diff --git a/doc/release-notes/rl-2611.section.md b/doc/release-notes/rl-2611.section.md
index e8cfd1a68c13..ab87aad9e40d 100644
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@@ -157,6 +157,8 @@
 
 - `pdfium` is now built from source instead of packaging prebuilt binaries. `pdfium-binaries` has been renamed to `pdfium`, and `pdfium-binaries-v8` has been removed.
 
+- `iocaine` has been updated to `3.5.1`.
+
 - `librest` providing 0.7 ABI was removed. `librest_1_0` providing 1.0 ABI was renamed to `librest` and `librest_1_0` was kept as an alias.
 
 - `luaPackages.lrexlib-pcre` has been removed as part of the process to fully migrate from the end-of-life PRCE library to PCRE2. `luaPackages.lrexlib-pcre2` and multiple other versions of lrexlib can be used instead.
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 4ff10f07d5cd..6c00b8b06f14 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -10411,7 +10411,7 @@
   };
   gibbert = {
     email = "gbjgms@gmail.com";
-    github = "zgibberish";
+    github = "2gibbert";
     githubId = 67570424;
     name = "gibbert";
   };
@@ -25336,6 +25336,14 @@
     github = "Ruixi-rebirth";
     githubId = 75824585;
   };
+  RumBugen = {
+    name = "Vladislav Wanner";
+    email = "vladislavwanner@gmail.com";
+    github = "RumBugen";
+    githubId = 43646118;
+    matrix = "@rumbugen:matrix.org";
+    keys = [ { fingerprint = "305D 2271 3C43 2E52 FB86  7C64 6107 6951 3194 1931"; } ];
+  };
   rumpelsepp = {
     name = "Stefan Tatschner";
     email = "stefan@rumpelsepp.org";
diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index e7b31bc1d418..04470e9ba9b2 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -62,6 +62,8 @@
 
 - [feishin](https://github.com/jeffvli/feishin), a modern self-hosted music player. Available as [services.feishin](#opt-services.feishin.enable).
 
+- [Aurral](https://aurral.org), a Lidarr companion for self-hosted music discovery. Available as [services.aurral](#opt-services.aurral.enable).
+
 - [CastSponsorSkip](https://github.com/gabe565/CastSponsorSkip/), skips YouTube sponsorships (and sometimes ads) on all local Google Cast devices.
 
 - [Stump](https://www.stumpapp.dev/), a free and open source comics, manga and digital book server with OPDS support. Available as [services.stump](#opt-services.stump.enable).
@@ -100,6 +102,8 @@
 
 - [vellum](https://github.com/greyxp1/vellum) is a live screen annotation overlay for Wayland. Available as [programs.vellum](#opt-programs.vellum.enable).
 
+- [iocaine](https://git.madhouse-project.org/iocaine/iocaine) is a defense mechanism against unwanted scrapers. Available as [services.iocaine](#opt-services.iocaine.enable).
+
 - [stash-clipboard](https://github.com/NotAShelf/stash), a Wayland clipboard "manager" with fast persistent history and multi-media support. Available as [services.stash-clipboard](#opt-services.stash-clipboard.enable).
 
 - [OO7](https://github.com/linux-credentials/oo7) is a desktop-agnostic Secret Service provider. Available as [services.oo7](#opt-services.oo7.enable)
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 9908b69a1f32..b29a426cf834 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -855,6 +855,7 @@
   ./services/misc/anki-sync-server.nix
   ./services/misc/apache-kafka.nix
   ./services/misc/atuin.nix
+  ./services/misc/aurral.nix
   ./services/misc/autobrr.nix
   ./services/misc/autofs.nix
   ./services/misc/autorandr.nix
@@ -1282,6 +1283,7 @@
   ./services/networking/imaginary.nix
   ./services/networking/inadyn.nix
   ./services/networking/inspircd.nix
+  ./services/networking/iocaine.nix
   ./services/networking/iodine.nix
   ./services/networking/iperf3.nix
   ./services/networking/ircd-hybrid/default.nix
diff --git a/nixos/modules/services/misc/aurral.nix b/nixos/modules/services/misc/aurral.nix
new file mode 100644
index 000000000000..06ef6af13e21
--- /dev/null
+++ b/nixos/modules/services/misc/aurral.nix
@@ -0,0 +1,185 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = config.services.aurral;
+in
+{
+  options = {
+    services.aurral = {
+      enable = lib.mkEnableOption "Aurral is the Lidarr companion for self-hosted music discovery";
+
+      package = lib.mkPackageOption pkgs "aurral" { };
+
+      directories = lib.mkOption {
+        type = lib.types.listOf lib.types.externalPath;
+        default = [ ];
+        description = ''
+          Directories that Aurral needs access to. Other directories won't be visible by the app.
+          Environment variable `DOWNLOAD_FOLDER` is added automatically.
+          See BindPaths in {manpage}`systemd.exec(5)`.
+        '';
+      };
+
+      dataDir = lib.mkOption {
+        type = lib.types.externalPath;
+        default = "/var/lib/aurral";
+        description = ''
+          The directory where Aurral stores its stateful data.
+        '';
+      };
+
+      port = lib.mkOption {
+        type = lib.types.port;
+        default = 3001;
+        description = "Port number";
+      };
+
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = ''
+          Open ports in the firewall for Aurral.
+        '';
+      };
+
+      user = lib.mkOption {
+        type = lib.types.str;
+        default = "aurral";
+        description = ''
+          User account under which Aurral runs.
+        '';
+      };
+
+      group = lib.mkOption {
+        type = lib.types.str;
+        default = "aurral";
+        description = ''
+          Group under which Aurral runs.
+        '';
+      };
+
+      environment = lib.mkOption {
+        type = lib.types.attrsOf lib.types.str;
+        default = { };
+        example = {
+          DOWNLOAD_FOLDER = "/media/downloads";
+          TRUST_PROXY = "true";
+        };
+        description = ''
+          Environment variables passed to the service.
+        '';
+      };
+
+      environmentFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
+        default = null;
+        description = ''
+          Environment file as defined in {manpage}`systemd.exec(5)` passed to the service.
+        '';
+      };
+
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.aurral = {
+      description = "Aurral";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      environment = cfg.environment // {
+        AURRAL_DATA_DIR = cfg.dataDir;
+        PORT = toString cfg.port;
+      };
+
+      path = [ cfg.package ];
+
+      serviceConfig = {
+        Type = "simple";
+        ExecStart = lib.getExe cfg.package;
+        Restart = "on-failure";
+        User = cfg.user;
+        Group = cfg.group;
+        EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
+        StateDirectory = lib.mkIf (cfg.dataDir == "/var/lib/aurral") "aurral";
+        WorkingDirectory = cfg.dataDir;
+        ReadWritePaths = "";
+        ProtectSystem = "strict";
+        BindPaths = [
+          cfg.dataDir
+        ]
+        ++ (lib.map (x: "-" + x) cfg.directories)
+        ++ lib.optional (cfg.environment ? DOWNLOAD_FOLDER) cfg.environment.DOWNLOAD_FOLDER;
+        BindReadOnlyPaths = [
+          builtins.storeDir
+          "${config.security.pki.caBundle}:/etc/ssl/certs/ca-certificates.crt"
+          "-/etc/resolv.conf"
+        ]
+        ++ lib.optionals config.services.resolved.enable [
+          "/run/systemd/resolve/stub-resolv.conf"
+          "/run/systemd/resolve/resolv.conf"
+        ];
+        RestrictSUIDSGID = true;
+        CapabilityBoundingSet = "";
+        RestrictAddressFamilies = [
+          "AF_UNIX"
+          "AF_INET"
+          "AF_INET6"
+        ];
+        SocketBindDeny = "any";
+        SocketBindAllow = toString cfg.port;
+        SystemCallErrorNumber = "EPERM";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+        UMask = "0007";
+        SystemCallArchitectures = "native";
+        ProtectProc = "invisible";
+        ProcSubset = "pid";
+        LockPersonality = true;
+        NoNewPrivileges = true;
+        DevicePolicy = "closed";
+        PrivateIPC = true;
+        PrivatePIDs = true;
+        ProtectClock = true;
+        ProtectHome = true;
+        ProtectKernelLogs = true;
+        ProtectHostname = true;
+        RemoveIPC = true;
+        RestrictRealtime = true;
+        RestrictNamespaces = true;
+        MemoryDenyWriteExecute = false;
+      };
+
+      confinement.enable = true;
+    };
+
+    systemd.tmpfiles.settings."10-aurral" = lib.mkIf (cfg.environment ? DOWNLOAD_FOLDER) {
+      ${cfg.environment.DOWNLOAD_FOLDER}.d = {
+        inherit (cfg) user group;
+        mode = "0770";
+      };
+    };
+
+    users.users = lib.mkIf (cfg.user == "aurral") {
+      aurral = {
+        isSystemUser = true;
+        home = cfg.dataDir;
+        group = cfg.group;
+      };
+    };
+
+    users.groups = lib.mkIf (cfg.group == "aurral") {
+      aurral = { };
+    };
+
+    networking.firewall = lib.mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.port ];
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/iocaine.nix b/nixos/modules/services/networking/iocaine.nix
new file mode 100644
index 000000000000..9ac0a8a12659
--- /dev/null
+++ b/nixos/modules/services/networking/iocaine.nix
@@ -0,0 +1,226 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib)
+    any
+    getExe
+    hasPrefix
+    mapAttrsToList
+    mkIf
+    literalExpression
+    mkEnableOption
+    mkMerge
+    mkOption
+    mkPackageOption
+    optional
+    optionals
+    ;
+
+  inherit (lib.types)
+    attrsOf
+    bool
+    listOf
+    nullOr
+    path
+    str
+    submodule
+    ;
+
+  cfg = config.services.iocaine;
+
+  jsonFormat = pkgs.formats.json { };
+
+  hasUDSbind = any (hasPrefix "/") (
+    mapAttrsToList (_server: cfg: cfg.bind) (cfg.settings.server or { })
+  );
+
+  ifHasSettings = optional (cfg.settings != null);
+
+  hasFirewall = cfg.settings.firewall.enable;
+
+  description = "iocaine, the deadliest poison known to AI";
+in
+{
+  options.services.iocaine = {
+    enable = mkEnableOption description;
+
+    package = mkPackageOption pkgs "iocaine" { };
+
+    environment = mkOption {
+      default = { };
+      type = attrsOf str;
+      description = "Environment variables for iocaine.";
+      example = literalExpression ''
+        {
+          RUST_LOG = "info";
+          RUST_BACKTRACE = "1";
+        }
+      '';
+    };
+
+    settings = mkOption {
+      type = nullOr (submodule {
+        freeformType = jsonFormat.type;
+
+        options = {
+          firewall.enable = mkOption {
+            default = false;
+            type = bool;
+            description = "Enables the firewall";
+            example = true;
+          };
+        };
+      });
+      default = null;
+      description = ''
+        The configuration for iocaine.
+        See [the configuration reference](https://iocaine.madhouse-project.org/documentation/3/configuration/)
+        for full documentation on the fields.
+      '';
+      example = literalExpression ''
+        {
+          server.default = {
+            bind = "localhost:2137";
+            mode = "http";
+            use.handler-from = "default";
+          };
+
+          handler.default = {
+            settings = {
+              "ai-robots-txt-path" = "/etc/iocaine/data/ai.robots.txt-robots.json";
+              sources = {
+                training-corpus = [
+                  "/data/corpus/1984.txt"
+                  "/data/corpus/brave-new-world.txt"
+                ];
+                wordlists = [ "/data/corpus/words.txt" ];
+              };
+            };
+          };
+        }
+      '';
+    };
+
+    extraSettingsPaths = mkOption {
+      type = listOf path;
+      default = [ ];
+      description = "Configuration paths to run iocaine with. Useful for secrets";
+      example = literalExpression ''
+        [
+          "/etc/iocaine/iocaine.json"
+          ./iocaine.json
+        ]
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment.etc."iocaine/iocaine.json" = mkIf (cfg.settings != null) {
+      source = jsonFormat.generate "iocaine.json" cfg.settings;
+    };
+
+    systemd.services = mkMerge [
+      {
+        iocaine = {
+          inherit description;
+
+          wantedBy = [ "multi-user.target" ];
+          after = [ "network.target" ];
+
+          environment = {
+            HOME = "%S/home";
+          }
+          // cfg.environment;
+
+          restartTriggers =
+            (ifHasSettings config.environment.etc."iocaine/iocaine.json".source) ++ cfg.extraSettingsPaths;
+
+          stopIfChanged = false;
+
+          serviceConfig = {
+            Type = "notify";
+            ExecStart = toString (
+              [
+                (getExe cfg.package)
+              ]
+              ++ (map (path: "--config-path=${path}") (
+                (ifHasSettings "/etc/iocaine/iocaine.json") ++ cfg.extraSettingsPaths
+              ))
+              ++ [ "start" ]
+            );
+
+            Restart = "on-failure";
+            DynamicUser = true;
+            UMask = "0077";
+            LimitNOFILE = 524288;
+
+            StateDirectory = "iocaine";
+            WorkingDirectory = "%S/iocaine";
+            RuntimeDirectory = "iocaine";
+
+            ProtectSystem = "strict";
+            ProtectClock = true;
+            ProtectHostname = true;
+            ProtectProc = "invisible";
+            ProtectControlGroups = true;
+            ProtectKernelModules = true;
+            ProtectKernelTunables = true;
+            ProtectKernelLogs = true;
+            ProtectHome = true;
+
+            PrivateTmp = true;
+            PrivateDevices = true;
+            PrivateUsers = !hasFirewall;
+
+            SystemCallArchitectures = "native";
+            DevicePolicy = "closed";
+            LockPersonality = true;
+            MemoryDenyWriteExecute = false;
+            NoNewPrivileges = true;
+
+            RestrictAddressFamilies =
+              (optionals hasUDSbind [
+                "AF_INET"
+                "AF_INET6"
+                "AF_UNIX"
+              ])
+              ++ (optionals hasFirewall [ "AF_NETLINK" ]);
+
+            RestrictNamespaces = true;
+            RestrictRealtime = true;
+            SystemCallFilter = [
+              "@system-service"
+              "~@privileged"
+              "~@resources"
+            ];
+
+            CapabilityBoundingSet = mkIf hasFirewall [ "CAP_NET_ADMIN" ];
+            AmbientCapabilities = mkIf hasFirewall [ "CAP_NET_ADMIN" ];
+          };
+        };
+      }
+
+      (
+        let
+          iocaineDep = {
+            requires = [ "iocaine.service" ];
+            after = [ "iocaine.service" ];
+            serviceConfig.SupplementaryGroups = [ "iocaine" ];
+          };
+        in
+        {
+          nginx = mkIf (config.services.nginx.enable && hasUDSbind) iocaineDep;
+          caddy = mkIf (config.services.caddy.enable && hasUDSbind) iocaineDep;
+        }
+      )
+    ];
+  };
+
+  meta = {
+    maintainers = with lib.maintainers; [ poz ];
+  };
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 48f75e4f1077..622abe491632 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -301,6 +301,7 @@ in
   audiobookshelf = runTest ./audiobookshelf.nix;
   audit = runTest ./audit.nix;
   audit-testsuite = runTest ./audit-testsuite.nix;
+  aurral = runTest ./aurral.nix;
   auth-mysql = runTest ./auth-mysql.nix;
   authelia = runTest ./authelia.nix;
   auto-cpufreq = runTest ./auto-cpufreq.nix;
@@ -860,6 +861,7 @@ in
   hibernate-systemd-stage-1 = handleTestOn [ "x86_64-linux" ] ./hibernate.nix {
     systemdStage1 = true;
   };
+  hickory-dns = runTest ./hickory-dns.nix;
   hister = runTest ./hister.nix;
   hitch = runTest ./hitch;
   hledger-web = runTest ./hledger-web.nix;
@@ -925,6 +927,7 @@ in
   inventree = runTest ./inventree.nix;
   invidious = runTest ./invidious.nix;
   invoiceplane = runTest ./invoiceplane.nix;
+  iocaine = runTest ./iocaine.nix;
   iodine = runTest ./iodine.nix;
   iosched = runTest ./iosched.nix;
   ipget = runTest ./ipget.nix;
diff --git a/nixos/tests/aurral.nix b/nixos/tests/aurral.nix
new file mode 100644
index 000000000000..b3cd79092899
--- /dev/null
+++ b/nixos/tests/aurral.nix
@@ -0,0 +1,29 @@
+{ lib, ... }:
+{
+  name = "aurral";
+  meta = with lib.maintainers; {
+    maintainers = [ hougo ];
+  };
+
+  nodes = {
+    machine =
+      { ... }:
+      {
+        services.aurral = {
+          enable = true;
+          environment = {
+            DOWNLOAD_FOLDER = "/var/lib/aurral-downloads";
+          };
+        };
+      };
+  };
+
+  testScript = ''
+    start_all()
+
+    machine.wait_for_unit("aurral.service")
+    machine.wait_for_open_port(3001)
+
+    machine.succeed('curl --fail http://localhost:3001/api/health')
+  '';
+}
diff --git a/nixos/tests/hickory-dns.nix b/nixos/tests/hickory-dns.nix
new file mode 100644
index 000000000000..341b25b91cc2
--- /dev/null
+++ b/nixos/tests/hickory-dns.nix
@@ -0,0 +1,41 @@
+{ pkgs, ... }:
+{
+  name = "hickory-dns";
+
+  meta.maintainers = with pkgs.lib.maintainers; [ adamcstephens ];
+
+  containers.machine = {
+    environment.systemPackages = [ pkgs.doggo ];
+
+    services.hickory-dns = {
+      enable = true;
+      settings.zones = [
+        {
+          zone = "example.test";
+          file = pkgs.writeText "example.test.zone" ''
+            $ORIGIN example.test.
+            $TTL 3600
+            @ IN SOA ns.example.test. hostmaster.example.test. (1 3600 600 86400 3600)
+            @ IN NS ns.example.test.
+            ns IN A 127.0.0.1
+            www IN A 192.0.2.1
+          '';
+        }
+      ];
+    };
+  };
+
+  testScript = ''
+    import json
+
+    machine.start()
+    machine.wait_for_unit("hickory-dns.service")
+    machine.wait_for_open_port(53)
+
+    response = json.loads(machine.succeed("doggo @127.0.0.1 www.example.test. A --json"))
+    answers = response["responses"][0]["answers"]
+    assert [(answer["name"], answer["type"], answer["address"]) for answer in answers] == [
+        ("www.example.test.", "A", "192.0.2.1")
+    ], response
+  '';
+}
diff --git a/nixos/tests/iocaine.nix b/nixos/tests/iocaine.nix
new file mode 100644
index 000000000000..ace4652ce0d4
--- /dev/null
+++ b/nixos/tests/iocaine.nix
@@ -0,0 +1,61 @@
+{ lib, ... }:
+{
+  name = "iocaine";
+  meta.maintainers = with lib.maintainers; [ poz ];
+
+  nodes = {
+    iocaine_default = {
+      services.iocaine = {
+        enable = true;
+      };
+    };
+
+    reverse_proxy_integration = {
+      services.iocaine = {
+        enable = true;
+        settings.server.main = {
+          bind = "/run/iocaine/iocaine.socket";
+          unix-socket-access = "group";
+          mode = "http";
+          use = {
+            handler-from = "default";
+          };
+        };
+        settings.handler.default = { };
+      };
+
+      services.caddy = {
+        enable = true;
+        globalConfig = ''
+          http_port 8080
+          https_port 8081
+        '';
+      };
+
+      services.nginx.enable = true;
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    iocaine_default.wait_for_unit("iocaine.service")
+    iocaine_default.fail("curl -s --show-error --fail http://127.0.0.1:42069/random-path/yes/")
+    iocaine_default.fail("curl -s --show-error --fail http://127.0.0.1:42069/ -A 'Googlebot'")
+    iocaine_default.succeed("curl -s --show-error --fail http://127.0.0.1:42069/a/path/very/deep/into/the/forest/ -A 'Perplexity'")
+    iocaine_default.fail("curl -s --show-error --fail http://127.0.0.1:42042/metrics")
+
+    reverse_proxy_integration.wait_for_unit("iocaine.service")
+    reverse_proxy_integration.wait_for_unit("caddy.service")
+    reverse_proxy_integration.wait_for_unit("nginx.service")
+    reverse_proxy_integration.stop_job("nginx")
+    reverse_proxy_integration.stop_job("caddy")
+    reverse_proxy_integration.stop_job("iocaine")
+    reverse_proxy_integration.start_job("nginx")
+    reverse_proxy_integration.succeed("systemctl is-active iocaine.service")
+    reverse_proxy_integration.stop_job("nginx")
+    reverse_proxy_integration.stop_job("iocaine")
+    reverse_proxy_integration.start_job("caddy")
+    reverse_proxy_integration.succeed("systemctl is-active iocaine.service")
+  '';
+}
diff --git a/pkgs/applications/editors/emacs/build-support/elpa2nix.el b/pkgs/applications/editors/emacs/build-support/elpa2nix.el
index 5b363b7b6640..4622442f7492 100644
--- a/pkgs/applications/editors/emacs/build-support/elpa2nix.el
+++ b/pkgs/applications/editors/emacs/build-support/elpa2nix.el
@@ -1,3 +1,5 @@
+;; -*- lexical-binding: t; -*-
+
 (require 'package)
 (package-initialize)
 
diff --git a/pkgs/applications/editors/emacs/build-support/melpa2nix.el b/pkgs/applications/editors/emacs/build-support/melpa2nix.el
index f2cb334f4c41..28ae9b65c5da 100644
--- a/pkgs/applications/editors/emacs/build-support/melpa2nix.el
+++ b/pkgs/applications/editors/emacs/build-support/melpa2nix.el
@@ -1,3 +1,5 @@
+;; -*- lexical-binding: t; -*-
+
 (require 'package-recipe)
 (require 'package-build)
 
diff --git a/pkgs/applications/editors/emacs/build-support/mk-wrapper-subdirs.el b/pkgs/applications/editors/emacs/build-support/mk-wrapper-subdirs.el
index 7d30400a5c65..caca513047a4 100644
--- a/pkgs/applications/editors/emacs/build-support/mk-wrapper-subdirs.el
+++ b/pkgs/applications/editors/emacs/build-support/mk-wrapper-subdirs.el
@@ -1,3 +1,5 @@
+;; -*- lexical-binding: t; -*-
+
 (defmacro mk-subdirs-expr (path)
   `(setq load-path
          (delete-dups (append '(,path)
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index e5af53fda1ab..a1b21aff02e7 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1190,8 +1190,8 @@ let
         mktplcRef = {
           publisher = "DanielSanMedium";
           name = "dscodegpt";
-          version = "3.24.57";
-          hash = "sha256-iZZlZqghFRBtAOGZz1DV5bW0n41DpJKB865plQ5rXoY=";
+          version = "3.24.67";
+          hash = "sha256-ynB3xPun4swOhvVLmNpIAue7VmfabKUzR0RCqOgpyYY=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/DanielSanMedium.dscodegpt/changelog";
@@ -1242,8 +1242,8 @@ let
         mktplcRef = {
           name = "databricks";
           publisher = "databricks";
-          version = "2.15.0";
-          hash = "sha256-IkzkKEmcbRI0RD72NFgE38oDKxrFe+rYozkUmOc3SBM=";
+          version = "2.17.1";
+          hash = "sha256-UWvn9Gy31/9HSKD+OCfpoE4BSGyReC4pv+4sH7higTU=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/databricks.databricks/changelog";
@@ -1792,8 +1792,8 @@ let
         mktplcRef = {
           name = "foam-vscode";
           publisher = "foam";
-          version = "0.44.5";
-          hash = "sha256-MiQ1Ze0vW0JCfmKVFe6eAWBbHhZqDKtRhhiQMkBgRe4=";
+          version = "0.44.6";
+          hash = "sha256-9OAQIXdFqV3pLFmixB2ES8Ti/qK3uPk6yMRs9Y+w4aI=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/foam.foam-vscode/changelog";
@@ -3877,8 +3877,8 @@ let
         mktplcRef = {
           name = "prisma";
           publisher = "Prisma";
-          version = "31.11.0";
-          hash = "sha256-vvHr5jZ2lccO93O82OKnRF4wyVv3n/H3nKJIqZdIjlY=";
+          version = "31.12.8";
+          hash = "sha256-3XJu7g8NnevBZiJ90iogqR2QMIgnCQ/HFII98RG8arI=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/Prisma.prisma/changelog";
@@ -4045,8 +4045,8 @@ let
           publisher = "rocq-prover";
           name = "vsrocq";
           # When updating the version here, also update the language server vsrocq-language-server
-          version = "2.4.3";
-          hash = "sha256-o9rsSDCDYRWZQBMDA7DtWay50tBI76kw7H7CivrZpKo=";
+          version = "2.5.0";
+          hash = "sha256-05YrIKtZRmEjs+QSzsCyIxajRmSLgoCkNUDti+w97Fw=";
         };
         meta = {
           description = "VsRocq is an extension for Visual Studio Code with support for the Rocq Prover";
diff --git a/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix b/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
index 9e2458d0bf7a..46db3260cba6 100644
--- a/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "claude-dev";
     publisher = "saoudrizwan";
-    version = "4.1.16";
-    hash = "sha256-ZsKIpyn2ZZzrfxAR8HAjNFMVQ5UdnH7bYaO7AdUCTKc=";
+    version = "4.1.17";
+    hash = "sha256-godUcnRN7Uo2DiLHJrthAZYuzwoXiqjv6Epcfqco0vU=";
   };
 
   meta = {
diff --git a/pkgs/applications/networking/cluster/helm/plugins/helm-diff.nix b/pkgs/applications/networking/cluster/helm/plugins/helm-diff.nix
index 2556de4e0d4f..ec3e6313a2fb 100644
--- a/pkgs/applications/networking/cluster/helm/plugins/helm-diff.nix
+++ b/pkgs/applications/networking/cluster/helm/plugins/helm-diff.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "helm-diff";
-  version = "3.15.12";
+  version = "3.15.13";
 
   src = fetchFromGitHub {
     owner = "databus23";
     repo = "helm-diff";
     rev = "v${version}";
-    hash = "sha256-cMW+crPNyMyS04LlnCbSOhDLGW1SPmoTYeyBif3tl+0=";
+    hash = "sha256-/Wu8OszNOhv1I7NA9vvwO0IB957sxnh8NGzo3cEjE/s=";
   };
 
-  vendorHash = "sha256-GWeQveyp04QODNuUFUysUraPwR1iJybgMfNmm99k4sc=";
+  vendorHash = "sha256-lzR/vuXJgoo2VpVeV/mLTmBi9LJepGA/uxtCg3KK9LI=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index c9d43ea65296..42a05dd6977b 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -36,13 +36,13 @@
     "vendorHash": "sha256-TXeJPVyb3+t1wJyHXNbmy6iPrPTG47bedHB0UyEUv98="
   },
   "akamai_akamai": {
-    "hash": "sha256-XGTdfOUr3Nb2vV49aGZThuae/n9KrM3NZ8A0P/LrSXg=",
+    "hash": "sha256-ui8w8z9kROptw0tCvtT645bbNJV/BRd10aVomwhl+hI=",
     "homepage": "https://registry.terraform.io/providers/akamai/akamai",
     "owner": "akamai",
     "repo": "terraform-provider-akamai",
-    "rev": "v10.4.0",
+    "rev": "v11.0.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-DTPaRkNWitoriOE0G+RctMIHAdSPK4wq410a+XxLnOY="
+    "vendorHash": "sha256-d9hJUjHczxy2/3bOmEYjTxKDIRc6Cox4sr5k40ZHWFE="
   },
   "aliyun_alicloud": {
     "hash": "sha256-caOnwD9wXa533I2kUpcbMwAJUUcSzyZNY4LIgJQjdc0=",
@@ -137,13 +137,13 @@
     "vendorHash": "sha256-TLNHhSyMw0rKFtd9EChg7zSGoxe57rh36nAPqu1j8w8="
   },
   "buildkite_buildkite": {
-    "hash": "sha256-Hq2I9/Fnery1CUWdOTu2hJQ0EwYN+Dw8yPb4mZsuYzU=",
+    "hash": "sha256-sqtC0Wkme+90jKdJCTVuOxkzeWnt/uQ8/y/d5bJoL/w=",
     "homepage": "https://registry.terraform.io/providers/buildkite/buildkite",
     "owner": "buildkite",
     "repo": "terraform-provider-buildkite",
-    "rev": "v1.39.1",
+    "rev": "v1.39.2",
     "spdx": "MIT",
-    "vendorHash": "sha256-QmtHr/zjSoqpiRepLjzMN+QLPUccaIXQPrLYHihm2/o="
+    "vendorHash": "sha256-VvihinrizplJmIyXyLsvYjj0uwS06xTH5SiTZlTdYWE="
   },
   "camptocamp_pass": {
     "hash": "sha256-GQ2g7VyK+eeBqW3LMR4U0gMYsvQnG3y+KEKKkvnmfsk=",
@@ -346,13 +346,13 @@
     "vendorHash": "sha256-fP6brpY/wRI1Yjgapzi+FfOci65gxWeOZulXbGdilrE="
   },
   "dnsimple_dnsimple": {
-    "hash": "sha256-YkoBGPcNKBeAHWcsRldHSsZ/hvWngCiySjK5zzI9jNE=",
+    "hash": "sha256-eprmwEPBGYCCoic4Y2nClxaGjXAD5AFdmuvRUzdnAG8=",
     "homepage": "https://registry.terraform.io/providers/dnsimple/dnsimple",
     "owner": "dnsimple",
     "repo": "terraform-provider-dnsimple",
-    "rev": "v2.2.0",
+    "rev": "v2.2.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-SuwDjQMgzcnNsBf/wXZvys6VINgnFeaWcV7jIMbNXo8="
+    "vendorHash": "sha256-Co7Rbjxi3cUglxVx7O3cXTA4r0SUUMv/EWHid5K+ILM="
   },
   "dnsmadeeasy_dme": {
     "hash": "sha256-JH9YcM9Fvd1x0BJpLUZCm6a9hZZxySrkFVLP89FO3fU=",
@@ -733,11 +733,11 @@
     "vendorHash": "sha256-s9tdthUzIdisP0XB9V+HGlWgZCXnOodz9Atu/XyDKf4="
   },
   "huaweicloud_huaweicloud": {
-    "hash": "sha256-ncTEM+7zS5P2fhXcB0wa8NatbJg9g2XHm2FGWqp6jx8=",
+    "hash": "sha256-r4SwNOQ2P9IdxAvPnIuJEolXfhI/GKSPUZ+yjBS7pKA=",
     "homepage": "https://registry.terraform.io/providers/huaweicloud/huaweicloud",
     "owner": "huaweicloud",
     "repo": "terraform-provider-huaweicloud",
-    "rev": "v1.97.2",
+    "rev": "v1.98.2",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
diff --git a/pkgs/by-name/_7/_7zz/package.nix b/pkgs/by-name/_7/_7zz/package.nix
index 6923d10979d1..a5143dda4255 100644
--- a/pkgs/by-name/_7/_7zz/package.nix
+++ b/pkgs/by-name/_7/_7zz/package.nix
@@ -122,6 +122,7 @@ stdenv.mkDerivation (finalAttrs: {
   outputs = [
     "out"
     "doc"
+    "lib"
   ];
 
   setupHook = ./setup-hook.sh;
@@ -130,12 +131,19 @@ stdenv.mkDerivation (finalAttrs: {
 
   preBuild = "cd CPP/7zip/Bundles/Alone2";
 
+  postBuild = ''
+    make $makeFlags -j $NIX_BUILD_CORES -C ../Format7zF -f ../../cmpl_gcc.mak
+  '';
+
   installPhase = ''
     runHook preInstall
 
     install -Dm555 -t $out/bin b/*/7zz${stdenv.hostPlatform.extensions.executable}
     install -Dm444 -t $out/share/doc/7zz ../../../../DOC/*.txt
 
+    mkdir -p $lib/lib
+    install -Dm555 -t $lib/lib ../Format7zF/b/g/*
+
     runHook postInstall
   '';
 
diff --git a/pkgs/by-name/ap/api-linter/package.nix b/pkgs/by-name/ap/api-linter/package.nix
index 8f4248f953b9..8adda5fd7209 100644
--- a/pkgs/by-name/ap/api-linter/package.nix
+++ b/pkgs/by-name/ap/api-linter/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "api-linter";
-  version = "2.3.1";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "api-linter";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xks5oKfJSMV4MbPFrYGWv82XeBLYbGgXF4r4kbFX93Q=";
+    hash = "sha256-r1OTgsLaEZPQd7P3E7BY0YYIr93Cmeo6gH4Z24LXP3Q=";
   };
 
-  vendorHash = "sha256-wPySRFqm396YRqEUZNMkA19SxqBNApwr8hm0PRA5cO0=";
+  vendorHash = "sha256-L1R0XvEn1pGy/EC/ivoUOGsyGrT5bRUkMLrGpI4VNyY=";
 
   subPackages = [ "cmd/api-linter" ];
 
diff --git a/pkgs/by-name/as/asn/package.nix b/pkgs/by-name/as/asn/package.nix
index dc5060a2c6f2..86a97226664a 100644
--- a/pkgs/by-name/as/asn/package.nix
+++ b/pkgs/by-name/as/asn/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "asn";
-  version = "0.81.1";
+  version = "0.82.0";
 
   src = fetchFromGitHub {
     owner = "nitefood";
     repo = "asn";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-V3C/jzCnhqOCmUU7X89x/3CKkMwkKvY6dAXAHqx2K1M=";
+    hash = "sha256-mB01NtiM1DZ830DykQeKrbqZC46IlOFyV5DVNf108bA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/au/aurral/package.json.patch b/pkgs/by-name/au/aurral/package.json.patch
new file mode 100644
index 000000000000..2ce732affad2
--- /dev/null
+++ b/pkgs/by-name/au/aurral/package.json.patch
@@ -0,0 +1,15 @@
+diff --git a/package.json b/package.json
+index 5e1328e5..0f289597 100644
+--- a/package.json
++++ b/package.json
+@@ -4,9 +4,7 @@
+   "description": "Aurral artist request manager",
+   "private": true,
+   "type": "module",
+-  "engines": {
+-    "node": "22.23.x"
+-  },
++  "files": ["backend/*", "frontend/dist/*", "lib/*"],
+   "workspaces": [
+     "backend",
+     "frontend"
diff --git a/pkgs/by-name/au/aurral/package.nix b/pkgs/by-name/au/aurral/package.nix
new file mode 100644
index 000000000000..efb66d38fc35
--- /dev/null
+++ b/pkgs/by-name/au/aurral/package.nix
@@ -0,0 +1,114 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  nix-update-script,
+  nodejs_26,
+  sqlite,
+  ffmpeg,
+  yt-dlp,
+  jemalloc,
+  runtimeShell,
+  makeFontsConf,
+  noto-fonts-color-emoji,
+  dejavu_fonts,
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "aurral";
+  version = "2.8.0";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "lklynet";
+    repo = "aurral";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Ceo5CHIGa+98XFLazqmAyAV64rzDYqB0gvJ95AKwfUk=";
+  };
+
+  # Specifies files to package leveraging npm & nix hooks. Not used by upstream.
+  # Remove engine constraint not matching upstream dockerfile.
+  patches = [
+    ./package.json.patch
+  ];
+
+  npmDepsHash = "sha256-Qa/TcKzMEY/w8FWKMiHUeqVB9cMxxWtEwF30y0nndkg=";
+
+  nodejs = nodejs_26;
+
+  env.VITE_APP_VERSION = finalAttrs.version;
+
+  npmInstallFlags = [
+    "--include=optional"
+    "--include-workspace-root=false"
+  ];
+
+  npmBuildFlags = [ "--workspace=frontend" ];
+
+  npmPruneFlags = [
+    "--workspace=backend"
+    "--include=optional"
+    "--include-workspace-root=false"
+  ];
+
+  postInstall = ''
+    mkdir $out/bin
+    cat > $out/bin/aurral <<EOL
+    #!${runtimeShell} -e
+    export LD_PRELOAD=${lib.getLib jemalloc}/lib/libjemalloc.so
+    export LD_LIBRARY_PATH=${
+      lib.makeLibraryPath [
+        sqlite
+      ]
+    }
+    export PATH=${
+      lib.makeBinPath [
+        finalAttrs.nodejs
+        ffmpeg
+        yt-dlp
+      ]
+    }\''${PATH:+:}\$PATH
+    export FONTCONFIG_FILE=${
+      makeFontsConf {
+        fontDirectories = [
+          noto-fonts-color-emoji
+          dejavu_fonts
+        ];
+      }
+    }
+    export APP_VERSION=${finalAttrs.version}
+    export NODE_ENV=production
+    case "\$1" in
+        resetAdminPassword)
+        exec node $out/lib/node_modules/aurral/backend/scripts/resetAdminPassword.js "\$@"
+        ;;
+        server|"")
+        exec node $out/lib/node_modules/aurral/backend/server.js
+        ;;
+        -h|--help|*)
+        echo "Usage: (server|resetAdminPassword)"
+        echo
+        echo "We recommend using it in the service namespace. Example:"
+        echo "sudo nsenter -t \\\$(systemctl show --property MainPID --value aurral.service) -a -e -S follow -G follow aurral resetAdminPassword -g"
+        ;;
+    esac
+    EOL
+    chmod +x $out/bin/aurral
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Aurral is the Lidarr companion for self-hosted music discovery";
+    mainProgram = "aurral";
+    homepage = "https://aurral.org";
+    changelog = "https://github.com/lklynet/aurral/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    platforms = lib.intersectLists lib.platforms.linux (lib.platforms.x86_64 ++ lib.platforms.aarch64);
+    maintainers = with lib.maintainers; [
+      hougo
+      staticdev
+    ];
+  };
+})
diff --git a/pkgs/by-name/ca/cadabra2/package.nix b/pkgs/by-name/ca/cadabra2/package.nix
index d083edc8de9d..09f0411f9d7d 100644
--- a/pkgs/by-name/ca/cadabra2/package.nix
+++ b/pkgs/by-name/ca/cadabra2/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch2,
 
   cmake,
   pkg-config,
@@ -51,6 +52,18 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-Pbk9SmJ64CZ+yxMj53JpxULBQye2ETDi8xNKw38cC9k=";
   };
 
+  patches = [
+    # Backport a MicroTeX fix for fontconfig >= 2.18.
+    # Remove once cadabra2 updates its MicroTeX submodule to 7944eb4 or later.
+    (fetchpatch2 {
+      name = "microtex-fix-recent-fontconfig-build.patch";
+      url = "https://github.com/kpeeters/MicroTeX/commit/7944eb496dec1b7ff8af4c13e0cfee279eea30b8.patch?full_index=1";
+      extraPrefix = "submodules/microtex/";
+      stripLen = 1;
+      hash = "sha256-mobQF8uZGF1bdddYoyAxrZ4XhbMwUuK8kLwjmVrZZh0=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace CMakeLists.txt \
       --replace-fail 'MESSAGE(FATAL_ERROR "Building with -DPACKAGING_MODE=ON also requires -DCMAKE_INSTALL_PREFIX=/usr")' ""
diff --git a/pkgs/by-name/ca/cargo-leptos/package.nix b/pkgs/by-name/ca/cargo-leptos/package.nix
index c76f676ff335..dd2533cbe56d 100644
--- a/pkgs/by-name/ca/cargo-leptos/package.nix
+++ b/pkgs/by-name/ca/cargo-leptos/package.nix
@@ -8,16 +8,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-leptos";
-  version = "0.3.7";
+  version = "0.3.8";
 
   src = fetchFromGitHub {
     owner = "leptos-rs";
     repo = "cargo-leptos";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-w1kd/eOjNHYAramUvHdgj0ogFqgHDQ1P+ItKTTLL9hU=";
+    hash = "sha256-SP/jnyUU+mqwL9dpfEi8ZM1/O6LGyMYoQ5puU51aMIw=";
   };
 
-  cargoHash = "sha256-p0mku5B9RtU0E7ny1Izhr2diBLgDH8HR2/B92MvBfws=";
+  cargoHash = "sha256-mvximFXCtpEDBVhlwcY1zVeQXahgjWPuRmmv52z1Vv0=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/ce/centrifugo/package.nix b/pkgs/by-name/ce/centrifugo/package.nix
index b392ca3cf8dc..dfebee4f25fc 100644
--- a/pkgs/by-name/ce/centrifugo/package.nix
+++ b/pkgs/by-name/ce/centrifugo/package.nix
@@ -16,16 +16,16 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "centrifugo";
-  version = "6.9.3";
+  version = "6.9.4";
 
   src = fetchFromGitHub {
     owner = "centrifugal";
     repo = "centrifugo";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-VGD2sOcnEnUC4p3sNGBf231/N98lyLKWvTTBu9JAqqI=";
+    hash = "sha256-5m2f7BB50AGrdMBCizQg3suEGPRzQr4NqI9v2JWy/78=";
   };
 
-  vendorHash = "sha256-DeimAevGCOlu74bgZdOE4/SCbTo3TXS12CqZRhk94/s=";
+  vendorHash = "sha256-DkuwByvpoJ17P84mKddDttALksHVO2sUVA3MI37kSOc=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/co/cobra-cli/package.nix b/pkgs/by-name/co/cobra-cli/package.nix
index 8093d89b4811..b872ea694b53 100644
--- a/pkgs/by-name/co/cobra-cli/package.nix
+++ b/pkgs/by-name/co/cobra-cli/package.nix
@@ -57,7 +57,7 @@ buildGoModule (finalAttrs: {
     description = "Cobra CLI tool to generate applications and commands";
     mainProgram = "cobra-cli";
     homepage = "https://github.com/spf13/cobra-cli/";
-    changelog = "https://github.com/spf13/cobra-cli/releases/tag/${finalAttrs.version}";
+    changelog = "https://github.com/spf13/cobra-cli/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.afl20;
     maintainers = [ lib.maintainers.ivankovnatsky ];
   };
diff --git a/pkgs/by-name/co/consul-template/package.nix b/pkgs/by-name/co/consul-template/package.nix
index 0d7570cdc97d..1ff36fffb718 100644
--- a/pkgs/by-name/co/consul-template/package.nix
+++ b/pkgs/by-name/co/consul-template/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "consul-template";
-  version = "0.42.1";
+  version = "0.43.0";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "consul-template";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-J/dUlF7FBo+WLMA6ff0WlqD1oqsmPI2W8ebW1eNTUX4=";
+    hash = "sha256-54+MHi6ZmcDcHk1Swwt+25ZQOLPRytgZ8oDdlXsGVKo=";
   };
 
-  vendorHash = "sha256-wmbv/YrjRweTsaA/3mXKx2L8yNdoSRXRVyEcaraJ/nw=";
+  vendorHash = "sha256-TffXWuVQKzaxwXozpdPJhwnBi9fmtolTZDPBsbVrOLY=";
 
   # consul-template tests depend on vault and consul services running to
   # execute tests so we skip them here
diff --git a/pkgs/by-name/cr/crowdsec/package.nix b/pkgs/by-name/cr/crowdsec/package.nix
index d70d812ac401..f25a59c47cd9 100644
--- a/pkgs/by-name/cr/crowdsec/package.nix
+++ b/pkgs/by-name/cr/crowdsec/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "crowdsec";
-  version = "1.8.0";
+  version = "1.8.1";
 
   src = fetchFromGitHub {
     owner = "crowdsecurity";
     repo = "crowdsec";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/LhA2CxLde7eVUs7yU+KYd5txLlmH/zB2g2S1Jo83fU=";
+    hash = "sha256-gyKqMUnAjfg3eAb7Z27qv6AgSxNo8Z7zIhXTUpkD5i4=";
   };
 
   vendorHash = "sha256-899kCO6wbiNe1NHmtew3ksQXI51LjdlLo5XAplsHUQQ=";
diff --git a/pkgs/by-name/de/dexter/package.nix b/pkgs/by-name/de/dexter/package.nix
index cff8f20d1dd0..80bb6459224f 100644
--- a/pkgs/by-name/de/dexter/package.nix
+++ b/pkgs/by-name/de/dexter/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "dexter";
-  version = "0.7.1";
+  version = "0.7.2";
 
   src = fetchFromGitHub {
     owner = "remoteoss";
     repo = "dexter";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VrKLi92fCkAL6C5dvydXuwOCp3dYXsDJSGk9rkHv1t8=";
+    hash = "sha256-4LAcV29ypn56UDt8RN+UdwR1ZMlGUixj+rwALo9a84g=";
   };
 
   vendorHash = "sha256-1mJ4HdDCsZl/g8F+L+NrW2ACuiHe2aSheJO/1XfKAb4=";
diff --git a/pkgs/by-name/em/empire-compiler/package.nix b/pkgs/by-name/em/empire-compiler/package.nix
index fde8dca7c4cf..9ddb8dff2123 100644
--- a/pkgs/by-name/em/empire-compiler/package.nix
+++ b/pkgs/by-name/em/empire-compiler/package.nix
@@ -9,13 +9,13 @@
 
 buildDotnetModule (finalAttrs: {
   pname = "empire-compiler";
-  version = "2.0.0";
+  version = "2.0.2";
 
   src = fetchFromGitHub {
     owner = "bc-security";
     repo = "empire-compiler";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hquqUEQHdID+2dTWiSkMjcYi4wc6KlSllAD9vUzdH10=";
+    hash = "sha256-k0y7pk79Az4lyXAcFP260T8WgCJSfxfaAtgsytC3wBw=";
   };
 
   dotnet-sdk = dotnetCorePackages.sdk_10_0;
diff --git a/pkgs/by-name/fa/far2l/package.nix b/pkgs/by-name/fa/far2l/package.nix
index c23ec05615c5..4adba782003f 100644
--- a/pkgs/by-name/fa/far2l/package.nix
+++ b/pkgs/by-name/fa/far2l/package.nix
@@ -7,7 +7,6 @@
   cmake,
   ninja,
   pkg-config,
-  m4,
   perl,
   bash,
   xdg-utils,
@@ -16,8 +15,11 @@
   gzip,
   bzip2,
   gnutar,
-  p7zip,
+  _7zz,
   xz,
+  nix-update-script,
+
+  # Backend options
   withTTYX ? true,
   libx11,
   withGUI ? true,
@@ -25,13 +27,13 @@
   withUCD ? true,
   libuchardet,
 
-  # Plugins
+  # Plugins (all are enabled by default)
   withColorer ? true,
   spdlog,
   libxml2,
   withMultiArc ? true,
   libarchive,
-  pcre,
+
   withNetRocks ? true,
   openssl,
   libssh,
@@ -42,57 +44,57 @@
   python3Packages,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "far2l";
-  version = "2.9.0";
+  version = "2.9.0-unstable-06-09-2026";
 
   src = fetchFromGitHub {
     owner = "elfmz";
     repo = "far2l";
-    tag = "v_${version}";
-    hash = "sha256-9mSi3gqZ2jpgUawD3Jr2Pmn1shLpySuFCh4iOZe7CO8=";
+    rev = "1d45c50547f4459c13f3613cb89b09bf8d6139b1";
+    hash = "sha256-/AxtL7L6YYKFrtdsUXiBQ1ljuqCBymkdajeMB2xlVrM=";
   };
 
   nativeBuildInputs = [
     cmake
     ninja
     pkg-config
-    m4
     perl
     makeWrapper
   ];
 
-  buildInputs =
-    lib.optional withTTYX libx11
-    ++ lib.optional withGUI wxwidgets_3_2
-    ++ lib.optional withUCD libuchardet
-    ++ lib.optionals withColorer [
-      spdlog
-      libxml2
+  buildInputs = [
+    bash
+  ]
+  ++ lib.optional withTTYX libx11
+  ++ lib.optional withGUI wxwidgets_3_2
+  ++ lib.optional withUCD libuchardet
+  ++ lib.optionals withColorer [
+    spdlog
+    libxml2
+  ]
+  ++ lib.optionals withMultiArc [
+    libarchive
+  ]
+  ++ lib.optionals withNetRocks [
+    openssl
+    libssh
+    libnfs
+    neon
+  ]
+  ++ lib.optional (withNetRocks && !stdenv.hostPlatform.isDarwin) samba # broken on darwin
+  ++ lib.optionals withPython (
+    with python3Packages;
+    [
+      python
+      cffi
+      debugpy
+      pcpp
     ]
-    ++ lib.optionals withMultiArc [
-      libarchive
-      pcre
-    ]
-    ++ lib.optionals withNetRocks [
-      openssl
-      libssh
-      libnfs
-      neon
-    ]
-    ++ lib.optional (withNetRocks && !stdenv.hostPlatform.isDarwin) samba # broken on darwin
-    ++ lib.optionals withPython (
-      with python3Packages;
-      [
-        python
-        cffi
-        debugpy
-        pcpp
-      ]
-    );
+  );
 
   postPatch = ''
-    patchShebangs python/src/prebuild.sh
+    chmod +x far2l/bootstrap/*.sh
     patchShebangs far2l/bootstrap/view.sh
   '';
 
@@ -111,9 +113,9 @@ stdenv.mkDerivation rec {
   ];
 
   runtimeDeps = [
+    bash
     unzip
     zip
-    p7zip
     xz
     gzip
     bzip2
@@ -122,15 +124,23 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     wrapProgram $out/bin/far2l \
-      --prefix PATH : ${lib.makeBinPath runtimeDeps} \
+      --prefix PATH : ${lib.makeBinPath finalAttrs.runtimeDeps} \
       --suffix PATH : ${lib.makeBinPath [ xdg-utils ]}
+    # Link 7z plugin
+    echo "Linking 7z libraries..."
+    mkdir -p $out/lib/far2l/Plugins/arclite/plug/
+    for file in ${_7zz.lib}/lib/*; do
+      ln -sf "$file" "$out/lib/far2l/Plugins/arclite/plug/"
+    done
   '';
 
+  passthru.updateScript = nix-update-script { extraArgs = "--version=branch=master"; };
+
   meta = {
-    description = "Linux port of FAR Manager v2, a program for managing files and archives in Windows operating systems";
+    description = "Linux port of FAR Manager v2 with enhanced plugin support";
     homepage = "https://github.com/elfmz/far2l";
     license = lib.licenses.gpl2Only;
     maintainers = with lib.maintainers; [ smakarov ];
     platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/by-name/ff/ffmpegthumbnailer/package.nix b/pkgs/by-name/ff/ffmpegthumbnailer/package.nix
index ec61110577d4..b4ee5193942a 100644
--- a/pkgs/by-name/ff/ffmpegthumbnailer/package.nix
+++ b/pkgs/by-name/ff/ffmpegthumbnailer/package.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   postInstall = ''
-    substituteInPlace $out/share/thumbnailers/ffmpegthumbnailer.thumbnailer \
+    substituteInPlace $out/share/thumbnailers/ffmpegthumbnailer{,-audio}.thumbnailer \
       --replace-fail '=ffmpegthumbnailer' "=$out/bin/ffmpegthumbnailer"
   '';
 
diff --git a/pkgs/by-name/gc/gcsfuse/package.nix b/pkgs/by-name/gc/gcsfuse/package.nix
index e70881bd9b74..75374a0c06cb 100644
--- a/pkgs/by-name/gc/gcsfuse/package.nix
+++ b/pkgs/by-name/gc/gcsfuse/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gcsfuse";
-  version = "3.11.3";
+  version = "3.11.4";
 
   src = fetchFromGitHub {
     owner = "googlecloudplatform";
     repo = "gcsfuse";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kysgRTHFGLC5Hjcs/i+Xx2zVhjBkv5WbKXFBVejRxlQ=";
+    hash = "sha256-k12Gi1fBsxd1P3iL7/5CwUfOpap4ienUY4dvubjL2MI=";
   };
 
-  vendorHash = "sha256-AyJPjX8vLk4jfIVur/+dM1cArh+OSh2v3w4FnfH26cM=";
+  vendorHash = "sha256-ATV2KYKWbxCYUzF+GFmaNYcGlVhyB+xDpgMEvT1sPEI=";
 
   subPackages = [
     "."
diff --git a/pkgs/by-name/gr/grcov/package.nix b/pkgs/by-name/gr/grcov/package.nix
index b5e61a855989..b83232d25114 100644
--- a/pkgs/by-name/gr/grcov/package.nix
+++ b/pkgs/by-name/gr/grcov/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "grcov";
-  version = "0.10.7";
+  version = "0.10.8";
 
   src = fetchFromGitHub {
     owner = "mozilla";
     repo = "grcov";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-64c8byxQDEE9eRS+YAd9BaGSjGm+cl2XTAy3l3Utrws=";
+    hash = "sha256-P9JOd2Dw3MDQ6Kr9m85JiqQScYdJzEVPtIfTOAc21rs=";
   };
 
-  cargoHash = "sha256-JTIYfAatMg9L597pRLywgCQmQO9sbuq/En0wNUx8QUo=";
+  cargoHash = "sha256-HZXH4sirjaZmHUiVr9A3ZnyqPoMaDTJnMD54/iUYQtg=";
 
   # tests do not find grcov path correctly
   checkFlags =
diff --git a/pkgs/by-name/gu/gum/package.nix b/pkgs/by-name/gu/gum/package.nix
index 556c7f2a45a1..bc15b6913f66 100644
--- a/pkgs/by-name/gu/gum/package.nix
+++ b/pkgs/by-name/gu/gum/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gum";
-  version = "2.0.0";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "charmbracelet";
     repo = "gum";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-M1eLi/Jc8QCc6Mai3Nc42MXRnl5ucafQMiOFL3kLoz4=";
+    hash = "sha256-EwLh86TMCmopS8cKwpmYR/7Iq7buXGwnk8ORB1BFisk=";
   };
 
-  vendorHash = "sha256-gvTQQOkCVIyKE27dgeQAPM4ZBV2XZnjRtqmEwPbY3Gc=";
+  vendorHash = "sha256-e18NSh+dhX4MoinZDqEDM73FaOqTM5CsSO6Lw196HNU=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/hi/hickory-dns/package.nix b/pkgs/by-name/hi/hickory-dns/package.nix
index 793837cb7a53..e995d80424b6 100644
--- a/pkgs/by-name/hi/hickory-dns/package.nix
+++ b/pkgs/by-name/hi/hickory-dns/package.nix
@@ -3,22 +3,23 @@
   fetchFromGitHub,
   lib,
   nix-update-script,
+  nixosTests,
   rustPlatform,
   versionCheckHook,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "hickory-dns";
-  version = "0.26.2";
+  version = "0.26.3";
 
   src = fetchFromGitHub {
     owner = "hickory-dns";
     repo = "hickory-dns";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qwyMfjo3LTyvxwRlQ/4Odc3yZsSuA4cn7zj/KLCfRSs=";
+    hash = "sha256-zm8qMYqdDEZjtNC9arMzCAxPpBRRRwiHsb3lsP/cHIg=";
   };
 
-  cargoHash = "sha256-TsawTK+MaQ8isxa+/lROTgnA2u26XKjZCtRFUKLRbrw=";
+  cargoHash = "sha256-u6Uf9lhrFgWfzIXZ3DIPk2JdDTdd1qBTkqUgmSspR9c=";
 
   buildFeatures = [
     "blocklist"
@@ -80,7 +81,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     substituteInPlace crates/resolver/src/lib.rs --replace-fail '//! ```rust' '//! ```rust,no_run'
   '';
 
-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    tests = {
+      inherit (nixosTests) hickory-dns;
+    };
+    updateScript = nix-update-script { };
+  };
 
   meta = {
     description = "Rust based DNS client, server, and resolver";
diff --git a/pkgs/by-name/hu/hugo/package.nix b/pkgs/by-name/hu/hugo/package.nix
index 870a1f603005..113a553ecf1a 100644
--- a/pkgs/by-name/hu/hugo/package.nix
+++ b/pkgs/by-name/hu/hugo/package.nix
@@ -1,7 +1,7 @@
 {
   stdenv,
   lib,
-  buildGoModule,
+  buildGo127Module,
   fetchFromGitHub,
   installShellFiles,
   buildPackages,
@@ -9,18 +9,18 @@
   nix-update-script,
 }:
 
-buildGoModule (finalAttrs: {
+buildGo127Module (finalAttrs: {
   pname = "hugo";
-  version = "0.165.0";
+  version = "0.166.0";
 
   src = fetchFromGitHub {
     owner = "gohugoio";
     repo = "hugo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xxBBvhNp/4IUtIPfiFaZhCnXPhnHZ0NP4R/gda9a6Ic=";
+    hash = "sha256-IzkwqfoqIscUI3EboIE3zHd0CsEUfa9JnoQ4yk6oIOg=";
   };
 
-  vendorHash = "sha256-k9e8lthkDzewLHRSZmiAQxsatOKUFrlNOJ4FnAb2uqk=";
+  vendorHash = "sha256-lqhBX8lmDHHCgjqdyQ6lAl6yHOZR0j04QJi5OkB5VKA=";
 
   checkFlags =
     let
@@ -73,7 +73,7 @@ buildGoModule (finalAttrs: {
     versionCheckHook
   ];
   doInstallCheck = true;
-  versionCheckProgram = "${placeholder "out"}/bin/hugo";
+  versionCheckProgram = "${placeholder "out"}/bin/${finalAttrs.meta.mainProgram}";
   versionCheckProgramArg = "version";
 
   passthru.updateScript = nix-update-script { };
diff --git a/pkgs/by-name/in/inkycap/package.nix b/pkgs/by-name/in/inkycap/package.nix
new file mode 100644
index 000000000000..d8b02507548d
--- /dev/null
+++ b/pkgs/by-name/in/inkycap/package.nix
@@ -0,0 +1,135 @@
+{
+  lib,
+  stdenv,
+  rustPlatform,
+  fetchFromForgejo,
+  buildNpmPackage,
+  cargo-tauri,
+  glib-networking,
+  gst_all_1,
+  libayatana-appindicator,
+  libsecret,
+  nodejs,
+  perl,
+  pkg-config,
+  tinymist,
+  webkitgtk_4_1,
+  wrapGAppsHook4,
+}:
+
+let
+  version = "26.9.6";
+  src = fetchFromForgejo {
+    domain = "codefloe.com";
+    owner = "InkyCap";
+    repo = "app";
+    tag = "v${version}";
+    hash = "sha256-X4KjRHUDYx0C61gBa5vr9i1u0DOZok1AUTwe6srVhy4=";
+  };
+  changelog = "https://codefloe.com/InkyCap/app/releases/tag/v${version}";
+  homepage = "http://inkycap.org/";
+  license = lib.licenses.liliq-p-11;
+  maintainers = with lib.maintainers; [ luker ];
+
+  # from TINYMIST_VERSION in scripts/download-tinymist.sh.
+  # developer says it should work with newer version, but no guarantees.
+  requiredTinymistVersion = "0.15.2";
+
+  frontend = buildNpmPackage (finalAttrs: {
+    pname = "inkycap-frontend";
+    inherit version src;
+
+    npmDepsHash = "sha256-vXf4W3U5EIzqHRdUkIy1z+0+umMbR1AflQ31pJCo37M=";
+
+    # The npm hook installs with `npm ci --ignore-scripts`, so the
+    # postinstall script (patch-package) never runs. Apply the patches
+    # from patches/ explicitly, before the bundle.
+    preBuild = ''
+      ./node_modules/.bin/patch-package
+    '';
+
+    installPhase = ''
+      runHook preInstall
+      cp -r dist $out
+      runHook postInstall
+    '';
+
+    meta = {
+      inherit
+        changelog
+        homepage
+        license
+        maintainers
+        ;
+      description = "Frontend assets for InkyCap";
+    };
+  });
+in
+assert (builtins.compareVersions requiredTinymistVersion tinymist.version) <= 0;
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "inkycap";
+  inherit version src;
+
+  __structuredAttrs = true;
+
+  cargoRoot = "src-tauri";
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) src cargoRoot;
+    hash = "sha256-NHlLURI2O2W28gAWGZd6Hx7lWOXn8LNeoiubReRA5Bo=";
+  };
+  buildAndTestSubdir = "src-tauri";
+
+  nativeBuildInputs = [
+    cargo-tauri.hook
+    pkg-config
+    perl
+    wrapGAppsHook4
+  ];
+
+  buildInputs = [
+    glib-networking
+    gst_all_1.gst-plugins-base
+    gst_all_1.gst-plugins-bad
+    gst_all_1.gst-plugins-good
+    gst_all_1.gst-libav
+    libayatana-appindicator
+    libsecret
+    webkitgtk_4_1
+  ];
+
+  postPatch = ''
+    # Tauri expects sidecars as binaries/<name>-<triple>.
+    # make sure nixpkgs version and package version are synchronized
+    install -Dm755 ${tinymist}/bin/tinymist \
+      "src-tauri/binaries/inkycap-tinymist-${stdenv.hostPlatform.rust.rustcTargetSpec}"
+
+    cp -r ${frontend} dist
+
+    # The frontend is already built; drop beforeBuildCommand so the
+    # tauri CLI does not re-run `npm run build`
+    substituteInPlace src-tauri/tauri.conf.json \
+      --replace-fail '"beforeBuildCommand": "npm run build"' "" \
+      --replace-fail '"beforeDevCommand": "npm run dev",' '"beforeDevCommand": "npm run dev"'
+  '';
+
+  doCheck = false;
+
+  meta = {
+    inherit
+      changelog
+      homepage
+      license
+      maintainers
+      ;
+    description = "Personal knowledge management (PKM) tool that uses Typst markup";
+    longDescription = ''
+      InkyCap is a personal knowledge management tool that helps you explore
+      ideas and write. Tailored for academic workflows, research, writing,
+      task and date awareness; InkyCap provides flexible ways to organize
+      your information.
+    '';
+    platforms = lib.platforms.linux;
+    mainProgram = "inkycap";
+  };
+})
diff --git a/pkgs/by-name/io/iocaine/package.nix b/pkgs/by-name/io/iocaine/package.nix
index dcd63c2dcee4..1f9837580d72 100644
--- a/pkgs/by-name/io/iocaine/package.nix
+++ b/pkgs/by-name/io/iocaine/package.nix
@@ -1,32 +1,48 @@
 {
-  stdenv,
   lib,
-  rustPlatform,
   fetchFromGitea,
+  nftables,
+  nixosTests,
+  pkg-config,
+  rustPlatform,
+  ...
 }:
-
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "iocaine";
-  version = "2.5.1";
+  version = "3.5.1";
 
   src = fetchFromGitea {
     domain = "git.madhouse-project.org";
     owner = "iocaine";
     repo = "iocaine";
     tag = "iocaine-${finalAttrs.version}";
-    hash = "sha256-213QLpGBKSsT9r8O27PyMom5+OGPz0VtRBevxswISZA=";
+    hash = "sha256-FkIgrptTiYZwHBa6blFeB4HrgTpMREbW004hKpcAKx0=";
   };
 
-  cargoHash = "sha256-EgPGDlJX/m+v3f/tGIO+saGHoYrtiWLZuMlXEvsgnxE=";
+  cargoHash = "sha256-GHveoZ19VaQie9D9i+yoKevB/cnxKd7GLnNOZcAqtJ0=";
+
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    rustPlatform.bindgenHook
+  ];
+
+  buildInputs = [
+    nftables
+  ];
+
+  passthru = {
+    tests = { inherit (nixosTests) iocaine; };
+  };
 
   meta = {
     description = "Deadliest poison known to AI";
     homepage = "https://iocaine.madhouse-project.org/";
     changelog = "https://git.madhouse-project.org/iocaine/iocaine/src/tag/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [ sugar700 ];
     mainProgram = "iocaine";
-    # Lacking OS access to fix, and upstream doesn't support macOS.
-    broken = stdenv.hostPlatform.isDarwin;
   };
 })
diff --git a/pkgs/by-name/ja/jabcode/package.nix b/pkgs/by-name/ja/jabcode/package.nix
index 5f5188982d76..ede827fbcc3a 100644
--- a/pkgs/by-name/ja/jabcode/package.nix
+++ b/pkgs/by-name/ja/jabcode/package.nix
@@ -17,7 +17,7 @@ let
 in
 stdenv.mkDerivation {
   pname = "jabcode-${subproject}";
-  version = "unstable-2022-06-17";
+  version = "0-unstable-2022-06-17";
   src = fetchFromGitHub {
     repo = "jabcode";
     owner = "jabcode";
diff --git a/pkgs/by-name/ku/kubelogin-oidc/package.nix b/pkgs/by-name/ku/kubelogin-oidc/package.nix
index f88a06c08424..95676c97d46e 100644
--- a/pkgs/by-name/ku/kubelogin-oidc/package.nix
+++ b/pkgs/by-name/ku/kubelogin-oidc/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "kubelogin";
-  version = "1.36.3";
+  version = "1.36.4";
 
   src = fetchFromGitHub {
     owner = "int128";
     repo = "kubelogin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VgsUQcFUbtZSZuar7K/ErJRsJZ0GvyIEixGGhF+hLnY=";
+    hash = "sha256-z0tHU+ZBxaE6VkACvYeQwkQ5CC2C4w+A41Xl24HLE8E=";
   };
 
   subPackages = [ "." ];
@@ -24,7 +24,7 @@ buildGoModule (finalAttrs: {
     "-X main.version=v${finalAttrs.version}"
   ];
 
-  vendorHash = "sha256-29D31EKO2Y6TXj607Tf3O5dGBHyrMyXoC5tWEKqvbbA=";
+  vendorHash = "sha256-LDAzmzcTcxCANgMLqQaDeJiGy+U93xhCIBiEs0mJ9aQ=";
 
   # test all packages
   preCheck = ''
diff --git a/pkgs/by-name/li/libretroPackages/cores/pcsx-rearmed.nix b/pkgs/by-name/li/libretroPackages/cores/pcsx-rearmed.nix
index 4c1f166a05dd..3cce373692e3 100644
--- a/pkgs/by-name/li/libretroPackages/cores/pcsx-rearmed.nix
+++ b/pkgs/by-name/li/libretroPackages/cores/pcsx-rearmed.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "pcsx-rearmed";
-  version = "0-unstable-2026-08-27";
+  version = "0-unstable-2026-09-05";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "pcsx_rearmed";
-    rev = "ba61a4fdee1f789e8012f205f1b63826667644fa";
-    hash = "sha256-9PpQiEn+IyteazYXOo9DhcbJh+pguWlYmDLIvLqYI6w=";
+    rev = "8625c395a24411f8c77e69802b516df9c613a712";
+    hash = "sha256-Kup3qx3/ylAEO7lwjdesLkOclcqJN8UMeB5OFIaax5c=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/li/libretroPackages/cores/prosystem.nix b/pkgs/by-name/li/libretroPackages/cores/prosystem.nix
index b3e11c217fe7..fbca0ac6a0b7 100644
--- a/pkgs/by-name/li/libretroPackages/cores/prosystem.nix
+++ b/pkgs/by-name/li/libretroPackages/cores/prosystem.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "prosystem";
-  version = "0-unstable-2026-06-04";
+  version = "0-unstable-2026-08-22";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "prosystem-libretro";
-    rev = "363b6dfbd3e240762e022c2b4897b4fe55722be3";
-    hash = "sha256-5KNxBCZq4BfBo5pF4tBzJNNyatrVQH4kmXmcyQcIPSY=";
+    rev = "8a88014287c7a01cd568067e5a557d0a2b2a051f";
+    hash = "sha256-xvfx/bypYiPal92v4m7xBRtnlKzYYtDXyRFebJpAVQQ=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/by-name/ls/lstk/package.nix b/pkgs/by-name/ls/lstk/package.nix
index 1ed8dd890ba8..20a633c87209 100644
--- a/pkgs/by-name/ls/lstk/package.nix
+++ b/pkgs/by-name/ls/lstk/package.nix
@@ -7,7 +7,7 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "lstk";
-  version = "0.22.2";
+  version = "1.0.1";
 
   __structuredAttrs = true;
 
@@ -15,10 +15,10 @@ buildGoModule (finalAttrs: {
     owner = "localstack";
     repo = "lstk";
     tag = "v${finalAttrs.version}";
-    sha256 = "sha256-Yy3LmKih91bXsa2wbBgGGNP6VhYBSD/3FFeU6WN15ek=";
+    sha256 = "sha256-QXc/VVejMgf3UdSmy6Xl6zZud+559/l4RFYc16zlNBw=";
   };
 
-  vendorHash = "sha256-wA59wFUoNW4NqAUI2MAGyF2g4vhX4++vlSAqwuXK4U4=";
+  vendorHash = "sha256-AQ2hQ1PYqd0gFBr0Bhxe7F6RxoC9QVsoNmBWxWbMSuw=";
 
   excludedPackages = "test/integration";
 
diff --git a/pkgs/by-name/ma/mackup/package.nix b/pkgs/by-name/ma/mackup/package.nix
index c559d7a7badb..faff663d70ec 100644
--- a/pkgs/by-name/ma/mackup/package.nix
+++ b/pkgs/by-name/ma/mackup/package.nix
@@ -7,14 +7,14 @@
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "mackup";
-  version = "0.11.1";
+  version = "0.11.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lra";
     repo = "mackup";
     rev = "${finalAttrs.version}";
-    hash = "sha256-qr/+Ot2mGRn/uZ2h6mOoNKS0Oeik0mBgpV2Kt3Lc6yg=";
+    hash = "sha256-+pdeG3uoNC3LCTyxWnBZ8U1pDIMKpws/Y62VrLtNghY=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/ma/martin/package.nix b/pkgs/by-name/ma/martin/package.nix
index 5ee7aecc21af..1626ae989e7b 100644
--- a/pkgs/by-name/ma/martin/package.nix
+++ b/pkgs/by-name/ma/martin/package.nix
@@ -47,18 +47,18 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "martin";
-  version = "1.14.0";
+  version = "1.16.1";
 
   src = fetchFromGitHub {
     owner = "maplibre";
     repo = "martin";
     tag = "martin-v${finalAttrs.version}";
-    hash = "sha256-XvGBLs6jIvVWtfjiwu7GHpflnAW5D3j6FjzP+AIpsvQ=";
+    hash = "sha256-VFBdFTquqTOJQUl3m3pu5sPD8z7kvuQMclKcOhC5qGc=";
   };
 
   patches = [ ./dont-build-webui.patch ];
 
-  cargoHash = "sha256-2xAdqSZmbsTpO9lfDuyk2v6mtTwxSgtwhx3R8VMQ3lA=";
+  cargoHash = "sha256-p5sAkmMTirMdmXnVb2aqGKhPYpX/uluvzq0uw4W1Bt8=";
 
   webui = buildNpmPackage {
     pname = "martin-ui";
@@ -72,7 +72,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       ln -sf ${finalAttrs.src}/demo/frontend/public/favicon.ico public/_/assets/favicon.ico
     '';
 
-    npmDepsHash = "sha256-cK/glIbXuGsXuCbGSMqVGh8vkIOPNbm6BoDMTc/TSWg=";
+    npmDepsHash = "sha256-ngYv8qtpUEiseE//tDauzvTzWJxyN2QMYvyV6ObsSvc=";
 
     buildPhase = ''
       runHook preBuild
diff --git a/pkgs/by-name/me/memtree/package.nix b/pkgs/by-name/me/memtree/package.nix
index b504a26bd40e..d504eb29970e 100644
--- a/pkgs/by-name/me/memtree/package.nix
+++ b/pkgs/by-name/me/memtree/package.nix
@@ -46,5 +46,6 @@ python3Packages.buildPythonApplication {
     maintainers = with lib.maintainers; [ nicoo ];
     mainProgram = "memtree";
     platforms = lib.platforms.linux;
+    license = lib.licenses.isc;
   };
 }
diff --git a/pkgs/by-name/me/metapac/package.nix b/pkgs/by-name/me/metapac/package.nix
index 69fe834a5b50..124f841608e3 100644
--- a/pkgs/by-name/me/metapac/package.nix
+++ b/pkgs/by-name/me/metapac/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "metapac";
-  version = "0.10.1";
+  version = "0.10.2";
 
   src = fetchFromGitHub {
     owner = "ripytide";
     repo = "metapac";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6Nw4CUTx0/KcHHguRrUH6Sa+DZhPJqdsTEeVBb0eEqw=";
+    hash = "sha256-VVDN+s6UNoLM5QywHGcSMVcgFFgnuJcCcCNm/KJ9wqQ=";
   };
 
-  cargoHash = "sha256-hUd9qWXXErOyJV0mjmkMUb8KPuUhp1XI3GNYwpt1Xow=";
+  cargoHash = "sha256-ze1oOYD8gUS4mlW/+VFfyzdo7rd10uKFmt3JhUsA32o=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
diff --git a/pkgs/by-name/mi/miracle-wm/package.nix b/pkgs/by-name/mi/miracle-wm/package.nix
index 489f32863563..b733d131b630 100644
--- a/pkgs/by-name/mi/miracle-wm/package.nix
+++ b/pkgs/by-name/mi/miracle-wm/package.nix
@@ -2,6 +2,7 @@
   stdenv,
   lib,
   fetchFromGitHub,
+  fetchpatch,
   gitUpdater,
   nixosTests,
   boost,
@@ -45,7 +46,21 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-htFgvXYgxQXV2U3F+tXEoaTb0udc2H1aHsIg5E8nRL8=";
   };
 
+  patches = [
+    # Mir 2.29 compat, remove when version > 0.10.1
+    (fetchpatch {
+      name = "0001-miracle-wm-remove-legacy-mir-optional-usage.patch";
+      url = "https://github.com/miracle-wm-org/miracle-wm/commit/a4d7b21e0d25667cd270d7ff52f8dccc2a217796.patch";
+      hash = "sha256-XBbYSuXUOS9Gbs/LwxbbTAVsFuH8xLj8VhoCAjmCDfQ=";
+    })
+  ];
+
+  # Mir 2.29 compat, remove when version > 0.10.1 (97a40cd8879898062b2cf7b5d1f5252ffc3b8dce is more than just a compat change)
   postPatch = ''
+    substituteInPlace src/policy.{cpp,h} \
+      --replace-fail 'handle_raise_window' 'handle_activate_window'
+  ''
+  + ''
     substituteInPlace CMakeLists.txt \
       --replace-fail 'DESTINATION lib' 'DESTINATION ''${CMAKE_INSTALL_LIBDIR}' \
       --replace-fail '-march=native' '# -march=native'
diff --git a/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix b/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix
index 0ae0a8f20b87..4f512f0af2ff 100644
--- a/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix
+++ b/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix
@@ -31,13 +31,13 @@ in
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "modrinth-app-unwrapped";
-  version = "0.19.1";
+  version = "0.20.2";
 
   src = fetchFromGitHub {
     owner = "modrinth";
     repo = "code";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-71Irrg5rAAil82z3ezPOI/SpqbdrPpWNZTk4zn9FNU0=";
+    hash = "sha256-PAoRh9McFvX3+F3KdwXoDbgTsrQEnhGIvA0XWCAKn2A=";
   };
 
   patches = [
@@ -67,7 +67,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail '1.0.0-local' '${finalAttrs.version}'
   '';
 
-  cargoHash = "sha256-7Kl3sQe+A/68yjzX5F9o60x2JehETn7blMScKIr/f9U=";
+  cargoHash = "sha256-HQYHggmfKlzhgKoP/lnC8wlcUc5BQ8sAjgaKuTUZZus=";
 
   mitmCache = gradle.fetchDeps {
     inherit (finalAttrs) pname;
@@ -78,7 +78,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_10;
     fetcherVersion = 3;
-    hash = "sha256-I1tFnuMlKn+67drRN1ZajA6j5b21yn+mAxWguWB885Q=";
+    hash = "sha256-A8mxLcpBX82iZkC66XhdziOvzLxEALEdFw3MBoLLNoo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/mu/music-assistant-desktop/package.nix b/pkgs/by-name/mu/music-assistant-desktop/package.nix
index 86c26884fda8..cd836186efa7 100644
--- a/pkgs/by-name/mu/music-assistant-desktop/package.nix
+++ b/pkgs/by-name/mu/music-assistant-desktop/package.nix
@@ -33,13 +33,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "music-assistant-desktop";
-  version = "0.6.5";
+  version = "0.6.8";
 
   src = fetchFromGitHub {
     owner = "music-assistant";
     repo = "desktop-app";
     tag = finalAttrs.version;
-    hash = "sha256-zTghc35CSazSfG2SvoigH+3qF7LcwpzrE5FP90I1gq0=";
+    hash = "sha256-oK6yl3no4OZmAz9F2lGtNLtMi8AK8yWp5DpcMT1HvWw=";
   };
 
   patches = [
@@ -59,7 +59,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   cargoRoot = "src-tauri";
   buildAndTestSubdir = finalAttrs.cargoRoot;
 
-  cargoHash = "sha256-18ZS8lmPMCTZU/UAg9gk6I7Ele2XbWCqf9O0L9xxwzE=";
+  cargoHash = "sha256-4gyxKLg+8OACYzRt1pM3COMGeyTx8gyihdjnxZzIIk8=";
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/yarn.lock";
diff --git a/pkgs/by-name/n8/n8n/package.nix b/pkgs/by-name/n8/n8n/package.nix
index 2ea41e448730..999fc64cc9b3 100644
--- a/pkgs/by-name/n8/n8n/package.nix
+++ b/pkgs/by-name/n8/n8n/package.nix
@@ -4,7 +4,7 @@
   nixosTests,
   fetchFromGitHub,
   nodejs,
-  pnpm_10,
+  pnpm_11,
   fetchPnpmDeps,
   pnpmConfigHook,
   python3,
@@ -27,25 +27,25 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "n8n";
-  version = "2.36.7";
+  version = "2.37.10";
 
   src = fetchFromGitHub {
     owner = "n8n-io";
     repo = "n8n";
     tag = "n8n@${finalAttrs.version}";
-    hash = "sha256-g0cIcvs3HMypQ0Y52R27GUGH03r6U4p0htLHUh5CIOA=";
+    hash = "sha256-cEWwXiyBLiZ8MgH5OKe0+hgd9ooYZTDQIuS4Dq0nKos=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
-    pnpm = pnpm_10;
+    pnpm = pnpm_11;
     fetcherVersion = 4;
-    hash = "sha256-bzYKeZ5ruIef62FnCG0mtnT9ssn/EETmUqGCA8GhkxQ=";
+    hash = "sha256-T1axKjZT1I8NjXFV8hAKSYa+zCl/Fpyzz2DGM+cmkLQ=";
   };
 
   nativeBuildInputs = [
     pnpmConfigHook
-    pnpm_10
+    pnpm_11
     python3 # required to build sqlite3 bindings
     node-gyp # required to build sqlite3 bindings
     makeWrapper
@@ -88,7 +88,7 @@ stdenv.mkDerivation (finalAttrs: {
     rm node_modules/.modules.yaml
     rm packages/nodes-base/dist/types/nodes.json
 
-    CI=true pnpm --ignore-scripts prune --prod
+    CI=true pnpm --ignore-scripts prune --prod -w
     find -type f \( -name "*.ts" -o -name "*.map" \) -exec rm -rf {} +
     rm -rf node_modules/.pnpm/{typescript*,prettier*}
     shopt -s globstar
diff --git a/pkgs/by-name/na/nar-serve/package.nix b/pkgs/by-name/na/nar-serve/package.nix
index a8c2037591a8..072adcdd3895 100644
--- a/pkgs/by-name/na/nar-serve/package.nix
+++ b/pkgs/by-name/na/nar-serve/package.nix
@@ -6,16 +6,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "nar-serve";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "numtide";
     repo = "nar-serve";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-C9MBCN/ResbYjmRkT65m8XnNbquoZ0PC/zx/Y7QFXkA=";
+    hash = "sha256-72gY3V9XLi+qZWDH3ARR2DLEYC3cszYkAVBBBRTNcrM=";
   };
 
-  vendorHash = "sha256-BP14jmOZ2MCugeTgbDR8wSZ8sRWt4QUWrH3+e2FBgqU=";
+  vendorHash = "sha256-sms5yAbbc6PN02DFFRTktjaryDF/h+3b14BC+ZwMBOA=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/nu/nufmt/package.nix b/pkgs/by-name/nu/nufmt/package.nix
index 82594fc4c4a0..487f44d4281a 100644
--- a/pkgs/by-name/nu/nufmt/package.nix
+++ b/pkgs/by-name/nu/nufmt/package.nix
@@ -7,13 +7,13 @@
 }:
 rustPlatform.buildRustPackage {
   pname = "nufmt";
-  version = "0-unstable-2026-08-12";
+  version = "0-unstable-2026-09-03";
 
   src = fetchFromGitHub {
     owner = "nushell";
     repo = "nufmt";
-    rev = "7cfd3b7eacf5a9feb22777230e3076038f2e9e8d";
-    hash = "sha256-v490Rlrih2R1zyGlHbOWzOFn5UTNb6Wx3v7LKLxXahY=";
+    rev = "08f332ba7abe915575dd0588e7a528a774906b92";
+    hash = "sha256-klrQf+myTOUt4NwyF7T/8e01O1+fe7UeNgd6pQBE14g=";
   };
 
   nativeBuildInputs = [
@@ -22,7 +22,7 @@ rustPlatform.buildRustPackage {
 
   cargoHash = "sha256-Fb2A9DcYCIdSWrFg4MqkZJ6ev4VQ/VwrBtZoJLEBOHc=";
 
-  # NOTE: Patch follows similar intention upstream https://github.com/nushell/nufmt/commit/7cfd3b7eacf5a9feb22777230e3076038f2e9e8d
+  # NOTE: Patch follows similar intention upstream https://github.com/nushell/nufmt/commit/074930a23bc89a5f720a0d46ac2853f3153817c2
   postPatch = ''
     substituteInPlace tests/ground_truth.rs --replace-fail \
       '        let path = PathBuf::from(target_dir).join("debug").join(exe_name);' \
diff --git a/pkgs/by-name/ox/oxigraph/package.nix b/pkgs/by-name/ox/oxigraph/package.nix
index 8f137f2879e5..f82610355a65 100644
--- a/pkgs/by-name/ox/oxigraph/package.nix
+++ b/pkgs/by-name/ox/oxigraph/package.nix
@@ -14,17 +14,17 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "oxigraph";
-  version = "0.5.10";
+  version = "0.5.11";
 
   src = fetchFromGitHub {
     owner = "oxigraph";
     repo = "oxigraph";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2mThlPqjUJ3FuqzGRTfrN8af1NupSgdbWomyL5aMJTA=";
+    hash = "sha256-eeLs92CqiijIrBwGGNmyDvAGVZASyT33XOX3/G90yAA=";
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-iDt9wHJr6PMXGuCvLJqK9bRb3Y5gjuuSYdPhQofeJFQ=";
+  cargoHash = "sha256-2+GTh77DDlCJGWRWUPZhSgD5l5VPu/N3JJ/4FaNUpUc=";
 
   nativeBuildInputs = [
     rustPlatform.bindgenHook
diff --git a/pkgs/by-name/po/poedit/package.nix b/pkgs/by-name/po/poedit/package.nix
index 10c4574b2ec1..5f9a5099267f 100644
--- a/pkgs/by-name/po/poedit/package.nix
+++ b/pkgs/by-name/po/poedit/package.nix
@@ -91,7 +91,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://www.poedit.net/";
     license = lib.licenses.mit;
     platforms = lib.platforms.unix;
-    maintainers = with lib.maintainers; [ dasj19 ];
+    maintainers = with lib.maintainers; [ RumBugen ];
     # configure: error: GTK+ build of wxWidgets is required
     broken = stdenv.hostPlatform.isDarwin;
   };
diff --git a/pkgs/by-name/ri/rime-moegirl/package.nix b/pkgs/by-name/ri/rime-moegirl/package.nix
index 3a88e169e2e9..879133bb82d7 100644
--- a/pkgs/by-name/ri/rime-moegirl/package.nix
+++ b/pkgs/by-name/ri/rime-moegirl/package.nix
@@ -5,10 +5,10 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "rime-moegirl";
-  version = "20260812";
+  version = "20260911";
   src = fetchurl {
     url = "https://github.com/outloudvi/mw2fcitx/releases/download/${finalAttrs.version}/moegirl.dict.yaml";
-    hash = "sha256-WDbIdQdBX03NsPxFrs9N166CGDplDN15MOHmY+MuOiQ=";
+    hash = "sha256-FhFH9wfUab5/X2DyRzWqwr+geCE84ijmfVloEOM1Lg0=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/sa/saucectl/package.nix b/pkgs/by-name/sa/saucectl/package.nix
index 2bc35fa1a4ee..8d31c1bc8ddb 100644
--- a/pkgs/by-name/sa/saucectl/package.nix
+++ b/pkgs/by-name/sa/saucectl/package.nix
@@ -2,12 +2,16 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  versionCheckHook,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "saucectl";
   version = "0.214.0";
 
+  __darwinAllowLocalNetworking = true;
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "saucelabs";
     repo = "saucectl";
@@ -24,6 +28,9 @@ buildGoModule (finalAttrs: {
 
   checkFlags = [ "-skip=^TestNewRequestWithContext$" ];
 
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
   meta = {
     description = "Command line interface for the Sauce Labs platform";
     changelog = "https://github.com/saucelabs/saucectl/releases/tag/v${finalAttrs.version}";
diff --git a/pkgs/by-name/se/setbfree/package.nix b/pkgs/by-name/se/setbfree/package.nix
index d1bf4b561ed7..97f862d21427 100644
--- a/pkgs/by-name/se/setbfree/package.nix
+++ b/pkgs/by-name/se/setbfree/package.nix
@@ -15,7 +15,7 @@
   nix-update-script,
 }:
 let
-  version = "0.8.16";
+  version = "0.8.17";
 in
 stdenv.mkDerivation {
   pname = "setbfree";
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
     owner = "pantherb";
     repo = "setBfree";
     rev = "v${version}";
-    hash = "sha256-bfmCNoTINFEqGKsnef8+gS8PGTAuogyikL9HzpMjKaI=";
+    hash = "sha256-MjbgN0WIZtoFjEtjYa0MkTtaub/oNSxQ0i8EedBbTGA=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/st/stackwhere/package.nix b/pkgs/by-name/st/stackwhere/package.nix
index e16b7beec313..603ccc05b591 100644
--- a/pkgs/by-name/st/stackwhere/package.nix
+++ b/pkgs/by-name/st/stackwhere/package.nix
@@ -8,7 +8,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "stackwhere";
-  version = "0.3.2";
+  version = "0.4.0";
 
   __structuredAttrs = true;
   __darwinAllowLocalNetworking = true;
@@ -17,7 +17,7 @@ buildGoModule (finalAttrs: {
     owner = "cilium";
     repo = "stackwhere";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-g1CnWA8WNRHaGXMm+Ksi3AnkFJCy9/bjQbhYjrOlu1M=";
+    hash = "sha256-Ofg0ibDG7QI5eESvKl1U8SNq8567aSo79/Iiuj2UaoM=";
   };
 
   vendorHash = "sha256-J2X1uTkRtmdmo8Fxxql6Nu84F6MarWHFTopavUPL+RU=";
diff --git a/pkgs/tools/system/testdisk/default.nix b/pkgs/by-name/te/testdisk/package.nix
similarity index 89%
rename from pkgs/tools/system/testdisk/default.nix
rename to pkgs/by-name/te/testdisk/package.nix
index 30734556c010..c3a1d5f0446e 100644
--- a/pkgs/tools/system/testdisk/default.nix
+++ b/pkgs/by-name/te/testdisk/package.nix
@@ -5,7 +5,6 @@
   ncurses,
   libuuid,
   pkg-config,
-  wrapQtAppsHook,
   libjpeg,
   zlib,
   libewf-legacy,
@@ -14,16 +13,12 @@
   enableExtFs ? !stdenv.hostPlatform.isDarwin,
   e2fsprogs ? null,
   enableQt ? false,
-  qtbase ? null,
-  qttools ? null,
-  qwt ? null,
+  qt5,
+  libsForQt5,
 }:
 
 assert enableNtfs -> ntfs3g != null;
 assert enableExtFs -> e2fsprogs != null;
-assert enableQt -> qtbase != null;
-assert enableQt -> qttools != null;
-assert enableQt -> qwt != null;
 
 stdenv.mkDerivation rec {
   pname = "testdisk";
@@ -50,15 +45,15 @@ stdenv.mkDerivation rec {
   ++ lib.optional enableNtfs ntfs3g
   ++ lib.optional enableExtFs e2fsprogs
   ++ lib.optionals enableQt [
-    qtbase
-    qttools
-    qwt
+    qt5.qtbase
+    qt5.qttools
+    libsForQt5.qwt
   ];
 
   nativeBuildInputs = [
     pkg-config
   ]
-  ++ lib.optional enableQt wrapQtAppsHook;
+  ++ lib.optional enableQt qt5.wrapQtAppsHook;
 
   env.NIX_CFLAGS_COMPILE = "-Wno-unused";
 
diff --git a/pkgs/by-name/tz/tzf-rs/package.nix b/pkgs/by-name/tz/tzf-rs/package.nix
index f1d52f57ffb7..c043802b2612 100644
--- a/pkgs/by-name/tz/tzf-rs/package.nix
+++ b/pkgs/by-name/tz/tzf-rs/package.nix
@@ -6,7 +6,7 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tzf-rs";
-  version = "1.3.7";
+  version = "2.0.0";
 
   __structuredAttrs = true;
 
@@ -14,7 +14,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "ringsaturn";
     repo = "tzf-rs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YFDoNlBLeFqv2aGa4Wbd9CwDAz6FOd+8OjSksGzzzlI=";
+    hash = "sha256-t/LleWuSu8czVhs0GqvgmoL8u0A6t7hcuNKDkKAy0Hc=";
   };
 
   buildFeatures = [
@@ -22,7 +22,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "export-geojson"
   ];
 
-  cargoHash = "sha256-FehvfC5cvmTjMqUR0nTkcUDC/IK+e5S/snKMI9OBJaM=";
+  cargoHash = "sha256-FpoXDbCufkm4FrqZHINZkJ79TA6vGDRaerousVY7HcA=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/ub/ubridge/package.nix b/pkgs/by-name/ub/ubridge/package.nix
index cd1d82f05021..a367165f4654 100644
--- a/pkgs/by-name/ub/ubridge/package.nix
+++ b/pkgs/by-name/ub/ubridge/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ubridge";
-  version = "1.2.1";
+  version = "1.2.3";
 
   src = fetchFromGitHub {
     owner = "GNS3";
     repo = "ubridge";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1dPHolK7eJimqolntBZK5k6e4CykeuvbU48iN3RN4bw=";
+    hash = "sha256-d/5E3JRel5/DGsowg10YxRX7JzcmuwtdP3Jo38GjwEc=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/va/vals/package.nix b/pkgs/by-name/va/vals/package.nix
index d8bc9561832f..d4987f7d9bfa 100644
--- a/pkgs/by-name/va/vals/package.nix
+++ b/pkgs/by-name/va/vals/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "vals";
-  version = "0.46.0";
+  version = "0.46.1";
 
   src = fetchFromGitHub {
     rev = "v${finalAttrs.version}";
     owner = "helmfile";
     repo = "vals";
-    sha256 = "sha256-aDFCJaAhZNxo/E++/yFeqeTttvmT4FHhcFzSV6Mn2ck=";
+    sha256 = "sha256-WLtr2KllSbCwHmepsW8IrTQ3mzgyS2QOmqteZTaePDA=";
   };
 
-  vendorHash = "sha256-eVoKsXFtvfGU3XUH+U9PKPYGCDNyGGrj8F0EANonkuY=";
+  vendorHash = "sha256-iaYbTVrtyOfudEQ9eejFfkr+3oZ9jPRg6Xm5Yyyqda8=";
 
   proxyVendor = true;
 
diff --git a/pkgs/by-name/ve/verapdf/package.nix b/pkgs/by-name/ve/verapdf/package.nix
index 893fe71cacb0..694c00d07c94 100644
--- a/pkgs/by-name/ve/verapdf/package.nix
+++ b/pkgs/by-name/ve/verapdf/package.nix
@@ -100,9 +100,8 @@ maven.buildMavenPackage rec {
     changelog = "https://github.com/veraPDF/veraPDF-library/blob/${src.tag}/RELEASENOTES.md";
     description = "Command line and GUI industry supported PDF/A and PDF/UA Validation";
     homepage = "https://github.com/veraPDF/veraPDF-apps";
-    license = [
+    license = lib.licenses.OR [
       lib.licenses.gpl3Plus
-      # or
       lib.licenses.mpl20
     ];
     maintainers = [
diff --git a/pkgs/by-name/vi/virter/package.nix b/pkgs/by-name/vi/virter/package.nix
index d9ca872e3ca0..77ba06fa9713 100644
--- a/pkgs/by-name/vi/virter/package.nix
+++ b/pkgs/by-name/vi/virter/package.nix
@@ -11,16 +11,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "virter";
-  version = "1.3.0";
+  version = "1.3.2";
 
   src = fetchFromGitHub {
     owner = "LINBIT";
     repo = "virter";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-i0PDZo1vRatOiBdGLhEAy9KIt+bNp94JASKf8HTkhMg=";
+    hash = "sha256-/8fsYadyXUM9N/rDKsv1dNnfngKGC1LyJkSja8Cue0I=";
   };
 
-  vendorHash = "sha256-XOMxe+pG4OB15l+TKuYR2tJPPcPbsnipxHlnDH0XukA=";
+  vendorHash = "sha256-3zl9y8MITJGw3wBhCQgvFcq7hxsSTtUAD0w2B+aSIyM=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/wa/wasmer/package.nix b/pkgs/by-name/wa/wasmer/package.nix
index daed0ef54031..131b82f86d87 100644
--- a/pkgs/by-name/wa/wasmer/package.nix
+++ b/pkgs/by-name/wa/wasmer/package.nix
@@ -61,7 +61,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wasmer";
-  version = "7.4.0";
+  version = "7.4.1";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -70,13 +70,13 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "wasmerio";
     repo = "wasmer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-IfrwkJQEOHxXS/Ly/rn4xus7CROc9vv3MNDIHhzU7hU=";
+    hash = "sha256-W84XhGPLwnsWvyP5gRKznNpBMgTWtbQ1XNhN/2M/qp4=";
     fetchSubmodules = true;
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-xIgF+RkbIcxv2Q8+Hy242X9BitVZq3QQ81SN2WbQ75w=";
+    hash = "sha256-KBTIhL7P9H9RGziz+42lssYAyG9fYvwjEZAXWommN8w=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/wa/wayland-proxy-virtwl/package.nix b/pkgs/by-name/wa/wayland-proxy-virtwl/package.nix
index da06e0ccd952..dc9c1acc92ca 100644
--- a/pkgs/by-name/wa/wayland-proxy-virtwl/package.nix
+++ b/pkgs/by-name/wa/wayland-proxy-virtwl/package.nix
@@ -9,13 +9,13 @@
 
 ocamlPackages.buildDunePackage {
   pname = "wayland-proxy-virtwl";
-  version = "0-unstable-2026-08-22";
+  version = "0-unstable-2026-09-04";
 
   src = fetchFromGitHub {
     owner = "talex5";
     repo = "wayland-proxy-virtwl";
-    rev = "3d092ebcaaa07ce56c47d05039be2ff8d7721486";
-    sha256 = "sha256-9FB/euTCGaxMF7lVs+KYkH1NiSmpo+TmWiv/waw6KXg=";
+    rev = "aa515e518a9e0de117d3b77b7e9db91aea7dcfbc";
+    sha256 = "sha256-VIm6jr9SfACtCQjrmELy64wECpuTjxQ3WlTQBL64rXI=";
   };
 
   minimalOCamlVersion = "5.0";
diff --git a/pkgs/by-name/xa/xan/package.nix b/pkgs/by-name/xa/xan/package.nix
index e33670ba6d58..b123e636dc95 100644
--- a/pkgs/by-name/xa/xan/package.nix
+++ b/pkgs/by-name/xa/xan/package.nix
@@ -5,16 +5,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "xan";
-  version = "0.60.0";
+  version = "0.61.0";
 
   src = fetchFromGitHub {
     owner = "medialab";
     repo = "xan";
     tag = finalAttrs.version;
-    hash = "sha256-CexefTLr8K6rNtXE8dog0cA4OlRa/uReK1HJrx471+4=";
+    hash = "sha256-Z8sEwoM0RdUqN4rlc8PP1D5046405UqtBD7RU+ybKlU=";
   };
 
-  cargoHash = "sha256-WGva0hf0eB/4VUPsNQZJnAW2uWctsVLqSsYkuoreMog=";
+  cargoHash = "sha256-dw8KlbCTK+K8okT88CbZieM/BmFDAKmGClirazRMEuI=";
 
   # FIXME: tests fail and I do not have the time to investigate. Temporarily disable
   # tests so that we can manually run and test the package for packaging purposes.
diff --git a/pkgs/by-name/ze/zeno/package.nix b/pkgs/by-name/ze/zeno/package.nix
index f2b89508b8d3..32b629ebfa41 100644
--- a/pkgs/by-name/ze/zeno/package.nix
+++ b/pkgs/by-name/ze/zeno/package.nix
@@ -5,16 +5,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "zeno";
-  version = "2.0.26";
+  version = "2.0.27";
 
   src = fetchFromGitHub {
     owner = "internetarchive";
     repo = "Zeno";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DuiAQKG25qFiGCAyZF9IonOGE/IZyDbowI/ZYdoQqIg=";
+    hash = "sha256-TxizytoXeZmgKUkLOqWUHSA7rNCAW43FQlC5KpbLe50=";
   };
 
-  vendorHash = "sha256-BBPhbJT99b/rPyrGrEKAWs3/YRGVFBMOMiC1FzbIlLI=";
+  vendorHash = "sha256-SgC8wZr2BHGXT2Oul3/YqX0H9XMpFBaA6GCQPfRkxY4=";
 
   env.CGO_ENABLED = true;
   ldFlags = [
diff --git a/pkgs/development/libraries/gstreamer/bad/default.nix b/pkgs/development/libraries/gstreamer/bad/default.nix
index d91572296421..e607d95bb631 100644
--- a/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/pkgs/development/libraries/gstreamer/bad/default.nix
@@ -443,5 +443,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = if enableGplPlugins then lib.licenses.gpl2Plus else lib.licenses.lgpl2Plus;
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
     maintainers = with lib.maintainers; [ tmarkus ];
+    identifiers.cpeParts = gstreamer.passthru.gstreamerCpeParts finalAttrs.version;
   };
 })
diff --git a/pkgs/development/libraries/gstreamer/base/default.nix b/pkgs/development/libraries/gstreamer/base/default.nix
index 087c8c50b3d1..b1a4029028fd 100644
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@@ -240,5 +240,6 @@ stdenv.mkDerivation (finalAttrs: {
     );
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ tmarkus ];
+    identifiers.cpeParts = gstreamer.passthru.gstreamerCpeParts finalAttrs.version;
   };
 })
diff --git a/pkgs/development/libraries/gstreamer/core/default.nix b/pkgs/development/libraries/gstreamer/core/default.nix
index 0c959452333b..354dd05ddf7c 100644
--- a/pkgs/development/libraries/gstreamer/core/default.nix
+++ b/pkgs/development/libraries/gstreamer/core/default.nix
@@ -146,6 +146,26 @@ stdenv.mkDerivation (finalAttrs: {
       pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
     };
     updateScript = directoryListingUpdater { odd-unstable = true; };
+
+    # From around version 1.12.0 on, there is a single CPE identifier for all of GStreamer.
+    # FIXME: Should gst-plugins-rs follow the main GStreamer versioning or its own deviating version?
+    gstreamerCpeParts =
+      let
+        commonGstreamerVersion = finalAttrs.version;
+      in
+      version:
+      lib.warnIf (version != commonGstreamerVersion)
+        ''
+          Detected mismatch between common GStreamer version (${commonGstreamerVersion}) and version used for gstreamerCpeParts (${version}).
+          Note that GStreamer uses a common CPE identifier for its components.
+          Having a deviating version is unusual, but may occur e.g. if overriding a subset of GStreamer libraries.
+        ''
+        (
+          lib.meta.cpeFullVersionWithVendor "gstreamer" version
+          // {
+            product = "gstreamer";
+          }
+        );
   };
 
   meta = {
@@ -159,5 +179,6 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [
       tmarkus
     ];
+    identifiers.cpeParts = finalAttrs.passthru.gstreamerCpeParts finalAttrs.version;
   };
 })
diff --git a/pkgs/development/libraries/gstreamer/devtools/default.nix b/pkgs/development/libraries/gstreamer/devtools/default.nix
index 12eafbc7e91a..892fe6e84af6 100644
--- a/pkgs/development/libraries/gstreamer/devtools/default.nix
+++ b/pkgs/development/libraries/gstreamer/devtools/default.nix
@@ -132,5 +132,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.lgpl2Plus;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ tmarkus ];
+    identifiers.cpeParts = gstreamer.passthru.gstreamerCpeParts finalAttrs.version;
   };
 })
diff --git a/pkgs/development/libraries/gstreamer/ges/default.nix b/pkgs/development/libraries/gstreamer/ges/default.nix
index 0bef33df0348..7b0130b4c977 100644
--- a/pkgs/development/libraries/gstreamer/ges/default.nix
+++ b/pkgs/development/libraries/gstreamer/ges/default.nix
@@ -14,6 +14,8 @@
   flex,
   gettext,
   gobject-introspection,
+  # for passthru.gstreamerCpeParts
+  gstreamer,
   # Checks meson.is_cross_build(), so even canExecute isn't enough.
   enableDocumentation ? stdenv.hostPlatform == stdenv.buildPlatform,
   hotdoc,
@@ -93,5 +95,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.lgpl2Plus;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ tmarkus ];
+    identifiers.cpeParts = gstreamer.passthru.gstreamerCpeParts finalAttrs.version;
   };
 })
diff --git a/pkgs/development/libraries/gstreamer/good/default.nix b/pkgs/development/libraries/gstreamer/good/default.nix
index 05b8833cbba5..f149568a0f86 100644
--- a/pkgs/development/libraries/gstreamer/good/default.nix
+++ b/pkgs/development/libraries/gstreamer/good/default.nix
@@ -61,6 +61,8 @@
   wavpack,
   glib,
   openssl,
+  # for passthru.gstreamerCpeParts
+  gstreamer,
   # Checks meson.is_cross_build(), so even canExecute isn't enough.
   enableDocumentation ? stdenv.hostPlatform == stdenv.buildPlatform,
   hotdoc,
@@ -306,5 +308,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.lgpl2Plus;
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
     maintainers = with lib.maintainers; [ tmarkus ];
+    identifiers.cpeParts = gstreamer.passthru.gstreamerCpeParts finalAttrs.version;
   };
 })
diff --git a/pkgs/development/libraries/gstreamer/libav/default.nix b/pkgs/development/libraries/gstreamer/libav/default.nix
index 6dc5f3abd6e4..4d0d96121fb9 100644
--- a/pkgs/development/libraries/gstreamer/libav/default.nix
+++ b/pkgs/development/libraries/gstreamer/libav/default.nix
@@ -75,5 +75,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.lgpl2Plus;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ tmarkus ];
+    identifiers.cpeParts = gstreamer.passthru.gstreamerCpeParts finalAttrs.version;
   };
 })
diff --git a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
index 742fbc362821..bb02d891686e 100644
--- a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
+++ b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
@@ -10,6 +10,8 @@
   gobject-introspection,
   gst-plugins-base,
   gst-plugins-bad,
+  # only for passthru.gstreamerCpeParts
+  gstreamer,
   # Checks meson.is_cross_build(), so even canExecute isn't enough.
   enableDocumentation ? stdenv.hostPlatform == stdenv.buildPlatform,
   hotdoc,
@@ -82,6 +84,7 @@ stdenv.mkDerivation (finalAttrs: {
       A library on top of GStreamer for building an RTSP server.
     '';
     license = lib.licenses.lgpl2Plus;
+    identifiers.cpeParts = gstreamer.passthru.gstreamerCpeParts finalAttrs.version;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ bkchr ];
   };
diff --git a/pkgs/development/libraries/gstreamer/ugly/default.nix b/pkgs/development/libraries/gstreamer/ugly/default.nix
index 4ad03256c94e..bb5a84bb7873 100644
--- a/pkgs/development/libraries/gstreamer/ugly/default.nix
+++ b/pkgs/development/libraries/gstreamer/ugly/default.nix
@@ -17,6 +17,8 @@
   libintl,
   lib,
   enableGplPlugins ? true,
+  # only for passthru.gstreamerCpeParts
+  gstreamer,
   # Checks meson.is_cross_build(), so even canExecute isn't enough.
   enableDocumentation ? stdenv.hostPlatform == stdenv.buildPlatform,
   hotdoc,
@@ -122,6 +124,7 @@ stdenv.mkDerivation (finalAttrs: {
       like. The code might be widely known to present patent problems.
     '';
     license = if enableGplPlugins then lib.licenses.gpl2Plus else lib.licenses.lgpl2Plus;
+    identifiers.cpeParts = gstreamer.passthru.gstreamerCpeParts finalAttrs.version;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ tmarkus ];
   };
diff --git a/pkgs/development/python-modules/bgutil-ytdlp-pot-provider/default.nix b/pkgs/development/python-modules/bgutil-ytdlp-pot-provider/default.nix
index 9dc0ebb58fe6..1f08f03a4cbf 100644
--- a/pkgs/development/python-modules/bgutil-ytdlp-pot-provider/default.nix
+++ b/pkgs/development/python-modules/bgutil-ytdlp-pot-provider/default.nix
@@ -16,21 +16,25 @@
 
 buildPythonPackage rec {
   pname = "bgutil-ytdlp-pot-provider";
-  version = "1.3.1";
+  version = "2.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Brainicism";
     repo = "bgutil-ytdlp-pot-provider";
     tag = version;
-    hash = "sha256-dhpataQ1HSCRPnm4k3K/NMaQPQdNrx8C4q855l7kbbQ=";
+    hash = "sha256-mmcRzTLzdjI/zHArUMPkhQ4uKmYhabiG7RpvH4IBxjc=";
   };
 
+  postPatch = ''
+    cp README.md plugin/README.md
+  '';
+
   npmDeps = fetchNpmDeps {
     name = "${pname}-${version}-npm-deps";
     src = src + "/server";
-    npmDepsFetcherVersion = 2;
-    hash = "sha256-Qwwi6W+Oeu6ZeLmZP5vEfAKOJyivbULR5mlk7tcVIE8=";
+    npmDepsFetcherVersion = 3;
+    hash = "sha256-1yrRJQ53v4LxzEsc6VODrKgzCdELyMCVfwyCLZSzWek=";
   };
 
   npmRoot = "server";
diff --git a/pkgs/development/python-modules/diskcache/default.nix b/pkgs/development/python-modules/diskcache/default.nix
index 0e6050c4da79..4d76e7462215 100644
--- a/pkgs/development/python-modules/diskcache/default.nix
+++ b/pkgs/development/python-modules/diskcache/default.nix
@@ -3,24 +3,29 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
+  setuptools,
   pytest-cov-stub,
   pytest-django,
   pytest-xdist,
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "diskcache";
   version = "5.6.3";
-  format = "setuptools";
+  pyproject = true;
+
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "grantjenks";
     repo = "python-diskcache";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-1cDpdf+rLaG14TDd1wEHAiYXb69NFTFeOHD1Ib1oOVY=";
   };
 
+  build-system = [ setuptools ];
+
   nativeCheckInputs = [
     pytest-cov-stub
     pytest-django
@@ -48,4 +53,4 @@ buildPythonPackage rec {
     license = lib.licenses.asl20;
     maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/lifx-async/default.nix b/pkgs/development/python-modules/lifx-async/default.nix
index fa473159c113..c6560a4bbf00 100644
--- a/pkgs/development/python-modules/lifx-async/default.nix
+++ b/pkgs/development/python-modules/lifx-async/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "lifx-async";
-  version = "5.4.9";
+  version = "5.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Djelibeybi";
     repo = "lifx-async";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DWclqWrCoUfFC2gu1CbrqHxx4BFP1jV597c4llq2B5A=";
+    hash = "sha256-MFXWleTbyrmw29s/s4j3ypRbL6g5/ibImrhuu25i8OA=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/nidaqmx/default.nix b/pkgs/development/python-modules/nidaqmx/default.nix
index e7afd3137b7d..7809d41e27ed 100644
--- a/pkgs/development/python-modules/nidaqmx/default.nix
+++ b/pkgs/development/python-modules/nidaqmx/default.nix
@@ -23,14 +23,14 @@
 
 buildPythonPackage rec {
   pname = "nidaqmx";
-  version = "1.4.0";
+  version = "1.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ni";
     repo = "nidaqmx-python";
     tag = version;
-    hash = "sha256-Khydb14+yJKWYcO4pROfbainXw3bHceXK5Gc9GCIYNo=";
+    hash = "sha256-dxSHaqNTzzMcUk/wtMtxmiHMpoL8f2T3p/h37tw/5AA=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/nomadnet/default.nix b/pkgs/development/python-modules/nomadnet/default.nix
index d705a631efd4..675b1b760ec7 100644
--- a/pkgs/development/python-modules/nomadnet/default.nix
+++ b/pkgs/development/python-modules/nomadnet/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "nomadnet";
-  version = "1.4.2";
+  version = "1.4.3";
   pyproject = true;
 
   __structuredAttrs = true;
 
   src = fetchPypi {
     inherit (finalAttrs) version pname;
-    hash = "sha256-d3fueyrzCpB66c4CZiH6AyIEFZq75Vu/TA9QTW3xnZE=";
+    hash = "sha256-wla7XviN+j3kW2+gKiry4OMTt7DDTJxRA5XwQYl2KZ0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/oelint-parser/default.nix b/pkgs/development/python-modules/oelint-parser/default.nix
index 81032de1c726..1129bf3fdf64 100644
--- a/pkgs/development/python-modules/oelint-parser/default.nix
+++ b/pkgs/development/python-modules/oelint-parser/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "oelint-parser";
-  version = "8.12.1";
+  version = "8.12.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "priv-kweihmann";
     repo = "oelint-parser";
     tag = finalAttrs.version;
-    hash = "sha256-UY8KqItX8kj3eS3peP8okBR8i81MisMSffbhSPaqBM0=";
+    hash = "sha256-8GnbfMX9RedPgvDHkzejkPVSEfhdKAryPRJIT+hNCxk=";
   };
 
   pythonRelaxDeps = [ "regex" ];
diff --git a/pkgs/development/python-modules/posthog/default.nix b/pkgs/development/python-modules/posthog/default.nix
index c32a20afac1a..a30e9d9715f4 100644
--- a/pkgs/development/python-modules/posthog/default.nix
+++ b/pkgs/development/python-modules/posthog/default.nix
@@ -29,14 +29,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "posthog";
-  version = "7.45.1";
+  version = "7.52.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "PostHog";
     repo = "posthog-python";
     tag = "posthog-v${finalAttrs.version}";
-    hash = "sha256-UZqfNc8u0sG6G0YCzKeoWfwKIASgtmsKRJISjyGyULw=";
+    hash = "sha256-EIH8CQgbnpbkMupyyxRR5+ZTiKiBBRtTyFQfbEABHV4=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pydle/default.nix b/pkgs/development/python-modules/pydle/default.nix
index da06f1deb953..283c84cf83ad 100644
--- a/pkgs/development/python-modules/pydle/default.nix
+++ b/pkgs/development/python-modules/pydle/default.nix
@@ -11,13 +11,13 @@
 
 buildPythonPackage rec {
   pname = "pydle";
-  version = "1.1.0";
+  version = "1.2.0";
   pyproject = true;
   src = fetchFromCodeberg {
     owner = "shiz";
     repo = "pydle";
     tag = "v${version}";
-    hash = "sha256-LxlE0JVKgwDcPB7QuKkmfBWG33pDzG0F9qaL88xF8r4=";
+    hash = "sha256-460oY68PSmmgXq4bLOr8SB9RiMy3wc5EwEV7s5AKePY=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/python-mpv-jsonipc/default.nix b/pkgs/development/python-modules/python-mpv-jsonipc/default.nix
index 9022caf8b6d3..735eb655469a 100644
--- a/pkgs/development/python-modules/python-mpv-jsonipc/default.nix
+++ b/pkgs/development/python-modules/python-mpv-jsonipc/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "python-mpv-jsonipc";
-  version = "1.3.0";
+  version = "1.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "iwalton3";
     repo = "python-mpv-jsonipc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-i21Pzaidoi2MLb6Le9pA37IRy804MeC0yVV4KONb3mk=";
+    hash = "sha256-fSZ2xPWkdkXubSvgT0pGEvTtnQepBkfYHRVlCGoH6Tg=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pytorch-lightning/default.nix b/pkgs/development/python-modules/pytorch-lightning/default.nix
index e372204602d3..c7f041c76662 100644
--- a/pkgs/development/python-modules/pytorch-lightning/default.nix
+++ b/pkgs/development/python-modules/pytorch-lightning/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pytorch-lightning";
-  version = "2.6.5";
+  version = "2.6.6";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -32,7 +32,7 @@ buildPythonPackage (finalAttrs: {
     owner = "Lightning-AI";
     repo = "pytorch-lightning";
     tag = finalAttrs.version;
-    hash = "sha256-j29UvQbm+R/uDqwj3kZrXw5YSbUPlJWZUT8RUPc4QyY=";
+    hash = "sha256-VKEd9Psj4DdOSdIXqwbmLl23FJWrQJEr9b34+t//c9w=";
   };
 
   env.PACKAGE_NAME = "pytorch";
diff --git a/pkgs/development/python-modules/rembg/default.nix b/pkgs/development/python-modules/rembg/default.nix
index c84ff7f925d6..4e947427c956 100644
--- a/pkgs/development/python-modules/rembg/default.nix
+++ b/pkgs/development/python-modules/rembg/default.nix
@@ -46,14 +46,14 @@ let
 in
 buildPythonPackage (finalAttrs: {
   pname = "rembg";
-  version = "2.0.83";
+  version = "2.0.84";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "danielgatis";
     repo = "rembg";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VqjZKo8fYhqgVzrwGnLDiUWu/gtxhQ3QyKBgOm1R+g4=";
+    hash = "sha256-iY5ajSCMYiEZ34/WFkMV9pKw1o6sHawIa4iyQiUg8+E=";
   };
 
   env.POETRY_DYNAMIC_VERSIONING_BYPASS = finalAttrs.version;
diff --git a/pkgs/development/python-modules/rns/default.nix b/pkgs/development/python-modules/rns/default.nix
index 094a0f36f2ea..91d3b9a33988 100644
--- a/pkgs/development/python-modules/rns/default.nix
+++ b/pkgs/development/python-modules/rns/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "rns";
-  version = "1.5.3";
+  version = "1.5.4";
   pyproject = true;
   __structuredAttrs = true;
 
   src = fetchPypi {
     pname = "rns";
     version = finalAttrs.version;
-    hash = "sha256-2WjnzyHyPHkmF8coh6w8WMeI9k8jAPvmA0ZqAQpjYDk=";
+    hash = "sha256-V4UI7wje33wQn3OkRQZcqJxQpjxqac7XsUftIDkc6xU=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/svgpathtools/default.nix b/pkgs/development/python-modules/svgpathtools/default.nix
index 8eb21500a61a..790d8983cf9c 100644
--- a/pkgs/development/python-modules/svgpathtools/default.nix
+++ b/pkgs/development/python-modules/svgpathtools/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "svgpathtools";
-  version = "1.7.4";
+  version = "1.8.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mathandy";
     repo = "svgpathtools";
     tag = "v${version}";
-    hash = "sha256-kuVEP4iVwFIiSON1CxbsmExu2ioKEhQXDeEpqULI0Rk=";
+    hash = "sha256-m+sjXVSF1gUksbq09DQvazn3IxadX9YJXqw3kTRO7Ac=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/yoto-api/default.nix b/pkgs/development/python-modules/yoto-api/default.nix
index 3ef15e50cf44..5893f03a6dc2 100644
--- a/pkgs/development/python-modules/yoto-api/default.nix
+++ b/pkgs/development/python-modules/yoto-api/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "yoto-api";
-  version = "4.3.4";
+  version = "4.4.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cdnninja";
     repo = "yoto_api";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cZbcRuw1AI1Xv9awfOJxMdsMuBVIWPUnjEJqhLNzf0s=";
+    hash = "sha256-q5wukMVqtOPKSEi6QOwNf/MpililTY8BebuNM0sSGas=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/os-specific/linux/r8168/default.nix b/pkgs/os-specific/linux/r8168/default.nix
index 3cf1687d86d8..64a87ffe2e43 100644
--- a/pkgs/os-specific/linux/r8168/default.nix
+++ b/pkgs/os-specific/linux/r8168/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   name = "${pname}-${version}-${kernel.version}";
   pname = "r8168";
   # on update please verify that the source matches the realtek version
-  version = "8.056.02";
+  version = "8.057.00";
 
   # This is a mirror. The original website[1] doesn't allow non-interactive
   # downloads, instead emailing you a download link.
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     owner = "mtorromeo";
     repo = "r8168";
     rev = version;
-    sha256 = "sha256-KKfI03RrD+34+KSxwTwDkeB4sGFNY/tU/YbfrfVkTp8=";
+    sha256 = "sha256-KymQThzYKpcgCjKX3ZQ2RAWNga2d0EaWXVQmHzw8hmA=";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/servers/home-assistant/custom-components/llm_intents/package.nix b/pkgs/servers/home-assistant/custom-components/llm_intents/package.nix
index 9b926d4fe912..73596813c4eb 100644
--- a/pkgs/servers/home-assistant/custom-components/llm_intents/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/llm_intents/package.nix
@@ -13,13 +13,13 @@
 buildHomeAssistantComponent (finalAttrs: {
   owner = "skye-harris";
   domain = "llm_intents";
-  version = "1.10.0";
+  version = "1.10.2";
 
   src = fetchFromGitHub {
     inherit (finalAttrs) owner;
     repo = "llm_intents";
     tag = finalAttrs.version;
-    hash = "sha256-RsQEdEhUOyJJBcDtlPYEBzmF4SiXPCF/NSpvg73x5iE=";
+    hash = "sha256-R92E4/89EapxlxQdlKbvuHg9CcVgvNXGpcDr7tvr46E=";
   };
 
   dependencies = [
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/custom-brand-icons/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/custom-brand-icons/package.nix
index 30063bafa6e2..eaf96149368a 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/custom-brand-icons/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/custom-brand-icons/package.nix
@@ -6,16 +6,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "custom-brand-icons";
-  version = "2026.08.5";
+  version = "2026.09.0";
 
   src = fetchFromGitHub {
     owner = "elax46";
     repo = "custom-brand-icons";
     tag = finalAttrs.version;
-    hash = "sha256-rHcZjNpil2YcV2A+Cqz/V22pMfL8eJvlrbQK+Tk9HbE=";
+    hash = "sha256-khX+OqeAN45kFAhMOOq3k4N/FtkS//p+1LaskDL3so8=";
   };
 
-  npmDepsHash = "sha256-+Kn2WQ1MQMKTJ0He/k9NxUpoac9sB61zWRt2wha6c7g=";
+  npmDepsHash = "sha256-SP7tmazutPJWx8Pj9NU30ErNARvsnizONNek8q3DCR4=";
 
   buildPhase = ''
     runHook preBuild
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/hourly-weather/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/hourly-weather/package.nix
index 58300e364888..60294918b54e 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/hourly-weather/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/hourly-weather/package.nix
@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "hourly-weather";
-  version = "7.0.0";
+  version = "7.1.0";
 
   src = fetchFromGitHub {
     owner = "decompil3d";
     repo = "lovelace-hourly-weather";
     rev = version;
-    hash = "sha256-sy21so7D5IbbiEnt1mAKFhxVJDzMWjOIhSOpGRRyMXk=";
+    hash = "sha256-oxC4w8Ieoz2fwqBalPI2jXBlebmEw3+7DFN2ocmVo1s=";
   };
 
-  npmDepsHash = "sha256-ZB/M8SO6Dw523CMKSAisoy5y4r1AouKXLY7Z1lgK4jU=";
+  npmDepsHash = "sha256-m/hXymkNJl6IvGWMLnhVc9i5bDc09+Vzt9kuLY20cpI=";
 
   env.CYPRESS_INSTALL_BINARY = "0";
 
diff --git a/pkgs/servers/mir/default.nix b/pkgs/servers/mir/default.nix
index be0fa6702191..873dca525581 100644
--- a/pkgs/servers/mir/default.nix
+++ b/pkgs/servers/mir/default.nix
@@ -5,9 +5,9 @@ let
 in
 {
   mir = common {
-    version = "2.28.0";
-    hash = "sha256-sSxV20loRXQfGWMI1zAzrAwww00bc/BQqJaFB8whH5E=";
-    cargoHash = "sha256-AHB4OYP2kU47EsutOxYa693pMLgyXuF1p+mLXg2cIGs=";
+    version = "2.29.0";
+    hash = "sha256-jh8Qgr/5Ht0eioLH9ES4M+jZr3RLKHg2YJXX5XzzwEA=";
+    cargoHash = "sha256-VQpLjoKlaoYaSfVVNjxDGJXSlIri4RwETaQJf8faqHQ=";
   };
 
   mir_2_15 = common {
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 8f4caeff32f0..4b81c8526205 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2957,8 +2957,6 @@ with pkgs;
     callPackage ../development/tools/continuous-integration/woodpecker/server.nix
       { };
 
-  testdisk = libsForQt5.callPackage ../tools/system/testdisk { };
-
   testdisk-qt = testdisk.override { enableQt = true; };
 
   tweet-hs = haskell.lib.compose.justStaticExecutables haskellPackages.tweet-hs;