diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 3514a6ded307..34333b64ec46 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -24,6 +24,10 @@ on:
       # not evaluate untrusted code.
       NIXPKGS_MANUAL_EDIT_CHECK_APP_PRIVATE_KEY:
         required: false
+      # Can be provided in pull requests because the job it is used in does
+      # not evaluate untrusted code.
+      NIXPKGS_CI_APP_PRIVATE_KEY:
+        required: false
       # Should only be provided in the merge queue, not in pull requests,
       # where we're evaluating untrusted code.
       CACHIX_AUTH_TOKEN_GHA:
@@ -136,6 +140,52 @@ jobs:
           GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
         run: gh api /rate_limit | jq
 
+  reminders:
+    if: inputs.baseBranch && inputs.headBranch
+    permissions:
+      pull-requests: write
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 8
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+          path: trusted
+          sparse-checkout: |
+            ci/github-script
+
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        if: github.event_name != 'pull_request' && vars.NIXPKGS_CI_CLIENT_ID
+        id: app-token
+        with:
+          client-id: ${{ vars.NIXPKGS_CI_CLIENT_ID }}
+          private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
+          permission-pull-requests: write
+
+      - name: Log current API rate limits
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
+        run: gh api /rate_limit | jq
+
+      - name: Post reminders
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          github-token: ${{ steps.app-token.outputs.token || github.token }}
+          script: |
+            const { default: postReminders } = await import('${{ github.workspace }}/trusted/ci/github-script/reminders.ts')
+            await postReminders({
+              github,
+              context,
+              core,
+              dry: context.eventName == 'pull_request',
+              repoPath: 'trusted',
+            })
+
+      - name: Log current API rate limits
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
+        run: gh api /rate_limit | jq
+
   github-script:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 5
diff --git a/.github/workflows/pull-request-target.yml b/.github/workflows/pull-request-target.yml
index 48f74b6dd930..aa42175a0cc1 100644
--- a/.github/workflows/pull-request-target.yml
+++ b/.github/workflows/pull-request-target.yml
@@ -82,6 +82,7 @@ jobs:
     secrets:
       NIXPKGS_COMMIT_CHECK_APP_PRIVATE_KEY: ${{ secrets.NIXPKGS_COMMIT_CHECK_APP_PRIVATE_KEY }}
       NIXPKGS_MANUAL_EDIT_CHECK_APP_PRIVATE_KEY: ${{ secrets.NIXPKGS_MANUAL_EDIT_CHECK_APP_PRIVATE_KEY }}
+      NIXPKGS_CI_APP_PRIVATE_KEY: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
     with:
       baseBranch: ${{ needs.prepare.outputs.baseBranch }}
       headBranch: ${{ needs.prepare.outputs.headBranch }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index d2e3c0e1bb4c..742e3d8ca6ed 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -89,6 +89,7 @@ jobs:
               'ci/github-script/package.json',
               'ci/github-script/package-lock.json',
               'ci/github-script/prepare.js',
+              'ci/github-script/reminders.ts',
               'ci/github-script/reviewers.js',
               'ci/github-script/reviews.js',
               'ci/github-script/supportedBranches.js',
@@ -96,7 +97,7 @@ jobs:
               'ci/github-script/withRateLimit.js',
               'ci/pinned.json',
               'pkgs/top-level/release-supported-systems.json',
-            ].includes(file))) core.setOutput('pr', true)
+            ].includes(file) || file.startsWith('ci/github-script/reminders/'))) core.setOutput('pr', true)
 
   merge-group:
     if: needs.prepare.outputs.merge-group
diff --git a/ci/github-script/README.md b/ci/github-script/README.md
index 52b78c79d79f..d47559081746 100644
--- a/ci/github-script/README.md
+++ b/ci/github-script/README.md
@@ -15,3 +15,9 @@ Run `./run commits OWNER REPO PR`, where OWNER is your username or "NixOS", REPO
 ## Labeler
 
 Run `./run labels OWNER REPO`, where OWNER is your username or "NixOS" and REPO the name of your fork or "nixpkgs".
+
+## Reminders
+
+Run `./run reminders OWNER REPO PR` to post the reminders that apply to the paths a pull request touches.
+
+To add a reminder, write the review body to `reminders/KEY.md` and list KEY with its path regexes in `reminders.js`.
diff --git a/ci/github-script/reminders.ts b/ci/github-script/reminders.ts
new file mode 100644
index 000000000000..49431c752149
--- /dev/null
+++ b/ci/github-script/reminders.ts
@@ -0,0 +1,111 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import type * as actionsCore from '@actions/core'
+import type { context as actionsContext } from '@actions/github'
+import type { GitHub } from '@actions/github/lib/utils'
+import { getCommitDetailsForPR } from './get-pr-commit-details.js'
+import { dismissReviews, postReview } from './reviews.js'
+import { classify } from './supportedBranches.js'
+
+/**
+ * Reminders to post as a non-blocking review when a pull request touches
+ * certain matching paths.
+ */
+export const reminders: { key: string; paths: RegExp[] }[] = [
+  {
+    key: 'docs-styleguide',
+    paths: [/^doc\//, /^nixos\/doc\//, /^nixos\/modules\/.*\.md$/],
+  },
+]
+
+export function matchesAny(changedPaths: string[], patterns: RegExp[]) {
+  return changedPaths.some((changedPath) =>
+    patterns.some((pattern) => pattern.test(changedPath)),
+  )
+}
+
+function reminderBody(key: string) {
+  return fs
+    .readFileSync(path.join(import.meta.dirname, 'reminders', `${key}.md`), {
+      encoding: 'utf8',
+    })
+    .trim()
+}
+
+export default async function postReminders({
+  github,
+  context,
+  core,
+  repoPath,
+  dry,
+}: {
+  github: InstanceType<typeof GitHub>
+  context: typeof actionsContext
+  core: typeof actionsCore
+  repoPath?: string
+  dry: boolean
+}) {
+  const pull_number = context.payload.pull_request?.number
+  if (!pull_number) {
+    core.info('This is not a pull request. Skipping reminders.')
+    return
+  }
+
+  const pr = (
+    await github.rest.pulls.get({
+      ...context.repo,
+      pull_number,
+    })
+  ).data
+
+  if (pr.user.login.endsWith('[bot]')) {
+    core.info('This is a bot, so reminders do not apply.')
+    return
+  }
+
+  const baseBranchType = classify(
+    pr.base.ref.replace(/^refs\/heads\//, ''),
+  ).type
+  const headBranchType = classify(
+    pr.head.ref.replace(/^refs\/heads\//, ''),
+  ).type
+
+  if (
+    baseBranchType.includes('development') &&
+    headBranchType.includes('development') &&
+    pr.base.repo.id === pr.head.repo?.id
+  ) {
+    // This matches, for example, PRs from NixOS:staging-next to NixOS:master, or vice versa.
+    // We ignore them, we should only care about PRs introducing new commits.
+    // We still want to run on PRs from, e.g., Someone:master to NixOS:master though.
+    core.info(
+      'This PR is from one development branch to another. Skipping reminders.',
+    )
+    return
+  }
+
+  const details = await getCommitDetailsForPR({ core, pr, repoPath })
+  const changedPaths = details.flatMap(({ changedPaths }) => changedPaths)
+
+  for (const { key, paths } of reminders) {
+    if (matchesAny(changedPaths, paths)) {
+      await postReview({
+        github,
+        context,
+        core,
+        dry,
+        event: 'COMMENT',
+        body: reminderBody(key),
+        reviewKey: key,
+      })
+    } else {
+      await dismissReviews({
+        github,
+        context,
+        core,
+        dry,
+        reviewKey: key,
+      })
+    }
+  }
+}
diff --git a/ci/github-script/reminders/docs-styleguide.md b/ci/github-script/reminders/docs-styleguide.md
new file mode 100644
index 000000000000..d42fc5265e11
--- /dev/null
+++ b/ci/github-script/reminders/docs-styleguide.md
@@ -0,0 +1,12 @@
+Thanks for contributing to the documentation
+
+Make sure you follow the [documentation styleguide](https://github.com/NixOS/nixpkgs/blob/master/doc/styleguide.md), most notably:
+
+- Show, don't tell: lead with a minimal working example; explanation follows the code.
+- No meta-commentary: don't write "This section explains how to…", just do it.
+- Imperative mood and active voice: "Run the command", not "The user should run the following command".
+- Present tense: "This creates a folder", not "This will create a folder".
+- Be confident: no hedging with "should", "might", "typically", "usually".
+- Cut filler words: "simply", "just", "easily", "basically"; "to", not "in order to".
+
+For larger changes, like adding or removing whole sections, ask the NixOS documentation team for a review.
diff --git a/ci/github-script/run b/ci/github-script/run
index 8852bd1e4063..bc164e017940 100755
--- a/ci/github-script/run
+++ b/ci/github-script/run
@@ -127,4 +127,15 @@ program
     await run(checkManualFileEdits, owner, repo, pr, options)
   })
 
+program
+  .command('reminders')
+  .description('Post reminders for the paths a PR touches')
+  .argument('<owner>', 'Owner of the GitHub repository to run on (Example: NixOS)')
+  .argument('<repo>', 'Name of the GitHub repository to run on (Example: nixpkgs)')
+  .argument('<pr>', 'Number of the Pull Request to run on')
+  .action(async (owner, repo, pr, options) => {
+    const postReminders = (await import('./reminders.ts')).default
+    await run(postReminders, owner, repo, pr, options)
+  })
+
 await program.parse()
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index b84c7abe12fd..8702379d3f11 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -10509,10 +10509,9 @@
     name = "Luis G. Torres";
   };
   giomf = {
-    email = "giomf@mailbox.org";
+    name = "giomf";
     github = "giomf";
     githubId = 35076723;
-    name = "Guillaume Fournier";
   };
   giorgiga = {
     email = "giorgio.gallo@bitnic.it";
diff --git a/nixos/modules/security/acme/default.nix b/nixos/modules/security/acme/default.nix
index 894dc9eacaff..100e7d714c5a 100644
--- a/nixos/modules/security/acme/default.nix
+++ b/nixos/modules/security/acme/default.nix
@@ -478,9 +478,9 @@ let
           // {
             Group = data.group;
 
-            # Let's Encrypt Failed Validation Limit allows 5 retries per hour, per account, hostname and hour.
-            # This avoids eating them all up if something is misconfigured upon the first try.
-            RestartSec = 15 * 60;
+            RestartSec = data.renewIntervalFailed;
+
+            Restart = "on-failure";
 
             # Keep in mind that these directories will be deleted if the user runs
             # systemctl clean --what=state
@@ -697,6 +697,18 @@ let
           '';
         };
 
+        renewIntervalFailed = lib.mkOption {
+          type = lib.types.str;
+          inherit (defaultAndText "renewIntervalFailed" "${toString (60 * 15)}") default defaultText;
+          description = ''
+            Systemd time-span value when to retry a renewal in case the service has failed.
+            See {manpage}`systemd.time(7)`
+
+            Let's Encrypt Failed Validation Limit allows 5 retries per hour, per account, hostname and hour.
+            The default avoids eating them all up if something is misconfigured upon the first try.
+          '';
+        };
+
         renewJitter = lib.mkOption {
           type = lib.types.str;
           inherit (defaultAndText "renewJitter" "24h") default defaultText;
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index a3fedf926196..7cb4135481e6 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -4302,8 +4302,8 @@ let
         mktplcRef = {
           publisher = "shd101wyy";
           name = "markdown-preview-enhanced";
-          version = "0.8.35";
-          hash = "sha256-LtaRHhtjO33TRi403SZ3LAbOOVe4w4PzoGV0Avkw/BY=";
+          version = "0.8.36";
+          hash = "sha256-acmubrmOUirHkam1CreoP7p/LR2/6A6kpBku8Den83Y=";
         };
         meta = {
           description = "Provides a live preview of markdown using either markdown-it or pandoc";
diff --git a/pkgs/by-name/ap/apache-airflow/python-package.nix b/pkgs/by-name/ap/apache-airflow/python-package.nix
index cf08710d9401..e5e5dc846bba 100644
--- a/pkgs/by-name/ap/apache-airflow/python-package.nix
+++ b/pkgs/by-name/ap/apache-airflow/python-package.nix
@@ -80,6 +80,7 @@
   tenacity,
   termcolor,
   tomli,
+  tomlkit,
   trove-classifiers,
   types-requests,
   typing-extensions,
@@ -115,7 +116,7 @@ buildPythonPackage (
         pnpm = pnpm_10;
         sourceRoot = uiAttrs.sourceRoot;
         fetcherVersion = 3;
-        hash = "sha256-dn8DRI2uRlc5FKNiP2nL1RlZOs7NSH+66qHyUKP5KBc=";
+        hash = "sha256-+f/AcJSQyvu3YCT6p4wvbNXz/xM0WN8N+MWT7iLlFEk=";
       };
 
       buildPhase = ''
@@ -148,7 +149,7 @@ buildPythonPackage (
         pnpm = pnpm_10;
         sourceRoot = simpleUiAttrs.sourceRoot;
         fetcherVersion = 3;
-        hash = "sha256-KcWxcWPhtoZIfa1DZdIjTDik28cTk86HQnCBg8e2xWg=";
+        hash = "sha256-jLCTKdBdKQufVWQ1XRzOVN4jVC0YAcP+jnz5R966zUY=";
       };
 
       buildPhase = ''
@@ -181,20 +182,37 @@ buildPythonPackage (
 
         dontCheckPythonMetadata = true;
 
+        dontCheckRuntimeDeps = true;
+
         inherit src;
         sourceRoot = "${src.name}/providers/${lib.replaceStrings [ "_" ] [ "/" ] provider}";
 
-        buildInputs = [ flit-core ];
+        postPatch = ''
+          # relax dependencies
+          sed -i -E 's/"flit_core==[^"]+"/"flit_core"/' pyproject.toml
+          sed -i -E 's/"hatchling==[^"]+"/"hatchling"/' pyproject.toml
+          sed -i -E 's/"packaging==[^"]+"/"packaging"/' pyproject.toml
+          sed -i -E 's/"pathspec==[^"]+"/"pathspec"/' pyproject.toml
+          sed -i -E 's/"pluggy==[^"]+"/"pluggy"/' pyproject.toml
+          sed -i -E 's/"tomlkit==[^"]+"/"tomlkit"/' pyproject.toml
+          sed -i -E 's/"trove-classifiers==[^"]+"/"trove-classifiers"/' pyproject.toml
+        '';
+
+        build-system = [
+          flit-core
+          hatchling
+          packaging
+          pathspec
+          pluggy
+          tomlkit
+          trove-classifiers
+        ];
 
         dependencies = map (dep: python.pkgs.${dep}) providers.${provider}.deps;
 
         pythonRemoveDeps = [
           "apache-airflow"
         ];
-
-        pythonRelaxDeps = [
-          "flit-core"
-        ];
       };
 
     taskSdk = buildPythonPackage {
@@ -213,8 +231,10 @@ buildPythonPackage (
         # relax dependencies
         sed -i -E 's/"hatchling==[^"]+"/"hatchling"/' pyproject.toml
         sed -i -E 's/"packaging==[^"]+"/"packaging"/' pyproject.toml
-        sed -i -E 's/"trove-classifiers==[^"]+"/"trove-classifiers"/' pyproject.toml
         sed -i -E 's/"pathspec==[^"]+"/"pathspec"/' pyproject.toml
+        sed -i -E 's/"pluggy==[^"]+"/"pluggy"/' pyproject.toml
+        sed -i -E 's/"tomlkit==[^"]+"/"tomlkit"/' pyproject.toml
+        sed -i -E 's/"trove-classifiers==[^"]+"/"trove-classifiers"/' pyproject.toml
 
         # task-sdk needs config.yml from core subpackage
         mkdir -p src/airflow/config_templates
@@ -223,6 +243,11 @@ buildPythonPackage (
 
       build-system = [
         hatchling
+        packaging
+        pathspec
+        pluggy
+        tomlkit
+        trove-classifiers
       ];
 
       dependencies = [
@@ -239,7 +264,10 @@ buildPythonPackage (
         methodtools
         msgspec
         opentelemetry-api
+        packaging
+        pathspec
         pendulum
+        pluggy
         psutil
         pydantic
         pygtrie
@@ -249,6 +277,7 @@ buildPythonPackage (
         structlog
         tenacity
         types-requests
+        typing-extensions
       ];
     };
 
@@ -269,9 +298,11 @@ buildPythonPackage (
         sed -i -E 's/"hatchling==[^"]+"/"hatchling"/' pyproject.toml
         sed -i -E 's/"packaging==[^"]+"/"packaging"/' pyproject.toml
         sed -i -E 's/"GitPython==[^"]+"/"GitPython"/' pyproject.toml
-        sed -i -E 's/"trove-classifiers==[^"]+"/"trove-classifiers"/' pyproject.toml
-        sed -i -E 's/"smmap==[^"]+"/"smmap"/' pyproject.toml
         sed -i -E 's/"pathspec==[^"]+"/"pathspec"/' pyproject.toml
+        sed -i -E 's/"pluggy==[^"]+"/"pluggy"/' pyproject.toml
+        sed -i -E 's/"smmap==[^"]+"/"smmap"/' pyproject.toml
+        sed -i -E 's/"tomlkit==[^"]+"/"tomlkit"/' pyproject.toml
+        sed -i -E 's/"trove-classifiers==[^"]+"/"trove-classifiers"/' pyproject.toml
 
         # Copy built UI assets
         cp -r ${airflowUi}/share/airflow/ui/dist src/airflow/ui/
@@ -283,8 +314,11 @@ buildPythonPackage (
         gitpython
         hatchling
         packaging
+        pathspec
+        pluggy
         smmap
         tomli
+        tomlkit
         trove-classifiers
       ];
 
@@ -361,7 +395,7 @@ buildPythonPackage (
   in
   {
     pname = "apache-airflow";
-    version = "3.3.1";
+    version = "3.3.2";
 
     __structuredAttrs = true;
 
@@ -369,7 +403,7 @@ buildPythonPackage (
       owner = "apache";
       repo = "airflow";
       tag = finalAttrs.version;
-      hash = "sha256-ezEeO14GdaD7ZAl5VCiiIqkyoccHQ76QrThA3NeGP78=";
+      hash = "sha256-iWr1LYq+lThZU7b7CmrIWFbg20bFy+SghrBpE6asgrg=";
     };
 
     pyproject = true;
@@ -378,8 +412,10 @@ buildPythonPackage (
       # relax dependencies
       sed -i -E 's/"hatchling==[^"]+"/"hatchling"/' pyproject.toml
       sed -i -E 's/"packaging==[^"]+"/"packaging"/' pyproject.toml
-      sed -i -E 's/"trove-classifiers==[^"]+"/"trove-classifiers"/' pyproject.toml
       sed -i -E 's/"pathspec==[^"]+"/"pathspec"/' pyproject.toml
+      sed -i -E 's/"pluggy==[^"]+"/"pluggy"/' pyproject.toml
+      sed -i -E 's/"tomlkit==[^"]+"/"tomlkit"/' pyproject.toml
+      sed -i -E 's/"trove-classifiers==[^"]+"/"trove-classifiers"/' pyproject.toml
     '';
 
     nativeBuildInputs = [ writableTmpDirAsHomeHook ];
@@ -393,6 +429,7 @@ buildPythonPackage (
       pluggy
       smmap
       tomli
+      tomlkit
       trove-classifiers
     ];
 
diff --git a/pkgs/by-name/at/atlas-file-manager/package.nix b/pkgs/by-name/at/atlas-file-manager/package.nix
new file mode 100644
index 000000000000..f3fe0ab39784
--- /dev/null
+++ b/pkgs/by-name/at/atlas-file-manager/package.nix
@@ -0,0 +1,68 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  ninja,
+  pkg-config,
+  qt6,
+  exiv2,
+  nix-update-script,
+  testers,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "atlas-file-manager";
+  version = "1.2.0";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "AstraSuite";
+    repo = "Atlas";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-l/jdB90oPVxFG5LlylQxYskYJN+av+MGjiy4jh5Il6s=";
+  };
+
+  postPatch = ''
+    substituteInPlace src/main.cpp \
+      --replace-fail 'app.setApplicationVersion("1.0.0");' 'app.setApplicationVersion("${finalAttrs.version}");'
+  '';
+
+  nativeBuildInputs = [
+    cmake
+    ninja
+    pkg-config
+    qt6.wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    qt6.qtbase
+    qt6.qtdeclarative
+    qt6.qtsvg
+    qt6.qtmultimedia
+    exiv2
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeFeature "ATLAS_VERSION" finalAttrs.version)
+  ];
+
+  passthru = {
+    updateScript = nix-update-script { };
+    tests.version = testers.testVersion {
+      package = finalAttrs.finalPackage;
+      command = "QT_QPA_PLATFORM=offscreen atlas --version";
+    };
+  };
+
+  meta = {
+    description = "File manager for Caelestia";
+    homepage = "https://github.com/AstraSuite/Atlas";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ rachalaraj ];
+    mainProgram = "atlas";
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/bo/bookorbit/package.nix b/pkgs/by-name/bo/bookorbit/package.nix
index 1e8dd969b48d..85973909e2ce 100644
--- a/pkgs/by-name/bo/bookorbit/package.nix
+++ b/pkgs/by-name/bo/bookorbit/package.nix
@@ -16,7 +16,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "bookorbit";
-  version = "2.10.0";
+  version = "3.0.0";
   __structuredAttrs = true;
   strictDeps = true;
 
@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "bookorbit";
     repo = "bookorbit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Hczdvkv0p17qbsg0ZKczpFFZwMLasX5QC/yZQ5BOzA4=";
+    hash = "sha256-+1yTDRnq8gHWHJY2q24+EpkPjvZFLgzzUkfa/XQS55g=";
   };
 
   pnpmWorkspaces = [
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
       ;
     inherit pnpm;
     fetcherVersion = 4;
-    hash = "sha256-v/SVAGwDyBGdHdrbk0H3cpnF+w2/TLOcVfLFXe8kr8Y=";
+    hash = "sha256-A+qKEHVLKn/tvYOk+h+drjWx59nVTh0wnrBxwf+uGx0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/bu/buildstream/package.nix b/pkgs/by-name/bu/buildstream/package.nix
index 43f55b73362e..d4da8b03c5be 100644
--- a/pkgs/by-name/bu/buildstream/package.nix
+++ b/pkgs/by-name/bu/buildstream/package.nix
@@ -3,6 +3,7 @@
   python3Packages,
   fetchFromGitHub,
   gitUpdater,
+  runtimeShell,
 
   # buildInputs
   buildbox,
@@ -72,6 +73,21 @@ python3Packages.buildPythonApplication (finalAttrs: {
     patch
   ];
 
+  # The dummy buildbox-casd scripts spawned by tests/internals/cascache.py use
+  # an `/usr/bin/env sh` shebang, which doesn't exist in the Nix build sandbox.
+  postPatch = ''
+    substituteInPlace tests/internals/cascache.py \
+      --replace-fail '#!/usr/bin/env sh' '#!${runtimeShell}'
+  '';
+
+  # /dev/fuse is not available inside the Nix build sandbox, so buildbox-casd's
+  # default FUSE-based staging strategy cannot work here. Force the hardlink/copy
+  # stager instead (this is a real, supported buildbox-casd staging mode, not a
+  # workaround: https://gitlab.com/BuildGrid/buildbox/buildbox/-/blob/main/casd/buildboxcasd_server.cpp).
+  preCheck = ''
+    export BUILDBOX_STAGER=copy-or-link
+  '';
+
   pythonImportsCheck = [ "buildstream" ];
 
   nativeCheckInputs = [
@@ -86,29 +102,17 @@ python3Packages.buildPythonApplication (finalAttrs: {
     python3Packages.pytest-xdist
     python3Packages.pytestCheckHook
     versionCheckHook
-  ];
 
-  disabledTests = [
-    # Error loading project: project.conf [line 37 column 2]: Failed to load source-mirror plugin 'mirror': No package metadata was found for sample-plugins
-    "test_source_mirror_plugin"
-
-    # AssertionError: assert '1a5528cad211...0bbe5ee314c14' == '2ccfee62a657...52dbc47203a88'
-    "test_fixed_cas_import"
-    "test_random_cas_import"
-
-    # Runtime error: The FUSE stager child process unexpectedly died with exit code 2
-    "test_patch_sources_cached_1"
-    "test_patch_sources_cached_2"
-    "test_source_cache_key"
-    "test_custom_transform_source"
-
-    # Blob not found in the local CAS
-    "test_source_pull_partial_fallback_fetch"
-  ];
-
-  disabledTestPaths = [
-    # FileNotFoundError: [Errno 2] No such file or directory: '/build/source/tmp/popen-gw1/test_report_when_cascache_exit0/buildbox-casd'
-    "tests/internals/cascache.py"
+    # Test fixture plugin package used by test_source_mirror_plugin[pip]; upstream
+    # normally installs this via tox before running the pip-origin plugin loading test.
+    (python3Packages.buildPythonPackage {
+      pname = "sample-plugins";
+      version = "1.2.3";
+      pyproject = true;
+      build-system = [ python3Packages.setuptools ];
+      src = "${finalAttrs.src}/tests/plugins/sample-plugins";
+      dontCheck = true;
+    })
   ];
 
   postInstall = ''
diff --git a/pkgs/by-name/ca/caelestia-cli/package.nix b/pkgs/by-name/ca/caelestia-cli/package.nix
index 039b73e2dd5e..4b75723ab8fa 100644
--- a/pkgs/by-name/ca/caelestia-cli/package.nix
+++ b/pkgs/by-name/ca/caelestia-cli/package.nix
@@ -20,13 +20,13 @@
 python3.pkgs.buildPythonApplication rec {
   pname = "caelestia-cli";
   __structuredAttrs = true;
-  version = "1.1.2";
+  version = "1.1.3";
 
   src = fetchFromGitHub {
     owner = "caelestia-dots";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-cCP6RAEh6JliKFmvtgi97uIG1dH0lIIuDNAdrdX+1U0=";
+    hash = "sha256-71nGzEgBK7lZVjjKC9h1zmVlloZOmSlzn0Q4VoYo6gI=";
   };
 
   pyproject = true;
diff --git a/pkgs/by-name/co/cosmic-ext-applet-sysinfo/package.nix b/pkgs/by-name/co/cosmic-ext-applet-sysinfo/package.nix
index 5d1191c1e9da..74e87c0734b4 100644
--- a/pkgs/by-name/co/cosmic-ext-applet-sysinfo/package.nix
+++ b/pkgs/by-name/co/cosmic-ext-applet-sysinfo/package.nix
@@ -9,16 +9,16 @@
 }:
 rustPlatform.buildRustPackage {
   pname = "cosmic-ext-applet-sysinfo";
-  version = "0-unstable-2026-09-08";
+  version = "0-unstable-2026-09-20";
 
   src = fetchFromGitHub {
     owner = "cosmic-utils";
     repo = "cosmic-ext-applet-sysinfo";
-    rev = "74265699a6d2b9803707bd1be9a4241b192f78fe";
-    hash = "sha256-kSxBoRepJX0bw6xhFXNp6inzv5vMlp2c5SDHxLY4I0s=";
+    rev = "d7359f09963cafb54f47a049a274acd9c2c3edda";
+    hash = "sha256-fv2cPisF6GapYAV9RdroaIY0JV6lwE5vTzRUHzNzBVM=";
   };
 
-  cargoHash = "sha256-xCzrsLQb9k7VcNmt+pyHQk6UdxR0TjdhRz9wPZ4tsEY=";
+  cargoHash = "sha256-GbHRdz7RZHSCIN6wBW+cTZS8JwYB3mCW6tgnKawFPao=";
 
   nativeBuildInputs = [
     libcosmicAppHook
diff --git a/pkgs/by-name/co/cosmic-ext-applet-weather/package.nix b/pkgs/by-name/co/cosmic-ext-applet-weather/package.nix
index 50950b2eb21b..2f645541dd4b 100644
--- a/pkgs/by-name/co/cosmic-ext-applet-weather/package.nix
+++ b/pkgs/by-name/co/cosmic-ext-applet-weather/package.nix
@@ -9,13 +9,13 @@
 }:
 rustPlatform.buildRustPackage {
   pname = "cosmic-ext-applet-weather";
-  version = "0-unstable-2026-09-03";
+  version = "0-unstable-2026-09-12";
 
   src = fetchFromGitHub {
     owner = "cosmic-utils";
     repo = "cosmic-ext-applet-weather";
-    rev = "52a9e3a4ac6de8d8476a3b609dcea32feae490a6";
-    hash = "sha256-O7CjexYM1AWS0P+cm1ibgZRannmKpJMIDi8oRLE2piM=";
+    rev = "7792d617245ae990ea2460c805e515b514a14ae6";
+    hash = "sha256-gBeqah4E2/KJS8nxOcFjQev73H6Hne754H4BsuhQfCs=";
   };
 
   cargoHash = "sha256-IzxjV+9Z3RNwF/6h1SGvsE8F5CgbqFTZzptgyi3jOZA=";
diff --git a/pkgs/by-name/cy/cyan-skillfish-governor-smu/package.nix b/pkgs/by-name/cy/cyan-skillfish-governor-smu/package.nix
index 25b1970b3c96..7c2806dd216c 100644
--- a/pkgs/by-name/cy/cyan-skillfish-governor-smu/package.nix
+++ b/pkgs/by-name/cy/cyan-skillfish-governor-smu/package.nix
@@ -10,7 +10,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cyan-skillfish-governor-smu";
-  version = "0.4.12";
+  version = "0.4.13";
 
   __structuredAttrs = true;
 
@@ -18,7 +18,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "filippor";
     repo = "cyan-skillfish-governor";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yer2MlLnj9lx2cEBeYqAktbx0BqQEK/eFPiga5gXCr8=";
+    hash = "sha256-EloJJiCmwGDYSyDPQOd3T7AtQp9M2ILkWg6oqOHHJWg=";
   };
 
   cargoHash = "sha256-zlAVGLGnub2Gc0Bkzb5GU9NBAJ2YWLhIG8JOa+1wHx8=";
diff --git a/pkgs/by-name/da/dataform/package-lock.json b/pkgs/by-name/da/dataform/package-lock.json
index cf78ffd651b2..04a03cc2f8f4 100644
--- a/pkgs/by-name/da/dataform/package-lock.json
+++ b/pkgs/by-name/da/dataform/package-lock.json
@@ -1,12 +1,12 @@
 {
     "name": "@dataform/cli",
-    "version": "3.0.69",
+    "version": "3.0.70",
     "lockfileVersion": 3,
     "requires": true,
     "packages": {
         "": {
             "name": "@dataform/cli",
-            "version": "3.0.69",
+            "version": "3.0.70",
             "license": "Apache-2.0",
             "dependencies": {
                 "@google-cloud/bigquery": "~8.3.0",
@@ -17,7 +17,7 @@
                 "glob": "13.0.6",
                 "google-sql-syntax-ts": "^1.0.3",
                 "js-beautify": "^1.10.2",
-                "js-yaml": "^4.2.0",
+                "js-yaml": "^4.3.2",
                 "moo": "^0.5.0",
                 "object-sizeof": "^1.6.1",
                 "parse-duration": "^1.0.0",
@@ -147,9 +147,9 @@
             }
         },
         "node_modules/@grpc/grpc-js": {
-            "version": "1.14.4",
-            "resolved": "https://registry.npmjs.org/@grpc/grpc-js/-/grpc-js-1.14.4.tgz",
-            "integrity": "sha512-k9Dj3DV/itK9D06Y8f190Qgop7/Ui+D0njFV3LHMPwPT75DpXLQohE9Wmz0QElrJnzsjB7KPWiKJbOl7IPDArQ==",
+            "version": "1.14.5",
+            "resolved": "https://registry.npmjs.org/@grpc/grpc-js/-/grpc-js-1.14.5.tgz",
+            "integrity": "sha512-7VZM+SVdEcUUqSQeNI3zM8Qs/BhQKZndPo2h5VkYkAM8Iz0wJIa8mKV5ekQGqG8UUsnkQ0NMxIxwkIHYvj0qOw==",
             "license": "Apache-2.0",
             "dependencies": {
                 "@grpc/proto-loader": "^0.8.0",
@@ -398,12 +398,12 @@
             "license": "BSD-3-Clause"
         },
         "node_modules/@types/node": {
-            "version": "22.20.2",
-            "resolved": "https://registry.npmjs.org/@types/node/-/node-22.20.2.tgz",
-            "integrity": "sha512-xlvWf4Vs9n1PEVYwP1n4vvG07M6y8WgvJ2t0vbrWTmijsIHp1cS+uJ2kMIRdY3nHZK0nCYKrPeD171+SzF4/zw==",
+            "version": "26.6.2",
+            "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.2.tgz",
+            "integrity": "sha512-X1P21scMv4zGKLYqjdGjaKa7COa0RKVYYZZN/NfvLQ1JegxFhdhpZG/Lyn8AXx6CDUavKAd11v6BvfpkDByK8g==",
             "license": "MIT",
             "dependencies": {
-                "undici-types": "~6.21.0"
+                "undici-types": "~8.9.0"
             }
         },
         "node_modules/abbrev": {
@@ -576,9 +576,9 @@
             }
         },
         "node_modules/brace-expansion": {
-            "version": "5.0.9",
-            "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
-            "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+            "version": "5.0.12",
+            "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz",
+            "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==",
             "license": "MIT",
             "dependencies": {
                 "balanced-match": "^4.0.2"
@@ -802,9 +802,9 @@
             "license": "MIT"
         },
         "node_modules/editorconfig/node_modules/brace-expansion": {
-            "version": "2.1.4",
-            "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz",
-            "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==",
+            "version": "2.1.7",
+            "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.7.tgz",
+            "integrity": "sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==",
             "license": "MIT",
             "dependencies": {
                 "balanced-match": "^1.0.0"
@@ -1284,9 +1284,9 @@
             "license": "MIT"
         },
         "node_modules/js-beautify/node_modules/brace-expansion": {
-            "version": "2.1.4",
-            "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz",
-            "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==",
+            "version": "2.1.7",
+            "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.7.tgz",
+            "integrity": "sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==",
             "license": "MIT",
             "dependencies": {
                 "balanced-match": "^1.0.0"
@@ -1433,9 +1433,9 @@
             "license": "Apache-2.0"
         },
         "node_modules/lru-cache": {
-            "version": "11.5.2",
-            "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.2.tgz",
-            "integrity": "sha512-4pfM1Ff0x50o0tQwb5ucw/RzNyD0/YJME6IVcStalZuMWxdt3sR3huStTtxz4PUmvZfRguvDejasvQ2kifR11g==",
+            "version": "11.5.3",
+            "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.3.tgz",
+            "integrity": "sha512-U4N8FgzmWxc8k1VH8Kr6lQg18U7Fjvby6wXHVRX/ZZ7IwWbRMgrRbP0Wrb5q5NVinryp4SQampHKdvtecItxUg==",
             "license": "BlueOak-1.0.0",
             "engines": {
                 "node": "20 || >=22"
@@ -1801,9 +1801,9 @@
             "license": "MIT"
         },
         "node_modules/rimraf/node_modules/brace-expansion": {
-            "version": "2.1.4",
-            "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz",
-            "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==",
+            "version": "2.1.7",
+            "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.7.tgz",
+            "integrity": "sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==",
             "license": "MIT",
             "dependencies": {
                 "balanced-match": "^1.0.0"
@@ -2068,9 +2068,9 @@
             }
         },
         "node_modules/undici-types": {
-            "version": "6.21.0",
-            "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
-            "integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",
+            "version": "8.9.0",
+            "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.9.0.tgz",
+            "integrity": "sha512-KTDyRTYX8sWmKXAikPHHSyc63CRPETMctyjKFupcC6OBLXT3xsN0e9aF7m+mIXutFWpUXuedtowG7iLOzp0kQg==",
             "license": "MIT"
         },
         "node_modules/universalify": {
diff --git a/pkgs/by-name/da/dataform/package.nix b/pkgs/by-name/da/dataform/package.nix
index 780b6e891854..8f0159919945 100644
--- a/pkgs/by-name/da/dataform/package.nix
+++ b/pkgs/by-name/da/dataform/package.nix
@@ -13,7 +13,7 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "dataform";
-  version = "3.0.69";
+  version = "3.0.70";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -22,7 +22,7 @@ buildNpmPackage (finalAttrs: {
 
   src = fetchurl {
     url = "https://registry.npmjs.org/@dataform/cli/-/cli-${finalAttrs.version}.tgz";
-    hash = "sha256-1fOvQfSyl3a+pBZxJc52tSEPLxjMNcLd1SMQ4t4TqhM=";
+    hash = "sha256-wNw+D8oZwR9Zn7wXvZxtA5HPLsfaO+pdHo7D/ZCrSUU=";
   };
 
   # Inject the locally committed lockfile into the extracted source
@@ -30,7 +30,7 @@ buildNpmPackage (finalAttrs: {
     cp ${./package-lock.json} package-lock.json
   '';
 
-  npmDepsHash = "sha256-ZWGmCk9fZX9osQTy8BCyM4Hx2xA/QLaHNqhUCpaEceQ=";
+  npmDepsHash = "sha256-cPBhKHy16ZB8a9U4Nad7/0wguIvJgIYlxFEhbsjY9FY=";
 
   dontNpmBuild = true;
 
diff --git a/pkgs/by-name/de/desync/package.nix b/pkgs/by-name/de/desync/package.nix
index d122b225d523..ee2d7319f5b5 100644
--- a/pkgs/by-name/de/desync/package.nix
+++ b/pkgs/by-name/de/desync/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "desync";
-  version = "1.1.3";
+  version = "1.1.4";
 
   src = fetchFromGitHub {
     owner = "folbricht";
     repo = "desync";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xiiN+0veHRxVNsIpob7W/iRH+dABYIiWfw22DH1bTEs=";
+    hash = "sha256-ORFIGjQD0S7RPgWJqDwPH2wI6Dnv4LvOZ0tMHpOtvPM=";
   };
 
-  vendorHash = "sha256-FRXwQUOD1UiGSlGkBLXT0RGG382RJdEGUJxaQiyzR9A=";
+  vendorHash = "sha256-08LGC+N0NjUAjo9b5JhKNr46CuIXMz/erw2RPRU17xo=";
 
   ldflags = [ "-X main.version=${finalAttrs.src.tag}" ];
 
diff --git a/pkgs/by-name/dn/dns-collector/package.nix b/pkgs/by-name/dn/dns-collector/package.nix
index a3d3596172d2..1d2dc6d816f0 100644
--- a/pkgs/by-name/dn/dns-collector/package.nix
+++ b/pkgs/by-name/dn/dns-collector/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "dns-collector";
-  version = "3.0.0";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "dmachard";
     repo = "dns-collector";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DUpNgnvCKTGU01Qh3L/foVUDHgXHICtOl6wFpNi1KaA=";
+    hash = "sha256-W0fCI/1aiSbKiFQ/DwNuc2+NSGs+QwN+Gv9OUu5rLOY=";
   };
 
   subPackages = [ "." ];
@@ -28,7 +28,7 @@ buildGoModule (finalAttrs: {
     "-X=github.com/prometheus/common/version.Version=${finalAttrs.version}"
   ];
 
-  vendorHash = "sha256-DRb/l8sXqugl8zh+QHO7a0KYF/JS4yDQ11L6MJPipd4=";
+  vendorHash = "sha256-6GMoyJy9HtuGjur1VwtgP3G9CXBKiJZlK/4YNPxhIgo=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/dv/dvdplusrwtools/package.nix b/pkgs/by-name/dv/dvdplusrwtools/package.nix
index b5971726a4c1..0211e13949e4 100644
--- a/pkgs/by-name/dv/dvdplusrwtools/package.nix
+++ b/pkgs/by-name/dv/dvdplusrwtools/package.nix
@@ -12,7 +12,12 @@ stdenv.mkDerivation (finalAttrs: {
   version = "7.1";
 
   src = fetchurl {
-    url = "http://fy.chalmers.se/~appro/linux/DVD+RW/tools/dvd+rw-tools-${finalAttrs.version}.tar.gz";
+    # Original source; no longer available
+    # url = "http://fy.chalmers.se/~appro/linux/DVD+RW/tools/dvd+rw-tools-${finalAttrs.version}.tar.gz";
+    urls = [
+      "https://anduin.linuxfromscratch.org/BLFS/dvd+rw-tools/dvd+rw-tools-${finalAttrs.version}.tar.gz"
+      "https://github.com/openeuler-mirror/dvdplusrw-tools/raw/refs/heads/master/dvd+rw-tools-${finalAttrs.version}.tar.gz"
+    ];
     sha256 = "1jkjvvnjcyxpql97xjjx0kwvy70kxpiznr2zpjy2hhci5s10zmpq";
   };
 
@@ -91,7 +96,7 @@ stdenv.mkDerivation (finalAttrs: {
   );
 
   meta = {
-    homepage = "http://fy.chalmers.se/~appro/linux/DVD+RW/tools";
+    homepage = "https://en.wikipedia.org/wiki/Dvd%2Brw-tools";
     description = "Tools for mastering Blu-ray and DVD+-RW/+-R media";
     platforms = lib.platforms.unix;
     license = with lib.licenses; [
diff --git a/pkgs/by-name/el/electron-mail/package.nix b/pkgs/by-name/el/electron-mail/package.nix
index c394024677f8..06b6b0076704 100644
--- a/pkgs/by-name/el/electron-mail/package.nix
+++ b/pkgs/by-name/el/electron-mail/package.nix
@@ -2,24 +2,23 @@
   appimageTools,
   lib,
   fetchurl,
-  nix-update-script,
   stdenvNoCC,
   makeWrapper,
-  undmg,
+  _7zz,
 }:
 
 let
   pname = "electron-mail";
-  version = "5.3.8";
+  version = "5.3.9";
 
   sources = {
     x86_64-linux = fetchurl {
       url = "https://github.com/vladimiry/ElectronMail/releases/download/v${version}/electron-mail-${version}-linux-x86_64.AppImage";
-      hash = "sha256-twqB1D3zLlZJuxQWD4dGF70w57yYv6i3abGBidERsss=";
+      hash = "sha256-hZxcodnfQ4iyLaXE04QgIjOJs+3NJ7Ukckk71DqnRy0=";
     };
     aarch64-darwin = fetchurl {
       url = "https://github.com/vladimiry/ElectronMail/releases/download/v${version}/electron-mail-${version}-mac-arm64.dmg";
-      hash = "sha256-V32Wi0oCU9dLfzqxg3OdseiILX7wPiBGNz7KuG0vlZY=";
+      hash = "sha256-2CRUEif7UMsZgDWw3HiUEip68wXd0AUPPHdo712ZnYc=";
     };
   };
 
@@ -53,6 +52,8 @@ let
       meta
       ;
 
+    passthru.updateScript = ./update.sh;
+
     extraInstallCommands = ''
       install -m 444 -D ${appimageContents}/${pname}.desktop -t $out/share/applications
       substituteInPlace $out/share/applications/${pname}.desktop \
@@ -64,8 +65,6 @@ let
       pkgs.libsecret
       pkgs.libappindicator
     ];
-
-    passthru.updateScript = nix-update-script { };
   };
 
   darwin = stdenvNoCC.mkDerivation {
@@ -76,9 +75,11 @@ let
       meta
       ;
 
+    passthru.updateScript = ./update.sh;
+
     sourceRoot = ".";
     nativeBuildInputs = [
-      undmg
+      _7zz
       makeWrapper
     ];
 
diff --git a/pkgs/by-name/el/electron-mail/update.sh b/pkgs/by-name/el/electron-mail/update.sh
new file mode 100755
index 000000000000..a2c1c4321560
--- /dev/null
+++ b/pkgs/by-name/el/electron-mail/update.sh
@@ -0,0 +1,27 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -I nixpkgs=./. -i bash -p curl gnused jq nix
+
+set -eou pipefail
+
+ROOT="$(dirname "$(readlink -f "$0")")"
+
+latestVersion=$(curl --fail --silent https://api.github.com/repos/vladimiry/ElectronMail/releases/latest | jq --raw-output .tag_name | sed 's/^v//')
+
+currentVersion=$(nix-instantiate --eval -E "with import ./. {}; electron-mail.version" | tr -d '"')
+
+if [[ "$currentVersion" == "$latestVersion" ]]; then
+  echo "electron-mail is up-to-date: $currentVersion"
+  exit 0
+fi
+
+echo "updating electron-mail: $currentVersion -> $latestVersion"
+
+sed -i "s/version = \".*\"/version = \"${latestVersion}\"/" "$ROOT/package.nix"
+
+APPIMAGE_URL="https://github.com/vladimiry/ElectronMail/releases/download/v${latestVersion}/electron-mail-${latestVersion}-linux-x86_64.AppImage"
+APPIMAGE_HASH=$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri "$(nix-prefetch-url "$APPIMAGE_URL")")
+sed -i "/linux-x86_64\.AppImage/,/hash/{s|hash = \".*\"|hash = \"${APPIMAGE_HASH}\"|}" "$ROOT/package.nix"
+
+DMG_URL="https://github.com/vladimiry/ElectronMail/releases/download/v${latestVersion}/electron-mail-${latestVersion}-mac-arm64.dmg"
+DMG_SHA=$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri "$(nix-prefetch-url "$DMG_URL")")
+sed -i "/mac-arm64\.dmg/,/hash/{s|hash = \".*\"|hash = \"${DMG_SHA}\"|}" "$ROOT/package.nix"
diff --git a/pkgs/by-name/gh/ghgrab/package.nix b/pkgs/by-name/gh/ghgrab/package.nix
index de7da9e6b173..16a651334427 100644
--- a/pkgs/by-name/gh/ghgrab/package.nix
+++ b/pkgs/by-name/gh/ghgrab/package.nix
@@ -23,6 +23,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
   versionCheckProgramArg = "--version";
   nativeInstallCheckInputs = [ versionCheckHook ];
 
+  checkFlags = [
+    # sends request to a github.com url
+    "--skip=test_mcp_repo_info_on_actual_repo"
+  ];
+
   meta = {
     changelog = "https://github.com/abhixdd/ghgrab/releases/tag/v${finalAttrs.version}";
     description = "Simple, pretty terminal tool that lets you search and download files from GitHub without leaving your CLI";
diff --git a/pkgs/by-name/go/gokrazy/package.nix b/pkgs/by-name/go/gokrazy/package.nix
index 7fe80b261ab2..dcb4a7c83fc3 100644
--- a/pkgs/by-name/go/gokrazy/package.nix
+++ b/pkgs/by-name/go/gokrazy/package.nix
@@ -7,13 +7,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "gokrazy";
-  version = "0-unstable-2026-07-23";
+  version = "0-unstable-2026-09-13";
 
   src = fetchFromGitHub {
     owner = "gokrazy";
     repo = "tools";
-    rev = "3fe400c13246e09469afca86df37cdc6fe7c3ee9";
-    hash = "sha256-+wLO374SJu4Sk7GKwJkg6UOxWmJ1ApIfLt3Hw89/dXU=";
+    rev = "64f7f697dfff1a24457b00cd93ca5c30c866f34e";
+    hash = "sha256-puqXa3OpHyzPpOYuf/SicoMJTNDf0hovLE/TOhmBDSw=";
   };
 
   vendorHash = "sha256-+9i4dlxcxXw0WpeuHhnxli2qhB6IWOc4babuJXIO4wA=";
diff --git a/pkgs/by-name/go/gotlsaflare/package.nix b/pkgs/by-name/go/gotlsaflare/package.nix
index ebaf3ac1ce1a..fc1378a7f523 100644
--- a/pkgs/by-name/go/gotlsaflare/package.nix
+++ b/pkgs/by-name/go/gotlsaflare/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gotlsaflare";
-  version = "2.8.4";
+  version = "2.9.0";
 
   src = fetchFromGitHub {
     owner = "Stenstromen";
     repo = "gotlsaflare";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LDUrLeIgEr0IaYUHRdPtk2soYGbPAycQcroIUMrmVKg=";
+    hash = "sha256-98e4uNTW04CMxGyLx7HKHNfDZGotLavH2oqK7WKg9zw=";
   };
 
-  vendorHash = "sha256-btvgwiYm+ccT9BPVO42bxidKfOBDrBMT3WidDlMi17k=";
+  vendorHash = "sha256-auULD38+Imk+OBtuJqDraXmlkqBXUrGCHOhwSR3gCtQ=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/hy/hydralauncher/package.nix b/pkgs/by-name/hy/hydralauncher/package.nix
index 655cccbcd3a7..e3e87e72a1eb 100644
--- a/pkgs/by-name/hy/hydralauncher/package.nix
+++ b/pkgs/by-name/hy/hydralauncher/package.nix
@@ -6,10 +6,10 @@
 }:
 let
   pname = "hydralauncher";
-  version = "4.1.3";
+  version = "4.1.4";
   src = fetchurl {
     url = "https://github.com/hydralauncher/hydra/releases/download/v${version}/hydralauncher-${version}.AppImage";
-    hash = "sha256-kyr5ILGB8yovz6QMNq/LTBFddjsGAzXD12cdBzG80zo=";
+    hash = "sha256-3OrrOdHD1/AvGWVFVvJK9dGNl90YRG6w3j+LcEFfpps=";
   };
 
   appimageContents = appimageTools.extract { inherit pname src version; };
diff --git a/pkgs/by-name/in/infer/package.nix b/pkgs/by-name/in/infer/package.nix
index eed9dec8d202..6e34ed9016f2 100644
--- a/pkgs/by-name/in/infer/package.nix
+++ b/pkgs/by-name/in/infer/package.nix
@@ -244,6 +244,8 @@ stdenv.mkDerivation {
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.kacper-uminski ];
     platforms = lib.platforms.darwin ++ lib.platforms.linux;
+    # ocaml dependency is failing on darwin
+    badPlatforms = lib.platforms.darwin;
     mainProgram = "infer";
   };
 }
diff --git a/pkgs/by-name/ka/kavita/nuget-deps.json b/pkgs/by-name/ka/kavita/nuget-deps.json
index 8f6cfb2ec5b1..43d928b7fec3 100644
--- a/pkgs/by-name/ka/kavita/nuget-deps.json
+++ b/pkgs/by-name/ka/kavita/nuget-deps.json
@@ -16,8 +16,8 @@
   },
   {
     "pname": "Cronos",
-    "version": "0.12.0",
-    "hash": "sha256-skLfxVZjaSP3CMBxzjHR5zBYeiF/Z+MBpDz+ZBy49k4="
+    "version": "0.13.0",
+    "hash": "sha256-ZhLGYF3D0W9hMFLaPFsiup6AwIJTzMXJG7QLTDoJOfc="
   },
   {
     "pname": "CsvHelper",
@@ -46,8 +46,8 @@
   },
   {
     "pname": "ExCSS",
-    "version": "4.3.1",
-    "hash": "sha256-nNn5+YEaqKSULhtDsImNEyndU/MHna7VpZNUExmo80o="
+    "version": "4.3.2",
+    "hash": "sha256-lbTVYhePCanRJN5u2J4bHUiwO3dQL6I3NCgQF4dnwSs="
   },
   {
     "pname": "Flurl",
@@ -61,13 +61,13 @@
   },
   {
     "pname": "Hangfire",
-    "version": "1.8.23",
-    "hash": "sha256-mPKuBcAQwCvy4ch9SB4MevvYRtSX55j60lwY70kkYLE="
+    "version": "1.8.24",
+    "hash": "sha256-Qvd4nFh2EQLiTKPs++zLXdIJMnSO3MbEXy3qajII/wM="
   },
   {
     "pname": "Hangfire.AspNetCore",
-    "version": "1.8.23",
-    "hash": "sha256-HJUrIRoJhIa3HUf7loXvAEKx3UXjqGXLSA6tAfIyIck="
+    "version": "1.8.24",
+    "hash": "sha256-fzwIxgw/0AxqEkFOqH5qB+SNwi8sZIlGlSaHPOPRL44="
   },
   {
     "pname": "Hangfire.Core",
@@ -81,8 +81,8 @@
   },
   {
     "pname": "Hangfire.Core",
-    "version": "1.8.23",
-    "hash": "sha256-yvK4/ynlKy6vkosgB9ncnoxB4vSJmp+ZDUcjDXLDZE4="
+    "version": "1.8.24",
+    "hash": "sha256-bNWFrGyLz5n/7Ulew8f+KKWyvTHX2OZKpe7O7WQrwC8="
   },
   {
     "pname": "Hangfire.InMemory",
@@ -96,13 +96,13 @@
   },
   {
     "pname": "Hangfire.NetCore",
-    "version": "1.8.23",
-    "hash": "sha256-7MxIbS0T7vh7S6PI0qV9wmonMCC9y22Q+BbGB6tblmw="
+    "version": "1.8.24",
+    "hash": "sha256-fKEPeO6y31qfetzRcbxMFbE7RcELpR/t6lDr1MWIJ3A="
   },
   {
     "pname": "Hangfire.SqlServer",
-    "version": "1.8.23",
-    "hash": "sha256-B0nCPPjoxpx9oGgYDYFyvBVftUuE4Hjq2+we/cL3q3M="
+    "version": "1.8.24",
+    "hash": "sha256-Q8LGel2WJgwth4Cyj+s87uthWubLEU//5Pm/GZffNbk="
   },
   {
     "pname": "HtmlAgilityPack",
@@ -116,18 +116,18 @@
   },
   {
     "pname": "MailKit",
-    "version": "4.16.0",
-    "hash": "sha256-4yyFxq8pJVTIgAJkyAYcuV2+/ZirENgUSk1OSD/gKIo="
+    "version": "4.17.0",
+    "hash": "sha256-LGruedMrHrI0AXHcXOFxsYP2awwPbrC9Q41AeQk4+9U="
   },
   {
     "pname": "Markdig",
-    "version": "1.1.3",
-    "hash": "sha256-NbAy/XovL7fFNvpxIqaBmdvNtKLghOGXcy+EoIIh/Bw="
+    "version": "1.3.2",
+    "hash": "sha256-rlIUsV0QBtkdXHsWvJAREQr5XYNQWOGKMOgOKMJ48Zo="
   },
   {
     "pname": "Microsoft.AspNetCore.Authentication",
-    "version": "2.3.0",
-    "hash": "sha256-7i4ZrV0ktGoZe/CCkAjkhpBWF4Gf0oktySXlMEHS4Gc="
+    "version": "2.3.10",
+    "hash": "sha256-Dc+FaTR5Zit4YUHjYIeExAXfbRMG4JIzfyd6n2JONFs="
   },
   {
     "pname": "Microsoft.AspNetCore.Authentication.Abstractions",
@@ -141,23 +141,23 @@
   },
   {
     "pname": "Microsoft.AspNetCore.Authentication.Cookies",
-    "version": "2.3.0",
-    "hash": "sha256-ZxWij7uU2IxCX5jP3dZd80wsbQDGOdf+tlLxg4c0wQ8="
+    "version": "2.3.11",
+    "hash": "sha256-k3e4HnTNtL9QYwUR6AKEd6Nw/2IAtDdQsq2DygA85tw="
   },
   {
     "pname": "Microsoft.AspNetCore.Authentication.Core",
-    "version": "2.3.0",
-    "hash": "sha256-c6LwqJeqKvQZ5HTDQZ8HK23SCcYNTWaAngt0bqhEW+g="
+    "version": "2.3.9",
+    "hash": "sha256-AEr/H0mp2Kh41UIDg2St2zNMLOQNulxKCUEOuWAsqjY="
   },
   {
     "pname": "Microsoft.AspNetCore.Authentication.JwtBearer",
-    "version": "10.0.6",
-    "hash": "sha256-e62RIibg5uKrjli5dBDeOYlLC0XashVY2Us2SBOr+sc="
+    "version": "10.0.11",
+    "hash": "sha256-HK+YNKX76vBkfqJaobygRjhF+juBasan8Qi6+aB6tyA="
   },
   {
     "pname": "Microsoft.AspNetCore.Authentication.OpenIdConnect",
-    "version": "10.0.6",
-    "hash": "sha256-TmsvFY7xEyqAGRrbz3hBDT1gDK/IclgIaDAMkypF9H0="
+    "version": "10.0.11",
+    "hash": "sha256-QJT97xf0AFQFqr85zvyGJxt/68jWTFnNd7a/Ljx7TcE="
   },
   {
     "pname": "Microsoft.AspNetCore.Authorization",
@@ -176,13 +176,8 @@
   },
   {
     "pname": "Microsoft.AspNetCore.Cryptography.Internal",
-    "version": "10.0.5",
-    "hash": "sha256-XYkd+UHDEfbOh+2CJ+3EzPEpfGPUbKzjrrUpYvQqXyI="
-  },
-  {
-    "pname": "Microsoft.AspNetCore.Cryptography.Internal",
-    "version": "10.0.6",
-    "hash": "sha256-sNUAC9nWGszN+lCe3sY4S8xLx4AHGn/u3y1msp/KYP8="
+    "version": "10.0.11",
+    "hash": "sha256-WlCfhVYRIbwiN7m/ufzLAk4iLaCieosx4beEuDyl1ho="
   },
   {
     "pname": "Microsoft.AspNetCore.Cryptography.Internal",
@@ -191,8 +186,8 @@
   },
   {
     "pname": "Microsoft.AspNetCore.Cryptography.KeyDerivation",
-    "version": "10.0.6",
-    "hash": "sha256-C2XT5T7fLjGU5/CS7zOZ2kw70E/JSoj2zrrJGraFRno="
+    "version": "10.0.11",
+    "hash": "sha256-CZTS51h6cWQwXQRgddyLWM+vwXsvF8W2qRGNylJSM18="
   },
   {
     "pname": "Microsoft.AspNetCore.Cryptography.KeyDerivation",
@@ -201,18 +196,18 @@
   },
   {
     "pname": "Microsoft.AspNetCore.DataProtection",
-    "version": "10.0.5",
-    "hash": "sha256-h0sm0Zckje3THdhhu92AJutVJGk16wgCg5Xm7PzqxBI="
+    "version": "10.0.11",
+    "hash": "sha256-bRFdI7XEUBIENvpC7KiWAvZA1ap/CEoWeJCKIckX4yo="
   },
   {
     "pname": "Microsoft.AspNetCore.DataProtection",
-    "version": "2.3.0",
-    "hash": "sha256-Kca0xofKGaV9r/+SfHv2maFcWuMTj5O6Aot/YDpR6Dw="
+    "version": "2.3.9",
+    "hash": "sha256-tu9yJ1zyy7ViYbR8J9jKrxn42HfGNZcB/m3tbMYurMM="
   },
   {
     "pname": "Microsoft.AspNetCore.DataProtection.Abstractions",
-    "version": "10.0.5",
-    "hash": "sha256-Mq2BrWyJmtUp+lEl34MIiQ3WGBhtlyQUWHlow6q8URw="
+    "version": "10.0.11",
+    "hash": "sha256-wJKFqBW+X6ce4P164tIkrfnGjsvwltzQkq8YE8fOT1s="
   },
   {
     "pname": "Microsoft.AspNetCore.DataProtection.Abstractions",
@@ -221,8 +216,8 @@
   },
   {
     "pname": "Microsoft.AspNetCore.DataProtection.EntityFrameworkCore",
-    "version": "10.0.5",
-    "hash": "sha256-AahovY88yke+c+oAVaa9bCZFY19HaBjHRGWKxeLOykA="
+    "version": "10.0.11",
+    "hash": "sha256-K60RxOPNzvSyGbWiBIkyRbjZj38njU1vQQ62yjtkqes="
   },
   {
     "pname": "Microsoft.AspNetCore.Hosting.Abstractions",
@@ -234,10 +229,15 @@
     "version": "2.3.0",
     "hash": "sha256-gtiRMQA5kO1biIVaBLjSq0/jVVpiI8WzS136z/Ex1zs="
   },
+  {
+    "pname": "Microsoft.AspNetCore.Hosting.Abstractions",
+    "version": "2.3.11",
+    "hash": "sha256-AP3zqzVH1rQde5Q+jkFf621d9MT/t0znsp+dw1as9Z8="
+  },
   {
     "pname": "Microsoft.AspNetCore.Hosting.Server.Abstractions",
-    "version": "2.3.0",
-    "hash": "sha256-ltKZ02L3cXu2dCx1JGEt1X8gQgwTABn45QkBsREYxaw="
+    "version": "2.3.10",
+    "hash": "sha256-5kipSlimeuvA3ZWUQTkzp3dImN8NLJUeIaXzr4ddKzw="
   },
   {
     "pname": "Microsoft.AspNetCore.Http",
@@ -249,6 +249,11 @@
     "version": "2.3.0",
     "hash": "sha256-ubPGvFwMjXbydY1gzo/m31pWq5/SsS/tGRtOotHFfBU="
   },
+  {
+    "pname": "Microsoft.AspNetCore.Http",
+    "version": "2.3.9",
+    "hash": "sha256-XuOH9M6qd6XFz15TnWNnNCVd567B5BCb0wfl0Xoz5g4="
+  },
   {
     "pname": "Microsoft.AspNetCore.Http.Abstractions",
     "version": "2.2.0",
@@ -259,6 +264,11 @@
     "version": "2.3.0",
     "hash": "sha256-NrAFzk5IcxmeRk3Zu+rLcq0+KKiAYfygJbAdIt2Zpfk="
   },
+  {
+    "pname": "Microsoft.AspNetCore.Http.Abstractions",
+    "version": "2.3.10",
+    "hash": "sha256-TlgQug0JPR5vsFsxU0btpa4SbLSLLKZ2T8izyZpkZtM="
+  },
   {
     "pname": "Microsoft.AspNetCore.Http.Connections",
     "version": "1.1.0",
@@ -279,6 +289,16 @@
     "version": "2.3.0",
     "hash": "sha256-sOVwC5wK5w85R+HbYkBlfPpmknyAEig3g0uVnTSGwhI="
   },
+  {
+    "pname": "Microsoft.AspNetCore.Http.Extensions",
+    "version": "2.3.11",
+    "hash": "sha256-MIlX/WRqRdpJky0ya8lSxp2qR3Bp8152BroMCI8qMTg="
+  },
+  {
+    "pname": "Microsoft.AspNetCore.Http.Extensions",
+    "version": "2.3.9",
+    "hash": "sha256-117nBKPITpEQrYY+nE6jaOx0R9QkkYpakCq8JnoTgN8="
+  },
   {
     "pname": "Microsoft.AspNetCore.Http.Features",
     "version": "2.2.0",
@@ -286,18 +306,18 @@
   },
   {
     "pname": "Microsoft.AspNetCore.Http.Features",
-    "version": "2.3.0",
-    "hash": "sha256-QkNFS3ScDLyt0XppATSogbF1raSQJN+wStcnAsSoUJw="
+    "version": "2.3.9",
+    "hash": "sha256-9VJKZ5adBKRrVp+XRWEQiazv9Q6jj7noT/X693djVgQ="
   },
   {
     "pname": "Microsoft.AspNetCore.Identity",
-    "version": "2.3.9",
-    "hash": "sha256-oULMEy4bSIu6NXo/xPywjKN2uSFQz2qto16aauCJF7g="
+    "version": "2.3.12",
+    "hash": "sha256-1ybsrVA50zOvxqXn911iIrag42jpnamXodVXfK7Yykc="
   },
   {
     "pname": "Microsoft.AspNetCore.Identity.EntityFrameworkCore",
-    "version": "10.0.6",
-    "hash": "sha256-dzVp2wIatsqrlUva6lw1CJJXd6Y8JdxIOrED2K51Id0="
+    "version": "10.0.11",
+    "hash": "sha256-HpnbBdRHTA7PdtlfPSozS56uelP3UubR7jWJeFLhSFM="
   },
   {
     "pname": "Microsoft.AspNetCore.Routing",
@@ -331,8 +351,8 @@
   },
   {
     "pname": "Microsoft.AspNetCore.StaticFiles",
-    "version": "2.3.9",
-    "hash": "sha256-OET/mF7B/P5aC7VSNR9KQ8fM7BEvOWZOBukHzQiznI0="
+    "version": "2.3.12",
+    "hash": "sha256-G7sIHQLPqndC3UxtZPJd3dQJo4sePiLOHxrbV2f6Ba4="
   },
   {
     "pname": "Microsoft.AspNetCore.WebSockets",
@@ -349,6 +369,11 @@
     "version": "2.3.0",
     "hash": "sha256-oJMEP44Q9ClhbyZUPtSb9jqQyJJ/dD4DHElRvkYpIOo="
   },
+  {
+    "pname": "Microsoft.Bcl.Cryptography",
+    "version": "10.0.2",
+    "hash": "sha256-+OYtcWsd1qZcEXadYeA4t6+pyADg1APQCxpKUtP002M="
+  },
   {
     "pname": "Microsoft.Build.Framework",
     "version": "17.11.31",
@@ -391,8 +416,8 @@
   },
   {
     "pname": "Microsoft.Data.Sqlite.Core",
-    "version": "10.0.6",
-    "hash": "sha256-4mCmsk/TV3fvPsHPLPQQkSCa2v1FigO+uat+mnXuQ0Y="
+    "version": "10.0.11",
+    "hash": "sha256-zCXkQ7XmO+2ZyEb1hPwr6S8HfLBC6qN2w5wke+qGb5c="
   },
   {
     "pname": "Microsoft.Data.Sqlite.Core",
@@ -401,43 +426,38 @@
   },
   {
     "pname": "Microsoft.EntityFrameworkCore",
-    "version": "10.0.5",
-    "hash": "sha256-SR8KBOuIx9e1j/cMwYRCO62WEB+CUrGptexl9MSgp8M="
-  },
-  {
-    "pname": "Microsoft.EntityFrameworkCore",
-    "version": "10.0.6",
-    "hash": "sha256-wEA3ySJvLjAs6O9feF8vZXFM8GgyP+1ufQCaawj20dU="
+    "version": "10.0.11",
+    "hash": "sha256-j+DNpi5fd077QGMKu09LKD3fV5qWmswsuypp+s5gH/0="
   },
   {
     "pname": "Microsoft.EntityFrameworkCore.Abstractions",
-    "version": "10.0.6",
-    "hash": "sha256-izcDKxbfeMBNxXmri20mESugr7NHxJEE4Hnvia6hVS4="
+    "version": "10.0.11",
+    "hash": "sha256-F4Cp4dWQx3MXPu2MKaWI8H7JIoTP8J8gTfgex3N6QTU="
   },
   {
     "pname": "Microsoft.EntityFrameworkCore.Analyzers",
-    "version": "10.0.6",
-    "hash": "sha256-qTZ9ZhnPM7Nqy/ZWjloDTEUO91CymeJ07Yp1SKMJWiY="
+    "version": "10.0.11",
+    "hash": "sha256-WX2Z7E3wYXDfQ032C33ebQpbfD8WbuFbL/yU8XBEw7c="
   },
   {
     "pname": "Microsoft.EntityFrameworkCore.Design",
-    "version": "10.0.6",
-    "hash": "sha256-9WAXxXdAM0rNbGq6j7VGubHslxzmpTYKZ9gFyxh/N74="
+    "version": "10.0.11",
+    "hash": "sha256-4U1Ovp1F2KvfDSjxdFgz6tSuLxXblZ0Glp8NzqVOnrg="
   },
   {
     "pname": "Microsoft.EntityFrameworkCore.Relational",
-    "version": "10.0.6",
-    "hash": "sha256-gyA+zXeRaMZl9qs9WXrvc0sEnptZy1nxC6kBux5bTQ0="
+    "version": "10.0.11",
+    "hash": "sha256-aMfOqNSXcSk9yJnzWig0+Zk8pBl2/Z9Fw6GxmfTlsMM="
   },
   {
     "pname": "Microsoft.EntityFrameworkCore.Sqlite",
-    "version": "10.0.6",
-    "hash": "sha256-EddxZvx9J8bUPNh3IGiubhN4nJDTNJaLcERkhytuPfg="
+    "version": "10.0.11",
+    "hash": "sha256-R4xhxP4ZZuHJ4nCpt5GeflxxPCrwPtMHzWrr/kE+21M="
   },
   {
     "pname": "Microsoft.EntityFrameworkCore.Sqlite.Core",
-    "version": "10.0.6",
-    "hash": "sha256-+Enzt/LSNCkhuR9aASMS7vWMnwPVFtVxomq9de70ONg="
+    "version": "10.0.11",
+    "hash": "sha256-V44eYx25lkySJsh3nOKYbdylei3UhJCX4d1bGf0IWRk="
   },
   {
     "pname": "Microsoft.Extensions.ApiDescription.Server",
@@ -446,8 +466,8 @@
   },
   {
     "pname": "Microsoft.Extensions.Caching.Abstractions",
-    "version": "10.0.6",
-    "hash": "sha256-9yCnv7SmbNOq21W0rmnpiT4GkkE2pceU3xA1HE7zAM4="
+    "version": "10.0.11",
+    "hash": "sha256-hhLHPCS06OOGQMlQT3KXU7x5dSp6BN48njsGY/aOFqA="
   },
   {
     "pname": "Microsoft.Extensions.Caching.Abstractions",
@@ -456,13 +476,13 @@
   },
   {
     "pname": "Microsoft.Extensions.Caching.Hybrid",
-    "version": "10.5.0",
-    "hash": "sha256-Gg3Slrr6MPKRimtvpLwTeUOvicLiQyOG64wXOvejgr0="
+    "version": "10.9.0",
+    "hash": "sha256-o3hcc3MNXpNaDZirukdblYqWtfHzo5hpd7kc6YXOz1I="
   },
   {
     "pname": "Microsoft.Extensions.Caching.Memory",
-    "version": "10.0.6",
-    "hash": "sha256-3dWBnlBfEbfC50yrB8isuAOCMeYVaVQo/JfuRvpVBlI="
+    "version": "10.0.11",
+    "hash": "sha256-1LXlZK3RnwIxdFqG+8BH0+lc7NhKjA99xN2fe/nIq2I="
   },
   {
     "pname": "Microsoft.Extensions.Configuration",
@@ -471,8 +491,8 @@
   },
   {
     "pname": "Microsoft.Extensions.Configuration",
-    "version": "10.0.6",
-    "hash": "sha256-CSd5RC5pMsmglpnE6Vm3JabMnbmziqtUGrZE5Rg7uF4="
+    "version": "10.0.11",
+    "hash": "sha256-hhXsutV4pzMdy8CCG12Pqh4jV/emiQsuWUl1WpClZOs="
   },
   {
     "pname": "Microsoft.Extensions.Configuration.Abstractions",
@@ -481,13 +501,8 @@
   },
   {
     "pname": "Microsoft.Extensions.Configuration.Abstractions",
-    "version": "10.0.5",
-    "hash": "sha256-DNK+lL2jeHFYyd43zfgVY32UskEfQ4YsTapztuQbYwo="
-  },
-  {
-    "pname": "Microsoft.Extensions.Configuration.Abstractions",
-    "version": "10.0.6",
-    "hash": "sha256-jxtne26QF7bASCRmLNwYsKruY3QhsnuzN9Us11WUdSQ="
+    "version": "10.0.11",
+    "hash": "sha256-gx/afsc4v9zRAUPsiySt6BcZVSMc9QJE4vqJMQpiOPk="
   },
   {
     "pname": "Microsoft.Extensions.Configuration.Abstractions",
@@ -511,8 +526,8 @@
   },
   {
     "pname": "Microsoft.Extensions.Configuration.Binder",
-    "version": "10.0.6",
-    "hash": "sha256-34blBlrQ3FRS7iCS7/gxPZMa9xgDW0p3iEERqwgXFMA="
+    "version": "10.0.11",
+    "hash": "sha256-qcSKa+uJdahahMucYIIUO1pg/zrlsHlK1kg/lWHP/qo="
   },
   {
     "pname": "Microsoft.Extensions.Configuration.Binder",
@@ -521,33 +536,33 @@
   },
   {
     "pname": "Microsoft.Extensions.Configuration.CommandLine",
-    "version": "10.0.6",
-    "hash": "sha256-U31ct2qLllJ+0INS4wsDhFztGpzr+7TdwpeKZsgslAw="
+    "version": "10.0.11",
+    "hash": "sha256-9vla+fmeValSMtmZxlNv1IoOhOMCWJtvPREX4OXvPZA="
   },
   {
     "pname": "Microsoft.Extensions.Configuration.EnvironmentVariables",
-    "version": "10.0.6",
-    "hash": "sha256-/p9mbkua5XJT8vg/r06aw2ZYydlGv9s+Fk+j98h8PF0="
+    "version": "10.0.11",
+    "hash": "sha256-3/OjBiZUrSI7Bekj+MCUmeMseCJmwS3wL1kYeEoJtB4="
   },
   {
     "pname": "Microsoft.Extensions.Configuration.FileExtensions",
-    "version": "10.0.6",
-    "hash": "sha256-N2DeLcgzjaQIk7LKvUqd2FO2bTmB65iZxpbTXb2DWz8="
+    "version": "10.0.11",
+    "hash": "sha256-U1Sfq/12RMtjKau0bwR8emdja0JfW+N+lgIi+du4yAo="
   },
   {
     "pname": "Microsoft.Extensions.Configuration.Json",
-    "version": "10.0.6",
-    "hash": "sha256-gj55DSHQluOlZKiNOVeeHuhsz4GpqVRSlbad6jq+Olk="
+    "version": "10.0.11",
+    "hash": "sha256-kd/4oufTKaitTqzHoZg8OQ0PZS9OOWI3tKFJiVW4KrY="
   },
   {
     "pname": "Microsoft.Extensions.Configuration.UserSecrets",
-    "version": "10.0.6",
-    "hash": "sha256-NwcoOoEiVrdQJU4GXYcNzdmYJSDefdJ1IflEHhPAQK8="
+    "version": "10.0.11",
+    "hash": "sha256-3SDfsz/hThd6HXjVp1htZR9wsLACCQPH/ynZ8Xx37bA="
   },
   {
     "pname": "Microsoft.Extensions.DependencyInjection",
-    "version": "10.0.6",
-    "hash": "sha256-K3ODZC+Bwd3Tze5wF7BQvJJGlNObdf2PNA35F41jHTE="
+    "version": "10.0.11",
+    "hash": "sha256-xuwGge8n7OjS+uS85QiR0LdDORIJ1gm6w3hMXtvuWj8="
   },
   {
     "pname": "Microsoft.Extensions.DependencyInjection",
@@ -566,13 +581,8 @@
   },
   {
     "pname": "Microsoft.Extensions.DependencyInjection.Abstractions",
-    "version": "10.0.5",
-    "hash": "sha256-KrP+hE3gk7pATbJYZsJ1LHiXjzLA+ntHW7G/VGgHk2g="
-  },
-  {
-    "pname": "Microsoft.Extensions.DependencyInjection.Abstractions",
-    "version": "10.0.6",
-    "hash": "sha256-lFiZb81kfBJK7J0b0A2UIpydPRT73Xcs57Gzf/+1xXc="
+    "version": "10.0.11",
+    "hash": "sha256-5PZeQgWmVo8K+7GgKEVAd6xcn+3XVNVzT4cg/DBtjqY="
   },
   {
     "pname": "Microsoft.Extensions.DependencyInjection.Abstractions",
@@ -616,8 +626,8 @@
   },
   {
     "pname": "Microsoft.Extensions.DependencyModel",
-    "version": "10.0.6",
-    "hash": "sha256-WY/CGoll5mwtiG3pBN/jDpt5/g4qcQuBL62LeS8KgmM="
+    "version": "10.0.11",
+    "hash": "sha256-hWKqLT0Ix5FibpGrr4/crZpSfKHPCe+sfWzWWu3Ykgw="
   },
   {
     "pname": "Microsoft.Extensions.DependencyModel",
@@ -626,8 +636,8 @@
   },
   {
     "pname": "Microsoft.Extensions.Diagnostics",
-    "version": "10.0.6",
-    "hash": "sha256-TGJjvsztoajNzOe0KeuOvtb2ZuNDbjq2NfPs15zo3kA="
+    "version": "10.0.11",
+    "hash": "sha256-cWitHAjZLDzvSzli/C9+BfD7PDSL4c2HzwVdvj/t6PU="
   },
   {
     "pname": "Microsoft.Extensions.Diagnostics.Abstractions",
@@ -636,13 +646,8 @@
   },
   {
     "pname": "Microsoft.Extensions.Diagnostics.Abstractions",
-    "version": "10.0.5",
-    "hash": "sha256-pwQltVfaqx0jRpO0d9k/dYtyOpnGixK2MB3aHVVbo0E="
-  },
-  {
-    "pname": "Microsoft.Extensions.Diagnostics.Abstractions",
-    "version": "10.0.6",
-    "hash": "sha256-9AbUvHuHhDPjtf6vsci2r6VfSg0BlmkJkMYmIqAQ2QA="
+    "version": "10.0.11",
+    "hash": "sha256-JSjnETAdUU/8ymeWP1OKoXu5sS5COEqwQR4OpiUnavI="
   },
   {
     "pname": "Microsoft.Extensions.Diagnostics.Abstractions",
@@ -656,13 +661,8 @@
   },
   {
     "pname": "Microsoft.Extensions.FileProviders.Abstractions",
-    "version": "10.0.5",
-    "hash": "sha256-6RwvzBQTJzbypUQAM9WNRkpn3gON63DLxY3gH0ZcrH4="
-  },
-  {
-    "pname": "Microsoft.Extensions.FileProviders.Abstractions",
-    "version": "10.0.6",
-    "hash": "sha256-CzUYBtxxXV8qn72ptRs0QkP8xmrKwlfq47MojRhM1Tw="
+    "version": "10.0.11",
+    "hash": "sha256-4NmJ1/Fgbn45wcD8iy0wV0aU//mCsrcwmLmzHpwJGqU="
   },
   {
     "pname": "Microsoft.Extensions.FileProviders.Abstractions",
@@ -676,18 +676,18 @@
   },
   {
     "pname": "Microsoft.Extensions.FileProviders.Physical",
-    "version": "10.0.6",
-    "hash": "sha256-zZAyRMT9DnZYlKTW9A5ZeDAlO8EaHxgX9hHuzWDgjiY="
+    "version": "10.0.11",
+    "hash": "sha256-XKXZuA0PDC+bNOKU9PJXs7uazkSaw0GrMShVbk6VdWA="
   },
   {
     "pname": "Microsoft.Extensions.FileSystemGlobbing",
-    "version": "10.0.6",
-    "hash": "sha256-hfoFBBqSIwZokoX3Kt+aRacLW06QbJkcecyLOhTd0T0="
+    "version": "10.0.11",
+    "hash": "sha256-PhOghJRLqX//zef4FTRk4uKIq0v2Kx04J2FusJgOw0o="
   },
   {
     "pname": "Microsoft.Extensions.Hosting",
-    "version": "10.0.6",
-    "hash": "sha256-qTfHGGLi0OWszbcJRyhStsz3EBBl8MVAzGeqxeNneSM="
+    "version": "10.0.11",
+    "hash": "sha256-3XEafns0atVGeWWcJg0Y93tO78gIMtYXRfzU619OWzk="
   },
   {
     "pname": "Microsoft.Extensions.Hosting.Abstractions",
@@ -696,13 +696,8 @@
   },
   {
     "pname": "Microsoft.Extensions.Hosting.Abstractions",
-    "version": "10.0.5",
-    "hash": "sha256-mqxu+PvqYP/J/9UWEbLIAfSNnsABhdl6m5wkZFf1DDM="
-  },
-  {
-    "pname": "Microsoft.Extensions.Hosting.Abstractions",
-    "version": "10.0.6",
-    "hash": "sha256-ZFt1jTnkzMsDNTe+nDJvJB3fbQrLvCjYp4NIyESErvU="
+    "version": "10.0.11",
+    "hash": "sha256-8rr3hfiZ649GUTB0t4+R8Yjo+H3ch5yyl5DICPPNv8I="
   },
   {
     "pname": "Microsoft.Extensions.Hosting.Abstractions",
@@ -716,18 +711,18 @@
   },
   {
     "pname": "Microsoft.Extensions.Identity.Core",
-    "version": "10.0.6",
-    "hash": "sha256-KTF/pNQwkrAYh3qYDi2teXyIWFaxb1ofqdWutV4jb40="
+    "version": "10.0.11",
+    "hash": "sha256-SsmQUacaO6uo91S6KRrfxhTKdM3gvPRV/ZZ9v/gZR40="
   },
   {
     "pname": "Microsoft.Extensions.Identity.Core",
-    "version": "2.3.0",
-    "hash": "sha256-fuihBY1L0w91zTUmcpspcWGv4vLqP5MEKaEi24FtsUY="
+    "version": "2.3.11",
+    "hash": "sha256-bIRULpKXEieyr8mbpNuO9kRquDe6clewlZV/R7RhKQU="
   },
   {
     "pname": "Microsoft.Extensions.Identity.Stores",
-    "version": "10.0.6",
-    "hash": "sha256-BfQMVemXTSvc2KdhXMv33wupYgsOG7RNRbHrE2tLfG4="
+    "version": "10.0.11",
+    "hash": "sha256-p6z0qrOh/VISAVUY2ZJY1qdAH7gE2+RYcLb53CKMasg="
   },
   {
     "pname": "Microsoft.Extensions.Logging",
@@ -736,8 +731,8 @@
   },
   {
     "pname": "Microsoft.Extensions.Logging",
-    "version": "10.0.6",
-    "hash": "sha256-tskLj/WXLK35gkuJAWaAhPjMW92N1JKOTzTLupR30pE="
+    "version": "10.0.11",
+    "hash": "sha256-K8MjBeYsxUdOyY5+QryOojGfc4AkE/FHqrx5MxSuZhU="
   },
   {
     "pname": "Microsoft.Extensions.Logging",
@@ -761,13 +756,8 @@
   },
   {
     "pname": "Microsoft.Extensions.Logging.Abstractions",
-    "version": "10.0.5",
-    "hash": "sha256-e3A/l+II+n+D7/OPwjdyQM1IBtKHfHeIdlkJmuRw77w="
-  },
-  {
-    "pname": "Microsoft.Extensions.Logging.Abstractions",
-    "version": "10.0.6",
-    "hash": "sha256-4ijpXt4PoTNcmF5dl/rEZkRWBAjukB229lXtBtJhxn4="
+    "version": "10.0.11",
+    "hash": "sha256-HdUH2q55lbAwMswMdQjX01DrgaxegtbyMo4VYezhB1o="
   },
   {
     "pname": "Microsoft.Extensions.Logging.Abstractions",
@@ -801,28 +791,28 @@
   },
   {
     "pname": "Microsoft.Extensions.Logging.Configuration",
-    "version": "10.0.6",
-    "hash": "sha256-/tXp5Q6002eNA4Ff9O8eyBgYNdNcOoJ4b2NrdHh+QcQ="
+    "version": "10.0.11",
+    "hash": "sha256-UtMmi9ZlS4hUXQurxTJ3MAZLWcp5z1UyMxkK4ab8HYA="
   },
   {
     "pname": "Microsoft.Extensions.Logging.Console",
-    "version": "10.0.6",
-    "hash": "sha256-hIwQTTJGdbqkfkzSHLG5aueueE15DrlggfmPbBZ6SOk="
+    "version": "10.0.11",
+    "hash": "sha256-yC7fdI8lbD8FOjkHehbuPZkkkyoc4YuAhd9fnls3NDc="
   },
   {
     "pname": "Microsoft.Extensions.Logging.Debug",
-    "version": "10.0.6",
-    "hash": "sha256-ZpIjMzwB0Dugr2aQtIt7HgSGKgDjfH0LXKIXsywJbnw="
+    "version": "10.0.11",
+    "hash": "sha256-mqyhIr7FqqaHudtyPRNV5v+RTsh3aI1/AAqLtuG+OIE="
   },
   {
     "pname": "Microsoft.Extensions.Logging.EventLog",
-    "version": "10.0.6",
-    "hash": "sha256-OrIL6QUhI8dntpTXgkrwJ443YpmJsfYNM08kYB4KQZE="
+    "version": "10.0.11",
+    "hash": "sha256-z7oIQzJ90GemCfAptGxqiKNpyiAxGqdEExLMC4P6x/M="
   },
   {
     "pname": "Microsoft.Extensions.Logging.EventSource",
-    "version": "10.0.6",
-    "hash": "sha256-LoMQ0w2MwzKGS8QhqNTv5TgAPmgaS5HCfjkJHJHT818="
+    "version": "10.0.11",
+    "hash": "sha256-osoraN03ksCKPYl5PBB/5snDb2s9nr3HMoP0rZHhfW4="
   },
   {
     "pname": "Microsoft.Extensions.ObjectPool",
@@ -841,13 +831,8 @@
   },
   {
     "pname": "Microsoft.Extensions.Options",
-    "version": "10.0.5",
-    "hash": "sha256-nw+m6VWXjmaBqZ1aH/l9SR9Oy62N9dmiMKloJ78kxv8="
-  },
-  {
-    "pname": "Microsoft.Extensions.Options",
-    "version": "10.0.6",
-    "hash": "sha256-GJCULaUcN2FxCA9fKOLe5EDEtkKLrEuP2Kw0jRqospA="
+    "version": "10.0.11",
+    "hash": "sha256-djBqHYNsYC427UNbkyBo9x9lAtX2Ls460ixdRrSdMa8="
   },
   {
     "pname": "Microsoft.Extensions.Options",
@@ -876,8 +861,8 @@
   },
   {
     "pname": "Microsoft.Extensions.Options.ConfigurationExtensions",
-    "version": "10.0.6",
-    "hash": "sha256-T0HNAYrIsm1xzfBD1qLqziI5qwSsGXGmXSDdOgpC5s0="
+    "version": "10.0.11",
+    "hash": "sha256-sx6aAZ3i7yZVIzqVcs+W8zT1V/nEua/ZwfnHRJX2Nxo="
   },
   {
     "pname": "Microsoft.Extensions.Options.ConfigurationExtensions",
@@ -891,13 +876,8 @@
   },
   {
     "pname": "Microsoft.Extensions.Primitives",
-    "version": "10.0.5",
-    "hash": "sha256-uvrur+0dg4zAAQcpLkkhPA77ST0tA3+EpGdDlCckC+E="
-  },
-  {
-    "pname": "Microsoft.Extensions.Primitives",
-    "version": "10.0.6",
-    "hash": "sha256-/iSFDryQIl8rl+TtrzunT5LcbPsQCeC2V+9CnS1P4Cc="
+    "version": "10.0.11",
+    "hash": "sha256-4z+bHf8r4cFzX2VwW3HdZ44yBjZpfhYzlgzkdpbS7o0="
   },
   {
     "pname": "Microsoft.Extensions.Primitives",
@@ -936,38 +916,38 @@
   },
   {
     "pname": "Microsoft.IdentityModel.Abstractions",
-    "version": "8.17.0",
-    "hash": "sha256-AU+EMOZArc3rTdsnKYzAufFAtspuYQM3XYi8/VsQAio="
+    "version": "8.22.0",
+    "hash": "sha256-7bBFHdYh/nftSX7dodUj17SB0jb2hmumyYihn53kZAw="
   },
   {
     "pname": "Microsoft.IdentityModel.JsonWebTokens",
-    "version": "8.17.0",
-    "hash": "sha256-MH7vdhCNAae32p6UTvaDtmyvFDxa/W71qTsEQ6yC9xM="
+    "version": "8.22.0",
+    "hash": "sha256-8TW85/8cHUZaQrVb68YYzvF3m6l20acJ+JCOoAP0FRI="
   },
   {
     "pname": "Microsoft.IdentityModel.Logging",
-    "version": "8.17.0",
-    "hash": "sha256-IM6jsPMz+l9JA0cye/v2ke51xlfP0u5HtWBqc2aKDYM="
+    "version": "8.22.0",
+    "hash": "sha256-yUuLjrNf/kqVf1W2txx2GKc0tqM6IqOlcJkno8pVhP8="
   },
   {
     "pname": "Microsoft.IdentityModel.Protocols",
-    "version": "8.0.1",
-    "hash": "sha256-v3DIpG6yfIToZBpHOjtQHRo2BhXGDoE70EVs6kBtrRg="
+    "version": "8.19.2",
+    "hash": "sha256-soADEUQsOp1Hytt1qLo+jOOeq7uy7I7tUOWogXeQXFY="
   },
   {
     "pname": "Microsoft.IdentityModel.Protocols.OpenIdConnect",
-    "version": "8.0.1",
-    "hash": "sha256-ZHKaZxqESk+OU1SFTFGxvZ71zbdgWqv1L6ET9+fdXX0="
+    "version": "8.19.2",
+    "hash": "sha256-uSrN5xlG+SXlxg4NACFU2FSlC3V3hYojdhU8lUc687o="
   },
   {
     "pname": "Microsoft.IdentityModel.Tokens",
-    "version": "8.0.1",
-    "hash": "sha256-beVbbVQy874HlXkTKarPTT5/r7XR1NGHA/50ywWp7YA="
+    "version": "8.19.2",
+    "hash": "sha256-POi3SzcK3+iB3104wXYh3ooVD1GbltwTUf+KMj//UYU="
   },
   {
     "pname": "Microsoft.IdentityModel.Tokens",
-    "version": "8.17.0",
-    "hash": "sha256-XcA0KXJbqMWt0I5LuHHMRLpgVQ18KcBej1BoySHeA1A="
+    "version": "8.22.0",
+    "hash": "sha256-cI3VoDGdlniZL4xsq03h599bDLu+8tlQE9PbbSzhq8k="
   },
   {
     "pname": "Microsoft.IO.RecyclableMemoryStream",
@@ -976,8 +956,8 @@
   },
   {
     "pname": "Microsoft.Net.Http.Headers",
-    "version": "10.0.6",
-    "hash": "sha256-/4WgtVHeoYv0MJhLqWYChPKh2AOXsJfyA+wFPKrI+14="
+    "version": "10.0.11",
+    "hash": "sha256-k6OG7wtLmNBSt0V8d++FvvBdf7b2IbyW5ebbwLYu2JY="
   },
   {
     "pname": "Microsoft.Net.Http.Headers",
@@ -989,6 +969,16 @@
     "version": "2.3.0",
     "hash": "sha256-XY3OyhKTzUVbmMnegp0IxApg8cw97RD9eXC2XenrOqE="
   },
+  {
+    "pname": "Microsoft.Net.Http.Headers",
+    "version": "2.3.10",
+    "hash": "sha256-4LG06n+vo2bFpg9dQ9NSLvVf7rQfiD+k0FEq5S6tDsE="
+  },
+  {
+    "pname": "Microsoft.Net.Http.Headers",
+    "version": "2.3.8",
+    "hash": "sha256-IgcqzFtv8NAmnb8uvr+lEKHWSehpK3eciCIZ/lcFyaI="
+  },
   {
     "pname": "Microsoft.NETCore.Platforms",
     "version": "1.1.0",
@@ -996,8 +986,8 @@
   },
   {
     "pname": "Microsoft.OpenApi",
-    "version": "2.4.1",
-    "hash": "sha256-DXdbXq5Gpg3MJVBM0C8uF6mcLczVJAUFp6LAdFojgPs="
+    "version": "2.7.5",
+    "hash": "sha256-oYeR/8toy23G+YbVWfJUdMHPKdbfaYU2+0sQ9TIX0yA="
   },
   {
     "pname": "Microsoft.VisualStudio.SolutionPersistence",
@@ -1006,13 +996,13 @@
   },
   {
     "pname": "Microsoft.Win32.SystemEvents",
-    "version": "10.0.6",
-    "hash": "sha256-9aY12va83TDG3ATTMTPIAKsKNtcXJGyiRsIK+s7U1Fc="
+    "version": "10.0.11",
+    "hash": "sha256-6zse+EdDZcELO+eAlTgOJpZXEs2J3j6omHBVJfW0X1A="
   },
   {
     "pname": "MimeKit",
-    "version": "4.16.0",
-    "hash": "sha256-yWGXVm+EHvBSsZlVHdWdD+rVwdf/5hHxsUfJMSd2Afo="
+    "version": "4.17.0",
+    "hash": "sha256-GpWv+8shoprshuPNB+H+C5saffiKQ6Pek3zhLUGklRo="
   },
   {
     "pname": "MimeTypeMapOfficial",
@@ -1031,13 +1021,13 @@
   },
   {
     "pname": "NeoSmart.Caching.Sqlite",
-    "version": "9.0.1",
-    "hash": "sha256-VqCqQmJRT+S8m6xaGbphI2Oq+0b9qqrtg5AptB0IqTI="
+    "version": "9.0.3",
+    "hash": "sha256-SfJNJPjxUlUOW4wzN1Ay1FYxFUyU7RywIRH21i6PQWI="
   },
   {
     "pname": "NeoSmart.Caching.Sqlite.AspNetCore",
-    "version": "9.0.1",
-    "hash": "sha256-yD5ILqaA7ygC/ZByCwc60GA76SBC1O2vrdm7W7jvLeQ="
+    "version": "9.0.3",
+    "hash": "sha256-0CxeY/eiOib0BWznH2nQtA/5qK3Pl6C330lzSNrbCXc="
   },
   {
     "pname": "NETStandard.Library",
@@ -1051,58 +1041,58 @@
   },
   {
     "pname": "NetVips.Native",
-    "version": "8.18.2",
-    "hash": "sha256-KR6aE5I7RKneD+3WSSX7DCM3E+jlttYAlt3b9ngewF0="
+    "version": "8.18.5",
+    "hash": "sha256-uPfjlt7/Tfl9JYmGcMucEY9I8obGPlnX+qE5XAaOA4Y="
   },
   {
     "pname": "NetVips.Native.linux-arm",
-    "version": "8.18.2",
-    "hash": "sha256-qEMu4zSSbqbJBE7BaAVoNBv8D4bX16c70sxLL+WU0fo="
+    "version": "8.18.5",
+    "hash": "sha256-FaVvFzSIHxsM/pvpkvObRRCbNHVGXCBIxXyFdkOMjDQ="
   },
   {
     "pname": "NetVips.Native.linux-arm64",
-    "version": "8.18.2",
-    "hash": "sha256-dFLghk06fGH1w6pY+HzYorGptwB81voIGDQT9qipgVU="
+    "version": "8.18.5",
+    "hash": "sha256-mIwUA+AWf2rq5fTBsWC4H/5cosc0o4pWQvD9dPgyb8c="
   },
   {
     "pname": "NetVips.Native.linux-musl-arm64",
-    "version": "8.18.2",
-    "hash": "sha256-6VYO0Y54+Dp6zWGjMZDJ2+1vg7wYT8+ahimQd/4NWMU="
+    "version": "8.18.5",
+    "hash": "sha256-zlVmca0zQG1l4ZJEKO9XCJniNDHJ2e1p1/EtuIyo0Qk="
   },
   {
     "pname": "NetVips.Native.linux-musl-x64",
-    "version": "8.18.2",
-    "hash": "sha256-42iSMN2luLpSUUX5peanVT4BLoRG9Zp4s/eyafnTlRE="
+    "version": "8.18.5",
+    "hash": "sha256-3TZHyGhxM9lDZZkEpv0OV223VstR3Bl1BJqeUfhH/DM="
   },
   {
     "pname": "NetVips.Native.linux-x64",
-    "version": "8.18.2",
-    "hash": "sha256-B9mDRhVUK0xA4u0TA+mg0wdmZuE0r9tFrCdqy7JTKT4="
+    "version": "8.18.5",
+    "hash": "sha256-GM3s3UIApkgQ5oTln+vZe11m8yaCqEl+fs/SGiDFavk="
   },
   {
     "pname": "NetVips.Native.osx-arm64",
-    "version": "8.18.2",
-    "hash": "sha256-0Z4ebWvYJzxXEsOIj9EioDMGW13jchBvNSHWNw+H0i8="
+    "version": "8.18.5",
+    "hash": "sha256-KG3INM4TliZ0Lw8UGsGCLaCkwjw+Z/z0PDpd4Gda8j0="
   },
   {
     "pname": "NetVips.Native.osx-x64",
-    "version": "8.18.2",
-    "hash": "sha256-k2stqKPwoC8VFZv65fLFJiUJkjFdDBSci71Rmc7W8Io="
+    "version": "8.18.5",
+    "hash": "sha256-snJuf1o4NZMxUcaqY4QMwK0VzbJjaI9sVXyOcg7BldY="
   },
   {
     "pname": "NetVips.Native.win-arm64",
-    "version": "8.18.2",
-    "hash": "sha256-VxPcs8tiH21n2rbsVAk35xLyymAPT0/YNNnatNvCxvk="
+    "version": "8.18.5",
+    "hash": "sha256-MjQbMz2k/FIYOLCoQdUwZap6rufoiNxYCtoiiAereig="
   },
   {
     "pname": "NetVips.Native.win-x64",
-    "version": "8.18.2",
-    "hash": "sha256-xLsrZeLS3Okk+LkrK2xkaWyP0J9TBguxNytJh1iLQN8="
+    "version": "8.18.5",
+    "hash": "sha256-wETKatS3LoyibfQy3gA9hVjy1FvCLbq2ULnKLUYSfaU="
   },
   {
     "pname": "NetVips.Native.win-x86",
-    "version": "8.18.2",
-    "hash": "sha256-w17N008yfpgLXY54Pb/gUJ6YqCZU7OGq+je/OYozaig="
+    "version": "8.18.5",
+    "hash": "sha256-RpBid9SbQ3pTcBHdC2Zk1S7980qNwiC57G9hfxkmI0c="
   },
   {
     "pname": "Newtonsoft.Json",
@@ -1126,13 +1116,13 @@
   },
   {
     "pname": "Polly",
-    "version": "8.6.6",
-    "hash": "sha256-0BrOttCw+HQYB24Y2uMy2vo0P5/txUlhELC8FlyLKps="
+    "version": "8.7.0",
+    "hash": "sha256-iMNusWW+4nuIvkNLUaoru23Roe9vpC140TOIHbLvewE="
   },
   {
     "pname": "Polly.Core",
-    "version": "8.6.6",
-    "hash": "sha256-y6/a4OWrUlRfe0J8qdhBRmYRDi6K2y+kwhEVCIUOjvU="
+    "version": "8.7.0",
+    "hash": "sha256-1AT4Xym9hn2Awgul9WErwXk2bBPN58P9XfRExrIPItg="
   },
   {
     "pname": "Scrutor",
@@ -1161,8 +1151,8 @@
   },
   {
     "pname": "Serilog",
-    "version": "4.3.1",
-    "hash": "sha256-TY+GaQYnyDfOGl0gi67xDyUMOuV/mjz8BU66/UsmStI="
+    "version": "4.4.0",
+    "hash": "sha256-tP4X06ThcDVL6XXtYIhdJyxn4uL9jLL0s3DRO6HNQk8="
   },
   {
     "pname": "Serilog.AspNetCore",
@@ -1199,6 +1189,11 @@
     "version": "10.0.0",
     "hash": "sha256-WJK+wR7XPGAtD+vO+pjF5mn4qy8tO5uWIqHhovL0lAs="
   },
+  {
+    "pname": "Serilog.Settings.Configuration",
+    "version": "10.0.1",
+    "hash": "sha256-aR+zh+LH9gshorDgm3YDq/KaRNNTZMqCfvXAgQ9EYmQ="
+  },
   {
     "pname": "Serilog.Sinks.AspNetCore.SignalR",
     "version": "0.4.0",
@@ -1226,28 +1221,23 @@
   },
   {
     "pname": "SharpCompress",
-    "version": "0.47.4",
-    "hash": "sha256-mH0R+al2GUomIYkieYudTmF1mAnIUiifQPTp13eUFg8="
-  },
-  {
-    "pname": "SixLabors.ImageSharp",
-    "version": "3.1.12",
-    "hash": "sha256-FR8v74w4P/1AZdW5ARW0y8zgDqLtvhxQmL1CKv68xR0="
+    "version": "0.50.4",
+    "hash": "sha256-BFrEiG6q1U/LDpeFzaMSF45xQFefpL69PlI4RWzilws="
   },
   {
     "pname": "SonarAnalyzer.CSharp",
-    "version": "10.23.0.137933",
-    "hash": "sha256-phxiICdupuG9F8o/Qn7MTIWDgLo8yWmdVCPbgjwPgWA="
+    "version": "10.32.0.713",
+    "hash": "sha256-t35nnEZ9MGFFBAvN7uAJlIbCddh8C9Ia8XxkTBIXnBQ="
   },
   {
     "pname": "SQLitePCLRaw.bundle_e_sqlite3",
-    "version": "2.1.11",
-    "hash": "sha256-kWRapMTVEfcc0DxnI9Ai1+RwAAcR2+HUu+WF+OeLJCs="
+    "version": "2.1.12",
+    "hash": "sha256-qaBua1oxP27zZ1+RmX0BKt7/6KqeH/1p7Uak5oWwVOE="
   },
   {
     "pname": "SQLitePCLRaw.bundle_green",
-    "version": "2.1.10",
-    "hash": "sha256-IanG4p+Jb/2TYaxEEdKb/Ecs6TtJaboQYUCyC5sYC/s="
+    "version": "2.1.11",
+    "hash": "sha256-gDSZzXICknhJmkZ1Lb++TGn55JfrbVWOLn3nOvHwdjw="
   },
   {
     "pname": "SQLitePCLRaw.core",
@@ -1256,13 +1246,13 @@
   },
   {
     "pname": "SQLitePCLRaw.core",
-    "version": "2.1.11",
-    "hash": "sha256-s/fxEoYlNf9c2C4HZueMzPCBvpiViDVlSpg7epB0GXY="
+    "version": "2.1.12",
+    "hash": "sha256-rwaQQTj/ptyVpZkTPWTSVHFtb6zHVDprO5EHk9rp3KU="
   },
   {
-    "pname": "SQLitePCLRaw.lib.e_sqlite3",
-    "version": "2.1.10",
-    "hash": "sha256-m2v2RQWol+1MNGZsx+G2N++T9BNtQGLLHXUjcwkdCnc="
+    "pname": "SQLitePCLRaw.core",
+    "version": "3.0.5",
+    "hash": "sha256-dHa0uOBn2IxMtZijGJO1EQN7iOBcKNUk9LRDP+n2kEg="
   },
   {
     "pname": "SQLitePCLRaw.lib.e_sqlite3",
@@ -1270,19 +1260,29 @@
     "hash": "sha256-ZmffbHNgnLUdsPbikilEAihxXl1MedIBQ1Xzt9226Bw="
   },
   {
-    "pname": "SQLitePCLRaw.provider.e_sqlite3",
-    "version": "2.1.10",
-    "hash": "sha256-MLs3jiETLZ7k/TgkHynZegCWuAbgHaDQKTPB0iNv7Fg="
+    "pname": "SQLitePCLRaw.lib.e_sqlite3",
+    "version": "2.1.12",
+    "hash": "sha256-SiLAL/z0iXkpA88mPe+fzidzlxaIP5ZfC17v8WN0MKw="
+  },
+  {
+    "pname": "SQLitePCLRaw.lib.e_sqlite3",
+    "version": "3.53.3",
+    "hash": "sha256-cstyR3khjgJIM6IeKQPHlanpDAv6AVIPJ5kMNkE/MtQ="
   },
   {
     "pname": "SQLitePCLRaw.provider.e_sqlite3",
     "version": "2.1.11",
     "hash": "sha256-LdfV325AmYgBOwmwP7MNZxMJZkNO6bwrHvB6C5SyItA="
   },
+  {
+    "pname": "SQLitePCLRaw.provider.e_sqlite3",
+    "version": "2.1.12",
+    "hash": "sha256-3ysycZkuXXGRhsRnHjz0+GWAl8FUy81BSUq1lMWZdZU="
+  },
   {
     "pname": "Swashbuckle.AspNetCore",
-    "version": "10.1.7",
-    "hash": "sha256-6NUOoTHcPdJAtrlMVkmgKs/sxuwV1Q78QzG+tt4j4wo="
+    "version": "10.2.3",
+    "hash": "sha256-AztrzyU6LVUsEMaWegzdPksGisUh+wXsI02U1LOov9M="
   },
   {
     "pname": "Swashbuckle.AspNetCore.Filters",
@@ -1296,8 +1296,8 @@
   },
   {
     "pname": "Swashbuckle.AspNetCore.Swagger",
-    "version": "10.1.7",
-    "hash": "sha256-jRCchEG4ESpuYtbzMDGtKkR9BkLO4Ac3PQwSmu8B6m8="
+    "version": "10.2.3",
+    "hash": "sha256-dTqnBh1DI/K3oSngYOMrXPmXDxMQPjCAMEQTOBcaKKs="
   },
   {
     "pname": "Swashbuckle.AspNetCore.SwaggerGen",
@@ -1306,13 +1306,13 @@
   },
   {
     "pname": "Swashbuckle.AspNetCore.SwaggerGen",
-    "version": "10.1.7",
-    "hash": "sha256-+6xUOc4EJS7KXQySb2wH2FF9yGM5rgzvlJz45QQyXBw="
+    "version": "10.2.3",
+    "hash": "sha256-6qF5z995SAqq0AkwSI4mK70Boww08amhW/YTOmUuLh8="
   },
   {
     "pname": "Swashbuckle.AspNetCore.SwaggerUI",
-    "version": "10.1.7",
-    "hash": "sha256-5JYW0MKQ0ePdMHHZrDDaWuj7BX0pvA7NT/K6M49TFm4="
+    "version": "10.2.3",
+    "hash": "sha256-7LJcUhAdEGhZ6CXIfjA1kDj+pZs3U6dgDTvX5KoXdIY="
   },
   {
     "pname": "System.CodeDom",
@@ -1356,28 +1356,28 @@
   },
   {
     "pname": "System.Diagnostics.EventLog",
-    "version": "10.0.6",
-    "hash": "sha256-MpXUz1TiiFkD1ngApC7HKqW+i37zi5V2ApOmqZwDqiI="
+    "version": "10.0.11",
+    "hash": "sha256-w/JzFTvPJr6x9srFpmeB7xPh9fkH1X9vf8izdvmxgt0="
   },
   {
     "pname": "System.Drawing.Common",
-    "version": "10.0.6",
-    "hash": "sha256-FTXHVYztZSh3PxzJDDFzDNmVBgWHyzdZ565REXSeGv4="
+    "version": "10.0.11",
+    "hash": "sha256-PvdmsppjVK3/OnG39T0ho5UIpNFNSPdJMhlrt4/g5SM="
   },
   {
     "pname": "System.IdentityModel.Tokens.Jwt",
-    "version": "8.0.1",
-    "hash": "sha256-hW4f9zWs0afxPbcMqCA/FAGvBZbBFSkugIOurswomHg="
+    "version": "8.19.2",
+    "hash": "sha256-kEqfEiWkotfDUDphn0MsMqhOc82qQLXlbo5XYg58/io="
   },
   {
     "pname": "System.IdentityModel.Tokens.Jwt",
-    "version": "8.17.0",
-    "hash": "sha256-DmAmWVosgwWlKGJm/0wFVbeV19YD2rT+gp8utjY0n0Q="
+    "version": "8.22.0",
+    "hash": "sha256-f/ytqBQxSm3XxzYJTq4cLbmCBl9dffF8uonK7+k++vA="
   },
   {
     "pname": "System.IO.Abstractions",
-    "version": "22.1.1",
-    "hash": "sha256-6pdLnst5H8W2OjXEn49U+QvZ6XpzGB3A63ITqaFmW0k="
+    "version": "22.2.0",
+    "hash": "sha256-vmH65j0eBwtGjTVJ2fqfg9vh1xLtR0eqIlv1F/JGOek="
   },
   {
     "pname": "System.Net.WebSockets.WebSocketProtocol",
@@ -1391,8 +1391,8 @@
   },
   {
     "pname": "System.Security.Cryptography.Pkcs",
-    "version": "10.0.5",
-    "hash": "sha256-d7iz6dRRsxMPLtkQpD0OCbagVO/fHxSLtdoVuV/oC1k="
+    "version": "10.0.11",
+    "hash": "sha256-+L6ZL7/9VeyMlOJDcNjV/Rb7FMxXctLekfWROU0tMIM="
   },
   {
     "pname": "System.Security.Cryptography.Pkcs",
@@ -1401,28 +1401,33 @@
   },
   {
     "pname": "System.Security.Cryptography.Xml",
-    "version": "10.0.5",
-    "hash": "sha256-2EVg0Gzv0WZ/Vm8TuSbP0bcFUeHPOe00s2X6mrrhB0g="
+    "version": "10.0.11",
+    "hash": "sha256-oHuLaMtw4Pt0bwZ8hDmM0TpLpxcPoKD+gO4nFI3AmH0="
   },
   {
     "pname": "System.Security.Cryptography.Xml",
     "version": "8.0.2",
     "hash": "sha256-9TCmVyMB4+By/ipU8vdYDtSnw1tkkebnXXVRdT78+28="
   },
+  {
+    "pname": "System.Security.Cryptography.Xml",
+    "version": "8.0.4",
+    "hash": "sha256-lB/XDngiCMTFL6iy2BtoJgPN6FYI9iXXX4Qu57Yosb8="
+  },
   {
     "pname": "TestableIO.System.IO.Abstractions",
-    "version": "22.1.1",
-    "hash": "sha256-nBLPa/4R7gHmKltK260ZX6e+aOLlVkw5+2kuhraF2ec="
+    "version": "22.2.0",
+    "hash": "sha256-kyoEyF+j/vws2STfSMzHKrqzZJu284lszy0PufOdFBY="
   },
   {
     "pname": "TestableIO.System.IO.Abstractions.Wrappers",
-    "version": "22.1.1",
-    "hash": "sha256-1dLAGZ6XaKlxWsYljNgEsQXG8ET4mubrYxLBNpdee6I="
+    "version": "22.2.0",
+    "hash": "sha256-YUzACGTLDZ8R5S8JoXFYXRtmytFxXE2jFuDHJw5feXw="
   },
   {
     "pname": "Testably.Abstractions.FileSystem.Interface",
-    "version": "10.1.0",
-    "hash": "sha256-zS5HAJ+iZbjsiiqPE0+M+0PMGxOH1Bsmm3vdNSKoYPU="
+    "version": "10.3.0",
+    "hash": "sha256-uSzMsiXAKZK6NbwXa59zIbCkfI9qwuWsrm5yoLrheKU="
   },
   {
     "pname": "TimeZoneConverter",
@@ -1441,7 +1446,7 @@
   },
   {
     "pname": "YamlDotNet",
-    "version": "17.0.1",
-    "hash": "sha256-z23qb/L7DcjLgVsvROjyD7gr342u3QKjcPA2mZ0xz2g="
+    "version": "18.1.0",
+    "hash": "sha256-Wf/mWt5nrZ2IYmf4d7Y0pFA2PLgblOGducpMNkYUFvY="
   }
 ]
diff --git a/pkgs/by-name/ka/kavita/package.nix b/pkgs/by-name/ka/kavita/package.nix
index ef8765729c2d..da32f4aea5af 100644
--- a/pkgs/by-name/ka/kavita/package.nix
+++ b/pkgs/by-name/ka/kavita/package.nix
@@ -10,13 +10,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "kavita";
-  version = "0.9.0.2";
+  version = "0.9.1.4";
 
   src = fetchFromGitHub {
     owner = "kareadita";
     repo = "kavita";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-Wfb/Lc+BvkiJLopH1NQx1YQWzm2Sdmvg1Xmn+8YwWus=";
+    rev = "d77d956b9551227d8be2ee488b08f14aa3a341e5"; # Upstream tagged the wrong commit for 0.9.1.4
+    hash = "sha256-f0qGURiegUypD0XKZi43vJbA4KQ8OjZ6kWYg8fh1rPU=";
   };
 
   backend = buildDotnetModule {
@@ -52,7 +52,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     npmBuildScript = "prod";
     npmFlags = [ "--legacy-peer-deps" ];
     npmRebuildFlags = [ "--ignore-scripts" ]; # Prevent playwright from trying to install browsers
-    npmDepsHash = "sha256-Qa/lf0hH2KMDdRcBj8GW9cJGE3YZsP32z2kfTk6YNYc=";
+    npmDepsHash = "sha256-LO2LP70q18yHBfpfsMfG0QtyJIb275En25Df+fS5cr0=";
   };
 
   dontBuild = true;
diff --git a/pkgs/by-name/ke/keyleds/package.nix b/pkgs/by-name/ke/keyleds/package.nix
index ae4321b36437..499f2e357423 100644
--- a/pkgs/by-name/ke/keyleds/package.nix
+++ b/pkgs/by-name/ke/keyleds/package.nix
@@ -15,7 +15,7 @@
 
 stdenv.mkDerivation {
   pname = "keyleds";
-  version = "unstable-2021-04-08";
+  version = "1.1.1-unstable-2021-03-27";
 
   src = fetchFromGitHub {
     owner = "keyleds";
diff --git a/pkgs/by-name/li/libdeltachat/package.nix b/pkgs/by-name/li/libdeltachat/package.nix
index b559b3558228..e0fdff5fb4e8 100644
--- a/pkgs/by-name/li/libdeltachat/package.nix
+++ b/pkgs/by-name/li/libdeltachat/package.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libdeltachat";
-  version = "2.60.0";
+  version = "2.61.0";
 
   src = fetchFromGitHub {
     owner = "chatmail";
     repo = "core";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NPOK5L17cR/2OYJ/wzhvy9Mf9lGjsEOfd27YBm3X1uc=";
+    hash = "sha256-lePHfmq4bUxb1reQe2BOMC0WUDdH7cZ33Fu8TLkb+xs=";
   };
 
   patches = [
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
   cargoDeps = rustPlatform.fetchCargoVendor {
     pname = "chatmail-core";
     inherit (finalAttrs) version src;
-    hash = "sha256-PSZzC3Z2HAjBrT2yIC3TYa8Z6FrxTuAOQO29nlbmaTI=";
+    hash = "sha256-VZkrewx54/M1XXs9j9asLdLNEez+XIUvFfgAjo8w09c=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/libresplit/package.nix b/pkgs/by-name/li/libresplit/package.nix
index adc7c021c474..7e11ec6dbb1f 100644
--- a/pkgs/by-name/li/libresplit/package.nix
+++ b/pkgs/by-name/li/libresplit/package.nix
@@ -7,6 +7,7 @@
   luajit,
   meson,
   ninja,
+  openssl,
   pkg-config,
   unstableGitUpdater,
   wrapGAppsHook3,
@@ -14,13 +15,13 @@
 
 stdenv.mkDerivation {
   pname = "libresplit";
-  version = "0-unstable-2026-02-11";
+  version = "0-unstable-2026-08-14";
 
   src = fetchFromGitHub {
     owner = "LibreSplit";
     repo = "LibreSplit";
-    rev = "f87a6829c9319acca907a39af4d391375a322713";
-    hash = "sha256-wcv4VkuVClc+yCe/o8hIQFO/mxF4NAB7et52SLOwgpk=";
+    rev = "2c7f6610519cb98c3a1529ab2383ae0cd50d5dea";
+    hash = "sha256-fU0ghAMXOeygKWZYPtwriw2qxGh+5pnF392+rxrIGqg=";
   };
 
   nativeBuildInputs = [
@@ -34,6 +35,7 @@ stdenv.mkDerivation {
     gtk3
     jansson
     luajit
+    openssl
   ];
 
   passthru.updateScript = unstableGitUpdater { };
diff --git a/pkgs/by-name/li/libretroPackages/cores/beetle-pce-fast.nix b/pkgs/by-name/li/libretroPackages/cores/beetle-pce-fast.nix
index 60e2912b3038..2308db9dfd84 100644
--- a/pkgs/by-name/li/libretroPackages/cores/beetle-pce-fast.nix
+++ b/pkgs/by-name/li/libretroPackages/cores/beetle-pce-fast.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-pce-fast";
-  version = "0-unstable-2026-08-28";
+  version = "0-unstable-2026-09-18";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-pce-fast-libretro";
-    rev = "2f623abd033257b969370b73d9da982dcb0c3fdd";
-    hash = "sha256-rGtmnfOh2IZBYS69/xtiwqNegtYV0GcKI3VB3cQ/r74=";
+    rev = "076a24e1b10f76f3a7a8e849d25fab89f81ce1e9";
+    hash = "sha256-fWXnh++ZM7+DglB1+X4LBpWek4+PEUmxCG7BAsTE9zQ=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/by-name/li/libretroPackages/cores/desmume.nix b/pkgs/by-name/li/libretroPackages/cores/desmume.nix
index bd12fc589965..55efa34ccbf8 100644
--- a/pkgs/by-name/li/libretroPackages/cores/desmume.nix
+++ b/pkgs/by-name/li/libretroPackages/cores/desmume.nix
@@ -10,13 +10,13 @@
 }:
 mkLibretroCore {
   core = "desmume";
-  version = "0-unstable-2026-08-23";
+  version = "0-unstable-2026-09-20";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "desmume";
-    rev = "8f6b32cb9a5e310bd38520e7087ce7fa14765f15";
-    hash = "sha256-u1YTW7thPzmcse0XDs7WOu3foL7kf+urplOufQqawW8=";
+    rev = "95b4d798731caa809125b6c3c11d17cc332ff6ef";
+    hash = "sha256-hewHELQM+snFUDEwhzOapZbhcv0oHv1s0QHjn/FpNWg=";
   };
 
   extraBuildInputs = [
diff --git a/pkgs/by-name/lm/lmdbxx/package.nix b/pkgs/by-name/lm/lmdbxx/package.nix
index f36619273025..99e6e7529275 100644
--- a/pkgs/by-name/lm/lmdbxx/package.nix
+++ b/pkgs/by-name/lm/lmdbxx/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lmdbxx";
-  version = "1.0.0";
+  version = "1.0.2";
 
   src = fetchFromGitHub {
     owner = "hoytech";
     repo = "lmdbxx";
     rev = finalAttrs.version;
-    sha256 = "sha256-7CxQZdgHVvmof6wVR9Mzic6tg89XJT3Z1ICGRs7PZYo=";
+    sha256 = "sha256-0c8Xev9Ys6beMQ9VD4S2o6N9R/w2eEz8iCxUiX7mW4E=";
   };
 
   buildInputs = [ lmdb ];
diff --git a/pkgs/by-name/mc/mcp-searxng/package.nix b/pkgs/by-name/mc/mcp-searxng/package.nix
index 63dd51af3c6f..e9db284baf97 100644
--- a/pkgs/by-name/mc/mcp-searxng/package.nix
+++ b/pkgs/by-name/mc/mcp-searxng/package.nix
@@ -6,7 +6,7 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "mcp-searxng";
-  version = "2.3.0";
+  version = "2.4.0";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -15,10 +15,10 @@ buildNpmPackage (finalAttrs: {
     owner = "ihor-sokoliuk";
     repo = "mcp-searxng";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LMlbuPF8KuUZlD9HUjhunuHl2tmCMSeydBZiWuGWRHA=";
+    hash = "sha256-1ZGo6150O8cn2b4pYLqPWs+l11L+SpeH+ATKE470Hwo=";
   };
 
-  npmDepsHash = "sha256-MqVn66vCbB8+3o6KB6GCU9GxsPtqeCYjTbI5A3nfTVs=";
+  npmDepsHash = "sha256-21mw8/qUgLuAhF9KYZU7N+K4af7OBVwBHGqnr7p6lDE=";
 
   meta = {
     description = "Private web search for AI assistants via SearXNG — supports Claude, Cursor, and any MCP client";
diff --git a/pkgs/by-name/mo/mongodb-cli/package.nix b/pkgs/by-name/mo/mongodb-cli/package.nix
index 561f798fb06c..aa73ce5ca53b 100644
--- a/pkgs/by-name/mo/mongodb-cli/package.nix
+++ b/pkgs/by-name/mo/mongodb-cli/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "mongodb-cli";
-  version = "2.0.7";
+  version = "2.0.8";
 
   src = fetchFromGitHub {
     owner = "mongodb";
     repo = "mongodb-cli";
     tag = "mongocli/v${finalAttrs.version}";
-    hash = "sha256-vytc/e+e6JE5bwh5hny9C7LWenGctQLUso8GAXgk4j8=";
+    hash = "sha256-pSxIOiow1G1CQ/lJnmtyVPQdukRDczkbjajblbymcVM=";
   };
 
-  vendorHash = "sha256-CswQV9uTnL58TzYaVzx6dc1aZDZQ5b2LWLE1bv+P/2c=";
+  vendorHash = "sha256-F+WP6/QCQTb19b8LX1CnOJuPSJMmbY3HIgyPQfjVrKE=";
 
   subPackages = [ "cmd/mongocli" ];
 
diff --git a/pkgs/by-name/na/navidrome/package.nix b/pkgs/by-name/na/navidrome/package.nix
index ab47fc3cdd53..faed8d928b8f 100644
--- a/pkgs/by-name/na/navidrome/package.nix
+++ b/pkgs/by-name/na/navidrome/package.nix
@@ -20,16 +20,16 @@
 
 buildGo127Module (finalAttrs: {
   pname = "navidrome";
-  version = "0.64.0";
+  version = "0.64.1";
 
   src = fetchFromGitHub {
     owner = "navidrome";
     repo = "navidrome";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-2GUAGuwVE3i49g/mGN3zd1J1y9jVhF0g4hKGceSQwD8=";
+    hash = "sha256-zjg5JwpzcDe8LFvF/soE4IrsdpkNpO7psAoQrHlKCVI=";
   };
 
-  vendorHash = "sha256-1aKih0Xl5OfV4IO/2E0S31rHhRx356zl2QPM96jcFco=";
+  vendorHash = "sha256-vndJx4BcXQCJewKCv3TvSrxG6sCykfBvkOQK/kVQIPk=";
 
   npmRoot = "ui";
 
diff --git a/pkgs/by-name/ne/nextcloud-client/package.nix b/pkgs/by-name/ne/nextcloud-client/package.nix
index 21423c053820..e208836ed3ac 100644
--- a/pkgs/by-name/ne/nextcloud-client/package.nix
+++ b/pkgs/by-name/ne/nextcloud-client/package.nix
@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nextcloud-client";
-  version = "34.0.3";
+  version = "34.0.4";
 
   outputs = [
     "out"
@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "nextcloud-releases";
     repo = "desktop";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-sxo4AV+4AouAHuNZqc0VjFpNaB1Ubsi4zes48WhAhFY=";
+    hash = "sha256-5qHhhMpgmdfNCO88ZtEtE+HcqeTOgxPUXYb8cgC6YiA=";
   };
 
   patches = [
diff --git a/pkgs/by-name/ni/nixos-enter/package.nix b/pkgs/by-name/ni/nixos-enter/package.nix
index 4839b3a34053..16c374e8a3b3 100644
--- a/pkgs/by-name/ni/nixos-enter/package.nix
+++ b/pkgs/by-name/ni/nixos-enter/package.nix
@@ -28,7 +28,7 @@ replaceVarsWith {
 
   meta = {
     description = "Run a command in a NixOS chroot environment";
-    homepage = "https://github.com/NixOS/nixpkgs/tree/master/pkgs/by-name/ni/nixos-install";
+    homepage = "https://github.com/NixOS/nixpkgs/tree/master/pkgs/by-name/ni/nixos-enter";
     license = lib.licenses.mit;
     platforms = lib.platforms.linux;
     mainProgram = "nixos-enter";
diff --git a/pkgs/by-name/op/opentrack/package.nix b/pkgs/by-name/op/opentrack/package.nix
index b0cd06fb9f99..3778dd34e441 100644
--- a/pkgs/by-name/op/opentrack/package.nix
+++ b/pkgs/by-name/op/opentrack/package.nix
@@ -29,13 +29,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "opentrack";
-  version = "2026.1.0-unstable-2026-07-24";
+  version = "2026.1.0-unstable-2026-09-21";
 
   src = fetchFromGitHub {
     owner = "opentrack";
     repo = "opentrack";
-    rev = "f009bb52cab7bf3884b8a9b3a326aa9ce84d6299";
-    hash = "sha256-tC04TjDa35MUPV23/A6tstTS1l5148end4Yrv0RN9qg=";
+    rev = "043bfc1be415962151217709a101422404ea36a6";
+    hash = "sha256-VS6Kt5EA+TNoQ/NzVFHMoBhOoopDZafZ3MqaJQyI3MU=";
   };
 
   aruco = callPackage ./aruco.nix { };
diff --git a/pkgs/by-name/ox/oxfmt/package.nix b/pkgs/by-name/ox/oxfmt/package.nix
index 3f147de85d47..bf0fbffdb195 100644
--- a/pkgs/by-name/ox/oxfmt/package.nix
+++ b/pkgs/by-name/ox/oxfmt/package.nix
@@ -21,25 +21,25 @@
 # A pure Rust build would lack the Prettier plugin functionality.
 stdenv.mkDerivation (finalAttrs: {
   pname = "oxfmt";
-  version = "0.61.0";
+  version = "0.68.0";
 
   src = fetchFromGitHub {
     owner = "oxc-project";
     repo = "oxc";
     tag = "oxfmt_v${finalAttrs.version}";
-    hash = "sha256-uXkAD4+B8ghUbti1ts1RO+Jc0wQlpovl6+JzZA1JaRk=";
+    hash = "sha256-BqBI+xOFDcsw4muiyh6TypA8msJfwTsQ/nC4B6AtiLE=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-eZAJdMDC09nE9n2Arh72ZZUQjmMFdA68rPCmH2tSx2w=";
+    hash = "sha256-1raDjWN2IvtschMmLgs9Twlxc4+XVIEZ+7pqkVUDOR8=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_10;
     fetcherVersion = 3;
-    hash = "sha256-WZ4eYwQNeDF55ax3mW5swKafCDeYG5rWPPzJk5f+H1k=";
+    hash = "sha256-A4HpPjyL5UTMlpQ7hT/f2zbbW3GOKBFXWpZNdPRM6/s=";
   };
 
   nativeBuildInputs = [
@@ -58,6 +58,22 @@ stdenv.mkDerivation (finalAttrs: {
 
   env.OXC_VERSION = finalAttrs.version;
 
+  # @napi-rs/cli >= 3.8 reads the process start time and machine identity via
+  # host binaries while acquiring its filesystem reconciliation lock. The
+  # Darwin build sandbox denies those execs; Node raises them as synchronous
+  # `spawn EPERM` from execFile, which escapes napi's callback-based error
+  # handling. Point the lookups at a store no-op so the sandbox allows them.
+  # Empty output is treated as unverifiable identity and only disables stale
+  # lock detection.
+  preBuild = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    for cli in node_modules/.pnpm/@napi-rs+cli@*/node_modules/@napi-rs/cli/dist/cli.js; do
+      substituteInPlace "$cli" \
+        --replace-fail '"/bin/ps"' '":"' \
+        --replace-fail '"/usr/sbin/ioreg"' '":"' \
+        --replace-fail '"/usr/sbin/sysctl"' '":"'
+    done
+  '';
+
   buildPhase = ''
     runHook preBuild
 
diff --git a/pkgs/by-name/ox/oxlint/package.nix b/pkgs/by-name/ox/oxlint/package.nix
index 28ce2ebc71a3..d6e3577358b0 100644
--- a/pkgs/by-name/ox/oxlint/package.nix
+++ b/pkgs/by-name/ox/oxlint/package.nix
@@ -28,25 +28,25 @@ in
 # runs without an external linter, which leaves `jsPlugins` configs inert.
 stdenv.mkDerivation (finalAttrs: {
   pname = "oxlint";
-  version = "1.82.0";
+  version = "1.85.0";
 
   src = fetchFromGitHub {
     owner = "oxc-project";
     repo = "oxc";
     tag = "oxlint_v${finalAttrs.version}";
-    hash = "sha256-jDFBK5yshhSYP/Zl5DpVOPYgRrfB0gAGg7sv6hd4qds=";
+    hash = "sha256-VlIDDUJC+5YDLpfLr92zOm0vjPAL0j6PCiHaukBpsdk=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-YiNm3jL8pDr4UUixnLVjEAEX/izi2SqBKsrtyX8SFrQ=";
+    hash = "sha256-iQfRPmpqG8Jbunw1iLYiIhVqCn4H+koGJROcVY5wvA0=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 4;
-    hash = "sha256-CMU2VhsSeSM7zJ4YxCfJWP3ThGRpzpgOTur1wU5F28I=";
+    hash = "sha256-4qJcYXPWnw/WFR1NPm1cGgI3KPpnRhZRE+oUDb2ENpE=";
   };
 
   dontUseCmakeConfigure = true;
diff --git a/pkgs/by-name/pa/paseo/package.nix b/pkgs/by-name/pa/paseo/package.nix
index de8ace4f86c3..8eb9f235a6f0 100644
--- a/pkgs/by-name/pa/paseo/package.nix
+++ b/pkgs/by-name/pa/paseo/package.nix
@@ -13,7 +13,7 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "paseo";
-  version = "0.8.0";
+  version = "0.9.0";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -22,12 +22,12 @@ buildNpmPackage (finalAttrs: {
     owner = "getpaseo";
     repo = "paseo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zYUj7CGz+i+w0elysbU+Sup+NACsBoIEqCu8WHA24PE=";
+    hash = "sha256-qCjsMOi9/vMp0AVuWeSoiS1bv4bFMKoAha/zWNb2fHE=";
   };
 
   nodejs = nodejs_22;
 
-  npmDepsHash = "sha256-gDB48rHd0K1VOAblaQlPP4XnKGHI8cAt9S09aRxx6b4=";
+  npmDepsHash = "sha256-3cqO8DpPVDjYaSh0q5EPJuMpCgl2OJ17uLGVGuk1Wwc=";
 
   npmRebuildFlags = [ "--ignore-scripts" ];
 
diff --git a/pkgs/by-name/pd/pdns-recursor/package.nix b/pkgs/by-name/pd/pdns-recursor/package.nix
index 86c08c29a303..8b5564834f6e 100644
--- a/pkgs/by-name/pd/pdns-recursor/package.nix
+++ b/pkgs/by-name/pd/pdns-recursor/package.nix
@@ -21,17 +21,17 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pdns-recursor";
-  version = "5.4.5";
+  version = "5.4.6";
 
   src = fetchurl {
     url = "https://downloads.powerdns.com/releases/pdns-recursor-${finalAttrs.version}.tar.xz";
-    hash = "sha256-ExBXaNlJAGdZbyY9fTSLzAxnmFdMfZkcxAlS8YudrBE=";
+    hash = "sha256-DUyf6+b5TaCu1+Bex7ZUkE+9YindU79ge2P6cHuSNoo=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
     sourceRoot = "pdns-recursor-${finalAttrs.version}/rec-rust-lib/rust";
-    hash = "sha256-r0fVF/N1K2rYUEuEZ4NYYbpYxILMklhwAodeAEK7SFs=";
+    hash = "sha256-uHcUCVtlVFAgi/rPD1lYlN81p7gcIXvHutKXYMVddv4=";
   };
 
   cargoRoot = "rec-rust-lib/rust";
diff --git a/pkgs/by-name/pi/pi-coding-agent/package.nix b/pkgs/by-name/pi/pi-coding-agent/package.nix
index c4be891b6856..4d9f707c8b09 100644
--- a/pkgs/by-name/pi/pi-coding-agent/package.nix
+++ b/pkgs/by-name/pi/pi-coding-agent/package.nix
@@ -13,16 +13,16 @@
 }:
 buildNpmPackage (finalAttrs: {
   pname = "pi-coding-agent";
-  version = "0.86.1";
+  version = "0.87.0";
 
   src = fetchFromGitHub {
     owner = "earendil-works";
     repo = "pi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/7+VoRfXdeOwtiNXQYOKg5OHeKuNLIHfODGDNBhWop0=";
+    hash = "sha256-7YkIA5IEs4U0qnoaO3IzlY+p/M7j30fSVelLeyoV+F8=";
   };
 
-  npmDepsHash = "sha256-VxjYw4lN/w0sDboihHAKEhdJFzJa09qZo7vavkTkBuw=";
+  npmDepsHash = "sha256-fbxwpQHnrUihO9MU72m331Uwt9dv0fQtEjdJ9hU8UxA=";
 
   # The provider model catalog (packages/ai/src/providers/data/) is generated by
   # a network fetch (models.dev plus provider APIs) and is gitignored upstream,
@@ -31,7 +31,7 @@ buildNpmPackage (finalAttrs: {
   # under dist/providers/data/. Bump this hash alongside version.
   modelData = fetchurl {
     url = "https://registry.npmjs.org/@earendil-works/pi-ai/-/pi-ai-${finalAttrs.version}.tgz";
-    hash = "sha256-88Nb88YGsJ9iupLSx8ieY+DKGAdUcBAtVWVoTFJLfv0=";
+    hash = "sha256-8q353oCdA192+NrfPRSHIOvu9GBqhIqzbug02JWugS8=";
   };
 
   preConfigure = ''
diff --git a/pkgs/by-name/qo/qownnotes/package.nix b/pkgs/by-name/qo/qownnotes/package.nix
index d61e43e8daac..db1bc1e499af 100644
--- a/pkgs/by-name/qo/qownnotes/package.nix
+++ b/pkgs/by-name/qo/qownnotes/package.nix
@@ -19,11 +19,11 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "qownnotes";
   appname = "QOwnNotes";
-  version = "26.9.4";
+  version = "26.9.9";
 
   src = fetchurl {
     url = "https://github.com/pbek/QOwnNotes/releases/download/v${finalAttrs.version}/qownnotes-${finalAttrs.version}.tar.xz";
-    hash = "sha256-lJBaXNA/B9OY1qthOLgqnWPkE/QyQ86Ok+pyBc0czik=";
+    hash = "sha256-WtpB9VxTA+nF3r6EYorxT0kiB9nj3zGczQL1O2mu0vc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ri/rio/package.nix b/pkgs/by-name/ri/rio/package.nix
index 31ba0981bd2b..e657b3338116 100644
--- a/pkgs/by-name/ri/rio/package.nix
+++ b/pkgs/by-name/ri/rio/package.nix
@@ -51,16 +51,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rio";
-  version = "0.5.27";
+  version = "0.5.28";
 
   src = fetchFromGitHub {
     owner = "raphamorim";
     repo = "rio";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NkuuhH5ygCH45ZP71mZ4+16TSQJLlCoLuqobHX8INSI=";
+    hash = "sha256-Sv9G2YGG4CEWbWlrUSBs1zdzMPZbGpvBYsOIxmTrxOg=";
   };
 
-  cargoHash = "sha256-iIKZTv2PdSD33Tfeg5p//00XSHAkBusEYXCi5jhP3iY=";
+  cargoHash = "sha256-ygX7saxVxK9NpnsO2J1zx7sWduTkhkD4RlB8SNLavGY=";
 
   nativeBuildInputs = [
     rustPlatform.bindgenHook
diff --git a/pkgs/by-name/rn/rnmon/package.nix b/pkgs/by-name/rn/rnmon/package.nix
index b14cb478278c..03a170e6d61f 100644
--- a/pkgs/by-name/rn/rnmon/package.nix
+++ b/pkgs/by-name/rn/rnmon/package.nix
@@ -7,7 +7,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "rnmon";
-  version = "0.3.4";
+  version = "0.3.6";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -15,7 +15,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "lbatalha";
     repo = "rnmon";
     tag = finalAttrs.version;
-    hash = "sha256-3ou2F8ePKzh6g63X0l9iX1fTSVe9misGBkPlCUEWpiU=";
+    hash = "sha256-Pu7kd9CUoHRWnmzrF9NSeqXxN7CRDFQslS+j3M7iNGQ=";
   };
 
   build-system = [
diff --git a/pkgs/by-name/sh/shader-slang/package.nix b/pkgs/by-name/sh/shader-slang/package.nix
index ad55d009da17..5e6f62bbd5b7 100644
--- a/pkgs/by-name/sh/shader-slang/package.nix
+++ b/pkgs/by-name/sh/shader-slang/package.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "shader-slang";
-  version = "2026.17.1";
+  version = "2026.18";
 
   src = fetchFromGitHub {
     owner = "shader-slang";
     repo = "slang";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-o6HRIpi/pV1dNmG9b5VK0DwKxSm/Vm6LLHR8YC9DC30=";
+    hash = "sha256-GlXTDfC6BLENmrzBceJGZIP4FU5ItqtyoxmbnFZ5fdQ=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/th/thunderbird-cli-bridge/package.nix b/pkgs/by-name/th/thunderbird-cli-bridge/package.nix
index ff5daca16388..bb14171d5d3d 100644
--- a/pkgs/by-name/th/thunderbird-cli-bridge/package.nix
+++ b/pkgs/by-name/th/thunderbird-cli-bridge/package.nix
@@ -7,7 +7,7 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "thunderbird-cli-bridge";
-  version = "1.0.2";
+  version = "1.1.0";
 
   __structuredAttrs = true;
 
@@ -15,14 +15,14 @@ buildNpmPackage (finalAttrs: {
     owner = "vitalio-sh";
     repo = "thunderbird-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jtIXOHjijFkwdh5FWrqdSfEwbEmWQud8Qr2jsTEwJts=";
+    hash = "sha256-WSbczKPxTyaSqYeI8WYKpo983sfJWa7QCYbElMetUqY=";
   };
 
   forceEmptyCache = true;
   dontNpmBuild = true;
 
   npmWorkspace = "bridge";
-  npmDepsHash = "sha256-ixzfebmKITD1lnPNQq765S1f+i7xBTTWWdZoJOqY7qg=";
+  npmDepsHash = "sha256-1+VkzCrLZvL7XUxoK/AazwSR3yLqgZ4CGJwDAJ2e+5U=";
 
   # TODO: revisit this when https://github.com/NixOS/nixpkgs/pull/333759 has landed
   postInstall = ''
diff --git a/pkgs/by-name/th/thunderbird-cli-mcp/package.nix b/pkgs/by-name/th/thunderbird-cli-mcp/package.nix
index 2f721a15fa69..608e4c2fc639 100644
--- a/pkgs/by-name/th/thunderbird-cli-mcp/package.nix
+++ b/pkgs/by-name/th/thunderbird-cli-mcp/package.nix
@@ -7,7 +7,7 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "thunderbird-cli-mcp";
-  version = "1.0.2";
+  version = "1.1.0";
 
   __structuredAttrs = true;
 
@@ -15,14 +15,14 @@ buildNpmPackage (finalAttrs: {
     owner = "vitalio-sh";
     repo = "thunderbird-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jtIXOHjijFkwdh5FWrqdSfEwbEmWQud8Qr2jsTEwJts=";
+    hash = "sha256-WSbczKPxTyaSqYeI8WYKpo983sfJWa7QCYbElMetUqY=";
   };
 
   forceEmptyCache = true;
   dontNpmBuild = true;
 
   npmWorkspace = "mcp";
-  npmDepsHash = "sha256-ixzfebmKITD1lnPNQq765S1f+i7xBTTWWdZoJOqY7qg=";
+  npmDepsHash = "sha256-1+VkzCrLZvL7XUxoK/AazwSR3yLqgZ4CGJwDAJ2e+5U=";
 
   # TODO: revisit this when https://github.com/NixOS/nixpkgs/pull/333759 has landed
   postInstall = ''
diff --git a/pkgs/by-name/th/thunderbird-cli/package.nix b/pkgs/by-name/th/thunderbird-cli/package.nix
index 65e0b4b5e451..96c8fc1e0368 100644
--- a/pkgs/by-name/th/thunderbird-cli/package.nix
+++ b/pkgs/by-name/th/thunderbird-cli/package.nix
@@ -7,7 +7,7 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "thunderbird-cli";
-  version = "1.0.2";
+  version = "1.1.0";
 
   __structuredAttrs = true;
 
@@ -15,14 +15,14 @@ buildNpmPackage (finalAttrs: {
     owner = "vitalio-sh";
     repo = "thunderbird-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jtIXOHjijFkwdh5FWrqdSfEwbEmWQud8Qr2jsTEwJts=";
+    hash = "sha256-WSbczKPxTyaSqYeI8WYKpo983sfJWa7QCYbElMetUqY=";
   };
 
   forceEmptyCache = true;
   dontNpmBuild = true;
 
   npmWorkspace = "cli";
-  npmDepsHash = "sha256-ixzfebmKITD1lnPNQq765S1f+i7xBTTWWdZoJOqY7qg=";
+  npmDepsHash = "sha256-1+VkzCrLZvL7XUxoK/AazwSR3yLqgZ4CGJwDAJ2e+5U=";
 
   # TODO: revisit this when https://github.com/NixOS/nixpkgs/pull/333759 has landed
   postInstall = ''
diff --git a/pkgs/by-name/ty/typesense/sources.json b/pkgs/by-name/ty/typesense/sources.json
index cb443f452229..77b5d2383b22 100644
--- a/pkgs/by-name/ty/typesense/sources.json
+++ b/pkgs/by-name/ty/typesense/sources.json
@@ -1,17 +1,17 @@
 {
-  "version": "29.0",
+  "version": "30.2",
   "platforms": {
     "aarch64-linux": {
       "arch": "linux-arm64",
-      "hash": "sha256-ztjCyK2378tg9yT9D6ProINlMT5GyUIEH8duHivCQ2E="
+      "hash": "sha256-qbnW4pJ8hjkAMGKQ6FMsF/Zr3/NO8q0EOyTtTM7Iprw="
     },
     "x86_64-linux": {
       "arch": "linux-amd64",
-      "hash": "sha256-BD0qE1dEVKVUPwO2fMO0SMXiwG9dD0RMnAzkVZitFKA="
+      "hash": "sha256-zXkWBefGzHvkV3lPU0zUufnTYXga2xDkACDvwihA68M="
     },
     "aarch64-darwin": {
       "arch": "darwin-arm64",
-      "hash": "sha256-yAOR/bGYBQGp8Mllhh0yKyqmItd2+IfLib3W+lIHwr0="
+      "hash": "sha256-fY1tDDOTCtIOoj3RhCUFR7FmFZRL6JGyB46KB1FS+n4="
     }
   }
 }
diff --git a/pkgs/by-name/xd/xdg-desktop-portal-wormhole/package.nix b/pkgs/by-name/xd/xdg-desktop-portal-wormhole/package.nix
new file mode 100644
index 000000000000..7171edb55b30
--- /dev/null
+++ b/pkgs/by-name/xd/xdg-desktop-portal-wormhole/package.nix
@@ -0,0 +1,77 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  ninja,
+  pkg-config,
+  qt6,
+  wayland-scanner,
+  glib,
+  pipewire,
+  wayland,
+  wayland-protocols,
+  nix-update-script,
+  testers,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xdg-desktop-portal-wormhole";
+  version = "1.0.2";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "AstraSuite";
+    repo = "Wormhole";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-NCttrS5eXXuSYNiynu2jTlpt3brPnS8nNJEAQqcXcuI=";
+  };
+
+  postPatch = ''
+    substituteInPlace src/main.cpp \
+      --replace-fail 'app.setApplicationVersion("1.0.0");' 'app.setApplicationVersion("${finalAttrs.version}");'
+  '';
+
+  nativeBuildInputs = [
+    cmake
+    ninja
+    pkg-config
+    qt6.wrapQtAppsHook
+    wayland-scanner
+  ];
+
+  buildInputs = [
+    qt6.qtbase
+    qt6.qtdeclarative
+    qt6.qtsvg
+    qt6.qtmultimedia
+    glib
+    pipewire
+    wayland
+    wayland-protocols
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeFeature "WORMHOLE_VERSION" finalAttrs.version)
+    (lib.cmakeFeature "INIT_SYSTEM" "systemd")
+  ];
+
+  passthru = {
+    updateScript = nix-update-script { };
+    tests.version = testers.testVersion {
+      package = finalAttrs.finalPackage;
+      command = "QT_QPA_PLATFORM=offscreen wormhole --version";
+    };
+  };
+
+  meta = {
+    description = "XDG Desktop Portal for Caelestia Shell";
+    homepage = "https://github.com/AstraSuite/Wormhole";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ rachalaraj ];
+    mainProgram = "wormhole";
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/xk/xk6/package.nix b/pkgs/by-name/xk/xk6/package.nix
index b5072cc950c0..39d74becca27 100644
--- a/pkgs/by-name/xk/xk6/package.nix
+++ b/pkgs/by-name/xk/xk6/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "xk6";
-  version = "1.4.12";
+  version = "1.4.14";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "xk6";
     tag = "v${version}";
-    hash = "sha256-puptwpgCNPupUZG6/zKIRuMwaItgwcZiBREPfcSAMvs=";
+    hash = "sha256-sA3b1EUczciQV9jrVR2YkjuW0i1LOIHctLJWK2q8po0=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/ze/zenroom/package.nix b/pkgs/by-name/ze/zenroom/package.nix
index ad212d45432a..7982964b1d0b 100644
--- a/pkgs/by-name/ze/zenroom/package.nix
+++ b/pkgs/by-name/ze/zenroom/package.nix
@@ -30,13 +30,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zenroom";
-  version = "5.37.2";
+  version = "5.38.1";
 
   src = fetchFromGitHub {
     owner = "dyne";
     repo = "Zenroom";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gNUclaXF7C2yBywo1TAwHOfB9Pe17g6fCLhEcFq8JL0=";
+    hash = "sha256-FDGIMeWzhHSLsVUAH/y3cgJbkXzzX3yiHjXeSL2xnto=";
     postFetch = ''
       # conflict on case-insensitive filesystems
       pushd $out/docs/examples/zencode_cookbook/cookbook_when
diff --git a/pkgs/by-name/zl/zlspectrumequalizer/package.nix b/pkgs/by-name/zl/zlspectrumequalizer/package.nix
new file mode 100644
index 000000000000..e60786db46b7
--- /dev/null
+++ b/pkgs/by-name/zl/zlspectrumequalizer/package.nix
@@ -0,0 +1,144 @@
+{
+  lib,
+  clangStdenv,
+  fetchFromGitHub,
+  nix-update-script,
+
+  # nativeBuildInputs
+  cmake,
+  darwin,
+  ninja,
+  pkg-config,
+  python3,
+  writableTmpDirAsHomeHook,
+
+  # buildInputs
+  alsa-lib,
+  fontconfig,
+  freetype,
+  libxcursor,
+  libxext,
+  libxi,
+  libxinerama,
+  libxrandr,
+  lv2,
+  # Highway is built static-dispatch only upstream (HWY_COMPILE_ONLY_STATIC is
+  # forced ON), so exactly one ISA is baked in -- there is no runtime dispatch.
+  # Default to the portable baseline so the cached binary runs everywhere nixpkgs
+  # targets. Override for a faster *local* build, e.g.
+  #   zlspectrumequalizer.override { simdTarget = "AVX2"; }
+  # SSE4/AVX2 map to -march=x86-64-v2/v3 and will SIGILL on CPUs lacking that ISA,
+  # which is why this must not be raised for the binary cache.
+  simdTarget ? (if clangStdenv.hostPlatform.isAarch64 then "NEON" else "SSE2"),
+}:
+assert lib.assertOneOf "simdTarget" simdTarget [
+  "SSE2"
+  "SSE4"
+  "AVX2"
+  "NEON"
+];
+clangStdenv.mkDerivation (finalAttrs: {
+  pname = "zlspectrumequalizer";
+  version = "0.1.0";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "ZL-Audio";
+    repo = "ZlSpectrumEqualizer";
+    tag = finalAttrs.version;
+    hash = "sha256-h4GZlyWieE1LVDr+SC3k2uklrqh5r8KQywW0+Ksa27E=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    cmake
+    ninja
+    pkg-config
+    python3
+    writableTmpDirAsHomeHook
+  ]
+  ++ lib.optionals clangStdenv.hostPlatform.isDarwin [ darwin.sigtool ];
+
+  buildInputs = [
+    fontconfig
+    freetype
+    lv2
+  ]
+  ++ lib.optionals clangStdenv.hostPlatform.isLinux [
+    alsa-lib
+    libxcursor
+    libxext
+    libxi
+    libxinerama
+    libxrandr
+  ];
+
+  env = lib.optionalAttrs clangStdenv.hostPlatform.isLinux {
+    # JUCE dlopen's these at runtime, crashes without them
+    # -lXi is essential: JUCE requests the unversioned
+    # "libXi.so", which no host has already loaded, and when that dlopen fails
+    # JUCE still believes XInput2 is present (the stub for the missing
+    # XIQueryVersion returns 0, which equals Success), so it discards all core
+    # pointer events and the GUI stops responding to the mouse entirely.
+    NIX_LDFLAGS = toString [
+      "-lX11"
+      "-lXcursor"
+      "-lXext"
+      "-lXi"
+      "-lXinerama"
+      "-lXrandr"
+    ];
+
+    NIX_CFLAGS_COMPILE = toString [
+      # juce, compiled in this build as part of a Git submodule, uses `-flto` as
+      # a Link Time Optimization flag, and instructs the plugin compiled here to
+      # use this flag to. This breaks the build for us. Using _fat_ LTO allows
+      # successful linking while still providing LTO benefits. If our build of
+      # `juce` was used as a dependency, we could have patched that `-flto` line
+      # in our juce's source, but that is not possible because it is used as a
+      # Git Submodule.
+      "-ffat-lto-objects"
+    ];
+  };
+
+  cmakeFlags = [
+    (lib.cmakeFeature "ZL_HWY_STATIC_TARGET" simdTarget)
+    (lib.cmakeBool "ZL_JUCE_COPY_PLUGIN" false)
+    # set the version for the settings screen.
+    (lib.cmakeFeature "FOOBAR_VERSION" "${finalAttrs.version}")
+  ];
+
+  installPhase = ''
+    runHook preInstall
+  ''
+  + lib.optionalString clangStdenv.hostPlatform.isLinux ''
+    mkdir -p $out/lib/{lv2,vst3}
+    cp -r "ZLSpectrumEqualizer_artefacts/Release/LV2/ZL Spectrum Equalizer.lv2" $out/lib/lv2/
+    cp -r "ZLSpectrumEqualizer_artefacts/Release/VST3/ZL Spectrum Equalizer.vst3" $out/lib/vst3/
+    install -Dm755 -t $out/bin "ZLSpectrumEqualizer_artefacts/Release/Standalone/ZL Spectrum Equalizer"
+  ''
+  + lib.optionalString clangStdenv.hostPlatform.isDarwin ''
+    mkdir -p $out/Applications
+    cp -r ZLSpectrumEqualizer_artefacts/Release/{AU,VST3} $out/
+    cp -r ZLSpectrumEqualizer_artefacts/Release/Standalone/* $out/Applications/
+  ''
+  + ''
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    homepage = "https://zl-audio.github.io/plugins/zlspeceq/";
+    changelog = "https://github.com/ZL-Audio/ZlSpectrumEqualizer/releases/tag/${finalAttrs.version}";
+    description = "Dynamic spectrum equalizer plugin for VST3, LV2 and standalone";
+    mainProgram = "ZL Spectrum Equalizer";
+    license = lib.licenses.agpl3Plus;
+    maintainers = with lib.maintainers; [
+      magnetophon
+    ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+  };
+})
diff --git a/pkgs/by-name/zw/zwave-js-ui/package.nix b/pkgs/by-name/zw/zwave-js-ui/package.nix
index f8e6c2f6ae08..44b54eae8bf5 100644
--- a/pkgs/by-name/zw/zwave-js-ui/package.nix
+++ b/pkgs/by-name/zw/zwave-js-ui/package.nix
@@ -7,15 +7,15 @@
 
 buildNpmPackage rec {
   pname = "zwave-js-ui";
-  version = "11.24.0";
+  version = "11.24.1";
 
   src = fetchFromGitHub {
     owner = "zwave-js";
     repo = "zwave-js-ui";
     tag = "v${version}";
-    hash = "sha256-KX90w0J4ASGxyFbv8l8dNoNqIURXuOeNl6E3dmFzbC4=";
+    hash = "sha256-wHeZOMMTq0Rb8SU4pbSMcN6/DBrPbT4VnGppwa5gEiE=";
   };
-  npmDepsHash = "sha256-ECuBLrAIfWgCLPbKOFmZvq/6MhB58o3JjTrRf5Dip2g=";
+  npmDepsHash = "sha256-SdmSf9LDKpQfcwA8kWMjZKdzf64/GTdLVZf5MNZtasQ=";
 
   passthru.tests.zwave-js-ui = nixosTests.zwave-js-ui;
 
diff --git a/pkgs/development/cuda-modules/packages/cccl.nix b/pkgs/development/cuda-modules/packages/cccl.nix
index 181d073c47a9..7b86ad2e0aec 100644
--- a/pkgs/development/cuda-modules/packages/cccl.nix
+++ b/pkgs/development/cuda-modules/packages/cccl.nix
@@ -37,7 +37,7 @@ buildRedist {
         hash = "sha256-hYfMFsd7Y8CwuNGaPYG6uEB+lg1TmWSIIU5ToVMULKY=";
       })
     ]
-    ++ lib.optionals (cudaAtLeast "13.2" && cudaOlder "13.4") [
+    ++ lib.optionals (cudaAtLeast "13.2" && cudaOlder "13.3") [
       # Fix onnxruntime compilation error: https://github.com/microsoft/onnxruntime/issues/28023
       # Backport: https://github.com/NVIDIA/cccl/pull/8771
       (fetchpatch {
diff --git a/pkgs/development/interpreters/erlang/27.nix b/pkgs/development/interpreters/erlang/27.nix
index ca19a264f12b..5ae686415e80 100644
--- a/pkgs/development/interpreters/erlang/27.nix
+++ b/pkgs/development/interpreters/erlang/27.nix
@@ -1,6 +1,6 @@
 genericBuilder:
 
 genericBuilder {
-  version = "27.3.4.17";
-  hash = "sha256-os1xGN+3boKGehVKtuM0Buetb56IGhn8SRuoHlJg5bA=";
+  version = "27.3.4.18";
+  hash = "sha256-KEnZ9UL/yOERn+CjTk+7tu0yR4RHwYwJOhnDj5nKfFs=";
 }
diff --git a/pkgs/development/interpreters/erlang/28.nix b/pkgs/development/interpreters/erlang/28.nix
index 3722a12eb1a9..0c8edca3151d 100644
--- a/pkgs/development/interpreters/erlang/28.nix
+++ b/pkgs/development/interpreters/erlang/28.nix
@@ -1,6 +1,6 @@
 genericBuilder:
 
 genericBuilder {
-  version = "28.5.0.6";
-  hash = "sha256-RjP7SmW6vH/sIf3w0ZROoQBbCTmsdGcqsm9rYU2Tfmw=";
+  version = "28.5.0.7";
+  hash = "sha256-1XnZspWzU8gCaeJz6kFMonrY51EKL4r/6jBI6UdNu0g=";
 }
diff --git a/pkgs/development/interpreters/erlang/29.nix b/pkgs/development/interpreters/erlang/29.nix
index a40c8cc08ea8..d0f7fcc02848 100644
--- a/pkgs/development/interpreters/erlang/29.nix
+++ b/pkgs/development/interpreters/erlang/29.nix
@@ -1,6 +1,6 @@
 genericBuilder:
 
 genericBuilder {
-  version = "29.1";
-  hash = "sha256-G1YZCdaicgmuZYXIi6g5bRM4nkvJoLb7fGdBCD+NIvQ=";
+  version = "29.1.1";
+  hash = "sha256-k84hE47sKK+eROIb65p2kcV9aHgZPxEg2SWGs2MpneE=";
 }
diff --git a/pkgs/development/python-modules/caldav/default.nix b/pkgs/development/python-modules/caldav/default.nix
index 2b1a391a5442..2cd2a583c192 100644
--- a/pkgs/development/python-modules/caldav/default.nix
+++ b/pkgs/development/python-modules/caldav/default.nix
@@ -29,14 +29,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "caldav";
-  version = "3.3.0";
+  version = "3.3.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "python-caldav";
     repo = "caldav";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-FV1C8RlbkNXOTtRKSCNgiGetImW0+647JgmZtf5U+pY=";
+    hash = "sha256-G1iZ2a81DTURIODWTXji7AU6ywPDg4XqGNoQFhPIMO4=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/colcon-mixin/default.nix b/pkgs/development/python-modules/colcon-mixin/default.nix
index bc785c002bb8..8b01d14833c7 100644
--- a/pkgs/development/python-modules/colcon-mixin/default.nix
+++ b/pkgs/development/python-modules/colcon-mixin/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "colcon-mixin";
-  version = "0.3.1";
+  version = "0.3.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "colcon";
     repo = "colcon-mixin";
     tag = version;
-    hash = "sha256-XpUZcfKxKr6wlqFFFEP26KlRjn6v/j1/r/pAORzPeSM=";
+    hash = "sha256-sSfJSLZVCIQRFj9Z3au/j+W6uFU3FKhnIBMk1HYgvTM=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/scipp/default.nix b/pkgs/development/python-modules/scipp/default.nix
index 809ec3be6dbd..f285ae3a5d4f 100644
--- a/pkgs/development/python-modules/scipp/default.nix
+++ b/pkgs/development/python-modules/scipp/default.nix
@@ -39,14 +39,14 @@
 
 buildPythonPackage rec {
   pname = "scipp";
-  version = "26.8.0";
+  version = "26.9.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "scipp";
     repo = "Scipp";
     tag = version;
-    hash = "sha256-D8xUq63S1mEALfrw0Qz/7Mprw1zQMj6W2j/LjkgfGvM=";
+    hash = "sha256-1u9KT6o83hn9x/WGXj26OsGJOQpMBu1G4FiDIVaGXoM=";
   };
 
   env = {
diff --git a/pkgs/development/python-modules/typesense/0001-linux-only-metrics.patch b/pkgs/development/python-modules/typesense/0001-linux-only-metrics.patch
new file mode 100644
index 000000000000..528a1e38d674
--- /dev/null
+++ b/pkgs/development/python-modules/typesense/0001-linux-only-metrics.patch
@@ -0,0 +1,62 @@
+From 24cb4ac0fcc6bfa88432c5c6a1b061f601458baf Mon Sep 17 00:00:00 2001
+From: phanirithvij <phanirithvij2000@gmail.com>
+Date: Wed, 25 Mar 2026 18:30:32 +0530
+Subject: [PATCH 1/6] linux only metrics
+
+Signed-off-by: phanirithvij <phanirithvij2000@gmail.com>
+---
+ tests/metrics_test.py | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/tests/metrics_test.py b/tests/metrics_test.py
+index 12fc300..6f2295d 100644
+--- a/tests/metrics_test.py
++++ b/tests/metrics_test.py
+@@ -42,18 +42,22 @@ def test_init_async(fake_async_api_call: AsyncApiCall) -> None:
+     )
+     assert metrics.resource_path == "/metrics.json"  # noqa: WPS437
+ 
++import platform
++
+ 
+ def test_actual_retrieve(actual_metrics: Metrics) -> None:
+     """Test that the Metrics object can retrieve metrics on Typesense server and verify response structure."""
+     response = actual_metrics.retrieve()
+ 
+-    assert "system_cpu_active_percentage" in response
++    if platform.system() == "Linux":
++        assert "system_cpu_active_percentage" in response
++        assert "system_network_received_bytes" in response
++        assert "system_network_sent_bytes" in response
++
+     assert "system_disk_total_bytes" in response
+     assert "system_disk_used_bytes" in response
+     assert "system_memory_total_bytes" in response
+     assert "system_memory_used_bytes" in response
+-    assert "system_network_received_bytes" in response
+-    assert "system_network_sent_bytes" in response
+     assert "typesense_memory_active_bytes" in response
+     assert "typesense_memory_allocated_bytes" in response
+     assert "typesense_memory_fragmentation_ratio" in response
+@@ -68,13 +72,15 @@ async def test_actual_retrieve_async(actual_async_metrics: AsyncMetrics) -> None
+     """Test that the AsyncMetrics object can retrieve metrics on Typesense server and verify response structure."""
+     response = await actual_async_metrics.retrieve()
+ 
+-    assert "system_cpu_active_percentage" in response
++    if platform.system() == "Linux":
++        assert "system_cpu_active_percentage" in response
++        assert "system_network_received_bytes" in response
++        assert "system_network_sent_bytes" in response
++
+     assert "system_disk_total_bytes" in response
+     assert "system_disk_used_bytes" in response
+     assert "system_memory_total_bytes" in response
+     assert "system_memory_used_bytes" in response
+-    assert "system_network_received_bytes" in response
+-    assert "system_network_sent_bytes" in response
+     assert "typesense_memory_active_bytes" in response
+     assert "typesense_memory_allocated_bytes" in response
+     assert "typesense_memory_fragmentation_ratio" in response
+-- 
+2.53.0
+
diff --git a/pkgs/development/python-modules/typesense/generated-temp-path.patch b/pkgs/development/python-modules/typesense/0002-generated-temp-path.patch
similarity index 56%
rename from pkgs/development/python-modules/typesense/generated-temp-path.patch
rename to pkgs/development/python-modules/typesense/0002-generated-temp-path.patch
index ddb15e2ea64d..902d4712efb6 100644
--- a/pkgs/development/python-modules/typesense/generated-temp-path.patch
+++ b/pkgs/development/python-modules/typesense/0002-generated-temp-path.patch
@@ -1,11 +1,21 @@
+From ed2f6f31f74fae21cb00b6ea3da92b300fadce76 Mon Sep 17 00:00:00 2001
+From: phanirithvij <phanirithvij2000@gmail.com>
+Date: Wed, 25 Mar 2026 19:05:02 +0530
+Subject: [PATCH 2/6] generated temp path
+
+Signed-off-by: phanirithvij <phanirithvij2000@gmail.com>
+---
+ tests/operations_test.py | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
 diff --git a/tests/operations_test.py b/tests/operations_test.py
-index 34bb74c..39f9265 100644
+index b48b946..71c134e 100644
 --- a/tests/operations_test.py
 +++ b/tests/operations_test.py
-@@ -51,11 +51,11 @@ def test_cache_clear(actual_operations: Operations) -> None:
+@@ -69,11 +69,11 @@ def test_cache_clear(actual_operations: Operations) -> None:
      assert response["success"]
-
-
+ 
+ 
 -def test_snapshot(actual_operations: Operations) -> None:
 +def test_snapshot(actual_operations: Operations, tmp_path) -> None:
      """Test that the Operations object can perform the snapshot operation."""
@@ -14,5 +24,8 @@ index 34bb74c..39f9265 100644
 -        {"snapshot_path": "/tmp"},  # noqa: S108
 +        {"snapshot_path": str(tmp_path)},  # noqa: S108
      )
-
+ 
      assert response["success"]
+-- 
+2.53.0
+
diff --git a/pkgs/development/python-modules/typesense/0003-tests-fix-endpoint-path.patch b/pkgs/development/python-modules/typesense/0003-tests-fix-endpoint-path.patch
new file mode 100644
index 000000000000..42c8988f074f
--- /dev/null
+++ b/pkgs/development/python-modules/typesense/0003-tests-fix-endpoint-path.patch
@@ -0,0 +1,106 @@
+From 90047673e4191ffaa6431059f9a8c1ffb31ea3cb Mon Sep 17 00:00:00 2001
+From: phanirithvij <phanirithvij2000@gmail.com>
+Date: Wed, 25 Mar 2026 19:02:46 +0530
+Subject: [PATCH 3/6] tests fix endpoint path
+
+_endpoint_path is not a function anymore
+
+Signed-off-by: phanirithvij <phanirithvij2000@gmail.com>
+---
+ tests/override_test.py  | 4 ++--
+ tests/overrides_test.py | 4 ++--
+ tests/synonym_test.py   | 4 ++--
+ tests/synonyms_test.py  | 4 ++--
+ 4 files changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/tests/override_test.py b/tests/override_test.py
+index 89526c7..47fc81b 100644
+--- a/tests/override_test.py
++++ b/tests/override_test.py
+@@ -47,7 +47,7 @@ def test_init(fake_api_call: ApiCall) -> None:
+         fake_api_call.config.nearest_node,
+     )
+     assert (
+-        override._endpoint_path()  # noqa: WPS437
++        override._endpoint_path  # noqa: WPS437
+         == "/collections/companies/overrides/company_override"
+     )
+ 
+@@ -104,7 +104,7 @@ def test_init_async(fake_async_api_call: AsyncApiCall) -> None:
+         fake_async_api_call.config.nearest_node,
+     )
+     assert (
+-        override._endpoint_path()  # noqa: WPS437
++        override._endpoint_path  # noqa: WPS437
+         == "/collections/companies/overrides/company_override"
+     )
+ 
+diff --git a/tests/overrides_test.py b/tests/overrides_test.py
+index a9376b5..de4de73 100644
+--- a/tests/overrides_test.py
++++ b/tests/overrides_test.py
+@@ -61,7 +61,7 @@ def test_get_missing_override(fake_overrides: Overrides) -> None:
+     )
+     assert override.collection_name == "companies"
+     assert (
+-        override._endpoint_path()  # noqa: WPS437
++        override._endpoint_path  # noqa: WPS437
+         == "/collections/companies/overrides/company_override"
+     )
+ 
+@@ -186,7 +186,7 @@ def test_get_missing_override_async(fake_async_overrides) -> None:
+     )
+     assert override.collection_name == "companies"
+     assert (
+-        override._endpoint_path()  # noqa: WPS437
++        override._endpoint_path  # noqa: WPS437
+         == "/collections/companies/overrides/company_override"
+     )
+ 
+diff --git a/tests/synonym_test.py b/tests/synonym_test.py
+index cfe6e51..d9affd9 100644
+--- a/tests/synonym_test.py
++++ b/tests/synonym_test.py
+@@ -45,7 +45,7 @@ def test_init(fake_api_call: ApiCall) -> None:
+         fake_api_call.config.nearest_node,
+     )
+     assert (
+-        synonym._endpoint_path()  # noqa: WPS437
++        synonym._endpoint_path  # noqa: WPS437
+         == "/collections/companies/synonyms/company_synonym"
+     )
+ 
+@@ -99,7 +99,7 @@ def test_init_async(fake_async_api_call: AsyncApiCall) -> None:
+         fake_async_api_call.config.nearest_node,
+     )
+     assert (
+-        synonym._endpoint_path()  # noqa: WPS437
++        synonym._endpoint_path  # noqa: WPS437
+         == "/collections/companies/synonyms/company_synonym"
+     )
+ 
+diff --git a/tests/synonyms_test.py b/tests/synonyms_test.py
+index 3402493..afe8638 100644
+--- a/tests/synonyms_test.py
++++ b/tests/synonyms_test.py
+@@ -62,7 +62,7 @@ def test_get_missing_synonym(fake_synonyms: Synonyms) -> None:
+     )
+     assert synonym.collection_name == "companies"
+     assert (
+-        synonym._endpoint_path()  # noqa: WPS437
++        synonym._endpoint_path  # noqa: WPS437
+         == "/collections/companies/synonyms/company_synonym"
+     )
+ 
+@@ -174,7 +174,7 @@ def test_get_missing_synonym_async(fake_async_synonyms) -> None:
+     )
+     assert synonym.collection_name == "companies"
+     assert (
+-        synonym._endpoint_path()  # noqa: WPS437
++        synonym._endpoint_path  # noqa: WPS437
+         == "/collections/companies/synonyms/company_synonym"
+     )
+ 
+-- 
+2.53.0
+
diff --git a/pkgs/development/python-modules/typesense/0004-tests-fix-rule_id.patch b/pkgs/development/python-modules/typesense/0004-tests-fix-rule_id.patch
new file mode 100644
index 000000000000..5e6f6fae4ddf
--- /dev/null
+++ b/pkgs/development/python-modules/typesense/0004-tests-fix-rule_id.patch
@@ -0,0 +1,29 @@
+From f6989c8e29fcb03bf76f1b143d116f081091fad1 Mon Sep 17 00:00:00 2001
+From: phanirithvij <phanirithvij2000@gmail.com>
+Date: Wed, 25 Mar 2026 19:35:38 +0530
+Subject: [PATCH 4/6] tests fix rule_id
+
+rule_id is not found for this class but rule_name exists with the
+expected value
+
+Signed-off-by: phanirithvij <phanirithvij2000@gmail.com>
+---
+ tests/analytics_rules_v1_test.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tests/analytics_rules_v1_test.py b/tests/analytics_rules_v1_test.py
+index d222d99..d1021d8 100644
+--- a/tests/analytics_rules_v1_test.py
++++ b/tests/analytics_rules_v1_test.py
+@@ -45,7 +45,7 @@ def test_get_missing_analytics_rule(fake_analytics_rules: AnalyticsRulesV1) -> N
+     """Test that the AnalyticsRulesV1 object can get a missing analytics_rule."""
+     analytics_rule = fake_analytics_rules["company_analytics_rule"]
+ 
+-    assert analytics_rule.rule_id == "company_analytics_rule"
++    assert analytics_rule.rule_name == "company_analytics_rule"
+     assert_match_object(analytics_rule.api_call, fake_analytics_rules.api_call)
+     assert_object_lists_match(
+         analytics_rule.api_call.node_manager.nodes,
+-- 
+2.53.0
+
diff --git a/pkgs/development/python-modules/typesense/0005-test-gate-v30-collection-schema-expectations.patch b/pkgs/development/python-modules/typesense/0005-test-gate-v30-collection-schema-expectations.patch
new file mode 100644
index 000000000000..ecaad48a362b
--- /dev/null
+++ b/pkgs/development/python-modules/typesense/0005-test-gate-v30-collection-schema-expectations.patch
@@ -0,0 +1,385 @@
+From 6eecb90897548584b8907731abf981237e032997 Mon Sep 17 00:00:00 2001
+From: Fanis Tharropoulos <ftharropoulos@gmail.com>
+Date: Thu, 7 May 2026 18:59:56 +0300
+Subject: [PATCH 5/6] test: gate v30 collection schema expectations
+
+- keep v29.0 and earlier tests passing
+---
+ tests/collection_test.py  |  31 +++--
+ tests/collections_test.py | 242 +++++++++++++-------------------------
+ 2 files changed, 106 insertions(+), 167 deletions(-)
+
+diff --git a/tests/collection_test.py b/tests/collection_test.py
+index 7eb29fa..30093d1 100644
+--- a/tests/collection_test.py
++++ b/tests/collection_test.py
+@@ -5,12 +5,24 @@ from tests.utils.object_assertions import (
+     assert_object_lists_match,
+     assert_to_contain_object,
+ )
++from tests.utils.version import is_v30_or_above
+ from typesense.sync.api_call import ApiCall
++from typesense.sync.client import Client
+ from typesense.sync.collection import Collection
+ from typesense.sync.collections import Collections
+ from typesense.types.collection import CollectionSchema
+ 
+ 
++is_v30_or_above_server = is_v30_or_above(
++    Client(
++        {
++            "api_key": "xyz",
++            "nodes": [{"host": "localhost", "port": 8108, "protocol": "http"}],
++        }
++    )
++)
++
++
+ def test_init(fake_api_call: ApiCall) -> None:
+     """Test that the Collection object is initialized correctly."""
+     collection = Collection(fake_api_call, "companies")
+@@ -52,7 +64,6 @@ def test_actual_retrieve(
+                 "infix": False,
+                 "stem": False,
+                 "stem_dictionary": "",
+-                "truncate_len": 100,
+                 "store": True,
+             },
+             {
+@@ -66,7 +77,6 @@ def test_actual_retrieve(
+                 "infix": False,
+                 "stem": False,
+                 "stem_dictionary": "",
+-                "truncate_len": 100,
+                 "store": True,
+             },
+         ],
+@@ -74,9 +84,12 @@ def test_actual_retrieve(
+         "num_documents": 0,
+         "symbols_to_index": [],
+         "token_separators": [],
+-        "synonym_sets": [],
+-        "curation_sets": [],
+     }
++    if is_v30_or_above_server:
++        expected["synonym_sets"] = []
++        expected["curation_sets"] = []
++        expected["fields"][0]["truncate_len"] = 100
++        expected["fields"][1]["truncate_len"] = 100
+ 
+     response.pop("created_at")
+ 
+@@ -93,10 +106,8 @@ def test_actual_update(
+         {"fields": [{"name": "num_locations", "type": "int32"}]},
+     )
+ 
+-    expected: CollectionSchema = {
+-        "fields": [
+-            {"name": "num_locations", "truncate_len": 100, "type": "int32"},
+-        ],
+-    }
++    expected_field = {"name": "num_locations", "type": "int32"}
++    if is_v30_or_above_server:
++        expected_field["truncate_len"] = 100
+ 
+-    assert_to_contain_object(response.get("fields")[0], expected.get("fields")[0])
++    assert_to_contain_object(response.get("fields")[0], expected_field)
+diff --git a/tests/collections_test.py b/tests/collections_test.py
+index 788e3dc..94e3c60 100644
+--- a/tests/collections_test.py
++++ b/tests/collections_test.py
+@@ -1,6 +1,5 @@
+ """Tests for the Collections class."""
+ 
+-
+ import sys
+ 
+ from typesense.async_.api_call import AsyncApiCall
+@@ -13,11 +12,68 @@ else:
+ 
+ from tests.utils.object_assertions import assert_match_object, assert_object_lists_match
+ from typesense.sync.api_call import ApiCall
++from tests.utils.version import is_v30_or_above
+ from typesense.sync.collections import Collections
+ from typesense.async_.collections import AsyncCollections
++from typesense.sync.client import Client
+ from typesense.types.collection import CollectionSchema
+ 
+ 
++IS_V30_OR_ABOVE = is_v30_or_above(
++    Client(
++        {
++            "api_key": "xyz",
++            "nodes": [{"host": "localhost", "port": 8108, "protocol": "http"}],
++        }
++    )
++)
++
++
++def expected_collection_field(
++    name: str,
++    type_: str,
++    *,
++    sort: bool,
++) -> dict[str, typing.Any]:
++    field: dict[str, typing.Any] = {
++        "name": name,
++        "type": type_,
++        "facet": False,
++        "index": True,
++        "optional": False,
++        "locale": "",
++        "sort": sort,
++        "infix": False,
++        "stem": False,
++        "stem_dictionary": "",
++        "store": True,
++    }
++    if IS_V30_OR_ABOVE:
++        field["truncate_len"] = 100
++    return field
++
++
++def expected_collection_schema(
++    *,
++    default_sorting_field: str,
++    fields: typing.List[dict[str, typing.Any]],
++    name: str,
++) -> CollectionSchema:
++    expected: CollectionSchema = {
++        "default_sorting_field": default_sorting_field,
++        "enable_nested_fields": False,
++        "fields": fields,
++        "name": name,
++        "num_documents": 0,
++        "symbols_to_index": [],
++        "token_separators": [],
++    }
++    if IS_V30_OR_ABOVE:
++        expected["synonym_sets"] = []
++        expected["curation_sets"] = []
++    return expected
++
++
+ def test_init(fake_api_call: ApiCall) -> None:
+     """Test that the Collections object is initialized correctly."""
+     collections = Collections(fake_api_call)
+@@ -98,46 +154,14 @@ def test_get_existing_collection(fake_collections: Collections) -> None:
+ 
+ def test_actual_create(actual_collections: Collections, delete_all: None) -> None:
+     """Test that the Collections object can create a collection on Typesense Server."""
+-    expected: CollectionSchema = {
+-        "default_sorting_field": "",
+-        "enable_nested_fields": False,
+-        "fields": [
+-            {
+-                "name": "company_name",
+-                "type": "string",
+-                "facet": False,
+-                "index": True,
+-                "optional": False,
+-                "locale": "",
+-                "sort": False,
+-                "infix": False,
+-                "stem": False,
+-                "stem_dictionary": "",
+-                "truncate_len": 100,
+-                "store": True,
+-            },
+-            {
+-                "name": "num_employees",
+-                "type": "int32",
+-                "facet": False,
+-                "index": True,
+-                "optional": False,
+-                "locale": "",
+-                "sort": False,
+-                "infix": False,
+-                "stem": False,
+-                "stem_dictionary": "",
+-                "truncate_len": 100,
+-                "store": True,
+-            },
++    expected = expected_collection_schema(
++        default_sorting_field="",
++        fields=[
++            expected_collection_field("company_name", "string", sort=False),
++            expected_collection_field("num_employees", "int32", sort=False),
+         ],
+-        "name": "companies",
+-        "num_documents": 0,
+-        "symbols_to_index": [],
+-        "token_separators": [],
+-        "synonym_sets": [],
+-        "curation_sets": [],
+-    }
++        name="companies",
++    )
+ 
+     response = actual_collections.create(
+         {
+@@ -170,46 +194,14 @@ def test_actual_retrieve(
+     response = actual_collections.retrieve()
+ 
+     expected: typing.List[CollectionSchema] = [
+-        {
+-            "default_sorting_field": "num_employees",
+-            "enable_nested_fields": False,
+-            "fields": [
+-                {
+-                    "name": "company_name",
+-                    "type": "string",
+-                    "facet": False,
+-                    "index": True,
+-                    "optional": False,
+-                    "locale": "",
+-                    "sort": False,
+-                    "infix": False,
+-                    "stem": False,
+-                    "stem_dictionary": "",
+-                    "truncate_len": 100,
+-                    "store": True,
+-                },
+-                {
+-                    "name": "num_employees",
+-                    "type": "int32",
+-                    "facet": False,
+-                    "index": True,
+-                    "optional": False,
+-                    "locale": "",
+-                    "sort": True,
+-                    "infix": False,
+-                    "stem": False,
+-                    "stem_dictionary": "",
+-                    "truncate_len": 100,
+-                    "store": True,
+-                },
++        expected_collection_schema(
++            default_sorting_field="num_employees",
++            fields=[
++                expected_collection_field("company_name", "string", sort=False),
++                expected_collection_field("num_employees", "int32", sort=True),
+             ],
+-            "name": "companies",
+-            "num_documents": 0,
+-            "symbols_to_index": [],
+-            "token_separators": [],
+-            "synonym_sets": [],
+-            "curation_sets": [],
+-        },
++            name="companies",
++        ),
+     ]
+ 
+     response[0].pop("created_at")
+@@ -235,46 +227,14 @@ async def test_actual_create_async(
+     actual_async_collections: AsyncCollections, delete_all: None
+ ) -> None:
+     """Test that the Collections object can create a collection on Typesense Server."""
+-    expected: CollectionSchema = {
+-        "default_sorting_field": "",
+-        "enable_nested_fields": False,
+-        "fields": [
+-            {
+-                "name": "company_name",
+-                "type": "string",
+-                "facet": False,
+-                "index": True,
+-                "optional": False,
+-                "locale": "",
+-                "sort": False,
+-                "infix": False,
+-                "stem": False,
+-                "stem_dictionary": "",
+-                "truncate_len": 100,
+-                "store": True,
+-            },
+-            {
+-                "name": "num_employees",
+-                "type": "int32",
+-                "facet": False,
+-                "index": True,
+-                "optional": False,
+-                "locale": "",
+-                "sort": False,
+-                "infix": False,
+-                "stem": False,
+-                "stem_dictionary": "",
+-                "truncate_len": 100,
+-                "store": True,
+-            },
++    expected = expected_collection_schema(
++        default_sorting_field="",
++        fields=[
++            expected_collection_field("company_name", "string", sort=False),
++            expected_collection_field("num_employees", "int32", sort=False),
+         ],
+-        "name": "companies",
+-        "num_documents": 0,
+-        "symbols_to_index": [],
+-        "token_separators": [],
+-        "synonym_sets": [],
+-        "curation_sets": [],
+-    }
++        name="companies",
++    )
+ 
+     response = await actual_async_collections.create(
+         {
+@@ -307,46 +267,14 @@ async def test_actual_retrieve_async(
+     response = await actual_async_collections.retrieve()
+ 
+     expected: typing.List[CollectionSchema] = [
+-        {
+-            "default_sorting_field": "num_employees",
+-            "enable_nested_fields": False,
+-            "fields": [
+-                {
+-                    "name": "company_name",
+-                    "type": "string",
+-                    "facet": False,
+-                    "index": True,
+-                    "optional": False,
+-                    "locale": "",
+-                    "sort": False,
+-                    "infix": False,
+-                    "stem": False,
+-                    "stem_dictionary": "",
+-                    "truncate_len": 100,
+-                    "store": True,
+-                },
+-                {
+-                    "name": "num_employees",
+-                    "type": "int32",
+-                    "facet": False,
+-                    "index": True,
+-                    "optional": False,
+-                    "locale": "",
+-                    "sort": True,
+-                    "infix": False,
+-                    "stem": False,
+-                    "stem_dictionary": "",
+-                    "truncate_len": 100,
+-                    "store": True,
+-                },
++        expected_collection_schema(
++            default_sorting_field="num_employees",
++            fields=[
++                expected_collection_field("company_name", "string", sort=False),
++                expected_collection_field("num_employees", "int32", sort=True),
+             ],
+-            "name": "companies",
+-            "num_documents": 0,
+-            "symbols_to_index": [],
+-            "token_separators": [],
+-            "synonym_sets": [],
+-            "curation_sets": [],
+-        },
++            name="companies",
++        ),
+     ]
+ 
+     response[0].pop("created_at")
+-- 
+2.53.0
+
diff --git a/pkgs/development/python-modules/typesense/0006-feat-curation-add-types-for-stem-and-synonyms-for-Ty.patch b/pkgs/development/python-modules/typesense/0006-feat-curation-add-types-for-stem-and-synonyms-for-Ty.patch
new file mode 100644
index 000000000000..dff3a3ccb3e6
--- /dev/null
+++ b/pkgs/development/python-modules/typesense/0006-feat-curation-add-types-for-stem-and-synonyms-for-Ty.patch
@@ -0,0 +1,194 @@
+From a5f8ce27a246a1c0a3dd5236cffa0afeaaf166b5 Mon Sep 17 00:00:00 2001
+From: Fanis Tharropoulos <ftharropoulos@gmail.com>
+Date: Thu, 7 May 2026 19:26:14 +0300
+Subject: [PATCH 6/6] feat(curation): add types for `stem` and `synonyms` for
+ Typesense v30.2
+
+---
+ src/typesense/types/curation_set.py | 56 ++++++++++++++++++++++++++---
+ tests/curation_set_test.py          | 13 ++++++-
+ tests/curation_sets_test.py         |  4 +++
+ 3 files changed, 67 insertions(+), 6 deletions(-)
+
+diff --git a/src/typesense/types/curation_set.py b/src/typesense/types/curation_set.py
+index 6468166..f99a020 100644
+--- a/src/typesense/types/curation_set.py
++++ b/src/typesense/types/curation_set.py
+@@ -33,15 +33,36 @@ class CurationRuleTagsSchema(typing.TypedDict):
+     tags: typing.List[str]
+ 
+ 
+-class CurationRuleQuerySchema(typing.TypedDict):
++class CurationRuleQueryBaseSchema(typing.TypedDict):
+     """
+-    Schema for a curation rule using query and match.
++    Schema for the base of a curation rule using query and match.
+     """
+ 
+     query: str
+     match: typing.Literal["exact", "contains"]
+ 
+ 
++class CurationRuleQueryCreateSchema(CurationRuleQueryBaseSchema):
++    """
++    Schema for creating a curation rule using query and match.
++    """
++
++    stem: typing.NotRequired[bool]
++    synonyms: typing.NotRequired[bool]
++
++
++class CurationRuleQuerySchema(CurationRuleQueryBaseSchema):
++    """
++    Schema for retrieving a curation rule using query and match.
++    """
++
++    stem: typing.NotRequired[
++        bool
++    ]  # TODO: This is a bug in Typesense server upstream, so until 31.0 is
++    # released, this is staying as notrequired.
++    synonyms: typing.NotRequired[bool]
++
++
+ class CurationRuleFilterBySchema(typing.TypedDict):
+     """
+     Schema for a curation rule using filter_by.
+@@ -85,20 +106,45 @@ class CurationItemSchema(typing.TypedDict):
+     metadata: typing.NotRequired[typing.Dict[str, typing.Any]]
+ 
+ 
++class CurationItemUpsertSchema(typing.TypedDict):
++    """
++    Schema for creating or updating a single curation item.
++    """
++
++    id: str
++    rule: typing.Union[
++        CurationRuleTagsSchema,
++        CurationRuleQueryCreateSchema,
++        CurationRuleFilterBySchema,
++    ]
++    includes: typing.NotRequired[typing.List[CurationIncludeSchema]]
++    excludes: typing.NotRequired[typing.List[CurationExcludeSchema]]
++    filter_by: typing.NotRequired[str]
++    sort_by: typing.NotRequired[str]
++    replace_query: typing.NotRequired[str]
++    remove_matched_tokens: typing.NotRequired[bool]
++    filter_curated_hits: typing.NotRequired[bool]
++    stop_processing: typing.NotRequired[bool]
++    effective_from_ts: typing.NotRequired[int]
++    effective_to_ts: typing.NotRequired[int]
++    metadata: typing.NotRequired[typing.Dict[str, typing.Any]]
++
++
+ class CurationSetUpsertSchema(typing.TypedDict):
+     """
+     Payload schema to create or replace a curation set.
+     """
+ 
+-    items: typing.List[CurationItemSchema]
++    items: typing.List[CurationItemUpsertSchema]
+ 
+ 
+-class CurationSetSchema(CurationSetUpsertSchema, total=False):
++class CurationSetSchema(typing.TypedDict):
+     """
+     Response schema for a curation set.
+     """
+ 
+-    name: typing.NotRequired[str]
++    items: typing.List[CurationItemSchema]
++    name: str
+ 
+ 
+ class CurationSetsListEntrySchema(typing.TypedDict):
+diff --git a/tests/curation_set_test.py b/tests/curation_set_test.py
+index a75196a..fe07278 100644
+--- a/tests/curation_set_test.py
++++ b/tests/curation_set_test.py
+@@ -1,6 +1,5 @@
+ """Tests for the CurationSet class including items APIs."""
+ 
+-
+ import pytest
+ 
+ from tests.utils.version import is_v30_or_above
+@@ -62,6 +61,8 @@ def test_actual_retrieve(
+                 "rule": {
+                     "match": "contains",
+                     "query": "shoe",
++                    "stem": False,
++                    "synonyms": False,
+                 },
+                 "stop_processing": True,
+             },
+@@ -108,6 +109,8 @@ def test_actual_list_items(
+             "rule": {
+                 "match": "contains",
+                 "query": "shoe",
++                "stem": False,
++                "synonyms": False,
+             },
+             "stop_processing": True,
+         },
+@@ -140,6 +143,8 @@ def test_actual_get_item(
+         "rule": {
+             "match": "contains",
+             "query": "shoe",
++            "stem": False,
++            "synonyms": False,
+         },
+         "stop_processing": True,
+     }
+@@ -218,6 +223,8 @@ async def test_actual_retrieve_async(
+                 "rule": {
+                     "match": "contains",
+                     "query": "shoe",
++                    "stem": False,
++                    "synonyms": False,
+                 },
+                 "stop_processing": True,
+             },
+@@ -263,6 +270,8 @@ async def test_actual_list_items_async(
+             "rule": {
+                 "match": "contains",
+                 "query": "shoe",
++                "stem": False,
++                "synonyms": False,
+             },
+             "stop_processing": True,
+         },
+@@ -295,6 +304,8 @@ async def test_actual_get_item_async(
+         "rule": {
+             "match": "contains",
+             "query": "shoe",
++            "stem": False,
++            "synonyms": False,
+         },
+         "stop_processing": True,
+     }
+diff --git a/tests/curation_sets_test.py b/tests/curation_sets_test.py
+index 0a06a05..e4a635a 100644
+--- a/tests/curation_sets_test.py
++++ b/tests/curation_sets_test.py
+@@ -87,6 +87,8 @@ def test_actual_upsert(
+                 "rule": {
+                     "match": "contains",
+                     "query": "shoe",
++                    "stem": False,
++                    "synonyms": False,
+                 },
+                 "stop_processing": True,
+             },
+@@ -150,6 +152,8 @@ async def test_actual_upsert_async(
+                 "rule": {
+                     "match": "contains",
+                     "query": "shoe",
++                    "stem": False,
++                    "synonyms": False,
+                 },
+                 "stop_processing": True,
+             },
+-- 
+2.53.0
+
diff --git a/pkgs/development/python-modules/typesense/default.nix b/pkgs/development/python-modules/typesense/default.nix
index 78441621aa8d..ebcb8f64419a 100644
--- a/pkgs/development/python-modules/typesense/default.nix
+++ b/pkgs/development/python-modules/typesense/default.nix
@@ -7,29 +7,38 @@
   pytestCheckHook,
   typesense,
   curl,
-  pytest-mock,
-  requests-mock,
-  python-dotenv,
   faker,
+  httpx,
   isort,
+  pytest-asyncio,
+  pytest-httpx,
+  pytest-mock,
+  python-dotenv,
+  requests-mock,
+  respx,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "typesense";
-  version = "1.1.1";
+  version = "2.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "typesense";
     repo = "typesense-python";
-    tag = "v${version}";
-    hash = "sha256-vo9DW4kinb00zWW4yX8ibyelQxW3eVabn+oMddPEd18=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-GzapEl26FS6yMGeLC54y9ysl0mt9l6ceYHr84E6BqBo=";
   };
 
   patches = [
-    # See <https://github.com/typesense/typesense-python/pull/103>.
-    ./linux-only-metrics.patch
-    ./generated-temp-path.patch
+    # See <https://github.com/typesense/typesense-python/pull/132>.
+    # See <https://github.com/typesense/typesense-python/pull/133>.
+    ./0001-linux-only-metrics.patch
+    ./0002-generated-temp-path.patch
+    ./0003-tests-fix-endpoint-path.patch
+    ./0004-tests-fix-rule_id.patch
+    ./0005-test-gate-v30-collection-schema-expectations.patch
+    ./0006-feat-curation-add-types-for-stem-and-synonyms-for-Ty.patch
   ];
 
   build-system = [ setuptools ];
@@ -40,31 +49,47 @@ buildPythonPackage rec {
     pytestCheckHook
     typesense
     curl
-    pytest-mock
-    requests-mock
-    python-dotenv
     faker
+    httpx
     isort
+    pytest-asyncio
+    pytest-httpx
+    pytest-mock
+    python-dotenv
+    requests-mock
+    respx
   ];
   disabledTestMarks = [ "open_ai" ];
-  disabledTests = [ "import_typing_extensions" ];
+  disabledTests = [
+    "import_typing_extensions"
+    # tests/operations_test.py::test_snapshot_async fails when tests are run
+    # in parallel due to writing to the shared /tmp directory on macOS
+    "test_snapshot_async"
+  ];
 
   __darwinAllowLocalNetworking = true;
 
+  # For darwin, the nix sandbox doesn't isolate loopback interfaces like linux does.
+  # So nixpkgs-review builds of python3.x will collide on the hardcoded port 8108.
+  # So for tests patch it to use random port.
   preCheck = ''
+    export TYPESENSE_PORT=$(( 10000 + $$ % 30000 ))
+    export PEERING_PORT=$(( TYPESENSE_PORT - 1 ))
+    find tests -type f -exec sed -i "s/8108/$TYPESENSE_PORT/g" {} +
+
     TYPESENSE_API_KEY="xyz" \
     TYPESENSE_DATA_DIR="$(mktemp -d)" \
-    typesense-server &
+    typesense-server --api-port=$TYPESENSE_PORT --peering-port=$PEERING_PORT &
 
     typesense_pid=$!
 
+    # Ensure typesense-server is killed even if tests fail
+    trap "kill $typesense_pid" EXIT
+
     # Wait for typesense to finish starting.
-    timeout 20 bash -c '
-      while ! curl -s --fail localhost:8108/health; do sleep 1; done
-    ' || false
-  '';
-  postCheck = ''
-    kill $typesense_pid
+    timeout 20 bash -c "
+      while ! curl -s --fail localhost:$TYPESENSE_PORT/health; do sleep 1; done
+    " || false
   '';
 
   pythonImportsCheck = [ "typesense" ];
@@ -74,5 +99,7 @@ buildPythonPackage rec {
     homepage = "https://github.com/typesense/typesense-python";
     license = lib.licenses.asl20;
     teams = [ lib.teams.ngi ];
+    # on x86_64-darwin the typesense server doesn't start
+    badPlatforms = [ "x86_64-darwin" ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/typesense/linux-only-metrics.patch b/pkgs/development/python-modules/typesense/linux-only-metrics.patch
deleted file mode 100644
index ac667a3e42f1..000000000000
--- a/pkgs/development/python-modules/typesense/linux-only-metrics.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From 9f0024ae3a0377d15788256c72af7a692d250afc Mon Sep 17 00:00:00 2001
-From: dotlambda <github@dotlambda.de>
-Date: Thu, 23 Oct 2025 13:40:33 -0700
-Subject: [PATCH] test(metrics): some metrics only exists on Linux
-
----
- tests/metrics_test.py | 12 ++++++++----
- 1 file changed, 8 insertions(+), 4 deletions(-)
-
-diff --git a/tests/metrics_test.py b/tests/metrics_test.py
-index 1e1ea47..fecf3c0 100644
---- a/tests/metrics_test.py
-+++ b/tests/metrics_test.py
-@@ -2,6 +2,8 @@
-
- from __future__ import annotations
-
-+import platform
-+
- from typesense.metrics import Metrics
-
-
-@@ -9,13 +11,15 @@ def test_actual_retrieve(actual_metrics: Metrics) -> None:
-     """Test that the Debug object can retrieve a debug on Typesense server and verify response structure."""
-     response = actual_metrics.retrieve()
-
--    assert "system_cpu_active_percentage" in response
-+    if platform.system() == "Linux":
-+        assert "system_cpu_active_percentage" in response
-+        assert "system_network_received_bytes" in response
-+        assert "system_network_sent_bytes" in response
-+
-     assert "system_disk_total_bytes" in response
-     assert "system_disk_used_bytes" in response
-     assert "system_memory_total_bytes" in response
-     assert "system_memory_used_bytes" in response
--    assert "system_network_received_bytes" in response
--    assert "system_network_sent_bytes" in response
-     assert "typesense_memory_active_bytes" in response
-     assert "typesense_memory_allocated_bytes" in response
-     assert "typesense_memory_fragmentation_ratio" in response
-@@ -23,4 +27,4 @@ def test_actual_retrieve(actual_metrics: Metrics) -> None:
-     assert "typesense_memory_mapped_bytes" in response
-     assert "typesense_memory_metadata_bytes" in response
-     assert "typesense_memory_resident_bytes" in response
--    assert "typesense_memory_retained_bytes" in response
-\ No newline at end of file
-+    assert "typesense_memory_retained_bytes" in response
diff --git a/pkgs/kde/plasma/powerdevil/default.nix b/pkgs/kde/plasma/powerdevil/default.nix
index ae2b56a004f2..30793431642a 100644
--- a/pkgs/kde/plasma/powerdevil/default.nix
+++ b/pkgs/kde/plasma/powerdevil/default.nix
@@ -3,10 +3,20 @@
   pkg-config,
   ddcutil,
   qtwayland,
+  fetchpatch,
 }:
 mkKdeDerivation {
   pname = "powerdevil";
 
+  patches = [
+    # backport fix for spurious low battery notifications
+    # FIXME: remove in 6.7.6
+    (fetchpatch {
+      url = "https://invent.kde.org/plasma/powerdevil/-/commit/54f8a4a848fa02d06fefc5543f35224eef73670c.diff";
+      hash = "sha256-YWUyOhFRUwzi+ISM2+TGctNDSUYc851U/b5hKkTmWXY=";
+    })
+  ];
+
   extraNativeBuildInputs = [ pkg-config ];
   extraBuildInputs = [
     ddcutil