Merge master into staging-next

2026-10-03 13:30:36 +00:00 · 2026-08-02 00:33:43 +00:00
parent 8da2a7077f cd017c33bb
commit 16bb753c97
350 changed files with 6522 additions and 3454 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -10006,6 +10006,13 @@
    githubId = 34658064;
    name = "Grace Dinh";
  };
+  geekiot-hub = {
+    email = "geekiot@proton.me";
+    github = "geekiot-hub";
+    githubId = 227938479;
+    name = "Kirill Samoylenkov";
+    keys = [ { fingerprint = "955B 97C5 78A3 DF03 D818  25EB 8E40 5DD2 CF84 CCE0"; } ];
+  };
  genga898 = {
    email = "genga898@gmail.com";
    github = "genga898";
@@ -17992,6 +17999,12 @@
    githubId = 94081214;
    name = "Jose Colomer";
  };
+  mcmah309 = {
+    email = "dillonmcmahon79@gmail.com";
+    github = "mcmah309";
+    githubId = 56412856;
+    name = "Dillon H. McMahon";
+  };
  mcmtroffaes = {
    email = "matthias.troffaes@gmail.com";
    github = "mcmtroffaes";
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -66,6 +66,8 @@

 - [LXMD](https://github.com/markqvist/LXMF), a universal, distributed and secure messaging protocol for Reticulum. Available as [services.lxmd](#opt-services.lxmd.enable).

+- [Entropy](https://github.com/ergohaven/entropy), a configurator for programmable keyboards and input devices running Vial-QMK/RMK firmware. Available as [programs.entropy](#opt-programs.entropy.enable).
+
 ## Backward Incompatibilities {#sec-release-26.11-incompatibilities}

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -210,6 +210,7 @@
  ./programs/ente-auth.nix
  ./programs/environment.nix
  ./programs/envision.nix
+  ./programs/ergohaven-entropy.nix
  ./programs/evince.nix
  ./programs/extra-container.nix
  ./programs/fcast-receiver.nix
--- a/nixos/modules/programs/ergohaven-entropy.nix
+++ b/nixos/modules/programs/ergohaven-entropy.nix
@@ -0,0 +1,35 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.programs.entropy;
+  inherit (lib) mkIf;
+in
+{
+  options.programs.entropy = {
+    enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Enables the Entropy keyboard configurator and sets up necessary
+        udev rules for Vial-QMK/RMK compatible devices.
+        This allows configuring programmable keyboards without root privileges.
+        Ensure your user is a member of the 'plugdev' group after enabling.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    users.groups.plugdev = { };
+
+    environment.systemPackages = [ pkgs.ergohaven-entropy ];
+
+    services.udev.packages = [ pkgs.ergohaven-entropy ];
+
+    i18n.inputMethod.ibus.engines = [ pkgs.ergohaven-entropy ];
+  };
+}
--- a/nixos/modules/services/misc/airsonic.nix
+++ b/nixos/modules/services/misc/airsonic.nix
@@ -131,15 +131,15 @@ in
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];

-      preStart = ''
-        # Install transcoders.
-        rm -rf ${cfg.home}/transcode
-        mkdir -p ${cfg.home}/transcode
-        for exe in ${toString cfg.transcoders}; do
-          ln -sf "$exe" ${cfg.home}/transcode
-        done
-      '';
      serviceConfig = {
+        # Install transcoders.
+        ExecStartPre = [
+          "${lib.getExe' pkgs.coreutils "rm"} -rf '${cfg.home}/transcode'"
+          "${lib.getExe' pkgs.coreutils "mkdir"} -p '${cfg.home}/transcode'"
+        ]
+        ++ map (
+          exe: "${lib.getExe' pkgs.coreutils "ln"} -sf '${exe}' '${cfg.home}/transcode'"
+        ) cfg.transcoders;
        ExecStart = ''
          ${cfg.jre}/bin/java -Xmx${toString cfg.maxMemory}m \
          -Dairsonic.home=${cfg.home} \
--- a/nixos/modules/services/misc/guix/default.nix
+++ b/nixos/modules/services/misc/guix/default.nix
@@ -284,21 +284,21 @@ in
        # should be sandboxed.
        systemd.services.guix-daemon = {
          environment = serviceEnv // config.networking.proxy.envVars;
-          script = ''
-            exec ${lib.getExe' package "guix-daemon"} \
-              --build-users-group=${cfg.group} \
-              ${
-                lib.optionalString (
-                  cfg.substituters.urls != [ ]
-                ) "--substitute-urls='${lib.concatStringsSep " " cfg.substituters.urls}'"
-              } \
-              ${lib.escapeShellArgs cfg.extraArgs}
-          '';
          serviceConfig = {
            OOMPolicy = "continue";
            RemainAfterExit = "yes";
            Restart = "always";
            TasksMax = 8192;
+            ExecStart = ''
+              ${lib.getExe' package "guix-daemon"} \
+                --build-users-group=${cfg.group} \
+                ${
+                  lib.optionalString (
+                    cfg.substituters.urls != [ ]
+                  ) "--substitute-urls='${lib.concatStringsSep " " cfg.substituters.urls}'"
+                } \
+                ${lib.escapeShellArgs cfg.extraArgs}
+            '';
          };
          unitConfig.RequiresMountsFor = [
            cfg.storeDir
@@ -407,16 +407,17 @@ in
                ${lib.getExe' package "guix"} archive --generate-key;
              }
          '';
-          script = ''
-            exec ${lib.getExe' package "guix"} publish \
-              --user=${cfg.publish.user} --port=${toString cfg.publish.port} \
-              ${lib.escapeShellArgs cfg.publish.extraArgs}
-          '';

          serviceConfig = {
            Restart = "always";
            RestartSec = 10;

+            ExecStart = ''
+              ${lib.getExe' package "guix"} publish \
+                --user=${cfg.publish.user} --port=${toString cfg.publish.port} \
+                ${lib.escapeShellArgs cfg.publish.extraArgs}
+            '';
+
            ProtectClock = true;
            ProtectHostname = true;
            ProtectKernelTunables = true;
@@ -463,11 +464,11 @@ in
        systemd.services.guix-gc = {
          description = "Guix garbage collection";
          startAt = cfg.gc.dates;
-          script = ''
-            exec ${lib.getExe' package "guix"} gc ${lib.escapeShellArgs cfg.gc.extraArgs}
-          '';
          serviceConfig = {
            Type = "oneshot";
+
+            ExecStart = "${lib.getExe' package "guix"} gc ${lib.escapeShellArgs cfg.gc.extraArgs}";
+
            PrivateDevices = true;
            PrivateNetwork = true;
            ProtectControlGroups = true;
--- a/nixos/modules/services/misc/mqtt2influxdb.nix
+++ b/nixos/modules/services/misc/mqtt2influxdb.nix
@@ -236,14 +236,12 @@ in
        description = "BigClown MQTT to InfluxDB bridge";
        wantedBy = [ "multi-user.target" ];
        wants = lib.mkIf config.services.mosquitto.enable [ "mosquitto.service" ];
-        preStart = ''
-          umask 077
-          ${pkgs.envsubst}/bin/envsubst -i "${configFile}" -o "${finalConfig}"
-        '';
        serviceConfig = {
          EnvironmentFile = cfg.environmentFiles;
+          ExecStartPre = lib.mkIf envConfig "${pkgs.envsubst}/bin/envsubst -i '${configFile}' -o \"${finalConfig}\"";
          ExecStart = "${lib.getExe cfg.package} -dc ${finalConfig}";
          RuntimeDirectory = "mqtt2influxdb";
+          RuntimeDirectoryMode = "0700";
        };
      };
  };
--- a/nixos/modules/services/monitoring/grafana.nix
+++ b/nixos/modules/services/monitoring/grafana.nix
@@ -2087,13 +2087,13 @@ in
      ]
      ++ lib.optional usePostgresql "postgresql.target"
      ++ lib.optional useMysql "mysql.service";
-      script = ''
-        set -o errexit -o pipefail -o nounset -o errtrace
-        shopt -s inherit_errexit
-
-        exec ${lib.getExe cfg.package} server -homepath ${cfg.dataDir} -config ${configFile}
-      '';
      serviceConfig = {
+        ExecStartPre = [
+          "${lib.getExe' pkgs.coreutils "ln"} -fs ${cfg.package}/share/grafana/conf ${cfg.dataDir}"
+          "${lib.getExe' pkgs.coreutils "ln"} -fs ${cfg.package}/share/grafana/tools ${cfg.dataDir}"
+        ];
+        ExecStart = "${lib.getExe cfg.package} server -homepath ${cfg.dataDir} -config ${configFile}";
+
        WorkingDirectory = cfg.dataDir;
        User = "grafana";
        Restart = "on-failure";
@@ -2136,10 +2136,6 @@ in
        ++ lib.optionals (cfg.settings.server.protocol == "socket") [ "@chown" ];
        UMask = "0027";
      };
-      preStart = ''
-        ln -fs ${cfg.package}/share/grafana/conf ${cfg.dataDir}
-        ln -fs ${cfg.package}/share/grafana/tools ${cfg.dataDir}
-      '';
    };

    networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.settings.server.http_port ];
--- a/nixos/modules/services/monitoring/kthxbye.nix
+++ b/nixos/modules/services/monitoring/kthxbye.nix
@@ -137,23 +137,23 @@ in
    systemd.services.kthxbye = {
      description = "kthxbye Alertmanager ack management daemon";
      wantedBy = [ "multi-user.target" ];
-      script = ''
-        ${cfg.package}/bin/kthxbye \
-          -alertmanager.timeout ${cfg.alertmanager.timeout} \
-          -alertmanager.uri ${cfg.alertmanager.uri} \
-          -extend-by ${cfg.extendBy} \
-          -extend-if-expiring-in ${cfg.extendIfExpiringIn} \
-          -extend-with-prefix ${cfg.extendWithPrefix} \
-          -interval ${cfg.interval} \
-          -listen ${cfg.listenAddress}:${toString cfg.port} \
-          ${lib.optionalString cfg.logJSON "-log-json"} \
-          ${lib.optionalString (cfg.maxDuration != null) "-max-duration ${cfg.maxDuration}"} \
-          ${lib.concatStringsSep " " cfg.extraOptions}
-      '';
      serviceConfig = {
        Type = "simple";
        DynamicUser = true;
        Restart = "on-failure";
+        ExecStart = ''
+          ${cfg.package}/bin/kthxbye \
+            -alertmanager.timeout ${cfg.alertmanager.timeout} \
+            -alertmanager.uri ${cfg.alertmanager.uri} \
+            -extend-by ${cfg.extendBy} \
+            -extend-if-expiring-in ${cfg.extendIfExpiringIn} \
+            -extend-with-prefix ${cfg.extendWithPrefix} \
+            -interval ${cfg.interval} \
+            -listen ${cfg.listenAddress}:${toString cfg.port} \
+            ${lib.optionalString cfg.logJSON "-log-json"} \
+            ${lib.optionalString (cfg.maxDuration != null) "-max-duration ${cfg.maxDuration}"} \
+            ${lib.concatStringsSep " " cfg.extraOptions}
+        '';
      };
    };

--- a/nixos/modules/services/monitoring/prometheus/alertmanager.nix
+++ b/nixos/modules/services/monitoring/prometheus/alertmanager.nix
@@ -200,11 +200,8 @@ in
        wantedBy = [ "multi-user.target" ];
        wants = [ "network-online.target" ];
        after = [ "network-online.target" ];
-        preStart = ''
-          ${lib.getBin pkgs.envsubst}/bin/envsubst -o "/tmp/alert-manager-substituted.yaml" \
-                                                   -i "${alertmanagerYml}"
-        '';
        serviceConfig = {
+          ExecStartPre = "${lib.getBin pkgs.envsubst}/bin/envsubst -i '${alertmanagerYml}' -o '/tmp/alert-manager-substituted.yaml'";
          ExecStart =
            "${cfg.package}/bin/alertmanager"
            + lib.optionalString (lib.length cmdlineArgs != 0) (
--- a/nixos/modules/services/network-filesystems/openafs/server.nix
+++ b/nixos/modules/services/network-filesystems/openafs/server.nix
@@ -357,11 +357,16 @@ in
        unitConfig.ConditionPathExists = [
          "|/etc/openafs/server/KeyFileExt"
        ];
-        preStart = ''
-          mkdir -m 0755 -p /var/openafs
-          ${optionalString (netInfo != null) "cp ${netInfo} /var/openafs/netInfo"}
-        '';
        serviceConfig = {
+          ExecStartPre = [
+            "${lib.getExe' pkgs.coreutils "mkdir"} -m 0755 -p /var/openafs"
+          ]
+          ++ lib.optionals (netInfo != null) [
+            "${lib.getExe' pkgs.coreutils "cp"} ${netInfo} /var/openafs/netInfo"
+          ]
+          ++ lib.optionals useBuCellServDB [
+            "${lib.getExe' pkgs.coreutils "cp"} ${buCellServDB}"
+          ];
          ExecStart = "${openafsBin}/bin/bosserver -nofork";
          ExecStop = "${openafsBin}/bin/bos shutdown localhost -wait -localauth";
        };
--- a/nixos/modules/services/networking/dnscache.nix
+++ b/nixos/modules/services/networking/dnscache.nix
@@ -108,17 +108,16 @@ in
        daemontools
        djbdns
      ];
-      preStart = ''
-        rm -rf /var/lib/dnscache
-        dnscache-conf dnscache dnscache /var/lib/dnscache ${config.services.dnscache.ip}
-        rm -rf /var/lib/dnscache/root
-        ln -sf ${dnscache-root} /var/lib/dnscache/root
-      '';
-      script = ''
-        cd /var/lib/dnscache/
-        ${lib.optionalString cfg.forwardOnly "export FORWARDONLY=1"}
-        exec ./run
-      '';
+      environment.FORWARDONLY = lib.mkIf cfg.forwardOnly "1";
+      serviceConfig.StateDirectory = "dnscache";
+      serviceConfig.WorkingDirectory = "/var/lib/dnscache";
+      serviceConfig.ExecStartPre = [
+        "${lib.getExe' pkgs.coreutils "rm"} -rf /var/lib/dnscache"
+        "${lib.getExe' pkgs.djbdns "dnscache-conf"} dnscache dnscache /var/lib/dnscache ${config.services.dnscache.ip}"
+        "${lib.getExe' pkgs.coreutils "rm"} -rf /var/lib/dnscache/root"
+        "${lib.getExe' pkgs.coreutils "ln"} -sf ${dnscache-root} /var/lib/dnscache/root"
+      ];
+      serviceConfig.ExecStart = "/var/lib/dnscache/run";
    };
  };
 }
--- a/nixos/modules/services/networking/murmur.nix
+++ b/nixos/modules/services/networking/murmur.nix
@@ -355,17 +355,13 @@ in
      ]
      ++ lib.optional (cfg.tls.useACMEHost != null) "acme-${cfg.tls.useACMEHost}.service";
      wants = lib.mkIf (cfg.tls.useACMEHost != null) [ "acme-${cfg.tls.useACMEHost}.service" ];
-      preStart = ''
-        ${pkgs.envsubst}/bin/envsubst \
-          -o /run/murmur/murmurd.ini \
-          -i ${configFile}
-      '';

      serviceConfig = {
        # murmurd doesn't fork when logging to the console.
        Type = if forking then "forking" else "simple";
        PIDFile = lib.mkIf forking "/run/murmur/murmurd.pid";
        EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
+        ExecStartPre = "${pkgs.envsubst}/bin/envsubst -i '${configFile}' -o /run/murmur/murmurd.ini";
        ExecStart = "${cfg.package}/bin/mumble-server -ini /run/murmur/murmurd.ini";
        Restart = "always";
        LogsDirectory = lib.mkIf cfg.logToFile "murmur";
--- a/nixos/modules/services/networking/openvpn.nix
+++ b/nixos/modules/services/networking/openvpn.nix
@@ -83,11 +83,14 @@ let
  restartService = optionalAttrs cfg.restartAfterSleep {
    openvpn-restart = {
      wantedBy = [ "sleep.target" ];
-      script =
-        let
-          unitNames = map (n: "openvpn-${n}.service") (builtins.attrNames cfg.servers);
-        in
-        "systemctl try-restart ${lib.escapeShellArgs unitNames}";
+      serviceConfig = {
+        Type = "oneshot";
+        ExecStart =
+          let
+            unitNames = map (n: "openvpn-${n}.service") (builtins.attrNames cfg.servers);
+          in
+          "systemctl try-restart ${lib.escapeShellArgs unitNames}";
+      };
      description = "Restart system OpenVPN connections when returning from sleep";
    };
  };
--- a/nixos/modules/services/networking/pihole-ftl.nix
+++ b/nixos/modules/services/networking/pihole-ftl.nix
@@ -9,6 +9,7 @@ with {
  inherit (lib)
    elemAt
    getExe
+    getExe'
    hasAttrByPath
    mkEnableOption
    mkIf
@@ -409,6 +410,17 @@ in
          Type = "oneshot";
          User = cfg.user;
          Group = cfg.group;
+          # Avoid creating an empty database file if it doesn't yet exist
+          ConditionFileNotEmpty = cfg.settings.files.database;
+          ExecStart =
+            let
+              days = toString cfg.queryLogDeleter.age;
+              database = cfg.settings.files.database;
+            in
+            [
+              "${getExe' pkgs.coreutils "echo"} 'Deleting query logs older than ${days} days'"
+              "${getExe cfg.package} sqlite3 '${database}' 'DELETE FROM query_storage WHERE timestamp <= CAST(strftime('%s', date('now', '-${days} day')) AS INT); select changes() from query_storage limit 1'"
+            ];
          # Hardening
          NoNewPrivileges = true;
          PrivateTmp = true;
@@ -427,22 +439,6 @@ in
          MemoryDenyWriteExecute = true;
          LockPersonality = true;
        };
-        script =
-          let
-            days = toString cfg.queryLogDeleter.age;
-            database = cfg.settings.files.database;
-          in
-          ''
-            set -euo pipefail
-
-            # Avoid creating an empty database file if it doesn't yet exist
-            if [ ! -f "${database}" ]; then
-              exit 0;
-            fi
-
-            echo "Deleting query logs older than ${days} days"
-            ${getExe cfg.package} sqlite3 "${database}" "DELETE FROM query_storage WHERE timestamp <= CAST(strftime('%s', date('now', '-${days} day')) AS INT); select changes() from query_storage limit 1"
-          '';
      };
    };

--- a/nixos/modules/services/networking/webhook.nix
+++ b/nixos/modules/services/networking/webhook.nix
@@ -208,31 +208,31 @@ in
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];
      environment = config.networking.proxy.envVars // cfg.environment;
-      script =
-        let
-          args = [
-            "-ip"
-            cfg.ip
-            "-port"
-            (toString cfg.port)
-            "-urlprefix"
-            cfg.urlPrefix
-          ]
-          ++ concatMap (hook: [
-            "-hooks"
-            hook
-          ]) hookFiles
-          ++ optional cfg.enableTemplates "-template"
-          ++ optional cfg.verbose "-verbose"
-          ++ cfg.extraArgs;
-        in
-        ''
-          ${cfg.package}/bin/webhook ${escapeShellArgs args}
-        '';
      serviceConfig = {
        Restart = "on-failure";
        User = cfg.user;
        Group = cfg.group;
+        ExecStart =
+          let
+            args = [
+              "-ip"
+              cfg.ip
+              "-port"
+              (toString cfg.port)
+              "-urlprefix"
+              cfg.urlPrefix
+            ]
+            ++ concatMap (hook: [
+              "-hooks"
+              hook
+            ]) hookFiles
+            ++ optional cfg.enableTemplates "-template"
+            ++ optional cfg.verbose "-verbose"
+            ++ cfg.extraArgs;
+          in
+          ''
+            ${cfg.package}/bin/webhook ${escapeShellArgs args}
+          '';
      };
    };
  };
--- a/nixos/modules/services/networking/wg-access-server.nix
+++ b/nixos/modules/services/networking/wg-access-server.nix
@@ -109,18 +109,9 @@ in
      wantedBy = [ "multi-user.target" ];
      requires = [ "network-online.target" ];
      after = [ "network-online.target" ];
-      script = ''
-        # merge secrets into main config
-        yq eval-all "select(fileIndex == 0) * select(fileIndex == 1)" ${configFile} $CREDENTIALS_DIRECTORY/SECRETS_FILE \
-          > "$STATE_DIRECTORY/config.yml"
-
-        ${lib.getExe cfg.package} serve --config "$STATE_DIRECTORY/config.yml"
-      '';

      path = with pkgs; [
        iptables
-        # needed by startup script
-        yq-go
      ];

      serviceConfig =
@@ -138,6 +129,14 @@ in
            "SECRETS_FILE:${cfg.secretsFile}"
          ];

+          # merge secrets into main config
+          ExecStartPre = [
+            "${lib.getExe' pkgs.coreutils "install"} '${configFile}' \"\${STATE_DIRECTORY}\"/config.yml"
+            "${lib.getExe pkgs.yq-go} eval-all 'select(fileIndex == 0) * select(fileIndex == 1)' \"\${STATE_DIRECTORY}\"/config.yml --inplace \"\${CREDENTIALS_DIRECTORY}\"/SECRETS_FILE"
+          ];
+
+          ExecStart = "${lib.getExe cfg.package} serve --config \"\${STATE_DIRECTORY}\"/config.yml";
+
          # Hardening
          DynamicUser = true;
          AmbientCapabilities = capabilities;
--- a/nixos/modules/services/search/meilisearch.nix
+++ b/nixos/modules/services/search/meilisearch.nix
@@ -184,7 +184,7 @@ in
      no_analytics = lib.mkDefault true;

      # allow updating without manual intervention
-      experimental_dumpless_upgrade = lib.mkDefault true;
+      upgrade_db = lib.mkDefault true;
    };

    # used to restore dumps
@@ -195,15 +195,6 @@ in
      wantedBy = [ "multi-user.target" ];
      after = [ "network.target" ];

-      preStart = lib.mkMerge [
-        ''
-          install -m 700 '${configFile}' "$RUNTIME_DIRECTORY/config.toml"
-        ''
-        (lib.mkIf (cfg.masterKeyFile != null) ''
-          ${lib.getExe pkgs.replace-secret} '${master-key-placeholder}' "$CREDENTIALS_DIRECTORY/master_key" "$RUNTIME_DIRECTORY/config.toml"
-        '')
-      ];
-
      environment = builtins.listToAttrs (
        map (secret: {
          name = secret.environment;
@@ -223,6 +214,12 @@ in
            secret: lib.mkIf (secret.setting != null) [ "${secret.name}:${secret.setting}" ]
          ) secrets-with-path
        );
+        ExecStartPre = [
+          "${lib.getExe' pkgs.coreutils "install"} -m 700 '${configFile}' \"\${RUNTIME_DIRECTORY}/config.toml\""
+        ]
+        ++ lib.optionals (cfg.masterKeyFile != null) [
+          "${lib.getExe pkgs.replace-secret} '${master-key-placeholder}' \"\${CREDENTIALS_DIRECTORY}/master_key\" \"\${RUNTIME_DIRECTORY}/config.toml\""
+        ];
        ExecStart = "${lib.getExe cfg.package} --config-file-path \${RUNTIME_DIRECTORY}/config.toml";
        StateDirectory = "meilisearch";
        WorkingDirectory = "%S/meilisearch";
--- a/nixos/modules/services/web-apps/davis.nix
+++ b/nixos/modules/services/web-apps/davis.nix
@@ -41,21 +41,20 @@ let
    };
  };
  secretPaths = lib.mapAttrsToList (_: v: v._secret) (lib.filterAttrs (_: isSecret) cfg.config);
-  mkSecretReplacement = file: ''
-    replace-secret ${
-      lib.escapeShellArgs [
-        (
-          if (lib.isString file) then
-            builtins.hashString "sha256" file
-          else
-            builtins.hashString "sha256" (builtins.readFile file)
-        )
-        file
-        "${cfg.dataDir}/.env.local"
-      ]
-    }
-  '';
-  secretReplacements = lib.concatMapStrings mkSecretReplacement secretPaths;
+  mkSecretReplacement =
+    file:
+    lib.escapeShellArgs [
+      (lib.getExe pkgs.replace-secret)
+      (
+        if (lib.isString file) then
+          builtins.hashString "sha256" file
+        else
+          builtins.hashString "sha256" (builtins.readFile file)
+      )
+      file
+      "${cfg.dataDir}/.env.local"
+    ];
+  secretReplacements = map mkSecretReplacement secretPaths;
  filteredConfig = lib.converge (lib.filterAttrsRecursive (
    _: v:
    !lib.elem v [
@@ -420,21 +419,18 @@ in
        serviceConfig = {
          Type = "oneshot";
          RemainAfterExit = true;
+          ExecStart = [
+            # create .env file with the upstream values
+            "${lib.getExe' pkgs.coreutils "install"} -T -m 0600 -o '${user}' '${cfg.package}/env-upstream' '${cfg.dataDir}/.env'"
+            # create .env.local file with the user-provided values
+            "${lib.getExe' pkgs.coreutils "install"} -T -m 0600 -o '${user}' '${davisEnv}' '${cfg.dataDir}/.env.local'"
+          ]
+          ++ secretReplacements;
        };
-        path = [ pkgs.replace-secret ];
        restartTriggers = [
          cfg.package
          davisEnv
        ];
-        script = ''
-          # error handling
-          set -euo pipefail
-          # create .env file with the upstream values
-          install -T -m 0600 -o ${user} ${cfg.package}/env-upstream "${cfg.dataDir}/.env"
-          # create .env.local file with the user-provided values
-          install -T -m 0600 -o ${user} ${davisEnv} "${cfg.dataDir}/.env.local"
-          ${secretReplacements}
-        '';
      };

      systemd.services.davis-db-migrate = {
@@ -458,17 +454,16 @@ in
            "APP_LOG_DIR=${cfg.dataDir}/var/log"
          ];
          EnvironmentFile = "${cfg.dataDir}/.env.local";
+          ExecStart = [
+            "${cfg.package}/bin/console cache:clear --no-debug"
+            "${cfg.package}/bin/console cache:warmup --no-debug"
+            "${cfg.package}/bin/console doctrine:migrations:migrate"
+          ];
        };
        restartTriggers = [
          cfg.package
          davisEnv
        ];
-        script = ''
-          set -euo pipefail
-          ${cfg.package}/bin/console cache:clear --no-debug
-          ${cfg.package}/bin/console cache:warmup --no-debug
-          ${cfg.package}/bin/console doctrine:migrations:migrate
-        '';
      };

      systemd.services.phpfpm-davis.after = [
--- a/nixos/modules/services/web-apps/sogo.nix
+++ b/nixos/modules/services/web-apps/sogo.nix
@@ -151,16 +151,15 @@ in
      description = "SOGo tmpwatch";

      startAt = [ "hourly" ];
-      script = ''
-        SOGOSPOOL=/var/lib/sogo/spool
-
-        find "$SOGOSPOOL" -type f -user sogo -atime +23 -delete > /dev/null
-        find "$SOGOSPOOL" -mindepth 1 -type d -user sogo -empty -delete > /dev/null
-      '';

      serviceConfig = {
        Type = "oneshot";

+        ExecStart = [
+          "find /var/lib/sogo/spool -type f -user sogo -atime +23 -delete"
+          "find /var/lib/sogo/spool -mindepth 1 -type d -user sogo -empty -delete"
+        ];
+
        ProtectSystem = "strict";
        ProtectHome = true;
        PrivateTmp = true;
--- a/nixos/modules/services/web-apps/wiki-js.nix
+++ b/nixos/modules/services/web-apps/wiki-js.nix
@@ -138,19 +138,18 @@ in
        openssh
      ];

-      preStart = ''
-        ln -sf ${configFile} /var/lib/${cfg.stateDirectoryName}/config.yml
-        ln -sf ${pkgs.wiki-js}/server /var/lib/${cfg.stateDirectoryName}
-        ln -sf ${pkgs.wiki-js}/assets /var/lib/${cfg.stateDirectoryName}
-        ln -sf ${pkgs.wiki-js}/package.json /var/lib/${cfg.stateDirectoryName}/package.json
-      '';
-
      serviceConfig = {
        EnvironmentFile = mkIf (cfg.environmentFile != null) cfg.environmentFile;
        StateDirectory = cfg.stateDirectoryName;
        WorkingDirectory = "/var/lib/${cfg.stateDirectoryName}";
        DynamicUser = true;
        PrivateTmp = true;
+        ExecStartPre = [
+          "${lib.getExe' pkgs.coreutils "ln"} -sf ${configFile} /var/lib/${cfg.stateDirectoryName}/config.yml"
+          "${lib.getExe' pkgs.coreutils "ln"} -sf ${pkgs.wiki-js}/server /var/lib/${cfg.stateDirectoryName}"
+          "${lib.getExe' pkgs.coreutils "ln"} -sf ${pkgs.wiki-js}/assets /var/lib/${cfg.stateDirectoryName}"
+          "${lib.getExe' pkgs.coreutils "ln"} -sf ${pkgs.wiki-js}/package.json /var/lib/${cfg.stateDirectoryName}/package.json"
+        ];
        ExecStart = "${pkgs.lib.getExe pkgs.nodejs-slim} ${pkgs.wiki-js}/server";
      };
    };
--- a/nixos/modules/services/web-apps/zitadel.nix
+++ b/nixos/modules/services/web-apps/zitadel.nix
@@ -202,34 +202,30 @@ in

    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ cfg.settings.Port ];

-    systemd.services.zitadel =
-      let
-        configFile = settingsFormat.generate "config.yaml" cfg.settings;
-        stepsFile = settingsFormat.generate "steps.yaml" cfg.steps;
+    systemd.services.zitadel = {
+      description = "ZITADEL identity access management";
+      wantedBy = [ "multi-user.target" ];

-        args = lib.cli.toCommandLineShellGNU { } {
-          config = cfg.extraSettingsPaths ++ [ configFile ];
-          steps = cfg.extraStepsPaths ++ [ stepsFile ];
-          masterkeyFile = cfg.masterKeyFile;
-          inherit (cfg) tlsMode;
-        };
-      in
-      {
-        description = "ZITADEL identity access management";
-        path = [ cfg.package ];
-        wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "simple";
+        ExecStart =
+          let
+            configFile = settingsFormat.generate "config.yaml" cfg.settings;
+            stepsFile = settingsFormat.generate "steps.yaml" cfg.steps;

-        script = ''
-          zitadel start-from-init ${args}
-        '';
-
-        serviceConfig = {
-          Type = "simple";
-          User = cfg.user;
-          Group = cfg.group;
-          Restart = "on-failure";
-        };
+            args = lib.cli.toCommandLineShellGNU { } {
+              config = cfg.extraSettingsPaths ++ [ configFile ];
+              steps = cfg.extraStepsPaths ++ [ stepsFile ];
+              masterkeyFile = cfg.masterKeyFile;
+              inherit (cfg) tlsMode;
+            };
+          in
+          "${lib.getExe cfg.package} start-from-init ${args}";
+        User = cfg.user;
+        Group = cfg.group;
+        Restart = "on-failure";
      };
+    };

    users.users.zitadel = lib.mkIf (cfg.user == "zitadel") {
      isSystemUser = true;
--- a/nixos/modules/services/web-servers/traefik.nix
+++ b/nixos/modules/services/web-servers/traefik.nix
@@ -130,12 +130,9 @@ in
      startLimitBurst = 5;
      serviceConfig = {
        EnvironmentFile = cfg.environmentFiles;
-        ExecStartPre = lib.optional (cfg.environmentFiles != [ ]) (
-          pkgs.writeShellScript "pre-start" ''
-            umask 077
-            ${pkgs.envsubst}/bin/envsubst -i "${staticConfigFile}" > "${finalStaticConfigFile}"
-          ''
-        );
+        ExecStartPre = lib.optional (
+          cfg.environmentFiles != [ ]
+        ) "${pkgs.envsubst}/bin/envsubst -i '${staticConfigFile}' -o '${finalStaticConfigFile}'";
        ExecStart = "${cfg.package}/bin/traefik --configfile=${finalStaticConfigFile}";
        Type = "simple";
        User = "traefik";
@@ -152,6 +149,7 @@ in
        ProtectSystem = "full";
        ReadWritePaths = [ cfg.dataDir ];
        RuntimeDirectory = "traefik";
+        RuntimeDirectoryMode = "0700";
        WorkingDirectory = cfg.dataDir;
      };
    };
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@@ -16,9 +16,9 @@ let
      inherit tiling_wm;
    };
  stableVersion = {
-    version = "2026.1.2.11"; # "Android Studio Quail 2 | 2026.1.2 Patch 1"
-    sha256Hash = "sha256-HMnNVPQA27DQeITw98DKtSTbXOCl73CyOu1v3TzURbk=";
-    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.2.11/android-studio-quail2-patch1-linux.tar.gz";
+    version = "2026.1.3.7"; # "Android Studio Quail 3 | 2026.1.3"
+    sha256Hash = "sha256-NoMhIlV6tzymjf2b2YndrEAQOsADyhDgTJSaH2FXimc=";
+    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.3.7/android-studio-quail3-linux.tar.gz";
  };
  betaVersion = {
    version = "2026.1.3.6"; # "Android Studio Quail 3 | 2026.1.3 RC 2"
--- a/pkgs/applications/misc/redshift/default.nix
+++ b/pkgs/applications/misc/redshift/default.nix
@@ -138,7 +138,7 @@ rec {
    version = "1.12";

    src = fetchFromGitHub {
-      owner = "jonls";
+      owner = "sharpbracket";
      repo = "redshift";
      rev = "v${version}";
      sha256 = "12cb4gaqkybp4bkkns8pam378izr2mwhr2iy04wkprs2v92j7bz6";
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1067,11 +1067,11 @@
    "vendorHash": null
  },
  "ovh_ovh": {
-    "hash": "sha256-BKaPKG9xuRq2rNxkMJnN428woyeK0NnssZaJRrGutoM=",
+    "hash": "sha256-KVYxtk94GyVhMVB0E0HZ8Cszm4RWMrSMJB0hh/Llcbk=",
    "homepage": "https://registry.terraform.io/providers/ovh/ovh",
    "owner": "ovh",
    "repo": "terraform-provider-ovh",
-    "rev": "v2.17.0",
+    "rev": "v2.18.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
--- a/pkgs/applications/networking/mumble/default.nix
+++ b/pkgs/applications/networking/mumble/default.nix
@@ -218,14 +218,14 @@ let
    } source;

  source = rec {
-    version = "1.5.901";
+    version = "1.5.915";

    # Needs submodules
    src = fetchFromGitHub {
      owner = "mumble-voip";
      repo = "mumble";
      tag = "v${version}";
-      hash = "sha256-UBJH7EwfWvInuSD6ZALOKeVnWdfh/rmq8GVLG5URjOQ=";
+      hash = "sha256-pbO+V8p/vqn+jIFWvcHOKhpr1Nv0nXaHG9lFiMRTntM=";
      fetchSubmodules = true;
    };
  };
--- a/pkgs/by-name/ah/ahk_x11/package.nix
+++ b/pkgs/by-name/ah/ahk_x11/package.nix
@@ -1,7 +1,7 @@
 {
  lib,
  fetchFromGitHub,
-  crystal,
+  crystal_1_19,
  copyDesktopItems,
  gtk3,
  libxkbcommon,
@@ -24,6 +24,10 @@
 let
  pname = "ahk_x11";
  version = "1.0.7";
+  # Pinning to Crystal 1.19.x since ahk_x11 crashes with segmentation
+  # fault when built using >=1.20.0
+  # Refernce: https://github.com/phil294/AHK_X11/pull/127
+  crystal = crystal_1_19;
 in
 crystal.buildCrystalPackage {
  inherit pname version;
--- a/pkgs/by-name/al/alibuild/package.nix
+++ b/pkgs/by-name/al/alibuild/package.nix
@@ -6,12 +6,12 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "alibuild";
-  version = "1.17.31";
+  version = "1.17.42";
  pyproject = true;

  src = fetchPypi {
    inherit (finalAttrs) pname version;
-    hash = "sha256-agAWJaaaHGN2oQaaIkMNEeU712bkWXEPH3jP8oH5Qjs=";
+    hash = "sha256-QFNyb6lmTGOaAj4qyDo/mTW7J6LHfALnjo+b0WTllDQ=";
  };

  build-system = with python3Packages; [
--- a/pkgs/by-name/an/andcli/package.nix
+++ b/pkgs/by-name/an/andcli/package.nix
@@ -9,7 +9,7 @@

 buildGoModule (finalAttrs: {
  pname = "andcli";
-  version = "2.7.0";
+  version = "2.8.0";

  __structuredAttrs = true;

@@ -19,10 +19,10 @@ buildGoModule (finalAttrs: {
    owner = "tjblackheart";
    repo = "andcli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-l+ZpAm+yHCKPalGib4OlIaGFsDHc3IFFlOvB1kXWZG0=";
+    hash = "sha256-yFYO223RbQ7qOw9dPXgMMTQpA+BzQ+xlT+CfWcQMeqk=";
  };

-  vendorHash = "sha256-S2JRkVy1iLGBqoOWukTQm80fVJ2YMNHTLfUUA2530GE=";
+  vendorHash = "sha256-aFOwfloqFPPMgCufwmDgfM9lDinkFvu4i+BiVUo+Iwk=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/at/atheme/package.nix
+++ b/pkgs/by-name/at/atheme/package.nix
@@ -16,13 +16,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "atheme";
-  version = "7.2.12-unstable-2026-06-06";
+  version = "7.2.12-unstable-2026-07-30";

  src = fetchFromGitHub {
    owner = "atheme";
    repo = "atheme";
-    rev = "b8b23c51cda120f2cfc5af9ac639cd257575f2ce";
-    hash = "sha256-+hOJH9tK78fNrxKyergHqMWaY0yBiFEWssS/r9IOQT0=";
+    rev = "bb8b8733b4ab04375b33269fab0d29677eed0922";
+    hash = "sha256-emjAsCPl+4/6JDwO4Cd1kDg9deaKonROQpeVHDVim8Y=";
    # for modules and pinned libmowgli
    fetchSubmodules = true;
    # configure checks for git tree
--- a/pkgs/by-name/au/ausweisapp/package.nix
+++ b/pkgs/by-name/au/ausweisapp/package.nix
@@ -12,13 +12,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "ausweisapp";
-  version = "2.5.3";
+  version = "2.5.4";

  src = fetchFromGitHub {
    owner = "Governikus";
    repo = "AusweisApp";
    rev = finalAttrs.version;
-    hash = "sha256-pr41KbejZCOvfXH2uHO5MA/VklSNU38EL6AgznvGqeY=";
+    hash = "sha256-y9F/dQZHbUFDRZDpdGtNCjTIypS2l4XJLbUZHjliEDA=";
  };

  postPatch = ''
--- a/pkgs/by-name/aw/aws-cdk-cli/missing-hashes.json
+++ b/pkgs/by-name/aw/aws-cdk-cli/missing-hashes.json
@@ -25,16 +25,16 @@
  "@esbuild/win32-arm64@npm:0.28.1": "551ada5396e1f10e3d3592dd60a148a7257af1ab2317bba09e9ed18a6d7ee7e5961c68eb1fbaee4e8c1961b504807493e1b8f5c700dd1fb990f0cb36b240ad57",
  "@esbuild/win32-ia32@npm:0.28.1": "2676ace6b4d63721da34873974152e869aed9fc8bd9fdff4b8df14a3a3e68b78a9b4566e643b90b948b4e85773cbf288a33a59d13979caaadd43b5adad68312c",
  "@esbuild/win32-x64@npm:0.28.1": "8d658b74ed9b7494b3799093551d4c928a7916865ed42d00a135156cbd08612b53072e9e424f0687c10a93a444d30d6b0294b6a1d5fdba78078d706646ba558f",
-  "@nx/nx-darwin-arm64@npm:22.7.6": "b336dcf04ce9c07d4bfe908fadb6bf5cc791342b4991439f5a7c0075d587c3d4570696c44b5d595735accda2bdf29c04a56dd0705b499f6a6b70f9886d833097",
-  "@nx/nx-darwin-x64@npm:22.7.6": "391780c2f14249c92a32b1245099e3d98241719f2cdf0b81289dc28948d011f18089ba94e272394b28aa2fbe5904119b954a633fc8bf82e8250bb00821e06d28",
-  "@nx/nx-freebsd-x64@npm:22.7.6": "bebebd506d74cbb62e3cbf3afbcb66e125e2ad3e3cd346e1ee51bf11167561649c6e60db751292e64f3b3a8c8a424d803979392c78a191c08ef510093ff93ab0",
-  "@nx/nx-linux-arm-gnueabihf@npm:22.7.6": "56d67d7536b0e89c08949bba7f94c071ced817195c37f3d947113888e0f624a8b21d31aad13107c86ac2225705298112ac593c359675540fcc47f74adb25f6eb",
-  "@nx/nx-linux-arm64-gnu@npm:22.7.6": "e61ff5c461d96294182c0ee823f627c37e925972a50375a4499b3089dcbadd9249cdbc995d5f573271a5aa7cb7a82690575a4ee51e149b6e3959559172d390ff",
-  "@nx/nx-linux-arm64-musl@npm:22.7.6": "0c0e5ba1583a49063779edd776555e11dbaf85f11600756b62774283ca1d8c2a84ddfdfe7c0f175275d0401a6aedc84deac831534bb3e5588841d719429477ee",
-  "@nx/nx-linux-x64-gnu@npm:22.7.6": "d65682bc14813e0f1e8e1bc5356081b6ecfde7a2fc3236e1d813f0da8ffc712b3b1641c8ebd4389e577348db549757efa2084fd16119fc6393e242331b2bad9e",
-  "@nx/nx-linux-x64-musl@npm:22.7.6": "924ed33a107b6647abe10acd77fe41f113e82dd83961b05d73c8b3a3c7c85d60cb35cae3a976497a8ef4fd48ab574d4ae5b683efd225fd4c404408b0ab87c1f9",
-  "@nx/nx-win32-arm64-msvc@npm:22.7.6": "feda72abfa06e7143a795993888ff2da73936a3bab4e2ca787b102322494abb3b3f24a944dd51c1de409afc19e921c6c98879d80f27921e848254d2a432cdc09",
-  "@nx/nx-win32-x64-msvc@npm:22.7.6": "5066816d70bcb55051259fc3acde32fef67f9359e15810e64dd3c93e11db40632e11a517dd3b1993a468632a8d75335ce550499711a23b5e7166f3130175bcda",
+  "@nx/nx-darwin-arm64@npm:22.7.7": "93f7de46da3da64c42489e7b42676ee59914635183f28640454a40bd0eb9f78b2c6a7b707bbd69024ffd45675e8a51b3ebde1b4ce268232ab9283f47f05001d9",
+  "@nx/nx-darwin-x64@npm:22.7.7": "5f175cbe8e2281b8055394c8b79afb98c81d1d06158d1866667b392134105db1c7b9c7b8eeea5f2bdcda8be56ff702f728067e8f505a370dbf5e6f80f41dd99e",
+  "@nx/nx-freebsd-x64@npm:22.7.7": "65cdfbe8663219e971dd50479f59b07ac37e08ed14be234069c67af3bde005c69197bbd28d83f64f0b7cafd5af744d74e6822e2c97b6336b2f4cd599ae510880",
+  "@nx/nx-linux-arm-gnueabihf@npm:22.7.7": "62925001769e4e21e1b5ef2ad17463ac2b42d5263a117e74e7c72797e26adbb990cb3017749077ed057c27b964823690896ee1785e1a835dc27b6d04a19403e7",
+  "@nx/nx-linux-arm64-gnu@npm:22.7.7": "bc851f35ca9308a530bf81d0f73e262b0124f40b4edd41ae055b5a0f893f2a24e2368f344817beb8cc9f820957b2fb6ad064df20818d7c356a060d533d5b0dea",
+  "@nx/nx-linux-arm64-musl@npm:22.7.7": "940e1f0277c180e828b5296437b2a4fd22d39e2f51f342f9f97c6feb2a917c9bc09297d2ca276a053b381909a863e0bb1c3c10bc207afcde24cd3f12c0672304",
+  "@nx/nx-linux-x64-gnu@npm:22.7.7": "db94d5f9b16600e9892442243f2fc51b614b16311e542ed80cbee0cd71aa72a2d4f4cfe705f3ef0fbc5ce5956abe5d18a7004eb41e18a3467539aa5b52fea6f7",
+  "@nx/nx-linux-x64-musl@npm:22.7.7": "4f587b7c5014c47bc371943c6eb3882d7473b6f9427a8babd5837eb0c1c45e65b50d393a20e1c932b568365e5f0a0a03c8476d391ed96fe12fb56b967354064b",
+  "@nx/nx-win32-arm64-msvc@npm:22.7.7": "bb5fc5f779ec467c57e2314038a47c81344ff43c99801650a6074c828c907882bd3bab1153a15f4a4371028c3ec4ba0b961014b225c81e084073bc922f0ab3cc",
+  "@nx/nx-win32-x64-msvc@npm:22.7.7": "f08aab74096e9c772b45eb20e9aecf6836d9d20511cbeba31d9a303ca29f15eab2c2a7f42bffad8d02508c6c5662816b4d0c107d60366df0a6e2153c15b9dbf9",
  "@unrs/resolver-binding-android-arm-eabi@npm:1.11.1": "04dd38b694c1680bfec192b499e188700398a414886a08a8a7c72815db56ac147df03d88c73ff6fff7ac3e0a01dc41978054b3622b49463e0d684c5168557fcc",
  "@unrs/resolver-binding-android-arm64@npm:1.11.1": "763626adc34dd2b4af677b5ced6493e7b2b1935351a5c9137f1c9561d11faf97b94015e6876e57e85c33ff563564314c92c0882a4780a57f2225cbbd779a695d",
  "@unrs/resolver-binding-darwin-arm64@npm:1.11.1": "03b477fdfec55dbabe488fe0962417bddaa38b028d2670053469f1d24163907b097aac15b565f6974449bee398a38d5e3e1525f2b515ce57e243149021b7aa2f",
--- a/pkgs/by-name/aw/aws-cdk-cli/package.nix
+++ b/pkgs/by-name/aw/aws-cdk-cli/package.nix
@@ -17,19 +17,19 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "aws-cdk-cli";
-  version = "2.1131.0";
+  version = "2.1134.0";

  src = fetchFromGitHub {
    owner = "aws";
    repo = "aws-cdk-cli";
    tag = "cdk@v${finalAttrs.version}";
-    hash = "sha256-66kMwa9IJN0Culc+oAUazKBlXE3nRoPJ2/0/OaTRxjI=";
+    hash = "sha256-VrP/L8uuTxC4TBEHhmuhNEf0nf5J8kYjOl3Kz1ejUPg=";
  };

  missingHashes = ./missing-hashes.json;
  offlineCache = yarn-berry.fetchYarnBerryDeps {
    inherit (finalAttrs) src missingHashes;
-    hash = "sha256-BVjva74w/6zHv6JKAPCBt5Pu72ztGSJYX5h4QffABkk=";
+    hash = "sha256-l6iKJvG8qbV6pp+XWS07lKqr63UABTLd4/dlJnosIRw=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ba/banjorecomp/package.nix
+++ b/pkgs/by-name/ba/banjorecomp/package.nix
@@ -42,13 +42,13 @@ in

 llvmPackages_21.stdenv.mkDerivation (finalAttrs: {
  pname = "banjorecomp";
-  version = "1.0.1";
+  version = "1.0.2";

  src = fetchFromGitHub {
    owner = "BanjoRecomp";
    repo = "BanjoRecomp";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-QIiSjwA0iyoGTaeKANah6WhTUwPGXv1qR26kTdg7OqU=";
+    hash = "sha256-GGV3L60Z0ivkWOoJnqK2Hx5q1EVUsbE2D5jHPAW3Cy0=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/bu/burpsuite/package.nix
+++ b/pkgs/by-name/bu/burpsuite/package.nix
@@ -15,7 +15,7 @@ assert lib.assertMsg (

 let
  pname = "burpsuite";
-  version = "2026.7";
+  version = "2026.7.2";

  src = fetchurl {
    name = "burpsuite.jar";
@@ -24,7 +24,7 @@ let
      "https://portswigger.net/burp/releases/download?product=desktop&version=${version}&type=Jar"
      "https://web.archive.org/web/https://portswigger.net/burp/releases/download?product=desktop&version=${version}&type=Jar"
    ];
-    hash = "sha256-vZcCNFVEHg1zkhAjSqc6vVzFaU0YdZ27AF+eHLfLazs=";
+    hash = "sha256-WLmuv09RKq4B4/L1iWFEPck45Fix/5DTFs/MPYJmC8M=";
  };

  description = "Integrated platform for performing security testing of web applications";
--- a/pkgs/by-name/cd/cdncheck/package.nix
+++ b/pkgs/by-name/cd/cdncheck/package.nix
@@ -6,13 +6,13 @@

 buildGoModule (finalAttrs: {
  pname = "cdncheck";
-  version = "1.2.45";
+  version = "1.2.46";

  src = fetchFromGitHub {
    owner = "projectdiscovery";
    repo = "cdncheck";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-TR7ogxaJ9Vee6bpqWKu75Yf8KWo8bPTBKwIecGkN68I=";
+    hash = "sha256-wk4+If+swd+jaAsvLBEFV6LAHxM9Ty/YvnRJ5LImyqc=";
  };

  vendorHash = "sha256-iJ1agL7sZ3ZKbW1wMA+qi8FgHdPa6gZLQ5BBPKJTNaQ=";
--- a/pkgs/by-name/ch/chef-cli/Gemfile.lock
+++ b/pkgs/by-name/ch/chef-cli/Gemfile.lock
@@ -1,12 +1,12 @@
 GEM
  remote: https://rubygems.org/
  specs:
-    addressable (2.8.10)
+    addressable (2.9.0)
      public_suffix (>= 2.0.2, < 8.0)
    ast (2.4.3)
    aws-eventstream (1.4.0)
-    aws-partitions (1.1241.0)
-    aws-sdk-core (3.246.0)
+    aws-partitions (1.1276.0)
+    aws-sdk-core (3.254.0)
      aws-eventstream (~> 1, >= 1.3.0)
      aws-partitions (~> 1, >= 1.992.0)
      aws-sigv4 (~> 1.9)
@@ -14,15 +14,15 @@ GEM
      bigdecimal
      jmespath (~> 1, >= 1.6.1)
      logger
-    aws-sdk-kms (1.123.0)
-      aws-sdk-core (~> 3, >= 3.244.0)
+    aws-sdk-kms (1.130.0)
+      aws-sdk-core (~> 3, >= 3.254.0)
      aws-sigv4 (~> 1.5)
-    aws-sdk-s3 (1.220.0)
-      aws-sdk-core (~> 3, >= 3.244.0)
+    aws-sdk-s3 (1.228.2)
+      aws-sdk-core (~> 3, >= 3.254.0)
      aws-sdk-kms (~> 1)
      aws-sigv4 (~> 1.5)
-    aws-sdk-secretsmanager (1.129.0)
-      aws-sdk-core (~> 3, >= 3.244.0)
+    aws-sdk-secretsmanager (1.134.0)
+      aws-sdk-core (~> 3, >= 3.254.0)
      aws-sigv4 (~> 1.5)
    aws-sigv4 (1.12.1)
      aws-eventstream (~> 1, >= 1.0.2)
@@ -31,14 +31,14 @@ GEM
    benchmark (0.5.0)
    bigdecimal (4.1.2)
    builder (3.3.0)
-    chef (19.2.12)
+    chef (19.3.15)
      addressable
      aws-sdk-s3 (~> 1.91)
      aws-sdk-secretsmanager (~> 1.46)
      bcrypt_pbkdf (~> 1.0)
-      chef-config (= 19.2.12)
+      chef-config (= 19.3.15)
      chef-licensing (~> 1.3)
-      chef-utils (= 19.2.12)
+      chef-utils (= 19.3.15)
      chef-vault
      chef-zero (~> 15.1.0)
      corefoundation (~> 0.3.4)
@@ -48,7 +48,7 @@ GEM
      erubis (~> 2.7)
      ffi (>= 1.15.5, < 1.18.0)
      ffi-libarchive (~> 1.0, >= 1.0.3)
-      ffi-yajl (~> 2.2)
+      ffi-yajl (>= 2.2, < 4.0)
      iniparse (~> 1.4)
      inspec-core (~> 7.0.107)
      license-acceptance (>= 1.0.5, < 3)
@@ -56,7 +56,7 @@ GEM
      mixlib-authentication (>= 2.1, < 4)
      mixlib-cli (>= 2.1.1, < 3.0)
      mixlib-log (>= 2.0.3, < 4.0)
-      mixlib-shellout (~> 3.3.8)
+      mixlib-shellout (>= 3.3.8, < 3.5.0)
      net-ftp
      net-sftp (>= 2.1.2, < 5.0)
      ohai (~> 19.0)
@@ -68,10 +68,10 @@ GEM
      train-rest (>= 0.4.1)
      train-winrm (>= 0.2.17)
      unf_ext (~> 0.0.9.1)
-      uri (~> 1.0.4)
-      vault (~> 0.18.2)
-    chef-cli (6.1.29)
-      addressable (>= 2.3.5, < 2.9)
+      uri (>= 1.0.4, < 1.2.0)
+      vault (>= 0.18.2, < 0.21.0)
+    chef-cli (6.1.34)
+      addressable (>= 2.9.0, < 3.0)
      chef (>= 18.0, < 20.0)
      chef-licensing (~> 1.0)
      cookbook-omnifetch (~> 0.5)
@@ -84,14 +84,14 @@ GEM
      pastel (~> 0.7)
      solve (> 2.0, < 5.0)
      syslog (~> 0.3)
-    chef-config (19.2.12)
+    chef-config (19.3.15)
      addressable
-      chef-utils (= 19.2.12)
+      chef-utils (= 19.3.15)
      fuzzyurl
      mixlib-config (>= 2.2.12, < 4.0)
      mixlib-shellout (>= 2.0, < 4.0)
      racc
-      tomlrb (~> 1.2)
+      tomlrb (>= 1.2, < 3.0)
    chef-gyoku (1.5.0)
      builder (>= 2.1.2)
      rexml (~> 3.4)
@@ -107,9 +107,9 @@ GEM
    chef-telemetry (1.1.1)
      chef-config
      concurrent-ruby (~> 1.0)
-    chef-utils (19.2.12)
+    chef-utils (19.3.15)
      concurrent-ruby
-    chef-vault (4.2.9)
+    chef-vault (4.2.12)
      syslog (~> 0.3)
    chef-winrm (2.5.0)
      builder (>= 2.1.2)
@@ -132,31 +132,31 @@ GEM
      erubi (>= 1.7)
      logging (>= 1.6.1, < 3.0)
      rubyzip (~> 2.0)
-    chef-zero (15.1.0)
+    chef-zero (15.1.11)
      ffi-yajl (>= 2.2, < 4.0)
      hashie (>= 2.0, < 6.0)
      mixlib-log (>= 2.0, < 4.0)
-      rack (~> 3.1, >= 3.1.16)
-      rackup (~> 2.2, >= 2.2.1)
-      unf_ext (~> 0.0.8)
-      uuidtools (~> 2.1)
+      rack (~> 3.2, >= 3.2.6)
+      rackup (~> 2.3, >= 2.3.1)
+      uuidtools (>= 2.1, < 4.0)
      webrick
    coderay (1.1.3)
-    concurrent-ruby (1.3.6)
+    concurrent-ruby (1.3.8)
+    connection_pool (3.0.2)
    cookbook-omnifetch (0.12.2)
      mixlib-archive (>= 0.4, < 2.0)
-    cookstyle (8.6.10)
-      rubocop (= 1.84.2)
-    corefoundation (0.3.13)
+    cookstyle (8.7.6)
+      rubocop (= 1.86.1)
+    corefoundation (0.3.19)
      ffi (>= 1.15.0)
-    csv (3.3.5)
+    csv (3.3.6)
    date (3.5.1)
    diff-lcs (1.6.2)
    domain_name (0.6.20240107)
    ed25519 (1.4.0)
    erubi (1.13.1)
    erubis (2.7.0)
-    faraday (2.14.1)
+    faraday (2.14.3)
      faraday-net_http (>= 2.0, < 3.5)
      json
      logger
@@ -164,14 +164,13 @@ GEM
      faraday (>= 1, < 3)
    faraday-http-cache (2.7.0)
      faraday (>= 0.8)
-    faraday-net_http (3.4.2)
+    faraday-net_http (3.4.4)
      net-http (~> 0.5)
    ffi (1.17.4)
    ffi-libarchive (1.1.14)
      ffi (~> 1.0)
-    ffi-yajl (2.7.7)
+    ffi-yajl (2.7.11)
      libyajl2 (>= 2.1)
-      yajl
    fuzzyurl (0.9.0)
    gssapi (1.3.1)
      ffi (>= 1.0.1)
@@ -214,8 +213,8 @@ GEM
    io-console (0.8.2)
    ipaddress (0.8.3)
    jmespath (1.6.2)
-    json (2.19.4)
-    language_server-protocol (3.17.0.5)
+    json (2.21.1)
+    language_server-protocol (3.17.0.6)
    libyajl2 (2.1.0)
    license-acceptance (2.1.13)
      pastel (~> 0.7)
@@ -232,7 +231,7 @@ GEM
    mime-types (3.7.0)
      logger
      mime-types-data (~> 3.2025, >= 3.2025.0507)
-    mime-types-data (3.2026.0414)
+    mime-types-data (3.2026.0701)
    minitar (1.1.0)
    mixlib-archive (1.3.3)
      mixlib-log
@@ -242,10 +241,10 @@ GEM
      tomlrb
    mixlib-log (3.2.3)
      ffi (>= 1.15.5)
-    mixlib-shellout (3.3.9)
+    mixlib-shellout (3.4.10)
      chef-utils
    molinillo (0.8.0)
-    multi_json (1.20.1)
+    multi_json (1.21.1)
    multipart-post (2.4.1)
    mutex_m (0.3.0)
    net-ftp (0.3.9)
@@ -253,33 +252,36 @@ GEM
      time
    net-http (0.9.1)
      uri (>= 0.11.1)
+    net-http-persistent (4.0.8)
+      connection_pool (>= 2.2.4, < 4)
    net-protocol (0.2.2)
      timeout
    net-scp (4.1.0)
      net-ssh (>= 2.6.5, < 8.0.0)
    net-sftp (4.0.0)
      net-ssh (>= 5.0.0, < 8.0.0)
-    net-ssh (7.3.2)
+    net-ssh (7.3.3)
    netrc (0.11.0)
-    nori (2.7.1)
+    nori (2.9.1)
      bigdecimal
-    ohai (19.1.24)
+      stringio
+    ohai (19.1.40)
      base64
      chef-config (>= 14.12, < 20)
      chef-utils (>= 16.0, < 20)
      ffi (>= 1.15.5)
-      ffi-yajl (~> 2.2)
+      ffi-yajl (>= 2.2, < 3.0)
      ipaddress
      mixlib-cli (>= 1.7.0)
      mixlib-config (>= 2.0, < 4.0)
      mixlib-log (>= 2.0.1, < 4.0)
-      mixlib-shellout (~> 3.3.6)
+      mixlib-shellout (>= 3.3.6, < 3.5.0)
      plist (~> 3.1)
      train-core
      wmi-lite (~> 1.0)
    ostruct (0.6.3)
    parallel (1.28.0)
-    parser (3.3.11.1)
+    parser (3.3.12.0)
      ast (~> 2.4.1)
      racc
    parslet (2.0.0)
@@ -324,18 +326,18 @@ GEM
      diff-lcs (>= 1.2.0, < 2.0)
      rspec-support (~> 3.13.0)
    rspec-support (3.13.7)
-    rubocop (1.84.2)
+    rubocop (1.86.1)
      json (~> 2.3)
      language_server-protocol (~> 3.17.0.2)
      lint_roller (~> 1.1.0)
-      parallel (~> 1.10)
+      parallel (>= 1.10)
      parser (>= 3.3.0.2)
      rainbow (>= 2.2.2, < 4.0)
      regexp_parser (>= 2.9.3, < 3.0)
      rubocop-ast (>= 1.49.0, < 2.0)
      ruby-progressbar (~> 1.7)
      unicode-display_width (>= 2.4.0, < 4.0)
-    rubocop-ast (1.49.1)
+    rubocop-ast (1.50.0)
      parser (>= 3.3.7.2)
      prism (~> 1.7)
    ruby-progressbar (1.13.0)
@@ -348,6 +350,7 @@ GEM
      molinillo (~> 0.6)
      semverse (>= 1.1, < 4.0)
    sslshake (1.3.1)
+    stringio (3.2.0)
    strings (0.2.1)
      strings-ansi (~> 0.2)
      unicode-display_width (>= 1.5, < 3.0)
@@ -360,8 +363,8 @@ GEM
    time (0.4.2)
      date
    timeout (0.6.1)
-    tomlrb (1.3.0)
-    train-core (3.16.2)
+    tomlrb (2.0.4)
+    train-core (3.16.5)
      addressable (~> 2.5)
      ffi (>= 1.16.0, < 1.18)
      json (>= 2.19.2, < 3.0)
@@ -400,14 +403,15 @@ GEM
    unf_ext (0.0.9.1)
    unicode-display_width (2.6.0)
    unicode_utils (1.4.0)
-    uri (1.0.4)
-    uuidtools (2.2.0)
-    vault (0.18.2)
+    uri (1.1.1)
+    uuidtools (3.0.0)
+    vault (0.20.1)
      aws-sigv4
+      base64
+      net-http-persistent (~> 4.0, >= 4.0.2)
    webrick (1.9.2)
    wisper (2.0.1)
    wmi-lite (1.0.7)
-    yajl (0.3.4)

 PLATFORMS
  ruby
--- a/pkgs/by-name/ch/chef-cli/gemset.nix
+++ b/pkgs/by-name/ch/chef-cli/gemset.nix
@@ -5,10 +5,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "031lb8jq55dxb5qiknzffl7nniqfmrc4603ggxqipnxywwp5ca6a";
+      sha256 = "1by7h2lwziiblizpd5yx87jsq8ppdhzvwf08ga34wzqgcv1nmpvz";
      type = "gem";
    };
-    version = "2.8.10";
+    version = "2.9.0";
  };
  ast = {
    groups = [ "default" ];
@@ -35,10 +35,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1gkc08r1s7mvinl7301rahylj3z7myypdbkpvj5jwy72bm1zq3nd";
+      sha256 = "0lsqlmq1fhf1h1y4g21p3g1pk49hg5mmamv80idw18bi6dn2vhf1";
      type = "gem";
    };
-    version = "1.1241.0";
+    version = "1.1276.0";
  };
  aws-sdk-core = {
    dependencies = [
@@ -54,10 +54,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1k6xqkipjli9vl40d4wqxcl7035lav9f9hnczilhwmj8i7n68f1r";
+      sha256 = "1zhj444iybzs1ikw1p4arv3zayw9xkk1ifnsb6g3r2j6p0h34gpf";
      type = "gem";
    };
-    version = "3.246.0";
+    version = "3.254.0";
  };
  aws-sdk-kms = {
    dependencies = [
@@ -68,10 +68,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "080zh4g1lcjl0bz2l0gjm8vmpd60cvi0p658bh235ypqh9zg61fl";
+      sha256 = "0jfpgjyhq3f7w67p3361f1racrc1m502zan934m7mdrir9i3ds52";
      type = "gem";
    };
-    version = "1.123.0";
+    version = "1.130.0";
  };
  aws-sdk-s3 = {
    dependencies = [
@@ -83,10 +83,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0z4cl87lbyw9qgp1l52sbjnysw63zmxih9wfhjfdvv67d9gdlzr3";
+      sha256 = "12s686zpqxp9jrd8wwvayhi74jg34ck5sp0ia8hmzd2lnmwbh5qj";
      type = "gem";
    };
-    version = "1.220.0";
+    version = "1.228.2";
  };
  aws-sdk-secretsmanager = {
    dependencies = [
@@ -97,10 +97,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0m69f1jghxlixd4b5wb2dsp38dly7nxm5si1klnajv89m23mqi00";
+      sha256 = "1da0djxzsxia1318q1ccvyy0059m3hxwjv0pf3xqfnkp0rbmaxja";
      type = "gem";
    };
-    version = "1.129.0";
+    version = "1.134.0";
  };
  aws-sigv4 = {
    dependencies = [ "aws-eventstream" ];
@@ -208,10 +208,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1iqg9vk9h40szvn1y5z1n1xs02l5n2bw5sahas2mx5ira2rs09d4";
+      sha256 = "19ilbjca0nggb30w54yc1rv0f8522da5qmi5lc2r2vps1cm79z22";
      type = "gem";
    };
-    version = "19.2.12";
+    version = "19.3.15";
  };
  chef-cli = {
    dependencies = [
@@ -233,10 +233,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1x3n57wb0zxqij8gccp4ss34i3w2xnh3qqzf6cqgav806sb5pyrz";
+      sha256 = "00kcszy8f6gbs6kcnsg7899y6pin65xsdvmr1sr8lxkhfp7am54f";
      type = "gem";
    };
-    version = "6.1.29";
+    version = "6.1.34";
  };
  chef-config = {
    dependencies = [
@@ -252,10 +252,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0999pzgsypcy5wvr42p3iagl4c96glcwfk08vlpxrc05q4jqwf24";
+      sha256 = "0icgxfzj92ld89pc30gm2iha5qkq50k35ym69n6imsmfq43wxx6r";
      type = "gem";
    };
-    version = "19.2.12";
+    version = "19.3.15";
  };
  chef-gyoku = {
    dependencies = [
@@ -311,10 +311,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "17jkln8gnxymvppnsbhzjza4gbhwc52shhql3yl1cn5c0lpsf0hb";
+      sha256 = "0smqw0vhccmzw0jpnpibmvgsc5xhcrmszs78gn4nsnxmhnf7llqw";
      type = "gem";
    };
-    version = "19.2.12";
+    version = "19.3.15";
  };
  chef-vault = {
    dependencies = [ "syslog" ];
@@ -322,10 +322,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0jv3mn4z650a8jbncyvz0sfb7kgwlz4rwhxw6k0f7q8m49p6mw7z";
+      sha256 = "0ss33g7bg1i3pjzjvi0ymvgbri32zsxrj5fm0sdshc0sp1x8rc9k";
      type = "gem";
    };
-    version = "4.2.9";
+    version = "4.2.12";
  };
  chef-winrm = {
    dependencies = [
@@ -388,7 +388,6 @@
      "mixlib-log"
      "rack"
      "rackup"
-      "unf_ext"
      "uuidtools"
      "webrick"
    ];
@@ -396,10 +395,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "12jqa1a1px56j5qkrl0bjb14pg7hyylbl23zd780rvmq7nghw8l5";
+      sha256 = "1v5q31439mfvzl51wagznbrkc4fkmhkmkbdh4w611l47r9msv0hq";
      type = "gem";
    };
-    version = "15.1.0";
+    version = "15.1.11";
  };
  coderay = {
    groups = [ "default" ];
@@ -416,10 +415,20 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1aymcakhzl83k77g2f2krz07bg1cbafbcd2ghvwr4lky3rz86mkb";
+      sha256 = "1qfi2ns3zwkgq616fc127xiqhan7g7m7gqpwriwcr34nds1vxwdj";
      type = "gem";
    };
-    version = "1.3.6";
+    version = "1.3.8";
+  };
+  connection_pool = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "02ifws3c4x7b54fv17sm4cca18d2pfw1saxpdji2lbd1f6xgbzrk";
+      type = "gem";
+    };
+    version = "3.0.2";
  };
  cookbook-omnifetch = {
    dependencies = [ "mixlib-archive" ];
@@ -438,10 +447,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0mxznj53rlcg9bcycf5i6jximl1b5mdhm4x0k0wfb8xa79zz57cv";
+      sha256 = "0qwm9zl1l94pdvjfjgh0a36pv59ipmgw9j6hvqm2rqlibk4fa42w";
      type = "gem";
    };
-    version = "8.6.10";
+    version = "8.7.6";
  };
  corefoundation = {
    dependencies = [ "ffi" ];
@@ -449,20 +458,20 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "14rgy3d636l9zy7zmw04j7pjkf3bn41vx7kb265l4zhxrik7gh19";
+      sha256 = "0wsyl0napnccy68jl3s0bivkf4n2xkan8rhadd5g2q27m0lnqv93";
      type = "gem";
    };
-    version = "0.3.13";
+    version = "0.3.19";
  };
  csv = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0gz7r2kazwwwyrwi95hbnhy54kwkfac5swh2gy5p5vw36fn38lbf";
+      sha256 = "0mj4kq4wwpc7c8ll52q30hsir1jrcd5kq7yb8lyz0rksa1z1x9mb";
      type = "gem";
    };
-    version = "3.3.5";
+    version = "3.3.6";
  };
  date = {
    groups = [ "default" ];
@@ -534,10 +543,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "077n5ss3z3ds4vj54w201kd12smai853dp9c9n7ii7g3q7nwwg54";
+      sha256 = "0y7j6yzv07zggic6g0p2v1ivnvkzsbqjnfdl4215qqb6cxz290hq";
      type = "gem";
    };
-    version = "2.14.1";
+    version = "2.14.3";
  };
  faraday-follow_redirects = {
    dependencies = [ "faraday" ];
@@ -567,10 +576,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0v4hfmc7d4lrqqj2wl366rm9551gd08zkv2ppwwnjlnkc217aizi";
+      sha256 = "125m3qri52vwh5v9dhq0dkqxf8629cxrf99yyc01pva72wasyy0f";
      type = "gem";
    };
-    version = "3.4.2";
+    version = "3.4.4";
  };
  ffi = {
    groups = [ "default" ];
@@ -594,18 +603,15 @@
    version = "1.1.14";
  };
  ffi-yajl = {
-    dependencies = [
-      "libyajl2"
-      "yajl"
-    ];
+    dependencies = [ "libyajl2" ];
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "04m8c2bp7hgw2b1zrwanalkh1s2smyv2nl84vw0dzsn0253pca06";
+      sha256 = "1nzlzlyhppjpq3yq69nm9bxb5iz6650ahbvvfxfihn1nkpwgsrbb";
      type = "gem";
    };
-    version = "2.7.7";
+    version = "2.7.11";
  };
  fuzzyurl = {
    groups = [ "default" ];
@@ -755,20 +761,20 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1b1rabz30grash5wh0lcv109w2ggggmmbclwnajqrcdk7wrps2k7";
+      sha256 = "10q54a0dkm0050n0zzqiv2ln8w931wszybbhym1i8r4mbpvkv90k";
      type = "gem";
    };
-    version = "2.19.4";
+    version = "2.21.1";
  };
  language_server-protocol = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1k0311vah76kg5m6zr7wmkwyk5p2f9d9hyckjpn3xgr83ajkj7px";
+      sha256 = "1w5p8c2145lmqzr25bxh4ikzjm6k8y1k5lriqqdpw9pq730w1wjy";
      type = "gem";
    };
-    version = "3.17.0.5";
+    version = "3.17.0.6";
  };
  libyajl2 = {
    groups = [ "default" ];
@@ -869,10 +875,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1k28j6ww8rf43r5i8278jvm2cq3pnzsvqm7yqpb4p93kadjlq726";
+      sha256 = "03vkd9g09jnxsp8mdacvjbplrrqfl5l26n50kd4kdn49zghi326d";
      type = "gem";
    };
-    version = "3.2026.0414";
+    version = "3.2026.0701";
  };
  minitar = {
    groups = [ "default" ];
@@ -943,10 +949,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "126k9zgxwj726gi0q0ywj4kdzf1gfm8z16i1nn7dw9kmn3imxpqf";
+      sha256 = "032z85m9w8kpf232xspd9r8im6wwq4lj2s7df642m4lhdid6r2kw";
      type = "gem";
    };
-    version = "3.3.9";
+    version = "3.4.10";
  };
  molinillo = {
    groups = [ "default" ];
@@ -963,10 +969,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0vfaab23d85617ps412ydb8ap4ci1sfzi8ainn8yyifc0pl38f9g";
+      sha256 = "1040lr5y2phn7avdyam6zw6ikprlmk77biw3yhclsfwfh0qnl4p6";
      type = "gem";
    };
-    version = "1.20.1";
+    version = "1.21.1";
  };
  multipart-post = {
    groups = [ "default" ];
@@ -1013,6 +1019,17 @@
    };
    version = "0.9.1";
  };
+  net-http-persistent = {
+    dependencies = [ "connection_pool" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1rk03449disq3azyiymv1c3qnpqr6cxawgq556rkf5b9klqyhggg";
+      type = "gem";
+    };
+    version = "4.0.8";
+  };
  net-protocol = {
    dependencies = [ "timeout" ];
    groups = [ "default" ];
@@ -1051,10 +1068,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1m1d6rs40rjvdb6df34fi3za1c2ajdiydv4jzpjj03iq7hhrw0k5";
+      sha256 = "0sp8hvrk1jkkb3wpizhrkkl0s8agglwjj3f0dvvcw7f5n9cfy7c3";
      type = "gem";
    };
-    version = "7.3.2";
+    version = "7.3.3";
  };
  netrc = {
    groups = [ "default" ];
@@ -1067,15 +1084,18 @@
    version = "0.11.0";
  };
  nori = {
-    dependencies = [ "bigdecimal" ];
+    dependencies = [
+      "bigdecimal"
+      "stringio"
+    ];
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0qb84bbi74q0zgs09sdkq750jf2ri3lblbry0xi4g1ard4rwsrk1";
+      sha256 = "01p6ns6fxrjba8q8yj624pjqmh0wmgcf9hk64k1n4gyb1i115pbj";
      type = "gem";
    };
-    version = "2.7.1";
+    version = "2.9.1";
  };
  ohai = {
    dependencies = [
@@ -1097,10 +1117,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0n3prpm36kxxk0jx8qs90gj72382jw7az9rnqnaa88c35793ypx1";
+      sha256 = "0yzdjp8ljl80m8yvvv2nmsw08crzyr4rxhqm2c3978f2p8pcx6pa";
      type = "gem";
    };
-    version = "19.1.24";
+    version = "19.1.40";
  };
  ostruct = {
    groups = [ "default" ];
@@ -1131,10 +1151,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0m2xqvn1la62hji1mn04y59giikww95p2hs0r4y2rrz3mdxcwyni";
+      sha256 = "0a4q5h2hcihk79dbr20scgkm56l79qp7fsvfvkxlv8nmapvxg9i1";
      type = "gem";
    };
-    version = "3.3.11.1";
+    version = "3.3.12.0";
  };
  parslet = {
    groups = [ "default" ];
@@ -1405,10 +1425,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0pxzipl8a1bv62jdfykh7j4ymdr4aiffjvwsny6drwv886jwx4jn";
+      sha256 = "0ca5inh368d4l24a2v2nbd3p4xc6s0pqs91j27h226nh04zmyha4";
      type = "gem";
    };
-    version = "1.84.2";
+    version = "1.86.1";
  };
  rubocop-ast = {
    dependencies = [
@@ -1419,10 +1439,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0dahfpnzz63hyqxa03x8rypnrxzwyvh4i5a8ri34bzpnf3pg64j4";
+      sha256 = "1nw84xk6vc2ls8sxqvyhxs2agh4l0jrws85d4bi3x0501lq8ijmr";
      type = "gem";
    };
-    version = "1.49.1";
+    version = "1.50.0";
  };
  ruby-progressbar = {
    groups = [ "default" ];
@@ -1499,6 +1519,16 @@
    };
    version = "1.3.1";
  };
+  stringio = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1q92y9627yisykyscv0bdsrrgyaajc2qr56dwlzx7ysgigjv4z63";
+      type = "gem";
+    };
+    version = "3.2.0";
+  };
  strings = {
    dependencies = [
      "strings-ansi"
@@ -1581,10 +1611,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "00x5y9h4fbvrv4xrjk4cqlkm4vq8gv73ax4alj3ac2x77zsnnrk8";
+      sha256 = "168v339gqaly00i4zqg2ag2h10r3rl7999d0cqrrpb63gaa7fbr6";
      type = "gem";
    };
-    version = "1.3.0";
+    version = "2.0.4";
  };
  train-core = {
    dependencies = [
@@ -1599,10 +1629,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1vz9ylinr4fbca7ab7ipv57hxd988a13b0vlwrhlxhckdaf215cg";
+      sha256 = "151a6vqgq64gx3d4xqaacdvsvjpakkqsfll7yyrjpkkv4f4bzvi9";
      type = "gem";
    };
-    version = "3.16.2";
+    version = "3.16.5";
  };
  train-rest = {
    dependencies = [
@@ -1770,31 +1800,35 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0jrl2vkdvc5aq8q3qvjmmrgjxfm784w8h7fal19qg7q7gh9msj1l";
+      sha256 = "1ijpbj7mdrq7rhpq2kb51yykhrs2s54wfs6sm9z3icgz4y6sb7rp";
      type = "gem";
    };
-    version = "1.0.4";
+    version = "1.1.1";
  };
  uuidtools = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0s8h35ia80p919kidb66nfp8904rhdmn41z9ghsx4ihp2ild3bn4";
+      sha256 = "1s2b78aknm6wjjqxx5schqwxnlhj017brs2vcwn553vj1v9d98s7";
      type = "gem";
    };
-    version = "2.2.0";
+    version = "3.0.0";
  };
  vault = {
-    dependencies = [ "aws-sigv4" ];
+    dependencies = [
+      "aws-sigv4"
+      "base64"
+      "net-http-persistent"
+    ];
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0z6j8s8cdmkbwzfis3dpk5dm91zi5fasids8npzrxhb4hcnnqd19";
+      sha256 = "0q6nf7akv6ykvpr0dz1sk2fpsxqdiihzg4pafp4j2pzap7lfv70n";
      type = "gem";
    };
-    version = "0.18.2";
+    version = "0.20.1";
  };
  webrick = {
    groups = [ "default" ];
@@ -1826,14 +1860,4 @@
    };
    version = "1.0.7";
  };
-  yajl = {
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1r1i0jjxbnnll8336y144sphn1cdns5n8ygb31z826i6xirq8w8d";
-      type = "gem";
-    };
-    version = "0.3.4";
-  };
 }
--- a/pkgs/by-name/co/concord-tui/package.nix
+++ b/pkgs/by-name/co/concord-tui/package.nix
@@ -2,36 +2,48 @@
  rustPlatform,
  fetchFromGitHub,
  pkg-config,
+  makeWrapper,
+  nasm,
  alsa-lib,
-  cmake,
  opus,
+  pipewire,
  lib,
  stdenv,
  nix-update-script,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "concord-tui";
-  version = "2.4.5";
+  version = "2.5.0";

  src = fetchFromGitHub {
    owner = "chojs23";
    repo = "concord";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-BLfNgIXTTYMr5pFmCBMfu4euKR96GAPLsGTW/AaqJjo=";
+    hash = "sha256-DkbZZlURGwQCajhWmkcYmgFZDLvUOg6aU/JjGRiZY4Y=";
  };

-  cargoHash = "sha256-jaHDy/5e9BXXLRe3oc9g3JCCSg28bb1d2dMPkPJTkB4=";
+  cargoHash = "sha256-ISWQjHUPoYPgMu+aJUDlLjp5AahauHG9BuOAANMXKRA=";

  buildInputs = [
    opus
  ]
  ++ lib.optionals stdenv.hostPlatform.isLinux [
    alsa-lib
+    pipewire
  ];
  nativeBuildInputs = [
    pkg-config
-    cmake
-  ];
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    rustPlatform.bindgenHook
+    makeWrapper
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isx86_64 [ nasm ];
+
+  postFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
+    wrapProgram "$out/bin/concord" \
+      --set-default PIPEWIRE_CONFIG_DIR "${pipewire}/share/pipewire"
+  '';

  __darwinAllowLocalNetworking = true;

--- a/pkgs/by-name/co/containeryard/package.nix
+++ b/pkgs/by-name/co/containeryard/package.nix
@@ -0,0 +1,36 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "containeryard";
+  version = "0.3.12";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "mcmah309";
+    repo = "containeryard";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-jXjr8y8QorpFamLIFVb3vJMH0FUrk2jZraxKtgdLev4=";
+  };
+
+  cargoHash = "sha256-VbIY7SF8imVTEGbQT2QI+lbPtkbfbGXJZVukVQvHX+E=";
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+
+  meta = {
+    description = "Declarative, reproducible, and reusable decentralized approach for defining containers";
+    homepage = "https://github.com/mcmah309/containeryard";
+    changelog = "https://github.com/mcmah309/containeryard/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.linux;
+    maintainers = [ lib.maintainers.mcmah309 ];
+    mainProgram = "yard";
+  };
+})
--- a/pkgs/by-name/cr/cryptop/package.nix
+++ b/pkgs/by-name/cr/cryptop/package.nix
@@ -1,25 +1,30 @@
 {
  lib,
  python3Packages,
-  fetchPypi,
+  fetchFromGitHub,
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "cryptop";
  version = "0.2.0";
-  format = "setuptools";
+  pyproject = true;
+  __structuredAttrs = true;

-  src = fetchPypi {
-    inherit (finalAttrs) pname version;
-    sha256 = "0akrrz735vjfrm78plwyg84vabj0x3qficq9xxmy9kr40fhdkzpb";
+  src = fetchFromGitHub {
+    owner = "huwwp";
+    repo = "cryptop";
+    tag = "v.${finalAttrs.version}";
+    hash = "sha256-lrHTtTQJ9Zuspt+LRT9WjmCruhwms6FUM3EFo6PZ26A=";
  };

-  propagatedBuildInputs = with python3Packages; [
+  build-system = with python3Packages; [ setuptools ];
+
+  dependencies = with python3Packages; [
    setuptools
    requests
    requests-cache
  ];

-  # No tests in archive
+  # No tests
  doCheck = false;

  meta = {
--- a/pkgs/by-name/cy/cyclonedx-python/package.nix
+++ b/pkgs/by-name/cy/cyclonedx-python/package.nix
@@ -6,14 +6,14 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "cyclonedx-python";
-  version = "7.3.0";
+  version = "7.3.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "CycloneDX";
    repo = "cyclonedx-python";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-mBOkSgHGKc77zhcMmdsrlZLXsK2t00VFiGW5eSN2lxc=";
+    hash = "sha256-BBnWnxhi7vDfzdFdimncy8u3djW2K3TooYxNBnAkEf8=";
  };

  build-system = with python3Packages; [ poetry-core ];
--- a/pkgs/by-name/da/datadog-pup/package.nix
+++ b/pkgs/by-name/da/datadog-pup/package.nix
@@ -10,7 +10,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "datadog-pup";
-  version = "1.8.0";
+  version = "1.10.0";

  __structuredAttrs = true;
  strictDeps = true;
@@ -19,10 +19,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "DataDog";
    repo = "pup";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-8leLUaoce3i4i2asd0tzhbM4mXAOkn/rdNIaGLLCfko=";
+    hash = "sha256-AmuTNMepJx5NQwkVkDrf0tQIssmUAHmlBF73WG1RJSY=";
  };

-  cargoHash = "sha256-+F5P2tOLGSjABD4B0MG84x1uVI4o06Kl1nZfOS7tP1Y=";
+  cargoHash = "sha256-vufZmhqXpaRD8AWAvFLolqeyPqBB1yD4oyZplWiJ5tA=";

  checkType = "debug";
  dontUseCargoParallelTests = true;
--- a/pkgs/by-name/do/dovi-tool/package.nix
+++ b/pkgs/by-name/do/dovi-tool/package.nix
@@ -17,16 +17,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "dovi-tool";
-  version = "2.3.2";
+  version = "2.3.3";

  src = fetchFromGitHub {
    owner = "quietvoid";
    repo = "dovi_tool";
    tag = finalAttrs.version;
-    hash = "sha256-8UG3p84wjuPpnwcz65dyDbLDaoFXtokxNvnldBZHqwc=";
+    hash = "sha256-oXHXt1u1zxWti22tT4nJQhVdCtIshKrlve8896QQg84=";
  };

-  cargoHash = "sha256-nr2F+QZurNN/iCFW62LZaheZkuCGId4TSRuYd1yYH88=";
+  cargoHash = "sha256-rJw9fEZ696N8xsFXCL5GWIuLYPXKp2K0WqFxbM1iGiw=";

  nativeBuildInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) [
    pkg-config
@@ -54,7 +54,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
  versionCheckProgram = "${placeholder "out"}/bin/dovi_tool";
  doInstallCheck = true;

-  passthru.updateScript = nix-update-script { };
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "^(?!libdovi-)(.*)$"
+    ];
+  };

  meta = {
    description = "CLI tool combining multiple utilities for working with Dolby Vision";
--- a/pkgs/by-name/dw/dwm/package.nix
+++ b/pkgs/by-name/dw/dwm/package.nix
@@ -18,11 +18,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "dwm";
-  version = "6.6";
+  version = "6.8";

  src = fetchzip {
    url = "https://dl.suckless.org/dwm/dwm-${finalAttrs.version}.tar.gz";
-    hash = "sha256-fD97OpObSOBTAMc3teejS0u2h4hCkMVYJrNZ6F4IaFs=";
+    hash = "sha256-mkMFmqV9NVGTdDGqW8f+T7r0YQNU1KDsn6uRcacoNco=";
  };

  nativeBuildInputs = lib.optional stdenv.hostPlatform.isStatic pkg-config;
@@ -74,5 +74,8 @@ stdenv.mkDerivation (finalAttrs: {
    license = lib.licenses.mit;
    platforms = lib.platforms.all;
    mainProgram = "dwm";
+    maintainers = with lib.maintainers; [
+      gepbird
+    ];
  };
 })
--- a/pkgs/by-name/er/ergohaven-entropy/package.nix
+++ b/pkgs/by-name/er/ergohaven-entropy/package.nix
@@ -0,0 +1,140 @@
+{
+  lib,
+  rustPlatform,
+  pkg-config,
+  makeWrapper,
+  makeDesktopItem,
+  copyDesktopItems,
+  iconConvTools,
+  hidapi,
+  systemd,
+  libxcb,
+  libxkbcommon,
+  xkeyboard-config,
+  openssl,
+  gtk3,
+  libglvnd,
+  libx11,
+  libxrandr,
+  wayland,
+  stdenv,
+  fetchFromGitHub,
+  python3,
+  ibus,
+  glib,
+}:
+
+let
+  python = python3.withPackages (
+    ps: with ps; [
+      pygobject3
+      (toPythonModule ibus)
+    ]
+  );
+in
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "ergohaven-entropy";
+  version = "0.3.1";
+
+  src = fetchFromGitHub {
+    owner = "ergohaven";
+    repo = "entropy";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ibU379pT0/u6xsIOfgK7KjIlmoyoN9+G3J1T2rYwc44=";
+  };
+
+  cargoHash = "sha256-e2bLlqH+2Cv4LBV+JooupcXDUe83NmiFI4zPNMTEW3A=";
+
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    makeWrapper
+    copyDesktopItems
+    iconConvTools
+    python
+  ];
+
+  buildInputs = [
+    hidapi
+    systemd
+    libxcb
+    libxkbcommon
+    openssl
+    gtk3
+    libglvnd
+    libx11
+    libxrandr
+    wayland
+    xkeyboard-config
+  ];
+
+  env = lib.optionalAttrs stdenv.cc.isGNU {
+    NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
+  };
+
+  desktopItems = lib.singleton (makeDesktopItem {
+    name = "entropy";
+    exec = "entropy";
+    icon = "entropy";
+    desktopName = "Entropy";
+    comment = "Configure programmable keyboards and input devices";
+    categories = [
+      "Settings"
+      "HardwareSettings"
+    ];
+  });
+
+  postInstall = ''
+    mkdir -p $out/lib/udev/rules.d
+    cat > $out/lib/udev/rules.d/59-vial.rules << RULES
+    KERNEL=="hidraw*", SUBSYSTEM=="hidraw", ATTRS{serial}=="*vial:f64c2b3c*", MODE="0660", GROUP="plugdev", TAG+="uaccess"
+    RULES
+
+    icoFileToHiColorTheme $src/assets/entropy.ico entropy $out
+
+    install -Dm755 $src/linux/ibus/entropy-ibus-engine $out/share/entropy/ibus/entropy-ibus-engine
+    mkdir -p $out/share/ibus/component
+    substitute $src/linux/ibus/entropy-universal-symbols.xml.in \
+      $out/share/ibus/component/entropy-universal-symbols.xml \
+      --replace-fail "@ENGINE_PATH@" "$out/share/entropy/ibus/entropy-ibus-engine"
+
+    wrapProgram $out/bin/entropy \
+      --prefix LD_LIBRARY_PATH : ${
+        lib.makeLibraryPath [
+          wayland
+          libglvnd
+          libxkbcommon
+        ]
+      } \
+      --set XKB_CONFIG_ROOT ${xkeyboard-config}/share/X11/xkb
+  '';
+
+  postFixup = ''
+    patchShebangs --build $out/share/entropy/ibus/entropy-ibus-engine
+    wrapProgram $out/share/entropy/ibus/entropy-ibus-engine \
+      --prefix GI_TYPELIB_PATH : ${
+        lib.makeSearchPath "lib/girepository-1.0" [
+          glib
+          ibus
+        ]
+      }
+  '';
+
+  meta = {
+    description = "Modern app for programmable keyboards and input devices";
+    longDescription = ''
+      Entropy is a desktop app with a modern, minimalist, and intuitive
+      interface for configuring programmable input devices running Vial-QMK
+      or Vial-RMK firmware: split keyboards, macropads, trackballs, touchpad
+      modules, and other hardware that exposes keyboard-style firmware
+      features through HID.
+    '';
+    homepage = "https://github.com/ergohaven/entropy";
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ geekiot-hub ];
+    mainProgram = "entropy";
+  };
+})
--- a/pkgs/by-name/fa/fairywren/package.nix
+++ b/pkgs/by-name/fa/fairywren/package.nix
@@ -22,13 +22,13 @@ lib.checkListOfEnum "${pname}: colorVariants" colorVariantList colorVariants
  stdenvNoCC.mkDerivation
  {
    inherit pname;
-    version = "0-unstable-2026-05-31";
+    version = "0-unstable-2026-07-21";

    src = fetchFromGitLab {
      owner = "FreshDoctor";
      repo = "FairyWren-Icons";
-      rev = "8037795e0b9075bc2b00b0a0bf350d633ac93897";
-      hash = "sha256-rBtCdO163tNMM6iCnjts9Ut2hhZ4e3ZYnpCv4BykCms=";
+      rev = "6d578aac69b897ca4afa3bc0981cb93fa0e0df4c";
+      hash = "sha256-vvE5p8l7K2jI5tw8tfX3WnjGSCVElZHB5PFX3gdT3lk=";
    };

    propagatedBuildInputs = [
--- a/pkgs/by-name/fl/flexget/package.nix
+++ b/pkgs/by-name/fl/flexget/package.nix
@@ -7,14 +7,14 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "flexget";
-  version = "3.19.30";
+  version = "3.19.31";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "Flexget";
    repo = "Flexget";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-LfitvBEg9qjv6glIK9KbttM/5nSnKA0i8+Q8gCNMVx8=";
+    hash = "sha256-5YGFG+ZeD0N1+U3jXXRLB1svYJWknRF7jn5oji0UHvI=";
  };

  pythonRelaxDeps = true;
--- a/pkgs/by-name/fl/flow-control/build.zig.zon.nix
+++ b/pkgs/by-name/fl/flow-control/build.zig.zon.nix
@@ -1,254 +0,0 @@
-# generated by zon2nix (https://github.com/Cloudef/zig2nix)
-
-{
-  lib,
-  linkFarm,
-  fetchurl,
-  fetchgit,
-  runCommandLocal,
-  zig,
-  name ? "zig-packages",
-}:
-
-let
-  unpackZigArtifact =
-    { name, artifact }:
-    runCommandLocal name { nativeBuildInputs = [ zig ]; } ''
-      hash="$(zig fetch --global-cache-dir "$TMPDIR" ${artifact})"
-      mv "$TMPDIR/p/$hash" "$out"
-      chmod 755 "$out"
-    '';
-
-  fetchZig =
-    {
-      name,
-      url,
-      hash,
-    }:
-    let
-      artifact = fetchurl { inherit url hash; };
-    in
-    unpackZigArtifact { inherit name artifact; };
-
-  fetchGitZig =
-    {
-      name,
-      url,
-      hash,
-      rev ? throw "rev is required, remove and regenerate the zon2json-lock file",
-    }:
-    let
-      parts = lib.splitString "#" url;
-      url_base = lib.elemAt parts 0;
-      url_without_query = lib.elemAt (lib.splitString "?" url_base) 0;
-    in
-    fetchgit {
-      inherit name rev hash;
-      url = url_without_query;
-      deepClone = false;
-    };
-
-  fetchZigArtifact =
-    {
-      name,
-      url,
-      hash,
-      ...
-    }@args:
-    let
-      parts = lib.splitString "://" url;
-      proto = lib.elemAt parts 0;
-      path = lib.elemAt parts 1;
-      fetcher = {
-        "git+http" = fetchGitZig (
-          args
-          // {
-            url = "http://${path}";
-          }
-        );
-        "git+https" = fetchGitZig (
-          args
-          // {
-            url = "https://${path}";
-          }
-        );
-        http = fetchZig {
-          inherit name hash;
-          url = "http://${path}";
-        };
-        https = fetchZig {
-          inherit name hash;
-          url = "https://${path}";
-        };
-      };
-    in
-    fetcher.${proto};
-in
-linkFarm name [
-  {
-    name = "flow_syntax-0.6.0-X8jOoWgVAQBBTuGGE9r1ECSDFzi8z6_XNCW1oF5B4fL8";
-    path = fetchZigArtifact {
-      name = "syntax";
-      url = "git+https://github.com/neurocyte/flow-syntax?ref=master#6992eddeb9a4a013886db0cbca2156686d01efe4";
-      hash = "sha256-TJJTGiQbdzVNQAjKg9R1NP9kXqEcMNy33rwqnQG8se4=";
-      rev = "6992eddeb9a4a013886db0cbca2156686d01efe4";
-    };
-  }
-  {
-    name = "tree_sitter-0.22.4-150-g7e3f5726-z0LhyGeG1y67PeOltaplVkxRNT2jMMexQhbUlrh0vdxM";
-    path = fetchZigArtifact {
-      name = "tree_sitter";
-      url = "https://github.com/neurocyte/tree-sitter/releases/download/master-6e2827ee231e220467bf04d2a2746faff5cb204a/source.tar.gz";
-      hash = "sha256-k8eOWun2ANzWJOa8XAakXN4Vldgwzly3FESYAlsbVVw=";
-    };
-  }
-  {
-    name = "cbor-1.0.0-RcQE_AswAQAPlqBCZXYQf9DZXn-0Ubt8Mk03ZcJWcsAG";
-    path = fetchZigArtifact {
-      name = "cbor";
-      url = "git+https://github.com/neurocyte/cbor?ref=master#7d2eeb68c8a2fb3f4d6baad6cc04c521b92974c0";
-      hash = "sha256-EWOz+BPxRB5NxmqNzrJcdcaoGH6PdgeU4KI9IjJqar8=";
-      rev = "7d2eeb68c8a2fb3f4d6baad6cc04c521b92974c0";
-    };
-  }
-  {
-    name = "flags-0.10.0-a_9h3gB4AADAYn0XaZuUqH1jKRmy6dqvAIbomtTIF6V1";
-    path = fetchZigArtifact {
-      name = "flags";
-      url = "git+https://github.com/neurocyte/flags?ref=main#984b27948da3e4e40a253f76c85b51ec1a9ada11";
-      hash = "sha256-PnR8RI1Rp1FxtjzBYcLCWi6zXykSsHVYnNkmI2XVxh4=";
-      rev = "984b27948da3e4e40a253f76c85b51ec1a9ada11";
-    };
-  }
-  {
-    name = "dizzy-1.0.0-q40X4YCRAAAGYO9QOZiYYSOwiiFlqZlecMuQcxPiBcXM";
-    path = fetchZigArtifact {
-      name = "dizzy";
-      url = "https://github.com/neurocyte/dizzy/archive/c9219d23daccd9aa226cfde754fea278cb516459.tar.gz";
-      hash = "sha256-lFtDVVlIYt/5lCCTTOEfEFd8w1osV8JSvreMmK3YtIc=";
-    };
-  }
-  {
-    name = "libfuzzer_kit-0.0.0-i7XWVl2PBwC3r18KoW8xTU05KyWEMj6RfBpAXd3CQqt7";
-    path = fetchZigArtifact {
-      name = "libfuzzer_kit";
-      url = "git+https://github.com/SuperAuguste/zig-libfuzzer-kit.git#a27221dda33b232e65504766294ea4c7c079c3f0";
-      hash = "sha256-yxhiP2kJYli5VjF0uMJcDM0ByFIRmSxnwnMy0JwQxmU=";
-      rev = "a27221dda33b232e65504766294ea4c7c079c3f0";
-    };
-  }
-  {
-    name = "thespian-0.0.1-owFOjlgiBgC8w4XqkCOegxz5vMy6kNErcssWQWf2QHeE";
-    path = fetchZigArtifact {
-      name = "thespian";
-      url = "git+https://github.com/neurocyte/thespian?ref=master#7da13f44e8462d1ac0cac87c6f00cc4fcb62b0f9";
-      hash = "sha256-FDrgVtZQg+sFsMYE2TGOv1Xl6QqzE8+WtuKRulVnKjo=";
-      rev = "7da13f44e8462d1ac0cac87c6f00cc4fcb62b0f9";
-    };
-  }
-  {
-    name = "cbor-1.0.0-RcQE_HwwAQAiNkKC9ezLxHUMkWgHeVa3QyTfv4hi3VZR";
-    path = fetchZigArtifact {
-      name = "cbor";
-      url = "git+https://github.com/neurocyte/cbor?ref=master#b6fc137250b7d3f70459652ee78c7b6cd9ad2826";
-      hash = "sha256-axyiz0+WqM9HCz9xbyl/UtdwJsKC/LIiQPZn/SdzxDU=";
-      rev = "b6fc137250b7d3f70459652ee78c7b6cd9ad2826";
-    };
-  }
-  {
-    name = "asio-1.30.2-tLhDd0SB4QB1041_DEW_1cvEw8eMfBYLAwjN_G53Fn66";
-    path = fetchZigArtifact {
-      name = "asio";
-      url = "git+https://github.com/neurocyte/asio#0f1cbf24e5fb6fabe7078a20b76452f42e24a0df";
-      hash = "sha256-H3y7CTAlEpl0y3ERrNht8KabDRqvNDE+MzK4Uud2wAQ=";
-      rev = "0f1cbf24e5fb6fabe7078a20b76452f42e24a0df";
-    };
-  }
-  {
-    name = "zig_tracy-0.0.3-5-cp3Ht3AAAfHqShKfTK7waFK3Wjd3l2NheiqxvRRAdo";
-    path = fetchZigArtifact {
-      name = "tracy";
-      url = "git+https://github.com/neurocyte/zig-tracy#67070c146104d93fd3bed5091738f22e33e13bce";
-      hash = "sha256-YcSgPAQo/4+mrKkJS5UAn7z5xZjeb8kKIWrBK3yXhQ4=";
-      rev = "67070c146104d93fd3bed5091738f22e33e13bce";
-    };
-  }
-  {
-    name = "N-V-__8AAO2QjgFRswZWFwtGKFgOVx2Ysf5F18DVgbwtReiU";
-    path = fetchZigArtifact {
-      name = "tracy_src";
-      url = "https://github.com/neurocyte/tracy/archive/0ff0a1b324f497cf313a445637b7df25aabefb47.tar.gz";
-      hash = "sha256-dzMilJsOSdjNyvhyDb1v5dPWcR5uvhnQmsBynAJH74I=";
-    };
-  }
-  {
-    name = "N-V-__8AAOKzJACguNxU76WX9M7RIhOYGuLnlasJ1-GDdhqT";
-    path = fetchZigArtifact {
-      name = "themes";
-      url = "https://github.com/neurocyte/flow-themes/releases/download/master-c6c7f18cfb2e3945cd0b71dab24271465074dbc3/flow-themes.tar.gz";
-      hash = "sha256-h4oVrZqXwsQa57ywc8Ez7c2Fur4MhyJ8xyRTpKUJh9E=";
-    };
-  }
-  {
-    name = "fuzzig-0.1.1-Ji0xivxIAQBD0g8O_NV_0foqoPf3elsg9Sc3pNfdVH4D";
-    path = fetchZigArtifact {
-      name = "fuzzig";
-      url = "https://github.com/fjebaker/fuzzig/archive/4251fe4230d38e721514394a485db62ee1667ff3.tar.gz";
-      hash = "sha256-VBkKxu+JdPzYRvANLX4/o3Mgl3Ojt1so99D8VNrSbTA=";
-    };
-  }
-  {
-    name = "vaxis-0.5.1-BWNV_PJJCQArtOy_n76jGWoqoBpnM5FKElA_i1IaYYcF";
-    path = fetchZigArtifact {
-      name = "vaxis";
-      url = "git+https://github.com/neurocyte/libvaxis?ref=main#95034c7114601178467b42e69588cdd4c1d39eb1";
-      hash = "sha256-IuToUtK3WdoOy+UzYy5OlXNR5E3DUSO5VwZvSIF28qc=";
-      rev = "95034c7114601178467b42e69588cdd4c1d39eb1";
-    };
-  }
-  {
-    name = "zigimg-0.1.0-8_eo2vUZFgAAtN1c6dAO5DdqL0d4cEWHtn6iR5ucZJti";
-    path = fetchZigArtifact {
-      name = "zigimg";
-      url = "git+https://github.com/zigimg/zigimg#eab2522c023b9259db8b13f2f90d609b7437e5f6";
-      hash = "sha256-e42T/ZmRzuzWAhwWkcWScukcOd6rNZ1VK1wk0XGTVKs=";
-      rev = "eab2522c023b9259db8b13f2f90d609b7437e5f6";
-    };
-  }
-  {
-    name = "uucode-0.1.0-ZZjBPj96QADXyt5sqwBJUnhaDYs_qBeeKijZvlRa0eqM";
-    path = fetchZigArtifact {
-      name = "uucode";
-      url = "git+https://github.com/jacobsandlund/uucode#5f05f8f83a75caea201f12cc8ea32a2d82ea9732";
-      hash = "sha256-sHPh+TQSdUGus/QTbj7KSJJkTuNTrK4VNmQDjS30Lf8=";
-      rev = "5f05f8f83a75caea201f12cc8ea32a2d82ea9732";
-    };
-  }
-  {
-    name = "zeit-0.6.0-5I6bk0J9AgCVa0nnyL0lNY9Xa9F68hHq-ZarhuXNV-Jb";
-    path = fetchZigArtifact {
-      name = "zeit";
-      url = "git+https://github.com/rockorager/zeit?ref=zig-0.15#ed2ca60db118414bda2b12df2039e33bad3b0b88";
-      hash = "sha256-IvXaqAzaWi3E1XBqQltCBFoRmXehZkVol3/RZwOsAKg=";
-      rev = "ed2ca60db118414bda2b12df2039e33bad3b0b88";
-    };
-  }
-  {
-    name = "zigwin32-25.0.28-preview-AAAAAICM5AMResOGQnQ85mfe60TTOQeMtt7GRATUOKoP";
-    path = fetchZigArtifact {
-      name = "win32";
-      url = "git+https://github.com/marlersoft/zigwin32?ref=main#5587b16fa040573846a6bf531301f6206d31a6bf";
-      hash = "sha256-GIH6aO8yEWKKvIr4syG6aYViXi2whIg4feWox7f9ZSM=";
-      rev = "5587b16fa040573846a6bf531301f6206d31a6bf";
-    };
-  }
-  {
-    name = "diffz-0.0.1-G2tlIezMAQBwGNGDs7Hn_N25dWSjEzgR_FAx9GFAvCuZ";
-    path = fetchZigArtifact {
-      name = "diffz";
-      url = "git+https://github.com/ziglibs/diffz.git#fbdf690b87db6b1142bbce6d4906f90b09ce60bb";
-      hash = "sha256-zzKnlKQ0Sz8aqJifSSlZImU3jY3QXLBDIfVDBmKcpVc=";
-      rev = "fbdf690b87db6b1142bbce6d4906f90b09ce60bb";
-    };
-  }
-]
--- a/pkgs/by-name/fl/flow-control/package.nix
+++ b/pkgs/by-name/fl/flow-control/package.nix
@@ -3,9 +3,11 @@
  fetchFromGitHub,
  stdenv,
  zig_0_15,
-  callPackage,
+  nix-update-script,
 }:
-
+let
+  zig = zig_0_15;
+in
 stdenv.mkDerivation (finalAttrs: {
  pname = "flow-control";
  version = "0.7.2";
@@ -17,24 +19,29 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-5+F0DKb4LXtcMXNutUSJuIe7cdBoFUoJhCs8vbm20jg=";
  };

-  deps = callPackage ./build.zig.zon.nix {
-    zig = zig_0_15;
+  zigDeps = zig.fetchDeps {
+    inherit (finalAttrs) src pname version;
+    fetchAll = true;
+    hash = "sha256-+07sJAnfB+mKziC5j8QfbL/YzjvRLxqRvpuxGKK7/nA=";
  };

-  nativeBuildInputs = [ zig_0_15 ];
+  nativeBuildInputs = [ zig ];

-  passthru.updateScript = ./update.sh;
+  passthru.updateScript = nix-update-script { };

  dontSetZigDefaultFlags = true;
  zigBuildFlags = [
    "--system"
-    "${finalAttrs.deps}"
+    "${finalAttrs.zigDeps}"
    "-Dcpu=baseline"
    "-Doptimize=ReleaseFast"
  ];

  env.VERSION = finalAttrs.version;

+  __structuredAttrs = true;
+  strictDeps = true;
+
  meta = {
    description = "Programmer's text editor";
    homepage = "https://github.com/neurocyte/flow";
--- a/pkgs/by-name/fl/flow-control/update.sh
+++ b/pkgs/by-name/fl/flow-control/update.sh
@@ -1,20 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p bash wget common-updater-scripts gnused
-
-latest_tag=$(list-git-tags --url=https://github.com/neurocyte/flow | sed 's/^v//' | tail -n 1)
-
-update-source-version flow-control "$latest_tag"
-
-mkdir -p src/syntax
-
-wget "https://raw.githubusercontent.com/neurocyte/flow/v${latest_tag}/build.zig.zon"
-wget -P src/syntax "https://raw.githubusercontent.com/neurocyte/flow/v${latest_tag}/src/syntax/build.zig.zon"
-
-nix --extra-experimental-features 'nix-command flakes' run github:Cloudef/zig2nix#zon2nix -- build.zig.zon
-mv build.zig.zon.nix pkgs/by-name/fl/flow-control/build.zig.zon.nix
-
-# strip file protocol
-sed -i '\|file = unpackZigArtifact { inherit name; artifact = /. + path; };|d' pkgs/by-name/fl/flow-control/build.zig.zon.nix
-nixfmt pkgs/by-name/fl/flow-control/build.zig.zon.nix
-
-rm -rf build.zig.zon build.zig.zon2json-lock src/
--- a/pkgs/by-name/fr/free42/package.nix
+++ b/pkgs/by-name/fr/free42/package.nix
@@ -69,6 +69,7 @@ stdenv.mkDerivation (finalAttrs: {
    make --jobs=$NIX_BUILD_CORES -C gtk AUDIO_ALSA=1
    make -C gtk clean
    make --jobs=$NIX_BUILD_CORES -C gtk AUDIO_ALSA=1 BCD_MATH=1
+    make --jobs=$NIX_BUILD_CORES -C gtk raw2txt txt2raw

    runHook postBuild
  '';
@@ -82,7 +83,7 @@ stdenv.mkDerivation (finalAttrs: {
                        $out/share/icons/hicolor/48x48/apps \
                        $out/share/icons/hicolor/128x128/apps

-    install -m755 gtk/free42dec gtk/free42bin $out/bin
+    install -m755 gtk/free42dec gtk/free42bin gtk/raw2txt gtk/txt2raw $out/bin
    install -m644 README $out/share/doc/free42/README

    install -m644 gtk/icon-48x48.png $out/share/icons/hicolor/48x48/apps/free42.png
--- a/pkgs/by-name/fr/frp/dashboard.nix
+++ b/pkgs/by-name/fr/frp/dashboard.nix
@@ -21,7 +21,7 @@ let
        runHook postInstall
      '';

-      npmDepsHash = "sha256-XuqQPfywzK81anAD1pAl1TMQqb1+hH2QxLwuTn7zCPU=";
+      npmDepsHash = "sha256-CJ8wNJZzzpdT9am40qHMaV66NlRM8ogLnJsrnwtd5zs=";

      meta = frp.meta // {
        description = "Dashboard for frp";
--- a/pkgs/by-name/fr/frp/package.nix
+++ b/pkgs/by-name/fr/frp/package.nix
@@ -10,15 +10,15 @@ let
 in
 buildGoModule (finalAttrs: {
  pname = "frp";
-  version = "0.69.1";
+  version = "0.70.1";
  src = fetchFromGitHub {
    owner = "fatedier";
    repo = "frp";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-3tOOgnzZZ05En5NMLbp4UFNazX950Jbosvszmjf947c=";
+    hash = "sha256-QV+Ti54JIWzBDm6urUSnkMQAxV8eewsIEbVm/hvcx3k=";
  };

-  vendorHash = "sha256-JrkIztnmhEYAogr4pDWrPu9/j+C0VLpEyNbh2UK5UcY=";
+  vendorHash = "sha256-TCXiZP8MpkIRqSAoDviHsIBFQuOdhCWzSvXt84rs+bE=";

  doCheck = false;

--- a/pkgs/by-name/ga/garmin-grafana/package.nix
+++ b/pkgs/by-name/ga/garmin-grafana/package.nix
@@ -1,12 +1,12 @@
 {
+  lib,
  fetchFromGitHub,
  python3Packages,
-  lib,
 }:
+
 python3Packages.buildPythonPackage rec {
  pname = "garmin-grafana";
  version = "0.5.0";
-
  pyproject = true;

  src = fetchFromGitHub {
@@ -16,9 +16,9 @@ python3Packages.buildPythonPackage rec {
    hash = "sha256-NrT4erpdWwqFBUumQdd5GqpmhIayszzkPd8fUgDRwXY=";
  };

-  build-system = with python3Packages; [
-    setuptools
-  ];
+  build-system = with python3Packages; [ setuptools ];
+
+  nativeBuildInputs = with python3Packages; [ pyprojectVersionPatchHook ];

  dependencies = with python3Packages; [
    fitparse
--- a/pkgs/by-name/gh/gh-aw/package.nix
+++ b/pkgs/by-name/gh/gh-aw/package.nix
@@ -6,7 +6,7 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "gh-aw";
-  version = "0.80.9";
+  version = "0.83.1";

  __structuredAttrs = true;

@@ -14,10 +14,10 @@ buildGoModule (finalAttrs: {
    owner = "github";
    repo = "gh-aw";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-2BGFKy/X8j0jYQc+W2rLZmZmPgCvZ+QOZweQaAQQJLM=";
+    hash = "sha256-NJOQGJxj46sqKPVUnGF2m/EFmSXZszHY9FXjjtL2/Cc=";
  };

-  vendorHash = "sha256-jxh8R/X12/QHxZOIKsTvS6FcDQSmJ7RJEvDnJuUr93A=";
+  vendorHash = "sha256-0fbfRPlf+m8lvR40h3d7UtMoDN608MtgZVj3ZX5EyPE=";

  subPackages = [ "cmd/gh-aw" ];

--- a/pkgs/by-name/gi/github-backup/package.nix
+++ b/pkgs/by-name/gi/github-backup/package.nix
@@ -10,14 +10,14 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "github-backup";
-  version = "0.64.2";
+  version = "0.65.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "josegonzalez";
    repo = "python-github-backup";
    tag = finalAttrs.version;
-    hash = "sha256-IO16n+Lx5igICbc0T6Nuir+I/nVBO6qlx+ILVWpYamo=";
+    hash = "sha256-0dcD0fCbjc5O434ApjKDGSpTHMbUQy61/vfQZOcXeJY=";
  };

  build-system = with python3Packages; [
--- a/pkgs/by-name/gl/glab/package.nix
+++ b/pkgs/by-name/gl/glab/package.nix
@@ -13,13 +13,13 @@

 buildGoModule (finalAttrs: {
  pname = "glab";
-  version = "1.108.0";
+  version = "1.111.0";

  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-JVUeCq21D5ajBiGU+fR6MHGF1Nz6i1aQFUiJZsw2zUI=";
+    hash = "sha256-sAtoXaujYr5TWuXXN8qqFS0emBCK8MZIWr8vfUZLhog=";
    leaveDotGit = true;
    postFetch = ''
      cd "$out"
@@ -28,7 +28,7 @@ buildGoModule (finalAttrs: {
    '';
  };

-  vendorHash = "sha256-Ss5JnTa9KfOw5fElleu+HcDHVW5Bz8QxZ++YrCF2jCY=";
+  vendorHash = "sha256-BwpS98DvU3QRm+N4FvLvDlYnRflD53cQ4fuEoK6Ct1Q=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/go/gokrazy/package.nix
+++ b/pkgs/by-name/go/gokrazy/package.nix
@@ -4,19 +4,18 @@
  fetchFromGitHub,
  installShellFiles,
 }:
-
 buildGoModule (finalAttrs: {
  pname = "gokrazy";
-  version = "0-unstable-2026-01-09";
+  version = "0-unstable-2026-07-23";

  src = fetchFromGitHub {
    owner = "gokrazy";
    repo = "tools";
-    rev = "8ed49b4fafc72841e5a087362d719eb8a648db9b";
-    hash = "sha256-VxRX94vmzVGt4KwC+0T/I8XCKdmftoDTLeYMISLsHoA=";
+    rev = "3fe400c13246e09469afca86df37cdc6fe7c3ee9";
+    hash = "sha256-+wLO374SJu4Sk7GKwJkg6UOxWmJ1ApIfLt3Hw89/dXU=";
  };

-  vendorHash = "sha256-Khvk7Q0HVyhCg4jMvjVQdSXHRq2uuv2wHszcDTTV3qk=";
+  vendorHash = "sha256-+9i4dlxcxXw0WpeuHhnxli2qhB6IWOc4babuJXIO4wA=";

  ldflags = [
    "-s"
@@ -36,7 +35,7 @@ buildGoModule (finalAttrs: {
  '';

  meta = {
-    description = "Turn your Go program(s) into an appliance running on the Raspberry Pi 3, Pi 4, Pi Zero 2 W, or amd64 PCs";
+    description = "Turn your Go program(s) into an appliance running on the Raspberry Pi 3, Pi 4, Pi 5, Pi Zero 2 W, or amd64 PCs";
    homepage = "https://github.com/gokrazy/gokrazy";
    license = lib.licenses.bsd3;
    maintainers = with lib.maintainers; [ shayne ];
--- a/pkgs/by-name/go/gopher64-netplay-server/package.nix
+++ b/pkgs/by-name/go/gopher64-netplay-server/package.nix
@@ -0,0 +1,29 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "gopher64-netplay-server";
+  version = "1.0.39";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "gopher64";
+    repo = "gopher64-netplay-server";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-LlCM1MO6cK8rOAyt93zXOuSo/iGbNWNh3Wj01lmAhQk=";
+  };
+
+  vendorHash = "sha256-abXUtF92o73lKXJdsbrQsTEo18HUc3CP23wrgTXwN84=";
+
+  meta = {
+    description = "Dedicated netplay server for gopher64, simple64 and RMG";
+    homepage = "https://github.com/gopher64/gopher64-netplay-server";
+    license = lib.licenses.gpl3Only;
+    mainProgram = "gopher64-netplay-server";
+    maintainers = with lib.maintainers; [ tomasajt ];
+  };
+})
--- a/pkgs/by-name/go/goupile/package.nix
+++ b/pkgs/by-name/go/goupile/package.nix
@@ -27,14 +27,14 @@ let
 in
 stdenv'.mkDerivation (finalAttrs: {
  pname = "goupile";
-  version = "3.12.5";
+  version = "3.12.6";

  # https://github.com/Koromix/rygel/tags
  src = fetchFromGitHub {
    owner = "Koromix";
    repo = "rygel";
    tag = "goupile/${finalAttrs.version}";
-    hash = "sha256-REgop8kMiB9j64hMsDmyuYidsKgMtKVYf/lwRbuf5Ho=";
+    hash = "sha256-vwHcvvGWqdixMnE5FmhM2RtQl3OL0EIxoHjkDf8czj4=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/gr/gram/package.nix
+++ b/pkgs/by-name/gr/gram/package.nix
@@ -30,7 +30,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "gram";
-  version = "3.0.1";
+  version = "3.2.0";

  outputs = [
    "out"
@@ -43,7 +43,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "GramEditor";
    repo = "gram";
    tag = finalAttrs.version;
-    hash = "sha256-B3RmY1h0+D0aawNzevdt9f+gzozckjInhoz+t9taf8o=";
+    hash = "sha256-AzS9+7HrWbPpjQpmTxwFbOHiLCX7Qzj+vE4zzSJQBRI=";
  };

  postPatch = ''
@@ -53,7 +53,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
      --replace-fail '$CARGO_ABOUT_VERSION' '${cargo-about.version}'
  '';

-  cargoHash = "sha256-pK0rUuPtWejXitbDQqh9fvdEv3aza0ZEg1XWnCmY4eE=";
+  cargoHash = "sha256-Setp4mO6PFnLbpjM1UdqZNHfNNk59M2jj9NtwQFXm3A=";

  __structuredAttrs = true;

--- a/pkgs/by-name/gr/grok-build/package.nix
+++ b/pkgs/by-name/gr/grok-build/package.nix
@@ -10,7 +10,7 @@
  grok-build,
 }:
 let
-  version = "0.2.111";
+  version = "0.2.118";

  throwSystem = throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}";

@@ -26,9 +26,9 @@ let
      url = "https://x.ai/cli/grok-${version}-${upstreamPlatform}";
      hash =
        {
-          x86_64-linux = "sha256-8VjQ1DNnw5WcWtITMnJVrFmRoOxMZ7tHXgnMjNukp7M=";
-          aarch64-linux = "sha256-0tqtErRIqWyrRhuBlbO1m2PJ+YHpigdBTxLbT8wnjxA=";
-          aarch64-darwin = "sha256-4fr9//4U8zlGC++vGUNg6PkL/QLv6KTyTPoceuplf/4=";
+          x86_64-linux = "sha256-wZIoLmKr0kqb5kdQNj/4J9gGumE5GDmajGnIFbHaCPY=";
+          aarch64-linux = "sha256-VAEOM1qs5rXe3QIlOeznvIPzglPoY2qvB5ZWKu7LLmc=";
+          aarch64-darwin = "sha256-LeW5YJoDSS3WueTMqWN9ZR/pmLuDcb+fhS57KLOMA04=";
        }
        .${system};
    }
--- a/pkgs/by-name/ha/hamlib_4/package.nix
+++ b/pkgs/by-name/ha/hamlib_4/package.nix
@@ -24,13 +24,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "hamlib";
-  version = "4.7.1";
+  version = "4.7.2";

  src = fetchFromGitHub {
    owner = "Hamlib";
    repo = "Hamlib";
    tag = finalAttrs.version;
-    hash = "sha256-nI8gDACxlci2Q9V2W4D1DYDUL74JwlCs+qyyNkXOPu4=";
+    hash = "sha256-t1GgCYH+AJE5UZKQu+9uqx7fJDv4zuT0OzWxicZFfdQ=";
  };

  strictDeps = true;
--- a/pkgs/by-name/ia/iaito/package.nix
+++ b/pkgs/by-name/ia/iaito/package.nix
@@ -14,14 +14,14 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "iaito";
-  version = "6.1.6";
+  version = "6.1.8";

  srcs = [
    (fetchFromGitHub {
      owner = "radareorg";
      repo = "iaito";
      tag = finalAttrs.version;
-      hash = "sha256-hGJ8f/auUDAM/pWT52X5fiDAt/un//oBniMG1lLbofc=";
+      hash = "sha256-aIJSfr5ZH1Naky66x85C5Y3Ix7sDzoYK84l+oA7Wggs=";
      name = "main";
    })
    (fetchFromGitHub {
--- a/pkgs/by-name/im/imgcrypt/package.nix
+++ b/pkgs/by-name/im/imgcrypt/package.nix
@@ -6,24 +6,26 @@

 buildGoModule (finalAttrs: {
  pname = "imgcrypt";
-  version = "1.1.10";
+  version = "2.0.2";

  src = fetchFromGitHub {
    owner = "containerd";
    repo = "imgcrypt";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-81jfoWHYYenGQFcQI9kk8uPnv6FcyOtcJjpo1ykdtOI=";
+    hash = "sha256-xHL+vxjGkjkDCEHMVOQsT6uokZq50iFAqGyDj6dDuG4=";
  };

-  vendorHash = null;
+  modRoot = "cmd";
+
+  vendorHash = "sha256-tTRYEvqhQm1XpSvXDDXEx5piZYOxAtmcjf2dLL9fGck=";

  ldflags = [
    "-X github.com/containerd/containerd/version.Version=${finalAttrs.version}"
  ];

  subPackages = [
-    "cmd/ctd-decoder"
-    "cmd/ctr"
+    "ctd-decoder"
+    "ctr"
  ];

  postFixup = ''
--- a/pkgs/by-name/im/immichframe/package.nix
+++ b/pkgs/by-name/im/immichframe/package.nix
@@ -12,13 +12,13 @@

 buildDotnetModule (finalAttrs: {
  pname = "immichframe";
-  version = "1.0.35.0";
+  version = "1.0.37.0";

  src = fetchFromGitHub {
    owner = "immichFrame";
    repo = "immichFrame";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-VET0em+CyJzXPlCXjozj6SDhjD26lH94AETFKGG895I=";
+    hash = "sha256-ZS6lkfDdMSq1cffIIeXqG3/eIaQFGSZcRYPXiDCHA/U=";
  };

  projectFile = "ImmichFrame.WebApi/ImmichFrame.WebApi.csproj";
--- a/pkgs/by-name/in/inspec/Gemfile.lock
+++ b/pkgs/by-name/in/inspec/Gemfile.lock
@@ -1,7 +1,7 @@
 GEM
  remote: https://rubygems.org/
  specs:
-    activesupport (7.2.3)
+    activesupport (7.2.3.2)
      base64
      benchmark (>= 0.3)
      bigdecimal
@@ -10,14 +10,14 @@ GEM
      drb
      i18n (>= 1.6, < 2)
      logger (>= 1.4.2)
-      minitest (>= 5.1)
+      minitest (>= 5.1, < 6)
      securerandom (>= 0.3)
      tzinfo (~> 2.0, >= 2.0.5)
-    addressable (2.8.8)
+    addressable (2.9.0)
      public_suffix (>= 2.0.2, < 8.0)
    ast (2.4.3)
    aws-eventstream (1.4.0)
-    aws-partitions (1.863.0)
+    aws-partitions (1.992.0)
    aws-sdk-accessanalyzer (1.44.0)
      aws-sdk-core (~> 3, >= 3.188.0)
      aws-sigv4 (~> 1.1)
@@ -72,9 +72,9 @@ GEM
    aws-sdk-cloudwatchevents (1.69.0)
      aws-sdk-core (~> 3, >= 3.188.0)
      aws-sigv4 (~> 1.1)
-    aws-sdk-cloudwatchlogs (1.77.0)
-      aws-sdk-core (~> 3, >= 3.188.0)
-      aws-sigv4 (~> 1.1)
+    aws-sdk-cloudwatchlogs (1.131.0)
+      aws-sdk-core (~> 3, >= 3.234.0)
+      aws-sigv4 (~> 1.5)
    aws-sdk-codecommit (1.62.0)
      aws-sdk-core (~> 3, >= 3.188.0)
      aws-sigv4 (~> 1.1)
@@ -87,17 +87,20 @@ GEM
    aws-sdk-cognitoidentity (1.51.0)
      aws-sdk-core (~> 3, >= 3.188.0)
      aws-sigv4 (~> 1.1)
-    aws-sdk-cognitoidentityprovider (1.85.0)
-      aws-sdk-core (~> 3, >= 3.188.0)
-      aws-sigv4 (~> 1.1)
+    aws-sdk-cognitoidentityprovider (1.131.0)
+      aws-sdk-core (~> 3, >= 3.234.0)
+      aws-sigv4 (~> 1.5)
    aws-sdk-configservice (1.103.0)
      aws-sdk-core (~> 3, >= 3.188.0)
      aws-sigv4 (~> 1.1)
-    aws-sdk-core (3.190.3)
+    aws-sdk-core (3.234.0)
      aws-eventstream (~> 1, >= 1.3.0)
-      aws-partitions (~> 1, >= 1.651.0)
-      aws-sigv4 (~> 1.8)
+      aws-partitions (~> 1, >= 1.992.0)
+      aws-sigv4 (~> 1.9)
+      base64
+      bigdecimal
      jmespath (~> 1, >= 1.6.1)
+      logger
    aws-sdk-costandusagereportservice (1.53.0)
      aws-sdk-core (~> 3, >= 3.188.0)
      aws-sigv4 (~> 1.1)
@@ -149,9 +152,9 @@ GEM
    aws-sdk-firehose (1.60.0)
      aws-sdk-core (~> 3, >= 3.188.0)
      aws-sigv4 (~> 1.1)
-    aws-sdk-glue (1.165.0)
-      aws-sdk-core (~> 3, >= 3.188.0)
-      aws-sigv4 (~> 1.1)
+    aws-sdk-glue (1.242.0)
+      aws-sdk-core (~> 3, >= 3.234.0)
+      aws-sigv4 (~> 1.5)
    aws-sdk-guardduty (1.85.0)
      aws-sdk-core (~> 3, >= 3.188.0)
      aws-sigv4 (~> 1.1)
@@ -164,9 +167,9 @@ GEM
    aws-sdk-kinesis (1.54.0)
      aws-sdk-core (~> 3, >= 3.188.0)
      aws-sigv4 (~> 1.1)
-    aws-sdk-kms (1.76.0)
-      aws-sdk-core (~> 3, >= 3.188.0)
-      aws-sigv4 (~> 1.1)
+    aws-sdk-kms (1.117.0)
+      aws-sdk-core (~> 3, >= 3.234.0)
+      aws-sigv4 (~> 1.5)
    aws-sdk-lambda (1.113.0)
      aws-sdk-core (~> 3, >= 3.188.0)
      aws-sigv4 (~> 1.1)
@@ -203,10 +206,10 @@ GEM
    aws-sdk-route53resolver (1.51.0)
      aws-sdk-core (~> 3, >= 3.188.0)
      aws-sigv4 (~> 1.1)
-    aws-sdk-s3 (1.141.0)
-      aws-sdk-core (~> 3, >= 3.189.0)
+    aws-sdk-s3 (1.208.0)
+      aws-sdk-core (~> 3, >= 3.234.0)
      aws-sdk-kms (~> 1)
-      aws-sigv4 (~> 1.8)
+      aws-sigv4 (~> 1.5)
    aws-sdk-s3control (1.74.0)
      aws-sdk-core (~> 3, >= 3.188.0)
      aws-sigv4 (~> 1.1)
@@ -275,40 +278,40 @@ GEM
    benchmark (0.5.0)
    bigdecimal (3.3.1)
    builder (3.3.0)
-    chef-config (18.8.54)
+    chef-config (19.3.15)
      addressable
-      chef-utils (= 18.8.54)
+      chef-utils (= 19.3.15)
      fuzzyurl
      mixlib-config (>= 2.2.12, < 4.0)
      mixlib-shellout (>= 2.0, < 4.0)
-      tomlrb (~> 1.2)
+      racc
+      tomlrb (>= 1.2, < 3.0)
    chef-gyoku (1.5.0)
      builder (>= 2.1.2)
      rexml (~> 3.4)
-    chef-licensing (1.3.0)
+    chef-licensing (1.4.1)
      chef-config (>= 15)
-      faraday (>= 1, < 2)
+      faraday (>= 1, < 3)
      faraday-http-cache
-      faraday_middleware (~> 1.0)
      mixlib-log (~> 3.0)
-      ostruct (~> 0.1.0)
+      ostruct (~> 0.6.0)
      pstore (~> 0.1.1)
      tty-prompt (~> 0.23)
      tty-spinner (~> 0.9.3)
    chef-telemetry (1.1.1)
      chef-config
      concurrent-ruby (~> 1.0)
-    chef-utils (18.8.54)
+    chef-utils (19.3.15)
      concurrent-ruby
-    chef-winrm (2.4.4)
+    chef-winrm (2.5.0)
      builder (>= 2.1.2)
      chef-gyoku (~> 1.5)
      erubi (~> 1.8)
      gssapi (~> 1.2)
      httpclient (~> 2.2, >= 2.2.0.2)
      logging (>= 1.6.1, < 3.0)
-      nori (= 2.7.0)
-      rexml (~> 3.3)
+      nori (~> 2.7)
+      rexml (>= 3.4.2, < 4.0)
      rubyntlm (~> 0.6.0, >= 0.6.3)
    chef-winrm-elevated (1.2.5)
      chef-winrm (>= 2.3.11)
@@ -322,11 +325,11 @@ GEM
      logging (>= 1.6.1, < 3.0)
      rubyzip (~> 2.0)
    coderay (1.1.3)
-    concurrent-ruby (1.3.5)
-    connection_pool (2.5.5)
-    cookstyle (8.5.2)
-      rubocop (= 1.81.6)
-    csv (3.3.5)
+    concurrent-ruby (1.3.8)
+    connection_pool (3.0.2)
+    cookstyle (8.7.6)
+      rubocop (= 1.86.1)
+    csv (3.3.6)
    declarative (0.0.20)
    diff-lcs (1.6.2)
    docker-api (2.4.0)
@@ -334,26 +337,26 @@ GEM
      multi_json
    domain_name (0.6.20240107)
    drb (2.2.3)
-    dry-configurable (1.3.0)
-      dry-core (~> 1.1)
+    dry-configurable (1.4.0)
+      dry-core (~> 1.0)
      zeitwerk (~> 2.6)
-    dry-core (1.1.0)
+    dry-core (1.2.0)
      concurrent-ruby (~> 1.0)
      logger
      zeitwerk (~> 2.6)
-    dry-inflector (1.2.0)
+    dry-inflector (1.3.1)
    dry-logic (1.6.0)
      bigdecimal
      concurrent-ruby (~> 1.0)
      dry-core (~> 1.1)
      zeitwerk (~> 2.6)
-    dry-struct (1.8.0)
+    dry-struct (1.8.1)
      dry-core (~> 1.1)
      dry-types (~> 1.8, >= 1.8.2)
      ice_nine (~> 0.11)
      zeitwerk (~> 2.6)
-    dry-types (1.8.3)
-      bigdecimal (~> 3.0)
+    dry-types (1.9.1)
+      bigdecimal (>= 3.0)
      concurrent-ruby (~> 1.0)
      dry-core (~> 1.0)
      dry-inflector (~> 1.0)
@@ -361,7 +364,7 @@ GEM
      zeitwerk (~> 2.6)
    erubi (1.13.1)
    excon (0.112.0)
-    faraday (1.10.4)
+    faraday (1.10.6)
      faraday-em_http (~> 1.0)
      faraday-em_synchrony (~> 1.0)
      faraday-excon (~> 1.1)
@@ -379,21 +382,21 @@ GEM
    faraday-em_http (1.0.0)
    faraday-em_synchrony (1.0.1)
    faraday-excon (1.1.0)
-    faraday-follow_redirects (0.4.0)
+    faraday-follow_redirects (0.5.0)
      faraday (>= 1, < 3)
-    faraday-http-cache (2.5.1)
+    faraday-http-cache (2.7.0)
      faraday (>= 0.8)
    faraday-httpclient (1.0.1)
-    faraday-multipart (1.1.1)
+    faraday-multipart (1.2.0)
      multipart-post (~> 2.0)
    faraday-net_http (1.0.2)
    faraday-net_http_persistent (1.2.0)
    faraday-patron (1.0.0)
    faraday-rack (1.0.0)
-    faraday-retry (1.0.3)
+    faraday-retry (1.0.4)
    faraday_middleware (1.2.1)
      faraday (~> 1.0)
-    ffi (1.16.3)
+    ffi (1.17.4)
    fuzzyurl (0.9.0)
    google-apis-admin_directory_v1 (0.46.0)
      google-apis-core (>= 0.11.0, < 2.a)
@@ -426,31 +429,32 @@ GEM
    gssapi (1.3.1)
      ffi (>= 1.0.1)
    hashdiff (1.2.1)
-    hashie (5.0.0)
+    hashie (5.1.0)
+      logger
    highline (3.1.2)
      reline
-    http-cookie (1.1.0)
+    http-cookie (1.1.6)
      domain_name (~> 0.5)
    httpclient (2.9.0)
      mutex_m
-    i18n (1.14.7)
+    i18n (1.15.2)
      concurrent-ruby (~> 1.0)
    ice_nine (0.11.2)
    inifile (3.0.0)
-    inspec (7.0.95)
+    inspec (7.1.7)
      faraday_middleware (~> 1.2, >= 1.2.1)
-      inspec-core (= 7.0.95)
+      inspec-core (= 7.1.7)
      progress_bar (~> 1.3.3)
-      rake
-      train (~> 3.13, >= 3.13.4)
+      rake (>= 12.3.3)
+      train (~> 3.16, >= 3.16.1)
      train-aws (~> 0.2)
      train-habitat (~> 0.1)
      train-kubernetes (>= 0.3.1)
      train-winrm (~> 0.4.0)
-    inspec-bin (7.0.95)
-      inspec (= 7.0.95)
-    inspec-core (7.0.95)
-      addressable (~> 2.4)
+    inspec-bin (7.1.7)
+      inspec (= 7.1.7)
+    inspec-core (7.1.7)
+      addressable (~> 2.9)
      chef-licensing (>= 1.2.0)
      chef-telemetry (~> 1.0, >= 1.0.8)
      cookstyle
@@ -474,15 +478,15 @@ GEM
      syslog (~> 0.1)
      thor (>= 0.20, < 1.5.0)
      tomlrb (>= 1.3, < 2.1)
-      train-core (~> 3.13, >= 3.13.4)
+      train-core (~> 3.16, >= 3.16.1)
      tty-prompt (~> 0.17)
      tty-table (~> 0.10)
-    io-console (0.8.1)
+    io-console (0.8.2)
    jmespath (1.6.2)
-    json (2.17.0)
+    json (2.21.1)
    jsonpath (1.1.5)
      multi_json
-    jwt (2.10.2)
+    jwt (2.10.3)
      base64
    k8s-ruby (0.17.2)
      base64
@@ -495,7 +499,7 @@ GEM
      recursive-open-struct (~> 1.1, >= 1.1.3)
      yajl-ruby (~> 1.4)
      yaml-safe_load_stream3
-    language_server-protocol (3.17.0.5)
+    language_server-protocol (3.17.0.6)
    license-acceptance (2.1.13)
      pastel (~> 0.7)
      tomlrb (>= 1.2, < 3.0)
@@ -509,12 +513,12 @@ GEM
      multi_json (~> 1.14)
    method_source (1.1.0)
    mini_mime (1.1.5)
-    minitest (5.26.2)
+    minitest (5.27.0)
    mixlib-config (3.0.27)
      tomlrb
    mixlib-log (3.2.3)
      ffi (>= 1.15.5)
-    mixlib-shellout (3.3.9)
+    mixlib-shellout (3.4.10)
      chef-utils
    ms_rest (0.7.6)
      concurrent-ruby (~> 1.0)
@@ -525,46 +529,48 @@ GEM
      faraday (>= 0.9, < 2.0.0)
      faraday-cookie_jar (~> 0.0.6)
      ms_rest (~> 0.7.6)
-    multi_json (1.18.0)
+    multi_json (1.21.1)
    multipart-post (2.4.1)
    mutex_m (0.3.0)
    net-scp (4.1.0)
      net-ssh (>= 2.6.5, < 8.0.0)
-    net-ssh (7.3.0)
-    nori (2.7.0)
+    net-ssh (7.3.3)
+    nori (2.9.1)
      bigdecimal
+      stringio
    options (2.3.2)
    os (1.1.4)
-    ostruct (0.1.0)
-    parallel (1.27.0)
-    parser (3.3.10.0)
+    ostruct (0.6.3)
+    parallel (1.28.0)
+    parser (3.3.12.0)
      ast (~> 2.4.1)
      racc
    parslet (2.0.0)
    pastel (0.8.0)
      tty-color (~> 0.5)
-    prism (1.6.0)
+    prism (1.9.0)
    progress_bar (1.3.4)
      highline (>= 1.6)
      options (~> 2.3.0)
-    pry (0.15.2)
+    pry (0.16.0)
      coderay (~> 1.1)
      method_source (~> 1.0)
+      reline (>= 0.6.0)
    pstore (0.1.4)
-    public_suffix (7.0.0)
+    public_suffix (7.0.5)
    racc (1.8.1)
    rainbow (3.1.1)
-    rake (13.3.1)
+    rake (13.4.2)
    recursive-open-struct (1.3.1)
      ostruct
-    regexp_parser (2.11.3)
+    regexp_parser (2.12.0)
    reline (0.6.3)
      io-console (~> 0.5)
    representable (3.2.0)
      declarative (< 0.1.0)
      trailblazer-option (>= 0.1.1, < 0.2.0)
      uber (< 0.2.0)
-    retriable (3.1.2)
+    retriable (3.8.0)
    rexml (3.4.4)
    rspec (3.13.2)
      rspec-core (~> 3.13.0)
@@ -578,24 +584,24 @@ GEM
    rspec-its (2.0.0)
      rspec-core (>= 3.13.0)
      rspec-expectations (>= 3.13.0)
-    rspec-mocks (3.13.7)
+    rspec-mocks (3.13.8)
      diff-lcs (>= 1.2.0, < 2.0)
      rspec-support (~> 3.13.0)
-    rspec-support (3.13.6)
-    rubocop (1.81.6)
+    rspec-support (3.13.7)
+    rubocop (1.86.1)
      json (~> 2.3)
      language_server-protocol (~> 3.17.0.2)
      lint_roller (~> 1.1.0)
-      parallel (~> 1.10)
+      parallel (>= 1.10)
      parser (>= 3.3.0.2)
      rainbow (>= 2.2.2, < 4.0)
      regexp_parser (>= 2.9.3, < 3.0)
-      rubocop-ast (>= 1.47.1, < 2.0)
+      rubocop-ast (>= 1.49.0, < 2.0)
      ruby-progressbar (~> 1.7)
      unicode-display_width (>= 2.4.0, < 4.0)
-    rubocop-ast (1.48.0)
+    rubocop-ast (1.50.0)
      parser (>= 3.3.7.2)
-      prism (~> 1.4)
+      prism (~> 1.7)
    ruby-progressbar (1.13.0)
    ruby2_keywords (0.0.5)
    rubyntlm (0.6.5)
@@ -603,31 +609,32 @@ GEM
    rubyzip (2.4.1)
    securerandom (0.4.1)
    semverse (3.0.2)
-    signet (0.21.0)
+    signet (0.22.0)
      addressable (~> 2.8)
      faraday (>= 0.17.5, < 3.a)
      jwt (>= 1.5, < 4.0)
-      multi_json (~> 1.10)
    socksify (1.8.1)
    sslshake (1.3.1)
+    stringio (3.2.0)
    strings (0.2.1)
      strings-ansi (~> 0.2)
      unicode-display_width (>= 1.5, < 3.0)
      unicode_utils (~> 1.4)
    strings-ansi (0.2.0)
-    syslog (0.3.0)
+    syslog (0.4.0)
      logger
    thor (1.4.0)
    timeliness (0.3.10)
-    tomlrb (1.3.0)
+    tomlrb (2.0.4)
    trailblazer-option (0.1.2)
-    train (3.13.4)
-      activesupport (~> 7.2, >= 7.2.2.1)
+    train (3.16.5)
+      activesupport (~> 7.2, >= 7.2.3.1)
      azure_graph_rbac (~> 0.16)
      azure_mgmt_key_vault (~> 0.17)
      azure_mgmt_resources (~> 0.15)
      azure_mgmt_security (~> 0.18)
      azure_mgmt_storage (~> 0.18)
+      bigdecimal (< 4)
      docker-api (>= 1.26, < 3.0)
      google-apis-admin_directory_v1 (~> 0.46.0)
      google-apis-cloudkms_v1 (~> 0.41.0)
@@ -638,11 +645,11 @@ GEM
      google-apis-storage_v1 (~> 0.30.0)
      googleauth (>= 0.16.2, < 1.9.0)
      inifile (~> 3.0)
-      ostruct (~> 0.1.0)
-      train-core (= 3.13.4)
+      ostruct (~> 0.6.0)
+      train-core (= 3.16.5)
      train-winrm (~> 0.4.0)
-    train-aws (0.2.41)
-      aws-partitions (~> 1.863.0)
+    train-aws (0.2.44)
+      aws-partitions (~> 1.992.0)
      aws-sdk-accessanalyzer (~> 1.44.0)
      aws-sdk-account (~> 1.20.0)
      aws-sdk-alexaforbusiness (~> 1.67.0)
@@ -668,7 +675,7 @@ GEM
      aws-sdk-cognitoidentity (~> 1.51.0)
      aws-sdk-cognitoidentityprovider (~> 1.84)
      aws-sdk-configservice (~> 1.103.0)
-      aws-sdk-core (~> 3.190.0)
+      aws-sdk-core (~> 3.234.0)
      aws-sdk-costandusagereportservice (~> 1.53.0)
      aws-sdk-databasemigrationservice (~> 1.91.0)
      aws-sdk-dynamodb (~> 1.98.0)
@@ -704,7 +711,7 @@ GEM
      aws-sdk-route53 (~> 1.83.0)
      aws-sdk-route53domains (~> 1.54.0)
      aws-sdk-route53resolver (~> 1.51.0)
-      aws-sdk-s3 (~> 1.141.0)
+      aws-sdk-s3 (~> 1.208.0)
      aws-sdk-s3control (~> 1.74.0)
      aws-sdk-secretsmanager (~> 1.87.0)
      aws-sdk-securityhub (~> 1.98.0)
@@ -722,10 +729,10 @@ GEM
      aws-sdk-transfer (~> 1.86.0)
      aws-sdk-waf (~> 1.58.0)
      aws-sdk-wafv2 (~> 1.74.0)
-    train-core (3.13.4)
+    train-core (3.16.5)
      addressable (~> 2.5)
-      ffi (~> 1.16.0)
-      json (>= 1.8, < 3.0)
+      ffi (>= 1.16.0, < 1.18)
+      json (>= 2.19.2, < 3.0)
      mixlib-shellout (>= 2.0, < 4.0)
      net-scp (>= 1.2, < 5.0)
      net-ssh (>= 2.9, < 8.0)
@@ -733,10 +740,10 @@ GEM
    train-kubernetes (0.3.1)
      k8s-ruby (>= 0.17.2)
      train (~> 3.0)
-    train-winrm (0.4.0)
-      chef-winrm (~> 2.4.4)
-      chef-winrm-elevated (~> 1.2.5)
-      chef-winrm-fs (~> 1.4.1)
+    train-winrm (0.4.3)
+      chef-winrm (>= 2.4.4, < 3.0)
+      chef-winrm-elevated (>= 1.2.5, < 2.0)
+      chef-winrm-fs (>= 1.4.1, < 2.0)
      socksify (~> 1.8)
    tty-box (0.7.0)
      pastel (~> 0.8)
@@ -766,7 +773,7 @@ GEM
    wisper (2.0.1)
    yajl-ruby (1.4.3)
    yaml-safe_load_stream3 (0.1.2)
-    zeitwerk (2.7.3)
+    zeitwerk (2.8.2)

 PLATFORMS
  ruby
--- a/pkgs/by-name/in/inspec/gemset.nix
+++ b/pkgs/by-name/in/inspec/gemset.nix
@@ -17,10 +17,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "043vbilaw855c91n5l7g0k0wxj63kngj911685qy74xc1mvwjxan";
+      sha256 = "04ikxwixhpnv2dih9hy3af45qgra7kz0fd70miw6s248vl8hvjfx";
      type = "gem";
    };
-    version = "7.2.3";
+    version = "7.2.3.2";
  };
  addressable = {
    dependencies = [ "public_suffix" ];
@@ -28,10 +28,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0mxhjgihzsx45l9wh2n0ywl9w0c6k70igm5r0d63dxkcagwvh4vw";
+      sha256 = "1by7h2lwziiblizpd5yx87jsq8ppdhzvwf08ga34wzqgcv1nmpvz";
      type = "gem";
    };
-    version = "2.8.8";
+    version = "2.9.0";
  };
  ast = {
    groups = [ "default" ];
@@ -58,10 +58,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1jgzsjdl1m9krycj0vx4riiiy0a6ydfbsmgalfgvkh6z0n02xcib";
+      sha256 = "0dyvbkiwlnmlv7ri3l0mq86igbi8w81wlkqirkym97wapfy2v50n";
      type = "gem";
    };
-    version = "1.863.0";
+    version = "1.992.0";
  };
  aws-sdk-accessanalyzer = {
    dependencies = [
@@ -324,10 +324,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "12w3rs5aihxz6z76q6vmn6024pw1wpzvxl5l24jv543z563cpzzg";
+      sha256 = "0l6yrzvfxc9davrm8qldddidvjnklv39zy6dnb5cb73nsylvfjmg";
      type = "gem";
    };
-    version = "1.77.0";
+    version = "1.131.0";
  };
  aws-sdk-codecommit = {
    dependencies = [
@@ -394,10 +394,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "04i9npmdcdcidwsiqgy55p50r4y0baivmmj6cp2fcjpjp0jxncz1";
+      sha256 = "128ymnzsh4m02j7b2105am1vzv41llbwzfwlx4zfcccz3b4lclc0";
      type = "gem";
    };
-    version = "1.85.0";
+    version = "1.131.0";
  };
  aws-sdk-configservice = {
    dependencies = [
@@ -418,16 +418,19 @@
      "aws-eventstream"
      "aws-partitions"
      "aws-sigv4"
+      "base64"
+      "bigdecimal"
      "jmespath"
+      "logger"
    ];
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0h9x1wk3axjmf8f7p49dz8cihaxcgb4s46h3rpzvq4lisxsngdpr";
+      sha256 = "06gxaiyssqhxfjcnr6cb77h4fzzqrn9903nd3bqn2fr3rnhg3amv";
      type = "gem";
    };
-    version = "3.190.3";
+    version = "3.234.0";
  };
  aws-sdk-costandusagereportservice = {
    dependencies = [
@@ -676,10 +679,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1bwarv5p3nhbwb6kqhp0wlr7bzbqsg25i783dlq5xb392g57az7n";
+      sha256 = "1qxhqjsmw020dx0702yh9f1w3d32y8x25jhlj9fl2jnfxa2da65w";
      type = "gem";
    };
-    version = "1.165.0";
+    version = "1.242.0";
  };
  aws-sdk-guardduty = {
    dependencies = [
@@ -746,10 +749,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0jfgw9a9c8xyjhkmgpd9rpi95h9i0rhbqszn8iqkbfm9rc9m1xz7";
+      sha256 = "053cnw2n1zdfyc2cxfihrz54rq9g0qz59qjmamqxd82whap5bmnk";
      type = "gem";
    };
-    version = "1.76.0";
+    version = "1.117.0";
  };
  aws-sdk-lambda = {
    dependencies = [
@@ -929,10 +932,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0bnhpmi0iiaj88rqc5lhhnp2gyrk4fs8xz51lj36wwzng94qinya";
+      sha256 = "0vbxg6hy0j2b931llwc0jxg1q27grbs31zdhzwjy9fki05817kiz";
      type = "gem";
    };
-    version = "1.141.0";
+    version = "1.208.0";
  };
  aws-sdk-s3control = {
    dependencies = [
@@ -1295,16 +1298,17 @@
      "fuzzyurl"
      "mixlib-config"
      "mixlib-shellout"
+      "racc"
      "tomlrb"
    ];
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0rhifk1ngqjx99cp2j9jw969cbnmznrd4vs60cmf0mwp0rwipc9f";
+      sha256 = "0icgxfzj92ld89pc30gm2iha5qkq50k35ym69n6imsmfq43wxx6r";
      type = "gem";
    };
-    version = "18.8.54";
+    version = "19.3.15";
  };
  chef-gyoku = {
    dependencies = [
@@ -1325,7 +1329,6 @@
      "chef-config"
      "faraday"
      "faraday-http-cache"
-      "faraday_middleware"
      "mixlib-log"
      "ostruct"
      "pstore"
@@ -1336,10 +1339,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "13z7rfrdfagxr5a0bgcy7dayg7q4zi2r1zawdc6847x3h7ckldcv";
+      sha256 = "0snnw3b3h0fydbllkgfc6gv724rlg7pv8lr9q84c972aibdsxs7h";
      type = "gem";
    };
-    version = "1.3.0";
+    version = "1.4.1";
  };
  chef-telemetry = {
    dependencies = [
@@ -1361,10 +1364,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1iqdxg0n58p2w8snnw21gjh55yk9h5cvxirnyvfhwlhs559nq735";
+      sha256 = "0smqw0vhccmzw0jpnpibmvgsc5xhcrmszs78gn4nsnxmhnf7llqw";
      type = "gem";
    };
-    version = "18.8.54";
+    version = "19.3.15";
  };
  chef-winrm = {
    dependencies = [
@@ -1382,10 +1385,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1sdddiwxf6lwrqnhwzi0m1b30bm01hshlyka88flqvbalgr58skz";
+      sha256 = "1ww5iclrsl1fpzj7lm6ds5dza7ifn7px0a6wic787mrr5v3ly8fh";
      type = "gem";
    };
-    version = "2.4.4";
+    version = "2.5.0";
  };
  chef-winrm-elevated = {
    dependencies = [
@@ -1435,20 +1438,20 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1ipbrgvf0pp6zxdk5ascp6i29aybz2bx9wdrlchjmpx6mhvkwfw1";
+      sha256 = "1qfi2ns3zwkgq616fc127xiqhan7g7m7gqpwriwcr34nds1vxwdj";
      type = "gem";
    };
-    version = "1.3.5";
+    version = "1.3.8";
  };
  connection_pool = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1b8nlxr5z843ii7hfk6igpr5acw3k2ih9yjrgkyz2gbmallgjkz5";
+      sha256 = "02ifws3c4x7b54fv17sm4cca18d2pfw1saxpdji2lbd1f6xgbzrk";
      type = "gem";
    };
-    version = "2.5.5";
+    version = "3.0.2";
  };
  cookstyle = {
    dependencies = [ "rubocop" ];
@@ -1456,20 +1459,20 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "159l8d5c5d8awzaxhqc0c2zrb211wq751rr1r490c5vspmflpszg";
+      sha256 = "0qwm9zl1l94pdvjfjgh0a36pv59ipmgw9j6hvqm2rqlibk4fa42w";
      type = "gem";
    };
-    version = "8.5.2";
+    version = "8.7.6";
  };
  csv = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0gz7r2kazwwwyrwi95hbnhy54kwkfac5swh2gy5p5vw36fn38lbf";
+      sha256 = "0mj4kq4wwpc7c8ll52q30hsir1jrcd5kq7yb8lyz0rksa1z1x9mb";
      type = "gem";
    };
-    version = "3.3.5";
+    version = "3.3.6";
  };
  declarative = {
    groups = [ "default" ];
@@ -1534,10 +1537,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1a5g30p7kzp37n9w3idp3gy70hzkj30d8j951lhw2zsnb0l8cbc8";
+      sha256 = "1kkk3fs22ndslgihxwm6rwr0y03rvccljmhz6vpm65q87iginpg3";
      type = "gem";
    };
-    version = "1.3.0";
+    version = "1.4.0";
  };
  dry-core = {
    dependencies = [
@@ -1549,20 +1552,20 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "15di39ssfkwigyyqla65n4x6cfhgwa4cv8j5lmyrlr07jwd840q9";
+      sha256 = "18cn9s2p7cbgacy0z41h3sf9jvl75vjfmvj774apyffzi3dagi8c";
      type = "gem";
    };
-    version = "1.1.0";
+    version = "1.2.0";
  };
  dry-inflector = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0blgyg9l4gpzhb7rs9hqq9j7br80ngiigjp2ayp78w6m1ysx1x92";
+      sha256 = "1k1dd35sqqqg2abd2g2w78m94pa3mcwvmrsjbkr3hxpn0jxw5c3z";
      type = "gem";
    };
-    version = "1.2.0";
+    version = "1.3.1";
  };
  dry-logic = {
    dependencies = [
@@ -1591,10 +1594,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0ri9iqxknxvvhpbshf6jn7bq581k8l67iv23mii69yr4k5aqphvl";
+      sha256 = "1wc07v0qm8zbblr74w3iy2s74sxpifyfpw9b2x01a9259icnhf03";
      type = "gem";
    };
-    version = "1.8.0";
+    version = "1.8.1";
  };
  dry-types = {
    dependencies = [
@@ -1609,10 +1612,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1g61cnmmwzff05sf8bh95qjd3hikasgvrmf3q0qk29zdw12pmndm";
+      sha256 = "0y7icwaa26ycikz6h97gwd1hji3r280n4yr2kmn5sfgqp76yxsxs";
      type = "gem";
    };
-    version = "1.8.3";
+    version = "1.9.1";
  };
  erubi = {
    groups = [ "default" ];
@@ -1652,10 +1655,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "069gmdh5j90v06rbwlqvlhzhq45lxhx74mahz25xd276rm0wb153";
+      sha256 = "0kddc595wl2vqcib8wfqilb5w16mw0f68ghv4ji7ca1idcm81x3z";
      type = "gem";
    };
-    version = "1.10.4";
+    version = "1.10.6";
  };
  faraday-cookie_jar = {
    dependencies = [
@@ -1707,10 +1710,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1nfmmnmqgbxci7dlca0qnwxn8j29yv7v8wm26m0f4l0kmcc13ynk";
+      sha256 = "1b8hgpci3wjm3rm41bzpasvsc5j253ljyg5rsajl62dkjk497pjw";
      type = "gem";
    };
-    version = "0.4.0";
+    version = "0.5.0";
  };
  faraday-http-cache = {
    dependencies = [ "faraday" ];
@@ -1718,10 +1721,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "10wld3vk3i8zsr3pa9zyjiyi2zlyyln872812f08bbg1hnd15z6b";
+      sha256 = "128dkxqssnnz801z86ykpaq4sv7pnac5yrgngbm951f0wsxw8ynd";
      type = "gem";
    };
-    version = "2.5.1";
+    version = "2.7.0";
  };
  faraday-httpclient = {
    groups = [ "default" ];
@@ -1739,10 +1742,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "00w9imp55hi81q0wsgwak90ldkk7gbyb8nzmmv8hy0s907s8z8bp";
+      sha256 = "0mzp9rlqiryyi99bm9ii80hfsbbafh9wl8r3c5pif51pd54sk2bx";
      type = "gem";
    };
-    version = "1.1.1";
+    version = "1.2.0";
  };
  faraday-net_http = {
    groups = [ "default" ];
@@ -1789,10 +1792,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "153i967yrwnswqgvnnajgwp981k9p50ys1h80yz3q94rygs59ldd";
+      sha256 = "1ahnsyy5f0f9qqna8883z4m10b2x19nfbzy2d5ngkavzfwrr4rfw";
      type = "gem";
    };
-    version = "1.0.3";
+    version = "1.0.4";
  };
  faraday_middleware = {
    dependencies = [ "faraday" ];
@@ -1810,10 +1813,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1yvii03hcgqj30maavddqamqy50h7y6xcn2wcyq72wn823zl4ckd";
+      sha256 = "1kqasqvy8d7r09ri4n6bkdwbk63j7afd9ilsw34nzlgh0qp69ldw";
      type = "gem";
    };
-    version = "1.16.3";
+    version = "1.17.4";
  };
  fuzzyurl = {
    groups = [ "default" ];
@@ -1960,14 +1963,15 @@
    version = "1.2.1";
  };
  hashie = {
+    dependencies = [ "logger" ];
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1nh3arcrbz1rc1cr59qm53sdhqm137b258y8rcb4cvd3y98lwv4x";
+      sha256 = "0w1qrab701d3a63aj2qavwc2fpcqmkzzh1w2x93c88zkjqc4frn2";
      type = "gem";
    };
-    version = "5.0.0";
+    version = "5.1.0";
  };
  highline = {
    dependencies = [ "reline" ];
@@ -1986,10 +1990,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "06dvmngd4hwrr6k774i1h6c50h2l8nww9f1id0wvrvi72l6yd99q";
+      sha256 = "1aga7z4p0dka4zcqw9i05wa4ab1q7h7cgnj328ldqqfycjz84jxs";
      type = "gem";
    };
-    version = "1.1.0";
+    version = "1.1.6";
  };
  httpclient = {
    dependencies = [ "mutex_m" ];
@@ -2008,10 +2012,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "03sx3ahz1v5kbqjwxj48msw3maplpp2iyzs22l4jrzrqh4zmgfnf";
+      sha256 = "1dfikmmd9dllirsfq0kjiyxpmlq0afkxm5sslsr97r9g85ifpy80";
      type = "gem";
    };
-    version = "1.14.7";
+    version = "1.15.2";
  };
  ice_nine = {
    groups = [ "default" ];
@@ -2049,10 +2053,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1gz6frd1hpzyxprgi9m1g9sw4xybglfgwc4h7qjsn6wsjcw72n2i";
+      sha256 = "1wqpdr4ny7cwcb5ap5qy9vc530jwjnq3rcac0kpjrwprblp56wfy";
      type = "gem";
    };
-    version = "7.0.95";
+    version = "7.1.7";
  };
  inspec-bin = {
    dependencies = [ "inspec" ];
@@ -2060,10 +2064,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "13l71qnj6dwlbkasa6rnxf73yb2fiy9vvd68cb3m2lp2nx35z1g2";
+      sha256 = "0s3zbp16jpjv84bk9xv0bxsz6jc7ysbxaj5gjyjrk30zxpwamiv8";
      type = "gem";
    };
-    version = "7.0.95";
+    version = "7.1.7";
  };
  inspec-core = {
    dependencies = [
@@ -2099,20 +2103,20 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0mghshl98py0q1wwd2dbmx72b1641y0nqz7y68bpws1b8n2hy5df";
+      sha256 = "184n6hfbamjdh0rcy1qwkvgqps5m7sq9iz1bybym1k1d6b2w398k";
      type = "gem";
    };
-    version = "7.0.95";
+    version = "7.1.7";
  };
  io-console = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1jszj95hazqqpnrjjzr326nn1j32xmsc9xvd97mbcrrgdc54858y";
+      sha256 = "1k0lk3pwadm2myvpg893n8jshmrf2sigrd4ki15lymy7gixaxqyn";
      type = "gem";
    };
-    version = "0.8.1";
+    version = "0.8.2";
  };
  jmespath = {
    groups = [ "default" ];
@@ -2129,10 +2133,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1cc8sz1zciy6yhn291b4kn6r0kyzpi45gbnvgl63zibmvxk592ch";
+      sha256 = "10q54a0dkm0050n0zzqiv2ln8w931wszybbhym1i8r4mbpvkv90k";
      type = "gem";
    };
-    version = "2.17.0";
+    version = "2.21.1";
  };
  jsonpath = {
    dependencies = [ "multi_json" ];
@@ -2151,10 +2155,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1x64l31nkqjwfv51s2vsm0yqq4cwzrlnji12wvaq761myx3fxq9i";
+      sha256 = "115ll278g3zdvff7b05gfxqc9n74vw9xfzcc8jkv22bkphpkbng4";
      type = "gem";
    };
-    version = "2.10.2";
+    version = "2.10.3";
  };
  k8s-ruby = {
    dependencies = [
@@ -2183,10 +2187,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1k0311vah76kg5m6zr7wmkwyk5p2f9d9hyckjpn3xgr83ajkj7px";
+      sha256 = "1w5p8c2145lmqzr25bxh4ikzjm6k8y1k5lriqqdpw9pq730w1wjy";
      type = "gem";
    };
-    version = "3.17.0.5";
+    version = "3.17.0.6";
  };
  license-acceptance = {
    dependencies = [
@@ -2273,10 +2277,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1qyda32pf9jivaw2m7yymxshqxxd0fhjn7zpbagvmfc5c65128gh";
+      sha256 = "1mbpz92ml19rcxxfjrj91gmkif9khb1xpzyw38f81rvglgw1ffrd";
      type = "gem";
    };
-    version = "5.26.2";
+    version = "5.27.0";
  };
  mixlib-config = {
    dependencies = [ "tomlrb" ];
@@ -2306,10 +2310,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "126k9zgxwj726gi0q0ywj4kdzf1gfm8z16i1nn7dw9kmn3imxpqf";
+      sha256 = "032z85m9w8kpf232xspd9r8im6wwq4lj2s7df642m4lhdid6r2kw";
      type = "gem";
    };
-    version = "3.3.9";
+    version = "3.4.10";
  };
  ms_rest = {
    dependencies = [
@@ -2347,10 +2351,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0vsrfm36zlg7jbrd1fjbr8kmdvr8bfayrw0hdlza75987vvhrxr3";
+      sha256 = "1040lr5y2phn7avdyam6zw6ikprlmk77biw3yhclsfwfh0qnl4p6";
      type = "gem";
    };
-    version = "1.18.0";
+    version = "1.21.1";
  };
  multipart-post = {
    groups = [ "default" ];
@@ -2388,21 +2392,24 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1w1ypxa3n6mskkwb00b489314km19l61p5h3bar6zr8cng27c80p";
+      sha256 = "0sp8hvrk1jkkb3wpizhrkkl0s8agglwjj3f0dvvcw7f5n9cfy7c3";
      type = "gem";
    };
-    version = "7.3.0";
+    version = "7.3.3";
  };
  nori = {
-    dependencies = [ "bigdecimal" ];
+    dependencies = [
+      "bigdecimal"
+      "stringio"
+    ];
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "12wfv36jzc0978ij5c56nnfh5k8ax574njawigs98ysmp1x5s2ql";
+      sha256 = "01p6ns6fxrjba8q8yj624pjqmh0wmgcf9hk64k1n4gyb1i115pbj";
      type = "gem";
    };
-    version = "2.7.0";
+    version = "2.9.1";
  };
  options = {
    groups = [ "default" ];
@@ -2429,20 +2436,20 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1zxx3mx34vcgc77rpxn55mldaf45389880m1sppr4wgmcg2mx42y";
+      sha256 = "04nrir9wdpc4izqwqbysxyly8y7hsfr4fsv69rw91lfi9d5fv8lm";
      type = "gem";
    };
-    version = "0.1.0";
+    version = "0.6.3";
  };
  parallel = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0c719bfgcszqvk9z47w2p8j2wkz5y35k48ywwas5yxbbh3hm3haa";
+      sha256 = "0w697335hi5dk5ay9kyn53399sy87y8v0y6ij93m5wmshhadxrik";
      type = "gem";
    };
-    version = "1.27.0";
+    version = "1.28.0";
  };
  parser = {
    dependencies = [
@@ -2453,10 +2460,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1mmb59323ldv6vxfmy98azgsla9k3di3fasvpb28hnn5bkx8fdff";
+      sha256 = "0a4q5h2hcihk79dbr20scgkm56l79qp7fsvfvkxlv8nmapvxg9i1";
      type = "gem";
    };
-    version = "3.3.10.0";
+    version = "3.3.12.0";
  };
  parslet = {
    groups = [ "default" ];
@@ -2484,10 +2491,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0sqwckzzpj1mmmjnqcvqmq6adlxbhkf5ij3b6ir4i33ih4d2ih5z";
+      sha256 = "11ggfikcs1lv17nhmhqyyp6z8nq5pkfcj6a904047hljkxm0qlvv";
      type = "gem";
    };
-    version = "1.6.0";
+    version = "1.9.0";
  };
  progress_bar = {
    dependencies = [
@@ -2507,15 +2514,16 @@
    dependencies = [
      "coderay"
      "method_source"
+      "reline"
    ];
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0ssv704qg75mwlyagdfr9xxbzn1ziyqgzm0x474jkynk8234pm8j";
+      sha256 = "0kh5nv8v74k1ccy6gc7nd04aaf1cjkbk7g8pwy2izvcqaq36jv6p";
      type = "gem";
    };
-    version = "0.15.2";
+    version = "0.16.0";
  };
  pstore = {
    groups = [ "default" ];
@@ -2532,10 +2540,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "15dhl6k4gbax0xz8frfs4nsb6lg5zgax9vkr1pqzjmhfxddhn2gp";
+      sha256 = "08znfv30pxmdkjyihvbjqbvv874dj3nybmmyscl958dy3f7v12qs";
      type = "gem";
    };
-    version = "7.0.0";
+    version = "7.0.5";
  };
  racc = {
    groups = [ "default" ];
@@ -2562,10 +2570,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "175iisqb211n0qbfyqd8jz2g01q6xj038zjf4q0nm8k6kz88k7lc";
+      sha256 = "009p524zl0p0kfa65nii8wdmaigkmawv9pbvlcffky7islmmp0nb";
      type = "gem";
    };
-    version = "13.3.1";
+    version = "13.4.2";
  };
  recursive-open-struct = {
    dependencies = [ "ostruct" ];
@@ -2583,10 +2591,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "192mzi0wgwl024pwpbfa6c2a2xlvbh3mjd75a0sakdvkl60z64ya";
+      sha256 = "1fwfw26a32rps78920nn29shqg2zmqv72i89j1fap41isshida9m";
      type = "gem";
    };
-    version = "2.11.3";
+    version = "2.12.0";
  };
  reline = {
    dependencies = [ "io-console" ];
@@ -2619,10 +2627,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1q48hqws2dy1vws9schc0kmina40gy7sn5qsndpsfqdslh65snha";
+      sha256 = "1rd8k2xh5a21r6kbvkn6g8w8fxgcp23iarvzy4bphk2r0w11nbwz";
      type = "gem";
    };
-    version = "3.1.2";
+    version = "3.8.0";
  };
  rexml = {
    groups = [ "default" ];
@@ -2697,20 +2705,20 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "071bqrk2rblk3zq3jk1xxx0dr92y0szi5pxdm8waimxici706y89";
+      sha256 = "0iqxmw0knjiz5nf6pgr8ihs6cjzh89f0ppj3fqiz8cvms79x6sh8";
      type = "gem";
    };
-    version = "3.13.7";
+    version = "3.13.8";
  };
  rspec-support = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1cmgz34hwj5s3jwxhyl8mszs24nci12ffbrmr5jb1si74iqf739f";
+      sha256 = "0z64h5rznm2zv21vjdjshz4v0h7bxvg02yc6g7yzxakj11byah06";
      type = "gem";
    };
-    version = "3.13.6";
+    version = "3.13.7";
  };
  rubocop = {
    dependencies = [
@@ -2729,10 +2737,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0hpgpyzpzgmp28pirlyrif3albsk5kni2k67h5yvxfvr3g55w2d7";
+      sha256 = "0ca5inh368d4l24a2v2nbd3p4xc6s0pqs91j27h226nh04zmyha4";
      type = "gem";
    };
-    version = "1.81.6";
+    version = "1.86.1";
  };
  rubocop-ast = {
    dependencies = [
@@ -2743,10 +2751,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0xifbp09jfl1hdy9wwgq9dq2l7mf8y2ycm5d1zgcqvks7yzrppr2";
+      sha256 = "1nw84xk6vc2ls8sxqvyhxs2agh4l0jrws85d4bi3x0501lq8ijmr";
      type = "gem";
    };
-    version = "1.48.0";
+    version = "1.50.0";
  };
  ruby-progressbar = {
    groups = [ "default" ];
@@ -2814,16 +2822,15 @@
      "addressable"
      "faraday"
      "jwt"
-      "multi_json"
    ];
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0nydm087m5c3j85gvzvz30w1qb9pl2lzpznw746jha29ybxyj5yn";
+      sha256 = "1027zvf46y2x00s515a1f5qyvn59cl394glzr3dkbb87rdf4jvdp";
      type = "gem";
    };
-    version = "0.21.0";
+    version = "0.22.0";
  };
  socksify = {
    groups = [ "default" ];
@@ -2845,6 +2852,16 @@
    };
    version = "1.3.1";
  };
+  stringio = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1q92y9627yisykyscv0bdsrrgyaajc2qr56dwlzx7ysgigjv4z63";
+      type = "gem";
+    };
+    version = "3.2.0";
+  };
  strings = {
    dependencies = [
      "strings-ansi"
@@ -2876,10 +2893,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "023lbh48fcn72gwyh1x52ycs1wx1bnhdajmv0qvkidmdsmxnxzjd";
+      sha256 = "0wklh86rhpiff34ja0hda5pwdfywybjvb50hqhz90wpyhblqmhy4";
      type = "gem";
    };
-    version = "0.3.0";
+    version = "0.4.0";
  };
  thor = {
    groups = [ "default" ];
@@ -2906,10 +2923,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "00x5y9h4fbvrv4xrjk4cqlkm4vq8gv73ax4alj3ac2x77zsnnrk8";
+      sha256 = "168v339gqaly00i4zqg2ag2h10r3rl7999d0cqrrpb63gaa7fbr6";
      type = "gem";
    };
-    version = "1.3.0";
+    version = "2.0.4";
  };
  trailblazer-option = {
    groups = [ "default" ];
@@ -2929,6 +2946,7 @@
      "azure_mgmt_resources"
      "azure_mgmt_security"
      "azure_mgmt_storage"
+      "bigdecimal"
      "docker-api"
      "google-apis-admin_directory_v1"
      "google-apis-cloudkms_v1"
@@ -2947,10 +2965,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0nxcfi1ffpav3wdggig2g2flh3apnzygxbfa20ry3d12s99ay4b1";
+      sha256 = "127yk97wlzacn4kr7sgbjy9xfcyajxzh7y6k3m31cwxvhs7i4hsz";
      type = "gem";
    };
-    version = "3.13.4";
+    version = "3.16.5";
  };
  train-aws = {
    dependencies = [
@@ -3039,10 +3057,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "18lwwmbq4l0b6k48gbd1frcdzk6k95alcwvrxraic56fmfdxzsiz";
+      sha256 = "04i21aqlr7rkckdjb4qj76gsmfc0sdyrchlq0z1fqfhr8qs58lhf";
      type = "gem";
    };
-    version = "0.2.41";
+    version = "0.2.44";
  };
  train-core = {
    dependencies = [
@@ -3057,10 +3075,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0pimza1lq703awwsnxsl1kb014lxkr2saxz031grjsf81098108d";
+      sha256 = "151a6vqgq64gx3d4xqaacdvsvjpakkqsfll7yyrjpkkv4f4bzvi9";
      type = "gem";
    };
-    version = "3.13.4";
+    version = "3.16.5";
  };
  train-habitat = {
    groups = [ "default" ];
@@ -3097,10 +3115,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1nbzs6j6fnfmlhdpcqfh6d7iazb5l6xvan57krznlzvh00cr3c87";
+      sha256 = "1yl4hzwksa89xd7hzfhr299q1w8hqmvzcfqxxi7rhm22y9k5d8sg";
      type = "gem";
    };
-    version = "0.4.0";
+    version = "0.4.3";
  };
  tty-box = {
    dependencies = [
@@ -3278,9 +3296,9 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "119ypabas886gd0n9kiid3q41w76gz60s8qmiak6pljpkd56ps5j";
+      sha256 = "04hx33lsnp4q0qf8982mz0acs1dap5s2bsmihi0n0g08249sc4kj";
      type = "gem";
    };
-    version = "2.7.3";
+    version = "2.8.2";
  };
 }
--- a/pkgs/by-name/js/js8call/package.nix
+++ b/pkgs/by-name/js/js8call/package.nix
@@ -14,13 +14,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "js8call";
-  version = "2.5.2";
+  version = "3.0.3";

  src = fetchFromGitHub {
    owner = "JS8Call-improved";
    repo = "JS8Call-improved";
-    tag = "release/${finalAttrs.version}";
-    hash = "sha256-dpPh3+s29ksdVGc1I5JOJrqzS51Bda8afgU5RrO6B3w=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-yT+0nZQqNHQrc2biL2Qneg6CdNC2yy7bs+NvdQ3I1gQ=";
  };

  nativeBuildInputs = [
@@ -48,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
    cp JS8Call $out/bin/js8call
    cp ../LICENSE ../README.md $out/share/doc/js8call
    cp ../artwork/js8call_icon.png $out/share/icons/hicolor/128x128/apps
-    cp ../JS8Call.desktop $out/share/applications
+    cp ../.github/workflows/misc/JS8Call.desktop $out/share/applications
    runHook postInstall
  '';

--- a/pkgs/by-name/ki/kiwix-apple/package.nix
+++ b/pkgs/by-name/ki/kiwix-apple/package.nix
@@ -8,11 +8,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "kiwix-apple";
-  version = "3.15.1";
+  version = "3.16.1";

  src = fetchurl {
    url = "https://download.kiwix.org/release/kiwix-macos/kiwix-macos_${finalAttrs.version}.dmg";
-    hash = "sha256-3wZ7zavLmLyPYGrdFpnhd8a1paI65yHFdL6JzL1e0e0=";
+    hash = "sha256-Z1grFsJmCtTTZP8whjAISD8YJwrU0yieZ5ycxDzciGE=";
  };

  sourceRoot = ".";
--- a/pkgs/by-name/ko/komikku/package.nix
+++ b/pkgs/by-name/ko/komikku/package.nix
@@ -24,14 +24,14 @@

 python3.pkgs.buildPythonApplication (finalAttrs: {
  pname = "komikku";
-  version = "50.10.0";
+  version = "50.11.0";
  pyproject = false;

  src = fetchFromCodeberg {
    owner = "valos";
    repo = "Komikku";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-OhQR6hXpQhM0O7pgfTdVn8CY3OAHhH+U1X91G/j8kqk=";
+    hash = "sha256-WO0wqDZP6rIe7B2oboJctQ302Ot2ooecqCSWOERdURg=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ko/kotofetch/package.nix
+++ b/pkgs/by-name/ko/kotofetch/package.nix
@@ -6,7 +6,7 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "kotofetch";
-  version = "0.2.22";
+  version = "0.2.23";

  __structuredAttrs = true;

@@ -14,10 +14,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "hxpe-dev";
    repo = "kotofetch";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-aY8HRKSHLQKjl4b7v5q3SeNMc+GJPnE2XVrEsl+nGR0=";
+    hash = "sha256-mW0oMrmDUn8qsCCu870z6zS3szGVyCU4wnSytH6DkUE=";
  };

-  cargoHash = "sha256-r36x/I/RaIWFEoDYXf3edpLeqGvEyozhT4EuCTSEe/k=";
+  cargoHash = "sha256-g5SLS6PpcRNm1zcHkX8pvqk7s2yQ+zUAjp4CSCq/U/o=";

  nativeInstallCheckInputs = [ versionCheckHook ];
  doInstallCheck = true;
--- a/pkgs/by-name/ku/kubernix/package.nix
+++ b/pkgs/by-name/ku/kubernix/package.nix
@@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "kubernix";
-  version = "0.3.3";
+  version = "0.3.4";

  src = fetchFromGitHub {
    owner = "saschagrunert";
    repo = "kubernix";
    tag = "v${finalAttrs.version}";
-    sha256 = "sha256-WHXhPa+U53Z8GTCpKYk2j4SnDxZX+E/rQUHUvOz7G6c=";
+    sha256 = "sha256-8wFrcs1XuW8Fz4P12eHAeA62ZthwO9grrtTHxhL+f1o=";
  };

-  cargoHash = "sha256-NQ0d7kk6nw1D/a57+nlrfjAr4gVKVjPrH59dcbKcII0=";
+  cargoHash = "sha256-sz7omys2cLTx+pHmQKjikxwJjSz8P0scO59KI2zm2e0=";

  # Tests require network access
  doCheck = false;
--- a/pkgs/by-name/le/legcord/package.nix
+++ b/pkgs/by-name/le/legcord/package.nix
@@ -6,24 +6,28 @@
  pnpmConfigHook,
  pnpm_10,
  nodejs,
-  electron,
+  electron_43,
  makeWrapper,
  copyDesktopItems,
  makeDesktopItem,
  autoPatchelfHook,
  pipewire,
  libpulseaudio,
+  jq,
  nix-update-script,
 }:
+let
+  electron = electron_43;
+in
 stdenv.mkDerivation (finalAttrs: {
  pname = "legcord";
-  version = "1.2.4";
+  version = "1.3.0";

  src = fetchFromGitHub {
    owner = "Legcord";
    repo = "Legcord";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-nai8lcimEts/E3bwUyQufLYIHhUK83IH431PUQFtQJI=";
+    hash = "sha256-Mjub2OFb5RN4yBwdUk8v6uo/dUeYZ5nELmpPzEFmx2c=";
  };

  nativeBuildInputs = [
@@ -37,6 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
    # legcord uses venmic, which is a shipped as a prebuilt node module
    # and needs to be patched
    autoPatchelfHook
+    jq
  ];

  buildInputs = [
@@ -49,9 +54,23 @@ stdenv.mkDerivation (finalAttrs: {
    inherit (finalAttrs) pname version src;
    pnpm = pnpm_10;
    fetcherVersion = 4;
-    hash = "sha256-a0FvNwEAEAltQltgUf4tX0IGSdcYHkSodx4b9v5QQcg=";
+    hash = "sha256-xBW7D/3Nz/h7VqLqTiVL9dTjXLdNOqfdIlj66iYwuhM=";
  };

+  preBuild = ''
+    # Validate electron version matches upstream package.json
+    expectedMajor="$(jq -r '.devDependencies.electron | ltrimstr("^") | split(".") | .[0]' < package.json)"
+    actualMajor="${lib.versions.major electron.version}"
+    if [ "$actualMajor" != "$expectedMajor" ] 2>/dev/null; then
+      echo "ERROR: electron version mismatch between package.json (major $expectedMajor) and nixpkgs (major $actualMajor)"
+      exit 1
+    fi
+
+    # electron builds must be writable
+    cp -r ${electron.dist} electron-dist
+    chmod -R u+w electron-dist
+  '';
+
  buildPhase = ''
    runHook preBuild

@@ -76,7 +95,7 @@ stdenv.mkDerivation (finalAttrs: {
    pnpm exec electron-builder \
      --dir \
      -c.asarUnpack="**/*.node" \
-      -c.electronDist="${electron.dist}" \
+      -c.electronDist=electron-dist \
      -c.electronVersion="${electron.version}"

    runHook postBuild
--- a/pkgs/by-name/le/leviculum/package.nix
+++ b/pkgs/by-name/le/leviculum/package.nix
@@ -10,7 +10,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "leviculum";
-  version = "0.7.0";
+  version = "0.8.0";
  __structuredAttrs = true;

  src = fetchFromGitea {
@@ -19,10 +19,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    repo = "leviculum";
    tag = "v${finalAttrs.version}";
    fetchSubmodules = false;
-    hash = "sha256-/ylHrCLs9QSTiox3/JHJtZBYLlysLsezG8iz6C1DtCI=";
+    hash = "sha256-Gfx1XxkIEfPxag0JHBU7+rNV63HnOcxBxqNiKtjM9h4=";
  };

-  cargoHash = "sha256-DfwN4DTWcezcDRkl27cZXQdfXIhxlAj6+2nmYXhxius=";
+  cargoHash = "sha256-CfdlcujftaPTGewjO+H7p9sQoXV5MmVF3wlZoRdW9BM=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/li/librevna/package.nix
+++ b/pkgs/by-name/li/librevna/package.nix
@@ -26,7 +26,12 @@ stdenv.mkDerivation (finalAttrs: {

  postPatch = ''
    substituteInPlace resources/librevna.desktop \
-      --replace-fail Exec=/opt/LibreVNA-GUI Exec=$out/bin/LibreVNA-GUI
+      --replace-fail Exec=/opt/LibreVNA-GUI Exec=$out/bin/LibreVNA-GUI \
+      --replace-fail Icon=librevna.png Icon=librevna
+
+    substituteInPlace main.cpp \
+      --replace-fail 'QCoreApplication::setApplicationName("LibreVNA-GUI");' \
+        'QCoreApplication::setApplicationName("LibreVNA-GUI"); QGuiApplication::setDesktopFileName("librevna");'
  '';

  nativeBuildInputs = [
@@ -64,6 +69,7 @@ stdenv.mkDerivation (finalAttrs: {
        install -Dm755 LibreVNA-GUI -t $out/bin
        install -Dm644 ../51-vna.rules -t $out/etc/udev/rules.d
        install -Dm644 resources/librevna.desktop -t $out/share/applications
+        install -Dm644 resources/librevna.png $out/share/icons/hicolor/256x256/apps/librevna.png
        install -Dm644 resources/librevna.png -t $out/share/pixmaps

        runHook postInstall
--- a/pkgs/by-name/li/litestream/package.nix
+++ b/pkgs/by-name/li/litestream/package.nix
@@ -3,16 +3,17 @@
  fetchFromGitHub,
  lib,
  nixosTests,
+  testers,
 }:
 buildGoModule (finalAttrs: {
  pname = "litestream";
-  version = "0.5.11";
+  version = "0.5.15";

  src = fetchFromGitHub {
    owner = "benbjohnson";
    repo = "litestream";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-LGlcc/FoBiZ7YiZUyqdYmAoV9BgUm4h2/n/KQ3NzFa4=";
+    hash = "sha256-SsHyi7E/1dHEzFQgKr8eSi1fEf61iqTQ6Avr4c/h9j4=";
  };

  ldflags = [
@@ -21,15 +22,27 @@ buildGoModule (finalAttrs: {
    "-X main.Version=${finalAttrs.version}"
  ];

-  vendorHash = "sha256-Zf7BdL0mljGFrRTx4JJxAUXUm6Uh/sVJP/zOJ4ef/CU=";
+  vendorHash = "sha256-Ms33rbFjsWzGbLy9v6kFGl6b62QQI4XAZ4wr73g5udw=";

-  passthru.tests = { inherit (nixosTests) litestream; };
+  # httptest servers in tests
+  __darwinAllowLocalNetworking = true;
+
+  passthru.tests = {
+    inherit (nixosTests) litestream;
+    version = testers.testVersion {
+      package = finalAttrs.finalPackage;
+      command = "litestream version";
+    };
+  };

  meta = {
    description = "Streaming replication for SQLite";
    mainProgram = "litestream";
    license = lib.licenses.asl20;
    homepage = "https://litestream.io/";
-    maintainers = with lib.maintainers; [ fbrs ];
+    maintainers = with lib.maintainers; [
+      fbrs
+      konradmalik
+    ];
  };
 })
--- a/pkgs/by-name/lx/lxmf-rs/package.nix
+++ b/pkgs/by-name/lx/lxmf-rs/package.nix
@@ -13,17 +13,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "lxmf-rs";
-  version = "0.9.6";
+  version = "0.9.7";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "FreeTAKTeam";
    repo = "LXMF-rs";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-lkvfcIdSlvhWMDGv/N20uKfUygz9OUwQ2kFTR+oqeow=";
+    hash = "sha256-ZK48G8oDms8GepF+g2SxWalBbSP3yD1IHDVyev/Sc7w=";
  };

-  cargoHash = "sha256-1ybnT3dSuPP+96fGP1ZBt1n7ommmD3/lsc3pJ+sK0yc=";
+  cargoHash = "sha256-ZqeTA5hbcYO12llZZ9/U1L9vOCxeY3GdT9s2TF7lU0I=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/ma/maestro/package.nix
+++ b/pkgs/by-name/ma/maestro/package.nix
@@ -10,11 +10,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "maestro";
-  version = "2.7.0";
+  version = "2.8.0";

  src = fetchurl {
    url = "https://github.com/mobile-dev-inc/maestro/releases/download/cli-${finalAttrs.version}/maestro.zip";
-    hash = "sha256-pMyra2BGF+eu9ttPiFZmBW6r5c+jK++qO8mUBBuPy7U=";
+    hash = "sha256-s+VhFhkE+zkYdcpYNNWyLPCwHAUt0bQIrYPjDY+JUbM=";
  };

  dontUnpack = true;
--- a/pkgs/by-name/mb/mbedtls/generic.nix
+++ b/pkgs/by-name/mb/mbedtls/generic.nix
@@ -5,6 +5,7 @@
  hash,
  patches ? [ ],
  fetchFromGitHub,
+  buildPackages,

  cmake,
  ninja,
@@ -87,6 +88,10 @@ stdenv.mkDerivation rec {
    "-DCMAKE_C_FLAGS=-fzero-init-padding-bits=unions"
  ];

+  env = lib.optionalAttrs (stdenv.buildPlatform != stdenv.hostPlatform) {
+    HOSTCC = lib.getExe buildPackages.stdenv.cc;
+  };
+
  doCheck = true;

  # Parallel checking causes test failures
--- a/pkgs/by-name/me/mealie/package.nix
+++ b/pkgs/by-name/me/mealie/package.nix
@@ -19,12 +19,12 @@
 }:

 let
-  version = "3.20.1";
+  version = "3.22.0";
  src = fetchFromGitHub {
    owner = "mealie-recipes";
    repo = "mealie";
    tag = "v${version}";
-    hash = "sha256-SkPbu0DUNyjo1ARjZX+BXq+3ehZqnrku9kPjwsTJfuM=";
+    hash = "sha256-3jDKcDHiA+7ePJGEyGhBSZrhkFQYHrak+AiOHoMv2qE=";
  };

  frontend = stdenv.mkDerivation {
@@ -36,7 +36,7 @@ let

    yarnOfflineCache = fetchYarnDeps {
      yarnLock = "${src}/frontend/yarn.lock";
-      hash = "sha256-nhV93uRfKUa/G7ikJkd6l9IudgMk7PZ7ujZNnwIZ71k=";
+      hash = "sha256-S0i7FGD6be/MIBZRDlEb65tzVUuMPLkg9rL71lkrmms=";
    };

    nativeBuildInputs = [
@@ -162,7 +162,7 @@ pythonpkgs.buildPythonApplication (finalAttrs: {
    rm -rf dev # Do not need dev scripts & code

    substituteInPlace pyproject.toml \
-     --replace-fail '"setuptools==82.0.1"' '"setuptools"'
+     --replace-fail '"setuptools==83.0.0"' '"setuptools"'

    substituteInPlace mealie/__init__.py \
      --replace-fail '__version__ = ' '__version__ = "v${version}" #'
--- a/pkgs/by-name/me/meraki-cli/package.nix
+++ b/pkgs/by-name/me/meraki-cli/package.nix
@@ -23,6 +23,11 @@ python3Packages.buildPythonApplication (finalAttrs: {
    "TestUpgrade"
  ];

+  disabledTestPaths = [
+    # requests-mock cannot intercept meraki's httpx client
+    "tests/test_user_agent.py"
+  ];
+
  build-system = with python3Packages; [
    setuptools
  ];
@@ -36,7 +41,6 @@ python3Packages.buildPythonApplication (finalAttrs: {

  nativeCheckInputs = with python3Packages; [
    pytestCheckHook
-    requests-mock
  ];

  pythonImportsCheck = [
--- a/pkgs/by-name/me/metasploit/Gemfile
+++ b/pkgs/by-name/me/metasploit/Gemfile
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 source "https://rubygems.org"

-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.4.146"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.5.0"

 gem "getoptlong"
 gem "syslog", "~> 0.3.0"
--- a/pkgs/by-name/me/metasploit/Gemfile.lock
+++ b/pkgs/by-name/me/metasploit/Gemfile.lock
@@ -1,9 +1,9 @@
 GIT
  remote: https://github.com/rapid7/metasploit-framework
-  revision: 7c96e48b424d2c5870db8c02883bfe79b0f7d21e
-  ref: refs/tags/6.4.146
+  revision: 00e217beb472b1eeca0adc324fca1078fa90c52a
+  ref: refs/tags/6.5.0
  specs:
-    metasploit-framework (6.4.146)
+    metasploit-framework (6.5.0)
      aarch64
      abbrev
      actionpack (~> 8.0.5)
@@ -49,9 +49,9 @@ GIT
      metasploit-concern
      metasploit-credential (>= 6.0.21)
      metasploit-model
-      metasploit-payloads (= 2.0.245)
+      metasploit-payloads (= 2.0.247)
      metasploit_data_models (>= 6.0.15)
-      metasploit_payloads-mettle (= 1.0.46)
+      metasploit_payloads-mettle (= 1.0.48)
      mqtt
      msgpack (~> 1.6.0)
      mutex_m
@@ -173,7 +173,7 @@ GEM
    arel-helpers (2.17.0)
      activerecord (>= 3.1.0)
    aws-eventstream (1.4.0)
-    aws-partitions (1.1275.0)
+    aws-partitions (1.1277.0)
    aws-sdk-core (3.254.0)
      aws-eventstream (~> 1, >= 1.3.0)
      aws-partitions (~> 1, >= 1.992.0)
@@ -188,13 +188,13 @@ GEM
    aws-sdk-ec2instanceconnect (1.74.0)
      aws-sdk-core (~> 3, >= 3.254.0)
      aws-sigv4 (~> 1.5)
-    aws-sdk-iam (1.149.0)
+    aws-sdk-iam (1.150.0)
      aws-sdk-core (~> 3, >= 3.254.0)
      aws-sigv4 (~> 1.5)
    aws-sdk-kms (1.130.0)
      aws-sdk-core (~> 3, >= 3.254.0)
      aws-sigv4 (~> 1.5)
-    aws-sdk-s3 (1.228.1)
+    aws-sdk-s3 (1.228.2)
      aws-sdk-core (~> 3, >= 3.254.0)
      aws-sdk-kms (~> 1)
      aws-sigv4 (~> 1.5)
@@ -288,7 +288,7 @@ GEM
    jmespath (1.6.2)
    jsobfu (0.4.2)
      rkelly-remix
-    json (2.21.1)
+    json (2.21.2)
    json-schema (6.2.0)
      addressable (~> 2.8)
      bigdecimal (>= 3.1, < 5)
@@ -332,7 +332,7 @@ GEM
      drb
      mutex_m
      railties (>= 7.0, < 8.1)
-    metasploit-payloads (2.0.245)
+    metasploit-payloads (2.0.247)
    metasploit_data_models (6.0.18)
      activerecord (>= 7.0, < 8.1)
      activesupport (>= 7.0, < 8.1)
@@ -346,7 +346,7 @@ GEM
      railties (>= 7.0, < 8.1)
      recog
      webrick
-    metasploit_payloads-mettle (1.0.46)
+    metasploit_payloads-mettle (1.0.48)
    mime-types (3.7.0)
      logger
      mime-types-data (~> 3.2025, >= 3.2025.0507)
@@ -449,7 +449,7 @@ GEM
    rasn1 (0.14.0)
      strptime (~> 0.2.5)
    rb-readline (0.5.5)
-    rbs (4.1.0)
+    rbs (4.1.1)
      logger
      prism (>= 1.6.0)
      tsort
@@ -532,7 +532,7 @@ GEM
    ruby-macho (6.0.0)
    ruby-mysql (4.2.1)
    ruby-rc4 (0.1.5)
-    ruby_smb (3.3.21)
+    ruby_smb (3.3.22)
      bindata (= 2.4.15)
      openssl-ccm
      openssl-cmac
--- a/pkgs/by-name/me/metasploit/gemset.nix
+++ b/pkgs/by-name/me/metasploit/gemset.nix
@@ -124,10 +124,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1adxiwh8jr292y6k8pkwik82ip2chgypmgjhz2w59kg5rmsl7rwd";
+      sha256 = "07jhyq6jx51v8p31lk41q6c6w8a69fq8kx7v8c6acibahybakga0";
      type = "gem";
    };
-    version = "1.1275.0";
+    version = "1.1277.0";
  };
  aws-sdk-core = {
    groups = [ "default" ];
@@ -164,10 +164,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "106ynnplkrhcsrf1cbla2yc6zv53b9512a47zfl0s5bbyw6can3s";
+      sha256 = "00gx2m6lgxiy4h37v1f3vl9xsygypl71pk69ikvp3c1rdfvvffgp";
      type = "gem";
    };
-    version = "1.149.0";
+    version = "1.150.0";
  };
  aws-sdk-kms = {
    groups = [ "default" ];
@@ -184,10 +184,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0gjm1xbdjssjjhwhn4fm7jlj000vs43q3zm658x73ab8s33gcrc8";
+      sha256 = "12s686zpqxp9jrd8wwvayhi74jg34ck5sp0ia8hmzd2lnmwbh5qj";
      type = "gem";
    };
-    version = "1.228.1";
+    version = "1.228.2";
  };
  aws-sdk-ssm = {
    groups = [ "default" ];
@@ -734,10 +734,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "10q54a0dkm0050n0zzqiv2ln8w931wszybbhym1i8r4mbpvkv90k";
+      sha256 = "0shwgjqbj856mb6m9kgkpy08nhym2gdvc2yaprlimfmky9y3n78z";
      type = "gem";
    };
-    version = "2.21.1";
+    version = "2.21.2";
  };
  json-schema = {
    groups = [ "default" ];
@@ -844,12 +844,12 @@
    platforms = [ ];
    source = {
      fetchSubmodules = false;
-      rev = "7c96e48b424d2c5870db8c02883bfe79b0f7d21e";
-      sha256 = "0fp4v52fdfkcfhv74h7ks4yhr0q556jgvkfr7v1dn95n7h8n1x9h";
+      rev = "00e217beb472b1eeca0adc324fca1078fa90c52a";
+      sha256 = "01ir5z7wk8jbhd2xmvdgqinmllfraf8bhgfvpi2aybcd6pcrv9sz";
      type = "git";
      url = "https://github.com/rapid7/metasploit-framework";
    };
-    version = "6.4.146";
+    version = "6.5.0";
  };
  metasploit-model = {
    groups = [ "default" ];
@@ -866,10 +866,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1cry73lkmg5p32ah7kn7scfawmgxc78i24nm559yzrrm1dqr2brx";
+      sha256 = "13hpnymi8zah9xv44pij1am33662f924hhvj33ipg0ry9r6i8iz4";
      type = "gem";
    };
-    version = "2.0.245";
+    version = "2.0.247";
  };
  metasploit_data_models = {
    groups = [ "default" ];
@@ -886,10 +886,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0i179sc2acy1d6kh24yry4sdg23gllzwc3kkbwsm41fdhqhkd10y";
+      sha256 = "0s83sgkynzc3hn4r66mw8f8cc67z9rmg86byyn6567ar78r40h1k";
      type = "gem";
    };
-    version = "1.0.46";
+    version = "1.0.48";
  };
  mime-types = {
    groups = [ "default" ];
@@ -1420,10 +1420,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0wpx4dlypl5i8bz2zss2pl5mnra904frn3h9l95knr5h128abawb";
+      sha256 = "17ibc9hx9v6f30fphmvy4ph63djja54msr2pcfax672xz7r1iw8v";
      type = "gem";
    };
-    version = "4.1.0";
+    version = "4.1.1";
  };
  rdoc = {
    groups = [ "default" ];
@@ -1720,10 +1720,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0v63xqvlkprvxmlwav43qlkdffvr4bbhk6im0978l9w5qyqd1fdn";
+      sha256 = "0rp8zvi7skm9i5fl8p7rr0fnriprfx28g84l08ii6pn9qgf3zgp8";
      type = "gem";
    };
-    version = "3.3.21";
+    version = "3.3.22";
  };
  rubyntlm = {
    groups = [ "default" ];
--- a/pkgs/by-name/me/metasploit/package.nix
+++ b/pkgs/by-name/me/metasploit/package.nix
@@ -18,13 +18,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "metasploit-framework";
-  version = "6.4.146";
+  version = "6.5.0";

  src = fetchFromGitHub {
    owner = "rapid7";
    repo = "metasploit-framework";
    tag = finalAttrs.version;
-    hash = "sha256-MPVgETy2JNvCPtnN/aQpBYMMPdHzQHI2dGy65kTZ5Do=";
+    hash = "sha256-X6ed2TWNLa9EvNs9uJBT2VFabcSv7dpFg0uiyc8vOQY=";
  };

  __structuredAttrs = true;
--- a/pkgs/by-name/mi/microscheme/package.nix
+++ b/pkgs/by-name/mi/microscheme/package.nix
@@ -8,17 +8,19 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "microscheme";
-  version = "0.9.3";
+  version = "0.9.4";

  src = fetchFromGitHub {
    owner = "ryansuchocki";
    repo = "microscheme";
-    rev = "v${finalAttrs.version}";
-    sha256 = "5qTWsBCfj5DCZ3f9W1bdo6WAc1DZqVxg8D7pwC95duQ=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-/LUiPZRV1AuCvKS1+0S0JCHauZMPGr2eXag0dnPk1K0=";
  };

  postPatch = ''
-    substituteInPlace makefile --replace gcc ${stdenv.cc.targetPrefix}cc
+    substituteInPlace makefile \
+      --replace-fail gcc ${stdenv.cc.targetPrefix}cc \
+      --replace-fail " -Werror" ""
  '';

  nativeBuildInputs = [
@@ -27,6 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  makeFlags = [ "PREFIX=${placeholder "out"}" ];
+  buildFlags = [ "build" ];

  meta = {
    homepage = "https://ryansuchocki.github.io/microscheme/";
--- a/pkgs/by-name/mp/mpop/package.nix
+++ b/pkgs/by-name/mp/mpop/package.nix
@@ -20,11 +20,11 @@ assert lib.assertOneOf "sslLibrary" sslLibrary [

 stdenv.mkDerivation (finalAttrs: {
  pname = "mpop";
-  version = "1.4.22";
+  version = "1.4.23";

  src = fetchurl {
    url = "https://marlam.de/mpop/releases/mpop-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-LNZKnCmlreNCkjDHBhDKS26jBfvCZPaWG12Fp6jOzUs=";
+    sha256 = "sha256-Avwv9E9iuPv0J+1tixbg03R1EZglT7HmrTbrbZqTgBc=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ne/neonmodem/package.nix
+++ b/pkgs/by-name/ne/neonmodem/package.nix
@@ -10,16 +10,16 @@

 buildGoModule (finalAttrs: {
  pname = "neonmodem";
-  version = "1.0.7";
+  version = "1.1.0";

  src = fetchFromGitHub {
    owner = "mrusme";
    repo = "neonmodem";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-gwhQG8H1OnGQmawPQ3m6VKVooBh8rZaNr6FDl6fgZXc=";
+    hash = "sha256-O12zkygenzSMNwV5gqJuW5/vCblU/ebbT/0JotrfNiQ=";
  };

-  vendorHash = "sha256-zqQtuyFrsDB1xRdl4cbaTsCawMrBvcu78zXgU2jUwHI=";
+  vendorHash = "sha256-PAtt72mGPDyS1wZMHOwrO8crC0mJ1GPAIm3i5T16xQY=";

  passthru.updateScript = nix-update-script { };

@@ -44,7 +44,10 @@ buildGoModule (finalAttrs: {
    homepage = "https://neonmodem.com";
    downloadPage = "https://github.com/mrusme/neonmodem/releases";
    changelog = "https://github.com/mrusme/neonmodem/releases/tag/v${finalAttrs.version}";
+
+    # license is expected to change with the next release (commit: b3b5ff2)
    license = lib.licenses.gpl3Only;
+
    maintainers = with lib.maintainers; [ acuteaangle ];
    mainProgram = "neonmodem";
  };
--- a/pkgs/by-name/ne/nerva/package.nix
+++ b/pkgs/by-name/ne/nerva/package.nix
@@ -6,13 +6,13 @@

 buildGoModule (finalAttrs: {
  pname = "nerva";
-  version = "1.53.1";
+  version = "1.57.0";

  src = fetchFromGitHub {
    owner = "praetorian-inc";
    repo = "nerva";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-nWK1D95mJINngjntsRRXzwUq72fZVCOxC9AB18J+6Jo=";
+    hash = "sha256-6E0HrSrZUmT02utEZxosTB4ReKvUJPl7SySGGUXAI3E=";
  };

  vendorHash = "sha256-Z0MSD+1/1VzrJ+pz5x0JvxrCxtJe59ckaTqHK/+TVN8=";
--- a/pkgs/by-name/ne/netpeek/package.nix
+++ b/pkgs/by-name/ne/netpeek/package.nix
@@ -14,7 +14,7 @@
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "netpeek";
-  version = "0.3.0";
+  version = "0.3.1";
  pyproject = false;

  __structuredAttrs = true;
@@ -23,7 +23,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
    owner = "ZingyTomato";
    repo = "NetPeek";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-SpWqj2D0gTjMgcn7TdmCLFqDTQITBQvfOZ9Jx2TerUQ=";
+    hash = "sha256-FsqCR4h5rwmtVJYEH9u7zaFDnfgzRd8KprXUhlGVIKU=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/no/nodenv/package.nix
+++ b/pkgs/by-name/no/nodenv/package.nix
@@ -8,11 +8,14 @@ stdenv.mkDerivation (finalAttrs: {
  pname = "nodenv";
  version = "1.5.0";

+  __structuredAttrs = true;
+  strictDeps = true;
+
  src = fetchFromGitHub {
    owner = "nodenv";
    repo = "nodenv";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-PGeZKL7qsffMAZIsCLB244Fuu48GyWw5Rh67ePu6h38=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-PGeZKL7qsffMAZIsCLB244Fuu48GyWw5Rh67ePu6h38=";
  };

  buildPhase = ''
--- a/pkgs/by-name/pa/pack/package.nix
+++ b/pkgs/by-name/pa/pack/package.nix
@@ -9,18 +9,18 @@

 buildGoModule (finalAttrs: {
  pname = "pack";
-  version = "0.38.2";
+  version = "0.40.8";

  src = fetchFromGitHub {
    owner = "buildpacks";
    repo = "pack";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-JDvNG0HMwr/bbWbuSLwuC5y+ZePECW4u+dzMBcKrcNk=";
+    hash = "sha256-mD32ZQ/PxiWnOvCdDFlNx1NIevhfgPcg9+ToUmfM6jo=";
  };

  subPackages = [ "." ];

-  vendorHash = "sha256-PvGoHJP+MsfidKz72qFx638x+uirhgckIKCBdTUrqB8=";
+  vendorHash = "sha256-0cyxhyEt4P+sd0FmN177rsTugWM0x2Ebk1LEHtX9wZE=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/pa/parquet-tools/package.nix
+++ b/pkgs/by-name/pa/parquet-tools/package.nix
@@ -5,7 +5,7 @@
  addBinToPathHook,
 }:

-python3Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication (finalAttrs: {
  pname = "parquet-tools";
  version = "0.2.16";

@@ -14,7 +14,7 @@ python3Packages.buildPythonApplication rec {
  src = fetchFromGitHub {
    owner = "ktrueda";
    repo = "parquet-tools";
-    tag = version;
+    tag = finalAttrs.version;
    hash = "sha256-mV66R5ejfzH1IasmoyAWAH5vzrnLVVhOqKBMfWKIVY0=";
  };

@@ -24,24 +24,17 @@ python3Packages.buildPythonApplication rec {
    ./moto5.patch
  ];

-  postPatch = ''
-    substituteInPlace tests/test_inspect.py \
-      --replace "parquet-cpp-arrow version 5.0.0" "parquet-cpp-arrow version ${python3Packages.pyarrow.version}" \
-      --replace "serialized_size: 2222" "serialized_size: 2221" \
-      --replace "format_version: 1.0" "format_version: 2.6"
-  '';
-
  pythonRelaxDeps = [
-    "halo"
+    "pandas"
    "tabulate"
    "thrift"
  ];

-  nativeBuildInputs = with python3Packages; [
+  build-system = with python3Packages; [
    poetry-core
  ];

-  propagatedBuildInputs = with python3Packages; [
+  dependencies = with python3Packages; [
    boto3
    colorama
    halo
@@ -74,9 +67,9 @@ python3Packages.buildPythonApplication rec {
  meta = {
    description = "CLI tool for parquet files";
    homepage = "https://github.com/ktrueda/parquet-tools";
-    changelog = "https://github.com/ktrueda/parquet-tools/releases/tag/${version}";
+    changelog = "https://github.com/ktrueda/parquet-tools/releases/tag/${finalAttrs.version}";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ cpcloud ];
    mainProgram = "parquet-tools";
  };
-}
+})
--- a/pkgs/by-name/pe/pekwm/package.nix
+++ b/pkgs/by-name/pe/pekwm/package.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
  version = "0.3.2";

  src = fetchFromGitHub {
-    owner = "pekdon";
+    owner = "pekwm";
    repo = "pekwm";
    rev = "release-${finalAttrs.version}";
    hash = "sha256-rwvecE9T+/zZg0rRUDl/DEMGH9ZmuvYj/Rz6vzmMv1I=";
--- a/pkgs/by-name/pg/pgmodeler/package.nix
+++ b/pkgs/by-name/pg/pgmodeler/package.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
  version = "1.2.3";

  src = fetchFromGitHub {
-    owner = "pgmodeler";
+    owner = "nullptrlabs";
    repo = "pgmodeler";
    rev = "v${finalAttrs.version}";
    sha256 = "sha256-WA3EOJm9RrKk7DrzdrpiihW+LhJOvvE2uajGwPCsBIk=";
--- a/pkgs/by-name/ph/phpantom-lsp/package.nix
+++ b/pkgs/by-name/ph/phpantom-lsp/package.nix
@@ -21,7 +21,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
  __structuredAttrs = true;

  src = fetchFromGitHub {
-    owner = "AJenbo";
+    owner = "PHPantom-dev";
    repo = "phpantom_lsp";
    tag = finalAttrs.version;
    hash = "sha256-euWaFH40VHefZewUcKvsLwwHZP+GwfTN8kfuAkaABB8=";
@@ -55,9 +55,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
  };

  meta = {
-    changelog = "https://github.com/AJenbo/phpantom_lsp/releases/tag/${finalAttrs.src.tag}";
+    changelog = "https://github.com/PHPantom-dev/phpantom_lsp/releases/tag/${finalAttrs.src.tag}";
    description = "Fast, lightweight PHP language server written in Rust";
-    homepage = "https://github.com/AJenbo/phpantom_lsp";
+    homepage = "https://github.com/PHPantom-dev/phpantom_lsp";
    license = lib.licenses.mit;
    mainProgram = "phpantom_lsp";
    maintainers = with lib.maintainers; [ nanoyaki ];
--- a/pkgs/by-name/pi/pico-sdk/package.nix
+++ b/pkgs/by-name/pi/pico-sdk/package.nix
@@ -17,7 +17,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "pico-sdk";
-  version = "2.2.0";
+  version = "2.3.0";

  src = fetchFromGitHub {
    owner = "raspberrypi";
@@ -26,9 +26,9 @@ stdenv.mkDerivation (finalAttrs: {
    fetchSubmodules = withSubmodules;
    hash =
      if withSubmodules then
-        "sha256-8ubZW6yQnUTYxQqYI6hi7s3kFVQhe5EaxVvHmo93vgk="
+        "sha256-ujqnFjJgvja++GQbcrqSgbxi/DxB6ryQP+sGiFl1bms="
      else
-        "sha256-hQdEZD84/cnLSzP5Xr9vbOGROQz4BjeVOnvbyhe6rfM=";
+        "sha256-QFKeOSYDuoSuVQsZ68fyQgVnGxZdBl8sehbQf665suM=";
  };

  cmakeFlags = [
@@ -50,7 +50,12 @@ stdenv.mkDerivation (finalAttrs: {
  '';

  passthru = {
-    updateScript = nix-update-script { };
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--subpackage"
+        "tests.withSubmodules"
+      ];
+    };
    tests = {
      withSubmodules = pico-sdk.override { withSubmodules = true; };
    };
--- a/Show More
+++ b/Show More