diff --git a/doc/release-notes/rl-2611.section.md b/doc/release-notes/rl-2611.section.md
index f6d4cabc93c4..ba5cddc4f56d 100644
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@@ -109,6 +109,8 @@
 
 - `buildFHSEnvChroot` has been removed after deprecation in 23.05.
 
+- `leafnode` has been removed, as it was an unmaintained alpha-release of leafnode 2 and has a dependency on the EOL PRCE-library. Consider using `leafnode1` instead, which is still maintained.
+
 - `gh-actions-cache` has been removed since its functionality has been integrated directly into `gh` (`gh cache`). See [upstream readme](https://github.com/actions/gh-actions-cache).
 
 - `requireFile` now sets `meta.license = lib.licenses.unfree` by default. Users of `requireFile`-based derivations that preserve this default will need to explicitly allow their evaluation as described in [](#sec-allow-unfree).
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 4b90c38188dc..89ccec3c26d2 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -7425,6 +7425,12 @@
     githubId = 974130;
     name = "David Pätzel";
   };
+  dpaulat = {
+    email = "dpaulat@gmail.com";
+    name = "Dan Paulat";
+    github = "dpaulat";
+    githubId = 2886605;
+  };
   dpc = {
     email = "dpc@dpc.pw";
     github = "dpc";
@@ -24024,6 +24030,12 @@
     githubId = 12279531;
     name = "Ricardo Guevara";
   };
+  rharish = {
+    email = "harish.rajagopals@gmail.com";
+    github = "rharish101";
+    githubId = 25344287;
+    name = "Harish Rajagopal";
+  };
   rhelmot = {
     name = "Audrey Dutcher";
     github = "rhelmot";
diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index 9aeec853c539..0fe2a5b7287d 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -40,6 +40,8 @@
 
 - [mail-tlsa-check-exporter](https://github.com/ietf-tools/mail-tlsa-check-exporter), validates SMTP / IMAP server certificates against a TLSA record as a Prometheus exporter. Available as [services.prometheus.exporters.mail-tlsa-check](#opt-services.prometheus.exporters.mail-tlsa-check.enable).
 
+- [feishin](https://github.com/jeffvli/feishin), a modern self-hosted music player. Available as [services.feishin](#opt-services.feishin.enable).
+
 - [CastSponsorSkip](https://github.com/gabe565/CastSponsorSkip/), skips YouTube sponsorships (and sometimes ads) on all local Google Cast devices.
 
 - [Stump](https://www.stumpapp.dev/), a free and open source comics, manga and digital book server with OPDS support. Available as [services.stump](#opt-services.stump.enable).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index d02c711b11bd..c33d7a1cbbb1 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1674,6 +1674,7 @@
   ./services/web-apps/engelsystem.nix
   ./services/web-apps/ente.nix
   ./services/web-apps/fediwall.nix
+  ./services/web-apps/feishin.nix
   ./services/web-apps/fider.nix
   ./services/web-apps/filebrowser.nix
   ./services/web-apps/firefly-iii-data-importer.nix
diff --git a/nixos/modules/services/web-apps/feishin.nix b/nixos/modules/services/web-apps/feishin.nix
new file mode 100644
index 000000000000..5ddbd9c8ba87
--- /dev/null
+++ b/nixos/modules/services/web-apps/feishin.nix
@@ -0,0 +1,156 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.feishin;
+in
+{
+  options.services.feishin = {
+    enable = lib.mkEnableOption "the web version of Feishin";
+
+    package = lib.mkPackageOption pkgs "feishin-web" { };
+
+    domain = lib.mkOption {
+      description = "Domain to use for the virtualhost.";
+      type = lib.types.str;
+    };
+
+    pathbase = lib.mkOption {
+      description = "URL path base to use for the virtualhost.";
+      type = lib.types.str;
+      default = "";
+      example = "/music";
+    };
+
+    settings = lib.mkOption {
+      description = ''
+        Configuration for the web version of Feishin, specified as key-value pairs.
+
+        Refer to <https://github.com/jeffvli/feishin#configuration>, and
+        <https://github.com/jeffvli/feishin/blob/development/settings.js.template>
+        for the template.
+      '';
+      type = lib.types.attrsOf lib.types.str;
+      default = {
+        ANALYTICS_DISABLED = "true";
+      };
+      example = {
+        ANALYTICS_DISABLED = "true";
+        SERVER_NAME = "My Server";
+        SERVER_LOCK = "true";
+      };
+    };
+
+    nginx = {
+      enable = lib.mkEnableOption "a virtualhost to serve Feishin through nginx";
+
+      virtualHost = lib.mkOption {
+        description = "Extra configuration for the nginx virtualhost for Feishin.";
+        type = lib.types.submodule (import ../web-servers/nginx/vhost-options.nix { inherit config lib; });
+        default = { };
+        example = lib.literalExpression ''
+          {
+            serverAliases = [ "feishin.''${config.networking.domain}" ];
+          }
+        '';
+      };
+    };
+
+    caddy = {
+      enable = lib.mkEnableOption "a virtualhost to serve Feishin through Caddy";
+
+      virtualHost = lib.mkOption {
+        description = "Extra configuration for the Caddy virtualhost for Feishin.";
+        type = lib.types.submodule (
+          import ../web-servers/caddy/vhost-options.nix { cfg = config.services.caddy; }
+        );
+        default = { };
+        example = lib.literalExpression ''
+          {
+            serverAliases = [ "feishin.''${config.networking.domain}" ];
+          }
+        '';
+      };
+    };
+  };
+
+  config =
+    let
+      resolvedSettings =
+        cfg.settings // lib.optionalAttrs (cfg.pathbase != "") { PUBLIC_PATH = cfg.pathbase; };
+      settingsJs = ''
+        "use strict";
+        ${lib.concatMapAttrsStringSep "\n" (name: value: ''window.${name} = "${value}";'') resolvedSettings}
+      '';
+      settingsJsDir = pkgs.writeTextDir "settings.js" settingsJs;
+    in
+    lib.mkIf cfg.enable {
+      services.nginx = lib.mkIf cfg.nginx.enable {
+        enable = lib.mkDefault true;
+        virtualHosts."${cfg.domain}" = lib.mkMerge [
+          cfg.nginx.virtualHost
+          {
+            root = lib.mkForce "${cfg.package}";
+            extraConfig = ''
+              gzip on;
+              gzip_vary    on;
+              gzip_proxied any;
+              gzip_types   text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;
+            '';
+            locations."${cfg.pathbase}/" = {
+              tryFiles = "$uri $uri/ /index.html =404";
+            };
+            locations."=${cfg.pathbase}/settings.js" = {
+              alias = settingsJsDir + "/settings.js";
+              extraConfig = ''
+                add_header Cache-Control "no-store";
+              '';
+            };
+          }
+        ];
+      };
+
+      services.caddy = lib.mkIf cfg.caddy.enable {
+        enable = lib.mkDefault true;
+        virtualHosts."${cfg.domain}" = lib.mkMerge [
+          cfg.caddy.virtualHost
+          {
+            hostName = lib.mkForce cfg.domain;
+            extraConfig =
+              let
+                baseConfig = ''
+                  encode
+                  handle /settings.js {
+                    header Cache-Control no-store
+                    root ${settingsJsDir}
+                    file_server
+                  }
+                  handle {
+                    root ${cfg.package}
+                    try_files {path} /index.html
+                    file_server
+                  }
+                '';
+              in
+              if (cfg.pathbase == "") then
+                baseConfig
+              else
+                ''
+                  handle_path ${cfg.pathbase}/* {
+                    ${baseConfig}
+                  }
+                '';
+          }
+        ];
+      };
+    };
+
+  meta.maintainers = with lib.maintainers; [
+    rharish
+    BatteredBunny
+  ];
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 9eac63329dff..44add4090727 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -577,6 +577,7 @@ in
   fastnetmon-advanced = runTest ./fastnetmon-advanced.nix;
   fcitx5 = runTest ./fcitx5;
   fedimintd = runTest ./fedimintd.nix;
+  feishin = handleTest ./feishin { };
   ferm = runTest ./ferm.nix;
   ferretdb = import ./ferretdb.nix { inherit pkgs runTest; };
   fider = runTest ./fider.nix;
diff --git a/nixos/tests/feishin/caddy.nix b/nixos/tests/feishin/caddy.nix
new file mode 100644
index 000000000000..1329c5fc3326
--- /dev/null
+++ b/nixos/tests/feishin/caddy.nix
@@ -0,0 +1,36 @@
+import ../make-test-python.nix (
+  { lib, ... }:
+
+  {
+    name = "feishin-caddy";
+    meta.maintainers = with lib.maintainers; [
+      rharish
+      BatteredBunny
+    ];
+
+    nodes.machine =
+      { pkgs, ... }:
+      {
+        services.feishin = {
+          enable = true;
+          domain = "localhost:80";
+          pathbase = "/feishin";
+          settings = {
+            ANALYTICS_DISABLED = "true";
+          };
+          caddy.enable = true;
+          caddy.virtualHost.extraConfig = "tls internal";
+        };
+        # disable letsencrypt cert fetching
+        services.caddy.globalConfig = "auto_https disable_certs";
+      };
+
+    testScript = ''
+      machine.wait_for_unit("caddy.service")
+      machine.wait_for_open_port(80)
+      machine.succeed("curl -vvv --fail --show-error --silent --location --insecure http://localhost/feishin/")
+      assert "<title>Feishin</title>" in machine.succeed("curl --fail --show-error --silent --location --insecure http://localhost/feishin/")
+      assert "window.ANALYTICS_DISABLED = \"true\";" in machine.succeed("curl --fail --show-error --silent --location --insecure http://localhost/feishin/settings.js")
+    '';
+  }
+)
diff --git a/nixos/tests/feishin/default.nix b/nixos/tests/feishin/default.nix
new file mode 100644
index 000000000000..fee30e520c7f
--- /dev/null
+++ b/nixos/tests/feishin/default.nix
@@ -0,0 +1,6 @@
+{ system, pkgs, ... }:
+
+{
+  caddy = import ./caddy.nix { inherit system pkgs; };
+  nginx = import ./nginx.nix { inherit system pkgs; };
+}
diff --git a/nixos/tests/feishin/nginx.nix b/nixos/tests/feishin/nginx.nix
new file mode 100644
index 000000000000..cfeeca40b04f
--- /dev/null
+++ b/nixos/tests/feishin/nginx.nix
@@ -0,0 +1,33 @@
+import ../make-test-python.nix (
+  { lib, ... }:
+
+  {
+    name = "feishin-nginx";
+    meta.maintainers = with lib.maintainers; [
+      rharish
+      BatteredBunny
+    ];
+
+    nodes.machine =
+      { pkgs, ... }:
+      {
+        services.feishin = {
+          enable = true;
+          domain = "localhost";
+          pathbase = "/feishin";
+          settings = {
+            ANALYTICS_DISABLED = "true";
+          };
+          nginx.enable = true;
+        };
+      };
+
+    testScript = ''
+      machine.wait_for_unit("nginx.service")
+      machine.wait_for_open_port(80)
+      machine.succeed("curl -vvv --fail --show-error --silent --location --insecure http://localhost/feishin/")
+      assert "<title>Feishin</title>" in machine.succeed("curl --fail --show-error --silent --location --insecure http://localhost/feishin/")
+      assert "window.ANALYTICS_DISABLED = \"true\";" in machine.succeed("curl --fail --show-error --silent --location --insecure http://localhost/feishin/settings.js")
+    '';
+  }
+)
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index a1bec261a466..1718400411d7 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -3538,6 +3538,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  cocci-syntax = buildVimPlugin {
+    pname = "cocci-syntax";
+    version = "0-unstable-2025-03-19";
+    src = fetchFromGitHub {
+      owner = "ahf";
+      repo = "cocci-syntax";
+      rev = "7399561a3e4a08e0f1dfa5288e2ebf112482816c";
+      hash = "sha256-Oah+00qd5MzTfNOi4daP3ibqtb6PflBaMzn0+QDqsj0=";
+    };
+    meta.homepage = "https://github.com/ahf/cocci-syntax/";
+    meta.license = unfree;
+    meta.hydraPlatforms = [ ];
+  };
+
   coconut-vim = buildVimPlugin {
     pname = "coconut.vim";
     version = "0-unstable-2017-10-10";
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index aee1f1aa5955..5263f5c47efd 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -894,6 +894,12 @@ assertNoAdditions {
     };
   });
 
+  cocci-syntax = super.cocci-syntax.overrideAttrs (old: {
+    meta = old.meta // {
+      license = lib.licenses.vim;
+    };
+  });
+
   codecompanion-history-nvim = super.codecompanion-history-nvim.overrideAttrs {
     dependencies = with self; [
       # transitive dependency for codecompanion-nvim
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index d76b0ecb4dae..e36af0ba88e3 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -251,6 +251,7 @@ https://github.com/neoclide/coc-neco/,,
 https://github.com/coc-extensions/coc-svelte/,,
 https://github.com/iamcco/coc-tailwindcss/,,
 https://github.com/neoclide/coc.nvim/,release,
+https://github.com/ahf/cocci-syntax/,,
 https://github.com/manicmaniac/coconut.vim/,,
 https://github.com/ravitemer/codecompanion-history.nvim/,,
 https://github.com/franco-ruggeri/codecompanion-lualine.nvim/,,
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index db6259d847ca..da80a3543a26 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -396,8 +396,8 @@ let
         mktplcRef = {
           name = "astro-vscode";
           publisher = "astro-build";
-          version = "2.16.17";
-          hash = "sha256-k54hpRlzjtNWv0mIUBKFxJYc5T2jpWxB9U8nuXXmjJ0=";
+          version = "2.16.18";
+          hash = "sha256-kDn4AtjFsdKjbUBg9nvYyXXUWiEqzoSnoxhiDuw8jVY=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/astro-build.astro-vscode/changelog";
@@ -1243,8 +1243,8 @@ let
         mktplcRef = {
           name = "vscode-markdownlint";
           publisher = "DavidAnson";
-          version = "0.61.2";
-          hash = "sha256-RGWgY6pyq7j509UjLD3SSyOOA7cXGFFk95H1hoeKPjA=";
+          version = "0.62.0";
+          hash = "sha256-cupXtTdzTKxhvTEHKe/OU8TFlp1CeAIIy2XCLvLMZ5s=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/DavidAnson.vscode-markdownlint/changelog";
@@ -2015,8 +2015,8 @@ let
         mktplcRef = {
           name = "gitlab-workflow";
           publisher = "gitlab";
-          version = "6.85.3";
-          hash = "sha256-EsQ+95Wo/5F9mEMQ7X36vBgUWlsz5BCOm+7QrGHuepc=";
+          version = "6.85.5";
+          hash = "sha256-WtdTQjDxeI4YLOSQFdrFpdualNizYIQC7HQlsocSt4M=";
         };
         meta = {
           description = "GitLab extension for Visual Studio Code";
@@ -4269,8 +4269,8 @@ let
         mktplcRef = {
           publisher = "shopify";
           name = "ruby-lsp";
-          version = "0.10.4";
-          hash = "sha256-fonAbZ2nvC3Dz/9j4J23hiiJ/xgT8z/LI1HYYQh6u9w=";
+          version = "0.10.6";
+          hash = "sha256-5yEfTSgcSv9SQILOu7hyfNcK+m5IBHKpLDjXXwOZb/I=";
         };
         meta = {
           description = "VS Code plugin for connecting with the Ruby LSP";
diff --git a/pkgs/applications/emulators/libretro/cores/dosbox-pure.nix b/pkgs/applications/emulators/libretro/cores/dosbox-pure.nix
index fe101fa4f1f3..7822a4f70829 100644
--- a/pkgs/applications/emulators/libretro/cores/dosbox-pure.nix
+++ b/pkgs/applications/emulators/libretro/cores/dosbox-pure.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "dosbox-pure";
-  version = "0-unstable-2026-07-15";
+  version = "0-unstable-2026-07-29";
 
   src = fetchFromGitHub {
     owner = "schellingb";
     repo = "dosbox-pure";
-    rev = "a4a0bab7f8931433588f2fcad9045c85b277373d";
-    hash = "sha256-sniDrr5kSU/OnoE08WXNmTTstfI6cHyq4I7xjtrM+7c=";
+    rev = "7f6e8fb7385fa446d1444d671063268520bf9b54";
+    hash = "sha256-w1LSyDvUPo5Owa0JCtXkEmdlqIzrk1pnpuwOlncMYJc=";
   };
 
   hardeningDisable = [ "format" ];
diff --git a/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix b/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix
index e02fd2ef0eab..ff8a51e8043b 100644
--- a/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix
+++ b/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "genesis-plus-gx";
-  version = "0-unstable-2026-07-10";
+  version = "0-unstable-2026-07-27";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "Genesis-Plus-GX";
-    rev = "fa4dca561e08d5be9077419f7b255e1da213ed21";
-    hash = "sha256-FfO5LzCH0hYqiVpE2qPJhX4gOrXqqYCoW4XRbz93La4=";
+    rev = "f687c49dc4b825101f26a483b222620686616b78";
+    hash = "sha256-CztdCuoNIGzpntWmdFmWaTv4TGbo3PdRiH57UMp785M=";
   };
 
   meta = {
diff --git a/pkgs/applications/emulators/libretro/cores/mame2000.nix b/pkgs/applications/emulators/libretro/cores/mame2000.nix
index f8a651a68410..90a62b154f71 100644
--- a/pkgs/applications/emulators/libretro/cores/mame2000.nix
+++ b/pkgs/applications/emulators/libretro/cores/mame2000.nix
@@ -6,13 +6,13 @@
 }:
 mkLibretroCore {
   core = "mame2000";
-  version = "0-unstable-2026-06-15";
+  version = "0-unstable-2026-07-28";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "mame2000-libretro";
-    rev = "131ae96d72a613451517fa2eca0b598b2b266a94";
-    hash = "sha256-fbOGMebiqckcwPk81YrdSHwti6qrLSxB3qYSY8SEqRs=";
+    rev = "f099ba44c7664906fd7e01cbed89d13a7e32dee1";
+    hash = "sha256-6DhPtvN8CzZl+jJ2ygQdvIJjvjA5Bqjho6KWGyJvOwQ=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/emulators/libretro/cores/mgba.nix b/pkgs/applications/emulators/libretro/cores/mgba.nix
index e7009525f8db..dd4ba6c236de 100644
--- a/pkgs/applications/emulators/libretro/cores/mgba.nix
+++ b/pkgs/applications/emulators/libretro/cores/mgba.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mgba";
-  version = "0-unstable-2026-04-03";
+  version = "0-unstable-2026-07-28";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "mgba";
-    rev = "6dce57eef127dc4cc292644f38196e0e7c58590c";
-    hash = "sha256-sLxQ7NG5ypSQACo1Q/9/FwQKCpZsIU0Y35dLa8uhOVs=";
+    rev = "32de792178a3662cd0402c8568fccfaad4a764a1";
+    hash = "sha256-Wz2qr657sF7D9R2jkHJLLs1BHkoKxYXd2rUAbroY5Rw=";
   };
 
   meta = {
diff --git a/pkgs/applications/emulators/libretro/cores/opera.nix b/pkgs/applications/emulators/libretro/cores/opera.nix
index e1d168a73376..766f34035a01 100644
--- a/pkgs/applications/emulators/libretro/cores/opera.nix
+++ b/pkgs/applications/emulators/libretro/cores/opera.nix
@@ -6,13 +6,13 @@
 }:
 mkLibretroCore {
   core = "opera";
-  version = "0-unstable-2026-07-23";
+  version = "0-unstable-2026-07-27";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "opera-libretro";
-    rev = "74dd2a8c6319678ffce9f31bdf36279db5681762";
-    hash = "sha256-NHXOfKItLkQJ0/jH1gLBpLFqOKBB8qgH5gMw7j1YoLw=";
+    rev = "0e9562eb2e2628fb4fc5d7180fd7125631da7fd4";
+    hash = "sha256-yz1pOn8S8l4FeMXOpaqdBnZETcr1iKFTOcCTyNEjVS8=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/emulators/libretro/cores/pokemini.nix b/pkgs/applications/emulators/libretro/cores/pokemini.nix
index 7148b40ec13f..c23b86b4a056 100644
--- a/pkgs/applications/emulators/libretro/cores/pokemini.nix
+++ b/pkgs/applications/emulators/libretro/cores/pokemini.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "pokemini";
-  version = "0-unstable-2026-04-20";
+  version = "0-unstable-2026-07-31";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "PokeMini";
-    rev = "bb009b1379ad15f1514f20ca7cbf710b4af42b3e";
-    hash = "sha256-iXHUk0gWciJCKfbfIa2pOBPIOeKg1yRahNKesLRC8v8=";
+    rev = "132111b76343559860532a1ccc094f93f1ed5650";
+    hash = "sha256-Gyany/aEzDlhLM/zowsOU8LLI4FdWEQ83B+mxHX56UI=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/networking/cluster/helm/plugins/helm-diff.nix b/pkgs/applications/networking/cluster/helm/plugins/helm-diff.nix
index 7000d9505809..32d89a2d9824 100644
--- a/pkgs/applications/networking/cluster/helm/plugins/helm-diff.nix
+++ b/pkgs/applications/networking/cluster/helm/plugins/helm-diff.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "helm-diff";
-  version = "3.15.10";
+  version = "3.15.11";
 
   src = fetchFromGitHub {
     owner = "databus23";
     repo = "helm-diff";
     rev = "v${version}";
-    hash = "sha256-c0sbFd19cDGm7VJbbfT+FKzUbeyAO1kCgh1eYV11C3I=";
+    hash = "sha256-h3q0YZQCP+TO5xXSLduAo0cLq3zGo+x3PyvwaZkKoOI=";
   };
 
-  vendorHash = "sha256-GanQBm/g+PcMHaXA5gAaqacpOuv6kES6ng/CmH8/0j4=";
+  vendorHash = "sha256-TZ+S1URJP6+R3mOFqisz4Uyhy1cJHw6yCotBOMMdStM=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index cee8608c3cff..3b4038913926 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -292,13 +292,13 @@
     "vendorHash": "sha256-frrFEPGmvem2qQSpPn9fG5hUITa2k5fQ0NHfm65ehfI="
   },
   "datadrivers_nexus": {
-    "hash": "sha256-gwExaFhOoJFrAhH91oZEp1AFvI7kgWekp655zd4tyd8=",
+    "hash": "sha256-t9hpZ4COmMPvs4TgcZLeuOA23oD5vvHw8UVK7SpzI0Y=",
     "homepage": "https://registry.terraform.io/providers/datadrivers/nexus",
     "owner": "datadrivers",
     "repo": "terraform-provider-nexus",
-    "rev": "v2.8.0",
+    "rev": "v3.0.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-2nNvLu2jicDUxiIi53qxtc6rvZQ+IEtW+LbRPYChfQE="
+    "vendorHash": "sha256-DXQ8bfDLI0Wt2UXXeRXaZkgLXoYKjJ6MMNeTbZctD6E="
   },
   "denoland_deno": {
     "hash": "sha256-7IvJrhXMeAmf8e21QBdYNSJyVMEzLpat4Tm4zHWglW8=",
@@ -1139,13 +1139,13 @@
     "vendorHash": "sha256-WpI4OZ7BUVgHwQY+7ct+K6CnwXFFuiRbI+iTFSJ8a5A="
   },
   "rootlyhq_rootly": {
-    "hash": "sha256-uxEqnGPJPUHhD2qtT9BR34/x6xSN5cZcW0JvH8fKfT0=",
+    "hash": "sha256-yKcXSVWb1oXXojnZxlVAWLueP6JqW+M0ShpuisyBE8I=",
     "homepage": "https://registry.terraform.io/providers/rootlyhq/rootly",
     "owner": "rootlyhq",
     "repo": "terraform-provider-rootly",
-    "rev": "v5.17.2",
+    "rev": "v5.18.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-CndTtUfv1NWZd1sgfGq+e4lPm68aQuqwo55KzmdgXeI="
+    "vendorHash": "sha256-1ZuYmpnvRD3DI9h6RwaRa171QRKWY9DpAZyVRRXJJlY="
   },
   "rundeck_rundeck": {
     "hash": "sha256-g8unbz8+UGLiAOJju6E2bLkygvZgHkv173PdMDefmrc=",
diff --git a/pkgs/build-support/dlang/builddubpackage/import-dub-lock.nix b/pkgs/build-support/dlang/builddubpackage/import-dub-lock.nix
index 121d21df9d99..3c7c2279a0e3 100644
--- a/pkgs/build-support/dlang/builddubpackage/import-dub-lock.nix
+++ b/pkgs/build-support/dlang/builddubpackage/import-dub-lock.nix
@@ -41,6 +41,7 @@ let
       src = fetchgit {
         url = repository;
         rev = version;
+        fetchSubmodules = true; # this is the default, but let's be explicit
         inherit sha256;
       };
     };
diff --git a/pkgs/build-support/dlang/dub-to-nix/dub-to-nix.py b/pkgs/build-support/dlang/dub-to-nix/dub-to-nix.py
index 879acc5f4acb..78073aff504c 100755
--- a/pkgs/build-support/dlang/dub-to-nix/dub-to-nix.py
+++ b/pkgs/build-support/dlang/dub-to-nix/dub-to-nix.py
@@ -57,7 +57,7 @@ for pname in depsDict:
         repository = depDict["repository"]
         strippedRepo = repository[4:]
         eprint(f"Fetching {pname}@{version} ({strippedRepo})")
-        command = ["nix-prefetch-git", strippedRepo, version]
+        command = ["nix-prefetch-git", "--fetch-submodules", strippedRepo, version]
         rawRes = subprocess.run(command, check=True, text=True, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL).stdout
         sha256 = json.loads(rawRes)["sha256"]
         lockedDepsDict[pname] = {"version": version, "repository": strippedRepo, "sha256": sha256}
diff --git a/pkgs/by-name/ab/ab-av1/package.nix b/pkgs/by-name/ab/ab-av1/package.nix
index 63c70c0afbb2..1920f5327c8f 100644
--- a/pkgs/by-name/ab/ab-av1/package.nix
+++ b/pkgs/by-name/ab/ab-av1/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ab-av1";
-  version = "0.11.4";
+  version = "0.11.5";
 
   src = fetchFromGitHub {
     owner = "alexheretic";
     repo = "ab-av1";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-830STu0YfEhsYr4EU3ATF6kgH5J/tUEhm4b47VOwMEQ=";
+    hash = "sha256-jXtl/V0cwugrUQ4Iz1Mx6zMeCpm0FaRTYDRIXHnKTOA=";
   };
 
-  cargoHash = "sha256-mKtP+QoG0MjbBB4kMLlioyxshlgVyhqLH4C5GKx9Hes=";
+  cargoHash = "sha256-XOXzWawdeGO5oqNlBOx0ZzMpdVTVidfak6AcfiZLFKY=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/ab/abracadabra/package.nix b/pkgs/by-name/ab/abracadabra/package.nix
index 822e4435e096..d4a7d3e76b75 100644
--- a/pkgs/by-name/ab/abracadabra/package.nix
+++ b/pkgs/by-name/ab/abracadabra/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "abracadabra";
-  version = "4.1.1";
+  version = "4.2.0";
 
   src = fetchFromGitHub {
     owner = "KejPi";
     repo = "AbracaDABra";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6MraWIon5bqLmqwLodZXys4Lz+kamFhIa03+eVsApqk=";
+    hash = "sha256-TuOqTVBJSuZyA53UETR383md4LjqQx1FL/qRZwXOCRs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ad/adscan/package.nix b/pkgs/by-name/ad/adscan/package.nix
index 7cf5a8c46657..a62fe9855b1b 100644
--- a/pkgs/by-name/ad/adscan/package.nix
+++ b/pkgs/by-name/ad/adscan/package.nix
@@ -7,7 +7,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "adscan";
-  version = "9.2.1";
+  version = "10.1.0";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -16,7 +16,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "ADScanPro";
     repo = "adscan";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gBlS5co1LUu07Xz+JZWi4zNOPtPHGfl+StpFPauOFG4=";
+    hash = "sha256-ITOfDt4T927fYdIiVzkowb4JWU4VTpsApdCpwWLLkK0=";
   };
 
   pythonRelaxDeps = [ "credsweeper" ];
diff --git a/pkgs/by-name/an/ani-cli/package.nix b/pkgs/by-name/an/ani-cli/package.nix
index 3df8eff5aec4..5692284ddc5e 100644
--- a/pkgs/by-name/an/ani-cli/package.nix
+++ b/pkgs/by-name/an/ani-cli/package.nix
@@ -5,13 +5,12 @@
   lib,
   gnugrep,
   gnused,
-  curl,
+  curl-impersonate,
   catt,
   syncplay,
-  openssl,
   ffmpeg,
   fzf,
-  aria2,
+  yt-dlp,
   mpv,
   vlc,
   iina,
@@ -39,17 +38,19 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ makeWrapper ];
   runtimeInputs = [
-    openssl
     gnugrep
     gnused
-    curl
+    curl-impersonate
     fzf
     ffmpeg
-    aria2
+    yt-dlp
   ]
   ++ lib.optional chromecastSupport catt
   ++ lib.optional syncSupport syncplay;
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/by-name/ap/apko/package.nix b/pkgs/by-name/ap/apko/package.nix
index dc213d4ae94b..611491298716 100644
--- a/pkgs/by-name/ap/apko/package.nix
+++ b/pkgs/by-name/ap/apko/package.nix
@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "apko";
-  version = "1.2.27";
+  version = "1.2.30";
 
   src = fetchFromGitHub {
     owner = "chainguard-dev";
     repo = "apko";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yu7DGFscciEVRshiUYHNo9QEggljbSOFLX/dl2LYsFU=";
+    hash = "sha256-uNUzlPuk2HD7O4ENnQ01u9h2U0PbP3a4XiYYvVuksqo=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -29,7 +29,7 @@ buildGoModule (finalAttrs: {
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  vendorHash = "sha256-4aQAnmmnwEPAZE/ph/xyQWcW+thfVX42dpFQq296Hf4=";
+  vendorHash = "sha256-HZrL3K1gbg5fXp0yrfXxgZ780qTGJJ2bpZ7Y//EhOqo=";
 
   excludedPackages = [
     "internal/gen-jsonschema"
diff --git a/pkgs/by-name/as/astc-encoder/package.nix b/pkgs/by-name/as/astc-encoder/package.nix
index 290c4fe82122..be3be3e3ed9b 100644
--- a/pkgs/by-name/as/astc-encoder/package.nix
+++ b/pkgs/by-name/as/astc-encoder/package.nix
@@ -47,13 +47,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "astc-encoder";
-  version = "5.6.0";
+  version = "5.7.0";
 
   src = fetchFromGitHub {
     owner = "ARM-software";
     repo = "astc-encoder";
     tag = finalAttrs.version;
-    hash = "sha256-2/3m5G7rMoc/qZ9wPN3kn7O/CdQbWnKyU5OvAIxx97A=";
+    hash = "sha256-g/XuCBs07G8Tpod6be8lQ5A8Jh52JUzrstrToAgT2ag=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/au/audiobookshelf/package.nix b/pkgs/by-name/au/audiobookshelf/package.nix
index d3ca939b161a..0999eb5d8094 100644
--- a/pkgs/by-name/au/audiobookshelf/package.nix
+++ b/pkgs/by-name/au/audiobookshelf/package.nix
@@ -70,6 +70,8 @@ buildNpmPackage {
   npmInstallFlags = [ "--only-production" ];
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/opt/client
     cp -r index.js server package* node_modules $out/opt/
     cp -r ${client}/lib/node_modules/audiobookshelf-client/dist $out/opt/client/dist
@@ -79,6 +81,8 @@ buildNpmPackage {
     echo "  exec ${nodejs_22}/bin/node $out/opt/index.js" >> $out/bin/audiobookshelf
 
     chmod +x $out/bin/audiobookshelf
+
+    runHook postInstall
   '';
 
   passthru = {
diff --git a/pkgs/by-name/ba/balena-compose-parser/package.nix b/pkgs/by-name/ba/balena-compose-parser/package.nix
index 666701c6b78d..db1048f21518 100644
--- a/pkgs/by-name/ba/balena-compose-parser/package.nix
+++ b/pkgs/by-name/ba/balena-compose-parser/package.nix
@@ -6,13 +6,13 @@
 buildGoModule rec {
   __structuredAttrs = true;
   pname = "balena-compose-parser";
-  version = "0.2.6";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "balena-io-modules";
     repo = "balena-compose-parser";
     rev = "v${version}";
-    hash = "sha256-Bpcj3a689CjXmcjccyBzg30bj4+YT2FCvDvnpIy+EdY=";
+    hash = "sha256-VOFSdcygi3YlRlV48zV1fGtRgFSio2KBZCs25iqBmLY=";
   };
 
   modRoot = "lib";
diff --git a/pkgs/by-name/bb/bbot/package.nix b/pkgs/by-name/bb/bbot/package.nix
index 86132aedd05e..ad1247308885 100644
--- a/pkgs/by-name/bb/bbot/package.nix
+++ b/pkgs/by-name/bb/bbot/package.nix
@@ -6,12 +6,12 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "bbot";
-  version = "2.8.6";
+  version = "3.0.1";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-u8F995BD1l6nPWYckMIYSgErSO3fBcU2IyBFU1WZjF8=";
+    hash = "sha256-2PmJFDvD1bFFO6AINU60P4yW7RGhcyFyZ6S9h42XqB4=";
   };
 
   pythonRelaxDeps = [
@@ -27,15 +27,15 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     "cloudcheck"
   ];
 
-  build-system = with python3.pkgs; [
-    poetry-core
-    poetry-dynamic-versioning
-  ];
+  build-system = with python3.pkgs; [ hatchling ];
 
   dependencies = with python3.pkgs; [
     ansible-core
     ansible-runner
+    asndb
     beautifulsoup4
+    blastdns
+    blasthttp
     cachetools
     cloudcheck
     deepdiff
@@ -47,6 +47,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     mmh3
     omegaconf
     orjson
+    pip
     psutil
     puremagic
     pycryptodome
@@ -67,6 +68,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     yara-python
     starlette
     tornado
+    zstandard
   ];
 
   # Project has no tests
@@ -74,7 +76,8 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
 
   meta = {
     description = "OSINT automation for hackers";
-    homepage = "https://pypi.org/project/bbot/";
+    homepage = "https://github.com/blacklanternsecurity/bbot";
+    changelog = "https://github.com/blacklanternsecurity/bbot/releases/tag/${finalAttrs.version}";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [
       fab
diff --git a/pkgs/by-name/bo/bosh-cli/package.nix b/pkgs/by-name/bo/bosh-cli/package.nix
index f0e64bbdf72d..0bcf8a0ed4b2 100644
--- a/pkgs/by-name/bo/bosh-cli/package.nix
+++ b/pkgs/by-name/bo/bosh-cli/package.nix
@@ -9,13 +9,13 @@
 buildGoModule (finalAttrs: {
   pname = "bosh-cli";
 
-  version = "7.10.7";
+  version = "7.10.8";
 
   src = fetchFromGitHub {
     owner = "cloudfoundry";
     repo = "bosh-cli";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-hWaJcB+H907QRw5A+xJzy4Dr22NufKNDEAJTtLNYqqg=";
+    sha256 = "sha256-MNXmSjkUNFWh0OQNefHAQEeD3TzoLJdLW/1WM9sxJK4=";
   };
   vendorHash = null;
 
diff --git a/pkgs/by-name/bu/bumpp/package.nix b/pkgs/by-name/bu/bumpp/package.nix
index 6ca849afa5b5..5a190258293a 100644
--- a/pkgs/by-name/bu/bumpp/package.nix
+++ b/pkgs/by-name/bu/bumpp/package.nix
@@ -15,20 +15,20 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "bumpp";
-  version = "12.0.0";
+  version = "12.1.1";
 
   src = fetchFromGitHub {
     owner = "antfu-collective";
     repo = "bumpp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9o3eUZ4cCusvV+IwQbLqbEI4NhTKkcwgqv4Mqe/VxZ4=";
+    hash = "sha256-Rl/dD5iRjdjQyvnM7YrU64Yl90+8zJKIretNoAB3AAU=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-Em3HvH5nCiyxgaPQvenqAnOraYnvQNxLVdHQd1lz3+o=";
+    hash = "sha256-5qMDDUs1Zi4FKZzhvZ8T87MRtEtpxvssicpvJd0Nhkc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/bu/bunster/package.nix b/pkgs/by-name/bu/bunster/package.nix
index 418da60880d8..7f80b432d616 100644
--- a/pkgs/by-name/bu/bunster/package.nix
+++ b/pkgs/by-name/bu/bunster/package.nix
@@ -31,7 +31,7 @@ buildGoModule (finalAttrs: {
   meta = {
     description = "Compile shell scripts to static binaries";
     homepage = "https://github.com/yassinebenaid/bunster";
-    changelog = "https://github.com/yassinebenaid/bunster/releases/tag/v{finalAttrs.version}";
+    changelog = "https://github.com/yassinebenaid/bunster/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [
       yunz
diff --git a/pkgs/by-name/ca/cargo-feature-combinations/package.nix b/pkgs/by-name/ca/cargo-feature-combinations/package.nix
index c04018c52a06..f8aa2c863fa1 100644
--- a/pkgs/by-name/ca/cargo-feature-combinations/package.nix
+++ b/pkgs/by-name/ca/cargo-feature-combinations/package.nix
@@ -9,16 +9,16 @@ rustPlatform.buildRustPackage (finalAttrs: {
   __structuredAttrs = true;
 
   pname = "cargo-feature-combinations";
-  version = "0.4.1";
+  version = "0.4.2";
 
   src = fetchFromGitHub {
     owner = "romnn";
     repo = "cargo-feature-combinations";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0aPe0YmEpLHt3aZHDuNlov/TiRbLLpR7TLt0ULkjsVU=";
+    hash = "sha256-jB2I/AZTiBR6w1SsxQKQbu5OtiEvPZBKIy8ostTx21M=";
   };
 
-  cargoHash = "sha256-r09otRStFli5Bx0pfDOMu1LGDonDyCVGPEdY/KnjkmY=";
+  cargoHash = "sha256-ECGf597VaVBIs7NsRF7vSCo+Uf5T/v5Es61MmoRIZI4=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/ca/cargo-update/package.nix b/pkgs/by-name/ca/cargo-update/package.nix
index dfb9f8bc728d..2d4b957224c2 100644
--- a/pkgs/by-name/ca/cargo-update/package.nix
+++ b/pkgs/by-name/ca/cargo-update/package.nix
@@ -16,14 +16,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-update";
-  version = "22.1.0";
+  version = "22.1.1";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-0iXO+cmW1vfKc9sPTnw132fZlqTMfInVCIgT8NLrhwM=";
+    hash = "sha256-aq6l2tDWwvARdRgFJ1dTrWnh4XSy8uM32GdACVtzjQ8=";
   };
 
-  cargoHash = "sha256-6yE4zdGosZhXhT3Q3mh/1h33OXqXrAWhZ0b18qaI1vs=";
+  cargoHash = "sha256-3OfxeVPWd2v0/A2945/MZgwTBpEcfH3ql1oMVTsjNBY=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/by-name/co/cockpit/package.nix b/pkgs/by-name/co/cockpit/package.nix
index 2dc918b5b885..177dd2e1200c 100644
--- a/pkgs/by-name/co/cockpit/package.nix
+++ b/pkgs/by-name/co/cockpit/package.nix
@@ -35,6 +35,7 @@
   pkg-config,
   polkit,
   python312Packages,
+  removeReferencesTo,
   sscg,
   systemd,
   udev,
@@ -78,6 +79,7 @@ stdenv.mkDerivation (finalAttrs: {
     pam
     pkg-config
     python3Packages.setuptools
+    removeReferencesTo
     systemd
     xmlto
   ];
@@ -250,9 +252,34 @@ stdenv.mkDerivation (finalAttrs: {
       popd
     ''}
 
+    remove-references-to \
+      -t ${stdenv.cc.cc} \
+      -t ${lib.getDev stdenv.cc.libc} \
+      -t ${lib.getDev glib} \
+      -t ${lib.getDev json-glib} \
+      -t ${lib.getDev systemd} \
+      -t ${lib.getDev gnutls} \
+      -t ${lib.getDev krb5} \
+      "$out/lib/security/pam_ssh_add.so" \
+      "$out/libexec/cockpit-certificate-ensure" \
+      "$out/libexec/cockpit-session" \
+      "$out/libexec/cockpit-tls" \
+      "$out/libexec/cockpit-ws" \
+      "$out/libexec/cockpit-wsinstance-factory"
+
     runHook postFixup
   '';
 
+  disallowedRequisites = [
+    stdenv.cc.cc
+    (lib.getDev stdenv.cc.libc)
+    (lib.getDev glib)
+    (lib.getDev json-glib)
+    (lib.getDev systemd)
+    (lib.getDev gnutls)
+    (lib.getDev krb5)
+  ];
+
   nativeCheckInputs = [ python3Packages.pytestCheckHook ];
 
   checkInputs = [
diff --git a/pkgs/by-name/co/coroot/package.nix b/pkgs/by-name/co/coroot/package.nix
index e95d0c30f4d3..71d31a2a4c07 100644
--- a/pkgs/by-name/co/coroot/package.nix
+++ b/pkgs/by-name/co/coroot/package.nix
@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "coroot";
-  version = "1.24.0";
+  version = "1.24.3";
 
   src = fetchFromGitHub {
     owner = "coroot";
     repo = "coroot";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-50VB7qONhRQ5FehPH6uemA8+4HZin/vdJ7JmD0S7AEk=";
+    hash = "sha256-IuUo3EEemPzMVTHoDMcBVYei+bU2PGk4FscljBzLOpI=";
   };
 
   vendorHash = "sha256-P7EXBRG6OYIwaoObqpKBK2n0f6QYphr+DRNLbfysotA=";
diff --git a/pkgs/by-name/cp/cpufetch/package.nix b/pkgs/by-name/cp/cpufetch/package.nix
index cd046f27b87a..ed990b71d18a 100644
--- a/pkgs/by-name/cp/cpufetch/package.nix
+++ b/pkgs/by-name/cp/cpufetch/package.nix
@@ -16,6 +16,14 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-qmT7WBWKtSWGIK/dEd3/bF1bBjqSjfkP99htfnlFLCw=";
   };
 
+  postPatch =
+    # Copy-pasting typo
+    # https://github.com/Dr-Noob/cpufetch/issues/350
+    ''
+      substituteInPlace src/ppc/udev.c \
+        --replace-fail 'memset(name, 0, sizeof(char) * 128)' 'memset(path, 0, sizeof(char) * 128)'
+    '';
+
   nativeBuildInputs = [
     installShellFiles
   ];
diff --git a/pkgs/by-name/da/dalfox/package.nix b/pkgs/by-name/da/dalfox/package.nix
index 1d0872f47438..6fed64691ba7 100644
--- a/pkgs/by-name/da/dalfox/package.nix
+++ b/pkgs/by-name/da/dalfox/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "dalfox";
-  version = "3.1.2";
+  version = "3.2.0";
 
   src = fetchFromGitHub {
     owner = "hahwul";
     repo = "dalfox";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0amVlnLwwb7YAUbTce9gRmjv3W1FMgc2/XZQKCettTY=";
+    hash = "sha256-YLM//zRdwnlIL+lZH3HyxwstViLm9o+XykT/e/iz6CQ=";
   };
 
-  cargoHash = "sha256-pxlUEGCrJjoakAVpXFq2q73wEWiODsHvdax12quDlec=";
+  cargoHash = "sha256-hhvmvnPYo6L0VreP8SKoiz2Xp9spgXuZL54DGxyzHY4=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/da/databricks-cli/package.nix b/pkgs/by-name/da/databricks-cli/package.nix
index 34ab2772083f..7466f173b7dc 100644
--- a/pkgs/by-name/da/databricks-cli/package.nix
+++ b/pkgs/by-name/da/databricks-cli/package.nix
@@ -9,13 +9,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "databricks-cli";
-  version = "1.7.0";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "databricks";
     repo = "cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-08fYKWJRYkT48ivM9miPyoQ3fNNm6etdeqvqPZehtaM=";
+    hash = "sha256-9Zh0SwFNX08R4+D0a0DlptJF7vyQluTiGLKnneFqYU4=";
   };
 
   # Otherwise these tests fail asserting that the version is 0.0.0-dev
@@ -24,7 +24,7 @@ buildGoModule (finalAttrs: {
       --replace-fail "cli/0.0.0-dev" "cli/${finalAttrs.version}"
   '';
 
-  vendorHash = "sha256-1K722pdIXdYkc2HMlnjyjrZb/L2iUoRx2vY1szcF7aY=";
+  vendorHash = "sha256-lq4+qRUDEvHUgtLrIQwAurHc6iPcrzk/7aLb52JbSfA=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/de/devenv/package.nix b/pkgs/by-name/de/devenv/package.nix
index 3a14560b2e1c..faf0a622de90 100644
--- a/pkgs/by-name/de/devenv/package.nix
+++ b/pkgs/by-name/de/devenv/package.nix
@@ -24,16 +24,16 @@
 }:
 
 let
-  version = "2.2.0";
+  version = "2.2.1";
   devenvNixVersion = "2.34";
-  devenvNixRev = "782ac1b155679b065ec945ae50d0fa1d495883b7";
+  devenvNixRev = "f33db89fd6db6edc337d93212f6628ab6d25f407";
 
   devenvNixSrc = fetchFromGitHub {
     name = "devenv-nix-${devenvNixVersion}-source";
     owner = "cachix";
     repo = "nix";
     rev = devenvNixRev;
-    hash = "sha256-xem+4ncdQCTFJsQ4PrVuyVmi3j4w/Yqg298hBUzVejA=";
+    hash = "sha256-JSD8lPe5kalvPKx5X+inX8ZZdGLeXkAbd3Jiv7UDf+I=";
   };
 
   nix_components = (nixVersions.nixComponents_git.overrideSource devenvNixSrc).overrideScope (
@@ -49,11 +49,11 @@ rustPlatform.buildRustPackage {
   src = fetchFromGitHub {
     owner = "cachix";
     repo = "devenv";
-    tag = "v2.2";
-    hash = "sha256-9ewHcbuOk7wvBRBM28g06MkjcEIWyqoD04QZKouiRKI=";
+    tag = "v2.2.1";
+    hash = "sha256-S4baMekJYJGWDCo1yOYxZkmgBlAruQ5MLi+h3Zo8als=";
   };
 
-  cargoHash = "sha256-OJqaOJx++WON7SvWQQmSQW0t/8lym5csf3gkSPYaDYY=";
+  cargoHash = "sha256-2SQbXhDOoXQ33RYB5ik2rSdP3LxNR77lp/B9R1abUl0=";
 
   env = {
     RUSTFLAGS = "--cfg tracing_unstable";
diff --git a/pkgs/by-name/dt/dtop/package.nix b/pkgs/by-name/dt/dtop/package.nix
index 025430f7b0b3..1425e2928afc 100644
--- a/pkgs/by-name/dt/dtop/package.nix
+++ b/pkgs/by-name/dt/dtop/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "dtop";
-  version = "0.7.9";
+  version = "0.7.11";
 
   src = fetchFromGitHub {
     owner = "amir20";
     repo = "dtop";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1OHtMV2GmZQIx2pVujOXoQOkc6hJdJZjca4kk4HyESM=";
+    hash = "sha256-2BtKGO8Y+fZv8RElCuh592Sj0xYPNBNyBHvcxzSvko8=";
   };
 
-  cargoHash = "sha256-OHjgG5qHBz0Q74uWLkN9Ok0NiVeT71qpEjzFdMFWlfs=";
+  cargoHash = "sha256-oM5jQ7KYJSf+AhnOXhxtiVwglE/TAj4i9IqaEVVXZ4E=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = "--version";
diff --git a/pkgs/by-name/el/eliza/package.nix b/pkgs/by-name/el/eliza/package.nix
index 40478e01db5c..6e579c8a2255 100644
--- a/pkgs/by-name/el/eliza/package.nix
+++ b/pkgs/by-name/el/eliza/package.nix
@@ -7,12 +7,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "eliza";
-  version = "0-unstable-2026-06-13";
+  version = "0-unstable-2026-07-28";
   src = fetchFromGitHub {
     owner = "anthay";
     repo = "ELIZA";
-    rev = "8e93cb50107a4c6c854e96b533a36958ac934d3f";
-    hash = "sha256-KRw5ow/34A0GANUoCLM3xOhMc4dlzTWpVqWcsgruTCE=";
+    rev = "31e8df29971773375305f87d26d52633683c3edc";
+    hash = "sha256-95xTWpeUsfLaawOtzdXV5XjhxTBkmP6U3WVtc/ebvJQ=";
   };
 
   doCheck = true;
diff --git a/pkgs/by-name/es/eslint_d/package.nix b/pkgs/by-name/es/eslint_d/package.nix
index 2390cdd1a551..7f42eccaac65 100644
--- a/pkgs/by-name/es/eslint_d/package.nix
+++ b/pkgs/by-name/es/eslint_d/package.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "eslint_d";
-  version = "15.0.2";
+  version = "15.0.3";
 
   src = fetchFromGitHub {
     owner = "mantoni";
     repo = "eslint_d.js";
     rev = "v${version}";
-    hash = "sha256-Q1FW/DmUyHbTYcisQ0rp/XZXxkf3c6kO7jLM4b+kYHI=";
+    hash = "sha256-pcwU4WB1aIHYV50DMbuobsh3dQm+IJ6ByMUz4zvnwHE=";
   };
 
-  npmDepsHash = "sha256-XFFjrAEXtNFSuIN5yn2AQeurY3cpF0silSgmIA17Wog=";
+  npmDepsHash = "sha256-R1hv7sRZrDLDK05LvxyvuYCsugBM3c4pyZsqYlA7vd4=";
 
   dontNpmBuild = true;
 
diff --git a/pkgs/by-name/fa/faas-cli/package.nix b/pkgs/by-name/fa/faas-cli/package.nix
index 171bfe18f7b2..2303c76ae5ac 100644
--- a/pkgs/by-name/fa/faas-cli/package.nix
+++ b/pkgs/by-name/fa/faas-cli/package.nix
@@ -24,13 +24,13 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "faas-cli";
-  version = "0.18.11";
+  version = "0.18.12";
 
   src = fetchFromGitHub {
     owner = "openfaas";
     repo = "faas-cli";
     rev = finalAttrs.version;
-    sha256 = "sha256-4bfp9nM6cAglx9mNzjQZ4uo6nJNWI9Q9g9zIdkev9FM=";
+    sha256 = "sha256-I7P30c7rEVqemgUu/1AtM6jq2f4KB8xyDpjGBMvkLRU=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/fo/foxglove-cli/package.nix b/pkgs/by-name/fo/foxglove-cli/package.nix
index c90023a5e8c4..7aabfddfe38e 100644
--- a/pkgs/by-name/fo/foxglove-cli/package.nix
+++ b/pkgs/by-name/fo/foxglove-cli/package.nix
@@ -11,13 +11,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "foxglove-cli";
-  version = "1.0.32";
+  version = "1.0.33";
 
   src = fetchFromGitHub {
     owner = "foxglove";
     repo = "foxglove-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bc2YNCkTbO6qO2PyBI4UH7O48GNMgDfKKXWXjYaznBI=";
+    hash = "sha256-Ec1kG04fFb+YXHogjVI4QUXFDxY7EaifJM/XNhYj/lQ=";
   };
 
   vendorHash = "sha256-IXmkO7WIvy4ETMMHHJF6hS8ACRat/vnoiqaXyhw8u+M=";
diff --git a/pkgs/by-name/ge/gelly/package.nix b/pkgs/by-name/ge/gelly/package.nix
index 67a920bbc921..18206ca31d3b 100644
--- a/pkgs/by-name/ge/gelly/package.nix
+++ b/pkgs/by-name/ge/gelly/package.nix
@@ -19,16 +19,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "gelly";
-  version = "1.9.4";
+  version = "1.9.5";
 
   src = fetchFromGitHub {
     owner = "Fingel";
     repo = "gelly";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GYMLV4hffaIbqUp1b5ERo2QQqiKRlHe9oXfq+wNH/hM=";
+    hash = "sha256-k6LgXEK5xoVrjiXCkYnFgC7Hs7oz+v3Kz47CELPqN9Q=";
   };
 
-  cargoHash = "sha256-CsmcXlkOec/KJ59Ng7MyGsfjWQ80YyV6MztRFULmvDA=";
+  cargoHash = "sha256-RbOs5CEj3KRe6F1RJSGx97wBoQKSynx+iza929ipfjA=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/go/go-judge/package.nix b/pkgs/by-name/go/go-judge/package.nix
index e3bca0300831..9550364816bb 100644
--- a/pkgs/by-name/go/go-judge/package.nix
+++ b/pkgs/by-name/go/go-judge/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "go-judge";
-  version = "1.12.1";
+  version = "1.12.2";
 
   src = fetchFromGitHub {
     owner = "criyle";
     repo = "go-judge";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-QWLR0bIBgjqh75D0J7KEDjS+6rL5kV+fg01ThO6Cbq0=";
+    hash = "sha256-iC26hZT4jD0Z3wADxnSXkUaBnBmxWXY3WNb46cseb/Q=";
   };
 
-  vendorHash = "sha256-i5RiLaALbHQhOSb143kyQQGu2maJIw2VS0JELmxbxM0=";
+  vendorHash = "sha256-LQnndEO4TFsLvxxfhifDmufjdFhsqOt4jBUqc38NuD0=";
 
   tags = [
     "nomsgpack"
diff --git a/pkgs/by-name/go/gofumpt/package.nix b/pkgs/by-name/go/gofumpt/package.nix
index a22c7a6027a1..50d8e69fe3f9 100644
--- a/pkgs/by-name/go/gofumpt/package.nix
+++ b/pkgs/by-name/go/gofumpt/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gofumpt";
-  version = "0.10.0";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "mvdan";
     repo = "gofumpt";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-FaaXfvx63q+CkVGm3DyPrAykRVmpwyw+/2bBIAz8ab8=";
+    hash = "sha256-ybGY9zgzg2cK72hoebj9QF3SlrTzfI1eEk7IsKbp3pQ=";
   };
 
-  vendorHash = "sha256-tM9IKMdCAdKcQPzENWdeK9GtVD20IzZYGaoLGJPettw=";
+  vendorHash = "sha256-xN7s8zSK9V7E0cCRaRKVkhzp0rOcEIlgaZjPAgrpdio=";
 
   env.CGO_ENABLED = "0";
 
diff --git a/pkgs/by-name/go/gopodder/package.nix b/pkgs/by-name/go/gopodder/package.nix
index 944c70fe416e..86dbe6b7b621 100644
--- a/pkgs/by-name/go/gopodder/package.nix
+++ b/pkgs/by-name/go/gopodder/package.nix
@@ -8,17 +8,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "gopodder";
-  version = "1.2.1";
+  version = "1.2.2";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "cbrgm";
     repo = "gopodder";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-o/iQnr8WLArecRyMttCluuEYwKirKsOJyj5a7tdulVo=";
+    hash = "sha256-e+d2/1yAhUc88Hn8lAACfK3LGhGiPxQX+FjzNQc6Wqk=";
   };
 
-  vendorHash = "sha256-iG2IUfBVLQ7P0W4HOiGShVyD4mGUQ0dfGjG4XIYVtWU=";
+  vendorHash = "sha256-3SJbVflgwhIw2JmWoKUVjVL8fXWHfYXlm7iI3hYbTpE=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/go/gore/package.nix b/pkgs/by-name/go/gore/package.nix
index 72a40dc11e56..f5ecedd33760 100644
--- a/pkgs/by-name/go/gore/package.nix
+++ b/pkgs/by-name/go/gore/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "gore";
-  version = "0.6.2";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "x-motemen";
     repo = "gore";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-niMYoYkDaZsv6ntUIfB0B4VheiG6rMouZGUSjHnm51w=";
+    sha256 = "sha256-0J+FnR2hFpoRV4+5NvU4Sp9YT+bNIXftruBDXPe9MIw=";
   };
 
   vendorHash = "sha256-oS5LJfLFrmHEwayoD+HygfamZpmerIL1i4QtoRL4Om4=";
diff --git a/pkgs/by-name/go/goshs/CVE-2026-5160.patch b/pkgs/by-name/go/goshs/CVE-2026-5160.patch
new file mode 100644
index 000000000000..b2d75c21f5e2
--- /dev/null
+++ b/pkgs/by-name/go/goshs/CVE-2026-5160.patch
@@ -0,0 +1,14 @@
+diff --git a/go.mod b/go.mod
+index fe507b4678693915f275648ff052c2d2d859f4cc..aeb7e04795d9527edd1c4c100a870b38f4de538c 100644
+--- a/go.mod
++++ b/go.mod
+@@ -104 +104 @@ require (
+-	github.com/yuin/goldmark v1.7.13 // indirect
++	github.com/yuin/goldmark v1.7.17 // indirect
+diff --git a/go.sum b/go.sum
+index 1c56fd543ca070281c9c23e83a3387b16cf3dac3..9cc1bcb4a0fac0eb2e366a9b438da16d6cd13428 100644
+--- a/go.sum
++++ b/go.sum
+@@ -217,0 +218,2 @@ github.com/yuin/goldmark v1.7.13/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Br
++github.com/yuin/goldmark v1.7.17 h1:p36OVWwRb246iHxA/U4p8OPEpOTESm4n+g+8t0EE5uA=
++github.com/yuin/goldmark v1.7.17/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Brc7iBKg=
diff --git a/pkgs/by-name/go/goshs/package.nix b/pkgs/by-name/go/goshs/package.nix
index 15c2ca9a5243..75337e167359 100644
--- a/pkgs/by-name/go/goshs/package.nix
+++ b/pkgs/by-name/go/goshs/package.nix
@@ -3,30 +3,25 @@
   stdenv,
   buildGoModule,
   fetchFromGitHub,
-  fetchpatch2,
   versionCheckHook,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "goshs";
-  version = "2.1.4";
+  version = "2.1.5";
 
   src = fetchFromGitHub {
     owner = "goshs-labs";
     repo = "goshs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8xSYdLO+2AB044sV3JJw0RXB0RuLQ7eIzWvwgoJdp5k=";
+    hash = "sha256-mVgBY1QhQ+tDQnfangqylNeCbBJTSJaM0y7vZ95BU3Y=";
   };
 
-  vendorHash = "sha256-yKNJHs6A7Du9NvGOpwaDmABz6SBMPVzJNoQb7W32IfA=";
+  vendorHash = "sha256-LLYgb0DIFx97+ZXOlQc4yVdjjiw7ebXx76hADfWnlkw=";
 
   patches = [
-    # Remove when updating to 2.1.5 or later.
-    (fetchpatch2 {
-      name = "CVE-2026-66063+CVE-2026-66064.patch";
-      url = "https://github.com/goshs-labs/goshs/commit/f3ef599e409151d1380866e47de8b1afb0bb54fa.patch?full_index=1";
-      hash = "sha256-fIKeqWKraaLcocp7aaWE58ffkA1/2NVwR7KMmJfXL5g=";
-    })
+    # No upstream fix yet; remove when updating to a release that uses goldmark 1.7.17 or later.
+    ./CVE-2026-5160.patch
   ];
 
   ldflags = [ "-s" ];
@@ -53,7 +48,7 @@ buildGoModule (finalAttrs: {
   meta = {
     description = "Simple, yet feature-rich web server written in Go";
     homepage = "https://goshs.de";
-    changelog = "https://github.com/goshs-labs/goshs/releases/tag/${finalAttrs.src.rev}";
+    changelog = "https://github.com/goshs-labs/goshs/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       fab
diff --git a/pkgs/by-name/he/helmfile/package.nix b/pkgs/by-name/he/helmfile/package.nix
index 58ac8ea7137f..4684f886c89e 100644
--- a/pkgs/by-name/he/helmfile/package.nix
+++ b/pkgs/by-name/he/helmfile/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "helmfile";
-  version = "1.7.1";
+  version = "1.7.2";
 
   src = fetchFromGitHub {
     owner = "helmfile";
     repo = "helmfile";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-RfhOc/iraWHdccKE5rp7WR5s9HhLOmxtSe1SZXy2UMI=";
+    hash = "sha256-B9peVIqI2DveyWzVo+oXtsW8WLq7COk/2RrUjf2XX0w=";
   };
 
-  vendorHash = "sha256-Q+G4G27hwT+zravktjk+mU0VC3OlS9zqXwclwACG9B0=";
+  vendorHash = "sha256-LBp+UASFNctJ0iclgNk3OlIumifG5jV6sllExwCvp1g=";
 
   proxyVendor = true; # darwin/linux hash mismatch
 
diff --git a/pkgs/by-name/ho/home-assistant-matter-hub/package.nix b/pkgs/by-name/ho/home-assistant-matter-hub/package.nix
index b6feefcde22d..ee731fc8f5fb 100644
--- a/pkgs/by-name/ho/home-assistant-matter-hub/package.nix
+++ b/pkgs/by-name/ho/home-assistant-matter-hub/package.nix
@@ -14,13 +14,13 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "home-assistant-matter-hub";
-  version = "2.0.49";
+  version = "2.0.52";
 
   src = fetchFromGitHub {
     owner = "RiDDiX";
     repo = "home-assistant-matter-hub";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-AbXm70mxpqIefVyoapdYc8NC+XUTAdfRDhorMP446JI=";
+    hash = "sha256-KRhSN2fRNcenql+KZMRS+v2rw1G9+xGqQiGzkqvf7W4=";
   };
 
   # The bundled cli.js imports transitive dependencies (e.g. @noble/curves)
@@ -38,7 +38,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       ;
     inherit pnpm;
     fetcherVersion = 4;
-    hash = "sha256-PESk5TexRfwD/4upUA7npGQobhFwgm87oqVS1LqzbRg=";
+    hash = "sha256-B2yjPQAI+B2E/siQ1YNjsbKfa0xeC1qWum13kD44DB8=";
   };
 
   __structuredAttrs = true;
diff --git a/pkgs/by-name/ho/hongdown/package.nix b/pkgs/by-name/ho/hongdown/package.nix
index f7250d2adf72..c8362b03c65e 100644
--- a/pkgs/by-name/ho/hongdown/package.nix
+++ b/pkgs/by-name/ho/hongdown/package.nix
@@ -5,15 +5,15 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "hongdown";
-  version = "0.5.1";
+  version = "0.5.3";
 
   src = fetchFromGitHub {
     owner = "dahlia";
     repo = "hongdown";
     tag = finalAttrs.version;
-    hash = "sha256-JnfYBPWnZgZ7149yVsabP3n2+GnxR6ZvK0S+4w6x/c4=";
+    hash = "sha256-yHKOGtm9ApBMry+5IROQxNEySf6q8jHpGlWPRQuDxGA=";
   };
-  cargoHash = "sha256-Vn5dEaDnZ2FQ6ZlDKbbQ5lUvjyhIuhT2/xEaZ8KWmRA=";
+  cargoHash = "sha256-VnNisWSEeyxlPQwsF6I47+jxm64ybwiq48EwpFwz7Pw=";
   meta = {
     description = "Markdown formatter that enforces Hong Minhee's Markdown style conventions";
     mainProgram = "hongdown";
diff --git a/pkgs/by-name/ji/jid/package.nix b/pkgs/by-name/ji/jid/package.nix
index 4c204d5c1129..af90df23f488 100644
--- a/pkgs/by-name/ji/jid/package.nix
+++ b/pkgs/by-name/ji/jid/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "jid";
-  version = "1.1.2";
+  version = "1.1.3";
 
   src = fetchFromGitHub {
     owner = "simeji";
     repo = "jid";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Zf1YIEhvmvO482wh8VqQhyvHp7Nz6MXQ1SG0RCG0lRI=";
+    hash = "sha256-5Bi9nPOASxuZoxVxt6i3AQxvyWfe1B3JDSjXyuOPUHk=";
   };
 
   vendorHash = "sha256-ZqnIBmziPX45wqiEzD9mq4jLLW69mgGYhDSOTj20auQ=";
diff --git a/pkgs/by-name/js/json-sort-cli/package.nix b/pkgs/by-name/js/json-sort-cli/package.nix
index 95ff466a1c9a..25c126fe9bb4 100644
--- a/pkgs/by-name/js/json-sort-cli/package.nix
+++ b/pkgs/by-name/js/json-sort-cli/package.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "json-sort-cli";
-  version = "3.0.1";
+  version = "3.0.2";
 
   src = fetchFromGitHub {
     owner = "tillig";
     repo = "json-sort-cli";
     tag = "v${version}";
-    hash = "sha256-wUuVQmmcevGfcoYq5tPzEFRyPMMtbW/CeE5vNoCKFXQ=";
+    hash = "sha256-QNMdSwZWJqKIxTSrxoW20r7XTepTHF4p1C/JYXxJxPg=";
   };
 
-  npmDepsHash = "sha256-4sjP3ri52CunwLcbIJF6+qGgciiPmZKsrLnm50HX0PQ=";
+  npmDepsHash = "sha256-n9i+Mny/EkS/ZU/TUUAu+eJoMZqECvVDeokO5XPFiQM=";
   dontNpmBuild = true;
 
   doCheck = true;
diff --git a/pkgs/by-name/ka/kardolus-chatgpt-cli/package.nix b/pkgs/by-name/ka/kardolus-chatgpt-cli/package.nix
index cbbb2b23e080..eb70ae1b713e 100644
--- a/pkgs/by-name/ka/kardolus-chatgpt-cli/package.nix
+++ b/pkgs/by-name/ka/kardolus-chatgpt-cli/package.nix
@@ -9,18 +9,18 @@ buildGoModule (finalAttrs: {
   # "chatgpt-cli" is taken by another package with the same upsteam name.
   # To keep "pname" and "package attribute name" identical, the owners name (kardolus) gets prefixed as identifier.
   pname = "kardolus-chatgpt-cli";
-  version = "1.10.12";
+  version = "1.11.0";
 
   src = fetchFromGitHub {
     owner = "kardolus";
     repo = "chatgpt-cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-X+QfmoVY8J+D9WEQ6GS7ws5sFUh/2yfszyLkNCRy4gc=";
+    hash = "sha256-OADL3dR6tFNGu5oGpxbeJSWkNe38zDlDmnM70ilpQPY=";
   };
 
   vendorHash = null;
   # The tests of kardolus/chatgpt-cli require an OpenAI API Key to be present in the environment,
-  # (e.g. https://github.com/kardolus/chatgpt-cli/blob/v1.10.12/test/contract/contract_test.go#L35)
+  # (e.g. https://github.com/kardolus/chatgpt-cli/blob/v1.11.0/test/contract/contract_test.go#L35)
   # which will not be the case in the pipeline.
   # Therefore, tests must be skipped.
   doCheck = false;
diff --git a/pkgs/by-name/ki/killport/package.nix b/pkgs/by-name/ki/killport/package.nix
index 85f4658533fd..7416ea96d0f7 100644
--- a/pkgs/by-name/ki/killport/package.nix
+++ b/pkgs/by-name/ki/killport/package.nix
@@ -7,14 +7,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "killport";
-  version = "2.0.1";
+  version = "2.0.2";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-BEvtRNP/fuS1l7RbUT4+6jWIElEa23yGQCOi9k23B0o=";
+    hash = "sha256-m2+rlVLmEODfGuY+pdhQRGLjDP3yBfu33VhYXMMSUEg=";
   };
 
-  cargoHash = "sha256-fEeG076P6z5FojNG19QXQYTymJddLemt9L+v9OX/uxI=";
+  cargoHash = "sha256-V3VWy+bAKeynod2u4eEJyywGAX4ASoNgRmiTe/ju1GU=";
 
   nativeBuildInputs = [ rustPlatform.bindgenHook ];
 
diff --git a/pkgs/by-name/kn/knightos-kpack/package.nix b/pkgs/by-name/kn/knightos-kpack/package.nix
index 57a41bce7455..0b885da4b77e 100644
--- a/pkgs/by-name/kn/knightos-kpack/package.nix
+++ b/pkgs/by-name/kn/knightos-kpack/package.nix
@@ -2,37 +2,28 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  cmake,
-  asciidoc,
-  libxslt,
+  scdoc,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "kpack";
 
-  version = "1.1.1";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "KnightOS";
     repo = "kpack";
     rev = finalAttrs.version;
-    sha256 = "1l6bm2j45946i80qgwhrixg9sckazwb5x4051s76d3mapq9bara8";
+    sha256 = "sha256-QIi960hlS+aE3DRMtHOndWlehVfD59ybAaO/Dl/qiyQ=";
   };
 
   strictDeps = true;
 
-  nativeBuildInputs = [
-    asciidoc
-    cmake
-    libxslt.bin
-  ];
+  nativeBuildInputs = [ scdoc ];
 
   hardeningDisable = [ "fortify" ];
 
-  postPatch = ''
-    substituteInPlace CMakeLists.txt \
-      --replace-fail "cmake_minimum_required(VERSION 2.8.5)" "cmake_minimum_required(VERSION 3.10)"
-  '';
+  installFlags = [ "PREFIX=$(out)" ];
 
   meta = {
     homepage = "https://knightos.org/";
diff --git a/pkgs/by-name/ku/ku/package.nix b/pkgs/by-name/ku/ku/package.nix
index ee24a471399a..dc12360a5546 100644
--- a/pkgs/by-name/ku/ku/package.nix
+++ b/pkgs/by-name/ku/ku/package.nix
@@ -8,14 +8,14 @@
 
 buildGo126Module (finalAttrs: {
   pname = "ku";
-  version = "0.9.0";
+  version = "0.10.0";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "bjarneo";
     repo = "ku";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4z4lPvmkEqC7YBEaAa8cUyB42hkFkTFRkHGaA58/Vpg=";
+    hash = "sha256-MXtZdogaUhaMQcZdave5rz3afq+6T/tvQkZVzk0WCfg=";
   };
 
   vendorHash = "sha256-x7O2/uKnIIFDr8WK0ej3FJiIGxN5Fq5Czqrv4OJ5A44=";
diff --git a/pkgs/by-name/ld/ldmud/package.nix b/pkgs/by-name/ld/ldmud/package.nix
index e93f77462a5d..554efc4eb9ee 100644
--- a/pkgs/by-name/ld/ldmud/package.nix
+++ b/pkgs/by-name/ld/ldmud/package.nix
@@ -6,7 +6,7 @@
   pkg-config,
   bison,
   libiconv,
-  pcre,
+  pcre2,
   libgcrypt,
   libxcrypt-legacy,
   json_c,
@@ -39,6 +39,11 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     ./mysql-compat.patch
+    # pcre2 support, vendored from the upstream maintainer's release prep
+    # branch, which is rebased regularly and so unsuitable for fetchpatch:
+    # https://github.com/amotzkau/ldmud/commit/421ae90e611b3a4816bf52d84abfdcc73bf999b7
+    # Remove when updating to the next release.
+    ./pcre2.patch
   ];
 
   sourceRoot = "${finalAttrs.src.name}/src";
@@ -52,7 +57,7 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     libgcrypt
     libxcrypt-legacy
-    pcre
+    pcre2
     json_c
     libxml2
   ]
diff --git a/pkgs/by-name/ld/ldmud/pcre2.patch b/pkgs/by-name/ld/ldmud/pcre2.patch
new file mode 100644
index 000000000000..587d51cb0b5e
--- /dev/null
+++ b/pkgs/by-name/ld/ldmud/pcre2.patch
@@ -0,0 +1,620 @@
+From 421ae90e611b3a4816bf52d84abfdcc73bf999b7 Mon Sep 17 00:00:00 2001
+From: Alexander Motzkau <a.motzkau@web.de>
+Date: Tue, 9 Sep 2025 23:15:11 +0200
+Subject: [PATCH] Implement support for libpcre2
+
+The original libpcre library is deprecated and not supported anymore.
+Therefore use libpcre2 instead if available.
+---
+ src/autoconf/configure.ac |  10 +-
+ src/driver.h              |   2 +-
+ src/lex.c                 |   2 +-
+ src/mregex.c              | 335 ++++++++++++++++++++++++++++++++++----
+ src/pkg-pcre.h            |  11 +-
+ src/simulate.c            |   2 +-
+ 6 files changed, 327 insertions(+), 35 deletions(-)
+
+diff --git src/autoconf/configure.ac src/autoconf/configure.ac
+index e04bcc659..678c2f487 100644
+--- src/autoconf/configure.ac
++++ src/autoconf/configure.ac
+@@ -1301,7 +1301,15 @@ int main(void)
+ else
+     lp_cv_has_pcre=no
+ fi
+-if test "$lp_cv_has_pcre" = "no" && test "x$enable_use_pcre" = "xyes"; then
++
++lp_cv_has_pcre2_lib="no"
++AC_CHECK_LIB(pcre2-8, pcre2_config_8, PKGLIBS="$PKGLIBS -lpcre2-8" lp_cv_has_pcre2_lib="yes")
++
++if test "$lp_cv_has_pcre2_lib" = "yes"; then
++    AC_DEFINE(HAS_PCRE2, 1, [Does the machine offer PCRE2?])
++fi
++
++if test "$lp_cv_has_pcre" = "no" && test "$lp_cv_has_pcre2_lib" = "no" && test "x$enable_use_pcre" = "xyes"; then
+   AC_NOT_AVAILABLE(use-pcre)
+ fi
+ 
+diff --git src/driver.h src/driver.h
+index ec10645ac..00509f59b 100644
+--- src/driver.h
++++ src/driver.h
+@@ -139,7 +139,7 @@
+ 
+ /* If USE_PCRE is defined, check if the libpcre is available on this system.
+  * Disable USE_PCRE if not. */
+-#if defined(USE_PCRE) && !defined(HAS_PCRE)
++#if defined(USE_PCRE) && !defined(HAS_PCRE) && !defined(HAS_PCRE2)
+ #undef USE_PCRE
+ #endif
+ 
+diff --git src/lex.c src/lex.c
+index df61f4435..783428515 100644
+--- src/lex.c
++++ src/lex.c
+@@ -920,7 +920,7 @@ init_lexer(void)
+ #ifdef USE_JSON
+     add_permanent_define_str("__JSON__", -1, "1");
+ #endif
+-#ifdef HAS_PCRE
++#if defined(HAS_PCRE) || defined(HAS_PCRE2)
+     add_permanent_define_str("__PCRE__", -1, "1");
+ #endif
+     add_permanent_define_str("__LPC_NOSAVE__", -1, "1");
+diff --git src/mregex.c src/mregex.c
+index 17014ddde..81b6ef826 100644
+--- src/mregex.c
++++ src/mregex.c
+@@ -80,18 +80,22 @@
+  */
+ 
+ typedef struct regdata_s {
+-    p_uint        ref;       /* Number of refs */
+-    int           opt;       /* Additional options, but no package flags */
++    p_uint             ref;             /* Number of refs */
++    int                opt;             /* Additional options, but no package flags */
+     /* -- PCRE -- */
+-#ifdef HAS_PCRE
+-    pcre        * pProg;     /* The generated regular expression */
+-    pcre_extra  * pHints;    /* Study data */
+-    int           num_subs;  /* Number of elements in pSubs */
+-    int         * pSubs;     /* Substring offsets + workarea */
+-    int           res;       /* Result of last rx_exec() */
++#if defined(HAS_PCRE2)
++    pcre2_code       * pcre_prog;       /* The compiled regular expression */
++    pcre2_match_data * pcre_match_data; /* Block for holding the result */
++    int                res;             /* Result of last pcre2_match() */
++#elif defined(HAS_PCRE)
++    pcre             * pProg;           /* The generated regular expression */
++    pcre_extra       * pHints;          /* Study data */
++    int                num_subs;        /* Number of elements in pSubs */
++    int              * pSubs;           /* Substring offsets + workarea */
++    int                res;             /* Result of last rx_exec() */
+ #endif // HAS_PCRE
+     /* -- Traditional -- */
+-    regexp      * rx;        /* The actual regular expression */
++    regexp           * rx;              /* The actual regular expression */
+ } regdata_t;
+ 
+ #ifdef RXCACHE_TABLE
+@@ -143,7 +147,14 @@ static uint32 iXSizeAlloc     = 0;  /* Dynamic memory held in regexp structs */
+ 
+ #endif /* RXCACHE_TABLE */
+ 
+-#ifdef HAS_PCRE
++#if defined(HAS_PCRE2)
++static bool in_init_context = false;
++static pcre2_general_context* general_context = NULL;
++static pcre2_compile_context* compile_context = NULL;
++static pcre2_match_context* match_context = NULL;
++#endif
++
++#if defined(HAS_PCRE) || defined(HAS_PCRE2)
+ static size_t pcre_malloc_size;
+   /* Accumulated size from pcre_malloc() calls. Used when creating
+    * a new PCRE to capture its allocated size for statistics.
+@@ -197,7 +208,41 @@ free_regdata(regdata_t *r)
+ #endif /* RXCHACHE_TABLE */
+ 
+ /*--------------------------------------------------------------------*/
+-#ifdef HAS_PCRE
++#if defined(HAS_PCRE2)
++static void *
++pcre_xalloc (PCRE2_SIZE size, void *data)
++
++/* Wrapper function so that PCRE will use our special allocator. */
++
++{
++    void * p;
++
++    if (!pcre_malloc_err)
++        pcre_malloc_err = "in PCRE function";
++    if (in_init_context)
++    {
++        p = pxalloc(size);
++        if (p == NULL)
++            fatal("Out of memory (%zu bytes) for pcre context\n", (size_t)(size));
++    }
++    else
++        xallocate(p, size, pcre_malloc_err);
++    pcre_malloc_size += size;
++    return p;
++} /* pcre_xalloc() */
++
++/*--------------------------------------------------------------------*/
++static void
++pcre_xfree (void *block, void *data)
++
++/* Wrapper function so that PCRE will use our special allocator. */
++
++{
++    xfree(block);
++} /* pcre_xalloc() */
++
++/*--------------------------------------------------------------------*/
++#elif defined(HAS_PCRE)
+ static void *
+ pcre_xalloc (size_t size)
+ 
+@@ -223,7 +268,9 @@ rx_pcre_version (void)
+ 
+ {
+     static char buf[40];
+-#ifdef HAS_PCRE
++#if defined(HAS_PCRE2)
++    snprintf(buf, sizeof(buf), "%d.%d", PCRE2_MAJOR, PCRE2_MINOR);
++#elif defined(HAS_PCRE)
+     snprintf(buf, sizeof(buf), "%d.%d", PCRE_MAJOR, PCRE_MINOR);
+ #else
+     sprintf(buf, "not available");
+@@ -240,7 +287,22 @@ void rx_init(void)
+ #ifdef RXCACHE_TABLE
+     memset(xtable, 0, sizeof(xtable));
+ #endif
+-#ifdef HAS_PCRE
++#if defined(HAS_PCRE2)
++    in_init_context = true;
++    general_context = pcre2_general_context_create(pcre_xalloc, pcre_xfree, NULL);
++    compile_context = pcre2_compile_context_create(general_context);
++    match_context = pcre2_match_context_create(general_context);
++    in_init_context = false;
++
++#if LD_PCRE_RECURSION_LIMIT > 0
++    pcre2_set_depth_limit(match_context, LD_PCRE_RECURSION_LIMIT);
++#endif
++
++    uint32_t opt = 0;
++    if (pcre2_config(PCRE2_CONFIG_UNICODE, &opt) || !opt)
++        fprintf(stderr, "%s PCRE2 package does not support Unicode.\n", time_stamp());
++
++#elif defined(HAS_PCRE)
+     int opt = 0;
+ 
+     pcre_malloc = pcre_xalloc;
+@@ -259,10 +321,22 @@ get_error_message (int code, int package)
+ /* Return a constant string with the error message for <code>
+  * generated by <package>.
+  * If <code> is not an error, NULL is returned.
++ * Subsequent calls to this function may overwrite previous results.
+  */
+ 
+ {
+-#ifdef HAS_PCRE
++#if defined(HAS_PCRE2)
++    if (package & RE_PCRE)
++    {
++        static unsigned char buf[256];
++
++        if (!code)
++            return NULL;
++        if (pcre2_get_error_message(code, buf, sizeof(buf)) == PCRE2_ERROR_BADDATA)
++            return "unknown error";
++        return (const char*) buf;
++    }
++#elif defined(HAS_PCRE)
+     if (package & RE_PCRE)
+     {
+         const char* text;
+@@ -373,7 +447,70 @@ rx_compile_re (string_t * expr, int opt, Bool from_ed, regdata_t * rdata)
+ } /* rx_compile_re() */
+ 
+ /*--------------------------------------------------------------------*/
+-#ifdef HAS_PCRE
++#if defined(HAS_PCRE2)
++static size_t
++rx_compile_pcre (string_t * expr, int opt, Bool from_ed, regdata_t * rdata)
++
++/* Compile the expression <expr> with the options <opt> into a PCRE2
++ * expression and store it into *<rdata>.
++ * On success, return the accumulated size of the expression.
++ * On failure, if <from_ed> is FALSE, an error is thrown.
++ * On failure, if <from_ed> is TRUE, the error message is printed directly
++ * to the user and the function returns with 0.
++ */
++
++{
++    uint32_t          pcre_opt;    /* <opt> translated into PCRE opts */
++    int               err_code;
++    PCRE2_SIZE        err_offset;
++    pcre2_code*       pcre_prog;
++    pcre2_match_data* pcre_match_data;
++
++    /* Sanitize the <opt> value */
++    opt = opt & ~(RE_EXCOMPATIBLE) & ~(RE_PACKAGE_MASK);
++
++    /* Determine the RE compilation options */
++    pcre_opt = PCRE2_UTF | PCRE2_UCP;
++    if (opt & RE_CASELESS)       pcre_opt |= PCRE2_CASELESS;
++    if (opt & RE_MULTILINE)      pcre_opt |= PCRE2_MULTILINE;
++    if (opt & RE_DOTALL)         pcre_opt |= PCRE2_DOTALL;
++    if (opt & RE_EXTENDED)       pcre_opt |= PCRE2_EXTENDED;
++    if (opt & RE_DOLLAR_ENDONLY) pcre_opt |= PCRE2_DOLLAR_ENDONLY;
++    if (opt & RE_UNGREEDY)       pcre_opt |= PCRE2_UNGREEDY;
++
++    /* Compile the RE */
++    pcre_malloc_size = 0;
++    pcre_malloc_err  = "compiling regex";
++    pcre_prog = pcre2_compile((unsigned char*) get_txt(expr), mstrsize(expr),
++                              pcre_opt, &err_code, &err_offset, compile_context);
++
++    if (pcre_prog == NULL)
++    {
++        rx_free_subdata(rdata); /* Might have HS data in it already */
++        if (from_ed)
++            add_message("pcre: %s at offset %d\n", get_error_message(err_code, RE_PCRE), (int)err_offset);
++        else
++            errorf("pcre: %s at offset %d\n", get_error_message(err_code, RE_PCRE), (int)err_offset);
++        return 0;
++    }
++
++    pcre_malloc_err  = "JIT compiling regex";
++    pcre2_jit_compile(pcre_prog, PCRE2_JIT_COMPLETE);
++
++    pcre_match_data = pcre2_match_data_create_from_pattern(pcre_prog, general_context);
++
++    /* Compilation complete - store the result in the outgoing regdata
++     * structure.
++     */
++
++    rdata->pcre_prog = pcre_prog;
++    rdata->pcre_match_data = pcre_match_data;
++    rdata->res = 0;
++
++    return pcre_malloc_size;
++} /* rx_compile_pcre() */
++/*--------------------------------------------------------------------*/
++#elif defined(HAS_PCRE)
+ static size_t
+ rx_compile_pcre (string_t * expr, int opt, Bool from_ed, regdata_t * rdata)
+ 
+@@ -537,8 +674,12 @@ rx_compile_data (string_t * expr, int opt, Bool from_ed)
+ 
+         /* Regexp found, but it may not have been compiled for us yet.
+          */
+-#ifdef HAS_PCRE
++#if defined(HAS_PCRE2) || defined(HAS_PCRE)
++#if defined(HAS_PCRE2)
++        if ((opt & RE_PCRE) && !pHash->base.pcre_prog)
++#else
+         if ((opt & RE_PCRE) && !pHash->base.pProg)
++#endif
+         {
+             pHash->size = rx_compile_pcre(expr, opt, from_ed, &(pHash->base));
+             if (!pHash->size)
+@@ -560,7 +701,7 @@ rx_compile_data (string_t * expr, int opt, Bool from_ed)
+     pcre_size = 0;
+     memset(&rdata, 0, sizeof(rdata));
+ 
+-#ifdef HAS_PCRE
++#if defined(HAS_PCRE) || defined(HAS_PCRE2)
+     if (opt & RE_PCRE)
+     {
+         pcre_size = rx_compile_pcre(expr, opt, from_ed, &rdata);
+@@ -673,7 +814,7 @@ rx_compile (string_t * expr, int opt, Bool from_ed)
+             errorf("Missing specification of which regexp package to use.\n");
+         return NULL;
+     }
+-#ifndef HAS_PCRE
++#if !(defined(HAS_PCRE) || defined(HAS_PCRE2))
+     if (opt & RE_PCRE)
+     {
+         if (from_ed)
+@@ -716,7 +857,31 @@ rx_exec (regexp_t *pRegexp, string_t * string, size_t start)
+ {
+     regdata_t * prog = pRegexp->data;
+ 
+-#ifdef HAS_PCRE
++#if defined(HAS_PCRE2)
++    if (pRegexp->opt & RE_PCRE)
++    {
++        uint32_t pcre_opt = 0;
++
++        /* Determine the RE compilation options */
++        if (prog->opt & RE_ANCHORED) pcre_opt |= PCRE2_ANCHORED;
++        if (prog->opt & RE_NOTBOL)   pcre_opt |= PCRE2_NOTBOL;
++        if (prog->opt & RE_NOTEOL)   pcre_opt |= PCRE2_NOTEOL;
++        if (prog->opt & RE_NOTEMPTY) pcre_opt |= PCRE2_NOTEMPTY;
++
++        prog->res = pcre2_match(prog->pcre_prog, (unsigned char*)get_txt(string), mstrsize(string),
++                                start, pcre_opt, prog->pcre_match_data, match_context);
++
++        /* Reverse the roles of return codes 0 (pcre_match_data too small)
++         * and PCRE_ERROR_NOMATCH.
++         */
++        if (prog->res == PCRE2_ERROR_NOMATCH)
++            prog->res = 0;
++        else if (prog->res == 0)
++            prog->res = PCRE2_ERROR_NOMATCH;
++
++        return prog->res;
++    }
++#elif defined(HAS_PCRE)
+     if (pRegexp->opt & RE_PCRE)
+     {
+         int rc;
+@@ -776,7 +941,32 @@ rx_exec_str (regexp_t *pRegexp, char * string, char * start)
+ 
+ {
+     regdata_t * prog = pRegexp->data;
+-#ifdef HAS_PCRE
++
++#if defined(HAS_PCRE2)
++    if (pRegexp->opt & RE_PCRE)
++    {
++        uint32_t pcre_opt = 0;
++
++        /* Determine the RE compilation options */
++        if (prog->opt & RE_ANCHORED) pcre_opt |= PCRE2_ANCHORED;
++        if (prog->opt & RE_NOTBOL)   pcre_opt |= PCRE2_NOTBOL;
++        if (prog->opt & RE_NOTEOL)   pcre_opt |= PCRE2_NOTEOL;
++        if (prog->opt & RE_NOTEMPTY) pcre_opt |= PCRE2_NOTEMPTY;
++
++        prog->res = pcre2_match(prog->pcre_prog, (unsigned char*)start, PCRE2_ZERO_TERMINATED,
++                                string - start, pcre_opt, prog->pcre_match_data, match_context);
++
++        /* Reverse the roles of return codes 0 (pcre_match_data too small)
++         * and PCRE_ERROR_NOMATCH.
++         */
++        if (prog->res == PCRE2_ERROR_NOMATCH)
++            prog->res = 0;
++        else if (prog->res == 0)
++            prog->res = PCRE2_ERROR_NOMATCH;
++
++        return prog->res;
++    }
++#elif defined(HAS_PCRE)
+     if (pRegexp->opt & RE_PCRE)
+     {
+         int rc;
+@@ -835,7 +1025,7 @@ rx_num_matches (regexp_t *pRegexp)
+  */
+ 
+ {
+-#ifdef HAS_PCRE
++#if defined(HAS_PCRE2) || defined(HAS_PCRE)
+     if (pRegexp->opt & RE_PCRE)
+     {
+         return pRegexp->data->res >= 1 ? pRegexp->data->res : 0;
+@@ -881,7 +1071,25 @@ rx_get_match_n (regexp_t *pRegexp, string_t * str, int n, size_t * start, size_t
+     Bool rc;
+     regdata_t * prog = pRegexp->data;
+ 
+-#ifdef HAS_PCRE
++#if defined(HAS_PCRE2)
++    if (pRegexp->opt & RE_PCRE)
++    {
++        PCRE2_SIZE* subs = pcre2_get_ovector_pointer(prog->pcre_match_data);
++        if (n < 0 || n >= prog->res || subs[2*n] == PCRE2_UNSET  || subs[2*n+1] == PCRE2_UNSET)
++        {
++            *start = 0;
++            *end = 0;
++            rc = false;
++        }
++        else
++        {
++            *start = (size_t) subs[2*n];
++            *end = (size_t) subs[2*n+1];
++            rc = true;
++        }
++        return rc;
++    }
++#elif defined(HAS_PCRE)
+     if (pRegexp->opt & RE_PCRE)
+     {
+         if (n < 0
+@@ -937,7 +1145,16 @@ rx_get_match (regexp_t *pRegexp, string_t * str, size_t * start, size_t * end)
+ {
+     regdata_t * prog = pRegexp->data;
+ 
+-#ifdef HAS_PCRE
++#if defined(HAS_PCRE2)
++    if (pRegexp->opt & RE_PCRE)
++    {
++        PCRE2_SIZE* subs = pcre2_get_ovector_pointer(prog->pcre_match_data);
++
++        *start = (size_t) subs[0];
++        *end = (size_t) subs[1];
++        return;
++    }
++#elif defined(HAS_PCRE)
+     if (pRegexp->opt & RE_PCRE)
+     {
+         *start = (size_t)prog->pSubs[0];
+@@ -963,7 +1180,16 @@ rx_get_match_str (regexp_t *pRegexp, char * str, size_t * start, size_t * end)
+ {
+     regdata_t * prog = pRegexp->data;
+ 
+-#ifdef HAS_PCRE
++#if defined(HAS_PCRE2)
++    if (pRegexp->opt & RE_PCRE)
++    {
++        PCRE2_SIZE* subs = pcre2_get_ovector_pointer(prog->pcre_match_data);
++
++        *start = (size_t) subs[0];
++        *end = (size_t) subs[1];
++        return;
++    }
++#elif defined(HAS_PCRE)
+     if (pRegexp->opt & RE_PCRE)
+     {
+         *start = (size_t)prog->pSubs[0];
+@@ -1042,7 +1268,28 @@ rx_sub (regexp_t *pRegexp, string_t *source, string_t *subst)
+             }
+             else
+             {
+-#ifdef HAS_PCRE
++#if defined(HAS_PCRE2)
++                if (pRegexp->opt & RE_PCRE)
++                {
++                    PCRE2_SIZE* subs = pcre2_get_ovector_pointer(prog->pcre_match_data);
++
++                    if (no < prog->res && subs[2*no] != PCRE2_UNSET && subs[2*no+1] != PCRE2_UNSET)
++                    {
++                        size_t start = (size_t) subs[2*no];
++                        size_t sublen = (size_t) subs[2*no+1] - start;
++
++                        if (copyPass)
++                        {
++                            memcpy(dst, get_txt(source)+start, sublen);
++                            dst += sublen;
++                        }
++                        else
++                        {
++                            len += sublen;
++                        }
++                    }
++                }
++#elif defined(HAS_PCRE)
+                 if (pRegexp->opt & RE_PCRE)
+                 {
+                     if (no < prog->res
+@@ -1139,7 +1386,7 @@ rx_sub_str (regexp_t *pRegexp, char *source, char *subst)
+ /*-------------------------------------------------------------------------*/
+ Bool
+ rx_reganch (regexp_t *pRegexp)
+-  
++
+ /* If <pRegexp> is a traditional regexp, return TRUE if rx->reganch
+  * is not NULL. If <pRegexp> is a PCRE, always return FALSE.
+  *
+@@ -1162,7 +1409,19 @@ rx_free_subdata (regdata_t * expr)
+  */
+ 
+ {
+-#ifdef HAS_PCRE
++#if defined(HAS_PCRE2)
++    if (expr->pcre_match_data)
++    {
++        pcre2_match_data_free(expr->pcre_match_data);
++        expr->pcre_match_data = NULL;
++    }
++
++    if (expr->pcre_prog)
++    {
++        pcre2_code_free(expr->pcre_prog);
++        expr->pcre_prog = NULL;
++    }
++#elif defined(HAS_PCRE)
+     if (expr->pSubs)
+     {
+         xfree(expr->pSubs);
+@@ -1324,6 +1583,20 @@ rxcache_driver_info (svalue_t *svp, int value)
+ /*--------------------------------------------------------------------*/
+ #if defined(GC_SUPPORT)
+ 
++/*--------------------------------------------------------------------*/
++void
++clear_regdata_ref (regdata_t * pRegexp)
++
++/* Clear regexp data where we cannot follow references.
++ */
++
++{
++#if defined(HAS_PCRE2)
++    if (pRegexp->pcre_prog != NULL)
++        rx_free_subdata(pRegexp);
++#endif
++} /* clear_regdata_ref() */
++
+ /*--------------------------------------------------------------------*/
+ void
+ clear_rxcache_refs (void)
+@@ -1341,6 +1614,7 @@ clear_rxcache_refs (void)
+         if (NULL != xtable[i])
+         {
+             xtable[i]->base.ref = 0;
++            clear_regdata_ref(&xtable[i]->base);
+         }
+ #endif
+ } /* clear_rxcache_refs() */
+@@ -1354,7 +1628,10 @@ clear_regexp_ref (regexp_t * pRegexp)
+ 
+ {
+     if (pRegexp)
++    {
+         pRegexp->data->ref = 0;
++        clear_regdata_ref(pRegexp->data);
++    }
+ } /* clear_regexp_ref() */
+ 
+ /*--------------------------------------------------------------------*/
+@@ -1368,7 +1645,7 @@ count_regdata_ref (regdata_t * pRegexp)
+ 
+ {
+     note_malloced_block_ref(pRegexp);
+-#ifdef HAS_PCRE
++#if defined(HAS_PCRE)
+     if (pRegexp->pProg)
+     {
+         note_malloced_block_ref(pRegexp->pProg);
+@@ -1414,7 +1691,7 @@ count_rxcache_refs (void)
+     {
+         if (NULL != xtable[i])
+         {
+-            count_regdata_ref((regdata_t *)xtable[i]);
++            count_regdata_ref(&xtable[i]->base);
+         }
+     } /* for (i) */
+ #endif
+diff --git src/pkg-pcre.h src/pkg-pcre.h
+index 7aa622561..21e452916 100644
+--- src/pkg-pcre.h
++++ src/pkg-pcre.h
+@@ -11,9 +11,15 @@
+ 
+ #include "driver.h"
+ 
+-#ifdef HAS_PCRE
++#if defined(HAS_PCRE2)
++#define PCRE2_CODE_UNIT_WIDTH 8
++#include <pcre2.h>
++
++#define RE_ERROR_BACKTRACK (-8) // Free error code, see regexp.h for others.
++#undef HAS_PCRE
++
++#elif defined(HAS_PCRE)
+ #include <pcre.h>
+-#endif
+ 
+ /* Error code to be returned if too many backtracks are detected.
+  */
+@@ -22,5 +28,6 @@
+ #else
+ #define RE_ERROR_BACKTRACK (-8) // PCRE_ERROR_MATCHLIMIT from PCRE
+ #endif
++#endif
+ 
+ #endif /* PKG_PCRE_H_ */
+diff --git src/simulate.c src/simulate.c
+index ac29fed98..6c4c73783 100644
+--- src/simulate.c
++++ src/simulate.c
+@@ -5108,7 +5108,7 @@ f_set_driver_hook (svalue_t *sp)
+         }
+         else if (n == H_REGEXP_PACKAGE)
+         {
+-#ifdef HAS_PCRE
++#if defined(HAS_PCRE) || defined(HAS_PCRE2)
+             if (sp->u.number != RE_PCRE
+              && sp->u.number != RE_TRADITIONAL )
+             {
diff --git a/pkgs/by-name/le/leafnode/package.nix b/pkgs/by-name/le/leafnode/package.nix
deleted file mode 100644
index 312b567d49ad..000000000000
--- a/pkgs/by-name/le/leafnode/package.nix
+++ /dev/null
@@ -1,48 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  pcre,
-  libxcrypt,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "leafnode";
-  version = "2.0.0.alpha20140727b";
-
-  src = fetchurl {
-    url = "http://krusty.dt.e-technik.tu-dortmund.de/~ma/leafnode/beta/leafnode-${finalAttrs.version}.tar.bz2";
-    sha256 = "sha256-NOuiy7uHG3JMjV3UAtHDWK6yG6QmvrVljhVe0NdGEHU=";
-  };
-
-  configureFlags = [ "--enable-runas-user=nobody" ];
-
-  prePatch = ''
-    substituteInPlace Makefile.in --replace 02770 0770
-  '';
-
-  # configure uses id to check environment; we don't want this check
-  preConfigure = ''
-    sed -re 's/^ID[=].*/ID="echo whatever"/' -i configure
-  '';
-
-  # The is_validfqdn is far too restrictive, and only allows
-  # Internet-facing servers to run.  In order to run leafnode via
-  # localhost only, we need to disable this check.
-  postConfigure = ''
-    sed -i validatefqdn.c -e 's/int is_validfqdn(const char \*f) {/int is_validfqdn(const char *f) { return 1;/;'
-  '';
-
-  buildInputs = [
-    pcre
-    libxcrypt
-  ];
-
-  meta = {
-    homepage = "https://leafnode.sourceforge.io/index.shtml";
-    description = "Implementation of a store & forward NNTP proxy, under development";
-    license = lib.licenses.mit;
-    platforms = lib.platforms.unix;
-    maintainers = [ ];
-  };
-})
diff --git a/pkgs/by-name/li/libpkgconf/package.nix b/pkgs/by-name/li/libpkgconf/package.nix
index 0279b301f7c4..82685483cd77 100644
--- a/pkgs/by-name/li/libpkgconf/package.nix
+++ b/pkgs/by-name/li/libpkgconf/package.nix
@@ -14,6 +14,7 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "pkgconf";
   version = "2.5.1";
 
+  # fetchFromGitHub isn't used because it's unavailable during bootstrapping
   src = fetchurl {
     url = "https://github.com/pkgconf/pkgconf/archive/refs/tags/pkgconf-${finalAttrs.version}.tar.gz";
     hash = "sha256-eXIbrcrRmH3q2cNgnrSHerm1iCHAa9rLgk8siJfBHyo=";
diff --git a/pkgs/by-name/li/lighthouse-steamvr/package.nix b/pkgs/by-name/li/lighthouse-steamvr/package.nix
index fa11ee8d3136..09423b9d5ae3 100644
--- a/pkgs/by-name/li/lighthouse-steamvr/package.nix
+++ b/pkgs/by-name/li/lighthouse-steamvr/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "Lighthouse";
-  version = "1.4.0";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "ShayBox";
     repo = "Lighthouse";
     rev = finalAttrs.version;
-    hash = "sha256-Ai+d7BKA1o98iOhQ7VXltnWHW/knw122xLZHhFM6gZ0=";
+    hash = "sha256-2AJMXnfMvtYfCWusVDdZYUzKIPxey2mP4v3JVhsp2JE=";
   };
 
-  cargoHash = "sha256-+5fxqWq7akICVmDa8Lc6M8laEAWrrEyg4uCFLoCNRpo=";
+  cargoHash = "sha256-fOiVMg3K3wYhgYZ9kx3WfAgrgcSzUKjKyvXm5N386nw=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/li/linux-router/package.nix b/pkgs/by-name/li/linux-router/package.nix
index 7c892ef33181..14bda20ac4c0 100644
--- a/pkgs/by-name/li/linux-router/package.nix
+++ b/pkgs/by-name/li/linux-router/package.nix
@@ -41,13 +41,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "linux-router";
-  version = "0.8.1";
+  version = "0.8.2";
 
   src = fetchFromGitHub {
     owner = "garywill";
     repo = "linux-router";
     tag = finalAttrs.version;
-    hash = "sha256-tBrHuZKTf+7ABmE4FVYT9ny62CBa2A7va7OOFUsKJtM=";
+    hash = "sha256-OIwrpQCzzcCMrBLv0ufGOIrNUZcvrFzHctAA0w4xNV8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ma/mailutils/fix-linking-with-libtool-2.6.2.patch b/pkgs/by-name/ma/mailutils/fix-linking-with-libtool-2.6.2.patch
new file mode 100644
index 000000000000..eccca933f89d
--- /dev/null
+++ b/pkgs/by-name/ma/mailutils/fix-linking-with-libtool-2.6.2.patch
@@ -0,0 +1,24 @@
+diff --git a/libmu_sieve/extensions/Makefile.am b/libmu_sieve/extensions/Makefile.am
+--- a/libmu_sieve/extensions/Makefile.am
++++ b/libmu_sieve/extensions/Makefile.am
+@@ -25,7 +25,7 @@ mod_LTLIBRARIES =\
+  vacation.la
+ AM_CPPFLAGS = $(MU_APP_COMMON_INCLUDES)
+ AM_LDFLAGS = -module -avoid-version -no-undefined -rpath '$(moddir)'
+-LIBS = ../libmu_sieve.la
++LIBS = ../libmu_sieve.la $(MU_LIB_MAILUTILS)
+ 
+ if MU_COND_DBM
+   mod_LTLIBRARIES += uidnew.la
+diff --git a/examples/Makefile.am b/examples/Makefile.am
+--- a/examples/Makefile.am
++++ b/examples/Makefile.am
+@@ -60,7 +60,7 @@ LDADD = \
+  $(MU_COMMON_LIBRARIES)
+ 
+ numaddr_la_SOURCES = numaddr.c
+-numaddr_la_LIBADD = $(MU_LIB_SIEVE)
++numaddr_la_LIBADD = $(MU_LIB_SIEVE) $(MU_LIB_MAILUTILS)
+ numaddr_la_LDFLAGS = -module -avoid-version -no-undefined -rpath '$(moddir)'
+ 
+ msg_send_LDADD =\
diff --git a/pkgs/by-name/ma/mailutils/package.nix b/pkgs/by-name/ma/mailutils/package.nix
index 493c25cf05b0..a25e02f06646 100644
--- a/pkgs/by-name/ma/mailutils/package.nix
+++ b/pkgs/by-name/ma/mailutils/package.nix
@@ -75,6 +75,9 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     ./fix-build-mb-len-max.patch
+    # Fix linking loadable modules with Libtool 2.6.2
+    # https://savannah.gnu.org/bugs/?68588
+    ./fix-linking-with-libtool-2.6.2.patch
     ./path-to-cat.patch
     # Fix cross-compilation
     # https://lists.gnu.org/archive/html/bug-mailutils/2020-11/msg00038.html
diff --git a/pkgs/by-name/ma/matterjs-server/package.nix b/pkgs/by-name/ma/matterjs-server/package.nix
index 6095c3894b97..7f18313c9d94 100644
--- a/pkgs/by-name/ma/matterjs-server/package.nix
+++ b/pkgs/by-name/ma/matterjs-server/package.nix
@@ -12,7 +12,7 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "matterjs-server";
-  version = "1.3.1";
+  version = "1.3.3";
   __structuredAttrs = true;
   strictDeps = true;
 
@@ -20,10 +20,10 @@ buildNpmPackage (finalAttrs: {
     owner = "matter-js";
     repo = "matterjs-server";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HY1VEjqQ2C6Ym9PB2/g7M7TeAgOFsVYMX6jvpZLPgOI=";
+    hash = "sha256-s30pdP/ci/ft3V01sDrs57niZO3yPJ16qexprKICJZM=";
   };
 
-  npmDepsHash = "sha256-I/iY2YdsgvdLMkLRzML5VttmmDNUr/U38l+Wp8bu2B8=";
+  npmDepsHash = "sha256-eKLRkyT3oKn5lJzRe5Mr/rYdSTnxipbpZ3EisBkD6l4=";
 
   nativeBuildInputs = [
     makeBinaryWrapper
diff --git a/pkgs/by-name/me/melonds/package.nix b/pkgs/by-name/me/melonds/package.nix
index c3efe98f1a1e..07369ae4d77a 100644
--- a/pkgs/by-name/me/melonds/package.nix
+++ b/pkgs/by-name/me/melonds/package.nix
@@ -29,13 +29,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "melonds";
-  version = "1.1-unstable-2026-07-19";
+  version = "1.1-unstable-2026-07-29";
 
   src = fetchFromGitHub {
     owner = "melonDS-emu";
     repo = "melonDS";
-    rev = "82fdbc78483f43b310e920e21acc47787cb43564";
-    hash = "sha256-2T8qzsqbULFw7jsNk0pTpLMIyS1XVnA5ojel8BmTPMw=";
+    rev = "b3dd9880768a5d36c8daf87229b0bc915b51c1ff";
+    hash = "sha256-wnfi43f2nUR4xh3BtlY8oKBsS8aFQ1xE7ZNp5cdkvb4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/mi/miniupnpd/package.nix b/pkgs/by-name/mi/miniupnpd/package.nix
index 6f9b25a62681..866d90da10be 100644
--- a/pkgs/by-name/mi/miniupnpd/package.nix
+++ b/pkgs/by-name/mi/miniupnpd/package.nix
@@ -48,11 +48,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "miniupnpd";
-  version = "2.3.9";
+  version = "2.3.10";
 
   src = fetchurl {
     url = "https://miniupnp.tuxfamily.org/files/miniupnpd-${version}.tar.gz";
-    sha256 = "sha256-Zss8PWl6srs6YdPEhigWbWujKNfC2+uViY/fKjICr3s=";
+    sha256 = "sha256-+cNO02MvtgzSSN1Yl72YR5oQOnVoiwVsovBp5oqzKYc=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/mo/mongodb-ce/package.nix b/pkgs/by-name/mo/mongodb-ce/package.nix
index f7f763729501..13cc8f573b71 100644
--- a/pkgs/by-name/mo/mongodb-ce/package.nix
+++ b/pkgs/by-name/mo/mongodb-ce/package.nix
@@ -17,7 +17,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mongodb-ce";
-  version = "8.2.11";
+  version = "8.2.12";
   __structuredAttrs = true;
   strictDeps = true;
 
@@ -60,15 +60,15 @@ stdenv.mkDerivation (finalAttrs: {
     sources = {
       "x86_64-linux" = fetchurl {
         url = "https://fastdl.mongodb.org/linux/mongodb-linux-x86_64-ubuntu2404-${finalAttrs.version}.tgz";
-        hash = "sha256-sqFkZ19eYZHQFwVX2zwaKaYXisvoqN25+8DFbyGU2H4=";
+        hash = "sha256-dInAJIYOsz7lAZD7o7p178pKUNlCZcSILebC0XUam4g=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://fastdl.mongodb.org/linux/mongodb-linux-aarch64-ubuntu2404-${finalAttrs.version}.tgz";
-        hash = "sha256-5AX8pb1jInbQTuE0RqpqqcRXon6wKwdvoDCNDF70krE=";
+        hash = "sha256-hIqjImtj0sZmgoU6fLp6ASdqL97bG+6iFoB62vuUndE=";
       };
       "aarch64-darwin" = fetchurl {
         url = "https://fastdl.mongodb.org/osx/mongodb-macos-arm64-${finalAttrs.version}.tgz";
-        hash = "sha256-M3/x/d2rVKUmIZBQ9hVuT6W9ajZy/Ut5+8aDeXF+HwY=";
+        hash = "sha256-ixFA3XRcI6yvuBIBL6w/9VnFkwZdtjGlvsPbr6+N0cI=";
       };
     };
     updateScript =
diff --git a/pkgs/by-name/mt/mtail/package.nix b/pkgs/by-name/mt/mtail/package.nix
index bb4ab44f0da3..aa47f549cb5c 100644
--- a/pkgs/by-name/mt/mtail/package.nix
+++ b/pkgs/by-name/mt/mtail/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "mtail";
-  version = "3.4.5";
+  version = "3.4.6";
 
   src = fetchFromGitHub {
     owner = "jaqx0r";
     repo = "mtail";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-lCIl5Kc9VatCt6APXUT7vk4AZJ/WeqEjKvvAZKLVuRE=";
+    hash = "sha256-xjakb+HpctC68FL8ct6aVfwzl0qA2F8sZ3/C1SkFTkY=";
   };
 
   proxyVendor = true;
diff --git a/pkgs/by-name/nf/nfs-ganesha/package.nix b/pkgs/by-name/nf/nfs-ganesha/package.nix
index 1ce447ee7852..49a7b43fdb8c 100644
--- a/pkgs/by-name/nf/nfs-ganesha/package.nix
+++ b/pkgs/by-name/nf/nfs-ganesha/package.nix
@@ -27,7 +27,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nfs-ganesha";
-  version = "12.0";
+  version = "13.0";
 
   outputs = [
     "out"
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "nfs-ganesha";
     repo = "nfs-ganesha";
     tag = "V${finalAttrs.version}";
-    hash = "sha256-a0Hv5smtGgVQCGxMZU/lafNlnRM1w0HgkUIQJ/L+0r0=";
+    hash = "sha256-PAEDBUIMjuMzhSvWn80EtiHOaFPgcJgE9kZVG6nKLZs=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/pf/pferd/package.nix b/pkgs/by-name/pf/pferd/package.nix
index c150a00b6a04..b680cd7d61a8 100644
--- a/pkgs/by-name/pf/pferd/package.nix
+++ b/pkgs/by-name/pf/pferd/package.nix
@@ -5,14 +5,14 @@
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "pferd";
-  version = "3.9.2";
+  version = "3.9.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Garmelon";
     repo = "PFERD";
     tag = "v${finalAttrs.version}";
-    sha256 = "sha256-q1IyuANj47M3KR8qQXASf3WOpFgjNGD/gFZn1l6grTk=";
+    sha256 = "sha256-wzBWDpnftDantDDAjb1k5ukSeTUpXAvaETIQSrjpt8U=";
   };
 
   nativeBuildInputs = with python3Packages; [
diff --git a/pkgs/by-name/pi/picard-tools/package.nix b/pkgs/by-name/pi/picard-tools/package.nix
index 5d4499cd5c73..b9e74dc8c3e7 100644
--- a/pkgs/by-name/pi/picard-tools/package.nix
+++ b/pkgs/by-name/pi/picard-tools/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "picard-tools";
-  version = "3.4.0";
+  version = "3.5.0";
 
   src = fetchurl {
     url = "https://github.com/broadinstitute/picard/releases/download/${finalAttrs.version}/picard.jar";
-    sha256 = "sha256-52EowoOIn8WDyd6jOjt0SJdMBn0QLJ41vhUmQtTV+QE=";
+    sha256 = "sha256-t9l4YcOlS6WkIfWjF/ODgvlVgDhi0w70rKK83FSUNjE=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/pr/prometheus-mongodb-exporter/package.nix b/pkgs/by-name/pr/prometheus-mongodb-exporter/package.nix
index 27f4e872db87..bd50b1e144f8 100644
--- a/pkgs/by-name/pr/prometheus-mongodb-exporter/package.nix
+++ b/pkgs/by-name/pr/prometheus-mongodb-exporter/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "mongodb_exporter";
-  version = "0.51.0";
+  version = "0.52.0";
 
   src = fetchFromGitHub {
     owner = "percona";
     repo = "mongodb_exporter";
     rev = "v${version}";
-    hash = "sha256-FpB1xijoKoKTCteHhuPakej4PkYXcuPMD9Vmc7B6/vs=";
+    hash = "sha256-sf9I5RTlciXcoNOo5UTiLcr3N1c93xqFozbLQke/fFY=";
   };
 
-  vendorHash = "sha256-xNfwbUPJjLDLMXzEYH+xsywRc9dRLf/8/V9Zn/sYato=";
+  vendorHash = "sha256-swxJxgZccgcfuixcjzQHBu/b0dlFvhfcE4IS6xDdZI8=";
 
   buildInputs = lib.optionals withGssapi [ krb5 ];
 
diff --git a/pkgs/by-name/pr/prometheus-script-exporter/package.nix b/pkgs/by-name/pr/prometheus-script-exporter/package.nix
index 3c939d2e3119..54fd36493062 100644
--- a/pkgs/by-name/pr/prometheus-script-exporter/package.nix
+++ b/pkgs/by-name/pr/prometheus-script-exporter/package.nix
@@ -11,13 +11,13 @@ buildGoModule rec {
   '';
 
   pname = "script_exporter";
-  version = "3.2.0";
+  version = "3.2.1";
 
   src = fetchFromGitHub {
     owner = "ricoberger";
     repo = "script_exporter";
     rev = "v${version}";
-    hash = "sha256-TanhxXQYiMVkY89TfuzlHNrExe0u6FCPUlmuLgCN1RQ=";
+    hash = "sha256-8FEMa/fBZS69TE9An6RZq3AvETxvYEqDEIq3roQvgac=";
   };
 
   postPatch = ''
@@ -26,7 +26,7 @@ buildGoModule rec {
     sed -i '/func TestHandler/a\\    t.Skip("skipped in Nix build")' prober/handler_test.go
   '';
 
-  vendorHash = "sha256-g7Sd8rMqxFTNi3XsO05gyQ1d1icENx9FZthnGC2qQbM=";
+  vendorHash = "sha256-9skBLU4btdKpboJ1Y/qs2BZ9RPKrKijJWVb+qOy2RlU=";
 
   passthru.tests = { inherit (nixosTests.prometheus-exporters) script; };
 
diff --git a/pkgs/by-name/pr/proton-pass-cli/package.nix b/pkgs/by-name/pr/proton-pass-cli/package.nix
index 07bbf6f3450b..c6c3e429f89b 100644
--- a/pkgs/by-name/pr/proton-pass-cli/package.nix
+++ b/pkgs/by-name/pr/proton-pass-cli/package.nix
@@ -15,7 +15,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "proton-pass-cli";
-  version = "2.2.3";
+  version = "2.2.4";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -57,15 +57,15 @@ stdenv.mkDerivation (finalAttrs: {
     sources = {
       "aarch64-darwin" = fetchurl {
         url = "https://proton.me/download/pass-cli/${finalAttrs.version}/pass-cli-macos-aarch64";
-        hash = "sha256-gxjlrznYmXgCFOxixtHCz9x2KLsgNtuo9yr3TJpjxzI=";
+        hash = "sha256-DtXcwCVpaep0OPkFMO3vLJYNwfBtCl6jnVaj4cMSWSQ=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://proton.me/download/pass-cli/${finalAttrs.version}/pass-cli-linux-aarch64";
-        hash = "sha256-NdBabzetuIJEbu81Rfg3hUVEw8BJ2A3Who/i08/qwMs=";
+        hash = "sha256-aqipkzdJwZYIpzZYNpuBM0Qbb/7T6DrGzz8yuYUbn6Y=";
       };
       "x86_64-linux" = fetchurl {
         url = "https://proton.me/download/pass-cli/${finalAttrs.version}/pass-cli-linux-x86_64";
-        hash = "sha256-cYjwKnweeahg9xZq0sNPei5slhJltwZ34nBPIW3Rdtk=";
+        hash = "sha256-nVDLhgTjx67gvdKfzs9Glu0yWRNKbBfkuK2t/eF9e7Y=";
       };
     };
     updateScript = writeShellScript "update-proton-pass-cli" ''
diff --git a/pkgs/by-name/ra/rancher/package.nix b/pkgs/by-name/ra/rancher/package.nix
index 45268d278ed5..91f4592fdefb 100644
--- a/pkgs/by-name/ra/rancher/package.nix
+++ b/pkgs/by-name/ra/rancher/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "rancher";
-  version = "2.14.2";
+  version = "2.15.0";
 
   src = fetchFromGitHub {
     owner = "rancher";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-SysEf7oe85htpwi2xy3Em82WuV+sTZCy2OlxoZLshYc=";
+    hash = "sha256-WG3XPt9sNTQQuiwNJMi+MB42NRnDLNwwD2DlpUOO9ME=";
   };
 
   env.CGO_ENABLED = 0;
@@ -25,7 +25,7 @@ buildGoModule (finalAttrs: {
     "-static"
   ];
 
-  vendorHash = "sha256-sDSblZzRZ3StEMBeJbx2+hsSTKkuU3ixgLqR7vLfp3A=";
+  vendorHash = "sha256-/aMJicr6O+a6YOgaAxjYxFU7oBF7Idad10mIh1Lk32g=";
 
   postInstall = ''
     mv $out/bin/cli $out/bin/rancher
diff --git a/pkgs/by-name/rc/rclip/package.nix b/pkgs/by-name/rc/rclip/package.nix
index 0426c8816718..2f1eceea26d0 100644
--- a/pkgs/by-name/rc/rclip/package.nix
+++ b/pkgs/by-name/rc/rclip/package.nix
@@ -7,14 +7,14 @@
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "rclip";
-  version = "3.2.4";
+  version = "3.2.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "yurijmikhalevich";
     repo = "rclip";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ggetthpQj6XdhwPHrx9piTB4/eIEqNYEc5nsWJ8EpJQ=";
+    hash = "sha256-rlrhGeNoTVuN7HjN26ahrxeBlB1VeEpBoF65qcV/A0M=";
   };
 
   patches = [
diff --git a/pkgs/by-name/rd/rdkafka/package.nix b/pkgs/by-name/rd/rdkafka/package.nix
index 50e12a97f3db..5a6e6fdf8081 100644
--- a/pkgs/by-name/rd/rdkafka/package.nix
+++ b/pkgs/by-name/rd/rdkafka/package.nix
@@ -15,13 +15,16 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rdkafka";
-  version = "2.13.0";
+  version = "2.15.0";
+
+  __structuredAttrs = true;
+  strictDeps = true;
 
   src = fetchFromGitHub {
     owner = "confluentinc";
     repo = "librdkafka";
     tag = "v${finalAttrs.version}";
-    sha256 = "sha256-gxZ20qpG3iXwY21fY2lvafWudcnsqN6hOml1UR9fPKQ=";
+    hash = "sha256-WW64fwh0xR4lEVwmrv00tP9mo6b49aCNgLLH/P0YS8k=";
   };
 
   outputs = [
@@ -61,19 +64,21 @@ stdenv.mkDerivation (finalAttrs: {
     patchShebangs .
   '';
 
-  postFixup = lib.optionalString stdenv.hostPlatform.isStatic ''
+  postFixup =
     # rdkafka changes the library names for static libraries but users in pkgsStatic aren't likely to be aware of this
     # make sure the libraries are findable with both names
-    for pc in rdkafka{,++}; do
-      ln -s $dev/lib/pkgconfig/$pc{-static,}.pc
-    done
-  '';
+    lib.optionalString stdenv.hostPlatform.isStatic ''
+      for pc in rdkafka{,++}; do
+        ln -s $dev/lib/pkgconfig/$pc{-static,}.pc
+      done
+    '';
 
   enableParallelBuilding = true;
 
   meta = {
     description = "Apache Kafka C/C++ client library";
     homepage = "https://github.com/confluentinc/librdkafka";
+    changelog = "https://github.com/confluentinc/librdkafka/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.bsd2;
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
     maintainers = with lib.maintainers; [ commandodev ];
diff --git a/pkgs/by-name/re/read-it-later/package.nix b/pkgs/by-name/re/read-it-later/package.nix
index 6fa1a6ea725e..a663436934b3 100644
--- a/pkgs/by-name/re/read-it-later/package.nix
+++ b/pkgs/by-name/re/read-it-later/package.nix
@@ -21,19 +21,19 @@
 
 stdenv.mkDerivation rec {
   pname = "read-it-later";
-  version = "0.6.2";
+  version = "0.6.3";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = "read-it-later";
     tag = version;
-    hash = "sha256-dXDpZ5CXR/+lJUpQ1EpGgzYC6WKE4Y6CKytvCPrsMNk=";
+    hash = "sha256-m4s5oW8JlRogPVriJ+WHhEmf1asmZoC8f5zgPW0Crpc=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-zC9rb+yUWKozTTc3aBOnpTkhqykhQYemnzPtjjKnOdQ=";
+    hash = "sha256-hAdWDzEs1Xs5Ywa7uxCvB8E9NqKVWbMtJSjoCeXHklM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/re/resvg/package.nix b/pkgs/by-name/re/resvg/package.nix
index 9d53f2483880..ba04cfb3a044 100644
--- a/pkgs/by-name/re/resvg/package.nix
+++ b/pkgs/by-name/re/resvg/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "resvg";
-  version = "0.47.0";
+  version = "0.48.0";
 
   src = fetchFromGitHub {
     owner = "linebender";
     repo = "resvg";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-BCYjVOWFpOZm7ocmfszFpaBxnd96vhf3/yGlvAVRtCw=";
+    hash = "sha256-rzTmbk1pt9plH2yIyNUD/zgyz2xrlpxU6pyz+puEw/A=";
   };
 
-  cargoHash = "sha256-cVOAmwX/pYA6R0HK8+RLt/IvzowAO/g1i2YM71bYFoA=";
+  cargoHash = "sha256-dhFymHs3BliU0lSqtUEiu9FTeGfdP47KtokZFOJAheI=";
 
   cargoBuildFlags = [
     "--package=resvg"
diff --git a/pkgs/by-name/ru/runpodctl/package.nix b/pkgs/by-name/ru/runpodctl/package.nix
index 4ace55b88191..361826fc36bc 100644
--- a/pkgs/by-name/ru/runpodctl/package.nix
+++ b/pkgs/by-name/ru/runpodctl/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "runpodctl";
-  version = "2.7.2";
+  version = "2.8.0";
 
   src = fetchFromGitHub {
     owner = "runpod";
     repo = "runpodctl";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-QorGhaHwgzcJJXa36dejLdN8STa8Q7H8qvKK66g2JBA=";
+    hash = "sha256-ZbqpeXQQA6ulcKn70BqHtYmdUQLsZuSnFd/GqrtWb5w=";
   };
 
-  vendorHash = "sha256-38d+nWZDjWgcK091G3JCGtBqyE7iJ60edAhbx8GzxPM=";
+  vendorHash = "sha256-aCrN521urP1FioTmbcR1BNKg+OCith1mabyayuC9FtI=";
 
   postInstall = ''
     rm $out/bin/docs # remove the docs binary
diff --git a/pkgs/by-name/ru/rustical/package.nix b/pkgs/by-name/ru/rustical/package.nix
index fa9b1c5e931e..0c1818323230 100644
--- a/pkgs/by-name/ru/rustical/package.nix
+++ b/pkgs/by-name/ru/rustical/package.nix
@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rustical";
-  version = "0.14.0";
+  version = "0.14.1";
   __darwinAllowLocalNetworking = true;
 
   src = fetchFromGitHub {
     owner = "lennart-k";
     repo = "rustical";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-V0gd4qFs3mRhajhBbtVO835HLAwLKswFQDaURENNTOM=";
+    hash = "sha256-kQBTNpl0DS1wpSetEtlHnvAOydl5FwZ4S1qTrIxD7/k=";
   };
 
-  cargoHash = "sha256-HJeN9xv1U6l1ailE+8L+wlZSCKiCZyhfsh7uT+zebE0=";
+  cargoHash = "sha256-gOJY5Y5futzTSkX+VW2DzGg4VIjdj1IfNRYrIeTXevM=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/sa/samrewritten/package.nix b/pkgs/by-name/sa/samrewritten/package.nix
index 098467a8afb0..244775c2e33d 100644
--- a/pkgs/by-name/sa/samrewritten/package.nix
+++ b/pkgs/by-name/sa/samrewritten/package.nix
@@ -15,16 +15,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "samrewritten";
-  version = "1.4.5";
+  version = "1.4.6";
 
   src = fetchFromGitHub {
     owner = "PaulCombal";
     repo = "SamRewritten";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-sSZC7yN/WuMYkdcPmHyvasaWRFzppSxmlS1bYLZGvyM=";
+    hash = "sha256-Fqsxcx8QLFVaNvKHXV0UfIMpGAi0Wtl8zfiGWSg0vOY=";
   };
 
-  cargoHash = "sha256-YKiICPP6z9lZWqdoPOYRq+0mmz7jY3/eJd7XzN8Vmnk=";
+  cargoHash = "sha256-6f5QRXUYt6isklEWKkFc3OQHVHH11jq0i74LmCYxdG8=";
 
   # Tests require network access and a running Steam client. Skipping.
   doCheck = false;
diff --git a/pkgs/by-name/sa/sane-airscan/package.nix b/pkgs/by-name/sa/sane-airscan/package.nix
index 1928c775f549..c0313017e23d 100644
--- a/pkgs/by-name/sa/sane-airscan/package.nix
+++ b/pkgs/by-name/sa/sane-airscan/package.nix
@@ -15,7 +15,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "sane-airscan";
-  version = "0.99.37";
+  version = "0.99.38";
 
   nativeBuildInputs = [
     meson
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "alexpevzner";
     repo = "sane-airscan";
     rev = finalAttrs.version;
-    sha256 = "sha256-Vm6t4i2UDAzMULM8d0m1W8vNtOh+i4X8oXOEdguudfw=";
+    sha256 = "sha256-LgheG67QVH9gcXLCgrmpXvE39n3H6ub1k4PYTpcGDxM=";
   };
 
   meta = {
diff --git a/pkgs/by-name/sc/scaleway-cli/package.nix b/pkgs/by-name/sc/scaleway-cli/package.nix
index c702702ca221..e8caa6e85940 100644
--- a/pkgs/by-name/sc/scaleway-cli/package.nix
+++ b/pkgs/by-name/sc/scaleway-cli/package.nix
@@ -10,16 +10,16 @@
 
 buildGo126Module (finalAttrs: {
   pname = "scaleway-cli";
-  version = "2.59.0";
+  version = "2.60.0";
 
   src = fetchFromGitHub {
     owner = "scaleway";
     repo = "scaleway-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7gZ8rjwbvbmCP2E7uHOsCT6D9SCAczz2XZ8TfQGmdEk=";
+    hash = "sha256-Zt44lX7P/5fakiIPYegehCB/OjS9CGDiL0V9PjnbGOE=";
   };
 
-  vendorHash = "sha256-A+w5tayU/Bri1R47/39+UREOGiAGxtKfZc1npvubHcY=";
+  vendorHash = "sha256-/ksIUNlYFQBOoLvO0VAHi4coxxICWkkdfAuOKnlVK4M=";
 
   env.CGO_ENABLED = 0;
 
diff --git a/pkgs/by-name/se/search-vulns/package.nix b/pkgs/by-name/se/search-vulns/package.nix
index 6b1e1943be61..8b05af30d512 100644
--- a/pkgs/by-name/se/search-vulns/package.nix
+++ b/pkgs/by-name/se/search-vulns/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "search-vulns";
-  version = "1.2.3";
+  version = "1.2.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ra1nb0rn";
     repo = "search_vulns";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YSnBM0nTjQSNh7eDqAeu58J1DuyG7tRjOX+6zlUVH+I=";
+    hash = "sha256-OflNIW4EnFArnfU1wPgjjOFAFQq7m2in5DJnNheLhWI=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/su/supercell-wx/package.nix b/pkgs/by-name/su/supercell-wx/package.nix
index 3425406e42e6..8c530536e06e 100644
--- a/pkgs/by-name/su/supercell-wx/package.nix
+++ b/pkgs/by-name/su/supercell-wx/package.nix
@@ -1,7 +1,6 @@
 {
   lib,
   stdenv,
-  gcc14Stdenv,
   fetchFromGitHub,
   replaceVars,
   tracy,
@@ -17,13 +16,16 @@
   bzip2,
   geos,
   geographiclib,
-  glew,
   glm,
   gtest,
   howard-hinnant-date,
   libsm,
   libcpr,
+  libGLU,
+  libjpeg,
   libpng,
+  libtiff,
+  libzip,
   onetbb,
   openssl,
   python3,
@@ -34,7 +36,11 @@
   zlib,
 }:
 let
-  buildStdenv = if stdenv.cc.isGNU then gcc14Stdenv else stdenv;
+  libtiffWithCxx = libtiff.overrideAttrs (old: {
+    cmakeFlags = (old.cmakeFlags or [ ]) ++ [
+      "-Dcxx=ON"
+    ];
+  });
 
   gtestSkip = [
     # Skip tests requiring network access
@@ -57,16 +63,16 @@ let
     "MarkerModelTest.*"
   ];
 in
-buildStdenv.mkDerivation (finalAttrs: {
+stdenv.mkDerivation (finalAttrs: {
   pname = "supercell-wx";
-  version = "0.5.3";
+  version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = "dpaulat";
     repo = "supercell-wx";
     tag = "v${finalAttrs.version}-release";
     fetchSubmodules = true;
-    hash = "sha256-1n1WXBLco2TpyhS8KA1tk6HzRIXLqS6YV3aYagoQiTM=";
+    hash = "sha256-wvtLu5K0bz0X7WzUCUH4/vAYtJsHJ2UOv5Q06uMMlyw=";
   };
 
   patches = [
@@ -78,13 +84,14 @@ buildStdenv.mkDerivation (finalAttrs: {
     })
     # Prevents using some Qt scripts that seemed to break the install step. Fixes missing link to some targets.
     ./patches/fix-cmake-install.patch
+    # libtiff with C++ support is required
+    ./patches/libtiff-cxx.patch
     # }}}
 
     # These may be or already are submitted upstream {{{
     ./patches/explicit-link-aws-crt.patch # fix missing symbols from aws-crt-cpp
-    ./patches/fix-qt-6.10.patch
-    ./patches/fix-find-opengl.patch
     # }}}
+    ./patches/boost-1.89-compat.patch
   ];
 
   # This also may be submitted upstream to maplibre-native-qt, which is currently vendored
@@ -96,6 +103,7 @@ buildStdenv.mkDerivation (finalAttrs: {
   env = {
     CXXFLAGS = lib.concatStringsSep " " [
       "-Wno-error=deprecated-declarations"
+      "-Wno-error=free-nonheap-object"
       "-Wno-error=maybe-uninitialized"
       "-Wno-error=restrict"
       "-Wno-error=stringop-overflow"
@@ -105,6 +113,9 @@ buildStdenv.mkDerivation (finalAttrs: {
   };
 
   cmakeFlags = [
+    # v0.6.1 Release Date
+    (lib.cmakeFeature "SCWX_RELEASE_DATE" "2026-07-18")
+
     # CMake Error at external/aws-sdk-cpp/crt/aws-crt-cpp/cmake/EnforceSubmoduleVersions.cmake:18 (message):
     # ENFORCE_SUBMODULE_VERSIONS is ON but Git was not found.
     (lib.cmakeBool "ENFORCE_SUBMODULE_VERSIONS" false)
@@ -127,13 +138,16 @@ buildStdenv.mkDerivation (finalAttrs: {
     bzip2
     geos
     geographiclib
-    glew
     glm
     gtest
     howard-hinnant-date
     libsm
     libcpr
+    libGLU
+    libjpeg
     libpng
+    libtiffWithCxx
+    libzip
     onetbb
     openssl
     (python3.withPackages (ps: [
@@ -167,7 +181,7 @@ buildStdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = {
-    homepage = "https://supercell-wx.rtfd.io";
+    homepage = "https://supercellwx.net/";
     downloadPage = "https://github.com/dpaulat/supercell-wx/releases";
     description = "Live visualization of NEXRAD weather data and alerts";
     changelog = "https://github.com/dpaulat/supercell-wx/releases/tag/${finalAttrs.src.tag}";
@@ -184,6 +198,9 @@ buildStdenv.mkDerivation (finalAttrs: {
       "x86_64-linux"
       "aarch64-linux"
     ];
-    maintainers = with lib.maintainers; [ aware70 ];
+    maintainers = with lib.maintainers; [
+      aware70
+      dpaulat
+    ];
   };
 })
diff --git a/pkgs/by-name/su/supercell-wx/patches/boost-1.89-compat.patch b/pkgs/by-name/su/supercell-wx/patches/boost-1.89-compat.patch
new file mode 100644
index 000000000000..69f094d249ff
--- /dev/null
+++ b/pkgs/by-name/su/supercell-wx/patches/boost-1.89-compat.patch
@@ -0,0 +1,12 @@
+diff --git a/wxdata/source/scwx/provider/nws_level3_behavior.cpp b/wxdata/source/scwx/provider/nws_level3_behavior.cpp
+index 378c98d4..f95b6d80 100644
+--- a/wxdata/source/scwx/provider/nws_level3_behavior.cpp
++++ b/wxdata/source/scwx/provider/nws_level3_behavior.cpp
+@@ -12,6 +12,7 @@
+ 
+ #include <boost/algorithm/string/case_conv.hpp>
+ #include <boost/unordered/unordered_flat_map.hpp>
++#include <boost/url/parse.hpp>
+ #include <boost/url/url.hpp>
+ #include <cpr/cpr.h>
+ #include <range/v3/range/conversion.hpp>
diff --git a/pkgs/by-name/su/supercell-wx/patches/explicit-link-aws-crt.patch b/pkgs/by-name/su/supercell-wx/patches/explicit-link-aws-crt.patch
index 3fca9577a889..2962d61db577 100644
--- a/pkgs/by-name/su/supercell-wx/patches/explicit-link-aws-crt.patch
+++ b/pkgs/by-name/su/supercell-wx/patches/explicit-link-aws-crt.patch
@@ -1,12 +1,12 @@
 diff --git a/wxdata/wxdata.cmake b/wxdata/wxdata.cmake
-index 36911947..451efc13 100644
+index 0624971d..1df079de 100644
 --- a/wxdata/wxdata.cmake
 +++ b/wxdata/wxdata.cmake
-@@ -320,6 +320,7 @@ endif()
+@@ -363,6 +363,7 @@ endif()
  
  target_link_libraries(wxdata PUBLIC aws-cpp-sdk-core
                                      aws-cpp-sdk-s3
 +                                    aws-crt-cpp
                                      cpr::cpr
                                      LibXml2::LibXml2
-                                     OpenSSL::Crypto
+                                     libzip::zip
diff --git a/pkgs/by-name/su/supercell-wx/patches/fix-cmake-install.patch b/pkgs/by-name/su/supercell-wx/patches/fix-cmake-install.patch
index 4db8401e3e94..2b6c288e6a85 100644
--- a/pkgs/by-name/su/supercell-wx/patches/fix-cmake-install.patch
+++ b/pkgs/by-name/su/supercell-wx/patches/fix-cmake-install.patch
@@ -1,18 +1,18 @@
 diff --git a/scwx-qt/scwx-qt.cmake b/scwx-qt/scwx-qt.cmake
-index 648b6578..4833b9c2 100644
+index ed40e428..8743b2ab 100644
 --- a/scwx-qt/scwx-qt.cmake
 +++ b/scwx-qt/scwx-qt.cmake
-@@ -776,6 +776,7 @@ target_link_libraries(scwx-qt PUBLIC Qt${QT_VERSION_MAJOR}::Widgets
+@@ -859,6 +859,7 @@ target_link_libraries(scwx-qt PUBLIC Qt${QT_VERSION_MAJOR}::Widgets
                                       Boost::timer
                                       Boost::atomic
                                       QMapLibre::Core
 +                                     QMapLibre::Widgets
+                                      OpenGL::GLU
                                       $<$<CXX_COMPILER_ID:MSVC>:opengl32>
                                       $<$<CXX_COMPILER_ID:MSVC>:SetupAPI>
-                                      Fontconfig::Fontconfig
-@@ -793,18 +794,7 @@ target_link_libraries(scwx-qt PUBLIC Qt${QT_VERSION_MAJOR}::Widgets
- target_link_libraries(supercell-wx PRIVATE scwx-qt
-                                            wxdata)
+@@ -891,18 +892,7 @@ if (WIN32)
+                        COMMENT "Running windeployqt for supercell-wx...")
+ endif()
  
 -if (LINUX)
 -    # Set DT_RUNPATH for Linux targets
@@ -29,7 +29,7 @@ index 648b6578..4833b9c2 100644
          RUNTIME
            COMPONENT supercell-wx
          BUNDLE
-@@ -819,24 +809,6 @@ install(TARGETS supercell-wx
+@@ -917,24 +907,6 @@ install(TARGETS supercell-wx
            COMPONENT supercell-wx
            OPTIONAL)
  
diff --git a/pkgs/by-name/su/supercell-wx/patches/fix-find-opengl.patch b/pkgs/by-name/su/supercell-wx/patches/fix-find-opengl.patch
deleted file mode 100644
index f3aebc9c99e0..000000000000
--- a/pkgs/by-name/su/supercell-wx/patches/fix-find-opengl.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-diff --git a/scwx-qt/scwx-qt.cmake b/scwx-qt/scwx-qt.cmake
-index 648b6578..3f1d8070 100644
---- a/scwx-qt/scwx-qt.cmake
-+++ b/scwx-qt/scwx-qt.cmake
-@@ -18,7 +18,7 @@ find_package(Fontconfig)
- find_package(geographiclib)
- find_package(geos)
- find_package(glm)
--find_package(OpenGL)
-+find_package(OpenGL REQUIRED)
- find_package(Python COMPONENTS Interpreter)
- find_package(SQLite3)
- 
-@@ -759,12 +759,7 @@ if (LINUX)
-     target_link_libraries(scwx-qt PUBLIC Qt${QT_VERSION_MAJOR}::WaylandClient)
- endif()
- 
--if (LINUX)
--    find_package(mesa-glu REQUIRED)
--    target_link_libraries(scwx-qt PUBLIC mesa-glu::mesa-glu)
--else()
--    target_link_libraries(scwx-qt PUBLIC OpenGL::GLU)
--endif()
-+target_link_libraries(scwx-qt PUBLIC OpenGL::GLU)
- 
- target_link_libraries(scwx-qt PUBLIC Qt${QT_VERSION_MAJOR}::Widgets
-                                      Qt${QT_VERSION_MAJOR}::OpenGLWidgets
diff --git a/pkgs/by-name/su/supercell-wx/patches/fix-qt-6.10.patch b/pkgs/by-name/su/supercell-wx/patches/fix-qt-6.10.patch
deleted file mode 100644
index d58710225f2d..000000000000
--- a/pkgs/by-name/su/supercell-wx/patches/fix-qt-6.10.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/external/qt6ct.cmake b/external/qt6ct.cmake
-index 665b5368..9e6ed0e9 100644
---- a/external/qt6ct.cmake
-+++ b/external/qt6ct.cmake
-@@ -5,7 +5,7 @@ find_package(QT NAMES Qt6
-              COMPONENTS Gui Widgets
-              REQUIRED)
- find_package(Qt${QT_VERSION_MAJOR}
--             COMPONENTS Gui Widgets
-+             COMPONENTS Gui Widgets WidgetsPrivate
-              REQUIRED)
- 
- #extract version from qt6ct.h
diff --git a/pkgs/by-name/su/supercell-wx/patches/libtiff-cxx.patch b/pkgs/by-name/su/supercell-wx/patches/libtiff-cxx.patch
new file mode 100644
index 000000000000..381f8dd5024b
--- /dev/null
+++ b/pkgs/by-name/su/supercell-wx/patches/libtiff-cxx.patch
@@ -0,0 +1,22 @@
+diff --git a/scwx-qt/scwx-qt.cmake b/scwx-qt/scwx-qt.cmake
+index 8743b2ab..afa7c407 100644
+--- a/scwx-qt/scwx-qt.cmake
++++ b/scwx-qt/scwx-qt.cmake
+@@ -23,7 +23,7 @@ find_package(OpenGL REQUIRED)
+ find_package(PNG)
+ find_package(Python COMPONENTS Interpreter)
+ find_package(SQLite3)
+-find_package(TIFF)
++find_package(Tiff CONFIG REQUIRED)
+ 
+ find_package(QT NAMES Qt6
+              COMPONENTS Gui
+@@ -875,7 +875,7 @@ target_link_libraries(scwx-qt PUBLIC Qt${QT_VERSION_MAJOR}::Widgets
+                                      qt6ct-widgets
+                                      SQLite::SQLite3
+                                      PNG::PNG
+-                                     TIFF::TIFF
++                                     TIFF::tiffxx
+                                      wxdata)
+ 
+ target_link_libraries(scwx-qt INTERFACE Boost::program_options)
diff --git a/pkgs/by-name/su/supercell-wx/patches/skip-git-versioning.patch b/pkgs/by-name/su/supercell-wx/patches/skip-git-versioning.patch
index 842d4118256a..8747ed2713bd 100644
--- a/pkgs/by-name/su/supercell-wx/patches/skip-git-versioning.patch
+++ b/pkgs/by-name/su/supercell-wx/patches/skip-git-versioning.patch
@@ -1,5 +1,38 @@
+diff --git a/scwx-qt/scwx-qt.cmake b/scwx-qt/scwx-qt.cmake
+index ed40e428..5d5676ad 100644
+--- a/scwx-qt/scwx-qt.cmake
++++ b/scwx-qt/scwx-qt.cmake
+@@ -642,6 +642,12 @@ else()
+     set(SCWX_BUILD_NUM 0)
+ endif()
+ 
++if (NOT SCWX_RELEASE_DATE)
++    message(FATAL_ERROR
++            "SCWX_RELEASE_DATE must be set to YYYY-MM-DD "
++            "(e.g. -DSCWX_RELEASE_DATE=2026-07-18)")
++endif()
++
+ if (WIN32)
+     add_custom_command(OUTPUT  ${VERSIONS_HEADER}
+                                ${RESOURCE_OUTPUT}
+@@ -655,6 +661,7 @@ if (WIN32)
+                                -i ${VERSIONS_INPUT}
+                                -o ${VERSIONS_HEADER}
+                                -b ${SCWX_BUILD_NUM}
++                               --release-date ${SCWX_RELEASE_DATE}
+                                --input-resource ${RESOURCE_INPUT}
+                                --output-resource ${RESOURCE_OUTPUT}
+                                --input-metainfo ${METAINFO_INPUT}
+@@ -671,6 +678,7 @@ else()
+                                -i ${VERSIONS_INPUT}
+                                -o ${VERSIONS_HEADER}
+                                -b ${SCWX_BUILD_NUM}
++                               --release-date ${SCWX_RELEASE_DATE}
+                                --input-metainfo ${METAINFO_INPUT}
+                                --output-metainfo ${METAINFO_OUTPUT})
+ endif()
 diff --git a/scwx-qt/tools/generate_versions.py b/scwx-qt/tools/generate_versions.py
-index c6c94020..000f6e6e 100644
+index 61b7cc1f..32ec482e 100644
 --- a/scwx-qt/tools/generate_versions.py
 +++ b/scwx-qt/tools/generate_versions.py
 @@ -1,6 +1,5 @@
@@ -9,26 +42,42 @@ index c6c94020..000f6e6e 100644
  import json
  import os
  import pathlib
-@@ -110,27 +109,23 @@ def ParseArguments():
+@@ -64,6 +63,13 @@ kKeys_ = [Keys.BuildNumber,
+           Keys.VersionCommas,
+           Keys.VersionString]
+ 
++def ParseReleaseDate(value: str) -> str:
++    try:
++        return datetime.date.fromisoformat(value).strftime("%Y-%m-%d")
++    except ValueError as ex:
++        raise argparse.ArgumentTypeError(
++            f"invalid release date '{value}'; expected YYYY-MM-DD") from ex
++
+ def ParseArguments():
+     parser = argparse.ArgumentParser(description='Generate versions')
+     parser.add_argument("-c", "--cache",
+@@ -126,6 +132,12 @@ def ParseArguments():
+                         dest     = "version_",
+                         type     = str,
                          required = True)
++    parser.add_argument("--release-date",
++                        metavar  = "YYYY-MM-DD",
++                        help     = "release date (YYYY-MM-DD)",
++                        dest     = "releaseDate_",
++                        type     = ParseReleaseDate,
++                        required = True)
      return parser.parse_args()
  
-+def GetYearFromLicense(license_file: pathlib.Path):
-+    import re
-+    for line in license_file.read_text().splitlines():
-+        m = re.search(r'^\s*Copyright \(c\) 2021-(\d{4,})', line)
-+        if m is not None:
-+            return int(m.group(1))
-+    raise RuntimeError(f"Could not find copyright year in {license_file}")
-+
  def CollectVersionInfo(args):
-     print("Collecting version info")
+@@ -133,24 +145,12 @@ def CollectVersionInfo(args):
  
      versionInfo = VersionInfo()
  
 -    repo = git.Repo(args.gitRepo_, search_parent_directories = True)
 -
 -    commitString = str(repo.head.commit)[:10]
+-    releaseDate  = datetime.datetime.fromtimestamp(
+-        repo.head.commit.committed_date, tz=datetime.timezone.utc).strftime("%Y-%m-%d")
 -
 -    if not repo.is_dirty(submodules = False):
 -        copyrightYear = datetime.datetime.fromtimestamp(repo.head.commit.committed_date).year
@@ -36,15 +85,15 @@ index c6c94020..000f6e6e 100644
 -        commitString  = commitString + "+dirty"
 -        copyrightYear = datetime.date.today().year
 -
--    resourceDir = str(args.gitRepo_).replace("\\", "\\\\")
--
+     resourceDir = str(args.gitRepo_).replace("\\", "\\\\")
+ 
      versionInfo.buildNumber_   = args.buildNumber_
 -    versionInfo.commitString_  = commitString
 -    versionInfo.copyrightYear_ = copyrightYear
--    versionInfo.resourceDir_   = resourceDir
+-    versionInfo.releaseDate_   = releaseDate
 +    versionInfo.commitString_  = "@rev@"
-+    versionInfo.copyrightYear_ = GetYearFromLicense(args.gitRepo_ / "LICENSE.txt")
-+    versionInfo.resourceDir_   = str(args.gitRepo_).replace("\\", "\\\\")
++    versionInfo.copyrightYear_ = datetime.date.fromisoformat(args.releaseDate_).year
++    versionInfo.releaseDate_   = args.releaseDate_
+     versionInfo.resourceDir_   = resourceDir
      versionInfo.versionString_ = args.version_
  
-     versionInfo.Calculate()
diff --git a/pkgs/by-name/su/supercell-wx/patches/use-find-package.patch b/pkgs/by-name/su/supercell-wx/patches/use-find-package.patch
index 58f1eba3baa9..d6b062cc4118 100644
--- a/pkgs/by-name/su/supercell-wx/patches/use-find-package.patch
+++ b/pkgs/by-name/su/supercell-wx/patches/use-find-package.patch
@@ -22,37 +22,36 @@ index 570af425..f2e7b2c8 100644
 -set(STB_INCLUDE_DIR ${CMAKE_CURRENT_SOURCE_DIR}/stb PARENT_SCOPE)
 +# Nix: set STB_INCLUDE_DIR in cmake flags
 diff --git a/scwx-qt/scwx-qt.cmake b/scwx-qt/scwx-qt.cmake
-index 4833b9c2..641fc637 100644
+index f73d70da..ed40e428 100644
 --- a/scwx-qt/scwx-qt.cmake
 +++ b/scwx-qt/scwx-qt.cmake
-@@ -13,14 +13,15 @@ set(CMAKE_CXX_STANDARD_REQUIRED ON)
+@@ -13,13 +13,14 @@ set(CMAKE_CXX_STANDARD_REQUIRED ON)
  
  OPTION(SCWX_DISABLE_CONSOLE "Disables the Windows console in release mode" ON)
  
 -find_package(Boost)
-+find_package(Boost REQUIRED COMPONENTS json timer atomic)
++find_package(Boost REQUIRED COMPONENTS json timer atomic program_options)
  find_package(Fontconfig)
 -find_package(geographiclib)
 +find_package(GeographicLib)
  find_package(geos)
  find_package(glm)
- find_package(OpenGL)
+ find_package(JPEG)
+ find_package(OpenGL REQUIRED)
++find_package(PNG)
  find_package(Python COMPONENTS Interpreter)
  find_package(SQLite3)
-+find_package(PNG)
- 
- find_package(QT NAMES Qt6
-              COMPONENTS Gui
-@@ -789,6 +790,7 @@ target_link_libraries(scwx-qt PUBLIC Qt${QT_VERSION_MAJOR}::Widgets
+ find_package(TIFF)
+@@ -872,6 +873,7 @@ target_link_libraries(scwx-qt PUBLIC Qt${QT_VERSION_MAJOR}::Widgets
                                       qt6ct-common
                                       qt6ct-widgets
                                       SQLite::SQLite3
 +                                     PNG::PNG
+                                      TIFF::TIFF
                                       wxdata)
  
- target_link_libraries(supercell-wx PRIVATE scwx-qt
 diff --git a/wxdata/wxdata.cmake b/wxdata/wxdata.cmake
-index 451efc13..86cbb42b 100644
+index 07fe8464..0624971d 100644
 --- a/wxdata/wxdata.cmake
 +++ b/wxdata/wxdata.cmake
 @@ -4,7 +4,8 @@ project(scwx-data)
@@ -60,8 +59,8 @@ index 451efc13..86cbb42b 100644
  include(CheckCXXSymbolExists)
  
 -find_package(Boost)
-+find_package(Boost REQUIRED COMPONENTS iostreams)
++find_package(Boost REQUIRED COMPONENTS iostreams url)
 +find_package(BZip2)
  find_package(cpr)
  find_package(LibXml2)
- find_package(OpenSSL)
+ find_package(libzip)
diff --git a/pkgs/by-name/sy/symfony-cli/package.nix b/pkgs/by-name/sy/symfony-cli/package.nix
index 6130898cd958..092f34cfa870 100644
--- a/pkgs/by-name/sy/symfony-cli/package.nix
+++ b/pkgs/by-name/sy/symfony-cli/package.nix
@@ -12,14 +12,14 @@
 
 buildGoModule (finalAttrs: {
   pname = "symfony-cli";
-  version = "5.18.1";
+  version = "5.18.2";
   vendorHash = "sha256-xAOp03sbtJv31nikkWHhBEHNQkDJ0RtPTPVPpw/6Eho=";
 
   src = fetchFromGitHub {
     owner = "symfony-cli";
     repo = "symfony-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-sd1C33n0Eo/lV9Uas+EcEojIYLRosuzcZn9se5dwukU=";
+    hash = "sha256-MWOpAnkdMF4bzBbbrxjTk4OYw03jKgEnCCuBZl3kKsU=";
     leaveDotGit = true;
     postFetch = ''
       git --git-dir $out/.git log -1 --pretty=%cd --date=format:'%Y-%m-%dT%H:%M:%SZ' > $out/SOURCE_DATE
diff --git a/pkgs/by-name/tk/tk-safe/package.nix b/pkgs/by-name/tk/tk-safe/package.nix
index 58ffdea9a73e..e1d734158d4f 100644
--- a/pkgs/by-name/tk/tk-safe/package.nix
+++ b/pkgs/by-name/tk/tk-safe/package.nix
@@ -21,12 +21,12 @@
 
 stdenv.mkDerivation rec {
   pname = "tk-safe";
-  version = "26.2.4";
-  revision = "28";
+  version = "26.2.6";
+  revision = "29";
 
   src = fetchurl {
     url = "https://api.snapcraft.io/api/v1/snaps/download/rLNeIGEaag0TKFQLO0TxF3ARXg3rcTNx_${revision}.snap";
-    hash = "sha512-5C0J4WFrlBUCGnNhHfi4TrZmDnu/ws/+ATSP2LmoPRhmjoJkW0WFmkwMzaEkbsrunpyK2g5c3gGFvuVlHJwTFQ==";
+    hash = "sha512-XvVXLmzopmzyIavLHcOItIe+wI9ACDTe/YOBYN7z8kAwA8Wlwf3Sz9eFQ2NZ6t25Am022uTI1WP8yi3Lt5fa7g==";
   };
 
   desktopItems = [
diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index a80cde29fbb1..5f0872632971 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -2556,9 +2556,9 @@
   };
 
   sshclientconfig = rec {
-    version = "2026.7.16";
+    version = "2026.7.30";
     url = "github:metio/tree-sitter-ssh-client-config?ref=${version}";
-    hash = "sha256-u0CcoXBiNAfiFJ+CV35Y7ZhmYEHmphDQWGTgaClX3gw=";
+    hash = "sha256-pZcEtZ9PBpydW4iVLPmnYCgLyEsi/UqRs7Szc6oEwio=";
     meta = {
       license = lib.licenses.cc0;
       maintainers = with lib.maintainers; [
diff --git a/pkgs/by-name/tu/tutanota-desktop/package.nix b/pkgs/by-name/tu/tutanota-desktop/package.nix
index 4bcdbca68547..e3266e3d1778 100644
--- a/pkgs/by-name/tu/tutanota-desktop/package.nix
+++ b/pkgs/by-name/tu/tutanota-desktop/package.nix
@@ -8,11 +8,11 @@
 
 appimageTools.wrapType2 rec {
   pname = "tutanota-desktop";
-  version = "355.260710.0";
+  version = "355.260720.0";
 
   src = fetchurl {
     url = "https://github.com/tutao/tutanota/releases/download/tutanota-desktop-release-${version}/tutanota-desktop-linux.AppImage";
-    hash = "sha256-HlR9dXXxnXwUTM0Xlovu1+G5rgH87dYxLgbp2qyAFbM=";
+    hash = "sha256-sdKth9sy5yQ9cs4xQg4/zsgdvitxByKl8NCJgo3lL4o=";
   };
 
   extraPkgs = pkgs: [ pkgs.libsecret ];
diff --git a/pkgs/by-name/uu/uutils-procps/package.nix b/pkgs/by-name/uu/uutils-procps/package.nix
index a9b1d0ba7ae3..59fb6e5931d7 100644
--- a/pkgs/by-name/uu/uutils-procps/package.nix
+++ b/pkgs/by-name/uu/uutils-procps/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "uutils-procps";
-  version = "0.0.1-unstable-2026-07-22";
+  version = "0.0.1-unstable-2026-08-01";
 
   src = fetchFromGitHub {
     owner = "uutils";
     repo = "procps";
-    rev = "610131519ff76cd2ebddd17441c2daf1e3653ffa";
-    hash = "sha256-D1aPex36SJ307SGKQV+zOnjfihTvSsRuNQKdM6lEzAQ=";
+    rev = "bf003c760701e16e8028d15477aea9b5fa89b25a";
+    hash = "sha256-fE2f3SI4tlN4IakAYHetQlBd29Tj1BEZmevIryc8D1M=";
   };
 
-  cargoHash = "sha256-uR43hwO+cIxLO4PFrF13MUUxLF+ISCy94ZmHwbVrS7Q=";
+  cargoHash = "sha256-WNMQ3smycaxdfo2Fhrs2ZkYjubwxoeyIxCTT1v8cUw0=";
 
   cargoBuildFlags = [ "--workspace" ];
 
diff --git a/pkgs/by-name/va/vale-ls/package.nix b/pkgs/by-name/va/vale-ls/package.nix
index 5b32cf53cd7e..598b1feb1251 100644
--- a/pkgs/by-name/va/vale-ls/package.nix
+++ b/pkgs/by-name/va/vale-ls/package.nix
@@ -11,13 +11,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "vale-ls";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "vale-cli";
     repo = "vale-ls";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lRRKRQTxgXF4E+XghJ5AOp+mtWtiCT13EcsPVydn4Uo=";
+    hash = "sha256-KgPSFyjKdXfjdZfoxHrhEUj1Km8oh1gd9eGSHKlsliM=";
   };
 
   nativeBuildInputs = [
@@ -42,7 +42,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   env.OPENSSL_NO_VENDOR = true;
 
-  cargoHash = "sha256-KPgi0wZh1+PTKUmvCkLGPf+DZW5Tt4dQVK/cdxjm/1A=";
+  cargoHash = "sha256-7hiNI7tzfA95SWJfbRpf9FuyU/9bQlp5Uix6c36ycyE=";
 
   postInstall = ''
     wrapProgram $out/bin/vale-ls \
diff --git a/pkgs/by-name/vp/vpcs/package.nix b/pkgs/by-name/vp/vpcs/package.nix
index f70cba5ea043..258e79efc224 100644
--- a/pkgs/by-name/vp/vpcs/package.nix
+++ b/pkgs/by-name/vp/vpcs/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vpcs";
-  version = "0.8.3";
+  version = "0.8.4";
 
   src = fetchFromGitHub {
     owner = "GNS3";
     repo = "vpcs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-OKi4sC4fmKtkJkkpHZ6OfeIDaBafVrJXGXh1R6gLPFY=";
+    hash = "sha256-sWqQDf3xqrr6k7MFXV/9K9KdsEAvftsDkGlSUhA5CmY=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/src";
diff --git a/pkgs/by-name/vp/vpxtool/package.nix b/pkgs/by-name/vp/vpxtool/package.nix
index 58c391f45b56..6136d1418072 100644
--- a/pkgs/by-name/vp/vpxtool/package.nix
+++ b/pkgs/by-name/vp/vpxtool/package.nix
@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "vpxtool";
-  version = "0.33.6";
+  version = "0.33.8";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "francisdb";
     repo = "vpxtool";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cgFylbxPEMhynuFH0sfyq0IvSA18K2s/Yn43Z1NbjLQ=";
+    hash = "sha256-cAB/18aYSbDK/u7aTKX0FrmnIwnsVcEMESGXwy9iNMo=";
   };
 
-  cargoHash = "sha256-xsVtNxNQy76KdoZQpfd+h+RvJRLRAQq2gzU+WUiVya4=";
+  cargoHash = "sha256-VuTYT7GpASp2CWsH2zz/AraRLGNlYOLIIwynTRxtc7U=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
 
diff --git a/pkgs/by-name/wa/wasm-component-ld/package.nix b/pkgs/by-name/wa/wasm-component-ld/package.nix
index 5d410f71fad3..9f9f5f9c89fc 100644
--- a/pkgs/by-name/wa/wasm-component-ld/package.nix
+++ b/pkgs/by-name/wa/wasm-component-ld/package.nix
@@ -6,7 +6,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wasm-component-ld";
-  version = "0.5.27";
+  version = "0.5.28";
 
   __structuredAttrs = true;
 
@@ -14,10 +14,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "bytecodealliance";
     repo = "wasm-component-ld";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-AXMJRKWFcd9tcyxKasRY/k/WT4K/3FlY9nJ6M/jv6VI=";
+    hash = "sha256-LABzedj3CsQMpgPeSCNxV6EohaAtyrqfHDIlolqlYO4=";
   };
 
-  cargoHash = "sha256-yFNxNV/rS+P2PtX2ktWdBl2S9Z0/gsZv77wkgWErgic=";
+  cargoHash = "sha256-u1rV51QwPG7ZCB6d/P9+seO8yumxUJ9iQ3N58zijbGc=";
 
   # Tests require a rustc that can target wasm32-wasip1, including std. This is awkward for
   # Nixpkgs to provide at the same time as providing a rustc that's targetting the actual target.
diff --git a/pkgs/by-name/wo/wootility/package.nix b/pkgs/by-name/wo/wootility/package.nix
index e41c29742542..f26600a4a96b 100644
--- a/pkgs/by-name/wo/wootility/package.nix
+++ b/pkgs/by-name/wo/wootility/package.nix
@@ -7,10 +7,10 @@
 
 let
   pname = "wootility";
-  version = "5.3.2";
+  version = "5.4.1";
   src = fetchurl {
     url = "https://wootility-updates.ams3.cdn.digitaloceanspaces.com/wootility-linux/Wootility-${version}.AppImage";
-    sha256 = "sha256-XCQTVFUv5SkqQamC8uJqJ2sHqU2ap2jvkzDGjTUuWug=";
+    sha256 = "sha256-QqkkfLi0teDH5E0mm4hnY42msgE/z1RV1Rl4+Tt+TaQ=";
   };
 in
 
diff --git a/pkgs/by-name/z8/z88dk/package.nix b/pkgs/by-name/z8/z88dk/package.nix
index 9f987a04ce21..4699bf91b1a4 100644
--- a/pkgs/by-name/z8/z88dk/package.nix
+++ b/pkgs/by-name/z8/z88dk/package.nix
@@ -136,6 +136,10 @@ stdenv.mkDerivation (finalAttrs: {
     rm src/z80asm/t/z80asm_lib.t
   '';
 
+  # z88dk-z80asm triggers buffer overflow detection with FORTIFY_SOURCE=3.
+  # Upstream bug: https://github.com/z88dk/z88dk/issues/3042
+  hardeningDisable = [ "fortify" ];
+
   # Parallel building is not working yet with the upstream Makefiles.
   # Explicitly switch this off for now.
   enableParallelBuilding = false;
diff --git a/pkgs/development/python-modules/aioweenect/default.nix b/pkgs/development/python-modules/aioweenect/default.nix
index 951244f60829..d00ea8a60dd0 100644
--- a/pkgs/development/python-modules/aioweenect/default.nix
+++ b/pkgs/development/python-modules/aioweenect/default.nix
@@ -5,12 +5,13 @@
   buildPythonPackage,
   fetchFromGitHub,
   hatchling,
+  pyprojectVersionPatchHook,
   pytest-asyncio,
   pytest-cov-stub,
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "aioweenect";
   version = "1.1.7";
   pyproject = true;
@@ -18,7 +19,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "eifinger";
     repo = "aioweenect";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-YaIOCBBfL2lC6EPwBShVbPXiVlic7zK6pNOWjBJ/Y7I=";
   };
 
@@ -31,6 +32,8 @@ buildPythonPackage rec {
 
   build-system = [ hatchling ];
 
+  nativeBuildInputs = [ pyprojectVersionPatchHook ];
+
   dependencies = [ aiohttp ];
 
   nativeCheckInputs = [
@@ -47,8 +50,8 @@ buildPythonPackage rec {
   meta = {
     description = "Library for the weenect API";
     homepage = "https://github.com/eifinger/aioweenect";
-    changelog = "https://github.com/eifinger/aioweenect/releases/tag/v${version}";
+    changelog = "https://github.com/eifinger/aioweenect/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/alpha-vantage/default.nix b/pkgs/development/python-modules/alpha-vantage/default.nix
index 5cafb34343ef..ecbb55c737aa 100644
--- a/pkgs/development/python-modules/alpha-vantage/default.nix
+++ b/pkgs/development/python-modules/alpha-vantage/default.nix
@@ -11,7 +11,7 @@
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "alpha-vantage";
   version = "3.0.0";
   pyproject = true;
@@ -19,11 +19,14 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "RomelTorres";
     repo = "alpha_vantage";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-Ae9WqEsAjJcD62NZOPh6a49g1wY4KMswzixDAZEtWkw=";
   };
 
   postPatch = ''
+    substituteInPlace setup.py \
+      --replace-fail "version='2.3.1'," "version='${finalAttrs.version}',"
+
     # Files are only linked
     rm alpha_vantage/async_support/*
     cp alpha_vantage/{cryptocurrencies.py,foreignexchange.py,techindicators.py,timeseries.py} alpha_vantage/async_support/
@@ -47,7 +50,7 @@ buildPythonPackage rec {
     requests-mock
     pytestCheckHook
   ]
-  ++ lib.concatAttrValues optional-dependencies;
+  ++ lib.flatten (builtins.attrValues finalAttrs.passthru.optional-dependencies);
 
   # Starting with 3.0.0 most tests require an API key
   doCheck = false;
@@ -57,8 +60,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python module for the Alpha Vantage API";
     homepage = "https://github.com/RomelTorres/alpha_vantage";
-    changelog = "https://github.com/RomelTorres/alpha_vantage/releases/tag/${version}";
+    changelog = "https://github.com/RomelTorres/alpha_vantage/releases/tag/v${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/amcrest/default.nix b/pkgs/development/python-modules/amcrest/default.nix
index 5144a6b07adf..54d19f0386ee 100644
--- a/pkgs/development/python-modules/amcrest/default.nix
+++ b/pkgs/development/python-modules/amcrest/default.nix
@@ -14,7 +14,7 @@
   urllib3,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "amcrest";
   version = "1.9.9";
   pyproject = true;
@@ -22,7 +22,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "tchellomello";
     repo = "python-amcrest";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-UPxs/sL8ZpUf29fpQFnLY4tV7qSQIxm0UVSl6Pm1dAY=";
   };
 
@@ -35,6 +35,11 @@ buildPythonPackage rec {
     })
   ];
 
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace-fail 'version="1.9.10",' 'version="${finalAttrs.version}",'
+  '';
+
   build-system = [ setuptools ];
 
   dependencies = [
@@ -56,8 +61,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python module for Amcrest and Dahua Cameras";
     homepage = "https://github.com/tchellomello/python-amcrest";
-    changelog = "https://github.com/tchellomello/python-amcrest/releases/tag/${src.tag}";
+    changelog = "https://github.com/tchellomello/python-amcrest/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.gpl2Only;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/ament-package/default.nix b/pkgs/development/python-modules/ament-package/default.nix
index 98af2d5d5dab..b14a689ecfc2 100644
--- a/pkgs/development/python-modules/ament-package/default.nix
+++ b/pkgs/development/python-modules/ament-package/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "ament-package";
-  version = "0.19.0";
+  version = "0.19.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ament";
     repo = "ament_package";
     tag = finalAttrs.version;
-    hash = "sha256-4NLrRcBM82Bu8hDufma3z5li/kJQCyJEJma0UBBBvKw=";
+    hash = "sha256-Eqj07xznL5gMYZF1FTPtgxqCIUVD6pFfct2vUcOHOkk=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/arxiv/default.nix b/pkgs/development/python-modules/arxiv/default.nix
index e76c832ac707..9bafe81fe146 100644
--- a/pkgs/development/python-modules/arxiv/default.nix
+++ b/pkgs/development/python-modules/arxiv/default.nix
@@ -8,7 +8,7 @@
   hatch-vcs,
 
   # dependencies
-  feedparser,
+  lxml,
   requests,
 
   # tests
@@ -17,14 +17,14 @@
 }:
 buildPythonPackage rec {
   pname = "arxiv";
-  version = "3.0.0";
+  version = "4.0.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lukasschwab";
     repo = "arxiv.py";
     tag = version;
-    hash = "sha256-o2Vqkr5Tlx7Iv1NEWDSU8X6hvlGUslIl4oHiRQNGdqI=";
+    hash = "sha256-nZhi0dPEiv6VLpacvcGvZhvvDkLalrs4IJvMVzb5MJI=";
   };
 
   build-system = [
@@ -33,7 +33,7 @@ buildPythonPackage rec {
   ];
 
   dependencies = [
-    feedparser
+    lxml
     requests
   ];
 
diff --git a/pkgs/development/python-modules/asndb/default.nix b/pkgs/development/python-modules/asndb/default.nix
new file mode 100644
index 000000000000..5058b59362a6
--- /dev/null
+++ b/pkgs/development/python-modules/asndb/default.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  blasthttp,
+  buildPythonPackage,
+  cachetools,
+  fetchPypi,
+  nix-update-script,
+  radixtarget,
+  setuptools,
+  typer,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "asndb";
+  version = "1.1.0";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchPypi {
+    inherit (finalAttrs) pname version;
+    hash = "sha256-Q1qXQepm1ouBfJwQVHKfiMPV66lLlsqZGxWa1Asj0Mo=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    blasthttp
+    cachetools
+    radixtarget
+    typer
+  ];
+
+  # Tests require network access
+  doCheck = false;
+
+  pythonImportsCheck = [ "asndb" ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Library for looking up ASNs by IP or AS number";
+    homepage = "https://pypi.org/project/asndb";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/awslambdaric/default.nix b/pkgs/development/python-modules/awslambdaric/default.nix
index 8db5470a6c50..dbeb6d1d9e7f 100644
--- a/pkgs/development/python-modules/awslambdaric/default.nix
+++ b/pkgs/development/python-modules/awslambdaric/default.nix
@@ -16,14 +16,14 @@
 }:
 buildPythonPackage rec {
   pname = "awslambdaric";
-  version = "4.0.1";
+  version = "4.0.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-lambda-python-runtime-interface-client";
     tag = version;
-    sha256 = "sha256-wlQTYFbC/5gmal4xx9XHAxpdzEhGaD9N28BrhDUKV5A=";
+    sha256 = "sha256-bEkaZUAAtilHLuUUvKloeF25DuesAr8RpKcxZq8Tqts=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/dask/default.nix b/pkgs/development/python-modules/dask/default.nix
index e767f05cd464..3c83bd0e6eda 100644
--- a/pkgs/development/python-modules/dask/default.nix
+++ b/pkgs/development/python-modules/dask/default.nix
@@ -44,7 +44,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "dask";
-  version = "2026.7.0";
+  version = "2026.7.1";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -52,7 +52,7 @@ buildPythonPackage (finalAttrs: {
     owner = "dask";
     repo = "dask";
     tag = finalAttrs.version;
-    hash = "sha256-Lp8l4luwCGUmLWzwhAYBn8lrXH2bLTnMO7JCD+TqrKU=";
+    hash = "sha256-Hh3QMSLMn7xCbwoiu4gjjF590YXZfiG5rp20kWX+Kms=";
   };
 
   postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
diff --git a/pkgs/development/python-modules/deptry/default.nix b/pkgs/development/python-modules/deptry/default.nix
index 3fef82922dfc..b2771b13bd5e 100644
--- a/pkgs/development/python-modules/deptry/default.nix
+++ b/pkgs/development/python-modules/deptry/default.nix
@@ -6,9 +6,10 @@
   colorama,
   fetchFromGitHub,
   packaging,
-  python,
+  pyprojectVersionPatchHook,
   pytest-xdist,
   pytestCheckHook,
+  python,
   requirements-parser,
   rustc,
   rustPlatform,
@@ -39,6 +40,8 @@ buildPythonPackage (finalAttrs: {
     rustc
   ];
 
+  nativeBuildInputs = [ pyprojectVersionPatchHook ];
+
   dependencies = [
     click
     colorama
diff --git a/pkgs/development/python-modules/distributed/default.nix b/pkgs/development/python-modules/distributed/default.nix
index c22fdcc53516..9f2fb7ebe6c3 100644
--- a/pkgs/development/python-modules/distributed/default.nix
+++ b/pkgs/development/python-modules/distributed/default.nix
@@ -26,7 +26,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "distributed";
-  version = "2026.7.0";
+  version = "2026.7.1";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -34,7 +34,7 @@ buildPythonPackage (finalAttrs: {
     owner = "dask";
     repo = "distributed";
     tag = finalAttrs.version;
-    hash = "sha256-JwN+Ey+Ii8mELa6oVS+SDiOPYyMcKdaiSjjMqDze+kc=";
+    hash = "sha256-9QZb7PpPhdJEc4Kgoc3PE6TU7LHmiw58jkgfaoSNSg4=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/groq/default.nix b/pkgs/development/python-modules/groq/default.nix
index 8546a62c4da6..68f4dc6760ce 100644
--- a/pkgs/development/python-modules/groq/default.nix
+++ b/pkgs/development/python-modules/groq/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "groq";
-  version = "1.5.0";
+  version = "1.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "groq";
     repo = "groq-python";
     tag = "v${version}";
-    hash = "sha256-WtibHngPubo4p+xtdvqqDTvRFMk+dSBmxjoQxVPyXQM=";
+    hash = "sha256-HxdLV6aTnF8d6OLFwIuVIfxHCtcl2fH9o4x0dWOkMt0=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/hy/default.nix b/pkgs/development/python-modules/hy/default.nix
index 4dc38d26b6dc..f7ae0b54113c 100644
--- a/pkgs/development/python-modules/hy/default.nix
+++ b/pkgs/development/python-modules/hy/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "hy";
-  version = "1.3.0";
+  version = "1.3.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "hylang";
     repo = "hy";
     tag = version;
-    hash = "sha256-B8luwaIDUMdMZk/QZNKTM+ejCvJR8LoIcuQCCqsqu2k=";
+    hash = "sha256-qNgPuFG/j/q1osu/IJ8JbF+l/XiCphdhUYPOKbLEgTk=";
   };
 
   # https://github.com/hylang/hy/blob/1.0a4/get_version.py#L9-L10
diff --git a/pkgs/development/python-modules/kaggle/default.nix b/pkgs/development/python-modules/kaggle/default.nix
index 7c748b51a265..4b2f24d2a3e9 100644
--- a/pkgs/development/python-modules/kaggle/default.nix
+++ b/pkgs/development/python-modules/kaggle/default.nix
@@ -23,14 +23,14 @@ buildPythonPackage (finalAttrs: {
   __structuredAttrs = true;
 
   pname = "kaggle";
-  version = "2.2.3";
+  version = "2.2.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Kaggle";
     repo = "kaggle-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NvSR3kSncBtjj2zuwESGXRMbZofYcnRnXIglRJ3dsrQ=";
+    hash = "sha256-G/9Z6sLapCoM1LLavn/y3jAsJeOBLnf7xL1ffixazPM=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/labelbox/default.nix b/pkgs/development/python-modules/labelbox/default.nix
index 185bf0e6e0ce..f564adf76c6b 100644
--- a/pkgs/development/python-modules/labelbox/default.nix
+++ b/pkgs/development/python-modules/labelbox/default.nix
@@ -30,14 +30,14 @@
 }:
 
 let
-  version = "7.8.0";
+  version = "7.9.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Labelbox";
     repo = "labelbox-python";
     tag = "v${version}";
-    hash = "sha256-l+2BSkfZIwu0d3hEB7jq3CzampRYkNA9jaJnMlode68=";
+    hash = "sha256-6NTrac0C1rFFVk2+/Nt82p9VH1WxwYMkgVP2uqn+j2k=";
   };
 
   lbox-clients = buildPythonPackage {
diff --git a/pkgs/development/python-modules/llama-stack-client/default.nix b/pkgs/development/python-modules/llama-stack-client/default.nix
index 267d487befe4..24f75a29411b 100644
--- a/pkgs/development/python-modules/llama-stack-client/default.nix
+++ b/pkgs/development/python-modules/llama-stack-client/default.nix
@@ -32,13 +32,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "llama-stack-client";
-  version = "0.7.4";
+  version = "0.7.5";
   pyproject = true;
 
   src = fetchPypi {
     pname = "llama_stack_client";
     inherit (finalAttrs) version;
-    hash = "sha256-SxPWXuH1ob5eYoZyWWs2YWsyElJufS28QXnby2hgwWc=";
+    hash = "sha256-gNQZu8uLHOwuGQU25XZXbtL7v0eIJGXXL8YGHvncrbI=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/llm-ollama/default.nix b/pkgs/development/python-modules/llm-ollama/default.nix
index 50c6000d0fcd..7e0011b043b7 100644
--- a/pkgs/development/python-modules/llm-ollama/default.nix
+++ b/pkgs/development/python-modules/llm-ollama/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "llm-ollama";
-  version = "0.16.1";
+  version = "0.16.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "taketwo";
     repo = "llm-ollama";
     tag = version;
-    hash = "sha256-PoFn/nl7CU9I3ssBMpkUMp0akQxQDz1bbht9ko+Tpc0=";
+    hash = "sha256-xQmUN1PKZofyy+Q4pWHl386gJg499GczDGc1SVsnWCg=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/markitdown/default.nix b/pkgs/development/python-modules/markitdown/default.nix
index 8ed51e46c207..f084dd26b193 100644
--- a/pkgs/development/python-modules/markitdown/default.nix
+++ b/pkgs/development/python-modules/markitdown/default.nix
@@ -41,14 +41,14 @@ let
 in
 buildPythonPackage (finalAttrs: {
   pname = "markitdown";
-  version = "0.1.6";
+  version = "0.1.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "markitdown";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pLL44w2jVj5X5/TmPqSveQe/9WLj0ddDUYPoSQlz+9E=";
+    hash = "sha256-iipiyUFwnmEGyJvnXmJZun/GQl7TDbvwgEYB4MtFWgk=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/packages/markitdown";
diff --git a/pkgs/development/python-modules/napari-plugin-engine/default.nix b/pkgs/development/python-modules/napari-plugin-engine/default.nix
index 0f13ea554067..206e73fa0f85 100644
--- a/pkgs/development/python-modules/napari-plugin-engine/default.nix
+++ b/pkgs/development/python-modules/napari-plugin-engine/default.nix
@@ -31,7 +31,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "First generation napari plugin engine";
     homepage = "https://github.com/napari/napari-plugin-engine";
-    changelog = "https://github.com/napari/napari-plugin-engine/releases/tag/{finalAttrs.src.tag}";
+    changelog = "https://github.com/napari/napari-plugin-engine/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ SomeoneSerge ];
   };
diff --git a/pkgs/development/python-modules/openinference-instrumentation/default.nix b/pkgs/development/python-modules/openinference-instrumentation/default.nix
index d86bfeefe993..e0f9f164b37e 100644
--- a/pkgs/development/python-modules/openinference-instrumentation/default.nix
+++ b/pkgs/development/python-modules/openinference-instrumentation/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "openinference-instrumentation";
-  version = "0.1.54";
+  version = "0.1.56";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -27,7 +27,7 @@ buildPythonPackage (finalAttrs: {
     owner = "Arize-ai";
     repo = "openinference";
     tag = "python-openinference-instrumentation-v${finalAttrs.version}";
-    hash = "sha256-6GWZmgb9ZcT/yx7MvGUQlht5fljQGCKMHMpJWZQKpPI=";
+    hash = "sha256-E9S+S4cAIhfRTVxAXPQMzqfWVlgLuGqdg0cAhV6W75U=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/python/${finalAttrs.pname}";
diff --git a/pkgs/development/python-modules/openinference-semantic-conventions/default.nix b/pkgs/development/python-modules/openinference-semantic-conventions/default.nix
index a7a129cc1cc3..bc38d6ca569e 100644
--- a/pkgs/development/python-modules/openinference-semantic-conventions/default.nix
+++ b/pkgs/development/python-modules/openinference-semantic-conventions/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "openinference-semantic-conventions";
-  version = "0.1.30";
+  version = "0.1.31";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -19,7 +19,7 @@ buildPythonPackage (finalAttrs: {
     owner = "Arize-ai";
     repo = "openinference";
     tag = "python-openinference-semantic-conventions-v${finalAttrs.version}";
-    hash = "sha256-MkgajZknHOw4/qra6uZ99rtpiylpHhOj8tDfLGUSU74=";
+    hash = "sha256-ewOmAqNrJrMKsOgreqCJ7OFwJz15D+CB9uyzrCCuHVk=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/python/${finalAttrs.pname}";
diff --git a/pkgs/development/python-modules/papis/default.nix b/pkgs/development/python-modules/papis/default.nix
index 6fbfbac761cc..4eb60b37b24d 100644
--- a/pkgs/development/python-modules/papis/default.nix
+++ b/pkgs/development/python-modules/papis/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch2,
 
   # build-system
   hatchling,
@@ -15,7 +16,6 @@
   dominate,
   filetype,
   habanero,
-  isbnlib,
   lxml,
   platformdirs,
   prompt-toolkit,
@@ -25,7 +25,6 @@
   python-slugify,
   pyyaml,
   requests,
-  stevedore,
 
   # optional dependencies
   chardet,
@@ -70,7 +69,6 @@ buildPythonPackage (finalAttrs: {
     dominate
     filetype
     habanero
-    isbnlib
     lxml
     platformdirs
     prompt-toolkit
@@ -80,7 +78,6 @@ buildPythonPackage (finalAttrs: {
     python-slugify
     pyyaml
     requests
-    stevedore
   ]
   ++ lib.optionals withOptDeps finalAttrs.passthru.optional-dependencies.complete;
 
@@ -111,27 +108,39 @@ buildPythonPackage (finalAttrs: {
     "tests"
   ];
 
-  disabledTestPaths = [
-    # Require network access
-    "tests/downloaders"
-    "papis/downloaders/usenix.py"
-  ];
-
   disabledTests = [
     # Require network access
     "test_add_folder_name_cli"
     "test_add_link_cli"
+    "test_download_document"
     "test_get_matching_importers_by_name"
     "test_matching_importers_by_uri"
     "test_yaml_unicode_dump"
-    # FileNotFoundError: Command not found: 'init'
-    "test_git_cli"
   ]
   ++ lib.optionals withOptDeps [
     # Require network access
     "test_csl_style_download"
   ];
 
+  # Until a release >0.15.0 (that would already contain these commits)
+  patches = [
+    # Commit 44c6463: chore: move isbnlib to optional dependencies
+    (fetchpatch2 {
+      url = "https://github.com/papis/papis/commit/44c6463f79cbc3a09adb541ae7df4e00a194b86b.patch?full_index=1";
+      hash = "sha256-3E18cyzkiZsNvgH/X8dZu+3tGGpbBsaQ3nIoDuIYFqw=";
+    })
+    # Commit 7518e53: chore: remove isbn dependency
+    (fetchpatch2 {
+      url = "https://github.com/papis/papis/commit/7518e53e5d485e3cec1e202af6cb4921b9976b5b.patch?full_index=1";
+      hash = "sha256-iBqlvHfH+6fyhi2C7lpwI1O59DKrKp7p45x29kzPRR0=";
+    })
+    # Commit 15cae59: test: skip tests if missing isbnlib
+    (fetchpatch2 {
+      url = "https://github.com/papis/papis/commit/15cae5986ae9dec75c7d103757adbd73c39feb89.patch?full_index=1";
+      hash = "sha256-kuVZdOd+H99TinM7yAs7NJrfw7rOPyxDlSaT0P2NeC4=";
+    })
+  ];
+
   meta = {
     description = "Powerful command-line document and bibliography manager";
     mainProgram = "papis";
@@ -140,7 +149,7 @@ buildPythonPackage (finalAttrs: {
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [
       nico202
-      teto
+      octvs
     ];
   };
 })
diff --git a/pkgs/development/python-modules/plaid-python/default.nix b/pkgs/development/python-modules/plaid-python/default.nix
index 70c3395ec5f8..6cf5986c0feb 100644
--- a/pkgs/development/python-modules/plaid-python/default.nix
+++ b/pkgs/development/python-modules/plaid-python/default.nix
@@ -10,13 +10,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "plaid-python";
-  version = "40.1.0";
+  version = "42.0.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "plaid_python";
     inherit (finalAttrs) version;
-    hash = "sha256-y5EmVNyPLQGBPGF45Yny1fIT92daC9tlOhTBcnxFkqY=";
+    hash = "sha256-3+AMimjYDU9BEKOgOp3IsEcPjGPazgZQ93kDLerM90k=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pyairtable/default.nix b/pkgs/development/python-modules/pyairtable/default.nix
index fcd4d58105b5..c36060632216 100644
--- a/pkgs/development/python-modules/pyairtable/default.nix
+++ b/pkgs/development/python-modules/pyairtable/default.nix
@@ -19,12 +19,12 @@
 
 buildPythonPackage rec {
   pname = "pyairtable";
-  version = "3.4.0";
+  version = "3.4.2";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-umABkxSJSMEACenkRJSRkJp9qLqUvIv6r4ZGsO6MA8o=";
+    hash = "sha256-apF01DgAlmZgVH4H0Ac2s6D973W1CHt27oug6AnAQu4=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pylatexenc/default.nix b/pkgs/development/python-modules/pylatexenc/default.nix
index d07b43412db3..503ac226bf5b 100644
--- a/pkgs/development/python-modules/pylatexenc/default.nix
+++ b/pkgs/development/python-modules/pylatexenc/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "pylatexenc";
-  version = "2.10";
+  version = "2.11";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "phfaist";
     repo = "pylatexenc";
     rev = "v${version}";
-    hash = "sha256-3Ho04qrmCtmmrR+BUJNbtdCZcK7lXhUGJjm4yfCTUkM=";
+    hash = "sha256-Zv3Sjx0YpSCnoHHf3CSiGaFMS7FNgUUwvIxNX/k9tOg=";
   };
 
   pythonImportsCheck = [ "pylatexenc" ];
diff --git a/pkgs/development/python-modules/pylsl/default.nix b/pkgs/development/python-modules/pylsl/default.nix
index 8def5f08ee6e..0a7c783fef9b 100644
--- a/pkgs/development/python-modules/pylsl/default.nix
+++ b/pkgs/development/python-modules/pylsl/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "pylsl";
-  version = "1.18.3.b1";
+  version = "1.18.4.b1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "labstreaminglayer";
     repo = "pylsl";
     tag = "v${version}";
-    hash = "sha256-AVnRkkzAiPGcnnDL7ZxsnY7R76DcqPcG1M5Fg4ZRSX0=";
+    hash = "sha256-Glcx+G7CXMftAkyYqgTN8sK6M9u0ccZK9L7JID217Hk=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/radixtarget/default.nix b/pkgs/development/python-modules/radixtarget/default.nix
index 5ade2268a5ef..dde4501a1af6 100644
--- a/pkgs/development/python-modules/radixtarget/default.nix
+++ b/pkgs/development/python-modules/radixtarget/default.nix
@@ -1,37 +1,61 @@
 {
   lib,
   buildPythonPackage,
-  fetchFromGitHub,
+  cargo,
+  fetchPypi,
+  nix-update-script,
   poetry-core,
-  poetry-dynamic-versioning,
+  pytestCheckHook,
+  rustc,
+  rustPlatform,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "radixtarget";
-  version = "3.0.0";
+  version = "4.2.0";
   pyproject = true;
 
-  src = fetchFromGitHub {
-    owner = "blacklanternsecurity";
-    repo = "radixtarget";
-    rev = "v${version}";
-    hash = "sha256-C7QmiAc8SO7ddfseoGDYkmrkLoxmAGww9MPhBX94ucg=";
+  __structuredAttrs = true;
+
+  src = fetchPypi {
+    inherit (finalAttrs) pname version;
+    hash = "sha256-xroXgy7e7XXWPOYFMnt5ou2bJKSl6unBsUGa29v6+Dk=";
+  };
+
+  postUnpack = ''
+    rm -f "$sourceRoot/dist/"*.whl
+  '';
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-opo/P7oHKcKFWjXuXIhjUoz60IQ0iqlUtqptOJXWrk4=";
   };
 
   build-system = [
+    cargo
     poetry-core
-    poetry-dynamic-versioning
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+    rustc
   ];
 
-  # Module has no tests
-  doCheck = false;
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  preCheck = ''
+    cp -r radixtarget/test ./
+    rm -rf radixtarget
+  '';
+
+  pytestFlags = [ "test" ];
 
   pythonImportsCheck = [ "radixtarget" ];
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
-    description = "Radix implementation designed for lookups of IP addresses/networks and DNS hostnames";
-    homepage = "https://github.com/blacklanternsecurity/radixtarget";
+    description = "Fast radix tree for IP addresses and DNS names";
+    homepage = "https://pypi.org/project/radixtarget";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/remarshal/default.nix b/pkgs/development/python-modules/remarshal/default.nix
index 7f1ab5ca1e09..b563a6257128 100644
--- a/pkgs/development/python-modules/remarshal/default.nix
+++ b/pkgs/development/python-modules/remarshal/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "remarshal";
-  version = "2.1.3"; # test with `nix-build pkgs/pkgs-lib/tests -A formats`
+  version = "2.1.4"; # test with `nix-build pkgs/pkgs-lib/tests -A formats`
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "remarshal-project";
     repo = "remarshal";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-n+V2+xSzrBH58F10yKhDiCLvQmlPfDx6rP+ysEGpZg4=";
+    hash = "sha256-QMz8XNdoI0ZNox7ah7flr67K7573y3rjWdHgOba1Rhg=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/requests-cache/default.nix b/pkgs/development/python-modules/requests-cache/default.nix
index 2f340c535413..74b4ff06e86a 100644
--- a/pkgs/development/python-modules/requests-cache/default.nix
+++ b/pkgs/development/python-modules/requests-cache/default.nix
@@ -98,7 +98,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Persistent cache for requests library";
     homepage = "https://github.com/reclosedev/requests-cache";
-    changelog = "https://github.com/requests-cache/requests-cache/blob/$v{finalAttrs.version}/HISTORY.md";
+    changelog = "https://github.com/requests-cache/requests-cache/blob/v${finalAttrs.version}/HISTORY.md";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index 9d2d53382b5e..f45b577a6995 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "tencentcloud-sdk-python";
-  version = "3.1.147";
+  version = "3.1.148";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = finalAttrs.version;
-    hash = "sha256-ggeM+WKpilDBtedKp3avdn4qqiNwLJ5balaVjZPknfg=";
+    hash = "sha256-u3ALIUq2fEj+2RIbwKO36zR7/DdhCYs6mUlzF0f0oPk=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/testcontainers/default.nix b/pkgs/development/python-modules/testcontainers/default.nix
index dd35cd70b37b..04482683b867 100644
--- a/pkgs/development/python-modules/testcontainers/default.nix
+++ b/pkgs/development/python-modules/testcontainers/default.nix
@@ -16,14 +16,15 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "testcontainers";
-  version = "4.14.2";
+  version = "4.15.0";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "testcontainers";
     repo = "testcontainers-python";
     tag = "testcontainers-v${finalAttrs.version}";
-    hash = "sha256-AsRTCEICdxrDnsQyfEY19a7Fox9erSJVTykLN3RUlOE=";
+    hash = "sha256-QJf7a7eA+UlxE6trO54APaEQdPqCkU8g5wJ0MbsuBkk=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/tmdbsimple/default.nix b/pkgs/development/python-modules/tmdbsimple/default.nix
index af5a9a8019d8..7bd486796e37 100644
--- a/pkgs/development/python-modules/tmdbsimple/default.nix
+++ b/pkgs/development/python-modules/tmdbsimple/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "tmdbsimple";
-  version = "2.9.6";
+  version = "2.9.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "celiao";
     repo = "tmdbsimple";
     tag = finalAttrs.version;
-    hash = "sha256-ooyfwRCvH980gym8ujpLxbmR7FYfi59gGXqT8K40pNw=";
+    hash = "sha256-bKSvknFnqF/QXdJZfQu6RCufXp6u4zvr8IAo8WToWf8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/trueskill/default.nix b/pkgs/development/python-modules/trueskill/default.nix
index 51d8baadf93d..ce70d2543876 100644
--- a/pkgs/development/python-modules/trueskill/default.nix
+++ b/pkgs/development/python-modules/trueskill/default.nix
@@ -2,28 +2,36 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  setuptools,
   six,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "trueskill";
   version = "0.4.5";
-  format = "setuptools";
+  pyproject = true;
+
+  __structuredAttrs = true;
 
   src = fetchPypi {
-    inherit pname version;
-    sha256 = "1fv7g1szyjykja9mzax2w4js7jm2z7wwzgnr5dqrsdi84j6v8qlx";
+    pname = "trueskill";
+    inherit (finalAttrs) version;
+    hash = "sha256-nWK0jSQoNp1xK9m+z/n5osqjJeGiq1+TktNL/3V4Z7s=";
   };
 
-  propagatedBuildInputs = [ six ];
+  build-system = [ setuptools ];
+
+  dependencies = [ six ];
 
   # Can't build distribute, see https://github.com/NixOS/nixpkgs/pull/49340
   doCheck = false;
 
+  pythonImportsCheck = [ "trueskill" ];
+
   meta = {
     description = "Video game rating system";
     homepage = "https://trueskill.org";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ eadwu ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/types-openpyxl/default.nix b/pkgs/development/python-modules/types-openpyxl/default.nix
index bfcb893c1959..63c4dcb61b7f 100644
--- a/pkgs/development/python-modules/types-openpyxl/default.nix
+++ b/pkgs/development/python-modules/types-openpyxl/default.nix
@@ -6,14 +6,14 @@
 }:
 buildPythonPackage (finalAttrs: {
   pname = "types-openpyxl";
-  version = "3.1.5.20260518";
+  version = "3.1.5.20260724";
 
   pyproject = true;
 
   src = fetchPypi {
     pname = "types_openpyxl";
     inherit (finalAttrs) version;
-    hash = "sha256-2pzWROToAhWj9gqMLCyOmA6UGptYHP+jh2KFqnkcpa8=";
+    hash = "sha256-27IA+KYVvoIFIjFKfacPGw5fRwIp4KmnJVDNy9xiR7E=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/warp-lang/default.nix b/pkgs/development/python-modules/warp-lang/default.nix
index f64ad1f22d0f..0aab14898d9e 100644
--- a/pkgs/development/python-modules/warp-lang/default.nix
+++ b/pkgs/development/python-modules/warp-lang/default.nix
@@ -5,13 +5,14 @@
   cudaPackages,
   callPackage,
   fetchFromGitHub,
+  fetchpatch,
   jax,
   lib,
-  llvmPackages, # TODO: use llvm 21 in 1.10, see python-packages.nix
+  symlinkJoin,
+  llvmPackages, # llvm 21, matching warp's build-from-source LLVM (see python-packages.nix)
   numpy,
   pkgsBuildHost,
   python,
-  replaceVars,
   runCommand,
   setuptools,
   stdenv,
@@ -19,6 +20,7 @@
   warp-lang, # Self-reference to this package for passthru.tests
   writableTmpDirAsHomeHook,
   writeShellApplication,
+  zlib,
 
   # Use standalone LLVM-based JIT compiler and CPU device support
   standaloneSupport ? true,
@@ -43,7 +45,7 @@ let
 in
 buildPythonPackage.override { stdenv = effectiveStdenv; } (finalAttrs: {
   pname = "warp-lang";
-  version = "1.11.0";
+  version = "1.15.0";
   pyproject = true;
 
   # TODO(@connorbaker): Some CUDA setup hook is failing when __structuredAttrs is false,
@@ -55,13 +57,18 @@ buildPythonPackage.override { stdenv = effectiveStdenv; } (finalAttrs: {
     owner = "NVIDIA";
     repo = "warp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wV4F6E4l0lfPB8zk/XhmdMNk649j5aJelW/DVu2R5mM=";
+    hash = "sha256-XHgurCEbsFqgJIW5gfP8H3UYInrpP0VKl1D/Qnvb8c4=";
   };
 
-  patches = lib.optionals standaloneSupport [
-    (replaceVars ./dynamic-link.patch {
-      LLVM_LIB = llvmPackages.llvm.lib;
-      LIBCLANG_LIB = llvmPackages.libclang.lib;
+  patches = [
+    # Fix dangling-reference bugs in clang.cpp's LLVM 21 path that segfault when JIT-compiling any
+    # CPU kernel. Also folds in the LLVM 19+ getHostCPUFeatures() guard we used to patch locally.
+    # Fixed upstream after v1.15.0: https://github.com/NVIDIA/warp/pull/1645
+    # TODO: drop once part of a tagged release.
+    (fetchpatch {
+      name = "fix-diagnostics-lifetime-llvm21.patch";
+      url = "https://github.com/NVIDIA/warp/commit/309c6147a6d19c3a01159a145d50c56ec1f34101.patch";
+      hash = "sha256-KZ7X7CViYol+XPK8Z7rQoaI8ccTfaTK8o5zGubGvjHA=";
     })
   ];
 
@@ -71,9 +78,15 @@ buildPythonPackage.override { stdenv = effectiveStdenv; } (finalAttrs: {
       --replace-fail \
         '"-D", f"CMAKE_CXX_FLAGS=-D_GLIBCXX_USE_CXX11_ABI=0 {abi_version}",  # The pre-C++11 ABI is still the default on the CentOS 7 toolchain' \
         ""
-
+  ''
+  # Drop the pre-C++11 ABI flag from both the g++ (.cpp, space-separated) and the nvcc
+  # (.cu, comma-separated in --compiler-options) command lines.
+  # If only one is dropped, the .cpp and .cu objects disagree on the std::string ABI and fail to link:
+  # warp 1.14.0's apic_load_graph_cuda_setup() passes a std::string across the .cpp/.cu boundary.
+  + ''
     substituteInPlace "$PWD/warp/_src/build_dll.py" \
-      --replace-fail " -D_GLIBCXX_USE_CXX11_ABI=0" ""
+      --replace-fail " -D_GLIBCXX_USE_CXX11_ABI=0" "" \
+      --replace-fail ",-D_GLIBCXX_USE_CXX11_ABI=0" ""
   ''
   + lib.optionalString effectiveStdenv.hostPlatform.isDarwin (
     ''
@@ -93,16 +106,28 @@ buildPythonPackage.override { stdenv = effectiveStdenv; } (finalAttrs: {
     substituteInPlace "$PWD/warp/_src/build_dll.py" \
       --replace-fail "clang++" "${effectiveStdenv.cc}/bin/cc"
   ''
-  + lib.optionalString standaloneSupport ''
-    substituteInPlace "$PWD/warp/_src/build_dll.py" \
-      --replace-fail \
-        '-I"{warp_home_path.parent}/external/llvm-project/out/install/{mode}-{arch}/include"' \
-        '-I"${llvmPackages.llvm.dev}/include"' \
-      --replace-fail \
-        '-I"{warp_home_path.parent}/_build/host-deps/llvm-project/release-{arch}/include"' \
-        '-I"${llvmPackages.libclang.dev}/include"' \
-
-  ''
+  + lib.optionalString standaloneSupport (
+    ''
+      substituteInPlace "$PWD/warp/_src/build_dll.py" \
+        --replace-fail \
+          'warp_home_path.parent, "external", "llvm-project", "out", "install", f"{mode}-{arch}", "include"' \
+          '"${lib.getDev llvmPackages.llvm}", "include"' \
+        --replace-fail \
+          'warp_home_path.parent, "_build", "host-deps", "llvm-project", f"release-{arch}", "include"' \
+          '"${lib.getDev llvmPackages.libclang}", "include"'
+    ''
+    # Warp expects to find static LLVM/Clang archives in the LLVM lib directory and links against
+    # every one it finds.
+    # Nixpkgs only ships the shared libraries, so link against those (plus zlib, which libLLVM
+    # depends on) instead.
+    + ''
+      nixLog "patching $PWD/build_llvm.py to link against nixpkgs' shared LLVM/Clang libraries"
+      substituteInPlace "$PWD/build_llvm.py" \
+        --replace-fail \
+          'libs = [f"-l{lib[3:-2]}" for lib in libs if os.path.splitext(lib)[1] == ".a"]' \
+          'libs = ["-lclang-cpp", "-lLLVM", "-lz"]'
+    ''
+  )
   # Patch build_dll.py to use our gencode flags rather than NVIDIA's very broad defaults.
   + lib.optionalString cudaSupport (
     let
@@ -163,6 +188,7 @@ buildPythonPackage.override { stdenv = effectiveStdenv; } (finalAttrs: {
       llvmPackages.llvm
       llvmPackages.clang
       llvmPackages.libcxx
+      zlib
     ]
     ++ lib.optionals cudaSupport [
       (lib.getStatic cudaPackages.cuda_nvcc) # dependency on nvptxcompiler_static; no dynamic version available
@@ -181,23 +207,35 @@ buildPythonPackage.override { stdenv = effectiveStdenv; } (finalAttrs: {
 
   preBuild =
     let
+      llvmPath = symlinkJoin {
+        name = "llvm-path";
+        paths = [
+          (lib.getDev llvmPackages.libclang)
+          (lib.getLib llvmPackages.llvm)
+          (lib.getLib llvmPackages.libclang)
+        ];
+      };
       buildOptions =
-        lib.optionals effectiveStdenv.cc.isClang [
-          "--clang_build_toolchain"
+        lib.optionals standaloneSupport [
+          "--standalone"
+          "--llvm-path=${llvmPath}"
+        ]
+        ++ lib.optionals effectiveStdenv.cc.isClang [
+          "--clang-build-toolchain"
         ]
         ++ lib.optionals (!standaloneSupport) [
-          "--no_standalone"
+          "--no-standalone"
         ]
         ++ lib.optionals cudaSupport [
           # NOTE: The `cuda_path` argument is the directory which contains `bin/nvcc` (i.e., the bin output).
-          "--cuda_path=${lib.getBin pkgsBuildHost.cudaPackages.cuda_nvcc}"
+          "--cuda-path=${lib.getBin pkgsBuildHost.cudaPackages.cuda_nvcc}"
         ]
         ++ lib.optionals libmathdxSupport [
-          "--libmathdx"
-          "--libmathdx_path=${libmathdx}"
+          "--use-libmathdx"
+          "--libmathdx-path=${libmathdx}"
         ]
         ++ lib.optionals (!libmathdxSupport) [
-          "--no_libmathdx"
+          "--no-use-libmathdx"
         ];
 
       buildOptionString = lib.concatStringsSep " " buildOptions;
diff --git a/pkgs/development/python-modules/warp-lang/dynamic-link.patch b/pkgs/development/python-modules/warp-lang/dynamic-link.patch
deleted file mode 100644
index a0e04e0900e7..000000000000
--- a/pkgs/development/python-modules/warp-lang/dynamic-link.patch
+++ /dev/null
@@ -1,44 +0,0 @@
---- a/build_llvm.py
-+++ b/build_llvm.py
-@@ -378,34 +378,24 @@
-
-         clang_dll_path = os.path.join(build_path, "bin", lib_name)
-
--        if args.build_llvm:
--            # obtain Clang and LLVM libraries from the local build
--            install_path = os.path.join(llvm_install_path, f"{args.mode}-{arch}")
--            libpath = os.path.join(install_path, "lib")
--        else:
--            # obtain Clang and LLVM libraries from packman
--            fetch_prebuilt_libraries(arch)
--            libpath = os.path.join(base_path, "_build", "host-deps", "llvm-project", f"release-{arch}", "lib")
--
--        libs = []
--
--        for _, _, libraries in os.walk(libpath):
--            libs.extend(libraries)
--            break  # just the top level contains library files
-+        libs = ["LLVM", "clang-cpp"]
-+        install_paths = ["@LLVM_LIB@", "@LIBCLANG_LIB@"]
-+        libpaths = [os.path.join(install_path, "lib") for install_path in install_paths]
-
-         if os.name == "nt":
-             libs.append("Version.lib")
-             libs.append("Ws2_32.lib")
-             libs.append("ntdll.lib")
--            libs.append(f'/LIBPATH:"{libpath}"')
-+            libs.extend(f'/LIBPATH:"{libpath}"' for libpath in libpaths)
-         else:
--            libs = [f"-l{lib[3:-2]}" for lib in libs if os.path.splitext(lib)[1] == ".a"]
-+            libs = [f"-l{lib}" for lib in libs]
-             if sys.platform == "darwin":
-                 libs += libs  # prevents unresolved symbols due to link order
-             else:
-                 libs.insert(0, "-Wl,--start-group")
-                 libs.append("-Wl,--end-group")
--            libs.append(f"-L{libpath}")
-+            libs.extend(f"-L{libpath}" for libpath in libpaths)
-+            libs.append("-lz")
-             libs.append("-lpthread")
-             libs.append("-ldl")
-             if sys.platform != "darwin":
diff --git a/pkgs/servers/http/angie/default.nix b/pkgs/servers/http/angie/default.nix
index fc468d763bdf..14cc765c62a0 100644
--- a/pkgs/servers/http/angie/default.nix
+++ b/pkgs/servers/http/angie/default.nix
@@ -43,5 +43,8 @@ callPackage ../nginx/generic.nix args rec {
     license = lib.licenses.bsd2;
     platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [ izorkin ];
+    knownVulnerabilities = [
+      "angie is insufficiently maintained in nixpkgs. Security updates are frequently delayed. Please consider stepping up as maintainer or switching to an alternative."
+    ];
   };
 }
diff --git a/pkgs/tools/misc/steampipe-packages/steampipe-plugin-aws/default.nix b/pkgs/tools/misc/steampipe-packages/steampipe-plugin-aws/default.nix
index 1a46c4d84dca..6c148dfc1c04 100644
--- a/pkgs/tools/misc/steampipe-packages/steampipe-plugin-aws/default.nix
+++ b/pkgs/tools/misc/steampipe-packages/steampipe-plugin-aws/default.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "steampipe-plugin-aws";
-  version = "1.31.0";
+  version = "1.32.0";
 
   src = fetchFromGitHub {
     owner = "turbot";
     repo = "steampipe-plugin-aws";
     tag = "v${version}";
-    hash = "sha256-Mt9KUyV9BrCdwDwF9NzOdOTF90W4vpT3N2n/QaVo6qo=";
+    hash = "sha256-btP3GrcqfRA3ofbcNqWJ2DB2NrcgR1IgzHu43FP1RLk=";
   };
 
   vendorHash = "sha256-8ZVl70Lwz3j3PM3XljZGFaoGt+JP6TP+o5gOGoBlUY8=";
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 08d69741489e..4170973abee3 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1231,6 +1231,7 @@ mapAliases {
   layan-kde = throw "'layan-kde' has been removed, as it is only compatible with Plasma 5, which is EOL"; # Added 2025-08-20
   lazarus-qt = throw "'lazarus-qt' has been renamed to/replaced by 'lazarus-qt5'"; # Converted to throw 2025-10-27
   leaf = throw "'leaf' has been removed as it is unmaintained. Consider using 'fastfetch' instead"; # Added 2026-04-24
+  leafnode = throw "'leafnode' has been removed as it is unmaintained and depends on EOL library PCRE. Consider using leafnode1 instead"; # Added 2026-07-30
   ledger-agent = throw "ledger-agent has been removed because upstream dropped Ledger support"; # Added 2026-03-11
   ledger_agent = throw "ledger-agent has been removed because upstream dropped Ledger support"; # Added 2026-03-11
   lepton = throw "'lepton' has been removed as it is archived upstream and has known vulnerabilities (CVE-2022-4104). Consider using 'lepton-jpeg-util' instead"; # Added 2026-06-29
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index df6b03ec5ba0..9aff07bb77d4 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1399,6 +1399,8 @@ self: super: with self; {
 
   asn1tools = callPackage ../development/python-modules/asn1tools { };
 
+  asndb = callPackage ../development/python-modules/asndb { };
+
   aspectlib = callPackage ../development/python-modules/aspectlib { };
 
   aspell-python-py3 = callPackage ../development/python-modules/aspell-python-py3 { };
@@ -21973,8 +21975,12 @@ self: super: with self; {
   warlock = callPackage ../development/python-modules/warlock { };
 
   warp-lang = callPackage ../development/python-modules/warp-lang {
-    stdenv = if stdenv.hostPlatform.isDarwin then pkgs.llvmPackages_19.stdenv else pkgs.stdenv;
-    llvmPackages = pkgs.llvmPackages_19;
+    # warp targets LLVM 21 in its build-from-source path (build_llvm.py clones llvmorg-21.x) and
+    # guards native/clang/clang.cpp for LLVM up to 22, so it builds against nixpkgs' from-source
+    # LLVM 21. One getHostCPUFeatures() call is missing its version guard upstream; the derivation
+    # patches that. See the postPatch in warp-lang/default.nix.
+    stdenv = if stdenv.hostPlatform.isDarwin then pkgs.llvmPackages_21.stdenv else pkgs.stdenv;
+    llvmPackages = pkgs.llvmPackages_21;
   };
 
   warrant = callPackage ../development/python-modules/warrant { };