diff --git a/doc/release-notes/rl-2611.section.md b/doc/release-notes/rl-2611.section.md
index 4f88d4e79ec2..b2aa83567c20 100644
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@@ -157,6 +157,16 @@
 
 - `pnpm_10` was upgraded to version 10.34.1+, which introduced stricter integrity checks. If you encounter `ERR_PNPM_MISSING_TARBALL_INTEGRITY`, you can fall back to the older `pnpm_10_34_0`.
 
+- `buildMozillaMach` is now using `enable<feature>` and `with<dependency>`
+  terminology from RFC 169 and the `wrapFirefox` and `wrapThunderbird` functions
+  check for these new attribute names on the passed package.
+  The `privacySupport` function argument has been replaced by multiple
+  granular options corresponding to individual features: `enableDataReporting`,
+  `enableLocation`, `enableWebRTC`.
+  The `requireSigning` and `allowAddonSideload` function arguments moved from
+  the outer to the inner function and were renamed to `enableAddonSigning` and
+  `enableAddonSideload`, respectively.
+
 - `fetchPnpmDeps`' `fetcherVersion = 1` and `fetcherVersion = 2` have been
   removed, as announced in the 26.05 release. Packages still using them now
   throw an evaluation error and must migrate to `fetcherVersion = 3` (or later)
@@ -209,6 +219,8 @@
   They were missing before because Ceph omitted logs when this directory was missing.
   Ceph logs can grow large, so you may want to configure rotation of these logs.
 
+- Firefox wrapper now accepts an optional `appDataDir` argument, which sets `MOZ_APP_DATA` to relocate Firefox application data. This is especially useful on macOS 27 and later, where wrapped Firefox applications may be denied access to profiles in traditional application data directory.
+
 ## Nixpkgs Library {#sec-nixpkgs-release-26.11-lib}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/nixos/doc/manual/administration/systemd-state.section.md b/nixos/doc/manual/administration/systemd-state.section.md
index 84f074871a65..473b8232d687 100644
--- a/nixos/doc/manual/administration/systemd-state.section.md
+++ b/nixos/doc/manual/administration/systemd-state.section.md
@@ -47,6 +47,6 @@ form to `/var/log/journal/{machine-id}`; if (locally) persisting the entire log
 is desired, it is recommended to make all of `/var/log/journal` persistent.
 
 If not, one can set `Storage=volatile` in {manpage}`journald.conf(5)`
-([`services.journald.storage = "volatile";`](#opt-services.journald.storage)),
+([`services.journald.settings.Journal.Storage = "volatile";`](#opt-services.journald.settings.Journal)),
 which disables journal persistence and causes it to be written to
 `/run/log/journal`.
diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index 5d8cf9b3f983..1fdf22be4f14 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -217,6 +217,15 @@
 
 - The papra NixOS module is now hardening the systemd unit by default. If this breaks any of the configured directories, please reconfigure them through `services.papra.environment` to enable sandbox passthrough.
 
+- `services.selfoss.extraConfig` and `services.selfoss.database` have been removed in favor of the structured [](#opt-services.selfoss.settings) option. When moving the `database` options to `settings`, you should also switch to the upstream naming:
+
+  - `type` → [`db_type`](#opt-services.selfoss.settings.db_type)
+  - `host` → [`db_host`](#opt-services.selfoss.settings.db_host)
+  - `name` → [`db_database`](#opt-services.selfoss.settings.db_database)
+  - `username` → [`db_user`](#opt-services.selfoss.settings.db_user)
+  - `password` → [`db_password`](#opt-services.selfoss.settings.db_password)
+  - `port` → [`db_port`](#opt-services.selfoss.settings.db_port)
+
 - `slskd` has been updated to v0.25.0, which renames the `global` option to `transfers`. Please review the [changelog](https://github.com/slskd/slskd/releases#release-0.25.0).
 
 - [firefox-syncserver.database.type](#opt-services.firefox-syncserver.database.type) no longer defaults to `"mysql"`. You must now explicitly choose between `"mysql"` and `"postgresql"`. New deployments should prefer PostgreSQL.
diff --git a/nixos/modules/config/nix.nix b/nixos/modules/config/nix.nix
index 671d0f7865e1..db9e70bb9c3f 100644
--- a/nixos/modules/config/nix.nix
+++ b/nixos/modules/config/nix.nix
@@ -252,6 +252,16 @@ in
               '';
             };
 
+            experimental-features = mkOption {
+              type = with types; listOf str;
+              default = [ ];
+              example = [ "ca-derivations" ];
+              description = ''
+                List of experimental features to enable in Nix.
+                See <https://nixos.org/manual/nix/stable/development/experimental-features> for available features.
+              '';
+            };
+
             sandbox = mkOption {
               type = types.either types.bool (types.enum [ "relaxed" ]);
               default = true;
diff --git a/nixos/modules/installer/cd-dvd/iso-image.nix b/nixos/modules/installer/cd-dvd/iso-image.nix
index 59e6c3be2d99..e73fa287c45b 100644
--- a/nixos/modules/installer/cd-dvd/iso-image.nix
+++ b/nixos/modules/installer/cd-dvd/iso-image.nix
@@ -371,7 +371,6 @@ let
           "gfxmenu"
           "gfxterm"
           "gfxterm_background"
-          "gfxterm_menu"
           "test"
           "loadenv"
           "all_video"
diff --git a/nixos/modules/services/logging/rsyslogd.nix b/nixos/modules/services/logging/rsyslogd.nix
index 01a94c549dfc..492ff3779b3f 100644
--- a/nixos/modules/services/logging/rsyslogd.nix
+++ b/nixos/modules/services/logging/rsyslogd.nix
@@ -84,6 +84,8 @@ in
 
   config = lib.mkIf cfg.enable {
 
+    services.journald.settings.Journal.ForwardToSyslog = lib.mkOptionDefault true;
+
     environment.systemPackages = [ pkgs.rsyslog ];
 
     systemd.services.syslog = {
diff --git a/nixos/modules/services/logging/syslog-ng.nix b/nixos/modules/services/logging/syslog-ng.nix
index 6b3e7c3e599d..b0bdc4871f8e 100644
--- a/nixos/modules/services/logging/syslog-ng.nix
+++ b/nixos/modules/services/logging/syslog-ng.nix
@@ -77,6 +77,8 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    services.journald.settings.Journal.ForwardToSyslog = lib.mkOptionDefault true;
+
     systemd.services.syslog-ng = {
       description = "syslog-ng daemon";
       wantedBy = [ "multi-user.target" ];
diff --git a/nixos/modules/services/security/step-ca.nix b/nixos/modules/services/security/step-ca.nix
index d92900b7220b..1fb880d067cd 100644
--- a/nixos/modules/services/security/step-ca.nix
+++ b/nixos/modules/services/security/step-ca.nix
@@ -54,6 +54,15 @@ in
           :::
         '';
       };
+      extraArgs = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        example = [
+          "--resolver=10.1.2.3:53"
+          "--quiet"
+        ];
+        description = "Ad-hoc command-line arguments passed to the service at startup.";
+      };
       intermediatePasswordFile = lib.mkOption {
         type = lib.types.nullOr lib.types.externalPath;
         default = null;
@@ -114,6 +123,7 @@ in
               + lib.optionalString (
                 cfg.intermediatePasswordFile != null
               ) " --password-file \${CREDENTIALS_DIRECTORY}/intermediate_password"
+              + lib.optionalString (cfg.extraArgs != [ ]) " ${lib.escapeShellArgs cfg.extraArgs}"
             )
           ];
 
diff --git a/nixos/modules/services/web-apps/selfoss.nix b/nixos/modules/services/web-apps/selfoss.nix
index 14dc44f911ed..6fd7f769e42f 100644
--- a/nixos/modules/services/web-apps/selfoss.nix
+++ b/nixos/modules/services/web-apps/selfoss.nix
@@ -4,33 +4,75 @@
   pkgs,
   ...
 }:
-with lib;
+
 let
+  inherit (lib)
+    mapAttrs
+    mkDefault
+    mkEnableOption
+    mkIf
+    mkOption
+    types
+    ;
+
   cfg = config.services.selfoss;
 
   poolName = "selfoss_pool";
 
   dataDir = "/var/lib/selfoss";
 
-  selfoss-config =
-    let
-      db_type = cfg.database.type;
-      default_port = if (db_type == "mysql") then 3306 else 5342;
-    in
-    pkgs.writeText "selfoss-config.ini" ''
-      [globals]
-      ${lib.optionalString (db_type != "sqlite") ''
-        db_type=${db_type}
-        db_host=${cfg.database.host}
-        db_database=${cfg.database.name}
-        db_username=${cfg.database.user}
-        db_password=${cfg.database.password}
-        db_port=${toString (if (cfg.database.port != null) then cfg.database.port else default_port)}
-      ''}
-      ${cfg.extraConfig}
-    '';
+  settingsFormat = pkgs.formats.iniWithGlobalSection {
+    mkKeyValue = lib.generators.mkKeyValueDefault {
+      mkValueString =
+        v:
+        if v == null then
+          ""
+        else if v == true then
+          "1"
+        else if v == false then
+          "0"
+        else
+          lib.generators.mkValueStringDefault { } v;
+    } "=";
+  };
+
+  selfoss-config = settingsFormat.generate "config.ini" { globalSection = cfg.settings; };
 in
 {
+  imports = [
+    (lib.mkRenamedOptionModule
+      [ "services" "selfoss" "database" "type" ]
+      [ "services" "selfoss" "settings" "db_type" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "selfoss" "database" "host" ]
+      [ "services" "selfoss" "settings" "db_host" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "selfoss" "database" "name" ]
+      [ "services" "selfoss" "settings" "db_database" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "selfoss" "database" "username" ]
+      [ "services" "selfoss" "settings" "db_user" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "selfoss" "database" "password" ]
+      [ "services" "selfoss" "settings" "db_password" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "selfoss" "database" "port" ]
+      [ "services" "selfoss" "settings" "db_port" ]
+    )
+    (lib.mkRemovedOptionModule [ "services" "selfoss" "extraConfig" ] ''
+      Use services.selfoss.settings instead.
+
+      This is part of the general move to use structured settings instead of raw
+      text for config as introduced by RFC0042:
+      https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md
+    '')
+  ];
+
   options = {
     services.selfoss = {
       enable = mkEnableOption "selfoss";
@@ -54,67 +96,75 @@ in
         '';
       };
 
-      database = {
-        type = mkOption {
-          type = types.enum [
-            "pgsql"
-            "mysql"
-            "sqlite"
-          ];
-          default = "sqlite";
-          description = ''
-            Database to store feeds. Supported are sqlite, pgsql and mysql.
-          '';
+      settings = lib.mkOption {
+        type = lib.types.submodule {
+          # Only single level of config supported
+          freeformType = types.attrsOf settingsFormat.lib.types.atom;
+
+          options = {
+            db_type = mkOption {
+              type = types.enum [
+                "pgsql"
+                "mysql"
+                "sqlite"
+              ];
+              default = "sqlite";
+              description = ''
+                Database to store feeds. Supported are sqlite, pgsql and mysql.
+              '';
+            };
+
+            db_host = mkOption {
+              type = types.str;
+              default = "localhost";
+              description = ''
+                Host of the database (has no effect if type is "sqlite").
+              '';
+            };
+
+            db_database = mkOption {
+              type = types.str;
+              default = "tt_rss";
+              description = ''
+                Name of the existing database (has no effect if type is "sqlite").
+              '';
+            };
+
+            db_user = mkOption {
+              type = types.str;
+              default = "tt_rss";
+              description = ''
+                The database user. The user must exist and has access to
+                the specified database (has no effect if type is "sqlite").
+              '';
+            };
+
+            db_password = mkOption {
+              type = types.nullOr types.str;
+              default = null;
+              description = ''
+                The database user's password (has no effect if type is "sqlite").
+              '';
+            };
+
+            db_port = mkOption {
+              type = types.nullOr types.port;
+              default = null;
+              description = ''
+                The database's port. If not set, the default ports will be
+                provided (5432 and 3306 for pgsql and mysql respectively)
+                (has no effect if type is "sqlite").
+              '';
+            };
+          };
         };
 
-        host = mkOption {
-          type = types.str;
-          default = "localhost";
-          description = ''
-            Host of the database (has no effect if type is "sqlite").
-          '';
-        };
+        default = { };
 
-        name = mkOption {
-          type = types.str;
-          default = "tt_rss";
-          description = ''
-            Name of the existing database (has no effect if type is "sqlite").
-          '';
-        };
-
-        user = mkOption {
-          type = types.str;
-          default = "tt_rss";
-          description = ''
-            The database user. The user must exist and has access to
-            the specified database (has no effect if type is "sqlite").
-          '';
-        };
-
-        password = mkOption {
-          type = types.nullOr types.str;
-          default = null;
-          description = ''
-            The database user's password (has no effect if type is "sqlite").
-          '';
-        };
-
-        port = mkOption {
-          type = types.nullOr types.port;
-          default = null;
-          description = ''
-            The database's port. If not set, the default ports will be
-            provided (5432 and 3306 for pgsql and mysql respectively)
-            (has no effect if type is "sqlite").
-          '';
-        };
-      };
-      extraConfig = mkOption {
-        type = types.lines;
-        default = "";
         description = ''
-          Extra configuration added to config.ini
+          Configuration for selfoss, see
+          <https://selfoss.aditu.de/docs/administration/options/>
+          for supported values.
         '';
       };
     };
@@ -123,7 +173,7 @@ in
   config = mkIf cfg.enable {
     services.phpfpm.pools = mkIf (cfg.pool == "${poolName}") {
       ${poolName} = {
-        user = config.services.nginx.user;
+        user = mkDefault config.services.nginx.user;
         settings = mapAttrs (name: mkDefault) {
           "listen.owner" = config.services.nginx.user;
           "listen.group" = config.services.nginx.group;
diff --git a/nixos/modules/system/boot/systemd/journald.nix b/nixos/modules/system/boot/systemd/journald.nix
index 4fa91c66d6b1..b7659b5e2871 100644
--- a/nixos/modules/system/boot/systemd/journald.nix
+++ b/nixos/modules/system/boot/systemd/journald.nix
@@ -1,7 +1,6 @@
 {
   config,
   lib,
-  pkgs,
   utils,
   ...
 }:
@@ -10,111 +9,65 @@ let
 in
 {
   imports = [
+    (lib.mkRenamedOptionModule
+      [ "services" "journald" "storage" ]
+      [ "services" "journald" "settings" "Journal" "Storage" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "journald" "rateLimitInterval" ]
+      [ "services" "journald" "settings" "Journal" "RateLimitIntervalSec" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "journald" "rateLimitBurst" ]
+      [ "services" "journald" "settings" "Journal" "RateLimitBurst" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "journald" "forwardToSyslog" ]
+      [ "services" "journald" "settings" "Journal" "ForwardToSyslog" ]
+    )
+    (lib.mkRemovedOptionModule
+      [
+        "services"
+        "journald"
+        "console"
+      ]
+      "Use services.journald.settings.Journal.ForwardToConsole and services.journald.settings.Journal.TTYPath instead."
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "journald" "audit" ]
+      [ "services" "journald" "settings" "Journal" "Audit" ]
+    )
+    (lib.mkRemovedOptionModule [
+      "services"
+      "journald"
+      "extraConfig"
+    ] "Use services.journald.settings.Journal instead.")
   ];
 
   options = {
-    services.journald.console = lib.mkOption {
-      default = "";
-      type = lib.types.str;
-      description = "If non-empty, write log messages to the specified TTY device.";
-    };
-
-    services.journald.rateLimitInterval = lib.mkOption {
-      default = "30s";
-      type = lib.types.str;
+    services.journald.settings.Journal = lib.mkOption {
+      default = { };
+      example = {
+        Storage = "volatile";
+        ForwardToConsole = true;
+        TTYPath = "/dev/tty12";
+      };
       description = ''
-        Configures the rate limiting interval that is applied to all
-        messages generated on the system. This rate limiting is applied
-        per-service, so that two services which log do not interfere with
-        each other's limit. The value may be specified in the following
-        units: s, min, h, ms, us. To turn off any kind of rate limiting,
-        set either value to 0.
-
-        See {option}`services.journald.rateLimitBurst` for important
-        considerations when setting this value.
-      '';
-    };
-
-    services.journald.storage = lib.mkOption {
-      default = "persistent";
-      type = lib.types.enum [
-        "persistent"
-        "volatile"
-        "auto"
-        "none"
-      ];
-      description = ''
-        Controls where to store journal data. See
-        {manpage}`journald.conf(5)` for further information.
-      '';
-    };
-
-    services.journald.rateLimitBurst = lib.mkOption {
-      default = 10000;
-      type = lib.types.int;
-      description = ''
-        Configures the rate limiting burst limit (number of messages per
-        interval) that is applied to all messages generated on the system.
-        This rate limiting is applied per-service, so that two services
-        which log do not interfere with each other's limit.
-
-        Note that the effective rate limit is multiplied by a factor derived
-        from the available free disk space for the journal as described on
-        {manpage}`journald.conf(5)`.
-
-        Note that the total amount of logs stored is limited by journald settings
-        such as `SystemMaxUse`, which defaults to 10% the file system size
-        (capped at max 4GB), and `SystemKeepFree`, which defaults to 15% of the
-        file system size.
-
-        It is thus recommended to compute what period of time that you will be
-        able to store logs for when an application logs at full burst rate.
-        With default settings for log lines that are 100 Bytes long, this can
-        amount to just a few hours.
-      '';
-    };
-
-    services.journald.audit = lib.mkOption {
-      default = "keep";
-      type = lib.types.oneOf [
-        lib.types.bool
-        (lib.types.enum [ "keep" ])
-      ];
-      description = ''
-        If enabled systemd-journald will turn on auditing on start-up.
-        If disabled it will turn it off. If unset it will neither enable nor disable it, leaving the previous state unchanged.
-
-        NixOS defaults to leaving this unset as enabling audit without auditd running leads to spamming /dev/kmesg with random messages
-        and if you enable auditd then auditd is responsible for turning auditing on.
-
-        If you want to have audit logs in journald and do not mind audit logs also ending up in /dev/kmesg you can set this option to true.
-
-        If you want to for some ununderstandable reason disable auditing if auditd enabled it then you can set this option to false.
-        It is of NixOS' opinion that setting this to false is definitely the wrong thing to do - but it's an option.
-      '';
-    };
-
-    services.journald.extraConfig = lib.mkOption {
-      default = "";
-      type = lib.types.lines;
-      example = "Storage=volatile";
-      description = ''
-        Extra config options for systemd-journald. See {manpage}`journald.conf(5)`
-        for available options.
-      '';
-    };
-
-    services.journald.forwardToSyslog = lib.mkOption {
-      default = config.services.rsyslogd.enable || config.services.syslog-ng.enable;
-      defaultText = lib.literalExpression "services.rsyslogd.enable || services.syslog-ng.enable";
-      type = lib.types.bool;
-      description = ''
-        Whether to forward log messages to syslog.
+        Options for the systemd journal service. See {manpage}`journald.conf(5)`
+        man page for available options.
       '';
+      type = lib.types.submodule {
+        freeformType = lib.types.attrsOf utils.systemdUtils.unitOptions.unitOption;
+      };
     };
   };
 
   config = {
+    services.journald.settings.Journal = {
+      # "keep" isn't systemd's default since v258, so set it explicitly.
+      Audit = lib.mkOptionDefault "keep";
+    };
+
     systemd.additionalUpstreamSystemUnits = [
       "systemd-journald.socket"
       "systemd-journald@.socket"
@@ -136,23 +89,8 @@ in
       "sockets.target"
     ];
 
-    environment.etc = {
-      "systemd/journald.conf".text = ''
-        [Journal]
-        Storage=${cfg.storage}
-        RateLimitInterval=${cfg.rateLimitInterval}
-        RateLimitBurst=${toString cfg.rateLimitBurst}
-        ${lib.optionalString (cfg.console != "") ''
-          ForwardToConsole=yes
-          TTYPath=${cfg.console}
-        ''}
-        ${lib.optionalString (cfg.forwardToSyslog) ''
-          ForwardToSyslog=yes
-        ''}
-        Audit=${utils.systemdUtils.lib.toOption cfg.audit}
-        ${cfg.extraConfig}
-      '';
-    };
+    environment.etc."systemd/journald.conf".text =
+      utils.systemdUtils.lib.settingsToSections cfg.settings;
 
     users.groups.systemd-journal.gid = config.ids.gids.systemd-journal;
 
diff --git a/nixos/modules/testing/test-instrumentation.nix b/nixos/modules/testing/test-instrumentation.nix
index 3a24c9272a6b..47890479a4c9 100644
--- a/nixos/modules/testing/test-instrumentation.nix
+++ b/nixos/modules/testing/test-instrumentation.nix
@@ -233,11 +233,11 @@ in
     environment.systemPackages = [ pkgs.xwininfo ];
 
     # Log everything to the serial console.
-    services.journald.extraConfig = ''
-      ForwardToConsole=yes
-      TTYPath=/dev/${qemu-common.qemuSerialDevice}
-      MaxLevelConsole=debug
-    '';
+    services.journald.settings.Journal = {
+      ForwardToConsole = true;
+      TTYPath = "/dev/${qemu-common.qemuSerialDevice}";
+      MaxLevelConsole = "debug";
+    };
 
     systemd.settings.Manager = managerSettings;
     systemd.user.settings.Manager = {
diff --git a/nixos/tests/firewall.nix b/nixos/tests/firewall.nix
index 5c2e94fccac4..1aaddc0eb469 100644
--- a/nixos/tests/firewall.nix
+++ b/nixos/tests/firewall.nix
@@ -121,13 +121,13 @@
       walled.succeed("${reset}")
       attacker.fail("curl --fail --connect-timeout 2 http://walled/ >&2")
 
+      # Check whether activation of a new configuration reloads the firewall.
+      walled.succeed(
+          "/run/booted-system/specialisation/different-config/bin/switch-to-configuration test 2>&1 | grep -F ${unit}.service"
+      )
+
       # If we stop the firewall, then connections should succeed.
       walled.stop_job("${unit}")
       attacker.succeed("curl -v http://walled/ >&2")
-
-      # Check whether activation of a new configuration reloads the firewall.
-      walled.succeed(
-          "/run/booted-system/specialisation/different-config/bin/switch-to-configuration test 2>&1 | grep -qF ${unit}.service"
-      )
     '';
 }
diff --git a/nixos/tests/grub/basic.nix b/nixos/tests/grub/basic.nix
index 4221eec73049..697681b1dc45 100644
--- a/nixos/tests/grub/basic.nix
+++ b/nixos/tests/grub/basic.nix
@@ -49,7 +49,7 @@
     grub_select_all_configurations()
     with subtest("Invalid credentials are rejected"):
         grub_login_as("wronguser", "wrongsecret")
-        machine.wait_for_console_text("error: access denied.")
+        machine.wait_for_console_text("access denied")
 
     grub_select_all_configurations()
     with subtest("Valid credentials are accepted"):
diff --git a/nixos/tests/os-prober.nix b/nixos/tests/os-prober.nix
index 1c26d7423a86..c1cb71dc75e4 100644
--- a/nixos/tests/os-prober.nix
+++ b/nixos/tests/os-prober.nix
@@ -99,9 +99,11 @@ import ./make-test-python.nix (
             desktop-file-utils
             docbook5
             docbook_xsl_ns
+            hello
             kbd.dev
             kmod.dev
             libarchive.dev
+            libcap-text-verifier
             libxml2.bin
             libxslt.bin
             nixos-artwork.wallpapers.simple-dark-gray-bottom
@@ -112,6 +114,7 @@ import ./make-test-python.nix (
             perlPackages.JSON
             perlPackages.ListCompare
             perlPackages.XMLLibXML
+            # make-options-doc/default.nix
             (python3.withPackages (p: [ p.mistune ]))
             shared-mime-info
             sudo
diff --git a/nixos/tests/rsyslogd.nix b/nixos/tests/rsyslogd.nix
index 99703f18d6a7..0702698d6c6e 100644
--- a/nixos/tests/rsyslogd.nix
+++ b/nixos/tests/rsyslogd.nix
@@ -13,10 +13,11 @@ with pkgs.lib;
     meta.maintainers = [ pkgs.lib.maintainers.aanderse ];
 
     nodes.machine =
-      { config, pkgs, ... }:
+      { lib, ... }:
       {
         services.rsyslogd.enable = true;
-        services.journald.forwardToSyslog = false;
+        # Verify that the module's option default remains overridable by downstream defaults.
+        services.journald.settings.Journal.ForwardToSyslog = lib.mkDefault false;
       };
 
     # ensure rsyslogd isn't receiving messages from journald if explicitly disabled
@@ -31,7 +32,7 @@ with pkgs.lib;
     meta.maintainers = [ pkgs.lib.maintainers.aanderse ];
 
     nodes.machine =
-      { config, pkgs, ... }:
+      { ... }:
       {
         services.rsyslogd.enable = true;
       };
diff --git a/nixos/tests/systemd-journal.nix b/nixos/tests/systemd-journal.nix
index e2867de95f64..64a8374f11d0 100644
--- a/nixos/tests/systemd-journal.nix
+++ b/nixos/tests/systemd-journal.nix
@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ lib, pkgs, ... }:
 
 {
   name = "systemd-journal";
@@ -14,7 +14,8 @@
     security.audit.enable = true;
   };
   nodes.journaldAudit = {
-    services.journald.audit = true;
+    # Verify that the module's option default remains overridable by downstream defaults.
+    services.journald.settings.Journal.Audit = lib.mkDefault true;
     security.audit.enable = true;
   };
   nodes.containerCheck = {
@@ -45,6 +46,7 @@
 
     with subtest("journald audit"):
       journaldAudit.wait_for_unit("multi-user.target")
+      journaldAudit.succeed("grep -Fx 'Audit=true' /etc/systemd/journald.conf")
 
       # logs should end up in the journald
       journaldAudit.succeed("journalctl _TRANSPORT=audit --grep 'unit=systemd-journald'")
diff --git a/nixos/tests/systemd.nix b/nixos/tests/systemd.nix
index b04b288e8939..22ec4d68898a 100644
--- a/nixos/tests/systemd.nix
+++ b/nixos/tests/systemd.nix
@@ -35,7 +35,7 @@
         KExecWatchdogSec = "5min";
       };
       systemd.user.settings.Manager.DefaultEnvironment = "\"XXX_USER=bar\"";
-      services.journald.extraConfig = "Storage=volatile";
+      services.journald.settings.Journal.Storage = "volatile";
       test-support.displayManager.auto.user = "alice";
 
       systemd.shutdownRamfs.contents."/etc/systemd/system-shutdown/test".source =
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index ee3029811164..910aa88cf3aa 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -4885,8 +4885,8 @@ let
         mktplcRef = {
           name = "opa";
           publisher = "tsandall";
-          version = "0.24.1";
-          hash = "sha256-wNlZM9/2K32W4vYPKzLiBCTqhV+SqgZzXGRxKoHoIaM=";
+          version = "0.25.0";
+          hash = "sha256-d+INOMEc4ZO3T3326GxQW3PP/UflOwmEPfQOm2weVRY=";
         };
         meta = {
           changelog = "https://github.com/open-policy-agent/vscode-opa/blob/master/CHANGELOG.md";
@@ -4978,8 +4978,8 @@ let
         mktplcRef = {
           name = "theme-bluloco-light";
           publisher = "uloco";
-          version = "3.7.5";
-          sha256 = "sha256-MDrw0JWioLyg+H0XOCpULsmtM/y7RfV9ruDtskRiT3A=";
+          version = "3.10.0";
+          sha256 = "sha256-dweX1i8nn8qSleeGyhnrzSUXkhA13IXcGwwdkV7WsCI=";
         };
         postInstall = ''
           rm -r $out/share/vscode/extensions/uloco.theme-bluloco-light/screenshots
@@ -5552,8 +5552,8 @@ let
         mktplcRef = {
           name = "markdown-editor";
           publisher = "zaaack";
-          version = "0.1.19";
-          hash = "sha256-W0lL0JMNyEszyJa6I7RbXYLu4cU9DQUh0ZEAOd6eshI=";
+          version = "0.1.20";
+          hash = "sha256-YewK36OeKWgTU/iFRVZHYjF2+ke6TXb6HIggRZt1/nk=";
         };
         meta = {
           description = "Visual Studio Code extension for WYSIWYG markdown editing";
diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index 884eeaa06645..67aa9f0afe9a 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -853,7 +853,7 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "152.0.7977.64",
+    "version": "152.0.7977.75",
     "deps": {
       "depot_tools": {
         "rev": "38c391feba5fb96812f9028da12413ffc39df394",
@@ -865,16 +865,16 @@
         "hash": "sha256-ovLx6KaORdXqnWgbsGEty10k2CHuCmTk3yEqy5//ovk="
       },
       "ungoogled-patches": {
-        "rev": "152.0.7977.64-1",
-        "hash": "sha256-9esE3TgtKiwwFL5pu87aEQznelMVtNXBslggYAJTEbc="
+        "rev": "152.0.7977.75-1",
+        "hash": "sha256-HXWnJfk0SxC8sRcgtFdGBOOeiV7kEQD2YXQFBwMsU1s="
       },
       "npmHash": "sha256-pF0JtwFpPC4/fodbhSJnQKkczA9WlDg4VqEAy9aDVLg="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "506c834ecceaa943c5f41e6cfe7f68acb5c45346",
-        "hash": "sha256-KEr9nzF55+c8Rvvay3SZjcWMDWVGTyv1f5Pjv3ckl3E=",
+        "rev": "4999cc1efed37c4d91dc4ce6ec4b0a50e2a9a8cb",
+        "hash": "sha256-RXykREnCulCwk8zkk8OAd62TM4qel6j4uhyaaYzgolY=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -989,8 +989,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "571752c9cb3ed36a3194854374984427794c4dda",
-        "hash": "sha256-YMgRmVMXo1Ra5M034zij/ik/1aHpb3veK4VWsKHIwhI="
+        "rev": "ab8827bc57b176eeaa89f71324130c02d4d41145",
+        "hash": "sha256-Xd1FsdIBO6hzNECnNnXR0306woHl5/L+5WZ/pxTlYfA="
       },
       "src/third_party/dawn/third_party/glfw3/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -1124,8 +1124,8 @@
       },
       "src/third_party/devtools-frontend/src": {
         "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "941348cf79c423892e1c7c219091a7103d18a68b",
-        "hash": "sha256-/b+NCAr1jRJd/Uq4Cf5aO/yTdNP00ImIWuSJ4aP+TEw="
+        "rev": "04db1f5240b636511ec4e9058a78f8274a7f65ee",
+        "hash": "sha256-vZxKC/QD2dHNnVm9OZI1Bo0Jdnn+AJhFpXYSXXF7JsA="
       },
       "src/third_party/dom_distiller_js/dist": {
         "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
@@ -1694,8 +1694,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "6aacaf6256a069ee455142333b7d38cad1c8d6e0",
-        "hash": "sha256-1NX4HP/BIJ6bWxoF42K89X8ADHuHjA5akkOL/WkIeME="
+        "rev": "3de6ffffbfdcf265e9f11a5c9d1cfb4d486d7550",
+        "hash": "sha256-ZHEmeSe8r226gjazm91GYqlfbM9a5yi8KnFv4iAWFKE="
       },
       "src/agents/shared": {
         "url": "https://chromium.googlesource.com/chromium/agents.git",
diff --git a/pkgs/applications/networking/browsers/firefox-bin/default.nix b/pkgs/applications/networking/browsers/firefox-bin/default.nix
index 88d59af1aa81..07423c272088 100644
--- a/pkgs/applications/networking/browsers/firefox-bin/default.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/default.nix
@@ -130,8 +130,8 @@ stdenv.mkDerivation {
   passthru = {
     inherit applicationName binaryName;
     libName = "firefox-bin-${version}";
-    ffmpegSupport = true;
-    gssSupport = true;
+    withFFmpeg = true;
+    withGSSAPI = true;
     gtk3 = gtk3;
 
     # update with:
diff --git a/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix b/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
index 8a03e06626a9..20f7f74a25af 100644
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
@@ -10,11 +10,11 @@
 buildMozillaMach rec {
   pname = "firefox-beta";
   binaryName = "firefox-beta";
-  version = "155.0b5";
+  version = "156.0b2";
   applicationName = "Firefox Beta";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "30b4b84c80057a992e763b8f967c65f46308324fd41c0307c9302e262e6428c379861ccd9ce52dde15d0dc3f4410b95a8c047ea7e5af9d90e60e7bb57ee59137";
+    sha512 = "5b685f8b947af0b519c59a308fba6a41f9481df68b7fb6f4b395707653c3ef1822817d2f867d663081cd2d61c8fd4537f46b8002da84b5efa9b8a57ae9491164";
   };
 
   meta = {
diff --git a/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix b/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
index 449995dd3620..99d3c7eabb6b 100644
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
@@ -7,16 +7,15 @@
   buildMozillaMach,
 }:
 
-buildMozillaMach rec {
+(buildMozillaMach rec {
   pname = "firefox-devedition";
   binaryName = "firefox-devedition";
-  version = "155.0b5";
+  version = "156.0b2";
   applicationName = "Firefox Developer Edition";
-  requireSigning = false;
   branding = "browser/branding/aurora";
   src = fetchurl {
     url = "mirror://mozilla/devedition/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "8e9ccc65a8cd6640171d4891fe8d01435cd524cee8164a5829429df827bcc2b49c3b7e6a092aaf5bfa48140d7f40f6c9cb371af48a7321132ea6ee5da0af08e3";
+    sha512 = "683326ff4367f9b807c4c5b93f100970258ada9838da2c597358105a99ff4aa7e33269fe67d6c68d466e2f539d2bea3015457109516af19e1785588ce43426b5";
   };
 
   # buildMozillaMach sets MOZ_APP_REMOTINGNAME during configuration, but
@@ -52,4 +51,7 @@ buildMozillaMach rec {
     versionSuffix = "b[0-9]*";
     baseUrl = "https://archive.mozilla.org/pub/devedition/releases/";
   };
-}
+}).override
+  {
+    enableAddonSigning = false;
+  }
diff --git a/pkgs/applications/networking/browsers/firefox/wrapper.nix b/pkgs/applications/networking/browsers/firefox/wrapper.nix
index f59895902aec..0933f6921764 100644
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@@ -69,8 +69,9 @@ let
       wmClass ? applicationName,
       nativeMessagingHosts ? [ ],
       pkcs11Modules ? [ ],
-      useGlvnd ? (!isDarwin),
+      withGlvnd ? (!isDarwin),
       cfg ? config.${applicationName} or { },
+      appDataDir ? null,
 
       ## Following options are needed for extra prefs & policies
       # For more information about anti tracking (german website)
@@ -88,20 +89,20 @@ let
     }:
 
     let
-      ffmpegSupport = browser.ffmpegSupport or false;
+      withFFmpeg = browser.withFFmpeg or false;
       # Firefox dlopens libavcodec by hardcoded soname, so each ffmpeg major needs
       # explicit browser support; keep versioned pins here (never the ffmpeg alias)
       # and add a tier when a release gains the next ABI.
       # libavcodec 62: 146 (bug 1962139), uplifted to ESR 140.10.2 (bug 2036244).
       # libavcodec 63: 154 (bug 2057577), uplifted to ESR 153.1 (bug 2057577).
       ffmpegPackage = if lib.versionAtLeast browser.version "153.1" then ffmpeg_9 else ffmpeg_8;
-      gssSupport = browser.gssSupport or false;
-      alsaSupport = browser.alsaSupport or false;
-      pipewireSupport = browser.pipewireSupport or false;
-      sndioSupport = browser.sndioSupport or false;
-      jackSupport = browser.jackSupport or false;
+      withGSSAPI = browser.withGSSAPI or false;
+      withALSA = browser.withALSA or false;
+      withPipewire = browser.withPipewire or false;
+      withSndio = browser.withSndio or false;
+      withJACK = browser.withJACK or false;
       # PCSC-Lite daemon (services.pcscd) also must be enabled for firefox to access smartcards
-      smartcardSupport = cfg.smartcardSupport or false;
+      withPCSC = cfg.smartcardSupport or false;
 
       allNativeMessagingHosts = map lib.getBin (lib.unique nativeMessagingHosts);
 
@@ -119,10 +120,10 @@ let
           ]
           ++ lib.optional (cfg.speechSynthesisSupport or true) speechd-minimal
         )
-        ++ lib.optional pipewireSupport pipewire
-        ++ lib.optional ffmpegSupport ffmpegPackage
-        ++ lib.optional gssSupport libkrb5
-        ++ lib.optional useGlvnd libglvnd
+        ++ lib.optional withPipewire pipewire
+        ++ lib.optional withFFmpeg ffmpegPackage
+        ++ lib.optional withGSSAPI libkrb5
+        ++ lib.optional withGlvnd libglvnd
         ++ lib.optionals (cfg.enableQuakeLive or false) [
           stdenv.cc
           libx11
@@ -134,10 +135,10 @@ let
           zlib
         ]
         ++ lib.optional (config.pulseaudio or (!isDarwin)) libpulseaudio
-        ++ lib.optional alsaSupport alsa-lib
-        ++ lib.optional sndioSupport sndio
-        ++ lib.optional jackSupport libjack2
-        ++ lib.optional smartcardSupport opensc
+        ++ lib.optional withALSA alsa-lib
+        ++ lib.optional withSndio sndio
+        ++ lib.optional withJACK libjack2
+        ++ lib.optional withPCSC opensc
         ++ pkcs11Modules
         ++ lib.optionals (!isDarwin) gtk_modules;
       gtk_modules = lib.optionals (!isDarwin) [ libcanberra-gtk3 ];
@@ -161,7 +162,7 @@ let
       extensions =
         if nameArray != (lib.unique nameArray) then
           throw "Firefox addon name needs to be unique"
-        else if browser.requireSigning || !browser.allowAddonSideload then
+        else if browser.enableAddonSigning || !browser.enableAddonSideload then
           throw "Nix addons are only supported with signature enforcement disabled and addon sideloading enabled (eg. LibreWolf)"
         else
           map (
@@ -195,7 +196,7 @@ let
               Install = lib.foldr (e: ret: ret ++ [ "${e.outPath}/${e.extid}.xpi" ]) [ ] extensions;
             };
           }
-          // lib.optionalAttrs smartcardSupport {
+          // lib.optionalAttrs withPCSC {
             SecurityDevices = {
               "OpenSC PKCS#11 Module" = "opensc-pkcs11.so";
             };
@@ -335,6 +336,11 @@ let
         "MOZ_ALLOW_DOWNGRADE"
         "1"
       ]
+      ++ lib.optionals (appDataDir != null) [
+        "--set"
+        "MOZ_APP_DATA"
+        appDataDir
+      ]
       ++ lib.optionals (!isDarwin) [
         "--suffix"
         "GTK_PATH"
diff --git a/pkgs/applications/networking/cluster/helm/plugins/helm-schema.nix b/pkgs/applications/networking/cluster/helm/plugins/helm-schema.nix
index 1219302378c5..c5b0a618c4aa 100644
--- a/pkgs/applications/networking/cluster/helm/plugins/helm-schema.nix
+++ b/pkgs/applications/networking/cluster/helm/plugins/helm-schema.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "helm-schema";
-  version = "2.5.0";
+  version = "2.6.0";
 
   src = fetchFromGitHub {
     owner = "losisin";
     repo = "helm-values-schema-json";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GryjtwHUchH/69iLKavvJF9BE/E9g3LtgW9SBGXenU0=";
+    hash = "sha256-DTxVVf8p9IHYPIC5TevnvvLWTQx2VIy3WNPXSczTkSs=";
   };
 
-  vendorHash = "sha256-FFxPgTjg88GX5J+23O7A4WerqzWwM6YS9FlT13arWMQ=";
+  vendorHash = "sha256-XSaTTzSoKnwoiZu/FqHYOas6dMtr5C4+F5jy4FX1ot8=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/applications/networking/cluster/k3s/1_33/chart-versions.nix b/pkgs/applications/networking/cluster/k3s/1_33/chart-versions.nix
deleted file mode 100644
index d9f782df1b61..000000000000
--- a/pkgs/applications/networking/cluster/k3s/1_33/chart-versions.nix
+++ /dev/null
@@ -1,10 +0,0 @@
-{
-  traefik-crd = {
-    url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-40.1.4+up40.1.0.tgz";
-    sha256 = "0g79q6rb3n3i2v1qw3j5259pjfb9y1g4m9r9wpqrijhrsj2qjn6d";
-  };
-  traefik = {
-    url = "https://k3s.io/k3s-charts/assets/traefik/traefik-40.1.4+up40.1.0.tgz";
-    sha256 = "0rvp9ch1rda4iv79hjc6236ldqv9xvzsfrqixbzz3ffmrppczsx9";
-  };
-}
diff --git a/pkgs/applications/networking/cluster/k3s/1_33/images-versions.json b/pkgs/applications/networking/cluster/k3s/1_33/images-versions.json
deleted file mode 100644
index f183ab128fa6..000000000000
--- a/pkgs/applications/networking/cluster/k3s/1_33/images-versions.json
+++ /dev/null
@@ -1,26 +0,0 @@
-{
-  "airgap-images-amd64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.13%2Bk3s2/k3s-airgap-images-amd64.tar.gz",
-    "sha256": "49f2d99717503e1f9db527baedf7b4b3d0463f1ed3d4544940a234561c5651ba"
-  },
-  "airgap-images-amd64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.13%2Bk3s2/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "7e59087b6a72e00db45a3bcb4f144114b13eb72dc8947c2b7908a0e1482b42b3"
-  },
-  "airgap-images-arm-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.13%2Bk3s2/k3s-airgap-images-arm.tar.gz",
-    "sha256": "91e2deca0b39119d02c03495520542977712641ec142a81af0ad1fa1cbf4f362"
-  },
-  "airgap-images-arm-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.13%2Bk3s2/k3s-airgap-images-arm.tar.zst",
-    "sha256": "b94244483badd6793f2e8d93de9d3125d4faf4a10b10047f289bee1e30bb1f44"
-  },
-  "airgap-images-arm64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.13%2Bk3s2/k3s-airgap-images-arm64.tar.gz",
-    "sha256": "35bbd4e5201c8c6a48776822b8e46d7067cff1875f86c3bde5de3bda37757584"
-  },
-  "airgap-images-arm64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.13%2Bk3s2/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "47bc05eb1b21f0f76530a927ec5e1c5c2dec457f0190bf423e7be1d49348b5e6"
-  }
-}
diff --git a/pkgs/applications/networking/cluster/k3s/1_33/versions.nix b/pkgs/applications/networking/cluster/k3s/1_33/versions.nix
deleted file mode 100644
index 00b7fc83a4bb..000000000000
--- a/pkgs/applications/networking/cluster/k3s/1_33/versions.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-{
-  k3sVersion = "1.33.13+k3s2";
-  k3sCommit = "875e930d812e17f955cfb3a4817ad33cce3c6822";
-  k3sRepoSha256 = "1hk3z4s2hhzdha894aai4jpl8nc5mkqb2sf7hywi8b11h8ckhv8n";
-  k3sVendorHash = "sha256-jsGm6y94Kqd4SIDy00A5QpBylHIuTuirEbChpEKo2R8=";
-  chartVersions = import ./chart-versions.nix;
-  imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
-  k3sRootVersion = "0.15.2";
-  k3sRootSha256 = "0yxq2jqqb7flm4rs9dl7fqxba3mmwkmjbc8rx7pgai4qa1lzyigy";
-  k3sCNIVersion = "1.9.1-k3s1";
-  k3sCNISha256 = "1ggaz0p1c2k94car9d89a05smz3zx32sxn197b1l5kmjcnzdwadh";
-  containerdVersion = "2.2.5-k3s1.33";
-  containerdSha256 = "1al4zsyh3pz379ia0awhrlz7nyl2abyy0ayw0gl4gr6xjp7jsp1s";
-  containerdPackage = "github.com/k3s-io/containerd/v2";
-  criCtlVersion = "1.33.0-k3s2";
-  flannelVersion = "v0.28.4";
-  flannelPluginVersion = "v1.9.0-flannel1";
-  kubeRouterVersion = "v2.6.3-k3s1";
-  criDockerdVersion = "v0.3.19-k3s2";
-  helmJobVersion = "v0.13.3-build20260727";
-}
diff --git a/pkgs/applications/networking/cluster/k3s/1_34/images-versions.json b/pkgs/applications/networking/cluster/k3s/1_34/images-versions.json
index affe7822e17e..5bc57d772387 100644
--- a/pkgs/applications/networking/cluster/k3s/1_34/images-versions.json
+++ b/pkgs/applications/networking/cluster/k3s/1_34/images-versions.json
@@ -1,26 +1,26 @@
 {
   "airgap-images-amd64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.10%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
-    "sha256": "e972a78ff6ba5a83ea80c36ac986e687ee2ce4181e0fe6104f98a48467094297"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.11%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
+    "sha256": "8347931329bd188ecfa7782e7c0b9509813a29f5b6481c7b1ab54238aef1cf1f"
   },
   "airgap-images-amd64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.10%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "7e59087b6a72e00db45a3bcb4f144114b13eb72dc8947c2b7908a0e1482b42b3"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.11%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "807160da9a1b3ec86183a777241a6fe948d27fd6fdf3b88d0da39fa3b1ceeddc"
   },
   "airgap-images-arm-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.10%2Bk3s1/k3s-airgap-images-arm.tar.gz",
-    "sha256": "718b9bf069aff3ffc9c3dd769abc30decf301ae90d06e47f33ed48e4957b9b3b"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.11%2Bk3s1/k3s-airgap-images-arm.tar.gz",
+    "sha256": "c6c996e5aefd1ffb02f2fd089c29d26ae2b5a24e1c81b32f330e93612d1c38de"
   },
   "airgap-images-arm-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.10%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "d24b30ad5536998219611cdb7ee20d2c821a9acb69fb3852dd892a1e082edf44"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.11%2Bk3s1/k3s-airgap-images-arm.tar.zst",
+    "sha256": "57133711ae21010fd197fb666c631d7ac7c5a3f40533038b9a9d9e51ea066e5f"
   },
   "airgap-images-arm64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.10%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
-    "sha256": "3040602c860a1827d11b6db19307e586300a271b2f5a7781909de47f32df4ea2"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.11%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
+    "sha256": "1f812132104de93d30d8d1f317e11cb263a8e44f9ef1abba07cf3eb178b8113e"
   },
   "airgap-images-arm64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.10%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "dc1a8c0d10a40f2d0dc1d53c5c42f2b4e00a996b1573227bcbf2855c644d3025"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.11%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "18c53139e7ad39009057d5c52ec5501aeea1ada235986e43c7357a3863ff3fdd"
   }
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_34/versions.nix b/pkgs/applications/networking/cluster/k3s/1_34/versions.nix
index 464581ab7cf2..bee4de84a654 100644
--- a/pkgs/applications/networking/cluster/k3s/1_34/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_34/versions.nix
@@ -1,16 +1,16 @@
 {
-  k3sVersion = "1.34.10+k3s1";
-  k3sCommit = "39a4509ed98145d4f1eb8e15a8ca8362ca018afa";
-  k3sRepoSha256 = "1r0far01pxbjvlrz7pjmx11k1hmvwr6xmkdcpf9iph64qlnwr4s3";
-  k3sVendorHash = "sha256-ypwsQOkbda18/YLqM4v88RH4aKAxsagiocukYFnQHSw=";
+  k3sVersion = "1.34.11+k3s1";
+  k3sCommit = "9312658016b9e33288b528da68bf88e37e6aeecf";
+  k3sRepoSha256 = "0mk2i1ir93amv9aq37mmnzyj1zzq6nvgg81vfnw4da4ln5kvj878";
+  k3sVendorHash = "sha256-QcGSnYXlG/+PFD+XGeVoCI/bh91YdW8sPUi4B0gFSC0=";
   chartVersions = import ./chart-versions.nix;
   imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
   k3sRootVersion = "0.15.2";
   k3sRootSha256 = "0yxq2jqqb7flm4rs9dl7fqxba3mmwkmjbc8rx7pgai4qa1lzyigy";
   k3sCNIVersion = "1.9.1-k3s1";
   k3sCNISha256 = "1ggaz0p1c2k94car9d89a05smz3zx32sxn197b1l5kmjcnzdwadh";
-  containerdVersion = "2.2.5-k3s2";
-  containerdSha256 = "1i9vkmf3gg34d9hjq15c00frhqxs9cba03zwg7qqq34gkb4qhjch";
+  containerdVersion = "2.2.7-k3s1";
+  containerdSha256 = "0zn64g6fzv8knan550ydbkgkaxa8qi2l8dw38w9g3hm8lv43nqyv";
   containerdPackage = "github.com/k3s-io/containerd/v2";
   criCtlVersion = "1.34.0-k3s2";
   flannelVersion = "v0.28.4";
diff --git a/pkgs/applications/networking/cluster/k3s/1_35/images-versions.json b/pkgs/applications/networking/cluster/k3s/1_35/images-versions.json
index d58cdb9b168a..d54f579310e1 100644
--- a/pkgs/applications/networking/cluster/k3s/1_35/images-versions.json
+++ b/pkgs/applications/networking/cluster/k3s/1_35/images-versions.json
@@ -1,26 +1,26 @@
 {
   "airgap-images-amd64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.7%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
-    "sha256": "c109b42bce8de6f258be41f3f83393ff2693b7ede95bce0e80a1ff394b590507"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.8%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
+    "sha256": "a2893ea3234e01facd06cdb2ca879b65348fccf6b43be20501d72a949ece45f7"
   },
   "airgap-images-amd64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.7%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "d28bbfef8a86b740e8235b6b2cfa6e29ecb0da457a55275d788a18d09142ee1f"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.8%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "807160da9a1b3ec86183a777241a6fe948d27fd6fdf3b88d0da39fa3b1ceeddc"
   },
   "airgap-images-arm-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.7%2Bk3s1/k3s-airgap-images-arm.tar.gz",
-    "sha256": "589150e3493a5cd29bf7b8b57f9e3f7968c1b2d1f79e8a072352d63abb59e978"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.8%2Bk3s1/k3s-airgap-images-arm.tar.gz",
+    "sha256": "08118b95556457b8a191357b329a42298d485b4597f720c14c5625d256f1e656"
   },
   "airgap-images-arm-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.7%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "c6d57e5fb17ba142464bc8db9debfa701f560b4defa70c2e06981bf52cb9e26b"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.8%2Bk3s1/k3s-airgap-images-arm.tar.zst",
+    "sha256": "3f502e7d64a87b5b5afc5ed8ed27febb73e090d81a5b7df9db51cfd5a7a144a1"
   },
   "airgap-images-arm64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.7%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
-    "sha256": "b686b4c09dc335535889d5630ae5b0283d421d40af1029b271938cfd3b358f11"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.8%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
+    "sha256": "23d82e394d9ad41ea2912afaf0a6ead69bacede819c12678ba5dec22d16784da"
   },
   "airgap-images-arm64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.7%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "47bc05eb1b21f0f76530a927ec5e1c5c2dec457f0190bf423e7be1d49348b5e6"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.8%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "18c53139e7ad39009057d5c52ec5501aeea1ada235986e43c7357a3863ff3fdd"
   }
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_35/versions.nix b/pkgs/applications/networking/cluster/k3s/1_35/versions.nix
index 3ccce4040e6a..ce3cb92a1f25 100644
--- a/pkgs/applications/networking/cluster/k3s/1_35/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_35/versions.nix
@@ -1,16 +1,16 @@
 {
-  k3sVersion = "1.35.7+k3s1";
-  k3sCommit = "cd43afc7151132bac92feacd3e4d2127ea1e70d0";
-  k3sRepoSha256 = "1m9kwz8i1sqjgmc71qknmr87c9g8z7r2wl9440r32lfzxq8a6g1b";
-  k3sVendorHash = "sha256-0MVOVrRWZ/xyTaRq5Nw5ogxIGZLArDVA1wiHmiwKqFA=";
+  k3sVersion = "1.35.8+k3s1";
+  k3sCommit = "e952d68a5a5f8953c4549cf8fb557f3eae417107";
+  k3sRepoSha256 = "07kpi9kl8pw4fyba474dap5hiskxays8qa8mf4qz6ai4wqapzg5c";
+  k3sVendorHash = "sha256-2u9D2HLhiryOi8bwu5Tbv162WEoRbFfgePW7AeefuG8=";
   chartVersions = import ./chart-versions.nix;
   imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
   k3sRootVersion = "0.15.2";
   k3sRootSha256 = "0yxq2jqqb7flm4rs9dl7fqxba3mmwkmjbc8rx7pgai4qa1lzyigy";
   k3sCNIVersion = "1.9.1-k3s1";
   k3sCNISha256 = "1ggaz0p1c2k94car9d89a05smz3zx32sxn197b1l5kmjcnzdwadh";
-  containerdVersion = "2.2.5-k3s2";
-  containerdSha256 = "1i9vkmf3gg34d9hjq15c00frhqxs9cba03zwg7qqq34gkb4qhjch";
+  containerdVersion = "2.2.7-k3s1";
+  containerdSha256 = "0zn64g6fzv8knan550ydbkgkaxa8qi2l8dw38w9g3hm8lv43nqyv";
   containerdPackage = "github.com/k3s-io/containerd/v2";
   criCtlVersion = "1.35.0-k3s2";
   flannelVersion = "v0.28.4";
diff --git a/pkgs/applications/networking/cluster/k3s/1_36/images-versions.json b/pkgs/applications/networking/cluster/k3s/1_36/images-versions.json
index 2fd4b7681648..f9bfef30d60d 100644
--- a/pkgs/applications/networking/cluster/k3s/1_36/images-versions.json
+++ b/pkgs/applications/networking/cluster/k3s/1_36/images-versions.json
@@ -1,26 +1,26 @@
 {
   "airgap-images-amd64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.36.3%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
-    "sha256": "e09e718f931ef094294781d3c35e58b84e2170acd5cc2edae075a20f58d1f89d"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.36.4%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
+    "sha256": "a5a6c970a992ce6ed5801b5fd090aa7edde354a786eb0e7d75b162d0b22901dd"
   },
   "airgap-images-amd64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.36.3%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "a197d79e979cc3f4fa9bca8f500bd70092b25c1b5ebda68b35a25f792abd42b0"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.36.4%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "9024613e2d468c51ba0e5ba21898604c41339354449fb3338cc6a7931189eb6a"
   },
   "airgap-images-arm-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.36.3%2Bk3s1/k3s-airgap-images-arm.tar.gz",
-    "sha256": "5e6b25d6cd2f6f25e663edf94a450e560a80b7a207c3d9f4d4646b688cceee5b"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.36.4%2Bk3s1/k3s-airgap-images-arm.tar.gz",
+    "sha256": "519824fd8ab0096959164c319de4e28abb4677c1e6a10a2fd0bb8922c73e16d1"
   },
   "airgap-images-arm-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.36.3%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "b94244483badd6793f2e8d93de9d3125d4faf4a10b10047f289bee1e30bb1f44"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.36.4%2Bk3s1/k3s-airgap-images-arm.tar.zst",
+    "sha256": "31a0be5131bb87286209fa0ea2c91e73fda57aee622e162f5f0e54b6e53f8ce5"
   },
   "airgap-images-arm64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.36.3%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
-    "sha256": "75fc0f7a1f8a9babf00e4a6bd5fadfb6657a3af1289fe3611eaf56f01e5ce735"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.36.4%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
+    "sha256": "5b66fde4e29681c09980d64bc77544769210abf8dcbd19dc210427ed12e0e8f8"
   },
   "airgap-images-arm64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.36.3%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "856feb047453cd697c2bc4dcf20127448554c8366be992a211558a13d830a038"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.36.4%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "9d3c4c2197bcf857ca17633aa393bad683cc982ddd408620f93036a3cca953b5"
   }
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_36/versions.nix b/pkgs/applications/networking/cluster/k3s/1_36/versions.nix
index 35ac31d3f09f..a9afa6110624 100644
--- a/pkgs/applications/networking/cluster/k3s/1_36/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_36/versions.nix
@@ -1,16 +1,16 @@
 {
-  k3sVersion = "1.36.3+k3s1";
-  k3sCommit = "5aed4d7beddeb3e67120da477c876ac9efd70318";
-  k3sRepoSha256 = "0y5lc93f5pdvgm3mmk87mh50z7iway4cz99nskfh1600zfhia2s6";
-  k3sVendorHash = "sha256-pxYh1AJVZL8Xx23Nairoi5bSNNSVs+EqJbXF7ISN3wg=";
+  k3sVersion = "1.36.4+k3s1";
+  k3sCommit = "4dedb15be78017a8ddd5b9e81acd44f3481078ed";
+  k3sRepoSha256 = "07ynarjmjqybfyq30kaa08nx9rw5h83nifir050mplqjwb10mrk5";
+  k3sVendorHash = "sha256-naO/9O5aLGNf7FwQvsvSb/eG0eCBFc/Um3yfH2fP+8Y=";
   chartVersions = import ./chart-versions.nix;
   imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
   k3sRootVersion = "0.15.2";
   k3sRootSha256 = "0yxq2jqqb7flm4rs9dl7fqxba3mmwkmjbc8rx7pgai4qa1lzyigy";
   k3sCNIVersion = "1.9.1-k3s1";
   k3sCNISha256 = "1ggaz0p1c2k94car9d89a05smz3zx32sxn197b1l5kmjcnzdwadh";
-  containerdVersion = "2.3.2-k3s2";
-  containerdSha256 = "1jzhkh0zg1s2922fkr4r5v1680apafkjqba8ic6br8nc8bk7j4xq";
+  containerdVersion = "2.3.4-k3s1.36";
+  containerdSha256 = "0mlazx89616j90s73953spi4ahcas8w9kb51a7qf02pa9isyz5vi";
   containerdPackage = "github.com/k3s-io/containerd/v2";
   criCtlVersion = "1.36.0-k3s1";
   flannelVersion = "v0.28.4";
diff --git a/pkgs/applications/networking/cluster/k3s/builder.nix b/pkgs/applications/networking/cluster/k3s/builder.nix
index c6c5f758dfc8..9ca056a19d54 100644
--- a/pkgs/applications/networking/cluster/k3s/builder.nix
+++ b/pkgs/applications/networking/cluster/k3s/builder.nix
@@ -377,6 +377,7 @@ buildGoModule (finalAttrs: {
   pname = "k3s";
   version = k3sVersion;
   pos = builtins.unsafeGetAttrPos "k3sVersion" attrs;
+  __structuredAttrs = true;
 
   tags = [
     "libsqlite3"
diff --git a/pkgs/applications/networking/cluster/k3s/default.nix b/pkgs/applications/networking/cluster/k3s/default.nix
index fafe11745677..9b8933ef3e99 100644
--- a/pkgs/applications/networking/cluster/k3s/default.nix
+++ b/pkgs/applications/networking/cluster/k3s/default.nix
@@ -2,7 +2,7 @@
 
 let
   k3s_builder = import ./builder.nix lib;
-  common = opts: callPackage (k3s_builder opts);
+  forVersions = versions: callPackage (k3s_builder (import versions)) extraArgs;
   # extraArgs is the extra arguments passed in by the caller to propagate downward.
   # This is to allow all-packages.nix to do:
   #
@@ -12,18 +12,7 @@ let
   extraArgs = removeAttrs args [ "callPackage" ];
 in
 {
-  k3s_1_33 = common (import ./1_33/versions.nix) extraArgs;
-
-  k3s_1_34 = (common (import ./1_34/versions.nix) extraArgs).overrideAttrs {
-    patches = [ ./go_runc_require.patch ];
-  };
-
-  k3s_1_35 = (common (import ./1_35/versions.nix) extraArgs).overrideAttrs {
-    patches = [ ./go_runc_require.patch ];
-  };
-
-  k3s_1_36 = (common (import ./1_36/versions.nix) extraArgs).overrideAttrs {
-    __structuredAttrs = true;
-    patches = [ ./go_runc_require.patch ];
-  };
+  k3s_1_34 = forVersions ./1_34/versions.nix;
+  k3s_1_35 = forVersions ./1_35/versions.nix;
+  k3s_1_36 = forVersions ./1_36/versions.nix;
 }
diff --git a/pkgs/applications/networking/cluster/k3s/go_runc_require.patch b/pkgs/applications/networking/cluster/k3s/go_runc_require.patch
deleted file mode 100644
index 8d8d5912afd1..000000000000
--- a/pkgs/applications/networking/cluster/k3s/go_runc_require.patch
+++ /dev/null
@@ -1,18 +0,0 @@
-# Adds explicit require of opencontainers/runc to go.mod before version.sh is called and
-# removes it afterwards so that later build commands don't complain about inconsistent
-# vendoring.
-diff --git a/scripts/package-cli b/scripts/package-cli
-index a15d754926..bc450dbe4e 100755
---- a/scripts/package-cli
-+++ b/scripts/package-cli
-@@ -3,7 +3,10 @@ set -e -x
- 
- cd $(dirname $0)/..
- 
-+runc_require=$(grep "github.com/opencontainers/runc" go.mod | awk -F '=> ' '{print $2}' | xargs -0 printf 'require %s')
-+echo "$runc_require" >> go.mod
- . ./scripts/version.sh
-+sed -i '$d' go.mod
- 
- GO=${GO-go}
- 
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 1123a30a4559..5200037a7741 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -82,13 +82,13 @@
     "vendorHash": "sha256-L9IGENsL8Kibq5O/JOgCxLRUxgS7q9G/NovC/Q7tw48="
   },
   "auth0_auth0": {
-    "hash": "sha256-SpGTMAFEiJVGpXYAIigJQditDvs8sU2Bz57ohanccAM=",
+    "hash": "sha256-t/AdooXhTpu4UXE8u6cvdVPL4HFUQQWOSAjw1RXFs8c=",
     "homepage": "https://registry.terraform.io/providers/auth0/auth0",
     "owner": "auth0",
     "repo": "terraform-provider-auth0",
-    "rev": "v1.55.0",
+    "rev": "v1.56.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-ajl7q+9oA+NA5eqAXA5yjej03qdI5nimRNQW6GoGOq4="
+    "vendorHash": "sha256-ydki+y2A6g94xNGVr7xZkBB/grEbOOD4LRwYGAmzLsc="
   },
   "aviatrixsystems_aviatrix": {
     "hash": "sha256-46djOfAj/5kfeoKLQHbeKefzdGbmlBATR+uN/IaAn8I=",
@@ -1490,13 +1490,13 @@
     "vendorHash": "sha256-GRnVhGpVgFI83Lg34Zv1xgV5Kp8ioKTFV5uaqS80ATg="
   },
   "vpsfreecz_vpsadmin": {
-    "hash": "sha256-T+az9OH9/ZMSJewZpC9VLSXOZ5N/wz00VRnl9Ab4aeI=",
+    "hash": "sha256-1r2SqoRWJJhQej8D3LXHOEXT5RSxE4t6s7QuiNoIqpg=",
     "homepage": "https://registry.terraform.io/providers/vpsfreecz/vpsadmin",
     "owner": "vpsfreecz",
     "repo": "terraform-provider-vpsadmin",
-    "rev": "v1.3.0",
+    "rev": "v1.5.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-98lrEH7j4Fl0oSEoL75e0h+8ySLacPK2k0OehY3jqhA="
+    "vendorHash": "sha256-fbFpENa1/8Qs6RnTUMi0LDATho8+WuKhj4i8S/dG3Yg="
   },
   "vultr_vultr": {
     "hash": "sha256-hK4/Pzj0UtWDLQS3cRMC73ZRr20HCWqI+jUlTUHcHaw=",
diff --git a/pkgs/applications/networking/instant-messengers/discord/sources.json b/pkgs/applications/networking/instant-messengers/discord/sources.json
index 8754e998d57c..864cac3c3607 100644
--- a/pkgs/applications/networking/instant-messengers/discord/sources.json
+++ b/pkgs/applications/networking/instant-messengers/discord/sources.json
@@ -1,83 +1,78 @@
 {
   "linux-canary": {
     "distro": {
-      "hash": "sha256-4j3ii6uD9f0tV71mU8XFFxWch7LiWCwclnkHa5NGj+4=",
-      "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1766/full.distro"
+      "hash": "sha256-UHlT587DCEDz7YSxN57S3mZ+4R2bi8/Aqvf62QuibEY=",
+      "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1794/full.distro"
     },
     "kind": "distro",
     "modules": {
-      "discord_arborium": {
-        "hash": "sha256-I6JRlVELq5Mldcaz+lKMt0izsNSfWdw/e5JPqBGLOzE=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1766/discord_arborium/1/full.distro",
-        "version": 1
-      },
       "discord_cloudsync": {
-        "hash": "sha256-ZulqlXaIFr+Ds20ON02HZLn45JFqq9POuYoFV1t0eZI=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1766/discord_cloudsync/1/full.distro",
+        "hash": "sha256-/gA7pLPkyWAMQc2gNgq9L14W9hu3Bi5rPtCyWZGghqQ=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1794/discord_cloudsync/1/full.distro",
         "version": 1
       },
       "discord_desktop_core": {
-        "hash": "sha256-H7mcz7tm2FQXrmbfLz9n1bxbuAMNAnGK9iWEbMoVoew=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1766/discord_desktop_core/1/full.distro",
+        "hash": "sha256-/iCoCP3vNeAVXRK3smZdf8XrQNYanejlcjZ9fcddbHg=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1794/discord_desktop_core/1/full.distro",
         "version": 1
       },
       "discord_dispatch": {
-        "hash": "sha256-XTmNR20AqtrpWiwOy0vMrUy0K2bDG7P27a80hbvWS58=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1766/discord_dispatch/1/full.distro",
+        "hash": "sha256-KjrgWGgTHuNOqm2NnOiDATyAgngaGSktATe5OnV3Cjg=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1794/discord_dispatch/1/full.distro",
         "version": 1
       },
       "discord_erlpack": {
-        "hash": "sha256-zH6H8EchYRXbK7HgG6F09Oiieep6JyTw1+r2nRmtQ6Q=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1766/discord_erlpack/1/full.distro",
+        "hash": "sha256-eLse+k1w07/mGh0h3beXGZtsCz7NuP6qSQH6hJcNspM=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1794/discord_erlpack/1/full.distro",
         "version": 1
       },
       "discord_game_utils": {
-        "hash": "sha256-3H3KVkC/t6UdxTQEUtKg9rfk1xKaWf0MDerUm5yO3/Y=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1766/discord_game_utils/1/full.distro",
+        "hash": "sha256-JPacuW/LhaFGftu3tR3C4AKU+6nnJuc4N99CnvJskf8=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1794/discord_game_utils/1/full.distro",
         "version": 1
       },
       "discord_krisp": {
-        "hash": "sha256-w8XATCZyCv1FeoRBweo7+wL9NAX2jD8JNKiF1ED7T1w=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1766/discord_krisp/1/full.distro",
+        "hash": "sha256-xYryuPZXFp9nvDQ4l8qFANh16CcO+ZNCEUc0/UXrBzE=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1794/discord_krisp/1/full.distro",
         "version": 1
       },
       "discord_modules": {
-        "hash": "sha256-Qd4gefF0GDNmZpwtIuuOdGRxRn7b+l88N7lbsRebe9U=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1766/discord_modules/1/full.distro",
+        "hash": "sha256-KCAWR5Eoib/RkO3MVn8oHh6WBTfTMA2fMLMjMCrRiZs=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1794/discord_modules/1/full.distro",
         "version": 1
       },
       "discord_rpc": {
-        "hash": "sha256-XxkRTULSxx7o8PNwCtz4FeZ9vowa8EHr7DNryvG/vMk=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1766/discord_rpc/1/full.distro",
+        "hash": "sha256-uYcDMwefWLdUzCjpN6b0h5pN95UKZs6gwgwA3uiPmb4=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1794/discord_rpc/1/full.distro",
         "version": 1
       },
       "discord_spellcheck": {
-        "hash": "sha256-mFEZg/Z33mdj4dIwJNfj7pCj/xcLoCTch/t2pssl45c=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1766/discord_spellcheck/1/full.distro",
+        "hash": "sha256-xSOog8VBcJBhbfzWXUlMMHWYfQ+Mkx0O5/IGu72zTvY=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1794/discord_spellcheck/1/full.distro",
         "version": 1
       },
       "discord_sysimg": {
-        "hash": "sha256-O5XrO1uL6zNHbIh6XUXQP3e/ZcAd46Z4s26+ihzWfBU=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1766/discord_sysimg/1/full.distro",
+        "hash": "sha256-UTNNk4RY6fk9GnTxNyhBI3XLmA38oSsdKVpLl3VqtjU=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1794/discord_sysimg/1/full.distro",
         "version": 1
       },
       "discord_utils": {
-        "hash": "sha256-aN53SHC3x1YKzd3pmmQX7lWu6iVRC7kN9BxViPSSNV8=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1766/discord_utils/1/full.distro",
+        "hash": "sha256-CbAcjtjZdENZcjcrEOLP/SOdi9Yay4/J4re0UguvO40=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1794/discord_utils/1/full.distro",
         "version": 1
       },
       "discord_voice": {
-        "hash": "sha256-pbzNmysNg7tWzbpQSqGr8OBWdaGSR8/pi5A15y2oZno=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1766/discord_voice/1/full.distro",
+        "hash": "sha256-Ev6sh9hjfjdZ+5ZmXKW4QXFdGwQAozXP4/F6P6BYISI=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1794/discord_voice/1/full.distro",
         "version": 1
       },
       "discord_zstd": {
-        "hash": "sha256-E+ai701mLhnEdSAO+9dR0KEWZuVEJvCzmrRjPB0ST0I=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1766/discord_zstd/1/full.distro",
+        "hash": "sha256-1Sfz6Wymr9T3mIwdRb4e6KYNl/iI2eDoiK+DDsGUty8=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1794/discord_zstd/1/full.distro",
         "version": 1
       }
     },
-    "version": "1.0.1766"
+    "version": "1.0.1794"
   },
   "linux-development": {
     "distro": {
@@ -161,253 +156,253 @@
   },
   "linux-ptb": {
     "distro": {
-      "hash": "sha256-9eq0gqGesGYXCLsztSt9mf0laH/OuLhjCuOKRL8Xnp4=",
-      "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.211/full.distro"
+      "hash": "sha256-4LjSOiwKk82VvmxYEKGJnp0yz5pNbdJ3mDOgnK3+GCs=",
+      "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.212/full.distro"
     },
     "kind": "distro",
     "modules": {
       "discord_arborium": {
-        "hash": "sha256-w4mPCev2fCDBLeozW24Aps/m+5kWAyVtYD55868lQzA=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.211/discord_arborium/1/full.distro",
+        "hash": "sha256-1Oh0s1LoS/IqGUfP5ZLYdVGPXZVzK/hRNRa6qelYqFc=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.212/discord_arborium/1/full.distro",
         "version": 1
       },
       "discord_cloudsync": {
-        "hash": "sha256-BXIIi69tGkND16aykVut6cE8B/WiVe6/9mpPBBxVZ1s=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.211/discord_cloudsync/1/full.distro",
+        "hash": "sha256-Tv21h/Zx3cCz3JiCuM/NN8VwZti+KGTqscmDZRsGC2Y=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.212/discord_cloudsync/1/full.distro",
         "version": 1
       },
       "discord_desktop_core": {
-        "hash": "sha256-gB3j55jhG/qh13itZ79Oiio2Ys7i61k5d4NIj9+a4d8=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.211/discord_desktop_core/1/full.distro",
+        "hash": "sha256-bfZVCO3uEWlHJa5IhENPpArW1j75wICaRe7BS2FyDN0=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.212/discord_desktop_core/1/full.distro",
         "version": 1
       },
       "discord_dispatch": {
-        "hash": "sha256-OcokUI/f0Ra6JBC7xJ3+Icv0yyZlD7g1As7c718f3AY=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.211/discord_dispatch/1/full.distro",
+        "hash": "sha256-C/o9W9HQM27j7Yd9EL/gPqZ4Qwh1PnWeh1hfdwWwnQE=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.212/discord_dispatch/1/full.distro",
         "version": 1
       },
       "discord_erlpack": {
-        "hash": "sha256-z9pwZyP59qIDZeojVaNgJohsu4SNstQliXvuIJjTWU0=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.211/discord_erlpack/1/full.distro",
+        "hash": "sha256-tGXulf3fiJh/rYWAVkc3X0BEfYmJ7B+bpco1jdGshiM=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.212/discord_erlpack/1/full.distro",
         "version": 1
       },
       "discord_game_utils": {
-        "hash": "sha256-pBvHJOJ8LqV1yDY/AKhxl9+5CBuGDdZxNECQ+mzPPcA=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.211/discord_game_utils/1/full.distro",
+        "hash": "sha256-HteWjRWb7cGjTVx4KR9s6usA742cp09NbTeHF91tCys=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.212/discord_game_utils/1/full.distro",
         "version": 1
       },
       "discord_krisp": {
-        "hash": "sha256-302w/9D93ESPY3ij6vbOeig32nikoWDD8t8YoCPGWEc=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.211/discord_krisp/1/full.distro",
+        "hash": "sha256-ntr0p+Mjam+JDwFWTgrFhbmesXPg0CzkajBM/D4pZPw=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.212/discord_krisp/1/full.distro",
         "version": 1
       },
       "discord_modules": {
-        "hash": "sha256-zDsZa17X3GIIGeNG6JBuTTyXqtqD2NiZRrmcL67oSj4=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.211/discord_modules/1/full.distro",
+        "hash": "sha256-YC00gpi63MLWWQG52neNOcrE0CLmLPo1f2qtqOQyCNI=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.212/discord_modules/1/full.distro",
         "version": 1
       },
       "discord_rpc": {
-        "hash": "sha256-ndZwouBJpQHNDIWfuC/xvM2+fIIwrUutLAQwj+fNyXY=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.211/discord_rpc/1/full.distro",
+        "hash": "sha256-+e6mv8np0+rcHbql4cBW2gymQPAceLC+1EX/fHOWf0k=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.212/discord_rpc/1/full.distro",
         "version": 1
       },
       "discord_spellcheck": {
-        "hash": "sha256-se40Ubw07Fwg7VBIkvgfIzBIbpdWyOEAHHk+SrAk9Dk=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.211/discord_spellcheck/1/full.distro",
+        "hash": "sha256-KxWS1m9gD5+hZHqbLmjZV8nmvRJflVITugyvj14aZjM=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.212/discord_spellcheck/1/full.distro",
         "version": 1
       },
       "discord_sysimg": {
-        "hash": "sha256-kbJsxsqrjoVajWCUDAywNQlEVHQ6Iyl6FjltvGenAPg=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.211/discord_sysimg/1/full.distro",
+        "hash": "sha256-g8mckNZNTCZDD8m1WnWx3vtsqZ1B/Ou0qGMf5F0bgX8=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.212/discord_sysimg/1/full.distro",
         "version": 1
       },
       "discord_utils": {
-        "hash": "sha256-l32yxA7h01KsBvc5wambNoyxiACacprLdJXnM5c0bxU=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.211/discord_utils/1/full.distro",
+        "hash": "sha256-/OKjhFGVQ/U3O/YvNkc+xrPNJGBAkmctgUjLiK2cOcY=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.212/discord_utils/1/full.distro",
         "version": 1
       },
       "discord_voice": {
-        "hash": "sha256-vuX/J5+Br2lC+rsEnAWlrYivkAF7HKb3FG+xBO3HxOI=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.211/discord_voice/1/full.distro",
+        "hash": "sha256-EgEXB1pXz5RTXtUPNwkDfuSP001luOYqFIH/TiIWGB4=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.212/discord_voice/1/full.distro",
         "version": 1
       },
       "discord_zstd": {
-        "hash": "sha256-ZZ1cKzbxPKyu7Ku+T6iQ9Qrs9tFA++Yebpu02v9IkMg=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.211/discord_zstd/1/full.distro",
+        "hash": "sha256-ivgN/iLzXIXdV0KTzZMakkgWj7mDvlAZ06RjLWvB1qQ=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.212/discord_zstd/1/full.distro",
         "version": 1
       }
     },
-    "version": "1.0.211"
+    "version": "1.0.212"
   },
   "linux-stable": {
     "distro": {
-      "hash": "sha256-8gWwie6ns9oLR+YcN5Yo0Ml9cozrM6Ybg7IXg3hEir0=",
-      "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.155/full.distro"
+      "hash": "sha256-vvQ7e7rsk85mPCbNeb00d3OCUWUzUkFNYVctPYvBGRE=",
+      "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.156/full.distro"
     },
     "kind": "distro",
     "modules": {
       "discord_arborium": {
-        "hash": "sha256-W0u/dID213JCOtMxvINaGPRXRMfOkbqWxw2LYJM03N4=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.155/discord_arborium/1/full.distro",
+        "hash": "sha256-JUA2EDfYcRaVnU4zzhOKZ8Q0X8YafPhKJcUd0J+MztU=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.156/discord_arborium/1/full.distro",
         "version": 1
       },
       "discord_cloudsync": {
-        "hash": "sha256-kCFreXY3IBuMZ7FtqVSv4IAMzQYBNV4qplQZx9PlQlU=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.155/discord_cloudsync/1/full.distro",
+        "hash": "sha256-J+lGNUKZJ+DtbQ8pXLUuw07T6MH7fyzblKr6fQ9bb2s=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.156/discord_cloudsync/1/full.distro",
         "version": 1
       },
       "discord_desktop_core": {
-        "hash": "sha256-s7WzMCq0J6XacDErIvMfmIlt9McK00dNshz+w7VJ0wo=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.155/discord_desktop_core/1/full.distro",
+        "hash": "sha256-21p4kuV4dJUvxNVWgYsVIxkyYohak7NxgscIYdlD0a0=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.156/discord_desktop_core/1/full.distro",
         "version": 1
       },
       "discord_dispatch": {
-        "hash": "sha256-PHjwOQ71MsbPTDSGGljPd9m4D471ImQp3a8obW7lod8=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.155/discord_dispatch/1/full.distro",
+        "hash": "sha256-P5FQFCzWsgrDNu7OoyI1mjStfBP5nM6C45fu42MoYv4=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.156/discord_dispatch/1/full.distro",
         "version": 1
       },
       "discord_erlpack": {
-        "hash": "sha256-vtd9yB9mK6twH74dgC7NuT2rVCr5ucjSv+11yCOF0Gs=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.155/discord_erlpack/1/full.distro",
+        "hash": "sha256-nfgYCt0rHjlZUedu40sRThxp1TEdfB+9TXz31RFZ60k=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.156/discord_erlpack/1/full.distro",
         "version": 1
       },
       "discord_game_utils": {
-        "hash": "sha256-H3FM1Ml97v9MkGVCgYUW+mz2JOd9CZP/Dgzvu2rGOuE=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.155/discord_game_utils/1/full.distro",
+        "hash": "sha256-gAB1QY8QjHl6xogqQr1uxgYuuywQV+VcqMB5cAC0vNc=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.156/discord_game_utils/1/full.distro",
         "version": 1
       },
       "discord_krisp": {
-        "hash": "sha256-lCOK9yjqa1yLcSOdhILgW/kr1ZJjqxAdbo93/FnyNnk=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.155/discord_krisp/1/full.distro",
+        "hash": "sha256-bmMDt2FshcCZA3eDZ+uVmxzCqgkTI81Zc6Wrrw3ZK/0=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.156/discord_krisp/1/full.distro",
         "version": 1
       },
       "discord_modules": {
-        "hash": "sha256-OC2VIUOXaiGcoqV8NOzW55z3DpRpdqfTBdni3wNyvlA=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.155/discord_modules/1/full.distro",
+        "hash": "sha256-YVhJEFMOo8AmGFpET5sdTdLiRLO407t5Z6KCixKEjGk=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.156/discord_modules/1/full.distro",
         "version": 1
       },
       "discord_rpc": {
-        "hash": "sha256-GS/nOO/ec43OgYN744Gao4IHYWBPpznA1stk/BmPEqQ=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.155/discord_rpc/1/full.distro",
+        "hash": "sha256-Av9sjzLybZV9OD5WEteV0sHRDzNp8LiBUOb1V63oZv8=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.156/discord_rpc/1/full.distro",
         "version": 1
       },
       "discord_spellcheck": {
-        "hash": "sha256-oBGlUOrQ2/cW5EbTcTe31wvfm5V14gyBoStucMXDJqU=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.155/discord_spellcheck/1/full.distro",
-        "version": 1
-      },
-      "discord_utils": {
-        "hash": "sha256-BOb01yg0+O3/k5CX0TKVaz8598HqcQp09R4vA60e87s=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.155/discord_utils/1/full.distro",
-        "version": 1
-      },
-      "discord_voice": {
-        "hash": "sha256-ib2a5g6Pr6YR+RUWYm4u929yTgWUMtMaETwMNaEal7M=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.155/discord_voice/1/full.distro",
-        "version": 1
-      },
-      "discord_zstd": {
-        "hash": "sha256-QNYSCSoJJVKeV3w+AS6AbaVcTnIs6gMX1nek0tn/eoA=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.155/discord_zstd/1/full.distro",
-        "version": 1
-      }
-    },
-    "version": "1.0.155"
-  },
-  "osx-canary": {
-    "distro": {
-      "hash": "sha256-g2G2hLwYUiQBDHUiWKGH7BK153qnRZvySwzktOio8SI=",
-      "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1294/full.distro"
-    },
-    "kind": "distro",
-    "modules": {
-      "discord_arborium": {
-        "hash": "sha256-KNEcVAc7z4n9yPSi3LT+sZe3iq4J7QtH66OAJ473nqM=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1294/discord_arborium/1/full.distro",
-        "version": 1
-      },
-      "discord_cloudsync": {
-        "hash": "sha256-0iKZk1fyyN5te8AUaC3H1gsOr/BGxhMwionpCgkna4A=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1294/discord_cloudsync/1/full.distro",
-        "version": 1
-      },
-      "discord_desktop_core": {
-        "hash": "sha256-K4O77jQCWBh2nYjFhwlJCHzxmmuadouv3pqLN0q8c9s=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1294/discord_desktop_core/1/full.distro",
-        "version": 1
-      },
-      "discord_dispatch": {
-        "hash": "sha256-6T4HWFZpkGQcpwfVWMaw4sTpibG4wo1HLk8ZcmtBfvM=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1294/discord_dispatch/1/full.distro",
-        "version": 1
-      },
-      "discord_erlpack": {
-        "hash": "sha256-MNX10Hk1nzEq000t15Msg8hzmGCkby7z/I6b9LuR5Sk=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1294/discord_erlpack/1/full.distro",
-        "version": 1
-      },
-      "discord_game_utils": {
-        "hash": "sha256-6znm3uE1Fl7ItuT/1OVRxP21kSYaDXkTIl1SNadWSSQ=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1294/discord_game_utils/1/full.distro",
-        "version": 1
-      },
-      "discord_intents": {
-        "hash": "sha256-titG9Z0eXKm2QnWm1xdPljUF7s3VBwM3kZN0Mwc730E=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1294/discord_intents/1/full.distro",
-        "version": 1
-      },
-      "discord_krisp": {
-        "hash": "sha256-9v2+nnjkQeI7RLt2+Q05zfGaKvchoCxRFciJFT5VrDc=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1294/discord_krisp/1/full.distro",
-        "version": 1
-      },
-      "discord_modules": {
-        "hash": "sha256-LAc5uFvYdg5ruzmd2Msh3c7eegChFoIBXj8X7JYJVqs=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1294/discord_modules/1/full.distro",
-        "version": 1
-      },
-      "discord_notifications": {
-        "hash": "sha256-mxQb3Em0wDma8EXTN4cULjvW31JwVxDzQ3ne9FcKbC4=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1294/discord_notifications/1/full.distro",
-        "version": 1
-      },
-      "discord_rpc": {
-        "hash": "sha256-DXSY6qhtxW0S3rE9w5/KO85bsU7JP2ldx5tOoTwoptM=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1294/discord_rpc/1/full.distro",
-        "version": 1
-      },
-      "discord_spellcheck": {
-        "hash": "sha256-X5BitbmM9HnEex2DsRN3t56tLBRtkyeeY7rZ9QgoNdU=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1294/discord_spellcheck/1/full.distro",
+        "hash": "sha256-O0p451X8HYslCd9QWJ/SbjQ+tIs3otCfxzBPmZjM6LI=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.156/discord_spellcheck/1/full.distro",
         "version": 1
       },
       "discord_sysimg": {
-        "hash": "sha256-SHpivOq+XZeEiU9EAfD2YMeIo10DvWDmzU0C0cm3wuQ=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1294/discord_sysimg/1/full.distro",
+        "hash": "sha256-9HxsiEhAPIpTRPoYYvsyakWJT6GaT+3/L1dvtxNZNhA=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.156/discord_sysimg/1/full.distro",
         "version": 1
       },
       "discord_utils": {
-        "hash": "sha256-MVLPSCP3AxDs3DNFuwyYjlZHyA4cVErANFCMTzorGWk=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1294/discord_utils/3/full.distro",
-        "version": 3
+        "hash": "sha256-qsB1dfte6qoD+nT0rZ+mJnn6L0p6OSeGVMWQobc9WM4=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.156/discord_utils/1/full.distro",
+        "version": 1
       },
       "discord_voice": {
-        "hash": "sha256-mfoo7ZBsU/fRkHGxKk0j/i0qj2PnBnzdTSt8pI0t53s=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1294/discord_voice/2/full.distro",
-        "version": 2
-      },
-      "discord_webauthn": {
-        "hash": "sha256-kCeElNUwLB1yFrHTqP6W+S6/F5npRiYo5uH6M31uNxo=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1294/discord_webauthn/1/full.distro",
+        "hash": "sha256-icxv/ISGtR5d7ZdQaFzrspulK8KRYZfMzxzatX7/xhI=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.156/discord_voice/1/full.distro",
         "version": 1
       },
       "discord_zstd": {
-        "hash": "sha256-15edfIf+s9zPaYWYw7SPsUGXXFJK9LMGK6LzaDvSiyE=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1294/discord_zstd/1/full.distro",
+        "hash": "sha256-tndzE1U8DA+K4XGbX9jII7zrSiybG1qAqSzCwypSYYo=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.156/discord_zstd/1/full.distro",
         "version": 1
       }
     },
-    "version": "0.0.1294"
+    "version": "1.0.156"
+  },
+  "osx-canary": {
+    "distro": {
+      "hash": "sha256-SjRGJwvd+IOkCqrG6akvvlFFpDV4gQozf4mPinKrZQE=",
+      "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1306/full.distro"
+    },
+    "kind": "distro",
+    "modules": {
+      "discord_cloudsync": {
+        "hash": "sha256-uynrrQxSvQjnGsS2V+CpiRfBCpNzAVgo94nySxMWrGw=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1306/discord_cloudsync/1/full.distro",
+        "version": 1
+      },
+      "discord_desktop_core": {
+        "hash": "sha256-7tAXBdi+OXZaXl8+camk2IHEwzqrUpHjcc8QYI3oals=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1306/discord_desktop_core/1/full.distro",
+        "version": 1
+      },
+      "discord_dispatch": {
+        "hash": "sha256-Kd3fZYacc9H2MfOfHIgdDu56HCeRYF60dG6234Uin2c=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1306/discord_dispatch/1/full.distro",
+        "version": 1
+      },
+      "discord_erlpack": {
+        "hash": "sha256-/JAAcJ/bDJaUllVn+0aAErWysh//dSPrT64uGe5THVU=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1306/discord_erlpack/1/full.distro",
+        "version": 1
+      },
+      "discord_game_utils": {
+        "hash": "sha256-4x+ZNH831aCeuNVK2RLiAfaYolFcPSXFcnk/Y/19/Nc=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1306/discord_game_utils/1/full.distro",
+        "version": 1
+      },
+      "discord_intents": {
+        "hash": "sha256-1RzkNxAlvdLr7vpW2sIj+dE/6gkauXbgmyU6ZfROxvk=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1306/discord_intents/1/full.distro",
+        "version": 1
+      },
+      "discord_krisp": {
+        "hash": "sha256-WY5x578AvlwSUC/tV0j+SZItOCiHqzNZDfV4TfK52XM=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1306/discord_krisp/1/full.distro",
+        "version": 1
+      },
+      "discord_modules": {
+        "hash": "sha256-tOTaUzDS5EEJpxCT+2eMaELyqrpBpyg4VVAR2qoKpqs=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1306/discord_modules/1/full.distro",
+        "version": 1
+      },
+      "discord_notifications": {
+        "hash": "sha256-wgywWGbwb4ZOxAbvP1zwGmXYY7YcWVZZ/3oHPTi6+ns=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1306/discord_notifications/1/full.distro",
+        "version": 1
+      },
+      "discord_rpc": {
+        "hash": "sha256-76+PQX58ftimpJWWaasvVUz5csbR+mKL0DTcUYAYuHs=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1306/discord_rpc/1/full.distro",
+        "version": 1
+      },
+      "discord_spellcheck": {
+        "hash": "sha256-An1SBmKEPI8pRip6g/YZW6dGsLpx0TIvS+QCkI1YnWs=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1306/discord_spellcheck/1/full.distro",
+        "version": 1
+      },
+      "discord_sysimg": {
+        "hash": "sha256-9MJv02Fk+ega0kbbLL7/s420Mx149sJFWvkkU66yJuY=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1306/discord_sysimg/1/full.distro",
+        "version": 1
+      },
+      "discord_utils": {
+        "hash": "sha256-ptioApBU8h3ryIan7db5A77Tf87MTqRRNSVZhiUeUcA=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1306/discord_utils/1/full.distro",
+        "version": 1
+      },
+      "discord_voice": {
+        "hash": "sha256-pVs09tpg7jTKfm54N1uaRf731Du9vpB7q8UFUHorpWU=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1306/discord_voice/1/full.distro",
+        "version": 1
+      },
+      "discord_webauthn": {
+        "hash": "sha256-op6K8vlmdjXxsZ2+23CSuZGmdvS7tb7gCq5eRrD1r6g=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1306/discord_webauthn/1/full.distro",
+        "version": 1
+      },
+      "discord_zstd": {
+        "hash": "sha256-bibBKtu5xxBdtk5lfJAMtrjVMz/YMjzFTjHu2xoTNSc=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1306/discord_zstd/1/full.distro",
+        "version": 1
+      }
+    },
+    "version": "0.0.1306"
   },
   "osx-development": {
     "distro": {
@@ -506,187 +501,192 @@
   },
   "osx-ptb": {
     "distro": {
-      "hash": "sha256-mTArbvIvLjOSGpb35GO17K8lnCqAHd6fDdxpzwFKmg4=",
-      "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.256/full.distro"
+      "hash": "sha256-0itWlg4uO9n251oeACGHfgId6sV9WwWXib+xTpLlKdg=",
+      "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.257/full.distro"
     },
     "kind": "distro",
     "modules": {
       "discord_arborium": {
-        "hash": "sha256-eySEVa1AmxNMG8P1cqxLFftrQjyzWrN8QInF8rUh53Q=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.256/discord_arborium/1/full.distro",
+        "hash": "sha256-nxM1iYpiUhF5out+DCCJGaiPr/WuQDYXxHHnOVG542U=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.257/discord_arborium/1/full.distro",
         "version": 1
       },
       "discord_cloudsync": {
-        "hash": "sha256-7/60p+KD/WIxA0ErfHUrSPXGxVTmyNiC9Kcu6WUAPsQ=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.256/discord_cloudsync/1/full.distro",
+        "hash": "sha256-+XUuoUmKHd0paaXCm64M/6GbI6oox3auQrHo2QB7IqY=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.257/discord_cloudsync/1/full.distro",
         "version": 1
       },
       "discord_desktop_core": {
-        "hash": "sha256-xtxh0mvHKtAtohJptt/89DhEVpC1UbWloVnhvK3kmO4=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.256/discord_desktop_core/1/full.distro",
+        "hash": "sha256-+n+arWUqZyDX9pTRYd90uuo//JXqMo6L3mIymSkrUTY=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.257/discord_desktop_core/1/full.distro",
         "version": 1
       },
       "discord_dispatch": {
-        "hash": "sha256-wi67HEYdj+bL+Zs+PrNkaMSfzjyGR0eMi0smyyvJoig=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.256/discord_dispatch/1/full.distro",
+        "hash": "sha256-7nuF4fhgJx0B7s73dnGddPr1gLpnaVksRYpKQmqf5Qk=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.257/discord_dispatch/1/full.distro",
         "version": 1
       },
       "discord_erlpack": {
-        "hash": "sha256-rhf2TnRJaz3uqFq2tu8JCIbUFdBHJFQWupn2BvreeiM=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.256/discord_erlpack/1/full.distro",
+        "hash": "sha256-YP5XoJ4gdPJwRVP9Poj0G+Rv+ZrWE1O8TQ211LfD6tI=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.257/discord_erlpack/1/full.distro",
         "version": 1
       },
       "discord_game_utils": {
-        "hash": "sha256-3GlzC6GHnC+hb6YMWNcA9ly7g8vKMuMf48Xv04tpMMw=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.256/discord_game_utils/1/full.distro",
+        "hash": "sha256-QOggWiTw6TK9mj7mnn5EvoI6Ai/QuF6R6c16vJQQwMA=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.257/discord_game_utils/1/full.distro",
         "version": 1
       },
       "discord_intents": {
-        "hash": "sha256-6cDb4uNVlpVTiqww03+74raqkOAbWgI0jS5xG0lgO0g=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.256/discord_intents/1/full.distro",
+        "hash": "sha256-n+LHKnwc/eDih0rCT11BCMNMG0Nb9LluIxkZ/qdLxYs=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.257/discord_intents/1/full.distro",
         "version": 1
       },
       "discord_krisp": {
-        "hash": "sha256-jx0nK45QkHhkl9DMB81qwJw6GceFu8KPBcQVMvJKRXI=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.256/discord_krisp/1/full.distro",
+        "hash": "sha256-hnPCYcyTRyXrq/HaQn7HoFlKF13VSvSwTRn3lrzYAxw=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.257/discord_krisp/1/full.distro",
         "version": 1
       },
       "discord_modules": {
-        "hash": "sha256-kELcckM97k084WfqVyFaJb9Nmdp1UOsXvL8vfeyzDck=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.256/discord_modules/1/full.distro",
+        "hash": "sha256-l5X0AeddEKdXzc8z3SkiIEeu0aF9pz7SlRN2+jgvJsQ=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.257/discord_modules/1/full.distro",
         "version": 1
       },
       "discord_notifications": {
-        "hash": "sha256-lVlDGN+qYKOPKUgHZ20b5b36T0GNj2KyHzRQZclJ6w8=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.256/discord_notifications/1/full.distro",
+        "hash": "sha256-1Hl6kvliMkmATrqPLUazkTkVhjXxuYufjV/wbg8WMsM=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.257/discord_notifications/1/full.distro",
         "version": 1
       },
       "discord_rpc": {
-        "hash": "sha256-gwqGxzJPCBIoYTftUIUiTi7D1qtsdxDJgCIqM8MRifo=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.256/discord_rpc/1/full.distro",
+        "hash": "sha256-pZtk1ilJRl6/UnKV70ON4X1gEewdwUHN8l0VjiGb1QU=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.257/discord_rpc/1/full.distro",
         "version": 1
       },
       "discord_spellcheck": {
-        "hash": "sha256-SeglC/2Wp8DdSt7EAdxdEB4kfx7pAZdelv7OQYb0fz4=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.256/discord_spellcheck/1/full.distro",
+        "hash": "sha256-wPa9fIcrPk1yln0/dbhdJzJO93Y7G9x+L61mpGmu9Uk=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.257/discord_spellcheck/1/full.distro",
         "version": 1
       },
       "discord_sysimg": {
-        "hash": "sha256-PDaNTbEZxg4W8HteDJ1QSgUcpizvnRRLGkYp3YNiSkY=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.256/discord_sysimg/1/full.distro",
+        "hash": "sha256-at2pxdYqY4h7I0vmmpJN+nuSi3b85qZvngfYVwjD7q0=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.257/discord_sysimg/1/full.distro",
         "version": 1
       },
       "discord_utils": {
-        "hash": "sha256-zGNUOs+uWSAgAht56Oe6y5xgEhtaSKOLwVmNC0L6t6Y=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.256/discord_utils/1/full.distro",
+        "hash": "sha256-83pMGx2wlw5gCqcZPKwqUqztF6EnJzHSNExi/LaUsn0=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.257/discord_utils/1/full.distro",
         "version": 1
       },
       "discord_voice": {
-        "hash": "sha256-pF3ki+YCVyrD/dL9aPCgylc7gs21MppkZOHROEiDm+w=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.256/discord_voice/1/full.distro",
+        "hash": "sha256-bR4oAeMkBEi4miW27/I6YD7wjcQWOaLZJMsEcA5GttM=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.257/discord_voice/1/full.distro",
         "version": 1
       },
       "discord_webauthn": {
-        "hash": "sha256-z+rVhzu+CL8nu9FfyQESkDbJBWVGHz03j/EGBc1f1vI=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.256/discord_webauthn/1/full.distro",
+        "hash": "sha256-JAhcJogkRO6w5lgDau3lQs7R9yvuw2J3e5yNeZkeOCc=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.257/discord_webauthn/1/full.distro",
         "version": 1
       },
       "discord_zstd": {
-        "hash": "sha256-5cNp0u8jlQYI9LBIbi3pmL7jm43tgD3EVq3bamPZSxE=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.256/discord_zstd/1/full.distro",
+        "hash": "sha256-YuztgnEkhGX5bUhqRTt4CNj3Cr/TKWFs9GFrnLHccXs=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.257/discord_zstd/1/full.distro",
         "version": 1
       }
     },
-    "version": "0.0.256"
+    "version": "0.0.257"
   },
   "osx-stable": {
     "distro": {
-      "hash": "sha256-KfWALYNAd/FX+LQRMIyCt69MY6J5jRS7gFg4jCl4fSY=",
-      "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.409/full.distro"
+      "hash": "sha256-J2gIsqC0Kzn+G9FaLqkO5xCr4g5VhIyydPHRKt13eMk=",
+      "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.410/full.distro"
     },
     "kind": "distro",
     "modules": {
       "discord_arborium": {
-        "hash": "sha256-53S9PggFNCKdfQ0sYl6Mn5R5Kngg2/T6eElq9C+DN08=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.409/discord_arborium/1/full.distro",
+        "hash": "sha256-1qA8sYKihOt3wymjEVgRTPhX2jSVtthc8KX4w54t+qE=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.410/discord_arborium/1/full.distro",
         "version": 1
       },
       "discord_cloudsync": {
-        "hash": "sha256-/ySgAAJ0n2TWB/wbvB7OihFxRrC7NyTjQ1H4TqvWZ84=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.409/discord_cloudsync/1/full.distro",
+        "hash": "sha256-VH8rFK6asP+2lGPiC4NbNY4t20dx7qwGmlp7Mj8iVTE=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.410/discord_cloudsync/1/full.distro",
         "version": 1
       },
       "discord_desktop_core": {
-        "hash": "sha256-szNLjknsUqkkxLPpyJjEfxT46AUjM4g+DTMoPgrxBm0=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.409/discord_desktop_core/1/full.distro",
+        "hash": "sha256-ZJKB5FeNJ7Z9+tuSxK9zcFG4826VFUMTrT6XHFi36YM=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.410/discord_desktop_core/1/full.distro",
         "version": 1
       },
       "discord_dispatch": {
-        "hash": "sha256-UoWIZ1Uc0Q6YXSTzulJSWNjgdRyTiX54R05UTh8fTiE=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.409/discord_dispatch/1/full.distro",
+        "hash": "sha256-D7R3j/sZpwel0WBwshGHqM/HMIWwA1vW2gxUCDpUZKU=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.410/discord_dispatch/1/full.distro",
         "version": 1
       },
       "discord_erlpack": {
-        "hash": "sha256-xlWB+o/sjHFLZVMFke9RCQt65lBVn/pUT8jNUUkfSyI=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.409/discord_erlpack/1/full.distro",
+        "hash": "sha256-kSKDbwiqhXVcGWtOqW184yO6uKeACyCAxgEKTOoqGOI=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.410/discord_erlpack/1/full.distro",
         "version": 1
       },
       "discord_game_utils": {
-        "hash": "sha256-Hqs0td1l6gWvdNcn0WA/DfADlZq+OT0+HlgUXiyvwEk=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.409/discord_game_utils/1/full.distro",
+        "hash": "sha256-jz65aXMzEct+HT1Shs1ziyaksbFIWyAY8YjWZTvt6jI=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.410/discord_game_utils/1/full.distro",
         "version": 1
       },
       "discord_intents": {
-        "hash": "sha256-jKNBNIlXutv2ex6MuO8kmwkx7kcQ2uaIt0f/ogw4Vws=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.409/discord_intents/1/full.distro",
+        "hash": "sha256-nU9TvJqrH6+ROZsF3WD+L/ZvuIqIuGbfejQe0C0XypY=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.410/discord_intents/1/full.distro",
         "version": 1
       },
       "discord_krisp": {
-        "hash": "sha256-7OizZzIYAlP4CmZ1kcpFc52ijT6abHYJ4KvQAhaG/J0=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.409/discord_krisp/1/full.distro",
+        "hash": "sha256-Jm1/RTUsXrvwntxWZKblkRzlwsVGVegzo9uqyjBH98Q=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.410/discord_krisp/1/full.distro",
         "version": 1
       },
       "discord_modules": {
-        "hash": "sha256-l3obGjd4nK7DQtwoml6PvzmQnYaRu36xAEUjd0TKmIs=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.409/discord_modules/1/full.distro",
+        "hash": "sha256-7Nsbay4MP424IAtpQCcgEmSeSxVphOFUJuY/Dytb1LY=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.410/discord_modules/1/full.distro",
         "version": 1
       },
       "discord_notifications": {
-        "hash": "sha256-8XfxczmmMq5w4HRLQnCjxjFV0fQgDwaEkcezXGd7gNU=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.409/discord_notifications/1/full.distro",
+        "hash": "sha256-4m4DjudjLxua1KUwjKN+DouU8JYxsa7wvTvbCTEkzKU=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.410/discord_notifications/1/full.distro",
         "version": 1
       },
       "discord_rpc": {
-        "hash": "sha256-1n+gO1c4SZrV2jOD2SVMCQYnHU8e5ErrB0eJEv8hvus=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.409/discord_rpc/1/full.distro",
+        "hash": "sha256-kv8Qh9F3PmCru7DKmvsJiq+4/LoYAOtpiE9SCpPBMbc=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.410/discord_rpc/1/full.distro",
         "version": 1
       },
       "discord_spellcheck": {
-        "hash": "sha256-QPZOJTNAU5rShPeV4SU2P9eBmDEbLZHEwThyXdRPsLg=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.409/discord_spellcheck/1/full.distro",
+        "hash": "sha256-dzieOT9NurZjWKaetEY5Z1DWXe/Axq7eLtPNyT3ATbk=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.410/discord_spellcheck/1/full.distro",
+        "version": 1
+      },
+      "discord_sysimg": {
+        "hash": "sha256-ruKew+1lZZO9FpvVkJp2U/X4/l5EaTAjuQqZZP+u2wU=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.410/discord_sysimg/1/full.distro",
         "version": 1
       },
       "discord_utils": {
-        "hash": "sha256-PMv/psANJnI+yhGwsibWDdLGdlUQC8/Rh0h5nmNQfJY=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.409/discord_utils/1/full.distro",
+        "hash": "sha256-M6Hd5ehiB7j/VLRRzP/UoO5AK7UdCO8iWdlM+5cps3E=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.410/discord_utils/1/full.distro",
         "version": 1
       },
       "discord_voice": {
-        "hash": "sha256-GtnSgoFM1aGBLLLwaB/81iRhuQvuuNuvNehO3k/UP7c=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.409/discord_voice/1/full.distro",
+        "hash": "sha256-eHBSpQfP+oDcbctuDhPeNkAT75bfk+IVhe212D2jCTI=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.410/discord_voice/1/full.distro",
         "version": 1
       },
       "discord_webauthn": {
-        "hash": "sha256-r0WinKYXuJtY0YWn2GHoFrUID1mwBGRMVVJOMLFGSOs=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.409/discord_webauthn/1/full.distro",
+        "hash": "sha256-Wlqq/elXIb8m8mZF3P6xWG1mViqrUieBmd83mS9V7Rg=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.410/discord_webauthn/1/full.distro",
         "version": 1
       },
       "discord_zstd": {
-        "hash": "sha256-pBA8Iyv1S7wePlvdNI4lj4MfY2Z8MPtiVaf6EBi8rY0=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.409/discord_zstd/1/full.distro",
+        "hash": "sha256-+OkUUomOUW6uj1/6cMZmi6dmEkR4HPDkjm1dJ5gSnTY=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.410/discord_zstd/1/full.distro",
         "version": 1
       }
     },
-    "version": "0.0.409"
+    "version": "0.0.410"
   }
 }
diff --git a/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/tg_owt.nix b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/tg_owt.nix
index 73038a5e3242..48752b669300 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/tg_owt.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/tg_owt.nix
@@ -33,13 +33,13 @@
 
 stdenv.mkDerivation {
   pname = "tg_owt";
-  version = "0-unstable-2026-04-09";
+  version = "0-unstable-2026-08-03";
 
   src = fetchFromGitHub {
     owner = "desktop-app";
     repo = "tg_owt";
-    rev = "89df288dd6ba5b2ec95b3c5eaf1e7e0c3a870fc4";
-    hash = "sha256-wdO3AACCEN3IDYWt5a+f7zrcPFoqz+c7vLpo6LZk29w=";
+    rev = "19d51d3c19632a63fdbe17c62f10332d978cb940";
+    hash = "sha256-Cb1XWnryZEKTyvhBeOsYX5KZG88zUOAlSRhfyIh06g4=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/unwrapped.nix b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/unwrapped.nix
index e744ee618380..55d16f978c84 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/unwrapped.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/unwrapped.nix
@@ -16,7 +16,7 @@
   kcoreaddons,
   lz4,
   xxhash,
-  ffmpeg_6,
+  ffmpeg,
   protobuf,
   openal-soft,
   minizip-ng-compat,
@@ -29,6 +29,7 @@
   boost,
   ada,
   cmark-gfm,
+  libfido2,
   libavif,
   libheif,
   libjxl,
@@ -46,14 +47,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "telegram-desktop-unwrapped";
-  version = "7.0.2";
+  version = "7.0.9";
 
   src = fetchFromGitHub {
     owner = "telegramdesktop";
     repo = "tdesktop";
     rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-G/A5J2m1sXHD50zDmMD9ehnorAGRjnQ+YGMv6DEiJcQ=";
+    hash = "sha256-zpGfubIZtTmLjAgxYGcMy2N3Xlf9NOppcxsMSUS/KEA=";
   };
 
   nativeBuildInputs = [
@@ -72,7 +73,7 @@ stdenv.mkDerivation (finalAttrs: {
     qtsvg
     lz4
     xxhash
-    ffmpeg_6
+    ffmpeg
     openal-soft
     minizip-ng-compat
     range-v3
@@ -83,6 +84,7 @@ stdenv.mkDerivation (finalAttrs: {
     boost
     ada
     cmark-gfm
+    libfido2
     (tdlib.override { tde2eOnly = true; })
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
diff --git a/pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix b/pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix
index 004c91f93cfc..a0403dccbbeb 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix
@@ -106,7 +106,7 @@ let
       gtk3
       ;
     binaryName = "thunderbird";
-    gssSupport = true;
+    withGSSAPI = true;
   };
 
 in
diff --git a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
index 27135e13e4f2..6f869185c2a9 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@@ -69,14 +69,14 @@ let
     }).override
       (
         {
-          geolocationSupport = false;
-          webrtcSupport = false;
+          enableLocation = false;
+          enableWebRTC = false;
 
-          pgoSupport = false; # console.warn: feeds: "downloadFeed: network connection unavailable"
+          enablePGO = false; # console.warn: feeds: "downloadFeed: network connection unavailable"
         }
         // lib.optionalAttrs (lib.versionAtLeast version "149") {
           # https://bugzilla.mozilla.org/show_bug.cgi?id=2025767
-          crashreporterSupport = false;
+          enableCrashReporter = false;
         }
       );
 
diff --git a/pkgs/build-support/build-mozilla-mach/default.nix b/pkgs/build-support/build-mozilla-mach/default.nix
index 1132b07930e3..57ea2447247c 100644
--- a/pkgs/build-support/build-mozilla-mach/default.nix
+++ b/pkgs/build-support/build-mozilla-mach/default.nix
@@ -8,8 +8,6 @@
   application ? "browser",
   applicationName ? "Firefox",
   branding ? null,
-  requireSigning ? true,
-  allowAddonSideload ? false,
   src,
   unpackPhase ? null,
   extraPatches ? [ ],
@@ -24,12 +22,8 @@
 }:
 
 let
-  # Rename the variables to prevent infinite recursion
-  requireSigningDefault = requireSigning;
-  allowAddonSideloadDefault = allowAddonSideload;
-
   # Specifying --(dis|en)able-elf-hack on a platform for which it's not implemented will give `--disable-elf-hack is not available in this configuration`
-  # This is declared here because it's used in the default value of elfhackSupport
+  # This is declared here because it's used in the default value of enableElfhack
   isElfhackPlatform =
     stdenv:
     stdenv.hostPlatform.isElf
@@ -50,11 +44,13 @@ in
 
   # build time
   autoconf,
+  buildPackages,
   cargo,
   dump_syms,
   makeBinaryWrapper,
   mimalloc,
   nodejs,
+  overrideCC,
   perl,
   pkg-config,
   pkgsCross, # wasm32 rlbox
@@ -115,80 +111,73 @@ in
   cups,
   rsync, # used when preparing .app directory
 
-  # optionals
-
-  ## addon signing/sideloading
-  requireSigning ? requireSigningDefault,
-  allowAddonSideload ? allowAddonSideloadDefault,
-
-  ## debugging
-
-  debugBuild ? false,
-
-  # On 32bit platforms, we disable adding "-g" for easier linking.
-  enableDebugSymbols ? !stdenv.hostPlatform.is32bit,
-
-  ## optional libraries
-
-  alsaSupport ? stdenv.hostPlatform.isLinux,
+  # optional dependencies
+  withALSA ? stdenv.hostPlatform.isLinux,
   alsa-lib,
-  ffmpegSupport ? true,
-  gssSupport ? true,
+  withFFmpeg ? true,
+  withGSSAPI ? true,
   libkrb5,
-  jackSupport ? stdenv.hostPlatform.isLinux,
+  withJACK ? stdenv.hostPlatform.isLinux,
   libjack2,
-  jemallocSupport ? !stdenv.hostPlatform.isMusl,
+  withJemalloc ? !stdenv.hostPlatform.isMusl,
   jemalloc,
-  ltoSupport ? (
+  withPipewire ? withWayland && enableWebRTC,
+  withPulseaudio ? stdenv.hostPlatform.isLinux,
+  libpulseaudio,
+  withSndio ? stdenv.hostPlatform.isLinux,
+  sndio,
+  withWayland ? !stdenv.hostPlatform.isDarwin,
+  libxkbcommon,
+  libdrm,
+
+  # Build configuration
+
+  ## Addon signing/sideloading
+  enableAddonSigning ? true,
+  enableAddonSideload ? false,
+
+  ## Optimizations
+  enableElfhack ?
+    isElfhackPlatform stdenv && !(stdenv.hostPlatform.isMusl && stdenv.hostPlatform.isAarch64),
+  enableLTO ? (
     (stdenv.hostPlatform.isLinux || stdenv.hostPlatform.isDarwin)
     && stdenv.hostPlatform.is64bit
     && !stdenv.hostPlatform.isRiscV
   ),
-  overrideCC,
-  buildPackages,
-  # PGO merges profile data with a 32-bit llvm-profdata, which runs out of
-  # address space on the huge libxul profile, so disable it on 32-bit.
-  pgoSupport ? (
+  enablePGO ? (
     stdenv.hostPlatform.isLinux
     && stdenv.hostPlatform == stdenv.buildPlatform
+    # PGO merges profile data with a 32-bit llvm-profdata, which runs out of
+    # address space on the huge libxul profile, so disable it on 32-bit.
     && stdenv.hostPlatform.is64bit
   ),
   xvfb-run,
-  elfhackSupport ?
-    isElfhackPlatform stdenv && !(stdenv.hostPlatform.isMusl && stdenv.hostPlatform.isAarch64),
-  pipewireSupport ? waylandSupport && webrtcSupport,
-  pulseaudioSupport ? stdenv.hostPlatform.isLinux,
-  libpulseaudio,
-  sndioSupport ? stdenv.hostPlatform.isLinux,
-  sndio,
-  waylandSupport ? !stdenv.hostPlatform.isDarwin,
-  libxkbcommon,
-  libdrm,
 
-  ## privacy-related options
+  ## Debugging
+  enableDebug ? false,
 
-  privacySupport ? false,
+  ## On 32bit platforms, we disable adding "-g" for easier linking.
+  enableDebugSymbols ? !stdenv.hostPlatform.is32bit,
 
-  # WARNING: NEVER set any of the options below to `true` by default.
-  # Set to `!privacySupport` or `false`.
+  ## Privacy knobs
+  enableDataReporting ? true,
+  enableLocation ? true,
+  enableWebRTC ? true,
+  enableNeckoWiFi ? enableLocation,
 
-  crashreporterSupport ?
-    !privacySupport
+  ## Crash reporting
+  ## https://crash-stats.mozilla.org/search/?distribution_id=%3Dnixos
+  enableCrashReporter ?
+    enableDataReporting
     && !stdenv.hostPlatform.isLoongArch64
     && !stdenv.hostPlatform.isRiscV
     && !stdenv.hostPlatform.isMusl,
   curl,
-  geolocationSupport ? !privacySupport,
-  webrtcSupport ? !privacySupport,
 
-  # digital rights management
-
-  # This flag controls whether Firefox will show the nagbar, that allows
-  # users at runtime the choice to enable Widevine CDM support when a site
-  # requests it.
-  # Controlling the nagbar and widevine CDM at runtime is possible by setting
-  # `browser.eme.ui.enabled` and `media.gmp-widevinecdm.enabled` accordingly
-  drmSupport ? true,
+  ## DRM / Encrypted Media Extensions
+  # Build time toggle to control whether the DRM nagbar will appear
+  # (browser.eme.ui.enabled), when sites require it to playback media.
+  enableEMENagbar ? true,
 
   # As stated by Sylvestre Ledru (@sylvestre) on Nov 22, 2017 at
   # https://github.com/NixOS/nixpkgs/issues/31843#issuecomment-346372756 we
@@ -213,10 +202,10 @@ in
 
 assert stdenv.cc.libc or null != null;
 assert
-  pipewireSupport
-  -> !waylandSupport || !webrtcSupport
-  -> throw "${pname}: pipewireSupport requires both wayland and webrtc support.";
-assert elfhackSupport -> isElfhackPlatform stdenv;
+  withPipewire
+  -> !withWayland || !enableWebRTC
+  -> throw "${pname}: Pipewire support depends on Wayland and WebRTC support.";
+assert enableElfhack -> isElfhackPlatform stdenv;
 
 let
   inherit (lib) enableFeature;
@@ -238,7 +227,7 @@ let
   # LTO requires LLVM bintools including ld.lld and llvm-ar.
   buildStdenv = overrideCC llvmPackages.stdenv (
     llvmPackages.stdenv.cc.override {
-      bintools = if ltoSupport then buildPackages.rustc.llvmPackages.bintools else stdenv.cc.bintools;
+      bintools = if enableLTO then buildPackages.rustc.llvmPackages.bintools else stdenv.cc.bintools;
     }
   );
 
@@ -273,7 +262,7 @@ let
     );
 
   defaultPrefs =
-    if geolocationSupport then
+    if enableLocation then
       {
         "geo.provider.network.url" = {
           value = "https://api.beacondb.net/v1/geolocate";
@@ -284,7 +273,7 @@ let
       {
         "geo.provider.use_geoclue" = {
           value = false;
-          reason = "Geolocation support has been disabled through the `geolocationSupport` package attribute.";
+          reason = "Geolocation support has been disabled through the `enableLocation` package attribute.";
         };
       };
 
@@ -301,7 +290,7 @@ let
     if stdenv.hostPlatform.isDarwin then
       "cairo-cocoa"
     else
-      "cairo-gtk3${lib.optionalString waylandSupport "-wayland"}";
+      "cairo-gtk3${lib.optionalString withWayland "-wayland"}";
 
 in
 
@@ -324,10 +313,10 @@ buildStdenv.mkDerivation {
   outputs = [
     "out"
   ]
-  ++ lib.optionals crashreporterSupport [ "symbols" ];
+  ++ lib.optionals enableCrashReporter [ "symbols" ];
 
   # Add another configure-build-profiling run before the final configure phase if we build with pgo
-  preConfigurePhases = lib.optionals pgoSupport [
+  preConfigurePhases = lib.optionals enablePGO [
     "configurePhase"
     "buildPhase"
     "profilingPhase"
@@ -393,11 +382,11 @@ buildStdenv.mkDerivation {
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [ rsync ]
   ++ lib.optionals stdenv.hostPlatform.isx86 [ nasm ]
-  ++ lib.optionals crashreporterSupport [
+  ++ lib.optionals enableCrashReporter [
     dump_syms
     patchelf
   ]
-  ++ lib.optionals pgoSupport [ xvfb-run ]
+  ++ lib.optionals enablePGO [ xvfb-run ]
   ++ extraNativeBuildInputs;
 
   setOutputFlags = false; # `./mach configure` doesn't understand `--*dir=` flags.
@@ -430,7 +419,7 @@ buildStdenv.mkDerivation {
     export WASM_CC=${pkgsCross.wasm32-wasip1.stdenv.cc}/bin/${pkgsCross.wasm32-wasip1.stdenv.cc.targetPrefix}cc
     export WASM_CXX=${pkgsCross.wasm32-wasip1.stdenv.cc}/bin/${pkgsCross.wasm32-wasip1.stdenv.cc.targetPrefix}c++
   ''
-  + lib.optionalString pgoSupport ''
+  + lib.optionalString enablePGO ''
     if [ -e "$TMPDIR/merged.profdata" ]; then
       echo "Configuring with profiling data"
       for i in "''${!configureFlagsArray[@]}"; do
@@ -464,7 +453,7 @@ buildStdenv.mkDerivation {
   + lib.optionalString (enableOfficialBranding && !stdenv.hostPlatform.is32bit) ''
     export MOZILLA_OFFICIAL=1
   ''
-  + lib.optionalString (!requireSigning) ''
+  + lib.optionalString (!enableAddonSigning) ''
     export MOZ_REQUIRE_SIGNING=
   ''
   + lib.optionalString stdenv.hostPlatform.isMusl ''
@@ -491,13 +480,13 @@ buildStdenv.mkDerivation {
     "--target=${buildStdenv.hostPlatform.config}"
   ]
   # LTO is done using clang and lld.
-  ++ lib.optionals ltoSupport [
+  ++ lib.optionals enableLTO [
     "--enable-lto=cross,full" # Cross-Language LTO
     "--enable-linker=lld"
   ]
-  ++ lib.optional (isElfhackPlatform stdenv) (enableFeature elfhackSupport "elf-hack")
-  ++ lib.optional (!drmSupport) "--disable-eme"
-  ++ lib.optional allowAddonSideload "--allow-addon-sideload"
+  ++ lib.optional (isElfhackPlatform stdenv) (enableFeature enableElfhack "elf-hack")
+  ++ lib.optional (!enableEMENagbar) "--disable-eme"
+  ++ lib.optional enableAddonSideload "--allow-addon-sideload"
   ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
     # MacOS builds use bundled versions of libraries: https://bugzilla.mozilla.org/show_bug.cgi?id=1776255
     "--enable-system-pixman"
@@ -514,27 +503,28 @@ buildStdenv.mkDerivation {
     "--with-system-zlib"
 
     # These options are not available on MacOS, even --disable-*
-    (enableFeature alsaSupport "alsa")
-    (enableFeature jackSupport "jack")
-    (enableFeature pulseaudioSupport "pulseaudio")
-    (enableFeature sndioSupport "sndio")
+    (enableFeature withALSA "alsa")
+    (enableFeature withJACK "jack")
+    (enableFeature withPulseaudio "pulseaudio")
+    (enableFeature withSndio "sndio")
   ]
   ++ lib.optionals (!buildStdenv.hostPlatform.isDarwin && lib.versionAtLeast version "141") [
     "--with-onnx-runtime=${lib.getLib onnxruntime}/lib"
   ]
   ++ [
-    (enableFeature crashreporterSupport "crashreporter")
-    (enableFeature ffmpegSupport "ffmpeg")
-    (enableFeature geolocationSupport "necko-wifi")
-    (enableFeature gssSupport "negotiateauth")
-    (enableFeature jemallocSupport "jemalloc")
-    (enableFeature webrtcSupport "webrtc")
+    (enableFeature withFFmpeg "ffmpeg")
+    (enableFeature withGSSAPI "negotiateauth")
+    (enableFeature withJemalloc "jemalloc")
 
-    (enableFeature debugBuild "debug")
-    (if debugBuild then "--enable-profiling" else "--enable-optimize")
+    (enableFeature enableCrashReporter "crashreporter")
+    (enableFeature enableNeckoWiFi "necko-wifi")
+    (enableFeature enableWebRTC "webrtc")
+
+    (enableFeature enableDebug "debug")
+    (if enableDebug then "--enable-profiling" else "--enable-optimize")
     # --enable-release adds -ffunction-sections & LTO that require a big amount
     # of RAM, and the 32-bit memory space cannot handle that linking
-    (enableFeature (!debugBuild && !stdenv.hostPlatform.is32bit) "release")
+    (enableFeature (!enableDebug && !stdenv.hostPlatform.is32bit) "release")
     (enableFeature enableDebugSymbols "debug-symbols")
   ]
   ++ lib.optionals enableDebugSymbols [
@@ -597,20 +587,20 @@ buildStdenv.mkDerivation {
       zlib
       (if (lib.versionAtLeast version "144") then nss_latest else nss_esr)
     ]
-    ++ lib.optional alsaSupport alsa-lib
-    ++ lib.optional jackSupport libjack2
-    ++ lib.optional pulseaudioSupport libpulseaudio # only headers are needed
-    ++ lib.optional sndioSupport sndio
-    ++ lib.optionals waylandSupport [
+    ++ lib.optional withALSA alsa-lib
+    ++ lib.optional withJACK libjack2
+    ++ lib.optional withPulseaudio libpulseaudio # only headers are needed
+    ++ lib.optional withSndio sndio
+    ++ lib.optionals withWayland [
       libxkbcommon
       libdrm
     ]
   ))
-  ++ lib.optional gssSupport libkrb5
-  ++ lib.optional jemallocSupport jemalloc
+  ++ lib.optional withGSSAPI libkrb5
+  ++ lib.optional withJemalloc jemalloc
   ++ extraBuildInputs;
 
-  profilingPhase = lib.optionalString pgoSupport ''
+  profilingPhase = lib.optionalString enablePGO ''
     # Avoid compressing the instrumented build with high levels of compression
     export MOZ_PKG_FORMAT=TAR
 
@@ -663,7 +653,7 @@ buildStdenv.mkDerivation {
   # Generate build symbols once after the final build
   # https://firefox-source-docs.mozilla.org/crash-reporting/uploading_symbol.html
   preInstall =
-    lib.optionalString crashreporterSupport ''
+    lib.optionalString enableCrashReporter ''
       ./mach buildsymbols
       mkdir -p $symbols/
       cp objdir/dist/*.crashreporter-symbols.zip $symbols/
@@ -697,7 +687,7 @@ buildStdenv.mkDerivation {
       cd ..
     '';
 
-  postFixup = lib.optionalString (crashreporterSupport && buildStdenv.hostPlatform.isLinux) ''
+  postFixup = lib.optionalString (enableCrashReporter && buildStdenv.hostPlatform.isLinux) ''
     patchelf --add-rpath "${lib.makeLibraryPath [ curl ]}" $out/lib/${binaryName}/crashreporter
   '';
 
@@ -715,21 +705,25 @@ buildStdenv.mkDerivation {
     '';
 
   passthru = {
-    inherit applicationName;
-    inherit application extraPatches;
-    inherit updateScript;
-    inherit alsaSupport;
-    inherit binaryName;
-    inherit requireSigning allowAddonSideload;
-    inherit jackSupport;
-    inherit pipewireSupport;
-    inherit sndioSupport;
-    inherit nspr;
-    inherit ffmpegSupport;
-    inherit gssSupport;
-    inherit tests;
-    inherit gtk3;
-    inherit wasiSysRoot;
+    inherit
+      application
+      applicationName
+      binaryName
+      enableAddonSideload
+      enableAddonSigning
+      extraPatches
+      gtk3
+      nspr
+      tests
+      updateScript
+      wasiSysRoot
+      withALSA
+      withFFmpeg
+      withGSSAPI
+      withJACK
+      withPipewire
+      withSndio
+      ;
     version = packageVersion;
   }
   // extraPassthru;
diff --git a/pkgs/by-name/_6/_64gram/package.nix b/pkgs/by-name/_6/_64gram/package.nix
index c87d829cb39d..f84ed1e536a1 100644
--- a/pkgs/by-name/_6/_64gram/package.nix
+++ b/pkgs/by-name/_6/_64gram/package.nix
@@ -10,13 +10,13 @@ telegram-desktop.override {
   inherit withWebkit;
   unwrapped = telegram-desktop.unwrapped.overrideAttrs (old: rec {
     pname = "64gram-unwrapped";
-    version = "1.2.5";
+    version = "1.2.7";
 
     src = fetchFromGitHub {
       owner = "TDesktop-x64";
       repo = "tdesktop";
       tag = "v${version}";
-      hash = "sha256-CcYcdSgeVEbGKOzim+Q/gIxMIfDGaSStF4cLLttA+SM=";
+      hash = "sha256-5Ovx/71wf0SV4RUwEmIvf1Q686AZ5WPxn9WlgklAMf4=";
       fetchSubmodules = true;
     };
 
diff --git a/pkgs/by-name/ag/age-plugin-fido2prf/package.nix b/pkgs/by-name/ag/age-plugin-fido2prf/package.nix
index 0665af9265d1..d2c9428f6b81 100644
--- a/pkgs/by-name/ag/age-plugin-fido2prf/package.nix
+++ b/pkgs/by-name/ag/age-plugin-fido2prf/package.nix
@@ -7,13 +7,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "age-plugin-fido2prf";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "FiloSottile";
     repo = "typage";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JGEn1xIzfLyoCWd/aRRG08Z/OoviEyZF+tGEfcj9DXw=";
+    hash = "sha256-vwE4u7xMHe0pGY/18ZbIAnoMyFyWlIbVbpQH4ZIbgZ8=";
   };
 
   srcRoot = "${finalAttrs.src}/fido2prf/cmd/age-plugin-fido2prf";
diff --git a/pkgs/by-name/as/ashell/package.nix b/pkgs/by-name/as/ashell/package.nix
index 4beac74e9bd9..3247a134ad30 100644
--- a/pkgs/by-name/as/ashell/package.nix
+++ b/pkgs/by-name/as/ashell/package.nix
@@ -15,16 +15,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ashell";
-  version = "0.9.0";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "MalpenZibo";
     repo = "ashell";
     tag = finalAttrs.version;
-    hash = "sha256-QRNEc2HNqA1tZk/jW/MXDwXda58yNlkw86SCTjH1/1w=";
+    hash = "sha256-1ci09G9qQCAmYnERtd1Pm2hZPEL0AMuYF7B9AlnnfbE=";
   };
 
-  cargoHash = "sha256-bLZcRASBGV9Y/QlDVBdOl2ElZDLI1KUAh5MlOsjmlKs=";
+  cargoHash = "sha256-yuj74sMsL1c0vLEb0iyXTJYUw0rH7bJdxJRVVpPCkf0=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/au/audacity/package.nix b/pkgs/by-name/au/audacity/package.nix
index ff0bd1ae1e67..9b096104c63d 100644
--- a/pkgs/by-name/au/audacity/package.nix
+++ b/pkgs/by-name/au/audacity/package.nix
@@ -31,7 +31,7 @@
   libid3tag,
   libopus,
   libuuid,
-  ffmpeg_8,
+  ffmpeg,
   soundtouch,
   portaudio, # given up fighting their portaudio.patch?
   portmidi,
@@ -58,18 +58,15 @@
 # TODO
 # 1. detach sbsms
 
-let
-  ffmpeg = ffmpeg_8;
-in
 stdenv.mkDerivation (finalAttrs: {
   pname = "audacity";
-  version = "3.7.8";
+  version = "3.7.9";
 
   src = fetchFromGitHub {
     owner = "audacity";
     repo = "audacity";
     rev = "Audacity-${finalAttrs.version}";
-    hash = "sha256-Vp3Nx3LuNu5fqeLF6dvZ9/hhkoUCu0eCAdIEDtS1IwU=";
+    hash = "sha256-q/5LPL76GPEFGRxTZcuxmLuq15fwbw2Mak/q2RObghk=";
   };
 
   patches = [
diff --git a/pkgs/by-name/ba/balena-compose-parser/package.nix b/pkgs/by-name/ba/balena-compose-parser/package.nix
index db1048f21518..211ab2b2b193 100644
--- a/pkgs/by-name/ba/balena-compose-parser/package.nix
+++ b/pkgs/by-name/ba/balena-compose-parser/package.nix
@@ -6,13 +6,13 @@
 buildGoModule rec {
   __structuredAttrs = true;
   pname = "balena-compose-parser";
-  version = "0.3.0";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "balena-io-modules";
     repo = "balena-compose-parser";
     rev = "v${version}";
-    hash = "sha256-VOFSdcygi3YlRlV48zV1fGtRgFSio2KBZCs25iqBmLY=";
+    hash = "sha256-fEvLu2xZlYoILM4DThiSQHG2gbGOB5IQVgmwcLKsKwo=";
   };
 
   modRoot = "lib";
diff --git a/pkgs/by-name/be/beekeeper-studio/package.nix b/pkgs/by-name/be/beekeeper-studio/package.nix
index 03a43ee33dc8..38081a914692 100644
--- a/pkgs/by-name/be/beekeeper-studio/package.nix
+++ b/pkgs/by-name/be/beekeeper-studio/package.nix
@@ -159,5 +159,8 @@ stdenv.mkDerivation (finalAttrs: {
       "x86_64-linux"
       "aarch64-darwin"
     ];
+    knownVulnerabilities = [
+      "Uses Electron 39.8.1, which was EOL on March 13 2026, with several known CVEs"
+    ];
   };
 })
diff --git a/pkgs/by-name/bu/buildstream/package.nix b/pkgs/by-name/bu/buildstream/package.nix
index 55fe57411dfd..350f92829371 100644
--- a/pkgs/by-name/bu/buildstream/package.nix
+++ b/pkgs/by-name/bu/buildstream/package.nix
@@ -24,14 +24,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "buildstream";
-  version = "2.7.0";
+  version = "2.8.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "apache";
     repo = "buildstream";
     tag = finalAttrs.version;
-    hash = "sha256-eHZmimuwOo3ZHZw5QF94B6wkso1+QbZIcgpDgsw1hiM=";
+    hash = "sha256-TS1er7lWoaMaVnfT1GAApt2qxxyTrl0o354v6rIpgCA=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/cw/cwal/package.nix b/pkgs/by-name/cw/cwal/package.nix
index 0bf13b9a0e1c..4b1e32eb7fbe 100644
--- a/pkgs/by-name/cw/cwal/package.nix
+++ b/pkgs/by-name/cw/cwal/package.nix
@@ -2,31 +2,27 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  cmake,
-  pkg-config,
+  pkgconf,
   imagemagick,
   libimagequant,
   luajit,
-  makeBinaryWrapper,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cwal";
-  version = "0.9.0";
+  version = "0.10.1";
 
   src = fetchFromGitHub {
     owner = "nitinbhat972";
     repo = "cwal";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-RDtYBgqTG3Ycn1D6QtaHGZVXKxw8UqhzssxXA4temYo=";
+    hash = "sha256-n9v2EiW1wRMsYoNk+m20qQao52vvmD6NDM8Z/oEyjbU=";
   };
 
   strictDeps = true;
 
   nativeBuildInputs = [
-    cmake
-    pkg-config
-    makeBinaryWrapper
+    pkgconf
   ];
 
   buildInputs = [
@@ -35,9 +31,23 @@ stdenv.mkDerivation (finalAttrs: {
     luajit
   ];
 
-  postFixup = ''
-    wrapProgram $out/bin/cwal \
-      --prefix XDG_DATA_DIRS : $out/share
+  postPatch = ''
+    substituteInPlace config.h \
+      --replace-fail '#define INSTALL_DIR "/usr"' \
+      "#define INSTALL_DIR \"$out\""
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+    cc nob.c -o nob
+    ./nob build
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    ./nob install
+    runHook postInstall
   '';
 
   meta = {
diff --git a/pkgs/by-name/cy/cypress/package.nix b/pkgs/by-name/cy/cypress/package.nix
index 9d614b677e0b..48de7545df25 100644
--- a/pkgs/by-name/cy/cypress/package.nix
+++ b/pkgs/by-name/cy/cypress/package.nix
@@ -127,5 +127,8 @@ stdenv.mkDerivation rec {
       Crafter
       jonhermansen
     ];
+    knownVulnerabilities = [
+      "Uses Electron 37.6.0, EOL on October 4, 2025, Several CVEs known."
+    ];
   };
 }
diff --git a/pkgs/by-name/da/daktari/package.nix b/pkgs/by-name/da/daktari/package.nix
index 5b4db545a25a..57df71b2be52 100644
--- a/pkgs/by-name/da/daktari/package.nix
+++ b/pkgs/by-name/da/daktari/package.nix
@@ -7,7 +7,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "daktari";
-  version = "0.0.350";
+  version = "0.0.353";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -15,7 +15,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "genio-learn";
     repo = "daktari";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JpLY+s88UcNgpy6K7+ZmLUCDlxqNtbuW3wIz8phy7Ag=";
+    hash = "sha256-gVch0gfuUd6/33z6KK7hTHOjG0rPaBThruqMLHf+2PA=";
   };
 
   patches = [ ./optional-pyclip.patch ];
diff --git a/pkgs/by-name/da/darkplaces/package.nix b/pkgs/by-name/da/darkplaces/package.nix
index 66181890271c..b6c7c21f6ed7 100644
--- a/pkgs/by-name/da/darkplaces/package.nix
+++ b/pkgs/by-name/da/darkplaces/package.nix
@@ -23,8 +23,13 @@ stdenv.mkDerivation {
     zlib
     libjpeg
     SDL2
-    libx11
-  ];
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [ libx11 ];
+
+  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    substituteInPlace makefile.inc \
+      --replace-fail '$(SDLCONFIG_STATICLIBS)' '$(SDLCONFIG_LIBS)'
+  '';
 
   buildFlags = [ "release" ];
 
@@ -38,12 +43,18 @@ stdenv.mkDerivation {
     runHook postInstall
   '';
 
-  postFixup = ''
-    patchelf \
-      --add-needed ${libvorbis}/lib/libvorbisfile.so \
-      --add-needed ${libvorbis}/lib/libvorbis.so \
-      $out/bin/darkplaces
-  '';
+  postFixup =
+    lib.optionalString stdenv.hostPlatform.isLinux ''
+      patchelf \
+        --add-needed ${libvorbis}/lib/libvorbisfile.so \
+        --add-needed ${libvorbis}/lib/libvorbis.so \
+        $out/bin/darkplaces
+    ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      ${stdenv.cc.targetPrefix}install_name_tool \
+        -add_rpath ${lib.getLib libvorbis}/lib \
+        $out/bin/darkplaces
+    '';
 
   meta = {
     homepage = "https://www.icculus.org/twilight/darkplaces/";
@@ -56,6 +67,6 @@ stdenv.mkDerivation {
     '';
     maintainers = with lib.maintainers; [ necrophcodr ];
     license = lib.licenses.gpl2Plus;
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
   };
 }
diff --git a/pkgs/by-name/do/docuum/package.nix b/pkgs/by-name/do/docuum/package.nix
index 5d956f2ebda5..d6d61d9c1c14 100644
--- a/pkgs/by-name/do/docuum/package.nix
+++ b/pkgs/by-name/do/docuum/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "docuum";
-  version = "0.27.0";
+  version = "0.27.1";
 
   src = fetchFromGitHub {
     owner = "stepchowfun";
     repo = "docuum";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Avd+37mY9E28kfqRI8W3Lx5O/RrxuHFwBnXZqqdrkNQ=";
+    hash = "sha256-yy2mZx2eFgEpYVvO0Dgvf42b2rK+xMiIiF5tFz+1tV0=";
   };
 
-  cargoHash = "sha256-VrCtfE4WvTlKeLsJVm73kNvo3lH90nt+imG2Yqse8K0=";
+  cargoHash = "sha256-GVjVX942kAUWZuR7k4Yu1GS9DbSr9HMoM/rfdUVXX5o=";
 
   checkFlags = [
     # fails, no idea why
diff --git a/pkgs/by-name/do/dokuwiki/package.nix b/pkgs/by-name/do/dokuwiki/package.nix
index e6b1e614063f..3059ee06e05a 100644
--- a/pkgs/by-name/do/dokuwiki/package.nix
+++ b/pkgs/by-name/do/dokuwiki/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dokuwiki";
-  version = "2026-07-14b";
+  version = "2026-07-14c";
 
   src = fetchFromGitHub {
     owner = "dokuwiki";
     repo = "dokuwiki";
     rev = "release-${version}";
-    sha256 = "sha256-w/uVk60gdr4PhUMOHHYl+X87Hx9pojYqJo5sZXLUX6o=";
+    sha256 = "sha256-84kMuFTWYo6Cjd6qpkZsLZoECIP9IzSrc9dX1uKMp0M=";
   };
 
   preload = writeText "preload.php" ''
diff --git a/pkgs/by-name/dp/dpkg/package.nix b/pkgs/by-name/dp/dpkg/package.nix
index e6aecac386cd..6d370bbb7f06 100644
--- a/pkgs/by-name/dp/dpkg/package.nix
+++ b/pkgs/by-name/dp/dpkg/package.nix
@@ -16,6 +16,7 @@
   diffutils,
   versionCheckHook,
   glibc,
+  bashNonInteractive,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -113,7 +114,9 @@ stdenv.mkDerivation (finalAttrs: {
     xz
     zstd
     libmd
+    bashNonInteractive
   ];
+
   nativeBuildInputs = [
     makeWrapper
     perl
@@ -121,6 +124,8 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
   ];
 
+  strictDeps = true;
+
   postInstall = ''
     for i in $out/bin/*; do
       if head -n 1 $i | grep -q perl; then
@@ -138,6 +143,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   setupHook = ./setup-hook.sh;
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Debian package manager";
     homepage = "https://wiki.debian.org/Teams/Dpkg";
diff --git a/pkgs/by-name/er/ergo/package.nix b/pkgs/by-name/er/ergo/package.nix
index 27c2cf09dcdc..aa29ccc07cc1 100644
--- a/pkgs/by-name/er/ergo/package.nix
+++ b/pkgs/by-name/er/ergo/package.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ergo";
-  version = "6.0.4";
+  version = "6.0.5";
 
   src = fetchurl {
     url = "https://github.com/ergoplatform/ergo/releases/download/v${finalAttrs.version}/ergo-${finalAttrs.version}.jar";
-    sha256 = "sha256-PeFQiRx+oE9cbNSPjVPU5/q7Ib+ZnFoXiattnszXT4c=";
+    sha256 = "sha256-Kn4peMsJU47WeA2FrjqjnB7M4Q5eWm4Nw82KsIeFFYg=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/fi/firebase-tools/package.nix b/pkgs/by-name/fi/firebase-tools/package.nix
index 1b67d10fff07..6fd7a9f2983c 100644
--- a/pkgs/by-name/fi/firebase-tools/package.nix
+++ b/pkgs/by-name/fi/firebase-tools/package.nix
@@ -11,17 +11,17 @@
 
 buildNpmPackage rec {
   pname = "firebase-tools";
-  version = "15.28.1";
+  version = "15.28.2";
   nodejs = nodejs_22;
 
   src = fetchFromGitHub {
     owner = "firebase";
     repo = "firebase-tools";
     tag = "v${version}";
-    hash = "sha256-Dls7xLkHnvLGQnw72RoOYw8iz2axHNBBKdzVwWpfWHE=";
+    hash = "sha256-19cIgkZ0luZYYx+9Cs077b5Q+sLxf+4ahwWO6hspxDw=";
   };
 
-  npmDepsHash = "sha256-u8zhpnd2avSXiIZi6rj8y6JI9ngqTxIhlPR+Xor3ka8=";
+  npmDepsHash = "sha256-ZcI4Do4NcTIhJx1o/Hb9fZysv7WyGMLOUKMb4SUbeTY=";
 
   # No more package-lock.json in upstream src
   postPatch = ''
diff --git a/pkgs/by-name/fi/firefoxpwa-unwrapped/package.nix b/pkgs/by-name/fi/firefoxpwa-unwrapped/package.nix
index 352795aa199e..29438dd2bf95 100644
--- a/pkgs/by-name/fi/firefoxpwa-unwrapped/package.nix
+++ b/pkgs/by-name/fi/firefoxpwa-unwrapped/package.nix
@@ -99,12 +99,12 @@ rustPlatform.buildRustPackage rec {
     # wrapped similarly to `firefoxRuntime`, and these passthru variables are
     # read when `wrapFirefox` wraps this derivation too.
     inherit (firefoxRuntime)
-      ffmpegSupport
-      gssSupport
-      alsaSupport
-      pipewireSupport
-      sndioSupport
-      jackSupport
+      withALSA
+      withFFmpeg
+      withGSSAPI
+      withJACK
+      withPipewire
+      withSndio
       ;
   };
 
diff --git a/pkgs/by-name/fl/floorp-bin-unwrapped/package.nix b/pkgs/by-name/fl/floorp-bin-unwrapped/package.nix
index 239e5cbbc80b..bc45d19ea164 100644
--- a/pkgs/by-name/fl/floorp-bin-unwrapped/package.nix
+++ b/pkgs/by-name/fl/floorp-bin-unwrapped/package.nix
@@ -113,8 +113,8 @@ stdenv.mkDerivation (finalAttrs: {
     inherit binaryName;
     applicationName = "Floorp";
     libName = "floorp-bin-${finalAttrs.version}";
-    ffmpegSupport = true;
-    gssSupport = true;
+    withFFmpeg = true;
+    withGSSAPI = true;
     gtk3 = gtk3;
     updateScript = ./update.sh;
   };
diff --git a/pkgs/by-name/fo/foot/package.nix b/pkgs/by-name/fo/foot/package.nix
index 2f18f121c896..581df7b8ad00 100644
--- a/pkgs/by-name/fo/foot/package.nix
+++ b/pkgs/by-name/fo/foot/package.nix
@@ -27,7 +27,7 @@
 }:
 
 let
-  version = "1.27.0";
+  version = "1.28.0";
 
   # build stimuli file for PGO build and the script to generate it
   # independently of the foot's build, so we can cache the result
@@ -40,7 +40,7 @@ let
 
     src = fetchurl {
       url = "https://codeberg.org/dnkl/foot/raw/tag/${version}/scripts/generate-alt-random-writes.py";
-      hash = "sha256-d7oE3hSStET9Bz8PcmRHSZ+ga+7lrL3/oJdx7phNei8=";
+      hash = "sha256-RUCG4EK9+aXe+EKvFYv6/JzQBglGZHyaEpr63v8akW4=";
     };
 
     dontUnpack = true;
@@ -103,7 +103,7 @@ stdenv.mkDerivation {
     owner = "dnkl";
     repo = "foot";
     tag = version;
-    hash = "sha256-jbE44SpMqDhOOT2o4Wh7UCdXn6bBqxOMskCHHTzEKmU=";
+    hash = "sha256-CZlbQut5jM8/dWuLlJPDaLBykV7K5l/caB3DLQ94mG8=";
   };
 
   separateDebugInfo = true;
diff --git a/pkgs/by-name/fr/frame-media-converter/package.nix b/pkgs/by-name/fr/frame-media-converter/package.nix
index a5e308a12ae7..634fac621ba7 100644
--- a/pkgs/by-name/fr/frame-media-converter/package.nix
+++ b/pkgs/by-name/fr/frame-media-converter/package.nix
@@ -25,7 +25,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "frame-media-converter";
-  version = "0.33.0";
+  version = "0.33.1";
 
   __structuredAttrs = true;
 
@@ -33,10 +33,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "66HEX";
     repo = "frame";
     tag = finalAttrs.version;
-    hash = "sha256-Nz1ct+Hkc1f7llXT925gBwAivfz1QCpTJW1WzjratTI=";
+    hash = "sha256-oUJ6yiSZGrpdKra22H/nyLjDh9f6p9gOA9TeXjlDuRY=";
   };
 
-  cargoHash = "sha256-n1HlMAYHrHwZN+nxA5dgTghcrNaYKL3LLtphcc2Ty7U=";
+  cargoHash = "sha256-Rq2/CWxKN7HmmFtmt26CMfVwmwc4Wl2wnbvB9inVsHw=";
   cargoBuildFlags = cargoFlags;
   cargoTestFlags = cargoFlags;
 
diff --git a/pkgs/by-name/gi/github-copilot-app/package.nix b/pkgs/by-name/gi/github-copilot-app/package.nix
index 8825e3f03439..873938c038ff 100644
--- a/pkgs/by-name/gi/github-copilot-app/package.nix
+++ b/pkgs/by-name/gi/github-copilot-app/package.nix
@@ -95,7 +95,8 @@ stdenv.mkDerivation {
         cp -r *.app $out/Applications/
 
         mkdir -p $out/bin
-        ln -s "$out/Applications/"*.app/Contents/MacOS/* $out/bin/github-copilot-app
+        ln -s "$out/Applications/"*.app/Contents/MacOS/git-credential-copilot "$out"/bin/git-credential-copilot
+        ln -s "$out/Applications/"*.app/Contents/MacOS/github "$out"/bin/github-copilot-app
       ''
     else
       ''
diff --git a/pkgs/by-name/go/gobgp/package.nix b/pkgs/by-name/go/gobgp/package.nix
index 6d26953e8377..7f974cda8684 100644
--- a/pkgs/by-name/go/gobgp/package.nix
+++ b/pkgs/by-name/go/gobgp/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "gobgp";
-  version = "4.8.0";
+  version = "4.9.0";
 
   src = fetchFromGitHub {
     owner = "osrg";
     repo = "gobgp";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-nU/HjHi0nKQy8SelwKSHneRjaRVNfvif4dljhPpUZrI=";
+    sha256 = "sha256-52eJtAQfDF76vvLQMxnttPgXppaumZcZ/toOoLeYBu8=";
   };
 
   vendorHash = "sha256-9r8LZlCF4sr8VTyJfDktjhk32afc8ep7GXtqxUnAleE=";
diff --git a/pkgs/by-name/go/gobgpd/package.nix b/pkgs/by-name/go/gobgpd/package.nix
index f6eb0a287a49..eb64b2546b46 100644
--- a/pkgs/by-name/go/gobgpd/package.nix
+++ b/pkgs/by-name/go/gobgpd/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "gobgpd";
-  version = "4.8.0";
+  version = "4.9.0";
 
   src = fetchFromGitHub {
     owner = "osrg";
     repo = "gobgp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-nU/HjHi0nKQy8SelwKSHneRjaRVNfvif4dljhPpUZrI=";
+    hash = "sha256-52eJtAQfDF76vvLQMxnttPgXppaumZcZ/toOoLeYBu8=";
   };
 
   vendorHash = "sha256-9r8LZlCF4sr8VTyJfDktjhk32afc8ep7GXtqxUnAleE=";
diff --git a/pkgs/by-name/go/goose/package.nix b/pkgs/by-name/go/goose/package.nix
index f58da1fbc62d..630cd5bd8bdf 100644
--- a/pkgs/by-name/go/goose/package.nix
+++ b/pkgs/by-name/go/goose/package.nix
@@ -7,17 +7,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "goose";
-  version = "3.27.3";
+  version = "3.28.0";
 
   src = fetchFromGitHub {
     owner = "pressly";
     repo = "goose";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-CSS0OtC4/EeQD7PGin64U0Fag2z490RQ7CKNBRyp8f8=";
+    hash = "sha256-V7kpDIJOyWB0O6uGQmxO1lgfdUYXIGJ3ycmXGu20H94=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-opO6G9Fdyt27GlWyaB/6J1xhm3wTgH9Xc/FYcLcqBVs=";
+  vendorHash = "sha256-phtM6ClEwszIE7TQVXJbRLvSk0uSbng6h/pQsjHmjGU=";
 
   # skipping: end-to-end tests require a docker daemon
   postPatch = ''
diff --git a/pkgs/by-name/gp/gpu-viewer/package.nix b/pkgs/by-name/gp/gpu-viewer/package.nix
index f0b4663a0796..36e55bcfe0ab 100644
--- a/pkgs/by-name/gp/gpu-viewer/package.nix
+++ b/pkgs/by-name/gp/gpu-viewer/package.nix
@@ -29,7 +29,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "gpu-viewer";
-  version = "3.35";
+  version = "4.00";
   pyproject = false;
   __structuredAttrs = true;
 
@@ -37,7 +37,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "arunsivaramanneo";
     repo = "gpu-viewer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-W8BPtHbOwLZ95bY6ZmAaKS87fh+gOWZIhxjWKqiavag=";
+    hash = "sha256-zSPXOWdd962DvwqYiit9wGT6vDxvgkQz91852+h4d7Q=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gr/graphify/package.nix b/pkgs/by-name/gr/graphify/package.nix
index 8e44e286cbf1..1ffaa444f2a7 100644
--- a/pkgs/by-name/gr/graphify/package.nix
+++ b/pkgs/by-name/gr/graphify/package.nix
@@ -8,14 +8,14 @@
 python3Packages.buildPythonApplication rec {
   __structuredAttrs = true;
   pname = "graphify";
-  version = "0.9.48";
+  version = "0.9.53";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Graphify-Labs";
     repo = "graphify";
     tag = "v${version}";
-    hash = "sha256-gcQ8isXZQu/VQkK74vAaOKnbNdsxiez+TSZdRUxEMiA=";
+    hash = "sha256-1G8PuSxYM70nMf8glJARA9vVMI8Ue7zqfAxgXi18lPM=";
   };
 
   build-system = [
diff --git a/pkgs/by-name/gr/grub2/add-hidden-menu-entries.patch b/pkgs/by-name/gr/grub2/add-hidden-menu-entries.patch
index 836a9853708f..3c3189693d3a 100644
--- a/pkgs/by-name/gr/grub2/add-hidden-menu-entries.patch
+++ b/pkgs/by-name/gr/grub2/add-hidden-menu-entries.patch
@@ -1,42 +1,86 @@
+From dc1b837925f7c2ee6663cf34bbd982e0b368d811 Mon Sep 17 00:00:00 2001
+From: hustlerone <nine-ball@tutanota.com>
+Date: Sun, 18 Jan 2026 11:57:36 +0100
+Subject: [PATCH] Add hidden menu entries
+
+Merge conflicts manually resolved.
+
+https://lists.gnu.org/archive/html/grub-devel/2016-04/msg00089.html
+https://marc.info/?l=grub-devel&m=146193404929072&w=2
+
+Vendored in:
+https://build.opensuse.org/projects/openSUSE:Factory/packages/grub2/files/grub2-Add-hidden-menu-entries.patch?expand=1
+---
+ grub-core/commands/blsuki.c    |  4 ++--
+ grub-core/commands/legacycfg.c |  4 ++--
+ grub-core/commands/menuentry.c | 22 +++++++++++++++++-----
+ grub-core/normal/menu.c        | 30 ++++++++++++++++++++++++++----
+ grub-core/normal/menu_text.c   |  6 +++++-
+ include/grub/menu.h            |  2 ++
+ include/grub/normal.h          |  2 +-
+ 7 files changed, 55 insertions(+), 15 deletions(-)
+
+diff --git a/grub-core/commands/blsuki.c b/grub-core/commands/blsuki.c
+index 4133d3111..26055f91f 100644
+--- a/grub-core/commands/blsuki.c
++++ b/grub-core/commands/blsuki.c
+@@ -1022,7 +1022,7 @@ bls_create_entry (grub_blsuki_entry_t *entry)
+ 			linux_cmd, initrd_cmd ? initrd_cmd : "",
+ 			dt_cmd ? dt_cmd : "");
+ 
+-  grub_normal_add_menu_entry (argc, argv, classes, id, users, hotkey, NULL, src, 0, entry);
++  grub_normal_add_menu_entry (argc, argv, classes, id, users, hotkey, NULL, src, 0, entry, 0);
+ 
+  finish:
+   grub_free (linux_cmd);
+@@ -1088,7 +1088,7 @@ uki_create_entry (grub_blsuki_entry_t *entry)
+ 			(options != NULL) ? " " : "",
+ 			(options != NULL) ? options : "");
+ 
+-  grub_normal_add_menu_entry (1, argv, NULL, id, NULL, NULL, NULL, src, 0, entry);
++  grub_normal_add_menu_entry (1, argv, NULL, id, NULL, NULL, NULL, src, 0, entry, 0);
+ 
+  finish:
+   grub_free (argv);
 diff --git a/grub-core/commands/legacycfg.c b/grub-core/commands/legacycfg.c
-index e9e9d94ef..54e08a1b4 100644
+index 7d9f9eb3c..bb5b7b3ad 100644
 --- a/grub-core/commands/legacycfg.c
 +++ b/grub-core/commands/legacycfg.c
 @@ -143,7 +143,7 @@ legacy_file (const char *filename)
  	    args[0] = oldname;
  	    grub_normal_add_menu_entry (1, args, NULL, NULL, "legacy",
  					NULL, NULL,
--					entrysrc, 0);
-+					entrysrc, 0, 0);
+-					entrysrc, 0, NULL);
++					entrysrc, 0, NULL, 0);
  	    grub_free (args);
  	    entrysrc[0] = 0;
  	    grub_free (oldname);
-@@ -205,7 +205,7 @@ legacy_file (const char *filename)
+@@ -204,7 +204,7 @@ legacy_file (const char *filename)
  	}
        args[0] = entryname;
        grub_normal_add_menu_entry (1, args, NULL, NULL, NULL,
--				  NULL, NULL, entrysrc, 0);
-+				  NULL, NULL, entrysrc, 0, 0);
+-				  NULL, NULL, entrysrc, 0, NULL);
++				  NULL, NULL, entrysrc, 0, NULL, 0);
        grub_free (args);
      }
  
 diff --git a/grub-core/commands/menuentry.c b/grub-core/commands/menuentry.c
-index 720e6d8ea..50632ccce 100644
+index 5e1318f17..288189b8d 100644
 --- a/grub-core/commands/menuentry.c
 +++ b/grub-core/commands/menuentry.c
 @@ -78,7 +78,7 @@ grub_normal_add_menu_entry (int argc, const char **args,
  			    char **classes, const char *id,
  			    const char *users, const char *hotkey,
  			    const char *prefix, const char *sourcecode,
--			    int submenu)
-+			    int submenu, int hidden)
+-			    int submenu, grub_blsuki_entry_t *blsuki)
++			    int submenu, grub_blsuki_entry_t *blsuki, int hidden)
  {
    int menu_hotkey = 0;
    char **menu_args = NULL;
-@@ -188,8 +188,11 @@ grub_normal_add_menu_entry (int argc, const char **args,
-   (*last)->args = menu_args;
+@@ -189,8 +189,11 @@ grub_normal_add_menu_entry (int argc, const char **args,
    (*last)->sourcecode = menu_sourcecode;
    (*last)->submenu = submenu;
+   (*last)->blsuki = blsuki;
 +  (*last)->hidden = hidden;
 +
 +  if (!hidden)
@@ -46,27 +90,28 @@ index 720e6d8ea..50632ccce 100644
    return GRUB_ERR_NONE;
  
   fail:
-@@ -286,7 +289,8 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args)
- 				       users,
+@@ -291,7 +294,8 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args)
  				       ctxt->state[2].arg, 0,
  				       ctxt->state[3].arg,
--				       ctxt->extcmd->cmd->name[0] == 's');
-+				       ctxt->extcmd->cmd->name[0] == 's',
+ 				       ctxt->extcmd->cmd->name[0] == 's',
+-				       NULL);
++				       NULL,
 +               ctxt->extcmd->cmd->name[0] == 'h');
  
    src = args[argc - 1];
    args[argc - 1] = NULL;
-@@ -303,7 +307,8 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args)
+@@ -308,7 +312,9 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args)
  				  ctxt->state[0].args, ctxt->state[4].arg,
  				  users,
  				  ctxt->state[2].arg, prefix, src + 1,
--				  ctxt->extcmd->cmd->name[0] == 's');
+-				  ctxt->extcmd->cmd->name[0] == 's', NULL);
 +				  ctxt->extcmd->cmd->name[0] == 's',
++          NULL,
 +          ctxt->extcmd->cmd->name[0] == 'h');
  
    src[len - 1] = ch;
    args[argc - 1] = src;
-@@ -311,7 +316,7 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args)
+@@ -316,7 +322,7 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args)
    return r;
  }
  
@@ -75,7 +120,7 @@ index 720e6d8ea..50632ccce 100644
  
  void
  grub_menu_init (void)
-@@ -327,6 +332,12 @@ grub_menu_init (void)
+@@ -332,6 +338,12 @@ grub_menu_init (void)
  				  | GRUB_COMMAND_FLAG_EXTRACTOR,
  				  N_("BLOCK"), N_("Define a submenu."),
  				  options);
@@ -89,10 +134,10 @@ index 720e6d8ea..50632ccce 100644
  
  void
 diff --git a/grub-core/normal/menu.c b/grub-core/normal/menu.c
-index 6a90e091f..4236f55bc 100644
+index b946c834d..483a3505c 100644
 --- a/grub-core/normal/menu.c
 +++ b/grub-core/normal/menu.c
-@@ -37,6 +37,8 @@
+@@ -38,6 +38,8 @@
     entry failing to boot.  */
  #define DEFAULT_ENTRY_ERROR_DELAY_MS  2500
  
@@ -101,7 +146,7 @@ index 6a90e091f..4236f55bc 100644
  grub_err_t (*grub_gfxmenu_try_hook) (int entry, grub_menu_t menu,
  				     int nested) = NULL;
  
-@@ -80,8 +82,20 @@ grub_menu_get_entry (grub_menu_t menu, int no)
+@@ -81,8 +83,20 @@ grub_menu_get_entry (grub_menu_t menu, int no)
  {
    grub_menu_entry_t e;
  
@@ -124,7 +169,7 @@ index 6a90e091f..4236f55bc 100644
  
    return e;
  }
-@@ -93,10 +107,10 @@ get_entry_index_by_hotkey (grub_menu_t menu, int hotkey)
+@@ -94,10 +108,10 @@ get_entry_index_by_hotkey (grub_menu_t menu, int hotkey)
    grub_menu_entry_t entry;
    int i;
  
@@ -137,7 +182,7 @@ index 6a90e091f..4236f55bc 100644
  
    return -1;
  }
-@@ -509,6 +523,10 @@ get_entry_number (grub_menu_t menu, const char *name)
+@@ -510,6 +524,10 @@ get_entry_number (grub_menu_t menu, const char *name)
        grub_menu_entry_t e = menu->entry_list;
        int i;
  
@@ -148,7 +193,7 @@ index 6a90e091f..4236f55bc 100644
        grub_errno = GRUB_ERR_NONE;
  
        for (i = 0; e; i++)
-@@ -520,6 +538,10 @@ get_entry_number (grub_menu_t menu, const char *name)
+@@ -521,6 +539,10 @@ get_entry_number (grub_menu_t menu, const char *name)
  	      break;
  	    }
  	  e = e->next;
@@ -160,10 +205,10 @@ index 6a90e091f..4236f55bc 100644
  
        if (! e)
 diff --git a/grub-core/normal/menu_text.c b/grub-core/normal/menu_text.c
-index b1321eb26..d2e46cac8 100644
+index 9c383e64a..e55bafa6c 100644
 --- a/grub-core/normal/menu_text.c
 +++ b/grub-core/normal/menu_text.c
-@@ -289,7 +289,11 @@ print_entries (grub_menu_t menu, const struct menu_viewer_data *data)
+@@ -292,7 +292,11 @@ print_entries (grub_menu_t menu, const struct menu_viewer_data *data)
        print_entry (data->geo.first_entry_y + i, data->offset == i,
  		   e, data);
        if (e)
@@ -177,10 +222,10 @@ index b1321eb26..d2e46cac8 100644
  
    grub_term_gotoxy (data->term,
 diff --git a/include/grub/menu.h b/include/grub/menu.h
-index ee2b5e910..eb8a86ba9 100644
+index 8d06e8400..f7a302081 100644
 --- a/include/grub/menu.h
 +++ b/include/grub/menu.h
-@@ -58,6 +58,8 @@ struct grub_menu_entry
+@@ -72,6 +72,8 @@ struct grub_menu_entry
  
    int submenu;
  
@@ -188,17 +233,20 @@ index ee2b5e910..eb8a86ba9 100644
 +
    /* The next element.  */
    struct grub_menu_entry *next;
- };
+ 
 diff --git a/include/grub/normal.h b/include/grub/normal.h
-index 218cbabcc..bcb412466 100644
+index d0150e3c2..4c1fe8ec1 100644
 --- a/include/grub/normal.h
 +++ b/include/grub/normal.h
 @@ -145,7 +145,7 @@ grub_normal_add_menu_entry (int argc, const char **args, char **classes,
  			    const char *id,
  			    const char *users, const char *hotkey,
  			    const char *prefix, const char *sourcecode,
--			    int submenu);
-+			    int submenu, int hidden);
+-			    int submenu, grub_blsuki_entry_t *blsuki);
++			    int submenu, grub_blsuki_entry_t *blsuki, int hidden);
  
  grub_err_t
  grub_normal_set_password (const char *user, const char *password);
+-- 
+2.51.2
+
diff --git a/pkgs/by-name/gr/grub2/bootstrap-po-downloads.patch b/pkgs/by-name/gr/grub2/bootstrap-po-downloads.patch
new file mode 100644
index 000000000000..521f44fb308a
--- /dev/null
+++ b/pkgs/by-name/gr/grub2/bootstrap-po-downloads.patch
@@ -0,0 +1,13 @@
+diff --git a/bootstrap b/bootstrap
+index dc9fb4383..5d0e90a92 100755
+--- a/bootstrap
++++ b/bootstrap
+@@ -931,7 +931,7 @@ update_po_files() {
+   # Usually contains *.s1 checksum files.
+   ref_po_dir="$po_dir/.reference"
+ 
+-  test -d $ref_po_dir || mkdir $ref_po_dir || return
++  test -d $ref_po_dir && return || mkdir $ref_po_dir
+   download_po_files $ref_po_dir $domain \
+     && ls "$ref_po_dir"/*.po 2>/dev/null |
+       sed 's|.*/||; s|\.po$||' > "$po_dir/LINGUAS" || return
diff --git a/pkgs/by-name/gr/grub2/package.nix b/pkgs/by-name/gr/grub2/package.nix
index a21d2f3257c4..392a6ed6e794 100644
--- a/pkgs/by-name/gr/grub2/package.nix
+++ b/pkgs/by-name/gr/grub2/package.nix
@@ -1,12 +1,15 @@
 {
   lib,
   stdenv,
+  fetchurl,
   fetchgit,
   flex,
   bison,
   python3,
   autoconf,
+  autoconf-archive,
   automake,
+  autoreconfHook,
   libtool,
   bash,
   gettext,
@@ -23,6 +26,7 @@
   buildPackages,
   nixosTests,
   fuse3, # only needed for grub-mount
+  xz, # for xz compression support. Usually counterproductive, so don't try to force compression in your GRUB install.
   runtimeShell,
   zfs ? null,
   efiSupport ? false,
@@ -30,7 +34,8 @@
   zfsSupport ? false,
   xenSupport ? false,
   xenPvhSupport ? false,
-  kbdcompSupport ? false,
+  corebootSupport ? false,
+  kbdcompSupport ? corebootSupport,
   ckbcomp,
 }:
 
@@ -40,6 +45,11 @@ let
     x86_64-linux.target = "i386";
   };
 
+  corebootSystemsBuild = {
+    i686-linux.target = "i386";
+    x86_64-linux.target = "i386";
+  };
+
   efiSystemsBuild = {
     i686-linux.target = "i386";
     x86_64-linux.target = "x86_64";
@@ -80,8 +90,8 @@ let
   inPCSystems = lib.any (system: stdenv.hostPlatform.system == system) (lib.attrNames pcSystems);
 
   gnulib = fetchgit {
-    url = "https://git.savannah.gnu.org/git/gnulib.git";
-    # NOTE: keep in sync with bootstrap.conf!
+    url = "https://https.git.savannah.gnu.org/git/gnulib.git";
+    # NOTE: get $GNULIB_REVISION from bootstrap.conf!
     rev = "9f48fb992a3d7e96610c4ce8be969cff2d61a01b";
     hash = "sha256-mzbF66SNqcSlI+xmjpKpNMwzi13yEWoc1Fl7p4snTto=";
   };
@@ -90,9 +100,12 @@ let
   # but those translations are not versioned/stable. For that reason
   # we take them from the nearest release tarball instead:
   locales = fetchzip {
-    url = "https://ftp.gnu.org/gnu/grub/grub-2.12.tar.gz";
-    hash = "sha256-IoRiJHNQ58y0UhCAD0CrpFiI8Mz1upzAtyh5K4Njh/w=";
+    url = "mirror://gnu/grub/grub-${version}.tar.gz";
+    hash = "sha256-NUlE6l8Ul3i1Si9mZgND6lnvFqc74EGptHV2iCtu+As=";
   };
+
+  # This is the variable that sets the GRUB release.
+  version = "2.14";
 in
 
 assert zfsSupport -> zfs != null;
@@ -103,505 +116,81 @@ assert lib.asserts.assertMsg (
       ieee1275Support
       xenSupport
       xenPvhSupport
+      corebootSupport
     ]
   ) <= 1 # (0 == pc)
 ) "Only <= 1 of grub2's platform-related *Support options may be enabled at the same time";
 
 stdenv.mkDerivation rec {
   pname = "grub";
-  version = "2.12";
+  inherit version;
 
   src = fetchgit {
-    url = "https://git.savannah.gnu.org/git/grub.git";
+    url = "https://gitlab.freedesktop.org/gnu-grub/grub.git";
     tag = "grub-${version}";
-    hash = "sha256-lathsBb2f7urh8R86ihpTdwo3h1hAHnRiHd5gCLVpBc=";
+    hash = "sha256-Gkpde5CeJOQ+0p5WGwXZ2P881jxrWkuFw3Fh4lul/so=";
   };
 
-  patches = [
-    ./fix-bash-completion.patch
-    ./add-hidden-menu-entries.patch
+  patches =
+    let
+      grubPatch = commit: "https://gitlab.freedesktop.org/gnu-grub/grub/-/commit/${commit}.patch";
+    in
+    [
+      ./fix-bash-completion.patch
+      ./add-hidden-menu-entries.patch
+      ./bootstrap-po-downloads.patch
 
-    # https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00024.html
-    (fetchpatch {
-      name = "01_implement_grub_strlcpy.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=ea703528a8581a2ea7e0bad424a70fdf0aec7d8f";
-      hash = "sha256-MSMgu1vMG83HRImUUsTyA1YQaIhgEreGGPd+ZDWSI2I=";
-    })
-    (fetchpatch {
-      name = "02_CVE-2024-45781.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c1a291b01f4f1dcd6a22b61f1c81a45a966d16ba";
-      hash = "sha256-q8ErK+cQzaqwSuhLRFL3AfYBkpgJq1IQmadnlmlz2yw=";
-    })
-    (fetchpatch {
-      name = "03_CVE-2024-45782_CVE-2024-56737.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=417547c10410b714e43f08f74137c24015f8f4c3";
-      hash = "sha256-mRinw27WZ2d1grzyzFGO18yXx72UVBM6Lf5cR8XJfs8=";
-    })
-    (fetchpatch {
-      name = "04_fs_tar_initialize_name_in_grub_cpio_find_file.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=2c8ac08c99466c0697f704242363fc687f492a0d";
-      hash = "sha256-EMGF0B+Fw6tSmllWUJAp1ynzWk+w2C/XM1LmXSReHWg=";
-    })
-    (fetchpatch {
-      name = "05_CVE-2024-45780.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=0087bc6902182fe5cedce2d034c75a79cf6dd4f3";
-      hash = "sha256-IlW5i4EJVoUYPu9/lb0LeytTpzltQuu5fpkFPQNIhls=";
-    })
-    (fetchpatch {
-      name = "06_fs_f2fs_grub_errno_mount_fails.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=563436258cde64da6b974880abff1bf0959f4da3";
-      hash = "sha256-Iu0RPyB+pAnqMT+MTX+TrJbYJsvYPn7jbMgE1jcLh/Q=";
-    })
-    (fetchpatch {
-      name = "07_CVE-2024-45783.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=f7c070a2e28dfab7137db0739fb8db1dc02d8898";
-      hash = "sha256-V1wh2dPeTazmad61jFtOjhq2MdoD+txPWY/AfwwyTZM=";
-    })
-    (fetchpatch {
-      name = "08_fs_iso9660_grub_errno_mount_fails.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=965db5970811d18069b34f28f5f31ddadde90a97";
-      hash = "sha256-6eN1AvZwXkJOQVcjgymy/E7QiAxzL/d0W3KlAZRqUzI=";
-    })
-    (fetchpatch {
-      name = "09_fs_iso9660_fix_invalid_free.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=1443833a9535a5873f7de3798cf4d8389f366611";
-      hash = "sha256-Gt5yMy5Vg9zrDggj3o/TLNt2vT9/6IuHg4Se2p8e8pI=";
-    })
-    (fetchpatch {
-      name = "10_fs_jfs_fix_oob_read_jfs_getent.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=66175696f3a385b14bdf1ebcda7755834bd2d5fb";
-      hash = "sha256-ETbzbc5gvf55sTLjmJOXXC9VH3qcP1Gv5seR/U9NRiY=";
-    })
-    (fetchpatch {
-      name = "11_fs_jfs_fix_oob_read_caused_by_invalid_dir_slot_index.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=ab09fd0531f3523ac0ef833404526c98c08248f7";
-      hash = "sha256-wE6niiIx4BdN800/Eegb6IbBRoMFpXq9kPvatwhWNXY=";
-    })
-    (fetchpatch {
-      name = "12_fs_jfs_use_full_40_bits_offset_and_address_for_data_extent.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=bd999310fe67f35a66de3bfa2836da91589d04ef";
-      hash = "sha256-fbC4oTEIoGWJASzJI5RXfoanrMLTfjFOI51LCUU7Ctg=";
-    })
-    (fetchpatch {
-      name = "13_fs_jfs_inconsistent_signed_unsigned_types_usage.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=edd995a26ec98654d907a9436a296c2d82bc4b28";
-      hash = "sha256-aa1G1vi4bPZejfKEqZokAZTzY9Ea2lyxTrP4drDV9tk=";
-    })
-    (fetchpatch {
-      name = "14_fs_ext2_fix_out-of-bounds_read_for_inline_extent.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7e2f750f0a795c4d64ec7dc7591edac8da2e978c";
-      hash = "sha256-PtPqZHMU2fy7btRRaaswLyHizplxnygCzDfcg5ievOQ=";
-    })
-    (fetchpatch {
-      name = "15_fs_ntfs_fix_out-of-bounds_read.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=aff26318783a135562b904ff09e2359893885732";
-      hash = "sha256-znN6lkAB9aAhTGKR1038DzOz5nzuTp+7ylHVqRM7HeI=";
-    })
-    (fetchpatch {
-      name = "16_fs_ntfs_track_the_end_of_the_MFT_attribute_buffer.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=237a71184a32d1ef7732f5f49ed6a89c5fe1c99a";
-      hash = "sha256-0I/g0qHkWY6PArPn1UaYRhCrrh9bHknADh34v5eSjjM=";
-    })
-    (fetchpatch {
-      name = "17_fs_ntfs_use_a_helper_function_to_access_attributes.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=048777bc29043403d077d41a81d0183767b8bc71";
-      hash = "sha256-Mm49MSLqCq143r8ruLJm1QoyCoLtOlCBfqoAPwPlv8E=";
-    })
-    # Patch 18 (067b6d225d482280abad03944f04e30abcbdafa1) has been removed because it causes regressions
-    # https://lists.gnu.org/archive/html/grub-devel/2025-03/msg00067.html
-    (fetchpatch {
-      name = "19_fs_xfs_fix_out-of-bounds_read.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=6ccc77b59d16578b10eaf8a4fe85c20b229f0d8a";
-      hash = "sha256-FvTzFvfEi3oyxPC/dUHreyzzeVCskaUlYUjpKY/l0DE=";
-    })
-    (fetchpatch {
-      name = "20_fs_xfs_ensuring_failing_to_mount_sets_a_grub_errno.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d1d6b7ea58aa5a80a4c4d0666b49460056c8ef0a";
-      hash = "sha256-SLdXMmYHq/gRmWrjRrOu5ZYFod84EllUL6hk+gnr3kg=";
-    })
-    (fetchpatch {
-      name = "21_kern_file_ensure_file_data_is_set.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=a7910687294b29288ac649e71b47493c93294f17";
-      hash = "sha256-DabZK9eSToEmSA9dEwtEN+URiVyS9qf6e2Y2UiMuy8Q=";
-    })
-    (fetchpatch {
-      name = "22_kern_file_implement_filesystem_reference_counting.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=16f196874fbe360a1b3c66064ec15adadf94c57b";
-      excludes = [ "grub-core/fs/erofs.c" ]; # Does not exist on 2.12
-      hash = "sha256-yGU//1tPaxi+xFKZrsbUAnvgFpwtrIMG+8cPbSud4+U=";
-    })
-    (fetchpatch {
-      name = "23_prerequisite_1_key_protector_add_key_protectors_framework.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5d260302da672258444b01239803c8f4d753e3f3";
-      hash = "sha256-5aFHzc5qXBNLEc6yzI17AH6J7EYogcXdLxk//1QgumY=";
-    })
-    (fetchpatch {
-      name = "23_prerequisite_2_disk_cryptodisk_allow_user_to_retry_failed_passphrase.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=386b59ddb42fa3f86ddfe557113b25c8fa16f88c";
-      hash = "sha256-e1kGQB7wGWvEb2bY3xIpZxE1uzTt9JOKi05jXyUm+bI=";
-    })
-    (fetchpatch {
-      name = "23_prerequisite_3_cryptodisk_support_key_protectors.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=ad0c52784a375cecaa8715d7deadcf5d65baf173";
-      hash = "sha256-+YIvUYA3fLiOFFsXDrQjqjWFluzLa7N1tv0lwq8BqCs=";
-    })
-    (fetchpatch {
-      name = "23_prerequisite_4_cryptodisk_fallback_to_passphrase.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=6abf8af3c54abc04c4ec71c75d10fcfbc190e181";
-      hash = "sha256-eMu9rW4iJucDAsTQMJD1XE6dDIcUmn02cGqIaqBbO3o=";
-    })
-    (fetchpatch {
-      name = "23_prerequisite_5_cryptodisk_wipe_out_the_cached_keys_from_protectors.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=b35480b48e6f9506d8b7ad8a3b5206d29c24ea95";
-      hash = "sha256-5L6Rr+X5Z+Ip91z8cpLcatDW1vyEoZa1icL2oMXPXuI=";
-    })
-    (fetchpatch {
-      name = "23_prerequisite_6_cli_lock_add_build_option_to_block_command_line_interface.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=bb65d81fe320e4b20d0a9b32232a7546eb275ecc";
-      hash = "sha256-HxXgtvEhtaIjXbOcxJHNpD9/NVOv3uXPnue7cagEMu8=";
-    })
-    (fetchpatch {
-      name = "23_CVE-2024-49504.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=13febd78db3cd85dcba67d8ad03ad4d42815f11e";
-      hash = "sha256-GejDL9IKbmbSUmp8F1NuvBcFAp2/W04jxmOatI5dKn8=";
-    })
-    (fetchpatch {
-      name = "24_disk_loopback_reference_tracking_for_the_loopback.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=67f70f70a36b6e87a65f928fe1e840a12eafb7ae";
-      hash = "sha256-sWBnSF3rAuY1A/IIK1Pc+BqTvyK3j7+lLEhvImtBQMA=";
-    })
-    (fetchpatch {
-      name = "25_kern_disk_limit_recursion_depth.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=18212f0648b6de7d71d4c8f41eb4d8b78b3a299b";
-      hash = "sha256-HiVzXUNs45Fxh4DSqO8wAxSBM7CaYU/bix0PVBcIHGw=";
-    })
-    (fetchpatch {
-      name = "26_kern_partition_limit_recursion_in_part_iterate.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=8a7103fddfd6664f41081f3bb88eebbf2871da2a";
-      hash = "sha256-Nw1VFRVww1VSDSBkRrnTGeaA2PKCitugM12XH6X/2YI=";
-    })
-    (fetchpatch {
-      name = "27_script_execute_limit_the_recursion_depth.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d8a937ccae5c6d86dc4375698afca5cefdcd01e1";
-      hash = "sha256-YOAdPMZ2iBNMzIwAXFkkyTMKh4ptZUQ0J3v9EjnRlbo=";
-    })
-    (fetchpatch {
-      name = "28_net_unregister_net_default_ip_and_net_default_mac_variables_hooks_on_unload.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=a1dd8e59da26f1a9608381d3a1a6c0f465282b1d";
-      hash = "sha256-7fqdkhFqLECzhz1OLavkHrE9ktDAEmx9ZxZayNr/Eo4=";
-    })
-    (fetchpatch {
-      name = "29_net_remove_variables_hooks_when_interface_is_unregisted.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=aa8b4d7facef7b75a2703274b1b9d4e0e734c401";
-      hash = "sha256-m3VLDbJlwchV5meEpU4LJrDxBtA80qvYcVMJinHLnac=";
-    })
-    (fetchpatch {
-      name = "30_CVE-2025-0624.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5eef88152833062a3f7e017535372d64ac8ef7e1";
-      hash = "sha256-DvhzHnenAmO9SZpi4kU+0GhyKZB4q4xQYuNJgEhJmn0=";
-    })
-    (fetchpatch {
-      name = "31_net_tftp_fix_stack_buffer_overflow_in_tftp_open.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=0707accab1b9be5d3645d4700dde3f99209f9367";
-      hash = "sha256-16NrpWFSE4jFT2uxmJg16jChw8HiGRTol25XQXNQ5l4=";
-    })
-    (fetchpatch {
-      name = "32_CVE-2024-45774.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=2c34af908ebf4856051ed29e46d88abd2b20387f";
-      hash = "sha256-OWmF+fp2TmetQjV4EWMcESW8u52Okkb5C5IPLfczyv4=";
-    })
-    (fetchpatch {
-      name = "33_kern_dl_fix_for_an_integer_overflow_in_grub_dl_ref.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=500e5fdd82ca40412b0b73f5e5dda38e4a3af96d";
-      hash = "sha256-FNqOWo+oZ4/1sCbTi2uaeKchUxwAKXtbzhScezm0yxk=";
-    })
-    # Patch 34 (https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d72208423dcabf9eb4a3bcb17b6b31888396bd49)
-    # is skipped, grub_dl_set_mem_attrs() does not exist on 2.12
-    (fetchpatch {
-      name = "35_kern_dl_check_for_the_SHF_INFO_LINK_flag_in_grub_dl_relocate_symbols.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=98ad84328dcabfa603dcf5bd217570aa6b4bdd99";
-      hash = "sha256-Zi4Pj2NbodL0VhhO5MWhvErb8xmA7Li0ur0MxpgQjzg=";
-    })
-    (fetchpatch {
-      name = "36_CVE-2024-45775.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=05be856a8c3aae41f5df90cab7796ab7ee34b872";
-      hash = "sha256-T6DO8iuImQTP7hPaCAHMtFnheQoCkZ6w+kfNolLPmrY=";
-    })
-    (fetchpatch {
-      name = "37_commands_ls_fix_NULL_dereference.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=0bf56bce47489c059e50e61a3db7f682d8c44b56";
-      hash = "sha256-h5okwqv4ZFahP3ANUbsk1fiSV4pwEnxUExeBgQ4tiTI=";
-    })
-    (fetchpatch {
-      name = "38_CVE-2025-0622.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=2123c5bca7e21fbeb0263df4597ddd7054700726";
-      hash = "sha256-tFE7VgImGZWDICyvHbrI1hqW6/XohgdTmk21MzljMGw=";
-    })
-    (fetchpatch {
-      name = "39_CVE-2025-0622.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=9c16197734ada8d0838407eebe081117799bfe67";
-      hash = "sha256-tTeuEvadKbXVuY0m0dKtTr11Lpb3yQi4zk0bpwrMOeA=";
-    })
-    (fetchpatch {
-      name = "40_CVE-2025-0622.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7580addfc8c94cedb0cdfd7a1fd65b539215e637";
-      hash = "sha256-khRLpWqE7hzzoqssVkGFMjAv09T+uHn13Q9pCpogMms=";
-    })
-    (fetchpatch {
-      name = "41_CVE-2024-45776.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=09bd6eb58b0f71ec273916070fa1e2de16897a91";
-      hash = "sha256-yrl/6XUdKQg/MLe8KFuFoRRbQSyOhDmyvnWBV+sr3EY=";
-    })
-    (fetchpatch {
-      name = "42_CVE-2024-45777.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=b970a5ed967816bbca8225994cd0ee2557bad515";
-      hash = "sha256-Vl5Emw3O3Ba2hD1GCWune4PGduDDPO0gM5u+zx/OwKo=";
-    })
-    (fetchpatch {
-      name = "43_CVE-2025-0690.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=dad8f502974ed9ad0a70ae6820d17b4b142558fc";
-      hash = "sha256-DeWOncndX2VM8w1lb5fd5wHAZrI+ChB5Pj9XbUIfDWY=";
-    })
-    (fetchpatch {
-      name = "44_commands_test_stack_overflow_due_to_unlimited_recursion_depth.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c68b7d23628a19da67ebe2e06f84165ee04961af";
-      hash = "sha256-aputM9KqkB/cK8hBiU9VXbu0LpLNlNCMVIeE9h2pMgY=";
-    })
-    (fetchpatch {
-      name = "45_CVE-2025-1118.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=34824806ac6302f91e8cabaa41308eaced25725f";
-      hash = "sha256-PKQs+fCwj4a9p4hbMqAT3tFNoAOw4xnbKmCwjPUgEOc=";
-    })
-    (fetchpatch {
-      name = "46_commands_memrw_disable_memory_reading_in_lockdown_mode.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=340e4d058f584534f4b90b7dbea2b64a9f8c418c";
-      hash = "sha256-NiMIUnfRreDBw+k4yxUzoRNMFL8pkJhVtkINVgmv5XA=";
-    })
-    (fetchpatch {
-      name = "47_commands_hexdump_disable_memory_reading_in_lockdown_mode.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5f31164aed51f498957cdd6ed733ec71a8592c99";
-      hash = "sha256-NA7QjxZ9FP+WwiOveqLkbZqsF7hULIyaVS3gNaSUXJE=";
-    })
-    (fetchpatch {
-      name = "48_CVE-2024-45778_CVE-2024-45779.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=26db6605036bd9e5b16d9068a8cc75be63b8b630";
-      hash = "sha256-1+ImwkF/qsejWs2lpyO6xbcqVo2NJGv32gjrP8mEPnI=";
-    })
-    (fetchpatch {
-      name = "49_CVE-2025-0677_CVE-2025-0684_CVE-2025-0685_CVE-2025-0686_CVE-2025-0689.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c4bc55da28543d2522a939ba4ee0acde45f2fa74";
-      hash = "sha256-qrlErSImMX8eXJHkXjOe5GZ6lWOya5SVpNoiqyEM1lE=";
-    })
-    (fetchpatch {
-      name = "50_disk_use_safe_math_macros_to_prevent_overflows.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c407724dad6c3e2fc1571e57adbda71cc03f82aa";
-      hash = "sha256-kkAjxXvCdzwqh+oWtEF3qSPiUX9cGWO6eSFVeo7WJzQ=";
-    })
-    (fetchpatch {
-      name = "51_disk_prevent_overflows_when_allocating_memory_for_arrays.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d8151f98331ee4d15fcca59edffa59246d8fc15f";
-      hash = "sha256-2U+gMLigOCCg3P1GB615xQ0B9PDA6j92tt1ba3Tqg+E=";
-    })
-    (fetchpatch {
-      name = "52_disk_check_if_returned_pointer_for_allocated_memory_is_NULL.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=33bd6b5ac5c77b346769ab5284262f94e695e464";
-      hash = "sha256-+BaJRskWP/YVEdvIxMvEydjQx2LpLlGphRtZjiOUxJ0=";
-    })
-    (fetchpatch {
-      name = "53_disk_ieee1275_ofdisk_call_grub_ieee1275_close_when_grub_malloc_fails.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=fbaddcca541805c333f0fc792b82772594e73753";
-      hash = "sha256-9sGA41HlB/8rtT/fMfkDo4ZJMXBSr+EyN92l/0gDfl4=";
-    })
-    (fetchpatch {
-      name = "54_fs_use_safe_math_macros_to_prevent_overflows.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=6608163b08a7a8be4b0ab2a5cd4593bba07fe2b7";
-      excludes = [ "grub-core/fs/erofs.c" ]; # Does not exist on 2.12
-      hash = "sha256-mW4MH5VH5pDxCaFhNh/4mEcYloga56p8vCi7X4kSaek=";
-    })
-    (fetchpatch {
-      name = "55_CVE-2025-0678_CVE-2025-1125.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=84bc0a9a68835952ae69165c11709811dae7634e";
-      hash = "sha256-rCliqM2+k7rTGNpdHFkg3pHvuISjoG0MQr6/8lIvwK4=";
-    })
-    (fetchpatch {
-      name = "56_fs_prevent_overflows_when_assigning_returned_values_from_read_number.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=cde9f7f338f8f5771777f0e7dfc423ddf952ad31";
-      hash = "sha256-dN3HJXNIYtaUZL0LhLabC4VKK6CVC8km9UTw/ln/6ys=";
-    })
-    (fetchpatch {
-      name = "57_fs_zfs_use_safe_math_macros_to_prevent_overflows.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=88e491a0f744c6b19b6d4caa300a576ba56db7c9";
-      hash = "sha256-taSuKyCf9+TiQZcF26yMWpDDQqCfTdRuZTqB9aEz3aA=";
-    })
-    (fetchpatch {
-      name = "58_fs_zfs_prevent_overflows_when_allocating_memory_for_arrays.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7f38e32c7ebeaebb79e2c71e3c7d5ea367d3a39c";
-      hash = "sha256-E5VmP7I4TAEXxTz3j7mi/uIr9kOSzMoPHAYAbyu56Xk=";
-    })
-    (fetchpatch {
-      name = "59_fs_zfs_check_if_returned_pointer_for_allocated_memory_is_NULL.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=13065f69dae0eeb60813809026de5bd021051892";
-      hash = "sha256-1W//rHUspDS+utdNc069J8lX1ONfoBKiJYnUt46C/D0=";
-    })
-    (fetchpatch {
-      name = "60_fs_zfs_add_missing_NULL_check_after_grub_strdup_call.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=dd6a4c8d10e02ca5056681e75795041a343636e4";
-      hash = "sha256-iFLEkz5G6aQ8FXGuY7/wgN4d4o0+sUxWMKYIFcQ/H+o=";
-    })
-    (fetchpatch {
-      name = "61_net_use_safe_math_macros_to_prevent_overflows.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=4beeff8a31c4fb4071d2225533cfa316b5a58391";
-      hash = "sha256-/gs5ZhplQ1h7PWw0p+b5+0OxmRcvDRKWHj39ezhivcg=";
-    })
-    (fetchpatch {
-      name = "62_net_prevent_overflows_when_allocating_memory_for_arrays.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=dee2c14fd66bc497cdc74c69fde8c9b84637c8eb";
-      hash = "sha256-cO02tCGEeQhQF0TmgtNOgUwRLnNgmxhEefo1gtSlFOk=";
-    })
-    (fetchpatch {
-      name = "63_net_check_if_returned_pointer_for_allocated_memory_is_NULL.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=1c06ec900591d1fab6fbacf80dc010541d0a5ec8";
-      hash = "sha256-oSRhWWVraitoVDqGlFOVzdCkaNqFGOHLjJu75CSc388=";
-    })
-    (fetchpatch {
-      name = "64_fs_sfs_check_if_allocated_memory_is_NULL.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=e3c578a56f9294e286b6028ca7c1def997a17b15";
-      hash = "sha256-7tvFbmjWmWmmRykQjMvZV6IYlhSS8oNR7YfaO5XXAfU=";
-    })
-    (fetchpatch {
-      name = "65_script_execute_fix_potential_underflow_and_NULL.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d13b6e8ebd10b4eb16698a002aa40258cf6e6f0e";
-      hash = "sha256-paMWaAIImzxtufUrVF5v4T4KnlDAJIPhdaHznu5CyZ8=";
-    })
-    (fetchpatch {
-      name = "66_osdep_unix_getroot_fix_potential_underflow.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=66733f7c7dae889861ea3ef3ec0710811486019e";
-      hash = "sha256-/14HC1kcW7Sy9WfJQFfC+YnvS/GNTMP+Uy6Dxd3zkwc=";
-    })
-    (fetchpatch {
-      name = "67_misc_ensure_consistent_overflow_error_messages.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=f8795cde217e21539c2f236bcbb1a4bf521086b3";
-      hash = "sha256-4X7wr1Tg16xDE9FO6NTlgkfLV5zFKmajeaOspIqcCuI=";
-    })
-    (fetchpatch {
-      name = "68_bus_usb_ehci_define_GRUB_EHCI_TOGGLE_as_grub_uint32_t.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=9907d9c2723304b42cf6da74f1cc6c4601391956";
-      hash = "sha256-D8xaI8g7ffGGmZqqeS8wxWIFLUWUBfmHwMVOHkYTc2I=";
-    })
-    (fetchpatch {
-      name = "69_normal_menu_use_safe_math_to_avoid_an_integer_overflow.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5b36a5210e21bee2624f8acc36aefd8f10266adb";
-      hash = "sha256-UourmM0Zlaj4o+SnYi5AtjfNujDOt+2ez2XH/uWyiaM=";
-    })
-    (fetchpatch {
-      name = "70_kern_partition_add_sanity_check_after_grub_strtoul_call.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=8e6e87e7923ca2ae880021cb42a35cc9bb4c8fe2";
-      hash = "sha256-4keMUu6ZDKmuSQlFnldV15dDGUibsnSvoEWhLsqWieI=";
-    })
-    (fetchpatch {
-      name = "71_kern_misc_add_sanity_check_after_grub_strtoul_call.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=a8d6b06331a75d75b46f3dd6cc6fcd40dcf604b7";
-      hash = "sha256-2Mpe1sqyuoUPyMAKGZTNzG/ig3G3K8w0gia7lc508Rg=";
-    })
-    (fetchpatch {
-      name = "72_loader_i386_linux_cast_left_shift_to_grub_uint32_t.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=490a6ab71cebd96fae7a1ceb9067484f5ccbec2a";
-      hash = "sha256-e49OC1EBaX0/nWTTXT5xE5apTJPQV0myP5Ohxn9Wwa8=";
-    })
-    (fetchpatch {
-      name = "73_loader_i386_bsd_use_safe_math_to_avoid_underflow.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=4dc6166571645780c459dde2cdc1b001a5ec844c";
-      hash = "sha256-e8X+oBvejcFNOY1Tp/f6QqCDwrgK7f9u1F8SdO/dhy4=";
-    })
-    (fetchpatch {
-      # Fixes 7e2f750f0a (security patch 14/73)
-      name = "fs_ext2_rework_out-of-bounds_read_for_inline_and_external_extents.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=348cd416a3574348f4255bf2b04ec95938990997";
-      hash = "sha256-WBLYQxv8si2tvdPAvbm0/4NNqYWBMJpFV4GC0HhN/kE=";
-    })
-    (fetchpatch {
-      name = "CVE-2025-4382.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c448f511e74cb7c776b314fcb7943f98d3f22b6d";
-      hash = "sha256-64gMhCEW0aYHt46crX/qN/3Hj8MgvWLazgQlVXqe8LE=";
-    })
-    # https://lists.gnu.org/archive/html/grub-devel/2025-11/msg00155.html
-    (fetchpatch {
-      name = "1_commands_test_fix_error_in_recursion_depth_calculation.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=cc9d621dd06bfa12eac511b37b4ceda5bd2f8246";
-      hash = "sha256-GpLpqTKr2ke/YaxnZIO1Kh9wpde44h2mvwcODcAL/nk=";
-    })
-    (fetchpatch {
-      name = "2_CVE-2025-54771.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c4fb4cbc941981894a00ba8e75d634a41967a27f";
-      hash = "sha256-yWowlAMVXdfIyC+BiB00IZvTwIybvaPhxAyz0MPjQuY=";
-    })
-    (fetchpatch {
-      name = "3_CVE-2025-54770.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=10e58a14db20e17d1b6a39abe38df01fef98e29d";
-      hash = "sha256-1ROc5n7sApw7aGr+y8gygFqVkifLdgOD3RPaW9b8aQQ=";
-    })
-    (fetchpatch {
-      name = "4_CVE-2025-61662.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=8ed78fd9f0852ab218cc1f991c38e5a229e43807";
-      hash = "sha256-mG+vcZHbF4duY2YoYAzPBQRHfWvp5Fvgtm0XBk7JqqM=";
-    })
-    (fetchpatch {
-      name = "5_CVE-2025-61663_CVE-2025-61664.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=05d3698b8b03eccc49e53491bbd75dba15f40917";
-      hash = "sha256-kgtXhZmAQpassEf8+RzqkghAzLrCcRoRMMnfunF/0J8=";
-    })
-    (fetchpatch {
-      name = "6_tests_lib_functional_test_unregister_commands_on_module_unload.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=9df1e693e70c5a274b6d60dc76efe2694b89c2fc";
-      hash = "sha256-UzyYkpP7vivx2jzxi7BMP9h9OB2yraswrMW4g9UWsbI=";
-    })
-    (fetchpatch {
-      name = "7_CVE-2025-61661.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=549a9cc372fd0b96a4ccdfad0e12140476cc62a3";
-      hash = "sha256-2mlDoVXY7Upwx4QBeAMOHUtoUlyx1MDDmabnrwK1gEY=";
-    })
-    (fetchpatch {
-      name = "8_commands_usbtest_ensure_string_length_is_sufficient_in_usb_string_processing.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7debdce1e98907e65223a4b4c53a41345ac45e53";
-      hash = "sha256-2ALvrmwxvpjQYjGNrQ0gyGotpk0kgmYlJXMF1xXrnEw=";
-    })
-    # Required to apply the GCC-15 patch
-    (fetchpatch {
-      name = "gnulib_Add_patch_to_allow_GRUB_w_GCC-15_compile_0_1.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=bba7dd7363402157034e9c94ee3d9ea82e37861d";
-      hash = "sha256-KO9rE/9xRkIGi/Y6jv1gVPiAJZUejwaUW6kIWthPUhw=";
-    })
-    # Required to apply the GCC-11 patch
-    (fetchpatch {
-      name = "gnulib_Add_patch_to_allow_GRUB_w_GCC-15_compile_0_2.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=db506b3b83640ab166a782e1ca47c47836afddcd";
-      hash = "sha256-4ucCu+9OZ8NoicLF9hCgUpX4xgJk4Gzu6F3P4zl9J3U=";
-    })
-    # Required to build grub 2.12 with GCC 15
-    (fetchpatch {
-      name = "gnulib_Add_patch_to_allow_GRUB_w_GCC-15_compile_1_2.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=ac1512b872af8567b408518a7efa01607a0219ae";
-      hash = "sha256-deyp6Yatlgv86bYMt7WcWhKg8J6StDPUEy4UPHqJYIc=";
-    })
-    # Required to build grub2_efi with GCC 16, or fails with "error: 'regparm'
-    # attribute ignored [-Werror=attributes]"
-    (fetchpatch {
-      name = "gcc16_make_regparm_attribute_more_conditional.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=9922ed133c2c754ec9f37198da2b3e3e8a4fd5ff";
-      hash = "sha256-V2vffDxL/qQ14YN5scc3CFPBFBWvkh57dc5/hWd/6F4=";
-    })
-  ];
+      /*
+        Fix parallel `msgmerge` race on de.po.
+        See https://gitlab.freedesktop.org/gnu-grub/grub/-/work_items/18
+        See https://github.com/NixOS/nixpkgs/pull/248747#issuecomment-1676301670
+      */
+      (fetchpatch {
+        name = "02_fix_msmerge.patch";
+        url = grubPatch "c2a215245e2e7d61da4f41945222bd761679ae11";
+        hash = "sha256-vBCDej/5DVX1NQMR05kNunxbmfyKywyYQtu4tg3Q2Cs=";
+      })
 
-  postPatch =
-    if kbdcompSupport then
-      ''
-        sed -i util/grub-kbdcomp.in -e 's@\bckbcomp\b@${ckbcomp}/bin/ckbcomp@'
-      ''
-    else
-      ''
-        echo '#! ${runtimeShell}' > util/grub-kbdcomp.in
-        echo 'echo "Compile grub2 with { kbdcompSupport = true; } to enable support for this command."' >> util/grub-kbdcomp.in
-      '';
+      /*
+        The commit that we're reverting below breaks the `kernel.img` payload that's generated at runtime.
+
+        If we don't do this, we can't install GRUB.
+      */
+      (fetchpatch {
+        name = "01_fix_kernel-img_load_offset.patch";
+        url = grubPatch "1dc2986c7e8480d955f87d276d31400116a21fac";
+        hash = "sha256-T1V7Rklc7RNsKTwk2gLoWHxoXUlCM0/mxcnymqUcyRg=";
+      })
+
+      # Required to build grub2_efi with GCC 16, or fails with "error: 'regparm' attribute ignored [-Werror=attributes]"
+      (fetchpatch {
+        name = "gcc16_make_regparm_attribute_more_conditional.patch";
+        url = grubPatch "9922ed133c2c754ec9f37198da2b3e3e8a4fd5ff";
+        hash = "sha256-V2vffDxL/qQ14YN5scc3CFPBFBWvkh57dc5/hWd/6F4=";
+      })
+    ];
+
+  postPatch = ''
+    ${
+      if kbdcompSupport then
+        ''
+          sed -i util/grub-kbdcomp.in -e 's@\bckbcomp\b@${ckbcomp}/bin/ckbcomp@'
+        ''
+      else
+        ''
+          echo '#! ${runtimeShell}' > util/grub-kbdcomp.in
+          echo 'echo "Compile grub2 with { kbdcompSupport = true; } to enable support for this command."' >> util/grub-kbdcomp.in
+        ''
+    }
+
+    GNULIB_REVISION=$(. bootstrap.conf; echo $GNULIB_REVISION)
+    if [ "$GNULIB_REVISION" != ${gnulib.rev} ]; then
+      echo "This version of GRUB requires a different gnulib revision!"
+      echo "We have: ${gnulib.rev}"
+      echo "GRUB needs: $GNULIB_REVISION"
+      exit 1
+    fi
+  '';
 
   depsBuildBuild = [
     buildPackages.stdenv.cc
@@ -615,6 +204,7 @@ stdenv.mkDerivation rec {
     gettext
     freetype
     autoconf
+    autoconf-archive
     automake
     help2man
   ];
@@ -624,6 +214,7 @@ stdenv.mkDerivation rec {
     freetype
     lvm2
     fuse3
+    xz
     libtool
     bash
   ]
@@ -637,36 +228,31 @@ stdenv.mkDerivation rec {
   separateDebugInfo = !xenSupport;
 
   preConfigure = ''
-     for i in "tests/util/"*.in
-     do
-       sed -i "$i" -e's|/bin/bash|${stdenv.shell}|g'
-     done
+    # Trust me, it's NEVER missing.
+    substituteInPlace configure.ac --replace-fail 'm4_ifndef([AX_CHECK_LINK_FLAG], [m4_fatal([autoconf-archive is missing. You must install it to generate the configure script.])])' ' '
 
-     # Apparently, the QEMU executable is no longer called
-     # `qemu-system-i386', even on i386.
-     #
-     # In addition, use `-nodefaults' to avoid errors like:
-     #
-     #  chardev: opening backend "stdio" failed
-     #  qemu: could not open serial device 'stdio': Invalid argument
-     #
-     # See <http://www.mail-archive.com/qemu-devel@nongnu.org/msg22775.html>.
-     sed -i "tests/util/grub-shell.in" \
-         -e's/qemu-system-i386/qemu-system-x86_64 -nodefaults/g'
+    for i in "tests/util/"*.in
+    do
+      sed -i "$i" -e's|/bin/bash|${stdenv.shell}|g'
+    done
 
-    unset CPP # setting CPP intereferes with dependency calculation
+    # Apparently, the QEMU executable is no longer called
+    # `qemu-system-i386', even on i386.
+    #
+    # In addition, use `-nodefaults' to avoid errors like:
+    #
+    #  chardev: opening backend "stdio" failed
+    #  qemu: could not open serial device 'stdio': Invalid argument
+    #
+    # See <http://www.mail-archive.com/qemu-devel@nongnu.org/msg22775.html>.
+    sed -i "tests/util/grub-shell.in" \
+        -e's/qemu-system-i386/qemu-system-x86_64 -nodefaults/g'
 
     patchShebangs .
 
-    GNULIB_REVISION=$(. bootstrap.conf; echo $GNULIB_REVISION)
-    if [ "$GNULIB_REVISION" != ${gnulib.rev} ]; then
-      echo "This version of GRUB requires a different gnulib revision!"
-      echo "We have: ${gnulib.rev}"
-      echo "GRUB needs: $GNULIB_REVISION"
-      exit 1
-    fi
-
     cp -f --no-preserve=mode ${locales}/po/LINGUAS ${locales}/po/*.po po
+    mkdir po/.reference
+    cp -f --no-preserve=mode ${locales}/po/*.po po/.reference
 
     ./bootstrap --no-git --gnulib-srcdir=${gnulib}
 
@@ -679,13 +265,6 @@ stdenv.mkDerivation rec {
     )
   '';
 
-  postConfigure = ''
-    # make sure .po files are up to date to workaround
-    # parallel `msgmerge --update` on autogenerated .po files:
-    #   https://github.com/NixOS/nixpkgs/pull/248747#issuecomment-1676301670
-    make dist
-  '';
-
   configureFlags = [
     "--enable-grub-mount" # dep of os-prober
   ]
@@ -718,6 +297,11 @@ stdenv.mkDerivation rec {
   ++ lib.optionals xenPvhSupport [
     "--with-platform=xen_pvh"
     "--target=${xenPvhSystemsBuild.${stdenv.hostPlatform.system}.target}"
+  ]
+  ++ lib.optionals corebootSupport [
+    "--with-platform=coreboot"
+    "--target=${corebootSystemsBuild.${stdenv.hostPlatform.system}.target}"
+    "--enable-boot-time" # Log boot times. Might be useful for debugging loading issues.
   ];
 
   # save target that grub is compiled for
@@ -726,6 +310,8 @@ stdenv.mkDerivation rec {
       "${efiSystemsInstall.${stdenv.hostPlatform.system}.target}-efi"
     else if ieee1275Support then
       "${ieee1275SystemsBuild.${stdenv.hostPlatform.system}.target}-ieee1275"
+    else if corebootSupport then
+      "${corebootSystemsBuild.${stdenv.hostPlatform.system}.target}-coreboot"
     else
       lib.optionalString inPCSystems "${pcSystems.${stdenv.hostPlatform.system}.target}-pc";
 
@@ -733,11 +319,10 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   postInstall = ''
-    # Avoid a runtime reference to gcc
+    # We have to do this or else closure size balloons up
+
+    patchShebangs $out/lib/grub/*/modinfo.sh
     sed -i $out/lib/grub/*/modinfo.sh -e "/grub_target_cppflags=/ s|'.*'|' '|"
-    # just adding bash to buildInputs wasn't enough to fix the shebang
-    substituteInPlace $out/lib/grub/*/modinfo.sh \
-      --replace ${buildPackages.bash} "/usr/bin/bash"
   '';
 
   passthru.tests = {
@@ -775,6 +360,8 @@ stdenv.mkDerivation rec {
         lib.attrNames xenSystemsBuild
       else if xenPvhSupport then
         lib.attrNames xenPvhSystemsBuild
+      else if corebootSupport then
+        lib.attrNames corebootSystemsBuild
       else
         lib.platforms.gnu ++ lib.platforms.linux;
 
diff --git a/pkgs/by-name/ha/hakuneko/package.nix b/pkgs/by-name/ha/hakuneko/package.nix
index 93a534d2d5b2..bab7e86d7799 100644
--- a/pkgs/by-name/ha/hakuneko/package.nix
+++ b/pkgs/by-name/ha/hakuneko/package.nix
@@ -101,5 +101,8 @@ stdenv.mkDerivation (finalAttrs: {
       "i686-linux"
     ];
     mainProgram = "hakuneko";
+    knownVulnerabilities = [
+      "Uses Electron 6.1.7, which was EOL on February 25, 2020, with many known CVEs"
+    ];
   };
 })
diff --git a/pkgs/by-name/ha/hash_extender/package.nix b/pkgs/by-name/ha/hash_extender/package.nix
index af192e02f956..c88185bcac1e 100644
--- a/pkgs/by-name/ha/hash_extender/package.nix
+++ b/pkgs/by-name/ha/hash_extender/package.nix
@@ -8,13 +8,16 @@
 
 stdenv.mkDerivation {
   pname = "hash_extender";
-  version = "unstable-2020-03-24";
+  version = "0-unstable-2020-03-24";
+
+  strictDeps = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "iagox86";
     repo = "hash_extender";
     rev = "cb8aaee49f93e9c0d2f03eb3cafb429c9eed723d";
-    sha256 = "1fj118566hr1wv03az2w0iqknazsqqkak0mvlcvwpgr6midjqi9b";
+    hash = "sha256-K0UsW6wmv8s3o7uCqSbG+is7cQRcfDXA5iFDYwoKQbo=";
   };
 
   patches = [
diff --git a/pkgs/by-name/in/inav-configurator/package.nix b/pkgs/by-name/in/inav-configurator/package.nix
index ffb5ad7d11e6..a3aaae2f6837 100644
--- a/pkgs/by-name/in/inav-configurator/package.nix
+++ b/pkgs/by-name/in/inav-configurator/package.nix
@@ -79,5 +79,8 @@ stdenv.mkDerivation rec {
       wucke13
     ];
     platforms = lib.platforms.linux;
+    knownVulnerabilities = [
+      "Uses Electron 38.7.2, EOL on 28-Jan-2026, with several known CVEs."
+    ];
   };
 }
diff --git a/pkgs/by-name/ja/jawiki-all-titles-in-ns0/package.nix b/pkgs/by-name/ja/jawiki-all-titles-in-ns0/package.nix
index c478b1d44dec..357480ea6462 100644
--- a/pkgs/by-name/ja/jawiki-all-titles-in-ns0/package.nix
+++ b/pkgs/by-name/ja/jawiki-all-titles-in-ns0/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "jawiki-all-titles-in-ns0";
-  version = "0-unstable-2026-08-01";
+  version = "0-unstable-2026-09-01";
 
   src = fetchFromGitHub {
     owner = "musjj";
     repo = "jawiki-archive";
-    rev = "9d043ec108e2bd63a0f5971826e14b9888d18399";
-    hash = "sha256-rCPD/Y82dvAiCVt2XmX1WwcujIpacCU/Pcyn4zUWg0I=";
+    rev = "5c0d3d609a19361e9ebbe24702da11c8285e278d";
+    hash = "sha256-D4dqdc0xeKPcy0MmfKcK6GEngQOmLg/2H6TuWGyS0i8=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/ke/keeweb/package.nix b/pkgs/by-name/ke/keeweb/package.nix
index e83b9b6863fa..81a5e2511523 100644
--- a/pkgs/by-name/ke/keeweb/package.nix
+++ b/pkgs/by-name/ke/keeweb/package.nix
@@ -76,6 +76,9 @@ let
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ sikmir ];
     platforms = builtins.attrNames srcs;
+    knownVulnerabilities = [
+      "Uses Electron 12, EOL on November 16 2012. Has many known CVEs"
+    ];
   };
 in
 if stdenv.hostPlatform.isDarwin then
diff --git a/pkgs/by-name/ke/keybase-gui/package.nix b/pkgs/by-name/ke/keybase-gui/package.nix
index df4bffcfc302..37f9754616a2 100644
--- a/pkgs/by-name/ke/keybase-gui/package.nix
+++ b/pkgs/by-name/ke/keybase-gui/package.nix
@@ -163,5 +163,8 @@ stdenv.mkDerivation (finalAttrs: {
     ];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.bsd3;
+    knownVulnerabilities = [
+      "Uses Electron 28, EOL on 05 Dec 2023. Has many known CVEs"
+    ];
   };
 })
diff --git a/pkgs/by-name/lc/lcrq/package.nix b/pkgs/by-name/lc/lcrq/package.nix
index 981b7a915f89..af635a242168 100644
--- a/pkgs/by-name/lc/lcrq/package.nix
+++ b/pkgs/by-name/lc/lcrq/package.nix
@@ -5,13 +5,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "lcrq";
-  version = "0.3.1";
+  version = "0.4.0";
 
   src = fetchFromCodeberg {
     owner = "librecast";
     repo = "lcrq";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-hNH5SdvKhNPUJWs7vpPECcBsRyNdHQF+Ot3LmyX2V3c=";
+    hash = "sha256-1kKWg+GN+WrYx7RTjTLqfGt9qcqeh9vc/TyfZMKsH7A=";
   };
 
   installFlags = [ "PREFIX=$(out)" ];
diff --git a/pkgs/by-name/li/libdigidocpp/package.nix b/pkgs/by-name/li/libdigidocpp/package.nix
index 0f9d6d7b4fa5..8ca53895155d 100644
--- a/pkgs/by-name/li/libdigidocpp/package.nix
+++ b/pkgs/by-name/li/libdigidocpp/package.nix
@@ -16,14 +16,14 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "4.5.0";
+  version = "4.5.1";
   pname = "libdigidocpp";
 
   src = fetchFromGitHub {
     owner = "open-eid";
     repo = "libdigidocpp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/RCRYF3G7/0J6oHT4mfapI4tlYLdWlQ2HTVqJGuDm3A=";
+    hash = "sha256-LT2JQwrliec3/tttu0SehhOnO+IL+IOLyk9L1tLsuuw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix b/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix
index e6e69af03db0..f134e082b967 100644
--- a/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix
+++ b/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix
@@ -96,8 +96,8 @@ stdenv.mkDerivation {
     inherit binaryName;
     applicationName = "LibreWolf";
     libName = "librewolf-bin-${version}";
-    ffmpegSupport = true;
-    gssSupport = true;
+    withFFmpeg = true;
+    withGSSAPI = true;
     gtk3 = gtk3;
     updateScript = ./update.sh;
   };
diff --git a/pkgs/by-name/li/librewolf-unwrapped/package.nix b/pkgs/by-name/li/librewolf-unwrapped/package.nix
index 86076f9126aa..8f19e763a723 100644
--- a/pkgs/by-name/li/librewolf-unwrapped/package.nix
+++ b/pkgs/by-name/li/librewolf-unwrapped/package.nix
@@ -15,8 +15,6 @@ in
   binaryName = "librewolf";
   version = librewolf-src.packageVersion;
   src = librewolf-src.firefox;
-  requireSigning = false;
-  allowAddonSideload = true;
   branding = "browser/branding/librewolf";
   inherit (librewolf-src)
     extraConfigureFlags
@@ -52,7 +50,10 @@ in
   };
 }).override
   {
-    crashreporterSupport = false;
+    enableAddonSigning = false;
+    enableAddonSideload = true;
+
+    enableCrashReporter = false;
     # This will set `MOZILLA_OFFICIAL=1`, which is set by the mozconfig upstream, but has to
     # be set manually in our case.
     # This will not override the branding as `branding` is already set to the official
diff --git a/pkgs/development/libraries/libsoup/3.x.nix b/pkgs/by-name/li/libsoup_3/package.nix
similarity index 100%
rename from pkgs/development/libraries/libsoup/3.x.nix
rename to pkgs/by-name/li/libsoup_3/package.nix
diff --git a/pkgs/by-name/li/libvgm/package.nix b/pkgs/by-name/li/libvgm/package.nix
index 9501dc43dc98..cf88c595f1d3 100644
--- a/pkgs/by-name/li/libvgm/package.nix
+++ b/pkgs/by-name/li/libvgm/package.nix
@@ -38,13 +38,13 @@ assert enableTools -> enableAudio && enableEmulation && enableLibplayer;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libvgm";
-  version = "0-unstable-2026-08-18";
+  version = "0-unstable-2026-08-27";
 
   src = fetchFromGitHub {
     owner = "ValleyBell";
     repo = "libvgm";
-    rev = "d4a07d0111527bf5130d0814505a1243136f3962";
-    hash = "sha256-t0/7uorfT+nusRGOv58XNXwZruwyKld7IC+l1q6Ewn8=";
+    rev = "e41ca80220cbcbaac0e7d77bf57c689a395c5f97";
+    hash = "sha256-r2bE8cmSxDab4kOu/8KJHqcICKTmv2uSMvIOaOHuaFc=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/ln/lnd/package.nix b/pkgs/by-name/ln/lnd/package.nix
index e975e1d11aff..fc9a13f49daf 100644
--- a/pkgs/by-name/ln/lnd/package.nix
+++ b/pkgs/by-name/ln/lnd/package.nix
@@ -23,16 +23,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "lnd";
-  version = "0.21.2-beta";
+  version = "0.21.3-beta";
 
   src = fetchFromGitHub {
     owner = "lightningnetwork";
     repo = "lnd";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-8HSKntW0cLkJi4You8gJgXaUoQoevl2zY+mji3fprJI=";
+    hash = "sha256-sz0BSf6QnxGQxLw/8fPNsg9/v742JNMCs+lTWa6lPD0=";
   };
 
-  vendorHash = "sha256-YdrgmzTbxrsW/smmxFBiHQ1jB+cxNgNxPAsrPPS61AU=";
+  vendorHash = "sha256-/TKQLgVCgBF6DLnaXUJCVvOmOXZ3sJUGbyKQGsBi1dE=";
 
   subPackages = [
     "cmd/lncli"
@@ -48,7 +48,6 @@ buildGoModule (finalAttrs: {
     homepage = "https://github.com/lightningnetwork/lnd";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
-      bleetube
       cypherpunk2140
       prusnak
     ];
diff --git a/pkgs/by-name/ma/mago/package.nix b/pkgs/by-name/ma/mago/package.nix
index 0005026fb61c..2eafa7f86b22 100644
--- a/pkgs/by-name/ma/mago/package.nix
+++ b/pkgs/by-name/ma/mago/package.nix
@@ -11,17 +11,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mago";
-  version = "1.47.4";
+  version = "1.47.5";
 
   src = fetchFromGitHub {
     owner = "carthage-software";
     repo = "mago";
     tag = finalAttrs.version;
-    hash = "sha256-Qi1Bz5u/ZDupJz/9ueAwCnJ1hUWIpx1B32dGzcp87Fo=";
+    hash = "sha256-IUz1BrwJnx+VXq89YbuN6kR7CzCZzkTOG1pQQ9+NpA4=";
     forceFetchGit = true; # Does not download all files otherwise
   };
 
-  cargoHash = "sha256-iw9ipn86SjXCdmC5W2naJvaSpYCYb6uNPkKVtA/ZMd4=";
+  cargoHash = "sha256-r9YgTFIBa3HoKEpDH3SLqmXLLd5HNPCznf/mo1si2rw=";
 
   env = {
     # Get openssl-sys to use pkg-config
diff --git a/pkgs/by-name/ma/materialgram/package.nix b/pkgs/by-name/ma/materialgram/package.nix
index d63199543aac..36642598b45d 100644
--- a/pkgs/by-name/ma/materialgram/package.nix
+++ b/pkgs/by-name/ma/materialgram/package.nix
@@ -11,12 +11,12 @@ telegram-desktop.override {
   unwrapped = telegram-desktop.unwrapped.overrideAttrs (
     finalAttrs: previousAttrs: {
       pname = "materialgram-unwrapped";
-      version = "6.7.7.1";
+      version = "7.0.5.1";
 
       src = fetchFromGitHub {
         owner = "kukuruzka165";
         repo = "materialgram";
-        hash = "sha256-Cy0ooQZOhfE+QBaRDblKXhmqYsKJ0TfeHsfJaVLVn8o=";
+        hash = "sha256-OE7TbxFEYzTM2IB7HMokR3a+tsrg4n4cbHmRXPITykI=";
         tag = "v${finalAttrs.version}";
         fetchSubmodules = true;
       };
diff --git a/pkgs/by-name/ma/matrix-alertmanager-receiver/package.nix b/pkgs/by-name/ma/matrix-alertmanager-receiver/package.nix
index e27bcda375e1..8f484dc1e881 100644
--- a/pkgs/by-name/ma/matrix-alertmanager-receiver/package.nix
+++ b/pkgs/by-name/ma/matrix-alertmanager-receiver/package.nix
@@ -8,17 +8,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "matrix-alertmanager-receiver";
-  version = "2026.8.5";
+  version = "2026.8.26";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "metio";
     repo = "matrix-alertmanager-receiver";
     tag = finalAttrs.version;
-    hash = "sha256-0Kh446DWt9UcAuFF0DjMxlNCb+kZOCHs+oCG+BPgsi8=";
+    hash = "sha256-Qlg3IvfTQ0lzPN+m4usRT5SW4IFWXkvG4PRGIhwukcs=";
   };
 
-  vendorHash = "sha256-+6qW0W2cSTMOPJznhGy8sAH8O1GucrwVL/uRj8qUYLQ=";
+  vendorHash = "sha256-AJ5st9AHf2laZI1hdGa0oFsPA8ulSSUFnSyeNttqem0=";
 
   env.CGO_ENABLED = "0";
 
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/models.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/models.py
index ec84383e5f16..56aecb868bb6 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/models.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/models.py
@@ -205,12 +205,17 @@ class Profile:
     name: str
     path: Path
 
+    @classmethod
+    def _is_custom_name(cls, name: str) -> bool:
+        return name != "system"
+
     @classmethod
     def from_arg(cls, name: str) -> Self:
-        match name:
-            case "system":
-                return cls(name, Path("/nix/var/nix/profiles/system"))
-            case _:
-                path = Path("/nix/var/nix/profiles/system-profiles") / name
-                path.parent.mkdir(mode=0o755, parents=True, exist_ok=True)
-                return cls(name, path)
+        if cls._is_custom_name(name):
+            path = Path("/nix/var/nix/profiles/system-profiles") / name
+            return cls(name, path)
+        else:
+            return cls(name, Path("/nix/var/nix/profiles/system"))
+
+    def is_custom(self) -> bool:
+        return self._is_custom_name(self.name)
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
index eb59898b8561..40cd1ad9e345 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
@@ -690,6 +690,15 @@ def set_profile(
             ).strip()
             raise NixOSRebuildError(msg)
 
+    if profile.is_custom():
+        # Using custom profile, the target profile directory may not exist yet,
+        # so we need to create it first
+        run_wrapper(
+            ["mkdir", "-p", profile.path.parent],
+            remote=target_host,
+            elevate=elevate,
+        )
+
     run_wrapper(
         ["nix-env", "-p", profile.path, "--set", path_to_config],
         remote=target_host,
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
index 221067f0bc08..bacfd86ef934 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
@@ -610,7 +610,7 @@ def test_execute_nix_switch_flake(mock_run: Mock, tmp_path: Path) -> None:
 @patch("subprocess.run", autospec=True)
 @patch("uuid.uuid4", autospec=True)
 @patch(get_qualified_name(nr.services.cleanup_ssh), autospec=True)
-def test_execute_nix_switch_build_target_host(
+def test_execute_nix_switch_build_target_host_custom_profile(
     mock_cleanup_ssh: Mock,
     mock_uuid4: Mock,
     mock_run: Mock,
@@ -654,10 +654,12 @@ def test_execute_nix_switch_build_target_host(
             "nixos-config=./configuration.nix",
             "-I",
             "nixpkgs=$HOME/.nix-defexpr/channels/pinned_nixpkgs",
+            "--profile-name",
+            "custom-profile",
         ]
     )
 
-    assert mock_run.call_count == 12
+    assert mock_run.call_count == 13
     mock_run.assert_has_calls(
         [
             call(
@@ -791,6 +793,24 @@ def test_execute_nix_switch_build_target_host(
                 check=True,
                 **DEFAULT_RUN_KWARGS,
             ),
+            call(
+                [
+                    "ssh",
+                    *nr.process.SSH_DEFAULT_OPTS,
+                    "user@target-host",
+                    "--",
+                    "sudo",
+                    "/bin/sh",
+                    "-c",
+                    """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
+                    "sh",
+                    "mkdir",
+                    "-p",
+                    "/nix/var/nix/profiles/system-profiles",
+                ],
+                check=True,
+                **DEFAULT_RUN_KWARGS,
+            ),
             call(
                 [
                     "ssh",
@@ -804,7 +824,7 @@ def test_execute_nix_switch_build_target_host(
                     "sh",
                     "nix-env",
                     "-p",
-                    "/nix/var/nix/profiles/system",
+                    "/nix/var/nix/profiles/system-profiles/custom-profile",
                     "--set",
                     str(config_path),
                 ],
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_models.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_models.py
index fa9a41f93a42..b2bd2702cd6a 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_models.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_models.py
@@ -205,19 +205,21 @@ def test_flake_from_arg(
         ) == m.Flake("/path/to", 'nixosConfigurations."remote-hostname"')
 
 
-@patch("pathlib.Path.mkdir", autospec=True)
-def test_profile_from_arg(mock_mkdir: Mock) -> None:
+def test_profile_from_arg() -> None:
     assert m.Profile.from_arg("system") == m.Profile(
         "system",
         Path("/nix/var/nix/profiles/system"),
     )
-    mock_mkdir.assert_not_called()
 
     assert m.Profile.from_arg("something") == m.Profile(
         "something",
         Path("/nix/var/nix/profiles/system-profiles/something"),
     )
-    mock_mkdir.assert_called_once()
+
+
+def test_profile_is_custom() -> None:
+    assert not m.Profile("system", Path()).is_custom()
+    assert m.Profile("something", Path()).is_custom()
 
 
 def test_grouped_nix_args_flake_build_flags() -> None:
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
index 7917764a6f72..51b4cde3bfe0 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
@@ -749,6 +749,32 @@ def test_set_profile(mock_run: Mock) -> None:
         elevate=e.NO_ELEVATOR,
     )
 
+    mock_run.reset_mock()
+    target_host = m.Remote("user@localhost", [], "ssh")
+
+    n.set_profile(
+        m.Profile("something", profile_path),
+        config_path,
+        target_host=target_host,
+        elevate=e.NO_ELEVATOR,
+    )
+
+    mock_run.assert_has_calls(
+        [
+            call(
+                ["mkdir", "-p", profile_path.parent],
+                remote=target_host,
+                elevate=e.NO_ELEVATOR,
+            ),
+            call(
+                ["nix-env", "-p", profile_path, "--set", config_path],
+                remote=target_host,
+                elevate=e.NO_ELEVATOR,
+            ),
+        ]
+    )
+
+    mock_run.reset_mock()
     mock_run.return_value = CompletedProcess([], 1)
 
     with pytest.raises(m.NixOSRebuildError) as exc:
diff --git a/pkgs/by-name/oi/oidc-agent/package.nix b/pkgs/by-name/oi/oidc-agent/package.nix
index e28f1d15e98b..2f721f059b71 100644
--- a/pkgs/by-name/oi/oidc-agent/package.nix
+++ b/pkgs/by-name/oi/oidc-agent/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "oidc-agent";
-  version = "5.3.6";
+  version = "5.3.8";
 
   src = fetchFromGitHub {
     owner = "indigo-dc";
     repo = "oidc-agent";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GY0YsZJUUDBx1+ivE+h7tRG32qTeAcI7mmh6+zK+1KA=";
+    hash = "sha256-n88PQgFqsYiFwngaz1LGicVszoiepafshZa5/DiNw3I=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ok/okms-cli/package.nix b/pkgs/by-name/ok/okms-cli/package.nix
index cf12c1008ebd..4ded50ddd191 100644
--- a/pkgs/by-name/ok/okms-cli/package.nix
+++ b/pkgs/by-name/ok/okms-cli/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "okms-cli";
-  version = "0.4.4";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "ovh";
     repo = "okms-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-S3A3X1Inrnqf4+Sz7e6mqL+vzrz2huIfvNSV6cV5NIU=";
+    hash = "sha256-mAHhmEB2N4TcW1axzNHtsOOc9mlUJS66CZprKIsrFyg=";
   };
 
-  vendorHash = "sha256-GJG6cZ1FIWUNjDvcuOav7gPrgaKsfEI7U9lkPq+2H7E=";
+  vendorHash = "sha256-/VKa35URUY4K60aN+9saFyzCgCUb0xDDTa8eSXofOtk=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ok/okteto/package.nix b/pkgs/by-name/ok/okteto/package.nix
index 085ec29445aa..13ba7d35d145 100644
--- a/pkgs/by-name/ok/okteto/package.nix
+++ b/pkgs/by-name/ok/okteto/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "okteto";
-  version = "3.22.0";
+  version = "3.23.0";
 
   src = fetchFromGitHub {
     owner = "okteto";
     repo = "okteto";
     tag = finalAttrs.version;
-    hash = "sha256-PuJag9/qQG23mU+TE1LboYF+/1od5nVmgXpAaTJKlIg=";
+    hash = "sha256-P5dHpv2CEoJYr4rj3hQbavlsNNBRBIx4mzE3KhtLTXg=";
   };
 
-  vendorHash = "sha256-zEdhWfbZv088CXN2+3FQdCPcz3lJOf5iJPeublmVJyM=";
+  vendorHash = "sha256-/ZC5p5TAJOD8Wx1MDaI2NMPIL2QLfCeP0+XzdK346vI=";
 
   postPatch = ''
     # Disable some tests that need file system & network access.
diff --git a/pkgs/by-name/or/orbvis/package.nix b/pkgs/by-name/or/orbvis/package.nix
index 6099bb5b8ba5..f845b69b8511 100644
--- a/pkgs/by-name/or/orbvis/package.nix
+++ b/pkgs/by-name/or/orbvis/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "orbvis";
-  version = "0.3.3";
+  version = "0.3.4";
 
   src = fetchFromGitHub {
     owner = "wojciech-graj";
     repo = "orbvis";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-U19kslgAULBBFozK5KUtew6KRsFeJ4+h8bL9cXmnzso=";
+    hash = "sha256-e41CDv86zz+x5LF2JDZuxzgIvhHBM0s2XHoQMHfMRAg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/os/os-prober/package.nix b/pkgs/by-name/os/os-prober/package.nix
index f96434477975..5cbc555ad8fa 100644
--- a/pkgs/by-name/os/os-prober/package.nix
+++ b/pkgs/by-name/os/os-prober/package.nix
@@ -16,14 +16,14 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "1.84";
+  version = "1.85";
   pname = "os-prober";
   src = fetchFromGitLab {
     domain = "salsa.debian.org";
     owner = "installer-team";
     repo = "os-prober";
     rev = finalAttrs.version;
-    sha256 = "sha256-91UTiwg4qIi+aCzAto7tCd5WZFjI15XxR1/hZQ0fUa4=";
+    sha256 = "sha256-JK1+xzbl1EyHZ4E6pmQ5NDbtivZvFySHX+JkWodxyl4=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/ox/oxker/package.nix b/pkgs/by-name/ox/oxker/package.nix
index f05fc246f815..2f0a763c5679 100644
--- a/pkgs/by-name/ox/oxker/package.nix
+++ b/pkgs/by-name/ox/oxker/package.nix
@@ -10,14 +10,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "oxker";
-  version = "0.13.3";
+  version = "0.13.4";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-F/5QkEA4/UFFM3FEiqyBFZQWiIhQokT4VjL5SaKrDIA=";
+    hash = "sha256-W2swVJd/rygvt/q3YqqI1bVMmuitre4k9Zwl9JYZZbs=";
   };
 
-  cargoHash = "sha256-v0EOUIEaAUtcNlkBhFQ1Q/quYdG6+18MT2nnjZ/ApbM=";
+  cargoHash = "sha256-pJAnR0P5/vA9HbljbC3XhQbpiSeq3oBDCCaMuwfzLZ4=";
 
   # See https://github.com/mrjackwills/oxker/issues/73
   checkFlags = lib.optionals stdenv.hostPlatform.isDarwin [
diff --git a/pkgs/by-name/pe/pedantix/package.nix b/pkgs/by-name/pe/pedantix/package.nix
index bc2d6ff37d30..1d17344d7674 100644
--- a/pkgs/by-name/pe/pedantix/package.nix
+++ b/pkgs/by-name/pe/pedantix/package.nix
@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "pedantix";
-  version = "1.1.0";
+  version = "1.2.1";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "Swarsel";
     repo = "pedantix";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6NwpoqHkMMnqDkoJGbjZ47PUx+M4yYDcN5HiTKscw7E=";
+    hash = "sha256-WqCiIOFaVZ6+pVBF+fIZlOEb4N+cHCJZBPQ8Rj2OEh0=";
   };
 
-  cargoHash = "sha256-6U9rnWTVsO1DPp1cEBkRLHjJKcbgNEqXSvzWUC8tWZQ=";
+  cargoHash = "sha256-ay4rANqOby+/VM+JWbXcd0JQCcZuv8TjZv3d9vcFgfI=";
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
diff --git a/pkgs/by-name/pe/pencil/package.nix b/pkgs/by-name/pe/pencil/package.nix
index 917bbaa7a9ed..b68c4797c766 100644
--- a/pkgs/by-name/pe/pencil/package.nix
+++ b/pkgs/by-name/pe/pencil/package.nix
@@ -146,5 +146,8 @@ stdenv.mkDerivation (finalAttrs: {
       mrVanDalo
     ];
     platforms = lib.platforms.linux;
+    knownVulnerabilities = [
+      "Uses Electron 6, EOL in May 2020 with many CVEs"
+    ];
   };
 })
diff --git a/pkgs/by-name/po/popcorntime/package.nix b/pkgs/by-name/po/popcorntime/package.nix
index 3c108c50e007..b32d14d030ad 100644
--- a/pkgs/by-name/po/popcorntime/package.nix
+++ b/pkgs/by-name/po/popcorntime/package.nix
@@ -102,5 +102,8 @@ stdenv.mkDerivation rec {
     license = lib.licenses.gpl3;
     maintainers = with lib.maintainers; [ onny ];
     mainProgram = "popcorntime";
+    knownVulnerabilities = [
+      "Uses vendored Electron 6, EOL on May 18, 2020 with many CVEs"
+    ];
   };
 }
diff --git a/pkgs/by-name/pr/prometheus-snowflake-exporter/package.nix b/pkgs/by-name/pr/prometheus-snowflake-exporter/package.nix
index 85f2e0152755..a5ef45a5913a 100644
--- a/pkgs/by-name/pr/prometheus-snowflake-exporter/package.nix
+++ b/pkgs/by-name/pr/prometheus-snowflake-exporter/package.nix
@@ -10,18 +10,18 @@ buildGoModule (finalAttrs: {
   pname = "prometheus-snowflake-exporter";
   # No tagged release upstream (only a moving `latest` tag), so pin the commit and
   # use nixpkgs' unstable versioning. Bump the date + rev on update.
-  version = "0-unstable-2026-07-02";
+  version = "latest-unstable-2026-08-26";
 
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "snowflake-prometheus-exporter";
-    rev = "d9447d3401aa81b26c091775606c502bf8e2d7cd";
-    hash = "sha256-3yaZ2kk2k5ivUNgRNazYjA38zY4dvsTOrkvftQpCW5A=";
+    rev = "744f67a6217d27d96ea664868cd19fa19595b45c";
+    hash = "sha256-UdMU4Z6dOzsMEuctQJBlkI/MxsCrZ4O092F0HSUTgLc=";
   };
 
-  vendorHash = "sha256-HvlZ5g1LqAoXuFuidmHCMTeFfivqUR2ryAh0hQayxnc=";
+  vendorHash = "sha256-QQKTxRBlx6v5gFOpQccYvMkRzwtjYaemheE3CMyA7W8=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/pr/prometheus-statsd-exporter/package.nix b/pkgs/by-name/pr/prometheus-statsd-exporter/package.nix
index d57e78b68df7..a1a6826cfd30 100644
--- a/pkgs/by-name/pr/prometheus-statsd-exporter/package.nix
+++ b/pkgs/by-name/pr/prometheus-statsd-exporter/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "statsd_exporter";
-  version = "0.28.0";
+  version = "0.31.0";
 
   src = fetchFromGitHub {
     owner = "prometheus";
     repo = "statsd_exporter";
     rev = "v${version}";
-    hash = "sha256-h58yD+jmvUCvYsJqNcBSR1f+5YgDyMbLDd3I0HW9/kA=";
+    hash = "sha256-6t2j8jzvxhtSPzo0QBFqggMiZk/vcKRiWeRhV8jZqjk=";
   };
 
   ldflags =
@@ -29,7 +29,7 @@ buildGoModule rec {
       "-X ${t}.BuildDate=unknown"
     ];
 
-  vendorHash = "sha256-QKDvoctvvdijQ+ZlClqTyJZfDzqAIikAwOQds9+NQIc=";
+  vendorHash = "sha256-iMRqQ77KbOaxSneMRm1ihcqqprxcw/azeyOOyR4Fu0Q=";
 
   meta = {
     description = "Receives StatsD-style metrics and exports them to Prometheus";
diff --git a/pkgs/by-name/pr/proto/package.nix b/pkgs/by-name/pr/proto/package.nix
index c290aae47187..96c9a3629c89 100644
--- a/pkgs/by-name/pr/proto/package.nix
+++ b/pkgs/by-name/pr/proto/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "proto";
-  version = "0.61.0";
+  version = "0.61.2";
 
   src = fetchFromGitHub {
     owner = "moonrepo";
     repo = "proto";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-g2465xAxDaPJzprKTcrI9XLp07dX9t64X+KYzqjERb4=";
+    hash = "sha256-y7utg4vGz7QE2cSwuXQMiz4CFZXFZideoNL1K6ZfFYc=";
   };
 
-  cargoHash = "sha256-ujAmzUDSAXMRKE+hxl80VOVBULYDNRsqYqlOp60ZE4o=";
+  cargoHash = "sha256-epmvqbupsK2PK99ko+7p5RwkGFC25BcOAQ2CGvhtH1c=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     libiconv
diff --git a/pkgs/by-name/pr/proton-pass-cli/package.nix b/pkgs/by-name/pr/proton-pass-cli/package.nix
index 16eb82a64463..f39fae72d43e 100644
--- a/pkgs/by-name/pr/proton-pass-cli/package.nix
+++ b/pkgs/by-name/pr/proton-pass-cli/package.nix
@@ -15,7 +15,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "proton-pass-cli";
-  version = "2.3.2";
+  version = "2.3.3";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -57,15 +57,15 @@ stdenv.mkDerivation (finalAttrs: {
     sources = {
       "aarch64-darwin" = fetchurl {
         url = "https://proton.me/download/pass-cli/${finalAttrs.version}/pass-cli-macos-aarch64";
-        hash = "sha256-+/ierVv7KGbZmdaHDmOnmW3rg/UQAhlDoWCwYw5RbEI=";
+        hash = "sha256-MoFYesnFCuLxYEunXp0dObbeuyIbZabMVvZNYm7ePbw=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://proton.me/download/pass-cli/${finalAttrs.version}/pass-cli-linux-aarch64";
-        hash = "sha256-tgEzTMePTdsSVwjG1kuLUJ5agqM3u4vq0Lwvht2cq/8=";
+        hash = "sha256-nD6F4Q07tjH/43fwY9mWucyaVF0wlxvO31kQ4W0DVCs=";
       };
       "x86_64-linux" = fetchurl {
         url = "https://proton.me/download/pass-cli/${finalAttrs.version}/pass-cli-linux-x86_64";
-        hash = "sha256-+VxrObRdlrZw8knMu1awazoX1FeTV9LQTErGTk/77/c=";
+        hash = "sha256-tbSaiz/Qr4gwwMGXnyjqDJDM7Oc/WQI6i8qCRdS2jak=";
       };
     };
     updateScript = writeShellScript "update-proton-pass-cli" ''
diff --git a/pkgs/by-name/ps/pshash/package.nix b/pkgs/by-name/ps/pshash/package.nix
index 8f7579fe23d1..5055f26c7ea1 100644
--- a/pkgs/by-name/ps/pshash/package.nix
+++ b/pkgs/by-name/ps/pshash/package.nix
@@ -5,12 +5,12 @@
 }:
 haskellPackages.mkDerivation rec {
   pname = "pshash";
-  version = "0.1.16.0";
+  version = "0.1.20.2";
   src = fetchFromGitHub {
     owner = "thornoar";
     repo = "pshash";
     tag = "v${version}";
-    hash = "sha256-3Qe52Hto3Z96b5q9TLz7XB7BzMfdNBd4p8V6dknH6VM=";
+    hash = "sha256-MQPOvVGWD2PeMf84asYlM5toEKJjOzGDrHKyqJTeSgg=";
   };
 
   postPatch = ''
@@ -31,6 +31,7 @@ haskellPackages.mkDerivation rec {
     base
     containers
     directory
+    random
   ];
 
   license = lib.licenses.mit;
diff --git a/pkgs/by-name/ra/rapidcheck/package.nix b/pkgs/by-name/ra/rapidcheck/package.nix
index 880630fa6bd6..9a7830a18f4e 100644
--- a/pkgs/by-name/ra/rapidcheck/package.nix
+++ b/pkgs/by-name/ra/rapidcheck/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rapidcheck";
-  version = "0-unstable-2023-12-14";
+  version = "0-unstable-2026-08-06";
 
   src = fetchFromGitHub {
     owner = "emil-e";
     repo = "rapidcheck";
-    rev = "ff6af6fc683159deb51c543b065eba14dfcf329b";
-    hash = "sha256-Ixz5RpY0n8Un/Pv4XoTfbs40+70iyMbkQUjDqoLaWOg=";
+    rev = "6e8dadfdafa3a74eabb52ead87f8787f72eccd0b";
+    hash = "sha256-AOHG06EVsOOdvyOohP5hsFuEe7yfXuvkEgFHQUVUs0w=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/re/react-native-debugger/package.nix b/pkgs/by-name/re/react-native-debugger/package.nix
deleted file mode 100644
index 21d016e33798..000000000000
--- a/pkgs/by-name/re/react-native-debugger/package.nix
+++ /dev/null
@@ -1,134 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  unzip,
-  cairo,
-  libxtst,
-  libxscrnsaver,
-  libxrender,
-  libxrandr,
-  libxi,
-  libxfixes,
-  libxext,
-  libxdamage,
-  libxcursor,
-  libxcomposite,
-  libx11,
-  libxcb,
-  gdk-pixbuf,
-  fontconfig,
-  pango,
-  atk,
-  at-spi2-atk,
-  at-spi2-core,
-  gtk3,
-  glib,
-  freetype,
-  dbus,
-  nss,
-  nspr,
-  alsa-lib,
-  cups,
-  expat,
-  udev,
-  makeDesktopItem,
-  libdrm,
-  libxkbcommon,
-  libgbm,
-  makeWrapper,
-}:
-
-let
-  rpath = lib.makeLibraryPath [
-    cairo
-    stdenv.cc.cc
-    gdk-pixbuf
-    fontconfig
-    pango
-    atk
-    gtk3
-    glib
-    freetype
-    dbus
-    nss
-    nspr
-    alsa-lib
-    cups
-    expat
-    udev
-    at-spi2-atk
-    at-spi2-core
-    libdrm
-    libxkbcommon
-    libgbm
-
-    libx11
-    libxcursor
-    libxtst
-    libxcb
-    libxext
-    libxi
-    libxdamage
-    libxrandr
-    libxcomposite
-    libxfixes
-    libxrender
-    libxscrnsaver
-  ];
-in
-stdenv.mkDerivation (finalAttrs: {
-  pname = "react-native-debugger";
-  version = "0.14.0";
-  src = fetchurl {
-    url = "https://github.com/jhen0409/react-native-debugger/releases/download/v${finalAttrs.version}/rn-debugger-linux-x64.zip";
-    sha256 = "sha256-RioBe0MAR47M84aavFaTJikGsJtcZDak8Tkg3WtX2l0=";
-  };
-
-  nativeBuildInputs = [
-    makeWrapper
-    unzip
-  ];
-  buildCommand = ''
-    shopt -s extglob
-    mkdir -p $out
-    unzip $src -d $out
-
-    mkdir $out/{lib,bin,share}
-    mv $out/{libEGL,libGLESv2,libvk_swiftshader,libffmpeg}.so $out/lib
-    mv $out/!(lib|share|bin) $out/share
-
-    patchelf \
-      --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
-      --set-rpath ${rpath}:$out/lib \
-      $out/share/react-native-debugger
-
-    wrapProgram $out/share/react-native-debugger \
-      --add-flags --no-sandbox
-
-    ln -s $out/share/react-native-debugger $out/bin/react-native-debugger
-
-    install -Dm644 "${finalAttrs.desktopItem}/share/applications/"* \
-      -t $out/share/applications/
-  '';
-
-  desktopItem = makeDesktopItem {
-    name = "rndebugger";
-    exec = "react-native-debugger";
-    desktopName = "React Native Debugger";
-    genericName = "React Native Debugger";
-    categories = [
-      "Development"
-      "Debugger"
-    ];
-  };
-
-  meta = {
-    homepage = "https://github.com/jhen0409/react-native-debugger";
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    license = lib.licenses.mit;
-    description = "Standalone app based on official debugger of React Native, and includes React Inspector / Redux DevTools";
-    mainProgram = "react-native-debugger";
-    maintainers = [ ];
-  };
-})
diff --git a/pkgs/by-name/re/regclient/package.nix b/pkgs/by-name/re/regclient/package.nix
index cb5ad5dbda68..cf0e04d4f834 100644
--- a/pkgs/by-name/re/regclient/package.nix
+++ b/pkgs/by-name/re/regclient/package.nix
@@ -19,15 +19,15 @@ in
 
 buildGoModule (finalAttrs: {
   pname = "regclient";
-  version = "0.11.5";
+  version = "0.11.6";
 
   src = fetchFromGitHub {
     owner = "regclient";
     repo = "regclient";
     tag = "v${finalAttrs.version}";
-    sha256 = "sha256-tJBnNtuN9BIlGvHekrvziyBu5gFPzbID/09eAoM5VUc=";
+    sha256 = "sha256-GBRqblUXSUVbpI/sQ8UIc/XaRQHZE+S43i/S3zc3vgo=";
   };
-  vendorHash = "sha256-jpXy3ZWj+JoDKU2r7FanKR8nQGIQPAL9GW4g//e5xZs=";
+  vendorHash = "sha256-XU6y15/6VEbV323jKWw2534huQjTxn/qmsyN+qszQxA=";
 
   outputs = [ "out" ] ++ bins;
 
diff --git a/pkgs/by-name/re/replibyte/package.nix b/pkgs/by-name/re/replibyte/package.nix
index ac985daae032..124dd6fdb1c6 100644
--- a/pkgs/by-name/re/replibyte/package.nix
+++ b/pkgs/by-name/re/replibyte/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   rustPlatform,
   fetchFromGitHub,
   pkg-config,
@@ -29,7 +30,17 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   # Fix undefined reference to `__rust_probestack` from wasmer_vm.
   # Define it as a no-op since it's only needed for stack overflow detection.
-  env.RUSTFLAGS = "-C link-arg=-Wl,--defsym,__rust_probestack=0";
+  env.RUSTFLAGS =
+    let
+      linkArgs = [
+        "-Wl"
+      ]
+      ++ lib.optionals stdenv.hostPlatform.isLinux [
+        "--defsym"
+        "__rust_probestack=0"
+      ];
+    in
+    "-C link-arg=${builtins.concatStringsSep "," linkArgs}";
 
   cargoBuildFlags = [ "--all-features" ];
 
diff --git a/pkgs/by-name/ru/ruff/package.nix b/pkgs/by-name/ru/ruff/package.nix
index 731f8fcbda6a..b9bec9e6ea83 100644
--- a/pkgs/by-name/ru/ruff/package.nix
+++ b/pkgs/by-name/ru/ruff/package.nix
@@ -16,7 +16,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ruff";
-  version = "0.16.4";
+  version = "0.16.5";
 
   __structuredAttrs = true;
 
@@ -24,12 +24,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "astral-sh";
     repo = "ruff";
     tag = finalAttrs.version;
-    hash = "sha256-x6fIeDT8J0RVFzNEMm5QfOxcnGImJsJCMUMC+5mDPBI=";
+    hash = "sha256-M9sZjXxW9ig2Wfk8fDafgxsbV/QHM4ESUsONRHJEonE=";
   };
 
   cargoBuildFlags = [ "--package=ruff" ];
 
-  cargoHash = "sha256-kwnSLBK4H/RPUY+Nb08quRe3q9Ke5Sgmdf588b2QfUs=";
+  cargoHash = "sha256-6jY6JbKnlfij+Hao6KSGmiSirQNsBg4zlhk58dV2xcw=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/so/sonar/package.nix b/pkgs/by-name/so/sonar/package.nix
index 1d564007953d..f91650c36ae2 100644
--- a/pkgs/by-name/so/sonar/package.nix
+++ b/pkgs/by-name/so/sonar/package.nix
@@ -8,13 +8,13 @@
 buildGoModule (finalAttrs: {
   __structuredAttrs = true;
   pname = "sonar";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "raskrebs";
     repo = "sonar";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rHc7uYk0Js/hvWntI/Kt4Wq6Pod4T1DnTjAeUDa0fv0=";
+    hash = "sha256-CQtr+22B2a1svX3KnDdGDXQRA1gyYI0uGF8DodvCfPE=";
   };
 
   vendorHash = "sha256-komX1AmHt2NoF1x6xsNa2RFkfVzOXfYEMPhT0zwMxjw=";
diff --git a/pkgs/by-name/sp/speakeasy-cli/package.nix b/pkgs/by-name/sp/speakeasy-cli/package.nix
index 9409cd5ae2fb..91eaf79de0e7 100644
--- a/pkgs/by-name/sp/speakeasy-cli/package.nix
+++ b/pkgs/by-name/sp/speakeasy-cli/package.nix
@@ -11,7 +11,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "speakeasy-cli";
-  version = "1.795.1";
+  version = "1.796.2";
 
   sourceRoot = ".";
   src =
@@ -33,15 +33,15 @@ stdenv.mkDerivation (finalAttrs: {
     sources = {
       "x86_64-linux" = fetchurl {
         url = "https://github.com/speakeasy-api/speakeasy/releases/download/v${finalAttrs.version}/speakeasy_linux_amd64.zip";
-        hash = "sha256-oKLhpMFjWjso7e7hdCdRiXltYVOVLkPvYVESUGsGy9E=";
+        hash = "sha256-5LAlRh0CDzs8eSsxLY8nK2ZazVl9rLZONWywlTOKwTs=";
       };
       "aarch64-darwin" = fetchurl {
         url = "https://github.com/speakeasy-api/speakeasy/releases/download/v${finalAttrs.version}/speakeasy_darwin_arm64.zip";
-        hash = "sha256-T73N3y/OGjEmlU6ehKfid6uxL6wD5bTpInLSM06OZbM=";
+        hash = "sha256-uVVX/6L3ehLnF/rZ9EmIrFhrulvzKxOI5ryBWqN7LtA=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://github.com/speakeasy-api/speakeasy/releases/download/v${finalAttrs.version}/speakeasy_linux_arm64.zip";
-        hash = "sha256-8mhwxAiB3OKJfmL60K0SdLNAhQgx+iBG/1lynGdczTM=";
+        hash = "sha256-n0C/wnGMcn90ECcPqwffMY94UUgdYyR1Wpn+Qj8vtY0=";
       };
     };
     updateScript = writeShellScript "update-speakeasy" ''
diff --git a/pkgs/by-name/su/supercronic/package.nix b/pkgs/by-name/su/supercronic/package.nix
index 39abc955861a..a74c5e590315 100644
--- a/pkgs/by-name/su/supercronic/package.nix
+++ b/pkgs/by-name/su/supercronic/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "supercronic";
-  version = "0.2.48";
+  version = "0.2.49";
 
   src = fetchFromGitHub {
     owner = "aptible";
     repo = "supercronic";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-29VJSC4bdmarniKe9rZVX0+8BTt9tYCbLetXCfx/oec=";
+    hash = "sha256-vjlsww/YEbG/HJaExH86kyciuTNs6583CFIFf2S8Rzk=";
   };
 
-  vendorHash = "sha256-v03ui07OuOGmeaCyW3VrKmtFDpRSanuMAYWNSqojhro=";
+  vendorHash = "sha256-qsxNAMTHEPtLuedEOAnE+BI65uo4iL620mGz0aveFQc=";
 
   excludedPackages = [ "cronexpr/cronexpr" ];
 
diff --git a/pkgs/by-name/tr/trilium-server/package.nix b/pkgs/by-name/tr/trilium-server/package.nix
index e25982d43b7d..0485ece28e54 100644
--- a/pkgs/by-name/tr/trilium-server/package.nix
+++ b/pkgs/by-name/tr/trilium-server/package.nix
@@ -46,7 +46,8 @@ stdenv.mkDerivation {
 
     cp -r ./* "$out/share/trilium-server/"
 
-    rm $out/share/trilium-server/node_modules/better-sqlite3/prebuilds/linuxmusl-x64.node
+    # Unused musl prebuilds confuse autoPatchelfHook (glibc-only).
+    rm -f "$out/share/trilium-server/node_modules/better-sqlite3/prebuilds"/linuxmusl-*.node
 
     makeWrapper "$out/share/trilium-server/node/bin/node" "$out/bin/trilium-server" \
       --chdir "$out/share/trilium-server" \
diff --git a/pkgs/by-name/ty/ty/package.nix b/pkgs/by-name/ty/ty/package.nix
index 4fffcf5b083b..8c0b34999a3e 100644
--- a/pkgs/by-name/ty/ty/package.nix
+++ b/pkgs/by-name/ty/ty/package.nix
@@ -17,7 +17,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ty";
-  version = "0.0.75";
+  version = "0.0.77";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     repo = "ty";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-hzEgbimysGMH+bQoKmTOWZl8DgaW/G1QUkI5T18UMp4=";
+    hash = "sha256-xg62mzRpDSgkehwbxCC3EHKk9xG9UhX0WhPL2aqAZP4=";
   };
 
   # For Darwin platforms, remove the integration test for file notifications,
@@ -39,7 +39,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoBuildFlags = [ "--package=ty" ];
 
-  cargoHash = "sha256-TSvfiHsXyn1MLUwfi+9ZxWH5AqKhkPPU297lL5nL7fI=";
+  cargoHash = "sha256-TsspMKOxq5rh6dNWev297FQYi27n2ncQ1gUx9469WwY=";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = [ rust-jemalloc-sys ];
@@ -72,6 +72,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
     # flaky: unmatched assertion: revealed: Literal[1]
     "--skip=mdtest::generics/pep695/functions.md"
+
+    # flaky: https://github.com/astral-sh/ty/issues/1540
+    # fails with: Indexed project files contains '/build/.tmpOzGFH2/project/bar/baz.py' which was not expected.
+    "--skip=unix::symlink_inside_project"
   ];
 
   nativeInstallCheckInputs = [ versionCheckHook ];
diff --git a/pkgs/development/libraries/unqlite/default.nix b/pkgs/by-name/un/unqlite/package.nix
similarity index 93%
rename from pkgs/development/libraries/unqlite/default.nix
rename to pkgs/by-name/un/unqlite/package.nix
index 8b368b6e6c8f..de260d78c20d 100644
--- a/pkgs/development/libraries/unqlite/default.nix
+++ b/pkgs/by-name/un/unqlite/package.nix
@@ -5,14 +5,14 @@
   cmake,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "unqlite";
   version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "symisc";
     repo = "unqlite";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-HXhI+IEnBBsWzI+EriGqqkJmeyOF+Y/NJzu4rMd0eY0=";
   };
 
@@ -38,5 +38,6 @@ stdenv.mkDerivation rec {
     '';
     maintainers = [ ];
     license = lib.licenses.bsd2;
+    priority = 10;
   };
-}
+})
diff --git a/pkgs/by-name/vi/victoriametrics/package.nix b/pkgs/by-name/vi/victoriametrics/package.nix
index f0361b1f915c..c03666eef1af 100644
--- a/pkgs/by-name/vi/victoriametrics/package.nix
+++ b/pkgs/by-name/vi/victoriametrics/package.nix
@@ -14,13 +14,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "VictoriaMetrics";
-  version = "1.150.0";
+  version = "1.151.0";
 
   src = fetchFromGitHub {
     owner = "VictoriaMetrics";
     repo = "VictoriaMetrics";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-fY8rfWuMk46sNiS+IhQYINxoasmHhUJzBKI2ocROZR8=";
+    hash = "sha256-LMilqB2enkzZr3zLcwnDLojtFV/lcOsXA9EhjiFarqE=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/xd/xdg-desktop-portal-generic/package.nix b/pkgs/by-name/xd/xdg-desktop-portal-generic/package.nix
index a2f604b84519..2ffed1bf60d2 100644
--- a/pkgs/by-name/xd/xdg-desktop-portal-generic/package.nix
+++ b/pkgs/by-name/xd/xdg-desktop-portal-generic/package.nix
@@ -11,13 +11,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "xdg-desktop-portal-generic";
-  version = "0.5.0";
+  version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = "lamco-admin";
     repo = "xdg-desktop-portal-generic";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Owx4GnsVzu16Md0ARQLwkjFN5bCurhS216nguA95EDg=";
+    hash = "sha256-Y7fdAbge1wG8lE0BUBSNGEbz3it2cZ8o80ayUEdFt8M=";
   };
 
   __structuredAttrs = true;
@@ -31,7 +31,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail '/usr/libexec/' '${placeholder "out"}/libexec/'
   '';
 
-  cargoHash = "sha256-m/OdKQNX4ufUBIBg5+dZyr46X9ovgKXMLa5AvdbOQ5Q=";
+  cargoHash = "sha256-3t2w37jqU9iLRZWldnuNZkqE4jreMe+OVl7f3ZHyGXc=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/xq/xq-xml/package.nix b/pkgs/by-name/xq/xq-xml/package.nix
index fcb2c2c6a8c7..ada1f81880b8 100644
--- a/pkgs/by-name/xq/xq-xml/package.nix
+++ b/pkgs/by-name/xq/xq-xml/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "xq";
-  version = "1.5.0";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "sibprogrammer";
     repo = "xq";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LjY+BQUrqjBZD3//4CULMiIbOfJXVB394ac1yT5DPaU=";
+    hash = "sha256-cDZdQ0gmyx3h64l+HlPKj9AJVyKR5EGFPaNU+4xX0pw=";
   };
 
-  vendorHash = "sha256-ILlqmZwC0azNfvC3f5wSV96X7GPy969YUiIYOrFxJmU=";
+  vendorHash = "sha256-ZYZgac2AW7Yjy3wYjh+VXK5Ng7+CBZebn4bUX2lt2sc=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/za/zapret2/package.nix b/pkgs/by-name/za/zapret2/package.nix
index ef985f84db1e..7a93f3302e10 100644
--- a/pkgs/by-name/za/zapret2/package.nix
+++ b/pkgs/by-name/za/zapret2/package.nix
@@ -21,7 +21,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zapret2";
-  version = "1.0.4";
+  version = "1.0.5";
 
   outputs = [
     "out"
@@ -35,7 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "bol-van";
     repo = "zapret2";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-C3TOpbqt805N/aiHO/G9VocwGjOGvxobi/Sfi7ZX38k=";
+    hash = "sha256-hoDUASf2xcpqNaoEGp4HduVbBIVvIo3CuwUJ9tgZ19c=";
     leaveDotGit = true;
     postFetch = ''
       cd "$out"
diff --git a/pkgs/by-name/ze/zenith/package.nix b/pkgs/by-name/ze/zenith/package.nix
index ab062dcb4c43..36d70c8620b5 100644
--- a/pkgs/by-name/ze/zenith/package.nix
+++ b/pkgs/by-name/ze/zenith/package.nix
@@ -8,13 +8,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zenith";
-  version = "0.15.0";
+  version = "0.15.1";
 
   src = fetchFromGitHub {
     owner = "bvaisvil";
     repo = "zenith";
     rev = finalAttrs.version;
-    hash = "sha256-NOQ+LqymP1VQ80up6XR7kBYRfWey82wbDbGkf1NsQhc=";
+    hash = "sha256-kxxavotpejDcWgsP06BmhpCe46tsu8EIPuao9i3RUpg=";
   };
 
   # remove cargo config so it can find the linker on aarch64-linux
@@ -22,7 +22,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rm .cargo/config.toml
   '';
 
-  cargoHash = "sha256-OABHxLLysx/atZBWCMJCcypugzs5OFtRp2KW3dkp2DE=";
+  cargoHash = "sha256-9c1c+DnGLyUpmevEn6H+9oD+aclvYAONaMutyQa7Fbc=";
 
   nativeBuildInputs = [ rustPlatform.bindgenHook ] ++ lib.optional nvidiaSupport makeWrapper;
 
diff --git a/pkgs/development/python-modules/aioghost/default.nix b/pkgs/development/python-modules/aioghost/default.nix
index aa41231e2194..095c126d5c1c 100644
--- a/pkgs/development/python-modules/aioghost/default.nix
+++ b/pkgs/development/python-modules/aioghost/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "aioghost";
-  version = "0.4.24";
+  version = "0.4.26";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TryGhost";
     repo = "aioghost";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5yQ2JL24BJ97xJKJlxod0BNT6gKTsdkFz+s8sM4plBc=";
+    hash = "sha256-Y3Dy+Gtb1u2x286bxScMYVn4D1B0TBCltD8ddeziYic=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/alibabacloud-ecs20140526/default.nix b/pkgs/development/python-modules/alibabacloud-ecs20140526/default.nix
index 777b98d5f535..bdb0236d0680 100644
--- a/pkgs/development/python-modules/alibabacloud-ecs20140526/default.nix
+++ b/pkgs/development/python-modules/alibabacloud-ecs20140526/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "alibabacloud-ecs20140526";
-  version = "7.10.0";
+  version = "7.11.1";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -17,7 +17,7 @@ buildPythonPackage (finalAttrs: {
   src = fetchPypi {
     pname = "alibabacloud_ecs20140526";
     inherit (finalAttrs) version;
-    hash = "sha256-1X48Rz1Fd9ggw7f4eqGJMGJAxtgQ/qF/8hKS9p3gKkk=";
+    hash = "sha256-q9vqFRjbyed8RldEEXGGJe6wlDL/XN6K1LsdPr1zcEU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/alibabacloud-sas20181203/default.nix b/pkgs/development/python-modules/alibabacloud-sas20181203/default.nix
index 11585202a1db..65c60c4feb3b 100644
--- a/pkgs/development/python-modules/alibabacloud-sas20181203/default.nix
+++ b/pkgs/development/python-modules/alibabacloud-sas20181203/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "alibabacloud-sas20181203";
-  version = "9.3.3";
+  version = "10.1.0";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -17,7 +17,7 @@ buildPythonPackage (finalAttrs: {
   src = fetchPypi {
     pname = "alibabacloud_sas20181203";
     inherit (finalAttrs) version;
-    hash = "sha256-Y1xDWiGmjuDkcgF6c031fe5xBO4tA8xUH9DIXBN2oRw=";
+    hash = "sha256-P2S5K15GHzXHgP9krkx51aI2xVwehttmdYL8BN88vQs=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/alibabacloud-vpc20160428/default.nix b/pkgs/development/python-modules/alibabacloud-vpc20160428/default.nix
index d8b6dce29b62..6dc483cd634a 100644
--- a/pkgs/development/python-modules/alibabacloud-vpc20160428/default.nix
+++ b/pkgs/development/python-modules/alibabacloud-vpc20160428/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "alibabacloud-vpc20160428";
-  version = "7.1.6";
+  version = "7.2.0";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -17,7 +17,7 @@ buildPythonPackage (finalAttrs: {
   src = fetchPypi {
     pname = "alibabacloud_vpc20160428";
     inherit (finalAttrs) version;
-    hash = "sha256-EJE/0D1EJdDK6A7FpJo72m/QmkzFwRDUHE90vb6AmYA=";
+    hash = "sha256-7z9ISKULT4/Cjssv7S6jt/qeXXbNNuYCqgwciMethvo=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/androidtvremote2/default.nix b/pkgs/development/python-modules/androidtvremote2/default.nix
index 1ca07612292a..fdccc81750b5 100644
--- a/pkgs/development/python-modules/androidtvremote2/default.nix
+++ b/pkgs/development/python-modules/androidtvremote2/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "androidtvremote2";
-  version = "0.3.1";
+  version = "0.3.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tronikos";
     repo = "androidtvremote2";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-W+L1yQ7FAoKIlYtlM7gfPv8Tco/9hCDDUQQ16xg+++s=";
+    hash = "sha256-zyM9s8gtL0lBGd2hkANZRNsG7BEZv+c7Agexpk80OT0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/azure-keyvault-certificates/default.nix b/pkgs/development/python-modules/azure-keyvault-certificates/default.nix
index 69838c92c21f..b8ef6b88fc71 100644
--- a/pkgs/development/python-modules/azure-keyvault-certificates/default.nix
+++ b/pkgs/development/python-modules/azure-keyvault-certificates/default.nix
@@ -11,13 +11,13 @@
 
 buildPythonPackage rec {
   pname = "azure-keyvault-certificates";
-  version = "4.11.1";
+  version = "4.11.2";
   pyproject = true;
 
   src = fetchPypi {
     pname = "azure_keyvault_certificates";
     inherit version;
-    hash = "sha256-c02aZfqg8r1FueFi0xesrexxBWk06/S7/gWLI9dL0HM=";
+    hash = "sha256-H7wd8a4bm1tJpbWRX4JuwLFmLs/ukJzHV601IIOYv70=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/censys/default.nix b/pkgs/development/python-modules/censys/default.nix
index 5b098bfb3ea1..2a3672bd77e7 100644
--- a/pkgs/development/python-modules/censys/default.nix
+++ b/pkgs/development/python-modules/censys/default.nix
@@ -4,33 +4,32 @@
   backoff,
   buildPythonPackage,
   fetchFromGitHub,
+  hatchling,
   importlib-metadata,
   parameterized,
-  poetry-core,
-  pytest-mock,
   pytest-cov-stub,
+  pytest-mock,
   pytestCheckHook,
-  pythonAtLeast,
-  requests,
   requests-mock,
+  requests,
   responses,
   rich,
   writableTmpDirAsHomeHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "censys";
-  version = "2.2.19";
+  version = "2.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "censys";
     repo = "censys-python";
-    tag = "v${version}";
-    hash = "sha256-3eQtGCIKtjpDWfyrIEPZnA6xLMNl0cg61wh0nuwNwh4=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-GBFsAVecUN49vousqnB6enqRsAg1aBrjaA/Q7XXnOUE=";
   };
 
-  build-system = [ poetry-core ];
+  build-system = [ hatchling ];
 
   dependencies = [
     argcomplete
@@ -55,21 +54,14 @@ buildPythonPackage rec {
     mkdir -p $HOME
   '';
 
-  disabledTests = lib.optionals (pythonAtLeast "3.14") [
-    # argparse usage prefix uses the actual prog (python3.14 -m pytest) instead of sys.argv[0]
-    "test_default_help"
-    "test_help"
-    "test_search_help"
-  ];
-
   pythonImportsCheck = [ "censys" ];
 
   meta = {
     description = "Python API wrapper for the Censys Search Engine (censys.io)";
     homepage = "https://github.com/censys/censys-python";
-    changelog = "https://github.com/censys/censys-python/releases/tag/${src.tag}";
+    changelog = "https://github.com/censys/censys-python/releases/tag/v${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "censys";
   };
-}
+})
diff --git a/pkgs/development/python-modules/django-treenode/default.nix b/pkgs/development/python-modules/django-treenode/default.nix
index e7959e3fce35..b4ba4e79728b 100644
--- a/pkgs/development/python-modules/django-treenode/default.nix
+++ b/pkgs/development/python-modules/django-treenode/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "django-treenode";
-  version = "0.24.0";
+  version = "0.25.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "fabiocaccamo";
     repo = "django-treenode";
     tag = version;
-    hash = "sha256-ZdoFUYgPbfS7ORqd1kVh+XpJetZZ4alEkaVu5jqw5II=";
+    hash = "sha256-MsMNKptwxBNHgW+0juIkJCD8qdXvXzorwL/DnL+FqgQ=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/gflanguages/default.nix b/pkgs/development/python-modules/gflanguages/default.nix
index 8367305b78f9..a5f86b4840cc 100644
--- a/pkgs/development/python-modules/gflanguages/default.nix
+++ b/pkgs/development/python-modules/gflanguages/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "gflanguages";
-  version = "0.7.10";
+  version = "0.7.11";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "googlefonts";
     repo = "lang";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-N7hFJ9qvb+i8j7NKGtJivFnrCKBE4tsvBAclrFBGFiw=";
+    hash = "sha256-skybvMeSP+F3Bz3PJEB7ZIEVhLdwBc8+VemDcC+1FZc=";
   };
 
   # Relax the dependency on protobuf 3. Other packages in the Google Fonts
diff --git a/pkgs/development/python-modules/gftools/default.nix b/pkgs/development/python-modules/gftools/default.nix
index e13b7af1b60e..97b29cc21b3a 100644
--- a/pkgs/development/python-modules/gftools/default.nix
+++ b/pkgs/development/python-modules/gftools/default.nix
@@ -58,14 +58,14 @@ let
 in
 buildPythonPackage rec {
   pname = "gftools";
-  version = "0.9.999";
+  version = "0.9991";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "googlefonts";
     repo = "gftools";
     tag = "v${version}";
-    hash = "sha256-jKd/i0qXzPJNOxzO2Ds3BxP2RDoelNhKutqeaz/yQww=";
+    hash = "sha256-660/sU9aSt1y3iljss82SJT8QTMnVMjjJECIgHA9xso=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/lxmf/default.nix b/pkgs/development/python-modules/lxmf/default.nix
index 4dd76bdccc70..cd15b5ec0e08 100644
--- a/pkgs/development/python-modules/lxmf/default.nix
+++ b/pkgs/development/python-modules/lxmf/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   buildPythonPackage,
-  fetchFromGitHub,
+  fetchPypi,
   # rns optionally depends on lxmf but we can't have two versions of rns in a closure
   propagateRns ? false,
   qrcode,
@@ -12,15 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "lxmf";
-  version = "1.1.0";
+  version = "1.1.1";
   pyproject = true;
   __structuredAttrs = true;
 
-  src = fetchFromGitHub {
-    owner = "markqvist";
-    repo = "lxmf";
-    tag = finalAttrs.version;
-    hash = "sha256-XiBBf9eqW7BWCcRJzgQ0SrItoF9hr33u9nK6VBkSM9Y=";
+  src = fetchPypi {
+    inherit (finalAttrs) version;
+    pname = "lxmf";
+    hash = "sha256-8vfqF9eT/MMsq4JugejpgkQE0CXR/HGxQ74yQtReal4=";
   };
 
   build-system = [ setuptools ];
@@ -45,7 +44,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Lightweight Extensible Message Format for Reticulum";
     homepage = "https://github.com/markqvist/lxmf";
-    changelog = "https://github.com/markqvist/LXMF/releases/tag/${finalAttrs.src.tag}";
+    changelog = "https://github.com/markqvist/LXMF/releases/tag/${finalAttrs.version}";
     license = lib.licenses.reticulum;
     maintainers = with lib.maintainers; [
       drupol
diff --git a/pkgs/development/python-modules/netutils/default.nix b/pkgs/development/python-modules/netutils/default.nix
index 87fc5dbf828d..029426afdf68 100644
--- a/pkgs/development/python-modules/netutils/default.nix
+++ b/pkgs/development/python-modules/netutils/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "netutils";
-  version = "1.18.0";
+  version = "1.19.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "networktocode";
     repo = "netutils";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1pfuuvJ3ze2MYW9IX3oCDZ/VRvuytdl3ZnMQOTjOEOs=";
+    hash = "sha256-5BtrtlwY/V8hFUxUOri8v8j4hd6hF2c7ZWvQEmKdTjM=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/nomadnet/default.nix b/pkgs/development/python-modules/nomadnet/default.nix
index 43aebc2a797f..99c550151d97 100644
--- a/pkgs/development/python-modules/nomadnet/default.nix
+++ b/pkgs/development/python-modules/nomadnet/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "nomadnet";
-  version = "1.2.8";
+  version = "1.3.0";
   pyproject = true;
 
   __structuredAttrs = true;
 
   src = fetchPypi {
     inherit (finalAttrs) version pname;
-    hash = "sha256-6RQsbUIruRc2r+br62GArjRQTst7xrR5R1YFVvjroeE=";
+    hash = "sha256-WbF57unbpvNabzsBgCWJGEodvtuSGUhpPPpw42GTGx4=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pandera/default.nix b/pkgs/development/python-modules/pandera/default.nix
index 790904b129d5..e130e0b03d05 100644
--- a/pkgs/development/python-modules/pandera/default.nix
+++ b/pkgs/development/python-modules/pandera/default.nix
@@ -49,7 +49,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pandera";
-  version = "0.33.0";
+  version = "0.33.1";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -57,7 +57,7 @@ buildPythonPackage (finalAttrs: {
     owner = "unionai-oss";
     repo = "pandera";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QW+od2owqkErtz8fZc+LFVtsVAdMZFtUnR+9eaAXPK4=";
+    hash = "sha256-5sM/iEbv1+ojqwL/E9cVQxJW3u1dlzMQ6iAiKAjV+DI=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/qscintilla/default.nix b/pkgs/development/python-modules/qscintilla/default.nix
index 4e757881f66a..64e10176c298 100644
--- a/pkgs/development/python-modules/qscintilla/default.nix
+++ b/pkgs/development/python-modules/qscintilla/default.nix
@@ -2,25 +2,34 @@
   lib,
   stdenv,
 
-  pythonPackages,
-  qmake,
-  qscintilla,
-  qtbase,
-  qtmacextras ? null,
+  buildPythonPackage,
+  isPy3k,
+  python,
+  pyqt-builder,
+  pyqt5,
+  pyqt6,
+  setuptools,
+  sip,
+
+  libsForQt5,
+  qt6Packages,
+
+  useQt6 ? true,
 }:
 
 let
-  qtVersion = lib.versions.major qtbase.version;
-  pyQtPackage = pythonPackages."pyqt${qtVersion}";
+  qtPackages = if useQt6 then qt6Packages else libsForQt5;
 
-  inherit (pythonPackages)
-    isPy3k
-    python
-    sip
-    pyqt-builder
+  inherit (qtPackages)
+    qmake
+    qscintilla
+    qtbase
     ;
+
+  qtVersion = lib.versions.major qtbase.version;
+  pyQtPackage = if useQt6 then pyqt6 else pyqt5;
 in
-pythonPackages.buildPythonPackage {
+buildPythonPackage {
   # Matches the `name` declared in Python/pyproject-qt${qtVersion}.toml upstream,
   # which is inconsistent between Qt5 ("QScintilla") and Qt6 ("PyQt6-QScintilla").
   pname = if qtVersion == "5" then "qscintilla" else "pyqt${qtVersion}-qscintilla";
@@ -35,7 +44,7 @@ pythonPackages.buildPythonPackage {
     qmake
     pyqt-builder
     qscintilla
-    pythonPackages.setuptools
+    setuptools
   ];
 
   buildInputs = [ qtbase ];
@@ -43,7 +52,7 @@ pythonPackages.buildPythonPackage {
   propagatedBuildInputs = [
     pyQtPackage
   ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [ qtmacextras ];
+  ++ lib.optionals (stdenv.hostPlatform.isDarwin && !useQt6) [ libsForQt5.qtmacextras ];
 
   dontWrapQtApps = true;
 
diff --git a/pkgs/development/tools/pnpm/default.nix b/pkgs/development/tools/pnpm/default.nix
index a02214ecbb3d..973a1b0016bf 100644
--- a/pkgs/development/tools/pnpm/default.nix
+++ b/pkgs/development/tools/pnpm/default.nix
@@ -49,8 +49,8 @@ let
       hash = "sha256-zLXEecqxsAYhMlv+fUyaioAx56Ul1ySeJ17L7IGwjbI=";
     };
     "11" = {
-      version = "11.22.0";
-      hash = "sha256-V6l+byOj+v/AMVOk74x3CgVSYSuGQK6+Ob/dV1TQ69w=";
+      version = "11.25.0";
+      hash = "sha256-M90HSPJ+eRbE8ci2lDRhmD40U7BrvaYxKmKAEwtIgeU=";
     };
   };
 
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 68637ab7b8fc..84c349595f0a 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -5,43 +5,43 @@
         "lts": false
     },
     "6.1": {
-        "version": "6.1.186",
-        "hash": "sha256:0vi3yqvass80jgjw2yc2iz7p4wfqlih2gvjhzxd20j14pwmw7vgf",
+        "version": "6.1.187",
+        "hash": "sha256:0av4fcw3hv4pfql85s2rirxj7hkdr2kdasj219kwl257xa57jvhv",
         "lts": true
     },
     "5.15": {
-        "version": "5.15.219",
-        "hash": "sha256:192ws3mf4hvhawdl6amg7a7q7d68v2ijgjsy1cbq2vy2iiwlyjnh",
+        "version": "5.15.220",
+        "hash": "sha256:08v7mbwvfgy9vv60j2ssdks4ss218p27rkwwrmjch2hj0ljrkcmm",
         "lts": true
     },
     "5.10": {
-        "version": "5.10.268",
-        "hash": "sha256:0fi6a8gbj60ankrx8gcjswv52k93xcjajcb6jihkwx63vfm4s5kv",
+        "version": "5.10.269",
+        "hash": "sha256:1sf6iikwr9rikdi097xplz7yw1jj4cx6ldng7gzp8rj0360icnlw",
         "lts": true
     },
     "6.6": {
-        "version": "6.6.155",
-        "hash": "sha256:10j9cm0jrjjwm8gy8h8nkyj8x3pfhaicj29125qb069c7wkajrsf",
+        "version": "6.6.156",
+        "hash": "sha256:07a1dyaxmcv289r0n4agna2li2rfsjdld8279cs18jmg9r52dqmf",
         "lts": true
     },
     "6.12": {
-        "version": "6.12.107",
-        "hash": "sha256:0yih5s4xbp1hlyfha49z2j3l9x7i5ij335jfl6f6sbfy7yzcby55",
+        "version": "6.12.108",
+        "hash": "sha256:1bxsykj1w8slrn837z05ax8r9d5kkgk5kbjzbngmrm921lhfmlg1",
         "lts": true
     },
     "6.18": {
-        "version": "6.18.48",
-        "hash": "sha256:137wqvcfl8drb4n51hqc2pw4kg0hl5j7fi8wdgy0hmsb1aqsvgay",
+        "version": "6.18.49",
+        "hash": "sha256:14c1l9hbqcjlzfl7bssa43yqsg26sycp5plx4wfnzshz24rnz0mf",
         "lts": true
     },
     "7.1": {
-        "version": "7.1.12",
-        "hash": "sha256:1qaskd7g2pzh32lvfb18qh29hfy3mh2flglh1d9cvr17xnrid5rq",
+        "version": "7.1.13",
+        "hash": "sha256:1mqshj3ldn0md1c0am35skznnq5vmz3fvrr0cqmwwp6bzpx9akb1",
         "lts": false
     },
     "7.2": {
-        "version": "7.2.2",
-        "hash": "sha256:10qd3kllldrw6gbp0wfziy94bgjr98svzzqci3z3xi4q9zhpq3kx",
+        "version": "7.2.3",
+        "hash": "sha256:00yd1rar9dxgdfx1003c9m5bs90bv6da7j2117pwcgmiwzl5k8lb",
         "lts": false
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index 524f23d39352..532c6641863a 100644
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -15,14 +15,14 @@ let
   variants = {
     # ./update-xanmod.sh lts
     lts = {
-      version = "6.18.47";
-      hash = "sha256-FdC/RgaV7p3asZp2skiJKJ4JCx5TI+L4eZxOx2+Pdz0=";
+      version = "6.18.49";
+      hash = "sha256-4kjRCVsj/nE4gfRg8KgagojPFiAVNa9zmAqls9Le6mI=";
       isLTS = true;
     };
     # ./update-xanmod.sh main
     main = {
-      version = "7.1.11";
-      hash = "sha256-Ao0TJVW4PyMHe9HXDRbnFYlz/ikrgNAMiA3K3LAwFeM=";
+      version = "7.1.13";
+      hash = "sha256-6ENhT+sf/e0xd2e0r3adcept7fasxz8SCgrpgzEhxU8=";
     };
   };
 
diff --git a/pkgs/servers/home-assistant/custom-components/blitzortung/package.nix b/pkgs/servers/home-assistant/custom-components/blitzortung/package.nix
index 5600f7edd3fd..3bfaf6033e3d 100644
--- a/pkgs/servers/home-assistant/custom-components/blitzortung/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/blitzortung/package.nix
@@ -10,13 +10,13 @@
 buildHomeAssistantComponent (finalAttrs: {
   owner = "mrk-its";
   domain = "blitzortung";
-  version = "1.7.0";
+  version = "1.7.1";
 
   src = fetchFromGitHub {
     owner = "mrk-its";
     repo = "homeassistant-blitzortung";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8/KIPOmQdaaSFFrjliBBNjboPx8ewzG9/W/grBuex6s=";
+    hash = "sha256-CjO1SeArDYMZyHDNxGGhS26leUEgrpRYiXEWKYdeA7o=";
   };
 
   dependencies = [
diff --git a/pkgs/servers/home-assistant/custom-components/localthings/package.nix b/pkgs/servers/home-assistant/custom-components/localthings/package.nix
index 40aa0fa468fc..e9f6da454062 100644
--- a/pkgs/servers/home-assistant/custom-components/localthings/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/localthings/package.nix
@@ -12,13 +12,13 @@
 buildHomeAssistantComponent (finalAttrs: {
   owner = "mbillow";
   domain = "localthings";
-  version = "0.22.0";
+  version = "0.24.0";
 
   src = fetchFromGitHub {
     owner = "mbillow";
     repo = "localthings";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-fgpSB+/4FXiRmOdYPheLyKkcBa/Ltp902fUQIeOOBog=";
+    hash = "sha256-Qu+mVPUW3P6kghwEfvKGIABEHdgOO9+EATbX5Fqzk28=";
   };
 
   dependencies = [
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 93259ca12a60..35cbb274e051 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1210,6 +1210,7 @@ mapAliases {
   k3s_1_30 = throw "'k3s_1_30' has been removed from nixpkgs as it has reached end of life"; # Added 2025-09-01
   k3s_1_31 = throw "'k3s_1_31' has been removed from nixpkgs as it has reached end of life"; # Added 2025-12-08
   k3s_1_32 = throw "'k3s_1_32' has been removed from nixpkgs as it has reached end of life"; # Added 2026-03-31
+  k3s_1_33 = throw "'k3s_1_33' has been removed from nixpkgs as it has reached end of life"; # Added 2026-08-30
   k4dirstat = throw "'k4dirstat' has been removed due to outdated KF5 dependencies; consider using 'qdirstat' instead."; # Added 2026-05-01
   kaffeine = throw "'kaffeine' has been removed due to outdated KF5 dependencies."; # Added 2026-05-01
   kak-lsp = throw "'kak-lsp' has been renamed to/replaced by 'kakoune-lsp'"; # Converted to throw 2025-10-27
@@ -2163,6 +2164,7 @@ mapAliases {
   rapidjson-unstable = throw "'rapidjson-unstable' has been renamed to/replaced by 'rapidjson'"; # Converted to throw 2025-10-27
   rar2fs = throw "'rar2fs' has been removed as it is unmaintained, and depends on the unmaintained fuse2 library"; # Added 2026-05-19
   raycast-beta = throw "'raycast-beta' has been removed because Raycast 2.0 is out of beta. Use 'raycast' instead."; # Added 2026-08-24
+  react-native-debugger = throw "'react-native-debugger' has been removed as it was unmaintained upstream and vendoring an EOL version of Electron"; # Added 2026-09-02
   react-static = throw "'react-static' has been removed due to lack of maintenance upstream"; # Added 2025-11-04
   recurseIntoAttrs = warnAlias "'recurseIntoAttrs' has been removed from pkgs, use `lib.recurseIntoAttrs` instead" lib.recurseIntoAttrs; # Added 2025-10-30
   redict = throw "'redict' has been removed due to lack of nixpkgs maintenance and a slow upstream development pace. Consider using 'valkey'."; # Added 2025-10-16
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c8001e274397..0316174ed39e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6055,8 +6055,6 @@ with pkgs;
 
   libsigcxx30 = callPackage ../development/libraries/libsigcxx/3.0.nix { };
 
-  libsoup_3 = callPackage ../development/libraries/libsoup/3.x.nix { };
-
   libtorrent-rasterbar = libtorrent-rasterbar-2_0_x;
 
   libubox-nossl = libubox.override { with_ustream_ssl = false; };
@@ -6651,8 +6649,6 @@ with pkgs;
 
   sqlite = lowPrio (callPackage ../development/libraries/sqlite { });
 
-  unqlite = lowPrio (callPackage ../development/libraries/unqlite { });
-
   inherit
     (callPackage ../development/libraries/sqlite/tools.nix {
     })
@@ -8793,7 +8789,6 @@ with pkgs;
   jackmix_jack1 = jackmix.override { jack = jack1; };
 
   inherit (callPackage ../applications/networking/cluster/k3s { })
-    k3s_1_33
     k3s_1_34
     k3s_1_35
     k3s_1_36
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index ad1c1a89e21d..624cbb6d9c27 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -15853,9 +15853,7 @@ self: super: with self; {
     inherit (pkgs) mesa;
   };
 
-  pyqt6-qscintilla = pkgs.qt6Packages.callPackage ../development/python-modules/qscintilla {
-    pythonPackages = self;
-  };
+  pyqt6-qscintilla = callPackage ../development/python-modules/qscintilla { };
 
   pyqt6-sip = callPackage ../development/python-modules/pyqt/pyqt6-sip.nix {
     inherit (pkgs) mesa;
@@ -17611,8 +17609,8 @@ self: super: with self; {
 
   qreactor = callPackage ../development/python-modules/qreactor { };
 
-  qscintilla = pkgs.libsForQt5.callPackage ../development/python-modules/qscintilla {
-    pythonPackages = self;
+  qscintilla = callPackage ../development/python-modules/qscintilla {
+    useQt6 = false;
   };
 
   qstylizer = callPackage ../development/python-modules/qstylizer { };