diff --git a/nixos/modules/services/desktop-managers/gnome.nix b/nixos/modules/services/desktop-managers/gnome.nix
index 3747a491098f..a56325fe7201 100644
--- a/nixos/modules/services/desktop-managers/gnome.nix
+++ b/nixos/modules/services/desktop-managers/gnome.nix
@@ -435,6 +435,7 @@ in
           optionalPackages = [
             pkgs.adwaita-icon-theme
             nixos-background-info
+            pkgs.glycin-thumbnailer # Image thumbnailers
             pkgs.gnome-backgrounds
             pkgs.gnome-bluetooth
             pkgs.gnome-color-manager
@@ -443,6 +444,7 @@ in
             pkgs.gnome-user-docs
             pkgs.glib # for gsettings program
             pkgs.gnome-menus
+            pkgs.gst-thumbnailers # Audio and video thumbnailers
             pkgs.gtk3.out # for gtk-launch program
             pkgs.xdg-user-dirs # Update user dirs as described in https://freedesktop.org/wiki/Software/xdg-user-dirs/
             pkgs.xdg-user-dirs-gtk # Used to create the default bookmarks
diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index 7da9fdfbf704..52b99ed04569 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -424,18 +424,18 @@ in
 
   docker_29 =
     let
-      version = "29.6.2";
+      version = "29.7.2";
     in
     callPackage dockerGen {
       inherit version;
       cliRev = "v${version}";
-      cliHash = "sha256-WpPSePMCfWAVxCkX1nZyI+sra/Vug009ZPmnVKDaX0I=";
+      cliHash = "sha256-ZYXRX4IQfUbb21yk/NodO5NH5OeX/KFDL9UdFS1e5ng=";
       mobyRev = "docker-v${version}";
-      mobyHash = "sha256-zrvrZCRUuiZ2vixZNOUFeGmDehHzSI+FzDMzV1gMqMc=";
-      runcRev = "v1.3.6";
-      runcHash = "sha256-cBMYZOElWHQ4OkF2NlYJSZrlW4833WD8CRJRkkXeKJc=";
-      containerdRev = "v2.2.6";
-      containerdHash = "sha256-Ngo9x847cXFYPnj/0I+g7BeV7e1/5T2YXfA1zkIdiPg=";
+      mobyHash = "sha256-k28c4cwt+ASVj8FTvM8dgIOL3yqR5wbI21r3LtrVamU=";
+      runcRev = "v1.4.3";
+      runcHash = "sha256-I9DruagoSWjrEBB4n+w5rzali5wvD/q3tVQFWPDnLAI=";
+      containerdRev = "v2.3.3";
+      containerdHash = "sha256-wa9Pixaq5RRrJucWibbBe4n6s53Pdj+mr5gLoFmDgLU=";
       tiniRev = "369448a167e8b3da4ca5bca0b3307500c3371828";
       tiniHash = "sha256-jCBNfoJAjmcTJBx08kHs+FmbaU82CbQcf0IVjd56Nuw=";
     };
diff --git a/pkgs/by-name/an/anker-powerconf-c200-linux-tools/package.nix b/pkgs/by-name/an/anker-powerconf-c200-linux-tools/package.nix
new file mode 100644
index 000000000000..1d4842c4eaa8
--- /dev/null
+++ b/pkgs/by-name/an/anker-powerconf-c200-linux-tools/package.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "anker-powerconf-c200-linux-tools";
+  version = "0.1.0";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "erans";
+    repo = "anker-powerconf-c200-linux-tools";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-txIVTbqxnFQ8GcJgxTp89Qc3U5CXkYolXCO4E1PXHHA=";
+  };
+
+  strictDeps = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out"/bin
+    cp ./build/anker-powerconf-c200-linux-tools "$out"/bin
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Linux CLI tools for the Anker PowerConf C200 webcam";
+    mainProgram = "anker-powerconf-c200-linux-tools";
+    homepage = "https://github.com/erans/anker-powerconf-c200-linux-tools";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fernsehmuell ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/fl/flashprog/package.nix b/pkgs/by-name/fl/flashprog/package.nix
index 3f7d9aa58be8..6483464e89d7 100644
--- a/pkgs/by-name/fl/flashprog/package.nix
+++ b/pkgs/by-name/fl/flashprog/package.nix
@@ -17,12 +17,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "flashprog";
-  version = "1.5";
+  version = "1.6";
 
   src = fetchgit {
     url = "https://review.sourcearcade.org/flashprog";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-laU2S7SPFCso/HzPSpbEM6hAE5/XYkNoBqFTT4PU8TU=";
+    hash = "sha256-Ih6cRUbmKIKRt8dIGNBbaLDomNvVdcl5P/lRBAzwwTI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gl/glycin-loaders/package.nix b/pkgs/by-name/gl/glycin-loaders/package.nix
index f9b97462d915..bb6e645bb5f1 100644
--- a/pkgs/by-name/gl/glycin-loaders/package.nix
+++ b/pkgs/by-name/gl/glycin-loaders/package.nix
@@ -20,8 +20,20 @@
   shared-mime-info,
   rustc,
   rustPlatform,
+
+  # List of loaders to build.
+  # https://gitlab.gnome.org/GNOME/glycin/-/blob/2.1.1/meson_options.txt?ref_type=tags#L26-43
+  enabledLoaders ? [
+    "heif"
+    "image-rs"
+    "jxl"
+    "svg"
+  ],
 }:
 
+# Doesn't produce any output if no loaders are enabled
+assert enabledLoaders != [ ];
+
 stdenv.mkDerivation (finalAttrs: {
   pname = "glycin-loaders";
 
@@ -59,12 +71,15 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   mesonFlags = [
-    "-Dglycin-loaders=true"
-    "-Dglycin-thumbnailer=false"
-    "-Dlibglycin=false"
-    "-Dlibglycin-gtk4=false"
-    "-Dvapi=false"
+    (lib.mesonBool "glycin-loaders" true)
+    (lib.mesonBool "glycin-thumbnailer" false)
+    (lib.mesonBool "libglycin" false)
+    (lib.mesonBool "libglycin-gtk4" false)
+    (lib.mesonBool "vapi" false)
     (lib.mesonBool "tests" finalAttrs.finalPackage.doCheck)
+    (lib.mesonOption "loaders" (
+      lib.concatMapStringsSep "," (loader: "glycin-${loader}") enabledLoaders
+    ))
   ];
 
   strictDeps = true;
@@ -88,9 +103,16 @@ stdenv.mkDerivation (finalAttrs: {
     export XDG_CACHE_HOME=$(mktemp -d)
   '';
 
+  # Thumbnailer files are provided by glycin-thumbnailer
+  postInstall = ''
+    rm -r $out/share/thumbnailers
+  '';
+
   env.CARGO_BUILD_TARGET = stdenv.hostPlatform.rust.rustcTargetSpec;
 
   passthru = {
+    inherit enabledLoaders;
+
     tests = {
       withTests = finalAttrs.finalPackage.overrideAttrs {
         doCheck = true;
@@ -102,10 +124,12 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Glycin loaders for several formats";
     homepage = "https://gitlab.gnome.org/GNOME/glycin";
     teams = [ lib.teams.gnome ];
-    license = with lib.licenses; [
-      mpl20 # or
-      lgpl21Plus
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        mpl20
+        lgpl21Plus
+      ];
     platforms = lib.platforms.linux;
   };
 })
diff --git a/pkgs/by-name/gl/glycin-thumbnailer/package.nix b/pkgs/by-name/gl/glycin-thumbnailer/package.nix
new file mode 100644
index 000000000000..f35f43a68f37
--- /dev/null
+++ b/pkgs/by-name/gl/glycin-thumbnailer/package.nix
@@ -0,0 +1,97 @@
+{
+  lib,
+  stdenv,
+  callPackage,
+  cargo,
+  fontconfig,
+  glib,
+  glycin-loaders,
+  glycin-thumbnailer,
+  libglycin,
+  libseccomp,
+  meson,
+  ninja,
+  pkg-config,
+  rustc,
+  rustPlatform,
+  wrapGAppsNoGuiHook,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "glycin-thumbnailer";
+
+  inherit (libglycin) version src cargoDeps;
+
+  nativeBuildInputs = [
+    cargo
+    libglycin.patchVendorHook
+    meson
+    ninja
+    pkg-config
+    rustc
+    rustPlatform.cargoSetupHook
+    wrapGAppsNoGuiHook
+  ];
+
+  buildInputs = [
+    fontconfig
+    glib
+    glycin-loaders
+    libglycin
+    libglycin.setupHook
+    libseccomp
+  ];
+
+  mesonFlags = [
+    (lib.mesonBool "glycin-loaders" false)
+    (lib.mesonBool "glycin-thumbnailer" true)
+    (lib.mesonBool "libglycin" false)
+    (lib.mesonBool "libglycin-gtk4" false)
+  ];
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  # Thumbnailer files are in `glycin-loaders`, but we provide them in this package
+  postInstall = ''
+    mkdir -p $out/share/thumbnailers
+
+    for loader in ${lib.concatStringsSep " " glycin-loaders.passthru.enabledLoaders}; do
+      substitute \
+        "../glycin-loaders/glycin-$loader/glycin-$loader.thumbnailer.in" \
+        "$out/share/thumbnailers/glycin-$loader.thumbnailer" \
+        --subst-var-by "BINDIR" "$out/bin"
+    done
+  '';
+
+  passthru.tests = {
+    all-loaders = glycin-thumbnailer.override {
+      glycin-loaders = glycin-loaders.override {
+        enabledLoaders = [
+          "heif"
+          "image-rs"
+          "jxl"
+          "raw"
+          "svg"
+        ];
+      };
+    };
+    thumbnailer = callPackage ./tests.nix { };
+  };
+
+  meta = {
+    description = "Glycin thumbnailers for several formats";
+    homepage = "https://gitlab.gnome.org/GNOME/glycin";
+    changelog = "https://gitlab.gnome.org/GNOME/glycin/-/tags/${finalAttrs.version}";
+    license =
+      with lib.licenses;
+      OR [
+        mpl20
+        lgpl21Plus
+      ];
+    maintainers = with lib.maintainers; [ thunze ];
+    teams = [ lib.teams.gnome ];
+    platforms = lib.platforms.linux;
+    mainProgram = "glycin-thumbnailer";
+  };
+})
diff --git a/pkgs/by-name/gl/glycin-thumbnailer/tests.nix b/pkgs/by-name/gl/glycin-thumbnailer/tests.nix
new file mode 100644
index 000000000000..da7f2a845de1
--- /dev/null
+++ b/pkgs/by-name/gl/glycin-thumbnailer/tests.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  glycin-thumbnailer,
+  shared-mime-info,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "glycin-thumbnailer-test";
+  inherit (glycin-thumbnailer) version;
+
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "sophie-h";
+    repo = "test-images";
+    rev = "f7a06d9131a5686c1b58c56f42f9fda9ea5e620d";
+    hash = "sha256-qoteYmliUha3lY21PRM0FaeYu9aD5MsygBTsTYog9SE=";
+  };
+
+  # Fix incorrectly detected MIME types
+  preBuild = ''
+    export XDG_DATA_DIRS=${shared-mime-info}/share:$XDG_DATA_DIRS
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    cd images/
+    mkdir -p $out
+
+    for image in color/* icon/*; do
+      for size in 128 256 512 1024; do
+        input="file://$(realpath "$image")"
+        output="$out/$(basename "$image")-$size.png"
+
+        ${lib.getExe glycin-thumbnailer} -i "$input" -o "$output" -s $size
+        file -E "$output"
+      done
+    done
+
+    runHook postBuild
+  '';
+})
diff --git a/pkgs/by-name/ir/ironwail/package.nix b/pkgs/by-name/ir/ironwail/package.nix
index 51821de58b41..7e20aec5c355 100644
--- a/pkgs/by-name/ir/ironwail/package.nix
+++ b/pkgs/by-name/ir/ironwail/package.nix
@@ -23,11 +23,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ironwail";
-  version = "0.8.1";
+  version = "0.8.2";
 
   src = fetchurl {
     url = "https://github.com/andrei-drexler/ironwail/archive/refs/tags/v${finalAttrs.version}.tar.gz";
-    hash = "sha256-TlEMuwmpQIoIyjyQo9T/h3T7rPHX+K8TqHKSt+UtMBg=";
+    hash = "sha256-rt+u0oY2W7UzsIUs5Tvd3IcBXsM2Z0UEfXNVLejc06U=";
   };
 
   sourceRoot = "${finalAttrs.pname}-${finalAttrs.version}/Quake";
diff --git a/pkgs/by-name/li/libgit2/package.nix b/pkgs/by-name/li/libgit2/package.nix
index 6ecfe9388430..c17240378a92 100644
--- a/pkgs/by-name/li/libgit2/package.nix
+++ b/pkgs/by-name/li/libgit2/package.nix
@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libgit2";
-  version = "1.9.3";
+  version = "1.9.4";
   # also check the following packages for updates: python3Packages.pygit2 and libgit2-glib
 
   outputs = [
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "libgit2";
     repo = "libgit2";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-nJrRdPs86oGNL4W2CJb16oSUgfzYr9A2i5sw9BAehME=";
+    hash = "sha256-ZKUiz3pdFE2SKxh53X2oyr7hs32Njj5YVA0OXDXz7h0=";
   };
 
   cmakeFlags = [
diff --git a/pkgs/by-name/li/libglycin-gtk4/package.nix b/pkgs/by-name/li/libglycin-gtk4/package.nix
index a7c2b7901ec1..3f9956a3f58a 100644
--- a/pkgs/by-name/li/libglycin-gtk4/package.nix
+++ b/pkgs/by-name/li/libglycin-gtk4/package.nix
@@ -89,10 +89,12 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "C-Bindings to convert glycin frames to GDK Textures";
     homepage = "https://gitlab.gnome.org/GNOME/glycin";
-    license = with lib.licenses; [
-      mpl20 # or
-      lgpl21Plus
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        mpl20
+        lgpl21Plus
+      ];
     teams = [ lib.teams.gnome ];
     platforms = lib.platforms.linux;
     pkgConfigModules = [
diff --git a/pkgs/by-name/li/libglycin/package.nix b/pkgs/by-name/li/libglycin/package.nix
index 3a00f5a33c38..74475dc990da 100644
--- a/pkgs/by-name/li/libglycin/package.nix
+++ b/pkgs/by-name/li/libglycin/package.nix
@@ -15,6 +15,7 @@
   glib,
   gobject-introspection,
   glycin-loaders,
+  glycin-thumbnailer,
   libglycin-gtk4,
   fontconfig,
   libseccomp,
@@ -146,6 +147,7 @@ stdenv.mkDerivation (finalAttrs: {
     tests = {
       inherit
         glycin-loaders
+        glycin-thumbnailer
         libglycin-gtk4
         ;
     };
@@ -155,10 +157,12 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Sandboxed and extendable image loading library";
     homepage = "https://gitlab.gnome.org/GNOME/glycin";
     changelog = "https://gitlab.gnome.org/GNOME/glycin/-/tags/${finalAttrs.version}";
-    license = with lib.licenses; [
-      mpl20 # or
-      lgpl21Plus
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        mpl20
+        lgpl21Plus
+      ];
     maintainers = [ ];
     teams = [ lib.teams.gnome ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/li/librewolf-unwrapped/librewolf.nix b/pkgs/by-name/li/librewolf-unwrapped/librewolf.nix
index e633da31cc11..a58fb3f9303a 100644
--- a/pkgs/by-name/li/librewolf-unwrapped/librewolf.nix
+++ b/pkgs/by-name/li/librewolf-unwrapped/librewolf.nix
@@ -34,6 +34,9 @@ rec {
       patch -p1 < ${source}/$patch_name
     done <${source}/assets/patches.txt
 
+    sed -i 's/5bc8c9bbe8c0eabe408d9a7cd7a8e6e09eee0ead817607643882b38a36d07c91/bddacbe056ce7458663a39dc99d5bb3434099aa69cae793cf0c57d4e54f5a6a4/g' third_party/rust/glean-core/.cargo-checksum.json
+    sed -i 's/c20989b1aa336b0849e96ec1b2beea1eab825ffd192c2c3a636e20f830b811d0/0b43fbc5f86c6c247c5189af58be425a829c3b09018c6b26589661eec9a5ad24/g' third_party/rust/glean-core/.cargo-checksum.json
+
     rm toolkit/components/ml/content/backends/OpenAIPipeline.mjs
     rm -rf toolkit/components/ml/vendor/openai
 
diff --git a/pkgs/by-name/li/librewolf-unwrapped/src.json b/pkgs/by-name/li/librewolf-unwrapped/src.json
index 07577047724b..f8a454af709b 100644
--- a/pkgs/by-name/li/librewolf-unwrapped/src.json
+++ b/pkgs/by-name/li/librewolf-unwrapped/src.json
@@ -1,11 +1,11 @@
 {
-  "packageVersion": "153.0.4-1",
+  "packageVersion": "154.0-2",
   "source": {
-    "rev": "153.0.4-1",
-    "hash": "sha256-Wa62qksr9/N768dqbTuJ7etZkTbe7QPSXQ4w7YD1xRE="
+    "rev": "154.0-2",
+    "hash": "sha256-J7n4xjl6RO9PQD0rMWeB+0EKkZcvopY8GvkM0+WbkM4="
   },
   "firefox": {
-    "version": "153.0.4",
-    "hash": "sha512-kIG+7X8IeXwhKAlBac+Vr0o14gj9IrunCb+xoZ4V0VqkhPzK5xFU0q4P+VW/YpzWNMx+1rGANxrqeS2vfGif9w=="
+    "version": "154.0",
+    "hash": "sha512-p3zWZJgq3WKGgRZ+9ZOb1r8MiUqjgMymb5tfsmWUeHTR6BnUImTx3QfIQ/im3AINomjMqf8eBk/KAZ3pGvm5lg=="
   }
 }
diff --git a/pkgs/by-name/li/librewolf-unwrapped/src.nix b/pkgs/by-name/li/librewolf-unwrapped/src.nix
index fd8e8a7656bc..5270c1821773 100644
--- a/pkgs/by-name/li/librewolf-unwrapped/src.nix
+++ b/pkgs/by-name/li/librewolf-unwrapped/src.nix
@@ -1,16 +1,17 @@
 {
   lib,
   fetchurl,
-  fetchFromCodeberg,
+  fetchFromGitLab,
 }:
 let
   src = lib.importJSON ./src.json;
 in
 {
   inherit (src) packageVersion;
-  source = fetchFromCodeberg (
+  source = fetchFromGitLab (
     src.source
     // {
+      domain = "librewolf.dev";
       owner = "librewolf";
       repo = "source";
       fetchSubmodules = true;
diff --git a/pkgs/by-name/li/librewolf-unwrapped/update.nix b/pkgs/by-name/li/librewolf-unwrapped/update.nix
index db09200e5520..d9d3e3d1cc44 100644
--- a/pkgs/by-name/li/librewolf-unwrapped/update.nix
+++ b/pkgs/by-name/li/librewolf-unwrapped/update.nix
@@ -33,7 +33,7 @@ writeScript "update-librewolf" ''
   }
   set -euo pipefail
 
-  latestTag=$(curl "https://codeberg.org/api/v1/repos/librewolf/source/tags?page=1&limit=1" | jq -r .[0].name)
+  latestTag=$(curl "https://librewolf.dev/api/v1/repos/librewolf/source/tags?page=1&limit=1" | jq -r .[0].name)
   echo "latestTag=$latestTag"
 
   srcJson=pkgs/by-name/li/librewolf-unwrapped/src.json
@@ -45,7 +45,7 @@ writeScript "update-librewolf" ''
   fi
 
   prefetchOut=$(mktemp)
-  repoUrl=https://codeberg.org/librewolf/source.git
+  repoUrl=https://librewolf.dev/librewolf/source.git
   nix-prefetch-git $repoUrl --quiet --rev $latestTag --fetch-submodules > $prefetchOut
   srcDir=$(jq -r .path < $prefetchOut)
   srcHash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 $(jq -r .sha256 < $prefetchOut))
diff --git a/pkgs/by-name/li/lighthouse-steamvr/package.nix b/pkgs/by-name/li/lighthouse-steamvr/package.nix
index fa11ee8d3136..1059c89afdac 100644
--- a/pkgs/by-name/li/lighthouse-steamvr/package.nix
+++ b/pkgs/by-name/li/lighthouse-steamvr/package.nix
@@ -8,20 +8,21 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "Lighthouse";
-  version = "1.4.0";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "ShayBox";
     repo = "Lighthouse";
     rev = finalAttrs.version;
-    hash = "sha256-Ai+d7BKA1o98iOhQ7VXltnWHW/knw122xLZHhFM6gZ0=";
+    hash = "sha256-qlQyDY+ZU4m3GBtn60DUiGJDhC8OF+WTqXc4BQIf+OI=";
   };
 
-  cargoHash = "sha256-+5fxqWq7akICVmDa8Lc6M8laEAWrrEyg4uCFLoCNRpo=";
+  cargoHash = "sha256-fOiVMg3K3wYhgYZ9kx3WfAgrgcSzUKjKyvXm5N386nw=";
 
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [ dbus ];
+  buildFeatures = [ "cli" ];
 
   meta = {
     description = "VR Lighthouse power state management";
diff --git a/pkgs/by-name/ma/mautrix-whatsapp/package.nix b/pkgs/by-name/ma/mautrix-whatsapp/package.nix
index 237445a9e328..70804bb29811 100644
--- a/pkgs/by-name/ma/mautrix-whatsapp/package.nix
+++ b/pkgs/by-name/ma/mautrix-whatsapp/package.nix
@@ -14,20 +14,20 @@
 
 buildGoModule rec {
   pname = "mautrix-whatsapp";
-  version = "26.07";
-  tag = "v0.2607.0";
+  version = "26.08";
+  tag = "v0.2608.0";
 
   src = fetchFromGitHub {
     owner = "mautrix";
     repo = "whatsapp";
     inherit tag;
-    hash = "sha256-cl3nJY9ui9J9fE9T1hBUV/o8lH0usrsUcpj9OwXxgtY=";
+    hash = "sha256-gB+XIS8b1W9wOcKnSlLgctjaD1mBvkNrS3ak9Xq39wg=";
   };
 
   buildInputs = lib.optional (!withGoolm) olm;
   tags = lib.optional withGoolm "goolm";
 
-  vendorHash = "sha256-fVs5su6UkjvQEkoWJH6WL1FCZNdwj0jzrjfpbWOHWDU=";
+  vendorHash = "sha256-02XiudW2yxseGWyNegNUIfA8RBJCyjhhgeKncLy6nQg=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/op/openbao/package.nix b/pkgs/by-name/op/openbao/package.nix
index d9d1317f85b5..f8f27f239081 100644
--- a/pkgs/by-name/op/openbao/package.nix
+++ b/pkgs/by-name/op/openbao/package.nix
@@ -14,16 +14,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "openbao";
-  version = "2.6.1";
+  version = "2.6.2";
 
   src = fetchFromGitHub {
     owner = "openbao";
     repo = "openbao";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2wl06I6/yF/V5P9MFCCzpEiX4G+YTtXWRjvh+wDyB1U=";
+    hash = "sha256-iFOah7LkuiL4MGhi6ANpgCYDYQl33gF+F4agdKLEFTk=";
   };
 
-  vendorHash = "sha256-2MMWs30e7GB0pcPmmDvw6RTBzKYXNwothAuQMZAFHoE=";
+  vendorHash = "sha256-gORWU9Yn+AX00mQD5uq9k7ksbkLVWv8W2N4IxEOsE88=";
 
   proxyVendor = true;
 
diff --git a/pkgs/by-name/op/opencloud/package.nix b/pkgs/by-name/op/opencloud/package.nix
index 983299455638..72bee11ec18f 100644
--- a/pkgs/by-name/op/opencloud/package.nix
+++ b/pkgs/by-name/op/opencloud/package.nix
@@ -28,13 +28,13 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "opencloud";
-  version = "7.2.0";
+  version = "7.2.3";
 
   src = fetchFromGitHub {
     owner = "opencloud-eu";
     repo = "opencloud";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GAoDEXk7sBN7N0V/msi/fcJS72RqqlF6Qb5B9hArmvk=";
+    hash = "sha256-5wmXBLO6wmlBRu0FWDGMzFipRSARyK2LED1BR0Vwnt0=";
   };
 
   postPatch = ''
@@ -92,6 +92,9 @@ buildGoModule (finalAttrs: {
     rm services/search/pkg/opensearch/*_test.go
   '';
 
+  # The activitylog tests start a local NATS server.
+  __darwinAllowLocalNetworking = true;
+
   env = {
     # avoids 'make generate' calling `git`, otherwise no-op
     STRING = finalAttrs.version;
diff --git a/pkgs/by-name/op/opencloud/web.nix b/pkgs/by-name/op/opencloud/web.nix
index 13e0d4a25879..d6ee7b45a808 100644
--- a/pkgs/by-name/op/opencloud/web.nix
+++ b/pkgs/by-name/op/opencloud/web.nix
@@ -10,20 +10,20 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "opencloud-web";
-  version = "7.2.0";
+  version = "7.1.4";
 
   src = fetchFromGitHub {
     owner = "opencloud-eu";
     repo = "web";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BiOue8+zQ3+6RLiDbLMnxKEen2aav3bljji4d+0Hr5c=";
+    hash = "sha256-Wg4VGweWBiTRGDRIbe4spFQB1MEC25zXZBAIa4+YttY=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_11;
     fetcherVersion = 4;
-    hash = "sha256-gCsgnOEi9rvtwTZy8J/i63D92Gl2V9ZihxCJ+Y5hLUE=";
+    hash = "sha256-YEdZ5B11I6U140qam7e1TMOacRqUeINhr/TI13ddAa0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ru/rustywind/package.nix b/pkgs/by-name/ru/rustywind/package.nix
index 5eec1a568907..767162a54185 100644
--- a/pkgs/by-name/ru/rustywind/package.nix
+++ b/pkgs/by-name/ru/rustywind/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rustywind";
-  version = "0.26.0";
+  version = "0.27.0";
 
   src = fetchFromGitHub {
     owner = "avencera";
     repo = "rustywind";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-uxgp8cwOswrhDLtx5ZAxsdy96/+UjYhzNKwvt0DBmhk=";
+    hash = "sha256-VlmJJ9movoMumCChINLikz1HJ+KjMvZiTiBhrSCEAdk=";
   };
 
-  cargoHash = "sha256-W5dPMSkihxWryLEpQhqt9IpiwyAYSsIgQLbwjnXVjEk=";
+  cargoHash = "sha256-DAozCVsUBUp6TsbmtfZnU3G73OZE4qtDqtJzpv3fvp4=";
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
diff --git a/pkgs/by-name/up/upower/package.nix b/pkgs/by-name/up/upower/package.nix
index df714dfef4c3..a317da29cb3c 100644
--- a/pkgs/by-name/up/upower/package.nix
+++ b/pkgs/by-name/up/upower/package.nix
@@ -38,7 +38,7 @@ assert withDocs -> withIntrospection;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "upower";
-  version = "1.91.2";
+  version = "1.91.3";
 
   outputs = [
     "out"
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "upower";
     repo = "upower";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-lr7Va7jmC7Hy+kY8YIbAEE5mK3TxU9LtgTKxEyM1QY8=";
+    hash = "sha256-QdAJxaua43iGovQeRg+n1MypS5CS0Ro3gqF9Tv8eMBg=";
   };
 
   patches =
diff --git a/pkgs/by-name/up/upsun/versions.json b/pkgs/by-name/up/upsun/versions.json
index 7d76f8484395..5b82974bf70e 100644
--- a/pkgs/by-name/up/upsun/versions.json
+++ b/pkgs/by-name/up/upsun/versions.json
@@ -1,19 +1,19 @@
 {
-  "version": "5.10.8",
+  "version": "5.11.0",
   "darwin-amd64": {
-    "hash": "sha256-8M7L9GAwaSpFg6VHI4T5CI2oBE2Z8It3Pt2Wr76Z+is=",
-    "url": "https://github.com/upsun/cli/releases/download/v5.10.8/upsun_5.10.8_darwin_all.tar.gz"
+    "hash": "sha256-kVnCzv0cfSLX6EjZp2cc7haCjJ4bBpAotSfL2jCdjoY=",
+    "url": "https://github.com/upsun/cli/releases/download/v5.11.0/upsun_5.11.0_darwin_all.tar.gz"
   },
   "darwin-arm64": {
-    "hash": "sha256-8M7L9GAwaSpFg6VHI4T5CI2oBE2Z8It3Pt2Wr76Z+is=",
-    "url": "https://github.com/upsun/cli/releases/download/v5.10.8/upsun_5.10.8_darwin_all.tar.gz"
+    "hash": "sha256-kVnCzv0cfSLX6EjZp2cc7haCjJ4bBpAotSfL2jCdjoY=",
+    "url": "https://github.com/upsun/cli/releases/download/v5.11.0/upsun_5.11.0_darwin_all.tar.gz"
   },
   "linux-amd64": {
-    "hash": "sha256-ymKZVLavGiGarDvdzYvxCVTHqPm2YPR5bJqQTQddiPw=",
-    "url": "https://github.com/upsun/cli/releases/download/v5.10.8/upsun_5.10.8_linux_amd64.tar.gz"
+    "hash": "sha256-wPEbVEsFGfshxWGXCOzodSap0DuWetCvdwJj76kFVOc=",
+    "url": "https://github.com/upsun/cli/releases/download/v5.11.0/upsun_5.11.0_linux_amd64.tar.gz"
   },
   "linux-arm64": {
-    "hash": "sha256-Fe4oSes/i3LdRP5bzI/d3gA2QtsfCO0dVswVoNMQXCs=",
-    "url": "https://github.com/upsun/cli/releases/download/v5.10.8/upsun_5.10.8_linux_arm64.tar.gz"
+    "hash": "sha256-rejRYbSHuddU43tpp/WDKz+KarNIHxrK2SJ/ftNoAHo=",
+    "url": "https://github.com/upsun/cli/releases/download/v5.11.0/upsun_5.11.0_linux_arm64.tar.gz"
   }
 }
diff --git a/pkgs/by-name/wa/wakapi/package.nix b/pkgs/by-name/wa/wakapi/package.nix
index 943b967335ca..e7a4cddf8580 100644
--- a/pkgs/by-name/wa/wakapi/package.nix
+++ b/pkgs/by-name/wa/wakapi/package.nix
@@ -6,7 +6,7 @@
   nix-update-script,
 }:
 let
-  version = "2.17.5";
+  version = "2.17.6";
 in
 buildGoLatestModule {
   pname = "wakapi";
@@ -16,10 +16,10 @@ buildGoLatestModule {
     owner = "muety";
     repo = "wakapi";
     tag = version;
-    hash = "sha256-CQliu0fPg1k28sL6lhgoXh1GEVM3dBXl6rN0yvHpA2U=";
+    hash = "sha256-fKCfjLh/nf6rRqxdGPWfEY9EDh+5sXSKkvzgq7D4ocE=";
   };
 
-  vendorHash = "sha256-kA+XeHU7XalQ2xnUfaZcvRAwHDF1hSPUGNXQ7e9y31M=";
+  vendorHash = "sha256-eyldhpDU5fT7tHdsQZ4qUrPlu1QSYaXX8FgksvAXiOw=";
 
   # Not a go module required by the project, contains development utilities
   excludedPackages = [ "scripts" ];
diff --git a/pkgs/by-name/wh/whoami/package.nix b/pkgs/by-name/wh/whoami/package.nix
index d3a7006aceaa..f9cefa780c3a 100644
--- a/pkgs/by-name/wh/whoami/package.nix
+++ b/pkgs/by-name/wh/whoami/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "whoami";
-  version = "1.11.0";
+  version = "1.12.0";
 
   src = fetchFromGitHub {
     owner = "traefik";
     repo = "whoami";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3jzLdCmmts/7S1Oxig9Dg3kRGh/H5l5UD7ztev0yvXY=";
+    hash = "sha256-0ijolVbIttA7yhnN8eDx/FercHh9x81Hpk/CqGzmwhs=";
   };
 
-  vendorHash = "sha256-0Qxw+MUYVgzgWB8vi3HBYtVXSq/btfh4ZfV/m1chNrA=";
+  vendorHash = "sha256-2smvg0b226PSvAEOssCM5NXIqluDBmjzjYd54LWs27A=";
 
   ldflags = [ "-s" ];
 
diff --git a/pkgs/development/compilers/openjdk/8/source.json b/pkgs/development/compilers/openjdk/8/source.json
index 894732a60e1f..c6e10c13600d 100644
--- a/pkgs/development/compilers/openjdk/8/source.json
+++ b/pkgs/development/compilers/openjdk/8/source.json
@@ -1,6 +1,6 @@
 {
-  "hash": "sha256-7sbEwNSd0SNdsfWREU6EIk+/9UMlZfWYEv+UQ6iJ3VI=",
+  "hash": "sha256-c0x+4FW1BqpvoMKfkhsea8xBIoRPc7NJuzDk5pcJnd0=",
   "owner": "openjdk",
   "repo": "jdk8u",
-  "rev": "refs/tags/jdk8u502-b07"
+  "rev": "refs/tags/jdk8u504-b01"
 }
diff --git a/pkgs/development/libraries/nss/latest.nix b/pkgs/development/libraries/nss/latest.nix
index 81261040032a..4bbe446610e2 100644
--- a/pkgs/development/libraries/nss/latest.nix
+++ b/pkgs/development/libraries/nss/latest.nix
@@ -5,8 +5,8 @@
 #       Example: nix-shell ./maintainers/scripts/update.nix --argstr package cacert
 
 import ./generic.nix {
-  version = "3.126";
-  hash = "sha256-+yiBEc8WLZ6qiO8MBQBiIXfm4OEJ9EFgmw2rY+U/bp8=";
+  version = "3.127";
+  hash = "sha256-SiaKDkDTHqhTCs/pcwOAk0lgIayeMKOwGLAZr9WKS4Q=";
   filename = "latest.nix";
   versionRegex = "NSS_(\\d+)_(\\d+)(?:_(\\d+))?_RTM";
 }
diff --git a/pkgs/development/python-modules/flask-security/default.nix b/pkgs/development/python-modules/flask-security/default.nix
index d715cd322f53..70f7f543996c 100644
--- a/pkgs/development/python-modules/flask-security/default.nix
+++ b/pkgs/development/python-modules/flask-security/default.nix
@@ -51,14 +51,14 @@
 
 buildPythonPackage rec {
   pname = "flask-security";
-  version = "5.8.1";
+  version = "5.8.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pallets-eco";
     repo = "flask-security";
     tag = version;
-    hash = "sha256-xNWgLIk/AB5beZQX7jzh8uQ9o0Gq+W5rgowBS215pk4=";
+    hash = "sha256-WRhQqSSlPKqY/NxqPCG3izYy782vCq6JGRzReL8Qwqw=";
   };
 
   build-system = [ flit-core ];
diff --git a/pkgs/development/tools/godot/4.7/default.nix b/pkgs/development/tools/godot/4.7/default.nix
index 3d411ed36a14..a2bfae19dc52 100644
--- a/pkgs/development/tools/godot/4.7/default.nix
+++ b/pkgs/development/tools/godot/4.7/default.nix
@@ -1,11 +1,11 @@
 {
-  version = "4.7.1-stable";
-  hash = "sha256-3JzJuFbicIJ4AiEVxh5t1/q9mjxwFXZvTAfEBdrIzsc=";
+  version = "4.7.2-stable";
+  hash = "sha256-RyUaOUkE6rYQcn1KKRY2GQ4vj8Gs7N24EJ+vU13meJE=";
   default = {
-    exportTemplatesHash = "sha256-hkCdtiALb4/TIwmJwtIAKFHz3Ris8R1726/d9aDdD3I=";
+    exportTemplatesHash = "sha256-8phJC41E2TS+QlpaZaUb8V9CJCiyKaBqbhHZ/+okgBE=";
   };
   mono = {
-    exportTemplatesHash = "sha256-75pwi+UezZdM19zNyv16GHDaPT4cJMByvbuYGMen22M=";
+    exportTemplatesHash = "sha256-kvhoHjSe8fkIkbeS2pXjsrC9HtYQt4AYxY/rLYfhWp0=";
     nugetDeps = ./deps.json;
   };
 }
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 934c89870e83..d0555c6f753d 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -5,38 +5,38 @@
         "lts": false
     },
     "6.1": {
-        "version": "6.1.182",
-        "hash": "sha256:118z7jqabpja5xzlqj73alvsg4sjs6fg5iv8x0da4940dsxid17k",
+        "version": "6.1.183",
+        "hash": "sha256:1qn0zw987amv77h7pj9rkc852haw783fxvqscp71bi1q97z0fb9n",
         "lts": true
     },
     "5.15": {
-        "version": "5.15.215",
-        "hash": "sha256:19xp4gyp9h341dmvg36i3jm4zgk4lgwrrrdjkzbacgw1l2fjfzym",
+        "version": "5.15.216",
+        "hash": "sha256:1v854sl38sxsl9zwm9sy6l3hgq24356angizxi7g98xf0lhgpbq9",
         "lts": true
     },
     "5.10": {
-        "version": "5.10.264",
-        "hash": "sha256:17j8bdqsq6n0zl5a59chiapxpn7yapqvihqq37414dbq6bn54xgj",
+        "version": "5.10.265",
+        "hash": "sha256:0i96z6iq218bcqyy4hllz9jnaj0j012ix82lf5gkvnj9kqbbj36i",
         "lts": true
     },
     "6.6": {
-        "version": "6.6.151",
-        "hash": "sha256:1xv9k5r0rm3gda5hzw7i6rjrpwnhlryzk9j1xfy70as1ffpfa0fy",
+        "version": "6.6.152",
+        "hash": "sha256:1mkhvln2x9npklg1b9b2gkavxcjmj9826sq0fh5rv16scf60b2vp",
         "lts": true
     },
     "6.12": {
-        "version": "6.12.103",
-        "hash": "sha256:0xiizhw3kk2ggx9yymzmpj0q9ckday1492vqdrhsayw7x2nslhzi",
+        "version": "6.12.104",
+        "hash": "sha256:16drg5rvgbg4s24byj3wkq4ib5l6azmlxd5aqpq0rgb329m1d7cl",
         "lts": true
     },
     "6.18": {
-        "version": "6.18.44",
-        "hash": "sha256:0hqd4izrmabjcp22z7h8zrxxp1r2azz78la0j0nfha38y0wdjwhg",
+        "version": "6.18.45",
+        "hash": "sha256:0cxbvrb43mqxjmxyz2i7n5xghrk4gx7n24js2an199lwaxb4myih",
         "lts": true
     },
     "7.1": {
-        "version": "7.1.8",
-        "hash": "sha256:0j9c88akklsdhivrlx7i0ccgzxcwcgp1zc6dzi65p79796sdq0gz",
+        "version": "7.1.9",
+        "hash": "sha256:1c3jq2y2isas3hi8dla4qs0wl6z6p9shjaqgk1987cwp72pa8w9j",
         "lts": false
     },
     "7.2": {