diff --git a/README.md b/README.md
index 62e7df0febab..0b026a107c88 100644
--- a/README.md
+++ b/README.md
@@ -47,9 +47,9 @@ Here are some of the main ones:
 Nixpkgs and NixOS are built and tested by our continuous integration system, [Hydra](https://hydra.nixos.org/).
 
 * [Continuous package builds for unstable/master](https://hydra.nixos.org/jobset/nixos/trunk-combined)
-* [Continuous package builds for the NixOS 25.11 release](https://hydra.nixos.org/jobset/nixos/release-25.11)
+* [Continuous package builds for the NixOS 26.05 release](https://hydra.nixos.org/jobset/nixos/release-26.05)
 * [Tests for unstable/master](https://hydra.nixos.org/job/nixos/trunk-combined/tested#tabs-constituents)
-* [Tests for the NixOS 25.11 release](https://hydra.nixos.org/job/nixos/release-25.11/tested#tabs-constituents)
+* [Tests for the NixOS 26.05 release](https://hydra.nixos.org/job/nixos/release-26.05/tested#tabs-constituents)
 
 Artifacts successfully built with Hydra are published to cache at https://cache.nixos.org/.
 When successful build and test criteria are met, the Nixpkgs expressions are distributed via [Nix channels](https://nix.dev/manual/nix/stable/command-ref/nix-channel.html).
diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
index 70c6cdd2d0d6..7abb090aa47e 100644
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -13,6 +13,7 @@
   - If you use LUKS disk encryption, ensure that `fileSystems."/".device` is set to `"/dev/mapper/<name>"`, where `<name>` matches the name in your `boot.initrd.luks.devices.<name>` definition, to avoid systemd timing out while prompting for a passphrase. If you have a more complex setup, e.g. with LVM on top of LUKS, you may need to add `"x-systemd.device-timeout=infinity"` to `fileSystems."/".options` instead. If you need to disable the timeout before you can boot into the system, pass `systemd.default_device_timeout_sec=infinity` on the kernel command line.
   - The `cryptsetup-askpass` program is not available; use `systemctl default` instead, which will prompt for passphrases as necessary. If you pipe password responses into SSH over stdin, use `ssh -o RequestTTY=force` to ensure `systemctl default` gets a TTY to prompt on.
   - Many kernel parameters have been replaced with native systemd versions; see [](#sec-boot-problems).
+  - `/dev/root` is not available with the systemd stage 1. In the old scripted stage 1, `/dev/root` was a symlink created by the init script from the `root=` kernel command line. With systemd stage 1, this symlink is not provided. If your configuration uses `/dev/root` in `fileSystems`, replace it with a stable device path such as `/dev/disk/by-label/...`, `/dev/disk/by-uuid/...`, or the appropriate `/dev/mapper/...` path.
 
 - The system.nix file has been added as an alternative entry point to configuration.nix (and flake.nix) that allows configuring NixOS without using `nix-channel`.
   This file must evaluate to a NixOS system derivation or an attribute set of such derivations, in which case the attribute to build has to be selected with the `--attr` option of `nixos-rebuild` or `nixos-install`.
diff --git a/nixos/lib/testing/driver.nix b/nixos/lib/testing/driver.nix
index 69392eb052af..f740dd3cbdf6 100644
--- a/nixos/lib/testing/driver.nix
+++ b/nixos/lib/testing/driver.nix
@@ -5,7 +5,12 @@
   ...
 }:
 let
-  inherit (lib) mkOption types literalMD;
+  inherit (lib)
+    mkOption
+    types
+    literalExpression
+    literalMD
+    ;
 
   inherit (config) sshBackdoor;
 
@@ -117,9 +122,10 @@ in
 {
   options = {
     pythonTestDriverPackage = mkOption {
-      description = "Package containing the python NixOS test driver implemetnation";
+      description = "Package containing the python NixOS test driver implementation";
       type = types.package;
       default = hostPkgs.nixos-test-driver;
+      defaultText = literalExpression "hostPkgs.nixos-test-driver";
       readOnly = true;
     };
 
diff --git a/nixos/modules/installer/cd-dvd/iso-image.nix b/nixos/modules/installer/cd-dvd/iso-image.nix
index c42fd64824aa..59e6c3be2d99 100644
--- a/nixos/modules/installer/cd-dvd/iso-image.nix
+++ b/nixos/modules/installer/cd-dvd/iso-image.nix
@@ -787,9 +787,10 @@ in
       options = [ "mode=0755" ];
     };
 
-    # Note that /dev/root is a symlink to the actual root device
-    # specified on the kernel command line, created in the stage 1
-    # init script.
+    # With systemd stage 1, the ISO is identified by its volume label.
+    # With the scripted stage 1, /dev/root is a symlink to the actual
+    # root device specified on the kernel command line, created by the
+    # stage 1 init script.
     "/iso" = lib.mkImageMediaOverride {
       device =
         if config.boot.initrd.systemd.enable then
diff --git a/nixos/modules/services/continuous-integration/gitlab-runner/runner.nix b/nixos/modules/services/continuous-integration/gitlab-runner/runner.nix
index 693229b87d97..cc96d1373f56 100644
--- a/nixos/modules/services/continuous-integration/gitlab-runner/runner.nix
+++ b/nixos/modules/services/continuous-integration/gitlab-runner/runner.nix
@@ -189,11 +189,15 @@ let
                         [ "--docker-image ${service.dockerImage}" ]
                         ++ optional service.dockerDisableCache "--docker-disable-cache"
                         ++ optional service.dockerPrivileged "--docker-privileged"
+                        ++ optional service.dockerServicesPrivileged "--docker-services_privileged true"
                         ++ optional (service.dockerPullPolicy != null) "--docker-pull-policy ${service.dockerPullPolicy}"
                         ++ map (v: "--docker-volumes ${escapeShellArg v}") service.dockerVolumes
                         ++ map (v: "--docker-extra-hosts ${escapeShellArg v}") service.dockerExtraHosts
                         ++ map (v: "--docker-allowed-images ${escapeShellArg v}") service.dockerAllowedImages
                         ++ map (v: "--docker-allowed-services ${escapeShellArg v}") service.dockerAllowedServices
+                        ++ map (
+                          v: "--docker-allowed-privileged-services ${escapeShellArg v}"
+                        ) service.dockerAllowedPrivilegedServices
                       )
                     )
                   )
@@ -521,6 +525,13 @@ in
                 Give extended privileges to container.
               '';
             };
+            dockerServicesPrivileged = mkOption {
+              type = types.bool;
+              default = false;
+              description = ''
+                Give extended privileges to services.
+              '';
+            };
             dockerExtraHosts = mkOption {
               type = types.listOf types.str;
               default = [ ];
@@ -554,6 +565,19 @@ in
                 Whitelist allowed services.
               '';
             };
+            dockerAllowedPrivilegedServices = mkOption {
+              type = types.listOf types.str;
+              default = [ ];
+              example = [
+                "docker.io/library/docker:*-dind-rootless"
+                "docker.io/library/docker:dind-rootless"
+                "docker:*-dind-rootless"
+                "docker:dind-rootless"
+              ];
+              description = ''
+                Whitelist allowed privileged services.
+              '';
+            };
             preGetSourcesScript = mkOption {
               type = types.nullOr (types.either types.str types.path);
               default = null;
diff --git a/nixos/modules/services/misc/klipper.nix b/nixos/modules/services/misc/klipper.nix
index c1502401c8d5..29497c15d22a 100644
--- a/nixos/modules/services/misc/klipper.nix
+++ b/nixos/modules/services/misc/klipper.nix
@@ -40,11 +40,27 @@ let
         '';
         serial = lib.mkOption {
           type = lib.types.nullOr lib.types.path;
-          description = "Path to serial port this printer is connected to. Derived from `service.klipper.settings` by default.";
+          description = "Path to serial port this mcu is connected to. Derived from `service.klipper.settings` by default.";
           defaultText = lib.literalExpression "config.services.klipper.settings.<name>.serial";
           default =
             if lib.hasAttrByPath [ "${mcu}" "serial" ] cfg.settings then cfg.settings."${mcu}".serial else null;
         };
+        canbus_uuid = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
+          description = "CAN bus uuid of this mcu. Derived from `service.klipper.settings` by default.";
+          defaultText = lib.literalExpression "config.services.klipper.settings.<name>.canbus_uuid";
+          default =
+            if lib.hasAttrByPath [ "${mcu}" "canbus_uuid" ] cfg.settings then
+              cfg.settings."${mcu}".canbus_uuid
+            else
+              null;
+        };
+        canbusNetwork = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
+          description = "CAN bus network this mcu is connected to. Defaults to can0 if canbus_uuid is set.";
+          defaultText = lib.literalExpression ''if canbus_uuid != null then "can0" else null'';
+          default = if subcfg.canbus_uuid != null then "can0" else null;
+        };
         configFile = lib.mkOption {
           type = lib.types.path;
           description = "Path to firmware config which is generated using `klipper-genconf`";
@@ -78,6 +94,8 @@ let
               klipper-firmware = subcfg.package;
               mcu = lib.strings.sanitizeDerivationName mcu;
               flashDevice = subcfg.serial;
+              canbusDevice = subcfg.canbus_uuid;
+              canbusNetwork = subcfg.canbusNetwork;
               firmwareConfig = subcfg.configFile;
             }
           else
@@ -224,12 +242,15 @@ in
       }
     ]
     ++ lib.mapAttrsToList (mcu: firmware: {
-      assertion = firmware.enableKlipperFlash -> firmware.serial != null;
+      assertion =
+        firmware.enableKlipperFlash -> (firmware.serial != null || firmware.canbus_uuid != null);
       message = ''
-        Unable to determine the serial connection for services.klipper.firmwares."${mcu}". Please set one of the following:
+        Unable to determine the serial or canbus connection for services.klipper.firmwares."${mcu}". Please set one of the following:
 
           - services.klipper.firmwares."${mcu}".serial
+          - services.klipper.firmwares."${mcu}".canbus_uuid
           - services.klipper.settings."${mcu}".serial
+          - services.klipper.settings."${mcu}".canbus_uuid
       '';
     }) cfg.firmwares;
 
@@ -308,7 +329,6 @@ in
 
     environment.systemPackages =
       let
-        default = a: b: if a != null then a else b;
         genconf = pkgs.klipper-genconf.override {
           klipper = cfg.package;
         };
diff --git a/nixos/modules/services/security/jitterentropy-rngd.nix b/nixos/modules/services/security/jitterentropy-rngd.nix
index ebf9b5ed8f76..71e1c183b2d8 100644
--- a/nixos/modules/services/security/jitterentropy-rngd.nix
+++ b/nixos/modules/services/security/jitterentropy-rngd.nix
@@ -26,6 +26,11 @@ in
       default = false;
       description = "Force SP800-90B mode for entropy reading";
     };
+    memlockLimit = lib.mkOption {
+      type = lib.types.str;
+      default = "2M";
+      description = "Set limit for lockable memory with mlock";
+    };
     verbose = lib.mkOption {
       type = lib.types.bool;
       default = false;
@@ -56,6 +61,12 @@ in
           # use service from package with our configured args
           "${cfg.package}/bin/jitterentropy-rngd ${args}"
         ];
+        LimitMEMLOCK = [
+          # clear old setting from built-in service file
+          ""
+          # use service from package with our configured limit
+          "${cfg.memlockLimit}"
+        ];
       };
     };
 
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index f76f15b9eb41..aaff787d6c4a 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -153,6 +153,7 @@ in
     console-log = runTest ./nixos-test-driver/console-log.nix;
     containers = runTest ./nixos-test-driver/containers.nix;
     skip-typecheck = runTest ./nixos-test-driver/skip-typecheck.nix;
+    options-doc-regression = import ./nixos-test-driver/options-doc-regression.nix { inherit pkgs; };
     driver-timeout =
       pkgs.runCommand "ensure-timeout-induced-failure"
         {
diff --git a/nixos/tests/nixos-test-driver/options-doc-regression.nix b/nixos/tests/nixos-test-driver/options-doc-regression.nix
new file mode 100644
index 000000000000..72ef8abe863d
--- /dev/null
+++ b/nixos/tests/nixos-test-driver/options-doc-regression.nix
@@ -0,0 +1,58 @@
+# Regression test for the `pythonTestDriverPackage` option's default value
+# leaking a `hostPkgs` reference into the NixOS manual build.
+#
+# `pythonTestDriverPackage` (added in d95261b435c4, "nixos-test-driver: Make
+# overridable") uses `default = hostPkgs.nixos-test-driver`. Without a
+# `defaultText`, the options-doc renderer force-evaluates that default when
+# building `options.json` for the NixOS manual. `hostPkgs` is only defined in
+# the VM testing framework, so evaluating its default from a regular NixOS
+# system configuration throws:
+#
+#   error: The option `hostPkgs' was accessed but has no value defined.
+#
+# In practice the bug only surfaces when `pkgs` ends up depending on
+# `config` — e.g. when `nixpkgs.config.packageOverrides` is wrapped in
+# `lib.mkIf`. Otherwise `nixos/doc/manual/default.nix`'s fallback
+# `config.hostPkgs = pkgs` rescue holds. With the dependency, that rescue
+# creates a cycle and the original `hostPkgs` error surfaces.
+#
+# The test builds a minimal system whose `pkgs` depends on `config`, and
+# asserts the toplevel (which includes `nixos-manual-html`) evaluates.
+
+{
+  pkgs,
+  ...
+}:
+let
+  evalConfig = import ../../lib/eval-config.nix;
+
+  nixos = evalConfig {
+    system = null;
+    modules = [
+      (
+        { lib, ... }:
+        {
+          system.stateVersion = "25.05";
+          fileSystems."/" = {
+            device = "/dev/null";
+            fsType = "none";
+          };
+          boot.loader.grub.device = "nodev";
+          nixpkgs.hostPlatform = pkgs.stdenv.hostPlatform.system;
+
+          # This is the trigger: wrapping `packageOverrides` in `mkIf` makes
+          # the `pkgs` module argument depend on `config`, which defeats the
+          # `config.hostPkgs = pkgs` rescue in `nixos/doc/manual/default.nix`.
+          nixpkgs.config.packageOverrides = lib.mkIf false (_: { });
+        }
+      )
+    ];
+  };
+in
+pkgs.runCommand "nixos-test-driver-options-doc-regression"
+  {
+    toplevel = nixos.config.system.build.toplevel.drvPath;
+  }
+  ''
+    echo "$toplevel" > $out
+  ''
diff --git a/pkgs/applications/editors/kakoune/default.nix b/pkgs/applications/editors/kakoune/default.nix
index 925e2f8d398b..39ddff428362 100644
--- a/pkgs/applications/editors/kakoune/default.nix
+++ b/pkgs/applications/editors/kakoune/default.nix
@@ -6,12 +6,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "kakoune-unwrapped";
-  version = "2026.04.12";
+  version = "2026.05.21";
   src = fetchFromGitHub {
     repo = "kakoune";
     owner = "mawww";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-m8q1+TooDREbQD848ciHxeHwMajmlmhAhCqGmdbThIU=";
+    hash = "sha256-4nhhvq871mgbpKYhAAVkIi2+MaO1jlt3d3lIXNGkh6I=";
   };
 
   makeFlags = [
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index caa8e1ba1c2c..2c8ffe8940b0 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -2014,8 +2014,8 @@ let
         mktplcRef = {
           name = "gleam";
           publisher = "gleam";
-          version = "2.12.1";
-          hash = "sha256-zU/iwaJ6ShEHYq7OeM6+RF/RVIx6SmJJKxtebN/tSGI=";
+          version = "2.12.2";
+          hash = "sha256-41HgkDcgyStJtyeE0x1H9rFOZ18imcKF7XQixDOmurE=";
         };
         meta = {
           description = "Support for the Gleam programming language";
diff --git a/pkgs/applications/editors/vscode/update-vscodium.sh b/pkgs/applications/editors/vscode/update-vscodium.sh
index 1f35a851613a..6420ff0ee1f2 100755
--- a/pkgs/applications/editors/vscode/update-vscodium.sh
+++ b/pkgs/applications/editors/vscode/update-vscodium.sh
@@ -5,9 +5,11 @@ set -eou pipefail
 
 latestVersion=$(curl ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} -sL https://api.github.com/repos/VSCodium/vscodium/releases/latest | jq -r ".tag_name")
 currentVersion=$(nix-instantiate --eval -E "with import ./. {}; vscodium.version or (lib.getVersion vscodium)" | tr -d '"')
+latestUpstream=$(curl -sL "https://raw.githubusercontent.com/VSCodium/vscodium/refs/tags/$latestVersion/upstream/stable.json" | jq -r ".tag")
 
 echo "latest  version: $latestVersion"
 echo "current version: $currentVersion"
+echo "latest upstream version: $latestUpstream"
 
 if [[ "$latestVersion" == "$currentVersion" ]]; then
     echo "package is up-to-date"
@@ -25,3 +27,5 @@ for i in \
     hash=$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri $(nix-prefetch-url "https://github.com/VSCodium/vscodium/releases/download/$latestVersion/VSCodium-$2-$latestVersion.$3"))
     update-source-version vscodium $latestVersion $hash --system=$1 --ignore-same-version
 done
+
+update-source-version vscodium $latestUpstream --version-key=vscodeVersion --ignore-same-version --ignore-same-hash
diff --git a/pkgs/applications/editors/vscode/vscodium.nix b/pkgs/applications/editors/vscode/vscodium.nix
index 45a88e87ae6e..0a1f4c0ab2b5 100644
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@@ -44,6 +44,7 @@ buildVscode rec {
   # Please backport all compatible updates to the stable release.
   # This is important for the extension ecosystem.
   version = "1.116.02821";
+  vscodeVersion = "1.116.0";
   pname = "vscodium";
 
   executableName = "codium";
diff --git a/pkgs/applications/science/logic/hol_light/0001-pa_j-accept-camlp5-8.05-for-OCaml-5.4.patch b/pkgs/applications/science/logic/hol_light/0001-pa_j-accept-camlp5-8.05-for-OCaml-5.4.patch
new file mode 100644
index 000000000000..b47e4a62c486
--- /dev/null
+++ b/pkgs/applications/science/logic/hol_light/0001-pa_j-accept-camlp5-8.05-for-OCaml-5.4.patch
@@ -0,0 +1,22 @@
+From: "Matthias J. Kannwischer" <matthias@zerorisc.com>
+Date: Sat, 30 May 2026 16:37:44 +0800
+Subject: pa_j: accept camlp5 8.05 for OCaml 5.4
+
+Signed-off-by: Matthias J. Kannwischer <matthias@zerorisc.com>
+---
+ pa_j/chooser.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/pa_j/chooser.sh b/pa_j/chooser.sh
+index 5ec8d00..de5c8c8 100755
+--- a/pa_j/chooser.sh
++++ b/pa_j/chooser.sh
+@@ -20,7 +20,7 @@ CAMLP5_FULL_VERSION=`camlp5 -v 2>&1 | cut -f3 -d' ' | cut -f1-3 -d'.' | cut -f1
+ 
+ if test ${OCAML_BINARY_VERSION} = "3.0"
+ then echo "pa_j_${OCAML_VERSION}.ml"
+-elif test ${CAMLP5_FULL_VERSION} = "8.04.00"
++elif test ${CAMLP5_BINARY_VERSION} = "8.04" -o ${CAMLP5_BINARY_VERSION} = "8.05"
+ then
+   if test ${OCAML_BINARY_VERSION} = "5.4"
+   then echo "pa_j_5.4_8.04.00.ml"
diff --git a/pkgs/applications/science/logic/hol_light/0002-link-findlib-into-ocaml-hol.patch b/pkgs/applications/science/logic/hol_light/0002-link-findlib-into-ocaml-hol.patch
new file mode 100644
index 000000000000..688f2e0506fe
--- /dev/null
+++ b/pkgs/applications/science/logic/hol_light/0002-link-findlib-into-ocaml-hol.patch
@@ -0,0 +1,12 @@
+diff --git a/Makefile b/Makefile
+--- a/Makefile
++++ b/Makefile
+@@ -128,7 +128,7 @@
+ hol.sh: pa_j.cmo ${HOLSRC} bignum.cmo hol_loader.cmo update_database.ml
+ 	if [ `uname` = "Linux" ] || [ `uname` = "Darwin" ] ; then \
+ 		if [ ${OCAML_UNARY_VERSION} = "5" ] || [ ${OCAML_VERSION} = "4.14" ] ; then \
+-			ocamlfind ocamlmktop -package zarith -o ocaml-hol zarith.cma bignum.cmo hol_loader.cmo ; \
++			ocamlfind ocamlmktop -package zarith,findlib -o ocaml-hol zarith.cma bignum.cmo hol_loader.cmo ; \
+ 			sed "s^__DIR__^`pwd`^g; s^__USE_MODULE__^$(HOLLIGHT_USE_MODULE)^g" hol_4.14.sh > hol.sh ; \
+ 		else \
+ 			ocamlmktop -o ocaml-hol nums.cma bignum.cmo hol_loader.cmo ; \
diff --git a/pkgs/applications/science/logic/hol_light/0004-Fix-compilation-with-camlp5-7.11.patch b/pkgs/applications/science/logic/hol_light/0004-Fix-compilation-with-camlp5-7.11.patch
deleted file mode 100644
index 2fc2b1544c44..000000000000
--- a/pkgs/applications/science/logic/hol_light/0004-Fix-compilation-with-camlp5-7.11.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From: Stephane Glondu <steph@glondu.net>
-Date: Wed, 12 Feb 2020 05:42:32 +0100
-Subject: Fix compilation with camlp5 7.11
-
----
- pa_j_4.xx_7.xx.ml | 17 +++++++++++------
- 1 file changed, 11 insertions(+), 6 deletions(-)
-
-diff --git a/pa_j_4.xx_7.xx.ml b/pa_j_4.xx_7.xx.ml
-index 4f7ed60..e834058 100755
---- a/pa_j/pa_j_4.xx_7.xx.ml
-+++ b/pa_j/pa_j_4.xx_7.xx.ml
-@@ -410,9 +410,10 @@ and reloc_module_type floc sh =
-     | MtApp loc x1 x2 →
-         let loc = floc loc in
-         MtApp loc (self x1) (self x2)
--    | MtFun loc x1 x2 x3 →
-+    | MtFun loc x x3 →
-         let loc = floc loc in
--        MtFun loc x1 (self x2) (self x3)
-+        let x = vala_map (option_map (fun (x1, x2) -> (x1, self x2))) x in
-+        MtFun loc x (self x3)
-     | MtLid loc x1 →
-         let loc = floc loc in
-         MtLid loc x1
-@@ -507,9 +508,10 @@ and reloc_module_expr floc sh =
-     | MeApp loc x1 x2 →
-         let loc = floc loc in
-         MeApp loc (self x1) (self x2)
--    | MeFun loc x1 x2 x3 →
-+    | MeFun loc x x3 →
-         let loc = floc loc in
--        MeFun loc x1 (reloc_module_type floc sh x2) (self x3)
-+        let x = vala_map (option_map (fun (x1, x2) -> (x1, reloc_module_type floc sh x2))) x in
-+        MeFun loc x (self x3)
-     | MeStr loc x1 →
-         let loc = floc loc in
-         MeStr loc (vala_map (List.map (reloc_str_item floc sh)) x1)
-@@ -2007,7 +2009,7 @@ EXTEND
-       | -> <:vala< [] >> ] ]
-   ;
-   mod_binding:
--    [ [ i = V UIDENT; me = mod_fun_binding -> (i, me) ] ]
-+    [ [ i = V uidopt "uidopt"; me = mod_fun_binding -> (i, me) ] ]
-   ;
-   mod_fun_binding:
-     [ RIGHTA
-@@ -2070,7 +2072,7 @@ EXTEND
-           <:sig_item< value $lid:i$ : $t$ >> ] ]
-   ;
-   mod_decl_binding:
--    [ [ i = V UIDENT; mt = module_declaration -> (i, mt) ] ]
-+    [ [ i = V uidopt "uidopt"; mt = module_declaration -> (i, mt) ] ]
-   ;
-   module_declaration:
-     [ RIGHTA
-@@ -2092,6 +2094,9 @@ EXTEND
-       | "module"; i = V mod_ident ""; ":="; me = module_expr ->
-           <:with_constr< module $_:i$ := $me$ >> ] ]
-   ;
-+  uidopt:
-+    [ [ m = V UIDENT -> Some m ] ]
-+  ;
-   (* Core expressions *)
-   expr:
-     [ "top" RIGHTA
diff --git a/pkgs/applications/science/logic/hol_light/default.nix b/pkgs/applications/science/logic/hol_light/default.nix
index c0b7ebbc0377..5c10c8e1a184 100644
--- a/pkgs/applications/science/logic/hol_light/default.nix
+++ b/pkgs/applications/science/logic/hol_light/default.nix
@@ -1,61 +1,51 @@
 {
   lib,
   stdenv,
-  runtimeShell,
   fetchFromGitHub,
+  makeBinaryWrapper,
+  writeText,
   ocaml,
   findlib,
-  num,
   zarith,
   camlp5,
   camlp-streams,
+  fmt,
   pcre2,
+  ledit,
   bash,
 }:
 
 let
-  use_zarith = lib.versionAtLeast ocaml.version "4.14";
-  load_num =
-    if use_zarith then
-      ''
-        -I ${zarith}/lib/ocaml/${ocaml.version}/site-lib/zarith \
-        -I ${zarith}/lib/ocaml/${ocaml.version}/site-lib/stublibs \
-        -I ${pcre2}/lib/ocaml/${ocaml.version}/site-lib/stublibs \
-      ''
-    else
-      lib.optionalString (num != null) ''
-        -I ${num}/lib/ocaml/${ocaml.version}/site-lib/num \
-        -I ${num}/lib/ocaml/${ocaml.version}/site-lib/top-num \
-        -I ${num}/lib/ocaml/${ocaml.version}/site-lib/stublibs
-      '';
-
-  start_script = ''
-    #!${runtimeShell}
-    cd $out/lib/hol_light
-    export OCAMLPATH="''${OCAMLPATH-}''${OCAMLPATH:+:}${camlp5}/lib/ocaml/${ocaml.version}/site-lib/"
-    exec ${ocaml}/bin/ocaml \
-      -I \`${camlp5}/bin/camlp5 -where\` \
-      ${load_num} \
-      -I ${findlib}/lib/ocaml/${ocaml.version}/site-lib/ \
-      -I ${camlp-streams}/lib/ocaml/${ocaml.version}/site-lib/camlp-streams camlp_streams.cma \
-      -init make.ml
-  '';
+  ocamlPath = lib.makeSearchPath "/lib/ocaml/${ocaml.version}/site-lib" [
+    camlp5
+    camlp-streams
+    fmt
+    pcre2
+    zarith
+  ];
+  stublibsPath = lib.makeSearchPath "/lib/ocaml/${ocaml.version}/site-lib/stublibs" [
+    zarith
+    pcre2
+  ];
 in
 
 stdenv.mkDerivation {
   pname = "hol_light";
-  version = "unstable-2024-07-07";
+  version = "0-unstable-2026-05-19";
 
   src = fetchFromGitHub {
     owner = "jrh13";
     repo = "hol-light";
-    rev = "16b184e30e7e3fe9add7d1ee93242323ed2e1726";
-    hash = "sha256-V0OtsmX5pa+CH3ZXmNG3juXwXZ5+A0k13eMCAfaRziQ=";
+    rev = "9b510bc76da4cecf6e509be44d327c9236ec273f";
+    hash = "sha256-QaTDrGHpHvEde2AK/SD7eM+bAC9vN5o+dQqW1oau1Yo=";
   };
 
-  patches = [ ./0004-Fix-compilation-with-camlp5-7.11.patch ];
-
-  buildInputs = [ bash ];
+  patches = [
+    # Accept camlp5 8.05 in the pa_j chooser; submitted upstream.
+    ./0001-pa_j-accept-camlp5-8.05-for-OCaml-5.4.patch
+    # Link findlib into ocaml-hol so `#use "topfind"` works in the sandbox.
+    ./0002-link-findlib-into-ocaml-hol.patch
+  ];
 
   strictDeps = true;
 
@@ -63,28 +53,77 @@ stdenv.mkDerivation {
     ocaml
     findlib
     camlp5
+    makeBinaryWrapper
+  ];
+  buildInputs = [
+    bash
+    ocaml
+    findlib
+    camlp5
+    ledit
   ];
   propagatedBuildInputs = [
     camlp-streams
+    fmt
     pcre2
-    (if use_zarith then zarith else num)
+    zarith
   ];
 
+  setupHook = writeText "hol-light-setup-hook.sh" ''
+    addHolLight () {
+      if test -d "''$1/lib/hol_light"; then
+        export HOLLIGHT_DIR="''$1/lib/hol_light"
+      fi
+    }
+    addEnvHooks "$targetOffset" addHolLight
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+    patchShebangs .
+    HOLLIGHT_USE_MODULE=1 make hol.sh
+    HOLLIGHT_USE_MODULE=1 make
+    runHook postBuild
+  '';
+
   installPhase = ''
-    mkdir -p "$out/lib/hol_light" "$out/bin"
-    cp -a  . $out/lib/hol_light
-    echo "${start_script}" > "$out/bin/hol_light"
-    chmod a+x "$out/bin/hol_light"
+    runHook preInstall
+    mkdir -p "$out/lib/hol_light"
+    cp -a . "$out/lib/hol_light"
+    # The Makefile bakes the build directory into hol.sh; regenerate it
+    # pointing at the install location.
+    sed "s^__DIR__^$out/lib/hol_light^g; s^__USE_MODULE__^1^g" hol_4.14.sh \
+      > "$out/lib/hol_light/hol.sh"
+    chmod +x "$out/lib/hol_light/hol.sh"
+    # Add the findlib site-lib so the toplevel can `#use "topfind"`.
+    substituteInPlace "$out/lib/hol_light/hol.sh" \
+      --replace-fail '-init ''${HOL_ML_PATH} -I ''${HOLLIGHT_DIR}' \
+        '-init ''${HOL_ML_PATH} -I ''${HOLLIGHT_DIR} -I ${findlib}/lib/ocaml/${ocaml.version}/site-lib'
+    makeWrapper "$out/lib/hol_light/hol.sh" "$out/bin/hol_light" \
+      --prefix PATH : ${
+        lib.makeBinPath [
+          ocaml
+          findlib
+          camlp5
+          ledit
+        ]
+      } \
+      --set OCAMLPATH "${ocamlPath}" \
+      --prefix CAML_LD_LIBRARY_PATH : "${stublibsPath}"
+    ln -s hol_light "$out/bin/hol.sh"
+    runHook postInstall
   '';
 
   meta = {
     description = "Interactive theorem prover based on Higher-Order Logic";
     homepage = "http://www.cl.cam.ac.uk/~jrh13/hol-light/";
+    mainProgram = "hol_light";
     license = lib.licenses.bsd2;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [
       thoughtpolice
       vbgl
+      mkannwischer
     ];
   };
 }
diff --git a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hypr-dynamic-cursors.nix b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hypr-dynamic-cursors.nix
index a73a1bc0c39e..08871d6f3056 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hypr-dynamic-cursors.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hypr-dynamic-cursors.nix
@@ -7,13 +7,13 @@
 
 mkHyprlandPlugin {
   pluginName = "hypr-dynamic-cursors";
-  version = "0-unstable-2026-03-09";
+  version = "0-unstable-2026-05-29";
 
   src = fetchFromGitHub {
     owner = "VirtCode";
     repo = "hypr-dynamic-cursors";
-    rev = "57e14edd0ae265b01828e466e287e96eb1e84dd3";
-    hash = "sha256-hHMMP4h9VvacDLb8lkI6gZcUnhDbEt+GP2RLLL2s2C4=";
+    rev = "1de08deb7d495124ce88b342fecc7e7542d0672f";
+    hash = "sha256-Ck9dFUfj/zDSab16CzsGWEMNeSNDhhDOB0JWeHzVvjk=";
   };
 
   dontUseCmakeConfigure = true;
diff --git a/pkgs/by-name/ag/agkozak-zsh-prompt/package.nix b/pkgs/by-name/ag/agkozak-zsh-prompt/package.nix
index f593f49ed78d..af3e98c50e15 100644
--- a/pkgs/by-name/ag/agkozak-zsh-prompt/package.nix
+++ b/pkgs/by-name/ag/agkozak-zsh-prompt/package.nix
@@ -6,13 +6,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "agkozak-zsh-prompt";
-  version = "3.11.4";
+  version = "3.11.5";
 
   src = fetchFromGitHub {
     owner = "agkozak";
     repo = "agkozak-zsh-prompt";
     tag = "v${version}";
-    sha256 = "sha256-FC9LIZaS6fV20qq6cJC/xQvfsM3DHXatVleH7yBgoNg=";
+    sha256 = "sha256-C9lyOm2+RVLOUSO5Vz013uTobnN+SBE1Jm8GuJZ7T7U=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/ap/apko/package.nix b/pkgs/by-name/ap/apko/package.nix
index e29031abb8b5..0940ab2ea90a 100644
--- a/pkgs/by-name/ap/apko/package.nix
+++ b/pkgs/by-name/ap/apko/package.nix
@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "apko";
-  version = "1.2.13";
+  version = "1.2.14";
 
   src = fetchFromGitHub {
     owner = "chainguard-dev";
     repo = "apko";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-T074IzGgs0mDX4u5L96Xa0bGwpCLVYu3hNrN/7JzF1U=";
+    hash = "sha256-+yvQK6mrDT9MOeJsEJp4maycz6jpyAnGkc4QddaCbDo=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -29,7 +29,7 @@ buildGoModule (finalAttrs: {
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  vendorHash = "sha256-Sq++amIZ5jdi/D499A8JRkr7yYPHkMXjU2yHOE8p3h4=";
+  vendorHash = "sha256-ITxeRtPJmLEqD8BundfWdQO10XGHaElL2vpYFSM24pQ=";
 
   excludedPackages = [
     "internal/gen-jsonschema"
diff --git a/pkgs/by-name/au/audacious-bare/package.nix b/pkgs/by-name/au/audacious-bare/package.nix
index 26db7531e2fe..d2584c1af00e 100644
--- a/pkgs/by-name/au/audacious-bare/package.nix
+++ b/pkgs/by-name/au/audacious-bare/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "audacious";
-  version = "4.5.1";
+  version = "4.6";
 
   src = fetchFromGitHub {
     owner = "audacious-media-player";
     repo = "audacious";
     rev = "${pname}-${version}";
-    hash = "sha256-1+RyGMUrotFdNCNpxzKpXGafKn9kNtzEyRVefUmJexU=";
+    hash = "sha256-TKzsAroCbeTI2dJdAWJYI/0ocroc1L8CC8ciepfEVMc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ci/circumflex/package.nix b/pkgs/by-name/ci/circumflex/package.nix
index 91da5cabb9bb..13b89884cd2e 100644
--- a/pkgs/by-name/ci/circumflex/package.nix
+++ b/pkgs/by-name/ci/circumflex/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "circumflex";
-  version = "4.1.1";
+  version = "4.3";
 
   src = fetchFromGitHub {
     owner = "bensadeh";
     repo = "circumflex";
     tag = finalAttrs.version;
-    hash = "sha256-2eCxk5FynwKt0T9cseesre+dumy5K5uZZAt++R+aTxw=";
+    hash = "sha256-VyUJ7qiaodLTdfGyh3/tLGfNVZCAxImxOuz4ztaaqtg=";
   };
 
-  vendorHash = "sha256-in6yPiT/SqRaw6hFF2gCmBwGcJ315Qej3HuM7TF5MaE=";
+  vendorHash = "sha256-4YL0N8wA8igveYfeL4uZDY5YD1InW0iD3WWq1E/vIJs=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/by-name/cm/cmake/package.nix b/pkgs/by-name/cm/cmake/package.nix
index af7a9c13d064..dc16992a27aa 100644
--- a/pkgs/by-name/cm/cmake/package.nix
+++ b/pkgs/by-name/cm/cmake/package.nix
@@ -124,6 +124,10 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optional cursesUI ncurses
     ++ lib.optional qt5UI qtbase;
 
+  # bootstrap is not autoconf and rejects --enable-static/--disable-shared
+  # FIXME: rebuild avoidance, drop optionalDrvAttr in staging
+  dontAddStaticConfigureFlags = lib.optionalDrvAttr stdenv.hostPlatform.isStatic true;
+
   preConfigure = ''
     substituteInPlace Modules/Platform/UnixPaths.cmake \
       --subst-var-by libc_bin ${lib.getBin stdenv.cc.libc} \
@@ -131,6 +135,10 @@ stdenv.mkDerivation (finalAttrs: {
       --subst-var-by libc_lib ${lib.getLib stdenv.cc.libc}
     # CC_FOR_BUILD and CXX_FOR_BUILD are used to bootstrap cmake
     configureFlags="--parallel=''${NIX_BUILD_CORES:-1} CC=$CC_FOR_BUILD CXX=$CXX_FOR_BUILD $configureFlags $cmakeFlags"
+  ''
+  + lib.optionalString (stdenv.hostPlatform.isStatic && useSharedLibraries) ''
+    # FindLibArchive ignores libarchive.pc's Libs.private
+    export NIX_LDFLAGS+=" $($PKG_CONFIG --static --libs-only-l libarchive)"
   '';
 
   # The configuration script is not autoconf-based, although being similar;
@@ -175,6 +183,11 @@ stdenv.mkDerivation (finalAttrs: {
 
     (lib.cmakeBool "CMAKE_USE_OPENSSL" useOpenSSL)
     (lib.cmakeBool "BUILD_CursesDialog" cursesUI)
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isStatic [
+    # kwsys's DynamicLoader test is inimical to -static
+    # doCheck is off anyway so just skip building tests
+    (lib.cmakeBool "BUILD_TESTING" false)
   ];
 
   # make install attempts to use the just-built cmake
diff --git a/pkgs/by-name/co/collabora-desktop/package.nix b/pkgs/by-name/co/collabora-desktop/package.nix
index 86fc4de7f3cb..89ba894a44aa 100644
--- a/pkgs/by-name/co/collabora-desktop/package.nix
+++ b/pkgs/by-name/co/collabora-desktop/package.nix
@@ -13,7 +13,6 @@
   pam,
   pango,
   pixman,
-  pkgs,
   pkg-config,
   poco,
   python3,
@@ -47,6 +46,10 @@ stdenv.mkDerivation (finalAttrs: {
 
     patchShebangs browser/util/*.py coolwsd-systemplate-setup scripts/*
     substituteInPlace configure.ac --replace-fail '/usr/bin/env python3' python3
+
+    # workaround for QtWebEngine crash when loading 'cell' cursor
+    substituteInPlace browser/css/spreadsheet.css \
+      --replace-warn "cursor: cell" "cursor: crosshair"
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/cu/cubeb/package.nix b/pkgs/by-name/cu/cubeb/package.nix
index ab3c587a7e77..6aee4f3613c5 100644
--- a/pkgs/by-name/cu/cubeb/package.nix
+++ b/pkgs/by-name/cu/cubeb/package.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cubeb";
-  version = "0-unstable-2026-05-06";
+  version = "0-unstable-2026-05-27";
 
   src = fetchFromGitHub {
     owner = "mozilla";
     repo = "cubeb";
-    rev = "6ad18e2b523a2c721ee1ed8ad0940521a19f5f84";
-    hash = "sha256-Q+UepE/mNIKBvltLKr1RGmuP7ulVd5sxHwaVCeb0BzM=";
+    rev = "7e6ad0ce1bf7b9deb9d360ff23bdfd22118cc536";
+    hash = "sha256-ZGyf/z+tpdwx5VcLkTVF59E86rYPWe/RbNj/kptN++0=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/dd/ddns-go/package.nix b/pkgs/by-name/dd/ddns-go/package.nix
index ac1bfc9cd74c..7b6b9de3d7cf 100644
--- a/pkgs/by-name/dd/ddns-go/package.nix
+++ b/pkgs/by-name/dd/ddns-go/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "ddns-go";
-  version = "6.17.0";
+  version = "6.17.1";
 
   src = fetchFromGitHub {
     owner = "jeessy2";
     repo = "ddns-go";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-si1+L523iXBhH/Jo7zm0M/zT5d/hrZvDTYS4WMaFdSQ=";
+    hash = "sha256-F5QErTVE4wjNMyJHSQN3MFTiTLdgy5ADf+UUZ8acF14=";
   };
 
-  vendorHash = "sha256-MbITJ2MxyTNE6LS9rQZ10IVgQuXpmbPf5HQgoy2OuOc=";
+  vendorHash = "sha256-3jIWxjjPeEj02OQkXLvcqLJH+PjuEtL2zhfUAOtQJio=";
 
   ldflags = [
     "-X main.version=${finalAttrs.version}"
diff --git a/pkgs/by-name/dn/dnslookup/package.nix b/pkgs/by-name/dn/dnslookup/package.nix
index af7e905e13fe..a0bf7ed7cf11 100644
--- a/pkgs/by-name/dn/dnslookup/package.nix
+++ b/pkgs/by-name/dn/dnslookup/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "dnslookup";
-  version = "1.11.2";
+  version = "1.12.0";
 
   src = fetchFromGitHub {
     owner = "ameshkov";
     repo = "dnslookup";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jN1JBqCZPoLbdododPRRRGfZugyesWb1Xt+np/xXK6U=";
+    hash = "sha256-RxplKQ21mskowAoMpgl4OVRyO7y89XS9CDcFd0RZVIg=";
   };
 
-  vendorHash = "sha256-FFVxqnFwYsoPt2wCmMpxxe+YkSg6ry71XbFd463uXn4=";
+  vendorHash = "sha256-DSicC/NbLOku7kYw1Ketur5qGk3Nh66Kj3NZoP7X524=";
 
   meta = {
     changelog = "https://github.com/ameshkov/dnslookup/releases/tag/v${finalAttrs.version}";
diff --git a/pkgs/by-name/do/dosage/package.nix b/pkgs/by-name/do/dosage/package.nix
index ba8df5ec66a9..ffeebba41ab5 100644
--- a/pkgs/by-name/do/dosage/package.nix
+++ b/pkgs/by-name/do/dosage/package.nix
@@ -7,11 +7,11 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "dosage";
-  version = "3.2";
+  version = "3.3";
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    sha256 = "sha256-MHikoqbsQ2WkDi+S+1fhHuJy/cwzHu6PVy/JfALNJUI=";
+    sha256 = "sha256-hkk8JCR1cWrYJFOlSfZkGtSHvPQcQ9O+0MMLfq9x0us=";
   };
 
   pyproject = true;
diff --git a/pkgs/by-name/fa/fabric-ai/package.nix b/pkgs/by-name/fa/fabric-ai/package.nix
index 0bc356a8ddfc..fa60fce1b1a2 100644
--- a/pkgs/by-name/fa/fabric-ai/package.nix
+++ b/pkgs/by-name/fa/fabric-ai/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "fabric-ai";
-  version = "1.4.452";
+  version = "1.4.453";
 
   src = fetchFromGitHub {
     owner = "danielmiessler";
     repo = "fabric";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2O/g0DC0ptxzEzXA1NYZWfdnUeIVFuLWNyw1uct2XyM=";
+    hash = "sha256-+q68ee4oCSJ7zR2XFaJChHkJoalUUZwebWVV823eAmc=";
   };
 
-  vendorHash = "sha256-oSHrn2Oad6XuIFjrqeC4NGC/rasCu+49xADY15YNSbc=";
+  vendorHash = "sha256-XJ6JlvEY1L7/w+e8QJEXcB9VzueNEFg1GPn75+zQaYA=";
 
   # Fabric introduced plugin tests that fail in the nix build sandbox.
   doCheck = false;
diff --git a/pkgs/by-name/fa/fastcov/package.nix b/pkgs/by-name/fa/fastcov/package.nix
index eaa3a4fee591..4c784247db8b 100644
--- a/pkgs/by-name/fa/fastcov/package.nix
+++ b/pkgs/by-name/fa/fastcov/package.nix
@@ -9,14 +9,14 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "fastcov";
-  version = "1.16";
+  version = "1.17";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "RPGillespie6";
     repo = "fastcov";
     tag = "v${version}";
-    hash = "sha256-frpX0b8jqKfsxQrts5XkOkjgKlmi7p1r/+Mu7Dl4mm8=";
+    hash = "sha256-2WrgLNC3FU4b8DdcoK3rk0+JBiv60JmlBktg0tMx6CM=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/ge/geeqie/package.nix b/pkgs/by-name/ge/geeqie/package.nix
index 282b44140401..c48dfab6f595 100644
--- a/pkgs/by-name/ge/geeqie/package.nix
+++ b/pkgs/by-name/ge/geeqie/package.nix
@@ -33,30 +33,23 @@
   zenity,
   libnotify,
   wrapGAppsHook3,
-  fetchpatch,
   doxygen,
   nix-update-script,
+  openexr,
+  cfitsio,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "geeqie";
-  version = "2.5";
+  version = "2.7";
 
   src = fetchFromGitHub {
     owner = "BestImageViewer";
     repo = "geeqie";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-k2FXj2ZKZzB5XpCcWzEv7Q1ozATfU3221XKcOFdWOGU=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-yCY9ltm21cD3NnC2hDZ3O+2UZYgop4TLHC0djPF3Lo0=";
   };
 
-  patches = [
-    # Remove changelog from menu
-    (fetchpatch {
-      url = "https://salsa.debian.org/debian/geeqie/-/raw/debian/master/debian/patches/Remove-changelog-from-menu-item.patch";
-      hash = "sha256-0awKKTLg/gUZhmwluVbHCOqssog9SneFOaUtG89q0go=";
-    })
-  ];
-
   postPatch = ''
     patchShebangs .
   '';
@@ -91,6 +84,8 @@ stdenv.mkDerivation (finalAttrs: {
     gspell
     libtiff
     libwebp
+    openexr
+    cfitsio
   ];
 
   postInstall = ''
@@ -179,6 +174,7 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.gpl2Plus;
 
     homepage = "https://www.geeqie.org/";
+    changelog = "https://github.com/BestImageViewer/geeqie/blob/${finalAttrs.src.tag}/NEWS";
 
     maintainers = with lib.maintainers; [
       pSub
diff --git a/pkgs/by-name/gi/git-pkgs/package.nix b/pkgs/by-name/gi/git-pkgs/package.nix
index c4f45e920904..fed7f36bd933 100644
--- a/pkgs/by-name/gi/git-pkgs/package.nix
+++ b/pkgs/by-name/gi/git-pkgs/package.nix
@@ -7,16 +7,16 @@
 }:
 buildGoModule rec {
   pname = "git-pkgs";
-  version = "0.16.1";
+  version = "0.16.2";
 
   src = fetchFromGitHub {
     owner = "git-pkgs";
     repo = "git-pkgs";
     tag = "v${version}";
-    hash = "sha256-biKDEvhV0CLoZxUgby7EH4kv0WZlQKHzPnjz5KarXK0=";
+    hash = "sha256-6AhA4CG4q6ujM3JSz5aUXvVG7vC5mL8DGiF4dO2kU3k=";
   };
 
-  vendorHash = "sha256-mBSoIsclotqBTBivHdpC33X2lBBIX/LlLJxKe03mHqo=";
+  vendorHash = "sha256-uram6wb0nTxVDy8PQa3R4os620S/XuDcTZkMhwNhd3A=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/gl/glaze/package.nix b/pkgs/by-name/gl/glaze/package.nix
index ee8a4aba63ba..5bdb15fb4c67 100644
--- a/pkgs/by-name/gl/glaze/package.nix
+++ b/pkgs/by-name/gl/glaze/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "glaze";
-  version = "7.7.0";
+  version = "7.7.1";
 
   src = fetchFromGitHub {
     owner = "stephenberry";
     repo = "glaze";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CxuNDOjdF6zYs0zRptqNJgfQondUSaN1AZanksG4U8s=";
+    hash = "sha256-CfN2mv1s+yv2HvRLBZhHUHBNfsgRzTT7USNYkkahh8M=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/gm/gmobile/package.nix b/pkgs/by-name/gm/gmobile/package.nix
index 208392283b73..85fd4cf3e380 100644
--- a/pkgs/by-name/gm/gmobile/package.nix
+++ b/pkgs/by-name/gm/gmobile/package.nix
@@ -13,11 +13,12 @@
   udevCheckHook,
   vala,
   nix-update-script,
+  fetchpatch2,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gmobile";
-  version = "0.7.0";
+  version = "0.7.1";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
@@ -25,9 +26,17 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "Phosh";
     repo = "gmobile";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zAF/9FQwpb6xiKRqfhWI/3lBwiDOEDu+TNkIJpEdbYY=";
+    hash = "sha256-RXkH+48WzACgNcIROlSTSO4l/ujWVHJDG+Xtk4k7Rdw=";
   };
 
+  patches = [
+    (fetchpatch2 {
+      name = "dont-set-libexecdir.patch";
+      url = "https://gitlab.gnome.org/World/Phosh/gmobile/-/commit/b085e13898edddf31b6da8c8fc4119bb2cb59c38.patch";
+      hash = "sha256-S3S1FORPC8czFx0ivLVOUhamStaJsKd6oXnh1jbdr3Y=";
+    })
+  ];
+
   nativeBuildInputs = [
     gtk-doc
     meson
diff --git a/pkgs/by-name/gr/grpc-health-probe/package.nix b/pkgs/by-name/gr/grpc-health-probe/package.nix
index 5acbf091b81a..f798e318a865 100644
--- a/pkgs/by-name/gr/grpc-health-probe/package.nix
+++ b/pkgs/by-name/gr/grpc-health-probe/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "grpc-health-probe";
-  version = "0.4.50";
+  version = "0.4.51";
 
   src = fetchFromGitHub {
     owner = "grpc-ecosystem";
     repo = "grpc-health-probe";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-gNQJeAeQTNhvtA7hP+9nS6MGnhwoayNub2o5S/oKWHU=";
+    hash = "sha256-F8vwgygsJNcQqDcw4QQ0BmAEH1t83Ri9NBsXj7bcpqU=";
   };
 
   tags = [
@@ -25,7 +25,7 @@ buildGoModule (finalAttrs: {
     "-X main.versionTag=${finalAttrs.version}"
   ];
 
-  vendorHash = "sha256-72nRpe4FIclZDpYw56UewFJRU2NBbuQ0M8HKYwqJU34=";
+  vendorHash = "sha256-KZNoXWay/fegj6q075s40VvqtbA0ADrPKJ3VkQ/6os0=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/by-name/gs/gsoap/package.nix b/pkgs/by-name/gs/gsoap/package.nix
index af156cdb3726..04aa2185bb39 100644
--- a/pkgs/by-name/gs/gsoap/package.nix
+++ b/pkgs/by-name/gs/gsoap/package.nix
@@ -13,17 +13,16 @@
 }:
 
 let
-  majorVersion = "2.8";
   isCross = stdenv.hostPlatform != stdenv.buildPlatform;
 
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gsoap";
-  version = "${majorVersion}.108";
+  version = "2.8.142";
 
   src = fetchurl {
-    url = "mirror://sourceforge/project/gsoap2/gsoap-${majorVersion}/gsoap_${finalAttrs.version}.zip";
-    sha256 = "0x58bwlclk7frv03kg8bp0pm7zl784samvbzskrnr7dl5v866nvl";
+    url = "mirror://sourceforge/gsoap2/gsoap_${finalAttrs.version}.zip";
+    hash = "sha256-bXGWvWWR7Cl3R0xoHjUbSjPrXC1kyeLmcnsATzMLN1I=";
   };
 
   buildInputs = [
@@ -40,11 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
   # Parallel building doesn't work as of 2.8.49
   enableParallelBuilding = false;
 
-  # Future versions of automake require subdir-objects if the source is structured this way
-  # As of 2.8.49 (maybe earlier) this is needed to silence warnings
   prePatch = ''
-    substituteInPlace configure.ac \
-      --replace 'AM_INIT_AUTOMAKE([foreign])' 'AM_INIT_AUTOMAKE([foreign subdir-objects])'
     ${lib.optionalString isCross ''
       substituteInPlace gsoap/wsdl/Makefile.am \
         --replace-fail 'SOAP=$(top_builddir)/gsoap/src/soapcpp2$(EXEEXT)' 'SOAP=${lib.getExe' buildPackages.gsoap "soapcpp2"}'
diff --git a/pkgs/by-name/gt/gtk-sharp-3_0/builder.sh b/pkgs/by-name/gt/gtk-sharp-3_0/builder.sh
deleted file mode 100644
index 946b65d98a58..000000000000
--- a/pkgs/by-name/gt/gtk-sharp-3_0/builder.sh
+++ /dev/null
@@ -1,9 +0,0 @@
-genericBuild
-
-# !!! hack
-export ALL_INPUTS="$out $pkgs"
-
-find $out -name "*.dll.config" | while read configFile; do
-    echo "modifying config file $configFile"
-    $monoDLLFixer "$configFile"
-done
diff --git a/pkgs/by-name/gt/gtk-sharp-3_0/package.nix b/pkgs/by-name/gt/gtk-sharp-3_0/package.nix
index 67d42d79625a..cfbd06065ff4 100644
--- a/pkgs/by-name/gt/gtk-sharp-3_0/package.nix
+++ b/pkgs/by-name/gt/gtk-sharp-3_0/package.nix
@@ -1,63 +1,62 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchFromGitHub,
   fetchpatch,
+  meson,
+  ninja,
   pkg-config,
   mono,
   glib,
   pango,
   gtk3,
-  libxml2,
-  monoDLLFixer,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gtk-sharp";
-  version = "2.99.3";
+  version = "3.22.2";
 
-  builder = ./builder.sh;
-  src = fetchurl {
-    url = "mirror://gnome/sources/gtk-sharp/${lib.versions.majorMinor finalAttrs.version}/gtk-sharp-${finalAttrs.version}.tar.xz";
-    sha256 = "18n3l9zcldyvn4lwi8izd62307mkhz873039nl6awrv285qzah34";
+  src = fetchFromGitHub {
+    owner = "GLibSharp";
+    repo = "GtkSharp";
+    tag = finalAttrs.version;
+    hash = "sha256-I15XpW2NotOK1gExCNgJOHd6QVGW9mGkWfeHfJGdLwI=";
   };
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  mesonFlags = [
+    "-Dinstall=true"
+  ];
+
   buildInputs = [
     mono
     glib
     pango
     gtk3
-    libxml2
-  ];
-
-  env.NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
-
-  patches = [
-    # Fixes MONO_PROFILE_ENTER_LEAVE undeclared when compiling against newer versions of mono.
-    # @see https://github.com/mono/gtk-sharp/pull/266
-    (fetchpatch {
-      name = "MONO_PROFILE_ENTER_LEAVE.patch";
-      url = "https://github.com/mono/gtk-sharp/commit/401df51bc461de93c1a78b6a7a0d5adc63cf186c.patch";
-      sha256 = "0hrkcr5a7wkixnyp60v4d6j3arsb63h54rd30lc5ajfjb3p92kcf";
-    })
-    # @see https://github.com/mono/gtk-sharp/pull/263
-    (fetchpatch {
-      name = "disambiguate_Gtk.Range.patch";
-      url = "https://github.com/mono/gtk-sharp/commit/a00552ad68ae349e89e440dca21b86dbd6bccd30.patch";
-      sha256 = "1ylplr9g9x7ybsgrydsgr6p3g7w6i46yng1hnl3afgn4vj45rag2";
-    })
   ];
 
   dontStrip = true;
 
-  inherit monoDLLFixer;
+  patches = [
+    (fetchpatch {
+      name = "fix-unknown-variable-gdk_api_includes.patch";
+      url = "https://github.com/GLibSharp/GtkSharp/commit/a1ffef907e06303bbd2787ced5c82a8bf6a7eef1.patch";
+      hash = "sha256-w3BbnEU6ye9WsNBNiELbbGOkXYsE3SACopRF0Dbfr3k=";
+    })
+  ];
 
   passthru = {
     inherit gtk3;
   };
 
   meta = {
+    homepage = "https://github.com/GLibSharp/GtkSharp";
+    license = lib.licenses.lgpl2Only;
     platforms = lib.platforms.linux;
   };
 })
diff --git a/pkgs/by-name/he/heroic/package.nix b/pkgs/by-name/he/heroic/package.nix
index 4884a733ecd1..d8034bceb24f 100644
--- a/pkgs/by-name/he/heroic/package.nix
+++ b/pkgs/by-name/he/heroic/package.nix
@@ -3,6 +3,7 @@
   heroic-unwrapped,
   extraPkgs ? pkgs: [ ],
   extraLibraries ? pkgs: [ ],
+  extraEnv ? { },
 }:
 
 steam.buildRuntimeEnv {
@@ -12,7 +13,7 @@ steam.buildRuntimeEnv {
   runScript = "heroic";
 
   extraPkgs = pkgs: [ heroic-unwrapped ] ++ extraPkgs pkgs;
-  inherit extraLibraries;
+  inherit extraLibraries extraEnv;
 
   extraInstallCommands = ''
     mkdir -p $out/share
diff --git a/pkgs/by-name/i3/i3/package.nix b/pkgs/by-name/i3/i3/package.nix
index 7a2432747630..dab8b208f809 100644
--- a/pkgs/by-name/i3/i3/package.nix
+++ b/pkgs/by-name/i3/i3/package.nix
@@ -39,13 +39,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "i3";
-  version = "4.24";
+  version = "4.25.1";
 
   src = fetchFromGitHub {
     owner = "i3";
     repo = "i3";
     tag = finalAttrs.version;
-    hash = "sha256-2tuhfB/SMN+osCBfZtw/yDPhNNEhBH4Qo6dexpqVWYk=";
+    hash = "sha256-gXm0jzRAHXnjEfmUtlB+Pr/ZNNuZVRk6KWBCxRNDneU=";
   };
 
   nativeBuildInputs = [
@@ -91,13 +91,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   postPatch = ''
     patchShebangs .
-
-    # This testcase generates a Perl executable file with a shebang, and
-    # patchShebangs can't replace a shebang in the middle of a file.
-    if [ -f testcases/t/318-i3-dmenu-desktop.t ]; then
-      substituteInPlace testcases/t/318-i3-dmenu-desktop.t \
-        --replace-fail "#!/usr/bin/env perl" "#!${lib.getExe perl}"
-    fi
   '';
 
   # xvfb-run is available only on Linux
diff --git a/pkgs/by-name/ic/iceauth/package.nix b/pkgs/by-name/ic/iceauth/package.nix
index 525de7f1e889..fa0f0834a69b 100644
--- a/pkgs/by-name/ic/iceauth/package.nix
+++ b/pkgs/by-name/ic/iceauth/package.nix
@@ -11,7 +11,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "iceauth";
-  version = "1.0.10";
+  version = "1.0.11";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
@@ -19,7 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "app";
     repo = "iceauth";
     tag = "iceauth-${finalAttrs.version}";
-    hash = "sha256-XAk+hffmX02/0wJlXZVSY325I1AyiJ6AozJizsv39Mg=";
+    hash = "sha256-HuC5q5kFek2v+Rzp+TgSRnl6Dr4eKtSl7SuSwfFvOdM=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/in/incus/package.nix b/pkgs/by-name/in/incus/package.nix
index d646004f03af..8ffc9f825563 100644
--- a/pkgs/by-name/in/incus/package.nix
+++ b/pkgs/by-name/in/incus/package.nix
@@ -2,7 +2,13 @@ import ./generic.nix {
   hash = "sha256-g0YnvPMwk7WpYCl5VbRtHKVYoLlrk6QYhRaRRqulVQM=";
   version = "7.1.0";
   vendorHash = "sha256-VqvDrjdBTblqEOY/HtoKXGRAdoTJpSWxkmgJNNPw6eQ=";
-  patches = [ ];
+  patches = fetchpatch2: [
+    (fetchpatch2 {
+      name = "lxc-fix-environment-quoting.patch";
+      url = "https://github.com/lxc/incus/commit/a1276cdb57297245496ac8c1db76b90d1fcebd3b.patch?full_index=1";
+      hash = "sha256-NqEMYcDYx18KbqShKxmaK1o08c8/X4O87zXclQ36Ors=";
+    })
+  ];
   nixUpdateExtraArgs = [
     "--override-filename=pkgs/by-name/in/incus/package.nix"
   ];
diff --git a/pkgs/by-name/in/infat/package.nix b/pkgs/by-name/in/infat/package.nix
index c0b70aff875a..a14c57506e55 100644
--- a/pkgs/by-name/in/infat/package.nix
+++ b/pkgs/by-name/in/infat/package.nix
@@ -7,20 +7,24 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "infat";
-  version = "3.0.3";
+  version = "3.1.2";
 
   src = fetchFromGitHub {
     owner = "philocalyst";
     repo = "infat";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-M0A9/rjw5aX4yfkEzkczLcvMpMuVTV5u1eyKhlM7nNk=";
+    hash = "sha256-/lZqI6E6mGQLtc3bmDH1NhnmVYa4sLjMJaYga33vLmI=";
   };
 
-  cargoHash = "sha256-8WE9TiZX1QWenjEQF/uhzJ8Gqbggt8B9EZ+1tzWq72Q=";
+  cargoHash = "sha256-XPwhwJNHou5fJZ94RpbOlWUPQjw45PNmYCRzmukrFYo=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = "--version";
-  doInstallCheck = true;
+  # The v3.1.2 tag ships infat-cli/Cargo.toml with version = "3.1.1", so the
+  # built binary reports "infat-cli 3.1.1" and versionCheckHook fails. Disable
+  # the check until upstream aligns the crate version with the release tag.
+  # https://github.com/philocalyst/infat/blob/v3.1.2/infat-cli/Cargo.toml
+  doInstallCheck = false;
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/ji/jitterentropy-rngd/package.nix b/pkgs/by-name/ji/jitterentropy-rngd/package.nix
index 876dd2422f4c..392975635920 100644
--- a/pkgs/by-name/ji/jitterentropy-rngd/package.nix
+++ b/pkgs/by-name/ji/jitterentropy-rngd/package.nix
@@ -19,8 +19,8 @@ stdenv.mkDerivation (finalAttrs: {
   patches = [
     # Allow the systemd service to mlock the daemon's entropy buffer.
     (fetchpatch {
-      url = "https://github.com/smuellerDD/jitterentropy-rngd/compare/v1.3.1...61ad2e7c83b95402536b90b52eabe20ce60cfbd7.patch";
-      hash = "sha256-Twg59vrqJGF0bH4pkIewbReCjabOFuqq+MtCnwjO9lw=";
+      url = "https://github.com/smuellerDD/jitterentropy-rngd/compare/v1.3.1...cee0c7a035e9564d161053012c6ea36b2ce27383.patch";
+      hash = "sha256-zwcY9z9EikrhxZa39p4+gl+/EeZ4sAKaItQfrL1DFSo=";
     })
   ];
 
diff --git a/pkgs/by-name/jo/joe/package.nix b/pkgs/by-name/jo/joe/package.nix
index 3f8e595f80ed..5ff37c28af2c 100644
--- a/pkgs/by-name/jo/joe/package.nix
+++ b/pkgs/by-name/jo/joe/package.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "joe";
-  version = "4.7";
+  version = "4.8";
 
   src = fetchurl {
     url = "mirror://sourceforge/joe-editor/joe-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-cSsjqDo3V6k9K0p2Mludq7pVTBgrIJ0mdVN8Jyhn/Lo=";
+    sha256 = "sha256-aZWyjuINzbvLWkWkwRBkLcltZ3SK6idFDHTNtN0HzCA=";
   };
 
   patches = [ ./macos-fix.patch ];
diff --git a/pkgs/by-name/jo/john/package.nix b/pkgs/by-name/jo/john/package.nix
index 3ce8d1cc4e7c..9c216258523e 100644
--- a/pkgs/by-name/jo/john/package.nix
+++ b/pkgs/by-name/jo/john/package.nix
@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation {
   pname = "john";
-  version = "1.9.0-Jumbo-1-unstable-2026-04-13";
+  version = "1.9.0-Jumbo-1-unstable-2026-05-31";
 
   src = fetchFromGitHub {
     owner = "openwall";
     repo = "john";
-    rev = "f514ece8ec4ae5e38ad75aaa322eac86d73dcd76";
-    hash = "sha256-zO1/KUJe3LvYCGlwVpNg5uDwPRD0ql/7anErb7tywC0=";
+    rev = "776889036312637dd97584da68af196e2a2c93ea";
+    hash = "sha256-JRQN5NJMCvRDjzXql06Pqy7xEwA8peMCeB4nCedhAvE=";
   };
 
   patches = lib.optionals withOpenCL [
diff --git a/pkgs/by-name/li/libkrunfw/package.nix b/pkgs/by-name/li/libkrunfw/package.nix
index 73120ed22c99..aa5c19c4a513 100644
--- a/pkgs/by-name/li/libkrunfw/package.nix
+++ b/pkgs/by-name/li/libkrunfw/package.nix
@@ -19,6 +19,12 @@ assert lib.elem variant [
   "tdx"
 ];
 
+let
+  kernelSrc = fetchurl {
+    url = "mirror://kernel/linux/kernel/v6.x/linux-6.12.76.tar.xz";
+    hash = "sha256-u7Q+g0xG5r1JpcKPIuZ5qTdENATh9lMgTUskkp862JY=";
+  };
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "libkrunfw" + lib.optionalString (variant != null) "-${variant}";
   version = "5.3.0";
@@ -30,14 +36,9 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-fhG/bP1HzmhyU2N+wnr1074WEGsD9RdTUUBhYUFpWlA=";
   };
 
-  kernelSrc = fetchurl {
-    url = "mirror://kernel/linux/kernel/v6.x/linux-6.12.76.tar.xz";
-    hash = "sha256-u7Q+g0xG5r1JpcKPIuZ5qTdENATh9lMgTUskkp862JY=";
-  };
-
   postPatch = ''
     substituteInPlace Makefile \
-      --replace 'curl $(KERNEL_REMOTE) -o $(KERNEL_TARBALL)' 'ln -s $(kernelSrc) $(KERNEL_TARBALL)'
+      --replace-fail 'curl $(KERNEL_REMOTE) -o $(KERNEL_TARBALL)' 'ln -s ${kernelSrc} $(KERNEL_TARBALL)'
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/md/mdbook-plugins/package.nix b/pkgs/by-name/md/mdbook-plugins/package.nix
index 4946e953f372..226755d667eb 100644
--- a/pkgs/by-name/md/mdbook-plugins/package.nix
+++ b/pkgs/by-name/md/mdbook-plugins/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mdbook-plugins";
-  version = "0.3.4";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "RustForWeb";
     repo = "mdbook-plugins";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-28Olgft2IQvvJEQ9oqj5o96MT8rILUESQiTOtpc2xLw=";
+    hash = "sha256-qV2ECcvhuLB4bvI7UYpnUr8MlOA0USyb1QrUxR+LXOM=";
   };
 
-  cargoHash = "sha256-5Mok7E85DKmo0NIdUZJhinLCWKk+G0tIBKcTy71kUxk=";
+  cargoHash = "sha256-Fhk4dtdOES+72/OBvhe/9WRk5sNzEuw3np84u13pEQ0=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/ms/msgpack-c/package.nix b/pkgs/by-name/ms/msgpack-c/package.nix
index 2e74d57a41a7..6c8e8400f682 100644
--- a/pkgs/by-name/ms/msgpack-c/package.nix
+++ b/pkgs/by-name/ms/msgpack-c/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "msgpack-c";
-  version = "6.1.0";
+  version = "7.0.0";
 
   src = fetchFromGitHub {
     owner = "msgpack";
     repo = "msgpack-c";
     tag = "c-${finalAttrs.version}";
-    hash = "sha256-yL1+6w9l1Ccgrh8WXqvHv2yrb9QH+TrHIAFLXGoVuT0=";
+    hash = "sha256-mCVczuKsLGQsOjGQLt0aBW4++GMEkuCHzGifAJk5C54=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/mu/music-assistant/package.nix b/pkgs/by-name/mu/music-assistant/package.nix
index 64b316f8d7c8..1adda47f84a0 100644
--- a/pkgs/by-name/mu/music-assistant/package.nix
+++ b/pkgs/by-name/mu/music-assistant/package.nix
@@ -1,7 +1,7 @@
 {
   lib,
   stdenv,
-  python3,
+  python3Packages,
   fetchFromGitHub,
   ffmpeg_7-headless,
   nixosTests,
@@ -10,34 +10,33 @@
 }:
 
 let
-  python = python3.override {
-    self = python;
-    packageOverrides = self: super: {
-      music-assistant-frontend = self.callPackage ./frontend.nix { };
+  pythonPackages = python3Packages.overrideScope (
+    prev: final: {
+      music-assistant-frontend = prev.callPackage ./frontend.nix { };
 
-      music-assistant-models = super.music-assistant-models.overridePythonAttrs (oldAttrs: {
+      music-assistant-models = final.music-assistant-models.overridePythonAttrs (oldAttrs: {
         version = "1.1.115";
 
         src = oldAttrs.src.override {
           hash = "sha256-oEXL0B8JNH4PcltpES375ov7QGs+gtYKlMGr1B7BlKY=";
         };
       });
-    };
-  };
+    }
+  );
 
   providerPackages = (import ./providers.nix).providers;
   providerNames = lib.attrNames providerPackages;
   providerDependencies = lib.concatMap (
-    provider: (providerPackages.${provider} python.pkgs)
+    provider: (providerPackages.${provider} pythonPackages)
   ) providers;
 
-  pythonPath = python.pkgs.makePythonPath providerDependencies;
+  pythonPath = pythonPackages.makePythonPath providerDependencies;
 in
 
 assert
   (lib.elem "ariacast" providers) -> throw "music-assistant: ariacast has not been packaged, yet.";
 
-python.pkgs.buildPythonApplication rec {
+pythonPackages.buildPythonApplication rec {
   pname = "music-assistant";
   version = "2.8.7";
   pyproject = true;
@@ -99,7 +98,7 @@ python.pkgs.buildPythonApplication rec {
     fi
   '';
 
-  build-system = with python.pkgs; [
+  build-system = with pythonPackages; [
     setuptools
   ];
 
@@ -118,7 +117,7 @@ python.pkgs.buildPythonApplication rec {
   ];
 
   dependencies =
-    with python.pkgs;
+    with pythonPackages;
     [
       # Only packages required in pyproject.toml
       aiodns
@@ -162,7 +161,7 @@ python.pkgs.buildPythonApplication rec {
     ++ gql.optional-dependencies.all
     ++ pyjwt.optional-dependencies.crypto;
 
-  optional-dependencies = with python.pkgs; {
+  optional-dependencies = with pythonPackages; {
     # Required subset of optional-dependencies in pyproject.toml
     test = [
       pytest-aiohttp
@@ -172,7 +171,7 @@ python.pkgs.buildPythonApplication rec {
   };
 
   nativeCheckInputs =
-    with python.pkgs;
+    with pythonPackages;
     [
       pytestCheckHook
     ]
@@ -206,7 +205,7 @@ python.pkgs.buildPythonApplication rec {
 
   passthru = {
     inherit
-      python
+      pythonPackages
       pythonPath
       providerPackages
       providerNames
diff --git a/pkgs/by-name/ne/nexttrace/package.nix b/pkgs/by-name/ne/nexttrace/package.nix
index aa95a3d9d8d0..80c9b402f2d8 100644
--- a/pkgs/by-name/ne/nexttrace/package.nix
+++ b/pkgs/by-name/ne/nexttrace/package.nix
@@ -7,15 +7,15 @@
 
 buildGoModule (finalAttrs: {
   pname = "nexttrace";
-  version = "1.6.5";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "nxtrace";
     repo = "NTrace-core";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-PpCWTak14Y2zZBYOtCHEjNtvrXo6JOAo/ddYrJZMou8=";
+    sha256 = "sha256-5J0P+HlfSt6wd/q7L/+6h7auQQBJkaA1NO053w32S8Y=";
   };
-  vendorHash = "sha256-8evslWY5EgZT5ah63t6UmREUgkuY8aYwdsox4xxyKiA=";
+  vendorHash = "sha256-9g0OZczhIhM96eYFyAMxajpIkRgNUkn6QUZtl3O/xSM=";
 
   buildInputs = [ libpcap ];
 
diff --git a/pkgs/by-name/ni/nixl/package.nix b/pkgs/by-name/ni/nixl/package.nix
index 43ffdcef4e1f..44c8fac0e236 100644
--- a/pkgs/by-name/ni/nixl/package.nix
+++ b/pkgs/by-name/ni/nixl/package.nix
@@ -36,7 +36,7 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
   pname = "nixl";
-  version = "1.1.0";
+  version = "1.2.0";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -45,7 +45,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
     owner = "ai-dynamo";
     repo = "nixl";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lzR+haBtRPUJ9VE1AcPndp3CPtW7KCI3nNPeVIGyR0U=";
+    hash = "sha256-viyoFc8g0B8kXW2umd7vdAAu+XMk0CJwQEGw+ll3AJ4=";
   };
 
   postPatch =
diff --git a/pkgs/by-name/om/omnictl/package.nix b/pkgs/by-name/om/omnictl/package.nix
index bd5941f7c637..dc086ccd503e 100644
--- a/pkgs/by-name/om/omnictl/package.nix
+++ b/pkgs/by-name/om/omnictl/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "omnictl";
-  version = "1.7.3";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "siderolabs";
     repo = "omni";
     rev = "v${version}";
-    hash = "sha256-c2dYVXYH12YAvfxiCA1Rl/9y/FD7fMBEBQvvc4TmBYA=";
+    hash = "sha256-8oTLe4ZGXqL62h+AbjjKv/SmDd9cMvFO3k/0K3VdrNI=";
   };
 
-  vendorHash = "sha256-QstTh4deaanljpFm6zEkm6ykGhUeTjK3Az9w8JROiWY=";
+  vendorHash = "sha256-yO9b26bXCg5pSXX65vQf/8YII/92sDjGJMK40zu/3s8=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/op/opengrok/package.nix b/pkgs/by-name/op/opengrok/package.nix
index 354cecb58896..c750ff07cea7 100644
--- a/pkgs/by-name/op/opengrok/package.nix
+++ b/pkgs/by-name/op/opengrok/package.nix
@@ -8,12 +8,12 @@
 
 stdenv.mkDerivation rec {
   pname = "opengrok";
-  version = "1.14.12";
+  version = "1.14.13";
 
   # binary distribution
   src = fetchurl {
     url = "https://github.com/oracle/opengrok/releases/download/${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-D67KpbmuqInnfymNc9QvreTVjZmzNuxoswD/ZxTlHx8=";
+    hash = "sha256-x15bXlAplJSv/nB3Spe7W2F7TxDM48MKulFgZ2LnIX0=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/op/opl3bankeditor/package.nix b/pkgs/by-name/op/opl3bankeditor/package.nix
index 1d286496a144..636128d6c6ff 100644
--- a/pkgs/by-name/op/opl3bankeditor/package.nix
+++ b/pkgs/by-name/op/opl3bankeditor/package.nix
@@ -12,14 +12,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "opl3bankeditor";
-  version = "1.5.1-unstable-2026-05-04";
+  version = "1.5.1-unstable-2026-05-23";
 
   src = fetchFromGitHub {
     owner = "Wohlstand";
     repo = "opl3bankeditor";
-    rev = "0155632a595897cb679c9f9c8575cee3eff2123d";
+    rev = "e347a35c3a29d5512b4b5c18f4e569e35238bc9f";
     fetchSubmodules = true;
-    hash = "sha256-OEcfqvvEACo270kNfli/mdf/JO45XOp9QXOmKQQTpos=";
+    hash = "sha256-FOIHsIbX5WweKFIqu5zRJQD6wn5R74OVx2jQs42oGYk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pa/pacemaker/package.nix b/pkgs/by-name/pa/pacemaker/package.nix
index a9e5a0fc5a8b..7d670749fe05 100644
--- a/pkgs/by-name/pa/pacemaker/package.nix
+++ b/pkgs/by-name/pa/pacemaker/package.nix
@@ -7,9 +7,13 @@
   bzip2,
   corosync,
   dbus,
+  docbook_xsl,
   fetchFromGitHub,
+  getopt,
+  gettext,
   glib,
   gnutls,
+  help2man,
   libqb,
   libtool,
   libuuid,
@@ -19,6 +23,7 @@
   pkg-config,
   python3,
   nixosTests,
+  versionCheckHook,
 
   # Pacemaker is compiled twice, once with forOCF = true to extract its
   # OCF definitions for use in the ocf-resource-agents derivation, then
@@ -26,6 +31,7 @@
   # as the OCF_ROOT.
   forOCF ? false,
   ocf-resource-agents,
+  withManpages ? !forOCF,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -35,32 +41,54 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "ClusterLabs";
     repo = "pacemaker";
-    rev = "Pacemaker-${finalAttrs.version}";
-    sha256 = "sha256-23YkNzqiimLy/KjO+hxVQQ4rUhSEhn5Oc2jUJO/VRo0=";
+    tag = "Pacemaker-${finalAttrs.version}";
+    hash = "sha256-23YkNzqiimLy/KjO+hxVQQ4rUhSEhn5Oc2jUJO/VRo0=";
   };
 
+  outputs = [ "out" ] ++ lib.optionals withManpages [ "man" ];
+
   nativeBuildInputs = [
     autoconf
     automake
+    gettext
+    getopt
     libtool
     pkg-config
+    python3
+  ]
+  ++ lib.optionals withManpages [
+    # If we don't supply the dependencies the manpage build will be silently skipped
+    help2man # for tool man pages (see mk/man.mk)
+    libxml2 # for other man pages (xmllint)
+    libxslt # for other man pages (xsltproc)
   ];
 
   buildInputs = [
     bash
     bzip2
     corosync
-    dbus.dev
+    dbus
     glib
     gnutls
     libqb
+    libtool
     libuuid
-    libxml2.dev
-    libxslt.dev
+    libxml2
+    libxslt
     pam
-    python3
   ];
 
+  strictDeps = true;
+
+  # If we do this unconditionally the build will fail because it sees a valid MANPAGE_XSLT
+  # but required executables are not available.
+  postPatch = lib.optionalString withManpages ''
+    # Avoid the use of xmlcatalog to resolve stylesheet for manpages, but set the path directly
+    substituteInPlace configure.ac \
+      --replace-fail 'MANPAGE_XSLT=""' 'MANPAGE_XSLT="${docbook_xsl}/xml/xsl/docbook/manpages/docbook.xsl"' \
+      --replace-fail 'AS_IF([test x"''${XSLTPROC}" != x""],' 'AS_IF([false],'
+  '';
+
   preConfigure = ''
     ./autogen.sh --prefix="$out"
   '';
@@ -87,11 +115,21 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
-  postInstall = ''
-    # pacemaker's install linking requires a weirdly nested hierarchy
-    mv $out$out/* $out
-    rm -r $out/nix
-  '';
+  # pacemaker's install linking requires a weirdly nested hierarchy
+  postInstall =
+    lib.optionalString withManpages ''
+      mkdir -p $man
+      mv $out$man/* $man
+    ''
+    + ''
+      mv $out$out/* $out
+      rm -r $out/nix
+    '';
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgram = [ "${placeholder "out"}/sbin/pacemakerd" ];
+  versionCheckProgramArg = "--version";
 
   passthru.tests = {
     inherit (nixosTests) pacemaker;
diff --git a/pkgs/applications/misc/peaclock/default.nix b/pkgs/by-name/pe/peaclock/package.nix
similarity index 79%
rename from pkgs/applications/misc/peaclock/default.nix
rename to pkgs/by-name/pe/peaclock/package.nix
index daf65937b5b4..ea2594deb2d3 100644
--- a/pkgs/applications/misc/peaclock/default.nix
+++ b/pkgs/by-name/pe/peaclock/package.nix
@@ -1,21 +1,21 @@
 {
   lib,
-  stdenv,
+  gccStdenv,
   fetchFromGitHub,
   cmake,
   libpthread-stubs,
   icu,
 }:
 
-stdenv.mkDerivation rec {
+gccStdenv.mkDerivation (finalAttrs: {
   pname = "peaclock";
   version = "0.4.3";
 
   src = fetchFromGitHub {
     owner = "octobanana";
     repo = "peaclock";
-    rev = version;
-    sha256 = "1582vgslhpgbvcd7ipgf1d1razrvgpq1f93q069yr2bbk6xn8i16";
+    tag = finalAttrs.version;
+    hash = "sha256-JkRku5lrieyTAXgkF/B9O3+VQwvu3Xga2+tdSPXbApU=";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -32,4 +32,4 @@ stdenv.mkDerivation rec {
     maintainers = with lib.maintainers; [ djanatyn ];
     mainProgram = "peaclock";
   };
-}
+})
diff --git a/pkgs/by-name/ph/phpantom-lsp/package.nix b/pkgs/by-name/ph/phpantom-lsp/package.nix
index d3196b088358..3958930ba315 100644
--- a/pkgs/by-name/ph/phpantom-lsp/package.nix
+++ b/pkgs/by-name/ph/phpantom-lsp/package.nix
@@ -11,14 +11,14 @@ let
   stubsSrc = fetchFromGitHub {
     owner = "JetBrains";
     repo = "phpstorm-stubs";
-    rev = "3327932472f512d2eb9e122b19702b335083fd9d";
-    hash = "sha256-WN5DAvaw4FfHBl2AqSo1OcEthUm3lOpikdB78qy3cyY=";
+    rev = "517b9ad1adaf2c5453c00ec2fbb02d192a4a9b6c";
+    hash = "sha256-IDWAuy301avfTF/E7Mby2JQQtIr/gnN5flZ3uctUpus=";
   };
 in
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "phpantom-lsp";
-  version = "0.7.0";
+  version = "0.8.0";
 
   __structuredAttrs = true;
 
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "AJenbo";
     repo = "phpantom_lsp";
     tag = finalAttrs.version;
-    hash = "sha256-ZmtOdoxXkwn2IDg7RyQ9KG0RNz5mrGDMcESfcOSR3Ig=";
+    hash = "sha256-00NAiPm3qqxyS1u1GPpJlgnBlUjDx9VmjK6oOwH8kcU=";
   };
 
   postPatch = ''
@@ -38,7 +38,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       > stubs/jetbrains/phpstorm-stubs/.commit
   '';
 
-  cargoHash = "sha256-pXP4qItYgmUXVx9XwMdS6WLVc5lP7P4VX9+0TbhYrUc=";
+  cargoHash = "sha256-FyMI8Kb3QUD8Jui9k7vayMcQC+KWL8sZi3A05NPbXsg=";
 
   checkFlags = [
     "--test"
diff --git a/pkgs/by-name/pl/plover/package.nix b/pkgs/by-name/pl/plover/package.nix
index 8753ebb0316c..8daff71626ed 100644
--- a/pkgs/by-name/pl/plover/package.nix
+++ b/pkgs/by-name/pl/plover/package.nix
@@ -3,7 +3,7 @@
   config,
   python3Packages,
   # For aliases
-  plover,
+  plover_4,
 }:
 python3Packages.toPythonApplication python3Packages.plover
 # Aliases to now-dropped plover.stable and plover.dev
@@ -11,7 +11,8 @@ python3Packages.toPythonApplication python3Packages.plover
 # TODO(@ShamrockLee): remove after Nixpkgs 25.11 EOL
 // lib.optionalAttrs (config.allowAliases && !(lib.oldestSupportedReleaseIsAtLeast 2605)) {
   dev =
-    lib.throwIf (lib.oldestSupportedReleaseIsAtLeast 2511) "plover.dev was renamed. Use plover instead."
-      plover; # Added 2026-04-26
+    lib.throwIf (lib.oldestSupportedReleaseIsAtLeast 2511)
+      "plover.dev was renamed. Use plover, plover_5, or plover_4 instead."
+      plover_4; # Added 2026-05-07
   stable = throw "plover.stable was renamed. Use plover instead."; # Added 2022-06-05; updated 2026-04-26
 }
diff --git a/pkgs/by-name/qm/qmediathekview/package.nix b/pkgs/by-name/qm/qmediathekview/package.nix
index e23be092fe02..62296d33d614 100644
--- a/pkgs/by-name/qm/qmediathekview/package.nix
+++ b/pkgs/by-name/qm/qmediathekview/package.nix
@@ -4,19 +4,32 @@
   fetchFromGitHub,
   boost,
   xz,
+  cargo,
   pkg-config,
-  libsForQt5,
+  qt6Packages,
+  rustPlatform,
+  sqlite,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "QMediathekView";
-  version = "0.2.1";
+  version = "0.2.3";
 
   src = fetchFromGitHub {
     owner = "adamreichold";
     repo = "QMediathekView";
     tag = "v${finalAttrs.version}";
-    sha256 = "0i9hac9alaajbra3lx23m0iiq6ww4is00lpbzg5x70agjrwj0nd6";
+    hash = "sha256-miqCzNTqbZwPuy6P911wlf5TF1lECzNW/02/edK8XaU=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs)
+      pname
+      version
+      src
+      cargoRoot
+      ;
+    hash = "sha256-89ogtmtJRgMoPOjyW+OGoptKE8VP9lUhbsB5vrdP7zQ=";
   };
 
   postPatch = ''
@@ -25,17 +38,24 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   buildInputs = [
-    libsForQt5.qtbase
+    qt6Packages.qtbase
+    sqlite
     xz
     boost
   ];
 
   nativeBuildInputs = [
-    libsForQt5.qmake
+    qt6Packages.qmake
+    cargo
     pkg-config
-    libsForQt5.wrapQtAppsHook
+    qt6Packages.wrapQtAppsHook
+    rustPlatform.cargoSetupHook
   ];
 
+  cargoRoot = "internals";
+
+  env.HOST_AR = lib.getExe' stdenv.cc.bintools.bintools "ar";
+
   installFlags = [ "INSTALL_ROOT=$(out)" ];
 
   meta = {
diff --git a/pkgs/by-name/qt/qtox/package.nix b/pkgs/by-name/qt/qtox/package.nix
index b18baac11b9d..edca7a105cd3 100644
--- a/pkgs/by-name/qt/qtox/package.nix
+++ b/pkgs/by-name/qt/qtox/package.nix
@@ -17,7 +17,6 @@
   libopus,
   libvpx,
   openal,
-  pcre,
   qrencode,
   qt6,
   sqlcipher,
@@ -47,7 +46,6 @@ stdenv.mkDerivation (finalAttrs: {
     libsodium
     libvpx
     openal
-    pcre
     qrencode
     qt6.qtbase
     qt6.qtsvg
diff --git a/pkgs/by-name/ra/rabtap/package.nix b/pkgs/by-name/ra/rabtap/package.nix
index 3490c772fcb0..c218e787c53e 100644
--- a/pkgs/by-name/ra/rabtap/package.nix
+++ b/pkgs/by-name/ra/rabtap/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "rabtap";
-  version = "1.44.1";
+  version = "1.45.0";
 
   src = fetchFromGitHub {
     owner = "jandelgado";
     repo = "rabtap";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-mW2O8/22zbA3/wpYkQHCI0z8EEL0Wyud2TD5vNUJrNI=";
+    sha256 = "sha256-1cNwNqbvF+i5GgzRD3RyFesGjA4/kJWFotPjJC+r/7g=";
   };
 
-  vendorHash = "sha256-Yi4vH3UMOE//p3H9iCR5RY3SjjR0mu2sBRx8WK57Dq8=";
+  vendorHash = "sha256-fp605VqspavEFQESP7yY6VG80ZpV6h33uhj2hoQiDKk=";
 
   ldflags = [
     "-X main.BuildVersion=v${finalAttrs.version}"
diff --git a/pkgs/by-name/ra/ralphex/package.nix b/pkgs/by-name/ra/ralphex/package.nix
index 02db0fb8a887..1157f9f84228 100644
--- a/pkgs/by-name/ra/ralphex/package.nix
+++ b/pkgs/by-name/ra/ralphex/package.nix
@@ -9,7 +9,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "ralphex";
-  version = "1.3.2";
+  version = "1.4.0";
 
   __structuredAttrs = true;
 
@@ -17,7 +17,7 @@ buildGoModule (finalAttrs: {
     owner = "umputun";
     repo = "ralphex";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4+U2m6dPH4u5RCt1eIeR1PMU90hDD13mmu+2bXnF7D0=";
+    hash = "sha256-IIGZ4uJRm4eYZW0Ezxuis1unEPUs8jUaKIcNyaUBCMg=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/rt/rtk/package.nix b/pkgs/by-name/rt/rtk/package.nix
index 942cbf312e8c..744e5710707a 100644
--- a/pkgs/by-name/rt/rtk/package.nix
+++ b/pkgs/by-name/rt/rtk/package.nix
@@ -12,17 +12,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rtk";
-  version = "0.41.0";
+  version = "0.42.0";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "rtk-ai";
     repo = "rtk";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-C8ns53qLpBdb5osdX68UBGMqM2Rs5UJyfal/iDns6a4=";
+    hash = "sha256-ZCDVS/AFljljMac+cAzQztYPQgvQrcEhKIHHRhkMsv8=";
   };
 
-  cargoHash = "sha256-gDkXAiW8ajEpsEBb7KT9MO5fPEWyUqS+2ak34cipPdc=";
+  cargoHash = "sha256-CFhKBzJc2/+gZDfHq7wxBWEbtHV8EF3OYa+t1b9aL8k=";
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/by-name/sf/sftpgo/package.nix b/pkgs/by-name/sf/sftpgo/package.nix
index a6d7ac6fb8e6..dddc8bd970f8 100644
--- a/pkgs/by-name/sf/sftpgo/package.nix
+++ b/pkgs/by-name/sf/sftpgo/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "sftpgo";
-  version = "2.7.1";
+  version = "2.7.3";
 
   src = fetchFromGitHub {
     owner = "drakkan";
     repo = "sftpgo";
     tag = "v${version}";
-    hash = "sha256-y5Khka7r1Mostg8qPdTlSOieO+x7AdvJFIefILT97OI=";
+    hash = "sha256-6VCm9rbC63UE5yUaY0JVe+Mf3thK+ZDhSOzzIvI1vzA=";
   };
 
-  vendorHash = "sha256-yIrI0yN+htfC+yORILt8oB+iu2UYWxxL6tzb4dzxtD0=";
+  vendorHash = "sha256-EB5Vyn08yZGl9HVaLAhgkJw/iuY07scd689my9aEimY=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/sk/skypilot/0001-Fix-docker-flag-default-for-Click-8.2-compatibility.patch b/pkgs/by-name/sk/skypilot/0001-Fix-docker-flag-default-for-Click-8.2-compatibility.patch
new file mode 100644
index 000000000000..4192588ac4a5
--- /dev/null
+++ b/pkgs/by-name/sk/skypilot/0001-Fix-docker-flag-default-for-Click-8.2-compatibility.patch
@@ -0,0 +1,31 @@
+From 6a2202baf3edff90aea6b66996a8e11e4e7c133e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ak=E1=B9=A3aya=20=C5=9Ar=C4=ABniv=C4=81san?=
+ <akssri@vakra.xyz>
+Date: Wed, 13 May 2026 13:31:19 +0530
+Subject: [PATCH] Fix --docker flag default for Click >= 8.2 compatibility
+
+Click 8.2 changed flag_value option handling: default=False is no longer
+normalised to None before the 'is None' guard. Change to default=None so
+sky launch works with Click >= 8.2 (e.g. nixpkgs).
+
+Upstream constrains click<8.2; this makes the code robust to newer versions.
+---
+ sky/client/cli/command.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sky/client/cli/command.py b/sky/client/cli/command.py
+index 6ee1102d0..15a5057d6 100644
+--- a/sky/client/cli/command.py
++++ b/sky/client/cli/command.py
+@@ -1072,7 +1072,7 @@ def _handle_infra_cloud_region_zone_options(infra: Optional[str],
+ @click.option('--docker',
+               'backend_name',
+               flag_value=backends.LocalDockerBackend.NAME,
+-              default=False,
++              default=None,
+               hidden=True,
+               help=('(Deprecated) Local docker support is deprecated. '
+                     'To run locally, create a local Kubernetes cluster with '
+-- 
+2.53.0
+
diff --git a/pkgs/by-name/sk/skypilot/0002-Fix-websocket-proxy-call-script-directly-as-executable.patch b/pkgs/by-name/sk/skypilot/0002-Fix-websocket-proxy-call-script-directly-as-executable.patch
new file mode 100644
index 000000000000..781741b2dc37
--- /dev/null
+++ b/pkgs/by-name/sk/skypilot/0002-Fix-websocket-proxy-call-script-directly-as-executable.patch
@@ -0,0 +1,37 @@
+diff --git a/sky/client/cli/command.py b/sky/client/cli/command.py
+index 15a5057d6..5417cad9f 100644
+--- a/sky/client/cli/command.py
++++ b/sky/client/cli/command.py
+@@ -203,7 +203,6 @@ def _get_cluster_records_and_set_ssh_config(
+             escaped_key_path = shlex.quote(
+                 (cluster_utils.SSHConfigHelper.generate_local_key_file(
+                     handle.cluster_name, credentials)))
+-            escaped_executable_path = shlex.quote(sys.executable)
+             escaped_websocket_proxy_path = shlex.quote(
+                 f'{directory_utils.get_sky_dir()}/templates/websocket_proxy.py')
+             # Instead of directly use websocket_proxy.py, we add an
+@@ -220,8 +219,7 @@ def _get_cluster_records_and_set_ssh_config(
+                 # TODO(zhwu): write the template to a temp file, don't use
+                 # the one in skypilot repo, to avoid changing the file when
+                 # updating skypilot.
+-                f'\"{escaped_executable_path} '
+-                f'{escaped_websocket_proxy_path} '
++                f'\"{escaped_websocket_proxy_path} '
+                 f'{server_common.get_server_url()} '
+                 f'{handle.cluster_name} '
+                 f'kubernetes-pod-ssh-proxy\"')
+@@ -229,13 +227,11 @@ def _get_cluster_records_and_set_ssh_config(
+         elif isinstance(handle.launched_resources.cloud, clouds.Slurm):
+             # Replace the proxy command to proxy through the SkyPilot API
+             # server with websocket.
+-            escaped_executable_path = shlex.quote(sys.executable)
+             escaped_websocket_proxy_path = shlex.quote(
+                 f'{directory_utils.get_sky_dir()}/templates/websocket_proxy.py')
+             # %w is a placeholder for the node index, substituted per-node
+             # in cluster_utils.SSHConfigHelper.add_cluster().
+-            proxy_command = (f'{escaped_executable_path} '
+-                             f'{escaped_websocket_proxy_path} '
++            proxy_command = (f'{escaped_websocket_proxy_path} '
+                              f'{server_common.get_server_url()} '
+                              f'{handle.cluster_name} '
+                              f'slurm-job-ssh-proxy %w')
diff --git a/pkgs/by-name/sk/skypilot/package.nix b/pkgs/by-name/sk/skypilot/package.nix
index d48db1649d1a..fe2dfc14dbe9 100644
--- a/pkgs/by-name/sk/skypilot/package.nix
+++ b/pkgs/by-name/sk/skypilot/package.nix
@@ -35,6 +35,11 @@ python3Packages.buildPythonApplication (finalAttrs: {
   pyproject = true;
   pythonRelaxDeps = true;
 
+  patches = [
+    ./0001-Fix-docker-flag-default-for-Click-8.2-compatibility.patch
+    ./0002-Fix-websocket-proxy-call-script-directly-as-executable.patch
+  ];
+
   nativeBuildInputs = [
     writableTmpDirAsHomeHook
   ];
@@ -217,6 +222,11 @@ python3Packages.buildPythonApplication (finalAttrs: {
     cp -r ${dashboard}/* $out/${python3Packages.python.sitePackages}/sky/dashboard/out/
   '';
 
+  postFixup = ''
+    chmod +x $out/${python3Packages.python.sitePackages}/sky/templates/websocket_proxy.py
+    wrapPythonProgramsIn "$out/${python3Packages.python.sitePackages}/sky/templates" "$out ''${pythonPath[*]}"
+  '';
+
   # Excluding the tests as it fails with error:
   # Message: 'Config loaded from /build/source/examples/admin_policy/restful_policy.yaml:\nadmin_policy: http://localhost:8080\n'
   #Arguments: ()
diff --git a/pkgs/by-name/sp/spruce/package.nix b/pkgs/by-name/sp/spruce/package.nix
index dada757f77ff..a371df25bc2b 100644
--- a/pkgs/by-name/sp/spruce/package.nix
+++ b/pkgs/by-name/sp/spruce/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "spruce";
-  version = "1.35.4";
+  version = "1.35.5";
 
   src = fetchFromGitHub {
     owner = "geofffranks";
     repo = "spruce";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Ulto2lYkCs/dGFDqnqU8RLxNhFY9vwl0b6E0HFeuX0I=";
+    hash = "sha256-VMHtIjg0Fact1gupE0GeZNHX0Tk34rpS6/M8Yiyeuhk=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/ss/sshfs-fuse/common.nix b/pkgs/by-name/ss/sshfs-fuse/common.nix
deleted file mode 100644
index ca4b1b111897..000000000000
--- a/pkgs/by-name/ss/sshfs-fuse/common.nix
+++ /dev/null
@@ -1,93 +0,0 @@
-{
-  version,
-  hash,
-  platforms,
-  patches ? [ ],
-}:
-
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  meson,
-  pkg-config,
-  ninja,
-  docutils,
-  makeWrapper,
-  fuse3,
-  macfuse-stubs,
-  glib,
-  which,
-  python3Packages,
-  openssh,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "sshfs-fuse";
-  inherit version;
-
-  src = fetchFromGitHub {
-    owner = "libfuse";
-    repo = "sshfs";
-    tag = "sshfs-${finalAttrs.version}";
-    inherit hash;
-  };
-
-  inherit patches;
-
-  nativeBuildInputs = [
-    meson
-    pkg-config
-    ninja
-    docutils
-    makeWrapper
-  ];
-  buildInputs = [
-    fuse3
-    glib
-  ];
-  nativeCheckInputs = [
-    which
-    python3Packages.pytest
-  ];
-
-  env.NIX_CFLAGS_COMPILE = lib.optionalString (
-    stdenv.hostPlatform.system == "i686-linux"
-  ) "-D_FILE_OFFSET_BITS=64";
-
-  postInstall = ''
-    mkdir -p $out/sbin
-    ln -sf $out/bin/sshfs $out/sbin/mount.sshfs
-  ''
-  + lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
-    wrapProgram $out/bin/sshfs --prefix PATH : "${openssh}/bin"
-  '';
-
-  outputs = [
-    "out"
-    "man"
-  ];
-
-  # doCheck = true;
-  checkPhase = lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
-    # The tests need fusermount:
-    mkdir bin
-    cp ${fuse3}/bin/fusermount3 bin/fusermount
-    export PATH=bin:$PATH
-    # Can't access /dev/fuse within the sandbox: "FUSE kernel module does not seem to be loaded"
-    substituteInPlace test/util.py --replace "/dev/fuse" "/dev/null"
-    # TODO: "fusermount executable not setuid, and we are not root"
-    # We should probably use a VM test instead
-    ${python3Packages.python.interpreter} -m pytest test/
-  '';
-
-  meta = {
-    inherit platforms;
-    description = "FUSE-based filesystem that allows remote filesystems to be mounted over SSH";
-    longDescription = macfuse-stubs.warning;
-    homepage = "https://github.com/libfuse/sshfs";
-    license = lib.licenses.gpl2Plus;
-    mainProgram = "sshfs";
-    maintainers = [ ];
-  };
-})
diff --git a/pkgs/by-name/ss/sshfs-fuse/package.nix b/pkgs/by-name/ss/sshfs-fuse/package.nix
index 54c2dab96c8e..974d3d3ebcd4 100644
--- a/pkgs/by-name/ss/sshfs-fuse/package.nix
+++ b/pkgs/by-name/ss/sshfs-fuse/package.nix
@@ -1,14 +1,85 @@
 {
   lib,
-  callPackage,
-  fetchpatch,
+  stdenv,
+  fetchFromGitHub,
+  meson,
+  pkg-config,
+  ninja,
+  docutils,
+  makeWrapper,
+  fuse3,
+  macfuse-stubs,
+  glib,
+  which,
+  python3Packages,
+  openssh,
 }:
 
-let
-  mkSSHFS = args: callPackage (import ./common.nix args) { };
-in
-mkSSHFS {
-  version = "3.7.5";
-  hash = "sha256-6SFjYYWx+p9tZQ670nbjbPtH/QvCAGCB0YwkaQbKIqA=";
-  platforms = lib.platforms.darwin ++ lib.platforms.linux;
-}
+stdenv.mkDerivation (finalAttrs: {
+  pname = "sshfs-fuse";
+  version = "3.7.6";
+
+  src = fetchFromGitHub {
+    owner = "libfuse";
+    repo = "sshfs";
+    tag = "sshfs-${finalAttrs.version}";
+    hash = "sha256-BT9qttXyryliR2kV1xVYvcwJhB6gkGf7IEwrTB38SvI=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    pkg-config
+    ninja
+    docutils
+    makeWrapper
+  ];
+  buildInputs = [
+    fuse3
+    glib
+  ];
+  nativeCheckInputs = [
+    which
+    python3Packages.pytest
+  ];
+
+  env.NIX_CFLAGS_COMPILE = lib.optionalString (
+    stdenv.hostPlatform.system == "i686-linux"
+  ) "-D_FILE_OFFSET_BITS=64";
+
+  postInstall = ''
+    mkdir -p $out/sbin
+    ln -sf $out/bin/sshfs $out/sbin/mount.sshfs
+  ''
+  + lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
+    wrapProgram $out/bin/sshfs --prefix PATH : "${openssh}/bin"
+  '';
+
+  outputs = [
+    "out"
+    "man"
+  ];
+
+  # doCheck = true;
+  checkPhase = lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
+    # The tests need fusermount:
+    mkdir bin
+    cp ${fuse3}/bin/fusermount3 bin/fusermount
+    export PATH=bin:$PATH
+    # Can't access /dev/fuse within the sandbox: "FUSE kernel module does not seem to be loaded"
+    substituteInPlace test/util.py --replace "/dev/fuse" "/dev/null"
+    # TODO: "fusermount executable not setuid, and we are not root"
+    # We should probably use a VM test instead
+    ${python3Packages.python.interpreter} -m pytest test/
+  '';
+
+  meta = {
+    changelog = "https://github.com/libfuse/sshfs/blob/${finalAttrs.src.tag}/ChangeLog.rst";
+    description = "FUSE-based filesystem that allows remote filesystems to be mounted over SSH";
+    longDescription = macfuse-stubs.warning;
+    homepage = "https://github.com/libfuse/sshfs";
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.darwin ++ lib.platforms.linux;
+    mainProgram = "sshfs";
+    maintainers = [ ];
+  };
+})
diff --git a/pkgs/by-name/st/steelix/package.nix b/pkgs/by-name/st/steelix/package.nix
index 74dd6630e3b3..fdaf8740516f 100644
--- a/pkgs/by-name/st/steelix/package.nix
+++ b/pkgs/by-name/st/steelix/package.nix
@@ -9,13 +9,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "steelix";
-  version = "0-unstable-2026-05-09";
+  version = "0-unstable-2026-05-21";
 
   src = fetchFromGitHub {
     owner = "mattwparas";
     repo = "helix";
-    rev = "47b4664ac868b334c9cb914d6b6bfa2045249d13";
-    hash = "sha256-+090DLPNNsDoYpAEgH9r5+8n0jQSbL7/5ThUJIT2yGg=";
+    rev = "4d86612df48447088ef4190bf503fd54a7562aa9";
+    hash = "sha256-qAUODNxHM9K6CrRCFgfBcbqzRd+YHiWn9fEfmIzrohA=";
   };
 
   cargoHash = "sha256-6bu8sIM4So3AbnHHYbh8uu+rEB4IjMQjDgh7/AkLQs0=";
diff --git a/pkgs/by-name/ti/timr-tui/package.nix b/pkgs/by-name/ti/timr-tui/package.nix
index 8bef4a38dba3..176eaf7a74cd 100644
--- a/pkgs/by-name/ti/timr-tui/package.nix
+++ b/pkgs/by-name/ti/timr-tui/package.nix
@@ -14,16 +14,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "timr-tui";
-  version = "1.8.1";
+  version = "1.9.0";
 
   src = fetchFromGitHub {
     owner = "sectore";
     repo = "timr-tui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9HaKBrW0MkNzDErEIINztLyGpN4mkGF5RpmXohgbK6A=";
+    hash = "sha256-MEDqrP/wlFHMkXFUwn+VQu8gEjc40xI5xcetG/VqSic=";
   };
 
-  cargoHash = "sha256-J6Zi8oEAsbxMQe+oCk9T6Ic1hPdNXI9iFmn4Z0d0lFE=";
+  cargoHash = "sha256-lQw6p0+uph2P4OdQq2Mz3EHc9o8RcH3SjYPzGvPn2tk=";
 
   # Enable upstream "sound" feature when requested
   buildFeatures = lib.optionals enableSound [ "sound" ];
diff --git a/pkgs/by-name/tl/tldx/package.nix b/pkgs/by-name/tl/tldx/package.nix
index 070a6e047f2e..f0de6e87b6f9 100644
--- a/pkgs/by-name/tl/tldx/package.nix
+++ b/pkgs/by-name/tl/tldx/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "tldx";
-  version = "1.3.4";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "brandonyoungdev";
     repo = "tldx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yKC/omwFG4equAlBHz25Wx+X/06N0x4vdNchiWSfZZQ=";
+    hash = "sha256-SN5uGIzC6a+cPSnrfL+1A+3NIQR6gbILFv7X9L8g/N8=";
   };
 
-  vendorHash = "sha256-FVcTTfOf1eAiR6Iys1uesZWpVrnMTGX7zS1MdeXDoQM=";
+  vendorHash = "sha256-IVxhgsw36/fNVV0Kn7aBza3htPzK09l84qBg3FBtOo0=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/to/tor/package.nix b/pkgs/by-name/to/tor/package.nix
index d67d83daafe7..49dbe04f2c5d 100644
--- a/pkgs/by-name/to/tor/package.nix
+++ b/pkgs/by-name/to/tor/package.nix
@@ -46,11 +46,11 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tor";
-  version = "0.4.9.8";
+  version = "0.4.9.9";
 
   src = fetchurl {
     url = "https://dist.torproject.org/tor-${finalAttrs.version}.tar.gz";
-    hash = "sha256-rB85Ti3Sqwh30n2Sj9DZ6GZi/jymr9/7n9m28PltBd4=";
+    hash = "sha256-vXW6f9aPYHx4Bvz3AVajAKqSbprWml5WqOZBT1In6DM=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/ve/versatiles/package.nix b/pkgs/by-name/ve/versatiles/package.nix
index bddbb7144cdc..dfcfc9333cbb 100644
--- a/pkgs/by-name/ve/versatiles/package.nix
+++ b/pkgs/by-name/ve/versatiles/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "versatiles";
-  version = "4.1.2";
+  version = "4.1.4";
 
   src = fetchFromGitHub {
     owner = "versatiles-org";
     repo = "versatiles-rs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kWUosTubAD/qk6xEGKUiLrw4mrAaOwwuQ3r+UeLsEJU=";
+    hash = "sha256-rM+ybYQTajF0YZoyJPKgc8wtJe5TWqMv8TeGBO/HC/E=";
   };
 
-  cargoHash = "sha256-rTVk8c00b94x6wEIDLvwadCQ/DXSFOPWcKYFSI9YI64=";
+  cargoHash = "sha256-PJ6tUd9ppSkv0FOWppR9RCc2TBbd1kr7ArasuFVx3OY=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/vi/virglrenderer/package.nix b/pkgs/by-name/vi/virglrenderer/package.nix
index 7e804b13d16e..8d06840fb8ae 100644
--- a/pkgs/by-name/vi/virglrenderer/package.nix
+++ b/pkgs/by-name/vi/virglrenderer/package.nix
@@ -68,6 +68,7 @@ stdenv.mkDerivation (finalAttrs: {
   mesonFlags = [
     (lib.mesonBool "video" vaapiSupport)
     (lib.mesonBool "venus" vulkanSupport)
+    (lib.mesonBool "vulkan-dload" false)
     (lib.mesonOption "drm-renderers" (
       lib.optionalString nativeContextSupport (
         lib.concatStringsSep "," (
diff --git a/pkgs/by-name/wa/wasm-tools/package.nix b/pkgs/by-name/wa/wasm-tools/package.nix
index 9ec141b8592c..281f40637fcf 100644
--- a/pkgs/by-name/wa/wasm-tools/package.nix
+++ b/pkgs/by-name/wa/wasm-tools/package.nix
@@ -6,20 +6,20 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wasm-tools";
-  version = "1.250.0";
+  version = "1.251.0";
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = "wasm-tools";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YzALjnjsEHGufpTPV7XHVvNL3xU727eJoE6db9KjStc=";
+    hash = "sha256-U02BnWiC6u7QPA2sCYC+BIgsjRbpjQFNK3tNAi/Td5Q=";
     fetchSubmodules = true;
   };
 
   # Disable cargo-auditable until https://github.com/rust-secure-code/cargo-auditable/issues/124 is solved.
   auditable = false;
 
-  cargoHash = "sha256-rHoLTljDw4mzZBrpSO600TN/DVr3JKPvYVdT1vC7ynw=";
+  cargoHash = "sha256-YXG6V8eBZm1NNvADhB71pkI05UcfkVW7t6N7kTH/I5Q=";
   cargoBuildFlags = [
     "--package"
     "wasm-tools"
diff --git a/pkgs/by-name/we/werf/package.nix b/pkgs/by-name/we/werf/package.nix
index 401835fcca72..eb20f23e352c 100644
--- a/pkgs/by-name/we/werf/package.nix
+++ b/pkgs/by-name/we/werf/package.nix
@@ -10,13 +10,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "werf";
-  version = "2.68.2";
+  version = "2.69.0";
 
   src = fetchFromGitHub {
     owner = "werf";
     repo = "werf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-961fPVffLh11QaJJYXIkXZiS+gNLqDKzImZw7DtFzgw=";
+    hash = "sha256-pSWrHbstEHvN9Kzql6naZ7HVxuH76xM5v2UMDY5QZ74=";
   };
 
   proxyVendor = true;
diff --git a/pkgs/by-name/wk/wkg/package.nix b/pkgs/by-name/wk/wkg/package.nix
index 1b8d13d94afa..d2256e7c0ec0 100644
--- a/pkgs/by-name/wk/wkg/package.nix
+++ b/pkgs/by-name/wk/wkg/package.nix
@@ -8,15 +8,15 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wkg";
-  version = "0.15.0";
+  version = "0.15.1";
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = "wasm-pkg-tools";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-G576caJ9oeYDFDIOP75mfkw6/JsxYyfDsVlFhb0RbIE=";
+    hash = "sha256-xWwhRqo/rRa+VPe2RqoZf77pf3YjqCdbOG8axme9oW4=";
   };
 
-  cargoHash = "sha256-3sf6fyLaiB/w6PF6CzO7p9ZHdBTLAzqIHEhT4COY/4A=";
+  cargoHash = "sha256-L0KYEnmvTUI6GreuEDf6QzNkTHzsLo/U27RrSwF5sA4=";
 
   # A large number of tests require Internet access in order to function.
   doCheck = false;
diff --git a/pkgs/by-name/zu/zuban/package.nix b/pkgs/by-name/zu/zuban/package.nix
index df8422c0453a..9b6fbda85dfd 100644
--- a/pkgs/by-name/zu/zuban/package.nix
+++ b/pkgs/by-name/zu/zuban/package.nix
@@ -9,13 +9,13 @@
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zuban";
 
-  version = "0.7.2";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "zubanls";
     repo = "zuban";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KCQOJ2NyWohbfW6fdG7F+borxUEXOy1IRB/jlc1wrc0=";
+    hash = "sha256-/m66vCXutOBMXMJfulJ9nFeqRWVJCIrHVJiICOvs/+A=";
     fetchSubmodules = true;
   };
 
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   buildAndTestSubdir = "crates/zuban";
 
-  cargoHash = "sha256-r8ezvIkd4R3rFdoKr+KKHKnLWl1/Vl3Ch9GdKhVflMo=";
+  cargoHash = "sha256-mT8QG4pI96gTgFFZN49Yi7Ax90ulPM8pA0tdB/fdSuM=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/development/cuda-modules/_cuda/db/bootstrap/nvcc.nix b/pkgs/development/cuda-modules/_cuda/db/bootstrap/nvcc.nix
index fa9a3fffd6cd..256a4a41e451 100644
--- a/pkgs/development/cuda-modules/_cuda/db/bootstrap/nvcc.nix
+++ b/pkgs/development/cuda-modules/_cuda/db/bootstrap/nvcc.nix
@@ -291,7 +291,7 @@
     };
 
     # No changes from 13.1 to 13.2
-    # https://docs.nvidia.com/cuda/cuda-installation-guide-linux/index.html#host-compiler-support-policy
+    # https://docs.nvidia.com/cuda/archive/13.2.0/cuda-installation-guide-linux/index.html#host-compiler-support-policy
     "13.2" = {
       clang = {
         maxMajorVersion = "21";
@@ -302,5 +302,18 @@
         minMajorVersion = "6";
       };
     };
+
+    # No changes from 13.2 to 13.3
+    # https://docs.nvidia.com/cuda/cuda-installation-guide-linux/index.html#host-compiler-support-policy
+    "13.3" = {
+      clang = {
+        maxMajorVersion = "21";
+        minMajorVersion = "7";
+      };
+      gcc = {
+        maxMajorVersion = "15";
+        minMajorVersion = "6";
+      };
+    };
   };
 }
diff --git a/pkgs/development/cuda-modules/_cuda/manifests/cuda/redistrib_13.3.0.json b/pkgs/development/cuda-modules/_cuda/manifests/cuda/redistrib_13.3.0.json
new file mode 100644
index 000000000000..99a193747f28
--- /dev/null
+++ b/pkgs/development/cuda-modules/_cuda/manifests/cuda/redistrib_13.3.0.json
@@ -0,0 +1,1026 @@
+{
+    "release_date": "2026-05-26",
+    "release_label": "13.3.0",
+    "release_product": "cuda",
+    "cccl": {
+        "name": "CXX Core Compute Libraries",
+        "license": "CCCL EULA",
+        "license_path": "cccl/LICENSE.txt",
+        "version": "13.3.3.3.1",
+        "linux-x86_64": {
+            "relative_path": "cccl/linux-x86_64/cccl-linux-x86_64-13.3.3.3.1-archive.tar.xz",
+            "sha256": "67746da12f16229ac4ebde78ce7895e42b069d1d3e2ae2d2d25f90bc43679d68",
+            "md5": "d4049f09c07164a3fc0d47b31ca1e947",
+            "size": "1262040"
+        },
+        "linux-sbsa": {
+            "relative_path": "cccl/linux-sbsa/cccl-linux-sbsa-13.3.3.3.1-archive.tar.xz",
+            "sha256": "37e9024c5e24a9e9d1618c4fb7b36e74a0a68fac91d589867676952204ecde5b",
+            "md5": "2e723df353c701001348010341636d9a",
+            "size": "1261944"
+        },
+        "windows-x86_64": {
+            "relative_path": "cccl/windows-x86_64/cccl-windows-x86_64-13.3.3.3.1-archive.zip",
+            "sha256": "607dcfca31da168171fbdae5b7096ade646c4c2b1e0ff2899077dde0ccbdd6fb",
+            "md5": "733b7312dfaf8dd67b080190ccbfe343",
+            "size": "3544189"
+        }
+    },
+    "cuda_compat": {
+        "name": "CUDA Forward Compatability",
+        "license": "NVIDIA Driver",
+        "license_path": "cuda_compat/LICENSE.txt",
+        "version": "610.43.02",
+        "linux-x86_64": {
+            "cuda13.3": {
+                "relative_path": "cuda_compat/linux-x86_64/cuda_compat-linux-x86_64-610.43.02_cuda13.3-archive.tar.xz",
+                "sha256": "39a959840ed06b37ccde9b84c083babe415160c6907517cefc463da6d7dc2342",
+                "md5": "9fab4fd189268d5f53552ac0c168452c",
+                "size": "101285400"
+            }
+        },
+        "cuda_variant": [
+            "13.3"
+        ],
+        "linux-sbsa": {
+            "cuda13.3": {
+                "relative_path": "cuda_compat/linux-sbsa/cuda_compat-linux-sbsa-610.43.02_cuda13.3-archive.tar.xz",
+                "sha256": "98b044e17e3b9d7ef27ad9bfd231af966744c9fb05b70fb43b5a000dd087952b",
+                "md5": "fe2ea81e5500c49dbb61b3a7cb02c61c",
+                "size": "91970080"
+            }
+        }
+    },
+    "cuda_compat_orin": {
+        "name": "CUDA compat orin L4T",
+        "license": "CUDA Toolkit",
+        "license_path": "cuda_compat_orin/LICENSE.txt",
+        "version": "13.3.45405995",
+        "linux-sbsa": {
+            "relative_path": "cuda_compat_orin/linux-sbsa/cuda_compat_orin-linux-sbsa-13.3.45405995-archive.tar.xz",
+            "sha256": "d9e7655f46c10eeda7c3652f4fce91825f2b446fab8976c4591bfd4b887e4c8d",
+            "md5": "ea64d8e8f3743d502b83131d36b4ae98",
+            "size": "91223464"
+        }
+    },
+    "cuda_crt": {
+        "name": "CUDA CRT",
+        "license": "CUDA Toolkit",
+        "license_path": "cuda_crt/LICENSE.txt",
+        "version": "13.3.33",
+        "linux-x86_64": {
+            "relative_path": "cuda_crt/linux-x86_64/cuda_crt-linux-x86_64-13.3.33-archive.tar.xz",
+            "sha256": "4755d36d24c6ef7697a2d3e1dbb23c4562c9c0d97d48390d4cbd8ab32dec5b5f",
+            "md5": "40633d5ea63dc795e273ea70835a863f",
+            "size": "99372"
+        },
+        "linux-sbsa": {
+            "relative_path": "cuda_crt/linux-sbsa/cuda_crt-linux-sbsa-13.3.33-archive.tar.xz",
+            "sha256": "6f6194918c00b980d8fd2111bf0aa004977760855c6e1528e0653bf4c889fbef",
+            "md5": "9178ef72a8d15cd054ad8b9e2ecb9e32",
+            "size": "99192"
+        },
+        "windows-x86_64": {
+            "relative_path": "cuda_crt/windows-x86_64/cuda_crt-windows-x86_64-13.3.33-archive.zip",
+            "sha256": "752c528281a06a0ddf89237d760ffd6acde1b9cd59efc35803c2591127ef55f0",
+            "md5": "3afe8200e49c16314b5f5ec0bf55a52c",
+            "size": "163110"
+        }
+    },
+    "cuda_ctadvisor": {
+        "name": "ctadvisor",
+        "license": "CUDA Toolkit",
+        "license_path": "cuda_ctadvisor/LICENSE.txt",
+        "version": "13.3.33",
+        "linux-x86_64": {
+            "relative_path": "cuda_ctadvisor/linux-x86_64/cuda_ctadvisor-linux-x86_64-13.3.33-archive.tar.xz",
+            "sha256": "b8019e542f109a5b9ac4df969a15c6cb3372b2eafdcb0f31bacf4c7c183d065b",
+            "md5": "94180ea1f540074232da1ecedf39edef",
+            "size": "784384"
+        },
+        "linux-sbsa": {
+            "relative_path": "cuda_ctadvisor/linux-sbsa/cuda_ctadvisor-linux-sbsa-13.3.33-archive.tar.xz",
+            "sha256": "cf8e667c58c5193e7d72617b2bdb53f1955f13c1e347792e28739021cb3fb762",
+            "md5": "038e4e74942dafec04441d07320b10c2",
+            "size": "697604"
+        },
+        "windows-x86_64": {
+            "relative_path": "cuda_ctadvisor/windows-x86_64/cuda_ctadvisor-windows-x86_64-13.3.33-archive.zip",
+            "sha256": "8f23724fdc96b7ed12f0c5981f304a500bdcba8532c779d91e861b6d6b34a71b",
+            "md5": "e9e5b3441e11e8ff68994c479ce7ec37",
+            "size": "863843"
+        }
+    },
+    "cuda_cudart": {
+        "name": "CUDA Runtime (cudart)",
+        "license": "CUDA Toolkit",
+        "license_path": "cuda_cudart/LICENSE.txt",
+        "version": "13.3.29",
+        "linux-x86_64": {
+            "relative_path": "cuda_cudart/linux-x86_64/cuda_cudart-linux-x86_64-13.3.29-archive.tar.xz",
+            "sha256": "1e59c4888267d27ba1a9bd0f3669a6439db1334a96e754cd9013c7c73e18dc9d",
+            "md5": "a6f87957617815446daa9a4af727c92c",
+            "size": "1573744"
+        },
+        "linux-sbsa": {
+            "relative_path": "cuda_cudart/linux-sbsa/cuda_cudart-linux-sbsa-13.3.29-archive.tar.xz",
+            "sha256": "0cdd73d11885062daf3aa98ad4d7b8bd84f89b398be11f7054edea9ed31f597d",
+            "md5": "564b740850c2222f0776ee6e968decab",
+            "size": "1567816"
+        },
+        "windows-x86_64": {
+            "relative_path": "cuda_cudart/windows-x86_64/cuda_cudart-windows-x86_64-13.3.29-archive.zip",
+            "sha256": "1feb7dd266813ffe8dbc24e115183a5ac35a4795c8d34aca0df85ab616b64d9c",
+            "md5": "38e6477bad56eca8e6bed74b6f5efb6b",
+            "size": "2589792"
+        }
+    },
+    "cuda_culibos": {
+        "name": "CUDA MATH Library (cuda culibos)",
+        "license": "CUDA Toolkit",
+        "license_path": "cuda_culibos/LICENSE.txt",
+        "version": "13.3.33",
+        "linux-x86_64": {
+            "relative_path": "cuda_culibos/linux-x86_64/cuda_culibos-linux-x86_64-13.3.33-archive.tar.xz",
+            "sha256": "db36b1381bb3105f2f13591393131d93f501958ebd44e9d0d52234cbbaf8cbd0",
+            "md5": "3dbada23050f773e4b7c3b952417f854",
+            "size": "21452"
+        },
+        "linux-sbsa": {
+            "relative_path": "cuda_culibos/linux-sbsa/cuda_culibos-linux-sbsa-13.3.33-archive.tar.xz",
+            "sha256": "af8e930c3527b8eeddea755b40d77e505691ca389f3135d04f46718aec3f45cb",
+            "md5": "552cb4bf2050760aa7d414dc6493298b",
+            "size": "21500"
+        }
+    },
+    "cuda_cuobjdump": {
+        "name": "cuobjdump",
+        "license": "CUDA Toolkit",
+        "license_path": "cuda_cuobjdump/LICENSE.txt",
+        "version": "13.3.29",
+        "linux-x86_64": {
+            "relative_path": "cuda_cuobjdump/linux-x86_64/cuda_cuobjdump-linux-x86_64-13.3.29-archive.tar.xz",
+            "sha256": "9ac891072c4f9c2079cff8fdc3939ac97c5c5bcdf7cb5cca5a351354c7a8ff21",
+            "md5": "915fabc80764effa7320657141001577",
+            "size": "277912"
+        },
+        "linux-sbsa": {
+            "relative_path": "cuda_cuobjdump/linux-sbsa/cuda_cuobjdump-linux-sbsa-13.3.29-archive.tar.xz",
+            "sha256": "622ec73dea88876a6e344b4c6ba432bdc51b50de633355253d32a5ce539f9067",
+            "md5": "5545be03fb7a629839949aa9fc15598c",
+            "size": "265292"
+        },
+        "windows-x86_64": {
+            "relative_path": "cuda_cuobjdump/windows-x86_64/cuda_cuobjdump-windows-x86_64-13.3.29-archive.zip",
+            "sha256": "50c8ab72fdfec7e5958fbd61988719460093d7ac86e2893377e77c8d908a2350",
+            "md5": "6e6420c28effe7497e36dddae5e61b67",
+            "size": "6265163"
+        }
+    },
+    "cuda_cupti": {
+        "name": "CUPTI",
+        "license": "CUDA Toolkit",
+        "license_path": "cuda_cupti/LICENSE.txt",
+        "version": "13.3.35",
+        "linux-x86_64": {
+            "relative_path": "cuda_cupti/linux-x86_64/cuda_cupti-linux-x86_64-13.3.35-archive.tar.xz",
+            "sha256": "8ec73c3063039a780a45d136329563a5c15e3a034b1b082196cd8d98add053ba",
+            "md5": "63a90b820ef060383d9d5d4f486a65ca",
+            "size": "17788236"
+        },
+        "linux-sbsa": {
+            "relative_path": "cuda_cupti/linux-sbsa/cuda_cupti-linux-sbsa-13.3.35-archive.tar.xz",
+            "sha256": "6a83909fe008f84815b39b257fbfb4f698ac777233930677c0deccbb596b26ef",
+            "md5": "03aeb9e90df8a911d6c0291d6401c5d1",
+            "size": "13613068"
+        },
+        "windows-x86_64": {
+            "relative_path": "cuda_cupti/windows-x86_64/cuda_cupti-windows-x86_64-13.3.35-archive.zip",
+            "sha256": "51d7b1a6e66f343cda1dff0fbd3309a0031034834f33f825e6ab87b7ad0b174b",
+            "md5": "570053f3c2f249bbcd220a6d51fd22ae",
+            "size": "14155281"
+        }
+    },
+    "cuda_cuxxfilt": {
+        "name": "CUDA cuxxfilt (demangler)",
+        "license": "CUDA Toolkit",
+        "license_path": "cuda_cuxxfilt/LICENSE.txt",
+        "version": "13.3.29",
+        "linux-x86_64": {
+            "relative_path": "cuda_cuxxfilt/linux-x86_64/cuda_cuxxfilt-linux-x86_64-13.3.29-archive.tar.xz",
+            "sha256": "3f15ed0e6b9673d30c4085e7d3819d1e4c17b09056ba5e8aa8eda351c27f5849",
+            "md5": "7feab9b5c9b2f28f9d4d7c6a7d7a33a8",
+            "size": "53156"
+        },
+        "linux-sbsa": {
+            "relative_path": "cuda_cuxxfilt/linux-sbsa/cuda_cuxxfilt-linux-sbsa-13.3.29-archive.tar.xz",
+            "sha256": "e68d8dcf348e8c8edcedac949f513138d62fb83cfea0a111c2571c602046ab56",
+            "md5": "6a64b7aaac3ba45e9f510cf68b5f3e63",
+            "size": "123652"
+        },
+        "windows-x86_64": {
+            "relative_path": "cuda_cuxxfilt/windows-x86_64/cuda_cuxxfilt-windows-x86_64-13.3.29-archive.zip",
+            "sha256": "f93a59c6086497603ddec4cd266bb4f5203138109af0a5e14304da3ee12431bd",
+            "md5": "7133f4bf4bc4a4fbe45a6025e3bf6000",
+            "size": "187616"
+        }
+    },
+    "cuda_documentation": {
+        "name": "CUDA Documentation",
+        "license": "CUDA Toolkit",
+        "license_path": "cuda_documentation/LICENSE.txt",
+        "version": "13.3.40",
+        "linux-x86_64": {
+            "relative_path": "cuda_documentation/linux-x86_64/cuda_documentation-linux-x86_64-13.3.40-archive.tar.xz",
+            "sha256": "92c7aba36c7d51ed0e8067c4323e7f8dc480313798dbe0082289c6b2e60e3aaf",
+            "md5": "6aed8141e3f47d03a3eb95110aeb42ca",
+            "size": "68060"
+        },
+        "linux-sbsa": {
+            "relative_path": "cuda_documentation/linux-sbsa/cuda_documentation-linux-sbsa-13.3.40-archive.tar.xz",
+            "sha256": "690ed0a1c678bf53450693b8dfd96495b7bc8d8cc748b4d5ac054f0f8c5a7b00",
+            "md5": "0b781999ed9d4b703e6e9c76651a251e",
+            "size": "67936"
+        },
+        "windows-x86_64": {
+            "relative_path": "cuda_documentation/windows-x86_64/cuda_documentation-windows-x86_64-13.3.40-archive.zip",
+            "sha256": "2b5ae2b7cd30eb224748e499104d4f362e4c19ece723b984cb05632854ce0e91",
+            "md5": "bb8e3a87423f4476cfb5b171e4d3a12d",
+            "size": "108113"
+        }
+    },
+    "cuda_gdb": {
+        "name": "CUDA GDB",
+        "license": "CUDA Toolkit",
+        "license_path": "cuda_gdb/LICENSE.txt",
+        "version": "13.3.27",
+        "linux-x86_64": {
+            "relative_path": "cuda_gdb/linux-x86_64/cuda_gdb-linux-x86_64-13.3.27-archive.tar.xz",
+            "sha256": "4dd9e2f93ff27c19a5536e10d73d8b209efd5cb73f59abca9d04de4c6c837ce3",
+            "md5": "5dd39f28f36647aef1226771002a64e8",
+            "size": "94457824"
+        },
+        "linux-sbsa": {
+            "relative_path": "cuda_gdb/linux-sbsa/cuda_gdb-linux-sbsa-13.3.27-archive.tar.xz",
+            "sha256": "5ca08ce62a5dc1a2c6810e5ab4caeb52eac91a58cc7077e33ed0ce1cfee486fe",
+            "md5": "507fbf8c57eb90b6987f42d70e7367ff",
+            "size": "92121232"
+        }
+    },
+    "cuda_nvcc": {
+        "name": "CUDA NVCC",
+        "license": "CUDA Toolkit",
+        "license_path": "cuda_nvcc/LICENSE.txt",
+        "version": "13.3.33",
+        "linux-x86_64": {
+            "relative_path": "cuda_nvcc/linux-x86_64/cuda_nvcc-linux-x86_64-13.3.33-archive.tar.xz",
+            "sha256": "93b098bda4a562ebf3541523ce82adc43f106a81dcf28bcbf8f0d8e093d1c66f",
+            "md5": "5180c45363243f1bce6db068e39b7080",
+            "size": "31609400"
+        },
+        "linux-sbsa": {
+            "relative_path": "cuda_nvcc/linux-sbsa/cuda_nvcc-linux-sbsa-13.3.33-archive.tar.xz",
+            "sha256": "b5dde44aadd52234af3944ae3b2e74e811ad8e71fb600bcc9dfe6d8540353499",
+            "md5": "c8e7d692a7622d4cde9f7ad42a4d171d",
+            "size": "27194924"
+        },
+        "windows-x86_64": {
+            "relative_path": "cuda_nvcc/windows-x86_64/cuda_nvcc-windows-x86_64-13.3.33-archive.zip",
+            "sha256": "8fed1ab69ed4e637ad76baff572579630674df9ff02570777800782ee5bdfbc5",
+            "md5": "80e4219a2e7cf34ac41921635c2fdc50",
+            "size": "31959263"
+        }
+    },
+    "cuda_nvdisasm": {
+        "name": "CUDA nvdisasm",
+        "license": "CUDA Toolkit",
+        "license_path": "cuda_nvdisasm/LICENSE.txt",
+        "version": "13.3.29",
+        "linux-x86_64": {
+            "relative_path": "cuda_nvdisasm/linux-x86_64/cuda_nvdisasm-linux-x86_64-13.3.29-archive.tar.xz",
+            "sha256": "95b7f617ea11bb983a7150827a14ff4488cba10f0171fa8ae2e845bd58823456",
+            "md5": "ecdd21125da5c35e0ac8cc05bc215151",
+            "size": "4658696"
+        },
+        "linux-sbsa": {
+            "relative_path": "cuda_nvdisasm/linux-sbsa/cuda_nvdisasm-linux-sbsa-13.3.29-archive.tar.xz",
+            "sha256": "cfca0e327c62b3cc5701ee819558f3133312eb47c16118faa0bfe710f435ccc3",
+            "md5": "28b4fd0b4925c6f4f312d698e91fb7c0",
+            "size": "4597352"
+        },
+        "windows-x86_64": {
+            "relative_path": "cuda_nvdisasm/windows-x86_64/cuda_nvdisasm-windows-x86_64-13.3.29-archive.zip",
+            "sha256": "b37b06979b064e51207d6761c575a68c5e5adb1f213f014551870a995b5c17e3",
+            "md5": "08e452b44299f597edb44a9d1bea7191",
+            "size": "4999385"
+        }
+    },
+    "cuda_nvml_dev": {
+        "name": "CUDA NVML Headers",
+        "license": "CUDA Toolkit",
+        "license_path": "cuda_nvml_dev/LICENSE.txt",
+        "version": "13.3.29",
+        "linux-x86_64": {
+            "relative_path": "cuda_nvml_dev/linux-x86_64/cuda_nvml_dev-linux-x86_64-13.3.29-archive.tar.xz",
+            "sha256": "b62508923dadc0ac79fb1846eeb444296813cb077964e0c8348ba051bc0160aa",
+            "md5": "5b66664cf14c83d1f471ce4eea0e7b15",
+            "size": "149668"
+        },
+        "linux-sbsa": {
+            "relative_path": "cuda_nvml_dev/linux-sbsa/cuda_nvml_dev-linux-sbsa-13.3.29-archive.tar.xz",
+            "sha256": "40d290c2fbabc3b559c8f5083a86adbb331a76e556914b2c46a0f0d11ca51494",
+            "md5": "bf4e59e6f0b1afbb9235bf06bc837c68",
+            "size": "151908"
+        },
+        "windows-x86_64": {
+            "relative_path": "cuda_nvml_dev/windows-x86_64/cuda_nvml_dev-windows-x86_64-13.3.29-archive.zip",
+            "sha256": "4e1bd1c66dd66293c6d94b1ed2efa5065654533b36ccbc7477dc1f466dc3d65c",
+            "md5": "aed95a496ded8db99d0d5b152f9695bb",
+            "size": "174612"
+        }
+    },
+    "cuda_nvprune": {
+        "name": "CUDA nvprune",
+        "license": "CUDA Toolkit",
+        "license_path": "cuda_nvprune/LICENSE.txt",
+        "version": "13.3.29",
+        "linux-x86_64": {
+            "relative_path": "cuda_nvprune/linux-x86_64/cuda_nvprune-linux-x86_64-13.3.29-archive.tar.xz",
+            "sha256": "b6332053b5101260f08e048664414e09fbb4910238c0087a65d532b95ae9b35d",
+            "md5": "b3c77abbadbd660eca9d502a16d94a91",
+            "size": "524880"
+        },
+        "linux-sbsa": {
+            "relative_path": "cuda_nvprune/linux-sbsa/cuda_nvprune-linux-sbsa-13.3.29-archive.tar.xz",
+            "sha256": "bc530696300a966a04752d555f260178ac333c844a77ceff8f43103fe1cfa198",
+            "md5": "acf862448c8a5263470f04713f90e0e9",
+            "size": "481512"
+        },
+        "windows-x86_64": {
+            "relative_path": "cuda_nvprune/windows-x86_64/cuda_nvprune-windows-x86_64-13.3.29-archive.zip",
+            "sha256": "e3aed34d1368382172eb9b811000f71f5a6a00c0e0cfb96f9fc709dc1c3761ab",
+            "md5": "74e397b8523936b2c5de205d52db31ce",
+            "size": "2931160"
+        }
+    },
+    "cuda_nvrtc": {
+        "name": "CUDA NVRTC",
+        "license": "CUDA Toolkit",
+        "license_path": "cuda_nvrtc/LICENSE.txt",
+        "version": "13.3.33",
+        "linux-x86_64": {
+            "relative_path": "cuda_nvrtc/linux-x86_64/cuda_nvrtc-linux-x86_64-13.3.33-archive.tar.xz",
+            "sha256": "9e8f78278215babd1236b137252424ca7912c185bd093201f5d97f7dd763b74a",
+            "md5": "ac13e83622b3584dcd8011bcfcdcf935",
+            "size": "69662780"
+        },
+        "linux-sbsa": {
+            "relative_path": "cuda_nvrtc/linux-sbsa/cuda_nvrtc-linux-sbsa-13.3.33-archive.tar.xz",
+            "sha256": "d0502b25799be62a50b743c640e94a1722d20b1ee4ab70d697d71750f04d3b8a",
+            "md5": "11065c957e739f5c9839d20f8bf06a4e",
+            "size": "64965560"
+        },
+        "windows-x86_64": {
+            "relative_path": "cuda_nvrtc/windows-x86_64/cuda_nvrtc-windows-x86_64-13.3.33-archive.zip",
+            "sha256": "8519f678588610bf380ccaac130729aa1a624c407183e7ad9c319c19ecc63d2f",
+            "md5": "d0b0b28b765ace7adc6466343fcf1c35",
+            "size": "312126196"
+        }
+    },
+    "cuda_nvtx": {
+        "name": "CUDA NVTX",
+        "license": "CUDA Toolkit",
+        "license_path": "cuda_nvtx/LICENSE.txt",
+        "version": "13.3.29",
+        "linux-x86_64": {
+            "relative_path": "cuda_nvtx/linux-x86_64/cuda_nvtx-linux-x86_64-13.3.29-archive.tar.xz",
+            "sha256": "7c7c2567e35de98b5bf92bef06b97ccc90cd472ca44b9b1558b25812a54df64e",
+            "md5": "79c48db5a2faec2d676832651a0262b2",
+            "size": "97672"
+        },
+        "linux-sbsa": {
+            "relative_path": "cuda_nvtx/linux-sbsa/cuda_nvtx-linux-sbsa-13.3.29-archive.tar.xz",
+            "sha256": "7c5bad2972e8d8fb701fe3f3241bdfd04ea6c78bfdc2c1eff04e03eb8d11153a",
+            "md5": "bddbce23d42bbb376c8f55c9c815206c",
+            "size": "98180"
+        },
+        "windows-x86_64": {
+            "relative_path": "cuda_nvtx/windows-x86_64/cuda_nvtx-windows-x86_64-13.3.29-archive.zip",
+            "sha256": "027baa3516c9a9c8512721e9bb3d0415c6d6bde93ec9521fa1d39a413f9f1844",
+            "md5": "39203e6bdcfbfcb281ac998168998310",
+            "size": "152549"
+        }
+    },
+    "cuda_opencl": {
+        "name": "CUDA OpenCL",
+        "license": "CUDA Toolkit",
+        "license_path": "cuda_opencl/LICENSE.txt",
+        "version": "13.3.27",
+        "linux-x86_64": {
+            "relative_path": "cuda_opencl/linux-x86_64/cuda_opencl-linux-x86_64-13.3.27-archive.tar.xz",
+            "sha256": "37ff303c2ceb712c54b5ef7198df736fa50c934e318164b01493c4621786e860",
+            "md5": "30121c811a242d224f0fffb19033117c",
+            "size": "95168"
+        },
+        "windows-x86_64": {
+            "relative_path": "cuda_opencl/windows-x86_64/cuda_opencl-windows-x86_64-13.3.27-archive.zip",
+            "sha256": "c41a4eac45e0d0633800a199143d414352ee29bc172ede3448ae708dfad423bc",
+            "md5": "724db8ff19d56f5147ea8bea68f6965b",
+            "size": "140991"
+        }
+    },
+    "cuda_profiler_api": {
+        "name": "CUDA Profiler API",
+        "license": "CUDA Toolkit",
+        "license_path": "cuda_profiler_api/LICENSE.txt",
+        "version": "13.3.27",
+        "linux-x86_64": {
+            "relative_path": "cuda_profiler_api/linux-x86_64/cuda_profiler_api-linux-x86_64-13.3.27-archive.tar.xz",
+            "sha256": "5aa4df91651f19c2c7c3ac0531cdcd96e18f5227a60efb81b18ca282be719780",
+            "md5": "3b2b3528b30d087fd744fb92ebaa7d80",
+            "size": "17112"
+        },
+        "linux-sbsa": {
+            "relative_path": "cuda_profiler_api/linux-sbsa/cuda_profiler_api-linux-sbsa-13.3.27-archive.tar.xz",
+            "sha256": "527d1c76abe450d110af6404da6db18fd507b8e47af69cb2ed69348925b95fa8",
+            "md5": "152347068b8a04555aab1d2c2709f517",
+            "size": "17112"
+        },
+        "windows-x86_64": {
+            "relative_path": "cuda_profiler_api/windows-x86_64/cuda_profiler_api-windows-x86_64-13.3.27-archive.zip",
+            "sha256": "b41e9634dee36a7c31e121f636c43ba8b461de03de678bcb918060bd352fa2b8",
+            "md5": "72f95826e266670dc0ae93dbf47f6729",
+            "size": "21250"
+        }
+    },
+    "cuda_sandbox_dev": {
+        "name": "CUDA nvsandboxutils Headers",
+        "license": "CUDA Toolkit",
+        "license_path": "cuda_sandbox_dev/LICENSE.txt",
+        "version": "13.3.29",
+        "linux-x86_64": {
+            "relative_path": "cuda_sandbox_dev/linux-x86_64/cuda_sandbox_dev-linux-x86_64-13.3.29-archive.tar.xz",
+            "sha256": "8db6e04caf7c9d395564672f50b39ecee96c05a4bd1ec01381f8850f2bf56e93",
+            "md5": "537efb12127cb3aaca286b81faf3b0ae",
+            "size": "30272"
+        },
+        "linux-sbsa": {
+            "relative_path": "cuda_sandbox_dev/linux-sbsa/cuda_sandbox_dev-linux-sbsa-13.3.29-archive.tar.xz",
+            "sha256": "ab4dcd020a4fe2b7d52532217c5de04a74a7ef173194c80aa0572b0748c899da",
+            "md5": "831cfc4c9478684c8a3bbc241d452616",
+            "size": "30840"
+        }
+    },
+    "cuda_sanitizer_api": {
+        "name": "CUDA Compute Sanitizer API",
+        "license": "CUDA Toolkit",
+        "license_path": "cuda_sanitizer_api/LICENSE.txt",
+        "version": "13.3.27",
+        "linux-x86_64": {
+            "relative_path": "cuda_sanitizer_api/linux-x86_64/cuda_sanitizer_api-linux-x86_64-13.3.27-archive.tar.xz",
+            "sha256": "bed47e6b465653a8d4138bce412733131536f1a0e8ab306bb2b0a15f92fc68ff",
+            "md5": "de29c011504be19cabc145101730f711",
+            "size": "10713868"
+        },
+        "linux-sbsa": {
+            "relative_path": "cuda_sanitizer_api/linux-sbsa/cuda_sanitizer_api-linux-sbsa-13.3.27-archive.tar.xz",
+            "sha256": "0624446464032a03f07a786330986b7d9148526258efedb1684ffe3bfa8e3d0d",
+            "md5": "bbc819d072a4cd85baddb251339630a0",
+            "size": "7638968"
+        },
+        "windows-x86_64": {
+            "relative_path": "cuda_sanitizer_api/windows-x86_64/cuda_sanitizer_api-windows-x86_64-13.3.27-archive.zip",
+            "sha256": "7751762461f59598e526dcbcb1c30384d3f231ebf68d25db9122f848d488266d",
+            "md5": "8b15f6a7d4565cb976863653ca286727",
+            "size": "10801193"
+        }
+    },
+    "cuda_tileiras": {
+        "name": "CUDA TileIR",
+        "license": "CUDA Toolkit",
+        "license_path": "cuda_tileiras/LICENSE.txt",
+        "version": "13.3.36",
+        "linux-x86_64": {
+            "relative_path": "cuda_tileiras/linux-x86_64/cuda_tileiras-linux-x86_64-13.3.36-archive.tar.xz",
+            "sha256": "1b055db199f806c746d53331200ccd8480bfdddd14638ed2911f30ee0cc4447b",
+            "md5": "bfa43ba99ba70fb44b2426092a980646",
+            "size": "26178188"
+        },
+        "linux-sbsa": {
+            "relative_path": "cuda_tileiras/linux-sbsa/cuda_tileiras-linux-sbsa-13.3.36-archive.tar.xz",
+            "sha256": "98d163bd49de3c06fc179e5534fe4d8d5e1ad65800bf8696f79d2aeccafa039e",
+            "md5": "c0d455d4f799d2d489905b2d4e6ed14d",
+            "size": "23778572"
+        },
+        "windows-x86_64": {
+            "relative_path": "cuda_tileiras/windows-x86_64/cuda_tileiras-windows-x86_64-13.3.36-archive.zip",
+            "sha256": "14cda835eca0121e8f82f60cb03e8584dc8cd584248f9e0827d5a11c0dae6fe8",
+            "md5": "1d68bfcdeb39d3049a5c911d0fbfd5c9",
+            "size": "28930771"
+        }
+    },
+    "fabricmanager": {
+        "name": "NVIDIA Fabric Manager",
+        "license": "NVIDIA Driver",
+        "license_path": "fabricmanager/LICENSE.txt",
+        "version": "610.43.02",
+        "linux-x86_64": {
+            "relative_path": "fabricmanager/linux-x86_64/fabricmanager-linux-x86_64-610.43.02-archive.tar.xz",
+            "sha256": "9dc65963009dc504cb6a36c009bb1a8c49904781129cb45204fa3d009f3f0062",
+            "md5": "433a4bde5f94a3979f3db9e15f441fc0",
+            "size": "8943604"
+        },
+        "linux-sbsa": {
+            "relative_path": "fabricmanager/linux-sbsa/fabricmanager-linux-sbsa-610.43.02-archive.tar.xz",
+            "sha256": "a38884892c4f03a0f6894cff55ad844e98267166b98e8b6661cc4a65ba6be64e",
+            "md5": "8b6f9cc8c7db39090f02aa6e7306d5c9",
+            "size": "8151708"
+        }
+    },
+    "imex": {
+        "name": "NVIDIA IMEX",
+        "license": "NVIDIA Driver",
+        "license_path": "imex/LICENSE.txt",
+        "version": "610.43.02",
+        "linux-x86_64": {
+            "relative_path": "imex/linux-x86_64/imex-linux-x86_64-610.43.02-archive.tar.xz",
+            "sha256": "1e7b173681d4e1828f9b936c9f5cc241d49b2dcb416bbbc129e88e8fe9fe9e5e",
+            "md5": "a5c9803dbed4d83775b650a4571ac080",
+            "size": "7846232"
+        },
+        "linux-sbsa": {
+            "relative_path": "imex/linux-sbsa/imex-linux-sbsa-610.43.02-archive.tar.xz",
+            "sha256": "f73dcde590df13ae63f7b7b7c00b01013e018494dfcace9dfab5796d140ae56b",
+            "md5": "c36275e726c4738da0d2c9d5c5832727",
+            "size": "7293104"
+        }
+    },
+    "libcublas": {
+        "name": "CUDA cuBLAS",
+        "license": "CUDA Toolkit",
+        "license_path": "libcublas/LICENSE.txt",
+        "version": "13.5.1.27",
+        "linux-x86_64": {
+            "relative_path": "libcublas/linux-x86_64/libcublas-linux-x86_64-13.5.1.27-archive.tar.xz",
+            "sha256": "35a898360520d6101ffcaf36c0d04496b54d4fc2afb82f7fce44218c54513808",
+            "md5": "0e8730cdd4d74668779129a4452cd23f",
+            "size": "813601980"
+        },
+        "linux-sbsa": {
+            "relative_path": "libcublas/linux-sbsa/libcublas-linux-sbsa-13.5.1.27-archive.tar.xz",
+            "sha256": "cdcfea21e8a68ce90c87aaf2e424883782dafb4792feb4e6ea903b97e9aeb6a7",
+            "md5": "3689c2f4e63b9923a412407d2a1a8c43",
+            "size": "1026346616"
+        },
+        "windows-x86_64": {
+            "relative_path": "libcublas/windows-x86_64/libcublas-windows-x86_64-13.5.1.27-archive.zip",
+            "sha256": "c946e1c825e05895747a95ed4fee18030b08052c09783b9b7b19818fd2e31f58",
+            "md5": "033b2cc750213afc19e7409fbbc85686",
+            "size": "391055517"
+        }
+    },
+    "libcudla": {
+        "name": "cuDLA",
+        "license": "CUDA Toolkit",
+        "license_path": "libcudla/LICENSE.txt",
+        "version": "13.3.29",
+        "linux-sbsa": {
+            "relative_path": "libcudla/linux-sbsa/libcudla-linux-sbsa-13.3.29-archive.tar.xz",
+            "sha256": "db426590f53be48fb1c843e73c00dda08c7aeeacc29e3b01ce71e1e91e58d818",
+            "md5": "e1b12c617186ca3ba2d76dfdf607e72e",
+            "size": "42028"
+        }
+    },
+    "libcufft": {
+        "name": "CUDA cuFFT",
+        "license": "CUDA Toolkit",
+        "license_path": "libcufft/LICENSE.txt",
+        "version": "12.3.0.29",
+        "linux-x86_64": {
+            "relative_path": "libcufft/linux-x86_64/libcufft-linux-x86_64-12.3.0.29-archive.tar.xz",
+            "sha256": "b2404952a5d630fbbc13e12d36975ef87a9c05c71c321c2cb5b3820789e47462",
+            "md5": "dd43c0c44d3304029a08d95781fa7d1f",
+            "size": "294625872"
+        },
+        "linux-sbsa": {
+            "relative_path": "libcufft/linux-sbsa/libcufft-linux-sbsa-12.3.0.29-archive.tar.xz",
+            "sha256": "59cab9753d0e025b9bfebda843555b1bbf99d9ea2d4a8eaa87a1185610b068e4",
+            "md5": "70bef00ee3ff9d4b2486e093d67e0272",
+            "size": "294751896"
+        },
+        "windows-x86_64": {
+            "relative_path": "libcufft/windows-x86_64/libcufft-windows-x86_64-12.3.0.29-archive.zip",
+            "sha256": "83df908ae67e2b3a86201de8463562ab49dd9ee8b3b5efc3fdc2e681b14b5dd9",
+            "md5": "7eca9509a39aa662d75d3834d3c9cb42",
+            "size": "182627436"
+        }
+    },
+    "libcufile": {
+        "name": "CUDA cuFile",
+        "license": "CUDA Toolkit",
+        "license_path": "libcufile/LICENSE.txt",
+        "version": "1.18.0.66",
+        "linux-x86_64": {
+            "relative_path": "libcufile/linux-x86_64/libcufile-linux-x86_64-1.18.0.66-archive.tar.xz",
+            "sha256": "be4b6376f9e407176f5bc1802c873a79ba629bc2b0b928a7b059471ef0d90081",
+            "md5": "334c0eda90cf63bdd8c02b34d6fec3df",
+            "size": "44452356"
+        },
+        "linux-sbsa": {
+            "relative_path": "libcufile/linux-sbsa/libcufile-linux-sbsa-1.18.0.66-archive.tar.xz",
+            "sha256": "197ee55e3882016106c6c3007c71a30f01393ec61a2497f1bad0bd411e2edf1a",
+            "md5": "06f414cf6351a51dbebf1149248152ce",
+            "size": "44006480"
+        }
+    },
+    "libcuobjclient": {
+        "name": "CUDA cuObject Client",
+        "license": "CUDA Toolkit",
+        "license_path": "libcuobjclient/LICENSE.txt",
+        "version": "1.2.0.59",
+        "linux-x86_64": {
+            "relative_path": "libcuobjclient/linux-x86_64/libcuobjclient-linux-x86_64-1.2.0.59-archive.tar.xz",
+            "sha256": "72a07d05c79bedc8b20a6a41e7ecf9ece63908a6ae946219110a6688db9b82a0",
+            "md5": "b24aff2770bc8b1553341fd32c1cd284",
+            "size": "62812"
+        },
+        "linux-sbsa": {
+            "relative_path": "libcuobjclient/linux-sbsa/libcuobjclient-linux-sbsa-1.2.0.59-archive.tar.xz",
+            "sha256": "b78b3e704303f56dfddc9411a43f40adad3951b301180549fe7d9b7809905efb",
+            "md5": "d11b062d1fb2dc93f710569ee2fe373c",
+            "size": "64568"
+        }
+    },
+    "libcurand": {
+        "name": "CUDA cuRAND",
+        "license": "CUDA Toolkit",
+        "license_path": "libcurand/LICENSE.txt",
+        "version": "10.4.3.29",
+        "linux-x86_64": {
+            "relative_path": "libcurand/linux-x86_64/libcurand-linux-x86_64-10.4.3.29-archive.tar.xz",
+            "sha256": "0218e62ab413e435dcd0274ec8e63b62214e6aba8519201061d1597e73caadbb",
+            "md5": "954923b7638795a6bd45bfa4ed1d295c",
+            "size": "86740648"
+        },
+        "linux-sbsa": {
+            "relative_path": "libcurand/linux-sbsa/libcurand-linux-sbsa-10.4.3.29-archive.tar.xz",
+            "sha256": "3c2245e848ff8948663646ad7870cc8451b7cf1726758bedff7c123011126e4b",
+            "md5": "2dc049a2a5317e8cba47074ba0c233e2",
+            "size": "87533932"
+        },
+        "windows-x86_64": {
+            "relative_path": "libcurand/windows-x86_64/libcurand-windows-x86_64-10.4.3.29-archive.zip",
+            "sha256": "d3c518485188990666cf9ad848dab40cd0f686a6760344a52fc9eed24acc5b49",
+            "md5": "04c07f76f70b1f2357ca97577b394b31",
+            "size": "54953801"
+        }
+    },
+    "libcusolver": {
+        "name": "CUDA cuSOLVER",
+        "license": "CUDA Toolkit",
+        "license_path": "libcusolver/LICENSE.txt",
+        "version": "12.2.2.18",
+        "linux-x86_64": {
+            "relative_path": "libcusolver/linux-x86_64/libcusolver-linux-x86_64-12.2.2.18-archive.tar.xz",
+            "sha256": "100b49bc0b6372fe17c1fea3400dbb4cd12313ad326dea516fa26eb1d20c1a32",
+            "md5": "592d715694a68c8a844c542eac593edd",
+            "size": "296666388"
+        },
+        "linux-sbsa": {
+            "relative_path": "libcusolver/linux-sbsa/libcusolver-linux-sbsa-12.2.2.18-archive.tar.xz",
+            "sha256": "d10bee9fe0f521125617a653ce9c5934dd59eabd8459b628b6a3bf80baa1bc3a",
+            "md5": "8aa4b30de616d7b7722aec3fd2586fcd",
+            "size": "325593460"
+        },
+        "windows-x86_64": {
+            "relative_path": "libcusolver/windows-x86_64/libcusolver-windows-x86_64-12.2.2.18-archive.zip",
+            "sha256": "1a25d1671bcbc96aefe481549a5f61563bc022f3aebb5bc598f70d727d69d7bb",
+            "md5": "c3ac89e465d86aa96d81c9b99e263b7c",
+            "size": "218734586"
+        }
+    },
+    "libcusparse": {
+        "name": "CUDA cuSPARSE",
+        "license": "CUDA Toolkit",
+        "license_path": "libcusparse/LICENSE.txt",
+        "version": "12.8.1.7",
+        "linux-x86_64": {
+            "relative_path": "libcusparse/linux-x86_64/libcusparse-linux-x86_64-12.8.1.7-archive.tar.xz",
+            "sha256": "c258aab32bd5c3f19eb9e82be368501b8e24c21d5825f2ab86473008a26ba0c7",
+            "md5": "4e4632049c8074a84464c63aff38d310",
+            "size": "292786388"
+        },
+        "linux-sbsa": {
+            "relative_path": "libcusparse/linux-sbsa/libcusparse-linux-sbsa-12.8.1.7-archive.tar.xz",
+            "sha256": "b23a486db30b80cd692e701e3f5eb77a2b96cb88292b1b588eac05100f82f72b",
+            "md5": "9caaf45428dbf96aa835188c851285eb",
+            "size": "325537280"
+        },
+        "windows-x86_64": {
+            "relative_path": "libcusparse/windows-x86_64/libcusparse-windows-x86_64-12.8.1.7-archive.zip",
+            "sha256": "bfd1e9f3db523f7a1e77ab47cddb41a7bd85d65070191926012153b19473507e",
+            "md5": "f0ea33c109da49d634162d523e4023e1",
+            "size": "152435128"
+        }
+    },
+    "libnpp": {
+        "name": "CUDA NPP",
+        "license": "CUDA Toolkit",
+        "license_path": "libnpp/LICENSE.txt",
+        "version": "13.1.2.48",
+        "linux-x86_64": {
+            "relative_path": "libnpp/linux-x86_64/libnpp-linux-x86_64-13.1.2.48-archive.tar.xz",
+            "sha256": "12fefdcae4c94a7b977b399b87b2a717ce8a11464a7ed55b8b2518c3261c08b4",
+            "md5": "bd55422fd7f2a3d5b3386be23111a798",
+            "size": "231516464"
+        },
+        "linux-sbsa": {
+            "relative_path": "libnpp/linux-sbsa/libnpp-linux-sbsa-13.1.2.48-archive.tar.xz",
+            "sha256": "8be40578e204d8c51bfb3f0d16631fd621bb1e7bded513d7f6e9c840afacaf3f",
+            "md5": "2d7a5fb8917309676ffc720d1812b76f",
+            "size": "261396648"
+        },
+        "windows-x86_64": {
+            "relative_path": "libnpp/windows-x86_64/libnpp-windows-x86_64-13.1.2.48-archive.zip",
+            "sha256": "d969a0ba5cf4424036557eac08b23cd2668d812cb5c5d5a5cd46b71c8fcfb598",
+            "md5": "8850c1bfc5d4b4d5f4f1c530f68f8aad",
+            "size": "132208702"
+        }
+    },
+    "libnvfatbin": {
+        "name": "NVIDIA compiler library for fatbin interaction",
+        "license": "CUDA Toolkit",
+        "license_path": "libnvfatbin/LICENSE.txt",
+        "version": "13.3.29",
+        "linux-x86_64": {
+            "relative_path": "libnvfatbin/linux-x86_64/libnvfatbin-linux-x86_64-13.3.29-archive.tar.xz",
+            "sha256": "f3e933b61a26f7b1f8b053bac4a66193e115b006911e2e493623ca01ec8560d4",
+            "md5": "cfdcbf4064fc32b26cbaeec53cc212b4",
+            "size": "466904"
+        },
+        "linux-sbsa": {
+            "relative_path": "libnvfatbin/linux-sbsa/libnvfatbin-linux-sbsa-13.3.29-archive.tar.xz",
+            "sha256": "d53e2c95f6817bfce9b7665ba29f47b5909aab6f3416c3b106e1ed7a575022c7",
+            "md5": "e95b09bec3f1a6d0dd217be575f460ce",
+            "size": "433872"
+        },
+        "windows-x86_64": {
+            "relative_path": "libnvfatbin/windows-x86_64/libnvfatbin-windows-x86_64-13.3.29-archive.zip",
+            "sha256": "95197dc49b931b2c0fa8bbd30dbb65a9ceb22a8b7af1f84994d6aadd868763a1",
+            "md5": "2c61dab2246f7df4a1442a17581bfbb3",
+            "size": "2312812"
+        }
+    },
+    "libnvidia_nscq": {
+        "name": "NVIDIA NSCQ API",
+        "license": "NVIDIA Driver",
+        "license_path": "libnvidia_nscq/LICENSE.txt",
+        "version": "610.43.02",
+        "linux-x86_64": {
+            "relative_path": "libnvidia_nscq/linux-x86_64/libnvidia_nscq-linux-x86_64-610.43.02-archive.tar.xz",
+            "sha256": "f136a46438acc2cd35df2bce3accec3381791b931272c450a8f1ca52509ce9d8",
+            "md5": "fd02efa1d7d88aebcd7120261d17f58e",
+            "size": "380332"
+        },
+        "linux-sbsa": {
+            "relative_path": "libnvidia_nscq/linux-sbsa/libnvidia_nscq-linux-sbsa-610.43.02-archive.tar.xz",
+            "sha256": "1976fd26883b12a0fb9a131b7db2bc84794fbb33aaa20486b1f422585bebd095",
+            "md5": "a497be97aa276c91a6418f3c9b57400c",
+            "size": "350924"
+        }
+    },
+    "libnvjitlink": {
+        "name": "NVIDIA compiler library for JIT LTO functionality",
+        "license": "CUDA Toolkit",
+        "license_path": "libnvjitlink/LICENSE.txt",
+        "version": "13.3.33",
+        "linux-x86_64": {
+            "relative_path": "libnvjitlink/linux-x86_64/libnvjitlink-linux-x86_64-13.3.33-archive.tar.xz",
+            "sha256": "f79e25bb1ef2f22f26c09897f6cb8719634f38e7330bd4700a1ea9ec9591eaff",
+            "md5": "d303fb60c2d1fcc172fce7fd5111926a",
+            "size": "56144284"
+        },
+        "linux-sbsa": {
+            "relative_path": "libnvjitlink/linux-sbsa/libnvjitlink-linux-sbsa-13.3.33-archive.tar.xz",
+            "sha256": "6ed3a14646bd53e25ccf03a52586cdd12b07ad48cf81fe79deac49b5d64c2ce6",
+            "md5": "9b6ac759fda0938882ac529aa216b1f6",
+            "size": "51761056"
+        },
+        "windows-x86_64": {
+            "relative_path": "libnvjitlink/windows-x86_64/libnvjitlink-windows-x86_64-13.3.33-archive.zip",
+            "sha256": "43bc22509507c138c86885191bb2709b5d23506ea6abdc8bc64d9960e2b63363",
+            "md5": "e90cea350b27b1671311cc1034b9ea85",
+            "size": "274601597"
+        }
+    },
+    "libnvjpeg": {
+        "name": "CUDA nvJPEG",
+        "license": "CUDA Toolkit",
+        "license_path": "libnvjpeg/LICENSE.txt",
+        "version": "13.2.0.21",
+        "linux-x86_64": {
+            "relative_path": "libnvjpeg/linux-x86_64/libnvjpeg-linux-x86_64-13.2.0.21-archive.tar.xz",
+            "sha256": "2296fcb2b6fbbe6a9dbeca987568e22ed63ccb793f6638bfe14d40e010f76e6f",
+            "md5": "ba096666ef14f414cb5f92c756c9c598",
+            "size": "3713788"
+        },
+        "linux-sbsa": {
+            "relative_path": "libnvjpeg/linux-sbsa/libnvjpeg-linux-sbsa-13.2.0.21-archive.tar.xz",
+            "sha256": "dd4a37f1b7caa9ffd81feb5c2e0d3b17f3f1bcf0b13abd5f44083ccd637376f5",
+            "md5": "85af0e7a0fe14d47ed4f089781a4d9a7",
+            "size": "3559564"
+        },
+        "windows-x86_64": {
+            "relative_path": "libnvjpeg/windows-x86_64/libnvjpeg-windows-x86_64-13.2.0.21-archive.zip",
+            "sha256": "13ee3e7db636eb516769bdc6dba7064cf7ca6e13cec6f4e78bb0ca75ee65f896",
+            "md5": "3260c426b0dbd18e07dfa06cf3658a3d",
+            "size": "3204557"
+        }
+    },
+    "libnvptxcompiler": {
+        "name": "CUDA libnvptxcompiler",
+        "license": "CUDA Toolkit",
+        "license_path": "libnvptxcompiler/LICENSE.txt",
+        "version": "13.3.33",
+        "linux-x86_64": {
+            "relative_path": "libnvptxcompiler/linux-x86_64/libnvptxcompiler-linux-x86_64-13.3.33-archive.tar.xz",
+            "sha256": "6c362578a8de750d28ae52efe5b3d2927983584293a9be24d40893e0f6ed73dd",
+            "md5": "c678e9d8f6cf39d620cb06c1f2d88ff9",
+            "size": "10228368"
+        },
+        "linux-sbsa": {
+            "relative_path": "libnvptxcompiler/linux-sbsa/libnvptxcompiler-linux-sbsa-13.3.33-archive.tar.xz",
+            "sha256": "3d61e77b3c1317bfc8d6807eee1137b232fdd109d5c7c9b91d0d3e1e05ea38c3",
+            "md5": "b7022375b780379f240bd1410d371b4d",
+            "size": "9772264"
+        },
+        "windows-x86_64": {
+            "relative_path": "libnvptxcompiler/windows-x86_64/libnvptxcompiler-windows-x86_64-13.3.33-archive.zip",
+            "sha256": "7bc5ffd885fb96b07fd8a601a3a7ebe06612730ca5453a6dda9197a848e84998",
+            "md5": "ad151e4d8709b1287084521cd04fd08a",
+            "size": "48105367"
+        }
+    },
+    "libnvsdm": {
+        "name": "NVSDM",
+        "license": "NVIDIA Driver",
+        "license_path": "libnvsdm/LICENSE.txt",
+        "version": "610.43.02",
+        "linux-x86_64": {
+            "relative_path": "libnvsdm/linux-x86_64/libnvsdm-linux-x86_64-610.43.02-archive.tar.xz",
+            "sha256": "b9400cbfab89d8ff021305ace85feb4db293894f3acddb0046dfaaa94ce39f56",
+            "md5": "423dafa682e48d0fa990526d5b51b3aa",
+            "size": "507772"
+        }
+    },
+    "libnvvm": {
+        "name": "CUDA NVVM",
+        "license": "CUDA Toolkit",
+        "license_path": "libnvvm/LICENSE.txt",
+        "version": "13.3.33",
+        "linux-x86_64": {
+            "relative_path": "libnvvm/linux-x86_64/libnvvm-linux-x86_64-13.3.33-archive.tar.xz",
+            "sha256": "fc9c1fd5844e44c0e5eeb051378c1b13cf0e3bb3fe4966d5103c38885424f802",
+            "md5": "422e0db4d9a8b03471e7379618f38210",
+            "size": "49180068"
+        },
+        "linux-sbsa": {
+            "relative_path": "libnvvm/linux-sbsa/libnvvm-linux-sbsa-13.3.33-archive.tar.xz",
+            "sha256": "5f8ca5c9a10c3c9804b045960ee6192281efec4c7d83d5f3245ec2de8612118e",
+            "md5": "94e9d15bcabe573fc5e8258617af39f6",
+            "size": "44055652"
+        },
+        "windows-x86_64": {
+            "relative_path": "libnvvm/windows-x86_64/libnvvm-windows-x86_64-13.3.33-archive.zip",
+            "sha256": "e8e48fcceb3ffeb3e421f29fc40252580c6dfd2a841bea3490782233048a5f00",
+            "md5": "143904101490b3a7eb86e9bb685f1e0e",
+            "size": "58567644"
+        }
+    },
+    "nsight_compute": {
+        "name": "Nsight Compute",
+        "license": "NVIDIA SLA",
+        "license_path": "nsight_compute/LICENSE.txt",
+        "version": "2026.2.0.7",
+        "linux-x86_64": {
+            "relative_path": "nsight_compute/linux-x86_64/nsight_compute-linux-x86_64-2026.2.0.7-archive.tar.xz",
+            "sha256": "706dec9b2fcf2cda2bc7af9d6f133ea544e6acb2d5b479e3dbe6ef45254d991c",
+            "md5": "e8922bd9a8faed465ed013c648466e97",
+            "size": "352815608"
+        },
+        "linux-sbsa": {
+            "relative_path": "nsight_compute/linux-sbsa/nsight_compute-linux-sbsa-2026.2.0.7-archive.tar.xz",
+            "sha256": "bda13a2a34ca046f25879afe58abd344708f9139cb6c01771c4f9b4016f8fe3b",
+            "md5": "e871098414b9a7cdf16bc4477a4eee1c",
+            "size": "127836712"
+        },
+        "windows-x86_64": {
+            "relative_path": "nsight_compute/windows-x86_64/nsight_compute-windows-x86_64-2026.2.0.7-archive.zip",
+            "sha256": "5ba8e740d1c64ab53f2a3356a73eaed34fd647deb66f7f7192b2a0cf3275f568",
+            "md5": "a3b91622e290ac7f6f19ed466c6e66a7",
+            "size": "438501723"
+        }
+    },
+    "nsight_systems": {
+        "name": "Nsight Systems",
+        "license": "NVIDIA SLA",
+        "license_path": "nsight_systems/LICENSE.txt",
+        "version": "2026.1.3.243",
+        "linux-x86_64": {
+            "relative_path": "nsight_systems/linux-x86_64/nsight_systems-linux-x86_64-2026.1.3.243-archive.tar.xz",
+            "sha256": "eb6849c6b54b816be08db9e57d9e508334322b099a73fa6f038eff8c82b7336f",
+            "md5": "c9555ee5edb8b2a923a9a81bbcc411a3",
+            "size": "1126988900"
+        },
+        "linux-sbsa": {
+            "relative_path": "nsight_systems/linux-sbsa/nsight_systems-linux-sbsa-2026.1.3.243-archive.tar.xz",
+            "sha256": "9d1e541109a0c97575614947000918f21e05953960833d39e19b88ba7e027254",
+            "md5": "dd28ce05751a8102172236e5f05123bb",
+            "size": "1158414564"
+        },
+        "windows-x86_64": {
+            "relative_path": "nsight_systems/windows-x86_64/nsight_systems-windows-x86_64-2026.1.3.243-archive.zip",
+            "sha256": "66a3093e1c79952a91569abbe45e27fd3059576dd5a6733cbadaf1ebb0dcc74a",
+            "md5": "9f1c420514c59e5cc38f6f4dd717125b",
+            "size": "533993929"
+        }
+    },
+    "nsight_vse": {
+        "name": "Nsight Visual Studio Edition (VSE)",
+        "license": "NVIDIA SLA",
+        "license_path": "nsight_vse/LICENSE.txt",
+        "version": "2026.2.0.26084",
+        "windows-x86_64": {
+            "relative_path": "nsight_vse/windows-x86_64/nsight_vse-windows-x86_64-2026.2.0.26084-archive.zip",
+            "sha256": "5cfb804c1ed8df6805ef9e440418280134a946cdcf418830e79a65a64c63e574",
+            "md5": "951592e8065698f65a55413fe5fdb49b",
+            "size": "76039086"
+        }
+    },
+    "nvidia_driver": {
+        "name": "NVIDIA Linux Driver",
+        "license": "NVIDIA Driver",
+        "license_path": "nvidia_driver/LICENSE.txt",
+        "version": "610.43.02",
+        "linux-x86_64": {
+            "relative_path": "nvidia_driver/linux-x86_64/nvidia_driver-linux-x86_64-610.43.02-archive.tar.xz",
+            "sha256": "3b6464c9af403206f51536879cdd0825038433a3307fcb0a5ec5be0b69a6f64c",
+            "md5": "b9f43f2690c0994b80502b1260fcce7f",
+            "size": "554589512"
+        },
+        "linux-sbsa": {
+            "relative_path": "nvidia_driver/linux-sbsa/nvidia_driver-linux-sbsa-610.43.02-archive.tar.xz",
+            "sha256": "40ad120751255171a343878c11d954e8aef7dd1422c343965aad9b7f9b00628f",
+            "md5": "bc0cba8366d96b20ca01c544828a4795",
+            "size": "413574520"
+        }
+    },
+    "nvidia_fs": {
+        "name": "NVIDIA filesystem",
+        "license": "CUDA Toolkit",
+        "license_path": "nvidia_fs/LICENSE.txt",
+        "version": "2.29.4",
+        "linux-x86_64": {
+            "relative_path": "nvidia_fs/linux-x86_64/nvidia_fs-linux-x86_64-2.29.4-archive.tar.xz",
+            "sha256": "b205136c3dbbaa72cc8335435fb68150271f9f69f02c77822e2e240cb5c80367",
+            "md5": "8f6a90cb063a956433f210b5fc1d4d5e",
+            "size": "66032"
+        },
+        "linux-sbsa": {
+            "relative_path": "nvidia_fs/linux-sbsa/nvidia_fs-linux-sbsa-2.29.4-archive.tar.xz",
+            "sha256": "5ffaed4fb044b4091ff9558153c5a0f559670438e0434af7bd99b9980d2a9734",
+            "md5": "bee4f30bce3e9d93a34350ac6b27ec02",
+            "size": "66020"
+        }
+    },
+    "nvlsm": {
+        "name": "NVLSM SM component",
+        "license": "NVIDIA Proprietary",
+        "license_path": "nvlsm/LICENSE.txt",
+        "version": "2025.10.12",
+        "linux-x86_64": {
+            "relative_path": "nvlsm/linux-x86_64/nvlsm-linux-x86_64-2025.10.12-archive.tar.xz",
+            "sha256": "613bb725644ea11c6d8e1c9f13c77022ebe4e701d399988dd81443cfd5441b6f",
+            "md5": "c82759a5755e8cb196690ec0861dc1f1",
+            "size": "10432272"
+        },
+        "linux-sbsa": {
+            "relative_path": "nvlsm/linux-sbsa/nvlsm-linux-sbsa-2025.10.12-archive.tar.xz",
+            "sha256": "320b3792a6b6ac0bd57e69327f03a185a83d6748f5483918c9d673987859472a",
+            "md5": "0a9af6f18b7137993180d06b47291b0e",
+            "size": "9522780"
+        }
+    },
+    "visual_studio_integration": {
+        "name": "CUDA Visual Studio Integration",
+        "license": "CUDA Toolkit",
+        "license_path": "visual_studio_integration/LICENSE.txt",
+        "version": "13.3.27",
+        "windows-x86_64": {
+            "relative_path": "visual_studio_integration/windows-x86_64/visual_studio_integration-windows-x86_64-13.3.27-archive.zip",
+            "sha256": "34f7b80e19833b176c3065c0a9c5bddfe74f13c50062abdf5b291da891e9c60c",
+            "md5": "935ac05f46e8d6c6f767b27546b32a13",
+            "size": "888967"
+        }
+    }
+}
\ No newline at end of file
diff --git a/pkgs/development/haskell-modules/configuration-darwin.nix b/pkgs/development/haskell-modules/configuration-darwin.nix
index c94f74c4e10c..487db708c48d 100644
--- a/pkgs/development/haskell-modules/configuration-darwin.nix
+++ b/pkgs/development/haskell-modules/configuration-darwin.nix
@@ -294,6 +294,12 @@ self: super:
 
     warp = overrideCabal (drv: {
       __darwinAllowLocalNetworking = true;
+      # These fail in darwin sandbox with:
+      #   Network.SendFile.MacOS.sendloopHeader: permission denied (Operation not permitted)
+      testFlags = drv.testFlags or [ ] ++ [
+        "--skip=/Response/range requests/"
+        "--skip=/Response/partial files/"
+      ];
     }) super.warp;
 
     ghcjs-dom-hello = overrideCabal (drv: {
diff --git a/pkgs/development/libraries/aspell/aspell-with-dicts.nix b/pkgs/development/libraries/aspell/aspell-with-dicts.nix
index 16afeade6cd9..eaec588d12a5 100644
--- a/pkgs/development/libraries/aspell/aspell-with-dicts.nix
+++ b/pkgs/development/libraries/aspell/aspell-with-dicts.nix
@@ -30,7 +30,7 @@ buildEnv {
     pushd "${aspell}/bin"
     for prg in *; do
       if [ -f "$prg" ]; then
-        makeWrapper "${aspell}/bin/$prg" "$out/bin/$prg" --set ASPELL_CONF "dict-dir $out/lib/aspell; data-dir $out/share/aspell"
+        makeWrapper "${aspell}/bin/$prg" "$out/bin/$prg" --set ASPELL_CONF "dict-dir $out/lib/aspell; data-dir $out/lib/aspell"
       fi
     done
     popd
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index 06cf679cd2cd..6c16418a2c51 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -460,14 +460,6 @@ stdenv.mkDerivation (
           hash = "sha256-ulB5BujAkoRJ8VHou64Th3E94z6m+l6v9DpG7/9nYsM=";
         })
       ]
-      ++ optionals (lib.versionAtLeast version "6.1" && lib.versionOlder version "6.2") [
-        (fetchpatch2 {
-          # this can be removed post 6.1
-          name = "fix_build_failure_due_to_PropertyKey_EncoderID";
-          url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/cb049d377f54f6b747667a93e4b719380c3e9475";
-          hash = "sha256-sxRXKKgUak5vsQTiV7ge8vp+N22CdTIvuczNgVRP72c=";
-        })
-      ]
       ++ optionals (lib.versionOlder version "7.1.1") [
         (fetchpatch2 {
           name = "texinfo-7.1.patch";
diff --git a/pkgs/development/libraries/qtstyleplugin-kvantum/default.nix b/pkgs/development/libraries/qtstyleplugin-kvantum/default.nix
index ca9a11ac16ea..31a4e6ba0af0 100644
--- a/pkgs/development/libraries/qtstyleplugin-kvantum/default.nix
+++ b/pkgs/development/libraries/qtstyleplugin-kvantum/default.nix
@@ -23,13 +23,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "qtstyleplugin-kvantum${lib.optionalString isQt5 "5"}";
-  version = "1.1.7";
+  version = "1.1.8";
 
   src = fetchFromGitHub {
     owner = "tsujan";
     repo = "Kvantum";
     rev = "V${finalAttrs.version}";
-    hash = "sha256-S/oIkr0C4fj78ih8Tm6pKxlREEMLeF5Va7+3jC6bK3c=";
+    hash = "sha256-Ki3AAcKKuPNARXH6kMsxA2JfouNPJIQkXjTE+7+vgq4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/facedancer/default.nix b/pkgs/development/python-modules/facedancer/default.nix
index 5acf39ec616a..9a9d01ba1906 100644
--- a/pkgs/development/python-modules/facedancer/default.nix
+++ b/pkgs/development/python-modules/facedancer/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "facedancer";
-  version = "3.1.2";
+  version = "3.1.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "greatscottgadgets";
     repo = "facedancer";
     tag = version;
-    hash = "sha256-CJU+ltQ+bWBK5AGS2WMR5RMx4UblknrCAMZyIAG/1bQ=";
+    hash = "sha256-kWXO3q4KpMZNgZvVEw3yhKQ7eLzaVQ/4y+GQcd7Hd8U=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/httpcore2/default.nix b/pkgs/development/python-modules/httpcore2/default.nix
index f7708b751017..cfbbf8113342 100644
--- a/pkgs/development/python-modules/httpcore2/default.nix
+++ b/pkgs/development/python-modules/httpcore2/default.nix
@@ -9,8 +9,8 @@
   uv-dynamic-versioning,
 
   # dependencies
-  certifi,
   h11,
+  truststore,
 
   # optional dependencies
   h2,
@@ -29,14 +29,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "httpcore2";
-  version = "2.2.0";
+  version = "2.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "httpx2";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-RdoMDF5XVOkb4JCmytdF0JmBfTUcHuM1N+SD8r+RNiU=";
+    hash = "sha256-cW6meHx6VBMz5r/lXCKKK7Sq4e2nk+n1A5YTNtR2kB4=";
   };
 
   postPatch = ''
@@ -50,8 +50,8 @@ buildPythonPackage (finalAttrs: {
   ];
 
   dependencies = [
-    certifi
     h11
+    truststore
   ];
 
   optional-dependencies = {
diff --git a/pkgs/development/python-modules/httpx2/default.nix b/pkgs/development/python-modules/httpx2/default.nix
index 82f5a2acd0fd..9e73b584f276 100644
--- a/pkgs/development/python-modules/httpx2/default.nix
+++ b/pkgs/development/python-modules/httpx2/default.nix
@@ -40,14 +40,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "httpx2";
-  version = "2.2.0";
+  version = "2.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "httpx2";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-RdoMDF5XVOkb4JCmytdF0JmBfTUcHuM1N+SD8r+RNiU=";
+    hash = "sha256-cW6meHx6VBMz5r/lXCKKK7Sq4e2nk+n1A5YTNtR2kB4=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/icalendar-searcher/default.nix b/pkgs/development/python-modules/icalendar-searcher/default.nix
index 7745937d5720..8361182725ae 100644
--- a/pkgs/development/python-modules/icalendar-searcher/default.nix
+++ b/pkgs/development/python-modules/icalendar-searcher/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "icalendar-searcher";
-  version = "1.0.5";
+  version = "1.0.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "python-caldav";
     repo = "icalendar-searcher";
     tag = "v${version}";
-    hash = "sha256-x11gdW6FuSCktMGtPxTg39C98J0/0C7F07jIHN0ewbY=";
+    hash = "sha256-HkiKy38B5+i6Lb+0Teu/YqvrE1gqy/x3u1GRUWAHNes=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/lizard/default.nix b/pkgs/development/python-modules/lizard/default.nix
index 0aa79480e997..4373ecd23487 100644
--- a/pkgs/development/python-modules/lizard/default.nix
+++ b/pkgs/development/python-modules/lizard/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "lizard";
-  version = "1.22.1";
+  version = "1.22.2";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "terryyin";
     repo = "lizard";
     tag = version;
-    hash = "sha256-k4HrecW6577GaxEGlkKNtqrHP1cSWOvWN32EUNeOuSg=";
+    hash = "sha256-Gh7ufW8A3FiQMCppwl2SIeOie9O/kl3wYxV4kW4raDQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/proton-vpn-local-agent/default.nix b/pkgs/development/python-modules/proton-vpn-local-agent/default.nix
index f419c6d01934..f1204b9f6e51 100644
--- a/pkgs/development/python-modules/proton-vpn-local-agent/default.nix
+++ b/pkgs/development/python-modules/proton-vpn-local-agent/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "proton-vpn-local-agent";
-  version = "1.6.1";
+  version = "1.6.2";
   pyproject = false;
   withDistOutput = false;
 
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "ProtonVPN";
     repo = "local-agent-rs";
     rev = version;
-    hash = "sha256-QELvjPJhS8nsQqNucwhMjbwDVg2YiESuhSB1XCN0o90=";
+    hash = "sha256-VmZ8nsKqP8jyNe7Rl+PHsXhsjgchq3rKmTtAqFEe7yM=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
@@ -29,7 +29,7 @@ buildPythonPackage rec {
       src
       sourceRoot
       ;
-    hash = "sha256-28WEWWI29EYADq/z7C01LxaeBJw8oWiF24iLpduJZ5w=";
+    hash = "sha256-MOCLMQ8mqv8Q3I3bIS0ynfpPmrULMA+80RHZBeu7r5s=";
   };
 
   sourceRoot = "${src.name}/python-proton-vpn-local-agent";
diff --git a/pkgs/development/python-modules/qpageview/default.nix b/pkgs/development/python-modules/qpageview/default.nix
index ebe6aef0af6c..715701dbbde3 100644
--- a/pkgs/development/python-modules/qpageview/default.nix
+++ b/pkgs/development/python-modules/qpageview/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "qpageview";
-  version = "1.0.4";
+  version = "1.0.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "frescobaldi";
     repo = "qpageview";
     tag = "v${version}";
-    hash = "sha256-PqoYxSYOsR/tsV3NZmxCtK1fKQuo8WUJZVBSNRjVNLw=";
+    hash = "sha256-oXZr35ZD+cFEgRNojpiW14xceGC9taMNTFvXHmyyeFg=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/ripser/default.nix b/pkgs/development/python-modules/ripser/default.nix
index 2a18ef66991b..793738395432 100644
--- a/pkgs/development/python-modules/ripser/default.nix
+++ b/pkgs/development/python-modules/ripser/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "ripser";
-  version = "0.6.14";
+  version = "0.6.15";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "scikit-tda";
     repo = "ripser.py";
     tag = "v${version}";
-    hash = "sha256-p47vhrG8+B226/no4PD7+XFNccbNJvi45Luwu287ygI=";
+    hash = "sha256-zzqyTVhoL8l/fN0nnkzmyxNG4t1s9z0ZueKkc/NO5FA=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/ucsmsdk/default.nix b/pkgs/development/python-modules/ucsmsdk/default.nix
index da4d16f8a7c9..e41d77193973 100644
--- a/pkgs/development/python-modules/ucsmsdk/default.nix
+++ b/pkgs/development/python-modules/ucsmsdk/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "ucsmsdk";
-  version = "0.9.25";
+  version = "0.9.26";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "CiscoUcs";
     repo = "ucsmsdk";
     tag = "v${version}";
-    hash = "sha256-hpGWaBlzfb5rcmgnmVQFGGH5T/EJRdilIH4Q83Ml8XQ=";
+    hash = "sha256-PX9SoUhFp0XlEXaKKEh1TA7+gNCUj+t0jOR5hgosu9c=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/ufo2ft/default.nix b/pkgs/development/python-modules/ufo2ft/default.nix
index 4500b59da5e3..5bdae28926f5 100644
--- a/pkgs/development/python-modules/ufo2ft/default.nix
+++ b/pkgs/development/python-modules/ufo2ft/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "ufo2ft";
-  version = "3.7.2";
+  version = "3.8.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "googlefonts";
     repo = "ufo2ft";
     tag = "v${version}";
-    hash = "sha256-g8nPtIGUiUVV0exddKGBRbLhO/XW+5bBNlYXRDlkIZM=";
+    hash = "sha256-Y9QyirOYbZ7fNivsb2N/hNlzr5FZqyscN9m1G8x1icE=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/yara-x/default.nix b/pkgs/development/python-modules/yara-x/default.nix
index c17442611276..76ee3ffa9e0c 100644
--- a/pkgs/development/python-modules/yara-x/default.nix
+++ b/pkgs/development/python-modules/yara-x/default.nix
@@ -9,21 +9,21 @@
 
 buildPythonPackage rec {
   pname = "yara-x";
-  version = "1.16.0";
+  version = "1.17.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "VirusTotal";
     repo = "yara-x";
     tag = "v${version}";
-    hash = "sha256-n/AhEKlQmjbTtPncal6NDn7BcXb4HfnkuJctvDjW2V0=";
+    hash = "sha256-8P3fNLENfoGD+FMeCXX8UwoMzI92JkjV/f3G7d+Li3Y=";
   };
 
   buildAndTestSubdir = "py";
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname src version;
-    hash = "sha256-MbMjrrPN1ctlYoE6R5p8g354OOmu4NplcGwSm3IcHRI=";
+    hash = "sha256-ifXe0LKEYMzCo0FIg2E5mCQRUCOlu3nvK2XN/3GM9bk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/yaramod/default.nix b/pkgs/development/python-modules/yaramod/default.nix
index d3f18e1213d4..ba357ec21545 100644
--- a/pkgs/development/python-modules/yaramod/default.nix
+++ b/pkgs/development/python-modules/yaramod/default.nix
@@ -21,14 +21,14 @@ let
 in
 buildPythonPackage (finalAttrs: {
   pname = "yaramod";
-  version = "4.6.0";
+  version = "4.7.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "avast";
     repo = "yaramod";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2XI7lGfoMHimtuQ29I1cFtV4OgfvR3Qcvh/FhA0yeBw=";
+    hash = "sha256-AtRHwJGaEnvOMno8/LjoSg8wCRxd1oyYKgmklW0jp5o=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/ocaml/camlp5/default.nix b/pkgs/development/tools/ocaml/camlp5/default.nix
index 4a8cd807a53f..e2931d73ddc3 100644
--- a/pkgs/development/tools/ocaml/camlp5/default.nix
+++ b/pkgs/development/tools/ocaml/camlp5/default.nix
@@ -8,6 +8,7 @@
   makeWrapper,
   rresult,
   bos,
+  fmt,
   pcre2,
   re,
   camlp-streams,
@@ -52,12 +53,15 @@ stdenv.mkDerivation (
 
     buildInputs = lib.optionals recent [
       bos
-      pcre2
       re
       rresult
     ];
 
-    propagatedBuildInputs = lib.optional recent camlp-streams;
+    propagatedBuildInputs = lib.optionals recent [
+      camlp-streams
+      pcre2
+      fmt
+    ];
 
     strictDeps = true;
 
diff --git a/pkgs/kde/gear/kdenlive/default.nix b/pkgs/kde/gear/kdenlive/default.nix
index 50ffa2dc4b4b..a03f01faa451 100644
--- a/pkgs/kde/gear/kdenlive/default.nix
+++ b/pkgs/kde/gear/kdenlive/default.nix
@@ -16,6 +16,7 @@
   kio-extras,
   opentimelineio,
   frei0r,
+  qtimageformats,
 }:
 mkKdeDerivation {
   pname = "kdenlive";
@@ -40,6 +41,7 @@ mkKdeDerivation {
     qtsvg
     qtmultimedia
     qtnetworkauth
+    qtimageformats # UI uses webp images
 
     kddockwidgets
     qqc2-desktop-style
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/default.nix
index a8c44d52fc5c..dae72f79852a 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/default.nix
@@ -361,7 +361,11 @@ lib.makeScope
           gnutar = gnutar-latest;
         };
 
-        inherit (callPackage ./utils.nix { }) derivationWithMeta writeTextFile writeText;
+        inherit (callPackage ./utils.nix { inherit hostPlatform; })
+          derivationWithMeta
+          writeTextFile
+          writeText
+          ;
         test = kaem.runCommand "minimal-bootstrap-test" { } (
           ''
             echo ${bash.tests.get-version}
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/utils.nix b/pkgs/os-specific/linux/minimal-bootstrap/utils.nix
index 180d55a91494..96e983f537f8 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/utils.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/utils.nix
@@ -6,7 +6,12 @@
   kaem,
   mescc-tools-extra,
   checkMeta,
+  hostPlatform,
 }:
+let
+  assertValidity = checkMeta.assertValidity hostPlatform;
+  commonMeta = checkMeta.commonMeta hostPlatform;
+in
 rec {
   maybeContentAddressed = lib.optionalAttrs config.contentAddressedByDefault {
     __contentAddressed = true;
@@ -18,8 +23,8 @@ rec {
     attrs:
     let
       passthru = attrs.passthru or { };
-      validity = checkMeta.assertValidity { inherit meta attrs; };
-      meta = checkMeta.commonMeta { inherit validity attrs; };
+      validity = assertValidity { inherit meta attrs; };
+      meta = commonMeta { inherit validity attrs; };
       baseDrv = derivation (
         {
           inherit (buildPlatform) system;
diff --git a/pkgs/servers/home-assistant/custom-components/llm_intents/package.nix b/pkgs/servers/home-assistant/custom-components/llm_intents/package.nix
new file mode 100644
index 000000000000..0fd034413066
--- /dev/null
+++ b/pkgs/servers/home-assistant/custom-components/llm_intents/package.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  buildHomeAssistantComponent,
+  fetchFromGitHub,
+  sympy,
+  pytest-asyncio,
+  pytest-cov-stub,
+  pytest-freezer,
+  pytest-homeassistant-custom-component,
+  pytestCheckHook,
+}:
+
+buildHomeAssistantComponent (finalAttrs: {
+  owner = "skye-harris";
+  domain = "llm_intents";
+  version = "1.8.1";
+
+  src = fetchFromGitHub {
+    inherit (finalAttrs) owner;
+    repo = "llm_intents";
+    tag = finalAttrs.version;
+    hash = "sha256-KIC9rDu2AKSLlW0lNXR05AyhreAnFAhNuNRlqdZwy5w=";
+  };
+
+  dependencies = [
+    sympy
+  ];
+
+  nativeCheckInputs = [
+    pytest-asyncio
+    pytest-cov-stub
+    pytest-freezer
+    pytest-homeassistant-custom-component
+    pytestCheckHook
+  ];
+
+  meta = {
+    changelog = "https://github.com/skye-harris/llm_intents/releases/tag/${finalAttrs.src.tag}";
+    description = "Exposes internet search tools for use by LLM-backed Assist in Home Assistant";
+    homepage = "https://github.com/skye-harris/llm_intents";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jpds ];
+  };
+})
diff --git a/pkgs/servers/klipper/default.nix b/pkgs/servers/klipper/default.nix
index 08f30b654b0c..00fbf21a14c4 100644
--- a/pkgs/servers/klipper/default.nix
+++ b/pkgs/servers/klipper/default.nix
@@ -90,6 +90,7 @@ stdenv.mkDerivation rec {
       p: with p; [
         numpy
         matplotlib
+        python-can
       ]
     )).interpreter;
 
@@ -109,8 +110,10 @@ stdenv.mkDerivation rec {
     # under `klipper_path`
     cp -r $src/docs $out/lib/docs
     cp -r $src/config $out/lib/config
-    cp -r $src/scripts $out/lib/scripts
     cp -r $src/klippy $out/lib/klippy
+    mkdir -p $out/lib/scripts
+    cp -r $src/scripts/* $out/lib/scripts
+    cp $src/lib/katapult/flashtool.py $out/lib/scripts/flash_can.py
 
     # Add version information. For the normal procedure see https://www.klipper3d.org/Packaging.html#versioning
     # This is done like this because scripts/make_version.py is not available when sourceRoot is set to "${src.name}/klippy"
@@ -125,6 +128,11 @@ stdenv.mkDerivation rec {
       --subst-var-by "script" "calibrate_shaper.py"
     chmod 755 "$out/bin/klipper-calibrate-shaper"
 
+    substitute "$pythonScriptWrapper" "$out/bin/klipper-canbus-query" \
+      --subst-var "out" \
+      --subst-var-by "script" "canbus_query.py"
+    chmod 755 "$out/bin/klipper-canbus-query"
+
     runHook postInstall
   '';
 
diff --git a/pkgs/servers/klipper/klipper-firmware.nix b/pkgs/servers/klipper/klipper-firmware.nix
index 90b29f33d987..6ab6beac9ac3 100644
--- a/pkgs/servers/klipper/klipper-firmware.nix
+++ b/pkgs/servers/klipper/klipper-firmware.nix
@@ -72,6 +72,7 @@ stdenv.mkDerivation {
     cp ./.config $out/config
     cp out/klipper.bin $out/ || true
     cp out/klipper.elf $out/ || true
+    cp out/klipper.elf.hex $out/ || true
     cp out/klipper.uf2 $out/ || true
 
     mkdir -p $out/lib/
@@ -95,7 +96,11 @@ stdenv.mkDerivation {
 
   passthru = {
     makeFlasher =
-      { flashDevice }:
+      {
+        flashDevice ? null,
+        canbusNetwork ? null,
+        canbusDevice ? null,
+      }:
       klipper-flash.override {
         klipper-firmware = klipper-firmware.override args;
         inherit
@@ -103,6 +108,8 @@ stdenv.mkDerivation {
           firmwareConfig
           mcu
           flashDevice
+          canbusNetwork
+          canbusDevice
           ;
       };
   };
diff --git a/pkgs/servers/klipper/klipper-flash.nix b/pkgs/servers/klipper/klipper-flash.nix
index 78ba90218953..14379c4b3156 100644
--- a/pkgs/servers/klipper/klipper-flash.nix
+++ b/pkgs/servers/klipper/klipper-flash.nix
@@ -7,7 +7,9 @@
   dfu-util,
   stm32flash,
   mcu ? "mcu",
-  flashDevice ? "/dev/null",
+  flashDevice ? null,
+  canbusNetwork ? null,
+  canbusDevice ? null,
   firmwareConfig ? ./simulator.cfg,
 }:
 let
@@ -20,34 +22,66 @@ let
     if matches != null then head matches else null;
   matchPlatform = getConfigField "CONFIG_BOARD_DIRECTORY";
   matchBoard = getConfigField "CONFIG_MCU";
+  matchAvrdudeProtocol = getConfigField "CONFIG_AVRDUDE_PROTOCOL";
+  flashUsbSupportedBoards = [
+    "sam3"
+    "sam4"
+    "same70"
+    "samd"
+    "same5"
+    "lpc176"
+    "stm32f103"
+    "stm32f4"
+    "stm32f042"
+    "stm32f070"
+    "stm32f072"
+    "stm32g0b1"
+    "stm32f7"
+    "stm32h7"
+    "stm32l4"
+    "stm32g4"
+    "rp2"
+  ];
 in
+assert lib.assertMsg (
+  (flashDevice != null) != (canbusNetwork != null && canbusDevice != null)
+  && ((canbusNetwork != null) == (canbusDevice != null))
+) "Either set flashDevice or both canbusNetwork and canbusDevice";
 writeShellApplication {
   name = "klipper-flash-${mcu}";
   runtimeInputs =
     [ ]
-    ++ lib.optionals (matchPlatform == "avr") [ avrdude ]
-    ++ lib.optionals (matchPlatform == "stm32") [
-      stm32flash
-      dfu-util
-    ]
-    ++ lib.optionals (matchPlatform == "lpc176x") [ dfu-util ]
-  # bossac, hid-flash and RP2040 flash binaries are built by klipper-firmware
-  ;
+    ++ lib.optionals (flashDevice != null) (
+      lib.optionals (matchPlatform == "avr") [ avrdude ]
+      ++ lib.optionals (matchPlatform == "stm32") [
+        stm32flash
+        dfu-util
+      ]
+      ++ lib.optionals (matchPlatform == "lpc176x") [ dfu-util ]
+      # bossac, hid-flash and RP2040 flash binaries are built by klipper-firmware
+    );
   text =
     # generic USB script for most things with serial and bootloader (see MCU_TYPES in scripts/flash_usb.py)
-    if matchBoard != null && matchPlatform != null then
-      ''
-        pushd ${klipper-firmware}
-        ${klipper}/lib/scripts/flash_usb.py -t ${matchBoard} -d ${flashDevice} ${klipper-firmware}/klipper.bin "$@"
-        popd
-      ''
+    if flashDevice != null then
+      if (builtins.elem matchBoard flashUsbSupportedBoards) && matchPlatform != null then
+        ''
+          ${klipper}/lib/scripts/flash_usb.py -t ${matchBoard} -d ${flashDevice} ${klipper-firmware}/klipper.bin "$@"
+        ''
+      else if matchPlatform == "avr" && matchAvrdudeProtocol != null && matchBoard != null then
+        ''
+          avrdude -p${matchBoard} -c${matchAvrdudeProtocol} -P"${flashDevice}" -D -U"flash:w:${klipper-firmware}/klipper.elf.hex:i"
+        ''
+      else
+        ''
+          cat <<EOF
+          Board pair ${toString matchBoard}/${toString matchPlatform} (config ${firmwareConfig}) is not supported in NixOS auto flashing script.
+          Please manually flash the firmware using the appropriate tool for your board.
+          Built firmware is located here:
+          ${klipper-firmware}
+          EOF
+        ''
     else
       ''
-        cat <<EOF
-        Board pair ${toString matchBoard}/${toString matchPlatform} (config ${firmwareConfig}) is not supported in NixOS auto flashing script.
-        Please manually flash the firmware using the appropriate tool for your board.
-        Built firmware is located here:
-        ${klipper-firmware}
-        EOF
+        ${klipper}/lib/scripts/flash_can.py -i ${canbusNetwork} -f ${klipper-firmware}/klipper.bin -u ${canbusDevice} "$@"
       '';
 }
diff --git a/pkgs/servers/monitoring/grafana/plugins/marcusolsson-calendar-panel/default.nix b/pkgs/servers/monitoring/grafana/plugins/marcusolsson-calendar-panel/default.nix
index 1becc370a285..bbad91ef621a 100644
--- a/pkgs/servers/monitoring/grafana/plugins/marcusolsson-calendar-panel/default.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/marcusolsson-calendar-panel/default.nix
@@ -2,8 +2,8 @@
 
 grafanaPlugin {
   pname = "marcusolsson-calendar-panel";
-  version = "4.2.3";
-  zipHash = "sha256-uyxbYeP/DN/+WKtvu1cJWDj1GTEaXwuvhh9hNiAXKIo=";
+  version = "4.2.4";
+  zipHash = "sha256-pqPz/wFzx3ffyMYYCoo34bof5UQ/Qz67V/E9c4QSizg=";
   meta = {
     description = "Calendar Panel is a Grafana plugin that displays events from various data sources";
     license = lib.licenses.asl20;
diff --git a/pkgs/servers/monitoring/zabbix/server.nix b/pkgs/servers/monitoring/zabbix/server.nix
index 901f79c00cb7..d38046e279ed 100644
--- a/pkgs/servers/monitoring/zabbix/server.nix
+++ b/pkgs/servers/monitoring/zabbix/server.nix
@@ -114,6 +114,9 @@ import ./versions.nix (
     + optionalString postgresqlSupport ''
       mkdir -p $out/share/zabbix/database/postgresql
       cp -prvd database/postgresql/*.sql $out/share/zabbix/database/postgresql/
+
+      mkdir -p $out/share/zabbix/database/postgresql/timescaledb
+      cp -prvd database/postgresql/timescaledb/schema.sql $out/share/zabbix/database/postgresql/timescaledb/schema.sql
     '';
 
     meta = {
diff --git a/pkgs/stdenv/adapters.nix b/pkgs/stdenv/adapters.nix
index 923de7168b55..fb15a93de819 100644
--- a/pkgs/stdenv/adapters.nix
+++ b/pkgs/stdenv/adapters.nix
@@ -13,7 +13,10 @@
 let
   # N.B. Keep in sync with default arg for stdenv/generic.
   defaultMkDerivationFromStdenv =
-    stdenv: (import ./generic/make-derivation.nix { inherit lib config; } stdenv).mkDerivation;
+    let
+      makeDerivationFile = import ./generic/make-derivation.nix lib config;
+    in
+    stdenv: (makeDerivationFile stdenv).mkDerivation;
 
   # Low level function to help with overriding `mkDerivationFromStdenv`. One
   # gives it the old stdenv arguments and a "continuation" function, and
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index 3cf47e5a7334..48c2db483e4a 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -27,6 +27,7 @@ assert crossSystem == localSystem;
 
 let
   inherit (localSystem) system;
+  genericStdenv = import ../generic { defaultConfig = config; };
 
   llvmVersion = "21"; # This needs to be updated when the default LLVM version is changed.
   sdkMajorVersion = lib.versions.major localSystem.darwinSdkVersion;
@@ -104,15 +105,13 @@ let
 
       bashNonInteractive = prevStage.bashNonInteractive or bootstrapTools;
 
-      thisStdenv = import ../generic {
+      thisStdenv = genericStdenv {
         name = "${name}-stdenv-darwin";
 
         buildPlatform = localSystem;
         hostPlatform = localSystem;
         targetPlatform = localSystem;
 
-        inherit config;
-
         extraBuildInputs = [ prevStage.apple-sdk ];
         inherit extraNativeBuildInputs;
 
@@ -975,15 +974,13 @@ assert bootstrapTools.passthru.isFromBootstrapFiles or false; # sanity check
     in
     {
       inherit config overlays;
-      stdenv = import ../generic {
+      stdenv = genericStdenv {
         name = "stdenv-darwin";
 
         buildPlatform = localSystem;
         hostPlatform = localSystem;
         targetPlatform = localSystem;
 
-        inherit config;
-
         preHook = ''
           ${commonPreHook}
           stripDebugFlags="-S" # llvm-strip does not support "-p" for Mach-O
diff --git a/pkgs/stdenv/freebsd/default.nix b/pkgs/stdenv/freebsd/default.nix
index 046039d1ffbe..7ede014f80f1 100644
--- a/pkgs/stdenv/freebsd/default.nix
+++ b/pkgs/stdenv/freebsd/default.nix
@@ -21,6 +21,8 @@
 
 assert crossSystem == localSystem;
 let
+  genericStdenv = import ../generic { defaultConfig = config; };
+
   inherit (localSystem) system;
   mkExtraBuildCommands0 = cc: ''
     rsrc="$out/resource-root"
@@ -383,9 +385,8 @@ let
         bsdcp
       ];
       shell = "${prevStage.bashNonInteractive}/bin/bash";
-      stdenvNoCC = import ../generic {
+      stdenvNoCC = genericStdenv {
         inherit
-          config
           initialPath
           shell
           fetchurlBoot
@@ -401,9 +402,8 @@ let
         inherit (prevStage) curl;
         inherit (config) hashedMirrors rewriteURL;
       };
-      stdenv = import ../generic {
+      stdenv = genericStdenv {
         inherit
-          config
           initialPath
           shell
           fetchurlBoot
diff --git a/pkgs/stdenv/generic/check-meta-test.nix b/pkgs/stdenv/generic/check-meta-test.nix
index bbd24acf8614..336c6bd5a78e 100644
--- a/pkgs/stdenv/generic/check-meta-test.nix
+++ b/pkgs/stdenv/generic/check-meta-test.nix
@@ -47,7 +47,7 @@ let
       checkMeta = testPkgs.callPackage ./check-meta.nix { };
       tryEval = expression: builtins.tryEval (builtins.deepSeq expression expression);
       actual = tryEval (
-        checkMeta.assertValidity {
+        checkMeta.assertValidity pkgs.stdenv.hostPlatform {
           meta = pkg.meta;
           attrs = pkg;
         }
diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix
index ac5ff3c0a6f1..70c009c3e83a 100644
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@@ -4,7 +4,6 @@
 {
   lib,
   config,
-  hostPlatform,
 }:
 
 let
@@ -122,6 +121,7 @@ let
 
   # Logical inversion of meta.availableOn for hostPlatform
   hasUnsupportedPlatform =
+    hostPlatform:
     let
       inherit (hostPlatform) system;
       # in almost all cases, meta.platforms is a simple list of strings, and we
@@ -416,6 +416,10 @@ let
   # !!! reason strings are hardcoded into OfBorg, make sure to keep them in sync
   # Along with a boolean flag for each reason
   checkValidity =
+    hostPlatform:
+    let
+      hasUnsupportedPlatform' = hasUnsupportedPlatform hostPlatform;
+    in
     attrs:
     if !attrs ? meta then
       null
@@ -458,7 +462,7 @@ let
         msg = "contains elements not built from source (‘${showSourceType attrs.meta.sourceProvenance}’)";
         remediation = remediate_allowlist "NonSource" (remediate_predicate "allowNonSourcePredicate" attrs);
       }
-    else if hasUnsupportedPlatform attrs && !allowUnsupportedSystem then
+    else if hasUnsupportedPlatform' attrs && !allowUnsupportedSystem then
       let
         toPretty' = toPretty {
           allowPrettyValues = true;
@@ -518,9 +522,13 @@ let
   # passed to the builder and is not a dependency.  But since we
   # include it in the result, it *is* available to nix-env for queries.
   # Example:
-  #   meta = checkMeta.commonMeta { inherit validity attrs pos references; };
-  #   validity = checkMeta.assertValidity { inherit meta attrs; };
+  #   meta = checkMeta.commonMeta hostPlatform { inherit validity attrs pos references; };
+  #   validity = checkMeta.assertValidity hostPlatform { inherit meta attrs; };
   commonMeta =
+    hostPlatform:
+    let
+      hasUnsupportedPlatform' = hasUnsupportedPlatform hostPlatform;
+    in
     {
       validity,
       attrs,
@@ -659,7 +667,7 @@ let
       # Expose the result of the checks for everyone to see.
       unfree = hasUnfreeLicense attrs;
       broken = isMarkedBroken attrs;
-      unsupported = hasUnsupportedPlatform attrs;
+      unsupported = hasUnsupportedPlatform' attrs;
       insecure = isMarkedInsecure attrs;
 
       available =
@@ -705,9 +713,13 @@ let
     builtins.seq (foldl' giveWarning null warnings) withError;
 
   assertValidity =
+    hostPlatform:
+    let
+      checkValidity' = checkValidity hostPlatform;
+    in
     { meta, attrs }:
     let
-      invalid = checkValidity attrs;
+      invalid = checkValidity' attrs;
       problems = checkProblems attrs;
     in
     if isNull invalid then
diff --git a/pkgs/stdenv/generic/default.nix b/pkgs/stdenv/generic/default.nix
index 9990b9b999b9..95d9228d7da2 100644
--- a/pkgs/stdenv/generic/default.nix
+++ b/pkgs/stdenv/generic/default.nix
@@ -1,5 +1,37 @@
+{
+  defaultConfig ? null,
+}@args:
 let
   lib = import ../../../lib;
+
+  # By taking defaultConfig early, we can cache the result of calling
+  # make-derivation.nix with config, which leads to more memoisation between
+  # bootstrapping stages. We only have to re-call the file with another config
+  # if stdenv-overridable is actually called with config, otherwise we stick to
+  # defaultConfig. No stdenvs currently specify a non-default config, but we
+  # leave it open as a possibility.
+  makeDerivationFile = import ./make-derivation.nix lib;
+  makeDerivationFileWithConfig =
+    assert args ? defaultConfig;
+    makeDerivationFile args.defaultConfig;
+
+  defaultNativeBuildInputs0 = [
+    ../../build-support/setup-hooks/no-broken-symlinks.sh
+    ../../build-support/setup-hooks/audit-tmpdir.sh
+    ../../build-support/setup-hooks/compress-man-pages.sh
+    ../../build-support/setup-hooks/make-symlinks-relative.sh
+    ../../build-support/setup-hooks/move-docs.sh
+    ../../build-support/setup-hooks/move-lib64.sh
+    ../../build-support/setup-hooks/move-sbin.sh
+    ../../build-support/setup-hooks/move-systemd-user-units.sh
+    ../../build-support/setup-hooks/multiple-outputs.sh
+    ../../build-support/setup-hooks/patch-shebangs.sh
+    ../../build-support/setup-hooks/prune-libtool-files.sh
+    ../../build-support/setup-hooks/reproducible-builds.sh
+    ../../build-support/setup-hooks/set-source-date-epoch-to-latest.sh
+    ../../build-support/setup-hooks/strip.sh
+  ];
+
   stdenv-overridable = lib.makeOverridable (
 
     argsStdenv@{
@@ -21,7 +53,7 @@ let
       allowedRequisites ? null,
       extraAttrs ? { },
       overrides ? (self: super: { }),
-      config,
+      config ? args.defaultConfig,
       disallowedRequisites ? [ ],
 
       # The `fetchurl' to use for downloading curl and its dependencies
@@ -64,29 +96,16 @@ let
       # The implementation of `mkDerivation`, parameterized with the final stdenv so we can tie the knot.
       # This is convenient to have as a parameter so the stdenv "adapters" work better
       mkDerivationFromStdenv ?
-        stdenv: (import ./make-derivation.nix { inherit lib config; } stdenv).mkDerivation,
+        let
+          makeDerivationWithConfig' =
+            if argsStdenv ? config then makeDerivationFile config else makeDerivationFileWithConfig;
+        in
+        stdenv: (makeDerivationWithConfig' stdenv).mkDerivation,
     }:
 
     let
       defaultNativeBuildInputs =
-        extraNativeBuildInputs
-        ++ [
-          ../../build-support/setup-hooks/no-broken-symlinks.sh
-          ../../build-support/setup-hooks/audit-tmpdir.sh
-          ../../build-support/setup-hooks/compress-man-pages.sh
-          ../../build-support/setup-hooks/make-symlinks-relative.sh
-          ../../build-support/setup-hooks/move-docs.sh
-          ../../build-support/setup-hooks/move-lib64.sh
-          ../../build-support/setup-hooks/move-sbin.sh
-          ../../build-support/setup-hooks/move-systemd-user-units.sh
-          ../../build-support/setup-hooks/multiple-outputs.sh
-          ../../build-support/setup-hooks/patch-shebangs.sh
-          ../../build-support/setup-hooks/prune-libtool-files.sh
-          ../../build-support/setup-hooks/reproducible-builds.sh
-          ../../build-support/setup-hooks/set-source-date-epoch-to-latest.sh
-          ../../build-support/setup-hooks/strip.sh
-        ]
-        ++ lib.optionals hasCC [ cc ];
+        extraNativeBuildInputs ++ defaultNativeBuildInputs0 ++ lib.optionals hasCC [ cc ];
 
       defaultBuildInputs = extraBuildInputs;
 
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 7a91595c95e1..89d413931c1b 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -6,10 +6,7 @@
 #
 # See https://github.com/NixOS/nixpkgs/pull/430969 for measurements.
 
-{ lib, config }:
-
-stdenv:
-
+lib:
 let
   # Lib attributes are inherited to the lexical scope for performance reasons.
   inherit (lib)
@@ -52,7 +49,6 @@ let
     unsafeDiscardStringContext
     unsafeGetAttrPos
     warn
-    warnIf
     zipAttrsWith
     any
     ;
@@ -60,9 +56,154 @@ let
   inherit (lib.generators) toPretty;
   inherit (lib.strings) sanitizeDerivationName;
 
+  knownHardeningFlags = [
+    "bindnow"
+    "format"
+    "fortify"
+    "fortify3"
+    "strictflexarrays1"
+    "strictflexarrays3"
+    "shadowstack"
+    "nostrictaliasing"
+    "pacret"
+    "pic"
+    "relro"
+    "stackprotector"
+    "glibcxxassertions"
+    "libcxxhardeningfast"
+    "libcxxhardeningextensive"
+    "stackclashprotection"
+    "strictoverflow"
+    "trivialautovarinit"
+    "zerocallusedregs"
+  ];
+
+  removedOrReplacedAttrNames = [
+    "checkInputs"
+    "installCheckInputs"
+    "nativeCheckInputs"
+    "nativeInstallCheckInputs"
+    "__contentAddressed"
+    "__darwinAllowLocalNetworking"
+    "__impureHostDeps"
+    "__propagatedImpureHostDeps"
+    "sandboxProfile"
+    "propagatedSandboxProfile"
+    "disallowedReferences"
+    "disallowedRequisites"
+    "allowedReferences"
+    "allowedRequisites"
+    "allowedImpureDLLs"
+  ];
+
+  referenceCheckingAttrsToRemove = [
+    "allowedReferences"
+    "allowedRequisites"
+    "disallowedReferences"
+    "disallowedRequisites"
+  ];
+
+  argumentAttrsToRemove = [
+    "meta"
+    "passthru"
+    "pos"
+    "env"
+  ];
+
+  attrsToRemoveLast = [
+    # Fixed-output derivations may not reference other paths, which means that for a fixed-output
+    # derivation, the corresponding inputDerivation should *not* be fixed-output. To achieve this we
+    # simply delete the attributes that would make it fixed-output.
+    "outputHashAlgo"
+    "outputHash"
+    "outputHashMode"
+
+    # inputDerivation produces the inputs; not the outputs, so any restrictions on what used to be
+    # the outputs don't serve a purpose anymore.
+    "allowedReferences"
+    "allowedRequisites"
+    "disallowedReferences"
+    "disallowedRequisites"
+    "outputChecks"
+  ];
+
+  defaultBuilderArgs = [
+    "-e"
+    ./source-stdenv.sh
+    ./default-builder.sh
+  ];
+
+  isSingularDependency = dep: dep == null || isDerivation dep || isString dep || isPath dep;
+
+  cachedOutputChecks = {
+    out = { };
+  };
+  debugCachedOutputChecks = {
+    out = { };
+    debug = { };
+  };
+
+  # Turn a derivation into its outPath without a string context attached.
+  # See the comment at the usage site.
+  unsafeDerivationToUntrackedOutpath =
+    drv:
+    if isDerivation drv && (!drv.__contentAddressed or false) then
+      unsafeDiscardStringContext drv.outPath
+    else
+      drv;
+
+  makeOutputChecks =
+    attrs:
+    # If we use derivations directly here, they end up as build-time dependencies.
+    # This is especially problematic in the case of disallowed*, since the disallowed
+    # derivations will be built by nix as build-time dependencies, while those
+    # derivations might take a very long time to build, or might not even build
+    # successfully on the platform used.
+    # We can improve on this situation by instead passing only the outPath,
+    # without an attached string context, to nix. The out path will be a placeholder
+    # which will be replaced by the actual out path if the derivation in question
+    # is part of the final closure (and thus needs to be built). If it is not
+    # part of the final closure, then the placeholder will be passed along,
+    # but in that case we know for a fact that the derivation is not part of the closure.
+    # This means that passing the out path to nix does the right thing in either
+    # case, both for disallowed and allowed references/requisites, and we won't
+    # build the derivation if it wouldn't be part of the closure, saving time and resources.
+    # While the problem is less severe for allowed*, since we want the derivation
+    # to be built eventually, we would still like to get the error early and without
+    # having to wait while nix builds a derivation that might not be used.
+    # See also https://github.com/NixOS/nix/issues/4629
+    {
+      ${if (attrs ? disallowedReferences) then "disallowedReferences" else null} =
+        map unsafeDerivationToUntrackedOutpath attrs.disallowedReferences;
+      ${if (attrs ? disallowedRequisites) then "disallowedRequisites" else null} =
+        map unsafeDerivationToUntrackedOutpath attrs.disallowedRequisites;
+      ${if (attrs ? allowedReferences) then "allowedReferences" else null} =
+        mapNullable unsafeDerivationToUntrackedOutpath attrs.allowedReferences;
+      ${if (attrs ? allowedRequisites) then "allowedRequisites" else null} =
+        mapNullable unsafeDerivationToUntrackedOutpath attrs.allowedRequisites;
+    };
+in
+config:
+let
+  doCheckByDefault = config.doCheckByDefault or false;
+  structuredAttrsByDefault = config.structuredAttrsByDefault or false;
+  inherit (config) enableParallelBuildingByDefault contentAddressedByDefault;
+  userHook = config.stdenv.userHook or null;
+  checkMeta = import ./check-meta.nix {
+    inherit lib config;
+  };
+in
+stdenv:
+
+let
   inherit (import ../../build-support/lib/cmake.nix { inherit lib stdenv; }) makeCMakeFlags;
   inherit (import ../../build-support/lib/meson.nix { inherit lib stdenv; }) makeMesonFlags;
 
+  # Nix itself uses the `system` field of a derivation to decide where
+  # to build it. This is a bit confusing for cross compilation.
+  commonMeta = checkMeta.commonMeta hostPlatform;
+  assertValidity = checkMeta.assertValidity hostPlatform;
+
   /**
     This function creates a derivation, and returns it in the form of a [package attribute set](https://nix.dev/manual/nix/latest/glossary#package-attribute-set)
     that refers to the derivation's outputs.
@@ -83,13 +224,6 @@ let
   */
   mkDerivation = fnOrAttrs: makeDerivationExtensible (toFunction fnOrAttrs);
 
-  checkMeta = import ./check-meta.nix {
-    inherit lib config;
-    # Nix itself uses the `system` field of a derivation to decide where
-    # to build it. This is a bit confusing for cross compilation.
-    inherit (stdenv) hostPlatform;
-  };
-
   # Based off lib.makeExtensible, with modifications:
   makeDerivationExtensible =
     rattrs:
@@ -176,89 +310,6 @@ let
     in
     finalPackage;
 
-  knownHardeningFlags = [
-    "bindnow"
-    "format"
-    "fortify"
-    "fortify3"
-    "strictflexarrays1"
-    "strictflexarrays3"
-    "shadowstack"
-    "nostrictaliasing"
-    "pacret"
-    "pic"
-    "relro"
-    "stackprotector"
-    "glibcxxassertions"
-    "libcxxhardeningfast"
-    "libcxxhardeningextensive"
-    "stackclashprotection"
-    "strictoverflow"
-    "trivialautovarinit"
-    "zerocallusedregs"
-  ];
-
-  removedOrReplacedAttrNames = [
-    "checkInputs"
-    "installCheckInputs"
-    "nativeCheckInputs"
-    "nativeInstallCheckInputs"
-    "__contentAddressed"
-    "__darwinAllowLocalNetworking"
-    "__impureHostDeps"
-    "__propagatedImpureHostDeps"
-    "sandboxProfile"
-    "propagatedSandboxProfile"
-    "disallowedReferences"
-    "disallowedRequisites"
-    "allowedReferences"
-    "allowedRequisites"
-    "allowedImpureDLLs"
-  ];
-
-  referenceCheckingAttrsToRemove = [
-    "allowedReferences"
-    "allowedRequisites"
-    "disallowedReferences"
-    "disallowedRequisites"
-  ];
-
-  argumentAttrsToRemove = [
-    "meta"
-    "passthru"
-    "pos"
-    "env"
-  ];
-
-  attrsToRemoveLast = [
-    # Fixed-output derivations may not reference other paths, which means that
-    # for a fixed-output derivation, the corresponding inputDerivation should
-    # *not* be fixed-output. To achieve this we simply delete the attributes that
-    # would make it fixed-output.
-    "outputHashAlgo"
-    "outputHash"
-    "outputHashMode"
-
-    # inputDerivation produces the inputs; not the outputs, so any
-    # restrictions on what used to be the outputs don't serve a purpose
-    # anymore.
-    "allowedReferences"
-    "allowedRequisites"
-    "disallowedReferences"
-    "disallowedRequisites"
-    "outputChecks"
-  ];
-
-  defaultBuilderArgs = [
-    "-e"
-    ./source-stdenv.sh
-    ./default-builder.sh
-  ];
-
-  doCheckByDefault = config.doCheckByDefault or false;
-  structuredAttrsByDefault = config.structuredAttrsByDefault or false;
-  inherit (config) enableParallelBuildingByDefault contentAddressedByDefault;
-
   inherit (stdenv)
     hostPlatform
     buildPlatform
@@ -303,14 +354,11 @@ let
   # TODO(@Ericson2314): Make always true and remove / resolve #178468
   defaultStrictDeps = if config.strictDepsByDefault then true else hostPlatform != buildPlatform;
 
-  isSingularDependency = dep: dep == null || isDerivation dep || isString dep || isPath dep;
-
   canExecuteHostOnBuild = buildPlatform.canExecute hostPlatform;
   defaultHardeningFlags = stdenv.cc.defaultHardeningFlags or knownHardeningFlags;
   hostSuffixNecessary = hostPlatform != buildPlatform && stdenvHasCC;
   stdenvHostSuffix = "-${hostPlatform.config}";
   stdenvStaticMarker = optionalString isStatic "-static";
-  userHook = config.stdenv.userHook or null;
 
   requiredSystemFeaturesShouldBeSet =
     buildPlatform ? gcc.arch
@@ -326,54 +374,6 @@ let
     );
   gccArchFeature = [ "gccarch-${buildPlatform.gcc.arch}" ];
 
-  cachedOutputChecks = {
-    out = { };
-  };
-  debugCachedOutputChecks = {
-    out = { };
-    debug = { };
-  };
-
-  # Turn a derivation into its outPath without a string context attached.
-  # See the comment at the usage site.
-  unsafeDerivationToUntrackedOutpath =
-    drv:
-    if isDerivation drv && (!drv.__contentAddressed or false) then
-      unsafeDiscardStringContext drv.outPath
-    else
-      drv;
-
-  makeOutputChecks =
-    attrs:
-    # If we use derivations directly here, they end up as build-time dependencies.
-    # This is especially problematic in the case of disallowed*, since the disallowed
-    # derivations will be built by nix as build-time dependencies, while those
-    # derivations might take a very long time to build, or might not even build
-    # successfully on the platform used.
-    # We can improve on this situation by instead passing only the outPath,
-    # without an attached string context, to nix. The out path will be a placeholder
-    # which will be replaced by the actual out path if the derivation in question
-    # is part of the final closure (and thus needs to be built). If it is not
-    # part of the final closure, then the placeholder will be passed along,
-    # but in that case we know for a fact that the derivation is not part of the closure.
-    # This means that passing the out path to nix does the right thing in either
-    # case, both for disallowed and allowed references/requisites, and we won't
-    # build the derivation if it wouldn't be part of the closure, saving time and resources.
-    # While the problem is less severe for allowed*, since we want the derivation
-    # to be built eventually, we would still like to get the error early and without
-    # having to wait while nix builds a derivation that might not be used.
-    # See also https://github.com/NixOS/nix/issues/4629
-    {
-      ${if (attrs ? disallowedReferences) then "disallowedReferences" else null} =
-        map unsafeDerivationToUntrackedOutpath attrs.disallowedReferences;
-      ${if (attrs ? disallowedRequisites) then "disallowedRequisites" else null} =
-        map unsafeDerivationToUntrackedOutpath attrs.disallowedRequisites;
-      ${if (attrs ? allowedReferences) then "allowedReferences" else null} =
-        mapNullable unsafeDerivationToUntrackedOutpath attrs.allowedReferences;
-      ${if (attrs ? allowedRequisites) then "allowedRequisites" else null} =
-        mapNullable unsafeDerivationToUntrackedOutpath attrs.allowedRequisites;
-    };
-
   makeDerivationArgument =
 
     # `makeDerivationArgument` is responsible for the `mkDerivation` arguments that
@@ -972,7 +972,7 @@ let
         }
       );
 
-      meta = checkMeta.commonMeta {
+      meta = commonMeta {
         inherit validity attrs pos;
         references =
           attrs.nativeBuildInputs or [ ]
@@ -980,7 +980,7 @@ let
           ++ attrs.propagatedNativeBuildInputs or [ ]
           ++ attrs.propagatedBuildInputs or [ ];
       };
-      validity = checkMeta.assertValidity { inherit meta attrs; };
+      validity = assertValidity { inherit meta attrs; };
 
       checkedEnv =
         let
diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index d8c9470e5dfa..feb7f90a147f 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -121,6 +121,8 @@
 assert crossSystem == localSystem;
 
 let
+  genericStdenv = import ../generic { defaultConfig = config; };
+
   inherit (localSystem) system;
 
   isFromNixpkgs = pkg: !(isFromBootstrapFiles pkg);
@@ -174,12 +176,12 @@ let
     }:
 
     let
-      thisStdenv = import ../generic {
+      thisStdenv = genericStdenv {
         name = "${name}-stdenv-linux";
         buildPlatform = localSystem;
         hostPlatform = localSystem;
         targetPlatform = localSystem;
-        inherit config extraNativeBuildInputs;
+        inherit extraNativeBuildInputs;
         inherit (stage0) initialPath;
         preHook = ''
           # Don't patch #!/interpreter because it leads to retained
@@ -696,13 +698,12 @@ in
     assert isBuiltByNixpkgsCompiler prevStage.patchelf;
     {
       inherit config overlays;
-      stdenv = import ../generic rec {
+      stdenv = genericStdenv rec {
         name = "stdenv-linux";
 
         buildPlatform = localSystem;
         hostPlatform = localSystem;
         targetPlatform = localSystem;
-        inherit config;
 
         preHook = commonPreHook;
 
diff --git a/pkgs/stdenv/linux/stage0.nix b/pkgs/stdenv/linux/stage0.nix
index 53e5605d65ef..9fa4bb162efd 100644
--- a/pkgs/stdenv/linux/stage0.nix
+++ b/pkgs/stdenv/linux/stage0.nix
@@ -23,7 +23,7 @@ if minbootSupported then
           system = localSystem;
           inherit (config) rewriteURL;
         };
-        checkMeta = callPackage ../generic/check-meta.nix { hostPlatform = localSystem; };
+        checkMeta = callPackage ../generic/check-meta.nix { };
       }
     );
     compilerPackage =
diff --git a/pkgs/stdenv/native/default.nix b/pkgs/stdenv/native/default.nix
index a4b2ca42b780..697e593e205a 100644
--- a/pkgs/stdenv/native/default.nix
+++ b/pkgs/stdenv/native/default.nix
@@ -10,6 +10,8 @@
 assert crossSystem == localSystem;
 
 let
+  genericStdenv = import ../generic { defaultConfig = config; };
+
   inherit (localSystem) system;
 
   shell =
@@ -105,7 +107,7 @@ let
       extraNativeBuildInputs ? [ ],
     }:
 
-    import ../generic {
+    genericStdenv {
       buildPlatform = localSystem;
       hostPlatform = localSystem;
       targetPlatform = localSystem;
@@ -145,7 +147,6 @@ let
         shell
         cc
         overrides
-        config
         ;
     };
 
diff --git a/pkgs/stdenv/nix/default.nix b/pkgs/stdenv/nix/default.nix
index 59e67960aef1..84998fa52581 100644
--- a/pkgs/stdenv/nix/default.nix
+++ b/pkgs/stdenv/nix/default.nix
@@ -9,15 +9,15 @@
 }:
 
 assert crossSystem == localSystem;
-
+let
+  genericStdenv = import ../generic { defaultConfig = config; };
+in
 bootStages
 ++ [
   (prevStage: {
     inherit config overlays;
 
-    stdenv = import ../generic rec {
-      inherit config;
-
+    stdenv = genericStdenv rec {
       inherit (prevStage.stdenv) buildPlatform hostPlatform targetPlatform;
 
       preHook = ''
diff --git a/pkgs/tools/networking/iperf/3.nix b/pkgs/tools/networking/iperf/3.nix
index 9adc42da8f0a..a88acec2192f 100644
--- a/pkgs/tools/networking/iperf/3.nix
+++ b/pkgs/tools/networking/iperf/3.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "iperf";
-  version = "3.20";
+  version = "3.21";
 
   src = fetchurl {
     url = "https://downloads.es.net/pub/iperf/iperf-${version}.tar.gz";
-    hash = "sha256-OsxXLR7MpOCyA1nHvwEy3cgNmC7+7iDIb2cmqaYJQ4g=";
+    hash = "sha256-ZW5EBevWIBId587KPq9DqI956huFfQQaagsTFIAazdg=";
   };
 
   buildInputs = [ openssl ] ++ lib.optionals stdenv.hostPlatform.isLinux [ lksctp-tools ];
diff --git a/pkgs/tools/package-management/nix/modular/packaging/components.nix b/pkgs/tools/package-management/nix/modular/packaging/components.nix
index 4efc2239670c..8022ad9400cb 100644
--- a/pkgs/tools/package-management/nix/modular/packaging/components.nix
+++ b/pkgs/tools/package-management/nix/modular/packaging/components.nix
@@ -190,6 +190,7 @@ let
     pos = builtins.unsafeGetAttrPos "pname" prevAttrs;
     meta = prevAttrs.meta or { } // {
       homepage = prevAttrs.meta.homepage or "https://nixos.org/nix";
+      donationPage = prevAttrs.meta.donationPage or "https://nixos.org/donate/";
       longDescription =
         prevAttrs.longDescription or ''
           Nix is a powerful package manager for mainly Linux and other Unix systems that
diff --git a/pkgs/tools/package-management/nix/modular/packaging/everything.nix b/pkgs/tools/package-management/nix/modular/packaging/everything.nix
index b37568ec7056..933002bb0f5b 100644
--- a/pkgs/tools/package-management/nix/modular/packaging/everything.nix
+++ b/pkgs/tools/package-management/nix/modular/packaging/everything.nix
@@ -240,6 +240,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Nix package manager";
     longDescription = nix-cli.meta.longDescription;
     homepage = nix-cli.meta.homepage;
+    donationPage = nix-cli.meta.donationPage;
     license = nix-cli.meta.license;
     teams = teams;
     platforms = nix-cli.meta.platforms;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1bfd37c297af..621bbb09e261 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1772,7 +1772,7 @@ with pkgs;
 
   klipper-firmware = callPackage ../servers/klipper/klipper-firmware.nix { };
 
-  klipper-flash = callPackage ../servers/klipper/klipper-flash.nix { };
+  klipper-flash = callPackage ../servers/klipper/klipper-flash.nix { flashDevice = "/dev/null"; };
 
   klipper-genconf = callPackage ../servers/klipper/klipper-genconf.nix { };
 
@@ -2060,6 +2060,7 @@ with pkgs;
     cudaPackages_13_0
     cudaPackages_13_1
     cudaPackages_13_2
+    cudaPackages_13_3
     ;
 
   cudaPackages_12 = cudaPackages_12_9;
@@ -8297,7 +8298,7 @@ with pkgs;
         inherit (stdenv.buildPlatform) system;
         inherit (config) rewriteURL;
       };
-      checkMeta = callPackage ../stdenv/generic/check-meta.nix { inherit (stdenv) hostPlatform; };
+      checkMeta = callPackage ../stdenv/generic/check-meta.nix { };
     }
   );
   minimal-bootstrap-sources =
@@ -9639,10 +9640,6 @@ with pkgs;
       ;
   };
 
-  peaclock = callPackage ../applications/misc/peaclock {
-    stdenv = gccStdenv;
-  };
-
   pianoteq = callPackage ../applications/audio/pianoteq { };
 
   pidginPackages = recurseIntoAttrs (
@@ -10995,7 +10992,7 @@ with pkgs;
     enableUnfree = true;
   };
 
-  inherit (ocaml-ng.ocamlPackages_5_3) hol_light;
+  inherit (ocamlPackages) hol_light;
 
   isabelle-components = recurseIntoAttrs (callPackage ../by-name/is/isabelle/components { });
 
diff --git a/pkgs/top-level/cuda-packages.nix b/pkgs/top-level/cuda-packages.nix
index 9cd19ae7695a..e8ba07abea45 100644
--- a/pkgs/top-level/cuda-packages.nix
+++ b/pkgs/top-level/cuda-packages.nix
@@ -174,6 +174,29 @@ let
       tensorrt =
         if hasPreThorJetsonCudaCapability requestedJetsonCudaCapabilities then "10.7.0" else "10.14.1";
     };
+
+  cudaPackages_13_3 =
+    let
+      inherit (cudaPackages_13_3.backendStdenv) requestedJetsonCudaCapabilities;
+    in
+    mkCudaPackages {
+      cublasmp = "0.8.1";
+      cuda = "13.3.0";
+      cudnn =
+        if hasPreThorJetsonCudaCapability requestedJetsonCudaCapabilities then "9.13.0" else "9.22.0";
+      cudss = "0.6.0";
+      cuquantum = "25.09.0";
+      cusolvermp = "0.8.0";
+      cusparselt = "0.8.1";
+      cutensor = "2.3.1";
+      nppplus = "0.10.0";
+      nvcomp = "5.0.0.6";
+      nvjpeg2000 = "0.9.0";
+      nvpl = "25.5";
+      nvtiff = "0.5.1";
+      tensorrt =
+        if hasPreThorJetsonCudaCapability requestedJetsonCudaCapabilities then "10.7.0" else "10.14.1";
+    };
 in
 {
   inherit
@@ -183,5 +206,6 @@ in
     cudaPackages_13_0
     cudaPackages_13_1
     cudaPackages_13_2
+    cudaPackages_13_3
     ;
 }
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index c9c9f327a0f7..6416a7daf1ff 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -2336,16 +2336,7 @@ let
 
         google-drive-ocamlfuse = callPackage ../applications/networking/google-drive-ocamlfuse { };
 
-        hol_light = callPackage ../applications/science/logic/hol_light {
-          camlp5 =
-            if lib.versionAtLeast camlp5.version "8.04.00" then
-              camlp5.overrideAttrs {
-                version = "8.03.2";
-                __intentionallyOverridingVersion = true;
-              }
-            else
-              camlp5;
-        };
+        hol_light = callPackage ../applications/science/logic/hol_light { };
 
         ### End ###
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index ffe1520697b8..921e63b948ed 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -12812,13 +12812,16 @@ self: super: with self; {
 
   plotpy = callPackage ../development/python-modules/plotpy { };
 
+  # Use Plover 5 as Plover 4 depends on setuptool's pkg_resources to discover plugins,
+  # which the setuptools upstream deprecated at version 81.0.0 and removed at version 82.0.0
+  # Plover 5 has addressed this issue by switching to importlib.meta.distributions()
+  #
+  # NOTE:
   # Plover 5 moves from PyQt5 to PySide6,
-  # which is a backward-incompatible change to praphical plugins.
-  # Use Plover 4 for now (2026-04-26),
-  # as the upstream still warns about this in every Plover 5 release,
+  # which is a backward-incompatible change to graphical plugins.
   # List of unsupported plugins:
   # https://github.com/opensteno/plover_plugins_registry/blob/master/unsupported.json
-  plover = plover_4;
+  plover = plover_5;
 
   plover-dict-commands = callPackage ../development/python-modules/plover-dict-commands { };