--- a/pkgs/by-name/fl/flintlock/package.nix
+++ b/pkgs/by-name/fl/flintlock/package.nix
@@ -11,16 +11,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "flintlock";
-  version = "0.8.1";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "liquidmetal-dev";
     repo = "flintlock";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-Kbk94sqj0aPsVonPsiu8kbjhIOURB1kX9Lt3NURL+jk=";
+    sha256 = "sha256-WQbZUbTrg50vYvFY5ng8LtT4d6aVsUzZUIy8tMUr50M=";
   };
 
-  vendorHash = "sha256-Iv1qHEQLgw6huCA/6PKNmm+dS2yHgOvY/oy2fKjwEpY=";
+  vendorHash = "sha256-SjKxnLsC6RAg7is+ABRG1NyKX01cRNwCcW5B3Fgo/FQ=";
 
   subPackages = [
     "cmd/flintlock-metrics"
diff --git a/pkgs/by-name/fs/fsverity-utils/package.nix b/pkgs/by-name/fs/fsverity-utils/package.nix
index 72eac55086af..b52e19121c67 100644
--- a/pkgs/by-name/fs/fsverity-utils/package.nix
+++ b/pkgs/by-name/fs/fsverity-utils/package.nix
@@ -10,7 +10,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fsverity-utils";
-  version = "1.6";
+  version = "1.7";
 
   outputs = [
     "out"
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchzip {
     url = "https://git.kernel.org/pub/scm/fs/fsverity/fsverity-utils.git/snapshot/fsverity-utils-v${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-FZN4MKNmymIXZ2Q0woA0SLzPf4SaUJkj4ssKPsY4xXc=";
+    sha256 = "sha256-c8dillkgGh41elo/a5EqGQIrS4TZeDLsYkmyNke6koc=";
   };
 
   patches = lib.optionals (!enableShared) [
diff --git a/pkgs/by-name/go/google-chrome/package.nix b/pkgs/by-name/go/google-chrome/package.nix
index e639b0005187..f0f9d5ba9f5b 100644
--- a/pkgs/by-name/go/google-chrome/package.nix
+++ b/pkgs/by-name/go/google-chrome/package.nix
@@ -289,11 +289,11 @@ let
 
   darwin = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "149.0.7827.201";
+    version = "150.0.7871.47";
 
     src = fetchurl {
-      url = "http://dl.google.com/release2/chrome/ph3mj7mqtvbfhr67ckmjvjj5a4_149.0.7827.201/GoogleChrome-149.0.7827.201.dmg";
-      hash = "sha256-AI5oBE0uB2/YacF9LB4d6rXlAqEuZtlPYNQwLbs1K7E=";
+      url = "http://dl.google.com/release2/chrome/ad2pojsfcj6hr5telal5kk4t6gua_150.0.7871.47/GoogleChrome-150.0.7871.47.dmg";
+      hash = "sha256-1VTMVSBLfSRp9CxPaRkmdgAC0H5KNuZNWywTGLSphUI=";
     };
 
     dontPatch = true;
diff --git a/pkgs/by-name/gr/gram/package.nix b/pkgs/by-name/gr/gram/package.nix
index 5ff5ef2d9d67..894b90cddfc5 100644
--- a/pkgs/by-name/gr/gram/package.nix
+++ b/pkgs/by-name/gr/gram/package.nix
@@ -65,6 +65,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     cargo-bundle
+    rustPlatform.bindgenHook
   ];
 
   dontUseCmakeConfigure = true;
diff --git a/pkgs/by-name/he/headplane/package.nix b/pkgs/by-name/he/headplane/package.nix
index 2d71367644ea..61201296d950 100644
--- a/pkgs/by-name/he/headplane/package.nix
+++ b/pkgs/by-name/he/headplane/package.nix
@@ -15,13 +15,13 @@
 let
   pname = "headplane";
   # Note, if you are upgrading this, you should upgrade headplane-agent at the same time
-  version = "0.6.2";
+  version = "0.6.3";
   pnpmDepsHash = "sha256-CsmffCo9Se/4oiOqbcuhjPMuGmR2GL+YfcyWgzBTAh8=";
   src = fetchFromGitHub {
     owner = "tale";
     repo = "headplane";
     tag = "v${version}";
-    hash = "sha256-2C/Pn2M2aHADtoljSFg9hz6xOaZp6IRI77jjy+LDAgw=";
+    hash = "sha256-zvJUTKRIlHyPMq80teVXBSb7K9Zz44Kuuj2PPi6qIOw=";
   };
 
   headplaneSshWasm = buildGoModule {
diff --git a/pkgs/by-name/im/immich-cli/package.nix b/pkgs/by-name/im/immich-cli/package.nix
index 3c16240a6ba3..a719db4480ea 100644
--- a/pkgs/by-name/im/immich-cli/package.nix
+++ b/pkgs/by-name/im/immich-cli/package.nix
@@ -12,12 +12,6 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "immich-cli";
   inherit (immich) version src pnpmDeps;
 
-  postPatch = ''
-    local -r cli_version="$(jq -r .version cli/package.json)"
-    test "$cli_version" = ${finalAttrs.version} \
-      || (echo "error: update immich-cli version to $cli_version" && exit 1)
-  '';
-
   nativeBuildInputs = [
     jq
     makeWrapper
@@ -29,8 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
   buildPhase = ''
     runHook preBuild
 
-    pnpm --filter @immich/sdk build
-    pnpm --filter @immich/cli build
+    pnpm --filter @immich/cli... build
 
     runHook postBuild
   '';
diff --git a/pkgs/by-name/im/immich-machine-learning/package.nix b/pkgs/by-name/im/immich-machine-learning/package.nix
index d562c395af1a..9c968802d3fd 100644
--- a/pkgs/by-name/im/immich-machine-learning/package.nix
+++ b/pkgs/by-name/im/immich-machine-learning/package.nix
@@ -1,6 +1,5 @@
 {
   lib,
-  fetchpatch2,
   immich,
   python3,
   nixosTests,
@@ -17,15 +16,6 @@ python.pkgs.buildPythonApplication rec {
   src = "${immich.src}/machine-learning";
   pyproject = true;
 
-  patches = [
-    (fetchpatch2 {
-      name = "fix_tests_with_openvino_ep.patch";
-      relative = "machine-learning";
-      url = "https://github.com/immich-app/immich/commit/7f611d90317d75ac3d75adf428f367376171e106.patch?full_index=1";
-      hash = "sha256-dntL5AZS3VIp7++yUec4HWIdtwltrnIePNFPJaiZdy4=";
-    })
-  ];
-
   pythonRelaxDeps = [
     "huggingface-hub"
     "insightface"
diff --git a/pkgs/by-name/im/immich/package.nix b/pkgs/by-name/im/immich/package.nix
index e94ad087378e..b39e88a2eab5 100644
--- a/pkgs/by-name/im/immich/package.nix
+++ b/pkgs/by-name/im/immich/package.nix
@@ -4,7 +4,7 @@
   fetchFromGitHub,
   fetchPnpmDeps,
   pnpmConfigHook,
-  pnpm_10,
+  pnpm_11,
   python3,
   nodejs,
   node-gyp,
@@ -37,7 +37,7 @@
   buildPackages,
 }:
 let
-  pnpm = pnpm_10;
+  pnpm = pnpm_11;
 
   esbuild' = buildPackages.esbuild.override {
     buildGoModule =
@@ -45,12 +45,12 @@ let
       buildPackages.buildGoModule (
         args
         // rec {
-          version = "0.25.5";
+          version = "0.28.1";
           src = fetchFromGitHub {
             owner = "evanw";
             repo = "esbuild";
             tag = "v${version}";
-            hash = "sha256-jemGZkWmN1x2+ZzJ5cLp3MoXO0oDKjtZTmZS9Be/TDw=";
+            hash = "sha256-V+HKaWGAIs24ynFFIS9fQ0EAJJdNmlAMeL1sgDEAqWM=";
           };
           vendorHash = "sha256-+BfxCyg0KkDQpHt/wycy/8CTG6YBA/VJvJFhhzUnSiQ=";
         }
@@ -115,20 +115,20 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "immich";
-  version = "2.7.5";
+  version = "3.0.1";
 
   src = fetchFromGitHub {
     owner = "immich-app";
     repo = "immich";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-EC1IXM7KObAWfwG5KEao5VDp79d8WGNEI7E89lLOJ44=";
+    hash = "sha256-Z18SEjUdFP2/grQtHFI6J7CVcAMalshPt3Sd4tGXsDw=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
-    fetcherVersion = 3;
-    hash = "sha256-FEesjbhxP7ydFfNshF3iFIk9N3Z53jrEZ9DRBjgEfs0=";
+    fetcherVersion = 4;
+    hash = "sha256-kCMFAPWcv2/qqVUoR5pbRxmkGg3mLPrpm8ce7R+9VYM=";
   };
 
   postPatch = ''
@@ -174,7 +174,7 @@ stdenv.mkDerivation (finalAttrs: {
     # If exiftool-vendored.pl isn't found, exiftool is searched for on the PATH
     rm node_modules/.pnpm/node_modules/exiftool-vendored.pl
 
-    pnpm --filter immich build
+    pnpm --filter immich... build
 
     runHook postBuild
   '';
@@ -196,8 +196,8 @@ stdenv.mkDerivation (finalAttrs: {
       -o -name '*.target.mk' \
     \) -exec rm -r {} +
 
-    mkdir -p "$packageOut/build"
-    ln -s '${finalAttrs.passthru.plugins}' "$packageOut/build/corePlugin"
+    mkdir -p "$packageOut/build/plugins"
+    ln -s '${finalAttrs.passthru.plugin-core}' "$packageOut/build/plugins/immich-plugin-core"
     ln -s '${finalAttrs.passthru.web}' "$packageOut/build/www"
     ln -s '${geodata}' "$packageOut/build/geodata"
 
@@ -231,8 +231,8 @@ stdenv.mkDerivation (finalAttrs: {
       immich = finalAttrs.finalPackage;
     };
 
-    plugins = stdenv.mkDerivation {
-      pname = "immich-plugins";
+    plugin-core = stdenv.mkDerivation {
+      pname = "immich-plugin-core";
       inherit (finalAttrs) version src pnpmDeps;
 
       nativeBuildInputs = [
@@ -246,7 +246,7 @@ stdenv.mkDerivation (finalAttrs: {
       buildPhase = ''
         runHook preBuild
 
-        pnpm --filter plugins build
+        pnpm --filter @immich/plugin-core... build
 
         runHook postBuild
       '';
@@ -254,7 +254,7 @@ stdenv.mkDerivation (finalAttrs: {
       installPhase = ''
         runHook preInstall
 
-        cd plugins
+        cd packages/plugin-core
         mkdir $out
         cp -r dist manifest.json $out
 
@@ -275,8 +275,7 @@ stdenv.mkDerivation (finalAttrs: {
       buildPhase = ''
         runHook preBuild
 
-        pnpm --filter @immich/sdk build
-        pnpm --filter immich-web build
+        pnpm --filter immich-web... build
 
         runHook postBuild
       '';
diff --git a/pkgs/by-name/in/interval-tree/package.nix b/pkgs/by-name/in/interval-tree/package.nix
index 71ce2ea68ead..f43b8f9dc640 100644
--- a/pkgs/by-name/in/interval-tree/package.nix
+++ b/pkgs/by-name/in/interval-tree/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "interval-tree";
-  version = "3.1.1";
+  version = "3.1.2";
 
   src = fetchFromGitHub {
     owner = "5cript";
     repo = "interval-tree";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bSZ56EzzNy6gHgs8OptT/iBlf56RJz+09BE4WGGJpog=";
+    hash = "sha256-t1/oTr+sYkpTiDzaM4SxUcWzO3r24EkUJO04TYNLcQQ=";
   };
 
   # interval-tree is a header only library
diff --git a/pkgs/by-name/je/jellyfin-mpv-shim/package.nix b/pkgs/by-name/je/jellyfin-mpv-shim/package.nix
index 0f1334afafdb..09bc30ca7aa4 100644
--- a/pkgs/by-name/je/jellyfin-mpv-shim/package.nix
+++ b/pkgs/by-name/je/jellyfin-mpv-shim/package.nix
@@ -10,12 +10,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "jellyfin-mpv-shim";
-  version = "2.9.0";
+  version = "2.10.0";
   pyproject = true;
 
+  # contains shaderpacks
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-YrwMvP66LAWKgx/yWBkWIkZtJ4a0YnhCiL7xB6fGm0E=";
+    pname = "jellyfin_mpv_shim";
+    inherit version;
+    hash = "sha256-ZWmJQJAGAonStZyWww4P+034f2vGnTwLua7KUOqoBBE=";
   };
 
   nativeBuildInputs = [
@@ -29,29 +31,23 @@ python3Packages.buildPythonApplication rec {
   dependencies = with python3Packages; [
     jellyfin-apiclient-python
     mpv
-    pillow
     python-mpv-jsonipc
+    requests
 
-    # gui dependencies
+    # gui + mirror dependencies
+    pillow
     pystray
     tkinter
 
-    # display_mirror dependencies
-    jinja2
-    pywebview
-
     # discord rich presence dependency
     pypresence
   ];
 
-  # override $HOME directory:
-  #   error: [Errno 13] Permission denied: '/homeless-shelter'
-  #
-  # remove jellyfin_mpv_shim/win_utils.py:
-  #   ModuleNotFoundError: No module named 'win32gui'
   preCheck = ''
     export HOME=$TMPDIR
 
+    # remove jellyfin_mpv_shim/win_utils.py:
+    #   ModuleNotFoundError: No module named 'win32gui'
     rm jellyfin_mpv_shim/win_utils.py
   '';
 
@@ -60,7 +56,7 @@ python3Packages.buildPythonApplication rec {
       --replace-fail "check_updates: bool = True" "check_updates: bool = False" \
       --replace-fail "notify_updates: bool = True" "notify_updates: bool = False"
     # python-mpv renamed to mpv with 1.0.4
-    substituteInPlace setup.py \
+    substituteInPlace pyproject.toml \
       --replace-fail "python-mpv" "mpv" \
       --replace-fail "mpv-jsonipc" "python_mpv_jsonipc"
   '';
@@ -70,7 +66,7 @@ python3Packages.buildPythonApplication rec {
     for s in 16 32 48 64 128 256; do
       mkdir -p $out/share/icons/hicolor/''${s}x''${s}/apps
       ln -s $out/${python3Packages.python.sitePackages}/jellyfin_mpv_shim/integration/jellyfin-''${s}.png \
-        $out/share/icons/hicolor/''${s}x''${s}/apps/${pname}.png
+        $out/share/icons/hicolor/''${s}x''${s}/apps/jellyfin-mpv-shim.png
     done
   '';
 
@@ -84,9 +80,9 @@ python3Packages.buildPythonApplication rec {
 
   desktopItems = [
     (makeDesktopItem {
-      name = pname;
-      exec = pname;
-      icon = pname;
+      name = "jellyfin-mpv-shim";
+      exec = "jellyfin-mpv-shim";
+      icon = "jellyfin-mpv-shim";
       desktopName = "Jellyfin MPV Shim";
       categories = [
         "Video"
@@ -123,5 +119,6 @@ python3Packages.buildPythonApplication rec {
     ];
     maintainers = with lib.maintainers; [ jojosch ];
     mainProgram = "jellyfin-mpv-shim";
+    platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/by-name/la/lasuite-meet/frontend.nix b/pkgs/by-name/la/lasuite-meet/frontend.nix
index a6ff5debfd6e..4afde016f643 100644
--- a/pkgs/by-name/la/lasuite-meet/frontend.nix
+++ b/pkgs/by-name/la/lasuite-meet/frontend.nix
@@ -3,17 +3,37 @@
   version,
   meta,
   fetchNpmDeps,
+  fetchpatch,
   buildNpmPackage,
 }:
 buildNpmPackage (finalAttrs: {
   pname = "lasuite-meet-frontend";
   inherit src version;
 
+  patches = [
+    # backport build fix
+    # FIXME: remove in next release
+    (fetchpatch {
+      url = "https://github.com/suitenumerique/meet/commit/df1495c97bc913866169ee8875a9a3169fcfc87e.diff";
+      stripLen = 2;
+      includes = [
+        "package.json"
+        "package-lock.json"
+      ];
+      hash = "sha256-1A26T6LtFlOiJNVGD/fZs562feoQXY37A2ecUfvDGpk=";
+    })
+  ];
+
   sourceRoot = "${finalAttrs.src.name}/src/frontend";
 
   npmDeps = fetchNpmDeps {
-    inherit (finalAttrs) version src sourceRoot;
-    hash = "sha256-YnHjuwDp293KVNTYTd4KcZqMamZNeccOdpSGgJ9a3G8=";
+    inherit (finalAttrs)
+      version
+      src
+      patches
+      sourceRoot
+      ;
+    hash = "sha256-uiD5pcpmka43uraMFo7lRuQFx/4aq1BEhQvyCAzo8fg=";
   };
   npmBuildScript = "build";
 
diff --git a/pkgs/by-name/la/lasuite-meet/mail.nix b/pkgs/by-name/la/lasuite-meet/mail.nix
index 128b5f6e8dee..9cdc0bbc74e3 100644
--- a/pkgs/by-name/la/lasuite-meet/mail.nix
+++ b/pkgs/by-name/la/lasuite-meet/mail.nix
@@ -22,7 +22,7 @@ buildNpmPackage (finalAttrs: {
     pname = "${finalAttrs.pname}-npm-deps";
     inherit version src;
     inherit (finalAttrs) sourceRoot;
-    hash = "sha256-yq88kbrKn9HMwvxcWNXm7zonAqTs8T2i7iQAsD0TtnU=";
+    hash = "sha256-EPVkSzhecDZpvz+uOW0GZnmWl9KfE3UpkTCnhVnJ7dg=";
   };
   npmBuildScript = "build";
 
diff --git a/pkgs/by-name/la/lasuite-meet/package.nix b/pkgs/by-name/la/lasuite-meet/package.nix
index ee61defe5c5e..efb0ab1e6b5e 100644
--- a/pkgs/by-name/la/lasuite-meet/package.nix
+++ b/pkgs/by-name/la/lasuite-meet/package.nix
@@ -6,13 +6,13 @@
   python3,
 }:
 let
-  version = "1.21.0";
+  version = "1.22.0";
 
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "meet";
     tag = "v${version}";
-    hash = "sha256-pUCSdnTBj/qwc0cya3P96r89r2K1GNSGg4DeIhxUKwI=";
+    hash = "sha256-w2Lw5K62Iaqzqa/ckxK36o5ZHFLXUpHnGGGl5PYGjaI=";
   };
 
   meta = {
@@ -86,6 +86,7 @@ python.pkgs.buildPythonApplication (finalAttrs: {
       mozilla-django-oidc
       nested-multipart-parser
       phonenumbers
+      posthog
       psycopg
       pydantic
       pyjwt
diff --git a/pkgs/by-name/lo/localstack/package.nix b/pkgs/by-name/lo/localstack/package.nix
index f34f54c902fb..86e68afc6ccb 100644
--- a/pkgs/by-name/lo/localstack/package.nix
+++ b/pkgs/by-name/lo/localstack/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "localstack";
-  version = "4.12.0";
+  version = "4.13.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "localstack";
     repo = "localstack";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-k5aIdfWm3Tvl/J0s1l0gTXJqnb4j5doJdIIaLLOJXg4=";
+    hash = "sha256-vagQ2+eG93ns+E9HT/aDWlDn9jhhIyE7PxBXedsgyH0=";
   };
 
   build-system = with python3.pkgs; [
diff --git a/pkgs/by-name/my/mysql84/package.nix b/pkgs/by-name/my/mysql84/package.nix
index 7f5b682121a5..9d5b78c1e168 100644
--- a/pkgs/by-name/my/mysql84/package.nix
+++ b/pkgs/by-name/my/mysql84/package.nix
@@ -28,11 +28,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mysql";
-  version = "8.4.9";
+  version = "8.4.10";
 
   src = fetchurl {
     url = "https://dev.mysql.com/get/Downloads/MySQL-${lib.versions.majorMinor finalAttrs.version}/mysql-${finalAttrs.version}.tar.gz";
-    hash = "sha256-5KqLOeQtH+B48zu9c2lfrCtU28e7E38L2+Y/e+GgLWs=";
+    hash = "sha256-1XpnMLrvFK4Rj39KbgKEW1tQkzdY32H7BuEE8nzMj5Y=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/oh/oh-my-posh/package.nix b/pkgs/by-name/oh/oh-my-posh/package.nix
index 93fbf33e6a40..0999756f48aa 100644
--- a/pkgs/by-name/oh/oh-my-posh/package.nix
+++ b/pkgs/by-name/oh/oh-my-posh/package.nix
@@ -6,16 +6,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "oh-my-posh";
-  version = "29.19.0";
+  version = "29.20.0";
 
   src = fetchFromGitHub {
     owner = "jandedobbeleer";
     repo = "oh-my-posh";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KhE0JWOY9j4rSmVZOmUxC9pQbjSpISph+6RyntlryFs=";
+    hash = "sha256-EzdrqeWM85hh8lPxrweSPezydICRFyOStgDlEq8g9+8=";
   };
 
-  vendorHash = "sha256-SI2FjnRlWSsS9Uju8R+FW6/IpqewXsiOwKXfueZ7KPY=";
+  vendorHash = "sha256-PAdk6nf750wL619W6nyt1Ne/eYYlVkewIhWirNi9rK8=";
 
   sourceRoot = "${finalAttrs.src.name}/src";
 
diff --git a/pkgs/by-name/om/omniorb/package.nix b/pkgs/by-name/om/omniorb/package.nix
index 4c82dd4c8241..966cf0dedbc9 100644
--- a/pkgs/by-name/om/omniorb/package.nix
+++ b/pkgs/by-name/om/omniorb/package.nix
@@ -9,11 +9,11 @@
 stdenv.mkDerivation (finalAttrs: {
 
   pname = "omniorb";
-  version = "4.3.3";
+  version = "4.3.4";
 
   src = fetchurl {
     url = "mirror://sourceforge/project/omniorb/omniORB/omniORB-${finalAttrs.version}/omniORB-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-rM0l4stwxOM+0iew2T6WaeOMRgGWN4h8dxOYhw7UXno=";
+    hash = "sha256-eXINQV0jzY2pkoek702gqhvTTT5MexUwcVYArcXtPcM=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/by-name/os/osm2pgsql/package.nix b/pkgs/by-name/os/osm2pgsql/package.nix
index 7f5f6ac5945b..ba1b472acb0e 100644
--- a/pkgs/by-name/os/osm2pgsql/package.nix
+++ b/pkgs/by-name/os/osm2pgsql/package.nix
@@ -25,13 +25,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "osm2pgsql";
-  version = "2.3.0";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "osm2pgsql-dev";
     repo = "osm2pgsql";
     rev = finalAttrs.version;
-    hash = "sha256-+l74TWD2CJr0vj2uNuCCf5EHHTVysKBqEeWHInF4Ols=";
+    hash = "sha256-tvcnXsbHjke/25PKfWMANHI9K3CModTW8uxI2JxCWi4=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/pr/prmers/package.nix b/pkgs/by-name/pr/prmers/package.nix
index 558ed96e6cfe..2fa6a19fc63a 100644
--- a/pkgs/by-name/pr/prmers/package.nix
+++ b/pkgs/by-name/pr/prmers/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "prmers";
-  version = "4.19.00-alpha";
+  version = "4.20.14-alpha-vtrace-memsafe-v63";
 
   src = fetchFromGitHub {
     owner = "cherubrock-seb";
     repo = "PrMers";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zG9JLBqIqQjiz8+QNogk/rFeoj1/irmhfbVVe9HTq6A=";
+    hash = "sha256-QnQTAwsReKY7Rqm8spXmHZwfrw5VCsOOAtvhzE4GmHg=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/se/seafile-client/package.nix b/pkgs/by-name/se/seafile-client/package.nix
index 07a6bf03666e..b4f1ea6534e7 100644
--- a/pkgs/by-name/se/seafile-client/package.nix
+++ b/pkgs/by-name/se/seafile-client/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   fetchpatch,
   fetchFromGitHub,
+  nix-update-script,
   pkg-config,
   cmake,
   qt6,
@@ -15,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "seafile-client";
-  version = "9.0.15";
+  version = "9.0.20";
 
   src = fetchFromGitHub {
     owner = "haiwen";
     repo = "seafile-client";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BV1+9/+ryZB1BQyRJ5JaIU6bbOi4h8vt+V+FQIfUJp8=";
+    hash = "sha256-0idZCoTsuC32DolSLFDknQjvGWHGd4DQPCUyqocuuKA=";
   };
 
   patches = [
@@ -72,4 +73,5 @@ stdenv.mkDerivation (finalAttrs: {
     ];
     mainProgram = "seafile-applet";
   };
+  passthru.updateScript = nix-update-script { };
 })
diff --git a/pkgs/by-name/se/seafile-shared/package.nix b/pkgs/by-name/se/seafile-shared/package.nix
index 64b3ccfe34f4..d6cc528cab50 100644
--- a/pkgs/by-name/se/seafile-shared/package.nix
+++ b/pkgs/by-name/se/seafile-shared/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "seafile-shared";
-  version = "9.0.15";
+  version = "9.0.20";
 
   src = fetchFromGitHub {
     owner = "haiwen";
     repo = "seafile";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-mWIOk8O3vlg7Sm/5ZQUB5nOgi8/pEczCGQ94p0km/GI=";
+    hash = "sha256-PBoZDhY7GN8UuYUSXBCPZyBHBtlNcYK+0yS/rl66v9I=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/se/seaweedfs/package.nix b/pkgs/by-name/se/seaweedfs/package.nix
index 4e75bec00cf5..996dc79064a9 100644
--- a/pkgs/by-name/se/seaweedfs/package.nix
+++ b/pkgs/by-name/se/seaweedfs/package.nix
@@ -9,7 +9,7 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "seaweedfs";
-  version = "4.36";
+  version = "4.37";
 
   src = fetchFromGitHub {
     owner = "seaweedfs";
@@ -22,7 +22,7 @@ buildGoModule (finalAttrs: {
       find "$out" -name .git -print0 | xargs -0 rm -rf
       popd
     '';
-    hash = "sha256-y42opbGNVMxWU/k0j5g27RWLBF0PLcOPlXU9eVg0jwY=";
+    hash = "sha256-/aX9f78AsdgvsesGv2vTPoWVcqAhehFuL3NkzOyZSXQ=";
   };
 
   vendorHash = "sha256-peRhKuZ1D+y8Uhw1+P8Ogc1HrOh1/kYVd29lR89+rIo=";
diff --git a/pkgs/by-name/sn/snipaste/package.nix b/pkgs/by-name/sn/snipaste/package.nix
index d263602fad1e..cd2a8efd0ecf 100644
--- a/pkgs/by-name/sn/snipaste/package.nix
+++ b/pkgs/by-name/sn/snipaste/package.nix
@@ -2,26 +2,23 @@
   appimageTools,
   lib,
   fetchurl,
+  stdenv,
+  stdenvNoCC,
+  undmg,
+  makeWrapper,
 }:
-let
-  pname = "snipaste";
-  version = "2.10.8";
-  src = fetchurl {
-    url = "https://download.snipaste.com/archives/Snipaste-${version}-x86_64.AppImage";
-    hash = "sha256-Ieitxc1HPjqBpf7/rREKca+U0srE+q/s8mz+9Vhczk0=";
-  };
-  contents = appimageTools.extract { inherit pname version src; };
-in
-appimageTools.wrapType2 {
-  inherit pname version src;
-  passthru.updateScript = ./update.sh;
 
-  extraInstallCommands = ''
-    install -d $out/share/{applications,icons}
-    cp ${contents}/usr/share/applications/*.desktop -t $out/share/applications/
-    cp -r ${contents}/usr/share/icons/* -t $out/share/icons/
-    substituteInPlace $out/share/applications/*.desktop --replace-warn 'Exec=Snipaste' 'Exec=${pname}'
-  '';
+let
+  sources = import ./sources.nix { inherit fetchurl; };
+  source =
+    sources.${stdenv.hostPlatform.system}
+      or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+  pname = "snipaste";
+  inherit (source) version src;
+
+  passthru = {
+    updateScript = ./update.sh;
+  };
 
   meta = {
     description = "Screenshot tools";
@@ -32,7 +29,58 @@ appimageTools.wrapType2 {
       ltrump
     ];
     mainProgram = "snipaste";
-    platforms = [ "x86_64-linux" ];
+    platforms = [
+      "aarch64-darwin"
+      "x86_64-darwin"
+      "x86_64-linux"
+    ];
     sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
   };
-}
+in
+if stdenv.hostPlatform.isDarwin then
+  stdenvNoCC.mkDerivation {
+    inherit
+      pname
+      version
+      src
+      passthru
+      meta
+      ;
+
+    nativeBuildInputs = [
+      undmg
+      makeWrapper
+    ];
+
+    sourceRoot = ".";
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/Applications $out/bin
+      cp -R Snipaste.app $out/Applications
+      makeWrapper $out/Applications/Snipaste.app/Contents/MacOS/Snipaste $out/bin/snipaste
+
+      runHook postInstall
+    '';
+  }
+else
+  let
+    contents = appimageTools.extract { inherit pname version src; };
+  in
+  appimageTools.wrapType2 {
+    inherit
+      pname
+      version
+      src
+      passthru
+      meta
+      ;
+
+    extraInstallCommands = ''
+      install -d $out/share/{applications,icons}
+      install -m 444 ${contents}/Snipaste.desktop $out/share/applications/${pname}.desktop
+      cp -r ${contents}/usr/share/icons/* -t $out/share/icons/
+      substituteInPlace $out/share/applications/${pname}.desktop --replace-warn 'Exec=Snipaste' 'Exec=${pname}'
+    '';
+  }
diff --git a/pkgs/by-name/sn/snipaste/sources.nix b/pkgs/by-name/sn/snipaste/sources.nix
new file mode 100644
index 000000000000..fd43d746efdc
--- /dev/null
+++ b/pkgs/by-name/sn/snipaste/sources.nix
@@ -0,0 +1,23 @@
+# Generated by ./update.sh - do not update manually!
+# Last updated: 2026-06-20
+{ fetchurl }:
+let
+  any-darwin = {
+    version = "2.11.3";
+    src = fetchurl {
+      url = "https://download.snipaste.com/archives/Snipaste-2.11.3.dmg";
+      hash = "sha256-oih4OIieexc0pl2VK65e9/R5vcFj0MMb6RhZvKEg/T4=";
+    };
+  };
+in
+{
+  aarch64-darwin = any-darwin;
+  x86_64-darwin = any-darwin;
+  x86_64-linux = {
+    version = "2.11.3";
+    src = fetchurl {
+      url = "https://download.snipaste.com/archives/Snipaste-2.11.3-x86_64.AppImage";
+      hash = "sha256-6ARv8gRbZoul+sbXc9g3MTE6TwC6FxFHxvoaE4UkAzQ=";
+    };
+  };
+}
diff --git a/pkgs/by-name/sn/snipaste/update.sh b/pkgs/by-name/sn/snipaste/update.sh
index 1c6843fe6839..114574e3732d 100755
--- a/pkgs/by-name/sn/snipaste/update.sh
+++ b/pkgs/by-name/sn/snipaste/update.sh
@@ -1,15 +1,52 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p bash curl coreutils jq common-updater-scripts
+#!nix-shell -i bash -p bash curl coreutils jq nix
 
-latestTag=$(curl -sSfL https://www.snipaste.com/linux_version | jq -r ".subject")
-latestVersion="$(expr "$latestTag" : 'v\(.*\)')"
-currentVersion=$(nix-instantiate --eval -E "with import ./. {}; snipaste.version" | tr -d '"')
+set -euo pipefail
 
-if [[ "$latestVersion" == "$currentVersion" ]]; then
-    echo "package is up-to-date"
-    exit 0
-fi
+cd "$(readlink -e "$(dirname "${BASH_SOURCE[0]}")")"
 
-prefetch=$(nix-prefetch-url "https://download.snipaste.com/archives/Snipaste-$latestVersion-x86_64.AppImage")
-hash=$(nix-hash --type sha256 --to-sri "$prefetch")
-update-source-version snipaste "$latestVersion" "$hash" --ignore-same-version
+linux_version=$(
+  curl -sSfL https://www.snipaste.com/linux_version \
+    | jq -r '.subject' \
+    | sed 's/^v//'
+)
+mac_version=$(
+  curl -sSfL https://www.snipaste.com/mac_version \
+    | jq -r '.subject' \
+    | sed 's/^v//'
+)
+
+linux_url="https://download.snipaste.com/archives/Snipaste-${linux_version}-x86_64.AppImage"
+mac_url="https://download.snipaste.com/archives/Snipaste-${mac_version}.dmg"
+
+linux_hash=$(nix-prefetch-url "$linux_url")
+mac_hash=$(nix-prefetch-url "$mac_url")
+
+linux_hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 "$linux_hash")
+mac_hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 "$mac_hash")
+
+cat >sources.nix <<EOF
+# Generated by ./update.sh - do not update manually!
+# Last updated: $(date +%F)
+{ fetchurl }:
+let
+  any-darwin = {
+    version = "$mac_version";
+    src = fetchurl {
+      url = "$mac_url";
+      hash = "$mac_hash";
+    };
+  };
+in
+{
+  aarch64-darwin = any-darwin;
+  x86_64-darwin = any-darwin;
+  x86_64-linux = {
+    version = "$linux_version";
+    src = fetchurl {
+      url = "$linux_url";
+      hash = "$linux_hash";
+    };
+  };
+}
+EOF
diff --git a/pkgs/by-name/ss/sslmate/package.nix b/pkgs/by-name/ss/sslmate/package.nix
index 00b2e0714e2b..2d20853d8cc6 100644
--- a/pkgs/by-name/ss/sslmate/package.nix
+++ b/pkgs/by-name/ss/sslmate/package.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sslmate";
-  version = "1.9.1";
+  version = "1.10.0";
 
   src = fetchurl {
     url = "https://packages.sslmate.com/other/sslmate-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-F5szGn1cbw7R3lHMocM7as1RS/uaBqKCsvOxA+rXDOc=";
+    sha256 = "sha256-yjeK/CjFSjjymriVb41AWy0SSJ5mwPp6T+asyHaeX5E=";
   };
 
   makeFlags = [ "PREFIX=$(out)" ];
diff --git a/pkgs/by-name/st/stevenblack-blocklist/package.nix b/pkgs/by-name/st/stevenblack-blocklist/package.nix
index 6da4571b4574..88e5948799ab 100644
--- a/pkgs/by-name/st/stevenblack-blocklist/package.nix
+++ b/pkgs/by-name/st/stevenblack-blocklist/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "stevenblack-blocklist";
-  version = "3.16.91";
+  version = "3.16.94";
 
   src = fetchFromGitHub {
     owner = "StevenBlack";
     repo = "hosts";
     tag = finalAttrs.version;
-    hash = "sha256-ZW1sbLqlGv7DlbJ1BnkyGbPtCKtlmZWvxNS9NWxmle8=";
+    hash = "sha256-vVEf9FAXT4QgwM2BZF593JVD7NpTlwXdy9JXrnufhAo=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/st/stig/package.nix b/pkgs/by-name/st/stig/package.nix
index 281347638a79..1feb9ec5165d 100644
--- a/pkgs/by-name/st/stig/package.nix
+++ b/pkgs/by-name/st/stig/package.nix
@@ -10,14 +10,14 @@ python3Packages.buildPythonApplication (finalAttrs: {
   pname = "stig";
   # This project has a different concept for pre release / alpha,
   # Read the project's README for details: https://github.com/rndusr/stig#stig
-  version = "0.14.1a0";
+  version = "0.14.2a0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "rndusr";
     repo = "stig";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-DwZG/HB2oyLtCL2uY8X2LnXU86OYCTh6BdY3rVheJgU=";
+    hash = "sha256-g37be8EiuQGnGC6uKNadtG9Z78f+NutHHpAwzGcsmD8=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/sw/swaytreesave/package.nix b/pkgs/by-name/sw/swaytreesave/package.nix
index 2ff1ad652253..802e8e3773e4 100644
--- a/pkgs/by-name/sw/swaytreesave/package.nix
+++ b/pkgs/by-name/sw/swaytreesave/package.nix
@@ -6,7 +6,7 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "swaytreesave";
-  version = "0.4.0";
+  version = "0.4.2";
 
   __structuredAttrs = true;
 
@@ -14,10 +14,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "fabienjuif";
     repo = "swaytreesave";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-aAJBbauOiFERABF13hMhxyvRBzcx5c1F+vbm/U+JS8o=";
+    hash = "sha256-CEhtO7gjuuQ58kWsQKJTDqSqqw2lF7EUsO/i8d0NIiU=";
   };
 
-  cargoHash = "sha256-5nI7YJyCu7kZTa+Gsp0LCQXNjwVhUqOAxLC7XGtfKVk=";
+  cargoHash = "sha256-gbcVgdGvKxQioL6aQcMoajsJo2rTPDNqEhsywFPCQ0s=";
 
   meta = {
     description = "CLI to save and load your compositors tree/layout";
diff --git a/pkgs/by-name/sw/swpui/package.nix b/pkgs/by-name/sw/swpui/package.nix
index 39cb978db0c4..d53507548cf8 100644
--- a/pkgs/by-name/sw/swpui/package.nix
+++ b/pkgs/by-name/sw/swpui/package.nix
@@ -6,17 +6,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "swpui";
-  version = "0.9.0";
+  version = "0.10.0";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "beeb";
     repo = "swpui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JnWm+UFditTpDTLvWycSmS1jAJs5KaOF+ymVCeGzgAw=";
+    hash = "sha256-/UojnHph71H7mhinCi+uQDhkKkh20JdcHjiF1R7SE3A=";
   };
 
-  cargoHash = "sha256-FkQs9FLJ8JxvmfHwWx8kvv7UcX3YX+wyXinGeX5sNVQ=";
+  cargoHash = "sha256-jaI5jX5hdyZu15oObp+vx4P0OxW/3q2Pg4aQzSJySLY=";
 
   meta = {
     description = "TUI utility to search and replace with a focus on ergonomics, speed and case-awareness";
diff --git a/pkgs/by-name/sy/syncthing/package.nix b/pkgs/by-name/sy/syncthing/package.nix
index bd1a3aa1d69e..4bbd0bed0b2a 100644
--- a/pkgs/by-name/sy/syncthing/package.nix
+++ b/pkgs/by-name/sy/syncthing/package.nix
@@ -22,16 +22,16 @@ assert builtins.elem target [
 
 buildGoModule (finalAttrs: {
   pname = "syncthing";
-  version = "2.1.0";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "syncthing";
     repo = "syncthing";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-sTtFmZBPJIHMksaFFLmA3Abt9EhAC8Nz/ibdzg2LMd4=";
+    hash = "sha256-OwR1OiwtlJSRnFXFEyyHcL3q6NdDUQd4JEy0YSQ18fg=";
   };
 
-  vendorHash = "sha256-rOsdg98WVAKqjV7AxH+m4oSf8Z4FPru4NSbgGFtUMVE=";
+  vendorHash = "sha256-gfGuXBvGdQr+o8zV4MM1FYnOy2fpytIIEdQ9waGNSW4=";
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     # Recent versions of macOS seem to require binaries to be signed when
diff --git a/pkgs/by-name/ta/taisei/package.nix b/pkgs/by-name/ta/taisei/package.nix
index cf60561951d0..76230234dad5 100644
--- a/pkgs/by-name/ta/taisei/package.nix
+++ b/pkgs/by-name/ta/taisei/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+
   # Build depends
   docutils,
   meson,
@@ -13,10 +14,14 @@
   gamemode,
   shaderc,
   makeWrapper,
+  cmake,
+  mimalloc,
+  glslang,
+  libogg,
+  makeBinaryWrapper,
+
   # Runtime depends
-  glfw,
   sdl3,
-  SDL2_mixer,
   cglm,
   freetype,
   libpng,
@@ -24,10 +29,10 @@
   zlib,
   zstd,
   spirv-cross,
-  mimalloc,
 
   gamemodeSupport ? stdenv.hostPlatform.isLinux,
 }:
+
 stdenv.mkDerivation (finalAttrs: {
   pname = "taisei";
   version = "1.4.4";
@@ -49,12 +54,12 @@ stdenv.mkDerivation (finalAttrs: {
     python3Packages.zstandard
     shaderc
     makeWrapper
+    makeBinaryWrapper
+    cmake
   ];
 
   buildInputs = [
-    glfw
     sdl3
-    SDL2_mixer
     cglm
     freetype
     libpng
@@ -63,30 +68,48 @@ stdenv.mkDerivation (finalAttrs: {
     zstd
     opusfile
     openssl
-    spirv-cross
     mimalloc
+    libogg
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    glslang
+    spirv-cross
   ]
   ++ lib.optional gamemodeSupport gamemode;
 
+  # Forced to use builtin-sincos because the symbol isn't available otherwise
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin " -Dsincos=__builtin_sincos";
+
   mesonFlags = [
-    (lib.mesonBool "b_lto" false)
-    (lib.mesonEnable "install_macos_bundle" false)
-    (lib.mesonEnable "install_relocatable" false)
-    (lib.mesonEnable "shader_transpiler" false)
-    (lib.mesonEnable "shader_transpiler_dxbc" false)
-    (lib.mesonEnable "gamemode" gamemodeSupport)
-    (lib.mesonEnable "package_data" false)
     (lib.mesonEnable "vfs_zip" false)
+    (lib.mesonEnable "shader_transpiler_dxbc" false)
+    (lib.mesonEnable "package_data" false)
+    (lib.mesonBool "b_lto" false)
+    (lib.mesonEnable "gamemode" gamemodeSupport)
+    (lib.mesonEnable "install_freedesktop" stdenv.hostPlatform.isLinux)
+    (lib.mesonEnable "install_macos_bundle" stdenv.hostPlatform.isDarwin)
+    (lib.mesonEnable "install_relocatable" stdenv.hostPlatform.isDarwin)
+    (lib.mesonEnable "shader_transpiler" stdenv.hostPlatform.isDarwin)
   ];
 
   preConfigure = ''
     patchShebangs .
   '';
 
-  postInstall = lib.optionalString gamemodeSupport ''
-    wrapProgram $out/bin/taisei \
-      --set LD_LIBRARY_PATH ${lib.makeLibraryPath [ gamemode ]}
-  '';
+  postInstall =
+    lib.optionalString (stdenv.hostPlatform.isLinux && gamemodeSupport) ''
+      wrapProgram $out/bin/taisei \
+        --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ gamemode ]}"
+    ''
+    +
+
+      lib.optionalString stdenv.hostPlatform.isDarwin ''
+        mkdir -p $out/Applications $out/bin
+
+        mv $out/Taisei.app $out/Applications/
+        # regular symlink will fail here due to resources being missed
+        makeBinaryWrapper $out/Applications/Taisei.app/Contents/MacOS/Taisei $out/bin/taisei
+      '';
 
   strictDeps = true;
 
@@ -106,7 +129,9 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [
       lambda-11235
       Gliczy
+      philocalyst
     ];
     platforms = lib.platforms.all;
+    changelog = "https://github.com/taisei-project/taisei/releases/tag/${finalAttrs.src.tag}";
   };
 })
diff --git a/pkgs/by-name/te/terraform-local/package.nix b/pkgs/by-name/te/terraform-local/package.nix
index 40309d681ce0..6c5c7f88e43b 100644
--- a/pkgs/by-name/te/terraform-local/package.nix
+++ b/pkgs/by-name/te/terraform-local/package.nix
@@ -5,12 +5,12 @@
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "terraform_local";
-  version = "0.24.1";
+  version = "0.25.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-LPrrKDoXUwg/P1m+Gi4I0iUoaRNjNpTWlbBLupkTrpE=";
+    hash = "sha256-hzDPyS3Nv8sQKTQgyvsiVm1Woq9YE56Kl2gosQ4Hx+I=";
   };
 
   build-system = with python3Packages; [ setuptools ];
diff --git a/pkgs/by-name/tr/trackma/package.nix b/pkgs/by-name/tr/trackma/package.nix
index 87417d91dd16..63f1a6211f8a 100644
--- a/pkgs/by-name/tr/trackma/package.nix
+++ b/pkgs/by-name/tr/trackma/package.nix
@@ -33,14 +33,14 @@ let
 in
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "trackma";
-  version = "0.9";
+  version = "0.10.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "z411";
     repo = "trackma";
     tag = "v${finalAttrs.version}";
-    sha256 = "Hov9qdVabu1k3SIoUmvcRtSK8TcETqGPXI2RqN/bei4=";
+    sha256 = "HiHeq8mLNT54BWXXwOfeY+c+wGHWnlN5rA2WgXdrRY8=";
     fetchSubmodules = true; # for anime-relations submodule
   };
 
diff --git a/pkgs/by-name/we/werf/package.nix b/pkgs/by-name/we/werf/package.nix
index d155117d3932..08ec0c59694a 100644
--- a/pkgs/by-name/we/werf/package.nix
+++ b/pkgs/by-name/we/werf/package.nix
@@ -10,13 +10,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "werf";
-  version = "2.72.1";
+  version = "2.73.0";
 
   src = fetchFromGitHub {
     owner = "werf";
     repo = "werf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6CspoMRKPf20zQrmgD2RO6xMnTuyvM56AElKvMNNUM0=";
+    hash = "sha256-4YLJv5YDJUaoQlyljK4e8ilhCU67K7jJiDkFm7sYwxo=";
   };
 
   proxyVendor = true;
diff --git a/pkgs/by-name/wi/wimlib/package.nix b/pkgs/by-name/wi/wimlib/package.nix
index 489a4984dfa7..8278133d5de1 100644
--- a/pkgs/by-name/wi/wimlib/package.nix
+++ b/pkgs/by-name/wi/wimlib/package.nix
@@ -13,7 +13,7 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "1.14.4";
+  version = "1.14.5";
   pname = "wimlib";
 
   nativeBuildInputs = [
@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://wimlib.net/downloads/wimlib-${finalAttrs.version}.tar.gz";
-    hash = "sha256-NjPbK2yLJV64bTvz3zBZeWvR8I5QuMlyjH62ZmLlEwA=";
+    hash = "sha256-hCIaOr1bkSKPFfjmBlwzWjNiN7VzgZe3W/QZ7qVhoZQ=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/wr/wrangler/package.nix b/pkgs/by-name/wr/wrangler/package.nix
index 484794806ed1..131cc4fcc2b0 100644
--- a/pkgs/by-name/wr/wrangler/package.nix
+++ b/pkgs/by-name/wr/wrangler/package.nix
@@ -16,6 +16,7 @@
   moreutils,
   nix-update-script,
   versionCheckHook,
+  writableTmpDirAsHomeHook,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "wrangler";
@@ -119,7 +120,9 @@ stdenv.mkDerivation (finalAttrs: {
   doInstallCheck = true;
   nativeInstallCheckInputs = [
     versionCheckHook
+    writableTmpDirAsHomeHook
   ];
+  versionCheckKeepEnvironment = [ "HOME" ];
 
   preFixup = ''
     # fixupPhase spends a lot of time trying to strip text files, which is especially slow on Darwin
diff --git a/pkgs/by-name/xa/xaos/package.nix b/pkgs/by-name/xa/xaos/package.nix
index b3e117834837..e0c07b43f34d 100644
--- a/pkgs/by-name/xa/xaos/package.nix
+++ b/pkgs/by-name/xa/xaos/package.nix
@@ -11,7 +11,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "xaos";
-  version = "4.3.5";
+  version = "4.3.6";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -20,7 +20,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "xaos-project";
     repo = "XaoS";
     tag = "release-${finalAttrs.version}";
-    hash = "sha256-dGfmX55bm2BCFl7mRit88ULAcJ0VP15yVGI7nhRH0Ig=";
+    hash = "sha256-1Tr9R4xfqQwky2o3uBqyL9su2YPYgJySDTpQkabjVM4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/ocaml-modules/alcobar/default.nix b/pkgs/development/ocaml-modules/alcobar/default.nix
new file mode 100644
index 000000000000..fa91d72dacd8
--- /dev/null
+++ b/pkgs/development/ocaml-modules/alcobar/default.nix
@@ -0,0 +1,49 @@
+{
+  afl-persistent,
+  alcotest,
+  buildDunePackage,
+  calendar,
+  cmdliner,
+  fetchurl,
+  fpath,
+  lib,
+  ocaml,
+  pprint,
+  uucp,
+  uunf,
+}:
+
+buildDunePackage (finalAttrs: {
+  pname = "alcobar";
+  version = "0.3.1";
+  minimalOCamlVersion = "4.10";
+  __structuredAttrs = true;
+
+  src = fetchurl {
+    url = "https://github.com/samoht/alcobar/releases/download/v${finalAttrs.version}/alcobar-${finalAttrs.version}.tbz";
+    hash = "sha256-V2UnvLrtf+XXkp7uFlrIpxg6+fZqwhCS/J7C3Nw+eVU=";
+  };
+
+  propagatedBuildInputs = [
+    afl-persistent
+    alcotest
+    cmdliner
+  ];
+
+  checkInputs = [
+    calendar
+    fpath
+    pprint
+    uucp
+    uunf
+  ];
+  doCheck = lib.versionAtLeast ocaml.version "5.0";
+
+  meta = {
+    description = "Crowbar with an Alcotest-compatible API";
+    homepage = "https://github.com/samoht/alcobar";
+    changelog = "https://github.com/samoht/alcobar/blob/v${finalAttrs.version}/CHANGES.md";
+    license = lib.licenses.isc;
+    maintainers = [ lib.maintainers.vog ];
+  };
+})
diff --git a/pkgs/development/ocaml-modules/cascade/default.nix b/pkgs/development/ocaml-modules/cascade/default.nix
new file mode 100644
index 000000000000..e59bc6fec7d0
--- /dev/null
+++ b/pkgs/development/ocaml-modules/cascade/default.nix
@@ -0,0 +1,52 @@
+{
+  alcobar,
+  buildDunePackage,
+  dune-build-info,
+  fetchFromGitHub,
+  lambdasoup,
+  lib,
+  logs,
+  mdx,
+  memtrace,
+  psq,
+  uutf,
+}:
+
+buildDunePackage (finalAttrs: {
+  pname = "cascade";
+  version = "0-unstable-2026-06-26";
+  minimalOCamlVersion = "5.2";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "samoht";
+    repo = "cascade";
+    rev = "434c07be7ec1a63213a234946d57937e4d080feb";
+    hash = "sha256-6g8UKsXdR0PxihrOiMVC36q7+bomMByPDbmuISL7h4U=";
+  };
+
+  propagatedBuildInputs = [
+    dune-build-info
+    logs
+    psq
+    uutf
+  ];
+  buildInputs = [
+    lambdasoup
+    memtrace
+  ];
+
+  nativeCheckInputs = [ mdx.bin ];
+  checkInputs = [
+    (mdx.override { inherit logs; })
+    alcobar
+  ];
+  doCheck = true;
+
+  meta = {
+    description = "CSS generation and manipulation library for OCaml";
+    homepage = "https://github.com/samoht/cascade";
+    license = lib.licenses.isc;
+    maintainers = [ lib.maintainers.vog ];
+  };
+})
diff --git a/pkgs/development/ocaml-modules/tw/default.nix b/pkgs/development/ocaml-modules/tw/default.nix
new file mode 100644
index 000000000000..55f73dbe105c
--- /dev/null
+++ b/pkgs/development/ocaml-modules/tw/default.nix
@@ -0,0 +1,55 @@
+{
+  buildDunePackage,
+  cascade,
+  cmdliner,
+  fetchFromGitHub,
+  fmt,
+  lib,
+  ocaml,
+}:
+
+buildDunePackage (finalAttrs: {
+  pname = "tw";
+  version = "0-unstable-2026-06-23";
+  minimalOCamlVersion = "5.2";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "samoht";
+    repo = "tw";
+    rev = "594d35df46ec2afcfe97632923331badf2940b93";
+    hash = "sha256-vCRq0FCBIxc/AQg+R2Hig7nqwJGxgy2jedLbAsKaIoA=";
+  };
+
+  propagatedBuildInputs = [ cascade ];
+  buildInputs = [
+    cmdliner
+    fmt
+  ];
+
+  # Disabling tests because they check for byte-for-byte identical
+  # output with tailwindcss, so they are tied to a specific
+  # tailwindcss version, and would prevent independent upgrades of tw
+  # and tailwindcss.
+  doCheck = false;
+
+  outputs = [
+    "bin"
+    "lib"
+    "out"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    dune install --prefix=$bin --libdir=$lib/lib/ocaml/${ocaml.version}/site-lib
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Type-safe Tailwind CSS v4 in OCaml";
+    homepage = "https://github.com/samoht/tw";
+    mainProgram = "tw";
+    license = lib.licenses.isc;
+    maintainers = [ lib.maintainers.vog ];
+  };
+})
diff --git a/pkgs/development/python-modules/beets-importreplace/default.nix b/pkgs/development/python-modules/beets-importreplace/default.nix
new file mode 100644
index 000000000000..d5216530c8b8
--- /dev/null
+++ b/pkgs/development/python-modules/beets-importreplace/default.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildPythonPackage,
+  setuptools,
+  beets-minimal,
+  pytestCheckHook,
+  writableTmpDirAsHomeHook,
+  nix-update-script,
+}:
+buildPythonPackage (finalAttrs: {
+  pname = "beets-importreplace";
+  version = "0.3";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "edgars-supe";
+    repo = "beets-importreplace";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-lTfHuOBFzBM/uN4GCX6btQy0KRDP/tzG0fp9/qppQtw=";
+  };
+
+  build-system = [ setuptools ];
+
+  nativeBuildInputs = [
+    beets-minimal
+  ];
+
+  nativeCheckInputs = [
+    writableTmpDirAsHomeHook
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "beetsplug.importreplace" ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Plugin for beets to perform regex replacements during import";
+    homepage = "https://github.com/edgars-supe/beets-importreplace";
+    maintainers = with lib.maintainers; [ pyrox0 ];
+    license = [ lib.licenses.mit ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+  };
+})
diff --git a/pkgs/development/python-modules/beets-ytimport/default.nix b/pkgs/development/python-modules/beets-ytimport/default.nix
new file mode 100644
index 000000000000..9b1de1ea6de0
--- /dev/null
+++ b/pkgs/development/python-modules/beets-ytimport/default.nix
@@ -0,0 +1,51 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildPythonPackage,
+  setuptools,
+  ytmusicapi,
+  yt-dlp,
+  beets-minimal,
+  pytestCheckHook,
+  writableTmpDirAsHomeHook,
+  nix-update-script,
+}:
+buildPythonPackage rec {
+  pname = "beets-ytimport";
+  version = "1.13.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "mgoltzsche";
+    repo = "beets-ytimport";
+    tag = "v${version}";
+    hash = "sha256-EwSL1rBEPTcMfrlTkQcqRuhR8OtibBZqA0qQz4+qLEw=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    ytmusicapi
+    yt-dlp
+  ];
+
+  nativeBuildInputs = [
+    beets-minimal
+  ];
+
+  nativeCheckInputs = [
+    writableTmpDirAsHomeHook
+    pytestCheckHook
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    changelog = "https://github.com/mgoltzsche/beets-ytimport/releases/tag/v${version}";
+    description = "Beets plugin to import music from Youtube and SoundCloud";
+    homepage = "https://github.com/mgoltzsche/beets-ytimport";
+    maintainers = with lib.maintainers; [ pyrox0 ];
+    license = [ lib.licenses.asl20 ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+  };
+}
diff --git a/pkgs/development/python-modules/bleak/default.nix b/pkgs/development/python-modules/bleak/default.nix
index b3be05444068..b47a1f70f0c2 100644
--- a/pkgs/development/python-modules/bleak/default.nix
+++ b/pkgs/development/python-modules/bleak/default.nix
@@ -3,16 +3,20 @@
   stdenv,
   bluez,
   buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  uv-build,
+
+  # dependencies
   bumble,
   dbus-fast,
-  fetchFromGitHub,
   pyobjc-core,
   pyobjc-framework-CoreBluetooth,
   pyobjc-framework-libdispatch,
   pytest-asyncio,
   pytest-cov-stub,
   pytestCheckHook,
-  uv-build,
 }:
 
 buildPythonPackage (finalAttrs: {
@@ -68,6 +72,6 @@ buildPythonPackage (finalAttrs: {
     changelog = "https://github.com/hbldh/bleak/blob/${finalAttrs.src.tag}/CHANGELOG.rst";
     license = lib.licenses.mit;
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ rhendric ];
   };
 })
diff --git a/pkgs/development/python-modules/ghapi/default.nix b/pkgs/development/python-modules/ghapi/default.nix
index e0ff98a9d3a7..a75b0af20bc7 100644
--- a/pkgs/development/python-modules/ghapi/default.nix
+++ b/pkgs/development/python-modules/ghapi/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "ghapi";
-  version = "1.0.14";
+  version = "1.0.15";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "fastai";
     repo = "ghapi";
     tag = finalAttrs.version;
-    hash = "sha256-vVGVX8mWzEenaoDYGd4RjD/u2k/N9Ajm/pheKHPNEWM=";
+    hash = "sha256-H1DuoESnGtU3nsKzW3Zj0RdGNXj1bBGpt6W3mprpVeg=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/lib4sbom/default.nix b/pkgs/development/python-modules/lib4sbom/default.nix
index 51f8942e736e..959820a90e44 100644
--- a/pkgs/development/python-modules/lib4sbom/default.nix
+++ b/pkgs/development/python-modules/lib4sbom/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "lib4sbom";
-  version = "0.9.3";
+  version = "0.9.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "anthonyharrison";
     repo = "lib4sbom";
     tag = "v${version}";
-    hash = "sha256-HnRr8ij/NFFMgXIlLFKrX8dBdGN1VZnUsE5QcWx4AZc=";
+    hash = "sha256-oH/mUN14s9c8n7yhHV0MMXpIZhaYSfdPsyxX1kjk0+Q=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/notebook/default.nix b/pkgs/development/python-modules/notebook/default.nix
index e71a21eeb12b..2d756476dc10 100644
--- a/pkgs/development/python-modules/notebook/default.nix
+++ b/pkgs/development/python-modules/notebook/default.nix
@@ -81,6 +81,7 @@ buildPythonPackage rec {
   ];
 
   env = {
+    CI = 1; # quiet lerna progress bar
     JUPYTER_PLATFORM_DIRS = 1;
   };
 
diff --git a/pkgs/development/python-modules/pipdeptree/default.nix b/pkgs/development/python-modules/pipdeptree/default.nix
index 1bae5e6dae8a..e9eb3d6bee24 100644
--- a/pkgs/development/python-modules/pipdeptree/default.nix
+++ b/pkgs/development/python-modules/pipdeptree/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pipdeptree";
-  version = "3.1.0";
+  version = "3.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tox-dev";
     repo = "pipdeptree";
     tag = finalAttrs.version;
-    hash = "sha256-poUults9ev+5aryrZPxnxF/X9u0iivnlc1ceLxB7dys=";
+    hash = "sha256-EDpKJBDb3CkTMfiLyYMakbm5riIHsf+49yM99uQDPT8=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pontos/default.nix b/pkgs/development/python-modules/pontos/default.nix
index 7c56eb41bc0f..0f500c2091ab 100644
--- a/pkgs/development/python-modules/pontos/default.nix
+++ b/pkgs/development/python-modules/pontos/default.nix
@@ -16,16 +16,16 @@
   tomlkit,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pontos";
-  version = "26.5.0";
+  version = "26.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "greenbone";
     repo = "pontos";
-    tag = "v${version}";
-    hash = "sha256-P18RqOSY2g6R5m79nJbfoP9w1RhYiQ2HPWZrhwIHknI=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-NKe5kM4YPxsGge1UG7DjE3SDXlfZIVazOVmF5RBCbSo=";
   };
 
   build-system = [ poetry-core ];
@@ -75,8 +75,8 @@ buildPythonPackage rec {
   meta = {
     description = "Collection of Python utilities, tools, classes and functions";
     homepage = "https://github.com/greenbone/pontos";
-    changelog = "https://github.com/greenbone/pontos/releases/tag/${src.tag}";
+    changelog = "https://github.com/greenbone/pontos/releases/tag/${finalAttrs.src.tag}";
     license = with lib.licenses; [ gpl3Plus ];
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/python-apt/default.nix b/pkgs/development/python-modules/python-apt/default.nix
index 316a3f8eb9e3..9df487e14ac0 100644
--- a/pkgs/development/python-modules/python-apt/default.nix
+++ b/pkgs/development/python-modules/python-apt/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "apt";
-  version = "2.9.9";
+  version = "3.1.0";
 
   pyproject = true;
 
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "apt-team";
     repo = "python-apt";
     tag = version;
-    hash = "sha256-3mRMqbhKy5CYwpSttq8MgXY147Ov3lPuZaTjUMtmHik=";
+    hash = "sha256-ISvPBBvo6PGYsGS/tKsBEOAEviuFRj5rgydJ5BQ1f+4=";
   };
 
   buildInputs = [ apt.dev ];
diff --git a/pkgs/development/python-modules/python-mpv-jsonipc/default.nix b/pkgs/development/python-modules/python-mpv-jsonipc/default.nix
index 4ddb70266c80..63b4be98a1d0 100644
--- a/pkgs/development/python-modules/python-mpv-jsonipc/default.nix
+++ b/pkgs/development/python-modules/python-mpv-jsonipc/default.nix
@@ -2,38 +2,32 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  requests,
-  tqdm,
-  websocket-client,
+  setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "python-mpv-jsonipc";
-  version = "1.2.1";
-  format = "setuptools";
+  version = "1.2.2";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "iwalton3";
     repo = "python-mpv-jsonipc";
-    rev = "v${version}";
-    hash = "sha256-ugdLUmo5w+IbtmL2b6+la1X01mWNmnXr9j6e99oPWpE=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-9QfGsJW08YqATP4+G3bADkjxHoauSF7BmcsIi56fBKI=";
   };
 
+  build-system = [ setuptools ];
+
   # 'mpv-jsonipc' does not have any tests
   doCheck = false;
 
-  propagatedBuildInputs = [
-    requests
-    tqdm
-    websocket-client
-  ];
-
   pythonImportsCheck = [ "python_mpv_jsonipc" ];
 
   meta = {
     homepage = "https://github.com/iwalton3/python-mpv-jsonipc";
     description = "Python API to MPV using JSON IPC";
-    license = lib.licenses.gpl3;
+    license = lib.licenses.asl20;
     maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/texsoup/default.nix b/pkgs/development/python-modules/texsoup/default.nix
index 361904d641ff..a3b1149c6602 100644
--- a/pkgs/development/python-modules/texsoup/default.nix
+++ b/pkgs/development/python-modules/texsoup/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "texsoup";
-  version = "0.3.1";
+  version = "0.3.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "alvinwan";
     repo = "TexSoup";
     tag = finalAttrs.version;
-    hash = "sha256-XKYJycYivtrszU46B3Bd4JLrvckBpQu9gKDMdr6MyZU=";
+    hash = "sha256-CKUDDq+97kktQnsdwOkwLILdsE7CkQMxId30fbWX90c=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/wadllib/default.nix b/pkgs/development/python-modules/wadllib/default.nix
index 5012671e5d56..6d09207714b7 100644
--- a/pkgs/development/python-modules/wadllib/default.nix
+++ b/pkgs/development/python-modules/wadllib/default.nix
@@ -6,14 +6,14 @@
   lazr-uri,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "wadllib";
-  version = "2.0.0";
+  version = "2.1.0";
   pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-HtuvI+T6NP6nDJs4C6oqE5sQhq5InrzMxLO2X8lzdCc=";
+    inherit (finalAttrs) pname version;
+    hash = "sha256-acYKGIycYpoOlH36/Yms3It9jUBKa16wrSWP7yk2JQE=";
   };
 
   build-system = [ setuptools ];
@@ -33,4 +33,4 @@ buildPythonPackage rec {
     license = lib.licenses.lgpl3Only;
     maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/servers/sql/postgresql/ext/pgvector.nix b/pkgs/servers/sql/postgresql/ext/pgvector.nix
index 9998466e704a..761fb99f0ea9 100644
--- a/pkgs/servers/sql/postgresql/ext/pgvector.nix
+++ b/pkgs/servers/sql/postgresql/ext/pgvector.nix
@@ -7,13 +7,13 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "pgvector";
-  version = "0.8.3";
+  version = "0.8.4";
 
   src = fetchFromGitHub {
     owner = "pgvector";
     repo = "pgvector";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Tpa+OGau8RRMVgWQiAwjL3ez72hx6J+01yVvuCj7zVU=";
+    hash = "sha256-DczatZRfNHb2OHRkJMqshOuRCgI7+7r25o8E2rc+qLU=";
   };
 
   meta = {
diff --git a/pkgs/tools/networking/openvpn/default.nix b/pkgs/tools/networking/openvpn/default.nix
index bee9e1744aba..a61d981d53f0 100644
--- a/pkgs/tools/networking/openvpn/default.nix
+++ b/pkgs/tools/networking/openvpn/default.nix
@@ -23,11 +23,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "openvpn";
-  version = "2.6.19";
+  version = "2.6.21";
 
   src = fetchurl {
     url = "https://swupdate.openvpn.net/community/releases/openvpn-${finalAttrs.version}.tar.gz";
-    hash = "sha256-E3AlJvaHwYslQMGj8uGJGHuqplIR7c9/9ncvpp8FNs8=";
+    hash = "sha256-JMthheVEpHMj1nmLA9OfI2fZbyJ77pzRVD6O1Sgxmxc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 5b1e4c87fc3a..287d06540253 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1213,6 +1213,8 @@ with pkgs;
     )
   );
 
+  tw = ocamlPackages.tw.bin;
+
   wrapRetroArch = retroarch-bare.wrapper;
 
   # Aliases kept here because they are easier to use
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 6858539d4229..974759c5491b 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -24,6 +24,8 @@ let
 
         aeneas = callPackage ../development/ocaml-modules/aeneas { };
 
+        alcobar = callPackage ../development/ocaml-modules/alcobar { };
+
         alcotest = callPackage ../development/ocaml-modules/alcotest { };
 
         alcotest-lwt = callPackage ../development/ocaml-modules/alcotest/lwt.nix { };
@@ -243,6 +245,8 @@ let
           git-binary = pkgs.git;
         };
 
+        cascade = callPackage ../development/ocaml-modules/cascade { };
+
         cbor = callPackage ../development/ocaml-modules/cbor { };
 
         cfstream = callPackage ../development/ocaml-modules/cfstream { };
@@ -2187,6 +2191,8 @@ let
 
         tuntap = callPackage ../development/ocaml-modules/tuntap { };
 
+        tw = callPackage ../development/ocaml-modules/tw { };
+
         twt = callPackage ../development/ocaml-modules/twt { };
 
         type_eq = callPackage ../development/ocaml-modules/type_eq { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index ef5dea667994..b8df53f8b208 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2307,10 +2307,14 @@ self: super: with self; {
 
   beets-filetote = callPackage ../development/python-modules/beets-filetote { };
 
+  beets-importreplace = callPackage ../development/python-modules/beets-importreplace { };
+
   beets-minimal = beets.override {
     disableAllPlugins = true;
   };
 
+  beets-ytimport = callPackage ../development/python-modules/beets-ytimport { };
+
   beewi-smartclim = callPackage ../development/python-modules/beewi-smartclim { };
 
   before-after = callPackage ../development/python-modules/before-after { };