diff --git a/ci/nixpkgs-vet.nix b/ci/nixpkgs-vet.nix
index 6bdf92eedb3f..9dd200064994 100644
--- a/ci/nixpkgs-vet.nix
+++ b/ci/nixpkgs-vet.nix
@@ -31,6 +31,7 @@ runCommand "nixpkgs-vet"
     env.NIXPKGS_VET_NIX_PACKAGE = nix;
   }
   ''
+    export NIX_STORE_DIR=$(mktemp -d)
     export NIX_STATE_DIR=$(mktemp -d)
     $NIXPKGS_VET_NIX_PACKAGE/bin/nix-store --init
 
diff --git a/doc/release-notes/rl-2611.section.md b/doc/release-notes/rl-2611.section.md
index 51c0a4e2ccb7..cadc135ca33b 100644
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@@ -16,11 +16,6 @@
   +nixpkgs.url = "https://channels.nixos.org/nixos-26.05/nixexprs.tar.zst";
   ```
 
-- Emacs has been updated to 31.1.
-  This introduces some backwards‐incompatible changes; see the NEWS for details.
-  NEWS can be viewed from Emacs by typing `C-h n`, or by clicking `Help->Emacs News` from the menu bar.
-  It can also be browsed [online](https://cgit.git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-31).
-
 - `sing-box` now supports NaïveProxy outbounds.
 
 ## Backward Incompatibilities {#sec-nixpkgs-release-26.11-incompatibilities}
@@ -147,6 +142,8 @@
   [pnpm `fetcherVersion` section](#javascript-pnpm-fetcherVersion) of the manual
   for details.
 
+- `makeSetupHook` now uses structured attributes and only makes substitutions based on the values of the `substitutions` argument - other derivation attributes are no longer considered.
+
 - `rebuilderd` has been updated to 0.27.0 introducing breaking changes. See upstream changelog for details: [0.26.0](https://github.com/kpcyrd/rebuilderd/releases/tag/v0.26.0), [0.27.0](https://github.com/kpcyrd/rebuilderd/releases/tag/v0.27.0)
 
 - Starting with v14, `flameshot` will primarily utilise xdg-desktop-portal calls for screenshotting. This will directly affect users on X11 window managers due to the lack of a compatible portal with Screenshot feature. See [upstream changelog](https://github.com/flameshot-org/flameshot/releases/tag/v14.0.0) or [NixOS Flameshot](https://wiki.nixos.org/wiki/Flameshot) wiki page for workarounds.
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 28211810b4aa..d5ac949e9d06 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -21702,6 +21702,12 @@
     name = "Oops418";
     githubId = 93655215;
   };
+  opdavies = {
+    email = "oliver+github@oliverdavies.uk";
+    github = "opdavies";
+    githubId = 339813;
+    name = "Oliver Davies";
+  };
   opeik = {
     email = "sandro@stikic.com";
     github = "opeik";
@@ -23084,6 +23090,12 @@
     name = "Pradyuman Vig";
     keys = [ { fingerprint = "240B 57DE 4271 2480 7CE3  EAC8 4F74 D536 1C4C A31E"; } ];
   };
+  prauscher = {
+    email = "prauscher@prauscher.de";
+    github = "prauscher";
+    githubId = 175521;
+    name = "Patrick Rauscher";
+  };
   preisschild = {
     email = "florian@florianstroeger.com";
     github = "Preisschild";
@@ -23432,12 +23444,6 @@
     github = "pyle";
     githubId = 7279609;
   };
-  pyrotelekinetic = {
-    name = "Clover Ison";
-    email = "clover@isons.org";
-    github = "pyrotelekinetic";
-    githubId = 29682759;
-  };
   pyrox0 = {
     name = "Pyrox";
     email = "pyrox@pyrox.dev";
@@ -29386,6 +29392,12 @@
     github = "tpwrules";
     githubId = 208010;
   };
+  tr3foil = {
+    name = "Clover Ison";
+    email = "clover@isons.org";
+    github = "tr3foil";
+    githubId = 29682759;
+  };
   transcaffeine = {
     name = "transcaffeine";
     email = "transcaffeine@finally.coffee";
diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index d921a1ec1cb2..deb30bbdc45c 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -54,6 +54,8 @@
 
 - [mail-tlsa-check-exporter](https://github.com/ietf-tools/mail-tlsa-check-exporter), validates SMTP / IMAP server certificates against a TLSA record as a Prometheus exporter. Available as [services.prometheus.exporters.mail-tlsa-check](#opt-services.prometheus.exporters.mail-tlsa-check.enable).
 
+- [snowflake-prometheus-exporter](https://github.com/grafana/snowflake-prometheus-exporter), a Prometheus exporter for Snowflake metrics. Available as [services.prometheus.exporters.snowflake](#opt-services.prometheus.exporters.snowflake.enable).
+
 - [feishin](https://github.com/jeffvli/feishin), a modern self-hosted music player. Available as [services.feishin](#opt-services.feishin.enable).
 
 - [CastSponsorSkip](https://github.com/gabe565/CastSponsorSkip/), skips YouTube sponsorships (and sometimes ads) on all local Google Cast devices.
@@ -110,6 +112,8 @@
 
 - [Rundeck](https://www.rundeck.com), Self-Service Operations [services.rundeck](#opt-services.rundeck.enable).
 
+- [yet-another-cloudwatch-exporter](https://github.com/prometheus-community/yet-another-cloudwatch-exporter), a Prometheus exporter for AWS CloudWatch metrics. Available as [services.prometheus.exporters.yace](#opt-services.prometheus.exporters.yace.enable).
+
 ## Backward Incompatibilities {#sec-release-26.11-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -199,6 +203,8 @@
 
 - `services.pfix-srsd` and the supporting `pfixtools` package have been removed, as the project is dormant and does not support pcre2.  `services.postsrsd` is the recommended replacement for Sender Rewriting Scheme support with Postfix.
 
+- `services.quake3-server.port` has been removed in favor of the structured [](#opt-services.quake3-server.settings.net_port) option. Use `services.quake3-server.settings.net_port` to set any custom UDP port directly.
+
 - Package `overseerr` has been removed as the `overseerr` and `jellyseerr` projects were merged under `seerr`.
 
 - The papra NixOS module is now hardening the systemd unit by default. If this breaks any of the configured directories, please reconfigure them through `services.papra.environment` to enable sandbox passthrough.
diff --git a/nixos/lib/testing/testScript.nix b/nixos/lib/testing/testScript.nix
index 2ba9b682d3cb..591330a40fd8 100644
--- a/nixos/lib/testing/testScript.nix
+++ b/nixos/lib/testing/testScript.nix
@@ -7,20 +7,15 @@ testModuleArgs@{
   ...
 }:
 let
-  inherit (lib) mkOption types;
-  inherit (types) either lines functionTo;
+  inherit (lib) mkOption types const;
+  inherit (types) coercedTo lines functionTo;
 in
 {
   options = {
     testScript = mkOption {
-      type = either lines (functionTo lines);
-      apply =
-        v:
-        if lib.isFunction v then
-          # Only pass args the testScript function expects.
-          args: v (builtins.intersectAttrs (lib.functionArgs v) args)
-        else
-          v;
+      type = coercedTo lines const (functionTo lines);
+      # Only pass args the testScript function expects.
+      apply = v: args: v (builtins.intersectAttrs (lib.functionArgs v) args);
       description = ''
         A series of python declarations and statements that you write to perform
         the test.
@@ -50,23 +45,19 @@ in
     withoutTestScriptReferences.includeTestScriptReferences = false;
     withoutTestScriptReferences.testScript = lib.mkForce "testscript omitted";
 
-    testScriptString =
-      if lib.isFunction config.testScript then
-        config.testScript {
-          nodes = lib.mapAttrs (
-            k: v:
-            if v.virtualisation.useNixStoreImage then
-              # prevent infinite recursion when testScript would
-              # reference v's toplevel
-              config.withoutTestScriptReferences.nodesCompat.${k}
-            else
-              # reuse memoized config
-              v
-          ) config.nodesCompat;
-          containers = config.containers;
-        }
-      else
-        config.testScript;
+    testScriptString = config.testScript {
+      nodes = lib.mapAttrs (
+        k: v:
+        if v.virtualisation.useNixStoreImage then
+          # prevent infinite recursion when testScript would
+          # reference v's toplevel
+          config.withoutTestScriptReferences.nodesCompat.${k}
+        else
+          # reuse memoized config
+          v
+      ) config.nodesCompat;
+      containers = config.containers;
+    };
 
     nodeDefaults =
       { config, name, ... }:
diff --git a/nixos/modules/image/repart.nix b/nixos/modules/image/repart.nix
index cfa90fd5f512..97b096fe9230 100644
--- a/nixos/modules/image/repart.nix
+++ b/nixos/modules/image/repart.nix
@@ -58,7 +58,7 @@ let
           example = lib.literalExpression ''
             {
               "/EFI/BOOT/BOOTX64.EFI".source =
-                "''${pkgs.systemd}/lib/systemd/boot/efi/systemd-bootx64.efi";
+                "''${config.systemd.package}/lib/systemd/boot/efi/systemd-bootx64.efi";
 
               "/loader/entries/nixos.conf".source = systemdBootEntry;
             }
@@ -227,7 +227,7 @@ in
           "10-esp" = {
             contents = {
               "/EFI/BOOT/BOOTX64.EFI".source =
-                "''${pkgs.systemd}/lib/systemd/boot/efi/systemd-bootx64.efi";
+                "''${config.systemd.package}/lib/systemd/boot/efi/systemd-bootx64.efi";
             };
             repartConfig = {
               Type = "esp";
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 5c77c2014238..981e0f4ecf44 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1084,6 +1084,7 @@
   ./services/monitoring/nezha.nix
   ./services/monitoring/ocsinventory-agent.nix
   ./services/monitoring/opentelemetry-collector.nix
+  ./services/monitoring/orbit.nix
   ./services/monitoring/osquery.nix
   ./services/monitoring/parsedmarc.nix
   ./services/monitoring/perses.nix
diff --git a/nixos/modules/services/audio/mympd.nix b/nixos/modules/services/audio/mympd.nix
index 3e728abaa4de..5f0b027d33bf 100644
--- a/nixos/modules/services/audio/mympd.nix
+++ b/nixos/modules/services/audio/mympd.nix
@@ -108,7 +108,7 @@ in
         DynamicUser = true;
         ExecStart = lib.getExe cfg.package;
         LockPersonality = true;
-        MemoryDenyWriteExecute = true;
+        MemoryDenyWriteExecute = false; # pcre2 jit
         PrivateDevices = true;
         ProtectClock = true;
         ProtectControlGroups = true;
diff --git a/nixos/modules/services/backup/borgbackup.nix b/nixos/modules/services/backup/borgbackup.nix
index 59581daeb721..5fe2694c513e 100644
--- a/nixos/modules/services/backup/borgbackup.nix
+++ b/nixos/modules/services/backup/borgbackup.nix
@@ -154,7 +154,7 @@ let
       script =
         "exec "
         + lib.optionalString cfg.inhibitsSleep ''
-          ${pkgs.systemd}/bin/systemd-inhibit \
+          ${config.systemd.package}/bin/systemd-inhibit \
               --who="borgbackup" \
               --what="sleep" \
               --why="Scheduled backup" \
diff --git a/nixos/modules/services/backup/restic.nix b/nixos/modules/services/backup/restic.nix
index b7d6424fe424..8344fc84246a 100644
--- a/nixos/modules/services/backup/restic.nix
+++ b/nixos/modules/services/backup/restic.nix
@@ -392,7 +392,7 @@ in
       let
         extraOptions = lib.concatMapStrings (arg: " -o ${arg}") backup.extraOptions;
         inhibitCmd = lib.concatStringsSep " " [
-          "${pkgs.systemd}/bin/systemd-inhibit"
+          "${config.systemd.package}/bin/systemd-inhibit"
           "--mode='block'"
           "--who='restic'"
           "--what='sleep'"
diff --git a/nixos/modules/services/databases/mysql.nix b/nixos/modules/services/databases/mysql.nix
index d046076da878..fd29a8c667be 100644
--- a/nixos/modules/services/databases/mysql.nix
+++ b/nixos/modules/services/databases/mysql.nix
@@ -752,7 +752,7 @@ in
             "AF_INET6"
           ];
           LockPersonality = true;
-          MemoryDenyWriteExecute = true;
+          MemoryDenyWriteExecute = false; # pcre2 jit
           RestrictRealtime = true;
           RestrictSUIDSGID = true;
           PrivateMounts = true;
diff --git a/nixos/modules/services/display-managers/dms-greeter.nix b/nixos/modules/services/display-managers/dms-greeter.nix
index 9814e5cdc25a..cb6a4126ff9c 100644
--- a/nixos/modules/services/display-managers/dms-greeter.nix
+++ b/nixos/modules/services/display-managers/dms-greeter.nix
@@ -291,7 +291,7 @@ in
         };
         initial_session = mkIf (cfgAutoLogin.enable && (cfgAutoLogin.user != null)) {
           inherit (cfgAutoLogin) user;
-          command = ''${getExe pkgs.bash} -lc "${pkgs.systemd}/bin/systemd-cat $(<${autoLoginCommand})"'';
+          command = ''${getExe pkgs.bash} -lc "${config.systemd.package}/bin/systemd-cat $(<${autoLoginCommand})"'';
         };
       };
     };
diff --git a/nixos/modules/services/games/quake3-server.nix b/nixos/modules/services/games/quake3-server.nix
index 43aad73a4b04..a57535c88a3a 100644
--- a/nixos/modules/services/games/quake3-server.nix
+++ b/nixos/modules/services/games/quake3-server.nix
@@ -15,9 +15,16 @@ let
     ;
   cfg = config.services.quake3-server;
 
-  configFile = pkgs.writeText "q3ds-extra.cfg" ''
-    set net_port ${toString cfg.port}
+  toQuake3Value = value: if lib.isBool value then (if value then "1" else "0") else toString value;
 
+  toQuake3Config =
+    settings:
+    lib.concatStrings (
+      lib.mapAttrsToList (name: value: ''seta ${name} "${toQuake3Value value}"'' + "\n") settings
+    );
+
+  configFile = pkgs.writeText "q3ds-extra.cfg" ''
+    ${toQuake3Config cfg.settings}
     ${cfg.extraConfig}
   '';
 
@@ -50,19 +57,19 @@ let
   '';
 in
 {
+
+  imports = [
+    (lib.mkRenamedOptionModule
+      [ "services" "quake3-server" "port" ]
+      [ "services" "quake3-server" "settings" "net_port" ]
+    )
+  ];
+
   options = {
     services.quake3-server = {
       enable = mkEnableOption "Quake 3 dedicated server";
       package = lib.mkPackageOption pkgs "ioquake3" { };
 
-      port = mkOption {
-        type = types.port;
-        default = 27960;
-        description = ''
-          UDP Port the server should listen on.
-        '';
-      };
-
       openFirewall = mkOption {
         type = types.bool;
         default = false;
@@ -71,16 +78,59 @@ in
         '';
       };
 
+      settings = mkOption {
+        type = types.submodule {
+          freeformType = types.attrsOf (
+            types.nullOr (
+              types.oneOf [
+                types.str
+                types.bool
+                types.int
+                types.float
+                types.port
+              ]
+            )
+          );
+          options = {
+            net_port = lib.mkOption {
+              type = lib.types.port;
+              default = 27960;
+              description = "UDP port for the dedicated server to bind to.";
+            };
+          };
+        };
+        default = { };
+        example = {
+          sv_hostname = "My Quake 3 server";
+          g_gametype = 0;
+          sv_pure = true;
+        };
+        description = ''
+          Quake 3 cvars set via `seta` on server start (i.e. persisted,
+          archive-flagged cvars – the vast majority of server settings).
+          Note that options changed via RCON will not be persisted. To list
+          all possible options, use "cvarlist 1" via RCON.
+        '';
+      };
+
       extraConfig = mkOption {
         type = types.lines;
         default = "";
         example = ''
-          seta rconPassword "superSecret"      // sets RCON password for remote console
-          seta sv_hostname "My Quake 3 server"      // name that appears in server list
+          // map rotation and other things that don't map onto plain cvars
+          set d1 "map q3dm1 ; set nextmap vstr d2"
+          set d2 "map q3dm7 ; set nextmap vstr d1"
+          vstr d1
+
+          // rarely needed: cvars with a non-seta flag
+          sets sv_privatePassword "hidden"
         '';
         description = ''
-          Extra configuration options. Note that options changed via RCON will not be persisted. To list all possible
-          options, use "cvarlist 1" via RCON.
+          Extra configuration lines appended after `settings`, for anything
+          that isn't a plain persisted cvar: map-rotation scripts, `exec`,
+          `vstr`, aliases, or cvars that need `set`/`sets`/`sett`/`setu`
+          instead of `seta`. Note that options changed via RCON will not be
+          persisted. To list all possible options, use "cvarlist 1" via RCON.
         '';
       };
 
@@ -103,7 +153,7 @@ in
       baseq3InStore = builtins.typeOf cfg.baseq3 == "set";
     in
     mkIf cfg.enable {
-      networking.firewall.allowedUDPPorts = mkIf cfg.openFirewall [ cfg.port ];
+      networking.firewall.allowedUDPPorts = mkIf cfg.openFirewall [ cfg.settings.net_port ];
 
       systemd.services.q3ds = {
         description = "Quake 3 dedicated server";
@@ -115,7 +165,7 @@ in
         serviceConfig = with lib; {
           Restart = "always";
           DynamicUser = true;
-          WorkingDirectory = home;
+          WorkingDirectory = if baseq3InStore then home else cfg.baseq3;
 
           # It is possible to alter configuration files via RCON. To ensure reproducibility we have to prevent this
           ReadOnlyPaths = if baseq3InStore then home else cfg.baseq3;
diff --git a/nixos/modules/services/hardware/nvidia-container-toolkit/default.nix b/nixos/modules/services/hardware/nvidia-container-toolkit/default.nix
index 1a1365c5d420..c6c744ca8311 100644
--- a/nixos/modules/services/hardware/nvidia-container-toolkit/default.nix
+++ b/nixos/modules/services/hardware/nvidia-container-toolkit/default.nix
@@ -332,7 +332,7 @@
           # devices needed here become available. This is terribly broken and
           # essentially no better than a random sleep(). See PR #452645 for
           # an attempt to fix this issue.
-          ExecStartPre = "-${lib.getExe' pkgs.systemd "udevadm"} settle --timeout=180";
+          ExecStartPre = "-${lib.getExe' config.systemd.package "udevadm"} settle --timeout=180";
           ExecStart =
             let
               script = pkgs.callPackage ./cdi-generate.nix {
diff --git a/nixos/modules/services/home-automation/homebridge.nix b/nixos/modules/services/home-automation/homebridge.nix
index 9f0d379c6514..21c3ea048bb9 100644
--- a/nixos/modules/services/home-automation/homebridge.nix
+++ b/nixos/modules/services/home-automation/homebridge.nix
@@ -405,17 +405,17 @@ in
         commands = [
           {
             # Ability to restart homebridge service
-            command = "${pkgs.systemd}/bin/systemctl restart homebridge";
+            command = "${config.systemd.package}/bin/systemctl restart homebridge";
             options = [ "NOPASSWD" ];
           }
           {
             # Ability to shutdown server
-            command = "${pkgs.systemd}/bin/shutdown -h now";
+            command = "${config.systemd.package}/bin/shutdown -h now";
             options = [ "NOPASSWD" ];
           }
           {
             # Ability to restart server
-            command = "${pkgs.systemd}/bin/shutdown -r now";
+            command = "${config.systemd.package}/bin/shutdown -r now";
             options = [ "NOPASSWD" ];
           }
         ];
diff --git a/nixos/modules/services/mail/cyrus-imap.nix b/nixos/modules/services/mail/cyrus-imap.nix
index 32a9869dd3c7..94b7d35850a8 100644
--- a/nixos/modules/services/mail/cyrus-imap.nix
+++ b/nixos/modules/services/mail/cyrus-imap.nix
@@ -355,7 +355,7 @@ in
         PrivateDevices = true;
         ProtectSystem = "full";
         CapabilityBoundingSet = [ "~CAP_NET_ADMIN CAP_SYS_ADMIN CAP_SYS_BOOT CAP_SYS_MODULE" ];
-        MemoryDenyWriteExecute = true;
+        MemoryDenyWriteExecute = false; # pcre2 jit
         ProtectKernelModules = true;
         ProtectKernelTunables = true;
         ProtectControlGroups = true;
diff --git a/nixos/modules/services/mail/dovecot.nix b/nixos/modules/services/mail/dovecot.nix
index 48b0795c53c1..950ac5859b62 100644
--- a/nixos/modules/services/mail/dovecot.nix
+++ b/nixos/modules/services/mail/dovecot.nix
@@ -1061,7 +1061,7 @@ in
           "CAP_SYS_RESOURCE"
         ];
         LockPersonality = true;
-        MemoryDenyWriteExecute = true;
+        MemoryDenyWriteExecute = false; # pcre2 jit
         NoNewPrivileges = false; # e.g for sendmail
         OOMPolicy = "continue";
         PrivateTmp = true;
diff --git a/nixos/modules/services/mail/postfix.nix b/nixos/modules/services/mail/postfix.nix
index 7a11a332a5af..cfc6a08895d1 100644
--- a/nixos/modules/services/mail/postfix.nix
+++ b/nixos/modules/services/mail/postfix.nix
@@ -1011,7 +1011,7 @@ in
             PrivateDevices = true;
             ProtectSystem = "full";
             CapabilityBoundingSet = [ "~CAP_NET_ADMIN CAP_SYS_ADMIN CAP_SYS_BOOT CAP_SYS_MODULE" ];
-            MemoryDenyWriteExecute = true;
+            MemoryDenyWriteExecute = false; # pcre2 jit
             ProtectKernelModules = true;
             ProtectKernelTunables = true;
             ProtectControlGroups = true;
diff --git a/nixos/modules/services/misc/blenderfarm.nix b/nixos/modules/services/misc/blenderfarm.nix
index b66cfa2b5be4..fac671613684 100644
--- a/nixos/modules/services/misc/blenderfarm.nix
+++ b/nixos/modules/services/misc/blenderfarm.nix
@@ -96,7 +96,7 @@ in
         ln -s ${lib.getExe cfg.blenderPackage} BlenderData/nix-blender-linux64/blender
       ''
       + lib.optionalString (cfg.basicSecurityPasswordFile != null) ''
-        BLENDFARM_PASSWORD=$(${pkgs.systemd}/bin/systemd-creds cat BLENDFARM_PASS_FILE)
+        BLENDFARM_PASSWORD=$(${config.systemd.package}/bin/systemd-creds cat BLENDFARM_PASS_FILE)
         sed -i "s/null/\"$BLENDFARM_PASSWORD\"/g" ServerSettings
       '';
       serviceConfig = {
diff --git a/nixos/modules/services/misc/cfdyndns.nix b/nixos/modules/services/misc/cfdyndns.nix
index bd870c2acdda..4c37a7218f78 100644
--- a/nixos/modules/services/misc/cfdyndns.nix
+++ b/nixos/modules/services/misc/cfdyndns.nix
@@ -78,7 +78,7 @@ in
           export CLOUDFLARE_EMAIL="${cfg.email}"
         ''}
         ${lib.optionalString (cfg.apiTokenFile != null) ''
-          export CLOUDFLARE_APITOKEN=$(${pkgs.systemd}/bin/systemd-creds cat CLOUDFLARE_APITOKEN_FILE)
+          export CLOUDFLARE_APITOKEN=$(${config.systemd.package}/bin/systemd-creds cat CLOUDFLARE_APITOKEN_FILE)
         ''}
         ${pkgs.cfdyndns}/bin/cfdyndns
       '';
diff --git a/nixos/modules/services/misc/duckdns.nix b/nixos/modules/services/misc/duckdns.nix
index 3a9b6fa3bd42..bf746595a093 100644
--- a/nixos/modules/services/misc/duckdns.nix
+++ b/nixos/modules/services/misc/duckdns.nix
@@ -96,7 +96,7 @@ in
       startAt = "*:0/5";
       path = [
         pkgs.gnused
-        pkgs.systemd
+        config.systemd.package
         pkgs.curl
         pkgs.gawk
         duckdns
diff --git a/nixos/modules/services/misc/forgejo.nix b/nixos/modules/services/misc/forgejo.nix
index 6834ca2008ea..5ed68d6df619 100644
--- a/nixos/modules/services/misc/forgejo.nix
+++ b/nixos/modules/services/misc/forgejo.nix
@@ -777,7 +777,7 @@ in
         ];
         RestrictNamespaces = true;
         LockPersonality = true;
-        MemoryDenyWriteExecute = true;
+        MemoryDenyWriteExecute = false; # pcre2 jit
         RestrictRealtime = true;
         RestrictSUIDSGID = true;
         RemoveIPC = true;
diff --git a/nixos/modules/services/misc/gitea.nix b/nixos/modules/services/misc/gitea.nix
index 3a0f637c5ca6..6c334776462a 100644
--- a/nixos/modules/services/misc/gitea.nix
+++ b/nixos/modules/services/misc/gitea.nix
@@ -953,7 +953,7 @@ in
         ++ lib.optional (useSendmail && config.services.postfix.enable) "AF_NETLINK";
         RestrictNamespaces = true;
         LockPersonality = true;
-        MemoryDenyWriteExecute = true;
+        MemoryDenyWriteExecute = false; # pcre2 jit
         RestrictRealtime = true;
         RestrictSUIDSGID = true;
         RemoveIPC = true;
diff --git a/nixos/modules/services/monitoring/orbit.nix b/nixos/modules/services/monitoring/orbit.nix
new file mode 100644
index 000000000000..bbaa7f3a0627
--- /dev/null
+++ b/nixos/modules/services/monitoring/orbit.nix
@@ -0,0 +1,182 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.orbit;
+in
+{
+  options.services.orbit = {
+    enable = lib.mkEnableOption "Fleet Orbit agent" // {
+      description = "Enable the Fleet Orbit agent.";
+      example = lib.literalExpression ''
+        # Use an enrollment secret from a plaintext file managed outside the Nix store.
+        {
+          services.orbit = {
+            enable = true;
+            fleetUrl = "https://fleet.example.com";
+            enrollSecretPath = "/etc/fleet/enroll-secret";
+
+            desktop.enable = true;
+          };
+        }
+
+        # Use an enrollment secret from sops-nix.
+        { config, ... }:
+        {
+          sops.secrets.fleet-orbit-enroll-secret = { };
+
+          services.orbit = {
+            enable = true;
+            fleetUrl = "https://fleet.example.com";
+            enrollSecretPath = config.sops.secrets.fleet-orbit-enroll-secret.path;
+
+            desktop.enable = true;
+          };
+        }
+      '';
+    };
+
+    orbitPackage = lib.mkPackageOption pkgs "fleet-orbit" { };
+
+    osqueryPackage = lib.mkPackageOption pkgs "osquery" { };
+
+    desktop = {
+      enable = lib.mkEnableOption "Fleet Desktop tray application";
+
+      package = lib.mkPackageOption pkgs "fleet-desktop" { };
+
+      alternativeBrowserHost = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+        example = "fleet-browser.example.com";
+        description = ''
+          Alternative host to use for Fleet Desktop browser URLs. This can be
+          required when Fleet uses TLS client authentication.
+        '';
+      };
+    };
+
+    fleetUrl = lib.mkOption {
+      type = lib.types.str;
+      example = "https://fleet.example.com";
+      description = "The base URL of the Fleet server.";
+    };
+
+    enrollSecretPath = lib.mkOption {
+      type = lib.types.path;
+      example = "/run/secrets/fleet-enroll-secret";
+      description = ''
+        Path to a file containing the enroll secret for authenticating to the Fleet server.
+        This should point to a secret outside the Nix store, for example a sops-nix or agenix
+        secret path.
+      '';
+    };
+
+    fleetCertificate = lib.mkOption {
+      type = lib.types.path;
+      default = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
+      defaultText = lib.literalExpression "\"\${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt\"";
+      description = "Path to the Fleet server certificate chain.";
+    };
+
+    debug = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Enable debug logging.";
+    };
+
+    devMode = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Run Orbit in development mode.";
+    };
+
+    enableScripts = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Enable Fleet script execution.";
+    };
+
+    endUserEmail = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      example = "user@example.com";
+      description = "End-user email to pass to Orbit.";
+    };
+
+    fleetManagedHostIdentityCertificate = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Configure Orbit to use Fleet-managed host identity certificates.
+        This requires a Fleet Enterprise Edition subscription.
+      '';
+    };
+
+    hostIdentifier = lib.mkOption {
+      type = lib.types.nullOr (
+        lib.types.enum [
+          "uuid"
+          "instance"
+        ]
+      );
+      default = null;
+      example = "uuid";
+      description = "Host identifier mode to use when Orbit and osquery enroll to Fleet.";
+    };
+
+    insecure = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Disable TLS certificate verification.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.orbit = {
+      description = "Fleet Orbit agent";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+
+      environment = lib.filterAttrs (_: value: value != null) {
+        ORBIT_FLEET_URL = cfg.fleetUrl;
+        ORBIT_ENROLL_SECRET_PATH = "%d/enroll-secret";
+        ORBIT_FLEET_CERTIFICATE = cfg.fleetCertificate;
+        ORBIT_DEBUG = lib.boolToString cfg.debug;
+        ORBIT_DEV_MODE = lib.boolToString cfg.devMode;
+        ORBIT_ENABLE_SCRIPTS = lib.boolToString cfg.enableScripts;
+        ORBIT_END_USER_EMAIL = cfg.endUserEmail;
+        ORBIT_FLEET_MANAGED_HOST_IDENTITY_CERTIFICATE = lib.boolToString cfg.fleetManagedHostIdentityCertificate;
+        ORBIT_HOST_IDENTIFIER = cfg.hostIdentifier;
+        ORBIT_INSECURE = lib.boolToString cfg.insecure;
+        ORBIT_FLEET_DESKTOP_ALTERNATIVE_BROWSER_HOST = cfg.desktop.alternativeBrowserHost;
+
+        ORBIT_DISABLE_KEYSTORE = "true";
+        ORBIT_DISABLE_UPDATES = "true";
+        ORBIT_FLEET_DESKTOP = lib.boolToString cfg.desktop.enable;
+        ORBIT_LOG_FILE = "/var/log/orbit/orbit.log";
+        ORBIT_OSQUERY_DB = "/var/lib/orbit/osquery.db";
+        ORBIT_ROOT_DIR = "/var/lib/orbit";
+        NIX_ORBIT_OSQUERYD_PATH = lib.getExe' cfg.osqueryPackage "osqueryd";
+        NIX_ORBIT_OSQUERY_LOG_PATH = "/var/log/orbit/osquery";
+        NIX_ORBIT_DESKTOP_PATH = if cfg.desktop.enable then lib.getExe cfg.desktop.package else null;
+      };
+
+      serviceConfig = {
+        ExecStart = lib.getExe cfg.orbitPackage;
+        LoadCredential = [ "enroll-secret:${cfg.enrollSecretPath}" ];
+        StateDirectory = "orbit";
+        LogsDirectory = "orbit";
+        TimeoutStartSec = 0;
+        Restart = "always";
+        RestartSec = 60;
+        KillMode = "control-group";
+        KillSignal = "SIGTERM";
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/monitoring/prometheus/exporters.nix b/nixos/modules/services/monitoring/prometheus/exporters.nix
index 530315264562..8748745256e1 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters.nix
@@ -121,6 +121,7 @@ let
         "smartctl"
         "smokeping"
         "snmp"
+        "snowflake"
         "speedtest"
         "sql"
         "statsd"
@@ -135,6 +136,7 @@ let
         "varnish"
         "wireguard"
         "xray"
+        "yace"
         "zfs-siebenmann"
         "zfs"
       ]
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/snowflake.nix b/nixos/modules/services/monitoring/prometheus/exporters/snowflake.nix
new file mode 100644
index 000000000000..c1589147b3bd
--- /dev/null
+++ b/nixos/modules/services/monitoring/prometheus/exporters/snowflake.nix
@@ -0,0 +1,91 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.prometheus.exporters.snowflake;
+  inherit (lib)
+    mkIf
+    mkOption
+    types
+    optional
+    escapeShellArg
+    concatStringsSep
+    getExe
+    ;
+
+  # The private key is passed to systemd via LoadCredential, which exposes it in
+  # the per-service credentials directory (`%d`) readable by the service even
+  # under DynamicUser.
+  args = [
+    "--web.listen-address ${cfg.listenAddress}:${toString cfg.port}"
+    "--account ${escapeShellArg cfg.account}"
+    "--username ${escapeShellArg cfg.username}"
+    "--warehouse ${escapeShellArg cfg.warehouse}"
+    "--role ${escapeShellArg cfg.role}"
+  ]
+  ++ optional (cfg.privateKeyFile != null) "--private-key-path=%d/snowflake-private-key"
+  ++ cfg.extraFlags;
+in
+{
+  port = 9975;
+  extraOpts = {
+    account = mkOption {
+      type = types.str;
+      example = "xy12345.us-east-1";
+      description = "Snowflake account to collect metrics for (`--account`).";
+    };
+    username = mkOption {
+      type = types.str;
+      description = "Username used when querying metrics (`--username`).";
+    };
+    warehouse = mkOption {
+      type = types.str;
+      description = "Warehouse used when querying metrics (`--warehouse`).";
+    };
+    role = mkOption {
+      type = types.str;
+      default = "ACCOUNTADMIN";
+      description = "Role used when querying metrics (`--role`).";
+    };
+    privateKeyFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      example = "/run/secrets/snowflake-exporter.p8";
+      description = ''
+        Path to the user's RSA private key for key-pair authentication. The file
+        is passed to the service via {manpage}`systemd.exec(5)` credentials, so
+        it is read only by the exporter and never copied into the world-readable
+        Nix store. If the key is encrypted, supply its password via
+        {option}`environmentFile` (`SNOWFLAKE_EXPORTER_PRIVATE_KEY_PASSWORD`).
+
+        Mutually exclusive with password authentication; when set, do not also
+        provide `SNOWFLAKE_EXPORTER_PASSWORD`.
+      '';
+    };
+    environmentFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      example = "/run/secrets/snowflake-exporter.env";
+      description = ''
+        Path to an environment file, as defined in {manpage}`systemd.exec(5)`,
+        used to pass secrets without exposing them in the world-readable Nix
+        store or the process's command line. For password authentication set
+        `SNOWFLAKE_EXPORTER_PASSWORD`; for an encrypted key (see
+        {option}`privateKeyFile`) set `SNOWFLAKE_EXPORTER_PRIVATE_KEY_PASSWORD`.
+      '';
+    };
+  };
+  serviceOpts = {
+    serviceConfig = {
+      EnvironmentFile = mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
+      LoadCredential = mkIf (cfg.privateKeyFile != null) [
+        "snowflake-private-key:${cfg.privateKeyFile}"
+      ];
+      ExecStart = "${getExe pkgs.prometheus-snowflake-exporter} ${concatStringsSep " " args}";
+    };
+  };
+}
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/yace.nix b/nixos/modules/services/monitoring/prometheus/exporters/yace.nix
new file mode 100644
index 000000000000..f35020a30ec1
--- /dev/null
+++ b/nixos/modules/services/monitoring/prometheus/exporters/yace.nix
@@ -0,0 +1,59 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.prometheus.exporters.yace;
+  inherit (lib)
+    mkIf
+    mkOption
+    types
+    escapeShellArg
+    concatStringsSep
+    getExe
+    ;
+in
+{
+  port = 5000;
+  extraOpts = {
+    configFile = mkOption {
+      type = types.path;
+      description = ''
+        Path to the YACE configuration file, defining which CloudWatch
+        metrics to scrape. See
+        <https://github.com/prometheus-community/yet-another-cloudwatch-exporter#configuration>
+        for the format. AWS credentials are supplied separately via the
+        environment (see {option}`environmentFile`, an IMDS instance role,
+        or the usual `AWS_*` variables).
+      '';
+    };
+    environmentFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      example = "/run/secrets/yace.env";
+      description = ''
+        Path to an environment file, as defined in {manpage}`systemd.exec(5)`,
+        used to pass AWS credentials (e.g. `AWS_ACCESS_KEY_ID`,
+        `AWS_SECRET_ACCESS_KEY`, `AWS_REGION`) to the exporter without exposing
+        them in the world-readable Nix store. Not needed on EC2 with an IMDS
+        instance role.
+      '';
+    };
+  };
+  serviceOpts = {
+    serviceConfig = {
+      EnvironmentFile = mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
+      ExecStart = concatStringsSep " " (
+        [
+          (getExe pkgs.yet-another-cloudwatch-exporter)
+          "--config.file ${escapeShellArg cfg.configFile}"
+          "--listen-address ${cfg.listenAddress}:${toString cfg.port}"
+        ]
+        ++ cfg.extraFlags
+      );
+    };
+  };
+}
diff --git a/nixos/modules/services/monitoring/ups.nix b/nixos/modules/services/monitoring/ups.nix
index 24d013c642e2..f82806b014eb 100644
--- a/nixos/modules/services/monitoring/ups.nix
+++ b/nixos/modules/services/monitoring/ups.nix
@@ -361,7 +361,7 @@ let
             MONITOR = <generated from config.power.ups.upsmon.monitor>
             NOTIFYCMD = "''${cfg.package}/bin/upssched";
             POWERDOWNFLAG = "/run/killpower";
-            SHUTDOWNCMD = "''${pkgs.systemd}/bin/shutdown now";
+            SHUTDOWNCMD = "''${config.systemd.package}/bin/shutdown now";
           }
         '';
         description = "Additional settings to add to `upsmon.conf`.";
@@ -398,7 +398,7 @@ let
         );
         NOTIFYCMD = lib.mkDefault "${cfg.package}/bin/upssched";
         POWERDOWNFLAG = lib.mkDefault "/run/killpower";
-        SHUTDOWNCMD = lib.mkDefault "${pkgs.systemd}/bin/shutdown now";
+        SHUTDOWNCMD = lib.mkDefault "${config.systemd.package}/bin/shutdown now";
       };
     };
   };
diff --git a/nixos/modules/services/networking/autossh-ng.nix b/nixos/modules/services/networking/autossh-ng.nix
index c7f4f52ebaab..2a9217cc2956 100644
--- a/nixos/modules/services/networking/autossh-ng.nix
+++ b/nixos/modules/services/networking/autossh-ng.nix
@@ -120,7 +120,7 @@ in
                   else
                     "-o \"UserKnownHostsFile=/dev/null\" -o \"StrictHostKeyChecking=no\"";
                 ready = pkgs.writers.writeBash "systemd-signal-ready" ''
-                  ${pkgs.systemd}/bin/systemd-notify --ready
+                  ${config.systemd.package}/bin/systemd-notify --ready
                 '';
               in
               ''
diff --git a/nixos/modules/services/networking/clatd.nix b/nixos/modules/services/networking/clatd.nix
index 573d77e71d71..29d433652a51 100644
--- a/nixos/modules/services/networking/clatd.nix
+++ b/nixos/modules/services/networking/clatd.nix
@@ -97,7 +97,7 @@ in
         source = pkgs.writeShellScript "restart-clatd" ''
           [ "$DEVICE_IFACE" = "${cfg.settings.clat-dev or "clat"}" ] && exit 0
           [ "$2" != "up" ] && [ "$2" != "down" ] && exit 0
-          ${pkgs.systemd}/bin/systemctl restart clatd.service
+          ${config.systemd.package}/bin/systemctl restart clatd.service
         '';
       }
     ];
diff --git a/nixos/modules/services/networking/cloudflare-warp.nix b/nixos/modules/services/networking/cloudflare-warp.nix
index 9cd946903adc..0d7a1a987b51 100644
--- a/nixos/modules/services/networking/cloudflare-warp.nix
+++ b/nixos/modules/services/networking/cloudflare-warp.nix
@@ -73,6 +73,8 @@ in
             "${cfg.rootDir}"
             "/etc/resolv.conf"
           ];
+          # warp-svc uses this absolute FHS path instead of looking up nft in PATH.
+          BindReadOnlyPaths = [ "${lib.getExe pkgs.nftables}:/usr/sbin/nft" ];
           CapabilityBoundingSet = caps;
           AmbientCapabilities = caps;
           Restart = "always";
diff --git a/nixos/modules/services/networking/dhcpcd.nix b/nixos/modules/services/networking/dhcpcd.nix
index d2705d4fa2d9..614ee08b0c31 100644
--- a/nixos/modules/services/networking/dhcpcd.nix
+++ b/nixos/modules/services/networking/dhcpcd.nix
@@ -302,7 +302,7 @@ in
         ]
         ++ lib.optional cfg.setHostname (
           pkgs.writeShellScriptBin "hostname" ''
-            ${lib.getExe' pkgs.systemd "hostnamectl"} set-hostname --transient $1
+            ${lib.getExe' config.systemd.package "hostnamectl"} set-hostname --transient $1
           ''
         );
 
diff --git a/nixos/modules/services/networking/suricata/default.nix b/nixos/modules/services/networking/suricata/default.nix
index 4b3613690b36..ce371b209b44 100644
--- a/nixos/modules/services/networking/suricata/default.nix
+++ b/nixos/modules/services/networking/suricata/default.nix
@@ -273,7 +273,7 @@ in
               ProtectSystem = "strict";
               DevicePolicy = "closed";
               LockPersonality = true;
-              MemoryDenyWriteExecute = true;
+              MemoryDenyWriteExecute = false; # pcre2 jit
               ProtectHostname = true;
               ProtectProc = true;
               ProtectKernelLogs = true;
diff --git a/nixos/modules/services/security/pocket-id.nix b/nixos/modules/services/security/pocket-id.nix
index 547b3df6db54..b86e982e25c1 100644
--- a/nixos/modules/services/security/pocket-id.nix
+++ b/nixos/modules/services/security/pocket-id.nix
@@ -31,7 +31,8 @@ let
   format = pkgs.formats.keyValue { };
   settingsFile = format.generate "pocket-id-env-vars" cfg.settings;
 
-  exportCredentials = n: _: ''export ${n}="$(${pkgs.systemd}/bin/systemd-creds cat ${n}_FILE)"'';
+  exportCredentials =
+    n: _: ''export ${n}="$(${config.systemd.package}/bin/systemd-creds cat ${n}_FILE)"'';
   exportAllCredentials = vars: lib.concatStringsSep "\n" (lib.mapAttrsToList exportCredentials vars);
   getLoadCredentialList = lib.mapAttrsToList (n: v: "${n}_FILE:${v}") cfg.credentials;
 in
diff --git a/nixos/modules/services/web-apps/librechat.nix b/nixos/modules/services/web-apps/librechat.nix
index 87dbb08823c9..2612a68cb0fa 100644
--- a/nixos/modules/services/web-apps/librechat.nix
+++ b/nixos/modules/services/web-apps/librechat.nix
@@ -9,7 +9,8 @@ let
   meiliCfg = config.services.meilisearch;
   format = pkgs.formats.yaml { };
   configFile = format.generate "librechat.yaml" cfg.settings;
-  exportCredentials = n: _: ''export ${n}="$(${pkgs.systemd}/bin/systemd-creds cat ${n}_FILE)"'';
+  exportCredentials =
+    n: _: ''export ${n}="$(${config.systemd.package}/bin/systemd-creds cat ${n}_FILE)"'';
   exportAllCredentials = vars: lib.concatStringsSep "\n" (lib.mapAttrsToList exportCredentials vars);
   getLoadCredentialList = lib.mapAttrsToList (n: v: "${n}_FILE:${v}") cfg.credentials;
 in
diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index 2981504bce4a..afe84550cacc 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -1626,11 +1626,7 @@ in
           ];
           RestrictNamespaces = true;
           LockPersonality = true;
-          MemoryDenyWriteExecute =
-            !(
-              (builtins.any (mod: (mod.allowMemoryWriteExecute or false)) cfg.package.modules)
-              || (lib.getName cfg.package == "openresty")
-            );
+          MemoryDenyWriteExecute = false; # for pcre2 & several plugins
           RestrictRealtime = true;
           RestrictSUIDSGID = true;
           RemoveIPC = true;
diff --git a/nixos/modules/services/web-servers/unit/default.nix b/nixos/modules/services/web-servers/unit/default.nix
index 301f01b5cf48..a1f6be076e2f 100644
--- a/nixos/modules/services/web-servers/unit/default.nix
+++ b/nixos/modules/services/web-servers/unit/default.nix
@@ -139,7 +139,7 @@ in
           "AF_INET6"
         ];
         LockPersonality = true;
-        MemoryDenyWriteExecute = true;
+        MemoryDenyWriteExecute = false; # pcre2 jit
         RestrictRealtime = true;
         RestrictSUIDSGID = true;
         PrivateMounts = true;
diff --git a/nixos/modules/system/boot/clevis-luks-askpass.nix b/nixos/modules/system/boot/clevis-luks-askpass.nix
index 1d9685ff889c..417daaf4499c 100644
--- a/nixos/modules/system/boot/clevis-luks-askpass.nix
+++ b/nixos/modules/system/boot/clevis-luks-askpass.nix
@@ -55,7 +55,7 @@ in
 
       storePaths = [
         cfg.package
-        "${pkgs.systemd}/lib/systemd/systemd-reply-password"
+        "${config.systemd.package}/lib/systemd/systemd-reply-password"
         "${pkgs.jose}/bin/jose"
         "${pkgs.curl}/bin/curl"
         "${pkgs.cryptsetup}/bin/cryptsetup"
diff --git a/nixos/modules/system/boot/systemd/journald-gateway.nix b/nixos/modules/system/boot/systemd/journald-gateway.nix
index 76a858e1b471..804b09b074bd 100644
--- a/nixos/modules/system/boot/systemd/journald-gateway.nix
+++ b/nixos/modules/system/boot/systemd/journald-gateway.nix
@@ -92,7 +92,7 @@ in
     systemd.services.systemd-journal-gatewayd.serviceConfig.ExecStart = [
       # Clear the default command line
       ""
-      "${pkgs.systemd}/lib/systemd/systemd-journal-gatewayd ${cliArgs}"
+      "${config.systemd.package}/lib/systemd/systemd-journal-gatewayd ${cliArgs}"
     ];
 
     systemd.sockets.systemd-journal-gatewayd = {
diff --git a/nixos/modules/system/boot/systemd/journald-remote.nix b/nixos/modules/system/boot/systemd/journald-remote.nix
index fbb444b6400b..b8ca73e34908 100644
--- a/nixos/modules/system/boot/systemd/journald-remote.nix
+++ b/nixos/modules/system/boot/systemd/journald-remote.nix
@@ -123,7 +123,7 @@ in
     systemd.services.systemd-journal-remote.serviceConfig.ExecStart = [
       # Clear the default command line
       ""
-      "${pkgs.systemd}/lib/systemd/systemd-journal-remote ${cliArgs}"
+      "${config.systemd.package}/lib/systemd/systemd-journal-remote ${cliArgs}"
     ];
 
     systemd.sockets.systemd-journal-remote = {
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 47c566171e56..1f549b1ef5ce 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1330,6 +1330,7 @@ in
   openvswitch = runTest ./openvswitch.nix;
   optee = runTestOn [ "aarch64-linux" ] ./optee.nix;
   orangefs = runTest ./orangefs.nix;
+  orbit = runTestOn [ "x86_64-linux" ] ./orbit.nix;
   orthanc = runTest ./orthanc.nix;
   os-prober = handleTestOn [ "x86_64-linux" ] ./os-prober.nix { };
   osquery = handleTestOn [ "x86_64-linux" ] ./osquery.nix { };
diff --git a/nixos/tests/appliance-repart-image.nix b/nixos/tests/appliance-repart-image.nix
index bba163b463e4..7422233828a3 100644
--- a/nixos/tests/appliance-repart-image.nix
+++ b/nixos/tests/appliance-repart-image.nix
@@ -57,7 +57,7 @@ in
               in
               {
                 "/EFI/BOOT/BOOT${lib.toUpper efiArch}.EFI".source =
-                  "${pkgs.systemd}/lib/systemd/boot/efi/systemd-boot${efiArch}.efi";
+                  "${config.systemd.package}/lib/systemd/boot/efi/systemd-boot${efiArch}.efi";
 
                 "/EFI/Linux/${config.system.boot.loader.ukiFile}".source =
                   "${config.system.build.uki}/${config.system.boot.loader.ukiFile}";
diff --git a/nixos/tests/orbit.nix b/nixos/tests/orbit.nix
new file mode 100644
index 000000000000..2c9b1cfbc7a1
--- /dev/null
+++ b/nixos/tests/orbit.nix
@@ -0,0 +1,47 @@
+{ ... }:
+
+{
+  name = "orbit";
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.etc."fleet/enroll-secret".text = "test-secret";
+
+      services.orbit = {
+        enable = true;
+        orbitPackage = pkgs.writeShellApplication {
+          name = "orbit";
+          text = ''
+            test "$ORBIT_FLEET_URL" = "https://fleet.example.test"
+            test -r "$ORBIT_ENROLL_SECRET_PATH"
+            test "$(cat "$ORBIT_ENROLL_SECRET_PATH")" = "test-secret"
+            test -x "$NIX_ORBIT_OSQUERYD_PATH"
+            sleep infinity
+          '';
+        };
+        osqueryPackage = pkgs.writeShellApplication {
+          name = "osqueryd";
+          text = "echo osquery";
+        };
+        desktop = {
+          enable = true;
+          package = pkgs.writeShellApplication {
+            name = "fleet-desktop";
+            text = "echo fleet-desktop";
+          };
+          alternativeBrowserHost = "fleet-browser.example.test";
+        };
+        fleetUrl = "https://fleet.example.test";
+        enrollSecretPath = "/etc/fleet/enroll-secret";
+        debug = true;
+        enableScripts = true;
+        hostIdentifier = "uuid";
+      };
+    };
+
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("orbit.service")
+  '';
+}
diff --git a/nixos/tests/prometheus-exporters.nix b/nixos/tests/prometheus-exporters.nix
index 7a246ba5eb35..e6d47c45ccc9 100644
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@@ -1803,6 +1803,34 @@ let
         '';
       };
 
+    snowflake =
+      { pkgs, ... }:
+      {
+        exporterConfig = {
+          enable = true;
+          account = "dummy";
+          username = "dummy";
+          warehouse = "dummy";
+          # key-pair auth: exercises the LoadCredential + `%d` wiring. The key is
+          # never parsed until a scrape, so a dummy file is enough to boot.
+          privateKeyFile = pkgs.writeText "snowflake-key.p8" "dummy";
+          environmentFile = pkgs.writeText "snowflake-exporter.env" ''
+            SNOWFLAKE_EXPORTER_PRIVATE_KEY_PASSWORD=dummy
+          '';
+        };
+        # Only the landing page is checked. Scraping `/metrics` would run the
+        # collector, which synchronously queries Snowflake and blocks until the
+        # driver's login timeout (~45s) with no reachable server. Booting with
+        # key-pair auth already exercises config validation and the
+        # LoadCredential/environmentFile wiring; the landing page confirms the
+        # exporter booted and is serving.
+        exporterTest = ''
+          wait_for_unit("prometheus-snowflake-exporter.service")
+          wait_for_open_port(9975)
+          succeed("curl -sSf http://localhost:9975/ | grep -i 'Snowflake exporter'")
+        '';
+      };
+
     sql =
       { ... }:
       {
@@ -2141,6 +2169,30 @@ let
         '';
       };
 
+    yace =
+      { pkgs, ... }:
+      {
+        exporterConfig = {
+          enable = true;
+          configFile = pkgs.writeText "yace-config.yml" ''
+            apiVersion: v1alpha1
+            sts-region: us-east-1
+            discovery:
+              jobs:
+                - type: AWS/EC2
+                  regions: [us-east-1]
+                  metrics:
+                    - name: CPUUtilization
+                      statistics: [Average]
+          '';
+        };
+        exporterTest = ''
+          wait_for_unit("prometheus-yace-exporter.service")
+          wait_for_open_port(5000)
+          succeed("curl -sSf http://localhost:5000/metrics")
+        '';
+      };
+
     zfs =
       { ... }:
       {
diff --git a/nixos/tests/scx/default.nix b/nixos/tests/scx/default.nix
index 65cc84bc718f..41c7b84c90b7 100644
--- a/nixos/tests/scx/default.nix
+++ b/nixos/tests/scx/default.nix
@@ -20,7 +20,6 @@
       flow.configuration.services.scx.scheduler = "scx_flow";
       forge.configuration.services.scx.scheduler = "scx_forge";
       lavd.configuration.services.scx.scheduler = "scx_lavd";
-      mlfq.configuration.services.scx.scheduler = "scx_mlfq";
       p2dq.configuration.services.scx.scheduler = "scx_p2dq";
       pandemonium.configuration.services.scx.scheduler = "scx_pandemonium";
       rlfifo.configuration.services.scx.scheduler = "scx_rlfifo";
@@ -41,7 +40,6 @@
       "flow",
       "forge",
       "lavd",
-      "mlfq",
       "p2dq",
       "pandemonium",
       "rlfifo",
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index b7c0132c4053..4093e6268d7f 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -15316,6 +15316,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  profile-nvim = buildVimPlugin {
+    pname = "profile.nvim";
+    version = "0-unstable-2025-03-05";
+    src = fetchFromGitHub {
+      owner = "stevearc";
+      repo = "profile.nvim";
+      rev = "30433d7513f0d14665c1cfcea501c90f8a63e003";
+      hash = "sha256-2Mk6VbC+K/WhTWF+yHyDhQKJhTi2rpo8VJsnO7ofHXs=";
+    };
+    meta.homepage = "https://github.com/stevearc/profile.nvim/";
+    meta.license = getLicenseFromSpdxId "MIT";
+    meta.hydraPlatforms = [ ];
+  };
+
   project-nvim = buildVimPlugin {
     pname = "project.nvim";
     version = "6.0.2-1";
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 3d57d904f9d9..f0d24fa627bc 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -1092,6 +1092,7 @@ https://github.com/sotte/presenting.vim/,,
 https://github.com/ewilazarus/preto/,,
 https://github.com/anuvyklack/pretty-fold.nvim/,,
 https://github.com/vim-scripts/prev_indent/,,
+https://github.com/stevearc/profile.nvim/,,
 https://github.com/DrKJeff16/project.nvim/,,
 https://github.com/GnikDroy/projections.nvim/,,
 https://github.com/kevinhwang91/promise-async/,,
diff --git a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
index 15e589b83c77..24ec6ed0786f 100644
--- a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
@@ -21,22 +21,22 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-oOytttotGI7f4RlnNBRM6TvXaXUht6v99Kzxc9GP404=";
+          hash = "sha256-Yabd8DFEh1wq0K4IQPFUBNFDkyHhXl695wSfKa5RX7k=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-9Ne1PGz0k1E1wY/HhoR5mqB3SFQiFkHt236+L5jXE60=";
+          hash = "sha256-gzMUtolNlNxFUofsL9JgOnaxfUGeSxFQY7C4smJ8fr8=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-2nwDsS4tVRikMZWZW4TKshQE7HVeQ/yY7CxpGg0os7w=";
+          hash = "sha256-U8S7U5sYj9LukYfmC2yyUjeenAYYHsMrx8snhXqATck=";
         };
       };
     in
     {
       name = "claude-code";
       publisher = "anthropic";
-      version = "2.1.238";
+      version = "2.1.245";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");
diff --git a/pkgs/applications/emulators/libretro/cores/beetle-psx.nix b/pkgs/applications/emulators/libretro/cores/beetle-psx.nix
index 4ee33cbfae79..843f7867bcb2 100644
--- a/pkgs/applications/emulators/libretro/cores/beetle-psx.nix
+++ b/pkgs/applications/emulators/libretro/cores/beetle-psx.nix
@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-psx" + lib.optionalString withHw "-hw";
-  version = "0-unstable-2026-08-07";
+  version = "0-unstable-2026-08-23";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-psx-libretro";
-    rev = "ed640fac8986d7813e4db6604544a6aafddd3018";
-    hash = "sha256-dwat09yGQ0OnF8GaglqCVlgcoyAfqhleqD/mMlgHh1w=";
+    rev = "ef51860dbd71ad6b7ce67115d4780c2ee321d968";
+    hash = "sha256-Yzzh/1+ZcySuFwXCEravLjLRJHbIMpf3rr7Mj0p9JM0=";
   };
 
   extraBuildInputs = lib.optionals withHw [
diff --git a/pkgs/applications/emulators/libretro/cores/bluemsx.nix b/pkgs/applications/emulators/libretro/cores/bluemsx.nix
index 9f94477e5346..5a33017f833e 100644
--- a/pkgs/applications/emulators/libretro/cores/bluemsx.nix
+++ b/pkgs/applications/emulators/libretro/cores/bluemsx.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "bluemsx";
-  version = "0-unstable-2026-07-29";
+  version = "0-unstable-2026-08-23";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "bluemsx-libretro";
-    rev = "0f32f52c48d3e772bfdf0379756f81f00b4e08bc";
-    hash = "sha256-4XjaPkv5Tm58nhU6JUdiZXbto/uePljwXpcePRCqVus=";
+    rev = "e3086eb5d36d77fa11704cf53dc176686e70127d";
+    hash = "sha256-cwyXtawCUyM/ISswY+O3bzGFX0wNayb/VAIv99E9esI=";
   };
 
   meta = {
diff --git a/pkgs/applications/emulators/libretro/cores/flycast.nix b/pkgs/applications/emulators/libretro/cores/flycast.nix
index 46888f2e8f31..18fd9bf197bd 100644
--- a/pkgs/applications/emulators/libretro/cores/flycast.nix
+++ b/pkgs/applications/emulators/libretro/cores/flycast.nix
@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "flycast";
-  version = "0-unstable-2026-08-07";
+  version = "0-unstable-2026-08-23";
 
   src = fetchFromGitHub {
     owner = "flyinghead";
     repo = "flycast";
-    rev = "a172e0001351dfbc49b86860a13d5390b1c493fe";
-    hash = "sha256-0vBKit2Ce5ihTtQjOrbwrFBEg1Qig/8+H86eJb7EjZs=";
+    rev = "c3763d8fc4208dd6f8f0bc456383543b8406a8a0";
+    hash = "sha256-/QfEDbodvtrfxe2qEqselWFyv6Lx77Z3fJOZhgwMAIk=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix b/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
index d70264c4a71a..b465f1e82054 100644
--- a/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
@@ -1,1859 +1,1859 @@
 {
-  version = "154.0";
+  version = "154.0.1";
   sources = [
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/ach/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/ach/firefox-154.0.1.tar.xz";
       locale = "ach";
       arch = "linux-x86_64";
-      sha256 = "8e64b67fb71a02aaa7c1621bd9e81f0052bd212aa4f7a55f337f2070a1d9bcf7";
+      sha256 = "02e9a328757c3d8792e8ee91e5fa580758e2e3336d983c030cc64af869633030";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/af/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/af/firefox-154.0.1.tar.xz";
       locale = "af";
       arch = "linux-x86_64";
-      sha256 = "d36ffb9caefabd66996a022207af98a370246cc875845440acf09b42717f87b8";
+      sha256 = "112ac2a20fd9d3fcff2f81e4a9958bc2685201fdc6e2d541067b05c8a22e6e9c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/an/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/an/firefox-154.0.1.tar.xz";
       locale = "an";
       arch = "linux-x86_64";
-      sha256 = "92b6238a6c1fc63837f41d1bd0d66be7b07c7d8f29053d0d41463c2e9d2f79d3";
+      sha256 = "674eb910e4ce6e9bbdbd144cd1d7709c5d24a9c5e5337b4eefc8a6d67494cd04";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/ar/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/ar/firefox-154.0.1.tar.xz";
       locale = "ar";
       arch = "linux-x86_64";
-      sha256 = "36b557499fe0cb76ce72341d0bda69b20c3a7d861b2bc29cfe1b8f10d7c4de9a";
+      sha256 = "3f95cd034dccfa50d84c137933b379d9a8e3b26a86ff76e9af251180312dc414";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/ast/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/ast/firefox-154.0.1.tar.xz";
       locale = "ast";
       arch = "linux-x86_64";
-      sha256 = "dc3653aefedac2e532b9c37969a009467ddf9bd39860db6d333b6911bd753c0e";
+      sha256 = "c5802acff008cd5cf2a90bb1ce3deeb5285a36d37f53d29d1f35d38e7723c23e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/az/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/az/firefox-154.0.1.tar.xz";
       locale = "az";
       arch = "linux-x86_64";
-      sha256 = "f31a48cfe6a283017e10cecd3ac9619ef8f9d2a901dc6bcee2fbf580779c3802";
+      sha256 = "1b1c6b84295e8eea6ec05c8d33c5c9c74a2fb980804d2417e9a3bb3523865974";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/be/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/be/firefox-154.0.1.tar.xz";
       locale = "be";
       arch = "linux-x86_64";
-      sha256 = "efcad27a81e59ea710f6e613f73f11b6da38850d2b4a9e437f11b6daab4315a6";
+      sha256 = "2fde4673340258a961e1fd6a5f56d73731ab37ffc6dadb7780f9c09ec50d524a";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/bg/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/bg/firefox-154.0.1.tar.xz";
       locale = "bg";
       arch = "linux-x86_64";
-      sha256 = "5b576c865ec5544605034335d6fa374629a4e1c95820d089d09cb8640b792738";
+      sha256 = "e95a47b8f27508d614c6ca29af60ed34d85d97c0455eacc326483596ea5e62be";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/bn/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/bn/firefox-154.0.1.tar.xz";
       locale = "bn";
       arch = "linux-x86_64";
-      sha256 = "e9634aabbbd53e2a4cda9ceada3c7b21279801a475a5d97f8911ff85da5ad2c3";
+      sha256 = "a7aa36921590c0b6c1cb042304debcce92202d63d610ef6ca1678a8be229fb87";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/br/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/br/firefox-154.0.1.tar.xz";
       locale = "br";
       arch = "linux-x86_64";
-      sha256 = "7f5dcba915a984f450d884f6ddeca4453c40242c4f54398fdfec21722dae049b";
+      sha256 = "1ca7b66dd12b4d9745554d2387090dfebed40c0b9e631280d66ab8994a1c8103";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/bs/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/bs/firefox-154.0.1.tar.xz";
       locale = "bs";
       arch = "linux-x86_64";
-      sha256 = "e0f512679d92a78374beed288f39bab0f12c07b3c4af334f0fa19e0818a5c68d";
+      sha256 = "99e89c7aadd91021338a6f9152121e17d26cd8caba134371761028e2f09005af";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/ca-valencia/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/ca-valencia/firefox-154.0.1.tar.xz";
       locale = "ca-valencia";
       arch = "linux-x86_64";
-      sha256 = "4300deb71493044a23599c6a75f1a043694c4f7713a8ee8982f98a69471ef8f6";
+      sha256 = "f9263218a7c2fe9bced0e28333f7da50bbb44e42fb3502b978c00506452bd7af";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/ca/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/ca/firefox-154.0.1.tar.xz";
       locale = "ca";
       arch = "linux-x86_64";
-      sha256 = "074d6e8be0027767ff94e1ace400851c0d2ee2173da4cf23b066c6508dbb2e4c";
+      sha256 = "ce6e02e9f72353d79d7845eabe857ad4dffda223979c6cca9c1f5af18c0b64d3";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/cak/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/cak/firefox-154.0.1.tar.xz";
       locale = "cak";
       arch = "linux-x86_64";
-      sha256 = "542c65943eb86d881199282129d9f2d4eede0c82e2dcf6717a0a8a9467f26bb7";
+      sha256 = "e364bc3f8a20c6507be0507dcbe19a0c3756d302756f01b9d6bdb140890eb291";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/cs/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/cs/firefox-154.0.1.tar.xz";
       locale = "cs";
       arch = "linux-x86_64";
-      sha256 = "937a98ee792817d7cd1b15aacf5408c5bbbcd63c096795116d480238539cd515";
+      sha256 = "7b2b09db775df4d0ccfd27c341b507b299e0c7297adbb00de012fdffd84a6925";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/cy/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/cy/firefox-154.0.1.tar.xz";
       locale = "cy";
       arch = "linux-x86_64";
-      sha256 = "d70a6572d52be34a6bcd54458ffcd9180b25321513af27f13145a2e4700fb243";
+      sha256 = "03b84754c03fd4a3693df10f6d42dcf5648f58da9ac00666b717880e29410ed4";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/da/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/da/firefox-154.0.1.tar.xz";
       locale = "da";
       arch = "linux-x86_64";
-      sha256 = "f7645df5a844c0f3087b2d6d9ba9b2c3147122c5e7492c217f6a09904ab8fa3c";
+      sha256 = "ae6ea05c2581a8f726e2963b31460dc811b4b46d747a381a23461631a3649cfd";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/de/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/de/firefox-154.0.1.tar.xz";
       locale = "de";
       arch = "linux-x86_64";
-      sha256 = "99d2e9ff23cfbd991f21580c9340a599ab5413867293a7a06c841b8b616f6ed5";
+      sha256 = "fb27c3a7097530d9fc448210f446a37d6dbfe575146683bee3a8e856723e531f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/dsb/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/dsb/firefox-154.0.1.tar.xz";
       locale = "dsb";
       arch = "linux-x86_64";
-      sha256 = "87a812842cd339f8ab591b23bffb0d604e3256d00d604540eeffc8f4f2bbe7df";
+      sha256 = "02cf5d58e154f7b1a33b304cd0f18a8c4dfcff98e7d8dea20c8cfeaa4b841366";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/el/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/el/firefox-154.0.1.tar.xz";
       locale = "el";
       arch = "linux-x86_64";
-      sha256 = "9f77aa924d35f7fba16364a7df613179578ea45e976ee7c75c0fc5e2ada49aaf";
+      sha256 = "dfce5b777425b6f649dda87664d4b428745d0add8672363dcac8c43b30e400a1";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/en-CA/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/en-CA/firefox-154.0.1.tar.xz";
       locale = "en-CA";
       arch = "linux-x86_64";
-      sha256 = "cf243c1c0950b7a8fe867c540bec8e25447c8949a329ef01c672b3f372dea674";
+      sha256 = "278fdaa59b1f872684b095656dcf29c7977db1d5bb4ee2f65f9c10c0569737b3";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/en-GB/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/en-GB/firefox-154.0.1.tar.xz";
       locale = "en-GB";
       arch = "linux-x86_64";
-      sha256 = "d755d09114736b6e6ecd2de70b75923ff0f024517d4f75f80374f8428a3b8905";
+      sha256 = "c59e4a7e5148b333b52f13be253c011a37cc2af487c7f8fa55bd6237889f373a";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/en-US/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/en-US/firefox-154.0.1.tar.xz";
       locale = "en-US";
       arch = "linux-x86_64";
-      sha256 = "7665cd49ab13417270748325838e565136adbc76d41bbd76fb24d15a0cc7792b";
+      sha256 = "ca29d2d001e0e54e3d83716d1104adb1ed281200d5fea6fdf8fac21b3ce3e526";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/eo/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/eo/firefox-154.0.1.tar.xz";
       locale = "eo";
       arch = "linux-x86_64";
-      sha256 = "aacb6ef648c4b560fafa713bb4af29246092404c51df57fe7a5898c4445f67a4";
+      sha256 = "782bc69caaad87e67452f8b6806bf34106338a263b98ed319033f3d6ea27a6ad";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/es-AR/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/es-AR/firefox-154.0.1.tar.xz";
       locale = "es-AR";
       arch = "linux-x86_64";
-      sha256 = "972d61a25fd0d42211421618d7e6ee57e9256f9484beaca6cf8eb17e3f4a2f07";
+      sha256 = "ffd7921c11ff9f99d0b79dc133a362f38e7c1d9e4ad9c7e748ef1b1cc5417d40";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/es-CL/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/es-CL/firefox-154.0.1.tar.xz";
       locale = "es-CL";
       arch = "linux-x86_64";
-      sha256 = "a205dd03b6cb89a2a63a0c3f5150f9aad8eba4a938e2019304607af61ce73e60";
+      sha256 = "e732f252350256fd624b24e4a031d8ad5cb3e4ccd5250ae80e2f50348f7ee9e0";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/es-ES/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/es-ES/firefox-154.0.1.tar.xz";
       locale = "es-ES";
       arch = "linux-x86_64";
-      sha256 = "fc9b00edeae2d7a587b42890477f6a9272f7cf0e97bae35adfb51179c4ba191d";
+      sha256 = "b30c9955eb4d6659d3ad9c8d6c4edc069928ce52203314b8fe0d4f8bb93d4bed";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/es-MX/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/es-MX/firefox-154.0.1.tar.xz";
       locale = "es-MX";
       arch = "linux-x86_64";
-      sha256 = "13bd360a772e253c97e477feadbca805f53c0f3701fb41cf077a135a3c46d9b3";
+      sha256 = "5ad9b7a3421cab4a42ab74f1d24f0a27da0c072067d3b814a428635c8addf263";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/et/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/et/firefox-154.0.1.tar.xz";
       locale = "et";
       arch = "linux-x86_64";
-      sha256 = "7748e34035a930b22bfc5630ee3b9bacf32ac1f09826162732496260046519d8";
+      sha256 = "cc4c59af649aae22b5d1a4c6a6f287ca6217aa28fbb143e1d285a97d66b1268e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/eu/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/eu/firefox-154.0.1.tar.xz";
       locale = "eu";
       arch = "linux-x86_64";
-      sha256 = "72b98a3d77332804565283f78d5c0ec7b4ed113c2880ceadca60bc9ce0f04fde";
+      sha256 = "6a00933fc3b94158683dc8b41940809bacddeb1b966f18cd53446b1f44b07239";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/fa/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/fa/firefox-154.0.1.tar.xz";
       locale = "fa";
       arch = "linux-x86_64";
-      sha256 = "10665eb863a0695be079ffef2ad4139c28af8b7877e8c03e144bf3ce2399df30";
+      sha256 = "4431cf57c93bf8f7df24d7ef15e177630f2dad6a378c2f4688d42105948ca817";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/ff/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/ff/firefox-154.0.1.tar.xz";
       locale = "ff";
       arch = "linux-x86_64";
-      sha256 = "7a3d577d913dbb823395b500b5be1f9c37feb5478db4048975ff743da0d4e0d3";
+      sha256 = "f45f9ad507def4b43a7e8df3a022c7c59c0a58006f576793efe76e5caac32572";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/fi/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/fi/firefox-154.0.1.tar.xz";
       locale = "fi";
       arch = "linux-x86_64";
-      sha256 = "9ce7ec8f2f6c9ec88aceefa2460a94c4343e4836341d9e28116da79012cfaca4";
+      sha256 = "70c9f0890e0065648812172e608452e7b91e38a3db181c5f90d35edeffb0cacd";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/fr/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/fr/firefox-154.0.1.tar.xz";
       locale = "fr";
       arch = "linux-x86_64";
-      sha256 = "e2790d0b6920128870a04d6e194dbc9bdb588a4df153a780f61a8d325deb8291";
+      sha256 = "da042ea18f86235f7f416542b1d63ed42af0e3cd3f89f182fcc69d4a30a701ee";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/fur/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/fur/firefox-154.0.1.tar.xz";
       locale = "fur";
       arch = "linux-x86_64";
-      sha256 = "c4d39384fac503316744e125f5c2fea87f5a156f299d8499821f6781a7674d1b";
+      sha256 = "634bb4c52009e48d944ce4eb0e61d9f81edabf3fe961b5aaa5d4001d9e015490";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/fy-NL/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/fy-NL/firefox-154.0.1.tar.xz";
       locale = "fy-NL";
       arch = "linux-x86_64";
-      sha256 = "1a79ce60d3a3ca17b6be991781bf89d7b7425040fc44b1e19d0ed6bcb55d4e37";
+      sha256 = "6a91016eb211a9d4246ebb72c4e9505c8303c47f186b53c02949a16eff5dd7e1";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/ga-IE/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/ga-IE/firefox-154.0.1.tar.xz";
       locale = "ga-IE";
       arch = "linux-x86_64";
-      sha256 = "a549e3953831708f83a1bec3a61ea78d145e87b9dcb96b038be3e6d3bcd19e17";
+      sha256 = "6c82bbd0a52d018d2e7f2137511c6d8bc1ad5b3492d86efc89bd0775decf5d7f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/gd/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/gd/firefox-154.0.1.tar.xz";
       locale = "gd";
       arch = "linux-x86_64";
-      sha256 = "aa1ac0b52f9821b87941fbfbd493aab9574881a99dbedf4e3537ec3df7cf6eaf";
+      sha256 = "1747245bcbf68c6b2516836ea2387dacd3478ba2f5886dee39c7e81c718d2e1e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/gl/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/gl/firefox-154.0.1.tar.xz";
       locale = "gl";
       arch = "linux-x86_64";
-      sha256 = "5b4916ae0ed2ff973ef09bf87435d11327eea9fbe1e0ecfe2b0cd15396f155bb";
+      sha256 = "903b078a42131372fab0b588afa2fd1bbd1fd930929f80c9334439aeb472dc34";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/gn/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/gn/firefox-154.0.1.tar.xz";
       locale = "gn";
       arch = "linux-x86_64";
-      sha256 = "1e54e0fb0322a8b0c129c490ddc699ea9f35e21fd827a8939ef9d43e3d2924b0";
+      sha256 = "6dce25645f21403be1677e34c004739d5fb9424c0a80fe85d1023975ec19a478";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/gu-IN/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/gu-IN/firefox-154.0.1.tar.xz";
       locale = "gu-IN";
       arch = "linux-x86_64";
-      sha256 = "66e9fe2b288969efe1f1b37694fc208009594d6f5f4794fde91afa4631eb84eb";
+      sha256 = "2355365ddfc8faceb911267aa4840e0d480d90a1e64cbf55610291eee519965c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/he/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/he/firefox-154.0.1.tar.xz";
       locale = "he";
       arch = "linux-x86_64";
-      sha256 = "2762f25afe7639ed290888a46e6f669b214052e3dedd8198f819e2719bf5b9a8";
+      sha256 = "48bb1917449e21d99f86b4336471900f2f18513d0284b97a493ad7fc03e70ed4";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/hi-IN/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/hi-IN/firefox-154.0.1.tar.xz";
       locale = "hi-IN";
       arch = "linux-x86_64";
-      sha256 = "22a4164fe8629436e36de2be7c9184d8849dbbdf6640c87bcee30e01cb3bde96";
+      sha256 = "ae374bd02f3719f0792c6bf38301b3fd74d3faa2c86220711500044acb98326a";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/hr/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/hr/firefox-154.0.1.tar.xz";
       locale = "hr";
       arch = "linux-x86_64";
-      sha256 = "0a000a4d1754fa98439fb2f7343a9525b365619fe9b0ccf7a6955d94c4351610";
+      sha256 = "1574fbaa6bc5fe15c6fc789df2f215263e89f6e6cb54d677d3d30d9b34421297";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/hsb/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/hsb/firefox-154.0.1.tar.xz";
       locale = "hsb";
       arch = "linux-x86_64";
-      sha256 = "2fcc7887e1e2ae378393881f0e179de86389128db992e8dd0c9b8a58eb329e41";
+      sha256 = "614fdbfbfd613c5f98a72b7cd15004a85e21c6300ee6b6a97cb806654a93843e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/hu/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/hu/firefox-154.0.1.tar.xz";
       locale = "hu";
       arch = "linux-x86_64";
-      sha256 = "13424d9c83596de2980c2a114aa658417da162122a07ad0dfdb487bae514e6b8";
+      sha256 = "3a1d6c2b8e085a0118649d11b615fd93b3b136c7e131dbc3d682cae673bf080f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/hy-AM/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/hy-AM/firefox-154.0.1.tar.xz";
       locale = "hy-AM";
       arch = "linux-x86_64";
-      sha256 = "c3b83ba41440602d5c07ac374504cf0ce78d4b6018b449565d4f1cdbe3ce4a1d";
+      sha256 = "ecdd017ac6dd6a16086f71f653ef8675e660abad8236053cb808993d873acf6e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/ia/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/ia/firefox-154.0.1.tar.xz";
       locale = "ia";
       arch = "linux-x86_64";
-      sha256 = "8b493ac5d67fb579414253aca8e4b4e005102dd40e792ec4ea36eccd2bd9e5ce";
+      sha256 = "8909b8af617f19b22dac401b2589b831ce945211d427fd813c1e6e4eafbe89e2";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/id/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/id/firefox-154.0.1.tar.xz";
       locale = "id";
       arch = "linux-x86_64";
-      sha256 = "1a7074f2b07ba6aefda11503fc8625c62a0a53fc7c233b60ee763f7695e94a4c";
+      sha256 = "b4a8b82209eb1f1173e6b93e88dc0360faf222f63347f6c6ca7c33838d0e73bd";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/is/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/is/firefox-154.0.1.tar.xz";
       locale = "is";
       arch = "linux-x86_64";
-      sha256 = "46493b41bf022d2b1e30180520646164520c8061ec81a4a6108a8a1dec676370";
+      sha256 = "91180bd1108a67f5f7145dc69ce794160050695692b750eebcaa7d554d4463f2";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/it/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/it/firefox-154.0.1.tar.xz";
       locale = "it";
       arch = "linux-x86_64";
-      sha256 = "e059c8bbadedd1d2fe50906d7b666aa752c30f0d9e0080acacc5802eaf17193d";
+      sha256 = "93dfa1fa06ce7e609bae1575f47bd35a4a6b047cd1c2d00c72303b90643d2f93";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/ja/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/ja/firefox-154.0.1.tar.xz";
       locale = "ja";
       arch = "linux-x86_64";
-      sha256 = "8757c7160d252057de0f6675e46a53c5180a22bed20f9330e1dbb2cd29af0a6f";
+      sha256 = "1db11b88cfd4cb951468b2edec404da81a17cb8eec633ea4e4a1b842c5241abe";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/ka/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/ka/firefox-154.0.1.tar.xz";
       locale = "ka";
       arch = "linux-x86_64";
-      sha256 = "6ad93f7b0dc202725b63866830ae2367fd715130169e7f2e63666c810ef72657";
+      sha256 = "dc31aecb2bc2aa7d2923253b9e30f7e71b11d75175be4b7a373530a091e54868";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/kab/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/kab/firefox-154.0.1.tar.xz";
       locale = "kab";
       arch = "linux-x86_64";
-      sha256 = "6f3a99af95b7534a6499fd2259f9878a81aa5e2d329526c5a01e8d89f1a67078";
+      sha256 = "c76efeea3a08e9d032c36c1f9718c8fad5ec959fcf944e2e1fcc070a56982726";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/kk/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/kk/firefox-154.0.1.tar.xz";
       locale = "kk";
       arch = "linux-x86_64";
-      sha256 = "2ba664cf967898bf9b7e2f4c3240c4f0c21141e0a35b4fb67df14854b2a48f3e";
+      sha256 = "e4e513ccc00b46e20c25ce5b5e649ad6de601e1303d82c9b45c2eb09b8a4383b";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/km/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/km/firefox-154.0.1.tar.xz";
       locale = "km";
       arch = "linux-x86_64";
-      sha256 = "8fa00ce60ba8d9b0231c94ddd1b5ec5b3828ae38f17e0b1b77c8f5e0305a4eb7";
+      sha256 = "a10c32cbffcf6b312abbd7978b72b341c32e25423f7f895a8fdb1ec7c1f47f90";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/kn/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/kn/firefox-154.0.1.tar.xz";
       locale = "kn";
       arch = "linux-x86_64";
-      sha256 = "40f10c1de26d649a7cb5d13503d8b50947b5cc0828ea39fa84a676f0efb3b96f";
+      sha256 = "42b3251058353b496f5045d36a80e150628dabcde86838eb7f346b4a912e9a69";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/ko/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/ko/firefox-154.0.1.tar.xz";
       locale = "ko";
       arch = "linux-x86_64";
-      sha256 = "b0193f9392332ded70bf9ead68a531b4ac39d317d7a21b6c0c8e7098f517c28f";
+      sha256 = "d69a34723bbf216954e207b6a469c7acfc735acae8c1d386141e555e6da27f1d";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/lij/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/lij/firefox-154.0.1.tar.xz";
       locale = "lij";
       arch = "linux-x86_64";
-      sha256 = "3a34574a70e1a2c53d51cdb12286ca37c5334e02586101cc0210309a8139763e";
+      sha256 = "c1860bc83cbcdf65c08a605c1d65da93effb743439dda210ffc6bf59c6dee6d2";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/lt/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/lt/firefox-154.0.1.tar.xz";
       locale = "lt";
       arch = "linux-x86_64";
-      sha256 = "f998e908c6cec6900d156f76f593cabc7680c16d158c2e07029e51abb9f8ca17";
+      sha256 = "f43d7c7ba3d45e360c380a3733c2d0703f23565a16b706b3b3e5edb2b1d0a100";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/lv/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/lv/firefox-154.0.1.tar.xz";
       locale = "lv";
       arch = "linux-x86_64";
-      sha256 = "6a8952fece3cd31a7601d83bf77f568ed76c6f153bf2a58805ce0f5e03fffb59";
+      sha256 = "08cb5663ad55bd9135bfd873da0d099dd7d7428576136df001151621015c9d7b";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/mk/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/mk/firefox-154.0.1.tar.xz";
       locale = "mk";
       arch = "linux-x86_64";
-      sha256 = "b1774475981556175bbbdd77b8f68f7fa281cd2d1f19aec875374cbe7bb51fc4";
+      sha256 = "c9fa475e2d78d98a0357c3aebc051cc980d4d22bb74086be0b5970dc116de877";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/mr/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/mr/firefox-154.0.1.tar.xz";
       locale = "mr";
       arch = "linux-x86_64";
-      sha256 = "ad81f7413a9fe604b7343cffcb387719bd0dcae004d050fe887c8ae825f2ed5d";
+      sha256 = "8b67a3e6df16af41651a27f9d7b6615f3062222205dfb4c0049aaa7503fe897b";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/ms/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/ms/firefox-154.0.1.tar.xz";
       locale = "ms";
       arch = "linux-x86_64";
-      sha256 = "97bfaa34bbe6bda39f67d8d3911b2212410ed35ea7236a74b8043fa07587bf45";
+      sha256 = "0e1612d59335ae0ab06c9ffbf338ee837873f436212c4aab1b56c4b04f815ce3";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/my/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/my/firefox-154.0.1.tar.xz";
       locale = "my";
       arch = "linux-x86_64";
-      sha256 = "8627166ff58524a4ac9f06840ede7e13988d1930ccb82201e0a53ede1a853b5e";
+      sha256 = "a92a26336da53b45e4c8e2179552f613179bbb0648f5d1c741c45ccdb08c510d";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/nb-NO/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/nb-NO/firefox-154.0.1.tar.xz";
       locale = "nb-NO";
       arch = "linux-x86_64";
-      sha256 = "faefb5a2916b6afc5e999914cc7cc22afd59fed0d6cac90520f69fc39f37021b";
+      sha256 = "df6dbecf6aba8d30fa9d5c077740d59b6e3d8e3c50bf33f36d7d0a73502dca81";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/ne-NP/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/ne-NP/firefox-154.0.1.tar.xz";
       locale = "ne-NP";
       arch = "linux-x86_64";
-      sha256 = "8cc12c2c78c4fc28061c2e0f7ece21027fc96bd6254e7f9bb66b2cbab5258b14";
+      sha256 = "03ec66f09f4331d4c212775cdfe8036fdb738017f18aa6f754b55cb47f3b3947";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/nl/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/nl/firefox-154.0.1.tar.xz";
       locale = "nl";
       arch = "linux-x86_64";
-      sha256 = "4f54b3589443f9393f30a0dc2a7834190eac343ba4537862b237b2a45f2746ab";
+      sha256 = "2c478837a48229d435bd2f45e8c92ec6f392c8b5b1669548ef84da93b2d17565";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/nn-NO/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/nn-NO/firefox-154.0.1.tar.xz";
       locale = "nn-NO";
       arch = "linux-x86_64";
-      sha256 = "51493fc5a9dfb800e8d4a6371dc238a6c41141f14caab77e04df09a2bbab008d";
+      sha256 = "2f93fec64dbeff386075c7bf9bef4678158cb5b6cd4cec538f65b9a6059e623b";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/oc/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/oc/firefox-154.0.1.tar.xz";
       locale = "oc";
       arch = "linux-x86_64";
-      sha256 = "a5d10589c6911ebe76824921674ef52d677597968ea5d5c630202c081eb5abc7";
+      sha256 = "eb36f5dc19cebb5cc15cb85aa0deaa928ea105cd1fd787852abe605355fd61bf";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/pa-IN/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/pa-IN/firefox-154.0.1.tar.xz";
       locale = "pa-IN";
       arch = "linux-x86_64";
-      sha256 = "2770c85c3c2cddb7232d9735631975717a15804950200a66780fa6700a4e0c26";
+      sha256 = "6156448e2bac8c3590a168cd0353ad219cd0db025f3ecb89de67eabd306b282e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/pl/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/pl/firefox-154.0.1.tar.xz";
       locale = "pl";
       arch = "linux-x86_64";
-      sha256 = "86d7ce296755f68af7e5566181e7ee8daa7874d527db1b7c55f85bf915cefb49";
+      sha256 = "326ce1d473c0bbf7765b5e19a55131f62848865c7f85dbe7ba77000853788b68";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/pt-BR/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/pt-BR/firefox-154.0.1.tar.xz";
       locale = "pt-BR";
       arch = "linux-x86_64";
-      sha256 = "253ddd4e9668111bd4e82b58d16bde27baa90f4aed753e0f65a5e1f2bde575e3";
+      sha256 = "ba454c759761e9e3148e84a19acb71fe5e0b9053cde5481520c1c433c0b4235a";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/pt-PT/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/pt-PT/firefox-154.0.1.tar.xz";
       locale = "pt-PT";
       arch = "linux-x86_64";
-      sha256 = "369c5f444d4aa056f0fdc2807a5dd8aa5feab3e1f231f80e6ec2d8b85791b479";
+      sha256 = "ba14631bd16c296a08fb09436180be3f4e1446cb72d6ab5a7ea81f255af1dc37";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/rm/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/rm/firefox-154.0.1.tar.xz";
       locale = "rm";
       arch = "linux-x86_64";
-      sha256 = "e9d14e8709d5e5604b755c9cfb6b8c77c38933d3b5c5cfdbd28986ea53e1f045";
+      sha256 = "3c7c04950b0cd84803ea45b2912479dd27b395be020e9e1feca15360a0e75848";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/ro/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/ro/firefox-154.0.1.tar.xz";
       locale = "ro";
       arch = "linux-x86_64";
-      sha256 = "4097d72314b6c25f091cc2360f5184c29216b749e99637912844ba5dd6d3c8a4";
+      sha256 = "79ca3625a3fcd577d96495ea2a3355ee4fa8795f1443befb2843b356acf8de9b";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/ru/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/ru/firefox-154.0.1.tar.xz";
       locale = "ru";
       arch = "linux-x86_64";
-      sha256 = "e672355787fed02f31292d60332008e7481f95e650e61c721edb7ce9108b6225";
+      sha256 = "19618072baa5af2173701231d7f56cb3706c860345a31d8034ae4c097ab75ea0";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/sat/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/sat/firefox-154.0.1.tar.xz";
       locale = "sat";
       arch = "linux-x86_64";
-      sha256 = "87f0c29fa1e0d07fd514309ba811de2ee1d3b9a0e0df68bb756b986396900491";
+      sha256 = "bbb2647f223708b43b908267d346db9c7dd1a869ac2bc93394afb64aca8ae0d2";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/sc/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/sc/firefox-154.0.1.tar.xz";
       locale = "sc";
       arch = "linux-x86_64";
-      sha256 = "a2156da19cc66d516771dbf011a9c016aeab1782a725729192e924eb696d70b6";
+      sha256 = "3ce3f1325c6a6ef1aaa51ef99414ae35b68b3f73a476b552d18e932d6abec0de";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/sco/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/sco/firefox-154.0.1.tar.xz";
       locale = "sco";
       arch = "linux-x86_64";
-      sha256 = "8548e1d01d1652416400cce196aeb9634743d99f9a5d07e43c89f35950d2dad9";
+      sha256 = "d23c40d515e95ca67daba8a5f7cf6d068c2af98f156e15ec747accac13aa1a2f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/si/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/si/firefox-154.0.1.tar.xz";
       locale = "si";
       arch = "linux-x86_64";
-      sha256 = "bac9e1bafe3c304f766875300fec556021e3c5e5f0b813a29a30ae8c8f27c720";
+      sha256 = "69f13947efa57799b4d91274396408f9b4bc44e119052e58c2f95232d62e043a";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/sk/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/sk/firefox-154.0.1.tar.xz";
       locale = "sk";
       arch = "linux-x86_64";
-      sha256 = "2907a789a27a3e0a59caac5c442016a3f3ffa2fb4eb212906e25f3c8dd827d19";
+      sha256 = "945ff516e0e7dd11d4290ec723b26e140988f4259509ad7372aa1088b5dbe3c3";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/skr/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/skr/firefox-154.0.1.tar.xz";
       locale = "skr";
       arch = "linux-x86_64";
-      sha256 = "9f8019822927e906e33b8bb09e6aed6e7a1833f37b9b52ba8585b4b7dd2dcfe3";
+      sha256 = "1a47b63eb211d32b5a6e49a9988f1633f9a13614d79993822767b21b954c7340";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/sl/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/sl/firefox-154.0.1.tar.xz";
       locale = "sl";
       arch = "linux-x86_64";
-      sha256 = "26fe98252f450dc419afe043b1df5f85313289123108ece2c26810c7ccee29bc";
+      sha256 = "e69e091f336814c2fbdf688c846f35d670528f48f2e9b69a630778458c4e3b0e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/son/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/son/firefox-154.0.1.tar.xz";
       locale = "son";
       arch = "linux-x86_64";
-      sha256 = "5c0bd0211e337d218d14c93efcbacf34e40249255fa1d3dcb899a28b32e82f82";
+      sha256 = "2a5492236d0fc2f84dd605639b226a76a75330d1a49d8289ce72a5acbb7d88da";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/sq/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/sq/firefox-154.0.1.tar.xz";
       locale = "sq";
       arch = "linux-x86_64";
-      sha256 = "f6ed3639b9156d6792798ff76197a44e2a249993f134b3629a45c433d6530cd7";
+      sha256 = "fc436c92edd7dd885e10860ff3e463923b31cffd24b4eec0416a567d17dd3061";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/sr/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/sr/firefox-154.0.1.tar.xz";
       locale = "sr";
       arch = "linux-x86_64";
-      sha256 = "9237547072178d8710b94f2d6cacfb37a36f4c12ed6302e7218b146ecc8654fa";
+      sha256 = "ac29150bfddd856efe9a2e7a752823be6f21f79b36c9d7d9a68780b1cdd08890";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/sv-SE/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/sv-SE/firefox-154.0.1.tar.xz";
       locale = "sv-SE";
       arch = "linux-x86_64";
-      sha256 = "eeaf0d728f9748bb5dbd373268f8f3fbf3d19cc03fc62b56c534612e1ea289d8";
+      sha256 = "3e364801e01054c33b4775a7b6fcec809121d8e77ec261a15f9f63979254108f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/szl/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/szl/firefox-154.0.1.tar.xz";
       locale = "szl";
       arch = "linux-x86_64";
-      sha256 = "4ce4555c9bc72cf8434500ed48b9fe2e2be8ade5bf3715adcf4518d549fcfd51";
+      sha256 = "1e0ad89580de9acc7605f7b64973efdb1d64838b17c4872e840552c8eacd8df0";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/ta/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/ta/firefox-154.0.1.tar.xz";
       locale = "ta";
       arch = "linux-x86_64";
-      sha256 = "692571474555633197e10fa6553a28ebc8ef2b5ccb3c0fe39f6d9ad73808aad0";
+      sha256 = "7f569bef788182808d7e38a9bfba37a1ae139a62c0b76b97c20b17b8f12e28c4";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/te/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/te/firefox-154.0.1.tar.xz";
       locale = "te";
       arch = "linux-x86_64";
-      sha256 = "3358251692e41bfa49a75b0d2405db7c05199ab33ba4addaa7d80485ab2f687d";
+      sha256 = "d10404e9e7140b369e56b55c2222d8bdd52fc3b9d387d4bd432d20f0aa98c306";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/tg/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/tg/firefox-154.0.1.tar.xz";
       locale = "tg";
       arch = "linux-x86_64";
-      sha256 = "c9556508d16767bc74122b53006508e3dc701f851216004aaa214454d89ccee9";
+      sha256 = "aa3e1a427c880e2dd9e5788ea48ee9b2e6070a19b9fb19ae71bd7365f18d027b";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/th/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/th/firefox-154.0.1.tar.xz";
       locale = "th";
       arch = "linux-x86_64";
-      sha256 = "4f592eca5024079e8c2070220eb5d53f35c3dd6d207df0acd2bc28e5bb9b5aaf";
+      sha256 = "204fb315770071206008c3384a23862757b2b4926327c4e381a1f58b5805bb8f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/tl/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/tl/firefox-154.0.1.tar.xz";
       locale = "tl";
       arch = "linux-x86_64";
-      sha256 = "b1188767da17e83b483146448088e00c8993f53da2c2fc15d54a27f73bd02fdc";
+      sha256 = "008248dee4d35236b5729cfb5524d530a6449232314de277a40be12d425186ca";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/tr/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/tr/firefox-154.0.1.tar.xz";
       locale = "tr";
       arch = "linux-x86_64";
-      sha256 = "776fbdc97b5d89359f7a9b9abd622acdb03802b6f50ed71d4077ebd884a38477";
+      sha256 = "44af43d08230a3a114cd7df83d753e8b06b9718250a81f5ca9d33321d21aef85";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/trs/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/trs/firefox-154.0.1.tar.xz";
       locale = "trs";
       arch = "linux-x86_64";
-      sha256 = "0083b4627b8dc92793a146c69bdfbf58c411f607db678b03f0268a825c64be50";
+      sha256 = "bc57b12d148dd0fe80dac2ec08bd8ecb41e028ae6f03a2b36f92bfe1822bc29a";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/uk/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/uk/firefox-154.0.1.tar.xz";
       locale = "uk";
       arch = "linux-x86_64";
-      sha256 = "9215dec3eddb8dffb695dd876c803134f296bac8505d9a728c1ad5477ef23d4d";
+      sha256 = "39f6b02423da6e2feefbee935cc2070a804e7cde0e1d8f1939d11decb9736806";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/ur/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/ur/firefox-154.0.1.tar.xz";
       locale = "ur";
       arch = "linux-x86_64";
-      sha256 = "c87334fa00b54f94c2a4d872026aab8cdf75b868fe9db98c998459671fddb639";
+      sha256 = "0489d77e61169b4eb1d85bd0f1047831a557f3979715ae361cfa8ffeb7375475";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/uz/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/uz/firefox-154.0.1.tar.xz";
       locale = "uz";
       arch = "linux-x86_64";
-      sha256 = "8e52e26e3d67029947766fbc91cb7577e8f8d86214a7722e189978ad35bf849f";
+      sha256 = "005fac89225a264a6d3052c2f4f0180e46d698ff335718d309179fa3316ea3ad";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/vi/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/vi/firefox-154.0.1.tar.xz";
       locale = "vi";
       arch = "linux-x86_64";
-      sha256 = "64b11775e250170da886d4b015d3e2786d2b391683fa6c3ca87357d417fa589c";
+      sha256 = "c0c3aa5c5ed7a902fc4e1c4096f8325cb15563e1c0e6871354bed1a77899d7ba";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/xh/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/xh/firefox-154.0.1.tar.xz";
       locale = "xh";
       arch = "linux-x86_64";
-      sha256 = "1ec5771032e55306736504d79195bdc5ddafb277c956a0dd51522b97b2857475";
+      sha256 = "72a0f8b1ab38d01e1e194e940ca1f06c98ecce56b405521f79c5b8af8764c766";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/zh-CN/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/zh-CN/firefox-154.0.1.tar.xz";
       locale = "zh-CN";
       arch = "linux-x86_64";
-      sha256 = "bc937876ac7efca3023e67ab6c56c7a4f89f8b36b39ee807e76def2827cab99d";
+      sha256 = "4071c0eec7b599cbf3b34e029cdf98f4d2cf246428a5b8f8f05c6f998f67e594";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/zh-TW/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/zh-TW/firefox-154.0.1.tar.xz";
       locale = "zh-TW";
       arch = "linux-x86_64";
-      sha256 = "baf4983d943e91a04d304b91cbef9b18f6226fe42ef93800729a30555537743e";
+      sha256 = "c032cf8ccff68a7964805e4f7d968676e40eff677a0bc50c1a73d48e88444ff8";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/ach/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/ach/firefox-154.0.1.tar.xz";
       locale = "ach";
       arch = "linux-aarch64";
-      sha256 = "993961b495372ba52f155e20ceadacf82de9d2ae740db3bd0936e81d38d732a0";
+      sha256 = "93b7080e857204edb395033062097881f54a7fd944cb1885b0b4a2d6aa5f4261";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/af/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/af/firefox-154.0.1.tar.xz";
       locale = "af";
       arch = "linux-aarch64";
-      sha256 = "abeb50f23674224473e89898ca25f2318a067826e33bb8a2510db2a4fcc63172";
+      sha256 = "84425be21cd30c31f1b71b59a2187e578a3fb12bee480f08995a65dd2b03ce2f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/an/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/an/firefox-154.0.1.tar.xz";
       locale = "an";
       arch = "linux-aarch64";
-      sha256 = "5b86495656dc45fe2208c300debb35342fa0579401c17ddab10a65d5ffb03bdd";
+      sha256 = "ea861a7dbac2fc571240952934f3e2d6b817a550004aa044313d156e06a3db23";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/ar/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/ar/firefox-154.0.1.tar.xz";
       locale = "ar";
       arch = "linux-aarch64";
-      sha256 = "5bf11831e43cc1e2a7a6c5d0d504a41649d3d8b2f70dc58b971f191c2baaecf4";
+      sha256 = "561236bc96d1770611e4f74a3034bdb91c58e8ef2f1ac62f3a9326838f4cd339";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/ast/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/ast/firefox-154.0.1.tar.xz";
       locale = "ast";
       arch = "linux-aarch64";
-      sha256 = "3dfa4798a8b8ee6b72192e695f8cb5a5c2138c3402ef60ad1171cb8c6fc9d96f";
+      sha256 = "e398bc29f85e6d6e6e31947b0fa22a267d4270aa0af34a96379dd30b385694b5";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/az/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/az/firefox-154.0.1.tar.xz";
       locale = "az";
       arch = "linux-aarch64";
-      sha256 = "f76cb5a973c11429fbac628f64b7ac7a31d4ccc1045f1088d83ffce07f4e21cc";
+      sha256 = "f1b5123be32b7ce7f75e0f6d05e5ff55aeb4185d63635530fc16a3be9bc2fec2";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/be/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/be/firefox-154.0.1.tar.xz";
       locale = "be";
       arch = "linux-aarch64";
-      sha256 = "b25d0726f681f5f1b5151209de44becab0d7fb7027c11c68208febec7566425e";
+      sha256 = "ea296ce40c47f1d6e2b69df5d63ecc9046f5cd11366c02852714334153f2f186";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/bg/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/bg/firefox-154.0.1.tar.xz";
       locale = "bg";
       arch = "linux-aarch64";
-      sha256 = "4b86edcfd41f5982ae0e80985655fb9d3e04e411c138c62f98806004e52b9aaf";
+      sha256 = "c45d9f23f163a301a78198a22367d5ab1203d58508386f71cae53d1b1285daba";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/bn/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/bn/firefox-154.0.1.tar.xz";
       locale = "bn";
       arch = "linux-aarch64";
-      sha256 = "a07471908be2fc3b7ceadb67872a83de1f71392aef279c8d2d864399fda77db2";
+      sha256 = "d7c3154b40c7d4dfab1e73a4bf439ca36b60b9fbc7c48c7487a5e19152c8723b";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/br/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/br/firefox-154.0.1.tar.xz";
       locale = "br";
       arch = "linux-aarch64";
-      sha256 = "216a30c68bacb211b367e298ee206be57da00b4564a22c24ff7c226c90bafb6d";
+      sha256 = "115156d892d441ea04eac869bc5a1f5dafbbd51c4454bee803db8f52c4a99947";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/bs/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/bs/firefox-154.0.1.tar.xz";
       locale = "bs";
       arch = "linux-aarch64";
-      sha256 = "58d9f171a9169d7de5e6964477f1d3c1320b06955ebfde7ef2b4fa68c3d02a15";
+      sha256 = "f0dc20d0a6eebacc86f1a5755b67cc8d245a5d73630545ef59b9940ceb2e2349";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/ca-valencia/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/ca-valencia/firefox-154.0.1.tar.xz";
       locale = "ca-valencia";
       arch = "linux-aarch64";
-      sha256 = "6e94c7778468a1ae580800d9d5e5c8ea184dadce0f198c762e79ce27c50ea985";
+      sha256 = "c117fde5a66f7a075ed719183f71ed71b6f067f0f2a107c4b683d7cc4c31047d";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/ca/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/ca/firefox-154.0.1.tar.xz";
       locale = "ca";
       arch = "linux-aarch64";
-      sha256 = "d7fe85c500757bade5455d831ee8ead7c9e3d1403eb08e1846c7e383172026f4";
+      sha256 = "5112f24ae36283a4072d1a30d6ac0f44b3224120b218966e61f3a9665acb746c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/cak/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/cak/firefox-154.0.1.tar.xz";
       locale = "cak";
       arch = "linux-aarch64";
-      sha256 = "58093f7d87a0b8adb06963692ab5de570cd815952e109bbcaefc5ddea6dc5438";
+      sha256 = "a01e33b13dc771ddfe021752f60d26c247c9d3a2fb920086d26ecb2e1e801d1f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/cs/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/cs/firefox-154.0.1.tar.xz";
       locale = "cs";
       arch = "linux-aarch64";
-      sha256 = "c647d857f6cdc7ed6617dceb59e4bf3616e290a240d601bcb8b46df5024f7965";
+      sha256 = "c1f256dbebd99ee8abc20ec75fae754fa18d6029e48a732f1cb0342597d800dd";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/cy/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/cy/firefox-154.0.1.tar.xz";
       locale = "cy";
       arch = "linux-aarch64";
-      sha256 = "509d2ac819ee4b36f996da09eef528e9beb63824698073a4e487dbde1e1cf92e";
+      sha256 = "db83d1bc35a395afa1f20808f101e124ef444ede83333d0c4bf4bfbafe8d79e1";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/da/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/da/firefox-154.0.1.tar.xz";
       locale = "da";
       arch = "linux-aarch64";
-      sha256 = "501e2f570e12eecc2ec17db85826f0261913801cd9d0bce751af52d4f1d464a5";
+      sha256 = "f960826ee03cb56c15284498f23239f4e2c80b30a1ab2aa3ae3d3d3cc5853862";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/de/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/de/firefox-154.0.1.tar.xz";
       locale = "de";
       arch = "linux-aarch64";
-      sha256 = "fce9229893a33fefc4322517295be1a5aa0839c12c4c2b49c558479336659c92";
+      sha256 = "33b020e23017b9d2b0253f044b7576cc7da54cbb1136ee8e86dffb9fd0da258c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/dsb/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/dsb/firefox-154.0.1.tar.xz";
       locale = "dsb";
       arch = "linux-aarch64";
-      sha256 = "44b66d7f93153640034a31ef198f6c3a4b4e924f1d8d76c87d6359718a2a5cf2";
+      sha256 = "6afb164374501c1edd988c611401024b443cb8ef09be542ecbc1ebdf6a022800";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/el/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/el/firefox-154.0.1.tar.xz";
       locale = "el";
       arch = "linux-aarch64";
-      sha256 = "3f0cbf20a640b4ea48ce32911dfb01f9029a9bdfe18da509ff505a6f5a066b8f";
+      sha256 = "44ffff4c1a90e4ff8155a840a54206c0d533220965c834ebd52c8b168058bfc8";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/en-CA/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/en-CA/firefox-154.0.1.tar.xz";
       locale = "en-CA";
       arch = "linux-aarch64";
-      sha256 = "314b696bf7250af83b8474a97875db0be3850056ae73b25e184e1bf985880da5";
+      sha256 = "7f2d1fad991770d363beb5ad0efbe6fdd306c009a476255ca97e5b82ca92d906";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/en-GB/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/en-GB/firefox-154.0.1.tar.xz";
       locale = "en-GB";
       arch = "linux-aarch64";
-      sha256 = "761f83b7c2bf2293a005258bcebac457b6b52c43c9aa6609f6fc5b1adce81fd7";
+      sha256 = "91a9dcd496b2f29dba97651bbd76d97b8f042d1a8e39b54478d07066a91e4773";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/en-US/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/en-US/firefox-154.0.1.tar.xz";
       locale = "en-US";
       arch = "linux-aarch64";
-      sha256 = "0391a8d072431286fbed8f9ff497a126ff0c9e81c455d4ef04f9fb878fd4bf1f";
+      sha256 = "0f6a24aace4bedc5e7a58a1905e4ad74e765934c73f3c2cef95347e72d2ea9ca";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/eo/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/eo/firefox-154.0.1.tar.xz";
       locale = "eo";
       arch = "linux-aarch64";
-      sha256 = "85c12827965cd7e3f665458efe42a63ad2b27806628a0c5f8e3dd5cd08cbf547";
+      sha256 = "a9a0f558c85ee3f6e932cdf6e959a457f78adbe0f60a53f2eb4b811270799654";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/es-AR/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/es-AR/firefox-154.0.1.tar.xz";
       locale = "es-AR";
       arch = "linux-aarch64";
-      sha256 = "3dfbe6cf34cdbdb1eb1a523e9c76950335aa7e42853b5e0c4c9480abc49f046a";
+      sha256 = "110b832b09a10f98315b2d32cdf47c245e09f4728fca136fbcdbb86cb63bb8a7";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/es-CL/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/es-CL/firefox-154.0.1.tar.xz";
       locale = "es-CL";
       arch = "linux-aarch64";
-      sha256 = "b613b262c2cfe017c68b9c7c0ab3b47d55b0a3be68559b7e74f8367d495ecc36";
+      sha256 = "45333c19935b95480af43768669c039c3455875f06ebf029282f86af109baf97";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/es-ES/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/es-ES/firefox-154.0.1.tar.xz";
       locale = "es-ES";
       arch = "linux-aarch64";
-      sha256 = "b7f2286e7a5532af53742d5a1abf6b3f805507a1e1479ae867c01585fbb18801";
+      sha256 = "129464a646aa24851f92b4d30917ed8c285baab08159e793286242f89a0eb9ed";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/es-MX/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/es-MX/firefox-154.0.1.tar.xz";
       locale = "es-MX";
       arch = "linux-aarch64";
-      sha256 = "9866abeb8e5e2f6509ee73fd9a8205a88762887efdab4d96c6c430846c1a1962";
+      sha256 = "6d9c35cc2d1f76350dac405c353ffcbc9f68489b7059da25880ad78fe4ad8c78";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/et/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/et/firefox-154.0.1.tar.xz";
       locale = "et";
       arch = "linux-aarch64";
-      sha256 = "e9a712cfefdedd7e3173cd40ec58b50bed43c8e9cdbf703b7e3a0e14f6b63c1e";
+      sha256 = "529f9f3a5426b55a85d587b8d73ad13cd62a84fa95d109d080e0ac83824fdd66";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/eu/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/eu/firefox-154.0.1.tar.xz";
       locale = "eu";
       arch = "linux-aarch64";
-      sha256 = "dcde31969468f454f355fe2361417f226ee0ce72a6d53b675114bb6e5121d07a";
+      sha256 = "77ee57ca411b857338430029a21698ab280ba49886e16fb83fabe2bf39262985";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/fa/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/fa/firefox-154.0.1.tar.xz";
       locale = "fa";
       arch = "linux-aarch64";
-      sha256 = "7af1063f815fd66f5857ce6651a2390491f7fdf5d83f58130041b85b65485f96";
+      sha256 = "c42acd97ef78e40d6004f6b215b113005423c08b2e33a1d582fe3eabf3825ab9";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/ff/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/ff/firefox-154.0.1.tar.xz";
       locale = "ff";
       arch = "linux-aarch64";
-      sha256 = "8a88862c22f617b645e1320ddd9181fadb51ec2fbb18fe894c4f8311ac129d4f";
+      sha256 = "91548420f91b841b144c752d767744cc138ee70dbdf1314ef0442e4c85ef8228";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/fi/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/fi/firefox-154.0.1.tar.xz";
       locale = "fi";
       arch = "linux-aarch64";
-      sha256 = "415124f0a0375e918109814e5c6859755d93322186e69a3d1b969cce879db2a1";
+      sha256 = "61fb2aa2c98dadbe69250274509818c6e20c29dbe39f77878926ec10b4893e80";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/fr/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/fr/firefox-154.0.1.tar.xz";
       locale = "fr";
       arch = "linux-aarch64";
-      sha256 = "1efb5eb745691452234b34b031ac5dd116ed1230937cac0bce698a604c88a39c";
+      sha256 = "cf894bb83f82d820ee4ad135e8a119e0ad21b8161f9b6c04c3377675f71f10aa";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/fur/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/fur/firefox-154.0.1.tar.xz";
       locale = "fur";
       arch = "linux-aarch64";
-      sha256 = "5c6cbaa218b51ed8040ec5cabda3acc574b4a9b239a4a275a2dc0ed70019020b";
+      sha256 = "6b07e8116563eac3e28f97e6068ebd818fe0a3dbf7e89924e424604b366b5efd";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/fy-NL/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/fy-NL/firefox-154.0.1.tar.xz";
       locale = "fy-NL";
       arch = "linux-aarch64";
-      sha256 = "11371644b1aa7b00e49929c29edae40f1bc09234a0999e8ca4397acb186f6253";
+      sha256 = "9b00960959db137409bef9c95f7f36f65a0e332a4930e4faf08f8f3356c78072";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/ga-IE/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/ga-IE/firefox-154.0.1.tar.xz";
       locale = "ga-IE";
       arch = "linux-aarch64";
-      sha256 = "11247ceea036964563d1040806629db1536100bebded42dd3fffc87d5d94c3a0";
+      sha256 = "1ba9a4fd37d40b0f23ecf51f5403c5a4ba18453b9a80edcf63b19259febb8438";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/gd/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/gd/firefox-154.0.1.tar.xz";
       locale = "gd";
       arch = "linux-aarch64";
-      sha256 = "f3b2e76f2f2a1ab195d5fde901c4d660fcc2a8cdfe1456de04e507ec4cf98bef";
+      sha256 = "7d18f738ad82c025ef2ad0a821c76275756fd610fccd433faf0b9ae7d9abc69c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/gl/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/gl/firefox-154.0.1.tar.xz";
       locale = "gl";
       arch = "linux-aarch64";
-      sha256 = "ba6a657c02118bd7363b6b805752dca8b15f260435913037ddc86243b1ff2459";
+      sha256 = "1379b0387810b9669c88aaff3d49b73635d45f1c4373f0eee24855ad309d79f2";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/gn/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/gn/firefox-154.0.1.tar.xz";
       locale = "gn";
       arch = "linux-aarch64";
-      sha256 = "46ff0d447f03e5feb1bea7061ba1d5a22f3951451cf97fea195ca5b512e62945";
+      sha256 = "20e7d85ae108e4b7624454e6034a99753d8d8c7cf32ef0baa6bc7f2ae73e01c1";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/gu-IN/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/gu-IN/firefox-154.0.1.tar.xz";
       locale = "gu-IN";
       arch = "linux-aarch64";
-      sha256 = "bd1de01be8ed3feae19222a221dcd8b32305b756a2d17a958282c924a64a1f56";
+      sha256 = "ffc964c4fd72db27691206ac7256f57109b27ef0b58ac1bddb1e859a72c06ccf";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/he/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/he/firefox-154.0.1.tar.xz";
       locale = "he";
       arch = "linux-aarch64";
-      sha256 = "f2e7e5356c2d34fff5ff52789d7f248f3e785d9c674952cc5ff607cb5a94a127";
+      sha256 = "cd58a5928a4d0922b88e1eb1129e3464a7917719ef749b8c4e7ea8461959919a";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/hi-IN/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/hi-IN/firefox-154.0.1.tar.xz";
       locale = "hi-IN";
       arch = "linux-aarch64";
-      sha256 = "f1a20082186b4398ebd5c8b8fd4456d58fcfd3fb9f8a0ba820c41c312e9e3a68";
+      sha256 = "c77d165e4fd7eab45ad908c177e7523abf2e102a00911d7c1558a31048bfb77f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/hr/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/hr/firefox-154.0.1.tar.xz";
       locale = "hr";
       arch = "linux-aarch64";
-      sha256 = "8e2092bb9cb1bce6b84b4d44403482c862e69afada3bb32a495cc5ae54c905bc";
+      sha256 = "ebf613731d891652cfa093769c271185ce9eebdd38fba595cd14a2674ac0b1a6";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/hsb/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/hsb/firefox-154.0.1.tar.xz";
       locale = "hsb";
       arch = "linux-aarch64";
-      sha256 = "19f439c7bf6a039b123fc5008066a9ffcd4f9ece65580d6ddcc491330ccb71ef";
+      sha256 = "bc65e0ad3b6be37cb8e2e1400c5c05366b16b57c8e1af40be70cdd1ed8641ae8";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/hu/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/hu/firefox-154.0.1.tar.xz";
       locale = "hu";
       arch = "linux-aarch64";
-      sha256 = "ce488ba221e5ed64fd89149316eb3c2040c85d128d4811f8d2282c26207333d3";
+      sha256 = "b7ac2a8ac43120afae289eb8df4fac70dc551d2b38bea1785e8810e3cdfa3d5f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/hy-AM/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/hy-AM/firefox-154.0.1.tar.xz";
       locale = "hy-AM";
       arch = "linux-aarch64";
-      sha256 = "2cdf5955ce74fa0552e6318cc668fdd1541e2049d4aaa02c3918eb21d3d0f9bc";
+      sha256 = "a71ec9c2f60a4d28e8f5a398549120a3e175c2a4e6d8851faea17d4c8de4b5d8";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/ia/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/ia/firefox-154.0.1.tar.xz";
       locale = "ia";
       arch = "linux-aarch64";
-      sha256 = "7965454ef1ee4e86953a85855c212a110c075a9dc89a8cb756866115809d744e";
+      sha256 = "c5d832bbd5b5b85f53c3b30a4cfe283b9811049f639ffcddf12e82e82c1b623d";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/id/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/id/firefox-154.0.1.tar.xz";
       locale = "id";
       arch = "linux-aarch64";
-      sha256 = "569dacdaef5f2957e879167190e7bb587d64559bed0d4b13fcaba68b7385f609";
+      sha256 = "6a770e99ae1b36a9a632ac192cef8379382e95b092b7b040f684e4bbe98e3841";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/is/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/is/firefox-154.0.1.tar.xz";
       locale = "is";
       arch = "linux-aarch64";
-      sha256 = "b7fee38b005fd401e7fed14509641251a0c3aee661ab5e3d25358d2035568e3b";
+      sha256 = "644d5e39b1a076d0b17ef548151c5ceff57261272c4276396afd6bd8b93e941b";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/it/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/it/firefox-154.0.1.tar.xz";
       locale = "it";
       arch = "linux-aarch64";
-      sha256 = "7af77f44fded94ce1035b18c6921e7c4494d1045a2a19494df97a75533769ea5";
+      sha256 = "44523327fdd2e884fac64828f48c506cb2f83c45a60bd4a74968958a149a6724";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/ja/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/ja/firefox-154.0.1.tar.xz";
       locale = "ja";
       arch = "linux-aarch64";
-      sha256 = "aba04778a75e549e420acc9637ab0af79769f4cae43be0b24f8fa1778750f7ef";
+      sha256 = "a16f8f08c00aa38e1235ad80de8cf92680f3636b31ee5e9232e4b452c099a199";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/ka/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/ka/firefox-154.0.1.tar.xz";
       locale = "ka";
       arch = "linux-aarch64";
-      sha256 = "575a3abb02174a678bebac0f56ab57912ef269d045a4aedd66062f05b271f524";
+      sha256 = "938ed5d45680b92cca414ef9e3b8cfe3bb2f3fa58a2f0b321ceed61cf886503e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/kab/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/kab/firefox-154.0.1.tar.xz";
       locale = "kab";
       arch = "linux-aarch64";
-      sha256 = "80cc42d2d2ad981a724e51630190f5ae1c3ad26f9fdf1d38c1df6c23ca568067";
+      sha256 = "a2f14addc58207f32b8fb8ecf551ca3a9e6f53b47a3827ce58723458fb12be77";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/kk/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/kk/firefox-154.0.1.tar.xz";
       locale = "kk";
       arch = "linux-aarch64";
-      sha256 = "3dafc9b33c7fd41028cfa1ec1c4cb3d04847cea03899d3233b3d5387c4ab0f82";
+      sha256 = "9831def5f74e22429f5b031d103479686e9ab5d5e12fce3505284a43ec2f0387";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/km/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/km/firefox-154.0.1.tar.xz";
       locale = "km";
       arch = "linux-aarch64";
-      sha256 = "ea5b69feef4944a91954b0bfcb8d8cd9337005dbcfdd7379cf496952d54200c0";
+      sha256 = "85379b0d26d5f61567748cd8f600ebbda7191588d8169fbb07ab025264130023";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/kn/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/kn/firefox-154.0.1.tar.xz";
       locale = "kn";
       arch = "linux-aarch64";
-      sha256 = "20387db292d63c498334ca4b376f798987debe1359fbedd683a4a39d2beff74e";
+      sha256 = "efee3d83190aa40986eb70ad474823dafa5593fff9e7a57497c167821acfd9f3";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/ko/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/ko/firefox-154.0.1.tar.xz";
       locale = "ko";
       arch = "linux-aarch64";
-      sha256 = "4e778413f904a2c47a2d3fbbc215a32919a789a9e454131b9d6401bbc5ffa3d8";
+      sha256 = "9338d6be0199eb3d58482ff4f9874db746efa52f33e1e371122445461783668f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/lij/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/lij/firefox-154.0.1.tar.xz";
       locale = "lij";
       arch = "linux-aarch64";
-      sha256 = "9aacf7ce0c090f80f17b8e97975cd2c68f9e0ebd1070b9ad3ec9d15df6acc72f";
+      sha256 = "61dddc4c5895709368f2004ff7edcd15dade237d63bb30036b9683c210ba0336";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/lt/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/lt/firefox-154.0.1.tar.xz";
       locale = "lt";
       arch = "linux-aarch64";
-      sha256 = "96234c0f73eb5e8cae00182804b3628ab80e5953ae48a3e624ab5d1185f3014a";
+      sha256 = "50503372f5c9dd47c22990a65434d5416922d2d52cc3bc8a9a7559188b9ee8ac";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/lv/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/lv/firefox-154.0.1.tar.xz";
       locale = "lv";
       arch = "linux-aarch64";
-      sha256 = "d63a1821dd3ec332a0002435dc9763b9db246ded70a61de61088603e01be7af7";
+      sha256 = "35c5d7b6d9006a2a5268844354a605db1e27548e009a5fc34df4c8feff524519";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/mk/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/mk/firefox-154.0.1.tar.xz";
       locale = "mk";
       arch = "linux-aarch64";
-      sha256 = "3abd72612e58ecb5dfc810ba857792173d40bc8fff8a80f4fa7629886d5ff917";
+      sha256 = "3bc568b473179443bc0df45913ee256c24fd00670f37d7804fda0190f3446f6c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/mr/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/mr/firefox-154.0.1.tar.xz";
       locale = "mr";
       arch = "linux-aarch64";
-      sha256 = "b3f8e8838c5bfb707ca46b02f1d8e4815ddfb93688fc41f5e326c6318c60d3ec";
+      sha256 = "16469180d177862bae490cd6c172b955d951703c6bf265084c5ed2dc8d665ace";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/ms/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/ms/firefox-154.0.1.tar.xz";
       locale = "ms";
       arch = "linux-aarch64";
-      sha256 = "648973d95243a7be29983ec656ceb125279ebac643393d2755151f0888e04669";
+      sha256 = "aefb7b3a02b4975795202f5fbd75a7ecad2fe4b638a8161ddaa744e038976bbf";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/my/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/my/firefox-154.0.1.tar.xz";
       locale = "my";
       arch = "linux-aarch64";
-      sha256 = "f8172867d11119abf3d91c835650c2bdc7ba59687faf9a1d00befad3caa76111";
+      sha256 = "acf89b9116b29fd37882a3ac35446434a9bda058bae9b907fe2a8476d0f9d630";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/nb-NO/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/nb-NO/firefox-154.0.1.tar.xz";
       locale = "nb-NO";
       arch = "linux-aarch64";
-      sha256 = "e7fcaf18437119bb4e6c3d1588059b6596296315024ebaa2286bc26e5f57bcc2";
+      sha256 = "7c0b7ec35bf1189cbef9e462996f8db38fb684d15de3124c278edef62900ce47";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/ne-NP/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/ne-NP/firefox-154.0.1.tar.xz";
       locale = "ne-NP";
       arch = "linux-aarch64";
-      sha256 = "3f136b43e9203af8c2bd9aec9a73835e88aafdaf5432c3b8a79c48d4eca474b0";
+      sha256 = "76bd7dcc19d0e3d48946834ff753eec20ce2ddfbf07dcddd001731ed5c3a8bdd";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/nl/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/nl/firefox-154.0.1.tar.xz";
       locale = "nl";
       arch = "linux-aarch64";
-      sha256 = "12b04da36550c9ee3bdf4d32c13daffbdaa335801d11124bf692d9a10bd3c048";
+      sha256 = "3a7800211c77033d61062d109d5c16080cd7d6876ba383cfd4169fdaeed30d55";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/nn-NO/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/nn-NO/firefox-154.0.1.tar.xz";
       locale = "nn-NO";
       arch = "linux-aarch64";
-      sha256 = "79ff432c9b4485f6e8d8c44723f2f303a0e7f64df8dfdbb4c9663466d34e86cb";
+      sha256 = "38c114d851b51b94dd3d0f24304efee38b0f6ef2f29cb542f769e107ae9f9ba0";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/oc/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/oc/firefox-154.0.1.tar.xz";
       locale = "oc";
       arch = "linux-aarch64";
-      sha256 = "c4b6f1cc0ba30c39fda8a2946159dd5185689f4940a3aad568d755f4d40c8ccd";
+      sha256 = "cd902822fa6e9e849548420d865aa666889054bb9e4a38893c713ac45da2357f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/pa-IN/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/pa-IN/firefox-154.0.1.tar.xz";
       locale = "pa-IN";
       arch = "linux-aarch64";
-      sha256 = "4f52ceebd244879151713155da4ee5d7725d10bceeca352cf3f43523ed968a22";
+      sha256 = "ac37379e121054e7f79b46bad135ac29f17281eb09318331f1589e9d083b7017";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/pl/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/pl/firefox-154.0.1.tar.xz";
       locale = "pl";
       arch = "linux-aarch64";
-      sha256 = "033151c22086c240907db71e9046163652fae862f4f9f091196abc60bab37aa1";
+      sha256 = "183ec3b3ef5de9784fb94ed8563ee9fa3b03599bb43f19331802d2aa6899219c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/pt-BR/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/pt-BR/firefox-154.0.1.tar.xz";
       locale = "pt-BR";
       arch = "linux-aarch64";
-      sha256 = "145f87e70e6690c21b2d60fbb27d1e48e194151bfe3b25661024ab6c995329d1";
+      sha256 = "f29fabd6dd1d66deb9c2f290d57bef0a864c8a2c5b723ea54b40b3f6952bb21c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/pt-PT/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/pt-PT/firefox-154.0.1.tar.xz";
       locale = "pt-PT";
       arch = "linux-aarch64";
-      sha256 = "fe68890ffaffcb0209aa825b9cd8b3d17c0111d1d5889f1c31cdcc9dd8c1d080";
+      sha256 = "828dc41763e63143d6ecbe79a1c45aff13f0e5098bb865b8489ee13fa7062f0a";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/rm/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/rm/firefox-154.0.1.tar.xz";
       locale = "rm";
       arch = "linux-aarch64";
-      sha256 = "94971d8a41b0ef30081c64ae4557e16049f84ee9a782df7890414d1760f882ec";
+      sha256 = "c042be8c2b3bb3943db5756c7ba1bff58be8512fd6bd409392fd79748662d857";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/ro/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/ro/firefox-154.0.1.tar.xz";
       locale = "ro";
       arch = "linux-aarch64";
-      sha256 = "bb6dc3d17a16675e04411bb8dbc28b18bf4ff90b86d67e9f3afad3f57d87d2a4";
+      sha256 = "0f9f65365eccbfd93adae3673fb95a4816974d79307766285322fae8233910f1";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/ru/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/ru/firefox-154.0.1.tar.xz";
       locale = "ru";
       arch = "linux-aarch64";
-      sha256 = "5f941d0a980bd71962df7eddd8f44d3801306503fa50c3c00e745c866e1a3417";
+      sha256 = "bccdfe811e259fac65e1ebb14cd8e841a406ca47cf62a43cd3826b6b77ac4361";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/sat/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/sat/firefox-154.0.1.tar.xz";
       locale = "sat";
       arch = "linux-aarch64";
-      sha256 = "16a7f9f1c742000b43883a900e4b61863639e21ebebe167a3cb09a1a65bf5e72";
+      sha256 = "e648cc7d406abe5da07a5215975d8791ff4f1f3ea071b95b952ecc407dfe98d4";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/sc/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/sc/firefox-154.0.1.tar.xz";
       locale = "sc";
       arch = "linux-aarch64";
-      sha256 = "3bfcddef3d55d9ad4d5283251ecb92b9e25ff46c41605ca277bb2b5b4098448f";
+      sha256 = "c3336c48e8e67f31e53eae11b9a6706d8b5d44491655b2919dacb67fe88ea5f5";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/sco/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/sco/firefox-154.0.1.tar.xz";
       locale = "sco";
       arch = "linux-aarch64";
-      sha256 = "59c639be7c1d86004d6d4d7c4762dd35f08b8cde87268c641dacd6fc875875f3";
+      sha256 = "b1982fa46ca0796b2e7e4b017f86a119f89ea506bfd918838e851a2d12c12f4c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/si/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/si/firefox-154.0.1.tar.xz";
       locale = "si";
       arch = "linux-aarch64";
-      sha256 = "ad655fc0a0d82be50ce331b88d514de0673eb1793bd5a1973b34ce29f9ef4384";
+      sha256 = "d8f81f8d34d46b91b116ae5bfbdbbadd20e1c885c4f449ac8700391f7952e94b";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/sk/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/sk/firefox-154.0.1.tar.xz";
       locale = "sk";
       arch = "linux-aarch64";
-      sha256 = "df4c97cb7c1b76048da242397ceeb762ee52c92b68c25efe221b3b8e48a71272";
+      sha256 = "3659a304e33a906a4debbb82ea43c2594d9d0345e60617782de9a3564c888f3e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/skr/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/skr/firefox-154.0.1.tar.xz";
       locale = "skr";
       arch = "linux-aarch64";
-      sha256 = "c47c6287ead0ed741cf58aa401ed7ce205817c293ba60fe6e236652edb3e6fc7";
+      sha256 = "3a9ffb62de94f0d3669908a607e259520e53a66def692d90778bda57609f8887";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/sl/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/sl/firefox-154.0.1.tar.xz";
       locale = "sl";
       arch = "linux-aarch64";
-      sha256 = "86d389df8132fd4a12eda1a721c05e0f86f8c8de1452bc7b05231cb5984a51dc";
+      sha256 = "31063908a97870189debd0602585bc249cba464e5f093e9824af143aa1494e67";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/son/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/son/firefox-154.0.1.tar.xz";
       locale = "son";
       arch = "linux-aarch64";
-      sha256 = "c9a51e0b07c397bdf64d911aa84b6f4e830ab84c5f3ed856c7c444dba3925d9f";
+      sha256 = "ebea857ba0d70219dc851065a94ec7b2374b592463a0fa694e27ced95da2fc6a";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/sq/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/sq/firefox-154.0.1.tar.xz";
       locale = "sq";
       arch = "linux-aarch64";
-      sha256 = "ce76c0a5e25250403552d1c1247078808f129e7f41a3768d334376751871b2ee";
+      sha256 = "e49cb38c51d2f0f668d9cd0c71b32978b8661abc32517ba0bdd7e4641d9d9ce8";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/sr/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/sr/firefox-154.0.1.tar.xz";
       locale = "sr";
       arch = "linux-aarch64";
-      sha256 = "3b6a5d7e82b98561fa1f701483950395ecb97a8d3a0d036316151a5867f6f790";
+      sha256 = "8f165b8e241c420ce2661357e62b7b3439e0f3d12930e4fb80418fcf4dfe97ab";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/sv-SE/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/sv-SE/firefox-154.0.1.tar.xz";
       locale = "sv-SE";
       arch = "linux-aarch64";
-      sha256 = "1ef95439d1a6f70905ef7ae87be7f377557bf8b15dc3d8427f393b5016251f0b";
+      sha256 = "4919f8d90a021fe66e895e969ae4bc810d3e5fcf43a2b385b69e905a76331e14";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/szl/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/szl/firefox-154.0.1.tar.xz";
       locale = "szl";
       arch = "linux-aarch64";
-      sha256 = "e68bec80d20046c3122246160a1af69d5bba0142f178b472cafb8a4996215184";
+      sha256 = "c1f30e58fb6e8c0437284760895a3fc16d631a9f4a99c64d9bed1df2fdb38e56";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/ta/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/ta/firefox-154.0.1.tar.xz";
       locale = "ta";
       arch = "linux-aarch64";
-      sha256 = "fa1b7bcd5ddea43751cb5bdca3d789a3d31479864a2fdac126e6838d32845f10";
+      sha256 = "52f58dc0c5faed694eae2c59ed6075ef8c9daf8df16590b84cb9c6e83f807545";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/te/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/te/firefox-154.0.1.tar.xz";
       locale = "te";
       arch = "linux-aarch64";
-      sha256 = "042c8c402606188aa55101d6e3c403a83e7bd0e50e7d8d81f99be101b313986d";
+      sha256 = "b48d1e2f30c0e640d3b84644bb496734f1fa12bf4a18f6ab7c0dd1dfc7984402";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/tg/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/tg/firefox-154.0.1.tar.xz";
       locale = "tg";
       arch = "linux-aarch64";
-      sha256 = "98d154f0a8682f07fbf568f0a78c7fda5c8a3c2ba45013602185110b542d126f";
+      sha256 = "d7c8c30f5827cf4f042ed6e14bdc022b62e00b97fe43ad43bf9b0d74b97cb105";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/th/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/th/firefox-154.0.1.tar.xz";
       locale = "th";
       arch = "linux-aarch64";
-      sha256 = "e7495eb4b531852ef28aa7ee894392099e1ff436b098645d88dd426bac4ee7e9";
+      sha256 = "6266a72a039ed32102e86793cc02926d03b9e0ae53bfdfc54084a6a51237bcc4";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/tl/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/tl/firefox-154.0.1.tar.xz";
       locale = "tl";
       arch = "linux-aarch64";
-      sha256 = "5d60dd0804cf274bdd814e706e727bc78ac31acd1a9c899682448ae7fcc71467";
+      sha256 = "6f51464b42ad1df318dfa1e7f6350d0dcceb5962a2f30c55cf27ec8fd0fb62b5";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/tr/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/tr/firefox-154.0.1.tar.xz";
       locale = "tr";
       arch = "linux-aarch64";
-      sha256 = "017c50f493a595c448bbbe80dad0958332dce570e66aae47a2eafca3aaa2cf17";
+      sha256 = "159321b1c8925aa17d7d44cb646925a64754fc3ebba992fe5bc95594bb4a3cf1";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/trs/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/trs/firefox-154.0.1.tar.xz";
       locale = "trs";
       arch = "linux-aarch64";
-      sha256 = "d43924f222323f47b90ae57edc3ab66c074930829ddc373256e4d98b750f774a";
+      sha256 = "28c20f09e707eda2db956f52eb9b56e57618215c0f8c60e2173044724d878aa0";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/uk/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/uk/firefox-154.0.1.tar.xz";
       locale = "uk";
       arch = "linux-aarch64";
-      sha256 = "13832393c90e2f2ba679bf06c51b985f8c22bd0694cdd63161946c02eeeae0e8";
+      sha256 = "42c72c97c8450a141be191a078e88a73eeffd760ef56a37910b5ccf1e64f133e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/ur/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/ur/firefox-154.0.1.tar.xz";
       locale = "ur";
       arch = "linux-aarch64";
-      sha256 = "97c9b136e4f1e6742ec9bbc92d17f39bb002b4ae6b900e911a51feebbab55005";
+      sha256 = "3c2c40d826aeaa25f3301da828d2ebd94e643ec7fc0dc893623211d748e53321";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/uz/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/uz/firefox-154.0.1.tar.xz";
       locale = "uz";
       arch = "linux-aarch64";
-      sha256 = "45a8f3a6795f4c5619ddc349e2e705c6037cff4800704ff6e6cca6ea5a0d7bc3";
+      sha256 = "8c63234e1705447d626a761caf269404bf55e4d23aafd9a5999dea248ddb48ff";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/vi/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/vi/firefox-154.0.1.tar.xz";
       locale = "vi";
       arch = "linux-aarch64";
-      sha256 = "1201600730d7473f672431d574bb773d3da00f89d6e4f6df00bd4345979d0832";
+      sha256 = "fc9e410de7e78f90f5e22aa8ed446a1918559fb5492af7b40ca22c8b5cd9755f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/xh/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/xh/firefox-154.0.1.tar.xz";
       locale = "xh";
       arch = "linux-aarch64";
-      sha256 = "d158a9ac754d11f1d5cc7c8cbbc79d0c29bd9e54f800223adbdf2bc916e66602";
+      sha256 = "7d6d094177969b5305ef032b66c12da96be36f77ea3f1cba47e535f6ada5e387";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/zh-CN/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/zh-CN/firefox-154.0.1.tar.xz";
       locale = "zh-CN";
       arch = "linux-aarch64";
-      sha256 = "ffbc0243de33d1efa36f670688655be8e43d93f8e884fa8dee87a58416c02451";
+      sha256 = "cf72b35fba58c10232884982f26f6439a73d84d362ad2e58883a0c55107115ea";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/zh-TW/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/zh-TW/firefox-154.0.1.tar.xz";
       locale = "zh-TW";
       arch = "linux-aarch64";
-      sha256 = "0961c1663f8c29e209fafdef1cd82512b5a9d293d62d13be32713e465b979f74";
+      sha256 = "a8e04d55c8ba8001636fbfa50e20d30b683f5eec543731fb14dbb529c78b016c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/ach/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/ach/Firefox%20154.0.1.dmg";
       locale = "ach";
       arch = "mac";
-      sha256 = "acec4d73f5157270fb509ea9c3c4e605f0edc86ed3016102bcfc1d50072b4177";
+      sha256 = "f06ac38d1584185849663c01d37be843a392e354ae049bfd4787649972adb9a1";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/af/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/af/Firefox%20154.0.1.dmg";
       locale = "af";
       arch = "mac";
-      sha256 = "71024d7feb97cab927d717164d4ae1942fbe0aff38cdff32b9456e6822f4e147";
+      sha256 = "84b0372daed5effe23816235e5d84a11f7523698b4f6cbed04bc04b5b41c4d10";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/an/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/an/Firefox%20154.0.1.dmg";
       locale = "an";
       arch = "mac";
-      sha256 = "67795753d14ad02b0880e213f1760cf9524ff09ef6306f91fa8783983fecd54b";
+      sha256 = "29c81ff08773147ef3569c8c5ce9a01bee4b9bda734e70699d4bd274be182210";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/ar/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/ar/Firefox%20154.0.1.dmg";
       locale = "ar";
       arch = "mac";
-      sha256 = "5b7f62cb0f63c2876ca7e8487b33f64cbdf43419e67f2b67e3a5d953cda1d034";
+      sha256 = "b5e2d5fd5d6b12d69caef76cb82c4b3b5f84c4b47642de71ff29b1b73c6ccdf3";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/ast/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/ast/Firefox%20154.0.1.dmg";
       locale = "ast";
       arch = "mac";
-      sha256 = "c7a1dbf4e0a3863522315c456a1fb821fe35e4c9722413c0ba2eb359a8c31638";
+      sha256 = "33def2a0e11260558030cf69ff7874d01a288038e810369728330ffc3396af80";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/az/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/az/Firefox%20154.0.1.dmg";
       locale = "az";
       arch = "mac";
-      sha256 = "999a2b112bf621554bb1ddef11c30750d2d7509fc62ce5be541168f5ff656e3b";
+      sha256 = "873e97da13a1a835a58b292a73a6422efbb0d55a3ea4d96837d8c6474c783e07";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/be/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/be/Firefox%20154.0.1.dmg";
       locale = "be";
       arch = "mac";
-      sha256 = "f8b012052b062b1e584e62f7ab855138fbd3dc4374253d3938ee410356e416a0";
+      sha256 = "263b6aee735a66df62504f458bd527455b6bd558a6aff66c52a974c7fe9d883b";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/bg/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/bg/Firefox%20154.0.1.dmg";
       locale = "bg";
       arch = "mac";
-      sha256 = "7993423d29c8d088737d4f7e9df69d6a46c44d461c1f9b2aa932a90dbb5ee66a";
+      sha256 = "a063beb1ebdf54de64a9e5e1f4a32000a59e3d2d28904daa5942b5236ceed6b8";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/bn/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/bn/Firefox%20154.0.1.dmg";
       locale = "bn";
       arch = "mac";
-      sha256 = "31bf918c828b4c1a42bae2892cb03aab2bc8e784d4681f6013eb03ebf0905fef";
+      sha256 = "91e7e6c1ec44c46c2c9c888782fab2858a6ed58473b8cf467f212f88dac2a9ed";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/br/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/br/Firefox%20154.0.1.dmg";
       locale = "br";
       arch = "mac";
-      sha256 = "2dc69b9369d16a5b3e6a38ff0ad2e2b9b52a97879b4e6eb92d8912304bb9485a";
+      sha256 = "7aef117ffd6ae93a56b617088a8d65d4a70c80ec16d46f9d141be6782de26aa3";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/bs/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/bs/Firefox%20154.0.1.dmg";
       locale = "bs";
       arch = "mac";
-      sha256 = "6dc939f5bf12e605115efe8c0f44b814ec190a59883bb2c09439db894d1e7a7e";
+      sha256 = "6d91cd9337b73667f0578d866ff889f44a65fcf12fd2aeeace3f8910b0d96056";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/ca-valencia/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/ca-valencia/Firefox%20154.0.1.dmg";
       locale = "ca-valencia";
       arch = "mac";
-      sha256 = "c8ce1598ac1963428cb0d141f09582dac880f25cb95c804b52621768adeea0a8";
+      sha256 = "75d2e1cfb821b8f28c0323d447bb07315e35c7d33e9440e408bde30ea918abb1";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/ca/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/ca/Firefox%20154.0.1.dmg";
       locale = "ca";
       arch = "mac";
-      sha256 = "b3a6e29c3a051d266853d4159e2ea2ab98d3037bcd305b5a7c39608e8332f305";
+      sha256 = "1cce50c6370dd6d3fa873d1a818721d3aaa9078df8151639801962486f955d52";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/cak/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/cak/Firefox%20154.0.1.dmg";
       locale = "cak";
       arch = "mac";
-      sha256 = "0c8a70aa1a7fb6d332815847bd723a46db4c8d4b307d36dddaaa7d236ac5478f";
+      sha256 = "a6a461e6810019125ce21d258fa185fdddf9068ef5d10d74820d8c7fa26771c5";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/cs/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/cs/Firefox%20154.0.1.dmg";
       locale = "cs";
       arch = "mac";
-      sha256 = "43e990ca06646e6b6b0f7d39d51f036bba2a053ec3c84ec2fa0943ff377d6604";
+      sha256 = "bcca96bdd59baeeb6f74a057fbee9aa5c88b44347cd1c2a4c5d71ab404dee53e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/cy/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/cy/Firefox%20154.0.1.dmg";
       locale = "cy";
       arch = "mac";
-      sha256 = "613e850023999735743d4fe7356c52767be86b1a3bd0abcb91ce9351f320db3c";
+      sha256 = "19f6e2e6464b0cc9563b4457d41c714b5e134ad7e1e27461191c54a4dff97890";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/da/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/da/Firefox%20154.0.1.dmg";
       locale = "da";
       arch = "mac";
-      sha256 = "7b57b1432d5249350338effc0a35b9dc5f817eec42d1cf7957d08f7ef7d43e07";
+      sha256 = "e7df58b688bd03da0d5f77d45b214055a555cd5199483c443527510155f9b117";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/de/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/de/Firefox%20154.0.1.dmg";
       locale = "de";
       arch = "mac";
-      sha256 = "6b5604036e7ca343fa3077a407a850ec2b5533e0c33ff1d1e302e22a8fc61374";
+      sha256 = "70cfbd49a1cdbf75dd7f8657dd1713df5ff06b4911f9904e945210c4e76492de";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/dsb/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/dsb/Firefox%20154.0.1.dmg";
       locale = "dsb";
       arch = "mac";
-      sha256 = "302f401f9b665df6009200b76ed84193a5c8bc92aa0d0056bbc82d70533dcba8";
+      sha256 = "6d0bacdeaa340a31f9e284db84eaffb18f7167da39050c2a712f857fe772e347";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/el/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/el/Firefox%20154.0.1.dmg";
       locale = "el";
       arch = "mac";
-      sha256 = "e7af11122aef81640f52083c04cf1e3e56a88bc6fece031e292bc996ead6dd94";
+      sha256 = "c5d174aa403fb6a3dc86ac4427a0ce75de46b07cdbd06ac3ed5001329d0b2f15";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/en-CA/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/en-CA/Firefox%20154.0.1.dmg";
       locale = "en-CA";
       arch = "mac";
-      sha256 = "89289a3567c1392a369a5630b9e7faed76d4f954f5f2073cb672d724023add63";
+      sha256 = "ebf35f442797b25cebd060037bb6903883cd3349e2672948d5605757a830e108";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/en-GB/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/en-GB/Firefox%20154.0.1.dmg";
       locale = "en-GB";
       arch = "mac";
-      sha256 = "2906cebb19ac09585b230da127e152b49ff079c03c809de70570aa72d3a45321";
+      sha256 = "cd70e5dcf678ba8f9abc65f2546d94a4962a499ef2fba37a19d51d979f6573d7";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/en-US/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/en-US/Firefox%20154.0.1.dmg";
       locale = "en-US";
       arch = "mac";
-      sha256 = "b0295d3b77ec632a60282cf2b9770e1dada085879d00e43d8d23fddf5015e06a";
+      sha256 = "01d95a6652018bb3d1e0bfad13ed6775864a1f3390d224e713f7d6f8b98fd679";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/eo/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/eo/Firefox%20154.0.1.dmg";
       locale = "eo";
       arch = "mac";
-      sha256 = "d404034431d0afae6ad401364e54b6672c731ffdf08a716f2376885b2a75faf0";
+      sha256 = "35341e852cd99da146330fea079cedafdd1a794bb0c6fa7f04740b8798994981";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/es-AR/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/es-AR/Firefox%20154.0.1.dmg";
       locale = "es-AR";
       arch = "mac";
-      sha256 = "1b745c276fa6e03eb40dff057d527cd4ad574a6941897811142db531e133eb13";
+      sha256 = "20368ed5632c0b7d4dc037c36ae941f028e574cf93f6aece76e70848212c3d0c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/es-CL/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/es-CL/Firefox%20154.0.1.dmg";
       locale = "es-CL";
       arch = "mac";
-      sha256 = "8c80d681da61eedd2b7422f6956cd21e855fe97318641f96967c6f65bb7e7bc9";
+      sha256 = "e53dddc643e3da0d2e159b340541591cf24412b5025fdc184bc80a45409b0989";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/es-ES/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/es-ES/Firefox%20154.0.1.dmg";
       locale = "es-ES";
       arch = "mac";
-      sha256 = "98b9e5a870058f0ecd13287367f061cfa95513b68a3f623505ae240d23b6447e";
+      sha256 = "5a7c2536c8c52c9c2ac283fb02ef53ab9d7603ccb4339e8bfdec9d06b224516d";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/es-MX/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/es-MX/Firefox%20154.0.1.dmg";
       locale = "es-MX";
       arch = "mac";
-      sha256 = "105deefb281c02a4c73d13e26e0c21884e1b73b28b7fe2a9cc5e1ab550992e75";
+      sha256 = "db2940c7dbf4e2f0746578669c0635ac7bbde9490e9bde63560f3ff28af30cdd";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/et/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/et/Firefox%20154.0.1.dmg";
       locale = "et";
       arch = "mac";
-      sha256 = "e906af6351ce057eff9512a98a1b72cb04d7da6e28753190b69abd59b7a6ed91";
+      sha256 = "d957c0a3a32be383b694c1c44a50469ae96dc52360a22e20341f5456f2e33a19";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/eu/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/eu/Firefox%20154.0.1.dmg";
       locale = "eu";
       arch = "mac";
-      sha256 = "bcddaf2a700b776c9d2f03944f8aff8651dc71b63e971f9364585f1a17c5b7d0";
+      sha256 = "74577ca222b501c33504a1f964ae6eb4d18a132bf1c16453f35540192d888d2d";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/fa/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/fa/Firefox%20154.0.1.dmg";
       locale = "fa";
       arch = "mac";
-      sha256 = "bdc19a054928852c532e9b78d466699504b5fe874e9f0ee176f1e31ca340e2df";
+      sha256 = "208b45e98f71b82f60f6a2eaf2fe98337ad45175e1b47aa6eb8c3b7191325d8a";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/ff/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/ff/Firefox%20154.0.1.dmg";
       locale = "ff";
       arch = "mac";
-      sha256 = "673ba559601a6e18f5ef5d0fccc5f79cfa2e1c0324ecef4fe807e0469ea68a9f";
+      sha256 = "e50a19f1733a26eeb0018ba5d46235ded266a1294afcd9726a4b175a43c3b927";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/fi/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/fi/Firefox%20154.0.1.dmg";
       locale = "fi";
       arch = "mac";
-      sha256 = "04f8d2c9ea4616e01bd0114e231701714a3114ef9ede808fb581109c9abb57d6";
+      sha256 = "5b283c0eda34b22a46c9b48c94df001f0de4f55c15efccb37f4524d401b1c765";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/fr/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/fr/Firefox%20154.0.1.dmg";
       locale = "fr";
       arch = "mac";
-      sha256 = "703b66a199f5cd1fe465fb9c38ffa1ebe713bc61849a5f2d2edd8c34e9a94558";
+      sha256 = "20ea7d4d57ef9b9fc8deb1c6695d5dd4a06cab9ede6526885ee4a257443d3570";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/fur/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/fur/Firefox%20154.0.1.dmg";
       locale = "fur";
       arch = "mac";
-      sha256 = "f4b7a9e6186b11eb4d01f66ae66d2e7a6c05f5f352e7d1bde44c6e37978ab9be";
+      sha256 = "c332abb2cce600290e122c2f2b235c7581d4ec6d5299c80f48a4687ea455b357";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/fy-NL/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/fy-NL/Firefox%20154.0.1.dmg";
       locale = "fy-NL";
       arch = "mac";
-      sha256 = "6a97ab106a5defeb09c31761a0de056616c51d3de4aedaadc755bfb443340a9f";
+      sha256 = "7d5b902b2b97d24ae167332feaf84327a3ae3274b1a529e1d090bd0acda652ab";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/ga-IE/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/ga-IE/Firefox%20154.0.1.dmg";
       locale = "ga-IE";
       arch = "mac";
-      sha256 = "e62f8cfbffb7fda1dc460583d456ce8fbae5bf132268f3e13f1ad79a321b659d";
+      sha256 = "138ce35e60240c2fc36e9171e881f07f444f95003eb8d0192c5514171c654d94";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/gd/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/gd/Firefox%20154.0.1.dmg";
       locale = "gd";
       arch = "mac";
-      sha256 = "1d59cd8437aa0706b636ce62a592734796b004fa56169dd7c850c6ffca543829";
+      sha256 = "da8274e963516289239837ef2ed38a7d7f1f3a42cef18282e289f6328d839a05";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/gl/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/gl/Firefox%20154.0.1.dmg";
       locale = "gl";
       arch = "mac";
-      sha256 = "ceba9c145611ea04a87730fde9c60535a62bbe7b913065b9621e2fd8f833d072";
+      sha256 = "f400382e2653f0e5a9a31f636432071bfe8ebfef01ea942c8c4a2be9f42262b8";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/gn/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/gn/Firefox%20154.0.1.dmg";
       locale = "gn";
       arch = "mac";
-      sha256 = "782b4dfcc1cd1c1a485858a906ae6f7c10624347fbbf521a45d34b8c29723b79";
+      sha256 = "1e5b123c249a3481aebb9bc06e09bea212bd25668cdb9b3c30fb00448dd2c935";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/gu-IN/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/gu-IN/Firefox%20154.0.1.dmg";
       locale = "gu-IN";
       arch = "mac";
-      sha256 = "98dad2fc3a85c609e62dc44b0f03d64ad9a207a869eea56644be80b2183071f1";
+      sha256 = "fa88a19d17cfe89cb5d9a1e070e53922f619b085869c469a63b2a016ca160171";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/he/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/he/Firefox%20154.0.1.dmg";
       locale = "he";
       arch = "mac";
-      sha256 = "1243457f155e4e42ff871fe9b4cfc8debbd387cab7032cba402925d25b41d650";
+      sha256 = "5e1f680a0b6ce42a165d9de00ce226415b246f6fda0f7f9dfeb4691c498704c2";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/hi-IN/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/hi-IN/Firefox%20154.0.1.dmg";
       locale = "hi-IN";
       arch = "mac";
-      sha256 = "6ab4190ff05c61f9b6f717627ee286aecd47acb352dee0173835d08a8df5629b";
+      sha256 = "a628cee20142f9f3c5c74fc9ebdafe192bc8fb0823d778a27abff74685820e6e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/hr/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/hr/Firefox%20154.0.1.dmg";
       locale = "hr";
       arch = "mac";
-      sha256 = "f295f0eddad40101c06045a2014030184b10122f8ed2f820763586a1d6ce2864";
+      sha256 = "39fe2e41d13d73bd20cd634cad40adfd523ab3471c75a31effe05c50a21cf565";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/hsb/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/hsb/Firefox%20154.0.1.dmg";
       locale = "hsb";
       arch = "mac";
-      sha256 = "158f2548e2c862135b650d193b87c06e56f0eada77aeed662021da4f42eac0c5";
+      sha256 = "0a3bcaac2fd166923bc96d17145fa8399dd8b8f7bc009c52f1df09e05fd684db";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/hu/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/hu/Firefox%20154.0.1.dmg";
       locale = "hu";
       arch = "mac";
-      sha256 = "99e4a5710dabb3fff6a91947c382b972055dfcedc8c84c9bfbf621c170069b59";
+      sha256 = "a897bea193e98ed07411236d533a6bb377d60575992980a53ac6cfa60c40fba6";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/hy-AM/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/hy-AM/Firefox%20154.0.1.dmg";
       locale = "hy-AM";
       arch = "mac";
-      sha256 = "4cc2d77540604dc2c3c02f589e91ccdd238269f392bb900d400aa73cc72f9217";
+      sha256 = "60a1978945016af85d5fa5705fd69da098e80627176ba7fd02cc0de43f2713f0";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/ia/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/ia/Firefox%20154.0.1.dmg";
       locale = "ia";
       arch = "mac";
-      sha256 = "e512681a38c635df0b1814f7d075ffc5afb1f9dafa4e8b2aa943e027613e3456";
+      sha256 = "c2e2161178596b4b056781d5cb077d494882c15106a85e4bd39bbc4e3352a031";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/id/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/id/Firefox%20154.0.1.dmg";
       locale = "id";
       arch = "mac";
-      sha256 = "d160404a204da163499d28aa3efcece84e55949886fd48db5a4ccef0c9149afc";
+      sha256 = "d1bddab3a82366687ff3bde873a60c41bf5d8a737ecb527822be9d0dd0a044dc";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/is/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/is/Firefox%20154.0.1.dmg";
       locale = "is";
       arch = "mac";
-      sha256 = "307b3a346cd9ac7424d2eac06ce1d20087db98d7b320a41d620f191c919a4f27";
+      sha256 = "835466ffbc88946bc7e540661725a19ed54afc4e978dcff2f9539601e764d681";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/it/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/it/Firefox%20154.0.1.dmg";
       locale = "it";
       arch = "mac";
-      sha256 = "f0a579ca2cc457391685446e684a850b5735a908b812a8f020c372cce8d29ab0";
+      sha256 = "8131abe54d2240670878a5c67bd4b5516738ee5e2df40523342f40e4374c6fff";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/ja-JP-mac/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/ja-JP-mac/Firefox%20154.0.1.dmg";
       locale = "ja-JP-mac";
       arch = "mac";
-      sha256 = "61015363122ea16df9d7ce2a53141ddad20fbb1b36fda27c14a2bbe0303d7256";
+      sha256 = "c75bc467cc66b036d29afbdac5667f31f4c889645e3f85f7293fac84a74f7011";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/ka/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/ka/Firefox%20154.0.1.dmg";
       locale = "ka";
       arch = "mac";
-      sha256 = "e4f43c099ffec021e01f74a2219e64df27b289ec52ae1c0d4552c58f7611f41c";
+      sha256 = "26a85a09892662633d107f1bdbbf3603c3e46306ab00b9f8632ba6a815a23aa0";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/kab/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/kab/Firefox%20154.0.1.dmg";
       locale = "kab";
       arch = "mac";
-      sha256 = "106d52e78e5b86dae85a043fb60806ae59501c099ddbac2c266860908c0cd8cf";
+      sha256 = "6c0150541668424e53485fd360d2e71aa2a5b206bf3bb4665c9c35ba5471328e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/kk/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/kk/Firefox%20154.0.1.dmg";
       locale = "kk";
       arch = "mac";
-      sha256 = "55fd92b30a51d5aa9b571d1c8177b897cef13f7975258251b4a6d6c41f2fefd8";
+      sha256 = "e8f3a404d07cd3f692315a1fcea0730af94d03347e2c495bdbea7071e2bea001";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/km/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/km/Firefox%20154.0.1.dmg";
       locale = "km";
       arch = "mac";
-      sha256 = "0d229d4613bc509de83ace539e11e86539b741dfdf4de92172df26f9d1f8d919";
+      sha256 = "9c30207a448ab083d590f25630289e26ea19e1235b3201e61ec1545ebb8cac1f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/kn/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/kn/Firefox%20154.0.1.dmg";
       locale = "kn";
       arch = "mac";
-      sha256 = "bec06ed3b0f0eb2f2db405d9284b781d5d0e88d126b23ecfaa211777b68ab1e5";
+      sha256 = "2701fa15c878006090f11315357fbca94d7fc382613842d498585028dee8937b";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/ko/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/ko/Firefox%20154.0.1.dmg";
       locale = "ko";
       arch = "mac";
-      sha256 = "288d2bf51c4a6f7c2c32a286d41fb7fc07191b3f9949dbba7043e850596e2357";
+      sha256 = "306327b13160acbe5dd034dc75aac62ed65415dd3e82f1f06dd1c37d714515a3";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/lij/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/lij/Firefox%20154.0.1.dmg";
       locale = "lij";
       arch = "mac";
-      sha256 = "7b48fec1aa78acc600f5f61bcf0b97d11851f8583827db65275ac64b6f683a4a";
+      sha256 = "0c8a38c3aa6b54694d5034595fdefeb86ec0c82cafa1e3878a29081c0fdd8a2c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/lt/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/lt/Firefox%20154.0.1.dmg";
       locale = "lt";
       arch = "mac";
-      sha256 = "ebf14db25268685ce43f430fd3d417aa9cb42f976440d914c7ecf24ac15c15c3";
+      sha256 = "6be388cf36c26e770ff718fbe92ccb7f489c906ef7e3e793d9ba4a80edea9e7d";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/lv/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/lv/Firefox%20154.0.1.dmg";
       locale = "lv";
       arch = "mac";
-      sha256 = "d2e58e6788d8d4d69694b348be0c4fc70420d57cc83d9a6f5c862045af82e17a";
+      sha256 = "e794427502e5747eeb25edbcebe78d53296b0d4aac4f082dc2436c69c8b74309";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/mk/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/mk/Firefox%20154.0.1.dmg";
       locale = "mk";
       arch = "mac";
-      sha256 = "0eebe41306962074c778655e1a82ef249e12130f0ea7be100ec70b9760415f55";
+      sha256 = "32b85a92071a3aed56e6caf17cc5f2eb64573ecdeef4da848eacfaa5f4ab4c97";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/mr/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/mr/Firefox%20154.0.1.dmg";
       locale = "mr";
       arch = "mac";
-      sha256 = "f1482cf455719ec7021e504f498795c746b48d55f5cdf4b5347769a886ffdee6";
+      sha256 = "040b0145395d0924b6ba300eacc414183bd1311756bee23e200180e4883ea05a";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/ms/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/ms/Firefox%20154.0.1.dmg";
       locale = "ms";
       arch = "mac";
-      sha256 = "9d4ab0059554815f46310b0076b95e5c5819c652b8901a44381b9a37ad8a57a4";
+      sha256 = "df525f6142be37da81fe588b98cfc6fc70f2f6865a5ae6a6203b19094464c8fa";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/my/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/my/Firefox%20154.0.1.dmg";
       locale = "my";
       arch = "mac";
-      sha256 = "e03f45a748fd7aadb73db4d731ce2728d730e6bfe29b4ca32b2fb086e04cd8e8";
+      sha256 = "895ed8618e7c67ea87789db809a0c7712d0e661632b1429f6a2dc4c169770a6f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/nb-NO/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/nb-NO/Firefox%20154.0.1.dmg";
       locale = "nb-NO";
       arch = "mac";
-      sha256 = "9b58bd2583246afee6d664db813212a025d5fd11db1cd4501578a080c56a3316";
+      sha256 = "679d52a171460c6f3fa2f6650d771d76f32560ee9415d53e6e82e81657fb9cba";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/ne-NP/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/ne-NP/Firefox%20154.0.1.dmg";
       locale = "ne-NP";
       arch = "mac";
-      sha256 = "b0b24a0833dd77c923e945fb159a4e2d93c25e8e95cea6985c21c5d76c4439cd";
+      sha256 = "cfcbc0e797651aa63ff60c3dbd931c706deea78f97e4942f1d7d360239e5d7f5";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/nl/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/nl/Firefox%20154.0.1.dmg";
       locale = "nl";
       arch = "mac";
-      sha256 = "270e8b9a7209e401db9e5c6a31aeecfb7d780751dd51141eae0da1bd6a4f27c3";
+      sha256 = "40610084048d88af57975b97eb29eb709d700495690947f41119307b436dd84d";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/nn-NO/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/nn-NO/Firefox%20154.0.1.dmg";
       locale = "nn-NO";
       arch = "mac";
-      sha256 = "217b548e3b3c21143036b1079b2ca4c2eab99764f85bdb0c9f85cc9d4fd35e70";
+      sha256 = "724d5c8a88280ec1bc2a444d4937fc999c90eeff14e58fa901eb3bbc0dee315b";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/oc/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/oc/Firefox%20154.0.1.dmg";
       locale = "oc";
       arch = "mac";
-      sha256 = "f442102201c2e78bb6ce675b89d8a009c2cc34f0a6094c81b17b20e6ffa094aa";
+      sha256 = "272cba1dff412f20e8771549ab3a889a0aef8aa069f474f27451fa19d8477c4d";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/pa-IN/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/pa-IN/Firefox%20154.0.1.dmg";
       locale = "pa-IN";
       arch = "mac";
-      sha256 = "3a0b9231d3f9c4903fd44b00967c471f16783e4a2ece1bba1e657d253bacfdf7";
+      sha256 = "4e7ee45a7b753485a1cbbeaffaa12149e5eed0ee6bbfe714292205d900419edd";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/pl/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/pl/Firefox%20154.0.1.dmg";
       locale = "pl";
       arch = "mac";
-      sha256 = "0ff7e06d57404483b30e12d634fe660e976293d709acc68621fc93c92d2ebe0d";
+      sha256 = "eb4606fe5472aa0ac452f52e0cad1dec65958d6b0e9e11e9ba983be8679886b5";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/pt-BR/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/pt-BR/Firefox%20154.0.1.dmg";
       locale = "pt-BR";
       arch = "mac";
-      sha256 = "fa635a610a2865d9b980c9eb17c1bf658c7bab8b2592c36da3f49f71d3a992a9";
+      sha256 = "7bdd8a74843d5034be226a9f0e2f7f4550c19a6a2120f156c77de6d7dfc7e346";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/pt-PT/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/pt-PT/Firefox%20154.0.1.dmg";
       locale = "pt-PT";
       arch = "mac";
-      sha256 = "e8da7857141089e7bd081a4f8de5f8b4e30207a56795115e392070a6532ca5dd";
+      sha256 = "223e628e3fc76da188b6c324a8e270fe90e39c8664c55083e52591607b78539f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/rm/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/rm/Firefox%20154.0.1.dmg";
       locale = "rm";
       arch = "mac";
-      sha256 = "346998cffc880bd7306f1218f9de90bdb4090a8875fec4b75f3b74d12821a0b3";
+      sha256 = "04377e24880319527413d81734ca17f8f65615a6dbb27e5702f2e1db084dd107";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/ro/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/ro/Firefox%20154.0.1.dmg";
       locale = "ro";
       arch = "mac";
-      sha256 = "f4e4282decf485251be9182541c6499f0bc9f5c7a869b61b75f5be4fd284aa46";
+      sha256 = "122d6f521dcd3002d6217d930ba994a545cd872c12ce057e22654d00b22b727f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/ru/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/ru/Firefox%20154.0.1.dmg";
       locale = "ru";
       arch = "mac";
-      sha256 = "0c4cd169fa81f611f49b3887b567549be6c52abfa420625a3c3ed17734911799";
+      sha256 = "599d1f8decec332a3b2605521970e9ea1ef27b4de82c32760a06463dab8d2115";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/sat/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/sat/Firefox%20154.0.1.dmg";
       locale = "sat";
       arch = "mac";
-      sha256 = "8787802a89daa0db5a3723abad077651e603d9bd0541c52bf646599ee04bc72c";
+      sha256 = "c1096508426c6d3a34b24978120268b595ca5e70a22cdcac1ba32abb8714952e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/sc/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/sc/Firefox%20154.0.1.dmg";
       locale = "sc";
       arch = "mac";
-      sha256 = "dd7fc4714c0890329e85b0a3e05b30dec01561f61b378ef13158562055ed03a1";
+      sha256 = "cdc862d707333f19c4834cb9a5ebde6d17c023a330790e875d3c97ddfe123bbe";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/sco/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/sco/Firefox%20154.0.1.dmg";
       locale = "sco";
       arch = "mac";
-      sha256 = "efac5870e5e9e8b4ce471364384445b612a141a143ffdb5890c57b4d5622aba9";
+      sha256 = "5b629086043ec6aa37d22e527ff034b535b1c390f4be549b5252945ce2674bd2";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/si/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/si/Firefox%20154.0.1.dmg";
       locale = "si";
       arch = "mac";
-      sha256 = "a2c6973b2273b99ac8855fd06b5b498dce0befa0dcd55f6b80213567a7ca31e3";
+      sha256 = "25ae120fb39ea91f385eee75995de55879bc4d3ec3cc478fc3ec14aaec6a86fa";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/sk/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/sk/Firefox%20154.0.1.dmg";
       locale = "sk";
       arch = "mac";
-      sha256 = "5120a7d6ed22910d9a47fc4df7c3c3c9db58233e9bdbfda3ccb7e92e8e2ec21e";
+      sha256 = "833e8b129c4086abc9f0e844391a4d048ade4a1973eef7659e7b627b22aa6b4d";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/skr/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/skr/Firefox%20154.0.1.dmg";
       locale = "skr";
       arch = "mac";
-      sha256 = "6b7c6d8bee92c448532cb63690b92747ecb86016410524f0fade47c7cdd78db4";
+      sha256 = "68c01848c3551eddef5765d32c8fc073a2624ee05db379bae20c95313557ec65";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/sl/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/sl/Firefox%20154.0.1.dmg";
       locale = "sl";
       arch = "mac";
-      sha256 = "2aadceea2181b67cb32212f018b9a2b71d8d6c00a413708d3a8e3fe2e70d4ea9";
+      sha256 = "68a5835bf9ec9946f7c755b47fe632591c8a39ee96cc1cb547f9f846414fc4c4";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/son/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/son/Firefox%20154.0.1.dmg";
       locale = "son";
       arch = "mac";
-      sha256 = "202935b82fcfad4bf3a3a576911c2e19704384a7885bcfa50fed708c9005279d";
+      sha256 = "0eda232501b16ed50e1042f81a130f41c78ecfe7f4f1e5ec10ce4701b083cb82";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/sq/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/sq/Firefox%20154.0.1.dmg";
       locale = "sq";
       arch = "mac";
-      sha256 = "f1047ee23eae8ae52f150123ff0113f49df8f45003c69f980d953790d6364f63";
+      sha256 = "dda4bf62d697a2d46c1b1e6c8e9bbd6a0d6be373a1a9deb7557dd66d663fc1a2";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/sr/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/sr/Firefox%20154.0.1.dmg";
       locale = "sr";
       arch = "mac";
-      sha256 = "42f149046451efe00b70c0b8f44838e5a362fd5cc711834a418d963472fc2361";
+      sha256 = "5a8c433ae15118c3876c0f4283ed6650d00a17c7143b5d6a730ed65abde73d69";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/sv-SE/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/sv-SE/Firefox%20154.0.1.dmg";
       locale = "sv-SE";
       arch = "mac";
-      sha256 = "974dd925a44442a4f3ce80faf744e2e49de81e706f7200929e17d02b285591b6";
+      sha256 = "3324c50077c4b356637bbf147d005d587016459668a551429c47b4a5a4f05b98";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/szl/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/szl/Firefox%20154.0.1.dmg";
       locale = "szl";
       arch = "mac";
-      sha256 = "43f7b6db959f43ed334a70883871604c760bff77054583396c39fe3d62869a59";
+      sha256 = "fb88323ad28b777f4a50ea883f74ec6233585908e28b97f172f0f3c975370268";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/ta/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/ta/Firefox%20154.0.1.dmg";
       locale = "ta";
       arch = "mac";
-      sha256 = "c1c8c98ed3504f493fbe43d68dc2da13d45078804f9c4806c94bd782ee53d1e2";
+      sha256 = "22782a11c4c41c02fa26b1631b642c5c9dcdad5ebed32a3c82cd55903433239a";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/te/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/te/Firefox%20154.0.1.dmg";
       locale = "te";
       arch = "mac";
-      sha256 = "f4ef40d51c55071c4307a40159cfac0ed407fe3ea510b81088f002dfb1677acb";
+      sha256 = "eb6d55a6531f3537215061bb714177084b90d7e73b40150649ef03166881fe04";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/tg/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/tg/Firefox%20154.0.1.dmg";
       locale = "tg";
       arch = "mac";
-      sha256 = "86513b7c21a9c4d80927b0da5ece77bc64556f21d6b911af6fc82e51a315856e";
+      sha256 = "1aa96e3c9051ebccecb71ab50b6e52274d4b848f4d8346c6f0949476b2537421";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/th/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/th/Firefox%20154.0.1.dmg";
       locale = "th";
       arch = "mac";
-      sha256 = "2c35394ca92b641c1792cd1436c6e4c8294f4013f3812406172c7218709b2806";
+      sha256 = "2aea80659fcf48e95a0b9d418ae05322c97aab792cda0c4931503d2a4e2ba421";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/tl/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/tl/Firefox%20154.0.1.dmg";
       locale = "tl";
       arch = "mac";
-      sha256 = "ec9e7d5f0abde902dc27f61a598184c573e40f93c09bf853ea5006d358eda91c";
+      sha256 = "5986856c931f9094edca1a835643be75409002edb74bfd3ababd5b98f6f60c49";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/tr/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/tr/Firefox%20154.0.1.dmg";
       locale = "tr";
       arch = "mac";
-      sha256 = "b29ef8c16f7ae03ec3bfdd98f818e3f99306087f458bb4f8b639b65c7c1f797d";
+      sha256 = "bd109949aea0eba6d23661559e311d58e9b3a921719363d93773b8ed0d85fc17";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/trs/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/trs/Firefox%20154.0.1.dmg";
       locale = "trs";
       arch = "mac";
-      sha256 = "7237eddde8f416fd12b65d0e89e589947c6c4a6b8e820892cd1907c4d02f5bd9";
+      sha256 = "9afc95428a7b11dd3afa169961f33d6f84f240772d3278f23ac957eee21e9f56";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/uk/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/uk/Firefox%20154.0.1.dmg";
       locale = "uk";
       arch = "mac";
-      sha256 = "962494f20f5be12a1849c29bb845739c77d81f556836dcbd25f7b5b93f52e3b5";
+      sha256 = "40ef11c4e840e176d4c79166238119fd49819ac044f8392f661fb45ce18c1e7a";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/ur/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/ur/Firefox%20154.0.1.dmg";
       locale = "ur";
       arch = "mac";
-      sha256 = "b797bf1f09ebe462a380198a693b13295529a50954697dec5a494a79853c1daf";
+      sha256 = "a14d5be4ca37884232ebddbbf0daa15efc6b24c5292bf2a3d69692e15ff1e029";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/uz/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/uz/Firefox%20154.0.1.dmg";
       locale = "uz";
       arch = "mac";
-      sha256 = "fdc19ff3422b5fa613f7167346751a1c25ce113c3c97fc25342d46c9440a595a";
+      sha256 = "ef1e18407a1a8171ba7696029dc3e89d9fdbfd3eb224bfee7e8aa5e421019900";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/vi/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/vi/Firefox%20154.0.1.dmg";
       locale = "vi";
       arch = "mac";
-      sha256 = "2ee4542168f06b2053a5dc0efea8881b336de735b49b81d284289d559231b2c7";
+      sha256 = "d1b7eb7ba0048d2d5f9b1f3ce4edf3d1a83893e699e61d419c899dbeb3e16396";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/xh/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/xh/Firefox%20154.0.1.dmg";
       locale = "xh";
       arch = "mac";
-      sha256 = "82bbc4cfcdc7beeb6698db288903982eb23a52622853eb8081ba158a7661a729";
+      sha256 = "92828aecb90f4ab1aa4ba479857a1b2227c362268b3c58b21712a130226e6b38";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/zh-CN/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/zh-CN/Firefox%20154.0.1.dmg";
       locale = "zh-CN";
       arch = "mac";
-      sha256 = "d51a4dd5583bf58a2e20ab6df46dbeb4aab7c046871a608157405627428b8622";
+      sha256 = "b003ef61cc82d152d52cc193e5bd56100ef0830cc965aecb785f11f85e39d061";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/zh-TW/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/zh-TW/Firefox%20154.0.1.dmg";
       locale = "zh-TW";
       arch = "mac";
-      sha256 = "2d6754c5a72238fcf18ef2ce2101b215e7427fa723abf03fb97a2a3610922ddf";
+      sha256 = "566b91ae10158cb8141be166da3deed608ed85d9f09b058388ed765c516e34a6";
     }
   ];
 }
diff --git a/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix b/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
index 8935ef5e314f..cbea4f9af1ed 100644
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
@@ -10,11 +10,11 @@
 buildMozillaMach rec {
   pname = "firefox-beta";
   binaryName = "firefox-beta";
-  version = "154.0b10";
+  version = "155.0b4";
   applicationName = "Firefox Beta";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "ddbe3ff45217a16df9eecfac52fcb12425accae76457e7054b20bd085f5b22908940a20448f213c3dc62d1276bb1c81f38194432336ba97459b2c17393ebd3cd";
+    sha512 = "6c1536924b955f856bc629cdf563ab9d4a87058fac7acf8db008bfe5a1f19defd004116bb3673fd23b62e1e00ca21acbcc7153d85dfa522eb3def6c85065b01b";
   };
 
   meta = {
diff --git a/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix b/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
index d9918265f160..4b541f399eae 100644
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
@@ -10,13 +10,13 @@
 buildMozillaMach rec {
   pname = "firefox-devedition";
   binaryName = "firefox-devedition";
-  version = "154.0b10";
+  version = "155.0b4";
   applicationName = "Firefox Developer Edition";
   requireSigning = false;
   branding = "browser/branding/aurora";
   src = fetchurl {
     url = "mirror://mozilla/devedition/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "e2275579e4769a0690010d8fbba528a0e347d86f0dc981d1702b3e627d9c73f3fd7399d3e618c514bf6a3c0059fa3aa5a29f9cdec802e52955a03b1122ca8d39";
+    sha512 = "d2b58b520393848c110714537aec2c71d1244d7439c8c62e85bf123a3f3ade3db8a31617c242d9803306f1655237666948aaa55b780f8743ab57fc406a6ea906";
   };
 
   # buildMozillaMach sets MOZ_APP_REMOTINGNAME during configuration, but
diff --git a/pkgs/applications/networking/browsers/firefox/packages/firefox.nix b/pkgs/applications/networking/browsers/firefox/packages/firefox.nix
index ffc02056a326..70bff435efee 100644
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox.nix
@@ -9,10 +9,10 @@
 
 buildMozillaMach rec {
   pname = "firefox";
-  version = "154.0";
+  version = "154.0.1";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "a77cd664982add628681167ef5939bd6bf0c894aa380cca66f9b5fb265947874d1e819d42264f1dd07c843f8a6dc020da268cca9ff1e064fca019de91af9b996";
+    sha512 = "9141e34978c2ecbe1b267b3cc63136142625734618e67cbbbf6536e1427af66d01f19851200eba0db7c715991f39e7d5d0200abb9e2cd7c15d58a8a411b1b412";
   };
 
   meta = {
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 6e0825105bbd..134d7b3df4cc 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -382,13 +382,13 @@
     "vendorHash": "sha256-y9GRTuoh1X6GfGkGZbPpO500y8DoJS1dnwZL3BCTUcY="
   },
   "equinix_equinix": {
-    "hash": "sha256-HwPjxVWIqWxpdIElMgDmOUx7KXr5VEwLVNbTLeEgRRo=",
+    "hash": "sha256-gPuRvWQiJZdyUGTNMCQSEFmbqC5ralxroBSbBprFe/8=",
     "homepage": "https://registry.terraform.io/providers/equinix/equinix",
     "owner": "equinix",
     "repo": "terraform-provider-equinix",
-    "rev": "v5.1.0",
+    "rev": "v5.2.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-8v7+xVF/X9q7VmjQD4azGIggWpgPGuoNSWetsbKN7LA="
+    "vendorHash": "sha256-JnbQPQi/dy3pEwurlzIcfBdbAfvYJVsoLYnvJPX3sjc="
   },
   "exoscale_exoscale": {
     "hash": "sha256-QIYIqJI/xznbkqR8E8R2LwF15M6ZdEntQ8JtdIwZypM=",
@@ -580,13 +580,13 @@
     "vendorHash": "sha256-gv54RqpkWri5yL40ajcLnqzF0XvMEzFoFEEV2/g1paE="
   },
   "hashicorp_google": {
-    "hash": "sha256-GWC0PIYMAhI9KO2j5yI7W7v0el8u9d1qqUyaWq/sodo=",
+    "hash": "sha256-Ed/D/c8Ut4gR+VAonZbqvgK/MKVLRryloO+7hvzn5G8=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google",
     "owner": "hashicorp",
     "repo": "terraform-provider-google",
-    "rev": "v7.44.0",
+    "rev": "v7.45.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-gy+Tn9L2NYRYnmYGcb2jqTTXJDzMqHtm2EgSQZunbjg="
+    "vendorHash": "sha256-d4nO4QTeHyVNdU1JFzQdU4UTisoY1tjv7GVCRNRtNC8="
   },
   "hashicorp_google-beta": {
     "hash": "sha256-WjgVh6LHcNmTT6Fg2FWmtMacCokaNuZTI9ZEcMoD7uo=",
@@ -1058,11 +1058,11 @@
     "vendorHash": null
   },
   "oracle_oci": {
-    "hash": "sha256-YcKLw5PotrwRdGEmPzy1Ka/doJ9fDbKuP6Q9Dw24mG0=",
+    "hash": "sha256-3/apEon1W1iaB7UIkYgI4POV+f1uVDVXX4V6dyeqsLk=",
     "homepage": "https://registry.terraform.io/providers/oracle/oci",
     "owner": "oracle",
     "repo": "terraform-provider-oci",
-    "rev": "v8.27.0",
+    "rev": "v8.28.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
diff --git a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
index 7f27c4383d44..5265b1225d80 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@@ -112,8 +112,8 @@ rec {
   thunderbird-140 = common {
     applicationName = "Thunderbird ESR";
 
-    version = "140.13.0esr";
-    sha512 = "778d2fc2837ba367e90c4336f3873da5a0823c182e2f50aa9373cd1ee9ee2b5310372ad9d33e1e11978791b67de4a6952d3036ff7d57b257a06f49c8cd4a830e";
+    version = "140.14.0esr";
+    sha512 = "4c95b1ca3fc7f6429b2360a7e732635bdfb60927622a7da4d8af9ca2abd550611b91763c587cddad5d51c0dd4e905ba8e106da3cd21591a1bec3dba1b9a2502d";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-140";
diff --git a/pkgs/build-support/bintools-wrapper/default.nix b/pkgs/build-support/bintools-wrapper/default.nix
index 1a9ce996c0dd..69dc6afc9f93 100644
--- a/pkgs/build-support/bintools-wrapper/default.nix
+++ b/pkgs/build-support/bintools-wrapper/default.nix
@@ -478,6 +478,8 @@ stdenvNoCC.mkDerivation {
       apple-sdk.__spliced.buildTarget or apple-sdk;
   };
 
+  __structuredAttrs = true;
+
   meta =
     let
       bintools_ = optionalAttrs (bintools != null) bintools;
diff --git a/pkgs/build-support/dotnet/build-dotnet-module/hook/default.nix b/pkgs/build-support/dotnet/build-dotnet-module/hook/default.nix
index e1f7cd816719..58a89b855e70 100644
--- a/pkgs/build-support/dotnet/build-dotnet-module/hook/default.nix
+++ b/pkgs/build-support/dotnet/build-dotnet-module/hook/default.nix
@@ -9,7 +9,7 @@
 makeSetupHook {
   name = "dotnet-hook";
   substitutions = {
-    dotnetRuntime = dotnet-runtime;
+    dotnetRuntime = lib.defaultTo "" dotnet-runtime;
     wrapperPath = lib.makeBinPath [
       which
       coreutils
diff --git a/pkgs/build-support/release/default.nix b/pkgs/build-support/release/default.nix
index 2ac928d77916..6ad860d4fac9 100644
--- a/pkgs/build-support/release/default.nix
+++ b/pkgs/build-support/release/default.nix
@@ -124,16 +124,12 @@ rec {
       name,
       constituents,
       meta ? { },
-      # Interpret string constituents as fnmatch patterns matched
-      # against all job names of the jobset.
-      globConstituents ? false,
     }:
     pkgs.runCommand name
       {
         inherit constituents meta;
         preferLocalBuild = true;
         _hydraAggregate = true;
-        _hydraGlobConstituents = globConstituents;
       }
       ''
         mkdir -p $out/nix-support
diff --git a/pkgs/build-support/trivial-builders/default.nix b/pkgs/build-support/trivial-builders/default.nix
index b33f75e34676..4f4b6a9e5911 100644
--- a/pkgs/build-support/trivial-builders/default.nix
+++ b/pkgs/build-support/trivial-builders/default.nix
@@ -735,7 +735,6 @@ rec {
       meta ? { },
       passthru ? { },
       substitutions ? { },
-      __structuredAttrs ? false,
     }@args:
     script:
     runCommand name
@@ -745,10 +744,6 @@ rec {
           # Make the position of the derivation accurate.
           # Since not having `name` is deprecated, this should be fairly accurate.
           pos = lib.unsafeGetAttrPos "name" args;
-          # TODO(@Artturin:) substitutions should be inside the env attrset
-          # but users are likely passing non-substitution arguments through substitutions
-          # turn off __structuredAttrs to unbreak substituteAll
-          inherit __structuredAttrs;
           pname = name;
           version = "26.05pre-git";
           inherit meta;
@@ -756,6 +751,7 @@ rec {
           inherit propagatedBuildInputs;
           inherit propagatedNativeBuildInputs;
           strictDeps = true;
+          __structuredAttrs = true;
           # TODO 2023-01, no backport: simplify to inherit passthru;
           passthru =
             passthru
@@ -771,7 +767,9 @@ rec {
           recordPropagatedDependencies
         ''
         + lib.optionalString (substitutions != { }) ''
-          substituteAll ${script} $out/nix-support/setup-hook
+          substitute ${script} $out/nix-support/setup-hook ${
+            lib.concatMapAttrsStringSep " " (name: _: "--subst-var ${name}") substitutions
+          }
         ''
       );
 
diff --git a/pkgs/by-name/_2/_2ship2harkinian/package.nix b/pkgs/by-name/_2/_2ship2harkinian/package.nix
index 807d61e658bf..cc897aaa19f7 100644
--- a/pkgs/by-name/_2/_2ship2harkinian/package.nix
+++ b/pkgs/by-name/_2/_2ship2harkinian/package.nix
@@ -19,6 +19,7 @@
   libpulseaudio,
   libzip,
   nlohmann_json,
+  stb,
   SDL2,
   spdlog,
   tinyxml-2,
@@ -89,12 +90,6 @@ let
     '';
   };
 
-  stb' = fetchurl {
-    name = "stb_image.h";
-    url = "https://raw.githubusercontent.com/nothings/stb/0bc88af4de5fb022db643c2d8e549a0927749354/stb_image.h";
-    hash = "sha256-xUsVponmofMsdeLsI6+kQuPg436JS3PBl00IZ5sg3Vw=";
-  };
-
   stormlib' = applyPatches {
     src = fetchFromGitHub {
       owner = "ladislav-zezula";
@@ -220,7 +215,7 @@ stdenv.mkDerivation (finalAttrs: {
   preConfigure = ''
     # mirror 2ship's stb
     mkdir stb
-    cp ${stb'} ./stb/${stb'.name}
+    cp ${stb}/include/stb/stb_image.h ./stb/stb_image.h
     cp ${stb_impl} ./stb/${stb_impl.name}
     substituteInPlace libultraship/cmake/dependencies/common.cmake \
       --replace-fail "\''${STB_DIR}" "$(readlink -f ./stb)"
diff --git a/pkgs/by-name/ab/abseil-cpp_202505/package.nix b/pkgs/by-name/ab/abseil-cpp_202505/package.nix
index 9dd41332758e..2485b170ce43 100644
--- a/pkgs/by-name/ab/abseil-cpp_202505/package.nix
+++ b/pkgs/by-name/ab/abseil-cpp_202505/package.nix
@@ -45,6 +45,8 @@ stdenv.mkDerivation (finalAttrs: {
     };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Open-source collection of C++ code designed to augment the C++ standard library";
     homepage = "https://abseil.io/";
diff --git a/pkgs/by-name/ab/abseil-cpp_202508/package.nix b/pkgs/by-name/ab/abseil-cpp_202508/package.nix
index 4c5a7b415cfe..c15d08514b2d 100644
--- a/pkgs/by-name/ab/abseil-cpp_202508/package.nix
+++ b/pkgs/by-name/ab/abseil-cpp_202508/package.nix
@@ -50,6 +50,8 @@ stdenv.mkDerivation (finalAttrs: {
     };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Open-source collection of C++ code designed to augment the C++ standard library";
     homepage = "https://abseil.io/";
diff --git a/pkgs/by-name/ab/abseil-cpp_202601/package.nix b/pkgs/by-name/ab/abseil-cpp_202601/package.nix
index f71a2aedf920..15d8d2a42a22 100644
--- a/pkgs/by-name/ab/abseil-cpp_202601/package.nix
+++ b/pkgs/by-name/ab/abseil-cpp_202601/package.nix
@@ -39,6 +39,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [ gtest ];
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Open-source collection of C++ code designed to augment the C++ standard library";
     homepage = "https://abseil.io/";
diff --git a/pkgs/by-name/ad/ada/package.nix b/pkgs/by-name/ad/ada/package.nix
index 79878f5a553b..4afbdecb59de 100644
--- a/pkgs/by-name/ad/ada/package.nix
+++ b/pkgs/by-name/ad/ada/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ada";
-  version = "3.4.4";
+  version = "4.0.0";
 
   src = fetchFromGitHub {
     owner = "ada-url";
     repo = "ada";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kfUbsqQ+CsqnySKgeL1GFJLcDe1Irivp4CoZG93BZYg=";
+    hash = "sha256-TvjoLUKO2+YgS1mlyglLb+rBLTO/SWSBVA2S34Z6kMI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ad/adhammer/package.nix b/pkgs/by-name/ad/adhammer/package.nix
index a7d137916a74..5f6fb23db48e 100644
--- a/pkgs/by-name/ad/adhammer/package.nix
+++ b/pkgs/by-name/ad/adhammer/package.nix
@@ -10,7 +10,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "adhammer";
-  version = "1.3.10";
+  version = "1.4.2";
 
   __structuredAttrs = true;
 
@@ -18,10 +18,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "icedracon";
     repo = "adhammer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QQjiyvj3e5unEsh17UyKck2rs8oKeLO5eodBG7cn1LQ=";
+    hash = "sha256-Jn3hmCSpc/9zxfIzebrCkDOgZ4HzfXdKOcJSXNvxZGM=";
   };
 
-  cargoHash = "sha256-Ebkvxl/JyiZ84ucv7FmOluHTqYd14I3B6z53QNmVQZw=";
+  cargoHash = "sha256-037x5bhTizcCqW/pszIadAVA9ElQzJOQ9W1dh5Kpg9Y=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/al/alsa-utils/package.nix b/pkgs/by-name/al/alsa-utils/package.nix
index 91653a4848b6..4ad614132da5 100644
--- a/pkgs/by-name/al/alsa-utils/package.nix
+++ b/pkgs/by-name/al/alsa-utils/package.nix
@@ -5,6 +5,7 @@
   fetchurl,
   alsa-lib,
   alsa-plugins,
+  bashNonInteractive,
   gettext,
   makeWrapper,
   pkg-config,
@@ -45,6 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
   ];
   buildInputs = [
+    bashNonInteractive
     alsa-lib
     ncurses
     libsamplerate
diff --git a/pkgs/by-name/an/angle/package.nix b/pkgs/by-name/an/angle/package.nix
index 0d6a2329e6a9..4038c508da07 100644
--- a/pkgs/by-name/an/angle/package.nix
+++ b/pkgs/by-name/an/angle/package.nix
@@ -24,11 +24,7 @@ let
   llvmPackages = llvmPackages_21;
   llvmMajorVersion = lib.versions.major llvmPackages.llvm.version;
   arch = stdenv.hostPlatform.parsed.cpu.name;
-  triplet = lib.getAttr arch {
-    "x86_64" = "x86_64-unknown-linux-gnu";
-    "aarch64" = "aarch64-unknown-linux-gnu";
-    "riscv64" = "riscv64-unknown-linux-gnu";
-  };
+  triplet = stdenv.hostPlatform.config;
 
   clang = symlinkJoin {
     name = "angle-clang-llvm-join";
@@ -115,30 +111,32 @@ stdenv.mkDerivation (finalAttrs: {
     ./fix-uninitialized-const-pointer-error-001.patch
   ];
 
-  postPatch = ''
-    substituteInPlace build/config/clang/BUILD.gn \
-      --replace-fail \
-        "_dir = \"${triplet}\"" \
-        "_dir = \"${triplet}\"
-         _suffix = \"-${arch}\""
+  postPatch =
+    lib.optionalString stdenv.hostPlatform.isLinux ''
+      substituteInPlace build/config/clang/BUILD.gn \
+        --replace-fail \
+          "_dir = \"${triplet}\"" \
+          "_dir = \"${triplet}\"
+           _suffix = \"-${arch}\""
+    ''
+    + ''
+      # Don't precompile Metal shaders, because the compiler is non-free.
+      substituteInPlace src/libANGLE/renderer/metal/metal_backend.gni \
+        --replace-fail \
+          "metal_internal_shader_compilation_supported =" \
+          "metal_internal_shader_compilation_supported = false &&"
 
-    # Don't precompile Metal shaders, because the compiler is non-free.
-    substituteInPlace src/libANGLE/renderer/metal/metal_backend.gni \
-      --replace-fail \
-        "metal_internal_shader_compilation_supported =" \
-        "metal_internal_shader_compilation_supported = false &&"
+      cat > build/config/gclient_args.gni <<EOF
+      # Generated from 'DEPS'
+      checkout_angle_internal = false
+      checkout_angle_mesa = false
+      checkout_angle_restricted_traces = false
+      generate_location_tags = false
+      EOF
 
-    cat > build/config/gclient_args.gni <<EOF
-    # Generated from 'DEPS'
-    checkout_angle_internal = false
-    checkout_angle_mesa = false
-    checkout_angle_restricted_traces = false
-    generate_location_tags = false
-    EOF
-
-    # For sandboxed build on darwin.
-    patchShebangs build/toolchain/apple
-  '';
+      # For sandboxed build on darwin.
+      patchShebangs build/toolchain/apple
+    '';
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/by-name/ar/argp-standalone/package.nix b/pkgs/by-name/ar/argp-standalone/package.nix
index 3064c3c94f83..a0aacd8ca60b 100644
--- a/pkgs/by-name/ar/argp-standalone/package.nix
+++ b/pkgs/by-name/ar/argp-standalone/package.nix
@@ -22,8 +22,12 @@ stdenv.mkDerivation (finalAttrs: {
     ninja
   ];
 
+  strictDeps = true;
+
   doCheck = true;
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://github.com/argp-standalone/argp-standalone";
     description = "Standalone version of arguments parsing functions from Glibc";
diff --git a/pkgs/by-name/as/asciidoc/package.nix b/pkgs/by-name/as/asciidoc/package.nix
index 5aee5a2d9108..8ceb6a06a487 100644
--- a/pkgs/by-name/as/asciidoc/package.nix
+++ b/pkgs/by-name/as/asciidoc/package.nix
@@ -151,7 +151,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
   src = fetchFromGitHub {
     owner = "asciidoc-py";
     repo = "asciidoc-py";
-    rev = finalAttrs.version;
+    tag = finalAttrs.version;
     hash = "sha256-td3C7xTWfSzdo9Bbz0dHW2oPaCQYmUE9H2sUFfg5HH0=";
   };
 
@@ -320,6 +320,8 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     runHook postCheck
   '';
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Text-based document generation system";
     longDescription = ''
diff --git a/pkgs/by-name/au/auto-patchelf/package.nix b/pkgs/by-name/au/auto-patchelf/package.nix
index 7823a55c72e5..4d5cf55f3236 100644
--- a/pkgs/by-name/au/auto-patchelf/package.nix
+++ b/pkgs/by-name/au/auto-patchelf/package.nix
@@ -15,6 +15,8 @@ stdenv.mkDerivation {
 
   buildInputs = [ pythonEnv ];
 
+  strictDeps = true;
+
   src = ./source;
 
   buildPhase = ''
@@ -33,6 +35,8 @@ stdenv.mkDerivation {
     runHook postInstall
   '';
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Automatically patch ELF binaries using patchelf";
     mainProgram = "auto-patchelf";
diff --git a/pkgs/by-name/au/auto-patchelf/source/auto-patchelf.py b/pkgs/by-name/au/auto-patchelf/source/auto-patchelf.py
index bda5329a1df3..b16c98096360 100644
--- a/pkgs/by-name/au/auto-patchelf/source/auto-patchelf.py
+++ b/pkgs/by-name/au/auto-patchelf/source/auto-patchelf.py
@@ -240,6 +240,35 @@ def find_first_matching_rpath_with_origin(binary: Path, lib_dir: Path, rpaths: l
             return Path(rpath)
     return None
 
+
+def relativize_rpath_to_origin(*, binary_path: Path, rpath_entries: list[Path], containing_path: Path) -> list[Path]:
+    """
+    Rewrite absolute RPATH entries to use $ORIGIN when the entry sits
+    under containing_path (the --paths entry the binary was found
+    under).
+
+    The resulting RPATH is relocatable: as long as the directory layout
+    within containing_path is preserved, the whole tree can be moved
+    and the binary will still find its dependencies.
+
+    Entries that already contain $ORIGIN are left untouched.
+    Entries outside containing_path are also left absolute.
+    """
+    containing_norm: Path = Path(os.path.normpath(containing_path))
+    new_rpath_entries: list[Path] = []
+    for entry in rpath_entries:
+        if "$ORIGIN" in entry.as_posix():
+            new_rpath_entries.append(entry)
+            continue
+        entry_norm: Path = Path(os.path.normpath(entry))
+        if not entry_norm.is_relative_to(containing_norm):
+            new_rpath_entries.append(entry)
+            continue
+        rel = os.path.relpath(entry_norm, binary_path.parent)
+        new_rpath_entries.append(Path("$ORIGIN") / rel)
+    return new_rpath_entries
+
+
 class Event(Protocol):
     """Protocol for loggable events that occur during the auto-patchelf process."""
     def to_human_readable_str(self) -> str: ...
@@ -317,7 +346,18 @@ class Logger:
 
 
 
-def auto_patchelf_file(logger: Logger, path: Path, runtime_deps: list[Path], append_rpaths: list[Path] = [], keep_libc: bool = False, preserve_origin: bool = False, extra_args: list[str] = []) -> list[Dependency]:
+def auto_patchelf_file(
+    *,
+    logger: Logger,
+    runtime_deps: list[Path],
+    append_rpaths: list[Path] = [],
+    keep_libc: bool = False,
+    preserve_origin: bool = False,
+    relativize_rpath: bool = False,
+    extra_args: list[str] = [],
+    path: Path,
+    containing_path: Path
+) -> list[Dependency]:
     try:
         with open_elf(path) as elf:
 
@@ -436,6 +476,9 @@ def auto_patchelf_file(logger: Logger, path: Path, runtime_deps: list[Path], app
             if "$ORIGIN" in existing_rpath:
                 rpath.append(Path(existing_rpath))
 
+    if relativize_rpath:
+        rpath = relativize_rpath_to_origin(binary_path=path, rpath_entries=rpath, containing_path=containing_path)
+
     # Dedup the rpath
     rpath_str = ":".join(dict.fromkeys(map(Path.as_posix, rpath)))
 
@@ -458,6 +501,7 @@ def auto_patchelf(
         append_rpaths: list[Path] = [],
         keep_libc: bool = False,
         preserve_origin: bool = False,
+        relativize_rpath: bool = False,
         add_existing: bool = True,
         extra_args: list[str] = []) -> None:
 
@@ -472,9 +516,20 @@ def auto_patchelf(
     populate_cache(lib_dirs)
 
     dependencies = []
-    for path in chain.from_iterable(glob(p, '*', recursive) for p in paths_to_patch):
-        if not path.is_symlink() and path.is_file():
-            dependencies += auto_patchelf_file(logger, path, runtime_deps, append_rpaths, keep_libc, preserve_origin, extra_args)
+    for containing_path in paths_to_patch:
+        for path in glob(containing_path, '*', recursive):
+            if not path.is_symlink() and path.is_file():
+                dependencies += auto_patchelf_file(
+                    logger=logger,
+                    runtime_deps=runtime_deps,
+                    append_rpaths=append_rpaths,
+                    keep_libc=keep_libc,
+                    preserve_origin=preserve_origin,
+                    relativize_rpath=relativize_rpath,
+                    extra_args=extra_args,
+                    path=path,
+                    containing_path=containing_path
+                )
 
     missing = [dep for dep in dependencies if not dep.found]
 
@@ -560,6 +615,12 @@ def main() -> None:
         action="store_true",
         help="When possible, replace absolute RPATH entries with original $ORIGIN entries that resolve to the same directory.",
     )
+    parser.add_argument(
+        "--relativize-rpath",
+        dest="relativize_rpath",
+        action="store_true",
+        help="Rewrite absolute RPATH entries to use $ORIGIN when the binary and the entry live under the same --paths root, so the patched tree is relocatable.",
+    )
     parser.add_argument(
         "--ignore-existing",
         dest="add_existing",
@@ -597,6 +658,7 @@ def main() -> None:
         append_rpaths=args.append_rpaths,
         keep_libc=args.keep_libc,
         preserve_origin=args.preserve_origin,
+        relativize_rpath=args.relativize_rpath,
         add_existing=args.add_existing,
         extra_args=args.extra_args)
 
diff --git a/pkgs/by-name/au/autoconf-archive/package.nix b/pkgs/by-name/au/autoconf-archive/package.nix
index 8a3e537001e7..deca81bdad53 100644
--- a/pkgs/by-name/au/autoconf-archive/package.nix
+++ b/pkgs/by-name/au/autoconf-archive/package.nix
@@ -28,6 +28,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [ xz ];
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Archive of autoconf m4 macros";
     homepage = "https://www.gnu.org/software/autoconf-archive/";
diff --git a/pkgs/by-name/bi/bison/package.nix b/pkgs/by-name/bi/bison/package.nix
index db0d43a5a3ca..b108cc896905 100644
--- a/pkgs/by-name/bi/bison/package.nix
+++ b/pkgs/by-name/bi/bison/package.nix
@@ -28,10 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
     "host"
   ];
 
-  # there's a /bin/sh shebang in bin/yacc which when no strictDeps is patched with the build stdenv shell
-  # however when cross-compiling it would still be patched with the build stdenv shell which would be wrong
-  # cannot add bash to buildInputs due to infinite recursion
-  strictDeps = stdenv.hostPlatform != stdenv.buildPlatform;
+  strictDeps = true;
 
   nativeBuildInputs = [
     m4
@@ -40,6 +37,13 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optional stdenv.hostPlatform.isSunOS help2man;
   propagatedBuildInputs = [ m4 ];
 
+  # there's a /bin/sh shebang in bin/yacc which when no strictDeps is patched with the build stdenv shell
+  # however when cross-compiling it would still be patched with the build stdenv shell which would be wrong
+  # cannot add bash to buildInputs due to infinite recursion
+  postFixup = lib.optionalString (lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform) ''
+    patchShebangs --build $out/bin/yacc
+  '';
+
   enableParallelBuilding = true;
   # tests are flaky / timing sensitive on FreeBSD
   enableParallelChecking = !stdenv.hostPlatform.isFreeBSD;
@@ -50,6 +54,8 @@ stdenv.mkDerivation (finalAttrs: {
   # TODO: enable doInstallCheck unconditionally when fixed upstream.
   doInstallCheck = !stdenv.cc.isClang;
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.gnu.org/software/bison/";
     description = "Yacc-compatible parser generator";
diff --git a/pkgs/by-name/bo/boost-build/package.nix b/pkgs/by-name/bo/boost-build/package.nix
index de41ba27871a..732b35fd8fda 100644
--- a/pkgs/by-name/bo/boost-build/package.nix
+++ b/pkgs/by-name/bo/boost-build/package.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation {
     useBoost.src or (fetchFromGitHub {
       owner = "boostorg";
       repo = "build";
-      rev = defaultVersion;
+      tag = defaultVersion;
       sha256 = "1r4rwlq87ydmsdqrik4ly5iai796qalvw7603mridg2nwcbbnf54";
     });
 
@@ -58,6 +58,8 @@ stdenv.mkDerivation {
     bison
   ];
 
+  strictDeps = true;
+
   buildPhase = ''
     runHook preBuild
     ./bootstrap.sh
@@ -76,6 +78,8 @@ stdenv.mkDerivation {
     runHook postInstall
   '';
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.boost.org/build/";
     license = lib.licenses.boost;
diff --git a/pkgs/by-name/br/brotli/package.nix b/pkgs/by-name/br/brotli/package.nix
index c6cc9bc0e8bb..6d26a2de5ac5 100644
--- a/pkgs/by-name/br/brotli/package.nix
+++ b/pkgs/by-name/br/brotli/package.nix
@@ -32,6 +32,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ cmake ];
 
+  strictDeps = true;
+
   cmakeFlags = lib.optional staticOnly "-DBUILD_SHARED_LIBS=OFF";
 
   outputs = [
@@ -60,6 +62,8 @@ stdenv.mkDerivation (finalAttrs: {
     updateScript = nix-update-script { };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://github.com/google/brotli";
     changelog = "https://github.com/google/brotli/blob/${finalAttrs.src.tag}/CHANGELOG.md";
diff --git a/pkgs/by-name/bs/bsky-cli/package.nix b/pkgs/by-name/bs/bsky-cli/package.nix
index 154f6c686220..6674d6f33675 100644
--- a/pkgs/by-name/bs/bsky-cli/package.nix
+++ b/pkgs/by-name/bs/bsky-cli/package.nix
@@ -8,16 +8,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "bsky-cli";
-  version = "0.0.81";
+  version = "0.0.82";
 
   src = fetchFromGitHub {
     owner = "mattn";
     repo = "bsky";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Su2AhHaIozuqTzK1vyAjZR/a01j0dnlayV14Q7hTcCU=";
+    hash = "sha256-2Qtr9Q01ZbjfrZFw8315hDGiX2CmyQ0ru1MhqTvdjVw=";
   };
 
-  vendorHash = "sha256-jGeKaAR0rAqrhoUx/FqdDwdOxA/WioppFjGyi/PsIQs=";
+  vendorHash = "sha256-pICYDE5rpGdyII53Ucxx2u51MG604/yjz9W9xsO3ZLs=";
 
   buildInputs = [
     libpcap
diff --git a/pkgs/by-name/bu/buf/package.nix b/pkgs/by-name/bu/buf/package.nix
index 54f93cb93ed0..f90e1408fcf5 100644
--- a/pkgs/by-name/bu/buf/package.nix
+++ b/pkgs/by-name/bu/buf/package.nix
@@ -44,7 +44,7 @@ buildGoModule (finalAttrs: {
 
   preCheck = ''
     # Some tests take longer depending on builder load.
-    substituteInPlace private/bufpkg/bufcheck/lint_test.go \
+    substituteInPlace private/bufpkg/bufcheck/lint_test.go private/bufpkg/bufcheck/breaking_test.go \
       --replace-fail 'context.WithTimeout(t.Context(), 60*time.Second)' \
                      'context.WithTimeout(t.Context(), 600*time.Second)'
     # For WebAssembly runtime tests
diff --git a/pkgs/by-name/ca/cacert/package.nix b/pkgs/by-name/ca/cacert/package.nix
index c4052964cd91..9ee779721bf0 100644
--- a/pkgs/by-name/ca/cacert/package.nix
+++ b/pkgs/by-name/ca/cacert/package.nix
@@ -70,6 +70,8 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ buildcatrust ];
 
+  strictDeps = true;
+
   buildPhase = ''
     mkdir unbundled hashed
     buildcatrust \
@@ -247,5 +249,7 @@ stdenv.mkDerivation {
       };
   };
 
+  __structuredAttrs = true;
+
   inherit meta;
 }
diff --git a/pkgs/by-name/ca/cargo-sort/package.nix b/pkgs/by-name/ca/cargo-sort/package.nix
index bf7268e72266..3c7b2226f105 100644
--- a/pkgs/by-name/ca/cargo-sort/package.nix
+++ b/pkgs/by-name/ca/cargo-sort/package.nix
@@ -6,13 +6,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-sort";
-  version = "2.1.3";
+  version = "2.1.4";
 
   src = fetchFromGitHub {
     owner = "devinr528";
     repo = "cargo-sort";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-PtBjs+mqrz9z6tkpajx/OYQATJP81vi4ColjFXr9Rv0=";
+    sha256 = "sha256-xT+fWwd92Ll9zcz7FKpQbHKjUGXNOSuCGpFuJ3DQTJY=";
   };
 
   cargoHash = "sha256-ygMtfhwoUEIZx+q6KB5yOr8/Fj5FRMIs7dXlYDUKb2U=";
diff --git a/pkgs/by-name/ca/catch2/package.nix b/pkgs/by-name/ca/catch2/package.nix
index 5d8315120c08..1565a2d1ae73 100644
--- a/pkgs/by-name/ca/catch2/package.nix
+++ b/pkgs/by-name/ca/catch2/package.nix
@@ -12,14 +12,18 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "catchorg";
     repo = "Catch2";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-XnT2ziES94Y4uzWmaxSw7nWegJFQjAqFUG8PkwK5nLU=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-XnT2ziES94Y4uzWmaxSw7nWegJFQjAqFUG8PkwK5nLU=";
   };
 
   nativeBuildInputs = [ cmake ];
 
+  strictDeps = true;
+
   cmakeFlags = [ "-H.." ];
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Multi-paradigm automated test framework for C++ and Objective-C (and, maybe, C)";
     homepage = "http://catch-lib.net";
diff --git a/pkgs/by-name/ch/checkPhaseThreadLimitHook/package.nix b/pkgs/by-name/ch/checkPhaseThreadLimitHook/package.nix
index 6bd9bda7135a..5171993b8856 100644
--- a/pkgs/by-name/ch/checkPhaseThreadLimitHook/package.nix
+++ b/pkgs/by-name/ch/checkPhaseThreadLimitHook/package.nix
@@ -6,8 +6,6 @@
 makeSetupHook {
   name = "check-phase-thread-limit-hook";
 
-  __structuredAttrs = true;
-
   meta = {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ grimmauld ];
diff --git a/pkgs/by-name/ch/checkstyle/package.nix b/pkgs/by-name/ch/checkstyle/package.nix
index 3290878f2fbd..b5d199cc3d05 100644
--- a/pkgs/by-name/ch/checkstyle/package.nix
+++ b/pkgs/by-name/ch/checkstyle/package.nix
@@ -8,14 +8,14 @@
 }:
 
 maven.buildMavenPackage (finalAttrs: {
-  version = "13.10.0";
+  version = "14.0.0";
   pname = "checkstyle";
 
   src = fetchFromGitHub {
     owner = "checkstyle";
     repo = "checkstyle";
     tag = "checkstyle-${finalAttrs.version}";
-    hash = "sha256-RJ0ALYE+X2wUdFB4WpGIKYYeRau7AHr5m2Qk3amiXX4=";
+    hash = "sha256-8XrYOILxxPMFkSjJyFULzFiqF1T63F/PIzPiRevUYws=";
   };
 
   patches = [
@@ -23,7 +23,7 @@ maven.buildMavenPackage (finalAttrs: {
     ./drop-nexus-codehaus-snapshot-plugin-repository.patch
   ];
 
-  mvnHash = "sha256-NWTabR7E3aXkLaERZmolOoWPzERnOT/1q7+DW815p9U=";
+  mvnHash = "sha256-8HMUvqhvI8dl2E4uPj3qmgwnyY5fAMtbTbXm67P1Wpo=";
 
   nativeBuildInputs = [
     maven
diff --git a/pkgs/by-name/ch/chromaprint/package.nix b/pkgs/by-name/ch/chromaprint/package.nix
index 1f4a27adb643..f08c1c0e914e 100644
--- a/pkgs/by-name/ch/chromaprint/package.nix
+++ b/pkgs/by-name/ch/chromaprint/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   fetchurl,
   cmake,
   ninja,
@@ -17,23 +16,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "chromaprint";
-  version = "1.6.0";
+  version = "1.6.1";
 
   src = fetchFromGitHub {
     owner = "acoustid";
     repo = "chromaprint";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-G3HIMgbjaAXsC+8nt7mkj58xA62qwA8FC+PfTGblhNg=";
+    hash = "sha256-Es903zeZ++9/Xb/npUU3rB0V87DVqwT9uTMbQdSzfJI=";
   };
 
-  patches = [
-    # fix generated pkg-config files
-    (fetchpatch {
-      url = "https://github.com/acoustid/chromaprint/commit/782ef6bb5f6498e35f8e275f76998fbd5ffa36d6.patch";
-      hash = "sha256-drUfAMzTrqqB5UbzOnfPq6XD3HI+3sxyJJSTCa0BmD8=";
-    })
-  ];
-
   nativeBuildInputs = [
     cmake
     ninja
diff --git a/pkgs/by-name/cl/claude-code/manifest.json b/pkgs/by-name/cl/claude-code/manifest.json
index d2348c148aff..1a4dca608de1 100644
--- a/pkgs/by-name/cl/claude-code/manifest.json
+++ b/pkgs/by-name/cl/claude-code/manifest.json
@@ -1,57 +1,51 @@
 {
-  "version": "2.1.238",
-  "commit": "46283063a4c23f7afadb8440f549264ad93b7c06",
-  "buildDate": "2026-08-20T15:26:31Z",
+  "version": "2.1.245",
+  "commit": "28b7e8c41235a9e2fcb24248e60c4cc2d29c853a",
+  "buildDate": "2026-08-25T04:08:50Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude",
-      "checksum": "1c196c456373b57818ae87df84aecee96cb659448c0d6a6bbb401ac5758431b2",
-      "size": 321263536
+      "checksum": "9f7c2260251765a18d0b35198669dacc1912f6e8129a3b01f6b58d93365ff1f1",
+      "size": 376109392
     },
     "darwin-x64": {
       "binary": "claude",
-      "checksum": "d10bc7bb1720435f8830aa3ee74085f09348d2b1a2a152bdee251b770d76cc73",
-      "size": 329970544
+      "checksum": "de044bb543e826352f31587a74356e1b2dae94dc1b9c960a362d9f07df96c2a7",
+      "size": 385137136
     },
     "linux-arm64": {
       "binary": "claude",
-      "checksum": "28d736120a6b14c5eae1ad1470e73371818c9c2fa41e0b3c7040207aa2d4edee",
-      "size": 335993064
+      "checksum": "d0da299303d710a7cc5cdece9629958f5128ce1a727e15463c651ed5cf385c7f",
+      "size": 389077224
     },
     "linux-x64": {
       "binary": "claude",
-      "checksum": "0933b286cf94e1b2504b35ac165ab76b8f822735d53371c56393988c23040d58",
-      "size": 338860336
+      "checksum": "16ad2b94deaf7b29abed966d981c9991a47af0420f5be8ed4a3f83bea9f678bc",
+      "size": 391948592
     },
     "linux-arm64-musl": {
       "binary": "claude",
-      "checksum": "a47d45149ea7c74e4474bce3c7628c4643b0541801b42053d6e26fd5e3203fdd",
-      "size": 329137944
+      "checksum": "8707fbe629fdd9876d9c356baa833a697dac76cd9a7157088f667199b8492851",
+      "size": 382222104
     },
     "linux-x64-musl": {
       "binary": "claude",
-      "checksum": "33546c2f7947bbfdb46a969123c5329e607c414045cd3645a29aa3cfe023c6ab",
-      "size": 332988384
+      "checksum": "d25564bc5d84ec988a762cfe25fe51cb706b96eaec614f704ddbf653ab08ba00",
+      "size": 386060256
     },
     "win32-x64": {
       "binary": "claude.exe",
-      "checksum": "223bc058b5aef48138876e28de5d00387e4fd7362a18e733143bf00819c01aab",
-      "size": 334150816
+      "checksum": "d1649bf5261792fee7e1a1b63fdd2197082adec36ce9701aa0c1723bdcd2348a",
+      "size": 384213664
     },
     "win32-arm64": {
       "binary": "claude.exe",
-      "checksum": "645800d24201c93e5fd6f4308e0292bba9a75900693667401cdffb4361f8e616",
-      "size": 322051744
+      "checksum": "9cff8169be24a8b3e59e89e58d9e3d37f3c17ca1b3a149e60666fe53c789d80a",
+      "size": 372111520
     }
   },
   "sdkCompat": {
     "testedWrapperVersions": [
-      "0.3.201",
-      "0.3.202",
-      "0.3.204",
-      "0.3.205",
-      "0.3.206",
-      "0.3.207",
       "0.3.208",
       "0.3.209",
       "0.3.210",
@@ -67,6 +61,8 @@
       "0.3.221",
       "0.3.222",
       "0.3.223",
+      "0.3.224",
+      "0.3.225",
       "0.3.226",
       "0.3.227"
     ],
diff --git a/pkgs/by-name/cl/clboss/package.nix b/pkgs/by-name/cl/clboss/package.nix
index 690ddb811cee..42174eee0d5b 100644
--- a/pkgs/by-name/cl/clboss/package.nix
+++ b/pkgs/by-name/cl/clboss/package.nix
@@ -13,12 +13,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "clboss";
-  version = "0.16.2";
+  version = "0.16.3";
 
   # The release tarball includes the pre-generated file `commit_hash.h` that is required for building
   src = fetchzip {
     url = "https://github.com/ZmnSCPxj/clboss/releases/download/v${finalAttrs.version}/clboss-v${finalAttrs.version}.tar.gz";
-    hash = "sha256-I83OH+31oqx2FSjzEIsz7uOko3/MbUqjrZ+xZTXxtto=";
+    hash = "sha256-lniKkyynkyzFBJBRTaPiGTVG9semZDhjpCxjyRDzt/g=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/cl/cloudflare-warp/package.nix b/pkgs/by-name/cl/cloudflare-warp/package.nix
index 809f6f028740..f4028750a539 100644
--- a/pkgs/by-name/cl/cloudflare-warp/package.nix
+++ b/pkgs/by-name/cl/cloudflare-warp/package.nix
@@ -3,18 +3,19 @@
   lib,
   autoPatchelfHook,
   versionCheckHook,
-  copyDesktopItems,
   desktop-file-utils,
   dbus,
   dpkg,
   fetchurl,
   gtk3,
+  libayatana-appindicator,
   libpcap,
-  makeDesktopItem,
   makeWrapper,
   nftables,
   nss,
   openssl,
+  tpm2-tss,
+  webkitgtk_4_1,
   writeShellApplication,
   curl,
   jq,
@@ -26,19 +27,21 @@
 }:
 
 let
-  version = "2026.3.846.0";
+  version = "2026.7.1343.0";
   sources = {
     x86_64-linux = fetchurl {
-      url = "https://pkg.cloudflareclient.com/pool/noble/main/c/cloudflare-warp/cloudflare-warp_${version}_amd64.deb";
-      hash = "sha256-1SKTK0QW+3CcqBLqHbIsPny/6ekyjZe9qRcjYOMnR58=";
+      name = "cloudflare-warp_${version}_amd64.deb";
+      url = "https://downloads.cloudflareclient.com/v1/download/noble-intel/version/${version}";
+      hash = "sha256-C0u01lhECaHPBDHPIc+yOlDYyHepwCBzJxEaHAV7EF4=";
     };
     aarch64-linux = fetchurl {
-      url = "https://pkg.cloudflareclient.com/pool/noble/main/c/cloudflare-warp/cloudflare-warp_${version}_arm64.deb";
-      hash = "sha256-0zYsyZbX8qq/P+GHW4UHSTy2OsDa4fJAVjHcRbpHtSc=";
+      name = "cloudflare-warp_${version}_arm64.deb";
+      url = "https://downloads.cloudflareclient.com/v1/download/noble-arm/version/${version}";
+      hash = "sha256-NT9VUPzTn7dTKyCn+0v81ekN9EKhzeojR2P096amQTQ=";
     };
     aarch64-darwin = fetchurl {
       url = "https://downloads.cloudflareclient.com/v1/download/macos/version/${version}";
-      hash = "sha256-cDmoM0nIYYQyurJeeiVSX0IWJdIY0pVLmjIae5mEXI4=";
+      hash = "sha256-tmUwWC8ejsE2bNhFkMBr5SzCnXLOux+wh3nZ9BBDKd4=";
     };
   };
 in
@@ -64,7 +67,6 @@ stdenv.mkDerivation (finalAttrs: {
     versionCheckHook
   ]
   ++ lib.optionals (!headless && stdenv.hostPlatform.isLinux) [
-    copyDesktopItems
     desktop-file-utils
   ];
 
@@ -74,31 +76,18 @@ stdenv.mkDerivation (finalAttrs: {
       libpcap
       openssl
       nss
+      tpm2-tss
       (lib.getLib stdenv.cc.cc)
     ]
     ++ lib.optionals (!headless) [
       gtk3
+      libayatana-appindicator
+      webkitgtk_4_1
     ]
   );
 
-  desktopItems = lib.optionals (!headless) [
-    (makeDesktopItem {
-      name = "com.cloudflare.WarpCli";
-      desktopName = "Cloudflare Zero Trust Team Enrollment";
-      categories = [
-        "Utility"
-        "Security"
-        "ConsoleOnly"
-      ];
-      noDisplay = true;
-      mimeTypes = [ "x-scheme-handler/com.cloudflare.warp" ];
-      exec = "warp-cli --accept-tos registration token %u";
-      startupNotify = false;
-      terminal = true;
-    })
-  ];
-
   autoPatchelfIgnoreMissingDeps = [
+    "libjvm.so"
     "libpcap.so.0.8"
   ];
 
@@ -137,6 +126,9 @@ stdenv.mkDerivation (finalAttrs: {
         mv lib/systemd/system $out/lib/systemd/
         substituteInPlace $out/lib/systemd/system/warp-svc.service \
           --replace-fail "ExecStart=" "ExecStart=$out"
+        substituteInPlace $out/share/applications/com.cloudflare.WarpTaskbar.desktop \
+                          $out/share/applications/com.cloudflare.warp.desktop \
+          --replace-fail "Exec=" "Exec=$out"
         ${lib.optionalString (!headless) ''
           substituteInPlace $out/lib/systemd/user/warp-taskbar.service \
             --replace-fail "ExecStart=" "ExecStart=$out" \
@@ -155,7 +147,7 @@ stdenv.mkDerivation (finalAttrs: {
           rm -r $out/etc
           rm -r $out/share/applications
           rm -r $out/share/icons
-          rm -r $out/share/warp
+          rm -r $out/lib/warp
         ''}
 
         runHook postInstall
@@ -165,6 +157,7 @@ stdenv.mkDerivation (finalAttrs: {
     wrapProgram $out/bin/warp-svc --prefix PATH : ${lib.makeBinPath [ nftables ]}
     ${lib.optionalString (!headless) ''
       wrapProgram $out/bin/warp-cli --prefix PATH : ${lib.makeBinPath [ desktop-file-utils ]}
+      wrapProgram $out/bin/warp-taskbar --prefix LD_LIBRARY_PATH : $out/lib/warp/lib
     ''}
   '';
 
diff --git a/pkgs/by-name/cn/cnspec/package.nix b/pkgs/by-name/cn/cnspec/package.nix
index ffa12d69be85..ff805d2f7d9d 100644
--- a/pkgs/by-name/cn/cnspec/package.nix
+++ b/pkgs/by-name/cn/cnspec/package.nix
@@ -9,18 +9,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "cnspec";
-  version = "13.35.2";
+  version = "13.36.0";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnspec";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-V3fVmIrrbTQhbOMFKmsUHkRADlcPadCi5zwr2WXwzAM=";
+    hash = "sha256-KDubdJ+OgXRxe2DX/8lDGITdl57ViZ8FPgrNNefKI3I=";
   };
 
   proxyVendor = true;
 
-  vendorHash = "sha256-WA4O3WITS4QW/yVQ8qcpgvSir77iWG7wRmS5JKML2zw=";
+  vendorHash = "sha256-2YccHGxnVz/4sHAjmOSSJ+W3tAKVQOPTl0NchKycHjI=";
 
   subPackages = [ "apps/cnspec" ];
 
diff --git a/pkgs/by-name/co/coreutils/package.nix b/pkgs/by-name/co/coreutils/package.nix
index 9a47b436ae3d..696a0844475e 100644
--- a/pkgs/by-name/co/coreutils/package.nix
+++ b/pkgs/by-name/co/coreutils/package.nix
@@ -83,7 +83,7 @@ stdenv.mkDerivation (finalAttrs: {
     # sandbox does not allow setgid
     sed '2i echo Skipping chmod setgid test && exit 77' -i ./tests/chmod/setgid.sh
     substituteInPlace ./tests/install/install-C.sh \
-      --replace 'mode3=2755' 'mode3=1755'
+      --replace-fail 'mode3=2755' 'mode3=1755'
 
     # Fails on systems with a rootfs. Looks like a bug in the test, see
     # https://lists.gnu.org/archive/html/bug-coreutils/2019-12/msg00000.html
@@ -162,6 +162,8 @@ stdenv.mkDerivation (finalAttrs: {
     # TODO(@Ericson2314): Investigate whether Darwin could benefit too
     ++ optional (isCross && stdenv.hostPlatform.libc != "glibc") libiconv;
 
+  strictDeps = true;
+
   hardeningDisable = [ "trivialautovarinit" ];
 
   configureFlags = [
@@ -271,6 +273,8 @@ stdenv.mkDerivation (finalAttrs: {
     '';
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.gnu.org/software/coreutils/";
     description = "GNU Core Utilities";
diff --git a/pkgs/by-name/co/corteza/package.nix b/pkgs/by-name/co/corteza/package.nix
index 072f8d9b14fb..a133042dc4be 100644
--- a/pkgs/by-name/co/corteza/package.nix
+++ b/pkgs/by-name/co/corteza/package.nix
@@ -4,18 +4,29 @@
   buildGoModule,
   callPackage,
   fetchFromGitHub,
+  fetchpatch,
+  applyPatches,
   lib,
   nixosTests,
   stdenvNoCC,
 }:
 
 let
-  version = "2024.9.2";
-  src = fetchFromGitHub {
-    owner = "cortezaproject";
-    repo = "corteza";
-    tag = version;
-    hash = "sha256-1mekSiRfFSNa/6MSzwRrI3rb9GHABkn3i1b6tX+73fI=";
+  version = "2024.9.9";
+  src = applyPatches {
+    src = fetchFromGitHub {
+      owner = "cortezaproject";
+      repo = "corteza";
+      tag = version;
+      hash = "sha256-r6/z5yplkT2d1iEhA4S29C1LcbdEJQiOWr0JRP5Pvb0=";
+    };
+    patches = [
+      # CVE-2026-6093
+      (fetchpatch {
+        url = "https://github.com/cortezaproject/corteza/commit/64b58b9d7324e77248bacd183fb994ff338091ec.patch";
+        hash = "sha256-0Ume1zkksS3kwf6QS6T5lDXklAboZVlTt5ZJReqwu3w=";
+      })
+    ];
   };
   meta = {
     description = "Low-code platform";
@@ -47,13 +58,13 @@ let
     };
 
   webApps = lib.mapAttrs mkWebApp {
-    admin = "sha256-34lfnK2mecvu1Lgg9IM61+fbnqRgZC/Agi7iyugn0fM=";
-    compose = "sha256-1/Fyl6Z27TtZzNBeerKYNs4VhLWEW3wJyr0SCapzc9E=";
-    discovery = "sha256-mL+ibAgVFCRV5AvN0VZc4LCCY8hyaIC8gOlgEdXayuU=";
-    one = "sha256-SuGf72y4PXatZJQgbW5X4mPjtJmQlpwbjfFYCEZElBU=";
-    privacy = "sha256-yHi6pq0OKCh+2reygNL7TvwULCHwxeD8BXVVMjlnpLc=";
-    reporter = "sha256-AWKSzULOTdUZ5wdlTo8dJwVGc7RlYbimR4YF4ZAN1pQ=";
-    workflow = "sha256-cxD2mG4uuO8KT1r2Y4opPlY84Hvqu7cbWh2BSo8CcEc=";
+    admin = "sha256-fen4KxPbYpH0ikWco1w3Zr+4WeghFITdmsOqHMGa3gA=";
+    compose = "sha256-UHhyzCeSWTROgzULYkDKN/2hgZ25aDZ7roHTLkt466o=";
+    discovery = "sha256-GHmALrqLTBie0VTDmZz4zJ9Ls2JYsfV0A3VkRwCKSuQ=";
+    one = "sha256-GHCtouGYrFgghWlBVbF5rD9cXrAfleVVxVqZtuLOSr0=";
+    privacy = "sha256-PlmeAJZY/S+osdM650tpJI3XSOanc80WYuMQ6jsiJwQ=";
+    reporter = "sha256-4O6FEF7Ol4V0FxznKGISaIA0w68XL0E3HvQ8bbt2klE=";
+    workflow = "sha256-2vyx3lCxICtVlRFLPkpy0fzXZ9W4li9ESm9sJzInc8g=";
   };
 
   server-webconsole = callPackage ./buildYarnDistOnly.nix {
@@ -67,8 +78,8 @@ let
   corteza-locale = fetchFromGitHub {
     owner = "cortezaproject";
     repo = "corteza-locale";
-    rev = "64b6d5d562dce642652db55949231abf8b9af4ef";
-    sha256 = "sha256-OKr/M91sEDlTwYBiDXwWkShlfazJBm21G0uU429fjW0=";
+    rev = "57b1f2403207c44055ebce19d95cedd5573f39df";
+    sha256 = "sha256-j+mfWG6tED8AACkUcRWpol2G05qknTxp8b+kwu7c2NA=";
   };
 
   corteza-webapp = stdenvNoCC.mkDerivation (finalAttrs: {
@@ -116,6 +127,7 @@ let
       cp -r ${server-webconsole}/* webconsole/dist/
     ''
     + lib.optionalString withLocales ''
+      chmod -R u+w pkg/locale/src
       cp -r ${corteza-locale}/src/* pkg/locale/src/
     '';
 
diff --git a/pkgs/by-name/cp/cpio/package.nix b/pkgs/by-name/cp/cpio/package.nix
index d53c81fe6919..30e608bda31f 100644
--- a/pkgs/by-name/cp/cpio/package.nix
+++ b/pkgs/by-name/cp/cpio/package.nix
@@ -2,7 +2,9 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
   autoreconfHook,
+  texinfo,
 
   # for passthru.tests
   git,
@@ -20,7 +22,29 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-k3YQuXwymh7JJoVT+3gAN7z/8Nz/6XJevE/ZwaqQdds=";
   };
 
-  nativeBuildInputs = [ autoreconfHook ];
+  patches = [
+    (fetchpatch {
+      name = "CVE-2026-66484.patch";
+      url = "https://git.savannah.gnu.org/cgit/cpio.git/patch/?id=e2b9cbdd3354d2b1569b7390d1bc15c1930559ad";
+      hash = "sha256-WjphVpMaI/ePg8MTZx+vvilKzpRAAzhAFwCwrbsPLRE=";
+    })
+    (fetchpatch {
+      name = "CVE-2026-66485.patch";
+      url = "https://git.savannah.gnu.org/cgit/cpio.git/patch/?id=3cd514031371d8aeeaf2048aa10103e02831aaa9";
+      hash = "sha256-YDlROEYYlZERNzzlx1cQD29gV5IrU01aVcZ/sKpWrRo=";
+    })
+    (fetchpatch {
+      name = "CVE-2026-66486.patch";
+      url = "https://git.savannah.gnu.org/cgit/cpio.git/patch/?id=2ff9600c9ef32e88759843cdbde74c8db5ae9b30";
+      excludes = [ "NEWS" ];
+      hash = "sha256-qi9/9xhKnIyPpji63RgzbnnHZsJgwRnQVMaMiLxQipk=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    autoreconfHook
+    texinfo # for makeinfo
+  ];
 
   separateDebugInfo = true;
 
diff --git a/pkgs/by-name/cp/cpp-netlib/0001-Compatibility-with-boost-1.83.patch b/pkgs/by-name/cp/cpp-netlib/0001-Compatibility-with-boost-1.83.patch
deleted file mode 100644
index 2c860aaba4f7..000000000000
--- a/pkgs/by-name/cp/cpp-netlib/0001-Compatibility-with-boost-1.83.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 8be99f5972826c25378bccb9fbd7291623c7b2a7 Mon Sep 17 00:00:00 2001
-From: Moraxyc <i@qaq.li>
-Date: Fri, 9 May 2025 13:39:17 +0800
-Subject: [PATCH] Compatibility with boost 1.83
-
----
- boost/network/protocol/http/server/impl/parsers.ipp | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/boost/network/protocol/http/server/impl/parsers.ipp b/boost/network/protocol/http/server/impl/parsers.ipp
-index c31e60e..3272c2f 100755
---- a/boost/network/protocol/http/server/impl/parsers.ipp
-+++ b/boost/network/protocol/http/server/impl/parsers.ipp
-@@ -13,6 +13,7 @@
- #include <tuple>
- #include <boost/fusion/include/std_tuple.hpp>
- #include <boost/network/protocol/http/message/header.hpp>
-+#include <boost/regex/pending/unicode_iterator.hpp>
- 
- #ifdef BOOST_NETWORK_NO_LIB
- #ifndef BOOST_NETWORK_INLINE
-@@ -32,7 +33,7 @@ typedef std::basic_string<uint32_t> u32_string;
- template <>  // <typename Attrib, typename T, typename Enable>
- struct assign_to_container_from_value<std::string, u32_string, void> {
-   static void call(u32_string const& val, std::string& attr) {
--    u32_to_u8_iterator<u32_string::const_iterator> begin = val.begin(),
-+    boost::u32_to_u8_iterator<u32_string::const_iterator> begin = val.begin(),
-                                                    end = val.end();
-     for (; begin != end; ++begin) attr += *begin;
-   }
--- 
-2.48.1
-
diff --git a/pkgs/by-name/cp/cpp-netlib/package.nix b/pkgs/by-name/cp/cpp-netlib/package.nix
deleted file mode 100644
index 665f240c54cd..000000000000
--- a/pkgs/by-name/cp/cpp-netlib/package.nix
+++ /dev/null
@@ -1,62 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  cmake,
-  boost186,
-  openssl,
-  llvmPackages_18,
-}:
-let
-  # std::char_traits has been removed
-  stdenvForCppNetlib = if stdenv.hostPlatform.isDarwin then llvmPackages_18.stdenv else stdenv;
-in
-stdenvForCppNetlib.mkDerivation rec {
-  pname = "cpp-netlib";
-  version = "0.13.0-final";
-
-  src = fetchFromGitHub {
-    owner = "cpp-netlib";
-    repo = "cpp-netlib";
-    tag = "cpp-netlib-${version}";
-    sha256 = "18782sz7aggsl66b4mmi1i0ijwa76iww337fi9sygnplz2hs03a3";
-    fetchSubmodules = true;
-  };
-
-  patches = [
-    # 'u32_to_u8_iterator' was not declared
-    ./0001-Compatibility-with-boost-1.83.patch
-  ];
-
-  # CMake 2.8 is deprecated and is no longer supported by CMake > 4
-  # https://github.com/NixOS/nixpkgs/issues/445447
-  postPatch = ''
-    substituteInPlace CMakeLists.txt --replace-fail \
-      "cmake_minimum_required(VERSION 2.8)" \
-      "cmake_minimum_required(VERSION 3.10)"
-  '';
-
-  nativeBuildInputs = [ cmake ];
-  buildInputs = [
-    # io_service.hpp has been removed in boost 1.87+
-    boost186
-    openssl
-  ];
-
-  cmakeFlags = [
-    "-DCPP-NETLIB_BUILD_SHARED_LIBS=ON"
-    # fatal error: 'boost/asio/stream_socket_service.hpp' file not found
-    "-DCPP-NETLIB_BUILD_EXAMPLES=OFF"
-    "-DCPP-NETLIB_BUILD_TESTS=OFF"
-  ];
-
-  # Most tests make network GET requests to various websites
-  doCheck = false;
-
-  meta = {
-    description = "Collection of open-source libraries for high level network programming";
-    homepage = "https://cpp-netlib.org";
-    license = lib.licenses.boost;
-    platforms = lib.platforms.all;
-  };
-}
diff --git a/pkgs/by-name/cr/cri-o-unwrapped/package.nix b/pkgs/by-name/cr/cri-o-unwrapped/package.nix
index ecdf29b84c39..8c2a434796fd 100644
--- a/pkgs/by-name/cr/cri-o-unwrapped/package.nix
+++ b/pkgs/by-name/cr/cri-o-unwrapped/package.nix
@@ -17,13 +17,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "cri-o";
-  version = "1.36.3";
+  version = "1.36.4";
 
   src = fetchFromGitHub {
     owner = "cri-o";
     repo = "cri-o";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-AhsSi79HUbNvPoa7duOl9290ZjKss2a6RLvRPHDh6Sg=";
+    hash = "sha256-GgjOY+TE9RcLjy9aSu8Um0Zdzd0juxbTaoT8ljThqws=";
   };
   vendorHash = null;
 
diff --git a/pkgs/by-name/cr/crossmacro-daemon/package.nix b/pkgs/by-name/cr/crossmacro-daemon/package.nix
index c19cf34e5b24..b4e69eeef038 100644
--- a/pkgs/by-name/cr/crossmacro-daemon/package.nix
+++ b/pkgs/by-name/cr/crossmacro-daemon/package.nix
@@ -14,13 +14,13 @@
 
 buildDotnetModule rec {
   pname = "crossmacro-daemon";
-  version = "1.2.1";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "alper-han";
     repo = "CrossMacro";
     tag = "v${version}";
-    hash = "sha256-lMXp7ItwpZ14ATRKuR7Q8/FhfMNQ+YCgHL13oj6iBNs=";
+    hash = "sha256-2L25A2OO2Ju6n1QlblNBtKva1PfbidFz/QESjLBVuSU=";
   };
 
   projectFile = "src/CrossMacro.Daemon/CrossMacro.Daemon.csproj";
@@ -44,7 +44,16 @@ buildDotnetModule rec {
     zlib
   ];
 
-  dotnetFlags = [ "-p:Version=${version}" ];
+  dotnetFlags = [
+    "-p:PublishAot=true"
+    "-p:PublishReadyToRun=false"
+    "-p:OptimizationPreference=Speed"
+    "-p:StripSymbols=true"
+    "-p:IlcTrimMetadata=true"
+    "-p:DebugType=None"
+    "-p:DebugSymbols=false"
+    "-p:Version=${version}"
+  ];
 
   postInstall = ''
     install -Dm644 scripts/assets/io.github.alper_han.crossmacro.policy \
diff --git a/pkgs/by-name/cr/cryptsetup/package.nix b/pkgs/by-name/cr/cryptsetup/package.nix
index 21ae5fc76b40..0ff0e32e1742 100644
--- a/pkgs/by-name/cr/cryptsetup/package.nix
+++ b/pkgs/by-name/cr/cryptsetup/package.nix
@@ -25,7 +25,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cryptsetup";
-  version = "2.8.6";
+  version = "2.8.7";
 
   outputs = [
     "bin"
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
     url =
       "mirror://kernel/linux/utils/cryptsetup/v${lib.versions.majorMinor finalAttrs.version}/"
       + "cryptsetup-${finalAttrs.version}.tar.xz";
-    hash = "sha256-gAQmX9mTiF0I97Yz2+BWhR3hohAwdhOk693HQ/zO/lo=";
+    hash = "sha256-53bw04HobKYQQsRXBpSR/o4KwoZ4DHw7Hk+ZIavJYdo=";
   };
 
   patches = [
diff --git a/pkgs/by-name/cs/csharp-ls/package.nix b/pkgs/by-name/cs/csharp-ls/package.nix
index 7335c3cd4f80..b4d236c836be 100644
--- a/pkgs/by-name/cs/csharp-ls/package.nix
+++ b/pkgs/by-name/cs/csharp-ls/package.nix
@@ -33,11 +33,5 @@ buildDotnetGlobalTool (finalAttrs: {
     license = lib.licenses.mit;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ GaetanLepage ];
-    badPlatforms = [
-      # Crashes immediately at runtime
-      # terminated by signal SIGKILL (Forced quit)
-      # https://github.com/razzmatazz/csharp-language-server/issues/211
-      "aarch64-darwin"
-    ];
   };
 })
diff --git a/pkgs/by-name/cu/cunit/package.nix b/pkgs/by-name/cu/cunit/package.nix
index 7d9ee6b0f51d..8c8db5d947bd 100644
--- a/pkgs/by-name/cu/cunit/package.nix
+++ b/pkgs/by-name/cu/cunit/package.nix
@@ -19,11 +19,15 @@ stdenv.mkDerivation (finalAttrs: {
   ];
   buildInputs = [ libtool ];
 
+  strictDeps = true;
+
   src = fetchurl {
     url = "mirror://sourceforge/cunit/CUnit/${finalAttrs.version}/CUnit-${finalAttrs.version}.tar.bz2";
     sha256 = "057j82da9vv4li4z5ri3227ybd18nzyq81f6gsvhifs5z0vr3cpm";
   };
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Unit Testing Framework for C";
 
diff --git a/pkgs/by-name/cu/cups/package.nix b/pkgs/by-name/cu/cups/package.nix
index dd12a5dcef57..10abd55a5977 100644
--- a/pkgs/by-name/cu/cups/package.nix
+++ b/pkgs/by-name/cu/cups/package.nix
@@ -14,7 +14,6 @@
   systemdLibs,
   acl,
   gmp,
-  darwin,
   libusb1 ? null,
   gnutls ? null,
   avahi ? null,
@@ -40,6 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
     "lib"
     "dev"
     "man"
+    "doc"
   ];
 
   postPatch = ''
diff --git a/pkgs/by-name/cu/curl-impersonate/deps.nix b/pkgs/by-name/cu/curl-impersonate/deps.nix
index 0764c5832ad3..d49fdb94db3c 100644
--- a/pkgs/by-name/cu/curl-impersonate/deps.nix
+++ b/pkgs/by-name/cu/curl-impersonate/deps.nix
@@ -1,5 +1,7 @@
 # Generated by update.sh
-{ fetchurl }: {
+{ fetchurl }:
+
+{
   "curl-8_21_0.tar.gz" = fetchurl {
     url = "https://github.com/curl/curl/archive/curl-8_21_0.tar.gz";
     hash = "sha256-7HU6pvQIo8qfDW1fendBeuzRVE2xPAOuXUQ2Er82c2Q=";
diff --git a/pkgs/by-name/cu/curl-impersonate/package.nix b/pkgs/by-name/cu/curl-impersonate/package.nix
index c483306f8529..e2c3da0ccd50 100644
--- a/pkgs/by-name/cu/curl-impersonate/package.nix
+++ b/pkgs/by-name/cu/curl-impersonate/package.nix
@@ -17,7 +17,7 @@
 }:
 stdenv.mkDerivation rec {
   pname = "curl-impersonate";
-  version = "2.1.0";
+  version = "2.1.1";
 
   outputs = [
     "out"
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     owner = "lexiforest";
     repo = "curl-impersonate";
     tag = "v${version}";
-    hash = "sha256-gN4TD+WxQM2eJofHsOHA/JpH6bQ8CI3VUTPL8NuySn4=";
+    hash = "sha256-AgC66L0z6cYVqePwc7yO1iO9F/6YD6dTqWKCcCrNLzc=";
   };
 
   separateDebugInfo = true;
diff --git a/pkgs/by-name/cu/cutter/package.nix b/pkgs/by-name/cu/cutter/package.nix
index 4872bb232346..db945a8ba885 100644
--- a/pkgs/by-name/cu/cutter/package.nix
+++ b/pkgs/by-name/cu/cutter/package.nix
@@ -32,6 +32,7 @@ let
       cmake
       pkg-config
       python3
+      python3.pkgs.shiboken6-generator
       qt6.wrapQtAppsHook
     ];
 
diff --git a/pkgs/by-name/da/dash/package.nix b/pkgs/by-name/da/dash/package.nix
index 1b1e6ceeef9d..916d5e54daa3 100644
--- a/pkgs/by-name/da/dash/package.nix
+++ b/pkgs/by-name/da/dash/package.nix
@@ -63,6 +63,8 @@ stdenv.mkDerivation (finalAttrs: {
     };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "http://gondor.apana.org.au/~herbert/dash/";
     description = "POSIX-compliant implementation of /bin/sh that aims to be as small as possible";
diff --git a/pkgs/by-name/de/deezer-desktop/package.nix b/pkgs/by-name/de/deezer-desktop/package.nix
index 748f1fc59a79..480c23654c53 100644
--- a/pkgs/by-name/de/deezer-desktop/package.nix
+++ b/pkgs/by-name/de/deezer-desktop/package.nix
@@ -8,15 +8,15 @@
 }:
 
 let
-  version = "7.1.300";
+  version = "7.1.310";
   srcs = {
     x86_64-linux = fetchurl {
       url = "https://github.com/aunetx/deezer-linux/releases/download/v${version}/deezer-desktop-${version}-x64.tar.xz";
-      hash = "sha256-6vS0jh8eaiZTMYbC/gvaTVGy/VuH1pfhRkbwzg/LJ2k=";
+      hash = "sha256-G1nrkyQR3pduZulFE30DTCTfVMmZe7X6nl6bcDfSf8E=";
     };
     aarch64-linux = fetchurl {
       url = "https://github.com/aunetx/deezer-linux/releases/download/v${version}/deezer-desktop-${version}-arm64.tar.xz";
-      hash = "sha256-KNs7rk1LCFhaKhgsw87WrKIMHTvP4mESZPuBgc002+Y=";
+      hash = "sha256-fMShKodtD8/icEcpRIVZZ9H3KlF/GEpMyuihcDkviWk=";
     };
   };
 
@@ -48,10 +48,9 @@ stdenv.mkDerivation (finalAttrs: {
     install -d $out/bin $out/share/deezer-desktop/resources $out/share/applications $out/share/icons/hicolor/scalable/apps
 
     substituteInPlace deezer-desktop-${version}-${archDir}/resources/dev.aunetx.deezer.desktop \
-      --replace-fail "run.sh" "deezer-desktop" \
-      --replace-fail "dev.aunetx.deezer" "deezer-desktop"
-    cp deezer-desktop-${version}-${archDir}/resources/dev.aunetx.deezer.desktop $out/share/applications/deezer-desktop.desktop
-    cp deezer-desktop-${version}-${archDir}/resources/dev.aunetx.deezer.svg $out/share/icons/hicolor/scalable/apps/deezer-desktop.svg
+      --replace-fail "run.sh" "deezer-desktop"
+    cp deezer-desktop-${version}-${archDir}/resources/dev.aunetx.deezer.desktop $out/share/applications/
+    cp deezer-desktop-${version}-${archDir}/resources/dev.aunetx.deezer.svg $out/share/icons/hicolor/scalable/apps/
     cp -r deezer-desktop-${version}-${archDir}/resources/{app.asar,linux} $out/share/deezer-desktop/resources/
 
     makeWrapper "${lib.getExe electron}" "$out/bin/deezer-desktop" \
diff --git a/pkgs/by-name/di/diffutils/package.nix b/pkgs/by-name/di/diffutils/package.nix
index ecbd00ec0094..ad36dd91eed9 100644
--- a/pkgs/by-name/di/diffutils/package.nix
+++ b/pkgs/by-name/di/diffutils/package.nix
@@ -12,12 +12,12 @@
 # cgit) that are needed here should be included directly in Nixpkgs as
 # files.
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "diffutils";
   version = "3.12";
 
   src = fetchurl {
-    url = "mirror://gnu/diffutils/diffutils-${version}.tar.xz";
+    url = "mirror://gnu/diffutils/diffutils-${finalAttrs.version}.tar.xz";
     hash = "sha256-fIt/n8hgkUH96pzs6FJJ0whiQ5H/Yd7a9Sj8szdyff0=";
   };
 
@@ -42,6 +42,8 @@ stdenv.mkDerivation rec {
   # If no explicit coreutils is given, use the one from stdenv.
   buildInputs = [ coreutils ];
 
+  strictDeps = true;
+
   # Disable stack-related gnulib tests on x86_64-darwin because they have problems running under
   # Rosetta 2: test-c-stack hangs, test-sigsegv-catch-stackoverflow and test-sigaction fail.
   # Disable all gnulib tests when building on Darwin due to test-nl_langinfo-mt failure
@@ -78,6 +80,8 @@ stdenv.mkDerivation rec {
   # Test failure on QEMU only (#300550)
   doCheck = !stdenv.buildPlatform.isRiscV64;
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.gnu.org/software/diffutils/diffutils.html";
     description = "Commands for showing the differences between files (diff, cmp, etc.)";
@@ -88,4 +92,4 @@ stdenv.mkDerivation rec {
       helsinki-Jo
     ];
   };
-}
+})
diff --git a/pkgs/by-name/dn/dns-root-data/package.nix b/pkgs/by-name/dn/dns-root-data/package.nix
index 88499b9fba9d..87517dc95c4e 100644
--- a/pkgs/by-name/dn/dns-root-data/package.nix
+++ b/pkgs/by-name/dn/dns-root-data/package.nix
@@ -27,6 +27,9 @@ stdenv.mkDerivation {
     cp ${./root.ds} $out/root.ds
   '';
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.iana.org/domains/root/files";
     description = "DNS root data including root hints and DNSSEC root trust anchor + key";
diff --git a/pkgs/by-name/do/docker-sbx/package.nix b/pkgs/by-name/do/docker-sbx/package.nix
index a33f4afc7540..e08fe53b538a 100644
--- a/pkgs/by-name/do/docker-sbx/package.nix
+++ b/pkgs/by-name/do/docker-sbx/package.nix
@@ -15,9 +15,9 @@
 }:
 let
   hashes = {
-    "x86_64-linux" = "sha256-nrzqgx1NJw4lrhd3vxXiR1ar+/h5GtJylHVGgoOO0As=";
-    "aarch64-linux" = "sha256-BR/fg0n4pm20epkOEaMM0dLgE6xsjkLkjAcr/OwGodU=";
-    "aarch64-darwin" = "sha256-Fg0eq0R8IA4vVKIqZIkByoDuhVVyTsALYMK9qsPE6hw=";
+    "x86_64-linux" = "sha256-LsRbx5OMIML0Bv6MxyKUrVqVS9wEdgFIS4m/GhCDEdQ=";
+    "aarch64-linux" = "sha256-OcRwpfXgmRscI1iVLiqzKnsDCb+lesYra7xktGbQLBc=";
+    "aarch64-darwin" = "sha256-0S+gau7OKY2W2uBYEB8lZTd3CgDvRuZYR2Lg8nsGpaM=";
   };
   platformName = {
     "x86_64-linux" = "linux-amd64";
@@ -27,7 +27,7 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "docker-sbx";
-  version = "0.38.0";
+  version = "0.39.0";
   src =
     let
       throwPlat = throw "Unsupported platform ${stdenvNoCC.hostPlatform.system}";
diff --git a/pkgs/by-name/du/duckdb/package.nix b/pkgs/by-name/du/duckdb/package.nix
index 9c86d318fa57..555ba3a1cf12 100644
--- a/pkgs/by-name/du/duckdb/package.nix
+++ b/pkgs/by-name/du/duckdb/package.nix
@@ -5,15 +5,33 @@
   cmake,
   ninja,
   openssl,
-  openjdk11,
   python3,
-  unixodbc,
-  withJdbc ? false,
-  withOdbc ? false,
   versionCheckHook,
 }:
 
 let
+  canExecute = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+  # Keep this in sync with DuckDBPlatform() in DuckDB's platform.hpp.
+  duckdbPlatform =
+    let
+      os =
+        if stdenv.hostPlatform.isWindows then
+          "windows"
+        else if stdenv.hostPlatform.isDarwin then
+          "osx"
+        else if stdenv.hostPlatform.isFreeBSD then
+          "freebsd"
+        else
+          "linux";
+      arch =
+        if stdenv.hostPlatform.isAarch64 then
+          "arm64"
+        else if stdenv.hostPlatform.is64bit then
+          "amd64"
+        else
+          "i686";
+    in
+    "${os}_${arch}${lib.optionalString stdenv.hostPlatform.isMusl "_musl"}${lib.optionalString stdenv.hostPlatform.isMinGW "_mingw"}";
   versions = lib.importJSON ./versions.json;
 in
 stdenv.mkDerivation (finalAttrs: {
@@ -40,22 +58,19 @@ stdenv.mkDerivation (finalAttrs: {
     ninja
     python3
   ];
-  buildInputs = [
-    openssl
-  ]
-  ++ lib.optionals withJdbc [ openjdk11 ]
-  ++ lib.optionals withOdbc [ unixodbc ];
+  buildInputs = [ openssl ];
 
   cmakeFlags = [
     (lib.cmakeFeature "DUCKDB_EXTENSION_CONFIGS" "${finalAttrs.src}/.github/config/in_tree_extensions.cmake")
-    (lib.cmakeBool "BUILD_ODBC_DRIVER" withOdbc)
-    (lib.cmakeBool "JDBC_DRIVER" withJdbc)
     (lib.cmakeFeature "OVERRIDE_GIT_DESCRIBE" "v${finalAttrs.version}-0-g${finalAttrs.rev}")
     # development settings
-    (lib.cmakeBool "BUILD_UNITTESTS" finalAttrs.doInstallCheck)
+    (lib.cmakeBool "BUILD_UNITTESTS" finalAttrs.finalPackage.doInstallCheck)
+  ]
+  ++ lib.optionals (!canExecute) [
+    (lib.cmakeFeature "DUCKDB_EXPLICIT_PLATFORM" duckdbPlatform)
   ];
 
-  doInstallCheck = true;
+  doInstallCheck = canExecute;
 
   nativeInstallCheckInputs = [ versionCheckHook ];
 
diff --git a/pkgs/by-name/ed/ed/package.nix b/pkgs/by-name/ed/ed/package.nix
index 8d97434a822d..11d4f49f4742 100644
--- a/pkgs/by-name/ed/ed/package.nix
+++ b/pkgs/by-name/ed/ed/package.nix
@@ -40,6 +40,8 @@ stdenv.mkDerivation (finalAttrs: {
     };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.gnu.org/software/ed/";
     description = "GNU implementation of the standard Unix editor";
diff --git a/pkgs/by-name/ei/eigen/package.nix b/pkgs/by-name/ei/eigen/package.nix
index c127636f24c3..8b1c86f12fd8 100644
--- a/pkgs/by-name/ei/eigen/package.nix
+++ b/pkgs/by-name/ei/eigen/package.nix
@@ -40,6 +40,8 @@ stdenv.mkDerivation (finalAttrs: {
     ctestCheckHook
   ];
 
+  strictDeps = true;
+
   cmakeFlags = [
     (lib.cmakeBool "EIGEN_LEAVE_TEST_IN_ALL_TARGET" true) # Build tests in parallel
   ];
@@ -47,6 +49,8 @@ stdenv.mkDerivation (finalAttrs: {
   # too many flaky tests
   doCheck = false;
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://eigen.tuxfamily.org";
     description = "C++ template library for linear algebra: vectors, matrices, and related algorithms";
diff --git a/pkgs/by-name/el/elfutils/package.nix b/pkgs/by-name/el/elfutils/package.nix
index a66af1cb091b..b0124617be22 100644
--- a/pkgs/by-name/el/elfutils/package.nix
+++ b/pkgs/by-name/el/elfutils/package.nix
@@ -113,6 +113,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   propagatedNativeBuildInputs = [ setupDebugInfoDirs ];
 
+  strictDeps = true;
+
   hardeningDisable = [ "strictflexarrays3" ];
 
   configureFlags = [
@@ -144,6 +146,8 @@ stdenv.mkDerivation (finalAttrs: {
     rev-prefix = "elfutils-";
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://sourceware.org/elfutils/";
     description = "Set of utilities to handle ELF objects";
diff --git a/pkgs/by-name/en/enpass/package.nix b/pkgs/by-name/en/enpass/package.nix
index feee30969107..2043123a09a6 100644
--- a/pkgs/by-name/en/enpass/package.nix
+++ b/pkgs/by-name/en/enpass/package.nix
@@ -101,6 +101,7 @@ let
         "i686-linux"
       ];
       maintainers = with lib.maintainers; [ ewok ];
+      mainProgram = "Enpass";
     };
 
     nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/ex/expat/package.nix b/pkgs/by-name/ex/expat/package.nix
index 2e831ef025da..cbc79fe484c8 100644
--- a/pkgs/by-name/ex/expat/package.nix
+++ b/pkgs/by-name/ex/expat/package.nix
@@ -23,13 +23,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "expat";
-  version = "2.8.2";
+  version = "2.8.3";
 
   src = fetchurl {
     url =
       with finalAttrs;
       "https://github.com/libexpat/libexpat/releases/download/${tagFor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-OtibhYjmZEvU5JmBSA1IshKJ7rvNTwoaSvscKfmbarQ=";
+    hash = "sha256-9iVt+QyQZ3PTRNoIRAK30+TyLtQbGlnJiQmKg9PqDIU=";
   };
 
   strictDeps = true;
@@ -72,6 +72,8 @@ stdenv.mkDerivation (finalAttrs: {
     };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     changelog = "https://github.com/libexpat/libexpat/blob/${tagFor finalAttrs.version}/expat/Changes";
     homepage = "https://libexpat.github.io/";
diff --git a/pkgs/by-name/ex/extism-js-core/package.nix b/pkgs/by-name/ex/extism-js-core/package.nix
index 1a1e72fd1011..c54fef1d5441 100644
--- a/pkgs/by-name/ex/extism-js-core/package.nix
+++ b/pkgs/by-name/ex/extism-js-core/package.nix
@@ -49,11 +49,14 @@ rustPlatform.buildRustPackage (finalAttrs: {
     wasm-opt --enable-reference-types --enable-bulk-memory --strip -O3 $out/bin/js_pdk_core.wasm -o $out/bin/js_pdk_core.wasm
   '';
 
+  depsBuildBuild = [
+    nodejs
+    npmHooks.npmConfigHook
+  ];
+
   nativeBuildInputs = [
     binaryen
     lld
-    nodejs
-    npmHooks.npmConfigHook
     rustPlatform.bindgenHook
   ];
 
diff --git a/pkgs/by-name/fl/fleet-desktop/package.nix b/pkgs/by-name/fl/fleet-desktop/package.nix
new file mode 100644
index 000000000000..162dc3617700
--- /dev/null
+++ b/pkgs/by-name/fl/fleet-desktop/package.nix
@@ -0,0 +1,64 @@
+{
+  lib,
+  buildGoModule,
+  fleet-orbit,
+  gtk3,
+  libayatana-appindicator,
+  nixosTests,
+  pkg-config,
+  versionCheckHook,
+}:
+
+buildGoModule {
+  pname = "fleet-desktop";
+  inherit (fleet-orbit) version src;
+  __structuredAttrs = true;
+
+  vendorHash = "sha256-fhACxmzJY0PEQmMbjQxlfQh5ZJ+7a4um0s8xFQq+57w=";
+
+  env.CGO_ENABLED = "1";
+
+  subPackages = [ "orbit/cmd/desktop" ];
+
+  goFlags = [ "-buildvcs=false" ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=main.version=${fleet-orbit.version}"
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    gtk3
+    libayatana-appindicator
+  ];
+
+  postInstall = ''
+    mv "$out/bin/desktop" "$out/bin/fleet-desktop"
+  '';
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.tests = {
+    inherit (nixosTests) orbit;
+  };
+
+  meta = {
+    description = "Fleet's desktop tray application";
+    homepage = "https://github.com/fleetdm/fleet";
+    changelog = "https://github.com/fleetdm/fleet/releases/tag/orbit-v${fleet-orbit.version}";
+    license = lib.licenses.mit;
+    mainProgram = "fleet-desktop";
+    maintainers = with lib.maintainers; [
+      adrielvelazquez
+      faukah
+    ];
+    platforms = lib.platforms.linux;
+    sourceProvenance = with lib.sourceTypes; [ fromSource ];
+  };
+}
diff --git a/pkgs/by-name/fl/fleet-orbit/0001-orbit-nixos.patch b/pkgs/by-name/fl/fleet-orbit/0001-orbit-nixos.patch
new file mode 100644
index 000000000000..64b62718ff63
--- /dev/null
+++ b/pkgs/by-name/fl/fleet-orbit/0001-orbit-nixos.patch
@@ -0,0 +1,81 @@
+diff --git a/orbit/pkg/scripts/exec_nonwindows.go b/orbit/pkg/scripts/exec_nonwindows.go
+index cedbd73..b16d150 100644
+--- a/orbit/pkg/scripts/exec_nonwindows.go
++++ b/orbit/pkg/scripts/exec_nonwindows.go
+@@ -6,14 +6,49 @@ import (
+ 	"context"
+ 	"os"
+ 	"os/exec"
+ 	"path/filepath"
++	"strings"
+ 	"time"
+ 
+ 	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
+ 	"github.com/fleetdm/fleet/v4/server/fleet"
+ )
+ 
++// patchShebang replaces common shebang paths with NixOS-style paths.
++func patchShebang(contents []byte) []byte {
++	script := string(contents)
++
++	if !strings.HasPrefix(script, "#!") {
++		return contents
++	}
++
++	firstLineEnd := strings.Index(script, "\n")
++	if firstLineEnd == -1 {
++		firstLineEnd = len(script)
++	}
++
++	shebang := script[:firstLineEnd]
++	rest := script[firstLineEnd:]
++
++	replacements := map[string]string{
++		"#!/bin/bash":        "#!/run/current-system/sw/bin/bash",
++		"#!/bin/sh":          "#!/run/current-system/sw/bin/sh",
++		"#!/bin/zsh":         "#!/run/current-system/sw/bin/zsh",
++		"#!/usr/bin/python":  "#!/run/current-system/sw/bin/python",
++		"#!/usr/bin/python3": "#!/run/current-system/sw/bin/python3",
++	}
++
++	for old, new := range replacements {
++		if strings.HasPrefix(shebang, old) {
++			shebang = new + strings.TrimPrefix(shebang, old)
++			break
++		}
++	}
++
++	return []byte(shebang + rest)
++}
++
+ func ExecCmd(ctx context.Context, scriptPath string, env []string) (output []byte, exitCode int, err error) {
+ 	// initialize to -1 in case the process never starts
+ 	exitCode = -1
+ 
+ 	contents, err := os.ReadFile(scriptPath)
+@@ -21,17 +56,25 @@ func ExecCmd(ctx context.Context, scriptPath string, env []string) (output []byt
+ 	if err != nil {
+ 		return nil, -1, ctxerr.Wrapf(ctx, err, "opening script for validation %s", scriptPath)
+ 	}
+-	directExecute, err := fleet.ValidateShebang(string(contents))
++	patchedContents := patchShebang(contents)
++	if string(patchedContents) != string(contents) {
++		err = os.WriteFile(scriptPath, patchedContents, 0o600)
++		if err != nil {
++			return nil, -1, ctxerr.Wrapf(ctx, err, "writing patched script %s", scriptPath)
++		}
++	}
++
++	directExecute, err := fleet.ValidateShebang(string(patchedContents))
+ 	if err != nil {
+ 		return nil, -1, ctxerr.Wrapf(ctx, err, "validating script %s", scriptPath)
+ 	}
+ 
+-	cmd := exec.CommandContext(ctx, "/bin/sh", scriptPath)
++	cmd := exec.CommandContext(ctx, "/run/current-system/sw/bin/sh", scriptPath)
+ 
+ 	if directExecute {
+ 		err = os.Chmod(scriptPath, 0o700) // nolint:gosec // G302
+ 		if err != nil {
+ 			return nil, -1, ctxerr.Wrapf(ctx, err, "marking script as executable %s", scriptPath)
+ 		}
diff --git a/pkgs/by-name/fl/fleet-orbit/0002-osqueryd-path-override.patch b/pkgs/by-name/fl/fleet-orbit/0002-osqueryd-path-override.patch
new file mode 100644
index 000000000000..411e96f21302
--- /dev/null
+++ b/pkgs/by-name/fl/fleet-orbit/0002-osqueryd-path-override.patch
@@ -0,0 +1,40 @@
+diff --git a/orbit/cmd/orbit/orbit.go b/orbit/cmd/orbit/orbit.go
+index ed6f10d..c4518fd 100644
+--- a/orbit/cmd/orbit/orbit.go
++++ b/orbit/cmd/orbit/orbit.go
+@@ -112,6 +112,16 @@ func main() {
+ 			Usage:   "Path to the Fleet server certificate chain",
+ 			EnvVars: []string{"ORBIT_FLEET_CERTIFICATE"},
+ 		},
++		&cli.StringFlag{
++			Name:    "osqueryd-path",
++			Usage:   "Override the path to the osqueryd binary",
++			EnvVars: []string{"NIX_ORBIT_OSQUERYD_PATH"},
++		},
++		&cli.StringFlag{
++			Name:    "desktop-path",
++			Usage:   "Override the path to the Fleet Desktop binary",
++			EnvVars: []string{"NIX_ORBIT_DESKTOP_PATH"},
++		},
+ 		&cli.StringFlag{
+ 			Name:    "fleet-desktop-alternative-browser-host",
+ 			Usage:   "Alternative host:port to use for Fleet Desktop in the browser (this may be required when using TLS client authentication in the Fleet server)",
+@@ -623,7 +633,17 @@ func orbitAction(c *cli.Context) error {
+ 	var updater *update.Updater
+ 	var updateRunner *update.Runner
+ 	var osqueryVersion string
+-	if !c.Bool("disable-updates") || c.Bool("dev-mode") {
++	if override := c.String("osqueryd-path"); override != "" {
++		log.Info().Msgf("Overriding osqueryd path: %s", override)
++		osquerydPath = override
++	}
++	if override := c.String("desktop-path"); override != "" {
++		log.Info().Msgf("Overriding Fleet Desktop path: %s", override)
++		desktopPath = override
++	}
++	if osquerydPath != "" && (!c.Bool("fleet-desktop") || desktopPath != "") {
++		log.Info().Msg("Using externally supplied component paths")
++	} else if !c.Bool("disable-updates") || c.Bool("dev-mode") {
+ 		updater, err := update.NewUpdater(opt)
+ 		if err != nil {
+ 			return fmt.Errorf("create updater: %w", err)
diff --git a/pkgs/by-name/fl/fleet-orbit/0003-osquery-log-path.patch b/pkgs/by-name/fl/fleet-orbit/0003-osquery-log-path.patch
new file mode 100644
index 000000000000..a57f3d7f017d
--- /dev/null
+++ b/pkgs/by-name/fl/fleet-orbit/0003-osquery-log-path.patch
@@ -0,0 +1,29 @@
+diff --git a/orbit/cmd/orbit/orbit.go b/orbit/cmd/orbit/orbit.go
+index ed6f10d..54af34b 100644
+--- a/orbit/cmd/orbit/orbit.go
++++ b/orbit/cmd/orbit/orbit.go
+@@ -242,6 +242,11 @@ func main() {
+ 			Usage:   "Sets a custom osquery database directory, it must be an absolute path",
+ 			EnvVars: []string{"ORBIT_OSQUERY_DB"},
+ 		},
++		&cli.StringFlag{
++			Name:    "osquery-log-path",
++			Usage:   "Path to osquery log file",
++			EnvVars: []string{"NIX_ORBIT_OSQUERY_LOG_PATH"},
++		},
+ 		&cli.BoolFlag{
+ 			Name:    "fleet-managed-host-identity-certificate",
+ 			Usage:   "Configures fleetd to use TPM-backed key to sign HTTP requests. This functionality is licensed under the Fleet EE License. Usage requires a current Fleet EE subscription.",
+@@ -862,7 +867,11 @@ func orbitAction(c *cli.Context) error {
+ 		optionsAfterFlagfile []osquery.Option
+ 	)
+ 	options = append(options, osquery.WithDataPath(c.String("root-dir"), ""))
+-	options = append(options, osquery.WithLogPath(filepath.Join(c.String("root-dir"), "osquery_log")))
++	osqueryLogPath := c.String("osquery-log-path")
++	if osqueryLogPath == "" {
++		osqueryLogPath = filepath.Join(c.String("root-dir"), "osquery_log")
++	}
++	options = append(options, osquery.WithLogPath(osqueryLogPath))
+ 	optionsAfterFlagfile = append(optionsAfterFlagfile, osquery.WithFlags(
+ 		[]string{"--database_path", osqueryDB},
+ 	))
diff --git a/pkgs/by-name/fl/fleet-orbit/0004-scripts-nixos.patch b/pkgs/by-name/fl/fleet-orbit/0004-scripts-nixos.patch
new file mode 100644
index 000000000000..fbcff826ca1d
--- /dev/null
+++ b/pkgs/by-name/fl/fleet-orbit/0004-scripts-nixos.patch
@@ -0,0 +1,33 @@
+diff --git a/server/fleet/scripts.go b/server/fleet/scripts.go
+index 4ae230e..930a520 100644
+--- a/server/fleet/scripts.go
++++ b/server/fleet/scripts.go
+@@ -387,8 +387,8 @@ const (
+ // anchored, so that it matches to the end of the line
+ var (
+ 	scriptHashbangValidation       = regexp.MustCompile(`^#!\s*(:?/usr)?/bin/(ba|z)?sh(?:\s*|\s+.*)$`)
+-	ErrUnsupportedInterpreter      = errors.New(`Interpreter not supported. Supported interpreters are "#!/bin/sh", "#!/bin/bash", "#!/bin/zsh", "#!/usr/bin/env python3", or an absolute path to "python" / "python3".`)
+-	ErrUnsupportedShellInterpreter = errors.New(`Interpreter not supported. Shell scripts must run in "#!/bin/sh", "#!/bin/bash", or "#!/bin/zsh."`)
++	ErrUnsupportedInterpreter      = errors.New(`Interpreter not supported. Supported interpreters are "#!/bin/sh", "#!/bin/bash", "#!/bin/zsh", "#!/run/current-system/sw/bin/sh", "#!/run/current-system/sw/bin/bash", "#!/run/current-system/sw/bin/zsh", "#!/usr/bin/env sh", "#!/usr/bin/env bash", "#!/usr/bin/env zsh", "#!/usr/bin/env python3", or an absolute path to "python" / "python3".`)
++	ErrUnsupportedShellInterpreter = errors.New(`Interpreter not supported. Shell scripts must run in "#!/bin/sh", "#!/bin/bash", "#!/bin/zsh", "#!/run/current-system/sw/bin/sh", "#!/run/current-system/sw/bin/bash", "#!/run/current-system/sw/bin/zsh", or their "/usr/bin/env" equivalents.`)
+ )
+ 
+ type ShebangKind int
+@@ -454,7 +454,7 @@ func shebangInfo(contents string) (kind shebangKind, directExecute bool, err err
+ 	// Support env-based shebangs like "#!/usr/bin/env python3"
+ 	if base == "env" {
+ 		// Require env to be in /bin or /usr/bin (common, predictable locations)
+-		if !strings.HasPrefix(interp, "/bin/") && !strings.HasPrefix(interp, "/usr/bin/") {
++		if !strings.HasPrefix(interp, "/bin/") && !strings.HasPrefix(interp, "/usr/bin/") && !strings.HasPrefix(interp, "/run/current-system/sw/bin/") {
+ 			return shebangNone, false, ErrUnsupportedInterpreter
+ 		}
+ 
+@@ -486,7 +486,7 @@ func shebangInfo(contents string) (kind shebangKind, directExecute bool, err err
+ 
+ 	switch {
+ 	case base == "sh" || base == "bash" || base == "zsh":
+-		if !strings.HasPrefix(interp, "/bin/") && !strings.HasPrefix(interp, "/usr/bin/") {
++		if !strings.HasPrefix(interp, "/bin/") && !strings.HasPrefix(interp, "/usr/bin/") && !strings.HasPrefix(interp, "/run/current-system/sw/bin/") {
+ 			return shebangNone, false, ErrUnsupportedInterpreter
+ 		}
+ 		return shebangShell, true, nil
diff --git a/pkgs/by-name/fl/fleet-orbit/package.nix b/pkgs/by-name/fl/fleet-orbit/package.nix
new file mode 100644
index 000000000000..ac56a97c4d34
--- /dev/null
+++ b/pkgs/by-name/fl/fleet-orbit/package.nix
@@ -0,0 +1,73 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nixosTests,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "fleet-orbit";
+  version = "1.55.0";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "fleetdm";
+    repo = "fleet";
+    tag = "orbit-v${finalAttrs.version}";
+    hash = "sha256-gaS6A9Zfpb/VMQMAO5qI0lIaohD8jj4KWFRTU0OeqMo=";
+  };
+
+  vendorHash = "sha256-fhACxmzJY0PEQmMbjQxlfQh5ZJ+7a4um0s8xFQq+57w=";
+
+  env.CGO_ENABLED = "1";
+
+  subPackages = [ "orbit/cmd/orbit" ];
+
+  goFlags = [ "-buildvcs=false" ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=github.com/fleetdm/fleet/v4/orbit/pkg/build.Version=${finalAttrs.version}"
+    "-X=github.com/fleetdm/fleet/v4/orbit/pkg/build.Commit=0000000000000000000000000000000000000000"
+    "-X=github.com/fleetdm/fleet/v4/orbit/pkg/build.Date=1970-01-01T00:00:00Z"
+  ];
+
+  patches = [
+    ./0001-orbit-nixos.patch
+    ./0002-osqueryd-path-override.patch
+    ./0003-osquery-log-path.patch
+    ./0004-scripts-nixos.patch
+  ];
+
+  doInstallCheck = true;
+  versionCheckProgramArg = "version";
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.tests = {
+    inherit (nixosTests) orbit;
+  };
+
+  meta = {
+    description = "Fleet's lightweight osquery manager";
+    homepage = "https://github.com/fleetdm/fleet";
+    changelog = "https://github.com/fleetdm/fleet/releases/tag/orbit-v${finalAttrs.version}";
+    license = with lib.licenses; [
+      mit
+      {
+        shortName = "fleet-ee";
+        fullName = "Fleet Enterprise Edition License";
+        url = "https://github.com/fleetdm/fleet/blob/orbit-v${finalAttrs.version}/ee/LICENSE";
+        free = false;
+      }
+    ];
+    mainProgram = "orbit";
+    maintainers = with lib.maintainers; [
+      adrielvelazquez
+      faukah
+    ];
+    platforms = lib.platforms.linux;
+    sourceProvenance = with lib.sourceTypes; [ fromSource ];
+  };
+})
diff --git a/pkgs/by-name/fl/fluxcd-operator/package.nix b/pkgs/by-name/fl/fluxcd-operator/package.nix
index fcdafe3e6f35..3b1de7601c8e 100644
--- a/pkgs/by-name/fl/fluxcd-operator/package.nix
+++ b/pkgs/by-name/fl/fluxcd-operator/package.nix
@@ -9,16 +9,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "fluxcd-operator";
-  version = "0.57.0";
+  version = "0.58.1";
 
   src = fetchFromGitHub {
     owner = "controlplaneio-fluxcd";
     repo = "flux-operator";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qY+uxYGkeiffU5UTsh7oVL1Cp8uKMj4/F6+Y62BSUPY=";
+    hash = "sha256-XGjRP9JvEpuVNKcErTKmKi4TGBADpbI1DDXYDd0Bbb4=";
   };
 
-  vendorHash = "sha256-uTj6P6UZtfFf7jBrRZMWJ3HObiSR/tPlFICk6Cw12WQ=";
+  vendorHash = "sha256-9iDxoWnizmTQ4FqxjlGPQO8Au2FxIdcgggtP+3dTOaU=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/fo/fooyin/package.nix b/pkgs/by-name/fo/fooyin/package.nix
index 32fae334adf9..784981c408ea 100644
--- a/pkgs/by-name/fo/fooyin/package.nix
+++ b/pkgs/by-name/fo/fooyin/package.nix
@@ -16,6 +16,8 @@
   libopenmpt,
   soundtouch,
   soxr,
+  libpulseaudio,
+  libprojectm,
   game-music-emu,
   SDL2,
   icu,
@@ -26,7 +28,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fooyin";
-  version = "0.11.1";
+  version = "0.12.6";
 
   __structuredAttrs = true;
 
@@ -34,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "fooyin";
     repo = "fooyin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-228hxjKkxE0ILzP8dnIS21R3AW9Y0+wutgcYlQdCgXc=";
+    hash = "sha256-rmejU5Q/qpxvIpl9HpXa0qdr/yQk6eKhbhEvNnvAYgw=";
   };
 
   buildInputs = [
@@ -59,6 +61,8 @@ stdenv.mkDerivation (finalAttrs: {
     game-music-emu
     soundtouch
     soxr
+    libpulseaudio
+    libprojectm
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/fr/frogatto/data.nix b/pkgs/by-name/fr/frogatto/data.nix
index c1b43013d178..c163739b566b 100644
--- a/pkgs/by-name/fr/frogatto/data.nix
+++ b/pkgs/by-name/fr/frogatto/data.nix
@@ -6,7 +6,7 @@
 
 stdenv.mkDerivation {
   pname = "frogatto-data";
-  version = "unstable-2023-02-27";
+  version = "1.3.1-unstable-2023-02-27";
 
   src = fetchFromGitHub {
     owner = "frogatto";
diff --git a/pkgs/by-name/fr/frogatto/engine.nix b/pkgs/by-name/fr/frogatto/engine.nix
index ba6ab8eef203..1e6e6d86e26f 100644
--- a/pkgs/by-name/fr/frogatto/engine.nix
+++ b/pkgs/by-name/fr/frogatto/engine.nix
@@ -19,7 +19,7 @@
 
 stdenv.mkDerivation {
   pname = "anura-engine";
-  version = "unstable-2023-02-27";
+  version = "0-unstable-2023-02-27";
 
   src = fetchFromGitHub {
     owner = "anura-engine";
diff --git a/pkgs/by-name/gb/gbenchmark/package.nix b/pkgs/by-name/gb/gbenchmark/package.nix
index fffc36fdfbbf..d9440337a1a2 100644
--- a/pkgs/by-name/gb/gbenchmark/package.nix
+++ b/pkgs/by-name/gb/gbenchmark/package.nix
@@ -38,6 +38,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeCheckInputs = lib.optionals (glibcLocales != null) [ glibcLocales ];
 
+  strictDeps = true;
+
   cmakeFlags = [
     (lib.cmakeBool "BENCHMARK_USE_BUNDLED_GTEST" false)
     (lib.cmakeBool "BENCHMARK_ENABLE_WERROR" false)
@@ -73,6 +75,8 @@ stdenv.mkDerivation (finalAttrs: {
     inherit prometheus-cpp;
   };
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Microbenchmark support library";
     homepage = "https://github.com/google/benchmark";
diff --git a/pkgs/by-name/gd/gdbm/package.nix b/pkgs/by-name/gd/gdbm/package.nix
index a31390c4ea3b..df4c6eae1247 100644
--- a/pkgs/by-name/gd/gdbm/package.nix
+++ b/pkgs/by-name/gd/gdbm/package.nix
@@ -17,6 +17,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ];
 
+  strictDeps = true;
+
   hardeningDisable = [ "strictflexarrays3" ];
 
   configureFlags = [ (lib.enableFeature true "libgdbm-compat") ];
@@ -63,6 +65,8 @@ stdenv.mkDerivation (finalAttrs: {
     };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.gnu.org/software/gdbm/";
     description = "GNU dbm key/value database library";
diff --git a/pkgs/by-name/ge/geoclue2/package.nix b/pkgs/by-name/ge/geoclue2/package.nix
index 951d6e1444c1..a2cf3a7ee8ee 100644
--- a/pkgs/by-name/ge/geoclue2/package.nix
+++ b/pkgs/by-name/ge/geoclue2/package.nix
@@ -29,7 +29,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "geoclue";
-  version = "2.8.1";
+  version = "2.8.2";
 
   outputs = [
     "out"
@@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "geoclue";
     repo = "geoclue";
     tag = finalAttrs.version;
-    hash = "sha256-CyZhUMAa2vMUi61sL+gGBZFxGo0lu7Cm68fTjcbblTg=";
+    hash = "sha256-fjF0yd3+b+q3gTW2PpPNFE6zQafilj/g9rXWSgs/XGE=";
   };
 
   patches = [
diff --git a/pkgs/by-name/ge/getopt/package.nix b/pkgs/by-name/ge/getopt/package.nix
index 110164193521..e0eada007285 100644
--- a/pkgs/by-name/ge/getopt/package.nix
+++ b/pkgs/by-name/ge/getopt/package.nix
@@ -16,6 +16,8 @@ stdenv.mkDerivation (finalAttrs: {
   # attempt to use C library functions without declaring them, which is raised as an error.
   env.NIX_CFLAGS_COMPILE = "-D__GNU_LIBRARY__";
 
+  strictDeps = true;
+
   makeFlags = [
     "WITHOUT_GETTEXT=1"
     "LIBCGETOPT=0"
@@ -23,6 +25,8 @@ stdenv.mkDerivation (finalAttrs: {
     "CC:=$(CC)"
   ];
 
+  __structuredAttrs = true;
+
   meta = {
     platforms = lib.platforms.unix;
     homepage = "https://frodo.looijaard.name/project/getopt";
diff --git a/pkgs/by-name/gh/ghostfolio/package.nix b/pkgs/by-name/gh/ghostfolio/package.nix
index 678516533ec3..87ef4c119c1b 100644
--- a/pkgs/by-name/gh/ghostfolio/package.nix
+++ b/pkgs/by-name/gh/ghostfolio/package.nix
@@ -12,13 +12,13 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "ghostfolio";
-  version = "3.50.0";
+  version = "3.59.1";
 
   src = fetchFromGitHub {
     owner = "ghostfolio";
     repo = "ghostfolio";
     tag = finalAttrs.version;
-    hash = "sha256-jW/qcLIAVNcLlg9NqPcH2QeTouFZEzUHy4qqOzZ3h/8=";
+    hash = "sha256-Wf5uxU4lLB/Xw8SoZKFyyZulmpQCKKIIonDmyUlDyHs=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -28,7 +28,7 @@ buildNpmPackage (finalAttrs: {
     '';
   };
 
-  npmDepsHash = "sha256-wi8NfGBCiCbGUdVGWrX4XMRLUyLoBnur/v8og6RufKU=";
+  npmDepsHash = "sha256-pUE/zXM+q9RcV9pEMBMAhGUMB6Exn3ZWCbvFggzz0N8=";
 
   postPatch = ''
     substituteInPlace replace.build.mjs \
diff --git a/pkgs/by-name/gi/git/package.nix b/pkgs/by-name/gi/git/package.nix
index a6fe8a13efc3..f20fdd8eaf3e 100644
--- a/pkgs/by-name/gi/git/package.nix
+++ b/pkgs/by-name/gi/git/package.nix
@@ -133,6 +133,12 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://lore.kernel.org/git/20260504101429.340123-1-joerg@thalheim.io/raw";
       hash = "sha256-44EPfEJ39LjPWjqjFb52EKNaJGzYxZzJaJOis8QnazU=";
     })
+    # Fix fortify darwin crashes when dealing with unicode filenames.
+    (fetchurl {
+      name = "darwin-unicode-filename-fix.patch";
+      url = "https://lore.kernel.org/git/20260704233724.16928-1-ihar.hrachyshka@gmail.com/raw";
+      hash = "sha256-lpGz3nFKQvFDtW2TtQLx/684ECJVBLGPGqip0XEtOdU=";
+    })
   ]
   ++ lib.optionals withSsh [
     # Hard-code the ssh executable to ${pkgs.openssh}/bin/ssh instead of
@@ -207,6 +213,8 @@ stdenv.mkDerivation (finalAttrs: {
     buildPackages.stdenv.cc
   ];
 
+  strictDeps = true;
+
   env = {
     # required to support pthread_cancel()
     NIX_LDFLAGS =
@@ -228,7 +236,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   preBuild = ''
-    makeFlagsArray+=( perllibdir=$out/$(perl -MConfig -wle 'print substr $Config{installsitelib}, 1 + length $Config{siteprefixexp}') )
+    makeFlags+=( perllibdir=$out/$(perl -MConfig -wle 'print substr $Config{installsitelib}, 1 + length $Config{siteprefixexp}') )
   '';
 
   makeFlags = [
@@ -274,7 +282,7 @@ stdenv.mkDerivation (finalAttrs: {
         ''${enableParallelBuilding:+-j''${NIX_BUILD_CORES}}
         SHELL="$SHELL"
     )
-    concatTo flagsArray makeFlags makeFlagsArray buildFlags buildFlagsArray
+    concatTo flagsArray makeFlags buildFlags
     echoCmd 'build flags' "''${flagsArray[@]}"
   ''
   + lib.optionalString withManual ''
@@ -335,7 +343,7 @@ stdenv.mkDerivation (finalAttrs: {
         ''${enableParallelInstalling:+-j''${NIX_BUILD_CORES}}
         SHELL="$SHELL"
     )
-    concatTo flagsArray makeFlags makeFlagsArray installFlags installFlagsArray
+    concatTo flagsArray makeFlags installFlags
     echoCmd 'install flags' "''${flagsArray[@]}"
 
     # Install git-subtree.
@@ -478,7 +486,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   installCheckTarget = "test";
 
-  # see also installCheckFlagsArray
+  # see also installCheckFlags in preInstallCheck
   installCheckFlags = [
     "DEFAULT_TEST_TARGET=prove"
     "PERL_PATH=${buildPackages.perl}/bin/perl"
@@ -502,7 +510,7 @@ stdenv.mkDerivation (finalAttrs: {
       NIX_BUILD_CORES=32
     fi
 
-    installCheckFlagsArray+=(
+    installCheckFlags+=(
       GIT_PROVE_OPTS="--jobs $NIX_BUILD_CORES --failures --state=failed,save"
       GIT_TEST_INSTALLED=$out/bin
       ${lib.optionalString (!svnSupport) "NO_SVN_TESTS=y"}
diff --git a/pkgs/by-name/gi/gitcomet/package.nix b/pkgs/by-name/gi/gitcomet/package.nix
index 484e0efc656b..656d9c6053e3 100644
--- a/pkgs/by-name/gi/gitcomet/package.nix
+++ b/pkgs/by-name/gi/gitcomet/package.nix
@@ -77,7 +77,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     writableTmpDirAsHomeHook
   ];
 
-  GIT_PAGER = "cat";
+  env.GIT_PAGER = "cat";
   dontUseCargoParallelTests = true;
 
   postInstall = ''
diff --git a/pkgs/by-name/gl/glib/package.nix b/pkgs/by-name/gl/glib/package.nix
index d504331900ce..b671ab262978 100644
--- a/pkgs/by-name/gl/glib/package.nix
+++ b/pkgs/by-name/gl/glib/package.nix
@@ -366,6 +366,8 @@ stdenv.mkDerivation (finalAttrs: {
     };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     description = "C library of programming buildings blocks";
     homepage = "https://gitlab.gnome.org/GNOME/glib";
diff --git a/pkgs/by-name/gn/gnome-desktop/bubblewrap-paths.patch b/pkgs/by-name/gn/gnome-desktop/bubblewrap-paths.patch
index c31e093f4b7e..9cee631288af 100644
--- a/pkgs/by-name/gn/gnome-desktop/bubblewrap-paths.patch
+++ b/pkgs/by-name/gn/gnome-desktop/bubblewrap-paths.patch
@@ -2,7 +2,7 @@ diff --git a/libgnome-desktop/gnome-desktop-thumbnail-script.c b/libgnome-deskto
 index ddcc1511..546c2a36 100644
 --- a/libgnome-desktop/gnome-desktop-thumbnail-script.c
 +++ b/libgnome-desktop/gnome-desktop-thumbnail-script.c
-@@ -555,9 +555,9 @@ add_bwrap (GPtrArray   *array,
+@@ -555,9 +555,10 @@ add_bwrap (GPtrArray   *array,
    g_return_val_if_fail (script->s_infile != NULL, FALSE);
  
    add_args (array,
@@ -12,6 +12,7 @@ index ddcc1511..546c2a36 100644
 +	    "@bubblewrap_bin@",
 +	    "--ro-bind", "@storeDir@", "@storeDir@",
 +	    "--ro-bind-try", "/run/current-system", "/run/current-system",
++	    "--ro-bind-try", "/run/opengl-driver", "/run/opengl-driver",
  	    NULL);
  
    /* These directories might be symlinks into /usr/... */
diff --git a/pkgs/by-name/gn/gnu-config/package.nix b/pkgs/by-name/gn/gnu-config/package.nix
index 80baba133a06..fc52ff2e9b6d 100644
--- a/pkgs/by-name/gn/gnu-config/package.nix
+++ b/pkgs/by-name/gn/gnu-config/package.nix
@@ -67,6 +67,8 @@ stdenv.mkDerivation {
 
   strictDeps = true;
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Attempt to guess a canonical system name";
     homepage = "https://savannah.gnu.org/projects/config";
diff --git a/pkgs/by-name/gn/gnugrep/package.nix b/pkgs/by-name/gn/gnugrep/package.nix
index 9f0ecedd8792..03b965b7268b 100644
--- a/pkgs/by-name/gn/gnugrep/package.nix
+++ b/pkgs/by-name/gn/gnugrep/package.nix
@@ -15,16 +15,12 @@
 # cgit) that are needed here should be included directly in Nixpkgs as
 # files.
 
-let
-  version = "3.12";
-in
-
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "gnugrep";
-  inherit version;
+  version = "3.12";
 
   src = fetchurl {
-    url = "mirror://gnu/grep/grep-${version}.tar.xz";
+    url = "mirror://gnu/grep/grep-${finalAttrs.version}.tar.xz";
     hash = "sha256-JkmyfA6Q5jLq3NdXvgbG6aT0jZQd5R58D4P/dkCKB7k=";
   };
 
@@ -39,13 +35,9 @@ stdenv.mkDerivation {
   # - on Musl: https://github.com/NixOS/nixpkgs/pull/228714
   # - on x86_64-darwin: https://github.com/NixOS/nixpkgs/pull/228714#issuecomment-1576826330
   # - when building on Darwin (cross-compilation): test-nl_langinfo-mt fails
-  postPatch =
-    if stdenv.hostPlatform.isMusl || stdenv.buildPlatform.isDarwin then
-      ''
-        sed -i 's:gnulib-tests::g' Makefile.in
-      ''
-    else
-      null;
+  postPatch = lib.optionalString (stdenv.hostPlatform.isMusl || stdenv.buildPlatform.isDarwin) ''
+    substituteInPlace Makefile.in --replace-fail "gnulib-tests" ""
+  '';
 
   nativeCheckInputs = [
     perl
@@ -63,6 +55,8 @@ stdenv.mkDerivation {
   ]
   ++ lib.optional (!stdenv.hostPlatform.isWindows) runtimeShellPackage;
 
+  strictDeps = true;
+
   # cygwin: FAIL: multibyte-white-space
   # freebsd: FAIL mb-non-UTF8-performance
   # x86_64-darwin: fails 'stack-overflow' tests on Rosetta 2 emulator
@@ -97,6 +91,8 @@ stdenv.mkDerivation {
     NIX_CFLAGS_COMPILE = "-Wno-error=format-security";
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.gnu.org/software/grep/";
     description = "GNU implementation of the Unix grep command";
@@ -116,7 +112,7 @@ stdenv.mkDerivation {
     teams = [ lib.teams.security-review ];
     platforms = lib.platforms.all;
     mainProgram = "grep";
-    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnu" version // {
+    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnu" finalAttrs.version // {
       product = "grep";
     };
   };
@@ -124,4 +120,4 @@ stdenv.mkDerivation {
   passthru = {
     inherit pcre2;
   };
-}
+})
diff --git a/pkgs/by-name/gn/gnum4/package.nix b/pkgs/by-name/gn/gnum4/package.nix
index 73c5be0ac04e..78e02d2698fa 100644
--- a/pkgs/by-name/gn/gnum4/package.nix
+++ b/pkgs/by-name/gn/gnum4/package.nix
@@ -47,6 +47,8 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optional stdenv.hostPlatform.isMinGW "CFLAGS=-fno-stack-protector";
 
+  __structuredAttrs = true;
+
   meta = {
     description = "GNU M4, a macro processor";
     longDescription = ''
diff --git a/pkgs/by-name/gn/gnumake/package.nix b/pkgs/by-name/gn/gnumake/package.nix
index 9f2aa3d764e9..bde1af39133b 100644
--- a/pkgs/by-name/gn/gnumake/package.nix
+++ b/pkgs/by-name/gn/gnumake/package.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnu/make/make-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-3Rb7HWe/q3mnL16DkHNcSePo5wtJRaFasfgd23hlj7M=";
+    hash = "sha256-3Rb7HWe/q3mnL16DkHNcSePo5wtJRaFasfgd23hlj7M=";
   };
 
   # To update patches:
@@ -82,6 +82,8 @@ stdenv.mkDerivation (finalAttrs: {
     gnumakeWithGuile = gnumake.override { guileSupport = true; };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Tool to control the generation of non-source files from sources";
     longDescription = ''
diff --git a/pkgs/by-name/gn/gnupatch/package.nix b/pkgs/by-name/gn/gnupatch/package.nix
index e32573c05048..361365accfb3 100644
--- a/pkgs/by-name/gn/gnupatch/package.nix
+++ b/pkgs/by-name/gn/gnupatch/package.nix
@@ -33,6 +33,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   strictDeps = true;
 
+  __structuredAttrs = true;
+
   meta = {
     description = "GNU Patch, a program to apply differences to files";
     mainProgram = "patch";
diff --git a/pkgs/by-name/gn/gnutls/package.nix b/pkgs/by-name/gn/gnutls/package.nix
index c132697abbd7..df21d5943035 100644
--- a/pkgs/by-name/gn/gnutls/package.nix
+++ b/pkgs/by-name/gn/gnutls/package.nix
@@ -58,12 +58,12 @@ let
   util-linux = util-linuxMinimal;
 in
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "gnutls";
   version = "3.8.13";
 
   src = fetchurl {
-    url = "mirror://gnupg/gnutls/v${lib.versions.majorMinor version}/gnutls-${version}.tar.xz";
+    url = "mirror://gnupg/gnutls/v${lib.versions.majorMinor finalAttrs.version}/gnutls-${finalAttrs.version}.tar.xz";
     hash = "sha256-/+2Owb8JwkJtTxSq43feR1O1PlN9aF5gTpmosWypyX4=";
   };
 
@@ -173,6 +173,8 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ nettle ];
 
+  strictDeps = true;
+
   inherit doCheck;
   # stdenv's `NIX_SSL_CERT_FILE=/no-cert-file.crt` breaks tests.
   # Also empty files won't work, and we want to avoid potentially impure /etc/
@@ -215,6 +217,8 @@ stdenv.mkDerivation rec {
     static = pkgsStatic.gnutls;
   };
 
+  __structuredAttrs = true;
+
   meta = {
     description = "GNU Transport Layer Security Library";
 
@@ -236,6 +240,6 @@ stdenv.mkDerivation rec {
     license = lib.licenses.lgpl21Plus;
     maintainers = with lib.maintainers; [ vcunat ];
     platforms = lib.platforms.all;
-    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnu" version;
+    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnu" finalAttrs.version;
   };
-}
+})
diff --git a/pkgs/by-name/go/gogdl/package.nix b/pkgs/by-name/go/gogdl/package.nix
index 85547311f399..a05251742aec 100644
--- a/pkgs/by-name/go/gogdl/package.nix
+++ b/pkgs/by-name/go/gogdl/package.nix
@@ -6,7 +6,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "gogdl";
-  version = "1.2.2";
+  version = "1.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -14,7 +14,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     repo = "heroic-gogdl";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-gXAlZa4rml8fH54jpOIXZN0/1iieLpZwpii5ICHQ2Sc=";
+    hash = "sha256-tTd41ufxPObXwLpA1F0HXNEROnJwHt4WpojsRnNLml0=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/go/google-chrome/package.nix b/pkgs/by-name/go/google-chrome/package.nix
index 243668efa5d4..804edd559344 100644
--- a/pkgs/by-name/go/google-chrome/package.nix
+++ b/pkgs/by-name/go/google-chrome/package.nix
@@ -179,7 +179,7 @@ let
 
   linux = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "151.0.7922.173";
+    version = "152.0.7977.64";
 
     src =
       let
@@ -194,8 +194,8 @@ let
         url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_${debArch}.deb";
         hash =
           {
-            amd64 = "sha256-h45atJW4ppSYD8phvAmzfmUcztziKRxzQ00W5IomRv0=";
-            arm64 = "sha256-rmIl2Yu9JT/wCqW3Mew8q1+t3utV905O1TDb4w88dx8=";
+            amd64 = "sha256-Tq4HNqgS2byFHNKTf3rwDkfbr4MFhF7tRScD/wCYc8c=";
+            arm64 = "sha256-bMq3mnr+HRdMieKM8NWiZebohV/ztFxqIVGmXX3a6eg=";
           }
           .${debArch};
       };
@@ -300,11 +300,11 @@ let
 
   darwin = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "151.0.7922.174";
+    version = "152.0.7977.65";
 
     src = fetchurl {
-      url = "http://dl.google.com/release2/chrome/kfi4kfphbh3b32pyrjxv55iqfi_151.0.7922.174/GoogleChrome-151.0.7922.174.dmg";
-      hash = "sha256-CcJ7VoCjUE8Zn5G2NMFJjKeDUBXVuF+2m/HglN8/R0Q=";
+      url = "http://dl.google.com/release2/chrome/hojsgpdatugdlbpbk6whstg6m4_152.0.7977.65/GoogleChrome-152.0.7977.65.dmg";
+      hash = "sha256-a3r/7DSXVfQJKNujF2xu5KPTLjJk3JLE+oFrAwktPAc=";
     };
 
     dontPatch = true;
diff --git a/pkgs/by-name/go/google-cloud-sdk/components.json b/pkgs/by-name/go/google-cloud-sdk/components.json
index 2770f12204c8..9ed0cffc42e6 100644
--- a/pkgs/by-name/go/google-cloud-sdk/components.json
+++ b/pkgs/by-name/go/google-cloud-sdk/components.json
@@ -5,7 +5,7 @@
         "checksum": "73eeb0b0222c8c72ce1cbba3c2ca787d7d89eabc5226463fd59a404f76280138",
         "contents_checksum": "a0096c5a5f0a315397d46a44d19b63f26bca1607a833260032e1efa03d44c9a7",
         "size": 761,
-        "source": "components/google-cloud-sdk-alpha-20260731054104.tar.gz",
+        "source": "components/google-cloud-sdk-alpha-20260814074256.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -23,8 +23,8 @@
       "platform": {},
       "platform_required": false,
       "version": {
-        "build_number": 20260731054104,
-        "version_string": "2026.07.31"
+        "build_number": 20260814074256,
+        "version_string": "2026.08.14"
       }
     },
     {
@@ -1138,7 +1138,7 @@
         "checksum": "0034138f7ee8d13690dae0a1443a09ecbdae1e45497360c14dabd2c57a79c8a2",
         "contents_checksum": "eee82cd34806ce26487960b9cf1705786ccf975d34390b179f7b89307dc51044",
         "size": 758,
-        "source": "components/google-cloud-sdk-beta-20260731054104.tar.gz",
+        "source": "components/google-cloud-sdk-beta-20260814074256.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -1156,8 +1156,8 @@
       "platform": {},
       "platform_required": false,
       "version": {
-        "build_number": 20260731054104,
-        "version_string": "2026.07.31"
+        "build_number": 20260814074256,
+        "version_string": "2026.08.14"
       }
     },
     {
@@ -1481,10 +1481,10 @@
     },
     {
       "data": {
-        "checksum": "ea5d5573c5f273c69031b1f861ce3579434b7a4b37a53f81b558f1b0e6fea3d7",
-        "contents_checksum": "30706c8fc569a3578eefceb01b78b0b5a67fd72d1c016f269abc264834baa0e4",
-        "size": 1973753,
-        "source": "components/google-cloud-sdk-bq-20260724054717.tar.gz",
+        "checksum": "954a92fb0c34dfc607295a230ef126e84ebae0e0827a5ba2424d2622ce3535d6",
+        "contents_checksum": "16f1ebfc39679cfb5e3e3a7f24de0bf9da8f9ba21e86fb90de9244bdd905821b",
+        "size": 2286040,
+        "source": "components/google-cloud-sdk-bq-20260814074256.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -1504,8 +1504,8 @@
       "platform": {},
       "platform_required": false,
       "version": {
-        "build_number": 20260724054717,
-        "version_string": "2.1.36"
+        "build_number": 20260814074256,
+        "version_string": "2.1.37"
       }
     },
     {
@@ -1610,15 +1610,15 @@
       "platform_required": false,
       "version": {
         "build_number": 0,
-        "version_string": "1.25.3"
+        "version_string": "1.25.4"
       }
     },
     {
       "data": {
-        "checksum": "79590ed52dbd03a247b69e11dd40c625ce16354b2a5d88de100f14f364e57bdb",
-        "contents_checksum": "762286f63aafe7d3b43863f7d81743ba77110c74b9dad7419e85ed58a06f162a",
-        "size": 20845895,
-        "source": "components/google-cloud-sdk-cbt-darwin-arm-20260717053915.tar.gz",
+        "checksum": "d6b7eee546c9f44de0c02018144539ebb7b739934bd477efe4ce14061a6d1fb6",
+        "contents_checksum": "105a55d37d626676b5b1351d9432d41dbc2c13327b44a2e965d4dd9a093cd389",
+        "size": 22101844,
+        "source": "components/google-cloud-sdk-cbt-darwin-arm-20260814074256.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -1643,8 +1643,8 @@
       },
       "platform_required": false,
       "version": {
-        "build_number": 20260717053915,
-        "version_string": "1.25.3"
+        "build_number": 20260814074256,
+        "version_string": "1.25.4"
       }
     },
     {
@@ -1683,10 +1683,10 @@
     },
     {
       "data": {
-        "checksum": "af846f78a8906d2f63c4da1449dd147c7805820bb30b6f1bd0437c5cab048a1f",
-        "contents_checksum": "a2b6581c530da0dad6e3d330b24f7b0d703e99915a91d829dd2893f7d4974d86",
-        "size": 22038894,
-        "source": "components/google-cloud-sdk-cbt-darwin-x86_64-20260717053915.tar.gz",
+        "checksum": "23ae91edc498b4e407ab529e1efa942870f32dac3923c1f830a41005b4fabfa9",
+        "contents_checksum": "dac40b2a5f61ce95a93fddc7495a483731c82e8c3e015854440f16aafc41f182",
+        "size": 23354874,
+        "source": "components/google-cloud-sdk-cbt-darwin-x86_64-20260814074256.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -1711,16 +1711,16 @@
       },
       "platform_required": false,
       "version": {
-        "build_number": 20260717053915,
-        "version_string": "1.25.3"
+        "build_number": 20260814074256,
+        "version_string": "1.25.4"
       }
     },
     {
       "data": {
-        "checksum": "051264f5559ecb4b0135f95935b55a221978b24382febd1ec4e68512c0ffd442",
-        "contents_checksum": "2e8f90e00370f41597de5f6c5759a889866d112022b3e0d950a29b1ee6d63777",
-        "size": 19276042,
-        "source": "components/google-cloud-sdk-cbt-linux-arm-20260717053915.tar.gz",
+        "checksum": "e4ba5ebc32e9c3eff8de39374a7ed4f85138eca034a2fdc4ea662fc3383e32ec",
+        "contents_checksum": "db962cb6a3b04fe90c5552204c4db88f97c1ea13d8fd4bbbe610b453d8a32164",
+        "size": 20420640,
+        "source": "components/google-cloud-sdk-cbt-linux-arm-20260814074256.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -1745,16 +1745,16 @@
       },
       "platform_required": false,
       "version": {
-        "build_number": 20260717053915,
-        "version_string": "1.25.3"
+        "build_number": 20260814074256,
+        "version_string": "1.25.4"
       }
     },
     {
       "data": {
-        "checksum": "6145eabb4c63f4dacd65b93b44cc53890496ab4c9cb1e6b12c1a4539bc86a2eb",
-        "contents_checksum": "58b86989036f07e3716686667fed972dea38af44f8aa417adccbbb0c8feff8d5",
-        "size": 19901952,
-        "source": "components/google-cloud-sdk-cbt-linux-x86-20260717053915.tar.gz",
+        "checksum": "79d91403cb2018a35a017a9258faec0377336ce1248d04673b365f73ce8bcf47",
+        "contents_checksum": "bef43c1e95fb7b881037c853822efc198bccaee65bdbcaee9a27516b744c896c",
+        "size": 21141620,
+        "source": "components/google-cloud-sdk-cbt-linux-x86-20260814074256.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -1779,16 +1779,16 @@
       },
       "platform_required": false,
       "version": {
-        "build_number": 20260717053915,
-        "version_string": "1.25.3"
+        "build_number": 20260814074256,
+        "version_string": "1.25.4"
       }
     },
     {
       "data": {
-        "checksum": "482bee238a7aade205fd1a3f88ac8ca7e41df6b829c34f53bd265c3d24b309f9",
-        "contents_checksum": "c300acced8b8f1d22f649a86ea7179d15b6a4f6d508a96cf15be6cea60c7cc4f",
-        "size": 20909709,
-        "source": "components/google-cloud-sdk-cbt-linux-x86_64-20260717053915.tar.gz",
+        "checksum": "bf72f5f6f2c8649594e45ea3c0a8578934e1b937d36a8ff89c1677169b4b3f22",
+        "contents_checksum": "c616e30c3986cce5e434a317bef33f2d4acf83328e1b04663fa09562ec0fffea",
+        "size": 22132663,
+        "source": "components/google-cloud-sdk-cbt-linux-x86_64-20260814074256.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -1813,16 +1813,16 @@
       },
       "platform_required": false,
       "version": {
-        "build_number": 20260717053915,
-        "version_string": "1.25.3"
+        "build_number": 20260814074256,
+        "version_string": "1.25.4"
       }
     },
     {
       "data": {
-        "checksum": "83b3187fed8cc589426d96d007d85e4c77119600d29c6ac9ce2aa1f8d9a62a4d",
-        "contents_checksum": "06031024289140c23288dc37ebdc66e2b1929ca384bfd9a4fbdff447e01dec6d",
-        "size": 20363797,
-        "source": "components/google-cloud-sdk-cbt-windows-x86-20260717053915.tar.gz",
+        "checksum": "11f15c7b7f13b51cb1505451eae37215e40caad709c248f3eed7771d15b2b99a",
+        "contents_checksum": "839b6d9391827353c2469f0f12a38cc777bfd9a6c7661acfba1d1c66823e78c0",
+        "size": 21644226,
+        "source": "components/google-cloud-sdk-cbt-windows-x86-20260814074256.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -1847,16 +1847,16 @@
       },
       "platform_required": false,
       "version": {
-        "build_number": 20260717053915,
-        "version_string": "1.25.3"
+        "build_number": 20260814074256,
+        "version_string": "1.25.4"
       }
     },
     {
       "data": {
-        "checksum": "aed38eeebcb8eca2fea6200a434b1b555c175a81eac720da1da127c64eaf22d6",
-        "contents_checksum": "268ac7799d48ec6c2dc6c3034890a3b98f9ee3185764f371180272c4d8897852",
-        "size": 21160864,
-        "source": "components/google-cloud-sdk-cbt-windows-x86_64-20260717053915.tar.gz",
+        "checksum": "1e682e75f4f4fe9c3f7ca1831ed63b24db8f29db26cff0a987bbceea22e2d373",
+        "contents_checksum": "61c764c9feec805d679d1c8d56abc36b9bdd6c9b90ea958ef0d4a167e73a5c0f",
+        "size": 22388510,
+        "source": "components/google-cloud-sdk-cbt-windows-x86_64-20260814074256.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -1881,8 +1881,8 @@
       },
       "platform_required": false,
       "version": {
-        "build_number": 20260717053915,
-        "version_string": "1.25.3"
+        "build_number": 20260814074256,
+        "version_string": "1.25.4"
       }
     },
     {
@@ -2301,15 +2301,15 @@
       "platform_required": false,
       "version": {
         "build_number": 0,
-        "version_string": "1.5.55"
+        "version_string": "1.5.56"
       }
     },
     {
       "data": {
-        "checksum": "2b33301e10787e62c622435ef9de0ee0082d6c79955f845a755d80116291dd9b",
-        "contents_checksum": "a0a68fd62c1dcb243f16964a8cba368032252b6747a049b160663ca6a278c9e8",
-        "size": 51210457,
-        "source": "components/google-cloud-sdk-cloud-spanner-emulator-linux-x86_64-20260710150251.tar.gz",
+        "checksum": "2249fc658438d2434c1cf7f0e444107cfc24ce1b894bcdad3e8a7dc947fe62dd",
+        "contents_checksum": "517267de89b3f20d3fda91b1385f7b3b9a76d3920d9ad597edfb4d76749264ff",
+        "size": 52345394,
+        "source": "components/google-cloud-sdk-cloud-spanner-emulator-linux-x86_64-20260807154943.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -2335,8 +2335,8 @@
       },
       "platform_required": false,
       "version": {
-        "build_number": 20260710150251,
-        "version_string": "1.5.55"
+        "build_number": 20260807154943,
+        "version_string": "1.5.56"
       }
     },
     {
@@ -3095,10 +3095,10 @@
     },
     {
       "data": {
-        "checksum": "ec505a00a8ccfba34e53d85f7302f9586a84eb17fe72525c60622606e1136aa4",
-        "contents_checksum": "726076916a36597072facad59103328324da73522ba20511cfeebea0f9ddc0ce",
-        "size": 27916650,
-        "source": "components/google-cloud-sdk-core-20260731054104.tar.gz",
+        "checksum": "645f514aede6e7c6d43d758c2464fc78b1d66d98d3dbbe63fa0e64d9370403a9",
+        "contents_checksum": "2b465549bd6ecb6dad4941fefd5e090d967b858daed22342955da03a7c9d9857",
+        "size": 28132031,
+        "source": "components/google-cloud-sdk-core-20260814074256.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -3119,8 +3119,8 @@
       "platform": {},
       "platform_required": false,
       "version": {
-        "build_number": 20260731054104,
-        "version_string": "2026.07.31"
+        "build_number": 20260814074256,
+        "version_string": "2026.08.14"
       }
     },
     {
@@ -3497,15 +3497,15 @@
       "platform_required": false,
       "version": {
         "build_number": 0,
-        "version_string": "0.3.19"
+        "version_string": "0.3.20"
       }
     },
     {
       "data": {
-        "checksum": "ed43d9c16d8763a42a980d8f62076c862463abdc7237492939bb569ef6fb92dd",
-        "contents_checksum": "043140a7d0fad390591d6e8a7768e910c447dbecf8b57c5b92abfa0fc5e030f9",
-        "size": 15336065,
-        "source": "components/google-cloud-sdk-enterprise-certificate-proxy-darwin-arm-20260731054104.tar.gz",
+        "checksum": "2f9947d3be36a47d3f690140111ca79c15391dbc670b120715693e0d5bcea0ed",
+        "contents_checksum": "1e67b289d8f07d3ff5ff3c90babc5ef72e6b3ccf3a18fac4a2d48c485d8b9500",
+        "size": 15337430,
+        "source": "components/google-cloud-sdk-enterprise-certificate-proxy-darwin-arm-20260807154943.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -3530,16 +3530,16 @@
       },
       "platform_required": false,
       "version": {
-        "build_number": 20260731054104,
-        "version_string": "0.3.19"
+        "build_number": 20260807154943,
+        "version_string": "0.3.20"
       }
     },
     {
       "data": {
-        "checksum": "cd2c825b1615fc97ccd632478694c010db608dce2f63e3cada4e66d255c27103",
-        "contents_checksum": "74a89013ab0da2e08a8d9ab5871212689bddc7583a66c60c54c704d15867c75d",
-        "size": 16297514,
-        "source": "components/google-cloud-sdk-enterprise-certificate-proxy-darwin-x86_64-20260731054104.tar.gz",
+        "checksum": "fa41da2478182e5b9f8f3b2679a3c65f8952eaaa8626b27d0727996b0f54dab0",
+        "contents_checksum": "f6d226c963d112a3e5a186d3fa2377cf9274c510cc1b9ec19393e841ea0fa13d",
+        "size": 16296666,
+        "source": "components/google-cloud-sdk-enterprise-certificate-proxy-darwin-x86_64-20260807154943.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -3564,16 +3564,16 @@
       },
       "platform_required": false,
       "version": {
-        "build_number": 20260731054104,
-        "version_string": "0.3.19"
+        "build_number": 20260807154943,
+        "version_string": "0.3.20"
       }
     },
     {
       "data": {
-        "checksum": "f8d7c5c09a436aff61918517824e5fcf1f10e82d46fe3898c8b915794f5bfa1d",
-        "contents_checksum": "e0a058d5ffd0ce65a6129bc37db8f1fec56e0f9e08e4b14c021a896bd0b84698",
-        "size": 18436186,
-        "source": "components/google-cloud-sdk-enterprise-certificate-proxy-linux-x86_64-20260731054104.tar.gz",
+        "checksum": "e346f92235ea867e1e1a2f7ef8ef2b9907f0e7e2a35dbcfc87b7eba6c908c5b0",
+        "contents_checksum": "68e57165e4453f13810109a554115feee1ab925b4481ce383fd5f85dac31a9ce",
+        "size": 18436193,
+        "source": "components/google-cloud-sdk-enterprise-certificate-proxy-linux-x86_64-20260807154943.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -3598,16 +3598,16 @@
       },
       "platform_required": false,
       "version": {
-        "build_number": 20260731054104,
-        "version_string": "0.3.19"
+        "build_number": 20260807154943,
+        "version_string": "0.3.20"
       }
     },
     {
       "data": {
-        "checksum": "d731c7710da2820cffc2b4cb7314f5218b2f4ac7c30fb341980df44a3ef13f81",
-        "contents_checksum": "e54a67c367628edf8d3efcb8669c0d738718dfb0c20bb1df929123852f25675d",
-        "size": 13416873,
-        "source": "components/google-cloud-sdk-enterprise-certificate-proxy-windows-x86_64-20260731054104.tar.gz",
+        "checksum": "b267dff0f17e28deffd96db80a6e844533c296f41092e45409e5192814ea000e",
+        "contents_checksum": "14bcdfa9a15b2fad5ee3d70439c5ff6b528f3f1fd5f1f2288f9373d3fc1103eb",
+        "size": 13416970,
+        "source": "components/google-cloud-sdk-enterprise-certificate-proxy-windows-x86_64-20260807154943.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -3632,8 +3632,8 @@
       },
       "platform_required": false,
       "version": {
-        "build_number": 20260731054104,
-        "version_string": "0.3.19"
+        "build_number": 20260807154943,
+        "version_string": "0.3.20"
       }
     },
     {
@@ -4359,10 +4359,10 @@
     },
     {
       "data": {
-        "checksum": "2648f2f8064a17b0d97236aa67aad62a4e503cf87f0c6d1117a03a4e9065e9b1",
-        "contents_checksum": "36383a100c64ae6002aa3fdd37eb8b0941d35fda6c48d2634be7c1a3aa18a0df",
-        "size": 10483823,
-        "source": "components/google-cloud-sdk-gcloud-man-pages-nix-20260731054104.tar.gz",
+        "checksum": "2c7a22f1d75b6a85fc6e44e28cca3fa8f6aa8a8c81e14e1ec3b7abebbb5dc9af",
+        "contents_checksum": "cd4beff93d45489198de5857881aec8009e50e437aa87d7a6b5d10b58d2ec305",
+        "size": 10535456,
+        "source": "components/google-cloud-sdk-gcloud-man-pages-nix-20260814074256.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -4388,7 +4388,7 @@
       },
       "platform_required": false,
       "version": {
-        "build_number": 20260731054104,
+        "build_number": 20260814074256,
         "version_string": ""
       }
     },
@@ -4827,15 +4827,15 @@
       "platform_required": false,
       "version": {
         "build_number": 0,
-        "version_string": "1.20.892"
+        "version_string": "1.20.8107"
       }
     },
     {
       "data": {
-        "checksum": "8b1d96997ba8a4e13043d362f6ff77c6515b9cf905237fcf6be363a950d219a4",
-        "contents_checksum": "3ebdd0a114596a3a470a48e6a6461db02099adeb53e79288c5d12748e6157a0a",
-        "size": 27723752,
-        "source": "components/google-cloud-sdk-istioctl-darwin-arm-20260710150251.tar.gz",
+        "checksum": "35825fe23b15d7604b617218fed998c96b87ca3c413b0cfe8717cc96966d5b8e",
+        "contents_checksum": "c000d3b1e6cbb45d3fc0cd236a3807b696e00b0c1c77a645ae928a4f834bd690",
+        "size": 27751763,
+        "source": "components/google-cloud-sdk-istioctl-darwin-arm-20260814074256.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -4860,16 +4860,16 @@
       },
       "platform_required": false,
       "version": {
-        "build_number": 20260710150251,
-        "version_string": "1.20.892"
+        "build_number": 20260814074256,
+        "version_string": "1.20.8107"
       }
     },
     {
       "data": {
-        "checksum": "10a72bfbf62eace1c22d752ce77189b01769f472e29629c592f22b1eaf1d0468",
-        "contents_checksum": "943e43953d21092e26c42a8d2eb930e9716505ecc1bbc338b1e5ddd3e11e43fb",
-        "size": 29776478,
-        "source": "components/google-cloud-sdk-istioctl-darwin-x86_64-20260710150251.tar.gz",
+        "checksum": "96a17744595b780d72b3745aec5ff1f32fee3aab4d015306137ec7a4b080fa73",
+        "contents_checksum": "cf37e1eddb2000ce464ae7448703dff00a4ee14c9b9312cac4cea91c138d6490",
+        "size": 29803999,
+        "source": "components/google-cloud-sdk-istioctl-darwin-x86_64-20260814074256.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -4894,16 +4894,16 @@
       },
       "platform_required": false,
       "version": {
-        "build_number": 20260710150251,
-        "version_string": "1.20.892"
+        "build_number": 20260814074256,
+        "version_string": "1.20.8107"
       }
     },
     {
       "data": {
-        "checksum": "b239adc3ce63ea6c4e3d016085f43774d85331d0bd891084984e19fe6a03df74",
-        "contents_checksum": "6ab5c4bcedb178abe3783876491d527e7c524ff258c4419a16f6a34f3a756035",
-        "size": 25874544,
-        "source": "components/google-cloud-sdk-istioctl-linux-arm-20260710150251.tar.gz",
+        "checksum": "991e4ea71e26eeeed8fc7a9b3d962d44f1a8b508a57282110d43264b89625cdb",
+        "contents_checksum": "c5fecdcd9b526b54f5b0f5cf88a874967a7819272f6e3153016b203ce4d65418",
+        "size": 25901981,
+        "source": "components/google-cloud-sdk-istioctl-linux-arm-20260814074256.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -4928,16 +4928,16 @@
       },
       "platform_required": false,
       "version": {
-        "build_number": 20260710150251,
-        "version_string": "1.20.892"
+        "build_number": 20260814074256,
+        "version_string": "1.20.8107"
       }
     },
     {
       "data": {
-        "checksum": "173078820da7f599c95b681933da7a5358f5aa9ef97a372f2dd9403e6a3d1ddf",
-        "contents_checksum": "c7328be1e3b6780074d609bdc48cf98bf19df7be3d46d29c696aa65e5a3f87a7",
-        "size": 28710833,
-        "source": "components/google-cloud-sdk-istioctl-linux-x86_64-20260710150251.tar.gz",
+        "checksum": "65e9bdd42333dca6f6ff87fe456f5c7b4d6b07476278cdfbc76fc44d997dc248",
+        "contents_checksum": "f337697c75f563559dcbb8b9766cb82f8d94883a6159f8b8d490e96619abd8f2",
+        "size": 28742918,
+        "source": "components/google-cloud-sdk-istioctl-linux-x86_64-20260814074256.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -4962,8 +4962,8 @@
       },
       "platform_required": false,
       "version": {
-        "build_number": 20260710150251,
-        "version_string": "1.20.892"
+        "build_number": 20260814074256,
+        "version_string": "1.20.8107"
       }
     },
     {
@@ -6720,7 +6720,7 @@
         "checksum": "f135e5f6dd331d28f3ebf299208dbe1993838ad4f2d9d87cbde365a6b760c66c",
         "contents_checksum": "c4caf1dd1ca46b5fb9d759606c18619ffaafff9315db4037ade8b3b628f6312b",
         "size": 782,
-        "source": "components/google-cloud-sdk-preview-20260731054104.tar.gz",
+        "source": "components/google-cloud-sdk-preview-20260814074256.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -6738,16 +6738,16 @@
       "platform": {},
       "platform_required": false,
       "version": {
-        "build_number": 20260731054104,
-        "version_string": "2026.07.31"
+        "build_number": 20260814074256,
+        "version_string": "2026.08.14"
       }
     },
     {
       "data": {
-        "checksum": "ce429db6453c95aee8d801cfa27486f9aca691be5b176f80223be0126280ba96",
-        "contents_checksum": "c54cc6153aa7694f9cb91c95961e9637a9c0f207f4671145cf718189af4f4abd",
-        "size": 53000366,
-        "source": "components/google-cloud-sdk-pubsub-emulator-20260710150251.tar.gz",
+        "checksum": "4d88c9a67c3f34f2669e9461db0ca067d406f6240881e04d00840f2da3e1fe4e",
+        "contents_checksum": "cfe5515690b9e0638c597a6f1476f6b27a8095c9f6f2c887384420dd9b16d116",
+        "size": 53008490,
+        "source": "components/google-cloud-sdk-pubsub-emulator-20260814074256.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -6765,8 +6765,8 @@
       "platform": {},
       "platform_required": false,
       "version": {
-        "build_number": 20260710150251,
-        "version_string": "0.8.34"
+        "build_number": 20260814074256,
+        "version_string": "0.8.35"
       }
     },
     {
@@ -7985,10 +7985,10 @@
     },
     {
       "data": {
-        "checksum": "79a897b67c84d3e91b276075aa5231290dfd5c65017f5c01f83bc4d053ffa220",
-        "contents_checksum": "3545ecf221daa4ce972b11b88cb6ae55e8c0d92e43c01350bf45d48551a025dd",
-        "size": 64010748,
-        "source": "components/google-cloud-sdk-tests-20260731054104.tar.gz",
+        "checksum": "0db579165ba1ee59f46b7772298b070a47f775d57e45ec414260445a5d917426",
+        "contents_checksum": "f530583ef6822009960bdc9e0fa9973081838876815f3142faa9c8f5f7309cfa",
+        "size": 102176840,
+        "source": "components/google-cloud-sdk-tests-20260814074256.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -8006,8 +8006,8 @@
       "platform": {},
       "platform_required": false,
       "version": {
-        "build_number": 20260731054104,
-        "version_string": "2026.07.31"
+        "build_number": 20260814074256,
+        "version_string": "2026.08.14"
       }
     },
     {
@@ -8160,11 +8160,11 @@
   ],
   "post_processing_command": "components post-process",
   "release_notes_url": "RELEASE_NOTES",
-  "revision": 20260731054104,
+  "revision": 20260814074256,
   "schema_version": {
     "no_update": false,
     "url": "https://dl.google.com/dl/cloudsdk/channels/rapid/google-cloud-sdk.tar.gz",
     "version": 3
   },
-  "version": "579.0.0"
+  "version": "581.0.0"
 }
diff --git a/pkgs/by-name/go/google-cloud-sdk/data.nix b/pkgs/by-name/go/google-cloud-sdk/data.nix
index 01af9edd747d..a4a60bc2622e 100644
--- a/pkgs/by-name/go/google-cloud-sdk/data.nix
+++ b/pkgs/by-name/go/google-cloud-sdk/data.nix
@@ -1,23 +1,23 @@
 # DO NOT EDIT! This file is generated automatically by update.sh
 { }:
 {
-  version = "579.0.0";
+  version = "581.0.0";
   googleCloudSdkPkgs = {
     x86_64-linux = {
-      url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-579.0.0-linux-x86_64.tar.gz";
-      sha256 = "1mqns1dkngv41hk9cr41pjcy1315sz9bq79ghq4sqw7ybyaapa3b";
+      url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-581.0.0-linux-x86_64.tar.gz";
+      sha256 = "14gvc7c0cha7v7jv4bkisc0m3q018kr989agi7hma4xgqmdwzrij";
     };
     aarch64-linux = {
-      url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-579.0.0-linux-arm.tar.gz";
-      sha256 = "0nrp4nycn221a6nrjmkb2rbm1rfcyq9as3alx4qxlhacl9cv327p";
+      url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-581.0.0-linux-arm.tar.gz";
+      sha256 = "1l00qdriqnnzdbd134v565p3ii50fx133wca5am6qf04yqnwbpyd";
     };
     aarch64-darwin = {
-      url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-579.0.0-darwin-arm.tar.gz";
-      sha256 = "1bbcl9f312bl2bng46vsnqg238prl1129wg7bij2rzmikvmmhdvq";
+      url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-581.0.0-darwin-arm.tar.gz";
+      sha256 = "1pabqk9nk2gfmzgp1kfw9qv3v2qk1asxsg5qzyyyn0n353y7jnsx";
     };
     i686-linux = {
-      url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-579.0.0-linux-x86.tar.gz";
-      sha256 = "1csy7l94f4xj5n3gpss1r6dfpr2cx3gvsfgfvhzrs2b48yjk39kc";
+      url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-581.0.0-linux-x86.tar.gz";
+      sha256 = "06lihs49m98mznzr9j6v03pfcqnjf5qvwrqwdr3wzas9kch56qyf";
     };
   };
 }
diff --git a/pkgs/by-name/gr/graphviz/package.nix b/pkgs/by-name/gr/graphviz/package.nix
index 6eae0490bca2..1a0439dbe8cc 100644
--- a/pkgs/by-name/gr/graphviz/package.nix
+++ b/pkgs/by-name/gr/graphviz/package.nix
@@ -40,13 +40,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "graphviz";
-  version = "15.1.0";
+  version = "15.1.1";
 
   src = fetchFromGitLab {
     owner = "graphviz";
     repo = "graphviz";
     tag = finalAttrs.version;
-    hash = "sha256-5v/ib8hwqHrJLs+jvDGvg0aJiKIt8ipXEd1EUzew7XU=";
+    hash = "sha256-nDuLQfYu0fzJXS8/oH6Bv9gGuLK+FwwgbPQE+nVKelw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gs/gsl-lite/package.nix b/pkgs/by-name/gs/gsl-lite/package.nix
index 07e497660fd5..dcb5734c1779 100644
--- a/pkgs/by-name/gs/gsl-lite/package.nix
+++ b/pkgs/by-name/gs/gsl-lite/package.nix
@@ -7,13 +7,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "gsl-lite";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "gsl-lite";
     repo = "gsl-lite";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lX4s/HyDIEhn7PNyCocFYhizTx6CSkSfmGCSU+eqOYw=";
+    hash = "sha256-mTZGYVwQqTz3sfnuB4c+du1jcqVxDYZPIC9yE8nGZH8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gt/gtest/package.nix b/pkgs/by-name/gt/gtest/package.nix
index 49d5de368f04..fec50046d186 100644
--- a/pkgs/by-name/gt/gtest/package.nix
+++ b/pkgs/by-name/gt/gtest/package.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "google";
     repo = "googletest";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-HIHMxAUR4bjmFLoltJeIAVSulVQ6kVuIT2Ku+lwAx/4=";
   };
 
@@ -56,6 +56,8 @@ stdenv.mkDerivation (finalAttrs: {
     re2
   ];
 
+  strictDeps = true;
+
   cmakeFlags = [
     "-DBUILD_SHARED_LIBS=${if static then "OFF" else "ON"}"
   ]
@@ -64,6 +66,8 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optional withAbseil "-DGTEST_HAS_ABSL=ON";
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Google's framework for writing C++ tests";
     homepage = "https://github.com/google/googletest";
diff --git a/pkgs/by-name/gt/gtk-doc/package.nix b/pkgs/by-name/gt/gtk-doc/package.nix
index 9f58e9fb8f75..475149609a7b 100644
--- a/pkgs/by-name/gt/gtk-doc/package.nix
+++ b/pkgs/by-name/gt/gtk-doc/package.nix
@@ -14,7 +14,7 @@
   dblatex,
 }:
 
-python3.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "gtk-doc";
   version = "1.36.1";
 
@@ -26,7 +26,7 @@ python3.pkgs.buildPythonApplication rec {
     domain = "gitlab.gnome.org";
     owner = "GNOME";
     repo = "gtk-doc";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-8hB43BCAtT1B7/ak2i0FAlYD3Kb4rNCWfsJ+wqGu3FA=";
   };
 
@@ -85,12 +85,14 @@ python3.pkgs.buildPythonApplication rec {
     };
   };
 
+  __structuredAttrs = true;
+
   meta = {
-    changelog = "https://gitlab.gnome.org/GNOME/gtk-doc/-/blob/${src.tag}/NEWS";
+    changelog = "https://gitlab.gnome.org/GNOME/gtk-doc/-/blob/${finalAttrs.src.tag}/NEWS";
     description = "Tools to extract documentation embedded in GTK and GNOME source code";
     homepage = "https://gitlab.gnome.org/GNOME/gtk-doc";
     license = lib.licenses.gpl2Plus;
     maintainers = with lib.maintainers; [ pSub ];
     teams = [ lib.teams.gnome ];
   };
-}
+})
diff --git a/pkgs/by-name/ha/harlequin/package.nix b/pkgs/by-name/ha/harlequin/package.nix
index 6e0ea05f5e84..a5e71d3d81d0 100644
--- a/pkgs/by-name/ha/harlequin/package.nix
+++ b/pkgs/by-name/ha/harlequin/package.nix
@@ -13,7 +13,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "harlequin";
-  version = "2.9.0";
+  version = "2.10.0";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -21,7 +21,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "tconbeer";
     repo = "harlequin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3GpchONAU+FAFh82E1vZ2tXqo536qpQaVbECyjnH6K4=";
+    hash = "sha256-TD6i+nlZncr8yNGYsEqIuRbYU/5DoHIoDaHih4S/7Vw=";
   };
 
   build-system = with python3Packages; [ hatchling ];
@@ -38,7 +38,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     [
       click
       duckdb
-      pandas
+      msgspec
       platformdirs
       pyarrow
       pyperclip
@@ -67,6 +67,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   nativeCheckInputs = with python3Packages; [
     flaky
+    jsonschema
     pytest-asyncio
     pytest-textual-snapshot
     pytest-xdist
diff --git a/pkgs/by-name/hd/hdrhistogram_c/package.nix b/pkgs/by-name/hd/hdrhistogram_c/package.nix
index 3ebcbe73e089..4c0f3a16cfeb 100644
--- a/pkgs/by-name/hd/hdrhistogram_c/package.nix
+++ b/pkgs/by-name/hd/hdrhistogram_c/package.nix
@@ -32,6 +32,20 @@ stdenv.mkDerivation (finalAttrs: {
     validatePkgConfig
   ];
 
+  cmakeFlags = lib.optionals stdenv.hostPlatform.isStatic [
+    (lib.cmakeBool "HDR_HISTOGRAM_BUILD_SHARED" false)
+    # Examples and tests depend on the shared library target; skip them in
+    # static builds (tests still run for the regular pkgs.hdrhistogram_c build).
+    (lib.cmakeBool "HDR_HISTOGRAM_BUILD_PROGRAMS" false)
+  ];
+
+  # The .pc file always references -lhdr_histogram, but in static builds only
+  # libhdr_histogram_static.a is produced. Provide a symlink so pkg-config
+  # consumers find the right archive.
+  postInstall = lib.optionalString stdenv.hostPlatform.isStatic ''
+    ln -s $out/lib/libhdr_histogram_static.a $out/lib/libhdr_histogram.a
+  '';
+
   doCheck = true;
 
   passthru = {
diff --git a/pkgs/by-name/he/help2man/package.nix b/pkgs/by-name/he/help2man/package.nix
index aee62e34cb57..7e19937f788d 100644
--- a/pkgs/by-name/he/help2man/package.nix
+++ b/pkgs/by-name/he/help2man/package.nix
@@ -56,6 +56,8 @@ stdenv.mkDerivation (finalAttrs: {
     chmod +x $out/bin/help2man
   '';
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Generate man pages from `--help' output";
     mainProgram = "help2man";
diff --git a/pkgs/by-name/he/heroic-unwrapped/fix-non-steam-shortcuts.patch b/pkgs/by-name/he/heroic-unwrapped/fix-non-steam-shortcuts.patch
index 7b46473245f7..2c771441ca8a 100644
--- a/pkgs/by-name/he/heroic-unwrapped/fix-non-steam-shortcuts.patch
+++ b/pkgs/by-name/he/heroic-unwrapped/fix-non-steam-shortcuts.patch
@@ -1,11 +1,11 @@
 diff --git a/src/backend/shortcuts/nonesteamgame/nonesteamgame.ts b/src/backend/shortcuts/nonesteamgame/nonesteamgame.ts
-index ebef6aa4..c8bd853d 100644
+index 28c917ce..f3b09c55 100644
 --- a/src/backend/shortcuts/nonesteamgame/nonesteamgame.ts
 +++ b/src/backend/shortcuts/nonesteamgame/nonesteamgame.ts
-@@ -252,7 +252,7 @@ async function addNonSteamGame(props: {
+@@ -255,7 +255,7 @@ async function addNonSteamGame(game: Game): Promise<boolean> {
      // add new Entry
      const newEntry = {} as ShortcutEntry
-     newEntry.AppName = props.gameInfo.title
+     newEntry.AppName = gameInfo.title
 -    newEntry.Exe = `"${app.getPath('exe')}"`
 +    newEntry.Exe = `"heroic"`
      newEntry.StartDir = `"${process.cwd()}"`
diff --git a/pkgs/by-name/he/heroic-unwrapped/legendary.nix b/pkgs/by-name/he/heroic-unwrapped/legendary.nix
deleted file mode 100644
index 2f968468aeba..000000000000
--- a/pkgs/by-name/he/heroic-unwrapped/legendary.nix
+++ /dev/null
@@ -1,45 +0,0 @@
-{
-  lib,
-  gitUpdater,
-  fetchFromGitHub,
-  python3Packages,
-}:
-
-python3Packages.buildPythonApplication (finalAttrs: {
-  pname = "legendary-heroic";
-  version = "0.20.43";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "Heroic-Games-Launcher";
-    repo = "legendary";
-    tag = finalAttrs.version;
-    hash = "sha256-EQBrj+GOmVD0ZEArOk1Me4LLKbs6Ezl1lTzD0k5uUsQ=";
-  };
-
-  build-system = with python3Packages; [
-    setuptools
-  ];
-
-  dependencies = with python3Packages; [
-    requests
-    requests-futures
-    filelock
-    pycryptodomex
-  ];
-
-  pythonImportsCheck = [ "legendary" ];
-
-  passthru.updateScript = gitUpdater { };
-
-  meta = {
-    description = "Free and open-source Epic Games Launcher alternative";
-    longDescription = ''
-      This is the Heroic Games Launcher's fork of legendary.
-    '';
-    homepage = "https://github.com/Heroic-Games-Launcher/legendary";
-    license = lib.licenses.gpl3;
-    maintainers = [ ];
-    mainProgram = "legendary";
-  };
-})
diff --git a/pkgs/by-name/he/heroic-unwrapped/package.nix b/pkgs/by-name/he/heroic-unwrapped/package.nix
index 8f0bdf3cbe88..397ce98563be 100644
--- a/pkgs/by-name/he/heroic-unwrapped/package.nix
+++ b/pkgs/by-name/he/heroic-unwrapped/package.nix
@@ -12,9 +12,10 @@
   makeWrapper,
   # Electron updates can break Heroic, so try to use same version as upstream.
   # If the used electron version is higher than upstream's then the node-abi package might need to be updated
-  electron,
+  electron_43,
   vulkan-helper,
   gogdl,
+  legendary-gl,
   nile,
   comet-gog_heroic,
   umu-launcher,
@@ -22,20 +23,20 @@
 
 let
   pnpm = pnpm_10;
+  electron = electron_43;
 
-  legendary = callPackage ./legendary.nix { };
   epic-integration = callPackage ./epic-integration.nix { };
   comet-gog = comet-gog_heroic;
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "heroic-unwrapped";
-  version = "2.22.0";
+  version = "2.22.1";
 
   src = fetchFromGitHub {
     owner = "Heroic-Games-Launcher";
     repo = "HeroicGamesLauncher";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-RDJDeL5exEzF2BhEWoiXWsTpV5hytrB6RDoXV0mTWTw=";
+    hash = "sha256-CpbCXmvfwXT16ZG/6fwPWSjBwK02ykJ/GuZk1VcW+tU=";
   };
 
   pnpmDeps = fetchPnpmDeps {
@@ -47,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
       ;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-lPHL6pA39hvEtq5WkcAXfcY3a0VPseQL/nI+oEjIZeE=";
+    hash = "sha256-NrglT9vtDMAYXmZ4G3vifvLXu1yS6xbp+cqE6B6vQFc=";
   };
 
   nativeBuildInputs = [
@@ -96,7 +97,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     ln -s \
       "${lib.getExe gogdl}" \
-      "${lib.getExe legendary}" \
+      "${lib.getExe legendary-gl}" \
       "${lib.getExe nile}" \
       "${lib.getExe comet-gog}" \
       "${lib.getExe vulkan-helper}" \
@@ -131,7 +132,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   passthru = {
-    inherit epic-integration legendary;
+    inherit epic-integration;
   };
 
   meta = {
diff --git a/pkgs/by-name/in/intel-graphics-compiler/package.nix b/pkgs/by-name/in/intel-graphics-compiler/package.nix
index 2443b412dd65..544fb1a1f2e5 100644
--- a/pkgs/by-name/in/intel-graphics-compiler/package.nix
+++ b/pkgs/by-name/in/intel-graphics-compiler/package.nix
@@ -92,14 +92,26 @@ stdenv.mkDerivation rec {
     chmod +x igc/IGC/Scripts/igc_create_linker_script.sh
     patchShebangs --build igc/IGC/Scripts/igc_create_linker_script.sh
 
-    # The build system only applies patches when the sources are in a Git repository.
-    git -C llvm-project init
-    git -C llvm-project add .
-    git -C llvm-project -c user.name=nixbld -c user.email= commit -m stub
+    # Their slapdash CMake code checks the exit code of "git rev-parse" whether patches must be applied.
+    # Since we do not have a full git repo and cannot clone one due to reproducibility issues,
+    # git exits with 128 which is in newer versions of opencl-clang logged as a STATUS, but does not abort either.
+    # We could hack around this, but since we are certain we want the patches (eg for CL3.1), we just shortcircuit the condition.
+    substituteInPlace llvm-project/llvm/projects/opencl-clang/cmake/modules/CMakeFunctions.cmake \
+      --replace-fail "if(patches_needed EQUAL 1)" "if(TRUE)"
 
+    # "git am" wants to check the git history if the commit is already applied, but we do not have that.
+    # "git apply" works very similar, but without a git history and supports the same options unlike patch.
     substituteInPlace llvm-project/llvm/projects/opencl-clang/cmake/modules/CMakeFunctions.cmake \
       --replace-fail 'COMMAND ''${GIT_EXECUTABLE} am --3way --keep-non-patch --ignore-whitespace -C0 ' \
                      'COMMAND ''${GIT_EXECUTABLE} apply --3way --ignore-whitespace -C0 '
+
+    # The build system only applies patches when the sources are in a Git repository.
+    export HOME=$(mktemp -d)
+    git config --global user.email ""
+    git config --global user.name nixbld
+    git -C llvm-project init
+    git -C llvm-project add .
+    git -C llvm-project commit -m stub >/dev/null
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ip/iproute2/package.nix b/pkgs/by-name/ip/iproute2/package.nix
index 2ad8fa7c8a26..dd3baede3a0f 100644
--- a/pkgs/by-name/ip/iproute2/package.nix
+++ b/pkgs/by-name/ip/iproute2/package.nix
@@ -16,24 +16,25 @@
   pkgsStatic,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "iproute2";
   version = "7.1.0";
 
   src = fetchurl {
-    url = "mirror://kernel/linux/utils/net/iproute2/iproute2-${version}.tar.xz";
+    url = "mirror://kernel/linux/utils/net/iproute2/iproute2-${finalAttrs.version}.tar.xz";
     hash = "sha256-/Z+huVgJQXFXyoPdcpV+MmG9vOiWNTy5NvgK8LM6S1w=";
   };
 
   postPatch = ''
     substituteInPlace Makefile \
-      --replace "CC := gcc" "CC ?= $CC"
+      --replace-fail "CC := gcc" "CC ?= $CC"
   '';
 
   outputs = [
     "out"
     "dev"
     "scripts"
+    "man"
   ];
 
   configureFlags = [
@@ -44,7 +45,6 @@ stdenv.mkDerivation rec {
   makeFlags = [
     "PREFIX=$(out)"
     "SBINDIR=$(out)/sbin"
-    "DOCDIR=$(TMPDIR)/share/doc/${pname}" # Don't install docs
     "HDRDIR=$(dev)/include/iproute2"
   ]
   ++ lib.optionals stdenv.hostPlatform.isStatic [
@@ -86,6 +86,8 @@ stdenv.mkDerivation rec {
     libbpf
   ];
 
+  __structuredAttrs = true;
+  strictDeps = true;
   enableParallelBuilding = true;
 
   passthru.updateScript = gitUpdater {
@@ -105,4 +107,4 @@ stdenv.mkDerivation rec {
       fpletz
     ];
   };
-}
+})
diff --git a/pkgs/by-name/ja/jackett/deps.json b/pkgs/by-name/ja/jackett/deps.json
index d67bcbde106a..691a93559d21 100644
--- a/pkgs/by-name/ja/jackett/deps.json
+++ b/pkgs/by-name/ja/jackett/deps.json
@@ -11,8 +11,8 @@
   },
   {
     "pname": "AngleSharp.Xml",
-    "version": "1.1.0",
-    "hash": "sha256-EPKraxfylSFngnba58kosmo4AHEUwK1fv7qiIZAFi14="
+    "version": "1.2.0",
+    "hash": "sha256-o03pwOwChufKpUzy4vneETKc1UC/oBvW2FOeTxeH4e4="
   },
   {
     "pname": "Autofac",
@@ -51,8 +51,8 @@
   },
   {
     "pname": "FluentAssertions",
-    "version": "6.12.1",
-    "hash": "sha256-R/Fi9eee6T8t8JECxL9+HFd8jAxRMkCg18j+fAQLNqM="
+    "version": "7.2.2",
+    "hash": "sha256-FI9qH9n0Qu8XpevIQghgMOO82VZSz9FjgnMIvymJPAI="
   },
   {
     "pname": "Microsoft.ApplicationInsights",
@@ -61,54 +61,54 @@
   },
   {
     "pname": "Microsoft.AspNetCore.Cryptography.Internal",
-    "version": "9.0.18",
-    "hash": "sha256-2sigYMwiq5w/E2EFTXf1D0IjWW4/1HQMH4HOYfYTYtw="
+    "version": "9.0.19",
+    "hash": "sha256-XPsSeFa0wITp9+biWgvNcgr1BL1CbYcF/hTn+cTNOWs="
   },
   {
     "pname": "Microsoft.AspNetCore.DataProtection",
-    "version": "9.0.18",
-    "hash": "sha256-wLswQ5CrFv93sZ1ZKhxUW1FrWH2KBp96GTqZrozuBVI="
+    "version": "9.0.19",
+    "hash": "sha256-NA7D/y1ERjUsc4up1fm6Yo/3NIBOi1sRnpX95A7fpe0="
   },
   {
     "pname": "Microsoft.AspNetCore.DataProtection.Abstractions",
-    "version": "9.0.18",
-    "hash": "sha256-Rpas+cH+OSP80wwQ448h0rFUbUG74XJHNtQLL9fUcR4="
+    "version": "9.0.19",
+    "hash": "sha256-fndKWkxrJkY+r7Lv8wINW4uKG5N7mg1O7AEO7qaXmjY="
   },
   {
     "pname": "Microsoft.AspNetCore.Http",
-    "version": "2.3.11",
-    "hash": "sha256-Wy+HphsrkH6r9ljPfQ+k1bgL/nsUKR5A9iCJ7DP33d4="
+    "version": "2.3.12",
+    "hash": "sha256-aXJG/CHxIdPr2Lhcr9iVrQLQLFGL74pQSoIpIdxSDsQ="
   },
   {
     "pname": "Microsoft.AspNetCore.Http.Abstractions",
-    "version": "2.3.10",
-    "hash": "sha256-TlgQug0JPR5vsFsxU0btpa4SbLSLLKZ2T8izyZpkZtM="
+    "version": "2.3.11",
+    "hash": "sha256-TZ29MQF9aJ+Iy3NSszVVDypEv7wXhWfLf5dp1uxxuCA="
   },
   {
     "pname": "Microsoft.AspNetCore.Http.Features",
-    "version": "2.3.9",
-    "hash": "sha256-9VJKZ5adBKRrVp+XRWEQiazv9Q6jj7noT/X693djVgQ="
+    "version": "2.3.10",
+    "hash": "sha256-XD/AU/0g+jriODowOVSPKGrjyQV1OlDrICmAq6xGJ9g="
   },
   {
     "pname": "Microsoft.AspNetCore.JsonPatch",
-    "version": "9.0.18",
-    "hash": "sha256-tKaK64BnFoj/J2DM4qSvO/zQ5alPLEasm6pr3+Tp3CM="
+    "version": "9.0.19",
+    "hash": "sha256-6kBV2zvRNS8SMsOdxW0lxjU7E0YvrD/4WP8bX2GXtag="
   },
   {
     "pname": "Microsoft.AspNetCore.Mvc.NewtonsoftJson",
-    "version": "9.0.18",
-    "hash": "sha256-jbOBm5T8ZlBhips96MI7u7JBLhNT/dX5eHjUQ6cw+dI="
-  },
-  {
-    "pname": "Microsoft.AspNetCore.WebUtilities",
-    "version": "2.3.10",
-    "hash": "sha256-XuHgYt83oinCBcCfY1FJa1PWj/t5kvg/YPse0DlYiUA="
+    "version": "9.0.19",
+    "hash": "sha256-j9Gc0hFdHhTQYXiUfZIJs1l8LOh5yfJ1Pge3qr1HlJg="
   },
   {
     "pname": "Microsoft.AspNetCore.WebUtilities",
     "version": "2.3.11",
     "hash": "sha256-HAGuLuTRLkTTcP9oqRpqPYQmIzQTecUWHI/UTAJ2iMY="
   },
+  {
+    "pname": "Microsoft.AspNetCore.WebUtilities",
+    "version": "2.3.12",
+    "hash": "sha256-js0KyvQlV2ZeQxuLHU8dNj6N1szO3xP3RPo0tpGjPFo="
+  },
   {
     "pname": "Microsoft.Bcl.AsyncInterfaces",
     "version": "6.0.0",
@@ -126,8 +126,8 @@
   },
   {
     "pname": "Microsoft.Bcl.AsyncInterfaces",
-    "version": "9.0.18",
-    "hash": "sha256-FscIiUzpg4lqoV4XU+qHKw1BipCPkC+twxRqcDDy4xo="
+    "version": "9.0.19",
+    "hash": "sha256-7K4FZvcCfZ1vkd5Q3B1Vbd6kURvqlwT960Y79YxAP5E="
   },
   {
     "pname": "Microsoft.Bcl.TimeProvider",
@@ -146,8 +146,8 @@
   },
   {
     "pname": "Microsoft.Extensions.Configuration",
-    "version": "9.0.18",
-    "hash": "sha256-Th2ejKhzEMKV1FUoj+74zhJIg3jaFhWmtci2utqfIn8="
+    "version": "9.0.19",
+    "hash": "sha256-/pAqE0AtGGYanAmk83vjrwNXIjwpHf5l1x3fJfTsnko="
   },
   {
     "pname": "Microsoft.Extensions.Configuration.Abstractions",
@@ -156,8 +156,8 @@
   },
   {
     "pname": "Microsoft.Extensions.Configuration.Abstractions",
-    "version": "9.0.18",
-    "hash": "sha256-e0ABlyKnPhqtd875N0d04E4bdYWe5MOHK7YZzFM9nnY="
+    "version": "9.0.19",
+    "hash": "sha256-C6zP/A5xBGd4tj+pV7XRL0IInYAB36OqMFP1/DD2dH4="
   },
   {
     "pname": "Microsoft.Extensions.DependencyInjection",
@@ -171,23 +171,23 @@
   },
   {
     "pname": "Microsoft.Extensions.DependencyInjection.Abstractions",
-    "version": "9.0.18",
-    "hash": "sha256-xpAbVQ2HlbLiEETz+IHa0Sih68j0HARbUCk423SCdYg="
+    "version": "9.0.19",
+    "hash": "sha256-gUwYr6vb5Y+Nl2PtBgx4xrYgMz6/OgIZNz9hv3cm7aQ="
   },
   {
     "pname": "Microsoft.Extensions.Diagnostics.Abstractions",
-    "version": "9.0.18",
-    "hash": "sha256-Or2ZUfYxYXZ7DrLYCPnkRhsKed4u0/ZElHrg65eovqY="
+    "version": "9.0.19",
+    "hash": "sha256-UfntG1BQUaDIzlJr4+QBDSiqgz90MTnXBQQoyoMtdLk="
   },
   {
     "pname": "Microsoft.Extensions.FileProviders.Abstractions",
-    "version": "9.0.18",
-    "hash": "sha256-SSERP6+GvZld+YjmGeAuwt6STik/aA8dR1v/7/kTiHo="
+    "version": "9.0.19",
+    "hash": "sha256-WryzNdWfXpJLY1PqDnO6K9/EXYVK/p0HnxJn7cdi/kI="
   },
   {
     "pname": "Microsoft.Extensions.Hosting.Abstractions",
-    "version": "9.0.18",
-    "hash": "sha256-VLWUfFSry5RZz+oA6xqaF751QiOQmHKQftDoFbiMzCs="
+    "version": "9.0.19",
+    "hash": "sha256-Bk5FEVg4eotiX1jh62XrVnnXhw2tqpIhGuVJ7opfnMQ="
   },
   {
     "pname": "Microsoft.Extensions.Logging",
@@ -201,8 +201,8 @@
   },
   {
     "pname": "Microsoft.Extensions.Logging.Abstractions",
-    "version": "9.0.18",
-    "hash": "sha256-wIfMBf7I1KuDIOyAuIML1Y9cZWkxYUdM3PercoEmSUM="
+    "version": "9.0.19",
+    "hash": "sha256-NUEhzO7a6dhWCLkGA+Op4+60S4jWSDZmh/WH0gr81Yk="
   },
   {
     "pname": "Microsoft.Extensions.ObjectPool",
@@ -221,8 +221,8 @@
   },
   {
     "pname": "Microsoft.Extensions.Options",
-    "version": "9.0.18",
-    "hash": "sha256-AqEIL9qf6OJ4nzZZ/GT/53nz4TQofShVrDQhru/RgZs="
+    "version": "9.0.19",
+    "hash": "sha256-mUd8YqUvGJZSaV7vJ1RN7T/+fU81dwblBLATS8QmxxY="
   },
   {
     "pname": "Microsoft.Extensions.Primitives",
@@ -231,13 +231,13 @@
   },
   {
     "pname": "Microsoft.Extensions.Primitives",
-    "version": "9.0.18",
-    "hash": "sha256-4WejEhNikEJEmlYxjqM5DpAeGH5LiaK9TVtZIBU56ck="
+    "version": "9.0.19",
+    "hash": "sha256-/DpiE48An/Ir7IVQ6+U3FY/e7LcJE1ED4U8mdBu0F4Q="
   },
   {
     "pname": "Microsoft.Net.Http.Headers",
-    "version": "2.3.10",
-    "hash": "sha256-4LG06n+vo2bFpg9dQ9NSLvVf7rQfiD+k0FEq5S6tDsE="
+    "version": "2.3.11",
+    "hash": "sha256-/6ttqU89/nmwSk6KmlbpoKsWqRyS9f0NhvxpnLF0s7E="
   },
   {
     "pname": "Microsoft.NET.Test.Sdk",
@@ -299,6 +299,11 @@
     "version": "17.14.1",
     "hash": "sha256-1cxHWcvHRD7orQ3EEEPPxVGEkTpxom1/zoICC9SInJs="
   },
+  {
+    "pname": "Microsoft.Win32.SystemEvents",
+    "version": "6.0.0",
+    "hash": "sha256-N9EVZbl5w1VnMywGXyaVWzT9lh84iaJ3aD48hIBk1zA="
+  },
   {
     "pname": "MimeMapping",
     "version": "1.0.1.50",
@@ -441,8 +446,8 @@
   },
   {
     "pname": "System.Configuration.ConfigurationManager",
-    "version": "4.4.0",
-    "hash": "sha256-+8wGYllXnIxRzy9dLhZFB88GoPj8ivYXS0KUfcivT8I="
+    "version": "6.0.0",
+    "hash": "sha256-fPV668Cfi+8pNWrvGAarF4fewdPVEDwlJWvJk0y+Cms="
   },
   {
     "pname": "System.Diagnostics.DiagnosticSource",
@@ -456,8 +461,13 @@
   },
   {
     "pname": "System.Diagnostics.EventLog",
-    "version": "9.0.18",
-    "hash": "sha256-pJBU/x5x1qwEjtSjkuTwVB6z04gAxMPPXOSdUIgYe1M="
+    "version": "9.0.19",
+    "hash": "sha256-0wH4FC8pNPr/ImPjID4Eo+MNagrqzQ58p7QLLFWek7g="
+  },
+  {
+    "pname": "System.Drawing.Common",
+    "version": "6.0.0",
+    "hash": "sha256-/9EaAbEeOjELRSMZaImS1O8FmUe8j4WuFUw1VOrPyAo="
   },
   {
     "pname": "System.IO.FileSystem.AccessControl",
@@ -476,8 +486,8 @@
   },
   {
     "pname": "System.IO.Pipelines",
-    "version": "9.0.18",
-    "hash": "sha256-JacrrdrxR6u7aVjeJiSDOptqAV/f3rcszgz/WdCMBkg="
+    "version": "9.0.19",
+    "hash": "sha256-Rh+QmhasR1YKSUlczvC7DyQF2NTSFo4+CL+CkflUcjc="
   },
   {
     "pname": "System.Memory",
@@ -524,25 +534,35 @@
     "version": "5.0.0",
     "hash": "sha256-ueSG+Yn82evxyGBnE49N4D+ngODDXgornlBtQ3Omw54="
   },
+  {
+    "pname": "System.Security.AccessControl",
+    "version": "6.0.0",
+    "hash": "sha256-qOyWEBbNr3EjyS+etFG8/zMbuPjA+O+di717JP9Cxyg="
+  },
   {
     "pname": "System.Security.Cryptography.Pkcs",
-    "version": "9.0.18",
-    "hash": "sha256-D16WfDikzmgkxmEspZqLa8m2UzyjgC3tivTAWCWZ87M="
+    "version": "9.0.19",
+    "hash": "sha256-NwRsuisjPKTvju0emRUkn2FTvgHMeqyr98SbToq9Y4U="
   },
   {
     "pname": "System.Security.Cryptography.ProtectedData",
-    "version": "4.4.0",
-    "hash": "sha256-Ri53QmFX8I8UH0x4PikQ1ZA07ZSnBUXStd5rBfGWFOE="
+    "version": "6.0.0",
+    "hash": "sha256-Wi9I9NbZlpQDXgS7Kl06RIFxY/9674S7hKiYw5EabRY="
   },
   {
     "pname": "System.Security.Cryptography.ProtectedData",
-    "version": "9.0.18",
-    "hash": "sha256-JfLdZjyzoRDHV2a6jGwq/xwuGy3T0XZNGB3zK9IAPBE="
+    "version": "9.0.19",
+    "hash": "sha256-f+9uhACebKboLUKT/W1XaRd73QyxA/EloGKx7JKn/8s="
   },
   {
     "pname": "System.Security.Cryptography.Xml",
-    "version": "9.0.18",
-    "hash": "sha256-OzwTTsPo8Gui1xs4+zlILwvZgbcxXJ97m3ejKqnebu4="
+    "version": "9.0.19",
+    "hash": "sha256-SXeOC+lW55jDpSSm+d1dbops2PH/UBiPp4FsJ/hJOvQ="
+  },
+  {
+    "pname": "System.Security.Permissions",
+    "version": "6.0.0",
+    "hash": "sha256-/MMvtFWGN/vOQfjXdOhet1gsnMgh6lh5DCHimVsnVEs="
   },
   {
     "pname": "System.Security.Principal.Windows",
@@ -551,13 +571,13 @@
   },
   {
     "pname": "System.ServiceProcess.ServiceController",
-    "version": "9.0.18",
-    "hash": "sha256-LGttR/XVbEu/ZKz9Np0hTjP0t1TP/3lkQfGxWrhhT10="
+    "version": "9.0.19",
+    "hash": "sha256-wbc8AJNktbSvBZOPFEgpUjt4SnTTG8Tyj3O5OLA4jq8="
   },
   {
     "pname": "System.Text.Encoding.CodePages",
-    "version": "9.0.18",
-    "hash": "sha256-g5Ps501kdW4XXvSQrwb8qJq71I+P48+2T41uBkx42VA="
+    "version": "9.0.19",
+    "hash": "sha256-M+NQmMFdvckrIeucrG7MGu5+OyQsOMrcvM6soY+GcJU="
   },
   {
     "pname": "System.Text.Encodings.Web",
@@ -566,13 +586,13 @@
   },
   {
     "pname": "System.Text.Encodings.Web",
-    "version": "9.0.18",
-    "hash": "sha256-DTjo1Iqkf8qIdwYPKKeddiiU78j/OCvrMITJ3vlPdhU="
+    "version": "9.0.19",
+    "hash": "sha256-VsJS/iiDZp41BY4fcqGZZAh0PYT+H5N13FMPfFeBDX8="
   },
   {
     "pname": "System.Text.Json",
-    "version": "9.0.18",
-    "hash": "sha256-tClFgkq64oP9F4UEZhi2SrvVCkgnOmjVn7p0sbpiwEw="
+    "version": "9.0.19",
+    "hash": "sha256-GbQS+KeI1Q5c9oNG3zERALc52l8RIlgYKmvXNbvbC7M="
   },
   {
     "pname": "System.Threading.Tasks.Extensions",
@@ -584,6 +604,11 @@
     "version": "4.5.4",
     "hash": "sha256-owSpY8wHlsUXn5xrfYAiu847L6fAKethlvYx97Ri1ng="
   },
+  {
+    "pname": "System.Windows.Extensions",
+    "version": "6.0.0",
+    "hash": "sha256-N+qg1E6FDJ9A9L50wmVt3xPQV8ZxlG1xeXgFuxO+yfM="
+  },
   {
     "pname": "YamlDotNet",
     "version": "18.1.0",
diff --git a/pkgs/by-name/ja/jackett/package.nix b/pkgs/by-name/ja/jackett/package.nix
index ef0c3f036e6e..f26ddba96e85 100644
--- a/pkgs/by-name/ja/jackett/package.nix
+++ b/pkgs/by-name/ja/jackett/package.nix
@@ -12,13 +12,13 @@
 
 buildDotnetModule (finalAttrs: {
   pname = "jackett";
-  version = "0.24.2406";
+  version = "0.24.2457";
 
   src = fetchFromGitHub {
     owner = "jackett";
     repo = "jackett";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-IFz5U91ukmmx53Z7VOmvD+zuqzSf35k1SknjJOGDB6E=";
+    hash = "sha256-oLKej0+Loiwn2yEAOHMeCqv1fU4d0vd7nzX/uTl3dFU=";
   };
 
   projectFile = "src/Jackett.Server/Jackett.Server.csproj";
diff --git a/pkgs/by-name/jq/jq/package.nix b/pkgs/by-name/jq/jq/package.nix
index 762562f1c7b3..fdd171b08316 100644
--- a/pkgs/by-name/jq/jq/package.nix
+++ b/pkgs/by-name/jq/jq/package.nix
@@ -59,6 +59,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   strictDeps = true;
+  __structuredAttrs = true;
   enableParallelBuilding = true;
 
   buildInputs = lib.optionals onigurumaSupport [ oniguruma ];
diff --git a/pkgs/by-name/ju/judy/no-struct-hack.patch b/pkgs/by-name/ju/judy/no-struct-hack.patch
new file mode 100644
index 000000000000..d11f931000fb
--- /dev/null
+++ b/pkgs/by-name/ju/judy/no-struct-hack.patch
@@ -0,0 +1,19 @@
+diff --git a/src/JudySL/JudySL.c b/src/JudySL/JudySL.c
+index d7314a7..6252bab 100644
+--- a/src/JudySL/JudySL.c
++++ b/src/JudySL/JudySL.c
+@@ -184,12 +184,12 @@
+ typedef struct SHORCUTLEAF
+ {
+     Pvoid_t   scl_Pvalue;               // callers value area.
+-    uint8_t   scl_Index[WORDSIZE];      // base Index string.
++    uint8_t   scl_Index[];              // base Index string.
+ } scl_t  , *Pscl_t;
+ 
+ // overhead of the scl_Pvalue only, the scl_Index is calculate elsewhere
+ 
+-#define STRUCTOVD       (sizeof(scl_t) - WORDSIZE)
++#define STRUCTOVD       (sizeof(scl_t))
+ 
+ // How big to malloc a shortcut leaf; stringlen should already include the
+ // trailing null char:
diff --git a/pkgs/by-name/ju/judy/package.nix b/pkgs/by-name/ju/judy/package.nix
index b1387dd6ccff..a90bca0aa47e 100644
--- a/pkgs/by-name/ju/judy/package.nix
+++ b/pkgs/by-name/ju/judy/package.nix
@@ -19,6 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
   depsBuildBuild = [ pkgsBuildBuild.stdenv.cc ];
   patches = [
     ./cross.patch
+    ./no-struct-hack.patch
     # Fix reproducible timestamps.
     ./fix-source-date.patch
   ];
@@ -29,6 +30,14 @@ stdenv.mkDerivation (finalAttrs: {
   # Let's wait for the upstream fix similar to https://sourceforge.net/p/judy/patches/4/
   enableParallelBuilding = false;
 
+  doCheck = true;
+
+  checkPhase = ''
+    runHook preCheck
+    make -C test check-TESTS
+    runHook postCheck
+  '';
+
   outputs = [
     "out"
     "man"
diff --git a/pkgs/by-name/kr/krep/package.nix b/pkgs/by-name/kr/krep/package.nix
index 502fc932bd7b..c65892a04640 100644
--- a/pkgs/by-name/kr/krep/package.nix
+++ b/pkgs/by-name/kr/krep/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "krep";
-  version = "3.0.0";
+  version = "3.0.1";
 
   src = fetchFromGitHub {
     owner = "davidesantangelo";
     repo = "krep";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-lLlgsIFU37m+C1pqLYH+7n9Ye6jrpSdSJQYyTISId54=";
+    hash = "sha256-w37k/A6fBJUCqI9gg126NvWxur16Bs4roBe+cgTNy8M=";
   };
 
   makeFlags = [
diff --git a/pkgs/by-name/la/lasuite-meet/frontend.nix b/pkgs/by-name/la/lasuite-meet/frontend.nix
index 80a000547394..fb28b763ab9e 100644
--- a/pkgs/by-name/la/lasuite-meet/frontend.nix
+++ b/pkgs/by-name/la/lasuite-meet/frontend.nix
@@ -17,7 +17,7 @@ buildNpmPackage (finalAttrs: {
       src
       sourceRoot
       ;
-    hash = "sha256-ZvdfLM0GlIZPaKbpDK9ymSgARVMsJE+cop8lKq3R7fE=";
+    hash = "sha256-CRq4qpdUBOPBelmrbOgrBdQxD0tY84S3YSbCTQXBkvA=";
   };
   npmBuildScript = "build";
 
diff --git a/pkgs/by-name/la/lasuite-meet/mail.nix b/pkgs/by-name/la/lasuite-meet/mail.nix
index dc03dc73bbf5..9065263ad759 100644
--- a/pkgs/by-name/la/lasuite-meet/mail.nix
+++ b/pkgs/by-name/la/lasuite-meet/mail.nix
@@ -22,7 +22,7 @@ buildNpmPackage (finalAttrs: {
     pname = "${finalAttrs.pname}-npm-deps";
     inherit version src;
     inherit (finalAttrs) sourceRoot;
-    hash = "sha256-Ojk0giCc7tTFAGOIisirMywfe5j7JCKoTnWGk/hR+U8=";
+    hash = "sha256-EpUeQpEerHfZ5nZMCanZ+ayzqKHnCeRE4MqVa8TApKk=";
   };
   npmBuildScript = "build";
 
diff --git a/pkgs/by-name/la/lasuite-meet/package.nix b/pkgs/by-name/la/lasuite-meet/package.nix
index f27c946dd496..14efb85710c8 100644
--- a/pkgs/by-name/la/lasuite-meet/package.nix
+++ b/pkgs/by-name/la/lasuite-meet/package.nix
@@ -6,13 +6,13 @@
   python3,
 }:
 let
-  version = "1.26.0";
+  version = "1.28.0";
 
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "meet";
     tag = "v${version}";
-    hash = "sha256-WiyVSqkyKDXYYPvzcA/fHcxQJrUThNGfNu+z/KcHK3g=";
+    hash = "sha256-BGYyAm4iX0/E1Fv9siRtOT9FXfpc3EAGhKwGRMTkoeQ=";
   };
 
   meta = {
diff --git a/pkgs/by-name/le/legendary-gl/package.nix b/pkgs/by-name/le/legendary-gl/package.nix
index a002532fa7bd..7a95a86a08b4 100644
--- a/pkgs/by-name/le/legendary-gl/package.nix
+++ b/pkgs/by-name/le/legendary-gl/package.nix
@@ -1,27 +1,28 @@
 {
   lib,
-  gitUpdater,
+  nix-update-script,
   fetchFromGitHub,
   python3Packages,
 }:
 
-python3Packages.buildPythonApplication {
+python3Packages.buildPythonApplication (finalAttrs: {
   pname = "legendary-gl"; # Name in pypi
-  version = "0.20.34";
+  version = "0.21.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "legendary-gl";
     repo = "legendary";
-    rev = "56d439ed2d3d9f34e2b08fa23e627c23a487b8d6";
-    hash = "sha256-yCHeeEGw+9gtRMGyIhbStxJhmSM/1Fqly7HSRDkZILQ=";
+    tag = finalAttrs.version;
+    hash = "sha256-k5zVjXibYWS0F1by1uNOynuun9WfU0WuK3ResqsG7I0=";
   };
 
   build-system = with python3Packages; [
-    setuptools
+    uv-build
   ];
 
   dependencies = with python3Packages; [
+    pycryptodomex
     requests
     filelock
   ];
@@ -31,7 +32,7 @@ python3Packages.buildPythonApplication {
 
   pythonImportsCheck = [ "legendary" ];
 
-  passthru.updateScript = gitUpdater { };
+  passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "Free and open-source Epic Games Launcher alternative";
@@ -40,4 +41,4 @@ python3Packages.buildPythonApplication {
     maintainers = with lib.maintainers; [ equirosa ];
     mainProgram = "legendary";
   };
-}
+})
diff --git a/pkgs/by-name/li/libarchive/package.nix b/pkgs/by-name/li/libarchive/package.nix
index fe81d018859c..7164e86c9d7a 100644
--- a/pkgs/by-name/li/libarchive/package.nix
+++ b/pkgs/by-name/li/libarchive/package.nix
@@ -32,13 +32,13 @@
 assert xarSupport -> libxml2 != null;
 stdenv.mkDerivation (finalAttrs: {
   pname = "libarchive";
-  version = "3.8.8";
+  version = "3.8.9";
 
   src = fetchFromGitHub {
     owner = "libarchive";
     repo = "libarchive";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-l8xh+z6lP7VnxMIf9tfoSByerjwN6Z4dE3JNA9zS3LM=";
+    hash = "sha256-/CoInUlOiFvR83mEeV3Tx+2SQGywWDQ4nY+NstE/cP4=";
   };
 
   outputs = [
@@ -108,6 +108,8 @@ stdenv.mkDerivation (finalAttrs: {
     acl
   ];
 
+  strictDeps = true;
+
   hardeningDisable = [
     "strictflexarrays3"
   ]
@@ -140,6 +142,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "http://libarchive.org";
     description = "Multi-format archive and compression library";
diff --git a/pkgs/by-name/li/libblake3/package.nix b/pkgs/by-name/li/libblake3/package.nix
index 08740597b3a3..74cc4afc1445 100644
--- a/pkgs/by-name/li/libblake3/package.nix
+++ b/pkgs/by-name/li/libblake3/package.nix
@@ -10,7 +10,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libblake3";
-  version = "1.8.5";
+  version = "1.8.6";
 
   outputs = [
     "out"
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "BLAKE3-team";
     repo = "BLAKE3";
     tag = finalAttrs.version;
-    hash = "sha256-4Oany3uk0759YIZgD1gsONSFU1Mn/GAMvsSeP33J9Ts=";
+    hash = "sha256-dCRtXHTJnDSJQ2T5bux+ND4e+5uRIoUFn5gYXvMfZi8=";
   };
 
   sourceRoot = finalAttrs.src.name + "/c";
diff --git a/pkgs/by-name/li/libcamera/package.nix b/pkgs/by-name/li/libcamera/package.nix
index 8930cd4d6aee..403a2f70c0bf 100644
--- a/pkgs/by-name/li/libcamera/package.nix
+++ b/pkgs/by-name/li/libcamera/package.nix
@@ -10,6 +10,7 @@
   libdrm,
   libevent,
   libyaml,
+  libyuv,
   gst_all_1,
   gtest,
   graphviz,
@@ -18,21 +19,26 @@
   python3Packages,
   udev,
   libpisp,
+  libglvnd,
   withTracing ? lib.meta.availableOn stdenv.hostPlatform lttng-ust,
   lttng-ust, # withTracing
-  withQcam ? false,
-  qt6, # withQcam
-  libtiff, # withQcam
+  withSoftispGPU ? true, # software ISP GPU acceleration
+  withQcam ? false, # cannot be enabled per default as it causes infinite recursion
+  # withQcam
+  qt6,
+  libjpeg,
+  libtiff,
+  SDL2,
 }:
 
 stdenv.mkDerivation rec {
   pname = "libcamera";
-  version = "0.7.0";
+  version = "0.7.2";
 
   src = fetchgit {
     url = "https://git.libcamera.org/libcamera/libcamera.git";
     rev = "v${version}";
-    hash = "sha256-W9pRE8/0Cf2EEP5bbvy4FsDSeKKSklfJb6T48ZN4dzE=";
+    hash = "sha256-vhFkeT1j2KKm+CVvGrtH5BEYJSEdaX7N7DRdA0a9EWk=";
   };
 
   outputs = [
@@ -80,6 +86,8 @@ stdenv.mkDerivation rec {
     # pycamera
     python3Packages.pybind11
 
+    libyuv
+
     # yamlparser
     libyaml
 
@@ -87,10 +95,13 @@ stdenv.mkDerivation rec {
   ]
   ++ lib.optionals stdenv.hostPlatform.isAarch [ libpisp ]
   ++ lib.optionals withTracing [ lttng-ust ]
+  ++ lib.optionals withSoftispGPU [ libglvnd ]
   ++ lib.optionals withQcam [
+    libjpeg
     libtiff
     qt6.qtbase
     qt6.qttools
+    SDL2
   ];
 
   nativeBuildInputs = [
@@ -109,22 +120,27 @@ stdenv.mkDerivation rec {
   ++ lib.optional withQcam qt6.wrapQtAppsHook;
 
   mesonFlags = [
-    "-Dv4l2=true"
+    (lib.mesonEnable "v4l2" true)
     (lib.mesonEnable "tracing" withTracing)
     (lib.mesonEnable "qcam" withQcam)
-    "-Dlibunwind=disabled"
-    "-Dlc-compliance=disabled" # tries unconditionally to download gtest when enabled
+    (lib.mesonEnable "apps-output-dng" withQcam)
+    (lib.mesonEnable "cam-output-sdl2" withQcam)
+    (lib.mesonEnable "cam-jpeg" withQcam)
+    (lib.mesonEnable "softisp-gpu" withSoftispGPU)
+    (lib.mesonEnable "libunwind" false)
+    (lib.mesonEnable "libdw" false)
+    (lib.mesonEnable "lc-compliance" false) # tries unconditionally to download gtest when enabled
     # Avoid blanket -Werror to evade build failures on less
     # tested compilers.
-    "-Dwerror=false"
+    (lib.mesonBool "werror" false)
     # Documentation breaks binary compatibility.
     # Given that upstream also provides public documentation,
     # we can disable it here.
-    "-Ddocumentation=disabled"
+    (lib.mesonEnable "documentation" false)
   ]
   ++ lib.optionals stdenv.hostPlatform.isAarch [
     # we don't have tensorflow-lite to build this
-    "-Drpi-awb-nn=disabled"
+    (lib.mesonEnable "rpi-awb-nn" false)
   ];
 
   env = {
diff --git a/pkgs/by-name/li/libcanberra/package.nix b/pkgs/by-name/li/libcanberra/package.nix
index baad63c8bf83..7c8f51c0aaad 100644
--- a/pkgs/by-name/li/libcanberra/package.nix
+++ b/pkgs/by-name/li/libcanberra/package.nix
@@ -11,8 +11,8 @@
   gst_all_1,
   libvorbis,
   libcap,
-  withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
-  systemd,
+  withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
+  systemdLibs,
   withAlsa ? stdenv.hostPlatform.isLinux,
   alsa-lib,
 }:
@@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
   ])
   ++ lib.optional (gtkSupport == "gtk3") gtk3-x11
   ++ lib.optional stdenv.hostPlatform.isLinux libcap
-  ++ lib.optional withSystemd systemd
+  ++ lib.optional withSystemd systemdLibs
   ++ lib.optional withAlsa alsa-lib;
 
   configureFlags = [
diff --git a/pkgs/by-name/li/libedit/package.nix b/pkgs/by-name/li/libedit/package.nix
index b74e107981a8..fd14cb442404 100644
--- a/pkgs/by-name/li/libedit/package.nix
+++ b/pkgs/by-name/li/libedit/package.nix
@@ -33,6 +33,8 @@ stdenv.mkDerivation (finalAttrs: {
     ncurses
   ];
 
+  strictDeps = true;
+
   # GCC automatically include `stdc-predefs.h` while Clang does not do this by
   # default. While Musl is ISO 10646 compliant, it does not define
   # __STDC_ISO_10646__.
@@ -50,6 +52,8 @@ stdenv.mkDerivation (finalAttrs: {
       xargs sed -i -e 's,-lncurses[a-z]*,-L${ncurses.out}/lib -lncursesw,g'
   '';
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "http://www.thrysoee.dk/editline/";
     changelog = "https://www.thrysoee.dk/editline/#changelog";
diff --git a/pkgs/by-name/li/libev/package.nix b/pkgs/by-name/li/libev/package.nix
index e51b04890ee6..cdb8e7264232 100644
--- a/pkgs/by-name/li/libev/package.nix
+++ b/pkgs/by-name/li/libev/package.nix
@@ -32,6 +32,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ];
 
+  strictDeps = true;
+
   configureFlags = lib.optional static "LDFLAGS=-static";
 
   makeFlags =
@@ -42,6 +44,8 @@ stdenv.mkDerivation (finalAttrs: {
       "LDFLAGS+=-lws2_32"
     ]);
 
+  __structuredAttrs = true;
+
   meta = {
     description = "High-performance event loop/event model with lots of features";
     homepage = "https://software.schmorp.de/pkg/libev.html";
diff --git a/pkgs/by-name/li/libevent/package.nix b/pkgs/by-name/li/libevent/package.nix
index d220a63c4963..05d16036ed14 100644
--- a/pkgs/by-name/li/libevent/package.nix
+++ b/pkgs/by-name/li/libevent/package.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
     # Don't define BIO_get_init() for LibreSSL 3.5+
     (fetchpatch {
       url = "https://github.com/libevent/libevent/commit/883630f76cbf512003b81de25cd96cb75c6cf0f9.patch";
-      sha256 = "sha256-VPJqJUAovw6V92jpqIXkIR1xYGbxIWxaHr8cePWI2SU=";
+      hash = "sha256-VPJqJUAovw6V92jpqIXkIR1xYGbxIWxaHr8cePWI2SU=";
     })
   ];
 
@@ -59,6 +59,8 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs =
     lib.optional sslSupport openssl ++ lib.optional stdenv.hostPlatform.isCygwin findutils;
 
+  strictDeps = true;
+
   doCheck = false; # needs the net
 
   postInstall = lib.optionalString sslSupport ''
@@ -70,6 +72,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Event notification library";
     mainProgram = "event_rpcgen.py";
diff --git a/pkgs/by-name/li/libffiReal/package.nix b/pkgs/by-name/li/libffiReal/package.nix
index 069f6508d0ce..89031a595b68 100644
--- a/pkgs/by-name/li/libffiReal/package.nix
+++ b/pkgs/by-name/li/libffiReal/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libffi";
-  version = "3.7.1";
+  version = "3.8.0";
 
   src = fetchurl {
     url =
       with finalAttrs;
       "https://github.com/libffi/libffi/releases/download/v${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-1emmY43b0lE921RRjrZ+S75vpwe8wBwQ9iEvCgiNgZ0=";
+    hash = "sha256-faPi2aFx6woDj1kuytP/K7JVDzSW2Hs7Ka0M9EMMDbQ=";
   };
 
   # Note: this package is used for bootstrapping fetchurl, and thus
@@ -73,6 +73,8 @@ stdenv.mkDerivation (finalAttrs: {
     };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Foreign function call interface library";
     longDescription = ''
diff --git a/pkgs/by-name/li/libgcrypt/package.nix b/pkgs/by-name/li/libgcrypt/package.nix
index bfa7ff5c49c7..0e23409dcd67 100644
--- a/pkgs/by-name/li/libgcrypt/package.nix
+++ b/pkgs/by-name/li/libgcrypt/package.nix
@@ -16,12 +16,12 @@
 
 assert enableCapabilities -> stdenv.hostPlatform.isLinux;
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libgcrypt";
   version = "1.12.2";
 
   src = fetchurl {
-    url = "mirror://gnupg/libgcrypt/${pname}-${version}.tar.bz2";
+    url = "mirror://gnupg/libgcrypt/libgcrypt-${finalAttrs.version}.tar.bz2";
     hash = "sha256-fOM8JJIiGgQ2+WqFACFenz49y1/SanV81BXnqEO6vV4=";
   };
 
@@ -123,13 +123,15 @@ stdenv.mkDerivation rec {
     inherit gnupg libotr rsyslog;
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.gnu.org/software/libgcrypt/";
-    changelog = "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=${pname}.git;a=blob;f=NEWS;hb=refs/tags/${pname}-${version}";
+    changelog = "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=blob;f=NEWS;hb=refs/tags/libgcrypt-${finalAttrs.version}";
     description = "General-purpose cryptographic library";
     license = lib.licenses.lgpl2Plus;
     platforms = lib.platforms.all;
     maintainers = [ ];
-    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnupg" version;
+    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnupg" finalAttrs.version;
   };
-}
+})
diff --git a/pkgs/by-name/li/libmpc/package.nix b/pkgs/by-name/li/libmpc/package.nix
index 4bfea7b7bd24..d29fcc4dc70b 100644
--- a/pkgs/by-name/li/libmpc/package.nix
+++ b/pkgs/by-name/li/libmpc/package.nix
@@ -35,6 +35,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   doCheck = true; # not cross;
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Library for multiprecision complex arithmetic with exact rounding";
 
diff --git a/pkgs/by-name/li/libnice/package.nix b/pkgs/by-name/li/libnice/package.nix
index a946663f2f4c..5a0590c209f5 100644
--- a/pkgs/by-name/li/libnice/package.nix
+++ b/pkgs/by-name/li/libnice/package.nix
@@ -1,21 +1,28 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  testers,
+  fetchFromGitLab,
   fetchpatch,
+  nix-update-script,
   meson,
   ninja,
   pkg-config,
-  python3,
-  gobject-introspection,
-  gtk-doc,
-  docbook_xsl,
-  docbook_xml_dtd_412,
   glib,
   gupnp-igd,
   gst_all_1,
   gnutls,
+  enableDocumentation ? stdenv.buildPlatform == stdenv.hostPlatform,
+  gtk-doc,
+  docbook_xsl,
+  docbook_xml_dtd_412,
   graphviz,
+  python3,
+  withIntrospection ?
+    lib.meta.availableOn stdenv.hostPlatform gobject-introspection
+    && stdenv.hostPlatform.emulatorAvailable buildPackages,
+  buildPackages,
+  gobject-introspection,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -27,11 +34,14 @@ stdenv.mkDerivation (finalAttrs: {
     "out"
     "dev"
   ]
-  ++ lib.optionals (stdenv.buildPlatform == stdenv.hostPlatform) [ "devdoc" ];
+  ++ lib.optionals enableDocumentation [ "devdoc" ];
 
-  src = fetchurl {
-    url = "https://libnice.freedesktop.org/releases/libnice-${finalAttrs.version}.tar.gz";
-    hash = "sha256-YY/E6N45O3GbFkHB2O7AGCbU050VrekmedIhx/Xk5w0=";
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "libnice";
+    repo = "libnice";
+    tag = finalAttrs.version;
+    hash = "sha256-UPppE5kBois0jJwsHKefBC8iTfSIkPZXV6XnUBnEFn8=";
   };
 
   patches = [
@@ -51,18 +61,26 @@ stdenv.mkDerivation (finalAttrs: {
     ./musl.patch
   ];
 
+  # specifies <1.30, but also works with later versions
+  postPatch = ''
+    substituteInPlace docs/reference/libnice/meson.build \
+      --replace-fail "version: '<1.30', " ""
+  '';
+
   nativeBuildInputs = [
     meson
     ninja
     pkg-config
-    python3
+  ]
+  ++ lib.optionals withIntrospection [
     gobject-introspection
-
-    # documentation
+  ]
+  ++ lib.optionals enableDocumentation [
     gtk-doc
     docbook_xsl
     docbook_xml_dtd_412
     graphviz
+    python3
   ];
 
   buildInputs = [
@@ -76,16 +94,28 @@ stdenv.mkDerivation (finalAttrs: {
     glib
   ];
 
-  mesonFlags = [
-    "-Dgtk_doc=${if (stdenv.buildPlatform == stdenv.hostPlatform) then "enabled" else "disabled"}"
-    "-Dintrospection=${if (stdenv.buildPlatform == stdenv.hostPlatform) then "enabled" else "disabled"}"
-    "-Dexamples=disabled" # requires many dependencies and probably not useful for our users
-  ];
+  mesonFlags = lib.mapAttrsToList lib.mesonEnable {
+    gtk_doc = enableDocumentation;
+    introspection = withIntrospection;
+
+    # requires many dependencies and probably not useful for our users
+    examples = false;
+    tests = finalAttrs.finalPackage.doCheck;
+
+    gstreamer = true;
+
+    glib_debug = false;
+  };
 
   # Tests are flaky
   # see https://github.com/NixOS/nixpkgs/pull/53293#issuecomment-453739295
   doCheck = false;
 
+  passthru = {
+    updateScript = nix-update-script { };
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
   meta = {
     changelog = "https://gitlab.freedesktop.org/libnice/libnice/-/blob/${finalAttrs.version}/NEWS";
     description = "GLib ICE implementation";
@@ -97,10 +127,12 @@ stdenv.mkDerivation (finalAttrs: {
       It provides a GLib-based library, libnice and a Glib-free library,
       libstun as well as GStreamer elements.'';
     homepage = "https://libnice.freedesktop.org/";
+    pkgConfigModules = [ "nice" ];
     platforms = lib.platforms.unix;
     license = with lib.licenses; [
       lgpl21
       mpl11
     ];
+    maintainers = with lib.maintainers; [ tmarkus ];
   };
 })
diff --git a/pkgs/by-name/li/libpcap/package.nix b/pkgs/by-name/li/libpcap/package.nix
index fefde4c82aa9..5abab91f1a89 100644
--- a/pkgs/by-name/li/libpcap/package.nix
+++ b/pkgs/by-name/li/libpcap/package.nix
@@ -12,7 +12,7 @@
   pkg-config,
   rdma-core,
   withBluez ? false,
-  withRdma ? false,
+  withRdma ? lib.meta.availableOn stdenv.hostPlatform rdma-core,
   withRemote ? false,
 
   # for passthru.tests
diff --git a/pkgs/by-name/li/libpfm/package.nix b/pkgs/by-name/li/libpfm/package.nix
index 87dcac45923c..e2c1362ea74a 100644
--- a/pkgs/by-name/li/libpfm/package.nix
+++ b/pkgs/by-name/li/libpfm/package.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://sourceforge/perfmon2/libpfm4/libpfm-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-0YuXdkx1VSjBBR03bjNUXQ62DG6/hWgENoE/pbBMw9E=";
+    hash = "sha256-0YuXdkx1VSjBBR03bjNUXQ62DG6/hWgENoE/pbBMw9E=";
   };
 
   # Don't install libpfm.so on windows as it doesn't exist
@@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
   # See: https://github.com/NixOS/nixpkgs/pull/252982#discussion_r1314346216
   postPatch = ''
     substituteInPlace config.mk examples/Makefile \
-      --replace '($(SYS),WINDOWS)' '($(SYS),Windows)'
+      --replace-fail '($(SYS),WINDOWS)' '($(SYS),Windows)'
   '';
 
   makeFlags = [
@@ -33,11 +33,17 @@ stdenv.mkDerivation (finalAttrs: {
     "SYS=${stdenv.hostPlatform.uname.system}"
   ];
 
-  env.NIX_CFLAGS_COMPILE = "-Wno-error";
-  env.CONFIG_PFMLIB_SHARED = if enableShared then "y" else "n";
+  env = {
+    NIX_CFLAGS_COMPILE = "-Wno-error";
+    CONFIG_PFMLIB_SHARED = if enableShared then "y" else "n";
+  };
 
   buildInputs = lib.optional stdenv.hostPlatform.isMinGW windows.libgnurx;
 
+  strictDeps = true;
+
+  __structuredAttrs = true;
+
   meta = {
     description = "Helper library to program the performance monitoring events";
     longDescription = ''
diff --git a/pkgs/by-name/li/libpisp/package.nix b/pkgs/by-name/li/libpisp/package.nix
index 6ee36b13ea8a..01f247bf2650 100644
--- a/pkgs/by-name/li/libpisp/package.nix
+++ b/pkgs/by-name/li/libpisp/package.nix
@@ -7,28 +7,19 @@
   ninja,
   boost,
   nlohmann_json,
-  fetchpatch,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libpisp";
-  version = "1.2.1";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "raspberrypi";
     repo = "libpisp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YshU7G5Rov67CVwFbf5ENp2j5ptAvkVrlMu85KmnEpk=";
+    hash = "sha256-hzJA8hoOXf2Lswwz9t0StJ9JJP8ICWJlstzSsli4Yqs=";
   };
 
-  patches = [
-    # fix build with glibc 2.42 & -Werror
-    (fetchpatch {
-      url = "https://github.com/raspberrypi/libpisp/commit/f2bbf7e000d3f11cac235b8ea1291722080a016c.patch";
-      hash = "sha256-vrdmVadyjlAnZtmBahOs/hlKPrkh/BF3LvrTPM9D15Q=";
-    })
-  ];
-
   nativeBuildInputs = [
     pkg-config
     meson
diff --git a/pkgs/by-name/li/libsodium/package.nix b/pkgs/by-name/li/libsodium/package.nix
index 4b27cbb4c759..240617b896eb 100644
--- a/pkgs/by-name/li/libsodium/package.nix
+++ b/pkgs/by-name/li/libsodium/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libsodium";
-  version = "1.0.22-unstable-2026-07-08";
+  version = "1.0.22-unstable-2026-07-31";
 
   src = fetchFromGitHub {
     owner = "jedisct1";
     repo = "libsodium";
-    rev = "77a422c85a3b8b487de50c811b38d18394831ba6";
-    hash = "sha256-Ahka2PnrmYvTLjZMzik5mFsxhDpMLRMKT/I5ftUb0Xc=";
+    rev = "701aa826b97dc84a353d70a551d49dc26da539c5";
+    hash = "sha256-vJK7nuvy22EWCdau9cn4HOvO8XDiVQXwf/zwhq9R9Jg=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/li/libssh2/package.nix b/pkgs/by-name/li/libssh2/package.nix
index b7c88dfc5eb7..1e2299e9075e 100644
--- a/pkgs/by-name/li/libssh2/package.nix
+++ b/pkgs/by-name/li/libssh2/package.nix
@@ -114,6 +114,8 @@ stdenv.mkDerivation (finalAttrs: {
   propagatedBuildInputs = [ openssl ]; # see Libs: in libssh2.pc
   buildInputs = [ zlib ] ++ lib.optional stdenv.hostPlatform.isMinGW windows.mingw_w64;
 
+  strictDeps = true;
+
   passthru.tests = {
     inherit
       aria2
@@ -124,6 +126,8 @@ stdenv.mkDerivation (finalAttrs: {
     curl = (curl.override { scpSupport = true; }).tests.withCheck;
   };
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Client-side C library implementing the SSH2 protocol";
     homepage = "https://www.libssh2.org";
diff --git a/pkgs/by-name/li/libtasn1/package.nix b/pkgs/by-name/li/libtasn1/package.nix
index 7de5f9bc2b74..8e27bac39404 100644
--- a/pkgs/by-name/li/libtasn1/package.nix
+++ b/pkgs/by-name/li/libtasn1/package.nix
@@ -32,14 +32,19 @@ stdenv.mkDerivation (finalAttrs: {
     perl
   ];
 
+  strictDeps = true;
+
   doCheck = true;
-  preCheck =
-    if stdenv.hostPlatform.isDarwin then "export DYLD_LIBRARY_PATH=`pwd`/lib/.libs" else null;
+  preCheck = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    export DYLD_LIBRARY_PATH=$(pwd)/lib/.libs
+  '';
 
   passthru.tests = {
     inherit gnutls samba qemu;
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.gnu.org/software/libtasn1/";
     description = "ASN.1 library";
diff --git a/pkgs/by-name/li/libuv/package.nix b/pkgs/by-name/li/libuv/package.nix
index bcbf5472a7e2..c16084e0ac39 100644
--- a/pkgs/by-name/li/libuv/package.nix
+++ b/pkgs/by-name/li/libuv/package.nix
@@ -7,7 +7,6 @@
   darwin,
   libtool,
   pkg-config,
-  pkgsStatic,
 
   # for passthru.tests
   bind,
@@ -19,6 +18,7 @@
   neovim,
   nodejs,
   ocamlPackages,
+  pkgsStatic,
   python3,
   testers,
 }:
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "libuv";
     repo = "libuv";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-Y9Nph2LkT1qnOYTW3WCumWWwORnI4P7HxzBjUlGaL7M=";
   };
 
@@ -151,8 +151,6 @@ stdenv.mkDerivation (finalAttrs: {
     in
     lib.optionalString (finalAttrs.finalPackage.doCheck) ''
       sed '/${tdRegexp}/d' -i test/test-list.h
-      # https://github.com/libuv/libuv/issues/4794
-      substituteInPlace Makefile.am --replace-fail -lutil "-lutil -lm"
     '';
 
   nativeBuildInputs = [
@@ -162,6 +160,8 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
   ];
 
+  strictDeps = true;
+
   # This is part of the Darwin bootstrap, so we don’t always get
   # `libutil.dylib` automatically propagated through the SDK.
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
@@ -209,6 +209,8 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
   };
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Multi-platform support library with a focus on asynchronous I/O";
     homepage = "https://libuv.org/";
diff --git a/pkgs/by-name/li/libxslt/package.nix b/pkgs/by-name/li/libxslt/package.nix
index da39812157a4..e0303ba11235 100644
--- a/pkgs/by-name/li/libxslt/package.nix
+++ b/pkgs/by-name/li/libxslt/package.nix
@@ -97,6 +97,8 @@ stdenv.mkDerivation (finalAttrs: {
     };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://gitlab.gnome.org/GNOME/libxslt";
     description = "C library and tools to do XSL transformations";
diff --git a/pkgs/by-name/li/liquibase/package.nix b/pkgs/by-name/li/liquibase/package.nix
index 4082e0009637..ecf6e2d6c29f 100644
--- a/pkgs/by-name/li/liquibase/package.nix
+++ b/pkgs/by-name/li/liquibase/package.nix
@@ -27,11 +27,11 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "liquibase";
-  version = "5.0.3";
+  version = "5.0.4";
 
   src = fetchurl {
     url = "https://github.com/liquibase/liquibase/releases/download/v${finalAttrs.version}/liquibase-${finalAttrs.version}.tar.gz";
-    hash = "sha256-hlqrORvpy+P+4iRhOS1dKap2ZSWWWYsUcAo/XwXJ4rc=";
+    hash = "sha256-uwhjjXDd3Wr4zKbgMxSFdvghS1mWgxsfiGTrNSj0z84=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/lm/lmdb/package.nix b/pkgs/by-name/lm/lmdb/package.nix
index 41c92ea0c8b6..f228bf12fd4f 100644
--- a/pkgs/by-name/lm/lmdb/package.nix
+++ b/pkgs/by-name/lm/lmdb/package.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation rec {
   pname = "lmdb";
-  version = "0.9.35";
+  version = "0.9.36";
 
   src = fetchFromGitLab {
     domain = "git.openldap.org";
     owner = "openldap";
     repo = "openldap";
     rev = "LMDB_${version}";
-    sha256 = "sha256-XkOeVqzKojRLojBLkXB0V9lypJnL5ZmGAwutn6aRQIU=";
+    sha256 = "sha256-iOwjUqR2ChCEUDsIFEetVktCD7Mx3R5JgHE+qIhBd5I=";
   };
 
   postUnpack = "sourceRoot=\${sourceRoot}/libraries/liblmdb";
diff --git a/pkgs/by-name/lz/lzo/package.nix b/pkgs/by-name/lz/lzo/package.nix
index a3ecb16bb807..da806c6a1e24 100644
--- a/pkgs/by-name/lz/lzo/package.nix
+++ b/pkgs/by-name/lz/lzo/package.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://www.oberhumer.com/opensource/lzo/download/lzo-${finalAttrs.version}.tar.gz";
-    sha256 = "0wm04519pd3g8hqpjqhfr72q8qmbiwqaxcs3cndny9h86aa95y60";
+    hash = "sha256-wPiSlDIIJm+bZUOzrjCPq2KExckOYnkxRG+0m0IhoHI=";
   };
 
   nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ];
@@ -30,6 +30,8 @@ stdenv.mkDerivation (finalAttrs: {
     "doc"
   ];
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Real-time data (de)compression library";
     longDescription = ''
diff --git a/pkgs/by-name/ma/mathematica/versions.nix b/pkgs/by-name/ma/mathematica/versions.nix
index 5fbd2ecd61b0..f583158a94e9 100644
--- a/pkgs/by-name/ma/mathematica/versions.nix
+++ b/pkgs/by-name/ma/mathematica/versions.nix
@@ -4,6 +4,20 @@
     nix --extra-experimental-features nix-command hash file <installer-file>
 */
 [
+  {
+    version = "15.0.1";
+    lang = "en";
+    language = "English";
+    hash = "sha256-7N5FJoj0gTGNwY3Q+8hJGZi+ze6IRRMnwu6nLEv3cF4=";
+    installer = "Wolfram_15.0.1_LIN.sh";
+  }
+  {
+    version = "15.0.1";
+    lang = "en";
+    language = "English";
+    hash = "sha256-VzK8CuOhk4sOO5CL4z3rfpY5631F2RN6c0Dh8cExeeg=";
+    installer = "Wolfram_15.0.1.sh";
+  }
   {
     version = "15.0.0";
     lang = "en";
diff --git a/pkgs/by-name/ma/maturin/package.nix b/pkgs/by-name/ma/maturin/package.nix
index fae97effb3b9..4576351fb4b2 100644
--- a/pkgs/by-name/ma/maturin/package.nix
+++ b/pkgs/by-name/ma/maturin/package.nix
@@ -48,6 +48,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
     updateScript = nix-update-script { };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Build and publish Rust crates Python packages";
     longDescription = ''
diff --git a/pkgs/by-name/mb/mbedtls/generic.nix b/pkgs/by-name/mb/mbedtls/generic.nix
index b74fe03e288e..8204cd73e95f 100644
--- a/pkgs/by-name/mb/mbedtls/generic.nix
+++ b/pkgs/by-name/mb/mbedtls/generic.nix
@@ -19,6 +19,7 @@
 stdenv.mkDerivation rec {
   pname = "mbedtls";
   inherit version;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "Mbed-TLS";
diff --git a/pkgs/by-name/md/mdbook-linkcheck2/package.nix b/pkgs/by-name/md/mdbook-linkcheck2/package.nix
index 8a3acf3e211d..4c392e6d9204 100644
--- a/pkgs/by-name/md/mdbook-linkcheck2/package.nix
+++ b/pkgs/by-name/md/mdbook-linkcheck2/package.nix
@@ -9,7 +9,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mdbook-linkcheck2";
-  version = "0.12.2";
+  version = "0.13.0";
 
   __structuredAttrs = true;
 
@@ -17,10 +17,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "marxin";
     repo = "mdbook-linkcheck2";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-D0pteKtmBDkqcaonbNzL6tyo97x+qQhn6oY88+4VGFE=";
+    hash = "sha256-HLV3LqMUbaUL/AMlid0oamceeWiac6zydjQYuujCp3M=";
   };
 
-  cargoHash = "sha256-XY1epCro/BqHm95HVP1eK0oVLSPYjD2hU7IdiEkgNMM=";
+  cargoHash = "sha256-TcMiConcI8KMptOS67J+faPtCRnMCJxrWqFs3o19XMA=";
 
   propagatedNativeBuildInputs = [ cacert ];
 
diff --git a/pkgs/by-name/me/metasploit/Gemfile b/pkgs/by-name/me/metasploit/Gemfile
index 5620433b9bdf..90f816ff8b1d 100644
--- a/pkgs/by-name/me/metasploit/Gemfile
+++ b/pkgs/by-name/me/metasploit/Gemfile
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 source "https://rubygems.org"
 
-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.5.1"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.5.2"
 
 gem "getoptlong"
 gem "syslog", "~> 0.3.0"
diff --git a/pkgs/by-name/me/metasploit/Gemfile.lock b/pkgs/by-name/me/metasploit/Gemfile.lock
index 7ba41155f307..448ae6185c4a 100644
--- a/pkgs/by-name/me/metasploit/Gemfile.lock
+++ b/pkgs/by-name/me/metasploit/Gemfile.lock
@@ -1,9 +1,9 @@
 GIT
   remote: https://github.com/rapid7/metasploit-framework
-  revision: 77223f289965af330765014a89fa0ceee5318255
-  ref: refs/tags/6.5.1
+  revision: 75120f414c183dcb05c5d99d04f2d62bf538555a
+  ref: refs/tags/6.5.2
   specs:
-    metasploit-framework (6.5.1)
+    metasploit-framework (6.5.2)
       aarch64
       abbrev
       actionpack (~> 8.0.5)
@@ -173,7 +173,7 @@ GEM
     arel-helpers (2.17.0)
       activerecord (>= 3.1.0)
     aws-eventstream (1.4.0)
-    aws-partitions (1.1279.0)
+    aws-partitions (1.1281.0)
     aws-sdk-core (3.254.1)
       aws-eventstream (~> 1, >= 1.3.0)
       aws-partitions (~> 1, >= 1.992.0)
@@ -182,13 +182,13 @@ GEM
       bigdecimal
       jmespath (~> 1, >= 1.6.1)
       logger
-    aws-sdk-ec2 (1.636.0)
+    aws-sdk-ec2 (1.638.0)
       aws-sdk-core (~> 3, >= 3.254.0)
       aws-sigv4 (~> 1.5)
     aws-sdk-ec2instanceconnect (1.74.0)
       aws-sdk-core (~> 3, >= 3.254.0)
       aws-sigv4 (~> 1.5)
-    aws-sdk-iam (1.151.0)
+    aws-sdk-iam (1.152.0)
       aws-sdk-core (~> 3, >= 3.254.0)
       aws-sigv4 (~> 1.5)
     aws-sdk-kms (1.130.0)
@@ -228,8 +228,8 @@ GEM
     domain_name (0.6.20240107)
     drb (2.2.3)
     ed25519 (1.4.0)
-    elftools (1.3.1)
-      bindata (~> 2)
+    elftools (2.0.0)
+      bindata (>= 2, < 4)
     em-http-request (1.1.7)
       addressable (>= 2.3.4)
       cookiejar (!= 0.3.1)
@@ -278,7 +278,7 @@ GEM
       mutex_m
     i18n (1.15.2)
       concurrent-ruby (~> 1.0)
-    io-console (0.9.1)
+    io-console (0.9.2)
     ipaddr (1.2.9)
     irb (1.18.0)
       pp (>= 0.6.0)
@@ -402,11 +402,10 @@ GEM
     parallel (2.1.0)
     patch_finder (1.0.2)
     pcaprub (0.13.3)
-    pdf-reader (2.15.1)
+    pdf-reader (2.16.0)
       Ascii85 (>= 1.0, < 3.0, != 2.0.0)
       afm (>= 0.2.1, < 2)
       hashery (~> 2.0)
-      ruby-rc4
       ttfunk
     pg (1.6.3)
     pp (0.6.4)
@@ -417,7 +416,7 @@ GEM
     puma (8.0.2)
       nio4r (~> 2.0)
     racc (1.8.1)
-    rack (3.2.6)
+    rack (3.2.7)
     rack-protection (4.2.1)
       base64 (>= 0.1.0)
       logger (>= 1.6.0)
@@ -449,7 +448,7 @@ GEM
     rasn1 (0.14.0)
       strptime (~> 0.2.5)
     rb-readline (0.5.5)
-    rbs (4.1.2)
+    rbs (4.2.0)
       logger
       prism (>= 1.6.0)
       tsort
@@ -458,7 +457,7 @@ GEM
       prism (>= 1.6.0)
       rbs (>= 4.0.0)
       tsort
-    recog (3.1.33)
+    recog (3.1.35)
       nokogiri
     redcarpet (3.6.1)
     reline (0.7.0)
@@ -470,7 +469,7 @@ GEM
       netrc (~> 0.8)
     rex-arch (0.1.20)
       rex-text
-    rex-bin_tools (0.1.16)
+    rex-bin_tools (0.1.17)
       metasm
       rex-arch
       rex-core
@@ -540,7 +539,7 @@ GEM
       windows_error (>= 0.1.4)
     rubyntlm (0.6.5)
       base64
-    rubyzip (3.4.1)
+    rubyzip (3.5.0)
     sawyer (0.9.3)
       addressable (>= 2.3.5)
       faraday (>= 0.17.3, < 3)
@@ -553,7 +552,7 @@ GEM
       rack-protection (= 4.2.1)
       rack-session (>= 2.0.0, < 3)
       tilt (~> 2.0)
-    sqlite3 (2.9.5)
+    sqlite3 (2.9.6)
       mini_portile2 (~> 2.8.0)
     sshkey (3.0.0)
     stringio (3.1.1)
@@ -567,7 +566,7 @@ GEM
       logger
       rack (>= 1, < 4)
     thor (1.5.0)
-    tilt (2.8.0)
+    tilt (2.9.0)
     timeout (0.6.1)
     tsort (0.2.0)
     ttfunk (1.7.0)
diff --git a/pkgs/by-name/me/metasploit/gemset.nix b/pkgs/by-name/me/metasploit/gemset.nix
index 02d1cf0651ec..fa951b8f2180 100644
--- a/pkgs/by-name/me/metasploit/gemset.nix
+++ b/pkgs/by-name/me/metasploit/gemset.nix
@@ -124,10 +124,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0dg4k9l1kb9xvagzag1ddqgsmaj0wrd6a9yzskjfzrd3pislzalv";
+      sha256 = "1v424xj0szmlki0g2zzd9f5i1yq8giccdn7w3q57kav8l3bcgz4p";
       type = "gem";
     };
-    version = "1.1279.0";
+    version = "1.1281.0";
   };
   aws-sdk-core = {
     groups = [ "default" ];
@@ -144,10 +144,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1a0z35sz9h6qy8wfv6wn8ycaryb3x55fgl7sxxbbxsyqm135nm57";
+      sha256 = "00383p597x4n3dl9knmvpjxldv226hzrv9qaj5ry3a3yby9zz67a";
       type = "gem";
     };
-    version = "1.636.0";
+    version = "1.638.0";
   };
   aws-sdk-ec2instanceconnect = {
     groups = [ "default" ];
@@ -164,10 +164,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1wivpvs3wc4w1wkgm991xjig4chnnxjgxs92b27klzwyzkbfsbx7";
+      sha256 = "0n5ac3zpy96vqkzaai5496g39k73fa8lvkz6k0brv0j5bxj84nq9";
       type = "gem";
     };
-    version = "1.151.0";
+    version = "1.152.0";
   };
   aws-sdk-kms = {
     groups = [ "default" ];
@@ -424,10 +424,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1y5ahqk24ngjiyfbj5xapxwfb34yslcpn4l0khdq4pkxkajgqilx";
+      sha256 = "08698s15r50hkbk31bmhlvy99mrn5cf8l304rfhashzky1ccvwba";
       type = "gem";
     };
-    version = "1.3.1";
+    version = "2.0.0";
   };
   em-http-request = {
     groups = [ "default" ];
@@ -684,10 +684,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1rnnj8nbvqcn55diifkmz82alix5ws5dgh18kpbxjd6rdrdddd9l";
+      sha256 = "026v93kja19bfslnwi9xfq2dj4r89kkwdprim4whjg6h3n4lz9zg";
       type = "gem";
     };
-    version = "0.9.1";
+    version = "0.9.2";
   };
   ipaddr = {
     groups = [ "default" ];
@@ -844,12 +844,12 @@
     platforms = [ ];
     source = {
       fetchSubmodules = false;
-      rev = "77223f289965af330765014a89fa0ceee5318255";
-      sha256 = "16bi5rp6mrl9c5yr88k4p9nrafyn8zxpvlxk07mwqxvwnr830wmq";
+      rev = "75120f414c183dcb05c5d99d04f2d62bf538555a";
+      sha256 = "06z8jqr6k51gdzc9gvsfbn2zhgslxrvycwvv4xhv897g9bzql5yp";
       type = "git";
       url = "https://github.com/rapid7/metasploit-framework";
     };
-    version = "6.5.1";
+    version = "6.5.2";
   };
   metasploit-model = {
     groups = [ "default" ];
@@ -1230,10 +1230,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1kk8f1f5kkdwsbskv0vikcwx5xaivv19y9zl97x1fcaam23akihq";
+      sha256 = "0cipbx3ssgfsww7hrlll2j27b2vpcwaczqxxg614s9l5q1j5a6xz";
       type = "gem";
     };
-    version = "2.15.1";
+    version = "2.16.0";
   };
   pg = {
     groups = [ "default" ];
@@ -1310,10 +1310,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1hhjy9gcp52dzij05gmidqac8g28ski5xm67prwmdqmjfcgqxmsy";
+      sha256 = "1dwgab330lsv4qppw3f52mc4ihr8lagxgll53mkmcdgr4hf3xqck";
       type = "gem";
     };
-    version = "3.2.6";
+    version = "3.2.7";
   };
   rack-protection = {
     groups = [ "default" ];
@@ -1420,10 +1420,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0j4g0wj90kiirgck0li9vxx2yc2jf0n0z74jxlxj7w88npcb23h5";
+      sha256 = "0x067q8cdam4kv5dc09iq2nzca8qm2kdl0dr22gc0ny0vj3bixsi";
       type = "gem";
     };
-    version = "4.1.2";
+    version = "4.2.0";
   };
   rdoc = {
     groups = [ "default" ];
@@ -1440,10 +1440,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1mxj6s3si6xl29wh5km53x0dnwq3sy0dpz308mdgh7vvafcc2xqf";
+      sha256 = "0jwgzwr6j1bcjcmjdk14j50yf58dqja7z3msn1w3bi0kzsh2j9qk";
       type = "gem";
     };
-    version = "3.1.33";
+    version = "3.1.35";
   };
   redcarpet = {
     groups = [ "default" ];
@@ -1490,10 +1490,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0b755sz6h9hn3f7qbx033h4j7pwx1r2ykyzqil8alpp8983li0h0";
+      sha256 = "0gpdvf8qqh0mm1c90vip1mpjgqrlgvaydyg5wbi3bl8dm3m1qghi";
       type = "gem";
     };
-    version = "0.1.16";
+    version = "0.1.17";
   };
   rex-core = {
     groups = [ "default" ];
@@ -1740,10 +1740,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "00nafgqjhwa504xrjv32v0757a2xcvspsia8s7mp4n62nm2yfy8a";
+      sha256 = "0z4d1wgn8868ll0zkjgii21cskhvydry8kfayribcjd86zbljz7p";
       type = "gem";
     };
-    version = "3.4.1";
+    version = "3.5.0";
   };
   sawyer = {
     groups = [ "default" ];
@@ -1790,10 +1790,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "01i6k25fv3w3f5ph5cix9ipg19ajsy6zrzxdm18ashzrldrjjmq4";
+      sha256 = "13nh4kd96d28dv3habjv2fiap30ccb73lz8mqx5d0834jl3fcvwm";
       type = "gem";
     };
-    version = "2.9.5";
+    version = "2.9.6";
   };
   sshkey = {
     groups = [ "default" ];
@@ -1870,10 +1870,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "089pvsdyf8krrhzavqm1lq4yqf79valiklnn290y1qbgf6r2wixs";
+      sha256 = "19d3k8ym9bj9j98zmc0pbjnwqdg4mqabnh8hm7lrdfhb5383amys";
       type = "gem";
     };
-    version = "2.8.0";
+    version = "2.9.0";
   };
   timeout = {
     groups = [ "default" ];
diff --git a/pkgs/by-name/me/metasploit/package.nix b/pkgs/by-name/me/metasploit/package.nix
index 083b89bafc09..5352dcf589a8 100644
--- a/pkgs/by-name/me/metasploit/package.nix
+++ b/pkgs/by-name/me/metasploit/package.nix
@@ -18,13 +18,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "metasploit-framework";
-  version = "6.5.1";
+  version = "6.5.2";
 
   src = fetchFromGitHub {
     owner = "rapid7";
     repo = "metasploit-framework";
     tag = finalAttrs.version;
-    hash = "sha256-uHIwULZ8d8zrAbPTfftH1juVbbpkIpR9YYnmam4ucZk=";
+    hash = "sha256-1xeK/0rvJLRhJ3tz5nfuVD/4hV1O75fYby+UaTKW6Bs=";
   };
 
   __structuredAttrs = true;
diff --git a/pkgs/by-name/mi/microsoft-rush/package.nix b/pkgs/by-name/mi/microsoft-rush/package.nix
new file mode 100644
index 000000000000..b569137f2e27
--- /dev/null
+++ b/pkgs/by-name/mi/microsoft-rush/package.nix
@@ -0,0 +1,121 @@
+{
+  fetchFromGitHub,
+  fetchPnpmDeps,
+  lib,
+  makeWrapper,
+  nodejs,
+  pnpm_10,
+  pnpmConfigHook,
+  stdenv,
+  testers,
+  yq,
+}:
+
+let
+  pnpm = pnpm_10;
+  rushWorkspace = "@microsoft/rush...";
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "microsoft-rush";
+  version = "5.178.0";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "microsoft";
+    repo = "rushstack";
+    tag = "@microsoft/rush_v${finalAttrs.version}";
+    hash = "sha256-e3M/wbdstVUZR0ShEHO7Bemz2BYHZn7tIIZP33UrRu8=";
+  };
+
+  # We have to patch some files to build rush with pnpm,
+  # as the repo is designed to be built with rush itself
+  postPatch = ''
+    # Rush usually places the pnpm lock file in a subdirectory (common/temp/default),
+    # but we need it at the root of the workspace
+    #
+    # But for this to work, we need to patch a few things:
+    # - We remove rush-specific overrides and checksums
+    # - We set injectWorkspacePackages to true to avoid ERR_PNPM_LOCKFILE_CONFIG_MISMATCH
+    # - We adjust the importer paths be relative to the root of the workspace instead of the common/temp/default subdirectory
+    ${lib.getExe yq} -y '
+      del(.overrides, .packageExtensionsChecksum, .pnpmfileChecksum)
+      | .settings.injectWorkspacePackages = true
+      | .importers |= with_entries(.key |= sub("^\\.\\./\\.\\./\\.\\./"; ""))
+    ' common/config/subspaces/default/pnpm-lock.yaml > pnpm-lock.yaml
+
+    # Since rush doesn't provide a committed pnpm workspace file, we synthesize one from the pnpm lock file
+    ${lib.getExe yq} -y \
+      '{ packages: (.importers | keys | map(select(. != "."))) }' \
+      pnpm-lock.yaml > pnpm-workspace.yaml
+  '';
+
+  pnpmDeps = fetchPnpmDeps {
+    inherit (finalAttrs)
+      pname
+      version
+      src
+      postPatch
+      env
+      pnpmWorkspaces
+      ;
+    inherit pnpm;
+    fetcherVersion = 4;
+    hash = "sha256-3zRdVvJQTT7jBaOm4SdM76LmikjaTjVCkZXZK+MFf7A=";
+  };
+
+  pnpmWorkspaces = [ rushWorkspace ];
+
+  env = {
+    npm_config_auto_install_peers = "false";
+    npm_config_inject_workspace_packages = "true";
+  };
+
+  nativeBuildInputs = [
+    makeWrapper
+    nodejs
+    pnpm
+    pnpmConfigHook
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    pnpm --filter '${rushWorkspace}' --recursive --if-present run _phase:lite-build
+    pnpm --filter '${rushWorkspace}' --recursive --if-present run _phase:build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    pnpm --filter @microsoft/rush deploy --prod --offline "$out/libexec/microsoft-rush"
+
+    for command in rush rush-pnpm rushx; do
+      makeWrapper ${nodejs}/bin/node "$out/bin/$command" \
+        --add-flags "$out/libexec/microsoft-rush/bin/$command"
+    done
+
+    runHook postInstall
+  '';
+
+  passthru = {
+    tests.version = testers.testVersion {
+      package = finalAttrs.finalPackage;
+      inherit (finalAttrs) version;
+      command = "HOME=$TMPDIR rush --help";
+    };
+    updateScript = ./update.sh;
+  };
+
+  meta = {
+    description = "Scalable monorepo manager for the web";
+    homepage = "https://rushjs.io";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ nilathedragon ];
+    inherit (nodejs.meta) platforms;
+    mainProgram = "rush";
+  };
+})
diff --git a/pkgs/by-name/mi/microsoft-rush/update.sh b/pkgs/by-name/mi/microsoft-rush/update.sh
new file mode 100755
index 000000000000..50340675c57c
--- /dev/null
+++ b/pkgs/by-name/mi/microsoft-rush/update.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix-update nodejs
+# shellcheck shell=bash
+
+set -euo pipefail
+
+version="$(npm view @microsoft/rush version)"
+nix-update "$UPDATE_NIX_ATTR_PATH" --version "$version" --build --test
diff --git a/pkgs/by-name/mi/mimalloc/package.nix b/pkgs/by-name/mi/mimalloc/package.nix
index 6f4c2362a33e..810596fdfe03 100644
--- a/pkgs/by-name/mi/mimalloc/package.nix
+++ b/pkgs/by-name/mi/mimalloc/package.nix
@@ -12,13 +12,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "mimalloc";
-  version = "3.3.2";
+  version = "3.4.5";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "mimalloc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GZ37qQVDe9jgMb4Coe5oKvgaLTspZDlSkS5rdy1MfUU=";
+    hash = "sha256-vNVZw2YsDkf0GcdFTNb/fXMQLQYvoc8P425LupPShpo=";
   };
 
   doCheck = !stdenv.hostPlatform.isStatic;
diff --git a/pkgs/by-name/mi/minefair/package.nix b/pkgs/by-name/mi/minefair/package.nix
index 2fc84795abb9..f7572e1331b1 100644
--- a/pkgs/by-name/mi/minefair/package.nix
+++ b/pkgs/by-name/mi/minefair/package.nix
@@ -19,7 +19,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     description = "Fair and infinite implementation of Minesweeper";
     homepage = "https://github.com/LyricLy/minefair";
     license = lib.licenses.mit;
-    maintainers = [ lib.maintainers.pyrotelekinetic ];
+    maintainers = [ lib.maintainers.tr3foil ];
     mainProgram = "minefair";
   };
 })
diff --git a/pkgs/by-name/mj/mjpegtools/package.nix b/pkgs/by-name/mj/mjpegtools/package.nix
index 157948c85891..fb6511452c38 100644
--- a/pkgs/by-name/mj/mjpegtools/package.nix
+++ b/pkgs/by-name/mj/mjpegtools/package.nix
@@ -2,7 +2,6 @@
   stdenv,
   lib,
   fetchurl,
-  gtk2,
   libdv,
   libjpeg,
   libpng,
@@ -46,12 +45,13 @@ stdenv.mkDerivation (finalAttrs: {
     libpng
   ]
   ++ lib.optionals (!withMinimal) [
-    gtk2
     libx11
     SDL
     SDL_gfx
   ];
 
+  configureFlags = [ "--without-gtk" ];
+
   env.NIX_CFLAGS_COMPILE = lib.optionalString (!withMinimal) "-I${lib.getDev SDL}/include/SDL";
 
   postPatch = ''
diff --git a/pkgs/by-name/mo/moor/package.nix b/pkgs/by-name/mo/moor/package.nix
index 90d6fe895994..ada1bcf76912 100644
--- a/pkgs/by-name/mo/moor/package.nix
+++ b/pkgs/by-name/mo/moor/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "moor";
-  version = "2.16.3";
+  version = "2.17.0";
 
   src = fetchFromGitHub {
     owner = "walles";
     repo = "moor";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-z1fGeeCkcPmvQEK+WK/W0kj/w57YqT06yEbQf5gEgGY=";
+    hash = "sha256-xxfuDZsVu6/1v/vBvWcCR7ZB/4SXgYnNSscXRjK73dE=";
   };
 
   vendorHash = "sha256-01FIkLojyCvjMjW4qe6mPP63hz5rYeVATyL0dW+F/Ek=";
diff --git a/pkgs/by-name/mp/mpdecimal/package.nix b/pkgs/by-name/mp/mpdecimal/package.nix
index ca1d0bba4969..0d90dec4f5aa 100644
--- a/pkgs/by-name/mp/mpdecimal/package.nix
+++ b/pkgs/by-name/mp/mpdecimal/package.nix
@@ -22,6 +22,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ autoreconfHook ];
 
+  strictDeps = true;
+
   enableParallelBuilding = true;
 
   postInstall = ''
@@ -32,6 +34,8 @@ stdenv.mkDerivation (finalAttrs: {
     echo -n $cxx >> $dev/nix-support/propagated-build-inputs
   '';
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Library for arbitrary precision decimal floating point arithmetic";
 
diff --git a/pkgs/by-name/mp/mpfr/package.nix b/pkgs/by-name/mp/mpfr/package.nix
index f9db385a11cb..579523e45309 100644
--- a/pkgs/by-name/mp/mpfr/package.nix
+++ b/pkgs/by-name/mp/mpfr/package.nix
@@ -12,14 +12,14 @@
 # cgit) that are needed here should be included directly in Nixpkgs as
 # files.
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   version = "4.2.2";
   pname = "mpfr";
 
   src = fetchurl {
     urls = [
-      "https://www.mpfr.org/${pname}-${version}/${pname}-${version}.tar.xz"
-      "mirror://gnu/mpfr/${pname}-${version}.tar.xz"
+      "https://www.mpfr.org/mpfr-${finalAttrs.version}/mpfr-${finalAttrs.version}.tar.xz"
+      "mirror://gnu/mpfr/mpfr-${finalAttrs.version}.tar.xz"
     ];
     hash = "sha256-tnugOD736KhWNzTi6InvXsPDuJigHQD6CmhprYHGzgE=";
   };
@@ -67,10 +67,12 @@ stdenv.mkDerivation rec {
       # Expect the text in format of '<title>GNU MPFR version 4.1.1</title>'
       new_version="$(curl -s https://www.mpfr.org/mpfr-current/ |
           pcre2grep -o1 '<title>GNU MPFR version ([0-9.]+)</title>')"
-      update-source-version ${pname} "$new_version"
+      update-source-version ${finalAttrs.pname} "$new_version"
     '';
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.mpfr.org/";
     description = "Library for multiple-precision floating-point arithmetic";
@@ -92,4 +94,4 @@ stdenv.mkDerivation rec {
     maintainers = [ ];
     platforms = lib.platforms.all;
   };
-}
+})
diff --git a/pkgs/by-name/mp/mprisence/package.nix b/pkgs/by-name/mp/mprisence/package.nix
index 908b6c5145a8..6f0864418195 100644
--- a/pkgs/by-name/mp/mprisence/package.nix
+++ b/pkgs/by-name/mp/mprisence/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mprisence";
-  version = "1.8.2";
+  version = "1.8.4";
 
   src = fetchFromGitHub {
     owner = "lazykern";
     repo = "mprisence";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-m3rmyE9sta8t2Xr3OQL85luPC2gnzCtA9hJ84dzqSVM=";
+    hash = "sha256-kPFTnwuyjad6qmJRg4ryFDL1slOt0JdOtzz3WTP0cKQ=";
   };
 
-  cargoHash = "sha256-BWsnQRKYjcJF3xojV73DCo2b99eLpuOuQHi4qZWmsnU=";
+  cargoHash = "sha256-tY6SBZ+vAGSTFRpOB4Y+ilZOx8EHOeLFsp3ZuQF0eQU=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/mu/musl-fts/package.nix b/pkgs/by-name/mu/musl-fts/package.nix
index 09c7cedb009b..6ba3b321df29 100644
--- a/pkgs/by-name/mu/musl-fts/package.nix
+++ b/pkgs/by-name/mu/musl-fts/package.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "void-linux";
     repo = "musl-fts";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     sha256 = "Azw5qrz6OKDcpYydE6jXzVxSM5A8oYWAztrHr+O/DOE=";
   };
 
@@ -22,8 +22,12 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
   ];
 
+  strictDeps = true;
+
   enableParallelBuilding = true;
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://github.com/void-linux/musl-fts";
     description = "Implementation of fts(3) for musl-libc";
diff --git a/pkgs/by-name/mu/musl-obstack/package.nix b/pkgs/by-name/mu/musl-obstack/package.nix
index e0172eb8aab9..cbd56e5bb559 100644
--- a/pkgs/by-name/mu/musl-obstack/package.nix
+++ b/pkgs/by-name/mu/musl-obstack/package.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "void-linux";
     repo = "musl-obstack";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     sha256 = "sha256-oydS7FubUniMHAUWfg84OH9+CZ0JCrTXy7jzwOyJzC8=";
   };
 
@@ -26,8 +26,12 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
   ];
 
+  strictDeps = true;
+
   enableParallelBuilding = true;
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://github.com/void-linux/musl-obstack";
     description = "Extraction of the obstack functions and macros from GNU libiberty for use with musl-libc";
diff --git a/pkgs/by-name/ne/nerd-font-patcher/package.nix b/pkgs/by-name/ne/nerd-font-patcher/package.nix
index 0fc27b25f6c1..4085ad081432 100644
--- a/pkgs/by-name/ne/nerd-font-patcher/package.nix
+++ b/pkgs/by-name/ne/nerd-font-patcher/package.nix
@@ -6,11 +6,11 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "nerd-font-patcher";
-  version = "3.5.0";
+  version = "3.5.1";
 
   src = fetchzip {
     url = "https://github.com/ryanoasis/nerd-fonts/releases/download/v${finalAttrs.version}/FontPatcher.zip";
-    hash = "sha256-Z3KpaSoJpZx3D07K5EtHBXDl4pyHxnTIg/AuXrzTWWA=";
+    hash = "sha256-gZ41oZPnsVLcchA58eJ1Vl28ccqePpOZd/ZCEKYywX4=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/ng/nghttp2/package.nix b/pkgs/by-name/ng/nghttp2/package.nix
index 209717165a3b..68a42a1826af 100644
--- a/pkgs/by-name/ng/nghttp2/package.nix
+++ b/pkgs/by-name/ng/nghttp2/package.nix
@@ -42,13 +42,13 @@ assert enableHpack -> enableApp;
 assert enableHttp3 -> enableApp;
 assert enableJemalloc -> enableApp;
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "nghttp2";
-  version = "1.69.0";
+  version = "1.70.0";
 
   src = fetchurl {
-    url = "https://github.com/nghttp2/nghttp2/releases/download/v${version}/nghttp2-${version}.tar.bz2";
-    hash = "sha256-PxhfWxw+d4heuc8/LE2ksan3OiS/WVe4KRg60Tf4Lcg=";
+    url = "https://github.com/nghttp2/nghttp2/releases/download/v${finalAttrs.version}/nghttp2-${finalAttrs.version}.tar.bz2";
+    hash = "sha256-j6yh94qpmsO8F2ina34PazbY5qYsE4GHUbHSBfAvlAU=";
   };
 
   outputs = [
@@ -77,6 +77,8 @@ stdenv.mkDerivation rec {
     ]
     ++ lib.optionals enablePython [ python3 ];
 
+  strictDeps = true;
+
   enableParallelBuilding = true;
 
   configureFlags = [
@@ -116,6 +118,8 @@ stdenv.mkDerivation rec {
     inherit curl libsoup_3;
   };
 
+  __structuredAttrs = true;
+
   meta = {
     description = "HTTP/2 C library and tools";
     longDescription = ''
@@ -129,10 +133,10 @@ stdenv.mkDerivation rec {
     '';
 
     homepage = "https://nghttp2.org/";
-    changelog = "https://github.com/nghttp2/nghttp2/releases/tag/v${version}";
+    changelog = "https://github.com/nghttp2/nghttp2/releases/tag/v${finalAttrs.version}";
     # News articles with changes summary can be found here: https://nghttp2.org/blog/archives/
     license = lib.licenses.mit;
     maintainers = [ ];
     platforms = lib.platforms.all;
   };
-}
+})
diff --git a/pkgs/by-name/ng/nghttp3/package.nix b/pkgs/by-name/ng/nghttp3/package.nix
index 852ebfce6194..94cbf454b4d2 100644
--- a/pkgs/by-name/ng/nghttp3/package.nix
+++ b/pkgs/by-name/ng/nghttp3/package.nix
@@ -23,6 +23,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ cmake ];
 
+  strictDeps = true;
+
   cmakeFlags = [
     (lib.cmakeBool "ENABLE_SHARED_LIB" (!stdenv.hostPlatform.isStatic))
     (lib.cmakeBool "ENABLE_STATIC_LIB" stdenv.hostPlatform.isStatic)
@@ -35,6 +37,8 @@ stdenv.mkDerivation (finalAttrs: {
     inherit curl;
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://github.com/ngtcp2/nghttp3";
     changelog = "https://github.com/ngtcp2/nghttp3/releases/tag/v${finalAttrs.version}";
diff --git a/pkgs/by-name/ni/ninja/package.nix b/pkgs/by-name/ni/ninja/package.nix
index 29196bd5db6a..39a2ada4da2a 100644
--- a/pkgs/by-name/ni/ninja/package.nix
+++ b/pkgs/by-name/ni/ninja/package.nix
@@ -52,6 +52,8 @@ stdenv.mkDerivation (finalAttrs: {
     libxslt.bin
   ];
 
+  strictDeps = true;
+
   patches = [
     ./0001-spawn-sh-instead-of-bin-sh.patch
   ]
@@ -114,6 +116,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru.updateScript = nix-update-script { };
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Small build system with a focus on speed";
     mainProgram = "ninja";
diff --git a/pkgs/by-name/ni/nix-output-monitor/package.nix b/pkgs/by-name/ni/nix-output-monitor/package.nix
index f6f4dda17d45..2787df1ff622 100644
--- a/pkgs/by-name/ni/nix-output-monitor/package.nix
+++ b/pkgs/by-name/ni/nix-output-monitor/package.nix
@@ -3,6 +3,7 @@
   haskellPackages,
   installShellFiles,
   lib,
+  extraComposeFunctions ? [ ],
 }:
 let
   inherit (haskell.lib.compose) justStaticExecutables overrideCabal;
@@ -27,7 +28,10 @@ let
   };
   raw-pkg = haskellPackages.callPackage ./generated-package.nix { };
 in
-lib.pipe raw-pkg [
-  (overrideCabal overrides)
-  justStaticExecutables
-]
+lib.pipe raw-pkg (
+  [
+    (overrideCabal overrides)
+    justStaticExecutables
+  ]
+  ++ extraComposeFunctions
+)
diff --git a/pkgs/by-name/ni/nixtamal/package.nix b/pkgs/by-name/ni/nixtamal/package.nix
index 294ab8df1c11..679262844969 100644
--- a/pkgs/by-name/ni/nixtamal/package.nix
+++ b/pkgs/by-name/ni/nixtamal/package.nix
@@ -21,7 +21,7 @@
 
 ocamlPackages.buildDunePackage (finalAttrs: {
   pname = "nixtamal";
-  version = "1.9.3";
+  version = "1.10.0";
   release_year = 2026;
 
   minimalOCamlVersion = "5.3";
@@ -30,7 +30,7 @@ ocamlPackages.buildDunePackage (finalAttrs: {
     url = "https://darcs.toastal.in.th/nixtamal/stable/";
     mirrors = [ "https://smeder.ee/~toastal/nixtamal.darcs" ];
     rev = finalAttrs.version;
-    hash = "sha256-NlCm9XQBK5ooX67ruOJr8TWlOAHGoCgNwIU0BKWol84=";
+    hash = "sha256-IiR8hihbhdGDIcKA4dwQPcieSxT6VOlB2TcuHB16PmQ=";
   };
 
   nativeBuildInputs = [
@@ -170,5 +170,6 @@ ocamlPackages.buildDunePackage (finalAttrs: {
       • No experimental Nix features required
     '';
     maintainers = with lib.maintainers; [ toastal ];
+    donationPage = "https://nixtamal.toast.al/funding/";
   };
 })
diff --git a/pkgs/by-name/no/noctalia-greeter/package.nix b/pkgs/by-name/no/noctalia-greeter/package.nix
index e223372a8a8a..2025ae76565b 100644
--- a/pkgs/by-name/no/noctalia-greeter/package.nix
+++ b/pkgs/by-name/no/noctalia-greeter/package.nix
@@ -28,18 +28,6 @@
   nix-update-script,
 }:
 
-let
-  # nixpkgs stb doesn't have stb_image_resize2.h which noctalia-greeter needs
-  stb' = stb.overrideAttrs {
-    version = "0-unstable-2025-10-26";
-    src = fetchFromGitHub {
-      owner = "nothings";
-      repo = "stb";
-      rev = "f1c79c02822848a9bed4315b12c8c8f3761e1296";
-      hash = "sha256-BlyXJtAI7WqXCTT3ylww8zoG0hBxaojJnQDvdQOXJPE=";
-    };
-  };
-in
 stdenv.mkDerivation (finalAttrs: {
   pname = "noctalia-greeter";
   version = "1.2.1";
@@ -73,7 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
     libxkbcommon
     nlohmann_json
     pango
-    stb'
+    stb
     tomlplusplus
     wayland
     wayland-protocols
diff --git a/pkgs/by-name/no/noctalia/package.nix b/pkgs/by-name/no/noctalia/package.nix
index cd253f686ae0..f3d6a17bda87 100644
--- a/pkgs/by-name/no/noctalia/package.nix
+++ b/pkgs/by-name/no/noctalia/package.nix
@@ -50,18 +50,6 @@
   gitMinimal,
 }:
 
-let
-  # nixpkgs stb doesn't have stb_image_resize2.h which noctalia needs
-  stb' = stb.overrideAttrs {
-    version = "0-unstable-2025-10-26";
-    src = fetchFromGitHub {
-      owner = "nothings";
-      repo = "stb";
-      rev = "f1c79c02822848a9bed4315b12c8c8f3761e1296";
-      hash = "sha256-BlyXJtAI7WqXCTT3ylww8zoG0hBxaojJnQDvdQOXJPE=";
-    };
-  };
-in
 stdenv.mkDerivation (finalAttrs: {
   __structuredAttrs = true;
 
@@ -113,7 +101,7 @@ stdenv.mkDerivation (finalAttrs: {
     pipewire
     polkit
     sdbus-cpp_2
-    stb'
+    stb
     systemdLibs
     tomlplusplus
     wayland
diff --git a/pkgs/by-name/ns/nspr/package.nix b/pkgs/by-name/ns/nspr/package.nix
index 372a7b3f067f..9784147f643b 100644
--- a/pkgs/by-name/ns/nspr/package.nix
+++ b/pkgs/by-name/ns/nspr/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nspr";
-  version = "4.39";
+  version = "4.40";
 
   src = fetchurl {
     url = "mirror://mozilla/nspr/releases/v${finalAttrs.version}/src/nspr-${finalAttrs.version}.tar.gz";
-    hash = "sha256-u9Au6HpVZ2Bjpj5byBngIn3iZmtHMHsqATRBTN9CNo4=";
+    hash = "sha256-wMGITGJ/Pbeng/fHMUxpUiayBDaWeR0VUZ5+BXjBm9w=";
   };
 
   patches = [
@@ -53,6 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   meta = {
+    changelog = "https://github.com/mozilla/nspr/releases/tag/NSPR_${lib.concatStringsSep "_" (lib.splitVersion finalAttrs.version)}_RTM";
     homepage = "https://firefox-source-docs.mozilla.org/nspr/index.html";
     description = "Netscape Portable Runtime, a platform-neutral API for system-level and libc-like functions";
     maintainers = with lib.maintainers; [
diff --git a/pkgs/by-name/nu/nushell/package.nix b/pkgs/by-name/nu/nushell/package.nix
index a798e0559e9a..d8fed2d39945 100644
--- a/pkgs/by-name/nu/nushell/package.nix
+++ b/pkgs/by-name/nu/nushell/package.nix
@@ -25,16 +25,16 @@ rustPlatform.buildRustPackage (finalAttrs: {
   # NOTE: when updating this to a new non-patch version, please also try to
   # update the plugins. Plugins only work if they are compiled for the same
   # major/minor version.
-  version = "0.115.0";
+  version = "0.115.1";
 
   src = fetchFromGitHub {
     owner = "nushell";
     repo = "nushell";
     tag = finalAttrs.version;
-    hash = "sha256-9QzdbNP8S9TmW8MRUVqvVRAi6dxTP3T2WY3+wuypsck=";
+    hash = "sha256-qndvtW1yD4n++LpGp+ucQVNqIm8jgcrM3M4O5q5WDgk=";
   };
 
-  cargoHash = "sha256-Vby1x3/W1IUs73bFz/+AZpn4IepWScqrGp0tXlF6an4=";
+  cargoHash = "sha256-73JFGry/aVBwIAs5DTqx7GbeCfwIopEIZ8pQp75TRq4=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/nu/nushell/plugins/polars/package.nix b/pkgs/by-name/nu/nushell/plugins/polars/package.nix
index 18c23ca6939d..bfd1aeba1821 100644
--- a/pkgs/by-name/nu/nushell/plugins/polars/package.nix
+++ b/pkgs/by-name/nu/nushell/plugins/polars/package.nix
@@ -10,9 +10,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "nu_plugin_polars";
-  inherit (nushell) version src;
-
-  cargoHash = "sha256-Vby1x3/W1IUs73bFz/+AZpn4IepWScqrGp0tXlF6an4=";
+  inherit (nushell) version src cargoHash;
 
   nativeBuildInputs = [ pkg-config ] ++ lib.optionals stdenv.cc.isClang [ rustPlatform.bindgenHook ];
   buildInputs = [ openssl ];
diff --git a/pkgs/by-name/oc/oci-cli/package.nix b/pkgs/by-name/oc/oci-cli/package.nix
index 349eef72ddd9..2fe978a4d9cb 100644
--- a/pkgs/by-name/oc/oci-cli/package.nix
+++ b/pkgs/by-name/oc/oci-cli/package.nix
@@ -31,14 +31,14 @@ in
 
 py.pkgs.buildPythonApplication (finalAttrs: {
   pname = "oci-cli";
-  version = "3.90.2";
+  version = "3.91.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "oracle";
     repo = "oci-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-FpLbJQGuajT72XSRpBYRpwqggqebuiRXID9x7ucZrng=";
+    hash = "sha256-vCTgug7wGohw7o2zj+rSsG2xR58s+/107g5z3ttCf+E=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/by-name/op/openfreebuds/package.nix b/pkgs/by-name/op/openfreebuds/package.nix
index 29fd14b2a4e0..2d9daa41a5d2 100644
--- a/pkgs/by-name/op/openfreebuds/package.nix
+++ b/pkgs/by-name/op/openfreebuds/package.nix
@@ -8,13 +8,13 @@
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "openfreebuds";
-  version = "0.17.3";
+  version = "0.18.0";
 
   src = fetchFromGitHub {
     owner = "melianmiko";
     repo = "OpenFreebuds";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3DTSoVnHYB8GjKw0G8O3hlkOdQmDxe6B2O7h6LT1+jg=";
+    hash = "sha256-wl+peoklWEC/k99ZfPACvM0HvgTtvbHCXqdwKOAv7Bg=";
   };
 
   pyproject = true;
diff --git a/pkgs/by-name/op/openhack/package.nix b/pkgs/by-name/op/openhack/package.nix
index 172f9d46efd3..e6674e07d6b6 100644
--- a/pkgs/by-name/op/openhack/package.nix
+++ b/pkgs/by-name/op/openhack/package.nix
@@ -8,7 +8,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "openhack";
-  version = "0.2.3";
+  version = "0.2.4";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -17,7 +17,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "openhackai";
     repo = "openhack";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ptM4jL+Wjmz9n4HPa87s5kLHU1OhSyD2AEz0m/i6E3o=";
+    hash = "sha256-vdjOjCeYXlwia1NBKkD94fPHjb4Ho/69NrCOLoz51No=";
   };
 
   build-system = with python3Packages; [ hatchling ];
diff --git a/pkgs/by-name/op/openlinkhub/package.nix b/pkgs/by-name/op/openlinkhub/package.nix
index 7330c386cb13..b87eaf9778a2 100644
--- a/pkgs/by-name/op/openlinkhub/package.nix
+++ b/pkgs/by-name/op/openlinkhub/package.nix
@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "openlinkhub";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "jurkovic-nikola";
     repo = "OpenLinkHub";
     tag = finalAttrs.version;
-    hash = "sha256-VGrLQmg+ze60LRVmzeN8y8W8ZQt1Zxk8iENOsxNaOZ4=";
+    hash = "sha256-MIr37WrS3DoBL1gdzUkXugX8KksUA3x5pTsh5+6VBXs=";
   };
 
   proxyVendor = true;
diff --git a/pkgs/by-name/op/opnborg/package.nix b/pkgs/by-name/op/opnborg/package.nix
index 78ec4f52d932..158750745a18 100644
--- a/pkgs/by-name/op/opnborg/package.nix
+++ b/pkgs/by-name/op/opnborg/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "opnborg";
-  version = "0.1.132";
+  version = "0.1.184";
 
   src = fetchFromGitHub {
     owner = "paepckehh";
     repo = "opnborg";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CfpmxYfC8VrfmO8H/mo7F6aeHVA/a2uJBA9CSYv9r/o=";
+    hash = "sha256-WjQy9LGJE+mcpuS+6h2ndsUqyyoroIPOLk/xwgzva0U=";
   };
 
-  vendorHash = "sha256-vNWtAtwWjjpZbWyduWWk/OF+iuvpGpbBUsy0cUZ5tYw=";
+  vendorHash = "sha256-obKLMRGwgsZMGOX+1AIODmzBJBJTlLcUJ9MvGnCT9WI=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/os/oscar64/package.nix b/pkgs/by-name/os/oscar64/package.nix
index 445b5ef07fde..8f6a7c66e355 100644
--- a/pkgs/by-name/os/oscar64/package.nix
+++ b/pkgs/by-name/os/oscar64/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "oscar64";
-  version = "1.32.272";
+  version = "1.32.273";
 
   src = fetchFromGitHub {
     owner = "drmortalwombat";
     repo = "oscar64";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-u27aEnEKhzgVERqrnKrooqvSWdF1kS4GunEopUSv0NA=";
+    hash = "sha256-Z2QIj7KX4Wg0ed4D6AfZkl3cqrpLgRWRyswCGga7h1k=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/pc/pcre2/package.nix b/pkgs/by-name/pc/pcre2/package.nix
index d846f87c0e42..91f18224b430 100644
--- a/pkgs/by-name/pc/pcre2/package.nix
+++ b/pkgs/by-name/pc/pcre2/package.nix
@@ -3,9 +3,6 @@
   stdenv,
   fetchurl,
   updateAutotoolsGnuConfigScriptsHook,
-  # Causes consistent segfaults on ELFv1 PPC64 when trying to use Perl regex in gnugrep
-  # https://github.com/PCRE2Project/pcre2/issues/762
-  withJitSealloc ? !(stdenv.hostPlatform.isPower64 && stdenv.hostPlatform.isAbiElfv1),
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -28,9 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
     "--enable-pcre2-32"
     # only enable jit on supported platforms which excludes Apple Silicon, see https://github.com/zherczeg/sljit/issues/51
     "--enable-jit=${if stdenv.hostPlatform.isS390x then "no" else "auto"}"
-  ]
-  # fix pcre jit in systemd units that set MemoryDenyWriteExecute=true like gitea
-  ++ lib.optional withJitSealloc "--enable-jit-sealloc";
+  ];
 
   outputs = [
     "bin"
diff --git a/pkgs/by-name/ph/phpantom-lsp/package.nix b/pkgs/by-name/ph/phpantom-lsp/package.nix
index 06c365793f63..6e23b1b44151 100644
--- a/pkgs/by-name/ph/phpantom-lsp/package.nix
+++ b/pkgs/by-name/ph/phpantom-lsp/package.nix
@@ -10,13 +10,13 @@ let
   stubsSrc = fetchFromGitHub {
     owner = "JetBrains";
     repo = "phpstorm-stubs";
-    rev = "f6dd2dd35d99fb774251a83555fe07bf2109d57e";
-    hash = "sha256-H9Td/yi9Um0Z9ifxZdh74bvGCMVSC+MA1OHrtbGD8vE=";
+    rev = "5f68c1021badebe34119fb8fa10ba7cc25de6c0c";
+    hash = "sha256-GQW+N5FrWKf6PpLyhJ6Gywbe1lESwW/rxiv2ESNdH1s=";
   };
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "phpantom-lsp";
-  version = "0.9.0";
+  version = "0.10.0";
 
   __structuredAttrs = true;
 
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "PHPantom-dev";
     repo = "phpantom_lsp";
     tag = finalAttrs.version;
-    hash = "sha256-euWaFH40VHefZewUcKvsLwwHZP+GwfTN8kfuAkaABB8=";
+    hash = "sha256-P5adooUaNCidGTIh/PDKzwvtIXCQ0y8tUMbLUC4sk98=";
   };
 
   postPatch = ''
@@ -36,7 +36,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       > stubs/jetbrains/phpstorm-stubs/.commit
   '';
 
-  cargoHash = "sha256-2MIJxVRqyCv5HzCwY1s+rCp1A4vFRsyAEEuyIEegZMA=";
+  cargoHash = "sha256-tZh1cn7Zu47FRVXozDjcoKW4MoxaaaxPmDX5OzlxnAs=";
 
   checkFlags = [
     "--test"
diff --git a/pkgs/by-name/pi/pipewire/package.nix b/pkgs/by-name/pi/pipewire/package.nix
index 144def6c59a9..981c7f867324 100644
--- a/pkgs/by-name/pi/pipewire/package.nix
+++ b/pkgs/by-name/pi/pipewire/package.nix
@@ -12,8 +12,8 @@
   elogind,
   libinotify-kqueue,
   epoll-shim,
-  systemd,
-  enableSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd, # enableSystemd=false maintained by maintainers.highghlow.
+  systemdLibs,
+  enableSystemd ? lib.meta.availableOn stdenv.hostPlatform systemdLibs, # enableSystemd=false maintained by maintainers.highghlow.
   pkg-config,
   docutils,
   doxygen,
@@ -157,7 +157,7 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ (
     if enableSystemd then
-      [ systemd ]
+      [ systemdLibs ]
     else if stdenv.hostPlatform.isLinux then
       [
         elogind
diff --git a/pkgs/by-name/pn/pnpmBuildHook/package.nix b/pkgs/by-name/pn/pnpmBuildHook/package.nix
index 361c15a16b99..0c86980d53b8 100644
--- a/pkgs/by-name/pn/pnpmBuildHook/package.nix
+++ b/pkgs/by-name/pn/pnpmBuildHook/package.nix
@@ -6,5 +6,4 @@ makeSetupHook {
   # the config hook must also be used.
   name = "pnpm-build-hook";
 
-  __structuredAttrs = true;
 } ./pnpm-build-hook.sh
diff --git a/pkgs/by-name/po/polkit/package.nix b/pkgs/by-name/po/polkit/package.nix
index 723f80bcdc74..381463f368af 100644
--- a/pkgs/by-name/po/polkit/package.nix
+++ b/pkgs/by-name/po/polkit/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   pkg-config,
   glib,
   expat,
@@ -22,6 +21,7 @@
   docbook_xml_dtd_412,
   gtk-doc,
   coreutils,
+  useConsoleKit ? false,
   useSystemd ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
   systemdLibs,
   elogind,
@@ -40,10 +40,12 @@ let
   system = "/run/current-system/sw";
   setuid = "/run/wrappers/bin";
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "polkit";
   version = "127";
 
+  disallowedReferences = lib.optional useConsoleKit systemdLibs;
+
   outputs = [
     "bin"
     "dev"
@@ -54,7 +56,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "polkit-org";
     repo = "polkit";
-    rev = version;
+    rev = finalAttrs.version;
     hash = "sha256-YTugETy0rqu/bv53jV1UeGqSK79bRXR52EJNcTblvzo=";
   };
 
@@ -95,7 +97,7 @@ stdenv.mkDerivation rec {
     dbus
     duktape
   ]
-  ++ lib.optionals stdenv.hostPlatform.isLinux [
+  ++ lib.optionals (stdenv.hostPlatform.isLinux && !useConsoleKit) [
     # On Linux, fall back to elogind when systemd support is off.
     (if useSystemd then systemdLibs else elogind)
   ];
@@ -146,7 +148,14 @@ stdenv.mkDerivation rec {
     "-Dsystemdsystemunitdir=${placeholder "out"}/lib/systemd/system"
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
-    "-Dsession_tracking=${if useSystemd then "logind" else "elogind"}"
+    "-Dsession_tracking=${
+      if useSystemd then
+        "logind"
+      else if useConsoleKit then
+        "ConsoleKit"
+      else
+        "elogind"
+    }"
   ];
 
   inherit doCheck;
@@ -193,4 +202,4 @@ stdenv.mkDerivation rec {
     ];
     teams = [ lib.teams.freedesktop ];
   };
-}
+})
diff --git a/pkgs/by-name/po/positron-bin/package.nix b/pkgs/by-name/po/positron-bin/package.nix
index a61b4b15df7d..1de17268cfc3 100644
--- a/pkgs/by-name/po/positron-bin/package.nix
+++ b/pkgs/by-name/po/positron-bin/package.nix
@@ -31,7 +31,7 @@
 }:
 let
   pname = "positron-bin";
-  version = "2026.08.1-2";
+  version = "2026.08.2-4";
 in
 stdenv.mkDerivation {
   dontFixup = stdenv.hostPlatform.isDarwin;
@@ -41,17 +41,17 @@ stdenv.mkDerivation {
     if stdenv.hostPlatform.isDarwin then
       fetchurl {
         url = "https://cdn.posit.co/positron/releases/mac/arm64/Positron-${version}-arm64.dmg";
-        hash = "sha256-U4uO1T0SsFq/gzE5SdvAMj6tt+Bi1KiMImT+JcSBBwA=";
+        hash = "sha256-ocDWNEWiIfgLcFOTD6KqaqswRpQqf4dVqJe28lDYs9k=";
       }
     else if stdenv.hostPlatform.system == "aarch64-linux" then
       fetchurl {
         url = "https://cdn.posit.co/positron/releases/deb/arm64/Positron-${version}-arm64.deb";
-        hash = "sha256-eMy5uPJfagyZ/SMzZ/ZnXCQAG/VDR9WtaUQjAgl218o=";
+        hash = "sha256-EHZZYLGquikmhWYPjv7+I4f1ZkSvyI9Q6nRJXvgGBk0=";
       }
     else
       fetchurl {
         url = "https://cdn.posit.co/positron/releases/deb/x86_64/Positron-${version}-x64.deb";
-        hash = "sha256-4wfTcQsFTeQja2JZFwJBmIfXO9tl6CU/J5/HZj087Yk=";
+        hash = "sha256-DmlFAr24drfuqWK22uPXfHvPIuvQrtq3Yl5hUgcY3Oo=";
       };
 
   buildInputs = [
diff --git a/pkgs/by-name/pr/prometheus-alertmanager/elm-ui.nix b/pkgs/by-name/pr/prometheus-alertmanager/elm-ui.nix
index 8beaa9c5f34e..7c0422035e05 100644
--- a/pkgs/by-name/pr/prometheus-alertmanager/elm-ui.nix
+++ b/pkgs/by-name/pr/prometheus-alertmanager/elm-ui.nix
@@ -13,6 +13,7 @@ buildNpmPackage (finalAttrs: {
   postPatch = ''
     # don't download elm from github
     sed -i '/"elm":/d' package.json
+    substituteInPlace elm.json --replace-fail "0.19.1" "${elmPackages.elm.version}"
   '';
 
   postConfigure = (
diff --git a/pkgs/by-name/pr/proxyt/package.nix b/pkgs/by-name/pr/proxyt/package.nix
new file mode 100644
index 000000000000..37962bc86288
--- /dev/null
+++ b/pkgs/by-name/pr/proxyt/package.nix
@@ -0,0 +1,55 @@
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  fetchFromGitHub,
+  installShellFiles,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "proxyt";
+  version = "0.0.7";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "jaxxstorm";
+    repo = "proxyt";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-6+MgmhacH0oZY9ksZdBpv/tH4su8EBtHOiBIbR3ZXxo=";
+  };
+
+  vendorHash = "sha256-eAOU4DRnvfHdIc3cXMCAHbw7AZJWkEk/u3ae+K43CVc=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=github.com/jaxxstorm/proxyt/cmd.Version=${finalAttrs.version}"
+  ];
+
+  env = {
+    CGO_ENABLED = "0";
+  };
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd proxyt \
+      --bash <($out/bin/proxyt completion bash) \
+      --fish <($out/bin/proxyt completion fish) \
+      --zsh <($out/bin/proxyt completion zsh)
+  '';
+
+  meta = {
+    changelog = "https://github.com/jaxxstorm/proxyt/releases/${finalAttrs.version}";
+    description = "Simple proxy for the Tailscale control plane";
+    homepage = "https://github.com/jaxxstorm/proxyt";
+    license = lib.licenses.mit;
+    mainProgram = "proxyt";
+    maintainers = with lib.maintainers; [ marie ];
+  };
+})
diff --git a/pkgs/by-name/pu/publicsuffix-list/package.nix b/pkgs/by-name/pu/publicsuffix-list/package.nix
index d6c15745fa64..fd7ab77f7b9e 100644
--- a/pkgs/by-name/pu/publicsuffix-list/package.nix
+++ b/pkgs/by-name/pu/publicsuffix-list/package.nix
@@ -7,17 +7,19 @@
 
 stdenvNoCC.mkDerivation {
   pname = "publicsuffix-list";
-  version = "0-unstable-2026-07-25";
+  version = "0-unstable-2026-08-14";
 
   src = fetchFromGitHub {
     owner = "publicsuffix";
     repo = "list";
-    rev = "e1b8015c3b2f0f4f8c18659c2480fc1a22c07b20";
-    hash = "sha256-F+OmANpg7I4dBFL7PM3oJlhpDzfxrRTfo+50lQHdU2M=";
+    rev = "a77cfe0674a4b05c6e2448c01f3cb2c965a1b6d8";
+    hash = "sha256-b/8hOFxgnoGQHGfgZ3Xz8H4Gu5ssxwHOCHswX2uQHMc=";
   };
 
   dontBuild = true;
 
+  strictDeps = true;
+
   installPhase = ''
     runHook preInstall
 
@@ -28,6 +30,8 @@ stdenvNoCC.mkDerivation {
 
   passthru.updateScript = unstableGitUpdater { };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://publicsuffix.org/";
     description = "Cross-vendor public domain suffix database";
diff --git a/pkgs/by-name/py/pyscan/package.nix b/pkgs/by-name/py/pyscan/package.nix
index 7482b3eb7691..1dde51029347 100644
--- a/pkgs/by-name/py/pyscan/package.nix
+++ b/pkgs/by-name/py/pyscan/package.nix
@@ -13,7 +13,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "pyscan";
-  version = "0.1.4";
+  version = "2.1.3";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -22,12 +22,12 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "ohaswin";
     repo = "pyscan";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-n1mwOYntWyW7lPKPLgG7PteTRh3mly5vqbKy2R/9xnw=";
+    hash = "sha256-I5Chs9N/ZH7NM1CsaIKjO0eS68/t+wZaHGEO59Ur/+8=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-QzFUoHfvjd6ZMkKIsGXIVyks2LxdJblIiQccsOoYcJs=";
+    hash = "sha256-Y3fxKYpGJCX4VECe0mmP2lDZc4efd9tNXY8YLeQXXRk=";
   };
 
   build-system = [
diff --git a/pkgs/by-name/rd/rdfind/package.nix b/pkgs/by-name/rd/rdfind/package.nix
index a88ebc058953..a1e3e3fd9f52 100644
--- a/pkgs/by-name/rd/rdfind/package.nix
+++ b/pkgs/by-name/rd/rdfind/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rdfind";
-  version = "1.7.0";
+  version = "1.8.0";
 
   src = fetchurl {
     url = "https://rdfind.pauldreik.se/rdfind-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-eMRjFS4dnk/Rv+uDuckt9ef8TF+Tx9Qm+x9++ivk3yk=";
+    sha256 = "sha256-Ci0NMgAswtwBNO57ZJvMgR7PsvjZ9nKqR2qFEVLnrzU=";
   };
 
   # the built-in configure script was generated by autoconf 2.72 and
diff --git a/pkgs/by-name/re/re2/package.nix b/pkgs/by-name/re/re2/package.nix
index 06249cd01c8f..06bc5bd10c12 100644
--- a/pkgs/by-name/re/re2/package.nix
+++ b/pkgs/by-name/re/re2/package.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "google";
     repo = "re2";
-    rev = finalAttrs.version;
+    tag = finalAttrs.version;
     hash = "sha256-0J1HVk+eR7VN0ymucW9dNlT36j16XIfCzcs1EVyEIEU=";
   };
 
@@ -43,6 +43,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   propagatedBuildInputs = [ abseil-cpp ] ++ lib.optionals (!stdenv.hostPlatform.isStatic) [ icu ];
 
+  strictDeps = true;
+
   cmakeFlags = [
     (lib.cmakeBool "RE2_BUILD_TESTING" true)
     (lib.cmakeFeature "CMAKE_CTEST_ARGUMENTS" "--timeout;999999")
@@ -60,6 +62,8 @@ stdenv.mkDerivation (finalAttrs: {
     haskell-re2 = haskellPackages.re2;
   };
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Regular expression library";
     longDescription = ''
diff --git a/pkgs/by-name/re/reposilite/package.nix b/pkgs/by-name/re/reposilite/package.nix
index 46de85e51b36..e7d6454166d6 100644
--- a/pkgs/by-name/re/reposilite/package.nix
+++ b/pkgs/by-name/re/reposilite/package.nix
@@ -18,11 +18,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "Reposilite";
-  version = "3.5.28";
+  version = "3.6.2";
 
   src = fetchurl {
     url = "https://maven.reposilite.com/releases/com/reposilite/reposilite/${finalAttrs.version}/reposilite-${finalAttrs.version}-all.jar";
-    hash = "sha256-sKbwO5Lk/DeRQhO3c2zHuHe/CPdb4wRLzG55tP7DVVE=";
+    hash = "sha256-N7oGxGQHGwy6iflj6uiiJGCc5KpCZgIO7+QACiR2Fuc=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/re/reposilite/plugins.json b/pkgs/by-name/re/reposilite/plugins.json
index cdff843cbcd2..d70cba3ecc64 100644
--- a/pkgs/by-name/re/reposilite/plugins.json
+++ b/pkgs/by-name/re/reposilite/plugins.json
@@ -1,7 +1,7 @@
 {
-  "checksum": "sha256-z5/Er3e/0cxs6gic44ncVXxpfbyXqadSSc16D67DwHY=",
-  "groovy": "sha256-R6htqL1vx6C8bagCBDbLZJ8tldXRWzOQ6mrowRmdIKU=",
-  "migration": "sha256-Sl5vlkmxkCGkWQmfkn+QdX3tJ/S9WL/DpQUYB3Y4Yrs=",
-  "prometheus": "sha256-8sCoot7tc74Xnwsz/In68XWMeqcnocfbiKWDl/BSqlI=",
-  "swagger": "sha256-WHFUg/T9fFKrioLNeKQtJvYlhAI68HXcFEMCtpB70Vk="
+  "checksum": "sha256-vRRHaA05BHKs4fP+ono9UNSMi6O9WOO/pY/Rmh08+8A=",
+  "groovy": "sha256-lytD+79N/WswnLLpfRElTktDQ5P24voQgthdBX7aagw=",
+  "migration": "sha256-taai2JRCyC6oJM6u25mEKLUtGs/5RAx7GXIM8lWk3b4=",
+  "prometheus": "sha256-CcurL21i8cHXj6tYIbU84/wBMSJuLSnHXLRCTY5H1OU=",
+  "swagger": "sha256-ULk0HpKTZyq1DOb3XAG3OiDbmQS6YA3pV9X0jdzoD8Q="
 }
diff --git a/pkgs/by-name/re/rerun/package.nix b/pkgs/by-name/re/rerun/package.nix
index 2a4decf21273..29fc17a3d361 100644
--- a/pkgs/by-name/re/rerun/package.nix
+++ b/pkgs/by-name/re/rerun/package.nix
@@ -40,7 +40,7 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rerun";
-  version = "0.36.2";
+  version = "0.36.3";
 
   __structuredAttrs = true;
 
@@ -53,7 +53,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "rerun-io";
     repo = "rerun";
     tag = finalAttrs.version;
-    hash = "sha256-vGbR3rjqlIoQaho5rTLgeZDO0ZKfzZwPdA1OHU3/C3E=";
+    hash = "sha256-oJduGAL+fqnQKEWIcpgH/X8F0+sW3BTF9x0nBco4Do4=";
   };
 
   # The path in `build.rs` is wrong for some reason, so we patch it to make the passthru tests work
@@ -62,7 +62,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail '"rerun_sdk/rerun_cli/rerun"' '"rerun_sdk/rerun"'
   '';
 
-  cargoHash = "sha256-oqlGsNb8j0thRAh+/2E95nGfhggQss89rvWvuvjNWUY=";
+  cargoHash = "sha256-8rNIf6Rl7MYo+nk1qxOdmY8BmTKvjBb47Hk6xBeMIVE=";
 
   cargoBuildFlags = [
     "--package"
diff --git a/pkgs/by-name/rh/rhash/package.nix b/pkgs/by-name/rh/rhash/package.nix
index f55b1a6275b9..0f37c334af04 100644
--- a/pkgs/by-name/rh/rhash/package.nix
+++ b/pkgs/by-name/rh/rhash/package.nix
@@ -14,13 +14,15 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "rhash";
     repo = "RHash";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-9/kFI38PG3AKsdDqEV/wEzSel9IlQQ/pvOyhU/N/aV0=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-9/kFI38PG3AKsdDqEV/wEzSel9IlQQ/pvOyhU/N/aV0=";
   };
 
   nativeBuildInputs = [ which ];
   buildInputs = lib.optionals stdenv.hostPlatform.isFreeBSD [ gettext ];
 
+  strictDeps = true;
+
   # configure script is not autotools-based, doesn't support these options
   dontAddStaticConfigureFlags = true;
 
@@ -46,6 +48,8 @@ stdenv.mkDerivation (finalAttrs: {
     "install-lib-so-link"
   ];
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://rhash.sourceforge.net/";
     description = "Console utility and library for computing and verifying hash sums of files";
diff --git a/pkgs/by-name/ro/rofi-games/package.nix b/pkgs/by-name/ro/rofi-games/package.nix
index 50ffb68edf76..51efa1e744b0 100644
--- a/pkgs/by-name/ro/rofi-games/package.nix
+++ b/pkgs/by-name/ro/rofi-games/package.nix
@@ -3,30 +3,34 @@
   stdenv,
   fetchFromGitHub,
   rustPlatform,
+
   cargo,
   just,
   rofi,
   pkg-config,
+
   glib,
   cairo,
   pango,
   sqlite,
+
+  nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rofi-games";
-  version = "1.16.2";
+  version = "1.18.0";
 
   src = fetchFromGitHub {
     owner = "Rolv-Apneseth";
     repo = "rofi-games";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LwzlBjRh9YdUGBl9+L3Vdetmy7lUdAIvjKvp8hSebvY=";
+    hash = "sha256-6/UeQ+j38NeQFkeP0Pb2UKUbwruPgUos3e9TUQwv9WI=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-opImhuLXj3/TtpmBjjMvrcdHalxYFyv5QZ0V8poYH7U=";
+    hash = "sha256-oWmfzlt/qqg1CYfk1pKWhaapiP3iqFU4Idn6pBivjko=";
   };
 
   patches = [
@@ -53,6 +57,8 @@ stdenv.mkDerivation (finalAttrs: {
     sqlite
   ];
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     changelog = "https://github.com/Rolv-Apneseth/rofi-games/blob/${finalAttrs.src.rev}/CHANGELOG.md";
     description = "Rofi plugin which adds a mode that will list available games for launch along with their box art";
diff --git a/pkgs/by-name/rs/rsync/package.nix b/pkgs/by-name/rs/rsync/package.nix
index a39a47765b4d..9f94ca51fcc8 100644
--- a/pkgs/by-name/rs/rsync/package.nix
+++ b/pkgs/by-name/rs/rsync/package.nix
@@ -2,9 +2,9 @@
   lib,
   stdenv,
   fetchurl,
-  fetchpatch,
 
   updateAutotoolsGnuConfigScriptsHook,
+  bashNonInteractive,
   perl,
   python3,
   libiconv,
@@ -29,27 +29,33 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rsync";
-  version = "3.4.4";
+  version = "3.5.0";
 
   src = fetchurl {
     # signed with key 9FEF 112D CE19 A0DC 7E88  2CB8 1BB2 4997 A853 5F6F
     url = "mirror://samba/rsync/src/rsync-${finalAttrs.version}.tar.gz";
-    hash = "sha256-vYjPgvplPaMjFPsikTZAfFyQ+A0XWNj0sJF2eHfY+pY=";
+    hash = "sha256-x//R72U+mVQPZh5HywC3+crR7muXI5mxb5PWcmVuDTM=";
   };
 
-  patches = [
-    # Fixes test failure on darwin
-    (fetchpatch {
-      url = "https://github.com/RsyncProject/rsync/commit/e1c5f0e93a75dd45f32f3b92ba221ef158ac2e5f.patch";
-      hash = "sha256-pg65K9BCTq/WvS5icK6KT28ARccFKedp2445wLYdRsE=";
-      excludes = [
-        ".github/workflows/cygwin-build.yml"
-      ];
-    })
-  ];
+  patches = [ ];
+
+  # Remove with the first upstream release that links t_acl against the snprintf fallback.
+  postPatch = ''
+    substituteInPlace Makefile.in \
+      --replace-fail 'T_ACL_OBJ = t_acl.o lib/acl.o' 'T_ACL_OBJ = t_acl.o lib/acl.o lib/snprintf.o'
+  '';
 
   preBuild = ''
-    patchShebangs ./runtests.py
+    patchShebangs ./runtests.py ./support/rrsync
+
+    # patchShebangs ignores non-executable test sources and embedded shebangs.
+    substituteInPlace \
+      testsuite/{daemon-namecvt-{empty-response,newline-token},rrsync-{sender-parent-pin,symlink}}_test.py \
+      --replace-fail '#!/usr/bin/env python3' '#!${python3}/bin/python3'
+
+    substituteInPlace \
+      testsuite/rsync-ssl-stunnel-{ca-required,hostname-check}_test.py \
+      --replace-fail '#!/usr/bin/env bash' '#!${stdenv.shell}'
   '';
 
   nativeBuildInputs = [
@@ -58,6 +64,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
+    bashNonInteractive
     libiconv
     zlib
     popt
@@ -103,12 +110,41 @@ stdenv.mkDerivation (finalAttrs: {
     python3
   ];
 
-  # Test fails when built in a chroot store
+  # These require set-id, chown, xattrs, or unrestricted /proc/self/fd,
+  # which the Linux Nix build sandbox does not provide.
   preCheck = ''
-    rm testsuite/chgrp.test
+    export RSYNC_EXCLUDE=${
+      lib.concatStringsSep "," (
+        lib.optionals stdenv.hostPlatform.isLinux [
+          "chmod-option"
+          "chmod-setid"
+          "chown-fake"
+          "fake-super-backup-fifo-regression"
+          "protected-regular"
+          "rrsync-backup-dir-inband-pivot"
+          "rrsync-pull-delivers-content"
+          "variety-symlink-traversal"
+          "variety"
+        ]
+        # The Darwin sandbox drops set-id bits, and Python's os.getgroups()
+        # reports account groups that may not be usable by this process.
+        ++ lib.optionals stdenv.hostPlatform.isDarwin [
+          "chmod-setid"
+          "daemon-groupmap-wild"
+        ]
+        # This test assumes that every Linux libc provides glibc malloc stats.
+        ++ lib.optional stdenv.hostPlatform.isMusl "misc-coverage"
+        # These require a native compiler and dynamic interposition.
+        ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
+          "link-dest-symlink-enotsup"
+          "partial-protected-regular-retry-linux"
+        ]
+      )
+    }
   '';
 
   doCheck = true;
+  strictDeps = true;
 
   __darwinAllowLocalNetworking = true;
 
diff --git a/pkgs/by-name/rt/rtl_wmbus/package.nix b/pkgs/by-name/rt/rtl_wmbus/package.nix
new file mode 100644
index 000000000000..0d49843d11bd
--- /dev/null
+++ b/pkgs/by-name/rt/rtl_wmbus/package.nix
@@ -0,0 +1,62 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  pname = "rtl-wmbus";
+  version = "1.1.0";
+  src = fetchFromGitHub {
+    owner = "xaelsouth";
+    repo = "rtl-wmbus";
+    tag = "${finalAttrs.version}";
+    hash = "sha256-T8cYRkj7w4nAtcPvDkpPTwbDPXUr1qYZtyDtTjHWDMA=";
+
+    # need to fetch revision from git
+    leaveDotGit = true;
+    postFetch = ''
+      # avoid having the whole .git-folder
+      substituteInPlace $out/Makefile --replace-fail "COMMIT_HASH?=\$(shell git log --pretty=format:'%H' -n 1)" "COMMIT_HASH:=$(git -C $out log --pretty=format:'%H' -n 1)"
+
+      rm -rf $out/.git
+    '';
+  };
+
+  # avoid reading the version from git to avoid fetching all tags
+  makeFlags = [
+    "TAG=${finalAttrs.version}"
+    "BRANCH="
+    "CHANGES="
+  ];
+
+  # make install would use /usr/bin
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp build/rtl_wmbus $out/bin
+
+    runHook postInstall
+  '';
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = false;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Software defined receiver for Wireless-M-Bus with RTL-SDR";
+    homepage = "https://github.com/xaelsouth/rtl-wmbus";
+    license = lib.licenses.bsd2;
+    mainProgram = "rtl_wmbus";
+    maintainers = with lib.maintainers; [
+      prauscher
+    ];
+  };
+})
diff --git a/pkgs/by-name/rt/rtmpdump/package.nix b/pkgs/by-name/rt/rtmpdump/package.nix
index b84a0f644b31..f09b5c92387f 100644
--- a/pkgs/by-name/rt/rtmpdump/package.nix
+++ b/pkgs/by-name/rt/rtmpdump/package.nix
@@ -2,6 +2,8 @@
   lib,
   stdenv,
   fetchgit,
+  testers,
+  versionCheckHook,
   zlib,
   gnutlsSupport ? false,
   gnutls,
@@ -12,7 +14,7 @@
 
 assert (gnutlsSupport || opensslSupport);
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "rtmpdump";
   version = "2.6";
 
@@ -23,6 +25,18 @@ stdenv.mkDerivation {
     hash = "sha256-rwMA9eougKnkpG+fe6vZIwOBt2CC1d9qI9a079EbE5o=";
   };
 
+  postPatch = ''
+    for file in rtmp{dump.1,gw.8}{,.html} librtmp/librtmp.3{,.html}; do
+      substituteInPlace "$file" \
+        --replace-fail "RTMPDump v2.4" "RTMPDump v${finalAttrs.version}"
+    done
+
+    for file in Makefile librtmp/Makefile; do
+      substituteInPlace "$file" \
+        --replace-fail "VERSION=v2.4" "VERSION=v${finalAttrs.version}"
+    done
+  '';
+
   preBuild = ''
     makeFlagsArray+=(CC="$CC")
   '';
@@ -44,18 +58,38 @@ stdenv.mkDerivation {
   ]
   ++ lib.optional opensslSupport openssl;
 
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--help";
+  doInstallCheck = true;
+
   outputs = [
     "out"
     "dev"
   ];
 
+  # incdir hardcoded to ${prefix}/include, but we move includes to -dev
+  # pkg-config version field is specified without "v" prefix
+  postFixup = ''
+    substituteInPlace $dev/lib/pkgconfig/librtmp.pc \
+      --replace-fail 'incdir=''${prefix}/include' "incdir=$dev/include" \
+      --replace-fail 'Version: v${finalAttrs.version}' 'Version: ${finalAttrs.version}'
+  '';
+
   separateDebugInfo = true;
 
+  passthru.tests.pkg-config = testers.hasPkgConfigModules {
+    package = finalAttrs.finalPackage;
+    versionCheck = true;
+  };
+
   meta = {
     description = "Toolkit for RTMP streams";
     homepage = "https://rtmpdump.mplayerhq.hu/";
+    changelog = "https://rtmpdump.mplayerhq.hu/ChangeLog";
     license = lib.licenses.gpl2Plus;
+    mainProgram = "rtmpdump";
+    pkgConfigModules = [ "librtmp" ];
     platforms = lib.platforms.unix;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ tmarkus ];
   };
-}
+})
diff --git a/pkgs/by-name/ru/rumdl/package.nix b/pkgs/by-name/ru/rumdl/package.nix
index 36022fe17ab6..5f42fc8243d3 100644
--- a/pkgs/by-name/ru/rumdl/package.nix
+++ b/pkgs/by-name/ru/rumdl/package.nix
@@ -11,7 +11,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rumdl";
-  version = "0.2.55";
+  version = "0.2.60";
 
   __structuredAttrs = true;
 
@@ -19,10 +19,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "rvben";
     repo = "rumdl";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-EZNHzJPnCkOaVxwz1lUQyNlk0mDAgK/ubTYu0ZMsttc=";
+    hash = "sha256-YKQFH0F/fZr6zeVDPAkF1nDXyg3Xk7Oi4vyJ2Jz+CM0=";
   };
 
-  cargoHash = "sha256-ooLf+EpWDRfDQBQTI3xRGR9qm5kFptTB4eRIu09Jyvs=";
+  cargoHash = "sha256-far2A4aCTlGmvsaAf9/i0osmAYECkdTvgVorf1umxKo=";
 
   cargoBuildFlags = [
     "--bin=rumdl"
diff --git a/pkgs/by-name/ru/rush-lyrics/deps.json b/pkgs/by-name/ru/rush-lyrics/deps.json
index a7767e5bbe68..0917c16aeb5e 100644
--- a/pkgs/by-name/ru/rush-lyrics/deps.json
+++ b/pkgs/by-name/ru/rush-lyrics/deps.json
@@ -1106,8 +1106,8 @@
   }
  },
  "https://plugins.gradle.org/m2": {
-  "com/diffplug/spotless#com.diffplug.spotless.gradle.plugin/8.9.0": {
-   "pom": "sha256-KiSidLMlcjuB1QGv6fjuNTNJK+WK2VIVukcEh39e4Y0="
+  "com/diffplug/spotless#com.diffplug.spotless.gradle.plugin/8.10.0": {
+   "pom": "sha256-ra/Nlpf+Kp8Avuz6+J2kSLeB9jalyt6qysEtRyplPuE="
   },
   "io/github/kdroidfilter#plugin/1.15.7": {
    "jar": "sha256-IvPp5/y8+e0Bcyi0Eb7VhDJhnawfX4TcLnDDH8EzPS4=",
@@ -1242,20 +1242,20 @@
    "module": "sha256-IFNqlfL+sr9DBRKMaq7Lb9idxFeYqchfJgK4qAnXUNs=",
    "pom": "sha256-Q1z/VXiZht7arXF/aPuo1UgklHhWLc2EsirU1lZvRAs="
   },
-  "com/diffplug/spotless#spotless-lib-extra/4.9.0": {
-   "jar": "sha256-HyB4zQvxKfI/aIGO8OrU6ZzrqKsAjmOKwDEbUHsBKZw=",
-   "module": "sha256-I50MaVyJBIeDyCJl4zMasKuy2R2M3KlK6mTFAn0trCs=",
-   "pom": "sha256-4wnu/KcMgWId/dV/l3tpBl8bLn/F1e5Ter3IWJqR7Js="
+  "com/diffplug/spotless#spotless-lib-extra/4.10.0": {
+   "jar": "sha256-qA1noQ+cq1Y/9COWXC6dEN7wcCiHHxzBn+H5jrY/rMQ=",
+   "module": "sha256-T4TFhZ9MzF7yp0I6/7fwHHedZeXUBp1ZsvLiU6y/Ycc=",
+   "pom": "sha256-ioWK1HalFxfvqjbUM4Ohc5jWHz4iChTTTPw2Y/2Q2cU="
   },
-  "com/diffplug/spotless#spotless-lib/4.9.0": {
-   "jar": "sha256-kJBhy1A+7QEskhkMHZAXa7on65jVopAG6tFoGlkG8m8=",
-   "module": "sha256-5ev03bdRVVuCANvKHdvU32eoI7dR1b71/s+m2wiZoyw=",
-   "pom": "sha256-ieleUBzLXDxf9VR8iyR3/Clbl34Nj34OULWTrue9sL4="
+  "com/diffplug/spotless#spotless-lib/4.10.0": {
+   "jar": "sha256-vzNRv+tuE9okAroygAd7Jo+1abvv9p7y4KqC8kGnH+M=",
+   "module": "sha256-jFGrf+KRC0NLXgzovbGy5BaOb1KpjJNX+WbgYLcCfQg=",
+   "pom": "sha256-wVQykHOJ3haa9MGXBgqliTz0q5W17B/bQMojbPHXhNM="
   },
-  "com/diffplug/spotless#spotless-plugin-gradle/8.9.0": {
-   "jar": "sha256-quTS9fpQJs0gJ0xXYP0Be0mSMAMv6E39jkgquZYNN2Y=",
-   "module": "sha256-Rdxah2UCG19mXf3ilysGO5Zgt0tySYdVqUVDQ0PYAOc=",
-   "pom": "sha256-PNYQSZvqWU/zcOUC/g/oAAWXUNpyrGTsPlBnkM0hE0s="
+  "com/diffplug/spotless#spotless-plugin-gradle/8.10.0": {
+   "jar": "sha256-oqP11YHf1YSstguJ891uR7Ek2dD3qUjc1nGb28u70W0=",
+   "module": "sha256-DuukKQzRN9+KmKyKzBHYTvG5zCFEhxtRaiCBSiAm2CM=",
+   "pom": "sha256-mxJJFkhEsRuoHuVUCxUdNiVULdfqqGUVguHzY1w/S3M="
   },
   "com/fleeksoft/charset#charset-iosarm64/0.0.8": {
    "module": "sha256-V8Uy9SUZRBEusEMLoGUv6CXHix6R9/eIWjeePvAhVpg=",
@@ -3736,12 +3736,12 @@
   "org/eclipse/ee4j#project/1.0.5": {
    "pom": "sha256-kWtHlNjYIgpZo/32pk2+eUrrIzleiIuBrjaptaLFkaY="
   },
-  "org/eclipse/jgit#org.eclipse.jgit-parent/7.7.0.202606012155-r": {
-   "pom": "sha256-S4qHPLaFhEH/MSUDTbVU0leSL7cIIEeVtyAZDW+05iE="
+  "org/eclipse/jgit#org.eclipse.jgit-parent/7.7.1.202607240634-r": {
+   "pom": "sha256-O/RKKe9ukBmDx7MfGQkaaEumdP6n1a3V3zF9DvoJxoc="
   },
-  "org/eclipse/jgit#org.eclipse.jgit/7.7.0.202606012155-r": {
-   "jar": "sha256-onxHjV94vD2VRh8VOmDv3xYjknUCxopFetmplaNcWnw=",
-   "pom": "sha256-owH00aR2nxrSVstU54V6Uq8n59A+UMo8UPTLZDw98SY="
+  "org/eclipse/jgit#org.eclipse.jgit/7.7.1.202607240634-r": {
+   "jar": "sha256-WRq8yElVpq0zY+yQS9p5zxRCdwbvtOBv/re8NgFQOYA=",
+   "pom": "sha256-4c9HhuyN3iB/5lh/QQ8lwsaHe+Oh3TCZ02dC3qgQUWs="
   },
   "org/eclipse/platform#org.eclipse.osgi/3.24.200": {
    "jar": "sha256-v+g/zR+gNOuamGs8tuXisY27rLZ+q9qtLaMoBOzYxlo=",
diff --git a/pkgs/by-name/ru/rush-lyrics/package.nix b/pkgs/by-name/ru/rush-lyrics/package.nix
index 9c6b55302f47..32722a7e210e 100644
--- a/pkgs/by-name/ru/rush-lyrics/package.nix
+++ b/pkgs/by-name/ru/rush-lyrics/package.nix
@@ -34,13 +34,13 @@ stdenv.mkDerivation (finalAttrs: {
   strictDeps = true;
 
   pname = "rush-lyrics";
-  version = "6.5.3";
+  version = "6.6.0";
 
   src = fetchFromGitHub {
     owner = "shub39";
     repo = "Rush";
     tag = finalAttrs.version;
-    hash = "sha256-LuI3i87ufGAm1hxrC8UdH7xfnubSRUIOoO9CVq5c6T4=";
+    hash = "sha256-8BdlNUQvPm8bk9X0JG00NYy/EANSHvh9TfqMIK1jJhk=";
   };
 
   patches = [
diff --git a/pkgs/by-name/ru/rustical/package.nix b/pkgs/by-name/ru/rustical/package.nix
index 66dac4085c2d..64167da240eb 100644
--- a/pkgs/by-name/ru/rustical/package.nix
+++ b/pkgs/by-name/ru/rustical/package.nix
@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rustical";
-  version = "0.15.0";
+  version = "0.16.0";
   __darwinAllowLocalNetworking = true;
 
   src = fetchFromGitHub {
     owner = "lennart-k";
     repo = "rustical";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rQgxbj5etwWH7R1NULHTMrs+KdnP8SYraooYWQgedFI=";
+    hash = "sha256-0IW3sS0CFqcSgiP+3w+SVFerbHX10gIs/I+blKFW4cE=";
   };
 
-  cargoHash = "sha256-+etAoH3sXNhHcRoN74itU9tY3O1h68A6Jq3KbhMtfDQ=";
+  cargoHash = "sha256-zTFDM3nMy5C26Zaz/7eFEe4dSwVXQ7TqN4z+MNRp7XE=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/sa/sandhole/package.nix b/pkgs/by-name/sa/sandhole/package.nix
index 50dc64b57804..bd445eb813e8 100644
--- a/pkgs/by-name/sa/sandhole/package.nix
+++ b/pkgs/by-name/sa/sandhole/package.nix
@@ -11,16 +11,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "sandhole";
-  version = "0.10.2";
+  version = "0.10.3";
 
   src = fetchFromGitHub {
     owner = "EpicEric";
     repo = "sandhole";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-iU9rMBiI+nlEqGthb/zHKsG/KPdBd16BKUsvzyCR0UY=";
+    hash = "sha256-9Bs8J+aHxKoHX8ksxe/iwl297rVyKDk4nm3+vzzh7Lo=";
   };
 
-  cargoHash = "sha256-PX2tRsNC60S2sc6kVuRS7uqFvX4CYV37v7HOqspEb7M=";
+  cargoHash = "sha256-DQWVTI7cwVuqWSXMkAw4RwRtp1SXeJj0idP3C68QTT4=";
 
   nativeBuildInputs = [
     cmake
@@ -52,7 +52,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     '';
     homepage = "https://sandhole.com.br";
     changelog = "https://github.com/EpicEric/sandhole/releases/tag/v${finalAttrs.version}";
-    license = lib.licenses.mit;
+    license = lib.licenses.agpl3Plus;
     mainProgram = "sandhole";
     maintainers = with lib.maintainers; [ EpicEric ];
     platforms = lib.platforms.all;
diff --git a/pkgs/by-name/sc/sculpin/package.nix b/pkgs/by-name/sc/sculpin/package.nix
new file mode 100644
index 000000000000..90adca3eab5d
--- /dev/null
+++ b/pkgs/by-name/sc/sculpin/package.nix
@@ -0,0 +1,30 @@
+{
+  fetchFromGitHub,
+  lib,
+  php,
+}:
+
+php.buildComposerProject2 rec {
+  __structuredAttrs = true;
+
+  pname = "sculpin";
+  version = "3.3.1";
+
+  src = fetchFromGitHub {
+    owner = "sculpin";
+    repo = "sculpin";
+    tag = version;
+    hash = "sha256-WoLqLe6UGzlDTRNpB75O2CT31EZkpHQZ6vPQIK/K/8Q=";
+  };
+
+  vendorHash = "sha256-y2W4GZNC7atxHkboNVWd2CWPDqWU2XIyWGC5Q47QqQs=";
+
+  meta = {
+    description = "PHP static site generator";
+    license = lib.licenses.mit;
+    homepage = "https://github.com/sculpin/sculpin";
+    maintainers = with lib.maintainers; [ opdavies ];
+    inherit (php.meta) platforms;
+    mainProgram = "sculpin";
+  };
+}
diff --git a/pkgs/by-name/sd/sdl3/package.nix b/pkgs/by-name/sd/sdl3/package.nix
index 9345096f3fa7..c3c6c7af9c6f 100644
--- a/pkgs/by-name/sd/sdl3/package.nix
+++ b/pkgs/by-name/sd/sdl3/package.nix
@@ -70,7 +70,7 @@ assert lib.assertMsg (ibusSupport -> dbusSupport) "SDL3 requires dbus support to
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sdl3";
-  version = "3.4.12";
+  version = "3.4.14";
 
   outputs = [
     "lib"
@@ -83,7 +83,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "libsdl-org";
     repo = "SDL";
     tag = "release-${finalAttrs.version}";
-    hash = "sha256-b6l3HgdhqIe9LazJmLivbCJgbKPAS8S54fuB9xvgalI=";
+    hash = "sha256-HzV5Fq+PhJr/dQBCVm2WL1BdaI4GG+W+B0scttjdRuQ=";
   };
 
   postPatch =
diff --git a/pkgs/by-name/sh/shadow/package.nix b/pkgs/by-name/sh/shadow/package.nix
index f47476196c2a..5c3c506ca15f 100644
--- a/pkgs/by-name/sh/shadow/package.nix
+++ b/pkgs/by-name/sh/shadow/package.nix
@@ -33,13 +33,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "shadow";
-  version = "4.20.0";
+  version = "4.20.2";
 
   src = fetchFromGitHub {
     owner = "shadow-maint";
     repo = "shadow";
     tag = finalAttrs.version;
-    hash = "sha256-UafTyfK+pmW2wyAQnvHov9KIorf1HSc6haskfv7auHs=";
+    hash = "sha256-uZQHIRjuXl1QQE5VCbdT6c+NEhFzb06WbjhH2wplU1E=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/sh/shipwright/package.nix b/pkgs/by-name/sh/shipwright/package.nix
index 6315867c2555..d1c4f44aa6ac 100644
--- a/pkgs/by-name/sh/shipwright/package.nix
+++ b/pkgs/by-name/sh/shipwright/package.nix
@@ -25,6 +25,7 @@
   nlohmann_json,
   tinyxml-2,
   spdlog,
+  stb,
   writeTextFile,
   fixDarwinDylibNames,
   applyPatches,
@@ -83,12 +84,6 @@ let
     '';
   };
 
-  stb' = fetchurl {
-    name = "stb_image.h";
-    url = "https://raw.githubusercontent.com/nothings/stb/0bc88af4de5fb022db643c2d8e549a0927749354/stb_image.h";
-    hash = "sha256-xUsVponmofMsdeLsI6+kQuPg436JS3PBl00IZ5sg3Vw=";
-  };
-
   stormlib' = applyPatches {
     src = fetchFromGitHub {
       owner = "ladislav-zezula";
@@ -208,7 +203,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   preConfigure = ''
     mkdir stb
-    cp ${stb'} ./stb/${stb'.name}
+    cp ${stb}/include/stb/stb_image.h ./stb/stb_image.h
     cp ${stb_impl} ./stb/${stb_impl.name}
     substituteInPlace libultraship/cmake/dependencies/common.cmake \
       --replace-fail "\''${STB_DIR}" "$(readlink -f ./stb)"
diff --git a/pkgs/by-name/so/somo/package.nix b/pkgs/by-name/so/somo/package.nix
index 40d6971423b9..bf5da00b6476 100644
--- a/pkgs/by-name/so/somo/package.nix
+++ b/pkgs/by-name/so/somo/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "somo";
-  version = "1.3.3";
+  version = "1.3.4";
 
   src = fetchFromGitHub {
     owner = "theopfr";
     repo = "somo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+NXB+iOuimd3nz8EqMNL0j2N15fZtURH40dwicytd88=";
+    hash = "sha256-MSTXub5S3LQqflJ2j1Wxzw7lXZE9kwWrURAPROFa95s=";
   };
 
-  cargoHash = "sha256-TAIUgyq8NBx7gQdZeY0dTGEvkRveMdozBjINQeyJOss=";
+  cargoHash = "sha256-wm80KbxvsffPA9KqOfVJpokMZsMgm3w4LQjf+XLzSp4=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/sp/spaghettikart/package.nix b/pkgs/by-name/sp/spaghettikart/package.nix
index bd4f62496b24..79b9a60a1db3 100644
--- a/pkgs/by-name/sp/spaghettikart/package.nix
+++ b/pkgs/by-name/sp/spaghettikart/package.nix
@@ -24,6 +24,7 @@
   SDL2,
   SDL2_net,
   spdlog,
+  stb,
   tinyxml-2,
   tomlplusplus,
   zenity,
@@ -83,12 +84,6 @@ let
     '';
   };
 
-  stb' = fetchurl {
-    name = "stb_image.h";
-    url = "https://raw.githubusercontent.com/nothings/stb/0bc88af4de5fb022db643c2d8e549a0927749354/stb_image.h";
-    hash = "sha256-xUsVponmofMsdeLsI6+kQuPg436JS3PBl00IZ5sg3Vw=";
-  };
-
   stormlib' = applyPatches {
     src = fetchFromGitHub {
       owner = "ladislav-zezula";
@@ -219,7 +214,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   preConfigure = ''
     mkdir stb
-    cp ${stb'} ./stb/${stb'.name}
+    cp ${stb}/include/stb/stb_image.h ./stb/stb_image.h
     cp ${stb_impl} ./stb/${stb_impl.name}
     substituteInPlace libultraship/cmake/dependencies/common.cmake \
       --replace-fail "\''${STB_DIR}" "$(readlink -f ./stb)"
diff --git a/pkgs/by-name/sq/sqlit-tui/package.nix b/pkgs/by-name/sq/sqlit-tui/package.nix
index 92d21228813a..3554d659235e 100644
--- a/pkgs/by-name/sq/sqlit-tui/package.nix
+++ b/pkgs/by-name/sq/sqlit-tui/package.nix
@@ -8,7 +8,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "sqlit-tui";
-  version = "1.6.0";
+  version = "1.6.1";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -16,7 +16,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "Maxteabag";
     repo = "sqlit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LAWlUnRa+i+XQN8Sl7ri4i0UGjyqV7MTz1X+XgNDAcI=";
+    hash = "sha256-xKlL6Q32v7lD9RCwlkJidYmtwXqNiXLf9W57c7hxjFI=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/st/stalwart_0_16/package.nix b/pkgs/by-name/st/stalwart_0_16/package.nix
index 9689e99cc051..ffa904adb6b6 100644
--- a/pkgs/by-name/st/stalwart_0_16/package.nix
+++ b/pkgs/by-name/st/stalwart_0_16/package.nix
@@ -51,7 +51,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "stalwart" + (lib.optionalString stalwartEnterprise "-enterprise");
-  version = "0.16.17";
+  version = "0.16.19";
 
   __structuredAttrs = true;
 
@@ -59,10 +59,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "stalwartlabs";
     repo = "stalwart";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tQY5L8tTyVbhIX0VrWbaKfR+Q97coTVoMRRDSHv5Lms=";
+    hash = "sha256-M6mO9z58WnvqmRcIxX9Hj2ZtY06mwlRtTXfdbXt6L00=";
   };
 
-  cargoHash = "sha256-EUx/ELV85pdPKzv49SEQ1Q8e/4ism2x3ZrKPqL6uvoE=";
+  cargoHash = "sha256-LsdGxAgBWTU7bMUrvypIVkiMDGG77qEXuD7i756YYCw=";
 
   env = {
     # https://docs.rs/openssl/latest/openssl/#manual
diff --git a/pkgs/by-name/st/stalwart_0_16/webui.nix b/pkgs/by-name/st/stalwart_0_16/webui.nix
index 124c546390c9..8ab6d0a74d74 100644
--- a/pkgs/by-name/st/stalwart_0_16/webui.nix
+++ b/pkgs/by-name/st/stalwart_0_16/webui.nix
@@ -8,13 +8,13 @@
 }:
 buildNpmPackage (finalAttrs: {
   pname = "webui";
-  version = "1.0.8";
+  version = "1.0.9";
 
   src = fetchFromGitHub {
     owner = "stalwartlabs";
     repo = "webui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-q6AR6/8eCzi9ED2PfL7wwNqFVWfkVIN93f8xEzOsAHo=";
+    hash = "sha256-EFENMnBuHU7ugciB/ib4iKGctZLMLl6rOZVQiakPgaU=";
   };
 
   npmDepsHash = "sha256-qe9cSrvs6kWwgbOO0xL7MBaJvICOvyuLFVi9R0dgnXQ=";
diff --git a/pkgs/by-name/st/starship-sf64/package.nix b/pkgs/by-name/st/starship-sf64/package.nix
index 9e65e91818e1..ec907ef85153 100644
--- a/pkgs/by-name/st/starship-sf64/package.nix
+++ b/pkgs/by-name/st/starship-sf64/package.nix
@@ -24,6 +24,7 @@
   nlohmann_json,
   SDL2,
   spdlog,
+  stb,
   tinyxml-2,
   zenity,
   sdl_gamecontrollerdb,
@@ -76,12 +77,6 @@ let
     '';
   };
 
-  stb' = fetchurl {
-    name = "stb_image.h";
-    url = "https://raw.githubusercontent.com/nothings/stb/0bc88af4de5fb022db643c2d8e549a0927749354/stb_image.h";
-    hash = "sha256-xUsVponmofMsdeLsI6+kQuPg436JS3PBl00IZ5sg3Vw=";
-  };
-
   stormlib' = applyPatches {
     src = fetchFromGitHub {
       owner = "ladislav-zezula";
@@ -195,7 +190,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   preConfigure = ''
     mkdir stb
-    cp ${stb'} ./stb/${stb'.name}
+    cp ${stb}/include/stb/stb_image.h ./stb/stb_image.h
     cp ${stb_impl} ./stb/${stb_impl.name}
     substituteInPlace libultraship/cmake/dependencies/common.cmake \
       --replace-fail "\''${STB_DIR}" "$(readlink -f ./stb)"
diff --git a/pkgs/by-name/st/stb/package.nix b/pkgs/by-name/st/stb/package.nix
index 3283dcc11f17..cd3e8b268a66 100644
--- a/pkgs/by-name/st/stb/package.nix
+++ b/pkgs/by-name/st/stb/package.nix
@@ -4,17 +4,18 @@
   fetchFromGitHub,
   copyPkgconfigItems,
   makePkgconfigItem,
+  unstableGitUpdater,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "stb";
-  version = "0-unstable-2023-01-29";
+  version = "0-unstable-2026-04-15";
 
   src = fetchFromGitHub {
     owner = "nothings";
     repo = "stb";
-    rev = "5736b15f7ea0ffb08dd38af21067c314d6a3aae9";
-    hash = "sha256-s2ASdlT3bBNrqvwfhhN6skjbmyEnUgvNOrvhgUSRj98=";
+    rev = "31c1ad37456438565541f4919958214b6e762fb4";
+    hash = "sha256-m2yNUlA37hDkKQVrQ+R8nufHfW/cXLnMo+n1X1Cyun0=";
   };
 
   nativeBuildInputs = [ copyPkgconfigItems ];
@@ -42,6 +43,8 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  passthru.updateScript = unstableGitUpdater { };
+
   meta = {
     description = "Single-file public domain libraries for C/C++";
     homepage = "https://github.com/nothings/stb";
diff --git a/pkgs/by-name/st/strace/package.nix b/pkgs/by-name/st/strace/package.nix
index d4c01551bb27..f825aa67d9c5 100644
--- a/pkgs/by-name/st/strace/package.nix
+++ b/pkgs/by-name/st/strace/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   fetchurl,
   perl,
+  bashNonInteractive,
   libunwind,
   buildPackages,
   gitUpdater,
@@ -28,17 +29,19 @@ stdenv.mkDerivation (finalAttrs: {
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ perl ];
 
-  enableParallelBuilding = true;
-
-  # libunwind for -k.
-  # On RISC-V platforms, LLVM's libunwind implementation is unsupported by strace.
-  # The build will silently fall back and -k will not work on RISC-V.
   buildInputs = [
+    bashNonInteractive # for strace-log-merge shebang
+    # libunwind for -k.
+    # On RISC-V platforms, LLVM's libunwind implementation is unsupported by strace.
+    # The build will silently fall back and -k will not work on RISC-V.
     libunwind
   ]
   # -kk
   ++ lib.optional (lib.meta.availableOn stdenv.hostPlatform elfutils) elfutils;
 
+  enableParallelBuilding = true;
+  strictDeps = true;
+
   configureFlags = [
     "--enable-mpers=check"
   ]
@@ -50,6 +53,8 @@ stdenv.mkDerivation (finalAttrs: {
     rev-prefix = "v";
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://strace.io/";
     description = "System call tracer for Linux";
diff --git a/pkgs/by-name/su/suitesparse-graphblas/package.nix b/pkgs/by-name/su/suitesparse-graphblas/package.nix
index 2d731685db41..a0926cc62813 100644
--- a/pkgs/by-name/su/suitesparse-graphblas/package.nix
+++ b/pkgs/by-name/su/suitesparse-graphblas/package.nix
@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "suitesparse-graphblas";
-  version = "10.4.1";
+  version = "10.5.0";
 
   outputs = [
     "out"
@@ -19,7 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "DrTimothyAldenDavis";
     repo = "GraphBLAS";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-cP5LktaO/vCPg6tRrK3uaCgOkOwS7X6mbb6VPTuYvl0=";
+    hash = "sha256-N+rpBYcpAjUPPeeqU6pMrPKR+b5rBP+z7Z9i2jS6kNE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sw/swig/package.nix b/pkgs/by-name/sw/swig/package.nix
index 7b7b7e01a8f3..6afb32b575f8 100644
--- a/pkgs/by-name/sw/swig/package.nix
+++ b/pkgs/by-name/sw/swig/package.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "swig";
     repo = "swig";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-jsi83v9sg0n5kUfDACqdNAS2VuLSyxv+pe2LRcO4Khc=";
   };
 
@@ -43,6 +43,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
+  __structuredAttrs = true;
+
   meta = {
     changelog = "https://github.com/swig/swig/blob/${finalAttrs.src.rev}/CHANGES.current";
     description = "Interface compiler that connects C/C++ code to higher-level languages";
diff --git a/pkgs/by-name/ta/tabby/package.nix b/pkgs/by-name/ta/tabby/package.nix
index 328af70e0ec9..6ae1b447c375 100644
--- a/pkgs/by-name/ta/tabby/package.nix
+++ b/pkgs/by-name/ta/tabby/package.nix
@@ -188,6 +188,6 @@ rustPlatform.buildRustPackage {
     mainProgram = "tabby";
     license = lib.licenses.asl20;
     maintainers = [ lib.maintainers.ghthor ];
-    broken = stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isAarch64;
+    broken = true;
   };
 }
diff --git a/pkgs/by-name/ta/tailscale/package.nix b/pkgs/by-name/ta/tailscale/package.nix
index 3c690470e15f..79a40f7d8075 100644
--- a/pkgs/by-name/ta/tailscale/package.nix
+++ b/pkgs/by-name/ta/tailscale/package.nix
@@ -24,7 +24,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "tailscale";
-  version = "1.102.2";
+  version = "1.102.3";
 
   outputs = [
     "out"
@@ -35,7 +35,7 @@ buildGoModule (finalAttrs: {
     owner = "tailscale";
     repo = "tailscale";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vqNShvER4jT+8WJCcaSVboXPEP6S3QacmkC39tJkR4g=";
+    hash = "sha256-NzWuMhLCqewkH/vwyfRND8yEubRmUSXe/TYA2ldhFl8=";
   };
 
   vendorHash = "sha256-amKkUPszyhG4N5ZtrB01swBACYq76raSS+SQRneLmwc=";
diff --git a/pkgs/by-name/ta/tamgamp-lv2/package.nix b/pkgs/by-name/ta/tamgamp-lv2/package.nix
index 9afcf0dd810b..341507d50a51 100644
--- a/pkgs/by-name/ta/tamgamp-lv2/package.nix
+++ b/pkgs/by-name/ta/tamgamp-lv2/package.nix
@@ -9,7 +9,7 @@
 
 stdenv.mkDerivation {
   pname = "tamgamp.lv2";
-  version = "unstable-2020-06-14";
+  version = "0-unstable-2020-06-14";
 
   src = fetchFromGitHub {
     owner = "sadko4u";
diff --git a/pkgs/by-name/ta/taws/package.nix b/pkgs/by-name/ta/taws/package.nix
new file mode 100644
index 000000000000..e222c05139b9
--- /dev/null
+++ b/pkgs/by-name/ta/taws/package.nix
@@ -0,0 +1,54 @@
+{
+  buildPackages,
+  fetchFromGitHub,
+  installShellFiles,
+  lib,
+  rustPlatform,
+  stdenv,
+  versionCheckHook,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "taws";
+  version = "1.2.1";
+
+  src = fetchFromGitHub {
+    owner = "huseyinbabal";
+    repo = "taws";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-76dC5ZLhQkItqGdWkq+U8mzimjDAAkzzpopx8ZPHCx4=";
+  };
+
+  cargoHash = "sha256-62Pk1RRx0eErGWNCYEyw0jFoNp97a+1kn5brgd81P5k=";
+
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  postInstall =
+    let
+      taws =
+        if stdenv.buildPlatform.canExecute stdenv.hostPlatform then
+          "$out/bin/taws"
+        else
+          lib.getExe buildPackages.taws;
+    in
+    ''
+      installShellCompletion --cmd taws \
+        --bash <(${taws} completion bash) \
+        --fish <(${taws} completion fish) \
+        --zsh <(${taws} completion zsh)
+    '';
+
+  meta = {
+    description = "Terminal-based AWS resource viewer and manager";
+    homepage = "https://github.com/huseyinbabal/taws";
+    changelog = "https://github.com/huseyinbabal/taws/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    mainProgram = "taws";
+    maintainers = [ lib.maintainers.EpicEric ];
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/by-name/tc/tcptrack/package.nix b/pkgs/by-name/tc/tcptrack/package.nix
index e50ff6c60c5f..c48e4c494b87 100644
--- a/pkgs/by-name/tc/tcptrack/package.nix
+++ b/pkgs/by-name/tc/tcptrack/package.nix
@@ -9,7 +9,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tcptrack";
-  version = "unstable-2017-04-29";
+  version = "1.4.3-unstable-2017-04-29";
 
   src = fetchFromGitHub {
     owner = "bchretien";
diff --git a/pkgs/by-name/te/terraria-server/package.nix b/pkgs/by-name/te/terraria-server/package.nix
index 327d3617eb67..eab25c93b734 100644
--- a/pkgs/by-name/te/terraria-server/package.nix
+++ b/pkgs/by-name/te/terraria-server/package.nix
@@ -10,12 +10,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "terraria-server";
-  version = "1.4.5.7";
+  version = "1.4.5.8";
   urlVersion = lib.replaceStrings [ "." ] [ "" ] finalAttrs.version;
 
   src = fetchurl {
     url = "https://terraria.org/api/download/pc-dedicated-server/terraria-server-${finalAttrs.urlVersion}.zip";
-    hash = "sha256-xqZ7c1WmwqEGm6NlPtShe9gb48+5IKc0CKrePFpBpUY=";
+    hash = "sha256-9ROkrJeJ00r3Zika4hfJzX2UcuE3gqDisXUS9w16gzQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ti/tinyalsa/package.nix b/pkgs/by-name/ti/tinyalsa/package.nix
index f90680f8f41b..de827704e4c8 100644
--- a/pkgs/by-name/ti/tinyalsa/package.nix
+++ b/pkgs/by-name/ti/tinyalsa/package.nix
@@ -1,43 +1,55 @@
 {
   lib,
   stdenv,
+  testers,
+  unstableGitUpdater,
   fetchFromGitHub,
-  cmake,
+  meson,
+  ninja,
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "tinyalsa";
-  version = "unstable-2022-06-05";
+  version = "2.0.0-unstable-2026-07-27";
 
   src = fetchFromGitHub {
     owner = "tinyalsa";
     repo = "tinyalsa";
-    rev = "3d70d227e7dfd1be6f8f420a5aae164a2b4126e0";
-    hash = "sha256-RHeF3VShy+LYFtJK+AEU7swIr5/rnpg2fdllnH9cFCk=";
+    rev = "9fab97ca07184371ecad81154d1dadb09d0fa7cf";
+    hash = "sha256-+/wz0pwyF1kulUA5kjFGVOwbSkunEU+WzsZf/UsCEVk=";
   };
 
+  separateDebugInfo = true;
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  outputs = [
+    "out"
+    "dev"
+    "bin"
+  ];
+
   nativeBuildInputs = [
-    cmake
+    meson
+    ninja
   ];
 
-  cmakeFlags = [
-    "-DTINYALSA_USES_PLUGINS=ON"
-  ];
-
-  env.NIX_CFLAGS_COMPILE = toString [
-    "-Wno-error=sign-compare"
-  ];
-
-  postPatch = ''
-    substituteInPlace CMakeLists.txt \
-      --replace-fail "cmake_minimum_required(VERSION 3.1)" "cmake_minimum_required(VERSION 3.10)"
-  '';
+  passthru = {
+    updateScript = unstableGitUpdater {
+      tagPrefix = "v";
+    };
+    tests.pkg-config = testers.hasPkgConfigModules {
+      package = finalAttrs.finalPackage;
+      versionCheck = false;
+    };
+  };
 
   meta = {
     homepage = "https://github.com/tinyalsa/tinyalsa";
     description = "Tiny library to interface with ALSA in the Linux kernel";
     license = lib.licenses.mit;
-    maintainers = [ ];
+    pkgConfigModules = [ "tinyalsa" ];
+    maintainers = with lib.maintainers; [ tmarkus ];
     platforms = with lib.platforms; linux;
   };
-}
+})
diff --git a/pkgs/by-name/to/torrserver/package.nix b/pkgs/by-name/to/torrserver/package.nix
index 9dfc2a8e1ebb..f8bb8d12d59d 100644
--- a/pkgs/by-name/to/torrserver/package.nix
+++ b/pkgs/by-name/to/torrserver/package.nix
@@ -7,15 +7,15 @@
 }:
 buildGo126Module rec {
   pname = "torrserver";
-  version = "142.2";
+  version = "143";
 
   src = fetchFromGitHub {
     owner = "YouROK";
     repo = "TorrServer";
     tag = "MatriX.${version}";
-    sha256 = "sha256-hwlhAQLSLSmQLeaNVt8QKClwkCn9XHN0kyrNllnC06I=";
+    sha256 = "sha256-JP6fvf2OCz5A495YXzuajzuxh7VDb88WZBz2AuaUEUU=";
   };
-  vendorHash = "sha256-CUnIKZ3MDv+ne0Yk8MI4dV0VBbEfz2a04zDxdonnnvE=";
+  vendorHash = "sha256-l4eaMqh2OeUkr812bLnIF4XjLlnQvPxcvhk0v+4I/gU=";
 
   modRoot = "server";
   subPackages = [ "cmd" ];
diff --git a/pkgs/by-name/tr/tree-sitter/grammars/default.nix b/pkgs/by-name/tr/tree-sitter/grammars/default.nix
index 237e0fd99c6a..a9a3dffcc78f 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/default.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/default.nix
@@ -13,7 +13,14 @@ let
   /**
     Set of grammar sources. See ./grammar-sources.nix to define a new grammar.
   */
-  grammar-sources = import ./grammar-sources.nix { inherit lib fetchpatch stdenv; };
+  grammar-sources = import ./grammar-sources.nix {
+    inherit
+      lib
+      fetchpatch
+      fetchFromGitLab
+      stdenv
+      ;
+  };
 
   /**
     Parse a flakeref style string to { type, owner, repo, ref }
diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index 9b77c61f9966..f3e28bf47d1a 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -1,5 +1,6 @@
 {
   fetchpatch,
+  fetchFromGitLab,
   lib,
   stdenv,
 }:
@@ -98,6 +99,15 @@
     };
   };
 
+  basic = {
+    version = "0-unstable-2025-11-11";
+    url = "github:Ra77a3l3-jar/tree-sitter-basic";
+    rev = "a98449c11d6c688b54c1ca132148a62d7e586a2a";
+    hash = "sha256-4wJLK+yZjBELTzTnB/9Xb70uGodetEyjVDtFshviQyA=";
+    excludeBrokenTreeSitterJson = true;
+    meta.license = lib.licenses.mit;
+  };
+
   bass = {
     version = "0-unstable-2024-05-03";
     url = "github:vito/tree-sitter-bass";
@@ -203,6 +213,14 @@
     };
   };
 
+  c3 = {
+    version = "0.11.0";
+    url = "github:c3lang/tree-sitter-c3";
+    hash = "sha256-EADHh63Sf4VlffQX3gH/9kodiws4lQsG+cyMwg1dFp8=";
+    excludeBrokenTreeSitterJson = true;
+    meta.license = lib.licenses.mit;
+  };
+
   caddyfile = {
     version = "0-unstable-2026-04-06";
     url = "github:caddyserver/tree-sitter-caddyfile";
@@ -255,6 +273,14 @@
     };
   };
 
+  chuck = {
+    version = "0-unstable-2026-03-27";
+    url = "github:tymbalodeon/tree-sitter-chuck";
+    rev = "68fb7bdba480915d87177feaa5593a666c0bb602";
+    hash = "sha256-yd+RWeY+gHtTkRaxYxXSv27yWupjZtnIDxbsUAMa9eg=";
+    meta.license = lib.licenses.mit;
+  };
+
   circom = {
     version = "0-unstable-2024-09-09";
     url = "github:Decurity/tree-sitter-circom";
@@ -318,6 +344,15 @@
     };
   };
 
+  concerto = {
+    version = "0-unstable-2026-03-19";
+    url = "github:accordproject/concerto-tree-sitter";
+    rev = "920ba23ea93af56b19dfc38fcddf80b3ddc62685";
+    hash = "sha256-WD+YEdwZJg4F4wNvUGDIMsL68QUt5AMypfC22lmLB+8=";
+    excludeBrokenTreeSitterJson = true;
+    meta.license = lib.licenses.asl20;
+  };
+
   cpon = {
     version = "0-unstable-2023-06-06";
     url = "github:fvacek/tree-sitter-cpon";
@@ -402,6 +437,14 @@
     };
   };
 
+  cython = {
+    version = "0-unstable-2024-12-21";
+    url = "github:b0o/tree-sitter-cython";
+    rev = "62f44f5e7e41dde03c5f0a05f035e293bcf2bcf8";
+    hash = "sha256-TFMVjzKWZBN1JISq5RTbXDTkqnttLKxckvwhf3WBQX0=";
+    meta.license = lib.licenses.mit;
+  };
+
   d = {
     version = "0.8.2-unstable-2025-06-29";
     url = "github:gdamore/tree-sitter-d";
@@ -516,6 +559,22 @@
     };
   };
 
+  doxyfile = {
+    version = "0-unstable-2025-08-14";
+    url = "github:tingerrr/tree-sitter-doxyfile";
+    rev = "18e44c6da639632a4e42264c7193df34be915f34";
+    hash = "sha256-/u1BHMJkj3FkTUwNiB6d8aQIBnnENsBzagXnQa9Dcls=";
+    meta.license = lib.licenses.mit;
+  };
+
+  drools = {
+    version = "0.1.0";
+    url = "github:iByteABit256/tree-sitter-drools";
+    hash = "sha256-TuIJbr5URQJOChsb0OuiLO3A0mUyoZ0zMU4dzquhL58=";
+    excludeBrokenTreeSitterJson = true;
+    meta.license = lib.licenses.agpl3Only;
+  };
+
   dtd = {
     version = "0.7.0-unstable-2026-01-21";
     url = "github:tree-sitter-grammars/tree-sitter-xml";
@@ -565,6 +624,15 @@
     };
   };
 
+  ebnf = {
+    version = "0-unstable-2023-02-06";
+    url = "github:RubixDev/ebnf";
+    rev = "8e635b0b723c620774dfb8abf382a7f531894b40";
+    hash = "sha256-Cch6WCYq9bsWGypzDGapxBLJ0ZB432uAl6YjEjBJ5yg=";
+    location = "crates/tree-sitter-ebnf";
+    meta.license = lib.licenses.mit;
+  };
+
   edoc = {
     version = "0-unstable-2022-11-23";
     url = "github:the-mikedavis/tree-sitter-edoc";
@@ -587,6 +655,13 @@
     };
   };
 
+  eiffel = {
+    version = "1.0.0";
+    url = "github:imustafin/tree-sitter-eiffel";
+    hash = "sha256-DeZZT+xlb+oWdTKXvf4W/siL8q/ESDVtpCOXUO/yeao=";
+    meta.license = lib.licenses.mit;
+  };
+
   elisp = rec {
     version = "1.6.1";
     url = "github:wilfred/tree-sitter-elisp?ref=${version}";
@@ -627,6 +702,14 @@
     };
   };
 
+  embedded-perl = {
+    version = "0-unstable-2026-03-18";
+    url = "github:jobindex-open/tree-sitter-embedded-perl";
+    rev = "5557a53f1f59a67cbd54c25bacd0c56d43158818";
+    hash = "sha256-4I14D3FY/GTOyESIywrRz298G1+I6DxwdSz84cI7Bqc=";
+    meta.license = lib.licenses.mit;
+  };
+
   embedded-template = {
     version = "0.25.0";
     url = "github:tree-sitter/tree-sitter-embedded-template";
@@ -713,6 +796,14 @@
     };
   };
 
+  flatbuffers = {
+    version = "0-unstable-2024-10-23";
+    url = "github:yuanchenxi95/tree-sitter-flatbuffers";
+    rev = "95e6f9ef101ea97e870bf6eebc0bd1fdfbaf5490";
+    hash = "sha256-rxCgEpZ9NXjhq7ByJLtl/3Oy73dPv1EGG95k3eGOUVE=";
+    meta.license = lib.licenses.mit;
+  };
+
   forth = {
     version = "0-unstable-2025-12-01";
     url = "github:alexanderbrevig/tree-sitter-forth";
@@ -735,6 +826,14 @@
     };
   };
 
+  freebasic = {
+    version = "0-unstable-2025-11-11";
+    url = "github:Ra77a3l3-jar/tree-sitter-freebasic";
+    rev = "dbf696adb4c0b9c020074e75043c90592981ee7f";
+    hash = "sha256-9JDf9Tj6K55JRTNfw9U7wR3/idQ8eBoQRCOQnLm3hbs=";
+    meta.license = lib.licenses.mit;
+  };
+
   fsharp = {
     version = "0.3.0-unstable-2026-04-16";
     url = "github:ionide/tree-sitter-fsharp";
@@ -909,6 +1008,22 @@
     excludeBrokenTreeSitterJson = true;
   };
 
+  glimmer-javascript = {
+    version = "0-unstable-2026-05-14";
+    url = "github:ember-tooling/tree-sitter-glimmer-javascript";
+    rev = "d9cf7a2f1dad3c6b660148eaf77e955d418fdb8b";
+    hash = "sha256-gvs85PiyNov10Ar0JytOzjmJQVOeVx74ZQSbV+XUKa4=";
+    meta.license = lib.licenses.mit;
+  };
+
+  glimmer-typescript = {
+    version = "0-unstable-2025-04-01";
+    url = "github:ember-tooling/tree-sitter-glimmer-typescript";
+    rev = "12d98944c1d5077b957cbdb90d663a7c4d50118c";
+    hash = "sha256-3cJI6vcbU62kUIhphprNeAl9RyY9TThrzVeArdLfxnI=";
+    meta.license = lib.licenses.mit;
+  };
+
   glsl = {
     version = "0.2.0";
     url = "github:tree-sitter-grammars/tree-sitter-glsl";
@@ -931,6 +1046,15 @@
     };
   };
 
+  gnuplot = {
+    version = "0-unstable-2026-01-29";
+    url = "codeberg:maribu/tree-sitter-gnuplot";
+    rev = "21a3a3929facb964b3592daeb69119294ff84cf2";
+    hash = "sha256-2Z0CDtLOZ7LWffFboxO+tE0VWEkzNNodFMXr5PHQkoo=";
+    excludeBrokenTreeSitterJson = true;
+    meta.license = lib.licenses.bsd0;
+  };
+
   go = {
     version = "0.25.0";
     url = "github:tree-sitter/tree-sitter-go";
@@ -940,6 +1064,13 @@
     };
   };
 
+  go-format-string = {
+    version = "1.1.0";
+    url = "codeberg:kpbaks/tree-sitter-go-format-string";
+    hash = "sha256-Em9uodgqj1TXyZieLuwrYouth5r4UvZoBFSSbzAqJE0=";
+    meta.license = lib.licenses.mit;
+  };
+
   go-template = {
     version = "0-unstable-2026-03-21";
     url = "github:ngalaiko/tree-sitter-go-template";
@@ -1082,6 +1213,15 @@
     };
   };
 
+  haskell-literate = {
+    version = "0-unstable-2025-10-30";
+    url = "github:LaurentRDC/tree-sitter-haskell-literate";
+    rev = "8ad7bd1b1595f4cc1a4ccc775d4a3c460f43a596";
+    hash = "sha256-P9FTcMwPU1AvH55ly0XydCSVOP0Mfi6jQ0Yg6Muraqk=";
+    excludeBrokenTreeSitterJson = true;
+    meta.license = lib.licenses.mit;
+  };
+
   haskell-persistent = {
     version = "0-unstable-2023-09-19";
     url = "github:MercuryTechnologies/tree-sitter-haskell-persistent";
@@ -1095,6 +1235,13 @@
     };
   };
 
+  haxe = {
+    version = "0.13.0";
+    url = "github:vantreeseba/tree-sitter-haxe";
+    hash = "sha256-MHZemYMpfbo1AdVUQv3j6eVWntZKi6K7UtRCPGk2kvE=";
+    meta.license = lib.licenses.mit;
+  };
+
   hcl = {
     version = "1.2.0";
     url = "github:tree-sitter-grammars/tree-sitter-hcl";
@@ -1104,6 +1251,14 @@
     };
   };
 
+  hdl = {
+    version = "0-unstable-2025-09-09";
+    url = "github:quantonganh/tree-sitter-hdl";
+    rev = "2199fdf1d302100a53002ea2cf540999119836a0";
+    hash = "sha256-aurnBP9R03QN1cDTKpZbp1VX3HCYjleRkSQs6m1aCxA=";
+    meta.license = lib.licenses.mit;
+  };
+
   heex = {
     version = "0.9.0";
     url = "github:phoenixframework/tree-sitter-heex";
@@ -1334,6 +1489,24 @@
     };
   };
 
+  jjrevset = {
+    version = "0-unstable-2025-07-09";
+    url = "github:bryceberger/tree-sitter-jjrevset";
+    rev = "d9af23944b884ec528b505f41d81923bb3136a51";
+    hash = "sha256-815IDF/V+blItEjW1ljUeV/it/8w532tm4k295z+ago=";
+    excludeBrokenTreeSitterJson = true;
+    meta.license = lib.licenses.mit;
+  };
+
+  jjtemplate = {
+    version = "0-unstable-2025-07-09";
+    url = "github:bryceberger/tree-sitter-jjtemplate";
+    rev = "4313eda8ac31c60e550e3ad5841b100a0a686715";
+    hash = "sha256-8rEatsR1vKBOlYYnGW88uwV0xLXGa+/rMAwiUeAuofk=";
+    excludeBrokenTreeSitterJson = true;
+    meta.license = lib.licenses.mit;
+  };
+
   jq = {
     version = "0-unstable-2025-05-10";
     url = "github:flurie/tree-sitter-jq";
@@ -1406,6 +1579,20 @@
     };
   };
 
+  kcl = {
+    version = "0.0.2";
+    url = "github:KittyCAD/tree-sitter-kcl";
+    hash = "sha256-oxyC6YPSf14YmZ7t/htMPU8BqUagylMCKCmJ5ky5ZII=";
+    meta.license = lib.licenses.mit;
+  };
+
+  kconfig = {
+    version = "1.3.0";
+    url = "github:tree-sitter-grammars/tree-sitter-kconfig";
+    hash = "sha256-ypjfe1IM3vxfoLWtsDUf+2WzjHkUjy8pc4xxKP4tUL4=";
+    meta.license = lib.licenses.mit;
+  };
+
   kdl = {
     version = "1.1.0";
     url = "github:tree-sitter-grammars/tree-sitter-kdl";
@@ -1415,6 +1602,15 @@
     };
   };
 
+  klog = {
+    version = "0-unstable-2026-01-10";
+    url = "github:Ansimorph/tree-sitter-klog";
+    rev = "0b215fe75bdeb8368546e3cee36aca8c19212d06";
+    hash = "sha256-L0FJpQsiMvPxZOGvp5kfStTPRc5Zgr8xMUj06Yp6VGU=";
+    excludeBrokenTreeSitterJson = true;
+    meta.license = lib.licenses.mit;
+  };
+
   koka = {
     version = "0-unstable-2025-07-26";
     url = "github:mtoohey31/tree-sitter-koka";
@@ -1506,6 +1702,13 @@
     };
   };
 
+  less = {
+    version = "1.0.0-d";
+    url = "github:jimliang/tree-sitter-less";
+    hash = "sha256-v2pE5CM6XxqQUooLR5r3qaPbDo/3tqQVMx2jWGGxfGo=";
+    meta.license = lib.licenses.mit;
+  };
+
   linkerscript = {
     version = "1.0.0";
     url = "github:tree-sitter-grammars/tree-sitter-linkerscript";
@@ -1577,6 +1780,20 @@
     };
   };
 
+  lua-format-string = {
+    version = "0.1.0";
+    url = "codeberg:kpbaks/tree-sitter-lua-format-string";
+    hash = "sha256-fP1c2F/nn4BsmO1u0JAGbECQfv0J9TCZWqiwu6W+JvM=";
+    meta.license = lib.licenses.mit;
+  };
+
+  luap = {
+    version = "1.0.1";
+    url = "github:tree-sitter-grammars/tree-sitter-luap";
+    hash = "sha256-SW2ubK5317GUc1dQLkhoaisMgctLOwr6TPVYSQh02vE=";
+    meta.license = lib.licenses.mit;
+  };
+
   luau = {
     version = "0-unstable-2025-12-08";
     url = "github:polychromatist/tree-sitter-luau";
@@ -1724,6 +1941,14 @@
     };
   };
 
+  nearley = {
+    version = "0-unstable-2025-09-24";
+    url = "github:mi2ebi/tree-sitter-nearley";
+    rev = "12d01113e194c8e83f6341aab8c2a5f21db9cac9";
+    hash = "sha256-Uhr1DbUK7svhJX1JCtBvKhwO4jgxQLvFPL3mc/zWAy8=";
+    meta.license = lib.licenses.mit;
+  };
+
   netlinx = {
     version = "1.0.4";
     url = "github:norgate-av/tree-sitter-netlinx";
@@ -1974,6 +2199,15 @@
     };
   };
 
+  penrose = {
+    version = "0-unstable-2026-01-25";
+    url = "github:klukaszek/tree-sitter-penrose";
+    rev = "d9368ff7f743b2ac2145a3342db13b1ad950cba5";
+    hash = "sha256-E/tpautC1I3w2+p2xrnd2CjdHVvNooX7yW84gUXlyrg=";
+    excludeBrokenTreeSitterJson = true;
+    meta.license = lib.licenses.mit;
+  };
+
   perl = {
     version = "1.1.1";
     url = "github:ganezdragon/tree-sitter-perl";
@@ -2038,6 +2272,13 @@
     };
   };
 
+  picat = {
+    version = "0.1.0";
+    url = "github:dlr-ft/tree-sitter-picat";
+    hash = "sha256-xMiQQHC2GsH9MQJDQkSeAaFr5g7tix0CVn3JvgwxauQ=";
+    meta.license = lib.licenses.mit;
+  };
+
   pioasm = {
     version = "0-unstable-2024-10-12";
     url = "github:leo60228/tree-sitter-pioasm";
@@ -2170,6 +2411,14 @@
     };
   };
 
+  proverif = {
+    version = "0-unstable-2026-02-28";
+    url = "codeberg:maribu/tree-sitter-proverif";
+    rev = "7741807092c4009c1fe4c3648da60ca72b1b80f1";
+    hash = "sha256-fMtGQsEbZHNIamrz3hoGvCJn5Dtu0oHhuLmMxOjFhGU=";
+    meta.license = lib.licenses.bsd0;
+  };
+
   prql = {
     version = "0-unstable-2023-07-28";
     url = "github:PRQL/tree-sitter-prql";
@@ -2183,6 +2432,14 @@
     };
   };
 
+  ptx = {
+    version = "0-unstable-2026-01-02";
+    url = "codeberg:jer-gremlin/tree-sitter-ptx";
+    rev = "3dfa6758d4c15832d051f933101992b9e01d6611";
+    hash = "sha256-h2a+ievbZGAYFVl3aZxM4/zTn92/fnfxelHWKfnXoP8=";
+    meta.license = lib.licenses.mit;
+  };
+
   pug = {
     version = "0-unstable-2024-11-17";
     url = "github:zealot128/tree-sitter-pug";
@@ -2322,6 +2579,13 @@
     };
   };
 
+  requirements = {
+    version = "0.6.1";
+    url = "github:tree-sitter-grammars/tree-sitter-requirements";
+    hash = "sha256-jLG+DcdVfC2Rj8SYL3WTBWreOLJWwtxpPxzyvJl77d4=";
+    meta.license = lib.licenses.mit;
+  };
+
   rescript = {
     version = "6.0.0-unstable-2026-07-13";
     url = "github:rescript-lang/tree-sitter-rescript";
@@ -2335,6 +2599,15 @@
     };
   };
 
+  ripple = {
+    version = "0-unstable-2025-11-15";
+    url = "github:Ripple-TS/ripple";
+    rev = "49762f0a63de0d1845fcd2e6632639c095995336";
+    hash = "sha256-ohUhJXdo9UPKhSCxuFXGJE1vl8/QNApQkIrbiszVCbM=";
+    location = "packages/tree-sitter";
+    meta.license = lib.licenses.mit;
+  };
+
   river = {
     version = "0-unstable-2023-11-22";
     url = "github:grafana/tree-sitter-river";
@@ -2357,6 +2630,13 @@
     };
   };
 
+  robots-txt = {
+    version = "1.0.1";
+    url = "github:opa-oz/tree-sitter-robots-txt";
+    hash = "sha256-fQq5agJ/xHsWxEJAydGxED4Z0bmREfXJ1t/EspBkYC8=";
+    meta.license = lib.licenses.mit;
+  };
+
   ron = {
     version = "0.2.0-unstable-2024-05-05";
     url = "github:tree-sitter-grammars/tree-sitter-ron";
@@ -2370,6 +2650,28 @@
     };
   };
 
+  rpmspec = {
+    version = "0-unstable-2025-08-11";
+    src = fetchFromGitLab {
+      owner = "cryptomilk";
+      repo = "tree-sitter-rpmspec";
+      rev = "d0275cd1316d9b7a2e0fae028ce95a5a18741e1d";
+      hash = "sha256-YBC0thdMf4UYdZr8+vm1SQjBBh1CZD/VpuzndxsglOU=";
+      postFetch = ''
+        # ensure that case-insensitive folders are not merged on Darwin
+        rm -rf $out/bindings/swift
+      '';
+    };
+    meta.license = lib.licenses.mit;
+  };
+
+  rshtml = {
+    version = "0.1.6";
+    url = "github:rshtml/tree-sitter-rshtml";
+    hash = "sha256-7RzjvJEMhtWDRnaoLki7FjTK9Y7+ZECE5gIqGUlx6DE=";
+    meta.license = lib.licenses.mit;
+  };
+
   rst = {
     version = "0.2.0";
     url = "github:stsewd/tree-sitter-rst";
@@ -2419,6 +2721,14 @@
     };
   };
 
+  scfg = {
+    version = "0-unstable-2025-10-29";
+    url = "github:rockorager/tree-sitter-scfg";
+    rev = "d850fd470445d73de318a21d734d1e09e29b773c";
+    hash = "sha256-AnyOcQFA3N6AFZiG7eLS1xCm1qX6hko9lFV4oV9p/E8=";
+    meta.license = lib.licenses.mit;
+  };
+
   scheme = {
     version = "0.24.7-1-unstable-2026-03-17";
     url = "github:6cdh/tree-sitter-scheme";
@@ -2438,6 +2748,13 @@
     };
   };
 
+  shellcheckrc = {
+    version = "0.1.0";
+    url = "codeberg:kpbaks/tree-sitter-shellcheckrc";
+    hash = "sha256-f7hko5qYClgft2vvw95w/yU21r/pN5LkqaGJ/aAq8bM=";
+    meta.license = lib.licenses.mit;
+  };
+
   slang = {
     version = "0.3.1-unstable-2025-09-01";
     url = "github:tree-sitter-grammars/tree-sitter-slang";
@@ -2461,6 +2778,14 @@
     };
   };
 
+  slisp = {
+    version = "0-unstable-2025-09-15";
+    url = "github:xenogenics/tree-sitter-slisp";
+    rev = "29f9c6707ce9dfc2fc915d175ec720b207f179f3";
+    hash = "sha256-ciolUtCf2e7VXmSIR8Zk4fQAGCeHoIQekYi2LVq7Hpg=";
+    meta.license = lib.licenses.bsd2;
+  };
+
   smali = {
     version = "1.0.0-unstable-2024-05-05";
     url = "github:amaanq/tree-sitter-smali";
@@ -2584,6 +2909,13 @@
     };
   };
 
+  ssh-client-config = rec {
+    version = "2026.7.9";
+    url = "github:metio/tree-sitter-ssh-client-config?ref=${version}";
+    hash = "sha256-La1h6uJC5gUA84OAr3zBbQiR+AnrhcUhNf6r4HUpwhg=";
+    meta.license = lib.licenses.cc0;
+  };
+
   strace = {
     version = "0-unstable-2025-12-21";
     url = "github:sigmaSd/tree-sitter-strace";
@@ -2599,6 +2931,28 @@
     excludeBrokenTreeSitterJson = true;
   };
 
+  strictdoc = {
+    version = "0.2.0";
+    url = "github:manueldiagostino/tree-sitter-strictdoc";
+    hash = "sha256-sIbh8mYWrGhaXtRxe/FYIT1aD8WAKfQYJJbhWhz9jEs=";
+    meta.license = lib.licenses.mit;
+  };
+
+  styx = rec {
+    version = "5.0.0-rc.0";
+    url = "github:bearcove/styx?ref=tree-sitter-styx-v${version}";
+    hash = "sha256-ogxqiKXdVuWZuMrVObGOLfV0t7snhRXtQhiGggvyvWY=";
+    location = "crates/tree-sitter-styx";
+    excludeBrokenTreeSitterJson = true;
+    meta.license = lib.licenses.OR (
+      with lib.licenses;
+      [
+        mit
+        asl20
+      ]
+    );
+  };
+
   supercollider = {
     version = "0.3.2";
     url = "github:madskjeldgaard/tree-sitter-supercollider";
@@ -2651,6 +3005,13 @@
     };
   };
 
+  systemverilog = {
+    version = "0.3.1";
+    url = "github:gmlarumbe/tree-sitter-systemverilog";
+    hash = "sha256-wzsjHDn6ZdGfOlufARurxCTwT8HqMvyfsnIIpXzRUYs=";
+    meta.license = lib.licenses.mit;
+  };
+
   t32 = {
     version = "9.0.1";
     url = "github:xasc/tree-sitter-t32";
@@ -2819,6 +3180,15 @@
     };
   };
 
+  tolk = {
+    version = "0-unstable-2025-07-14";
+    url = "github:ton-blockchain/ton-language-server";
+    rev = "e90dbb89f8ec8fbf8a16b61a31d6cc19a840de4f";
+    hash = "sha256-EeCp7i8ao+KCm8OAx4ALCDg7Nj0GAZbcC1ecyw76qZQ=";
+    location = "server/src/languages/tolk/tree-sitter-tolk";
+    meta.license = lib.licenses.mit;
+  };
+
   toml = {
     version = "0.7.0-unstable-2024-12-03";
     url = "github:tree-sitter-grammars/tree-sitter-toml";
@@ -2829,6 +3199,13 @@
     };
   };
 
+  tql = {
+    version = "1.1.0";
+    url = "github:tenzir/tree-sitter-tql";
+    hash = "sha256-2XbSwUKSNcODT2GIQ/k4w+4DSbV8dH689DrYBnWhPfU=";
+    meta.license = lib.licenses.mit;
+  };
+
   tsq = {
     version = "0.19.0-unstable-2024-02-24";
     url = "github:tree-sitter/tree-sitter-tsq";
@@ -3128,6 +3505,13 @@
     };
   };
 
+  wikitext = {
+    version = "0.1.3";
+    url = "github:wikimedia/tree-sitter-wikitext";
+    hash = "sha256-jqM+SQzQZNjUyHc4wv9c80lPkH62xWrxAU1uvGEmQho=";
+    meta.license = lib.licenses.mit;
+  };
+
   wing = {
     version = "0.83.11";
     url = "github:winglang/tree-sitter-wing";
diff --git a/pkgs/by-name/tr/tree-sitter/package.nix b/pkgs/by-name/tr/tree-sitter/package.nix
index 1968cf15d603..f16b467c5821 100644
--- a/pkgs/by-name/tr/tree-sitter/package.nix
+++ b/pkgs/by-name/tr/tree-sitter/package.nix
@@ -135,17 +135,17 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tree-sitter";
-  version = "0.26.9";
+  version = "0.26.11";
 
   src = fetchFromGitHub {
     owner = "tree-sitter";
     repo = "tree-sitter";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ohVhW4AEKX5VspqBePtfxbJGkjmJnNkf5ntU3RUxF+0=";
+    hash = "sha256-YXnmVM90sEH8kqgqCygpeCAyvggMIsv+oXi0SJOvMRM=";
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-3egxdusYHQs8PadxGZ44+VWtlTcGBrcqlWMUyUzpWnY=";
+  cargoHash = "sha256-kHDjPRhBUYlxLWYSv6cn6U1QDIWwCgHeIz2A5yCi1yo=";
 
   cargoBuildFeatures = lib.optionals wasmSupport [ "wasm" ];
 
diff --git a/pkgs/by-name/tu/tuicr/package.nix b/pkgs/by-name/tu/tuicr/package.nix
index 4f7ab1acb862..e1d7ed299117 100644
--- a/pkgs/by-name/tu/tuicr/package.nix
+++ b/pkgs/by-name/tu/tuicr/package.nix
@@ -9,7 +9,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tuicr";
-  version = "0.23.1";
+  version = "0.24.0";
 
   __structuredAttrs = true;
 
@@ -17,10 +17,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "agavra";
     repo = "tuicr";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-SvRvoQN9b4pXg4rPFnYI2Yeg3SAZKyjYknR2AzfoHnY=";
+    hash = "sha256-AnLLEOI3QaWZLMy339nJeyfCXt4NZpnzsYhZXTEagkU=";
   };
 
-  cargoHash = "sha256-1h8jDRssVA7gNfHB/9Uh1QWOsNF+aUBU698P/qLbyeY=";
+  cargoHash = "sha256-LyBCtZ93HZ5GvceqD27zhKzXbAgJ0aLOgGcFNoq/WdE=";
 
   strictDeps = true;
 
diff --git a/pkgs/by-name/tz/tzdata/package.nix b/pkgs/by-name/tz/tzdata/package.nix
index 75cb3cc49134..7e3f8f38535d 100644
--- a/pkgs/by-name/tz/tzdata/package.nix
+++ b/pkgs/by-name/tz/tzdata/package.nix
@@ -35,6 +35,8 @@ stdenv.mkDerivation (finalAttrs: {
   ];
   propagatedBuildOutputs = [ ];
 
+  strictDeps = true;
+
   makeFlags = [
     "TOPDIR=${placeholder "out"}"
     "TZDIR=${placeholder "out"}/share/zoneinfo"
@@ -113,6 +115,8 @@ stdenv.mkDerivation (finalAttrs: {
   # minor releases.
   passthru.tests = postgresql;
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "http://www.iana.org/time-zones";
     description = "Database of current and historical time zones";
diff --git a/pkgs/by-name/ud/udisks/package.nix b/pkgs/by-name/ud/udisks/package.nix
index 9761a5e10247..e62fee1b6f25 100644
--- a/pkgs/by-name/ud/udisks/package.nix
+++ b/pkgs/by-name/ud/udisks/package.nix
@@ -8,7 +8,7 @@
   autoreconfHook,
   gtk-doc,
   acl,
-  systemd,
+  systemdLibs,
   glib,
   libatasmart,
   polkit,
@@ -111,7 +111,7 @@ stdenv.mkDerivation (finalAttrs: {
     libgudev
     libblockdev
     acl
-    systemd
+    systemdLibs
     glib
     libatasmart
     polkit
diff --git a/pkgs/by-name/um/umbriel/package.nix b/pkgs/by-name/um/umbriel/package.nix
index a3ed1b57eb24..e813bdec3c13 100644
--- a/pkgs/by-name/um/umbriel/package.nix
+++ b/pkgs/by-name/um/umbriel/package.nix
@@ -30,7 +30,7 @@
 }:
 stdenv.mkDerivation {
   pname = "umbriel";
-  version = "0-unstable-2026-08-23";
+  version = "0-unstable-2026-08-25";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -39,9 +39,9 @@ stdenv.mkDerivation {
     owner = "noctalia-dev";
     repo = "umbriel";
     # No tagged releases yet
-    rev = "8650637f6fdb3cb78022a4560f5f34861439dbad";
+    rev = "af351dfa7564eaa0e73d215d057eb0b209cba057";
     fetchSubmodules = true;
-    hash = "sha256-WSTWPuF6KkSaO+zudERJCuga4BQzIH/RJdpvpkLVH4Q=";
+    hash = "sha256-y/ofPV9De3qxrLsmmAUs4fX/ZaNBquqvm6VvnnNXXhA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/um/umple-lsp/package.nix b/pkgs/by-name/um/umple-lsp/package.nix
index e564a15c6aaf..a9f26473dd21 100644
--- a/pkgs/by-name/um/umple-lsp/package.nix
+++ b/pkgs/by-name/um/umple-lsp/package.nix
@@ -15,6 +15,11 @@ let
   # tree-sitter needs a wasi32 clang available at `bin/clang`
   wasi32cc = lib.getExe pkgsCross.wasi32.stdenv.cc;
   wasi-sdk = linkFarm "wasi-sdk" { "bin/clang" = wasi32cc; };
+  # tree-sitter invokes clang with `--target=wasm32-unknown-wasi`, so clang looks
+  # for an unprefixed `wasm-ld` instead of the prefixed one that the cross bintools ship
+  wasm-ld = linkFarm "wasm-ld" {
+    "bin/wasm-ld" = lib.getExe' pkgsCross.wasi32.buildPackages.llvmPackages.lld "wasm-ld";
+  };
 in
 buildNpmPackage (finalAttrs: {
   pname = "umple-lsp";
@@ -43,6 +48,7 @@ buildNpmPackage (finalAttrs: {
     nodejs
     pkgsCross.wasi32.stdenv.cc.bintools
     tree-sitter
+    wasm-ld
   ];
 
   # Stop tree-sitter from trying to fetch its own wasi-sdk
diff --git a/pkgs/by-name/um/umple/deps.json b/pkgs/by-name/um/umple/deps.json
index 74ff05bdcd87..5d7d7abff810 100644
--- a/pkgs/by-name/um/umple/deps.json
+++ b/pkgs/by-name/um/umple/deps.json
@@ -242,8 +242,8 @@
   "com/google/guava/guava/maven-metadata": {
    "xml": {
     "groupId": "com.google.guava",
-    "lastUpdated": "20260414193116",
-    "release": "33.6.0-jre"
+    "lastUpdated": "20260817142319",
+    "release": "33.7.0-jre"
    }
   },
   "com/google/inject#guice-parent/3.0": {
diff --git a/pkgs/by-name/um/umple/package.nix b/pkgs/by-name/um/umple/package.nix
index fcd3d706f3e1..cac644b96e5e 100644
--- a/pkgs/by-name/um/umple/package.nix
+++ b/pkgs/by-name/um/umple/package.nix
@@ -12,7 +12,7 @@
 }:
 let
   versions = lib.importJSON ./versions.json;
-  inherit (versions.umple) version longVersion;
+  inherit (versions.umple) longVersion;
 
   # Required for bootstrapping
   umpleJar = fetchurl versions.umpleJar;
@@ -28,13 +28,13 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "umple";
-  inherit version;
+  version = "1.37.1";
 
   src = fetchFromGitHub {
     owner = "umple";
     repo = "umple";
-    tag = "v${version}";
-    hash = "sha256-BPy1L3bzvKoywM0srv36SXVe8psaY/m0bljy30z5dr8=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-xrq3Qmoq0tWR+9vrp292H3WpcWCYjYeIu1LJPBLvhD4=";
   };
 
   patches = [
diff --git a/pkgs/by-name/um/umple/update.sh b/pkgs/by-name/um/umple/update.sh
index 0ec6f3e14525..b55b84c6eb29 100755
--- a/pkgs/by-name/um/umple/update.sh
+++ b/pkgs/by-name/um/umple/update.sh
@@ -42,17 +42,17 @@ umpleUrl="https://github.com/umple/umple/releases/download/$latestTag/$umpleName
 umpleHash=$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 \
   "$(nix-prefetch-url "$umpleUrl")")
 
-# Save version info
+# Save version info.
+# Note that the Nix package version is directly inlined so that nixpkgs-update
+# can properly detect when the version changes in the source
 jq -n \
-  --arg version "$latestVersion" \
   --arg longVersion "$longVersion" \
   --arg revision "$revision" \
-  --arg commitCount "$commitCount" \
+  --argjson commitCount "$commitCount" \
   --arg umpleUrl "$umpleUrl" \
   --arg umpleHash "$umpleHash" \
   '{
     "umple": {
-      "version": $version,
       "longVersion": $longVersion,
       "revision": $revision,
       "commitCount": $commitCount
@@ -63,5 +63,5 @@ jq -n \
     }
   }' > "$location/versions.json"
 
-# Version update is done; use nix-update for hashes and Gradle deps
-nix-update umple --version=skip
+# use nix-update for hashes and Gradle deps
+nix-update umple --version="$latestVersion"
diff --git a/pkgs/by-name/um/umple/versions.json b/pkgs/by-name/um/umple/versions.json
index 9ca7502961c5..a551fcffbdf5 100644
--- a/pkgs/by-name/um/umple/versions.json
+++ b/pkgs/by-name/um/umple/versions.json
@@ -1,12 +1,11 @@
 {
   "umple": {
-    "version": "1.37.0",
-    "longVersion": "1.37.0.8543.1593c2b83",
-    "revision": "1593c2b83",
-    "commitCount": "8543"
+    "longVersion": "1.37.1.8673.860b8c752",
+    "revision": "860b8c752",
+    "commitCount": "8673"
   },
   "umpleJar": {
-    "url": "https://github.com/umple/umple/releases/download/v1.37.0/umple-1.37.0.8542.3a8c87689.jar",
-    "hash": "sha256-pBHHbURbe7B5A11tShvHGlSO4XMJPcdM7Iy+ph3PxAE="
+    "url": "https://github.com/umple/umple/releases/download/v1.37.1/umple-1.37.1.8672.ffc0b7ae3.jar",
+    "hash": "sha256-4EWhIxPPkwsS59ZSmpFkZXMRBa/3CTCyQuUWvYcVVC8="
   }
 }
diff --git a/pkgs/by-name/un/unbound/package.nix b/pkgs/by-name/un/unbound/package.nix
index a90eb0b1d364..2dba1d12c66d 100644
--- a/pkgs/by-name/un/unbound/package.nix
+++ b/pkgs/by-name/un/unbound/package.nix
@@ -63,13 +63,13 @@ assert lib.assertMsg (
 ) "unbound: withDoQ requires OpenSSL with QUIC support (OpenSSL >= 3.5)";
 stdenv.mkDerivation (finalAttrs: {
   pname = "unbound";
-  version = "1.25.2";
+  version = "1.26.0";
 
   src = fetchFromGitHub {
     owner = "NLnetLabs";
     repo = "unbound";
     tag = "release-${finalAttrs.version}";
-    hash = "sha256-zt0JpVmct7w6ay+p8CdH6SGt/rL/v//e7K3MT8KZfOY=";
+    hash = "sha256-ESRboc5vwsNZ/Yynl2JGRWhH1QEYZumoTzgSvN3NbSU=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/ut/util-linux/package.nix b/pkgs/by-name/ut/util-linux/package.nix
index bfabdf565486..46c428876cac 100644
--- a/pkgs/by-name/ut/util-linux/package.nix
+++ b/pkgs/by-name/ut/util-linux/package.nix
@@ -171,6 +171,8 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals ncursesSupport [ ncurses ]
   ++ lib.optionals systemdSupport [ systemdLibs ];
 
+  strictDeps = true;
+
   enableParallelBuilding = true;
 
   postInstall = ''
@@ -229,6 +231,8 @@ stdenv.mkDerivation (finalAttrs: {
     };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.kernel.org/pub/linux/utils/util-linux/";
     description = "Set of system utilities for Linux";
diff --git a/pkgs/by-name/ve/vencord/package.nix b/pkgs/by-name/ve/vencord/package.nix
index 1611168efcb4..c2ac71ef129f 100644
--- a/pkgs/by-name/ve/vencord/package.nix
+++ b/pkgs/by-name/ve/vencord/package.nix
@@ -110,7 +110,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [
       _4evy
-      FlafyDev
       Gliczy
       NotAShelf
       Scrumplex
diff --git a/pkgs/by-name/vk/vkd3d/package.nix b/pkgs/by-name/vk/vkd3d/package.nix
index cc2d5ed3ec83..7312ac84837a 100644
--- a/pkgs/by-name/vk/vkd3d/package.nix
+++ b/pkgs/by-name/vk/vkd3d/package.nix
@@ -15,14 +15,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vkd3d";
-  version = "2.0";
+  version = "2.1";
 
   src = fetchFromGitLab {
     domain = "gitlab.winehq.org";
     owner = "wine";
     repo = "vkd3d";
     tag = "vkd3d-${finalAttrs.version}";
-    hash = "sha256-S0sQaDt0aYYi2Rs/MNRIQ9oOuHm9/LsxaSL93M5jBRw=";
+    hash = "sha256-ruknQ1etTYFxKSu6GZvNz+YEtRNIdJrx+F4bX6CZiiU=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/wa/wasmtime/package.nix b/pkgs/by-name/wa/wasmtime/package.nix
index fa8e93bba3c3..b6a58c3bc924 100644
--- a/pkgs/by-name/wa/wasmtime/package.nix
+++ b/pkgs/by-name/wa/wasmtime/package.nix
@@ -15,9 +15,9 @@
 let
   sources = {
     lts-36 = {
-      version = "36.0.13";
-      hash = "sha256-KVNnxmEVDgH+EzItFdpRIpLm6DbmrN2JIKjctx6IyBE=";
-      cargoHash = "sha256-q1l2zmfdCI7Yg41/8jDTjf5akeHiQcC/60iIzMnh6B0=";
+      version = "36.0.14";
+      hash = "sha256-OI8wixfzV4U2brmW7uqhk55eLhj+Fdp+J5Pzz1iBO6U=";
+      cargoHash = "sha256-2Nwcw3Z4/cbkRcG2hJ2/1PcXZf3vYB9NGUlr7pxdqzU=";
     };
     main = {
       version = "48.0.0";
diff --git a/pkgs/by-name/we/weaviate/package.nix b/pkgs/by-name/we/weaviate/package.nix
index 6ce624a7f957..5aa980356b68 100644
--- a/pkgs/by-name/we/weaviate/package.nix
+++ b/pkgs/by-name/we/weaviate/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "weaviate";
-  version = "1.39.0";
+  version = "1.39.1";
 
   src = fetchFromGitHub {
     owner = "weaviate";
     repo = "weaviate";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Nc6QAMjZF24KiYcS9W1AMgusUXHn96KqNV/RC2N4Glc=";
+    hash = "sha256-fD8Zju/WR+vxY/Ocopy0YosF0FZrVNbCZB6jd9JWBqM=";
   };
 
   vendorHash = "sha256-31yzL0fx2dhYiSdcKvHBe8UeFENSzFxsB/RQAMM/1e4=";
diff --git a/pkgs/by-name/xd/xdg-desktop-portal-umbriel/package.nix b/pkgs/by-name/xd/xdg-desktop-portal-umbriel/package.nix
index a4b1fe2404a5..a73e30f5ad60 100644
--- a/pkgs/by-name/xd/xdg-desktop-portal-umbriel/package.nix
+++ b/pkgs/by-name/xd/xdg-desktop-portal-umbriel/package.nix
@@ -21,7 +21,7 @@
 }:
 stdenv.mkDerivation {
   pname = "xdg-desktop-portal-umbriel";
-  version = "0-unstable-2026-08-23";
+  version = "0-unstable-2026-08-24";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -30,8 +30,8 @@ stdenv.mkDerivation {
     owner = "noctalia-dev";
     repo = "xdg-desktop-portal-umbriel";
     # No tagged releases yet
-    rev = "c8a9a223d48e6c62652f3f3cfaaa0f50aca39146";
-    hash = "sha256-jQFZRDnoaa0EvB9b55J1eYyfwCfD9LO2bwT1NVNbUME=";
+    rev = "515c9f70f13ba4b4b9e19930b3e899c4ac8a50a4";
+    hash = "sha256-fqU58lZeFchlY5aqyQgIfrN5ec/jqbhXNwNxyL2lp/g=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/xe/xenia-canary/package.nix b/pkgs/by-name/xe/xenia-canary/package.nix
index 7ed8c138ba22..8552bdde949b 100644
--- a/pkgs/by-name/xe/xenia-canary/package.nix
+++ b/pkgs/by-name/xe/xenia-canary/package.nix
@@ -33,14 +33,14 @@ let
 in
 llvmPackages_20.stdenv.mkDerivation {
   pname = "xenia-canary";
-  version = "0-unstable-2026-08-13";
+  version = "0-unstable-2026-08-24";
 
   src = fetchFromGitHub {
     owner = "xenia-canary";
     repo = "xenia-canary";
     fetchSubmodules = true;
-    rev = "907d92bf8cfad334cb1b83755f48b6bfea391806";
-    hash = "sha256-5ATxs7iD5QS7VKAevRNOfCAAjMRDLuk5djAQrhBMnfQ=";
+    rev = "1e834f8a8c4033e9848f1a65c57edb8703990e09";
+    hash = "sha256-mfVRWZeLSCbjC2uJqztcvQeOfmscCzMZXR117tHXwA4=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/xz/xz/package.nix b/pkgs/by-name/xz/xz/package.nix
index 62460c88acd4..1313bc1779a2 100644
--- a/pkgs/by-name/xz/xz/package.nix
+++ b/pkgs/by-name/xz/xz/package.nix
@@ -77,6 +77,8 @@ stdenv.mkDerivation (finalAttrs: {
     };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     changelog = "https://github.com/tukaani-project/xz/releases/tag/v${finalAttrs.version}";
     description = "General-purpose data compression software, successor of LZMA";
diff --git a/pkgs/by-name/ya/yara-x/package.nix b/pkgs/by-name/ya/yara-x/package.nix
index 22807879f612..fd51b4b8fbfd 100644
--- a/pkgs/by-name/ya/yara-x/package.nix
+++ b/pkgs/by-name/ya/yara-x/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "yara-x";
-  version = "1.19.0";
+  version = "1.20.0";
 
   src = fetchFromGitHub {
     owner = "VirusTotal";
     repo = "yara-x";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CokjFTQoFT9k/2/MuQSbfzHonW4V0F8hskhqDvpCesM=";
+    hash = "sha256-TR9P4QYDxHSpAmPShiRNdNK1c4v3hGAx8mNOEhAo/HQ=";
   };
 
-  cargoHash = "sha256-wMh8F++16tQ0IUhacBPb4rDcydmDKZKzQf8EK/qDJXo=";
+  cargoHash = "sha256-/D4/H/+O1bCHecEO92aq05U3lPG2P/CFTWVlHekuH98=";
 
   env = {
     CARGO_PROFILE_RELEASE_LTO = "fat";
diff --git a/pkgs/by-name/ya/yazi/plugins/mediainfo/default.nix b/pkgs/by-name/ya/yazi/plugins/mediainfo/default.nix
index 65e148c38625..b2600757e674 100644
--- a/pkgs/by-name/ya/yazi/plugins/mediainfo/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/mediainfo/default.nix
@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
   pname = "mediainfo.yazi";
-  version = "0-unstable-2026-07-13";
+  version = "0-unstable-2026-08-23";
 
   src = fetchFromGitHub {
     owner = "boydaihungst";
     repo = "mediainfo.yazi";
-    rev = "e079a001f4fefd69007e515bbede4e16b95a811e";
-    hash = "sha256-RIVcKJO89R4oaE6sJuFcV8pFK4nvWtq6ILAXehu4FIY=";
+    rev = "73a36587bd896a20a0c84c0b79b341a0cb7e7b92";
+    hash = "sha256-cdIVIqVxsr+V1I/pqAhr2dxfujTL/de7DFTAOd2jfUk=";
   };
 
   meta = {
diff --git a/pkgs/by-name/ya/yazi/plugins/ouch/default.nix b/pkgs/by-name/ya/yazi/plugins/ouch/default.nix
index 5a88ae55cbb4..29cb7b09469e 100644
--- a/pkgs/by-name/ya/yazi/plugins/ouch/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/ouch/default.nix
@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
   pname = "ouch.yazi";
-  version = "0.7.1";
+  version = "0.7.2";
 
   src = fetchFromGitHub {
     owner = "ndtoan96";
     repo = "ouch.yazi";
-    tag = "v0.7.1";
-    hash = "sha256-CSthsFIiIa81xHgs2Szoy9atRouRESHOPxUt/pOtvl0=";
+    tag = "v0.7.2";
+    hash = "sha256-t1kUo4+YODeTG9d5Yq/vxElcmRHIebC5TRv+uDGG88c=";
   };
 
   meta = {
diff --git a/pkgs/by-name/ya/yazi/plugins/recycle-bin/default.nix b/pkgs/by-name/ya/yazi/plugins/recycle-bin/default.nix
index 261185b749b6..989625bc00db 100644
--- a/pkgs/by-name/ya/yazi/plugins/recycle-bin/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/recycle-bin/default.nix
@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
   pname = "recycle-bin.yazi";
-  version = "0-unstable-2026-01-17";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "uhs-robert";
     repo = "recycle-bin.yazi";
-    rev = "fa687116c46a784e664ef96619b32abf51f29b06";
-    hash = "sha256-lpxTGWA15szM5VJ+qvV2+GTg7HXiZaZfyWyjeNMsTSM=";
+    tag = "v1.1.1";
+    hash = "sha256-ghmjM4jmXNC4+P2sl70UhI+8Vv5k3PZV7AwV7iBj1I4=";
   };
 
   meta = {
diff --git a/pkgs/by-name/ya/yazi/plugins/sudo/default.nix b/pkgs/by-name/ya/yazi/plugins/sudo/default.nix
index 29bb21a557b3..01480fd698c3 100644
--- a/pkgs/by-name/ya/yazi/plugins/sudo/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/sudo/default.nix
@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
   pname = "sudo.yazi";
-  version = "0-unstable-2026-05-07";
+  version = "0-unstable-2026-08-23";
 
   src = fetchFromGitHub {
     owner = "TD-Sky";
     repo = "sudo.yazi";
-    rev = "afd61cedbcd13c549c552766755645069561d28c";
-    hash = "sha256-5wa4fdYo7wOXOzdrigWMtADZIL/7alG8Jw7r8iWz9yA=";
+    rev = "be3670f3eae8c565e541d65e5f8f292f2e4f2398";
+    hash = "sha256-GNhoRnEKfA6otuXal87JWLW1bUW4Ago94BbQQ1ae3zA=";
   };
 
   meta = {
diff --git a/pkgs/by-name/za/zashboard/package.nix b/pkgs/by-name/za/zashboard/package.nix
index b1fd526438c0..53c9057c82aa 100644
--- a/pkgs/by-name/za/zashboard/package.nix
+++ b/pkgs/by-name/za/zashboard/package.nix
@@ -12,13 +12,13 @@ let
 in
 buildNpmPackage (finalAttrs: {
   pname = "zashboard";
-  version = "3.19.0";
+  version = "3.22.0";
 
   src = fetchFromGitHub {
     owner = "Zephyruso";
     repo = "zashboard";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lFuM6ovnFJysndARV00A659nXIlG+tMNuXv2Z7DlQZM=";
+    hash = "sha256-K7WZnFXgiSI/pxhDWfoWX9tHKJiNK1wbO6qowUu1hOo=";
   };
 
   npmDeps = null;
@@ -26,7 +26,7 @@ buildNpmPackage (finalAttrs: {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-UjoY2/cLJ0chdZ2VUq/7KoJXRhLrJAADi8jEYjHKdmw=";
+    hash = "sha256-jbTAN9QbhXiGzD/McdoN62JIdRL8MA/v/kdLawWbokU=";
   };
 
   nativeBuildInputs = [ pnpm ];
diff --git a/pkgs/by-name/zi/zip/12-fix-build-with-gcc-14.patch b/pkgs/by-name/zi/zip/12-fix-build-with-gcc-14.patch
deleted file mode 100644
index 58d070a3c2b9..000000000000
--- a/pkgs/by-name/zi/zip/12-fix-build-with-gcc-14.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From: Santiago Vila <sanvila@debian.org>
-Subject: Fix build with gcc-14
-Bug-Debian: https://bugs.debian.org/1075706
-X-Debian-version: 3.0-14
-
---- a/unix/configure
-+++ b/unix/configure
-@@ -514,14 +514,16 @@
-   echo Check for $func
-   echo "int main(){ $func(); return 0; }" > conftest.c
-   $CC $BFLAG -o conftest conftest.c >/dev/null 2>/dev/null
--  [ $? -ne 0 ] && CFLAGS="${CFLAGS} -DNO_`echo $func | tr '[a-z]' '[A-Z]'`"
-+# glibc-based systems do not need this
-+# [ $? -ne 0 ] && CFLAGS="${CFLAGS} -DNO_`echo $func | tr '[a-z]' '[A-Z]'`"
- done
- 
- 
- echo Check for memset
- echo "int main(){ char k; memset(&k,0,0); return 0; }" > conftest.c
- $CC -o conftest conftest.c >/dev/null 2>/dev/null
--[ $? -ne 0 ] && CFLAGS="${CFLAGS} -DZMEM"
-+# glibc-based systems do not need this
-+# [ $? -ne 0 ] && CFLAGS="${CFLAGS} -DZMEM"
- 
- 
- echo Check for memmove
-@@ -551,7 +553,8 @@
- }
- _EOF_
- $CC $CFLAGS -c conftest.c >/dev/null 2>/dev/null
--[ $? -ne 0 ] && CFLAGS="${CFLAGS} -DNO_ERRNO"
-+# glibc-based systems do not need this
-+# [ $? -ne 0 ] && CFLAGS="${CFLAGS} -DNO_ERRNO"
- 
- 
- echo Check for directory libraries
-@@ -567,7 +570,8 @@
-     $CC -o conftest conftest.c -l$lib >/dev/null 2>/dev/null
-     [ $? -eq 0 ] && OPT=-l$lib && break
-   done
--  if [ ${OPT} ]; then
-+  # glibc-based systems do not need this
-+  if true; then
-     LFLAGS2="${LFLAGS2} ${OPT}"
-   else
-     CFLAGS="${CFLAGS} -DNO_DIR"
-@@ -629,7 +633,8 @@
- }
- _EOF_
- $CC ${CFLAGS} -c conftest.c > /dev/null 2>/dev/null
--[ $? -ne 0 ] && CFLAGS="${CFLAGS} -DNO_VALLOC"
-+# glibc-based systems do not need this
-+# [ $? -ne 0 ] && CFLAGS="${CFLAGS} -DNO_VALLOC"
- 
- 
- echo Check for /usr/local/bin and /usr/local/man
diff --git a/pkgs/by-name/zi/zip/package.nix b/pkgs/by-name/zi/zip/package.nix
index 3bf6b8a1641a..e67be89c2a9b 100644
--- a/pkgs/by-name/zi/zip/package.nix
+++ b/pkgs/by-name/zi/zip/package.nix
@@ -6,17 +6,20 @@
   libnatspec ? null,
   libiconv,
   fetchpatch,
+  fetchDebianPatch,
 }:
 
 assert enableNLS -> libnatspec != null;
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "zip";
   version = "3.0";
 
   src = fetchurl {
     urls = [
-      "ftp://ftp.info-zip.org/pub/infozip/src/zip${lib.replaceStrings [ "." ] [ "" ] version}.tgz"
+      "ftp://ftp.info-zip.org/pub/infozip/src/zip${
+        lib.replaceStrings [ "." ] [ "" ] finalAttrs.version
+      }.tgz"
       "https://src.fedoraproject.org/repo/pkgs/zip/zip30.tar.gz/7b74551e63f8ee6aab6fbc86676c0d37/zip30.tar.gz"
     ];
     sha256 = "0sb3h3067pzf3a7mlxn1hikpcjrsvycjcnj9hl9b1c3ykcgvps7h";
@@ -44,9 +47,12 @@ stdenv.mkDerivation rec {
     #     zip I/O error: No such file or directory
     #     zip error: Could not create output file (was replacing the original zip file)
     #     make[2]: *** [CreateJars.gmk:659: /build/source/build/linux-x86_64-normal-server-release/images/src.zip] Error 1
-    #
-    # Source: Debian
-    ./12-fix-build-with-gcc-14.patch
+    (fetchDebianPatch {
+      inherit (finalAttrs) pname version;
+      debianRevision = "16";
+      patch = "fix-build-with-gcc-14.patch";
+      hash = "sha256-C966AdPV5E44cJ1L28iFvmXq3frjNiW6PoHiOOusS04=";
+    })
     (fetchpatch {
       url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/app-arch/zip/files/zip-3.0-pic.patch?id=d37d095fc7a2a9e4a8e904a7bf0f597fe99df85a";
       hash = "sha256-OXgC9KqiOpH/o/bSabt3LqtoT/xifqfkvpLLPfPz+1c=";
@@ -74,6 +80,22 @@ stdenv.mkDerivation rec {
       url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/app-arch/zip/files/zip-3.0-zipnote-freeze.patch?id=d37d095fc7a2a9e4a8e904a7bf0f597fe99df85a";
       hash = "sha256-EVr7YS3IytnCRjAYUlkg05GA/kaAY9NRFG7uDt0QLAY=";
     })
+    # Fix buffer overflow (CVE-2018-13410).
+    # See: https://seclists.org/fulldisclosure/2018/Jul/24
+    (fetchDebianPatch {
+      inherit (finalAttrs) pname version;
+      debianRevision = "16";
+      patch = "buffer-overflow-cve-2018-13410.patch";
+      hash = "sha256-Hgy0yrBuSX2XWN1PNASQbjiXfyzSScwHQ+o0fv6Sgs4=";
+    })
+    # Command injection in zip -T for specially crafted file
+    # names. See: https://seclists.org/oss-sec/2026/q3/494
+    (fetchDebianPatch {
+      inherit (finalAttrs) pname version;
+      debianRevision = "16";
+      patch = "fix-command-injection.patch";
+      hash = "sha256-cfE98l98KkPfDS5KT/DB2bqFNPTbHBKyJ7W2+iKgaGI=";
+    })
   ]
   ++ lib.optionals (enableNLS && !stdenv.hostPlatform.isCygwin) [ ./natspec-gentoo.patch.bz2 ];
 
@@ -88,4 +110,4 @@ stdenv.mkDerivation rec {
     maintainers = with lib.maintainers; [ RossComputerGuy ];
     mainProgram = "zip";
   };
-}
+})
diff --git a/pkgs/by-name/zl/zlib-ng/package.nix b/pkgs/by-name/zl/zlib-ng/package.nix
index 6d813b919db7..5bf6295a3e2c 100644
--- a/pkgs/by-name/zl/zlib-ng/package.nix
+++ b/pkgs/by-name/zl/zlib-ng/package.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "zlib-ng";
     repo = "zlib-ng";
-    rev = finalAttrs.version;
+    tag = finalAttrs.version;
     hash = "sha256-6GlHCnx9dQtmViPnvHnMS+l9Z+g6M8ynrSxLhLtmAKU=";
   };
 
@@ -46,6 +46,8 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals withZlibCompat [ "-DZLIB_COMPAT=ON" ];
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Zlib data compression library for the next generation systems";
     homepage = "https://github.com/zlib-ng/zlib-ng";
diff --git a/pkgs/by-name/zv/zvbi/package.nix b/pkgs/by-name/zv/zvbi/package.nix
index 50c58744efab..ea33b1e12e8e 100644
--- a/pkgs/by-name/zv/zvbi/package.nix
+++ b/pkgs/by-name/zv/zvbi/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zvbi";
-  version = "0.2.44";
+  version = "0.2.45";
 
   src = fetchFromGitHub {
     owner = "zapping-vbi";
     repo = "zvbi";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-knc9PejugU6K4EQflfz91keZr3ZJqZu2TKFQFFJrxiI=";
+    hash = "sha256-Nkg/Y7tHYAEi3ndbiJwwutVrGCOIE5RUCNQW3j12BkM=";
   };
 
   configureFlags = lib.optionals (!lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform) [
diff --git a/pkgs/development/beam-modules/default.nix b/pkgs/development/beam-modules/default.nix
index 5e7622a3c11b..ac2536a46c92 100644
--- a/pkgs/development/beam-modules/default.nix
+++ b/pkgs/development/beam-modules/default.nix
@@ -91,6 +91,11 @@ makeScopeWithSplicing' {
 
     }
     // lib.optionalAttrs config.allowAliases {
+      extend = throw ''
+        'beamPackages.extend' has been replaced by 'beamPackages.overrideScope'
+
+        See examples at https://nixos.org/manual/nixpkgs/unstable/#sec-beam
+      ''; # added 2026-08-24
       webdriver = throw "'beamPackages.webdriver' has been removed."; # added 2026-07-29
     };
 
diff --git a/pkgs/development/compilers/arocc/default.nix b/pkgs/development/compilers/arocc/default.nix
index 2372e60c421d..a017b60b9a4e 100644
--- a/pkgs/development/compilers/arocc/default.nix
+++ b/pkgs/development/compilers/arocc/default.nix
@@ -2,18 +2,18 @@
   lib,
   fetchFromGitHub,
   callPackage,
-  zig_0_14,
+  zig,
 }:
 let
   versions = [
     {
-      zig = zig_0_14;
-      version = "0-unstable-2025-03-05";
+      inherit zig;
+      version = "0-unstable-2026-04-02";
       src = fetchFromGitHub {
         owner = "Vexu";
         repo = "arocc";
-        rev = "8c6bab43ba351fc045a1d262d8a8da4a11215e37";
-        hash = "sha256-J5Cj9UMwAMwH2JGby13FIKl5Qbj4N4XpSSY7zL21aoY=";
+        rev = "5f5a050569a95ecc40a426f0c3666ae7ef987ede";
+        hash = "sha256-f8Z0SXWx5Uia2TCMB5SUpcO8+xUnaWk32Oknva7xcxw=";
       };
     }
   ];
diff --git a/pkgs/development/compilers/dart/default.nix b/pkgs/development/compilers/dart/default.nix
index c3bc2b39fd9e..033da4699ddf 100644
--- a/pkgs/development/compilers/dart/default.nix
+++ b/pkgs/development/compilers/dart/default.nix
@@ -21,11 +21,13 @@ stdenv.mkDerivation (finalAttrs: {
       system = selectSystem {
         x86_64-linux = "linux-x64";
         aarch64-linux = "linux-arm64";
+        riscv64-linux = "linux-riscv64";
         aarch64-darwin = "macos-arm64";
       };
       hash = selectSystem {
         x86_64-linux = "sha256-h5Alc/rNisrKx+4f5z+o0GaOBgZQFgaOLtbFyZxrHuA=";
         aarch64-linux = "sha256-IBQaBlMyeTm7IMS4eyMSJr66ESjYqa7bswy1rxonkNQ=";
+        riscv64-linux = "sha256-VmvqaHCVsXv9W8+YdgnWAaW+THuDcc851O/6czx7WFE=";
         aarch64-darwin = "sha256-GBLWAq7Qqc9ygck/UUoeGuz2DcNFxDN9uk/yj6jTmMo=";
       };
     in
@@ -112,6 +114,7 @@ stdenv.mkDerivation (finalAttrs: {
       "x86_64-linux"
       "aarch64-linux"
       "aarch64-darwin"
+      "riscv64-linux"
     ];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.bsd3;
diff --git a/pkgs/development/compilers/emscripten/0002-libunwind-restore-Unwind_CallPersonality.patch b/pkgs/development/compilers/emscripten/0002-libunwind-restore-Unwind_CallPersonality.patch
new file mode 100644
index 000000000000..407f9573f670
--- /dev/null
+++ b/pkgs/development/compilers/emscripten/0002-libunwind-restore-Unwind_CallPersonality.patch
@@ -0,0 +1,23 @@
+libunwind: restore _Unwind_CallPersonality for release LLVM
+
+Nixpkgs builds emscripten with the release LLVM, not the llvm-project
+main commit that emsdk pins. Release LLVM (<= 22.x) emits calls to
+_Unwind_CallPersonality. llvm-project PR #209282 moved that helper into
+libc++abi, renamed to __gxx_wasm_personality_v0. Add the old name back
+as a forwarder to the new name. Remove this patch when llvmPackages
+reaches LLVM 23.
+
+--- a/system/lib/libunwind/src/Unwind-wasm.c
++++ b/system/lib/libunwind/src/Unwind-wasm.c
+@@ -95,4 +95,11 @@
+   return 0;
+ }
+ 
++_Unwind_Reason_Code __gxx_wasm_personality_v0(void *exception_ptr);
++
++_LIBUNWIND_EXPORT _Unwind_Reason_Code
++_Unwind_CallPersonality(void *exception_ptr) {
++  return __gxx_wasm_personality_v0(exception_ptr);
++}
++
+ #endif // defined(__WASM_EXCEPTIONS__)
diff --git a/pkgs/development/compilers/emscripten/default.nix b/pkgs/development/compilers/emscripten/default.nix
index cf4576b9402f..25dc6e1cc03b 100644
--- a/pkgs/development/compilers/emscripten/default.nix
+++ b/pkgs/development/compilers/emscripten/default.nix
@@ -69,6 +69,8 @@ stdenv.mkDerivation rec {
     (replaceVars ./0001-emulate-clang-sysroot-include-logic.patch {
       resourceDir = "${llvmEnv}/lib/clang/${lib.versions.major llvmPackages.llvm.version}/";
     })
+    # Remove this patch when llvmPackages reaches LLVM 23
+    ./0002-libunwind-restore-Unwind_CallPersonality.patch
   ];
 
   buildPhase = ''
@@ -196,6 +198,21 @@ stdenv.mkDerivation rec {
         runHook postInstall
   '';
 
+  doInstallCheck = true;
+
+  # C++ exceptions with -fwasm-exceptions must compile and link
+  # see https://github.com/NixOS/nixpkgs/pull/556385
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    pushd $TMPDIR
+    echo 'int main() { try { throw 42; } catch (int) { return 0; } return 1; }' > throw.cpp
+    $out/bin/em++ -fwasm-exceptions throw.cpp -o throw.js
+    popd
+
+    runHook postInstallCheck
+  '';
+
   passthru = {
     # HACK: Make emscripten look more like a cc-wrapper to GHC
     # when building the javascript backend.
diff --git a/pkgs/development/compilers/ghc/common-have-ncg.nix b/pkgs/development/compilers/ghc/common-have-ncg.nix
index 1b92a0700ac2..ea2a8af23c09 100644
--- a/pkgs/development/compilers/ghc/common-have-ncg.nix
+++ b/pkgs/development/compilers/ghc/common-have-ncg.nix
@@ -12,3 +12,4 @@ stdenv.targetPlatform.isx86
 || (lib.versionAtLeast version "9.2" && stdenv.targetPlatform.isAarch64)
 || (lib.versionAtLeast version "9.6" && stdenv.targetPlatform.isGhcjs)
 || (lib.versionAtLeast version "9.12" && stdenv.targetPlatform.isRiscV64)
+|| (lib.versionAtLeast version "9.14" && stdenv.targetPlatform.isLoongArch64)
diff --git a/pkgs/development/compilers/go/1.26.nix b/pkgs/development/compilers/go/1.26.nix
index b9c04a91729c..ccb5b67f17af 100644
--- a/pkgs/development/compilers/go/1.26.nix
+++ b/pkgs/development/compilers/go/1.26.nix
@@ -25,11 +25,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
-  version = "1.26.5";
+  version = "1.26.7";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-SVvkvIcXasVnOS5bQRar2YRm0z17SdQedkzMaXay3EI=";
+    hash = "sha256-DtJOrHVRBQhbif6cq8J0K5GgrXuUtZ0602SRjryJVq0=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/compilers/openjdk/11/source.json b/pkgs/development/compilers/openjdk/11/source.json
index e1ee5457ea14..bded9bb92a3f 100644
--- a/pkgs/development/compilers/openjdk/11/source.json
+++ b/pkgs/development/compilers/openjdk/11/source.json
@@ -1,6 +1,6 @@
 {
-  "hash": "sha256-2j3rFo7jRAQ/a+z2og0Nhrf1eyHarzb4vDTbrRtXwB4=",
+  "hash": "sha256-vXJaEXp8cum+sXm9dnmVeDsZBobeHh82Jd8jIND03Yk=",
   "owner": "openjdk",
   "repo": "jdk11u",
-  "rev": "refs/tags/jdk-11.0.32+9"
+  "rev": "refs/tags/jdk-11.0.32.1+1"
 }
diff --git a/pkgs/development/compilers/vala/default.nix b/pkgs/development/compilers/vala/default.nix
index 47d32565ac18..17847cb1ae04 100644
--- a/pkgs/development/compilers/vala/default.nix
+++ b/pkgs/development/compilers/vala/default.nix
@@ -127,8 +127,8 @@ let
 in
 rec {
   vala_0_56 = generic {
-    version = "0.56.18";
-    hash = "sha256-8q/+fUCrY9uOe57MP2vcnC/H4xNMhP8teV9IL+kmo4I=";
+    version = "0.56.19";
+    hash = "sha256-WtfLv8wN5htAPWeXye9gRVv769jhYq7DO1sLCXrfudU=";
   };
 
   vala = vala_0_56;
diff --git a/pkgs/development/interpreters/lua-5/interpreter.nix b/pkgs/development/interpreters/lua-5/interpreter.nix
index c4fc149074ee..c7cc52a75a5e 100644
--- a/pkgs/development/interpreters/lua-5/interpreter.nix
+++ b/pkgs/development/interpreters/lua-5/interpreter.nix
@@ -82,6 +82,8 @@ stdenv.mkDerivation (
     nativeBuildInputs = [ makeWrapper ];
     buildInputs = [ readline ];
 
+    strictDeps = true;
+
     inherit patches;
 
     postPatch = ''
@@ -217,6 +219,8 @@ stdenv.mkDerivation (
         );
       };
 
+    __structuredAttrs = true;
+
     meta = {
       homepage = "https://www.lua.org";
       description = "Powerful, fast, lightweight, embeddable scripting language";
diff --git a/pkgs/development/interpreters/luajit/2.1.nix b/pkgs/development/interpreters/luajit/2.1.nix
index 84c188166673..a227695f2cc4 100644
--- a/pkgs/development/interpreters/luajit/2.1.nix
+++ b/pkgs/development/interpreters/luajit/2.1.nix
@@ -8,13 +8,13 @@
 callPackage ./default.nix {
   # The patch version is the timestamp of the git commit,
   # obtain via `cat $(nix-build -A luajit_2_1.src)/.relver`
-  version = "2.1.1774638290";
+  version = "2.1.1785763465";
 
   src = fetchFromGitHub {
     owner = "LuaJIT";
     repo = "LuaJIT";
-    rev = "fbb36bb6bfa88716a47c58bcf9ce9f2ef752abac";
-    hash = "sha256-BqH66q38mJpIYJgPiSPt7I0B3VLBvuDRRTiMJ7ldkBI=";
+    rev = "1edc3e52b67eaf6ce5f809be8e17d6862594b8bc";
+    hash = "sha256-mcOvVJ7AaoHrbEXxznpOkFoY7Kbd2aWMoOmyx5B4FIg=";
   };
 
   inherit self passthruFun;
diff --git a/pkgs/development/interpreters/perl/CVE-2026-15534-1.patch b/pkgs/development/interpreters/perl/CVE-2026-15534-1.patch
new file mode 100644
index 000000000000..fc8ee2f29ea9
--- /dev/null
+++ b/pkgs/development/interpreters/perl/CVE-2026-15534-1.patch
@@ -0,0 +1,39 @@
+CVE-2026-15534, upstream commit
+568e6fd238867bb9e99fa3f47cba3169009239e0.
+
+diff --git a/regexec.c b/regexec.c
+index 35a727459c4a..29aa73c13cb9 100644
+--- a/regexec.c
++++ b/regexec.c
+@@ -9211,7 +9211,8 @@ NULL
+                     reginfo->poscache_iter = reginfo->poscache_maxiter;
+                 }
+ 
+-                if (reginfo->poscache_iter-- == 0) {
++                if (reginfo->poscache_iter == 1) {
++                    reginfo->poscache_iter--;
+                     /* initialise cache */
+                     const SSize_t size = (reginfo->poscache_maxiter + 7)/8;
+                     regmatch_info_aux *const aux = reginfo->info_aux;
+@@ -9232,11 +9233,10 @@ NULL
+                     );
+                 }
+ 
+-                if (reginfo->poscache_iter < 0) {
++                if (reginfo->poscache_iter == 0) {
+                     /* have we already failed at this position? */
+                     SSize_t offset, mask;
+ 
+-                    reginfo->poscache_iter = -1; /* stop eventual underflow */
+                     offset  = (FLAGS(scan) & 0xf) - 1
+                                 +   (locinput - reginfo->strbeg)
+                                   * (FLAGS(scan)>>4);
+@@ -9252,6 +9252,8 @@ NULL
+                     ST.cache_offset = offset;
+                     ST.cache_mask   = mask;
+                 }
++                else
++                    reginfo->poscache_iter--;
+             }
+ 
+             /* Prefer B over A for minimal matching. */
diff --git a/pkgs/development/interpreters/perl/CVE-2026-15534-2.patch b/pkgs/development/interpreters/perl/CVE-2026-15534-2.patch
new file mode 100644
index 000000000000..b5d0ff5ed3d0
--- /dev/null
+++ b/pkgs/development/interpreters/perl/CVE-2026-15534-2.patch
@@ -0,0 +1,59 @@
+CVE-2026-15534, upstream commit
+54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.
+
+diff --git a/regexec.c b/regexec.c
+index 29aa73c13cb9..66e0c0924059 100644
+--- a/regexec.c
++++ b/regexec.c
+@@ -9202,22 +9202,27 @@ NULL
+                 if (!reginfo->poscache_maxiter) {
+                     /* start the countdown: Postpone detection until we
+                      * know the match is not *that* much linear. */
+-                    reginfo->poscache_maxiter
+-                        =    (reginfo->strend - reginfo->strbeg + 1)
+-                           * (FLAGS(scan)>>4);
+-                    /* possible overflow for long strings and many CURLYX's */
+-                    if (reginfo->poscache_maxiter < 0)
+-                        reginfo->poscache_maxiter = I32_MAX;
+-                    reginfo->poscache_iter = reginfo->poscache_maxiter;
++                    STRLEN len = reginfo->strend - reginfo->strbeg;
++                    /* number of participating WHILEMs */
++                    U8 n = (FLAGS(scan)>>4);
++
++                    /* Only do the calculations and enable the cache if it
++                     * won't overflow. This test is equivalent to:
++                     *    ((len + 1) * n  + 7) <= max(STRLEN)
++                     */
++                    if (len < ((~(STRLEN)0) - 7)/n) {
++                        reginfo->poscache_maxiter = (len + 1) * n;
++                        reginfo->poscache_iter = reginfo->poscache_maxiter;
++                    }
+                 }
+ 
+                 if (reginfo->poscache_iter == 1) {
+                     reginfo->poscache_iter--;
+                     /* initialise cache */
+-                    const SSize_t size = (reginfo->poscache_maxiter + 7)/8;
++                    const STRLEN size = (reginfo->poscache_maxiter + 7)/8;
+                     regmatch_info_aux *const aux = reginfo->info_aux;
+                     if (aux->poscache) {
+-                        if ((SSize_t)reginfo->poscache_size < size) {
++                        if (reginfo->poscache_size < size) {
+                             Renew(aux->poscache, size, char);
+                             reginfo->poscache_size = size;
+                         }
+diff --git a/regexp.h b/regexp.h
+index 057d9ac5011b..d5d40e0a5618 100644
+--- a/regexp.h
++++ b/regexp.h
+@@ -839,8 +839,8 @@ typedef struct {
+     char *cutpoint;      /* (*COMMIT) position (if any) */
+     regmatch_info_aux      *info_aux; /* extra fields that need cleanup */
+     regmatch_info_aux_eval *info_aux_eval; /* extra saved state for (?{}) */
+-    I32  poscache_maxiter; /* how many whilems todo before S-L cache kicks in */
+-    I32  poscache_iter;    /* current countdown from _maxiter to zero */
++    STRLEN poscache_maxiter; /* how many whilems todo before S-L cache kicks in */
++    STRLEN poscache_iter;    /* current countdown from _maxiter to zero */
+     STRLEN poscache_size;  /* size of regmatch_info_aux.poscache */
+     bool intuit;    /* re_intuit_start() is the top-level caller */
+     bool is_utf8_pat;    /* regex is utf8 */
diff --git a/pkgs/development/interpreters/perl/CVE-2026-8376.patch b/pkgs/development/interpreters/perl/CVE-2026-8376.patch
deleted file mode 100644
index c8ad72298178..000000000000
--- a/pkgs/development/interpreters/perl/CVE-2026-8376.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-Targeted patch for CVE-2026-8376, based on 5e7f119eb2bb1181be908701f22bf7068e722f1c but avoids changes to t/re/pat_psycho.t as they do not apply cleanly.
-
-diff --git a/regcomp_study.c b/regcomp_study.c
-index b513454a4258..1602663f4b26 100644
---- a/regcomp_study.c
-+++ b/regcomp_study.c
-@@ -2784,6 +2784,13 @@ Perl_study_chunk(pTHX_
-                                                (U8 *) SvEND(data->last_found))
-                                 - (U8*)s;
-                         l -= old;
-+
-+                        if (l > 0 &&
-+                            (mincount >= SSize_t_MAX / (SSize_t)l
-+                             || old > SSize_t_MAX - mincount * (SSize_t)l)) {
-+                            FAIL("Regexp out of space");
-+                        }
-+
-                         /* Get the added string: */
-                         last_str = newSVpvn_utf8(s  + old, l, UTF);
-                         last_chrs = UTF ? utf8_length((U8*)(s + old),
diff --git a/pkgs/development/interpreters/perl/default.nix b/pkgs/development/interpreters/perl/default.nix
index cab0ea1a2268..6cc6f5755ac4 100644
--- a/pkgs/development/interpreters/perl/default.nix
+++ b/pkgs/development/interpreters/perl/default.nix
@@ -73,8 +73,8 @@ in
 rec {
   perl5 = callPackage ./interpreter.nix {
     self = perl5;
-    version = "5.42.0";
-    sha256 = "sha256-4JPvGE1/mhuXl+JGUpb1VRCtttq4hCsMPtUzKWYwltw=";
+    version = "5.42.3";
+    sha256 = "sha256-ETd0CYWDe1zfFfDPq5Miedy0NS+RL+1vwUTotPCCNic=";
     inherit passthruFun;
   };
 }
diff --git a/pkgs/development/interpreters/perl/interpreter.nix b/pkgs/development/interpreters/perl/interpreter.nix
index cdb03912b517..ae75db2ead90 100644
--- a/pkgs/development/interpreters/perl/interpreter.nix
+++ b/pkgs/development/interpreters/perl/interpreter.nix
@@ -37,7 +37,8 @@ let
     # Do not look in /usr etc. for dependencies.
     ./no-sys-dirs.patch
 
-    ./CVE-2026-8376.patch
+    ./CVE-2026-15534-1.patch
+    ./CVE-2026-15534-2.patch
   ]
 
   # Fix build on Solaris on x86_64
@@ -83,48 +84,7 @@ let
 
   # Inject fixed CPAN releases for bundled dual-life distributions until the
   # next perl maintenance release includes them.
-  vendoredPerlDistributions = [
-    {
-      # CVE-2026-7010
-      path = "cpan/HTTP-Tiny";
-      src = fetchurl {
-        url = "mirror://cpan/authors/id/H/HA/HAARG/HTTP-Tiny-0.094.tar.gz";
-        hash = "sha256-poQemfwbVdFd6VlHzL17dnvsxRxxAhl/qPBE333cB0M=";
-      };
-    }
-    {
-      # CVE-2026-3381, CVE-2026-4176
-      path = "cpan/Compress-Raw-Zlib";
-      src = fetchurl {
-        url = "mirror://cpan/authors/id/P/PM/PMQS/Compress-Raw-Zlib-2.222.tar.gz";
-        hash = "sha256-Hf19URplVifIGBXTDTurwo+luIRV/wP4sECZ3LUShrg=";
-      };
-    }
-    {
-      # Runtime dependency of IO-Compress 2.220.
-      path = "cpan/Compress-Raw-Bzip2";
-      src = fetchurl {
-        url = "mirror://cpan/authors/id/P/PM/PMQS/Compress-Raw-Bzip2-2.218.tar.gz";
-        hash = "sha256-iRU+ai69pSNJSTsHT6S3VJ/x+QU952E8GKXgXFtBX6g=";
-      };
-    }
-    {
-      # CVE-2026-48962, CVE-2026-48961, CVE-2026-48959
-      path = "cpan/IO-Compress";
-      src = fetchurl {
-        url = "mirror://cpan/authors/id/P/PM/PMQS/IO-Compress-2.220.tar.gz";
-        hash = "sha256-nZbqKR8sVO82fHOWuFfZO6GsHEsvG84T7Yo+Xz7rtic=";
-      };
-    }
-    {
-      # CVE-2026-42496, CVE-2026-42497, CVE-2026-9538
-      path = "cpan/Archive-Tar";
-      src = fetchurl {
-        url = "mirror://cpan/authors/id/B/BI/BINGOS/Archive-Tar-3.12.tar.gz";
-        hash = "sha256-ARTvObZfSfiWgoOrR3Gdfoj5jXNg/jZJvjMcf1PVgyw=";
-      };
-    }
-  ];
+  vendoredPerlDistributions = [ ];
 
   replaceVendoredPerlDistributions = lib.concatMapStringsSep "\n" (d: ''
     rm -rf ${d.path}
@@ -440,6 +400,8 @@ stdenv.mkDerivation (
       # fixes build failure due to missing d_fdopendir/HAS_FDOPENDIR configure option
       # https://github.com/arsv/perl-cross/pull/159
       ./cross-fdopendir.patch
+
+      ./perl-cross-1.6.4--5.42.3.patch
     ];
 
     depsBuildBuild = [
diff --git a/pkgs/development/interpreters/perl/perl-cross-1.6.4--5.42.3.patch b/pkgs/development/interpreters/perl/perl-cross-1.6.4--5.42.3.patch
new file mode 100644
index 000000000000..853fb8a667a2
--- /dev/null
+++ b/pkgs/development/interpreters/perl/perl-cross-1.6.4--5.42.3.patch
@@ -0,0 +1,86 @@
+perl-cross 1.6.4 ships no patch set for perl 5.42.3. The perl5-5.42.0 set
+applies unchanged, so link it under the name perl-cross looks for. The
+links are per-file because `find cnf/diffs/perl5-$version`, which
+perl-cross uses to collect them, does not descend into a symlinked
+directory.
+
+diff --git a/cnf/diffs/perl5-5.42.3/constant.patch b/cnf/diffs/perl5-5.42.3/constant.patch
+new file mode 120000
+index 0000000..61f792a
+--- /dev/null
++++ b/cnf/diffs/perl5-5.42.3/constant.patch
+@@ -0,0 +1 @@
++../perl5-5.42.0/constant.patch
+\ No newline at end of file
+diff --git a/cnf/diffs/perl5-5.42.3/dynaloader.patch b/cnf/diffs/perl5-5.42.3/dynaloader.patch
+new file mode 120000
+index 0000000..543415e
+--- /dev/null
++++ b/cnf/diffs/perl5-5.42.3/dynaloader.patch
+@@ -0,0 +1 @@
++../perl5-5.42.0/dynaloader.patch
+\ No newline at end of file
+diff --git a/cnf/diffs/perl5-5.42.3/findext.patch b/cnf/diffs/perl5-5.42.3/findext.patch
+new file mode 120000
+index 0000000..94ed668
+--- /dev/null
++++ b/cnf/diffs/perl5-5.42.3/findext.patch
+@@ -0,0 +1 @@
++../perl5-5.42.0/findext.patch
+\ No newline at end of file
+diff --git a/cnf/diffs/perl5-5.42.3/installscripts.patch b/cnf/diffs/perl5-5.42.3/installscripts.patch
+new file mode 120000
+index 0000000..6f715b4
+--- /dev/null
++++ b/cnf/diffs/perl5-5.42.3/installscripts.patch
+@@ -0,0 +1 @@
++../perl5-5.42.0/installscripts.patch
+\ No newline at end of file
+diff --git a/cnf/diffs/perl5-5.42.3/liblist.patch b/cnf/diffs/perl5-5.42.3/liblist.patch
+new file mode 120000
+index 0000000..5037380
+--- /dev/null
++++ b/cnf/diffs/perl5-5.42.3/liblist.patch
+@@ -0,0 +1 @@
++../perl5-5.42.0/liblist.patch
+\ No newline at end of file
+diff --git a/cnf/diffs/perl5-5.42.3/makemaker.patch b/cnf/diffs/perl5-5.42.3/makemaker.patch
+new file mode 120000
+index 0000000..cf9fc6c
+--- /dev/null
++++ b/cnf/diffs/perl5-5.42.3/makemaker.patch
+@@ -0,0 +1 @@
++../perl5-5.42.0/makemaker.patch
+\ No newline at end of file
+diff --git a/cnf/diffs/perl5-5.42.3/posix-makefile.patch b/cnf/diffs/perl5-5.42.3/posix-makefile.patch
+new file mode 120000
+index 0000000..072ba89
+--- /dev/null
++++ b/cnf/diffs/perl5-5.42.3/posix-makefile.patch
+@@ -0,0 +1 @@
++../perl5-5.42.0/posix-makefile.patch
+\ No newline at end of file
+diff --git a/cnf/diffs/perl5-5.42.3/test-checkcase.patch b/cnf/diffs/perl5-5.42.3/test-checkcase.patch
+new file mode 120000
+index 0000000..6ecc9bc
+--- /dev/null
++++ b/cnf/diffs/perl5-5.42.3/test-checkcase.patch
+@@ -0,0 +1 @@
++../perl5-5.42.0/test-checkcase.patch
+\ No newline at end of file
+diff --git a/cnf/diffs/perl5-5.42.3/test-makemaker.patch b/cnf/diffs/perl5-5.42.3/test-makemaker.patch
+new file mode 120000
+index 0000000..fc6bcda
+--- /dev/null
++++ b/cnf/diffs/perl5-5.42.3/test-makemaker.patch
+@@ -0,0 +1 @@
++../perl5-5.42.0/test-makemaker.patch
+\ No newline at end of file
+diff --git a/cnf/diffs/perl5-5.42.3/xconfig.patch b/cnf/diffs/perl5-5.42.3/xconfig.patch
+new file mode 120000
+index 0000000..87ac501
+--- /dev/null
++++ b/cnf/diffs/perl5-5.42.3/xconfig.patch
+@@ -0,0 +1 @@
++../perl5-5.42.0/xconfig.patch
+\ No newline at end of file
diff --git a/pkgs/development/interpreters/php/default.nix b/pkgs/development/interpreters/php/default.nix
index 28d68b002166..2222676354bd 100644
--- a/pkgs/development/interpreters/php/default.nix
+++ b/pkgs/development/interpreters/php/default.nix
@@ -12,9 +12,6 @@ let
     let
       base = callPackage ./generic.nix {
         stdenv = if stdenv.cc.isClang then llvmPackages.stdenv else stdenv;
-        pcre2 = pcre2.override {
-          withJitSealloc = false; # See https://bugs.php.net/bug.php?id=78927 and https://bugs.php.net/bug.php?id=78630
-        };
         inherit version hash;
       };
     in
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index 7b859c889be9..35a356e30a30 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -366,6 +366,8 @@ stdenv.mkDerivation (finalAttrs: {
     ]
     ++ buildInputs;
 
+  strictDeps = true;
+
   prePatch = optionalString stdenv.hostPlatform.isDarwin ''
     substituteInPlace configure --replace-fail '`/usr/bin/arch`' '"i386"'
   '';
diff --git a/pkgs/development/interpreters/python/hooks/unittest-check-hook.sh b/pkgs/development/interpreters/python/hooks/unittest-check-hook.sh
index 3ee947e278e6..151ea81cf134 100644
--- a/pkgs/development/interpreters/python/hooks/unittest-check-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/unittest-check-hook.sh
@@ -10,11 +10,16 @@ unittestCheckPhase() {
     local -a flagsArray=()
 
     # Compatibility layer to the obsolete unittestFlagsArray
+    if [[ -z "${dontUseUnittestDiscover-}" ]]; then
+      flagsArray+=("discover")
+    fi
+
     eval "flagsArray+=(${unittestFlagsArray[*]-})"
 
     concatTo flagsArray unittestFlags
+
     echoCmd 'unittest flags' "${flagsArray[@]}"
-    @pythonCheckInterpreter@ -m unittest discover "${flagsArray[@]}"
+    @pythonCheckInterpreter@ -m unittest "${flagsArray[@]}"
 
     runHook postCheck
     echo "Finished executing unittestCheckPhase"
diff --git a/pkgs/development/libraries/appstream/default.nix b/pkgs/development/libraries/appstream/default.nix
index 095a87c4d853..61d93622913e 100644
--- a/pkgs/development/libraries/appstream/default.nix
+++ b/pkgs/development/libraries/appstream/default.nix
@@ -32,13 +32,13 @@
   pango,
   librsvg,
   bash-completion,
-  systemd,
+  systemdLibs,
   nixosTests,
   testers,
   withIntrospection ?
     lib.meta.availableOn stdenv.hostPlatform gobject-introspection
     && stdenv.hostPlatform.emulatorAvailable buildPackages,
-  withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
+  withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -115,7 +115,7 @@ stdenv.mkDerivation (finalAttrs: {
     bash-completion
   ]
   ++ lib.optionals withSystemd [
-    systemd
+    systemdLibs
   ];
 
   mesonFlags = [
diff --git a/pkgs/development/libraries/attr/default.nix b/pkgs/development/libraries/attr/default.nix
index 10891ece56a8..fbab3ffe14c2 100644
--- a/pkgs/development/libraries/attr/default.nix
+++ b/pkgs/development/libraries/attr/default.nix
@@ -10,12 +10,12 @@
 # cgit) that are needed here should be included directly in Nixpkgs as
 # files.
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "attr";
   version = "2.6.0";
 
   src = fetchurl {
-    url = "mirror://savannah/attr/attr-${version}.tar.gz";
+    url = "mirror://savannah/attr/attr-${finalAttrs.version}.tar.gz";
     hash = "sha256-1C+jdFExgLtIyxGkZpb0iCQOUST/HmrYiwq/9waYVhI=";
   };
 
@@ -29,6 +29,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ gettext ];
 
+  strictDeps = true;
+
   postPatch = ''
     for script in install-sh include/install-sh; do
       patchShebangs $script
@@ -38,6 +40,8 @@ stdenv.mkDerivation rec {
   # See nixos/tests/attr.nix
   doCheck = false;
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://savannah.nongnu.org/projects/attr/";
     description = "Library and tools for manipulating extended attributes";
@@ -45,6 +49,6 @@ stdenv.mkDerivation rec {
     badPlatforms = lib.platforms.microblaze;
     license = lib.licenses.gpl2Plus;
     teams = [ lib.teams.security-review ];
-    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "attr_project" version;
+    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "attr_project" finalAttrs.version;
   };
-}
+})
diff --git a/pkgs/development/libraries/ffmpeg/default.nix b/pkgs/development/libraries/ffmpeg/default.nix
index 9a37a2d12637..492830ac3f5d 100644
--- a/pkgs/development/libraries/ffmpeg/default.nix
+++ b/pkgs/development/libraries/ffmpeg/default.nix
@@ -36,8 +36,8 @@ let
   };
 
   v9 = {
-    version = "9.0";
-    hash = "sha256-LbHwxvylAPh5lb/H+o+9eMVTB9X+tphrxYYX0cqAL0k=";
+    version = "9.0.1";
+    hash = "sha256-9Vnryl9jSSXRfvt2jPsNp7vHWL0KYdWA29D2zDRAZ+0=";
   };
 in
 
diff --git a/pkgs/development/libraries/fmt/default.nix b/pkgs/development/libraries/fmt/default.nix
index 6c63ba589886..a3bcaac532e9 100644
--- a/pkgs/development/libraries/fmt/default.nix
+++ b/pkgs/development/libraries/fmt/default.nix
@@ -106,7 +106,7 @@ in
     version = "12.2.0";
     hash = "sha256-Tc7PmNxUv7ajw6GaHPGEEtrD/fl6is7RB8TPestJa1o=";
 
-    patches = lib.optionals stdenv.hostPlatform.is32bit [
+    patches = [
       # fix build on 32-bit targets
       # FIXME: remove in next update
       (fetchpatch {
diff --git a/pkgs/development/libraries/gettext/default.nix b/pkgs/development/libraries/gettext/default.nix
index 6814348c1d24..aa242f4e262a 100644
--- a/pkgs/development/libraries/gettext/default.nix
+++ b/pkgs/development/libraries/gettext/default.nix
@@ -12,12 +12,12 @@
 # cgit) that are needed here should be included directly in Nixpkgs as
 # files.
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "gettext";
   version = "1.0";
 
   src = fetchurl {
-    url = "mirror://gnu/gettext/${pname}-${version}.tar.gz";
+    url = "mirror://gnu/gettext/gettext-${finalAttrs.version}.tar.gz";
     hash = "sha256-hdmbecmBpASHTALgNCF2z3XHaY4rUf5BAxz2Um2XTxo=";
   };
   patches = [
@@ -45,6 +45,10 @@ stdenv.mkDerivation rec {
     "gl_cv_func_wcwidth_works=yes"
   ];
 
+  makeFlags = lib.optionals stdenv.hostPlatform.isDarwin [
+    "CFLAGS=-D_FORTIFY_SOURCE=0"
+  ];
+
   postPatch = ''
     # Older versions of gettext come with a copy of `extern-inline.m4` that is not compatible with clang 18.
     # When a project uses gettext + autoreconfPhase, autoreconfPhase will invoke `autopoint -f`, which will
@@ -103,6 +107,8 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
   enableParallelChecking = false; # fails sometimes
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Well integrated set of translation tools and documentation";
 
@@ -131,8 +137,4 @@ stdenv.mkDerivation rec {
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.all;
   };
-}
-
-// lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-  makeFlags = [ "CFLAGS=-D_FORTIFY_SOURCE=0" ];
-}
+})
diff --git a/pkgs/development/libraries/glibc/0001-resolv-Check-for-inet_ntop-failure-in-ns_sprintrrf.patch b/pkgs/development/libraries/glibc/0001-resolv-Check-for-inet_ntop-failure-in-ns_sprintrrf.patch
deleted file mode 100644
index 5e55d1242bb4..000000000000
--- a/pkgs/development/libraries/glibc/0001-resolv-Check-for-inet_ntop-failure-in-ns_sprintrrf.patch
+++ /dev/null
@@ -1,69 +0,0 @@
-From 4d9c6b19fcb34fab03fb7dab8f6d36a2cc4ef982 Mon Sep 17 00:00:00 2001
-From: Florian Weimer <fweimer@redhat.com>
-Date: Fri, 19 Jun 2026 18:22:20 +0200
-Subject: [PATCH 1/3] resolv: Check for inet_ntop failure in ns_sprintrrf
-
-This makes the output more consistent (either failure or complete
-output) and helps with systematic testing with varying buffer
-sizes.
-
-Reviewed-by: Carlos O'Donell <carlos@redhat.com>
-Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
-(cherry picked from commit cd0db208d56a2cecd528b8ae96df752ba5344d9a)
----
- resolv/ns_print.c | 18 +++++++++++-------
- 1 file changed, 11 insertions(+), 7 deletions(-)
-
-diff --git a/resolv/ns_print.c b/resolv/ns_print.c
-index cef2212fd2..cb680fb74e 100644
---- a/resolv/ns_print.c
-+++ b/resolv/ns_print.c
-@@ -140,8 +140,9 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
- 	switch (type) {
- 	case ns_t_a:
- 	  if (rdlen != (size_t)NS_INADDRSZ)
--			goto formerr;
--		(void) inet_ntop(AF_INET, rdata, buf, buflen);
-+		  goto formerr;
-+		if (inet_ntop (AF_INET, rdata, buf, buflen) == NULL)
-+		  return -1;
- 		addlen(strlen(buf), &buf, &buflen);
- 		break;
- 
-@@ -307,9 +308,10 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
- 	    }
- 
- 	case ns_t_aaaa:
--	  if (rdlen != (size_t)NS_IN6ADDRSZ)
--			goto formerr;
--		(void) inet_ntop(AF_INET6, rdata, buf, buflen);
-+		if (rdlen != (size_t)NS_IN6ADDRSZ)
-+		  goto formerr;
-+		if (inet_ntop (AF_INET6, rdata, buf, buflen) == NULL)
-+		  return -1;
- 		addlen(strlen(buf), &buf, &buflen);
- 		break;
- 
-@@ -400,7 +402,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
- 			goto formerr;
- 
- 		/* Address. */
--		(void) inet_ntop(AF_INET, rdata, buf, buflen);
-+		if (inet_ntop (AF_INET, rdata, buf, buflen) == NULL)
-+		  return -1;
- 		addlen(strlen(buf), &buf, &buflen);
- 		rdata += NS_INADDRSZ;
- 
-@@ -542,7 +545,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
- 			if (rdata + pbyte >= edata) goto formerr;
- 			memset(&a, 0, sizeof(a));
- 			memcpy(&a.s6_addr[pbyte], rdata, sizeof(a) - pbyte);
--			(void) inet_ntop(AF_INET6, &a, buf, buflen);
-+			if (inet_ntop (AF_INET6, &a, buf, buflen) == NULL)
-+			  return -1;
- 			addlen(strlen(buf), &buf, &buflen);
- 			rdata += sizeof(a) - pbyte;
- 		}
--- 
-2.54.0
-
diff --git a/pkgs/development/libraries/glibc/0002-resolv-More-types-as-unknown-in-ns_sprintrrf-CVE-202.patch b/pkgs/development/libraries/glibc/0002-resolv-More-types-as-unknown-in-ns_sprintrrf-CVE-202.patch
deleted file mode 100644
index 5b39165a43b0..000000000000
--- a/pkgs/development/libraries/glibc/0002-resolv-More-types-as-unknown-in-ns_sprintrrf-CVE-202.patch
+++ /dev/null
@@ -1,134 +0,0 @@
-From 103658e72f5aaeb36a5e405f9abaa1b687488fc1 Mon Sep 17 00:00:00 2001
-From: Florian Weimer <fweimer@redhat.com>
-Date: Fri, 19 Jun 2026 18:22:20 +0200
-Subject: [PATCH 2/3] resolv: More types as unknown in ns_sprintrrf
- (CVE-2026-5435)
-
-Specifically, CERT, TKEY, TSIG, OPT.  This removes the buggy
-implementations of TSIG, fixing bug 34033, and partially
-fixing bug 34069.
-
-Reviewed-by: Carlos O'Donell <carlos@redhat.com>
-Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
-(cherry picked from commit ca44a6609c29a683b03575fa035c6d17aa591e72)
----
- resolv/ns_print.c | 96 -----------------------------------------------
- 1 file changed, 96 deletions(-)
-
-diff --git a/resolv/ns_print.c b/resolv/ns_print.c
-index cb680fb74e..8c876b147e 100644
---- a/resolv/ns_print.c
-+++ b/resolv/ns_print.c
-@@ -437,96 +437,6 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
- 		break;
- 	    }
- 
--	case ns_t_cert: {
--		u_int c_type, key_tag, alg;
--		int n;
--		unsigned int siz;
--		char base64_cert[8192], tmp[40];
--		const char *leader;
--
--		c_type  = ns_get16(rdata); rdata += NS_INT16SZ;
--		key_tag = ns_get16(rdata); rdata += NS_INT16SZ;
--		alg = (u_int) *rdata++;
--
--		len = SPRINTF((tmp, "%d %d %d ", c_type, key_tag, alg));
--		T(addstr(tmp, len, &buf, &buflen));
--		siz = (edata-rdata)*4/3 + 4; /* "+4" accounts for trailing \0 */
--		if (siz > sizeof(base64_cert) * 3/4) {
--			const char *str = "record too long to print";
--			T(addstr(str, strlen(str), &buf, &buflen));
--		}
--		else {
--			len = b64_ntop(rdata, edata-rdata, base64_cert, siz);
--
--			if (len < 0)
--				goto formerr;
--			else if (len > 15) {
--				T(addstr(" (", 2, &buf, &buflen));
--				leader = "\n\t\t";
--				spaced = 0;
--			}
--			else
--				leader = " ";
--
--			for (n = 0; n < len; n += 48) {
--				T(addstr(leader, strlen(leader),
--					 &buf, &buflen));
--				T(addstr(base64_cert + n, MIN(len - n, 48),
--					 &buf, &buflen));
--			}
--			if (len > 15)
--				T(addstr(" )", 2, &buf, &buflen));
--		}
--		break;
--	    }
--
--	case ns_t_tkey: {
--		/* KJD - need to complete this */
--		u_long t;
--		int mode, err, keysize;
--
--		/* Algorithm name. */
--		T(addname(msg, msglen, &rdata, origin, &buf, &buflen));
--		T(addstr(" ", 1, &buf, &buflen));
--
--		/* Inception. */
--		t = ns_get32(rdata);  rdata += NS_INT32SZ;
--		len = SPRINTF((tmp, "%lu ", t));
--		T(addstr(tmp, len, &buf, &buflen));
--
--		/* Expiration. */
--		t = ns_get32(rdata);  rdata += NS_INT32SZ;
--		len = SPRINTF((tmp, "%lu ", t));
--		T(addstr(tmp, len, &buf, &buflen));
--
--		/* Mode , Error, Key Size. */
--		/* Priority, Weight, Port. */
--		mode = ns_get16(rdata);  rdata += NS_INT16SZ;
--		err  = ns_get16(rdata);  rdata += NS_INT16SZ;
--		keysize  = ns_get16(rdata);  rdata += NS_INT16SZ;
--		len = SPRINTF((tmp, "%u %u %u ", mode, err, keysize));
--		T(addstr(tmp, len, &buf, &buflen));
--
--		/* XXX need to dump key, print otherdata length & other data */
--		break;
--	    }
--
--	case ns_t_tsig: {
--		/* BEW - need to complete this */
--		int n;
--
--		T(len = addname(msg, msglen, &rdata, origin, &buf, &buflen));
--		T(addstr(" ", 1, &buf, &buflen));
--		rdata += 8; /*%< time */
--		n = ns_get16(rdata); rdata += INT16SZ;
--		rdata += n; /*%< sig */
--		n = ns_get16(rdata); rdata += INT16SZ; /*%< original id */
--		sprintf(buf, "%d", ns_get16(rdata));
--		rdata += INT16SZ;
--		addlen(strlen(buf), &buf, &buflen);
--		break;
--	    }
--
- 	case ns_t_a6: {
- 		struct in6_addr a;
- 		int pbyte, pbit;
-@@ -561,12 +471,6 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
- 		break;
- 	    }
- 
--	case ns_t_opt: {
--		len = SPRINTF((tmp, "%u bytes", class));
--		T(addstr(tmp, len, &buf, &buflen));
--		break;
--	    }
--
- 	default:
- 		snprintf (errbuf, sizeof (errbuf), "unknown RR type %d", type);
- 		comment = errbuf;
--- 
-2.54.0
-
diff --git a/pkgs/development/libraries/glibc/0003-resolv-Fix-buffer-overreads-in-ns_sprintrrf-CVE-2026.patch b/pkgs/development/libraries/glibc/0003-resolv-Fix-buffer-overreads-in-ns_sprintrrf-CVE-2026.patch
deleted file mode 100644
index 8bde49f159e0..000000000000
--- a/pkgs/development/libraries/glibc/0003-resolv-Fix-buffer-overreads-in-ns_sprintrrf-CVE-2026.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From 2290143edc27486196815874dca5a528c118a73f Mon Sep 17 00:00:00 2001
-From: Florian Weimer <fweimer@redhat.com>
-Date: Fri, 19 Jun 2026 18:22:20 +0200
-Subject: [PATCH 3/3] resolv: Fix buffer overreads in ns_sprintrrf
- (CVE-2026-6238)
-
-Check that the RDATA payload does not require more than RDATALEN
-bytes while processing it.  The fixes cover A6, LOC records.
-(CERT, TKEY, TSIG were fixed before, by switching to the generic
-formatter.)
-
-The vulnerable LOC record handling was first introduced before
-glibc 2.0, in commit ee188d555b8c32ad9704a7440cab400af967292f.
-
-CERT, TSIG, TKEY handling came with commit
-b43b13ac2544b11f35be301d1589b51a8473e32b, released with glibc 2.2.
-
-A6 record handling was introduced in commit
-91633816430e7ec5a19fe3ff510a7c4822a9557e ("* resolv/ns_print.c
-(ns_sprintrrf): Handle ns_t_a6 and ns_t_opt."), which went into glibc
-2.7.
-
-This fixes bug 34069.
-
-Reviewed-by: Carlos O'Donell <carlos@redhat.com>
-Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
-(cherry picked from commit a7b60d23bbb56eaef59f4962e4140062e552600a)
----
- resolv/ns_print.c | 10 ++++++----
- 1 file changed, 6 insertions(+), 4 deletions(-)
-
-diff --git a/resolv/ns_print.c b/resolv/ns_print.c
-index 8c876b147e..6832255a25 100644
---- a/resolv/ns_print.c
-+++ b/resolv/ns_print.c
-@@ -318,7 +318,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
- 	case ns_t_loc: {
- 		char t[255];
- 
--		/* XXX protocol format checking? */
-+		if (rdlen != 16)
-+		  goto formerr;
- 		(void) loc_ntoa(rdata, t);
- 		T(addstr(t, strlen(t), &buf, &buflen));
- 		break;
-@@ -452,13 +453,14 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
- 
- 		/* address suffix: provided only when prefix len != 128 */
- 		if (pbit < 128) {
--			if (rdata + pbyte >= edata) goto formerr;
-+			unsigned int bytelen = sizeof(a) - pbyte;
-+			if (edata - rdata < bytelen) goto formerr;
- 			memset(&a, 0, sizeof(a));
--			memcpy(&a.s6_addr[pbyte], rdata, sizeof(a) - pbyte);
-+			memcpy(&a.s6_addr[pbyte], rdata, bytelen);
- 			if (inet_ntop (AF_INET6, &a, buf, buflen) == NULL)
- 			  return -1;
- 			addlen(strlen(buf), &buf, &buflen);
--			rdata += sizeof(a) - pbyte;
-+			rdata += bytelen;
- 		}
- 
- 		/* prefix name: provided only when prefix len > 0 */
--- 
-2.54.0
-
diff --git a/pkgs/development/libraries/glibc/2.42-master.patch b/pkgs/development/libraries/glibc/2.42-master.patch
index a7bdf93961db..8abd567ee32b 100644
--- a/pkgs/development/libraries/glibc/2.42-master.patch
+++ b/pkgs/development/libraries/glibc/2.42-master.patch
@@ -7913,3 +7913,3262 @@ index 86ae5019a6..17b5565d0f 100644
  		    /* Enlarge the buffer.  */
  		    wstr = (wchar_t *) realloc (*strptr,
  						newsize * sizeof (wchar_t));
+
+commit b866ef29773b22a1343ff9084374775114350b78
+Author: Maciej W. Rozycki <macro@redhat.com>
+Date:   Wed May 27 12:57:10 2026 -0400
+
+    support: Implement 'xfmemopen' for seamless 'fmemopen' use
+    
+    Add 'xfmemopen' wrapper for seamless 'fmemopen' use in tests, following
+    'xfopen', 'xfclose', etc., and providing a standardized error reporting
+    facility.
+    
+    Reviewed-by: Florian Weimer <fweimer@redhat.com>
+    (cherry picked from commit fe709cc24578ecfd2ff5b07e10e3829fcb55075b)
+    
+    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+
+diff --git a/support/Makefile b/support/Makefile
+index d41278eeab..f67f38130a 100644
+--- a/support/Makefile
++++ b/support/Makefile
+@@ -134,6 +134,7 @@ libsupport-routines = \
+   xfclose \
+   xfdopendir \
+   xfgets \
++  xfmemopen \
+   xfopen \
+   xfork \
+   xfread \
+diff --git a/support/xfmemopen.c b/support/xfmemopen.c
+new file mode 100644
+index 0000000000..f1dbc72c67
+--- /dev/null
++++ b/support/xfmemopen.c
+@@ -0,0 +1,31 @@
++/* fmemopen with error checking.
++   Copyright (C) 2025 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <support/xstdio.h>
++
++#include <support/check.h>
++#include <stdlib.h>
++
++FILE *
++xfmemopen (void *mem, size_t len, const char *mode)
++{
++  FILE *fp = fmemopen (mem, len, mode);
++  if (fp == NULL)
++    FAIL_EXIT1 ("fmemopen (mode \"%s\"): %m", mode);
++  return fp;
++}
+diff --git a/support/xstdio.h b/support/xstdio.h
+index c3fdf9496f..70b83f11da 100644
+--- a/support/xstdio.h
++++ b/support/xstdio.h
+@@ -27,6 +27,7 @@ __BEGIN_DECLS
+ FILE *xfopen (const char *path, const char *mode);
+ void xfclose (FILE *);
+ FILE *xfreopen (const char *path, const char *mode, FILE *stream);
++FILE *xfmemopen (void *mem, size_t len, const char *mode);
+ void xfread (void *ptr, size_t size, size_t nmemb, FILE *stream);
+ char *xfgets (char *s, int size, FILE *stream);
+ 
+
+commit 97926e9017f3faeaacce9337f1288460f5e6ec7d
+Author: Maciej W. Rozycki <macro@redhat.com>
+Date:   Wed May 27 12:57:10 2026 -0400
+
+    stdio-common: Reject insufficient character data in scanf [BZ #12701]
+    
+    Reject invalid formatted scanf character data with the 'c' conversion
+    where there is not enough input available to satisfy the field width
+    requested.  It is required by ISO C that this conversion matches a
+    sequence of characters of exactly the number specified by the field
+    width and it is also already documented as such in our own manual:
+    
+    "It reads precisely the next N characters, and fails if it cannot get
+    that many."
+    
+    Currently a matching success is instead incorrectly produced where the
+    EOF condition is encountered before the required number of characters
+    has been retrieved, and the characters actually obtained are stored in
+    the buffer provided.
+    
+    Add test cases accordingly and remove placeholders from 'c' conversion
+    input data for the existing scanf tests.
+    
+    Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
+    
+    [This is a modified version of commit 2b16c76609, which tests for the
+    old behavior and only includes the test cases, for older branches
+    and downstream backports - DJ]
+    
+    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+
+diff --git a/localedata/Makefile b/localedata/Makefile
+index 4a23593cca..bff5c0bc71 100644
+--- a/localedata/Makefile
++++ b/localedata/Makefile
+@@ -236,6 +236,7 @@ tests = \
+   bug-iconv-trans \
+   bug-setlocale1 \
+   bug-usesetlocale \
++  tst-bz12701-lc \
+   tst-bz13988 \
+   tst-c-utf8-consistency \
+   tst-digits \
+diff --git a/localedata/tst-bz12701-lc.c b/localedata/tst-bz12701-lc.c
+new file mode 100644
+index 0000000000..23c2ab7d2a
+--- /dev/null
++++ b/localedata/tst-bz12701-lc.c
+@@ -0,0 +1,218 @@
++/* Verify scanf field width handling with the 'lc' conversion (BZ #12701).
++   Copyright (C) 2025-2026 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <locale.h>
++#include <stddef.h>
++#include <stdio.h>
++#include <string.h>
++#include <wchar.h>
++
++#include <libc-diag.h>
++#include <support/check.h>
++#include <support/next_to_fault.h>
++#include <support/xstdio.h>
++
++/* Compare character-wise the initial part of the wide character object
++   pointed to by WS corresponding to wide characters obtained by the
++   conversion of first N bytes of the multibyte character object pointed
++   to by S.  */
++
++static int
++tst_bz12701_lc_memcmp (const wchar_t *ds, const char *s, size_t n)
++{
++  size_t nc = mbsnrtowcs (NULL, &s, n, 0, NULL);
++
++  struct support_next_to_fault ntf;
++  ntf = support_next_to_fault_allocate (nc * sizeof (wchar_t));
++  wchar_t *ss = (wchar_t *) ntf.buffer;
++
++  mbsnrtowcs (ss, &s, n, nc, NULL);
++  int r = wmemcmp (ds, ss, nc);
++
++  support_next_to_fault_free (&ntf);
++
++  return r;
++}
++
++/* Verify various aspects of field width handling, including the data
++   obtained, the number of bytes consumed, and the stream position.  */
++
++static int
++do_test (void)
++{
++  if (setlocale (LC_ALL, "pl_PL.UTF-8") == NULL)
++    FAIL_EXIT1 ("setlocale (LC_ALL, \"pl_PL.UTF-8\")");
++
++  /* Part of a tongue-twister in Polish, which says:
++     "On a rainy morning cuckoos and warblers, rather than starting
++     on earthworms, stuffed themselves fasted with the flesh of cress."  */
++  static const char s[126] = "Dżdżystym rankiem gżegżółki i piegże, "
++			     "zamiast wziąć się za dżdżownice, "
++			     "nażarły się na czczo miąższu rzeżuchy";
++
++  const char *sp = s;
++  size_t nc;
++  TEST_VERIFY_EXIT ((nc = mbsnrtowcs (NULL, &sp, sizeof (s), 0, NULL)) == 108);
++
++  struct support_next_to_fault ntfo, ntfi;
++  ntfo = support_next_to_fault_allocate (nc * sizeof (wchar_t));
++  ntfi = support_next_to_fault_allocate (sizeof (s));
++  wchar_t *e = (wchar_t *) ntfo.buffer + nc;
++  char *b = ntfi.buffer;
++
++  wchar_t *c;
++  FILE *f;
++  int ic;
++  int n;
++  int i;
++
++  memcpy (ntfi.buffer, s, sizeof (s));
++
++  ic = i = 0;
++  f = xfmemopen (b, sizeof (s), "r");
++
++  c = e - 1;
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  /* Avoid: "warning: zero width in gnu_scanf format [-Werror=format=]".  */
++  DIAG_PUSH_NEEDS_COMMENT;
++  DIAG_IGNORE_NEEDS_COMMENT (4.9, "-Wformat");
++  TEST_VERIFY_EXIT (fscanf (f, "%0lc%n", c, &n) == 1);
++  DIAG_POP_NEEDS_COMMENT;
++  TEST_VERIFY_EXIT (n == 1);
++  TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, n) == 0);
++  ic += 1;
++  i += n;
++
++  c = e - 1;
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%lc%n", c, &n) == 1);
++  TEST_VERIFY_EXIT (n == 2);
++  TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, n) == 0);
++  ic += 1;
++  i += n;
++
++  c = e - 1;
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%1lc%n", c, &n) == 1);
++  TEST_VERIFY_EXIT (n == 1);
++  TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, n) == 0);
++  ic += 1;
++  i += n;
++
++  c = e - 2;
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%2lc%n", c, &n) == 1);
++  TEST_VERIFY_EXIT (n == 3);
++  TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, n) == 0);
++  ic += 2;
++  i += n;
++
++  c = e - 4;
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%4lc%n", c, &n) == 1);
++  TEST_VERIFY_EXIT (n == 4);
++  TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, n) == 0);
++  ic += 4;
++  i += n;
++
++  c = e - 8;
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%8lc%n", c, &n) == 1);
++  TEST_VERIFY_EXIT (n == 8);
++  TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, n) == 0);
++  ic += 8;
++  i += n;
++
++  c = e - 16;
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%16lc%n", c, &n) == 1);
++  TEST_VERIFY_EXIT (n == 20);
++  TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, n) == 0);
++  ic += 16;
++  i += n;
++
++  c = e - 32;
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%32lc%n", c, &n) == 1);
++  TEST_VERIFY_EXIT (n == 38);
++  TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, n) == 0);
++  ic += 32;
++  i += n;
++
++  c = e - (nc - ic);
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_COMPARE (fscanf (f, "%64lc%n", c, &n), 1);
++  TEST_COMPARE (n , 49);
++  TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, sizeof (s) - i) == 0);
++
++  TEST_VERIFY_EXIT (ftell (f) == sizeof (s));
++  TEST_VERIFY_EXIT (feof (f) != 0);
++
++  xfclose (f);
++
++  ic = i = 0;
++  f = xfmemopen (b, 3, "r");
++
++  c = e - 2;
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%2lc%n", c, &n) == 1);
++  TEST_VERIFY_EXIT (n == 3);
++  TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, n) == 0);
++  ic += 2;
++  i += n;
++
++  c = e - (nc - ic);
++  TEST_VERIFY_EXIT (feof (f) == 0);
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%2lc%n", c, &n) == EOF);
++  TEST_VERIFY_EXIT (n == 3);
++
++  TEST_VERIFY_EXIT (ftell (f) == 3);
++  TEST_VERIFY_EXIT (feof (f) != 0);
++
++  xfclose (f);
++
++  ic = i = 0;
++  f = xfmemopen (b, 3, "r");
++
++  c = e - 1;
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%lc%n", c, &n) == 1);
++  TEST_VERIFY_EXIT (n == 1);
++  TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, n) == 0);
++  ic += 1;
++  i += n;
++
++  c = e - (nc - ic);
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%2lc%n", c, &n) == 1);
++  TEST_VERIFY_EXIT (n == 2);
++  TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, 3 - i) == 0);
++
++  TEST_VERIFY_EXIT (ftell (f) == 3);
++  TEST_VERIFY_EXIT (feof (f) != 0);
++
++  xfclose (f);
++
++  support_next_to_fault_free (&ntfi);
++  support_next_to_fault_free (&ntfo);
++
++  return 0;
++}
++
++#include <support/test-driver.c>
+diff --git a/stdio-common/Makefile b/stdio-common/Makefile
+index e52c333808..fdb545242e 100644
+--- a/stdio-common/Makefile
++++ b/stdio-common/Makefile
+@@ -260,6 +260,7 @@ tests := \
+   tllformat \
+   tst-bz11319 \
+   tst-bz11319-fortify2 \
++  tst-bz12701-c \
+   tst-cookie \
+   tst-dprintf-length \
+   tst-fclose-devzero \
+diff --git a/stdio-common/tst-bz12701-c.c b/stdio-common/tst-bz12701-c.c
+new file mode 100644
+index 0000000000..4f3616fbfd
+--- /dev/null
++++ b/stdio-common/tst-bz12701-c.c
+@@ -0,0 +1,169 @@
++/* Verify scanf field width handling with the 'c' conversion (BZ #12701).
++   Copyright (C) 2025-2026 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <stdio.h>
++#include <string.h>
++
++#include <libc-diag.h>
++#include <support/check.h>
++#include <support/next_to_fault.h>
++#include <support/xstdio.h>
++
++/* Verify various aspects of field width handling, including the data
++   obtained, the number of bytes consumed, and the stream position.  */
++
++static int
++do_test (void)
++{
++  static const char s[43] = "The quick brown fox jumps over the lazy dog";
++  struct support_next_to_fault ntfo, ntfi;
++  ntfo = support_next_to_fault_allocate (sizeof (s));
++  ntfi = support_next_to_fault_allocate (sizeof (s));
++  char *e = ntfo.buffer + sizeof (s);
++  char *b = ntfi.buffer;
++
++  char *c;
++  FILE *f;
++  int n;
++  int i;
++
++  memcpy (ntfi.buffer, s, sizeof (s));
++
++  i = 0;
++  f = xfmemopen (b, sizeof (s), "r");
++
++  c = e - 1;
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  /* Avoid: "warning: zero width in gnu_scanf format [-Werror=format=]".  */
++  DIAG_PUSH_NEEDS_COMMENT;
++  DIAG_IGNORE_NEEDS_COMMENT (4.9, "-Wformat");
++  TEST_VERIFY_EXIT (fscanf (f, "%0c%n", c, &n) == 1);
++  DIAG_POP_NEEDS_COMMENT;
++  TEST_VERIFY_EXIT (n == 1);
++  TEST_VERIFY_EXIT (memcmp (c, s + i, n) == 0);
++  i += n;
++
++  c = e - 1;
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%c%n", c, &n) == 1);
++  TEST_VERIFY_EXIT (n == 1);
++  TEST_VERIFY_EXIT (memcmp (c, s + i, n) == 0);
++  i += n;
++
++  c = e - 1;
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%1c%n", c, &n) == 1);
++  TEST_VERIFY_EXIT (n == 1);
++  TEST_VERIFY_EXIT (memcmp (c, s + i, n) == 0);
++  i += n;
++
++  c = e - 2;
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%2c%n", c, &n) == 1);
++  TEST_VERIFY_EXIT (n == 2);
++  TEST_VERIFY_EXIT (memcmp (c, s + i, n) == 0);
++  i += n;
++
++  c = e - 4;
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%4c%n", c, &n) == 1);
++  TEST_VERIFY_EXIT (n == 4);
++  TEST_VERIFY_EXIT (memcmp (c, s + i, n) == 0);
++  i += n;
++
++  c = e - 8;
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%8c%n", c, &n) == 1);
++  TEST_VERIFY_EXIT (n == 8);
++  TEST_VERIFY_EXIT (memcmp (c, s + i, n) == 0);
++  i += n;
++
++  c = e - 16;
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%16c%n", c, &n) == 1);
++  TEST_VERIFY_EXIT (n == 16);
++  TEST_VERIFY_EXIT (memcmp (c, s + i, n) == 0);
++  i += n;
++
++  c = e - (sizeof (s) - i);
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%32c%n", c, &n) == 1);
++  TEST_VERIFY_EXIT (n == 10);
++  TEST_VERIFY_EXIT (memcmp (c, s + i, sizeof (s) - i) == 0);
++
++  TEST_VERIFY_EXIT (ftell (f) == sizeof (s));
++  TEST_VERIFY_EXIT (feof (f) != 0);
++
++  xfclose (f);
++
++  i = 0;
++  f = xfmemopen (b, 3, "r");
++
++  c = e - 1;
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%c%n", c, &n) == 1);
++  TEST_VERIFY_EXIT (n == 1);
++  TEST_VERIFY_EXIT (memcmp (c, s + i, n) == 0);
++  i += n;
++
++  c = e - 2;
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%2c%n", c, &n) == 1);
++  TEST_VERIFY_EXIT (n == 2);
++  TEST_VERIFY_EXIT (memcmp (c, s + i, n) == 0);
++  i += n;
++
++  c = e - (3 - i);
++  TEST_VERIFY_EXIT (feof (f) == 0);
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%2c%n", c, &n) == EOF);
++  TEST_VERIFY_EXIT (n == 2);
++
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (feof (f) != 0);
++
++  xfclose (f);
++
++  i = 0;
++  f = xfmemopen (b, 3, "r");
++
++  c = e - 2;
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%2c%n", c, &n) == 1);
++  TEST_VERIFY_EXIT (n == 2);
++  TEST_VERIFY_EXIT (memcmp (c, s + i, n) == 0);
++  i += n;
++
++  c = e - (3 - i);
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%2c%n", c, &n) == 1);
++  TEST_VERIFY_EXIT (n == 1);
++  TEST_VERIFY_EXIT (memcmp (c, s + i, 3 - i) == 0);
++
++  TEST_VERIFY_EXIT (ftell (f) == 3);
++  TEST_VERIFY_EXIT (feof (f) != 0);
++
++  xfclose (f);
++
++  support_next_to_fault_free (&ntfi);
++  support_next_to_fault_free (&ntfo);
++
++  return 0;
++}
++
++#include <support/test-driver.c>
+
+commit 6cebb0b80fd783e442a8ad27c3f52cde52a9cac7
+Author: DJ Delorie <dj@redhat.com>
+Date:   Wed May 27 12:57:10 2026 -0400
+
+    stdio-common: Allow partially-filled %mc buffers [BZ #12701]
+    
+    This is a backwards-compatible alternative to the main solution to
+    the %mc part of 12701.  The allocated buffer is expanded to the
+    requested size and NUL padded, but truncated reads are allowed.
+    
+    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+
+diff --git a/localedata/Makefile b/localedata/Makefile
+index bff5c0bc71..e212facef0 100644
+--- a/localedata/Makefile
++++ b/localedata/Makefile
+@@ -237,6 +237,7 @@ tests = \
+   bug-setlocale1 \
+   bug-usesetlocale \
+   tst-bz12701-lc \
++  tst-bz12701-lc2 \
+   tst-bz13988 \
+   tst-c-utf8-consistency \
+   tst-digits \
+diff --git a/localedata/tst-bz12701-lc2.c b/localedata/tst-bz12701-lc2.c
+new file mode 100644
+index 0000000000..b24e86df0b
+--- /dev/null
++++ b/localedata/tst-bz12701-lc2.c
+@@ -0,0 +1,47 @@
++/* Verify scanf memory handling with the 'c' conversion (BZ #12701).
++   Copyright (C) 2026 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <stdio.h>
++#include <malloc.h>
++#include <string.h>
++
++#include <libc-diag.h>
++#include <support/check.h>
++#include <support/next_to_fault.h>
++#include <support/xstdio.h>
++
++static int
++do_test (void)
++{
++  wchar_t *c = NULL;
++  int i;
++
++  TEST_VERIFY (sscanf ("1234", "%30mlc", &c) == 1);
++
++  TEST_VERIFY (c != NULL);
++  TEST_COMPARE_BLOB (c, 5 * sizeof (wchar_t),
++		     L"1234\0", 5 * sizeof (wchar_t));
++  for (i = 5; i < 30; i ++)
++    TEST_VERIFY (c[i] == L'\0');
++
++  TEST_VERIFY (malloc_usable_size (c) >= 30 * sizeof(wchar_t));
++
++  return 0;
++}
++
++#include <support/test-driver.c>
+diff --git a/stdio-common/Makefile b/stdio-common/Makefile
+index fdb545242e..27e7ea20f0 100644
+--- a/stdio-common/Makefile
++++ b/stdio-common/Makefile
+@@ -261,6 +261,7 @@ tests := \
+   tst-bz11319 \
+   tst-bz11319-fortify2 \
+   tst-bz12701-c \
++  tst-bz12701-c2 \
+   tst-cookie \
+   tst-dprintf-length \
+   tst-fclose-devzero \
+diff --git a/stdio-common/tst-bz12701-c2.c b/stdio-common/tst-bz12701-c2.c
+new file mode 100644
+index 0000000000..5f9ca7c592
+--- /dev/null
++++ b/stdio-common/tst-bz12701-c2.c
+@@ -0,0 +1,46 @@
++/* Verify scanf memory handling with the 'c' conversion (BZ #12701).
++   Copyright (C) 2026 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <stdio.h>
++#include <malloc.h>
++#include <string.h>
++
++#include <libc-diag.h>
++#include <support/check.h>
++#include <support/next_to_fault.h>
++#include <support/xstdio.h>
++
++static int
++do_test (void)
++{
++  char *c = NULL;
++  int i;
++
++  TEST_VERIFY (sscanf ("1234", "%30mc", &c) == 1);
++
++  TEST_VERIFY (c != NULL);
++  TEST_COMPARE_BLOB (c, 5, "1234\0", 5);
++  for (i = 5; i < 30; i ++)
++    TEST_VERIFY (c[i] == '\0');
++
++  TEST_VERIFY (malloc_usable_size (c) >= 30);
++
++  return 0;
++}
++
++#include <support/test-driver.c>
+diff --git a/stdio-common/vfscanf-internal.c b/stdio-common/vfscanf-internal.c
+index 17b5565d0f..90a1886951 100644
+--- a/stdio-common/vfscanf-internal.c
++++ b/stdio-common/vfscanf-internal.c
+@@ -780,9 +780,9 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
+ 		    conv_error ();					      \
+ 		} while (0)
+ #ifdef COMPILE_WSCANF
+-	      STRING_ARG (str, char, 100);
++	      STRING_ARG (str, char, (width > 0 ? width : 1));
+ #else
+-	      STRING_ARG (str, char, (width > 1024 ? 1024 : width));
++	      STRING_ARG (str, char, (width > 0 ? width : 1));
+ #endif
+ 
+ 	      c = inchar ();
+@@ -891,6 +891,11 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
+ 
+ 	      if (!(flags & SUPPRESS))
+ 		{
++		  /* If the buffer isn't completely filled, pad it with NULs.  */
++		  if (flags & MALLOC)
++		    while (width-- > 0)
++		      *str++ = '\0';
++
+ 		  if ((flags & MALLOC) && str - *strptr != strsize)
+ 		    {
+ 		      char *cp = (char *) realloc (*strptr, str - *strptr);
+@@ -908,7 +913,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
+ 	  if (width == -1)
+ 	    width = 1;
+ 
+-	  STRING_ARG (wstr, wchar_t, (width > 1024 ? 1024 : width));
++	  STRING_ARG (wstr, wchar_t, (width > 0 ? width : 1));
+ 
+ 	  c = inchar ();
+ 	  if (__glibc_unlikely (c == EOF))
+@@ -1044,6 +1049,11 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
+ 
+ 	  if (!(flags & SUPPRESS))
+ 	    {
++	      /* If the buffer isn't completely filled, pad it with NULs.  */
++	      if (flags & MALLOC)
++		while (width-- > 0)
++		  *wstr++ = L'\0';
++
+ 	      if ((flags & MALLOC) && wstr - (wchar_t *) *strptr != strsize)
+ 		{
+ 		  wchar_t *cp = (wchar_t *) realloc (*strptr,
+
+commit 748699d9385fc298f7d3369af0a015a6d88b7e64
+Author: Sam James <sam@gentoo.org>
+Date:   Sat Jun 6 20:32:27 2026 +0100
+
+    elf: don't clobber ld.so.conf in tst-glibc-hwcaps-prepend-cache [BZ #34210]
+    
+    dbe5065f2166be20e57a24f246a40d50e001a05d and ae589cb84df10825fc545a45c7007a5f79409bf1
+    cater for setups where ld.so.conf{,.d} is required to find runtime support
+    libraries, but tst-glibc-hwcaps-prepend-cache clobbers the created ld.so.conf
+    with its own entry.
+    
+    Fix it to instead use the ld.so.conf.d created in ae589cb84df10825fc545a45c7007a5f79409bf1
+    to co-exist with existing entries.
+    
+    Bug: https://bugs.gentoo.org/976773
+    Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=31901
+    Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=34210
+    Tested-by: Andreas K. Hüttel <dilfridge@gentoo.org>
+    Reported-by: Eli Schwartz <eschwartz@gentoo.org>
+    Reviewed-by: Andreas K. Hüttel <dilfridge@gentoo.org>
+    (cherry picked from commit d0cc9bf859d0434e397530d75a6507f13db79fba)
+
+diff --git a/elf/tst-glibc-hwcaps-prepend-cache.c b/elf/tst-glibc-hwcaps-prepend-cache.c
+index b7df3962b5..2d51c22328 100644
+--- a/elf/tst-glibc-hwcaps-prepend-cache.c
++++ b/elf/tst-glibc-hwcaps-prepend-cache.c
+@@ -46,7 +46,7 @@ do_test (void)
+ 
+   {
+     /* Install the default implementation of libmarkermod1.so.  */
+-    char *conf_path = xasprintf ("%s/ld.so.conf", support_sysconfdir_prefix);
++    char *conf_path = xasprintf ("%s/ld.so.conf.d/hwcaps.conf", support_sysconfdir_prefix);
+     xmkdirp (support_sysconfdir_prefix, 0777);
+     support_write_file_string (conf_path, "/glibc-test/lib\n");
+     free (conf_path);
+
+commit f671746f6c3ae511432b5666953be668267159f8
+Author: Florian Weimer <fweimer@redhat.com>
+Date:   Tue Jun 9 07:28:02 2026 +0200
+
+    iconv: Suppress intermediate errors with //TRANSLIT (bug 34236)
+    
+    When tentatively converting characters on behalf of
+    __gconv_transliterate, do not create a persistent error.  Just
+    produce a local error, and rely on __gconv_transliterate to
+    produce the error if all transliteration options are exhausted.
+    
+    This fixes transliteration of “½” to ASCII, which cannot use the
+    “ 1⁄2 ” alternative.  Eventually, the “ 1/2 ” alternative is chosen,
+    but the error sticks.  Therefore, iconv exited with status 1 before
+    this change.
+    
+    Adjust iconv/tst-iconv_prog.sh to test both C and en_US.UTF-8 locales.
+    This requires changing the way the ICONV template is defined, so that
+    run_program_env is evaluated multiple times.
+    
+    Fixes commit 9a4b0eaf726f5404c6683d5c7c5e86f61c3f3fbc ("iconv: do not
+    report error exit with transliteration [BZ #32448]"),
+    commit 6cbf845fcdc76131d0e674cee454fe738b69c69d ("iconv: Preserve
+    iconv -c error exit on invalid inputs (bug 32046)"), and bug 34236.
+    
+    Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
+    (cherry picked from commit e9325bd7d04aacc45cf39505e279b1ca9de22c08)
+
+diff --git a/iconv/Makefile b/iconv/Makefile
+index 9a94a41ba4..028d24ffc3 100644
+--- a/iconv/Makefile
++++ b/iconv/Makefile
+@@ -138,7 +138,8 @@ $(objpfx)test-iconvconfig.out: $(objpfx)iconvconfig
+ 	 rm -f $$tmp) > $@; \
+ 	$(evaluate-test)
+ 
+-$(objpfx)tst-iconv_prog.out: tst-iconv_prog.sh $(objpfx)iconv_prog
++$(objpfx)tst-iconv_prog.out: tst-iconv_prog.sh $(objpfx)iconv_prog \
++  $(gen-locales)
+ 	$(BASH) $< $(common-objdir) '$(test-wrapper-env)' \
+ 		 '$(run-program-env)' > $@; \
+ 	$(evaluate-test)
+diff --git a/iconv/loop.c b/iconv/loop.c
+index 1378d23147..74b2a3e26d 100644
+--- a/iconv/loop.c
++++ b/iconv/loop.c
+@@ -144,8 +144,10 @@
+     if (irreversible == NULL)						      \
+       {									      \
+ 	/* This means we are in call from __gconv_transliterate.  In this     \
+-	   case we are not doing any error recovery ourselves.  */	      \
+-	result = __gconv_mark_illegal_input (step_data);		      \
++	   case we are not doing any error recovery ourselves.  Do not create \
++	   a persistent error state.  If __gconv_transliterate exhausts all   \
++	   alternatives, it will call __gconv_mark_illegal_input itself.  */  \
++	result = __GCONV_ILLEGAL_INPUT;					      \
+ 	break;								      \
+       }									      \
+ 									      \
+diff --git a/iconv/tst-iconv_prog.sh b/iconv/tst-iconv_prog.sh
+index e2a43280d2..7d7948b7aa 100644
+--- a/iconv/tst-iconv_prog.sh
++++ b/iconv/tst-iconv_prog.sh
+@@ -27,10 +27,10 @@ LIBPATH=$codir:$codir/iconvdata
+ 
+ # How the start the iconv(1) program.  $from is not defined/expanded yet.
+ ICONV='
++$test_wrapper_env $run_program_env
+ $codir/elf/ld.so --library-path $LIBPATH --inhibit-rpath ${from}.so
+ $codir/iconv/iconv_prog
+ '
+-ICONV="$test_wrapper_env $run_program_env $ICONV"
+ 
+ TIMEOUTFACTOR=${TIMEOUTFACTOR:-1}
+ 
+@@ -218,6 +218,7 @@ testarray=(
+ "\x00\x00;;INVALID;UTF-8;1"
+ "\x00\x00;;UTF-8;INVALID;1"
+ "\xc3\xa9;;UTF-8;ASCII//TRANSLIT;0"
++"X\xc2\xbdY;;UTF-8;ASCII//TRANSLIT;0"
+ )
+ 
+ # Requires $twobyte input, $c flag, $from, and $to to be set; sets $ret
+@@ -278,12 +279,21 @@ check_errtest_result ()
+   fi
+ }
+ 
+-for testcommand in "${testarray[@]}"; do
+-  twobyte="$(echo "$testcommand" | cut -d";" -f 1)"
+-  c="$(echo "$testcommand" | cut -d";" -f 2)"
+-  from="$(echo "$testcommand" | cut -d";" -f 3)"
+-  to="$(echo "$testcommand" | cut -d";" -f 4)"
+-  eret="$(echo "$testcommand" | cut -d";" -f 5)"
+-  execute_test
+-  check_errtest_result
+-done
++run_test_array ()
++{
++  for testcommand in "${testarray[@]}"; do
++    twobyte="$(echo "$testcommand" | cut -d";" -f 1)"
++    c="$(echo "$testcommand" | cut -d";" -f 2)"
++    from="$(echo "$testcommand" | cut -d";" -f 3)"
++    to="$(echo "$testcommand" | cut -d";" -f 4)"
++    eret="$(echo "$testcommand" | cut -d";" -f 5)"
++    execute_test
++    check_errtest_result
++  done
++}
++
++echo "info: testing C locale"
++run_test_array
++echo "info: testing en_US.UTF-8 locale"
++run_program_env="$run_program_env LC_ALL=en_US.UTF-8"
++run_test_array
+
+commit f6713070c6accac5c93d96c1d580833afacde3f5
+Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
+Date:   Wed May 13 08:32:24 2026 -0300
+
+    arm: Save/restore VFP registers in PLT trampolines (BZ 34144, BZ 15792)
+    
+    _dl_runtime_resolve and _dl_runtime_profile only preserved the integer
+    argument registers (r0-r3) across the inner call to _dl_fixup /
+    _dl_profile_fixup.  Two related ABI requirements demand more:
+    
+      * Under AAPCS-VFP, d0-d7 hold the caller's double arguments to the
+        function being resolved.  Recent GCC emits VFP instructions inside
+        the fixup routines, clobbering them, so the resolved function sees
+        corrupted arguments (BZ 34144).
+    
+      * Per RTABI32, the __aeabi_mem* helpers (and similar runtime helpers
+        reachable through the dynamic linker) must only corrupt integer
+        core registers.  IFUNC resolvers, audit modules, and interposed
+        malloc invoked during symbol resolution may also use VFP, even on
+        softfp ABI builds (BZ 15792).
+    
+    Save all call-clobbered VFP state -- d0-d15 unconditionally, d16-d31
+    when HWCAP_ARM_VFPD32 is set, and fpscr -- around the inner fixup
+    call.  Whether VFP is usable is a property of the hardware, not of
+    the ABI glibc was built with, so the decision is gated on AT_HWCAP at
+    runtime in both hardfp and softfp builds; hardfp builds will always
+    find HWCAP_ARM_VFP set, while softfp builds running on a non-VFP CPU
+    correctly skip the save.
+    
+    For _dl_runtime_profile the save area is slipped in just before the
+    bl to _dl_profile_fixup; the outgoing framesizep argument is
+    recomputed to account for the extra frame, and both the fast path
+    (no audit framesize) and the slow path (audit wraps with
+    pltenter/pltexit) traverse the restore before splitting.
+    
+    Checked on arm-linux-gnueabihf.
+    
+    Tested-by: Aurelien Jarno <aurelien@aurel32.net>
+    Reviewed-by: Wilco Dijkstra  <Wilco.Dijkstra@arm.com>
+    (cherry picked from commit 1111fbdd3e7ebed402800bc23e67055eaae0d972)
+
+diff --git a/sysdeps/arm/Makefile b/sysdeps/arm/Makefile
+index 9c4fd6b236..be9e46aeeb 100644
+--- a/sysdeps/arm/Makefile
++++ b/sysdeps/arm/Makefile
+@@ -30,6 +30,25 @@ $(objpfx)tst-armtlsdescloc: $(objpfx)tst-armtlsdesclocmod.so
+ $(objpfx)tst-armtlsdescextnow: $(objpfx)tst-armtlsdescextnowmod.so
+ $(objpfx)tst-armtlsdescextlazy: $(objpfx)tst-armtlsdescextlazymod.so
+ endif
++
++tests += \
++  tst-bz34144 \
++  tst-bz34144-audit \
++  # tests
++modules-names += \
++  tst-bz34144-auditmod \
++  tst-bz34144-mod \
++  # modules-names
++$(objpfx)tst-bz34144: $(objpfx)tst-bz34144-mod.so
++$(objpfx)tst-bz34144-audit: $(objpfx)tst-bz34144-mod.so
++$(objpfx)tst-bz34144-audit.out: $(objpfx)tst-bz34144-auditmod.so
++# Use lazy binding to check if _dl_runtime_resolve correctly save/restore
++# the VFP state.
++LDFLAGS-tst-bz34144 = -Wl,-z,lazy
++# With LD_AUDIT, lazy resolution goes through _dl_runtime_profile, which
++# must also save/restore VFP state (BZ 34144).
++LDFLAGS-tst-bz34144-audit = -Wl,-z,lazy
++tst-bz34144-audit-ENV = LD_AUDIT=$(objpfx)tst-bz34144-auditmod.so
+ endif
+ endif
+ 
+diff --git a/sysdeps/arm/dl-trampoline.S b/sysdeps/arm/dl-trampoline.S
+index fffac55050..ef358d48bc 100644
+--- a/sysdeps/arm/dl-trampoline.S
++++ b/sysdeps/arm/dl-trampoline.S
+@@ -20,6 +20,7 @@
+ #define NO_THUMB
+ #include <sysdep.h>
+ #include <libc-symbols.h>
++#include <rtld-global-offsets.h>
+ 
+ 	.text
+ 	.globl _dl_runtime_resolve
+@@ -36,13 +37,40 @@ _dl_runtime_resolve:
+ 	@	ip contains &GOT[n+3] (pointer to function)
+ 	@	lr points to &GOT[2]
+ 
+-	@ Save arguments.  We save r4 to realign the stack.
++	@ Save arguments.  We save r4 to realign the stack and to hold
++	@ the hwcap value used to decide whether to save VFP registers.
+ 	push	{r0-r4}
+ 	cfi_adjust_cfa_offset (20)
+ 	cfi_rel_offset (r0, 0)
+ 	cfi_rel_offset (r1, 4)
+ 	cfi_rel_offset (r2, 8)
+ 	cfi_rel_offset (r3, 12)
++	cfi_rel_offset (r4, 16)
++
++#ifdef SHARED
++	@ Preserve all call-clobbered VFP registers across _dl_fixup.
++	@ VFP may be used by IFUNC resolvers, audit modules, interposed
++	@ malloc, and the __aeabi_mem* helpers required by RTABI32,
++	@ which mandates that those helpers only corrupt integer core
++	@ registers.
++	LDR_GLOBAL (r4, r3, C_SYMBOL_NAME(_rtld_global_ro), \
++		    RTLD_GLOBAL_RO_DL_HWCAP_OFFSET)
++
++	tst	r4, #HWCAP_ARM_VFP
++	beq	.Lno_vfp_save
++
++# define VFP_STACK_REQ (32*8 + 8)
++	sub	sp, sp, VFP_STACK_REQ
++	cfi_adjust_cfa_offset (VFP_STACK_REQ)
++	mov	r3, sp
++	.inst	0xeca30b20	@ vstmia r3!, {d0-d15}
++	tst	r4, #HWCAP_ARM_VFPD32
++	beq	1f
++	.inst	0xece30b20	@ vstmia r3!, {d16-d31}
++1:	.inst	0xeef12a10	@ vmrs r2, fpscr
++	str	r2, [r3]
++.Lno_vfp_save:
++#endif /* SHARED */
+ 
+ 	@ get pointer to linker struct
+ 	ldr	r0, [lr, #-4]
+@@ -59,8 +87,23 @@ _dl_runtime_resolve:
+ 	@ save the return
+ 	mov	ip, r0
+ 
+-	@ get arguments and return address back.  We restore r4
+-	@ only to realign the stack.
++#ifdef SHARED
++	tst	r4, #HWCAP_ARM_VFP
++	beq	.Lno_vfp_restore
++	mov	r3, sp
++	.inst	0xecb30b20	@ vldmia r3!, {d0-d15}
++	tst	r4, #HWCAP_ARM_VFPD32
++	beq	2f
++	.inst	0xecf30b20	@ vldmia r3!, {d16-d31}
++2:	ldr	r2, [r3]
++	.inst	0xeee12a10	@ vmsr fpscr, r2
++	add	sp, sp, VFP_STACK_REQ
++	cfi_adjust_cfa_offset (-VFP_STACK_REQ)
++.Lno_vfp_restore:
++#endif /* SHARED */
++
++	@ get arguments and return address back.  We restore r4 to
++	@ its original value as well.
+ 	pop	{r0-r4,lr}
+ 	cfi_adjust_cfa_offset (-24)
+ 
+@@ -124,14 +167,71 @@ _dl_runtime_profile:
+ 	add	r3, sp, #8
+ 	stmia	r3!, {r0,r1}
+ 
++	@ Preserve all call-clobbered VFP registers across
++	@ _dl_profile_fixup.  See the matching comment in
++	@ _dl_runtime_resolve above for the rationale (BZ 34144,
++	@ BZ 15792).
++	@
++	@ Stack layout below the current sp (which becomes the new sp
++	@ after the sub):
++	@   sp +  0 ..   3: outgoing arg (framesizep) for _dl_profile_fixup
++	@   sp +  4 ..   7: saved hwcap (so we can test it after the call)
++	@   sp +  8 ..  11: saved r2 (used as scratch for LDR_GLOBAL)
++	@   sp + 12 ..  15: padding (for 8-byte alignment of the VFP area)
++	@   sp + 16 .. 16+VFP_STACK_REQ-1: VFP regs + fpscr
++#define VFP_PROFILE_STACK (16 + VFP_STACK_REQ)
++	sub	sp, sp, #VFP_PROFILE_STACK
++	cfi_adjust_cfa_offset (VFP_PROFILE_STACK)
++
++	@ r2 holds the retaddr (3rd arg to _dl_profile_fixup); spill
++	@ it so we can use it as the LDR_GLOBAL destination.
++	str	r2, [sp, #8]
++
++	LDR_GLOBAL (r2, ip, C_SYMBOL_NAME(_rtld_global_ro), \
++		    RTLD_GLOBAL_RO_DL_HWCAP_OFFSET)
++	str	r2, [sp, #4]
++
++	tst	r2, #HWCAP_ARM_VFP
++	beq	.Lprofile_no_vfp_save
++	add	ip, sp, #16
++	.inst	0xecac0b20	@ vstmia ip!, {d0-d15}
++	tst	r2, #HWCAP_ARM_VFPD32
++	beq	7f
++	.inst	0xecec0b20	@ vstmia ip!, {d16-d31}
++7:	.inst	0xeef12a10	@ vmrs r2, fpscr
++	str	r2, [ip]
++.Lprofile_no_vfp_save:
++
++	@ Restore r2 (retaddr) for _dl_profile_fixup.
++	ldr	r2, [sp, #8]
++
+ 	@ Set up extra args for _dl_profile_fixup.
+-	@ r2 and r3 are already loaded.
+-	add	ip, sp, #208
++	@ The framesize slot is at the old sp+208, which is the new
++	@ sp + VFP_PROFILE_STACK + 208 -- compute in two steps because
++	@ the combined offset is not encodable as an ARM immediate.
++	add	ip, sp, #VFP_PROFILE_STACK
++	add	ip, ip, #208
+ 	str	ip, [sp, #0]
+ 
+ 	@ call profiling fixup routine
+ 	bl	_dl_profile_fixup
+ 
++	@ Restore VFP registers.  r0 holds the resolved function
++	@ address; r1/r2/ip are caller-saved by the call.
++	ldr	r1, [sp, #4]
++	tst	r1, #HWCAP_ARM_VFP
++	beq	.Lprofile_no_vfp_restore
++	add	ip, sp, #16
++	.inst	0xecbc0b20	@ vldmia ip!, {d0-d15}
++	tst	r1, #HWCAP_ARM_VFPD32
++	beq	8f
++	.inst	0xecfc0b20	@ vldmia ip!, {d16-d31}
++8:	ldr	r2, [ip]
++	.inst	0xeee12a10	@ vmsr fpscr, r2
++.Lprofile_no_vfp_restore:
++	add	sp, sp, #VFP_PROFILE_STACK
++	cfi_adjust_cfa_offset (-VFP_PROFILE_STACK)
++
+ 	@ The address to call is now in r0.
+ 
+ 	@ Check whether we're wrapping this function.
+diff --git a/sysdeps/arm/tst-bz34144-audit.c b/sysdeps/arm/tst-bz34144-audit.c
+new file mode 100644
+index 0000000000..8f1084fa0a
+--- /dev/null
++++ b/sysdeps/arm/tst-bz34144-audit.c
+@@ -0,0 +1,32 @@
++/* Test that lazy PLT resolution via _dl_runtime_profile preserves
++   caller-saved VFP registers used to pass double arguments (BZ 34144).
++   Copyright (C) 2026 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <support/test-driver.h>
++
++extern void test_float_args (double a, double b, double c, double d,
++			     double e, double f, double g, double h);
++
++static int
++do_test (void)
++{
++  test_float_args (2.0, 3.0, 4.0, 5.0, 6.0, 7.0, 8.0, 9.0);
++  return 0;
++}
++
++#include <support/test-driver.c>
+diff --git a/sysdeps/arm/tst-bz34144-auditmod.c b/sysdeps/arm/tst-bz34144-auditmod.c
+new file mode 100644
+index 0000000000..ada9f126c2
+--- /dev/null
++++ b/sysdeps/arm/tst-bz34144-auditmod.c
+@@ -0,0 +1,50 @@
++/* Minimal audit module used by tst-bz34144-audit to force PLT calls
++   to go through _dl_runtime_profile instead of _dl_runtime_resolve.
++   Copyright (C) 2026 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <link.h>
++#include <stddef.h>
++#include <stdint.h>
++
++unsigned int
++la_version (unsigned int v)
++{
++  return v;
++}
++
++unsigned int
++la_objopen (struct link_map *l, Lmid_t lmid, uintptr_t *cookie)
++{
++  return LA_FLG_BINDFROM | LA_FLG_BINDTO;
++}
++
++uintptr_t
++la_symbind32 (Elf32_Sym *sym, unsigned int ndx, uintptr_t *refcook,
++	      uintptr_t *defcook, unsigned int *flags, const char *symname)
++{
++  return sym->st_value;
++}
++
++Elf32_Addr
++la_arm_gnu_pltenter (Elf32_Sym *sym, unsigned int ndx, uintptr_t *refcook,
++		     uintptr_t *defcook, La_arm_regs *regs,
++		     unsigned int *flags, const char *symname,
++		     long int *framesizep)
++{
++  return sym->st_value;
++}
+diff --git a/sysdeps/arm/tst-bz34144-mod.c b/sysdeps/arm/tst-bz34144-mod.c
+new file mode 100644
+index 0000000000..be6b54bf91
+--- /dev/null
++++ b/sysdeps/arm/tst-bz34144-mod.c
+@@ -0,0 +1,28 @@
++/* DSO used by tst-bz34144.
++   Copyright (C) 2026 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <stdlib.h>
++
++void
++test_float_args (double a, double b, double c, double d,
++		 double e, double f, double g, double h)
++{
++  if (a != 2.0 || b != 3.0 || c != 4.0 || d != 5.0
++      || e != 6.0 || f != 7.0 || g != 8.0 || h != 9.0)
++    abort ();
++}
+diff --git a/sysdeps/arm/tst-bz34144.c b/sysdeps/arm/tst-bz34144.c
+new file mode 100644
+index 0000000000..61e41b3945
+--- /dev/null
++++ b/sysdeps/arm/tst-bz34144.c
+@@ -0,0 +1,32 @@
++/* Test that lazy PLT resolution preserves caller-saved VFP registers
++   used to pass double arguments (BZ 34144).
++   Copyright (C) 2026 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <support/test-driver.h>
++
++extern void test_float_args (double a, double b, double c, double d,
++			     double e, double f, double g, double h);
++
++static int
++do_test (void)
++{
++  test_float_args (2.0, 3.0, 4.0, 5.0, 6.0, 7.0, 8.0, 9.0);
++  return 0;
++}
++
++#include <support/test-driver.c>
+
+commit 0be5a6a72a4a3132bc211720d2b6949a84f54dc3
+Author: John David Anglin <danglin@gcc.gnu.org>
+Date:   Tue Jun 23 13:41:10 2026 -0400
+
+    hppa: Fix missing call to __feraiseexcept (BZ 34306)
+    
+    The feupdateenv function is supposed to raise exceptions after
+    installing the environment represented by its envp argument.
+    This was accidentally missed on hppa.
+    
+    The failure to raise exceptions was noticed by the failure of
+    the math/test-narrowing-trap test.
+    
+    Signed-off-by: John David Anglin <dave.anglin@bell.net>
+
+diff --git a/sysdeps/hppa/fpu/feupdateenv.c b/sysdeps/hppa/fpu/feupdateenv.c
+index 46b83cc7a0..a3d3de33e4 100644
+--- a/sysdeps/hppa/fpu/feupdateenv.c
++++ b/sysdeps/hppa/fpu/feupdateenv.c
+@@ -24,6 +24,7 @@ __feupdateenv (const fenv_t *envp)
+ {
+   union { unsigned long long l; unsigned int sw[2]; } s;
+   fenv_t temp;
++
+   /* Get the current exception status */
+   __asm__ ("fstd %%fr0,0(%1)	\n\t"
+            "fldd 0(%1),%%fr0	\n\t"
+@@ -46,6 +47,10 @@ __feupdateenv (const fenv_t *envp)
+ 
+   /* Install new environment.  */
+   __fesetenv (&temp);
++
++  /* Raise exceptions.  */
++  __feraiseexcept (temp.__status_word >> 27);
++
+   /* Success.  */
+   return 0;
+ }
+
+commit 54929540335ef339ac66a8c28e3f4c22ebae2630
+Author: Fabian Rast <fabian.rast@tum.de>
+Date:   Thu Jun 11 14:30:37 2026 +0200
+
+    rtld: cache cpuid results on the stack for intel
+    
+    dl_init_cacheinfo retrieves various information about cache
+    sizes, using the cpuid instruction on x86.
+    Previously, the same cpuid leaves were queried multiple times.
+    This behavior caused intel_check_word to prominently show up in
+    profiles of dynamic loader startup on the Intel(R) Xeon(R) Gold 6430.
+    The big performance impact could not be reproduced on other Intel cpus.
+    
+    This patch reduces the number of cpuid queries on startup
+    by caching their results on the stack for reuse when searching for a
+    different cache size value.
+    This approach does not change the overall design of
+    the cache enumeration code (repeated calls to handle_* functions).
+    The values are cached on the stack instead of globally (e.g.
+    in the cpu_features global) because they are never needed after
+    early initialization.
+    
+    The cache is only active for Intel cpus, because it has not yet
+    been shown through benchmarks that it meaningfully improves performance
+    for other processors.
+    
+    Signed-off-by: Fabian Rast <fabian.rast@tum.de>
+    Reviewed-by: Sunil K Pandey <skpgkp2@gmail.com>
+    (cherry picked from commit df83fa8813eb53dcb232462a4f6dd00c873115f0)
+
+diff --git a/sysdeps/x86/dl-cacheinfo.h b/sysdeps/x86/dl-cacheinfo.h
+index 6f9bb08a19..201d3ad278 100644
+--- a/sysdeps/x86/dl-cacheinfo.h
++++ b/sysdeps/x86/dl-cacheinfo.h
+@@ -98,6 +98,15 @@ static const struct intel_02_cache_info
+ 
+ #define nintel_02_known (sizeof (intel_02_known) / sizeof (intel_02_known [0]))
+ 
++/* Cache for redundant cpuid queries in handle_intel, intel_check_word and
++   get_common_cache_info.  Currently, this has only been shown to significantly
++   improve performance on a specific Intel CPU (Xeon 6430).  */
++struct intel_cpuid_cache
++{
++  unsigned char leaf2_valid, leaf4_valid; /* Number of cached (sub)leaves.  */
++  unsigned int leaf2[4], leaf4[0x10][4];
++};
++
+ static int
+ intel_02_known_compare (const void *p1, const void *p2)
+ {
+@@ -118,7 +127,8 @@ static long int
+ __attribute__ ((noinline))
+ intel_check_word (int name, unsigned int value, bool *has_level_2,
+ 		  bool *no_level_2_or_3,
+-		  const struct cpu_features *cpu_features)
++		  const struct cpu_features *cpu_features,
++		  struct intel_cpuid_cache *cache)
+ {
+   if ((value & 0x80000000) != 0)
+     /* The register value is reserved.  */
+@@ -152,7 +162,21 @@ intel_check_word (int name, unsigned int value, bool *has_level_2,
+ 	  unsigned int round = 0;
+ 	  while (1)
+ 	    {
+-	      __cpuid_count (4, round, eax, ebx, ecx, edx);
++	      if (round < cache->leaf4_valid)
++		/* Subleaf was queried before.  Do not execute cpuid again.  */
++		eax = cache->leaf4[round][0], ebx = cache->leaf4[round][1],
++		ecx = cache->leaf4[round][2], edx = cache->leaf4[round][3];
++	      else if (round == cache->leaf4_valid
++		       && round < sizeof(cache->leaf4)/sizeof(*cache->leaf4))
++		{
++		  /* Cache the cpuid result if we have space.  */
++		  __cpuid_count (4, round, eax, ebx, ecx, edx);
++		  cache->leaf4[round][0] = eax, cache->leaf4[round][1] = ebx;
++		  cache->leaf4[round][2] = ecx, cache->leaf4[round][3] = edx;
++		  cache->leaf4_valid++;
++		}
++	      else
++		__cpuid_count (4, round, eax, ebx, ecx, edx);
+ 
+ 	      enum { null = 0, data = 1, inst = 2, uni = 3 } type = eax & 0x1f;
+ 	      if (type == null)
+@@ -247,7 +271,8 @@ intel_check_word (int name, unsigned int value, bool *has_level_2,
+ 
+ 
+ static long int __attribute__ ((noinline))
+-handle_intel (int name, const struct cpu_features *cpu_features)
++handle_intel (int name, const struct cpu_features *cpu_features,
++	      struct intel_cpuid_cache *cache)
+ {
+   unsigned int maxidx = cpu_features->basic.max_cpuid;
+ 
+@@ -260,41 +285,33 @@ handle_intel (int name, const struct cpu_features *cpu_features)
+   long int result = 0;
+   bool no_level_2_or_3 = false;
+   bool has_level_2 = false;
+-  unsigned int eax;
+-  unsigned int ebx;
+-  unsigned int ecx;
+-  unsigned int edx;
+-  __cpuid (2, eax, ebx, ecx, edx);
++  int i;
++
++  if (!cache->leaf2_valid)
++    {
++      __cpuid (2, cache->leaf2[0], cache->leaf2[1],
++		  cache->leaf2[2], cache->leaf2[3]);
++      cache->leaf2_valid = 1;
++    }
+ 
+   /* The low byte of EAX of CPUID leaf 2 should always return 1 and it
+      should be ignored.  If it isn't 1, use CPUID leaf 4 instead.  */
+-  if ((eax & 0xff) != 1)
++  if ((cache->leaf2[0] & 0xff) != 1)
+     return intel_check_word (name, 0xff, &has_level_2, &no_level_2_or_3,
+-			     cpu_features);
+-  else
+-    {
+-      eax &= 0xffffff00;
+-
+-      /* Process the individual registers' value.  */
+-      result = intel_check_word (name, eax, &has_level_2,
+-				 &no_level_2_or_3, cpu_features);
+-      if (result != 0)
+-	return result;
++			     cpu_features, cache);
+ 
+-      result = intel_check_word (name, ebx, &has_level_2,
+-				 &no_level_2_or_3, cpu_features);
+-      if (result != 0)
+-	return result;
+-
+-      result = intel_check_word (name, ecx, &has_level_2,
+-				 &no_level_2_or_3, cpu_features);
+-      if (result != 0)
+-	return result;
++  /* Process all descriptors in leaf 2.  */
++  result = intel_check_word (name, cache->leaf2[0]&0xffffff00, &has_level_2,
++			    &no_level_2_or_3, cpu_features, cache);
++  if (result != 0)
++    return result;
+ 
+-      result = intel_check_word (name, edx, &has_level_2,
+-				 &no_level_2_or_3, cpu_features);
++  for (i = 1; i < 4; i++)
++    {
++      result = intel_check_word (name, cache->leaf2[i], &has_level_2,
++				&no_level_2_or_3, cpu_features, cache);
+       if (result != 0)
+-	return result;
++        return result;
+     }
+ 
+   if (name >= _SC_LEVEL2_CACHE_SIZE && name <= _SC_LEVEL3_CACHE_LINESIZE
+@@ -611,7 +628,7 @@ handle_hygon (int name)
+ 
+ static void
+ get_common_cache_info (long int *shared_ptr, long int * shared_per_thread_ptr, unsigned int *threads_ptr,
+-                long int core)
++                long int core, struct intel_cpuid_cache *cache)
+ {
+   unsigned int eax;
+   unsigned int ebx;
+@@ -669,7 +686,14 @@ get_common_cache_info (long int *shared_ptr, long int * shared_per_thread_ptr, u
+           int check = 0x1 | (threads_l3 == 0) << 1;
+           do
+             {
+-              __cpuid_count (4, i++, eax, ebx, ecx, edx);
++              if (cache != NULL && i < cache->leaf4_valid)
++                eax = cache->leaf4[i][0], ebx = cache->leaf4[i][1],
++                ecx = cache->leaf4[i][2], edx = cache->leaf4[i][3];
++              else
++                /* Do not attempt to cache queries at this point,
++		   because get_common_cache_info is called last.  */
++                __cpuid_count (4, i, eax, ebx, ecx, edx);
++              i++;
+ 
+               /* There seems to be a bug in at least some Pentium Ds
+                  which sometimes fail to iterate all cache parameters.
+@@ -849,35 +873,38 @@ dl_init_cacheinfo (struct cpu_features *cpu_features)
+ 
+   if (cpu_features->basic.kind == arch_kind_intel)
+     {
+-      data = handle_intel (_SC_LEVEL1_DCACHE_SIZE, cpu_features);
+-      shared = handle_intel (_SC_LEVEL3_CACHE_SIZE, cpu_features);
++      struct intel_cpuid_cache cache;
++      cache.leaf2_valid = cache.leaf4_valid = 0;
++
++      data = handle_intel (_SC_LEVEL1_DCACHE_SIZE, cpu_features, &cache);
++      shared = handle_intel (_SC_LEVEL3_CACHE_SIZE, cpu_features, &cache);
+       shared_per_thread = shared;
+ 
+       level1_icache_size
+-	= handle_intel (_SC_LEVEL1_ICACHE_SIZE, cpu_features);
++	= handle_intel (_SC_LEVEL1_ICACHE_SIZE, cpu_features, &cache);
+       level1_icache_linesize
+-	= handle_intel (_SC_LEVEL1_ICACHE_LINESIZE, cpu_features);
++	= handle_intel (_SC_LEVEL1_ICACHE_LINESIZE, cpu_features, &cache);
+       level1_dcache_size = data;
+       level1_dcache_assoc
+-	= handle_intel (_SC_LEVEL1_DCACHE_ASSOC, cpu_features);
++	= handle_intel (_SC_LEVEL1_DCACHE_ASSOC, cpu_features, &cache);
+       level1_dcache_linesize
+-	= handle_intel (_SC_LEVEL1_DCACHE_LINESIZE, cpu_features);
++	= handle_intel (_SC_LEVEL1_DCACHE_LINESIZE, cpu_features, &cache);
+       level2_cache_size
+-	= handle_intel (_SC_LEVEL2_CACHE_SIZE, cpu_features);
++	= handle_intel (_SC_LEVEL2_CACHE_SIZE, cpu_features, &cache);
+       level2_cache_assoc
+-	= handle_intel (_SC_LEVEL2_CACHE_ASSOC, cpu_features);
++	= handle_intel (_SC_LEVEL2_CACHE_ASSOC, cpu_features, &cache);
+       level2_cache_linesize
+-	= handle_intel (_SC_LEVEL2_CACHE_LINESIZE, cpu_features);
++	= handle_intel (_SC_LEVEL2_CACHE_LINESIZE, cpu_features, &cache);
+       level3_cache_size = shared;
+       level3_cache_assoc
+-	= handle_intel (_SC_LEVEL3_CACHE_ASSOC, cpu_features);
++	= handle_intel (_SC_LEVEL3_CACHE_ASSOC, cpu_features, &cache);
+       level3_cache_linesize
+-	= handle_intel (_SC_LEVEL3_CACHE_LINESIZE, cpu_features);
++	= handle_intel (_SC_LEVEL3_CACHE_LINESIZE, cpu_features, &cache);
+       level4_cache_size
+-	= handle_intel (_SC_LEVEL4_CACHE_SIZE, cpu_features);
++	= handle_intel (_SC_LEVEL4_CACHE_SIZE, cpu_features, &cache);
+ 
+       get_common_cache_info (&shared, &shared_per_thread, &threads,
+-			     level2_cache_size);
++			     level2_cache_size, &cache);
+     }
+   else if (cpu_features->basic.kind == arch_kind_zhaoxin)
+     {
+@@ -898,7 +925,7 @@ dl_init_cacheinfo (struct cpu_features *cpu_features)
+       level3_cache_linesize = handle_zhaoxin (_SC_LEVEL3_CACHE_LINESIZE);
+ 
+       get_common_cache_info (&shared, &shared_per_thread, &threads,
+-			     level2_cache_size);
++			     level2_cache_size, NULL);
+     }
+   else if (cpu_features->basic.kind == arch_kind_amd)
+     {
+
+commit f2f55eac9e6f1167486f2694dea88adf87c77fdd
+Author: Florian Weimer <fweimer@redhat.com>
+Date:   Fri Jun 19 18:22:20 2026 +0200
+
+    resolv: Declare __p_class_syms, __p_type_syms for internal use
+    
+    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+    Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
+    (cherry picked from commit 360f352c9a6da545d798ef3015e73ca114f0d230)
+
+diff --git a/include/resolv.h b/include/resolv.h
+index 4dbbac3800..d5ad9994b9 100644
+--- a/include/resolv.h
++++ b/include/resolv.h
+@@ -70,6 +70,11 @@ libc_hidden_proto (__libc_res_nameinquery)
+ extern __typeof (__res_queriesmatch) __libc_res_queriesmatch;
+ libc_hidden_proto (__libc_res_queriesmatch)
+ 
++extern const struct res_sym __p_class_syms[];
++libresolv_hidden_proto (__p_class_syms)
++extern const struct res_sym __p_type_syms[];
++libresolv_hidden_proto (__p_type_syms)
++
+ /* Variant of res_hnok which operates on binary (but uncompressed) names.  */
+ bool __res_binary_hnok (const unsigned char *dn) attribute_hidden;
+ 
+diff --git a/resolv/res_debug.c b/resolv/res_debug.c
+index 73af0c72fe..6bf9962916 100644
+--- a/resolv/res_debug.c
++++ b/resolv/res_debug.c
+@@ -390,8 +390,6 @@ p_fqname(const u_char *cp, const u_char *msg, FILE *file) {
+  * that C_ANY is a qclass but not a class.  (You can ask for records of class
+  * C_ANY, but you can't have any records of that class in the database.)
+  */
+-extern const struct res_sym __p_class_syms[];
+-libresolv_hidden_proto (__p_class_syms)
+ const struct res_sym __p_class_syms[] = {
+   {C_IN,    (char *) "IN"},
+   {C_CHAOS, (char *) "CHAOS"},
+@@ -426,8 +424,6 @@ const struct res_sym __p_update_section_syms[] attribute_hidden = {
+  * Names of RR types and qtypes.  The list is incomplete because its
+  * size is part of the ABI.
+  */
+-extern const struct res_sym __p_type_syms[];
+-libresolv_hidden_proto (__p_type_syms)
+ const struct res_sym __p_type_syms[] = {
+   {ns_t_a,      (char *) "A",     (char *) "address"},
+   {ns_t_ns,     (char *) "NS",    (char *) "name server"},
+
+commit 3c27e5170c456a69807348de8586c123f62a51f6
+Author: Florian Weimer <fweimer@redhat.com>
+Date:   Fri Jun 19 18:22:20 2026 +0200
+
+    resolv: Fix ns_sprintrrf formatting of class, type values (bug 34289)
+    
+    The p_class and p_type results could overwrite each other if both
+    were unknown.  Format unknown values with CLASS and TYPE prefixes,
+    as in RFC 3597.  Handle A6 separately because it cannot be added
+    to __p_type_syms for ABI reasons.
+    
+    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+    Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
+    (cherry picked from commit f69b7f95e3694177546faec25d88bb266885c3b8)
+
+diff --git a/resolv/ns_print.c b/resolv/ns_print.c
+index cef2212fd2..e75c39eaa8 100644
+--- a/resolv/ns_print.c
++++ b/resolv/ns_print.c
+@@ -78,6 +78,24 @@ ns_sprintrr(const ns_msg *handle, const ns_rr *rr,
+ }
+ libresolv_hidden_def (ns_sprintrr)
+ 
++/* Writes the class/type symbol NUMBER to *BUF, using the name from
++   *SYMS if possible.  If NUMBER is not found in *SYMS, print the
++   number with PREFIX.  */
++static int
++addsym (const struct res_sym *syms, int number, const char *prefix,
++	char **buf, size_t *buflen)
++{
++  for (; syms->name != NULL; syms++)
++    if (number == syms->number)
++      {
++	T (addstr (" ", 1, buf, buflen));
++	return addstr (syms->name, strlen (syms->name), buf, buflen);
++      }
++  char tmp[20];
++  int len = snprintf (tmp, sizeof (tmp), " %s%d", prefix, number);
++  return addstr (tmp, len, buf, buflen);
++}
++
+ /*%
+  *	Convert the fields of an RR into presentation format.
+  *
+@@ -128,11 +146,21 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+ 	/*
+ 	 * TTL, Class, Type.
+ 	 */
+-	T(x = ns_format_ttl(ttl, buf, buflen));
+-	addlen(x, &buf, &buflen);
+-	len = SPRINTF((tmp, " %s %s", p_class(class), p_type(type)));
+-	T(addstr(tmp, len, &buf, &buflen));
+-	T(spaced = addtab(x + len, 16, spaced, &buf, &buflen));
++	{
++	  char *start = buf;
++
++	  T (x = ns_format_ttl (ttl, buf, buflen));
++	  addlen (x, &buf, &buflen);
++	  T (addsym (__p_class_syms, class, "CLASS", &buf, &buflen));
++	  if (type == ns_t_a6)
++	    /* A6 is not part of __p_type_syms, which is exported.
++	       Adding A6 there would change its size.  Handle it here.  */
++	    T (addstr (" A6", 3, &buf, &buflen));
++	  else
++	    T (addsym (__p_type_syms, type, "TYPE", &buf, &buflen));
++
++	  T (spaced = addtab(buf - start, 16, spaced, &buf, &buflen));
++	}
+ 
+ 	/*
+ 	 * RData.
+
+commit 509d819cea20f5d6c615eed1f869cc930effd9d2
+Author: Florian Weimer <fweimer@redhat.com>
+Date:   Fri Jun 19 18:22:20 2026 +0200
+
+    resolv: Improve formatting of unknown records in ns_sprintrrf
+    
+    Do not add the "unknown RR type" comment.  After adding the TYPE
+    prefix, the number is largely redundant.
+    
+    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+    Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
+    (cherry picked from commit d58415eb17d457a160af99f9e8ab164404ca151b)
+
+diff --git a/resolv/ns_print.c b/resolv/ns_print.c
+index e75c39eaa8..3d38876483 100644
+--- a/resolv/ns_print.c
++++ b/resolv/ns_print.c
+@@ -115,7 +115,6 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+ 
+ 	const char *comment;
+ 	char tmp[100];
+-	char errbuf[40];
+ 	int len, x;
+ 
+ 	/*
+@@ -590,20 +589,18 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+ 		T(addstr(tmp, len, &buf, &buflen));
+ 		break;
+ 	    }
+-
+ 	default:
+-		snprintf (errbuf, sizeof (errbuf), "unknown RR type %d", type);
+-		comment = errbuf;
++		comment = "";
+ 		goto hexify;
+ 	}
+ 	return (buf - obuf);
+  formerr:
+-	comment = "RR format error";
++	comment = " ; RR format error";
+  hexify: {
+ 	int n, m;
+ 	char *p;
+ 
+-	len = SPRINTF((tmp, "\\# %u%s\t; %s", (unsigned)(edata - rdata),
++	len = SPRINTF((tmp, "\\# %u%s%s", (unsigned)(edata - rdata),
+ 		       rdlen != 0U ? " (" : "", comment));
+ 	T(addstr(tmp, len, &buf, &buflen));
+ 	while (rdata < edata) {
+
+commit 05dc6da0b4e12dbc60d3705e4961b823d3f7026d
+Author: Florian Weimer <fweimer@redhat.com>
+Date:   Fri Jun 19 18:22:20 2026 +0200
+
+    resolv: Check for inet_ntop failure in ns_sprintrrf
+    
+    This makes the output more consistent (either failure or complete
+    output) and helps with systematic testing with varying buffer
+    sizes.
+    
+    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+    Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
+    (cherry picked from commit cd0db208d56a2cecd528b8ae96df752ba5344d9a)
+
+diff --git a/resolv/ns_print.c b/resolv/ns_print.c
+index 3d38876483..e58df5f35a 100644
+--- a/resolv/ns_print.c
++++ b/resolv/ns_print.c
+@@ -167,8 +167,9 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+ 	switch (type) {
+ 	case ns_t_a:
+ 	  if (rdlen != (size_t)NS_INADDRSZ)
+-			goto formerr;
+-		(void) inet_ntop(AF_INET, rdata, buf, buflen);
++		  goto formerr;
++		if (inet_ntop (AF_INET, rdata, buf, buflen) == NULL)
++		  return -1;
+ 		addlen(strlen(buf), &buf, &buflen);
+ 		break;
+ 
+@@ -334,9 +335,10 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+ 	    }
+ 
+ 	case ns_t_aaaa:
+-	  if (rdlen != (size_t)NS_IN6ADDRSZ)
+-			goto formerr;
+-		(void) inet_ntop(AF_INET6, rdata, buf, buflen);
++		if (rdlen != (size_t)NS_IN6ADDRSZ)
++		  goto formerr;
++		if (inet_ntop (AF_INET6, rdata, buf, buflen) == NULL)
++		  return -1;
+ 		addlen(strlen(buf), &buf, &buflen);
+ 		break;
+ 
+@@ -427,7 +429,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+ 			goto formerr;
+ 
+ 		/* Address. */
+-		(void) inet_ntop(AF_INET, rdata, buf, buflen);
++		if (inet_ntop (AF_INET, rdata, buf, buflen) == NULL)
++		  return -1;
+ 		addlen(strlen(buf), &buf, &buflen);
+ 		rdata += NS_INADDRSZ;
+ 
+@@ -569,7 +572,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+ 			if (rdata + pbyte >= edata) goto formerr;
+ 			memset(&a, 0, sizeof(a));
+ 			memcpy(&a.s6_addr[pbyte], rdata, sizeof(a) - pbyte);
+-			(void) inet_ntop(AF_INET6, &a, buf, buflen);
++			if (inet_ntop (AF_INET6, &a, buf, buflen) == NULL)
++			  return -1;
+ 			addlen(strlen(buf), &buf, &buflen);
+ 			rdata += sizeof(a) - pbyte;
+ 		}
+
+commit 299e1d25c32c5f9ef78ddd6cbfd0c6a09a1f4227
+Author: Florian Weimer <fweimer@redhat.com>
+Date:   Fri Jun 19 18:22:20 2026 +0200
+
+    resolv: More types as unknown in ns_sprintrrf (CVE-2026-5435)
+    
+    Specifically, CERT, TKEY, TSIG, OPT.  This removes the buggy
+    implementations of TSIG, fixing bug 34033, and partially
+    fixing bug 34069.
+    
+    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+    Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
+    (cherry picked from commit ca44a6609c29a683b03575fa035c6d17aa591e72)
+
+diff --git a/resolv/ns_print.c b/resolv/ns_print.c
+index e58df5f35a..ab68bf2cb7 100644
+--- a/resolv/ns_print.c
++++ b/resolv/ns_print.c
+@@ -464,96 +464,6 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+ 		break;
+ 	    }
+ 
+-	case ns_t_cert: {
+-		u_int c_type, key_tag, alg;
+-		int n;
+-		unsigned int siz;
+-		char base64_cert[8192], tmp[40];
+-		const char *leader;
+-
+-		c_type  = ns_get16(rdata); rdata += NS_INT16SZ;
+-		key_tag = ns_get16(rdata); rdata += NS_INT16SZ;
+-		alg = (u_int) *rdata++;
+-
+-		len = SPRINTF((tmp, "%d %d %d ", c_type, key_tag, alg));
+-		T(addstr(tmp, len, &buf, &buflen));
+-		siz = (edata-rdata)*4/3 + 4; /* "+4" accounts for trailing \0 */
+-		if (siz > sizeof(base64_cert) * 3/4) {
+-			const char *str = "record too long to print";
+-			T(addstr(str, strlen(str), &buf, &buflen));
+-		}
+-		else {
+-			len = b64_ntop(rdata, edata-rdata, base64_cert, siz);
+-
+-			if (len < 0)
+-				goto formerr;
+-			else if (len > 15) {
+-				T(addstr(" (", 2, &buf, &buflen));
+-				leader = "\n\t\t";
+-				spaced = 0;
+-			}
+-			else
+-				leader = " ";
+-
+-			for (n = 0; n < len; n += 48) {
+-				T(addstr(leader, strlen(leader),
+-					 &buf, &buflen));
+-				T(addstr(base64_cert + n, MIN(len - n, 48),
+-					 &buf, &buflen));
+-			}
+-			if (len > 15)
+-				T(addstr(" )", 2, &buf, &buflen));
+-		}
+-		break;
+-	    }
+-
+-	case ns_t_tkey: {
+-		/* KJD - need to complete this */
+-		u_long t;
+-		int mode, err, keysize;
+-
+-		/* Algorithm name. */
+-		T(addname(msg, msglen, &rdata, origin, &buf, &buflen));
+-		T(addstr(" ", 1, &buf, &buflen));
+-
+-		/* Inception. */
+-		t = ns_get32(rdata);  rdata += NS_INT32SZ;
+-		len = SPRINTF((tmp, "%lu ", t));
+-		T(addstr(tmp, len, &buf, &buflen));
+-
+-		/* Expiration. */
+-		t = ns_get32(rdata);  rdata += NS_INT32SZ;
+-		len = SPRINTF((tmp, "%lu ", t));
+-		T(addstr(tmp, len, &buf, &buflen));
+-
+-		/* Mode , Error, Key Size. */
+-		/* Priority, Weight, Port. */
+-		mode = ns_get16(rdata);  rdata += NS_INT16SZ;
+-		err  = ns_get16(rdata);  rdata += NS_INT16SZ;
+-		keysize  = ns_get16(rdata);  rdata += NS_INT16SZ;
+-		len = SPRINTF((tmp, "%u %u %u ", mode, err, keysize));
+-		T(addstr(tmp, len, &buf, &buflen));
+-
+-		/* XXX need to dump key, print otherdata length & other data */
+-		break;
+-	    }
+-
+-	case ns_t_tsig: {
+-		/* BEW - need to complete this */
+-		int n;
+-
+-		T(len = addname(msg, msglen, &rdata, origin, &buf, &buflen));
+-		T(addstr(" ", 1, &buf, &buflen));
+-		rdata += 8; /*%< time */
+-		n = ns_get16(rdata); rdata += INT16SZ;
+-		rdata += n; /*%< sig */
+-		n = ns_get16(rdata); rdata += INT16SZ; /*%< original id */
+-		sprintf(buf, "%d", ns_get16(rdata));
+-		rdata += INT16SZ;
+-		addlen(strlen(buf), &buf, &buflen);
+-		break;
+-	    }
+-
+ 	case ns_t_a6: {
+ 		struct in6_addr a;
+ 		int pbyte, pbit;
+@@ -588,11 +498,6 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+ 		break;
+ 	    }
+ 
+-	case ns_t_opt: {
+-		len = SPRINTF((tmp, "%u bytes", class));
+-		T(addstr(tmp, len, &buf, &buflen));
+-		break;
+-	    }
+ 	default:
+ 		comment = "";
+ 		goto hexify;
+
+commit cb4c62448047c043981deea84e5e01eccf8b36d4
+Author: Florian Weimer <fweimer@redhat.com>
+Date:   Fri Jun 19 18:22:20 2026 +0200
+
+    resolv: Fix buffer overreads in ns_sprintrrf (CVE-2026-6238)
+    
+    Check that the RDATA payload does not require more than RDATALEN
+    bytes while processing it.  The fixes cover A6, LOC records.
+    (CERT, TKEY, TSIG were fixed before, by switching to the generic
+    formatter.)
+    
+    The vulnerable LOC record handling was first introduced before
+    glibc 2.0, in commit ee188d555b8c32ad9704a7440cab400af967292f.
+    
+    CERT, TSIG, TKEY handling came with commit
+    b43b13ac2544b11f35be301d1589b51a8473e32b, released with glibc 2.2.
+    
+    A6 record handling was introduced in commit
+    91633816430e7ec5a19fe3ff510a7c4822a9557e ("* resolv/ns_print.c
+    (ns_sprintrrf): Handle ns_t_a6 and ns_t_opt."), which went into glibc
+    2.7.
+    
+    This fixes bug 34069.
+    
+    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+    Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
+    (cherry picked from commit a7b60d23bbb56eaef59f4962e4140062e552600a)
+
+diff --git a/resolv/ns_print.c b/resolv/ns_print.c
+index ab68bf2cb7..f9dd086804 100644
+--- a/resolv/ns_print.c
++++ b/resolv/ns_print.c
+@@ -345,7 +345,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+ 	case ns_t_loc: {
+ 		char t[255];
+ 
+-		/* XXX protocol format checking? */
++		if (rdlen != 16)
++		  goto formerr;
+ 		(void) loc_ntoa(rdata, t);
+ 		T(addstr(t, strlen(t), &buf, &buflen));
+ 		break;
+@@ -479,13 +480,14 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+ 
+ 		/* address suffix: provided only when prefix len != 128 */
+ 		if (pbit < 128) {
+-			if (rdata + pbyte >= edata) goto formerr;
++			unsigned int bytelen = sizeof(a) - pbyte;
++			if (edata - rdata < bytelen) goto formerr;
+ 			memset(&a, 0, sizeof(a));
+-			memcpy(&a.s6_addr[pbyte], rdata, sizeof(a) - pbyte);
++			memcpy(&a.s6_addr[pbyte], rdata, bytelen);
+ 			if (inet_ntop (AF_INET6, &a, buf, buflen) == NULL)
+ 			  return -1;
+ 			addlen(strlen(buf), &buf, &buflen);
+-			rdata += sizeof(a) - pbyte;
++			rdata += bytelen;
+ 		}
+ 
+ 		/* prefix name: provided only when prefix len > 0 */
+
+commit 296fb7f4a2b35db13efef52609f8efc00291b2a8
+Author: Florian Weimer <fweimer@redhat.com>
+Date:   Fri Jun 19 18:22:20 2026 +0200
+
+    resolv: Add test case tst-ns_sprintrr (bug 34033, bug 34069)
+    
+    This test case covers both input buffer overreads and output buffer
+    overflows.  It should systematically cover these issues.
+    
+    I used code auto-generation for updating the test expectations for
+    truncated RDATA in TXT, ISDN records, after writing the rest
+    of the test by hand.
+    
+    Assisted-by: LLM
+    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+    Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
+    (cherry picked from commit 4ba0b79b9596e5a4951cc9eaa1546a55e543e083)
+
+diff --git a/resolv/Makefile b/resolv/Makefile
+index 088a22ea18..c6d73b411c 100644
+--- a/resolv/Makefile
++++ b/resolv/Makefile
+@@ -98,6 +98,7 @@ tests += \
+   tst-ns_name \
+   tst-ns_name_compress \
+   tst-ns_name_pton \
++  tst-ns_sprintrr \
+   tst-res_hconf_reorder \
+   tst-res_hnok \
+   tst-resolv-aliases \
+@@ -331,5 +332,6 @@ $(objpfx)tst-ns_name: $(objpfx)libresolv.so
+ $(objpfx)tst-ns_name.out: tst-ns_name.data
+ $(objpfx)tst-ns_name_compress: $(objpfx)libresolv.so
+ $(objpfx)tst-ns_name_pton: $(objpfx)libresolv.so
++$(objpfx)tst-ns_sprintrr: $(objpfx)libresolv.so
+ $(objpfx)tst-res_hnok: $(objpfx)libresolv.so
+ $(objpfx)tst-p_secstodate: $(objpfx)libresolv.so
+diff --git a/resolv/tst-ns_sprintrr.c b/resolv/tst-ns_sprintrr.c
+new file mode 100644
+index 0000000000..34739b5924
+--- /dev/null
++++ b/resolv/tst-ns_sprintrr.c
+@@ -0,0 +1,329 @@
++/* Tests for the ns_sprintrr function.
++   Copyright (C) 2026 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <arpa/nameser.h>
++
++#include <alloc_buffer.h>
++#include <arpa/inet.h>
++#include <libc-diag.h>
++#include <stdbool.h>
++#include <string.h>
++#include <support/check.h>
++#include <support/next_to_fault.h>
++
++#include <stdio.h>
++
++/* Regions that test_one_record uses for input and output.  */
++static struct support_next_to_fault ntf_in;
++static struct support_next_to_fault ntf_out;
++
++/* This is used by test_one_record to construct the packet.   */
++static const char packet_prefix[] =
++  /* DNS response with one question, one answer record.  */
++  "AA\x81\x80\0\1\0\1\0\0\0\0"
++  /* Question: www.example.org/IN/ANY.  */
++  "\3www\7example\3org\0\0\xff\0\1"
++  /* Response: compression reference.  */
++  "\xc0\x0c";
++
++/* Use ns_sprintrr to format a DNS record (starting with
++   packet_prefix) of type RTYPE, with a record payload of RDATALEN
++   bytes starting at RDATA.  Check successful formatting against
++   EXPECTED.  Try various truncated input and output buffers to catch
++   overreads and buffer overflows, using ntf_in and ntf_out above.  */
++static void
++test_one_record (uint16_t rtype, const char *rdata, size_t rdatalen,
++                 const char *expected)
++{
++  struct rr_header
++  {
++    uint16_t typ;
++    uint16_t cls;
++    uint32_t ttl;
++    uint16_t rdatalen;
++    uint16_t pad;
++  } hdr =
++    {
++      .typ = htons (rtype),
++      .cls = htons (ns_c_in),
++      .ttl = htonl (86400),     /* One day.  */
++      .rdatalen = htons (rdatalen),
++    };
++  enum { hdrlen = offsetof (struct rr_header, pad) };
++  TEST_COMPARE (hdrlen, 10);
++
++  /* Construct the packet from packet_prefix, hdr, and rdata.  */
++  unsigned char packet[512];
++  size_t packetlen;
++  {
++    struct alloc_buffer buf = alloc_buffer_create (packet, sizeof (packet));
++    alloc_buffer_copy_bytes (&buf, packet_prefix, sizeof (packet_prefix) - 1);
++    alloc_buffer_copy_bytes (&buf, &hdr, hdrlen);
++    alloc_buffer_copy_bytes (&buf, rdata, rdatalen);
++    packetlen = sizeof (packet) - alloc_buffer_size (&buf);
++  }
++
++  /* Parse the record.   */
++  ns_msg msg;
++  TEST_COMPARE (ns_initparse (packet, packetlen, &msg), 0);
++  ns_rr rr;
++  TEST_COMPARE (ns_parserr (&msg, ns_s_an, 0, &rr), 0);
++
++  /* Try sizes up to this limit.  Go a bit beyond the expected size to
++     check for errors.  */
++  size_t max_result_size = strlen (expected) + 16;
++
++  bool success = false;
++  for (size_t result_size = 1; result_size <= max_result_size; ++result_size)
++    {
++      char *result_start = ntf_out.buffer + ntf_out.length - result_size;
++      memset (result_start, 'X', result_size);
++
++      /* ns_sprintrr was deprecated in 2.34.  */
++      DIAG_PUSH_NEEDS_COMMENT;
++      DIAG_IGNORE_NEEDS_COMMENT (4.9, "-Wdeprecated-declarations");
++      int ret = ns_sprintrr (&msg, &rr, NULL, NULL, result_start, result_size);
++      DIAG_POP_NEEDS_COMMENT;
++
++      if (ret > 0)
++        {
++          TEST_COMPARE_STRING (result_start, expected);
++          TEST_COMPARE (ret, strlen (expected));
++          success = true;
++        }
++      else
++        {
++          TEST_VERIFY (!success);
++          TEST_COMPARE (ret, -1);
++        }
++    }
++  TEST_VERIFY (success);
++
++  /* Test with truncated RDATA.   */
++  for (size_t rdata_size = 0; rdata_size <= rdatalen; ++rdata_size)
++    {
++      size_t truncated_packet_size = packetlen - rdatalen + rdata_size;
++      unsigned char *packet_start
++        = ((unsigned char *) ntf_in.buffer + ntf_in.length
++           - truncated_packet_size);
++      memcpy (packet_start, packet, truncated_packet_size);
++      /* Patch in the updated RDATA length field.  */
++      uint16_t new_rdatalen = htons (rdata_size);
++      memcpy (packet_start + truncated_packet_size - rdata_size - 2,
++              &new_rdatalen, 2);
++
++      ns_msg msg;
++      TEST_COMPARE (ns_initparse (packet_start, truncated_packet_size, &msg),
++                    0);
++      ns_rr rr;
++      TEST_COMPARE (ns_parserr (&msg, ns_s_an, 0, &rr), 0);
++
++      size_t result_size = strlen (expected) + 1;
++      char *result_start = ntf_out.buffer + ntf_out.length - result_size;
++      memset (result_start, 'X', result_size);
++
++      /* ns_sprintrr was deprecated in 2.34.  */
++      DIAG_PUSH_NEEDS_COMMENT;
++      DIAG_IGNORE_NEEDS_COMMENT (4.9, "-Wdeprecated-declarations");
++      int ret = ns_sprintrr (&msg, &rr, NULL, NULL, result_start, result_size);
++      DIAG_POP_NEEDS_COMMENT;
++
++      /* This flag indicates whether the output is syntactically
++         correct.  In some cases, truncation may still yield a valid
++         payload.  */
++      bool broken = rdata_size < rdatalen;
++      switch (rtype)
++        {
++        case ns_t_wks:
++          /* WKS records use all trailing bytes for the port bitmap.  */
++          broken = rdata_size < 5;
++          break;
++        case ns_t_nsap:
++          /* Uses all bytes that are available.  */
++          broken = false;
++          break;
++        case ns_t_txt:
++          /* Truncation produces a valid payload if it occurs right
++             after a complete string in the TXT payload.  */
++          broken = false;
++          for (size_t pos = 0; pos < rdata_size; )
++            {
++              unsigned int slen = rdata[pos] & 0xff;
++              if (pos + 1 + slen > rdata_size)
++                {
++                  broken = true;
++                  break;
++                }
++              pos += 1 + slen;
++            }
++          break;
++        case ns_t_isdn:
++          /* The second field is optional.  If it is present, it must
++             not be truncated.  */
++          broken = rdata_size < 6 || (rdata_size > 6 && rdata_size < rdatalen);
++          break;
++        case ns_t_a6:
++          /* The first A6 subtest contains a trailing domain name,
++             which is ignored and not formatted.  */
++          if (rdata_size > 0 && rdata[0] == 0)
++            broken = rdata_size < 17;
++          break;
++        case ns_t_cert:
++        case ns_t_tkey:
++        case ns_t_tsig:
++          /* Only generic printing, which does not validate anything.  */
++          broken = false;
++          break;
++        }
++
++      if (broken)
++        {
++          if (strstr (result_start, "RR format error") != NULL)
++            /* No further checks if an error indicator has been added
++               to the output.  */
++            ;
++          else
++            TEST_COMPARE (ret, -1);
++        }
++      else
++        TEST_VERIFY (ret > 0);
++    }
++}
++
++static int
++do_test (void)
++{
++  ntf_in = support_next_to_fault_allocate (512);
++  ntf_out = support_next_to_fault_allocate (256);
++
++#define T(rtype, rdata, expected) \
++  test_one_record (rtype, rdata, sizeof (rdata) - 1, expected)
++  T (ns_t_a, "\xc0\0\2\1", "www.example.org.\t1D IN A\t\t192.0.2.1");
++  T (ns_t_cname, "\4www1\4prod\xc0\x10",
++     "www.example.org.\t1D IN CNAME\twww1.prod.example.org.");
++  T (ns_t_hinfo, "\5first\6second",
++     "www.example.org.\t1D IN HINFO\t\"first\" \"second\"");
++  T (ns_t_isdn, "\5first\6second",
++     "www.example.org.\t1D IN ISDN\t\"first\" \"second\"");
++  /* Bug: Extra space at the end in the text representation of ISDN RRs.  */
++  T (ns_t_isdn, "\5first", "www.example.org.\t1D IN ISDN\t\"first\" ");
++  T (ns_t_soa,
++     "\2ns\xc0\x10\12hostmaster\xc0\x10"
++     "\0\0\0\1\0\0\0\2\0\0\0\3\0\0\0\4\0\0\0\5",
++     "www.example.org.\t1D IN SOA\tns.example.org. hostmaster.example.org. (\n"
++     "\t\t\t\t\t1\t\t; serial\n"
++     "\t\t\t\t\t2S\t\t; refresh\n"
++     "\t\t\t\t\t3S\t\t; retry\n"
++     "\t\t\t\t\t4S\t\t; expiry\n"
++     "\t\t\t\t\t5S )\t\t; minimum\n");
++  T (ns_t_mx, "\0\xa\2mx\xc0\x10",
++     "www.example.org.\t1D IN MX\t10 mx.example.org.");
++  T (ns_t_px, "\0\xa\3px1\xc0\x10\3px2\xc0\x10",
++     "www.example.org.\t1D IN PX\t10 px1.example.org. px2.example.org.");
++  T (ns_t_x25, "\4X.25",
++     "www.example.org.\t1D IN X25\t\"X.25\"");
++  T (ns_t_txt, "\1A\2BC\3DEF",
++     "www.example.org.\t1D IN TXT\t\"A\" \"BC\" \"DEF\"");
++  T (ns_t_nsap, "",
++     "www.example.org.\t1D IN NSAP\t");
++  T (ns_t_nsap, "\1",
++     "www.example.org.\t1D IN NSAP\t01");
++  T (ns_t_nsap, "\1\2",
++     "www.example.org.\t1D IN NSAP\t01.02");
++  T (ns_t_nsap, "\1\2\3",
++     "www.example.org.\t1D IN NSAP\t01.0203");
++  T (ns_t_nsap, "\1\2\3\4",
++     "www.example.org.\t1D IN NSAP\t01.0203.04");
++  T (ns_t_nsap,
++     "\1\2\3\4\5\6\7\10\11\12\13\14\15\16\17\20\21\22\23\24\25\26\27\30\31\32"
++     "\33\34\35\36\37\40\41\42\43\44\45\46\47\50\51\52\53\54\55\56\57\60\61"
++     "\62\63\64\65\66\67\70\71\72\73\74\75\76\77\100\101\102\103\104\105\106"
++     "\107\110\111\112\113\114\115\116\117\120\121\122\123\124\125\126\127"
++     "\130\131\132\133\134\135\136\137\140\141\142\143\144\145\146\147\150"
++     "\151\152\153\154\155\156\157\160\161\162\163\164\165\166\167\170\171"
++     "\172\173\174\175\176\177\200\201\202\203\204\205\206\207\210\211\212"
++     "\213\214\215\216\217\220\221\222\223\224\225\226\227\230\231\232\233"
++     "\234\235\236\237\240\241\242\243\244\245\246\247\250\251\252\253\254"
++     "\255\256\257\260\261\262\263\264\265\266\267\270\271\272\273\274\275"
++     "\276\277\300\301\302\303\304\305\306\307\310\311\312\313\314\315\316"
++     "\317\320\321\322\323\324\325\326\327\330\331\332\333\334\335\336\337"
++     "\340\341\342\343\344\345\346\347\350\351\352\353\354\355\356\357\360"
++     "\361\362\363\364\365\366\367\370\371\372\373\374\375\376\377",
++     "www.example.org.\t1D IN NSAP\t"
++     "01.0203.0405.0607.0809.0A0B.0C0D.0E0F.1011.1213.1415.1617.1819.1A1B"
++     ".1C1D.1E1F.2021.2223.2425.2627.2829.2A2B.2C2D.2E2F.3031.3233.3435.3637"
++     ".3839.3A3B.3C3D.3E3F.4041.4243.4445.4647.4849.4A4B.4C4D.4E4F.5051.5253"
++     ".5455.5657.5859.5A5B.5C5D.5E5F.6061.6263.6465.6667.6869.6A6B.6C6D.6E6F"
++     ".7071.7273.7475.7677.7879.7A7B.7C7D.7E7F.8081.8283.8485.8687.8889.8A8B"
++     ".8C8D.8E8F.9091.9293.9495.9697.9899.9A9B.9C9D.9E9F.A0A1.A2A3.A4A5.A6A7"
++     ".A8A9.AAAB.ACAD.AEAF.B0B1.B2B3.B4B5.B6B7.B8B9.BABB.BCBD.BEBF.C0C1.C2C3"
++     ".C4C5.C6C7.C8C9.CACB.CCCD.CECF.D0D1.D2D3.D4D5.D6D7.D8D9.DADB.DCDD.DEDF"
++     ".E0E1.E2E3.E4E5.E6E7.E8E9.EAEB.ECED.EEEF.F0F1.F2F3.F4F5.F6F7.F8F9.FAFB"
++     ".FCFD.FEFF");
++  T (ns_t_aaaa, "\x20\x01\x0d\xb8\0\0\0\0\0\0\0\0\0\0\x12\x34",
++     "www.example.org.\t1D IN AAAA\t2001:db8::1234");
++  /* Example from RFC 1876.  The loc_ntoa format is different from the
++     official text representation.  */
++  T (ns_t_loc,
++     "\000\063\026\023\211\027\055\320\160\276\025\360\000\230\215\040",
++     "www.example.org.\t1D IN LOC"
++     "\t42 21 54.000 N 71 06 18.000 W -24.00m 30.00m 10000.00m 10.00m");
++  T (ns_t_naptr,
++     "\0\1\0\2\5flags\7service\2.*\5naptr\xc0\x10",
++     "www.example.org.\t1D IN NAPTR\t1 2 \"flags\" \"service\" \".*\""
++     " naptr.example.org.");
++  T (ns_t_srv,
++     "\0\1\0\2\0\x50\4www1\xc0\x10",
++     "www.example.org.\t1D IN SRV\t1 2 80 www1.example.org.");
++  T (ns_t_rp, "\3rp1\xc0\x10\3rp2\xc0\x10",
++     "www.example.org.\t1D IN RP\trp1.example.org. rp2.example.org.");
++  T (ns_t_wks, "\xc0\0\2\1\6\0\0\0\0\0\0\0\0\0\0\200",
++     "www.example.org.\t1D IN WKS\t192.0.2.1 6 ( \n\t\t\t\t80 )");
++  T (ns_t_cert, "\0\1\x04\xd2\0blob",
++     "www.example.org.\t1D IN CERT\t\\# 9 (\n"
++     "\t00 01 04 d2 00 62 6c 6f 62 )\t\t\t; .....blob");
++  T (ns_t_tkey, "\4algo\0\0\0\0\1\0\0\0\2\0\3\0\4"
++     "\0\5\xa1\xa2\xa3\xa4\xa5\0\3\xb1\xb2\xb3",
++     "www.example.org.\t1D IN TYPE249\t\\# 30 (\n"
++     "\t04 61 6c 67 6f 00 00 00 00 01 00 00 00 02 00 03 ; .algo...........\n"
++     "\t00 04 00 05 a1 a2 a3 a4 a5 00 03 b1 b2 b3 )\t; ..............");
++  T (ns_t_tsig, "\4algo\0"
++     "\0\20\xdd\xcd\x64\x10\xe9\x21\x34\x1a\x8e\xe0\xa1\x9a\x30\xfc\x3b\xd1"
++     "\0\2\0\3\0\5other",
++     "www.example.org.\t1D IN TSIG\t\\# 35 (\n"
++     "\t04 61 6c 67 6f 00 00 10 dd cd 64 10 e9 21 34 1a ; .algo.....d..!4.\n"
++     "\t8e e0 a1 9a 30 fc 3b d1 00 02 00 03 00 05 6f 74 ; ....0.;.......ot\n"
++     "\t68 65 72 )\t\t\t\t\t; her");
++  T (ns_t_a6,
++     "\0\x20\x01\x0d\xb8\0\0\0\0\0\0\0\0\0\0\x12\x34\6prefix\xc0\x10",
++     "www.example.org.\t1D IN A6\t0 2001:db8::1234");
++  T (ns_t_a6,
++     "\0\x20\x01\x0d\xb8\0\0\0\0\0\0\0\0\0\0\x12\x35",
++     "www.example.org.\t1D IN A6\t0 2001:db8::1235");
++  T (ns_t_a6, "\200\6prefix\xc0\x10",
++     "www.example.org.\t1D IN A6\t128  prefix.example.org.");
++  T (ns_t_a6, "\x20\0\0\0\0\0\0\0\0\0\0\x12\x36\6prefix\xc0\x10",
++     "www.example.org.\t1D IN A6\t32 ::1236 prefix.example.org.");
++#undef T
++
++  support_next_to_fault_free (&ntf_in);
++  support_next_to_fault_free (&ntf_out);
++  return 0;
++}
++
++#include <support/test-driver.c>
+
+commit 7414631f8aec8b9cee1a8311506e1fdcd9b94c0d
+Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
+Date:   Tue Apr 14 10:50:37 2026 -0300
+
+    posix: Fix stack overflow in wordexp tilde expansion (BZ 34091, CVE-2026-6791)
+    
+    The parse_tilde function previously used strndupa to allocate memory
+    for the parsed username on the stack, and since the input is
+    user-defined, this can lead to a stack overflow.
+    
+    This patch fixes the issue by replacing strndupa with scratch_buffer,
+    by reusing the buffer used in the __getpwnam_r call.
+    
+    The new “tst-wordexp-tilde.c” test is a test-container to avoid using
+    system-defined NSS modules.
+    
+    Checked on x86_64-linux-gnu and i686-linux-gnu.
+    
+    (cherry picked from commit 07c24f35392b727e6100d33edfdf811a6c68c218)
+
+diff --git a/posix/Makefile b/posix/Makefile
+index 0b29c9aa4e..595c6b3ec2 100644
+--- a/posix/Makefile
++++ b/posix/Makefile
+@@ -356,6 +356,7 @@ tests-internal := \
+ tests-container := \
+   bug-ga2 \
+   tst-vfork3 \
++  tst-wordexp-tilde \
+   # tests-container
+ 
+ tests-time64 := \
+diff --git a/posix/tst-wordexp-tilde.c b/posix/tst-wordexp-tilde.c
+new file mode 100644
+index 0000000000..1661603681
+--- /dev/null
++++ b/posix/tst-wordexp-tilde.c
+@@ -0,0 +1,244 @@
++/* Test wordexp tilde expansion with large usernames (BZ 34091).
++   Copyright (C) 2026 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <pwd.h>
++#include <stdio.h>
++#include <string.h>
++#include <wordexp.h>
++#include <stdlib.h>
++#include <sys/resource.h>
++
++#include <support/check.h>
++#include <support/support.h>
++#include <support/xunistd.h>
++#include <support/namespace.h>
++
++typedef void (*func_callback_t)(void);
++
++static void
++subprocess_small_stack (void *closure)
++{
++  struct rlimit rl;
++  TEST_COMPARE (getrlimit (RLIMIT_STACK, &rl), 0);
++  rl.rlim_cur = 512 * 1024;
++  TEST_COMPARE (setrlimit (RLIMIT_STACK, &rl), 0);
++
++  func_callback_t func_test = closure;
++  func_test ();
++}
++
++/* Build a string "~<padding>/tail" where <padding> is LEN bytes of the
++   character CH.  The caller must free the result.  */
++static char *
++make_tilde_input (char ch, size_t len, const char *tail)
++{
++  /* ~  +  len  +  /  +  tail  +  \0 */
++  size_t taillen = tail != NULL ? strlen (tail) : 0;
++  size_t total = 1 + len + 1 + taillen + 1;
++  char *buf = xmalloc (total);
++  buf[0] = '~';
++  memset (buf + 1, ch, len);
++  buf[1 + len] = '/';
++  if (tail != NULL)
++    memcpy (buf + 1 + len + 1, tail, taillen);
++  buf[total - 1] = '\0';
++  return buf;
++}
++
++/* Test 1: A very long username must not crash.  The username will not match
++   any real user, so wordexp returns ~<long>/rest.  */
++static void
++test_long_username (void)
++{
++  printf ("info: test_long_username_no_crash\n");
++
++  static const char REST[] = "rest";
++
++  /* 1 MiB username — well beyond any reasonable stack frame.  */
++  const size_t long_len = 1024 * 1024;
++  char *input = make_tilde_input ('A', long_len, REST);
++
++  wordexp_t we = { 0 };
++  int ret = wordexp (input, &we, 0);
++  /* The (non-existent) username is invalid, so wordexp falls back to
++     literal output: ~AAA…/rest.  */
++  TEST_COMPARE (ret, 0);
++  TEST_COMPARE (we.we_wordc, 1);
++
++  /* Verify prefix: '~' followed by long_len 'A's.  */
++  const char *result = we.we_wordv[0];
++  TEST_COMPARE (result[0], '~');
++  TEST_COMPARE (strlen (result),
++	        1 /* ~ */ + long_len + sizeof (REST));
++  for (size_t j = 1; j <= long_len; j++)
++    if (result[j] != 'A')
++      {
++	printf ("  mismatch at position %zu: expected 'A', got '%c'\n",
++		j, result[j]);
++	support_record_failure ();
++	break;
++      }
++  /* Verify the tail after the username.  */
++  TEST_COMPARE_STRING (result + 1 + long_len, "/rest");
++
++  wordfree (&we);
++  free (input);
++}
++
++/* Test 2: A username that just exceeds the default scratch_buffer inline
++   size (1024 bytes) exercises the scratch_buffer_set_array_size growth path
++   without being excessively large.  */
++static void
++test_scratch_buffer_growth (void)
++{
++  printf ("info: test_scratch_buffer_growth\n");
++
++  const size_t len = 2048;
++  char *input = make_tilde_input ('x', len, NULL);
++
++  wordexp_t we = { 0 };
++  int ret = wordexp (input, &we, 0);
++  TEST_COMPARE (ret, 0);
++  TEST_COMPARE (we.we_wordc, 1);
++
++  /* ~xxx…/ — the trailing slash makes a separate empty component, but
++     wordexp merges it into the single token ~xxx…/.  */
++  const char *result = we.we_wordv[0];
++  TEST_COMPARE (result[0], '~');
++  for (size_t j = 1; j <= len; j++)
++    if (result[j] != 'x')
++      {
++	printf ("  mismatch at position %zu\n", j);
++	support_record_failure ();
++	break;
++      }
++  TEST_COMPARE (result[1 + len], '/');
++
++  wordfree (&we);
++  free (input);
++}
++
++/* Test 3: ~root still resolves to the correct home directory through the
++   __getpwnam_r path.  */
++static void
++test_known_user (void)
++{
++  printf ("info: test_known_user\n");
++
++  /* Look up root's home directory for comparison.  */
++  struct passwd *pw = getpwnam ("root");
++  if (pw == NULL || pw->pw_dir == NULL)
++    {
++      printf ("  SKIP: cannot look up root\n");
++      return;
++    }
++
++  char *expected = xasprintf ("%s/file", pw->pw_dir);
++
++  wordexp_t we = { 0 };
++  TEST_COMPARE (wordexp ("~root/file", &we, 0), 0);
++  TEST_COMPARE (we.we_wordc, 1);
++  TEST_COMPARE_STRING (we.we_wordv[0], expected);
++
++  wordfree (&we);
++  free (expected);
++}
++
++/* Test 4: Bare tilde expands to $HOME.  */
++static void
++test_bare_tilde (void)
++{
++  printf ("info: test_bare_tilde\n");
++
++  const char *home = getenv ("HOME");
++  if (home == NULL)
++    {
++      printf ("  SKIP: HOME is not set\n");
++      return;
++    }
++
++  wordexp_t we = { 0 };
++  TEST_COMPARE (wordexp ("~", &we, 0), 0);
++  TEST_COMPARE (we.we_wordc, 1);
++  TEST_COMPARE_STRING (we.we_wordv[0], home);
++
++  wordfree (&we);
++}
++
++/* Test 5: Short non-existent username falls back to literal ~username output,
++   exercising the invalid-login-name path.  */
++static void
++test_unknown_user (void)
++{
++  printf ("info: test_unknown_user\n");
++
++  /* Pick a username that is extremely unlikely to exist.  */
++  wordexp_t we = { 0 };
++  TEST_COMPARE (wordexp ("~no_such_user_xyzzy42", &we, 0), 0);
++  TEST_COMPARE (we.we_wordc, 1);
++  TEST_COMPARE_STRING (we.we_wordv[0], "~no_such_user_xyzzy42");
++
++  wordfree (&we);
++}
++
++/* Test 6: Tilde with username and WRDE_APPEND — exercises parse_tilde's
++   interaction with the WRDE_APPEND word list.  */
++static void
++test_tilde_with_append (void)
++{
++  printf ("info: test_tilde_with_append\n");
++
++  const char *home = getenv ("HOME");
++  if (home == NULL)
++    {
++      printf ("  SKIP: HOME is not set\n");
++      return;
++    }
++
++  wordexp_t we = { 0 };
++  TEST_COMPARE (wordexp ("first", &we, 0), 0);
++
++  TEST_COMPARE (wordexp ("~/path", &we, WRDE_APPEND), 0);
++  TEST_COMPARE (we.we_wordc, 2);
++  TEST_COMPARE_STRING (we.we_wordv[0], "first");
++
++  char *expected = xasprintf ("%s/path", home);
++  TEST_COMPARE_STRING (we.we_wordv[1], expected);
++
++  wordfree (&we);
++  free (expected);
++}
++
++static int
++do_test (void)
++{
++  test_known_user ();
++  test_bare_tilde ();
++  test_unknown_user ();
++  test_tilde_with_append ();
++
++  support_isolate_in_subprocess (subprocess_small_stack,
++				 test_long_username);
++
++  support_isolate_in_subprocess (subprocess_small_stack,
++				 test_scratch_buffer_growth);
++
++  return 0;
++}
++
++#include <support/test-driver.c>
+diff --git a/posix/tst-wordexp-tilde.root/etc/group b/posix/tst-wordexp-tilde.root/etc/group
+new file mode 100644
+index 0000000000..1dbf9013ee
+--- /dev/null
++++ b/posix/tst-wordexp-tilde.root/etc/group
+@@ -0,0 +1 @@
++root:x:0:
+diff --git a/posix/tst-wordexp-tilde.root/etc/nsswitch.conf b/posix/tst-wordexp-tilde.root/etc/nsswitch.conf
+new file mode 100644
+index 0000000000..098a8d5938
+--- /dev/null
++++ b/posix/tst-wordexp-tilde.root/etc/nsswitch.conf
+@@ -0,0 +1,3 @@
++passwd: files
++group:  files
++shadow: files
+diff --git a/posix/tst-wordexp-tilde.root/etc/passwd b/posix/tst-wordexp-tilde.root/etc/passwd
+new file mode 100644
+index 0000000000..eb85a552ad
+--- /dev/null
++++ b/posix/tst-wordexp-tilde.root/etc/passwd
+@@ -0,0 +1 @@
++root:x:0:0:root:/root:/bin/sh
+diff --git a/posix/wordexp.c b/posix/wordexp.c
+index 9df4bb7424..731d1650e9 100644
+--- a/posix/wordexp.c
++++ b/posix/wordexp.c
+@@ -335,17 +335,29 @@ parse_tilde (char **word, size_t *word_length, size_t *max_length,
+   else
+     {
+       /* Look up user name in database to get home directory */
+-      char *user = strndupa (&words[1 + *offset], i - (1 + *offset));
+-      struct passwd pwd, *tpwd;
+-      int result;
++      size_t userlen = i - (1 + *offset);
++      /* tmpbuf contains both the user and the __getpwnam_r working area.  */
+       struct scratch_buffer tmpbuf;
+       scratch_buffer_init (&tmpbuf);
++      if (!scratch_buffer_set_array_size (&tmpbuf, userlen + 1, 1))
++	return WRDE_NOSPACE;
++      char *user = tmpbuf.data;
++      memcpy (user, &words[1 + *offset], userlen);
++      user[userlen] = '\0';
+ 
+-      while ((result = __getpwnam_r (user, &pwd, tmpbuf.data, tmpbuf.length,
++      struct passwd pwd, *tpwd;
++      int result;
++      while ((result = __getpwnam_r (user,
++				     &pwd,
++				     tmpbuf.data + userlen + 1,
++				     tmpbuf.length - userlen - 1,
+ 				     &tpwd)) != 0
+ 	     && errno == ERANGE)
+-	if (!scratch_buffer_grow (&tmpbuf))
+-	  return WRDE_NOSPACE;
++	{
++	  if (!scratch_buffer_grow_preserve (&tmpbuf))
++	    return WRDE_NOSPACE;
++	  user = tmpbuf.data;
++	}
+ 
+       if (result == 0 && tpwd != NULL && pwd.pw_dir)
+ 	*word = w_addstr (*word, word_length, max_length, pwd.pw_dir);
+
+commit 8be3551ccb4e17e93ad82152de56d2c90de21f97
+Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
+Date:   Mon Apr 13 16:33:30 2026 -0300
+
+    posix: Fix wordexp WRDE_APPEND to preserve state on non-NOSPACE errors (BZ 34090, CVE-2026-6368)
+    
+    The previous implementation saved a copy of the wordexp_t struct at
+    entry and blindly restored it on error via (*pwordexp = old_word).
+    This is incorrect when WRDE_APPEND is set because w_addword may have
+    called realloc on we_wordv during partial processing before the error
+    was detected.  If realloc relocated the buffer, the saved we_wordv
+    pointer is dangling; restoring it causes a use-after-free in the
+    caller (e.g. via wordfree), and the relocated buffer is leaked.
+    
+    Fix this by duplicating the we_wordv pointer array at entry when
+    WRDE_APPEND is set, so that all subsequent realloc calls inside
+    w_addword operate on the copy.
+    
+    This change also fixes a POSIX conformance issue: if the WRDE_APPEND
+    flag is specified, pwordexp->we_wordc and pwordexp->we_wordv shall
+    not be modified.
+    
+    Also fix two pre-existing error return paths in the '"' and '\'' cases
+    that returned directly from w_addword failures instead of going through
+    do_error, which would leak the saved array (and previously would also
+    skip the word cleanup).
+    
+    Checked on x86_64-linux-gnu and i686-linux-gnu.
+    
+    Reviewed-by: DJ Delorie <dj@redhat.com>
+    (cherry picked from commit e2cefe16c37a617df9f11407cb00a272a6098823)
+
+diff --git a/posix/Makefile b/posix/Makefile
+index 595c6b3ec2..a12c49c0ed 100644
+--- a/posix/Makefile
++++ b/posix/Makefile
+@@ -326,6 +326,7 @@ tests := \
+   tst-wait3 \
+   tst-wait4 \
+   tst-waitid \
++  tst-wordexp-append \
+   tst-wordexp-nocmd \
+   tst-wordexp-reuse \
+   tstgetopt \
+diff --git a/posix/tst-wordexp-append.c b/posix/tst-wordexp-append.c
+new file mode 100644
+index 0000000000..87f388f0a7
+--- /dev/null
++++ b/posix/tst-wordexp-append.c
+@@ -0,0 +1,393 @@
++/* Test for wordexp with WRDE_APPEND flag.
++   Copyright (C) 2026 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <wordexp.h>
++#include <string.h>
++#include <stdio.h>
++#include <stdlib.h>
++#include <malloc.h>
++
++#include <support/check.h>
++#include <support/support.h>
++
++static unsigned int relocating_reallocs;
++
++/* w_addword grows we_wordv with realloc, make every call guaranteed to
++   relocate the block.  This makes BZ 34090 regression more deterministic.  */
++void *
++realloc (void *ptr, size_t size)
++{
++  if (ptr == NULL)
++    return malloc (size);
++  if (size == 0)
++    {
++      free (ptr);
++      return NULL;
++    }
++
++  void *new = malloc (size);
++  if (new == NULL)
++    return NULL;
++
++  /* Copy only what is valid in the old block to avoid reading past it.  */
++  size_t old = malloc_usable_size (ptr);
++  memcpy (new, ptr, old < size ? old : size);
++  /* Clobber the old block so that a stale we_wordv pointer restored on the
++     error path reads garbage instead of the old contents, which might
++     otherwise survive intact and mask the bug.  */
++  memset (ptr, 0x5a, old);
++  free (ptr);
++  relocating_reallocs++;
++  return new;
++}
++
++/* Verify that all words in we match the expected NULL-terminated
++   array.  */
++static void
++check_words (const wordexp_t *we, const char *const *expected)
++{
++  size_t i;
++  for (i = 0; expected[i] != NULL; i++)
++    {
++      TEST_VERIFY (i < we->we_wordc);
++      TEST_COMPARE_STRING (we->we_wordv[we->we_offs + i], expected[i]);
++    }
++  TEST_COMPARE (we->we_wordc, i);
++}
++
++#define CHECK_WORDS(we, ...) \
++  do {								\
++    const char *const expected_[] = { __VA_ARGS__, NULL };	\
++    check_words (we, expected_);				\
++  } while (0)
++
++/* Test 1: WRDE_APPEND + WRDE_BADCHAR preserves we_wordc.  */
++static void
++test_append_badchar_preserves_count (void)
++{
++  printf ("info: test_append_badchar_preserves_count\n");
++  wordexp_t we = { 0 };
++
++  TEST_COMPARE (wordexp ("one two three", &we, 0), 0);
++  TEST_COMPARE (we.we_wordc, 3);
++
++  size_t saved_count = we.we_wordc;
++
++  /* ')' triggers WRDE_BADCHAR and  "extra" would be a new word if the
++     expansion succeeded, exercising the w_addword path before the error
++     is detected.  */
++  TEST_COMPARE (wordexp ("extra )", &we, WRDE_APPEND), WRDE_BADCHAR);
++  TEST_COMPARE (we.we_wordc, saved_count);
++
++  wordfree (&we);
++}
++
++/* Test 2: WRDE_APPEND + WRDE_BADCHAR preserves the we_wordv pointer even
++   when internal realloc would move the buffer.  */
++static void
++test_append_badchar_preserves_pointer (void)
++{
++  printf ("info: test_append_badchar_preserves_pointer\n");
++  wordexp_t we = { 0 };
++
++  /* Use many words so that the initial we_wordv allocation is
++     non-trivial and a later realloc is more likely to move it.  */
++  TEST_COMPARE (wordexp ("a b c d e f g h", &we, 0), 0);
++  TEST_COMPARE (we.we_wordc, 8);
++
++  char **saved_wordv = we.we_wordv;
++  size_t saved_count = we.we_wordc;
++  unsigned int saved_reallocs = relocating_reallocs;
++
++  /* The interposed realloc guarantees the internal we_wordv buffer moves
++     during parsing, so the pointer-stability check below is meaningful.  */
++  TEST_COMPARE (wordexp ("append )", &we, WRDE_APPEND), WRDE_BADCHAR);
++  /* Verify that a relocating realloc actually happened during the failed
++     call, otherwise the pointer-stability check is vacuous.  */
++  TEST_VERIFY (relocating_reallocs > saved_reallocs);
++  TEST_COMPARE (we.we_wordc, saved_count);
++  TEST_VERIFY (we.we_wordv == saved_wordv);
++
++  wordfree (&we);
++}
++
++/* Test 3: After a failed WRDE_APPEND the original words are still accessible
++   and correct.  */
++static void
++test_append_badchar_words_intact (void)
++{
++  printf ("info: test_append_badchar_words_intact\n");
++  wordexp_t we = { 0 };
++
++  TEST_COMPARE (wordexp ("alpha beta gamma", &we, 0), 0);
++  CHECK_WORDS (&we, "alpha", "beta", "gamma");
++
++  TEST_COMPARE (wordexp ("delta )", &we, WRDE_APPEND), WRDE_BADCHAR);
++
++  /* Words must still be intact.  */
++  CHECK_WORDS (&we, "alpha", "beta", "gamma");
++  /* The NULL terminator must still be present.  */
++  TEST_VERIFY (we.we_wordv[we.we_offs + we.we_wordc] == NULL);
++
++  wordfree (&we);
++}
++
++/* Test 4: Successful WRDE_APPEND still works (regression test).  */
++static void
++test_append_success (void)
++{
++  printf ("info: test_append_success\n");
++  wordexp_t we = { 0 };
++
++  TEST_COMPARE (wordexp ("hello", &we, 0), 0);
++  TEST_COMPARE (we.we_wordc, 1);
++
++  char **saved_wordv = we.we_wordv;
++
++  TEST_COMPARE (wordexp ("world", &we, WRDE_APPEND), 0);
++  TEST_COMPARE (we.we_wordc, 2);
++  /* A successful append works on a fresh copy of the array, so the
++     caller-visible pointer must have changed.  */
++  TEST_VERIFY (we.we_wordv != saved_wordv);
++  CHECK_WORDS (&we, "hello", "world");
++
++  wordfree (&we);
++}
++
++/* Test 5: Successful append after a failed append — the implementation must
++   recover and allow further use of the wordexp_t.  */
++static void
++test_append_success_after_failure (void)
++{
++  printf ("info: test_append_success_after_failure\n");
++  wordexp_t we = { 0 };
++
++  TEST_COMPARE (wordexp ("first", &we, 0), 0);
++  CHECK_WORDS (&we, "first");
++
++  TEST_COMPARE (wordexp ("bad |", &we, WRDE_APPEND), WRDE_BADCHAR);
++
++  /* State must be exactly as before the failed call.  */
++  CHECK_WORDS (&we, "first");
++
++  /* A subsequent successful append must work.  */
++  TEST_COMPARE (wordexp ("second third", &we, WRDE_APPEND), 0);
++  CHECK_WORDS (&we, "first", "second", "third");
++
++  wordfree (&we);
++}
++
++/* Test 6: Multiple consecutive failed appends do not corrupt state.  */
++static void
++test_append_multiple_failures (void)
++{
++  printf ("info: test_append_multiple_failures\n");
++  wordexp_t we = { 0 };
++
++  TEST_COMPARE (wordexp ("keep this", &we, 0), 0);
++  CHECK_WORDS (&we, "keep", "this");
++
++  size_t saved_count = we.we_wordc;
++  char **saved_wordv = we.we_wordv;
++
++  /* Each of these bad characters must leave the state unchanged.  */
++  TEST_COMPARE (wordexp ("x )", &we, WRDE_APPEND), WRDE_BADCHAR);
++  TEST_COMPARE (wordexp ("x |", &we, WRDE_APPEND), WRDE_BADCHAR);
++  TEST_COMPARE (wordexp ("x ;", &we, WRDE_APPEND), WRDE_BADCHAR);
++  TEST_COMPARE (wordexp ("x &", &we, WRDE_APPEND), WRDE_BADCHAR);
++  TEST_COMPARE (wordexp ("x <", &we, WRDE_APPEND), WRDE_BADCHAR);
++  TEST_COMPARE (wordexp ("x >", &we, WRDE_APPEND), WRDE_BADCHAR);
++
++  TEST_COMPARE (we.we_wordc, saved_count);
++  TEST_VERIFY (we.we_wordv == saved_wordv);
++  CHECK_WORDS (&we, "keep", "this");
++
++  wordfree (&we);
++}
++
++/* Test 7: WRDE_APPEND with WRDE_SYNTAX error (unterminated quote) also
++   preserves state.  */
++static void
++test_append_syntax_error (void)
++{
++  printf ("info: test_append_syntax_error\n");
++  wordexp_t we = { 0 };
++
++  TEST_COMPARE (wordexp ("original", &we, 0), 0);
++  CHECK_WORDS (&we, "original");
++
++  char **saved_wordv = we.we_wordv;
++  size_t saved_count = we.we_wordc;
++
++  /* Unterminated double quote triggers WRDE_SYNTAX.  */
++  TEST_COMPARE (wordexp ("\"unterminated", &we, WRDE_APPEND), WRDE_SYNTAX);
++
++  TEST_COMPARE (we.we_wordc, saved_count);
++  TEST_VERIFY (we.we_wordv == saved_wordv);
++  CHECK_WORDS (&we, "original");
++
++  wordfree (&we);
++}
++
++/* Test 8: Error without WRDE_APPEND still works (regression test for the
++   non-APPEND code path in do_error).  */
++static void
++test_no_append_error (void)
++{
++  printf ("info: test_no_append_error\n");
++  wordexp_t we = { 0 };
++
++  /* Simple failure without WRDE_APPEND.  */
++  TEST_COMPARE (wordexp ("bad |", &we, 0), WRDE_BADCHAR);
++
++  /* After failure without WRDE_APPEND the struct should be safe to
++     reuse — start fresh.  */
++  TEST_COMPARE (wordexp ("ok", &we, 0), 0);
++  CHECK_WORDS (&we, "ok");
++
++  wordfree (&we);
++}
++
++/* Test 9: WRDE_BADCHAR on the very first character (no partial words added
++   before the error).  */
++static void
++test_append_badchar_immediate (void)
++{
++  printf ("info: test_append_badchar_immediate\n");
++  wordexp_t we = { 0 };
++
++  TEST_COMPARE (wordexp ("hello world", &we, 0), 0);
++  CHECK_WORDS (&we, "hello", "world");
++
++  char **saved_wordv = we.we_wordv;
++  size_t saved_count = we.we_wordc;
++
++  /* The bad character is the very first byte — no w_addword call happens
++     before the error.  */
++  TEST_COMPARE (wordexp ("|", &we, WRDE_APPEND), WRDE_BADCHAR);
++  TEST_COMPARE (we.we_wordc, saved_count);
++  TEST_VERIFY (we.we_wordv == saved_wordv);
++
++  wordfree (&we);
++}
++
++/* Test 10: WRDE_APPEND into an empty wordexp_t (initial call uses WRDE_APPEND
++   with a zeroed struct — unusual but allowed).  */
++static void
++test_append_into_empty (void)
++{
++  printf ("info: test_append_into_empty\n");
++  wordexp_t we = { 0 };
++
++  /* First call with WRDE_APPEND on a zeroed struct.  The implementation
++     must handle we_wordv == NULL gracefully.  */
++  TEST_COMPARE (wordexp ("solo", &we, WRDE_APPEND), 0);
++  TEST_COMPARE (we.we_wordc, 1);
++  CHECK_WORDS (&we, "solo");
++
++  wordfree (&we);
++}
++
++/* Verify that the leading we_offs slots are all NULL.  */
++static void
++check_offs_null (const wordexp_t *we)
++{
++  for (size_t i = 0; i < we->we_offs; i++)
++    TEST_VERIFY (we->we_wordv[i] == NULL);
++}
++
++/* Test 11: successful WRDE_APPEND with WRDE_DOOFFS and a non-zero we_offs.
++   The leading offset slots must stay NULL and words must land at
++   we_wordv[we_offs + i] across both the initial and the appended call.  */
++static void
++test_dooffs_append_success (void)
++{
++  printf ("info: test_dooffs_append_success\n");
++  wordexp_t we = { 0 };
++  we.we_offs = 2;
++
++  TEST_COMPARE (wordexp ("one two", &we, WRDE_DOOFFS), 0);
++  TEST_COMPARE (we.we_offs, 2);
++  check_offs_null (&we);
++  CHECK_WORDS (&we, "one", "two");
++
++  TEST_COMPARE (wordexp ("three", &we, WRDE_APPEND | WRDE_DOOFFS), 0);
++  TEST_COMPARE (we.we_offs, 2);
++  check_offs_null (&we);
++  CHECK_WORDS (&we, "one", "two", "three");
++  /* The NULL terminator must sit right after the last word.  */
++  TEST_VERIFY (we.we_wordv[we.we_offs + we.we_wordc] == NULL);
++
++  wordfree (&we);
++}
++
++/* Test 12: failed WRDE_APPEND with WRDE_DOOFFS preserves we_wordc, the
++   we_wordv pointer, the words and the leading NULL offset slots.  This
++   exercises the we_offs arithmetic in the array duplication and in the
++   error-path cleanup (we_wordv[we_offs + --we_wordc]).  */
++static void
++test_dooffs_append_error_preserves_state (void)
++{
++  printf ("info: test_dooffs_append_error_preserves_state\n");
++  wordexp_t we = { 0 };
++  we.we_offs = 3;
++
++  TEST_COMPARE (wordexp ("alpha beta", &we, WRDE_DOOFFS), 0);
++  check_offs_null (&we);
++  CHECK_WORDS (&we, "alpha", "beta");
++
++  char **saved_wordv = we.we_wordv;
++  size_t saved_count = we.we_wordc;
++  unsigned int saved_reallocs = relocating_reallocs;
++
++  /* "gamma" is a partial word added via w_addword (forcing a relocating
++     realloc of we_wordv) before ')' triggers WRDE_BADCHAR.  */
++  TEST_COMPARE (wordexp ("gamma )", &we, WRDE_APPEND | WRDE_DOOFFS),
++		WRDE_BADCHAR);
++  TEST_VERIFY (relocating_reallocs > saved_reallocs);
++
++  TEST_COMPARE (we.we_offs, 3);
++  TEST_COMPARE (we.we_wordc, saved_count);
++  TEST_VERIFY (we.we_wordv == saved_wordv);
++  check_offs_null (&we);
++  CHECK_WORDS (&we, "alpha", "beta");
++  TEST_VERIFY (we.we_wordv[we.we_offs + we.we_wordc] == NULL);
++
++  wordfree (&we);
++}
++
++static int
++do_test (void)
++{
++  test_append_badchar_preserves_count ();
++  test_append_badchar_preserves_pointer ();
++  test_append_badchar_words_intact ();
++  test_append_success ();
++  test_append_success_after_failure ();
++  test_append_multiple_failures ();
++  test_append_syntax_error ();
++  test_no_append_error ();
++  test_append_badchar_immediate ();
++  test_append_into_empty ();
++  test_dooffs_append_success ();
++  test_dooffs_append_error_preserves_state ();
++
++  return 0;
++}
++
++#include <support/test-driver.c>
+diff --git a/posix/wordexp.c b/posix/wordexp.c
+index 731d1650e9..50b0d7a256 100644
+--- a/posix/wordexp.c
++++ b/posix/wordexp.c
+@@ -35,6 +35,7 @@
+ #include <scratch_buffer.h>
+ #include <_itoa.h>
+ #include <assert.h>
++#include <intprops.h>
+ 
+ /*
+  * This is a recursive-descent-style word expansion routine.
+@@ -2224,6 +2225,12 @@ wordexp (const char *words, wordexp_t *pwordexp, int flags)
+   char ifs_white[4];
+   wordexp_t old_word = *pwordexp;
+ 
++  /* When WRDE_APPEND is set we work on a copy of the we_wordv array so that
++     the caller's original pointer is never invalidated by realloc inside
++     w_addword.  The saved_wordv keeps the original; on success we free it,
++     on non-NOSPACE error we free the working copy and restore the original.  */
++  char **saved_wordv = NULL;
++
+   if (flags & WRDE_REUSE)
+     {
+       /* Minimal implementation of WRDE_REUSE for now */
+@@ -2258,6 +2265,23 @@ wordexp (const char *words, wordexp_t *pwordexp, int flags)
+ 	  pwordexp->we_offs = 0;
+ 	}
+     }
++  else if (pwordexp->we_wordv != NULL)
++    {
++      /* WRDE_APPEND with an existing word list: duplicate the array so that
++	 realloc during parsing does not invalidate the caller's pointer.  The
++	 strings themselves are shared.  */
++      size_t num_p;
++      char **dup;
++      if (INT_ADD_WRAPV (pwordexp->we_offs, pwordexp->we_wordc, &num_p)
++	  || INT_ADD_WRAPV (num_p, 1, &num_p))
++	return WRDE_NOSPACE;
++      dup = __libc_reallocarray (NULL, num_p, sizeof *dup);
++      if (dup == NULL)
++	return WRDE_NOSPACE;
++      memcpy (dup, pwordexp->we_wordv, num_p * sizeof *dup);
++      saved_wordv = pwordexp->we_wordv;
++      pwordexp->we_wordv = dup;
++    }
+ 
+   /* Find out what the field separators are.
+    * There are two types: whitespace and non-whitespace.
+@@ -2338,7 +2362,7 @@ wordexp (const char *words, wordexp_t *pwordexp, int flags)
+ 	    error = w_addword (pwordexp, NULL);
+ 
+ 	    if (error)
+-	      return error;
++	      goto do_error;
+ 	  }
+ 
+ 	break;
+@@ -2356,7 +2380,7 @@ wordexp (const char *words, wordexp_t *pwordexp, int flags)
+ 	    error = w_addword (pwordexp, NULL);
+ 
+ 	    if (error)
+-	      return error;
++	      goto do_error;
+ 	  }
+ 
+ 	break;
+@@ -2422,10 +2446,18 @@ wordexp (const char *words, wordexp_t *pwordexp, int flags)
+ 
+   /* There was a word separator at the end */
+   if (word == NULL) /* i.e. w_newword */
+-    return 0;
++    {
++      free (saved_wordv);
++      return 0;
++    }
+ 
+-  /* There was no field separator at the end */
+-  return w_addword (pwordexp, word);
++  /* There was no field separator at the end.  The only possible error
++     from w_addword is WRDE_NOSPACE.  */
++  error = w_addword (pwordexp, word);
++  if (error != 0)
++    goto do_error;
++  free (saved_wordv);
++  return 0;
+ 
+ do_error:
+   /* Error:
+@@ -2436,11 +2468,30 @@ do_error:
+   free (word);
+ 
+   if (error == WRDE_NOSPACE)
+-    return WRDE_NOSPACE;
++    {
++      /* we_wordc and we_wordv are updated to reflect any words that were
++	 successfully expanded.  The old array is obsolete.  */
++      free (saved_wordv);
++      return WRDE_NOSPACE;
++    }
+ 
+-  if ((flags & WRDE_APPEND) == 0)
+-    wordfree (pwordexp);
++  if (flags & WRDE_APPEND)
++    {
++      /* POSIX 2024 states that for in other error cases, if the WRDE_APPEND
++	 flag was specified, we_wordc and we_wordv shall not be modified.
++
++	 Free strings appended during this call, discard the working copy of
++	 we_wordv, and restore the caller's original pointer.  */
++      while (pwordexp->we_wordc > old_word.we_wordc)
++	free (pwordexp->we_wordv[pwordexp->we_offs + --pwordexp->we_wordc]);
++      free (pwordexp->we_wordv);
++      pwordexp->we_wordv = saved_wordv;
++    }
++  else
++    {
++      wordfree (pwordexp);
++      *pwordexp = old_word;
++    }
+ 
+-  *pwordexp = old_word;
+   return error;
+ }
diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index ab48390cc82f..4db1dac187ed 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -51,7 +51,7 @@
 
 let
   version = "2.42";
-  patchSuffix = "-67";
+  patchSuffix = "-84";
   sha256 = "sha256-0XdeMuRijmTvkw9DW2e7Y691may2viszW58Z8WUJ8X8=";
 in
 
@@ -116,15 +116,6 @@ stdenv.mkDerivation (
       # enable parallel & reproducible build of glibcLocales
       ./0001-localedata-allow-reproducible-parallel-install-of-lo.patch
       ./0002-Makeconfig-make-inst_complocaledir-overridable.patch
-
-      # Security fixes.
-      #
-      # Can be dropped on 2.44. The first patch is only to make it
-      # easier to backport the fix for CVE-2026-6238 and it seems
-      # useful in its own right anyhow.
-      ./0001-resolv-Check-for-inet_ntop-failure-in-ns_sprintrrf.patch
-      ./0002-resolv-More-types-as-unknown-in-ns_sprintrrf-CVE-202.patch
-      ./0003-resolv-Fix-buffer-overreads-in-ns_sprintrrf-CVE-2026.patch
     ]
     /*
       NVCC does not support ARM intrinsics. Since <math.h> is pulled in by almost
@@ -354,6 +345,8 @@ stdenv.mkDerivation (
 
       doCheck = false; # fails
 
+      __structuredAttrs = true;
+
       meta =
 
         {
diff --git a/pkgs/development/libraries/gmp/6.x.nix b/pkgs/development/libraries/gmp/6.x.nix
index 76b54b479c5d..6a81bdf49c04 100644
--- a/pkgs/development/libraries/gmp/6.x.nix
+++ b/pkgs/development/libraries/gmp/6.x.nix
@@ -14,19 +14,19 @@
 # files.
 
 let
-  inherit (lib) optional;
+  inherit (lib) optionals;
 in
 
 let
-  self = stdenv.mkDerivation rec {
+  self = stdenv.mkDerivation (finalAttrs: {
     pname = "gmp${lib.optionalString cxx "-with-cxx"}";
     version = "6.3.0";
 
     src = fetchurl {
       # we need to use bz2, others aren't in bootstrapping stdenv
       urls = [
-        "mirror://gnu/gmp/gmp-${version}.tar.bz2"
-        "ftp://ftp.gmplib.org/pub/gmp-${version}/gmp-${version}.tar.bz2"
+        "mirror://gnu/gmp/gmp-${finalAttrs.version}.tar.bz2"
+        "ftp://ftp.gmplib.org/pub/gmp-${finalAttrs.version}/gmp-${finalAttrs.version}.tar.bz2"
       ];
       hash = "sha256-rCghGnz7YJuuLiyNYFjWbI/pZDT3QM9v4uR7AA0cIMs=";
     };
@@ -65,11 +65,18 @@ let
       # broken on multicore CPUs). Avoid this impurity.
       "--build=${stdenv.buildPlatform.config}"
     ]
-    ++ optional (cxx && stdenv.hostPlatform.isDarwin) "CPPFLAGS=-fexceptions"
-    ++ optional (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.is64bit) "ABI=64"
+    ++ optionals (cxx && stdenv.hostPlatform.isDarwin) [
+      "CPPFLAGS=-fexceptions"
+    ]
+    ++ optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.is64bit) [
+      "ABI=64"
+    ]
     # to build a .dll on windows, we need --disable-static + --enable-shared
     # see https://gmplib.org/manual/Notes-for-Particular-Systems.html
-    ++ optional (!withStatic && stdenv.hostPlatform.isPE) "--disable-static --enable-shared";
+    ++ optionals (!withStatic && stdenv.hostPlatform.isPE) [
+      "--disable-static"
+      "--enable-shared"
+    ];
 
     doCheck = true; # not cross;
 
@@ -77,6 +84,8 @@ let
 
     enableParallelBuilding = true;
 
+    __structuredAttrs = true;
+
     meta = {
       homepage = "https://gmplib.org/";
       description = "GNU multiple precision arithmetic library";
@@ -112,6 +121,6 @@ let
       platforms = lib.platforms.all;
       maintainers = with lib.maintainers; [ coolcuber ];
     };
-  };
+  });
 in
 self
diff --git a/pkgs/development/libraries/gstreamer/bad/default.nix b/pkgs/development/libraries/gstreamer/bad/default.nix
index f470d9e7f161..d91572296421 100644
--- a/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/pkgs/development/libraries/gstreamer/bad/default.nix
@@ -116,7 +116,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-plugins-bad";
-  version = "1.28.5";
+  version = "1.28.6";
 
   outputs = [
     "out"
@@ -125,7 +125,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-plugins-bad/gst-plugins-bad-${finalAttrs.version}.tar.xz";
-    hash = "sha256-2K9V+u8pWMGoZjdRR17kb1Fkh3z02MWRPqkG7xgK63E=";
+    hash = "sha256-Zjbywiic7aUsSrqXEzjIHitXgNM4G9NnPBwRbsh1h8M=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/gstreamer/base/default.nix b/pkgs/development/libraries/gstreamer/base/default.nix
index 4415abbd5931..087c8c50b3d1 100644
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@@ -50,7 +50,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-plugins-base";
-  version = "1.28.5";
+  version = "1.28.6";
 
   outputs = [
     "out"
@@ -61,7 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-plugins-base/gst-plugins-base-${finalAttrs.version}.tar.xz";
-    hash = "sha256-d28ZIo+R/SW79U2YUFl+FYUH9ZSHKlK5toFOJCm0Pqo=";
+    hash = "sha256-C6aZx8bGb0umQL54yziiRxWt2Wg/PjoZn1Np3FpPBKw=";
   };
 
   __structuredAttrs = true;
@@ -129,37 +129,48 @@ stdenv.mkDerivation (finalAttrs: {
     libdrm
   ];
 
-  mesonFlags = [
-    "-Dglib_debug=disabled" # cast checks should be disabled on stable releases
-    "-Dexamples=disabled" # requires many dependencies and probably not useful for our users
-    # See https://github.com/GStreamer/gst-plugins-base/blob/d64a4b7a69c3462851ff4dcfa97cc6f94cd64aef/meson_options.txt#L15 for a list of choices
-    "-Dgl_winsys=${
-      lib.concatStringsSep "," (
+  mesonFlags =
+    let
+      # For a list of choices, see
+      # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/blob/d529453528a5dd11c15eab788cce6676141134b7/subprojects/gst-plugins-base/meson.options#L14-1
+      # unsupported platforms: win32, winrt, android
+      # deprecated/ancient platforms: dispmanx, eagl
+      # TODO: should we add egl, surfaceless, viv-fb, gbm?
+      # (on Linux, autodiscovery would automatically add egl and surfaceless)
+      # 'egl', 'surfaceless', 'viv-fb', 'gbm',
+      enabledGlWinSys =
         lib.optional enableX11 "x11"
         ++ lib.optional enableWayland "wayland"
-        ++ lib.optional enableCocoa "cocoa"
-      )
-    }"
-    (lib.mesonEnable "introspection" withIntrospection)
-    (lib.mesonEnable "doc" enableDocumentation)
-    (lib.mesonEnable "libvisual" false)
-    (lib.mesonEnable "tremor" false) # unmaintained in nixpkgs, just use regular libvorbis instead
-    (lib.mesonEnable "vorbis" true)
-  ]
-  ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
-    "-Dtests=disabled"
-  ]
-  ++ lib.optionals (!enableX11) [
-    "-Dx11=disabled"
-    "-Dxi=disabled"
-    "-Dxshm=disabled"
-    "-Dxvideo=disabled"
-  ]
-  # TODO How to disable Wayland?
-  ++ lib.optional (!enableGl) "-Dgl=disabled"
-  ++ lib.optional (!enableAlsa) "-Dalsa=disabled"
-  ++ lib.optional (!enableCdparanoia) "-Dcdparanoia=disabled"
-  ++ lib.optional stdenv.hostPlatform.isDarwin "-Ddrm=disabled";
+        ++ lib.optional enableCocoa "cocoa";
+    in
+    lib.mapAttrsToList lib.mesonEnable {
+      orc = true;
+      orc-compiler = true;
+      nls = true;
+
+      glib_debug = false; # cast checks should be disabled on stable releases
+      examples = false; # requires many dependencies and probably not useful for our users
+      introspection = withIntrospection;
+      doc = enableDocumentation;
+
+      tests = finalAttrs.finalPackage.doCheck;
+
+      libvisual = false;
+      tremor = false; # unmaintained in nixpkgs, just use regular libvorbis instead
+      vorbis = true;
+
+      x11 = enableX11;
+      xi = enableX11;
+      xshm = enableX11;
+      xvideo = enableX11;
+
+      # TODO How to disable Wayland?
+      gl = enableGl;
+      alsa = enableAlsa;
+      cdparanoia = enableCdparanoia;
+      drm = !stdenv.hostPlatform.isDarwin;
+    }
+    ++ [ (lib.mesonOption "gl_winsys" (lib.concatStringsSep "," enabledGlWinSys)) ];
 
   postPatch = ''
     patchShebangs \
@@ -194,20 +205,39 @@ stdenv.mkDerivation (finalAttrs: {
     waylandEnabled = enableWayland;
 
     updateScript = directoryListingUpdater { odd-unstable = true; };
-  };
 
-  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+    tests.pkg-config = testers.hasPkgConfigModules {
+      package = finalAttrs.finalPackage;
+      versionCheck = true;
+    };
+  };
 
   meta = {
     description = "Base GStreamer plug-ins and helper libraries";
     homepage = "https://gstreamer.freedesktop.org";
     license = lib.licenses.lgpl2Plus;
-    pkgConfigModules = [
-      "gstreamer-audio-1.0"
-      "gstreamer-base-1.0"
-      "gstreamer-net-1.0"
-      "gstreamer-video-1.0"
-    ];
+    pkgConfigModules = lib.map (m: "gstreamer-${m}-1.0") (
+      [
+        "allocators"
+        "app"
+        "audio"
+        "fft"
+        "pbutils"
+        "plugins-base"
+        "riff"
+        "rtp"
+        "rtsp"
+        "sdp"
+        "tag"
+      ]
+      ++ lib.optionals enableGl [
+        "gl"
+        "gl-egl"
+        "gl-prototypes"
+      ]
+      ++ lib.optional (enableGl && enableWayland) "gl-wayland"
+      ++ lib.optional (enableGl && enableX11) "gl-x11"
+    );
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ tmarkus ];
   };
diff --git a/pkgs/development/libraries/gstreamer/core/default.nix b/pkgs/development/libraries/gstreamer/core/default.nix
index fcc1de6d9920..0c959452333b 100644
--- a/pkgs/development/libraries/gstreamer/core/default.nix
+++ b/pkgs/development/libraries/gstreamer/core/default.nix
@@ -40,7 +40,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gstreamer";
-  version = "1.28.5";
+  version = "1.28.6";
 
   outputs = [
     "bin"
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gstreamer/gstreamer-${finalAttrs.version}.tar.xz";
-    hash = "sha256-pan3g4CbF6jrd09KdpWyy4y6axVSASmQb4fq8w5/hGk=";
+    hash = "sha256-Yra58K0xR6bdZCCsZKkRgLFOmQaVvd01O5YEFhHQUso=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/development/libraries/gstreamer/devtools/default.nix b/pkgs/development/libraries/gstreamer/devtools/default.nix
index 55421dc2010e..12eafbc7e91a 100644
--- a/pkgs/development/libraries/gstreamer/devtools/default.nix
+++ b/pkgs/development/libraries/gstreamer/devtools/default.nix
@@ -27,7 +27,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-devtools";
-  version = "1.28.5";
+  version = "1.28.6";
 
   outputs = [
     "out"
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-devtools/gst-devtools-${finalAttrs.version}.tar.xz";
-    hash = "sha256-dFkEXbMdbkRgC8vgEdySV1AmiHDnuQ9+ego69KIcCeU=";
+    hash = "sha256-FNQfquA2GSUflZWdPVe/ZcYQaDiztUIY3JXHE14euhM=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
diff --git a/pkgs/development/libraries/gstreamer/ges/default.nix b/pkgs/development/libraries/gstreamer/ges/default.nix
index 005a3f90c3a9..0bef33df0348 100644
--- a/pkgs/development/libraries/gstreamer/ges/default.nix
+++ b/pkgs/development/libraries/gstreamer/ges/default.nix
@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-editing-services";
-  version = "1.28.5";
+  version = "1.28.6";
 
   outputs = [
     "out"
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-editing-services/gst-editing-services-${finalAttrs.version}.tar.xz";
-    hash = "sha256-0C+d99108qUCQ6b6XjJ8+71cEhKc57bnPXDAhTJJGog=";
+    hash = "sha256-PRUeUJfWhsWJCudvFMV+4ZU4/WHGz2NxcfkLMJyv1Tw=";
   };
 
   separateDebugInfo = true;
diff --git a/pkgs/development/libraries/gstreamer/good/default.nix b/pkgs/development/libraries/gstreamer/good/default.nix
index 987295f7ac0a..00b47201a47e 100644
--- a/pkgs/development/libraries/gstreamer/good/default.nix
+++ b/pkgs/development/libraries/gstreamer/good/default.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  fetchpatch,
   replaceVars,
   meson,
   nasm,
@@ -16,8 +15,6 @@
   libGL,
   libv4l,
   libdv,
-  libavc1394,
-  libiec61883,
   libvpx,
   libdrm,
   speex,
@@ -53,6 +50,10 @@
   libxext,
   libxdamage,
   ncurses,
+  enableFireWire ? stdenv.hostPlatform.isLinux,
+  libavc1394,
+  libiec61883,
+  enableOSS ? stdenv.hostPlatform.isLinux,
   enableWayland ? stdenv.hostPlatform.isLinux,
   wayland,
   wayland-protocols,
@@ -78,7 +79,7 @@ assert raspiCameraSupport -> hostSupportsRaspiCamera;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-plugins-good";
-  version = "1.28.5";
+  version = "1.28.6";
 
   outputs = [
     "out"
@@ -87,7 +88,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-plugins-good/gst-plugins-good-${finalAttrs.version}.tar.xz";
-    hash = "sha256-WLRdJKHXeznXu32czG4tdrvyhhiZjDNcFj8Y5vlKkyQ=";
+    hash = "sha256-sMYgpLGLbukxtMQ7vxdg0whmbcN/cwp+fxrTJ+Wc4t8=";
   };
 
   patches = [
@@ -200,9 +201,11 @@ stdenv.mkDerivation (finalAttrs: {
     libGL
     libv4l
     libpulseaudio
+    libgudev
+  ]
+  ++ lib.optionals enableFireWire [
     libavc1394
     libiec61883
-    libgudev
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     apple-sdk_gstreamer
@@ -214,45 +217,38 @@ stdenv.mkDerivation (finalAttrs: {
     libjack2
   ];
 
-  mesonFlags = [
-    "-Dexamples=disabled" # requires many dependencies and probably not useful for our users
-    "-Dglib_debug=disabled" # cast checks should be disabled on stable releases
-    (lib.mesonEnable "doc" enableDocumentation)
-    (lib.mesonEnable "asm" true)
-  ]
-  ++ lib.optionals (!qt5Support) [
-    "-Dqt5=disabled"
-  ]
-  ++ lib.optionals (!qt6Support) [
-    "-Dqt6=disabled"
-  ]
-  ++ lib.optionals (!gtkSupport) [
-    "-Dgtk3=disabled"
-  ]
-  ++ lib.optionals (!enableX11) [
-    "-Dximagesrc=disabled" # Linux-only
-  ]
-  ++ lib.optionals (!enableJack) [
-    "-Djack=disabled"
-  ]
-  ++ lib.optionals (!stdenv.hostPlatform.isLinux) [
-    "-Ddv1394=disabled" # Linux only
-    "-Doss4=disabled" # Linux only
-    "-Doss=disabled" # Linux only
-    "-Dpulse=disabled" # TODO check if we can keep this enabled
-    "-Dv4l2-gudev=disabled" # Linux-only
-    "-Dv4l2=disabled" # Linux-only
-  ]
-  ++ (
-    if raspiCameraSupport then
-      [
-        "-Drpi-lib-dir=${libraspberrypi}/lib"
-      ]
-    else
-      [
-        "-Drpicamsrc=disabled"
-      ]
-  );
+  mesonFlags =
+    lib.mapAttrsToList lib.mesonEnable {
+      orc = true;
+      orc-compiler = true;
+      nls = true;
+
+      tests = finalAttrs.finalPackage.doCheck;
+
+      examples = false; # requires many dependencies and probably not useful for our users
+      glib_debug = false; # cast checks should be disabled on stable releases
+      doc = enableDocumentation;
+      asm = true;
+      qt5 = qt5Support;
+      qt6 = qt6Support;
+      gtk3 = gtkSupport;
+      ximagesrc = enableX11; # Linux-only
+      jack = enableJack;
+
+      # Linux only
+      dv1394 = enableFireWire;
+      oss = enableOSS;
+      oss4 = enableOSS;
+      pulse = stdenv.hostPlatform.isLinux; # TODO check if we can keep this enabled
+      v4l2 = stdenv.hostPlatform.isLinux;
+      v4l2-gudev = stdenv.hostPlatform.isLinux;
+
+      rpicamsrc = raspiCameraSupport;
+    }
+    ++ lib.optionals raspiCameraSupport [
+      (lib.mesonOption "rpi-header-dir" "${lib.getDev libraspberrypi}/include")
+      (lib.mesonOption "rpi-lib-dir" "${lib.getLib libraspberrypi}/lib")
+    ];
 
   postPatch = ''
     patchShebangs \
@@ -264,7 +260,7 @@ stdenv.mkDerivation (finalAttrs: {
     NIX_LDFLAGS =
       # linking error on Darwin
       # https://github.com/NixOS/nixpkgs/pull/70690#issuecomment-553694896
-      "-lncurses";
+      lib.optionalString stdenv.hostPlatform.isDarwin "-lncurses";
   };
 
   # fails 1 tests with "Unexpected critical/warning: g_object_set_is_valid_property: object class 'GstRtpStorage' has no property named ''"
@@ -273,6 +269,7 @@ stdenv.mkDerivation (finalAttrs: {
   # must be explicitly set since 5590e365
   dontWrapQtApps = true;
 
+  # Note: gst-plugins-good produces no pkg-config files unless building static libraries
   preFixup = ''
     moveToOutput "lib/gstreamer-1.0/pkgconfig" "$dev"
   '';
diff --git a/pkgs/development/libraries/gstreamer/libav/default.nix b/pkgs/development/libraries/gstreamer/libav/default.nix
index 3714fb286d9c..6dc5f3abd6e4 100644
--- a/pkgs/development/libraries/gstreamer/libav/default.nix
+++ b/pkgs/development/libraries/gstreamer/libav/default.nix
@@ -9,8 +9,7 @@
   gstreamer,
   gst-plugins-base,
   gettext,
-  # FIXME: unpin when upstream supports ffmpeg 9
-  ffmpeg_8-headless,
+  ffmpeg-headless,
   # Checks meson.is_cross_build(), so even canExecute isn't enough.
   enableDocumentation ? stdenv.hostPlatform == stdenv.buildPlatform,
   hotdoc,
@@ -20,16 +19,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-libav";
-  version = "1.28.5";
-
-  outputs = [
-    "out"
-    "dev"
-  ];
+  version = "1.28.6";
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-libav/gst-libav-${finalAttrs.version}.tar.xz";
-    hash = "sha256-RShUZWBW8LFlEaHZrU8mef9eWofIn5DPfuXewAXdseQ=";
+    hash = "sha256-cebq+0//KmbRuwuo0HgiTf5+M5cwfYwLuj3CNgbgj1E=";
   };
 
   separateDebugInfo = true;
@@ -51,15 +45,16 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     gstreamer
     gst-plugins-base
-    ffmpeg_8-headless
+    ffmpeg-headless
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     apple-sdk_gstreamer
   ];
 
-  mesonFlags = [
-    (lib.mesonEnable "doc" enableDocumentation)
-  ];
+  mesonFlags = lib.mapAttrsToList lib.mesonEnable {
+    doc = enableDocumentation;
+    tests = finalAttrs.finalPackage.doCheck;
+  };
 
   postPatch = ''
     patchShebangs \
diff --git a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
index 5fdb31e1ddd8..742fbc362821 100644
--- a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
+++ b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
@@ -19,7 +19,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-rtsp-server";
-  version = "1.28.5";
+  version = "1.28.6";
 
   outputs = [
     "out"
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-rtsp-server/gst-rtsp-server-${finalAttrs.version}.tar.xz";
-    hash = "sha256-fhn93rEmG+vD7Dl4V/7dXHcSm2arUniP2trQURdWYiU=";
+    hash = "sha256-DLclsTUfdeiIA8Vd3eofJ74JUj3c1/KasYJw4YKipGM=";
   };
 
   separateDebugInfo = true;
diff --git a/pkgs/development/libraries/gstreamer/ugly/default.nix b/pkgs/development/libraries/gstreamer/ugly/default.nix
index b524bc2fac7f..4ad03256c94e 100644
--- a/pkgs/development/libraries/gstreamer/ugly/default.nix
+++ b/pkgs/development/libraries/gstreamer/ugly/default.nix
@@ -27,7 +27,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-plugins-ugly";
-  version = "1.28.5";
+  version = "1.28.6";
 
   outputs = [
     "out"
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-plugins-ugly/gst-plugins-ugly-${finalAttrs.version}.tar.xz";
-    hash = "sha256-DvTPnDyaXndqbKjRkKMYYzkbaBmAJSFDuCKymqgx4SA=";
+    hash = "sha256-7iedoTp0D9fwYNYxpnMiP6O8yMM9NQyNAmS9Myok7Ng=";
   };
 
   separateDebugInfo = true;
diff --git a/pkgs/development/libraries/isl/generic.nix b/pkgs/development/libraries/isl/generic.nix
index 8988e8faf982..232057fe03e7 100644
--- a/pkgs/development/libraries/isl/generic.nix
+++ b/pkgs/development/libraries/isl/generic.nix
@@ -44,6 +44,8 @@ stdenv.mkDerivation {
 
   makeFlags = lib.optional stdenv.hostPlatform.isPE "LDFLAGS=-no-undefined";
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://libisl.sourceforge.io/";
     license = lib.licenses.lgpl21;
diff --git a/pkgs/development/libraries/libiconv/default.nix b/pkgs/development/libraries/libiconv/default.nix
index 294e7a81d5e4..2e24e6a509e0 100644
--- a/pkgs/development/libraries/libiconv/default.nix
+++ b/pkgs/development/libraries/libiconv/default.nix
@@ -10,13 +10,13 @@
 
 # assert !stdenv.hostPlatform.isLinux || stdenv.hostPlatform != stdenv.buildPlatform; # TODO: improve on cross
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libiconv";
   version = "1.19";
 
   src = fetchurl {
-    url = "mirror://gnu/libiconv/${pname}-${version}.tar.gz";
-    sha256 = "sha256-iN2WqMBGTsoUT8eRrmDNMc2O54Mh5nOX4l/AlcShmqY=";
+    url = "mirror://gnu/libiconv/libiconv-${finalAttrs.version}.tar.gz";
+    hash = "sha256-iN2WqMBGTsoUT8eRrmDNMc2O54Mh5nOX4l/AlcShmqY=";
   };
 
   enableParallelBuilding = true;
@@ -25,6 +25,8 @@ stdenv.mkDerivation rec {
   # https://git.savannah.gnu.org/cgit/config.git/commit/?id=e4786449e1c26716e3f9ea182caf472e4dbc96e0
   nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ];
 
+  strictDeps = true;
+
   # https://github.com/NixOS/nixpkgs/pull/192630#discussion_r978985593
   hardeningDisable = lib.optional (stdenv.hostPlatform.libc == "bionic") "fortify";
 
@@ -82,7 +84,9 @@ stdenv.mkDerivation rec {
   # remove after gnulib is updated
   ++ lib.optional stdenv.hostPlatform.isCygwin "gl_cv_clean_version_stddef=yes";
 
-  passthru = { inherit setupHooks; };
+  passthru = { inherit (finalAttrs) setupHooks; };
+
+  __structuredAttrs = true;
 
   meta = {
     description = "Iconv(3) implementation";
@@ -106,4 +110,4 @@ stdenv.mkDerivation rec {
     # This library is not needed on GNU platforms.
     hydraPlatforms = with lib.platforms; cygwin ++ darwin ++ freebsd;
   };
-}
+})
diff --git a/pkgs/development/libraries/libidn2/default.nix b/pkgs/development/libraries/libidn2/default.nix
index 3d06a7410c5e..8b34a2842082 100644
--- a/pkgs/development/libraries/libidn2/default.nix
+++ b/pkgs/development/libraries/libidn2/default.nix
@@ -14,12 +14,12 @@
 # cgit) that are needed here should be included directly in Nixpkgs as
 # files.
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libidn2";
   version = "2.3.8";
 
   src = fetchurl {
-    url = "https://ftp.gnu.org/gnu/libidn/libidn2-${version}.tar.gz";
+    url = "https://ftp.gnu.org/gnu/libidn/libidn2-${finalAttrs.version}.tar.gz";
     hash = "sha256-9VeRG/YXFiHh9y/zX1sYJbs1tS7UUyXc3ukx5dPAeHo=";
   };
 
@@ -44,6 +44,8 @@ stdenv.mkDerivation rec {
   buildInputs = [ libunistring ] ++ lib.optional stdenv.hostPlatform.isDarwin libiconv;
   depsBuildBuild = [ buildPackages.stdenv.cc ];
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.gnu.org/software/libidn/#libidn2";
     description = "Free software implementation of IDNA2008 and TR46";
@@ -65,6 +67,6 @@ stdenv.mkDerivation rec {
     ];
     platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [ fpletz ];
-    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnu" version;
+    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnu" finalAttrs.version;
   };
-}
+})
diff --git a/pkgs/development/libraries/libidn2/no-bootstrap-reference.nix b/pkgs/development/libraries/libidn2/no-bootstrap-reference.nix
index ff8c47915067..773dfb6efe0f 100644
--- a/pkgs/development/libraries/libidn2/no-bootstrap-reference.nix
+++ b/pkgs/development/libraries/libidn2/no-bootstrap-reference.nix
@@ -4,7 +4,6 @@
   libidn2,
   libunistring,
   runCommandLocal,
-  patchelf,
 }:
 # Construct a copy of libidn2.* where all (transitive) libc references (in .bin)
 # get replaced by a new one, so that there's no reference to bootstrap tools.
diff --git a/pkgs/development/libraries/libinput/default.nix b/pkgs/development/libraries/libinput/default.nix
index 17ef7da85270..924696025cf1 100644
--- a/pkgs/development/libraries/libinput/default.nix
+++ b/pkgs/development/libraries/libinput/default.nix
@@ -61,6 +61,8 @@ stdenv.mkDerivation rec {
     "dev"
   ];
 
+  propagatedBuildOutputs = [ "out" ];
+
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "libinput";
diff --git a/pkgs/development/libraries/libxml2/common.nix b/pkgs/development/libraries/libxml2/common.nix
index 61c40a95ffe3..6fbae9218df3 100644
--- a/pkgs/development/libraries/libxml2/common.nix
+++ b/pkgs/development/libraries/libxml2/common.nix
@@ -153,6 +153,8 @@ stdenv'.mkDerivation (finalAttrs: {
     };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://gitlab.gnome.org/GNOME/libxml2";
     description = "XML parsing library for C";
diff --git a/pkgs/development/libraries/nettle/generic.nix b/pkgs/development/libraries/nettle/generic.nix
index b626e137c427..9494a282a1df 100644
--- a/pkgs/development/libraries/nettle/generic.nix
+++ b/pkgs/development/libraries/nettle/generic.nix
@@ -25,6 +25,8 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ gnum4 ];
   propagatedBuildInputs = [ gmp ];
 
+  strictDeps = true;
+
   configureFlags =
     # runtime selection of HW-accelerated code; it's default since 3.7
     [ "--enable-fat" ]
@@ -40,6 +42,8 @@ stdenv.mkDerivation {
 
   patches = lib.optional (stdenv.hostPlatform.system == "i686-cygwin") ./cygwin.patch;
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Cryptographic library";
 
diff --git a/pkgs/development/libraries/ngtcp2/default.nix b/pkgs/development/libraries/ngtcp2/default.nix
index a7f342c6eaf7..20dac13831d2 100644
--- a/pkgs/development/libraries/ngtcp2/default.nix
+++ b/pkgs/development/libraries/ngtcp2/default.nix
@@ -36,6 +36,8 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optional withJemalloc jemalloc;
 
+  strictDeps = true;
+
   cmakeFlags = [
     # The examples try to link against `ngtcp2_crypto_ossl` and `ngtcp2` libraries.
     # This works in the dynamic case where the targets have the same name, but not here where they're suffixed with `_static`.
@@ -56,6 +58,8 @@ stdenv.mkDerivation (finalAttrs: {
     inherit curl;
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://github.com/ngtcp2/ngtcp2";
     changelog = "https://github.com/ngtcp2/ngtcp2/releases/tag/v${finalAttrs.version}";
diff --git a/pkgs/development/libraries/ngtcp2/gnutls.nix b/pkgs/development/libraries/ngtcp2/gnutls.nix
index 3de8d611a9d4..476334552e79 100644
--- a/pkgs/development/libraries/ngtcp2/gnutls.nix
+++ b/pkgs/development/libraries/ngtcp2/gnutls.nix
@@ -11,14 +11,14 @@
   curlWithGnuTls,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "ngtcp2";
   version = "1.25.0";
 
   src = fetchFromGitHub {
     owner = "ngtcp2";
     repo = "ngtcp2";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-BBV4nNtSWQOFuwVOeH3LJEUeF7v4LVhGbfcrkroBAvc=";
   };
 
@@ -33,6 +33,8 @@ stdenv.mkDerivation rec {
   ];
   buildInputs = [ gnutls ];
 
+  strictDeps = true;
+
   configureFlags = [ "--with-gnutls=yes" ];
   enableParallelBuilding = true;
 
@@ -43,6 +45,8 @@ stdenv.mkDerivation rec {
     inherit curlWithGnuTls;
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://github.com/ngtcp2/ngtcp2";
     description = "Effort to implement RFC9000 QUIC protocol";
@@ -52,7 +56,7 @@ stdenv.mkDerivation rec {
       vcunat # for knot-dns
     ];
   };
-}
+})
 
 /*
   Why split from ./default.nix?
diff --git a/pkgs/development/libraries/poppler/default.nix b/pkgs/development/libraries/poppler/default.nix
index c0a00366eac2..580d1fbfb73e 100644
--- a/pkgs/development/libraries/poppler/default.nix
+++ b/pkgs/development/libraries/poppler/default.nix
@@ -3,6 +3,7 @@
   stdenv,
   fetchurl,
   fetchFromGitLab,
+  fetchpatch,
   cairo,
   clang-tools,
   cmake,
@@ -39,6 +40,7 @@
   cups-filters,
   gdal,
   gegl,
+  gtk3,
   inkscape,
   scribus,
   vips,
@@ -62,7 +64,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "poppler-${suffix}";
-  version = "26.06.0"; # beware: updates often break cups-filters build, check scribus too!
+  version = "26.06.0";
 
   outputs = [
     "out"
@@ -74,6 +76,16 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-TLTlo9yMte7HUciiPIuhn2H5be3AzQfSruawyOLPa6Q=";
   };
 
+  patches = [
+    # Backports Darwin crash fix from upstream
+    # https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1743
+    (fetchpatch {
+      name = "darwin-mutex-lock-crash.patch";
+      url = "https://gitlab.freedesktop.org/poppler/poppler/-/commit/08f4bca6a669f9fce75dbab743db559a86591738.patch";
+      hash = "sha256-+eWqVK/v3Ys9k2+z/dCoS2o82m039UER1StMUW4PIgM=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
     ninja
@@ -184,9 +196,17 @@ stdenv.mkDerivation (finalAttrs: {
       gdal = gdal.override { usePoppler = true; };
       python-poppler-qt5 = python3.pkgs.poppler-qt5;
 
-      pkg-config = testers.hasPkgConfigModules {
-        package = finalAttrs.finalPackage;
-      };
+      pkg-config =
+        testers.hasPkgConfigModules {
+          package = finalAttrs.finalPackage;
+        }
+        // lib.optionalAttrs (!minimal) {
+          # Poppler skips tests unless GTK3 is detected; add to closure
+          poppler-with-gtk-tests = finalAttrs.finalPackage.overrideAttrs (old: {
+            pname = "${old.pname}-gtk-tests";
+            buildInputs = old.buildInputs ++ [ gtk3 ];
+          });
+        };
     };
   };
 
diff --git a/pkgs/development/libraries/qt-6/fetch.sh b/pkgs/development/libraries/qt-6/fetch.sh
index bd94b3ae2c48..e97e92bf7f8c 100644
--- a/pkgs/development/libraries/qt-6/fetch.sh
+++ b/pkgs/development/libraries/qt-6/fetch.sh
@@ -1 +1 @@
-WGET_ARGS=( https://download.qt.io/official_releases/qt/6.11/6.11.1/submodules/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.qt.io/official_releases/qt/6.11/6.11.2/submodules/ -A '*.tar.xz' )
diff --git a/pkgs/development/libraries/qt-6/modules/qtbase/default.nix b/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
index 7686093f4d75..3704ac8354ed 100644
--- a/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
@@ -251,6 +251,12 @@ stdenv.mkDerivation {
       url = "https://github.com/qt/qtbase/commit/515cbbacfba9f4259c9c3b0714a31222c2b4c879.diff";
       hash = "sha256-93tzp4O7dZxRZv7ilN/gbQSVmaeOGmxpYgM7aomN0n8=";
     })
+
+    # icon loading fix
+    (fetchpatch {
+      url = "https://github.com/qt/qtbase/commit/85420d5d4f78a6ba4cf70ed8ee092e0ef4fb9a54.diff";
+      hash = "sha256-BFL1mtwzEH0uUYbeUZDC2Fcp9pjBhtSYOaSxxVILe30=";
+    })
   ];
 
   postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
diff --git a/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix b/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
index cfcdb5f6c59a..786229c5651b 100644
--- a/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
@@ -43,20 +43,6 @@ qtModule {
       hash = "sha256-ESy35OlmsvI4yFQ/rFT8oelOUBCwCmlcbQJvwcTrCig=";
       revert = true;
     })
-
-    # backport fix recommended by KDE
-    (fetchpatch {
-      url = "https://github.com/qt/qtdeclarative/commit/8a2c82be6ad90e3f2a0760d8bab1e3a8cdb2473a.diff";
-      hash = "sha256-3KbyoQPAiRyCwGnwwYV3y0yz2i6UAJcX70EPsXV0ZZM=";
-    })
-
-    # backport required at least for [musescore][1], and perhaps many other
-    # applications.
-    # [1]: https://github.com/musescore/MuseScore/issues/33015
-    (fetchpatch {
-      url = "https://github.com/qt/qtdeclarative/commit/9d4d376726a6ce15c429128dc65b927e411e40da.diff";
-      hash = "sha256-XhfliF5wZuN4/E55f8hfipIRjxBe9V7vL1cgn5p4xqA=";
-    })
   ];
 
   cmakeFlags = [
diff --git a/pkgs/development/libraries/qt-6/modules/qtmqtt.nix b/pkgs/development/libraries/qt-6/modules/qtmqtt.nix
index c70d2cbd1f88..b5e6c6bc6e19 100644
--- a/pkgs/development/libraries/qt-6/modules/qtmqtt.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtmqtt.nix
@@ -6,13 +6,13 @@
 
 qtModule rec {
   pname = "qtmqtt";
-  version = "6.11.1";
+  version = "6.11.2";
 
   src = fetchFromGitHub {
     owner = "qt";
     repo = "qtmqtt";
     tag = "v${version}";
-    hash = "sha256-GWaF4iCPtATL1mJkPHVY0rom8R2FMNWGahE3KWBlfV8=";
+    hash = "sha256-Xg4vfVfYgruRXB6LSWFJWSMtsClJMtML+KhaQExWUGs=";
   };
 
   propagatedBuildInputs = [ qtbase ];
diff --git a/pkgs/development/libraries/qt-6/srcs.nix b/pkgs/development/libraries/qt-6/srcs.nix
index 93c206858d18..c6688d20db77 100644
--- a/pkgs/development/libraries/qt-6/srcs.nix
+++ b/pkgs/development/libraries/qt-6/srcs.nix
@@ -4,339 +4,339 @@
 
 {
   qt3d = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qt3d-everywhere-src-6.11.1.tar.xz";
-      sha256 = "01q11bs7vjz1s5wdrdjq904dgl2m6l7r8d3vd2kyf7lx0j78qvd6";
-      name = "qt3d-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qt3d-everywhere-src-6.11.2.tar.xz";
+      sha256 = "0adczdz74mlmrb8w7hzjln1902isn7bgfbzpr1r18wasg6j8a4a1";
+      name = "qt3d-everywhere-src-6.11.2.tar.xz";
     };
   };
   qt5compat = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qt5compat-everywhere-src-6.11.1.tar.xz";
-      sha256 = "06qndy534rzabxk9yq07dsl8fj1vd72lmck11r5xbajil3d9zjyg";
-      name = "qt5compat-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qt5compat-everywhere-src-6.11.2.tar.xz";
+      sha256 = "11s225zq0hskkq61rrfhy65aqzdny7np00c75ngnl2ci6gz21hv8";
+      name = "qt5compat-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtactiveqt = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtactiveqt-everywhere-src-6.11.1.tar.xz";
-      sha256 = "05hcnhxkajry4ha7ykmqr83p16qjipspwxid8l2rxgz80wy6aadv";
-      name = "qtactiveqt-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtactiveqt-everywhere-src-6.11.2.tar.xz";
+      sha256 = "0g3ak3jmh4fqjl0xh3vcj7hlw7k7902b2arqxa304hmh1s0dmblx";
+      name = "qtactiveqt-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtbase = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtbase-everywhere-src-6.11.1.tar.xz";
-      sha256 = "1b616gr7k8byfr2ns4vczs4kj3sznhlrlw9inpb3m8la48qllnfr";
-      name = "qtbase-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtbase-everywhere-src-6.11.2.tar.xz";
+      sha256 = "08ng4gns21a3za3qszzw3yp3a2pxipma1zrl870xi97mrbn00bjv";
+      name = "qtbase-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtcanvaspainter = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtcanvaspainter-everywhere-src-6.11.1.tar.xz";
-      sha256 = "1l08zp68q3wcr9v5hh82kw6jqvc1wmnrjn7h9959psx520dwcdly";
-      name = "qtcanvaspainter-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtcanvaspainter-everywhere-src-6.11.2.tar.xz";
+      sha256 = "0q77hc83ynvnagwxa9z0j9rwvlzmyig06kklb7v5zvyfa1ra544a";
+      name = "qtcanvaspainter-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtcharts = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtcharts-everywhere-src-6.11.1.tar.xz";
-      sha256 = "0p2icmrwb6am7x2kgk9pnpa8ypi7jiscyaawgi0x31iaihqyvqrz";
-      name = "qtcharts-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtcharts-everywhere-src-6.11.2.tar.xz";
+      sha256 = "0agvnva90diqvllfvrd1smicar6nlv5pjqvwjfg509fih4xyasah";
+      name = "qtcharts-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtconnectivity = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtconnectivity-everywhere-src-6.11.1.tar.xz";
-      sha256 = "14g5h0wixqy981cnn5f8gkjbji804f18gfjkzbanxd0lljg2h191";
-      name = "qtconnectivity-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtconnectivity-everywhere-src-6.11.2.tar.xz";
+      sha256 = "0dv0bqlvfdphk2a5pzq7fm222h6zvy87k18aaamq7585pmbimc45";
+      name = "qtconnectivity-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtdatavis3d = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtdatavis3d-everywhere-src-6.11.1.tar.xz";
-      sha256 = "1b4kcqfq5q79lm70f08qiksxl36laa9dgx9ladjk2xwl1af7n6hy";
-      name = "qtdatavis3d-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtdatavis3d-everywhere-src-6.11.2.tar.xz";
+      sha256 = "07b61fkdzkhv3hfa7r6vfadd72bnyk4cgqwws5ns3y6nqlcnjknj";
+      name = "qtdatavis3d-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtdeclarative = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtdeclarative-everywhere-src-6.11.1.tar.xz";
-      sha256 = "193ar0fcfzjjr7mi8i2622vip95qrr3qry949d9lyc5hf3v71rjj";
-      name = "qtdeclarative-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtdeclarative-everywhere-src-6.11.2.tar.xz";
+      sha256 = "0c5lqr8kbrfvaxh147d92vqbcirw7wj94sxwx8ih2f3ya5q7nnr1";
+      name = "qtdeclarative-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtdoc = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtdoc-everywhere-src-6.11.1.tar.xz";
-      sha256 = "1hd5z6prx2sbr3wxzkynrn2iyjllvkids505l2xg3p272j4b5306";
-      name = "qtdoc-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtdoc-everywhere-src-6.11.2.tar.xz";
+      sha256 = "1dsfnlsk0kihz55fnmyrybya9x3s88nam9jfpb5g68vk4n9if9sn";
+      name = "qtdoc-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtgraphs = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtgraphs-everywhere-src-6.11.1.tar.xz";
-      sha256 = "0qh43qxqg4biyrrsd78nmi4dm3dnbswa95cq8db2k3lans517cc4";
-      name = "qtgraphs-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtgraphs-everywhere-src-6.11.2.tar.xz";
+      sha256 = "08cbzc0146j4d18dlqsw0qbilhcwk1hi9h8n84adsigs9a2hj8cz";
+      name = "qtgraphs-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtgrpc = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtgrpc-everywhere-src-6.11.1.tar.xz";
-      sha256 = "0l52w91hd2crq6zyh5a8arv07yixnwcr2pya74bxpk2hqpq08ys3";
-      name = "qtgrpc-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtgrpc-everywhere-src-6.11.2.tar.xz";
+      sha256 = "14xdchng4sn90r2cva7wxrqlyzncpwkj11gscm4z73q5y0blcha4";
+      name = "qtgrpc-everywhere-src-6.11.2.tar.xz";
     };
   };
   qthttpserver = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qthttpserver-everywhere-src-6.11.1.tar.xz";
-      sha256 = "01p7li9fvwnz2shx3d9wj9nnnnipya2q0whchyvgjqb8yzy71gq4";
-      name = "qthttpserver-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qthttpserver-everywhere-src-6.11.2.tar.xz";
+      sha256 = "13mxwy5h41c96ykdkxlxcdf2pqv2gswyvyzxrzsj13x55cxpdxgh";
+      name = "qthttpserver-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtimageformats = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtimageformats-everywhere-src-6.11.1.tar.xz";
-      sha256 = "04y4pa5krrpyiqn039d6m8bzcxj6pa1m850rz3bmw5xc8ml6rgxj";
-      name = "qtimageformats-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtimageformats-everywhere-src-6.11.2.tar.xz";
+      sha256 = "1y0123s8hry81059w8x46fv0i0425zv99g09cc3m0rabyc08kkff";
+      name = "qtimageformats-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtlanguageserver = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtlanguageserver-everywhere-src-6.11.1.tar.xz";
-      sha256 = "1vwavpi8swgs88pfjfddnb9cmsb4k1sjcgywp2rsnm6ay8vqa02h";
-      name = "qtlanguageserver-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtlanguageserver-everywhere-src-6.11.2.tar.xz";
+      sha256 = "0ppw27jsqsih48sd0iizfc2jwsxya8z0a9vjjaqhxjplxir45g1q";
+      name = "qtlanguageserver-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtlocation = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtlocation-everywhere-src-6.11.1.tar.xz";
-      sha256 = "06z4hbiqki5chhmph131s71czyrjpnjvy3rxb4560vwy55vwx49p";
-      name = "qtlocation-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtlocation-everywhere-src-6.11.2.tar.xz";
+      sha256 = "0fn2clzz2wmc3lwzqlkwk07scvmmdhim1ihpxkv7dg8zw3nafl2d";
+      name = "qtlocation-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtlottie = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtlottie-everywhere-src-6.11.1.tar.xz";
-      sha256 = "0y969gp64imwh49d5zbnw0wi2yva9fsp6qn58617rs9kvkdzml70";
-      name = "qtlottie-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtlottie-everywhere-src-6.11.2.tar.xz";
+      sha256 = "0lj8a90frd265waypkwghabj0r9h5p6vh1dlrjksksyr2qkp2g7m";
+      name = "qtlottie-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtmultimedia = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtmultimedia-everywhere-src-6.11.1.tar.xz";
-      sha256 = "02lvq1jk6m67m6z0w7vdzxhzmi441j8avvp79mfclfpfvm98w3rr";
-      name = "qtmultimedia-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtmultimedia-everywhere-src-6.11.2.tar.xz";
+      sha256 = "17yd17qm0jxfimkqs843z5m86ciif1pcs8h66vdkqybbxh15wywn";
+      name = "qtmultimedia-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtnetworkauth = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtnetworkauth-everywhere-src-6.11.1.tar.xz";
-      sha256 = "0gan2qjv97d1387jqaiis2gigm6lz5jbk1k10x13w0yc5kr5n7cz";
-      name = "qtnetworkauth-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtnetworkauth-everywhere-src-6.11.2.tar.xz";
+      sha256 = "0nx03zab9jrzkrwali45czswlniwbh0v0nx17wwj8y5bfwqc50qc";
+      name = "qtnetworkauth-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtopenapi = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtopenapi-everywhere-src-6.11.1.tar.xz";
-      sha256 = "0nzl95w5pbfd6mfb6rzv6arz09pcm6siz1n07pgm9rrdr6z083a4";
-      name = "qtopenapi-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtopenapi-everywhere-src-6.11.2.tar.xz";
+      sha256 = "1873byinl4ikm3bncz869fjhn1z2jwj9s0bg3h9ncnn4kl0fp74b";
+      name = "qtopenapi-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtpositioning = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtpositioning-everywhere-src-6.11.1.tar.xz";
-      sha256 = "1xbq1xjjbhb41lfp9mli8a5rgqf5pniswv0161v6wa5f04cbkrnm";
-      name = "qtpositioning-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtpositioning-everywhere-src-6.11.2.tar.xz";
+      sha256 = "16blmv0plbh0l214q6phfp7jb18201cyqk66v8555cd38fnibkyq";
+      name = "qtpositioning-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtquick3d = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtquick3d-everywhere-src-6.11.1.tar.xz";
-      sha256 = "0vs5bcz62r32gin0g4lb6wdmqrv0ypzar1s9wsza98la7zg8asy7";
-      name = "qtquick3d-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtquick3d-everywhere-src-6.11.2.tar.xz";
+      sha256 = "1d1pcy9ipjsipczrassn6h9jq2bx7v1457fg6wx3f9nvivqf3f1s";
+      name = "qtquick3d-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtquick3dphysics = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtquick3dphysics-everywhere-src-6.11.1.tar.xz";
-      sha256 = "1bvrmjb6m0ynq00ybdghvkbmwm237vff23ng8n4njysf05pns26i";
-      name = "qtquick3dphysics-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtquick3dphysics-everywhere-src-6.11.2.tar.xz";
+      sha256 = "0vmqvr68qq0caglackln225xj3p8srdycykw3m44iz458b7j8nhw";
+      name = "qtquick3dphysics-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtquickeffectmaker = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtquickeffectmaker-everywhere-src-6.11.1.tar.xz";
-      sha256 = "0sqk8hkkdibv0ayxrvpcbgj3dcwfngpd6qjp2xm15pcbx1q3xrng";
-      name = "qtquickeffectmaker-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtquickeffectmaker-everywhere-src-6.11.2.tar.xz";
+      sha256 = "1dswhg102b09x3p3iyldmwkhnkphcisl4jp2dbisacz9hirdq8vr";
+      name = "qtquickeffectmaker-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtquicktimeline = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtquicktimeline-everywhere-src-6.11.1.tar.xz";
-      sha256 = "09wcx83yxif8r4v81h2jfj3wlj60wnc9k4dsp7hlah4yzm1zclxg";
-      name = "qtquicktimeline-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtquicktimeline-everywhere-src-6.11.2.tar.xz";
+      sha256 = "05qxi1gqv02af28rlzlbmxc4v939i920gqblvrfh9i50002z22i5";
+      name = "qtquicktimeline-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtremoteobjects = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtremoteobjects-everywhere-src-6.11.1.tar.xz";
-      sha256 = "06hiiyjpcgn8dp9jmgxj30nlrw73rqb869f0m63scccmqsarhqj0";
-      name = "qtremoteobjects-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtremoteobjects-everywhere-src-6.11.2.tar.xz";
+      sha256 = "1zbwg7pzswibjjx2vgcl3r4v47xhdwk0c9bik8bv3hlyg60rc32y";
+      name = "qtremoteobjects-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtscxml = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtscxml-everywhere-src-6.11.1.tar.xz";
-      sha256 = "0gr0j09isxgii3aivfvr35x40d9n0kj0g2icc7g7bzniwm2m4jcf";
-      name = "qtscxml-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtscxml-everywhere-src-6.11.2.tar.xz";
+      sha256 = "1zrmxhf2a58dynbxij08vxa6x7b6jllcfwvrhlhgpgzqlyxw957m";
+      name = "qtscxml-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtsensors = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtsensors-everywhere-src-6.11.1.tar.xz";
-      sha256 = "13ygry3lybkgci6gkrd7k081l01icavzkiyy4g82drbvv9i70q93";
-      name = "qtsensors-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtsensors-everywhere-src-6.11.2.tar.xz";
+      sha256 = "069ij142dvh4spqp9584pfqqj8265x659xb35wcf5s1jzd6y9j38";
+      name = "qtsensors-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtserialbus = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtserialbus-everywhere-src-6.11.1.tar.xz";
-      sha256 = "02pj4jnxc4afl5ymv7w8asggpg0hdj3dbnwwcqd305b8il69qv64";
-      name = "qtserialbus-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtserialbus-everywhere-src-6.11.2.tar.xz";
+      sha256 = "1h9nvwhbfhb5js0458ha653n04d46m70j4gh8gn4bc7njnxcj1lg";
+      name = "qtserialbus-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtserialport = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtserialport-everywhere-src-6.11.1.tar.xz";
-      sha256 = "0x1r5l3kx7riprf0b2api0bcg0z755fq9vbgmx7px6pxiy4imwws";
-      name = "qtserialport-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtserialport-everywhere-src-6.11.2.tar.xz";
+      sha256 = "13md2wdypib4wjw3mai8hqfyjjs4l67232dnxjr32ks42qv76fnz";
+      name = "qtserialport-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtshadertools = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtshadertools-everywhere-src-6.11.1.tar.xz";
-      sha256 = "1z42r414jid12jmhm1yf5kw44j886w01igav0kggkg13kcphax90";
-      name = "qtshadertools-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtshadertools-everywhere-src-6.11.2.tar.xz";
+      sha256 = "070b41mzqf1b7xnxn2mh7ap79s2702a7bcwhd1c6axkmnyw4cl40";
+      name = "qtshadertools-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtspeech = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtspeech-everywhere-src-6.11.1.tar.xz";
-      sha256 = "051z4yf22hkqhy3pkgxq8s77x06k4cd70i9jcmd8f99004cc6df0";
-      name = "qtspeech-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtspeech-everywhere-src-6.11.2.tar.xz";
+      sha256 = "166bqmcffdncyr64zw4h99c9ng19nk30ys371br4j03ikpf0a7cw";
+      name = "qtspeech-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtsvg = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtsvg-everywhere-src-6.11.1.tar.xz";
-      sha256 = "154adaicyy5wyz6yc95g3lm4iw9v2zdsd7l5qp107gr490pz0g3z";
-      name = "qtsvg-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtsvg-everywhere-src-6.11.2.tar.xz";
+      sha256 = "0xhq64622f6iz42xj4dn0jjgs4jwd9gbi1zyczxjck58xizk756m";
+      name = "qtsvg-everywhere-src-6.11.2.tar.xz";
     };
   };
   qttasktree = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qttasktree-everywhere-src-6.11.1.tar.xz";
-      sha256 = "1mjdwy3i24ggn2g82z5pg3grzhnaxmq7nmvdc7ba8dsdixzvjam2";
-      name = "qttasktree-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qttasktree-everywhere-src-6.11.2.tar.xz";
+      sha256 = "1n1yq8hws4yq0raanfkjj2r4z671mic2dspg2p6sc5hny292jxn0";
+      name = "qttasktree-everywhere-src-6.11.2.tar.xz";
     };
   };
   qttools = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qttools-everywhere-src-6.11.1.tar.xz";
-      sha256 = "03gmr9zpf0raqcvqk2cpw9lblw907hsl5cb5c2fgm4wwcxd86qcf";
-      name = "qttools-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qttools-everywhere-src-6.11.2.tar.xz";
+      sha256 = "07h4nhk02izczi1wz6dh7gab84vzk7rkm30wwq4pwbsibkrmm9wy";
+      name = "qttools-everywhere-src-6.11.2.tar.xz";
     };
   };
   qttranslations = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qttranslations-everywhere-src-6.11.1.tar.xz";
-      sha256 = "0xsnxhiqc3ybwvyn1jbhdf1sjmcf7v4mma6w9sxwg535420jrh1p";
-      name = "qttranslations-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qttranslations-everywhere-src-6.11.2.tar.xz";
+      sha256 = "0560cyg3j4fcsq7ikb7rraa8g5ymi9lscmmhqfmryylklz0q85h2";
+      name = "qttranslations-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtvirtualkeyboard = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtvirtualkeyboard-everywhere-src-6.11.1.tar.xz";
-      sha256 = "073y02qmpwxxdqc4pkm6k9frghsjg1zppg2hip5b4hv269xrdim1";
-      name = "qtvirtualkeyboard-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtvirtualkeyboard-everywhere-src-6.11.2.tar.xz";
+      sha256 = "0bvwci70c4ng5zgzj621a723p22v58cmzbprbz6llkjw99rjcsjc";
+      name = "qtvirtualkeyboard-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtwayland = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtwayland-everywhere-src-6.11.1.tar.xz";
-      sha256 = "1cyr5frhglp2krxvpnqk9q426rgp6nr34ngnxpa42m7p0ajqly4m";
-      name = "qtwayland-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtwayland-everywhere-src-6.11.2.tar.xz";
+      sha256 = "1pzr4a11dmlbpzfgcm7z95cvnm2r5pq71pg80vsi0aik75g63dwf";
+      name = "qtwayland-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtwebchannel = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtwebchannel-everywhere-src-6.11.1.tar.xz";
-      sha256 = "10ld2nh6gd1v2ssbgqlf6w0lsjlqkjdfwqv85mn5krnnf45vbyv9";
-      name = "qtwebchannel-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtwebchannel-everywhere-src-6.11.2.tar.xz";
+      sha256 = "0pspql8j7yxjvvxwibavb4kw5lidh6a62rcjqbq8ga5xb2bi9czy";
+      name = "qtwebchannel-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtwebengine = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtwebengine-everywhere-src-6.11.1.tar.xz";
-      sha256 = "10vhcvw8j60n0mf38bi3fjcx5v1i0cbfyn4wbqhzqn61qv66d737";
-      name = "qtwebengine-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtwebengine-everywhere-src-6.11.2.tar.xz";
+      sha256 = "0qy1lyykwwkp288v0y5kqnd1pmz8frzicpgfcldkv4zz02mc20b1";
+      name = "qtwebengine-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtwebsockets = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtwebsockets-everywhere-src-6.11.1.tar.xz";
-      sha256 = "1gvgci383dfm4sljqlapdiva7jhks1i2z2ayck0wbj1436hklgi4";
-      name = "qtwebsockets-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtwebsockets-everywhere-src-6.11.2.tar.xz";
+      sha256 = "18y9ycpmny1czkqz7c97hp7l89vxj34h56y5wf87czy3hg1jbzib";
+      name = "qtwebsockets-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtwebview = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtwebview-everywhere-src-6.11.1.tar.xz";
-      sha256 = "0g8k4xs7b0s474x00ds4i8q9b164icdgrdg8ngln10nmf3pwhqld";
-      name = "qtwebview-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtwebview-everywhere-src-6.11.2.tar.xz";
+      sha256 = "0k0zi0pzbcvrrjfzhim55rbaar4xrdmpip9y5ppxxnl9xq4y28by";
+      name = "qtwebview-everywhere-src-6.11.2.tar.xz";
     };
   };
 }
diff --git a/pkgs/development/libraries/science/math/openblas/default.nix b/pkgs/development/libraries/science/math/openblas/default.nix
index b1a0175dfde1..89ad14774c9f 100644
--- a/pkgs/development/libraries/science/math/openblas/default.nix
+++ b/pkgs/development/libraries/science/math/openblas/default.nix
@@ -44,6 +44,7 @@
   R,
   openmp ? null,
   testers,
+  pkgsCross,
 }:
 
 let
@@ -81,7 +82,9 @@ let
     aarch64-linux = {
       BINARY = 64;
       TARGET = setTarget "ARMV8";
-      DYNAMIC_ARCH = setDynamicArch true;
+      # DYNAMIC_ARCH includes ARMV9SME which references sgemm_kernel_sve_v2x4.S,
+      # a file missing when cross-compiling.
+      DYNAMIC_ARCH = setDynamicArch (stdenv.buildPlatform.canExecute stdenv.hostPlatform);
       USE_OPENMP = true;
     };
 
@@ -332,6 +335,7 @@ stdenv.mkDerivation (finalAttrs: {
       package = finalAttrs.finalPackage;
       moduleNames = [ "OpenBLAS" ];
     };
+    aarch64-multiplatform = pkgsCross.aarch64-multiplatform.openblas;
   };
 
   meta = {
diff --git a/pkgs/development/libraries/webkitgtk/default.nix b/pkgs/development/libraries/webkitgtk/default.nix
index f70e3573fa6b..f4d3e8074044 100644
--- a/pkgs/development/libraries/webkitgtk/default.nix
+++ b/pkgs/development/libraries/webkitgtk/default.nix
@@ -42,7 +42,6 @@
   nettle,
   libtasn1,
   p11-kit,
-  libidn,
   libedit,
   readline,
   libGL,
@@ -160,7 +159,6 @@ clangStdenv.mkDerivation (finalAttrs: {
     libgbm
     libgcrypt
     libgpg-error
-    libidn
     libintl
     lcms2
     libpthread-stubs
diff --git a/pkgs/development/libraries/zlib/default.nix b/pkgs/development/libraries/zlib/default.nix
index d1ade7177909..a400e4b60c63 100644
--- a/pkgs/development/libraries/zlib/default.nix
+++ b/pkgs/development/libraries/zlib/default.nix
@@ -161,6 +161,8 @@ stdenv.mkDerivation (finalAttrs: {
     inherit minizip;
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://zlib.net";
     description = "Lossless data-compression library";
diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index c340134f9a8e..2baa58abfc90 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -811,15 +811,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "dkjson";
-      version = "2.10-1";
+      version = "2.11-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/dkjson-2.10-1.rockspec";
-          sha256 = "0h49fv93h6n32xwwgwvrhb6w5rzvgjzyls6m9xhmcd94pbkih8v2";
+          url = "mirror://luarocks/dkjson-2.11-1.rockspec";
+          sha256 = "0fkgsqfd0k7pq9j3d1hrhsiha7dc145fbf7hqw0r7lzmp03vjfai";
         }).outPath;
       src = fetchurl {
-        url = "https://dkolf.de/dkjson-lua/dkjson-2.10.tar.gz";
-        sha256 = "092v9m13h7zl89qfgywbs22wdvniwr2lr3shjqrn91f4nl39xiz8";
+        url = "https://dkolf.de/dkjson-lua/dkjson-2.11.tar.gz";
+        sha256 = "16725vrd5apdxapj641cc0x218vp0ylfcf0z24wfffxwh7v9l5ks";
       };
 
       disabled = luaOlder "5.1" || luaAtLeast "5.6";
diff --git a/pkgs/development/ocaml-modules/bitstring/default.nix b/pkgs/development/ocaml-modules/bitstring/default.nix
index 4c612b177a7c..791620a77c08 100644
--- a/pkgs/development/ocaml-modules/bitstring/default.nix
+++ b/pkgs/development/ocaml-modules/bitstring/default.nix
@@ -1,21 +1,25 @@
 {
   lib,
   fetchFromGitHub,
+  ocaml,
   buildDunePackage,
   stdlib-shims,
 }:
 
 buildDunePackage (finalAttrs: {
   pname = "bitstring";
-  version = "4.1.1";
-
-  duneVersion = "3";
+  version = if lib.versionAtLeast ocaml.version "5.3" then "5.0.2" else "4.1.1";
 
   src = fetchFromGitHub {
     owner = "xguerin";
     repo = "bitstring";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-eO7/S9PoMybZPnQQ+q9qbqKpYO4Foc9OjW4uiwwNds8=";
+    tag = "v${finalAttrs.version}";
+    hash =
+      {
+        "5.0.2" = "sha256-MN16b37EM5NIZcvd59Y9Bd+YgcM62RdhrgCskd21tSg=";
+        "4.1.1" = "sha256-eO7/S9PoMybZPnQQ+q9qbqKpYO4Foc9OjW4uiwwNds8=";
+      }
+      ."${finalAttrs.version}";
   };
 
   propagatedBuildInputs = [ stdlib-shims ];
diff --git a/pkgs/development/ocaml-modules/bitstring/ppx.nix b/pkgs/development/ocaml-modules/bitstring/ppx.nix
index 9215c8293d28..826e01501fb2 100644
--- a/pkgs/development/ocaml-modules/bitstring/ppx.nix
+++ b/pkgs/development/ocaml-modules/bitstring/ppx.nix
@@ -1,8 +1,6 @@
 {
   lib,
   buildDunePackage,
-  fetchpatch,
-  ocaml,
   bitstring,
   ppxlib,
   ounit,
@@ -12,21 +10,15 @@ buildDunePackage {
   pname = "ppx_bitstring";
   inherit (bitstring) version src;
 
-  patches = lib.optional (lib.versionAtLeast ppxlib.version "0.36") (fetchpatch {
-    url = "https://github.com/xguerin/bitstring/commit/b42d4924cbb5ec5fd5309e6807852b63f456f35d.patch";
-    hash = "sha256-wtpSnGOzIUTmB3LhyHGopecy7F/5SYFOwaR6eReV+6g=";
-  });
-
   buildInputs = [
     bitstring
     ppxlib
   ];
 
-  doCheck = lib.versionAtLeast ocaml.version "4.08";
+  doCheck = true;
   checkInputs = [ ounit ];
 
   meta = bitstring.meta // {
     description = "Bitstrings and bitstring matching for OCaml - PPX extension";
-    broken = lib.versionOlder ppxlib.version "0.18.0";
   };
 }
diff --git a/pkgs/development/ocaml-modules/cohttp/default.nix b/pkgs/development/ocaml-modules/cohttp/default.nix
index 1642868a9d85..d0f5bbb0d751 100644
--- a/pkgs/development/ocaml-modules/cohttp/default.nix
+++ b/pkgs/development/ocaml-modules/cohttp/default.nix
@@ -22,7 +22,7 @@ buildDunePackage (finalAttrs: {
   pname = "cohttp";
   version =
     if lib.versionAtLeast ocaml.version "5.2" then
-      "6.2.2"
+      "6.3.0"
     else if lib.versionAtLeast ocaml.version "4.13" then
       "6.2.1"
     else
@@ -32,7 +32,7 @@ buildDunePackage (finalAttrs: {
     url = "https://github.com/mirage/ocaml-cohttp/releases/download/v${finalAttrs.version}/cohttp-${finalAttrs.version}.tbz";
     hash =
       {
-        "6.2.2" = "sha256-SZzYsJTO5LAP5rn2MiaA+B/ocWHpY6GWsQnBiCYQr2I=";
+        "6.3.0" = "sha256-MRMPaKnwpc2NcbVfBCRW5tNb+LeranGrbXvX29tgeyQ=";
         "6.2.1" = "sha256-ZQgCR3Y0QtHcPNkGeLgjO3mHcvA2rIHNHqreH11mpl8=";
         "5.3.1" = "sha256-9eJz08Lyn/R71+Ftsj4fPWzQGkC+ACCJhbxDTIjUV2s=";
       }
diff --git a/pkgs/development/ocaml-modules/yamlx/default.nix b/pkgs/development/ocaml-modules/yamlx/default.nix
index 15eb9a8ef564..3c77231f349f 100644
--- a/pkgs/development/ocaml-modules/yamlx/default.nix
+++ b/pkgs/development/ocaml-modules/yamlx/default.nix
@@ -8,11 +8,11 @@
 
 buildDunePackage (finalAttrs: {
   pname = "yamlx";
-  version = "0.3.0";
+  version = "0.5.0";
 
   src = fetchurl {
     url = "https://github.com/mjambon/yamlx/releases/download/${finalAttrs.version}/yamlx-${finalAttrs.version}.tbz";
-    hash = "sha256-9pGp4XSCjMEwsUqHtwoyLBKTUdPjmYccqaU3dLkgVzg=";
+    hash = "sha256-ejpFZY4G6m4/EPApN6GDwEfFC9qS8azWeJQspOCRhkA=";
   };
 
   propagatedBuildInputs = [ ppx_deriving ];
diff --git a/pkgs/development/openscad-packages/bosl2/default.nix b/pkgs/development/openscad-packages/bosl2/default.nix
index 7d4786930144..e7061d6b15cc 100644
--- a/pkgs/development/openscad-packages/bosl2/default.nix
+++ b/pkgs/development/openscad-packages/bosl2/default.nix
@@ -9,7 +9,7 @@
 
 buildOpenSCADPackage (finalAttrs: {
   pname = "bosl2";
-  version = "2.0.750";
+  version = "2.0.751";
   libName = "BOSL2";
 
   installTargets = [ "*.scad" ];
@@ -18,7 +18,7 @@ buildOpenSCADPackage (finalAttrs: {
     owner = "BelfrySCAD";
     repo = "BOSL2";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ErSJxw1hLlnyUQCXBChwBrN9kS6+l4KXYvu9bBO1m6w=";
+    hash = "sha256-WyTUmyCYcK/e+adYJysn0A2yVdYbcyGzN6ODJnIutMQ=";
   };
 
   passthru = {
diff --git a/pkgs/development/perl-modules/FileFindRule-CVE-2011-10007.patch b/pkgs/development/perl-modules/FileFindRule-CVE-2011-10007.patch
deleted file mode 100644
index dd8492c60f21..000000000000
--- a/pkgs/development/perl-modules/FileFindRule-CVE-2011-10007.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From ca70a73bb147549e62e74751d924b1dbb59d1707 Mon Sep 17 00:00:00 2001
-From: Stig Palmquist <stig@stig.io>
-Date: Thu, 5 Jun 2025 03:45:50 +0200
-Subject: [PATCH] Fix CVE-2011-10007
-
----
- lib/File/Find/Rule.pm | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/lib/File/Find/Rule.pm b/lib/File/Find/Rule.pm
-index feccc76..d4dc475 100644
---- a/lib/File/Find/Rule.pm
-+++ b/lib/File/Find/Rule.pm
-@@ -420,7 +420,7 @@ sub grep {
- 
-     $self->exec( sub {
-         local *FILE;
--        open FILE, $_ or return;
-+        open FILE, '<', $_ or return;
-         local ($_, $.);
-         while (<FILE>) {
-             for my $p (@pattern) {
--- 
-2.49.0
-
diff --git a/pkgs/development/perl-modules/JSON-XS-CVE-2025-40928.patch b/pkgs/development/perl-modules/JSON-XS-CVE-2025-40928.patch
deleted file mode 100644
index f1d258c12a3d..000000000000
--- a/pkgs/development/perl-modules/JSON-XS-CVE-2025-40928.patch
+++ /dev/null
@@ -1,31 +0,0 @@
---- a/XS.xs	2025-09-06 08:34:51.376455632 -0300
-+++ b/XS.xs	2025-09-06 08:35:30.725873619 -0300
-@@ -253,16 +253,16 @@
-   // if we recurse too deep, skip all remaining digits
-   // to avoid a stack overflow attack
-   if (expect_false (--maxdepth <= 0))
--    while (((U8)*s - '0') < 10)
-+    while ((U8)(*s - '0') < 10)
-       ++s;
- 
-   for (;;)
-     {
--      U8 dig = (U8)*s - '0';
-+      U8 dig = *s - '0';
- 
-       if (expect_false (dig >= 10))
-         {
--          if (dig == (U8)((U8)'.' - (U8)'0'))
-+          if (dig == (U8)('.' - '0'))
-             {
-               ++s;
-               json_atof_scan1 (s, accum, expo, 1, maxdepth);
-@@ -282,7 +282,7 @@
-               else if (*s == '+')
-                 ++s;
- 
--              while ((dig = (U8)*s - '0') < 10)
-+              while ((dig = (U8)(*s - '0')) < 10)
-                 exp2 = exp2 * 10 + *s++ - '0';
- 
-               *expo += neg ? -exp2 : exp2;
diff --git a/pkgs/development/python-modules/absl-py/default.nix b/pkgs/development/python-modules/absl-py/default.nix
index 21552b076199..691665b8cd61 100644
--- a/pkgs/development/python-modules/absl-py/default.nix
+++ b/pkgs/development/python-modules/absl-py/default.nix
@@ -4,17 +4,16 @@
   fetchFromGitHub,
   hatchling,
 }:
-
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "absl-py";
-  version = "2.3.1";
+  version = "2.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "abseil";
     repo = "abseil-py";
-    tag = "v${version}";
-    hash = "sha256-U8doys7SoOhtUkF0dsCFKnM9ItOoi5a6cK6zGOe/U8s=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-BnR9QnZ5AaSlboQuQnX4UKGjAVVpyzMLZ68Do3VZrE0=";
   };
 
   build-system = [ hatchling ];
@@ -27,8 +26,8 @@ buildPythonPackage rec {
   meta = {
     description = "Abseil Python Common Libraries";
     homepage = "https://github.com/abseil/abseil-py";
-    changelog = "https://github.com/abseil/abseil-py/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/abseil/abseil-py/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/bootstrap/build/default.nix b/pkgs/development/python-modules/bootstrap/build/default.nix
index 0d693e2dde58..dbd713e10482 100644
--- a/pkgs/development/python-modules/bootstrap/build/default.nix
+++ b/pkgs/development/python-modules/bootstrap/build/default.nix
@@ -37,6 +37,9 @@ let
 
           runHook postInstall
         '';
+
+        strictDeps = true;
+        __structuredAttrs = true;
       }
       // attrs
     );
diff --git a/pkgs/development/python-modules/bootstrap/flit-core/default.nix b/pkgs/development/python-modules/bootstrap/flit-core/default.nix
index 67b8a00ee0ee..5b5858e598cc 100644
--- a/pkgs/development/python-modules/bootstrap/flit-core/default.nix
+++ b/pkgs/development/python-modules/bootstrap/flit-core/default.nix
@@ -31,4 +31,7 @@ stdenv.mkDerivation {
 
     runHook postInstall
   '';
+
+  strictDeps = true;
+  __structuredAttrs = true;
 }
diff --git a/pkgs/development/python-modules/bootstrap/installer/default.nix b/pkgs/development/python-modules/bootstrap/installer/default.nix
index 9f396bb6275a..2e0c1729bf4b 100644
--- a/pkgs/development/python-modules/bootstrap/installer/default.nix
+++ b/pkgs/development/python-modules/bootstrap/installer/default.nix
@@ -31,4 +31,7 @@ stdenv.mkDerivation {
 
     runHook postInstall
   '';
+
+  strictDeps = true;
+  __structuredAttrs = true;
 }
diff --git a/pkgs/development/python-modules/bootstrap/packaging/default.nix b/pkgs/development/python-modules/bootstrap/packaging/default.nix
index 8f429e5f5c65..e0e067060641 100644
--- a/pkgs/development/python-modules/bootstrap/packaging/default.nix
+++ b/pkgs/development/python-modules/bootstrap/packaging/default.nix
@@ -28,4 +28,7 @@ stdenv.mkDerivation {
 
     runHook postInstall
   '';
+
+  strictDeps = true;
+  __structuredAttrs = true;
 }
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index 35c75197bacf..f4383510640c 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -358,13 +358,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "boto3-stubs";
-  version = "1.43.78";
+  version = "1.43.79";
   pyproject = true;
 
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit (finalAttrs) version;
-    hash = "sha256-TosHjxSZH4l0/IOrjZb8cuaRP8iiRy1x3qD+ItaHZQ8=";
+    hash = "sha256-bfdQ6vu9WakrZ4v7ci0FLJ2b6FtACw5KI2e/LgJZ4k4=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/caido-schema-proxy/default.nix b/pkgs/development/python-modules/caido-schema-proxy/default.nix
index 6e45c9d226d6..b1054f0e8891 100644
--- a/pkgs/development/python-modules/caido-schema-proxy/default.nix
+++ b/pkgs/development/python-modules/caido-schema-proxy/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "caido-schema-proxy";
-  version = "0.58.0";
+  version = "0.58.2";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -16,7 +16,7 @@ buildPythonPackage (finalAttrs: {
   src = fetchPypi {
     pname = "caido_schema_proxy";
     inherit (finalAttrs) version;
-    hash = "sha256-1vGmDivVqx3XN1CUR/XwgYTG/mwI6Zny0Nv8AKUpOa4=";
+    hash = "sha256-AABaSkaSDs4meoDxG4sbOd/jxGTmo+dodDdqzE9UvWk=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/comet-ml/default.nix b/pkgs/development/python-modules/comet-ml/default.nix
index 15f5ea10c677..e955d026fcb7 100644
--- a/pkgs/development/python-modules/comet-ml/default.nix
+++ b/pkgs/development/python-modules/comet-ml/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "comet-ml";
-  version = "3.58.4";
+  version = "3.58.5";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -32,7 +32,7 @@ buildPythonPackage (finalAttrs: {
   src = fetchPypi {
     pname = "comet_ml";
     inherit (finalAttrs) version;
-    hash = "sha256-h5sYsTA4fZcPdN+w/gWrKzCLFstbVmbFuwHUTQ621Dk=";
+    hash = "sha256-OSCDQ20UiYhvmyE2/qLAaIVKf1mfXlM4yUrqhW2C5zo=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/crontab/default.nix b/pkgs/development/python-modules/crontab/default.nix
deleted file mode 100644
index b73902e45ecf..000000000000
--- a/pkgs/development/python-modules/crontab/default.nix
+++ /dev/null
@@ -1,46 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  nix-update-script,
-  pytestCheckHook,
-  python-dateutil,
-  pytz,
-  setuptools,
-}:
-
-buildPythonPackage (finalAttrs: {
-  pname = "crontab";
-  version = "1.0.5";
-  pyproject = true;
-
-  __structuredAttrs = true;
-
-  src = fetchFromGitHub {
-    owner = "josiahcarlson";
-    repo = "parse-crontab";
-    tag = finalAttrs.version;
-    hash = "sha256-iZS4vkfp93BK5wp1S3qCg0bC7NcT7o5/nNMRI+SXTws=";
-  };
-
-  build-system = [ setuptools ];
-
-  dependencies = [
-    python-dateutil
-    pytz
-  ];
-
-  nativeCheckInputs = [ pytestCheckHook ];
-
-  pythonImportsCheck = [ "crontab" ];
-
-  passthru.updateScript = nix-update-script { };
-
-  meta = {
-    description = "Parse and use crontab schedules in Python";
-    homepage = "https://github.com/josiahcarlson/parse-crontab";
-    changelog = "https://github.com/josiahcarlson/parse-crontab/blob/${finalAttrs.src.rev}/changelog.txt";
-    license = lib.licenses.lgpl21Only;
-    maintainers = with lib.maintainers; [ fab ];
-  };
-})
diff --git a/pkgs/development/python-modules/datamodel-code-generator/default.nix b/pkgs/development/python-modules/datamodel-code-generator/default.nix
index 875cb53d382d..4ab9cc01b5a9 100644
--- a/pkgs/development/python-modules/datamodel-code-generator/default.nix
+++ b/pkgs/development/python-modules/datamodel-code-generator/default.nix
@@ -123,6 +123,9 @@ buildPythonPackage (finalAttrs: {
     "test_type_checking_imports_default_to_runtime_imports_for_modular_pydantic_ruff"
   ];
 
+  # Some of the tests use localhost networking.
+  __darwinAllowLocalNetworking = true;
+
   pythonImportsCheck = [ "datamodel_code_generator" ];
 
   meta = {
diff --git a/pkgs/development/python-modules/dbus-python/default.nix b/pkgs/development/python-modules/dbus-python/default.nix
index ed518d645081..fc648cdf7d1d 100644
--- a/pkgs/development/python-modules/dbus-python/default.nix
+++ b/pkgs/development/python-modules/dbus-python/default.nix
@@ -14,85 +14,100 @@
   # native dependencies
   dbus,
   dbus-glib,
+
+  # test dependencies
+  pygobject3,
 }:
 
-lib.fix (
-  finalPackage:
-  buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
+  pname = "dbus-python";
+  version = "1.4.0";
+  pyproject = true;
+
+  disabled = isPyPy;
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  src = fetchPypi {
     pname = "dbus-python";
-    version = "1.4.0";
-    pyproject = true;
+    inherit (finalAttrs) version;
+    hash = "sha256-mRZm5Jj2Db8+Sbi3Z49VWbimUDT99hquYs3s232Jx3A=";
+  };
 
-    disabled = isPyPy;
+  patches = [
+    # reduce required dependencies
+    # https://gitlab.freedesktop.org/dbus/dbus-python/-/merge_requests/23
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/dbus/dbus-python/-/commit/d5e19698a8d6e1485f05b67a5b2daa2392819aaf.patch";
+      hash = "sha256-Rmj/ByRLiLnIF3JsMBElJugxsG8IARcBdixLhoWgIYU=";
+    })
 
-    outputs = [
-      "out"
-      "dev"
-    ];
+    # Fix on Python 3.15, the patch did not achieve what it aimed for anyway.
+    # https://gitlab.freedesktop.org/dbus/dbus-python/-/work_items/59
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/dbus/dbus-python/-/commit/ebecd1747c382a57ad8e47d0e32112cdbd454b40.patch";
+      hash = "sha256-Hg4o+FPJvQ1/RW9fd8UJg/YEeVOvbJCov7SS7bT0vvs=";
+      revert = true;
+    })
+  ];
 
-    src = fetchPypi {
-      inherit pname version;
-      hash = "sha256-mRZm5Jj2Db8+Sbi3Z49VWbimUDT99hquYs3s232Jx3A=";
-    };
+  postPatch = ''
+    # we provide patchelf natively, not through the python package
+    sed -i '/patchelf/d' pyproject.toml
 
-    patches = [
-      # reduce required dependencies
-      # https://gitlab.freedesktop.org/dbus/dbus-python/-/merge_requests/23
-      (fetchpatch {
-        url = "https://gitlab.freedesktop.org/dbus/dbus-python/-/commit/d5e19698a8d6e1485f05b67a5b2daa2392819aaf.patch";
-        hash = "sha256-Rmj/ByRLiLnIF3JsMBElJugxsG8IARcBdixLhoWgIYU=";
-      })
-    ];
+    patchShebangs test/*.sh
+  '';
 
-    postPatch = ''
-      # we provide patchelf natively, not through the python package
-      sed -i '/patchelf/d' pyproject.toml
+  nativeBuildInputs = [
+    dbus # build systems checks for `dbus-run-session` in PATH
+    meson
+    meson-python
+    pkg-config
+  ];
 
-      patchShebangs test/*.sh
-    '';
+  buildInputs = [
+    dbus
+    dbus-glib
+  ];
 
-    nativeBuildInputs = [
-      dbus # build systems checks for `dbus-run-session` in PATH
-      meson
-      meson-python
-      pkg-config
-    ];
+  checkInputs = [
+    pygobject3
+  ];
 
-    buildInputs = [
-      dbus
-      dbus-glib
-    ];
+  mesonFlags = [
+    (lib.mesonEnable "tests" finalAttrs.finalPackage.doInstallCheck)
+  ];
 
-    mesonFlags = [ (lib.mesonBool "tests" finalPackage.doInstallCheck) ];
+  # workaround bug in meson-python
+  # https://github.com/mesonbuild/meson-python/issues/240
+  postInstall = ''
+    mkdir -p $dev/lib
+    mv $out/${python.sitePackages}/.dbus_python.mesonpy.libs/pkgconfig/ $dev/lib
+  '';
 
-    # workaround bug in meson-python
-    # https://github.com/mesonbuild/meson-python/issues/240
-    postInstall = ''
-      mkdir -p $dev/lib
-      mv $out/${python.sitePackages}/.dbus_python.mesonpy.libs/pkgconfig/ $dev/lib
-    '';
+  # make sure the Cflags in the pkgconfig file are correct and make the structure backwards compatible
+  postFixup = ''
+    ln -s $dev/include/*/dbus_python/dbus-1.0/ $dev/include/dbus-1.0
+  '';
 
-    # make sure the Cflags in the pkgconfig file are correct and make the structure backwards compatible
-    postFixup = ''
-      ln -s $dev/include/*/dbus_python/dbus-1.0/ $dev/include/dbus-1.0
-    '';
+  nativeCheckInputs = [ dbus.out ];
 
-    nativeCheckInputs = [ dbus.out ];
+  checkPhase = ''
+    runHook preCheck
 
-    checkPhase = ''
-      runHook preCheck
+    meson test -C build --no-rebuild --print-errorlogs --timeout-multiplier 0
 
-      meson test -C build --no-rebuild --print-errorlogs --timeout-multiplier 0
+    runHook postCheck
+  '';
 
-      runHook postCheck
-    '';
-
-    meta = {
-      description = "Python DBus bindings";
-      homepage = "https://gitlab.freedesktop.org/dbus/dbus-python";
-      license = lib.licenses.mit;
-      platforms = dbus.meta.platforms;
-      maintainers = [ ];
-    };
-  }
-)
+  meta = {
+    description = "Python DBus bindings";
+    homepage = "https://gitlab.freedesktop.org/dbus/dbus-python";
+    license = lib.licenses.mit;
+    platforms = dbus.meta.platforms;
+    maintainers = [ ];
+  };
+})
diff --git a/pkgs/development/python-modules/fastapi/default.nix b/pkgs/development/python-modules/fastapi/default.nix
index 1be0d0d05b02..dd805f9b5a4e 100644
--- a/pkgs/development/python-modules/fastapi/default.nix
+++ b/pkgs/development/python-modules/fastapi/default.nix
@@ -41,7 +41,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "fastapi";
-  version = "0.139.0";
+  version = "0.141.1";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -49,7 +49,7 @@ buildPythonPackage (finalAttrs: {
     owner = "tiangolo";
     repo = "fastapi";
     tag = finalAttrs.version;
-    hash = "sha256-c4balkkmBv7zKRQnYRpRohVjP23m0HvtdiVrJtgNKYo=";
+    hash = "sha256-5P9aDMS7gLti2CBlrucvjgl4Od1mti9ityPdqxI1RIM=";
   };
 
   build-system = [ pdm-backend ];
diff --git a/pkgs/development/python-modules/geoip2/default.nix b/pkgs/development/python-modules/geoip2/default.nix
index b90d1c34edb5..d6dd6a5e6f2a 100644
--- a/pkgs/development/python-modules/geoip2/default.nix
+++ b/pkgs/development/python-modules/geoip2/default.nix
@@ -50,6 +50,8 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "geoip2" ];
 
+  __darwinAllowLocalNetworking = true;
+
   meta = {
     description = "GeoIP2 webservice client and database reader";
     homepage = "https://github.com/maxmind/GeoIP2-python";
diff --git a/pkgs/development/python-modules/gflanguages/default.nix b/pkgs/development/python-modules/gflanguages/default.nix
index 0072dc6945f3..a9ab94c90ecc 100644
--- a/pkgs/development/python-modules/gflanguages/default.nix
+++ b/pkgs/development/python-modules/gflanguages/default.nix
@@ -14,12 +14,12 @@
 
 buildPythonPackage rec {
   pname = "gflanguages";
-  version = "0.7.9";
+  version = "0.7.10";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-57a0dvGuwGux9fuOnBEoZCnbJ0RQ+T0+5SCUrSro5BE=";
+    hash = "sha256-d5tSIlJhwlJ/8lwYlfLoPglV57+bNehlnghDwk4nNU0=";
   };
 
   # Relax the dependency on protobuf 3. Other packages in the Google Fonts
diff --git a/pkgs/development/python-modules/gst-python/default.nix b/pkgs/development/python-modules/gst-python/default.nix
index 1934d3a14ea6..af6a9347b0e3 100644
--- a/pkgs/development/python-modules/gst-python/default.nix
+++ b/pkgs/development/python-modules/gst-python/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "gst-python";
-  version = "1.28.5";
+  version = "1.28.6";
 
   pyproject = false;
 
@@ -32,7 +32,7 @@ buildPythonPackage rec {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-python/gst-python-${version}.tar.xz";
-    hash = "sha256-CsRhtXALl2aZiqaGQ5BkyvWMpP2vhI39R3tadwCxdsw=";
+    hash = "sha256-NNWEQMU7VJWhI9Ckt7ervG6XkqWyGVTbhqB5Gxb24BI=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/httpx2/default.nix b/pkgs/development/python-modules/httpx2/default.nix
index a92c7ccb868d..962f8760414e 100644
--- a/pkgs/development/python-modules/httpx2/default.nix
+++ b/pkgs/development/python-modules/httpx2/default.nix
@@ -1,4 +1,5 @@
 {
+  stdenv,
   lib,
   buildPythonPackage,
   fetchFromGitHub,
@@ -114,6 +115,10 @@ buildPythonPackage (finalAttrs: {
     "test_client_decode_text_using_autodetect"
     "test_client_decode_text_using_explicit_encoding"
     "test_response_decode_text_using_autodetect"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    # TODO?
+    "test_keepalive_ping"
   ];
 
   passthru.tests = {
diff --git a/pkgs/development/python-modules/hyprland-monitors/default.nix b/pkgs/development/python-modules/hyprland-monitors/default.nix
index 67052ce556eb..c32040664027 100644
--- a/pkgs/development/python-modules/hyprland-monitors/default.nix
+++ b/pkgs/development/python-modules/hyprland-monitors/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "hyprland-monitors";
-  version = "0.8.0";
+  version = "0.9.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "BlueManCZ";
     repo = "hyprland-monitors";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-a7fEDPPN9XYsrpE99C9c9MZGpqg24ZlY6vvHzgvNtzc=";
+    hash = "sha256-7nrLBsU7QacSf5l0Y/LgegfHtx2qHBNCJUBz0cc3dLE=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/hyprland-schema/default.nix b/pkgs/development/python-modules/hyprland-schema/default.nix
index 10d618b86c0a..07fd86860de0 100644
--- a/pkgs/development/python-modules/hyprland-schema/default.nix
+++ b/pkgs/development/python-modules/hyprland-schema/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "hyprland-schema";
-  version = "0.7.0";
+  version = "0.7.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "BlueManCZ";
     repo = "hyprland-schema";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5wm21kpn7Car4hntm+ZYG0xdRBpfbwI57yCBmoHmooQ=";
+    hash = "sha256-36nSnuiWtJeCGcxJB2hNlbWEd0t2Ke5hhsUJddoap+w=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index 251a4a99f7c1..5b9241fb3ef8 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202608241";
+  version = "0.1.202608251";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-IBVOk3VLGpn4xKbmbDPj70qM3H/KuKT9X52e4HVsNtQ=";
+    hash = "sha256-BiObFh1DdHQTadEHjkg5yh2DH/gK1rDAEDD1iI41iG4=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/itkwasm/default.nix b/pkgs/development/python-modules/itkwasm/default.nix
index 0bbf4042c69b..9322dace1811 100644
--- a/pkgs/development/python-modules/itkwasm/default.nix
+++ b/pkgs/development/python-modules/itkwasm/default.nix
@@ -13,12 +13,12 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "itkwasm";
-  version = "1.0b200";
+  version = "1.0b201";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-vhN4Nm5tuGDRYYZKFyC+mH+LxW4UXmVxZDzsQI48U4s=";
+    hash = "sha256-f1DRcDlGW0y8VwfIrCEWaUIhN3zrgsbWsK/SJRbtbqM=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/jenkins-job-builder/default.nix b/pkgs/development/python-modules/jenkins-job-builder/default.nix
index 83e64b65474b..ef3de8c5dee7 100644
--- a/pkgs/development/python-modules/jenkins-job-builder/default.nix
+++ b/pkgs/development/python-modules/jenkins-job-builder/default.nix
@@ -10,7 +10,7 @@
   six,
   stevedore,
   pytestCheckHook,
-  setuptools,
+  setuptools_80,
   testtools,
   pytest-mock,
   nixosTests,
@@ -18,21 +18,21 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "jenkins-job-builder";
-  version = "6.4.4";
+  version = "6.5.0";
   pyproject = true;
 
   # forge at opendev.org does not provide release tarballs
   src = fetchPypi {
     pname = "jenkins_job_builder";
     inherit (finalAttrs) version;
-    hash = "sha256-7PpCDpe3KLRpt+R/Nu+qxdDxLKWVqTiCPK3j+nNaum8=";
+    hash = "sha256-9E3tWR9olpAZrloh/dxsIztz2PJJfRJrPUzMvpuLFJ0=";
   };
 
   postPatch = ''
     export HOME=$(mktemp -d)
   '';
 
-  build-system = [ setuptools ];
+  build-system = [ setuptools_80 ];
 
   dependencies = [
     pbr
diff --git a/pkgs/development/python-modules/jsonpatch/default.nix b/pkgs/development/python-modules/jsonpatch/default.nix
index 962ab4d756c7..ebff042dfe12 100644
--- a/pkgs/development/python-modules/jsonpatch/default.nix
+++ b/pkgs/development/python-modules/jsonpatch/default.nix
@@ -4,21 +4,26 @@
   fetchFromGitHub,
   jsonpointer,
   pytestCheckHook,
+  setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "jsonpatch";
   version = "1.33";
-  format = "setuptools";
+
+  __structuredAttrs = true;
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "stefankoegl";
     repo = "python-json-patch";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-JHBB64LExzHQVoFF2xcsqGlNWX/YeEBa1M/TmfeQLWI=";
   };
 
-  propagatedBuildInputs = [ jsonpointer ];
+  build-system = [ setuptools ];
+
+  dependencies = [ jsonpointer ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
@@ -32,4 +37,4 @@ buildPythonPackage rec {
     license = lib.licenses.bsd3;
     maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/jupyter-collaboration-ui/default.nix b/pkgs/development/python-modules/jupyter-collaboration-ui/default.nix
index d6417013ec21..b64484c40702 100644
--- a/pkgs/development/python-modules/jupyter-collaboration-ui/default.nix
+++ b/pkgs/development/python-modules/jupyter-collaboration-ui/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "jupyter-collaboration-ui";
-  version = "3.0.0";
+  version = "3.0.2";
   pyproject = true;
   __structuredAttrs = true;
 
   src = fetchPypi {
     pname = "jupyter_collaboration_ui";
     inherit (finalAttrs) version;
-    hash = "sha256-cPR+sCvX1RqLTLcPqQ6+TS8OrDUNkVxcOzAYySiqXx0=";
+    hash = "sha256-X2o6WEb5tAk6EYV212cx/fAa3SL7F5WmKyn9Pd/dExQ=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/jupyter-collaboration/default.nix b/pkgs/development/python-modules/jupyter-collaboration/default.nix
index ee01b55117ce..e5fb83d2864f 100644
--- a/pkgs/development/python-modules/jupyter-collaboration/default.nix
+++ b/pkgs/development/python-modules/jupyter-collaboration/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  pythonOlder,
 
   # build-system
   hatchling,
@@ -68,6 +69,10 @@ buildPythonPackage (finalAttrs: {
   disabledTests = [
     # Failed: Timeout (>300.0s) from pytest-timeout
     "test_document_ttl_from_settings"
+  ]
+  ++ lib.optionals (pythonOlder "3.14") [
+    # pytest.PytestUnraisableExceptionWarning: Exception ignored in: None
+    "test_dirty"
   ];
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index eb6e218d354c..ca9677848d91 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -110,6 +110,7 @@ buildPythonPackage (finalAttrs: {
     ffmpeg-headless
     freetype
     qhull
+    pybind11
     libraqm
   ]
   ++ lib.optionals enableGtk3 [
@@ -123,7 +124,6 @@ buildPythonPackage (finalAttrs: {
   build-system = [
     certifi
     numpy
-    pybind11
     meson-python
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/monty/default.nix b/pkgs/development/python-modules/monty/default.nix
index 1ee9626ab6e5..542e15cbbf1c 100644
--- a/pkgs/development/python-modules/monty/default.nix
+++ b/pkgs/development/python-modules/monty/default.nix
@@ -9,42 +9,43 @@
   setuptools-scm,
 
   # dependencies
-  msgpack,
+  numpy,
   ruamel-yaml,
 
   # optional-dependencies
-  coverage,
-  pymongo,
-  pytest,
-  pytest-cov,
-  types-requests,
-  sphinx,
-  sphinx-rtd-theme,
+  invoke,
+  ipython,
+  msgpack,
+  myst-parser,
   orjson,
   pandas,
-  pydantic,
   pint,
+  pydantic,
+  pymongo,
+  requests,
+  roman-numerals,
+  sphinx,
+  sphinx-markdown-builder,
+  sphinx-rtd-theme,
   torch,
   tqdm,
-  invoke,
-  requests,
 
   # tests
-  ipython,
-  numpy,
   pytestCheckHook,
+  pytest-benchmark,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "monty";
-  version = "2025.3.3";
+  version = "2026.7.16";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
-    owner = "materialsvirtuallab";
+    owner = "materialyzeai";
     repo = "monty";
-    tag = "v${version}";
-    hash = "sha256-3UoACKJtPm2BrkJP8z7BFrh3baRyL/S3VwCG3K8AQn0=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-x5FNw7E3rtrgCWVhMsBpnO+uwu+mB3ELNFdd33+uFds=";
   };
 
   build-system = [
@@ -53,53 +54,39 @@ buildPythonPackage rec {
   ];
 
   dependencies = [
-    msgpack
+    numpy
     ruamel-yaml
   ];
 
   optional-dependencies = rec {
-    ci = [
-      coverage
-      pymongo
-      pytest
-      pytest-cov
-      types-requests
-    ]
-    ++ optional;
     dev = [ ipython ];
     docs = [
       sphinx
       sphinx-rtd-theme
+      requests
+      invoke
+      myst-parser
+      sphinx-markdown-builder
+      roman-numerals
     ];
     json = [
       orjson
       pandas
+      pint
       pydantic
       pymongo
-    ]
-    ++ lib.optionals (pythonOlder "3.13") [
-      pint
       torch
     ];
     multiprocessing = [ tqdm ];
     optional = dev ++ json ++ multiprocessing ++ serialization;
     serialization = [ msgpack ];
-    task = [
-      invoke
-      requests
-    ];
   };
 
   nativeCheckInputs = [
-    ipython
-    numpy
-    pandas
-    pydantic
-    pymongo
     pytestCheckHook
-    torch
-    tqdm
-  ];
+    pytest-benchmark
+  ]
+  ++ finalAttrs.passthru.optional-dependencies.optional;
 
   pythonImportsCheck = [ "monty" ];
 
@@ -110,9 +97,12 @@ buildPythonPackage rec {
       standard library. Examples include useful utilities like transparent support for zipped files, useful design
       patterns such as singleton and cached_class, and many more.
     ";
-    homepage = "https://github.com/materialsvirtuallab/monty";
-    changelog = "https://github.com/materialsvirtuallab/monty/releases/tag/${src.tag}";
+    homepage = "https://github.com/materialyzeai/monty";
+    changelog = "https://github.com/materialyzeai/monty/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ psyanticy ];
+    maintainers = with lib.maintainers; [
+      psyanticy
+      berquist
+    ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index ec4b3f0f6999..fccd35731e77 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -163,8 +163,8 @@ in
       "sha256-EMl1KCe3/wEmsfTPgMbzDWo1V+NakqzhZJRPYNadeZQ=";
 
   mypy-boto3-batch =
-    buildMypyBoto3Package "batch" "1.43.76"
-      "sha256-LYp5PZ8yfozAhn9yF1a2FboHX3xqGoUytKCh9U9AC4U=";
+    buildMypyBoto3Package "batch" "1.43.79"
+      "sha256-3D1VN30a3RNbVUIeu2T2IBH18327SHca+LzmqbUec8c=";
 
   mypy-boto3-billingconductor =
     buildMypyBoto3Package "billingconductor" "1.43.7"
@@ -335,12 +335,12 @@ in
       "sha256-3JYcWKFk0dKJg/qn+EBvxeAO5xh5PXCU3dTEWDr1oXI=";
 
   mypy-boto3-connect =
-    buildMypyBoto3Package "connect" "1.43.73"
-      "sha256-2QzVxRO0JU0CWqv6RKGXMOkDloYoIHCqt98qcozFmQc=";
+    buildMypyBoto3Package "connect" "1.43.79"
+      "sha256-nup6lqkxN1g/df7cw2mCLKMGHuCm52BeoHhAgSIZzn8=";
 
   mypy-boto3-connect-contact-lens =
-    buildMypyBoto3Package "connect-contact-lens" "1.43.0"
-      "sha256-7rXsHj0fTM5UPbdvtGH0AimOjKbrrSZwW7pueKjF/uA=";
+    buildMypyBoto3Package "connect-contact-lens" "1.43.79"
+      "sha256-pfKiLx6qZJxvFGY7Jm+355d1fT4knIoZYD52VtWn+ck=";
 
   mypy-boto3-connectcampaigns =
     buildMypyBoto3Package "connectcampaigns" "1.43.0"
@@ -706,8 +706,8 @@ in
       "sha256-9XMdnVsYUmz8Uf9kAgVMbG960vy0TOJturoD9/ZoM98=";
 
   mypy-boto3-kafka =
-    buildMypyBoto3Package "kafka" "1.43.66"
-      "sha256-reGKCXTFRIebc26zStSUrcX8TxFF+3FJ+t4cSaSpnW0=";
+    buildMypyBoto3Package "kafka" "1.43.79"
+      "sha256-kgfPSlNO0uj6Az83Bc/p3uyjqI3VMgwK+5/6tRoY4ok=";
 
   mypy-boto3-kafkaconnect =
     buildMypyBoto3Package "kafkaconnect" "1.43.0"
diff --git a/pkgs/development/python-modules/openai/default.nix b/pkgs/development/python-modules/openai/default.nix
index 41871cd05921..60af6eade212 100644
--- a/pkgs/development/python-modules/openai/default.nix
+++ b/pkgs/development/python-modules/openai/default.nix
@@ -21,11 +21,17 @@
   aiohttp,
   httpx-aiohttp,
 
+  # optional-dependencies (bedock)
+  botocore,
+
   # optional-dependencies (datalib)
   numpy,
   pandas,
   pandas-stubs,
 
+  # optional-dependencies (httpx2)
+  httpx2,
+
   # optional-dependencies (realtime)
   websockets,
 
@@ -36,29 +42,29 @@
   pytestCheckHook,
   dirty-equals,
   inline-snapshot,
-  nest-asyncio,
+  jsonschema,
   pytest-asyncio,
   pytest-mock,
   pytest-xdist,
   respx,
 
   # optional-dependencies toggle
-  withAiohttp ? true,
+  withAiohttp ? false,
   withDatalib ? false,
-  withRealtime ? true,
-  withVoiceHelpers ? true,
+  withRealtime ? false,
+  withVoiceHelpers ? false,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "openai";
-  version = "2.41.1";
+  version = "2.53.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "openai";
     repo = "openai-python";
-    tag = "v${version}";
-    hash = "sha256-jSkBxZY5POlrznhBwFMR2NcL92uGRSYI6BDDC3C7RfU=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-XwiSIKjYD07zhx8uIO8wsPWdAASBCJ5KqFUgdk+uaUU=";
   };
 
   postPatch = ''substituteInPlace pyproject.toml --replace-fail "hatchling==1.26.3" "hatchling"'';
@@ -78,21 +84,29 @@ buildPythonPackage rec {
     tqdm
     typing-extensions
   ]
-  ++ lib.optionals withAiohttp optional-dependencies.aiohttp
-  ++ lib.optionals withDatalib optional-dependencies.datalib
-  ++ lib.optionals withRealtime optional-dependencies.realtime
-  ++ lib.optionals withVoiceHelpers optional-dependencies.voice-helpers;
+  ++ lib.optionals withAiohttp finalAttrs.passthru.optional-dependencies.aiohttp
+  ++ lib.optionals withDatalib finalAttrs.passthru.optional-dependencies.datalib
+  ++ lib.optionals withRealtime finalAttrs.passthru.optional-dependencies.realtime
+  ++ lib.optionals withVoiceHelpers finalAttrs.passthru.optional-dependencies.voice-helpers;
 
   optional-dependencies = {
     aiohttp = [
       aiohttp
       httpx-aiohttp
     ];
+    bedrock = [
+      botocore
+    ];
     datalib = [
       numpy
       pandas
       pandas-stubs
     ];
+    httpx2 = [
+      anyio
+      httpx
+      httpx2
+    ];
     realtime = [
       websockets
     ];
@@ -108,12 +122,14 @@ buildPythonPackage rec {
     pytestCheckHook
     dirty-equals
     inline-snapshot
-    nest-asyncio
+    jsonschema
     pytest-asyncio
     pytest-mock
     pytest-xdist
     respx
-  ];
+  ]
+  # including pandas-stubs would cause infinite recursion
+  ++ lib.concatAttrValues (lib.removeAttrs finalAttrs.passthru.optional-dependencies [ "datalib" ]);
 
   disabledTestPaths = [
     # Test makes network requests
@@ -126,8 +142,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python client library for the OpenAI API";
     homepage = "https://github.com/openai/openai-python";
-    changelog = "https://github.com/openai/openai-python/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/openai/openai-python/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = [ lib.maintainers.malo ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/opower/default.nix b/pkgs/development/python-modules/opower/default.nix
index a06c810156bf..af6c25828a76 100644
--- a/pkgs/development/python-modules/opower/default.nix
+++ b/pkgs/development/python-modules/opower/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "opower";
-  version = "0.19.0";
+  version = "0.20.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tronikos";
     repo = "opower";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-EMR04egHcv2Ln51g+t7uEAoC19JKa6lw7VhpaZJlrG0=";
+    hash = "sha256-ZNWZ46UWMcp0imJi9WFdfNnXrGx+5tHsf33F58Pn4XA=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pbr/default.nix b/pkgs/development/python-modules/pbr/default.nix
index d0ea8d49103c..a31a700e5c5d 100644
--- a/pkgs/development/python-modules/pbr/default.nix
+++ b/pkgs/development/python-modules/pbr/default.nix
@@ -9,19 +9,19 @@
 
 buildPythonPackage rec {
   pname = "pbr";
-  version = "7.0.3";
+  version = "7.1.2";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-tGAE7DClMkZyaD7ISK7Z6PxQCw0mHUCjIpwtK7/O3Ck=";
+    hash = "sha256-Rjm4fMkdDVhHG3vaHyi30ISbpD15NcTEgvPHT+9xmAQ=";
   };
 
   build-system = [ setuptools ];
 
   dependencies = [
     distutils # for distutils.command in pbr/packaging.py
-    setuptools # for pkg_resources
+    setuptools
   ];
 
   # check in passthru.tests.pytest to escape infinite recursion with fixtures
diff --git a/pkgs/development/python-modules/pocket-tts/default.nix b/pkgs/development/python-modules/pocket-tts/default.nix
index 3db78e3c6c37..eae65524de18 100644
--- a/pkgs/development/python-modules/pocket-tts/default.nix
+++ b/pkgs/development/python-modules/pocket-tts/default.nix
@@ -30,7 +30,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pocket-tts";
-  version = "2.1.0";
+  version = "3.0.2";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -38,17 +38,13 @@ buildPythonPackage (finalAttrs: {
     owner = "kyutai-labs";
     repo = "pocket-tts";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TonwnbH1FQMoK7SyKiCyEVIn9TY8drUyN2ZOq8JpXj4=";
+    hash = "sha256-/8MLr8Z1UDqrS5DBVPdsKOKO2XCFjk8aK+CXY1lYjRQ=";
   };
 
   build-system = [
     hatchling
   ];
 
-  pythonRelaxDeps = [
-    "beartype"
-    "python-multipart"
-  ];
   dependencies = [
     beartype
     einops
diff --git a/pkgs/development/python-modules/posthog/default.nix b/pkgs/development/python-modules/posthog/default.nix
index e94bf194bd76..55c5e4187e43 100644
--- a/pkgs/development/python-modules/posthog/default.nix
+++ b/pkgs/development/python-modules/posthog/default.nix
@@ -4,13 +4,19 @@
   backoff,
   buildPythonPackage,
   distro,
+  django,
   fetchFromGitHub,
   freezegun,
+  google-genai,
+  mcp,
   mock,
   monotonic,
   openai,
+  opentelemetry-exporter-otlp,
+  opentelemetry-sdk,
   parameterized,
   pytest-asyncio,
+  pytest-bdd,
   pytestCheckHook,
   python-dateutil,
   pythonAtLeast,
@@ -18,18 +24,19 @@
   setuptools,
   six,
   typing-extensions,
+  zstandard,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "posthog";
-  version = "7.11.0";
+  version = "7.39.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "PostHog";
     repo = "posthog-python";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-GmwFI23HUp9/p6o+UFCES7WwvnexrBrVTDhLd/YYWOs=";
+    tag = "posthog-v${finalAttrs.version}";
+    hash = "sha256-HmINi03pq2dkTaCLjdkzMqK7jWOyu5BRCIT5wz3m22g=";
   };
 
   build-system = [ setuptools ];
@@ -46,36 +53,28 @@ buildPythonPackage (finalAttrs: {
 
   nativeCheckInputs = [
     anthropic
+    django
     freezegun
+    google-genai
+    mcp
     mock
     openai
+    opentelemetry-exporter-otlp
+    opentelemetry-sdk
     parameterized
     pytest-asyncio
+    pytest-bdd
     pytestCheckHook
+    zstandard
   ];
 
   pythonImportsCheck = [ "posthog" ];
 
   disabledTests = [
-    "test_load_feature_flags_wrong_key"
     # Tests require network access
     "test_excepthook"
     "test_request"
-    "test_trying_to_use_django_integration"
     "test_upload"
-    # AssertionError: 2 != 3
-    "test_flush_interval"
-    # len(client.distinct_ids_feature_flags_reported) = 101 != i % 100 + 1
-    "test_capture_multiple_users_doesnt_out_of_memory"
-  ]
-  ++ lib.optionals (pythonAtLeast "3.14") [
-    # Pydantic V1 functionality isn't compatible with Python 3.14
-    "test_clean_pydantic"
-  ];
-
-  disabledTestPaths = [
-    # Missing parts
-    "posthog/test/integrations/test_middleware.py"
   ];
 
   meta = {
diff --git a/pkgs/development/python-modules/pyarrow/default.nix b/pkgs/development/python-modules/pyarrow/default.nix
index f21dac9e39cc..d911cff61143 100644
--- a/pkgs/development/python-modules/pyarrow/default.nix
+++ b/pkgs/development/python-modules/pyarrow/default.nix
@@ -21,6 +21,7 @@
   scikit-build-core,
   setuptools,
   setuptools-scm,
+  tzdata,
 }:
 
 let
@@ -121,8 +122,6 @@ buildPythonPackage rec {
     "pyarrow/tests/test_csv.py::TestThreadedCSVTableRead::test_cancellation"
     # expects arrow-cpp headers to be bundled.
     "pyarrow/tests/test_cpp_internals.py::test_pyarrow_include"
-    # Searches for TZDATA in /usr.
-    "pyarrow/tests/test_orc.py::test_example_using_json"
     # AssertionError: assert 'Europe/Monaco' == 'Europe/Paris'
     "pyarrow/tests/test_types.py::test_dateutil_tzinfo_to_string"
     # These fail with xxx_fixture not found.
@@ -168,6 +167,13 @@ buildPythonPackage rec {
   disabledTests = [ "GcsFileSystem" ];
 
   preCheck = ''
+    # Prepare r/w zoneinfo that test_orc can then copy and modify.
+    export TZDIR="$TMPDIR/zoneinfo"
+    cp -R "${tzdata}/${python.sitePackages}/tzdata/zoneinfo" "$TZDIR"
+    chmod -R u+w "$TZDIR"
+    substituteInPlace pyarrow/tests/test_orc.py \
+      --replace-fail "Path('/usr/share/zoneinfo')" "Path('$TZDIR')"
+
     export PARQUET_TEST_DATA="${arrow-cpp.env.PARQUET_TEST_DATA}"
     shopt -s extglob
     rm -r pyarrow/!(conftest.py|tests)
diff --git a/pkgs/development/python-modules/pydocket/default.nix b/pkgs/development/python-modules/pydocket/default.nix
index 25014d5d8c62..1e78537cdfbe 100644
--- a/pkgs/development/python-modules/pydocket/default.nix
+++ b/pkgs/development/python-modules/pydocket/default.nix
@@ -25,7 +25,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pydocket";
-  version = "0.23.1";
+  version = "0.24.1";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -33,7 +33,7 @@ buildPythonPackage (finalAttrs: {
     owner = "chrisguidry";
     repo = "docket";
     tag = finalAttrs.version;
-    hash = "sha256-52UHiQUh4Aa5skYCWow+vKjtzPmcRQ9/wEW3UvLbHX4=";
+    hash = "sha256-Z/cmxHLOjZmgugSNo/XzBa/62wmAVpYQYs0Xwtly+OI=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pyintesishome/default.nix b/pkgs/development/python-modules/pyintesishome/default.nix
index 07a7487b60b1..eef6b9489544 100644
--- a/pkgs/development/python-modules/pyintesishome/default.nix
+++ b/pkgs/development/python-modules/pyintesishome/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pyintesishome";
-  version = "2.2.0";
+  version = "2.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jnimmo";
     repo = "pyIntesisHome";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-eTOamGfZEkQixJ9x/3R4ZGeHiHq7fFpTDgR7BWGUGfA=";
+    hash = "sha256-ICwwvg7zJVdXP42W4ZtWEnztW3HthHZ0z3OEUoSfjqM=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pyside6/default.nix b/pkgs/development/python-modules/pyside6/default.nix
index 402400afaca0..e1ad0f958fc8 100644
--- a/pkgs/development/python-modules/pyside6/default.nix
+++ b/pkgs/development/python-modules/pyside6/default.nix
@@ -8,6 +8,7 @@
   pythonImportsCheckHook,
   moveBuildTree,
   shiboken6,
+  shiboken6-generator,
   llvmPackages,
   symlinkJoin,
 }:
@@ -91,6 +92,7 @@ stdenv.mkDerivation (finalAttrs: {
     ninja
     python
     pythonImportsCheckHook
+    shiboken6-generator
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [ moveBuildTree ];
 
diff --git a/pkgs/development/python-modules/pyswitchbot/default.nix b/pkgs/development/python-modules/pyswitchbot/default.nix
index b52999a0a550..577bf5306d1f 100644
--- a/pkgs/development/python-modules/pyswitchbot/default.nix
+++ b/pkgs/development/python-modules/pyswitchbot/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pyswitchbot";
-  version = "2.4.1";
+  version = "2.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Danielhiversen";
     repo = "pySwitchbot";
     tag = finalAttrs.version;
-    hash = "sha256-is/eLRiVzekX+kLy/CHps6Gw7jujCJJ0A9AWMTNUObs=";
+    hash = "sha256-dyk3eAMwKkTLotv1yLBai9vvATTU2jeiwvPs0uurNz4=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/python-jenkins/default.nix b/pkgs/development/python-modules/python-jenkins/default.nix
index 6c0edc0c21d9..98ab8be23a52 100644
--- a/pkgs/development/python-modules/python-jenkins/default.nix
+++ b/pkgs/development/python-modules/python-jenkins/default.nix
@@ -6,7 +6,6 @@
   mock,
   pbr,
   pyyaml,
-  setuptools,
   six,
   multi-key-dict,
   testscenarios,
@@ -40,7 +39,6 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     pbr
     pyyaml
-    setuptools
     six
     multi-key-dict
     requests
diff --git a/pkgs/development/python-modules/python-youtube/default.nix b/pkgs/development/python-modules/python-youtube/default.nix
index 2f5c72a2185b..5bab4a15a1a0 100644
--- a/pkgs/development/python-modules/python-youtube/default.nix
+++ b/pkgs/development/python-modules/python-youtube/default.nix
@@ -45,6 +45,11 @@ buildPythonPackage rec {
     pytest-cov-stub
   ];
 
+  disabledTests = [
+    # This test try to make request to the internet
+    "test_parse_response"
+  ];
+
   meta = {
     description = "Simple Python wrapper around for YouTube Data API";
     homepage = "https://github.com/sns-sdks/python-youtube";
diff --git a/pkgs/development/python-modules/rerun-notebook/default.nix b/pkgs/development/python-modules/rerun-notebook/default.nix
index f232157fae37..83cbf23c84a5 100644
--- a/pkgs/development/python-modules/rerun-notebook/default.nix
+++ b/pkgs/development/python-modules/rerun-notebook/default.nix
@@ -22,7 +22,7 @@ buildPythonPackage (finalAttrs: {
     inherit (finalAttrs) version;
     format = "wheel";
     python = "py2.py3";
-    hash = "sha256-t23UmPiWUxt2jVhMuOd90Wq9tDriZNr2hMlEjWn6o5w=";
+    hash = "sha256-QYOfTf2PCEjLA0YI6G/HDtA3UlUkhV5t7fCdw9QU584=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/shiboken6/default.nix b/pkgs/development/python-modules/shiboken6/default.nix
index 7492add38e8e..b5b9a8e98ac1 100644
--- a/pkgs/development/python-modules/shiboken6/default.nix
+++ b/pkgs/development/python-modules/shiboken6/default.nix
@@ -21,16 +21,13 @@ stdenv'.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     cmake
     python.pkgs.ninja
+    shiboken6-generator
     (python.pythonOnBuildForHost.withPackages (ps: [
       ps.packaging
       ps.setuptools
     ]))
   ];
 
-  propagatedNativeBuildInputs = [
-    shiboken6-generator
-  ];
-
   buildInputs = [
     python.pkgs.qt6.qtbase
   ]
diff --git a/pkgs/development/python-modules/smg-grpc-servicer/default.nix b/pkgs/development/python-modules/smg-grpc-servicer/default.nix
index c367990e4103..0727201f056a 100644
--- a/pkgs/development/python-modules/smg-grpc-servicer/default.nix
+++ b/pkgs/development/python-modules/smg-grpc-servicer/default.nix
@@ -14,7 +14,7 @@
 }:
 buildPythonPackage (finalAttrs: {
   pname = "smg-grpc-servicer";
-  version = "0.5.5";
+  version = "0.5.6";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -23,7 +23,7 @@ buildPythonPackage (finalAttrs: {
     format = "setuptools";
     pname = "smg_grpc_servicer";
     inherit (finalAttrs) version;
-    hash = "sha256-g3SCR/WjoSpxoq1a+Elvf9z+kAvb8nGgayMRMR/q4d8=";
+    hash = "sha256-uOXwaldTdomIj2fqen1bHwgAOKPIqtoSkJhSkkXRhcA=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/smmap/default.nix b/pkgs/development/python-modules/smmap/default.nix
index 27ae1788145f..a9d20b2e2bbc 100644
--- a/pkgs/development/python-modules/smmap/default.nix
+++ b/pkgs/development/python-modules/smmap/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "smmap";
-  version = "6.0.0";
+  version = "5.0.3";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-jXkCjqbMEx2l6rCZpdlamY1DxneZVv/+O0VQQJEQdto=";
+    hash = "sha256-TZ3ruLmQB65HFlq8CGcL10y3S1In3af2Q+zMTp61ZCw=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/stemming/default.nix b/pkgs/development/python-modules/stemming/default.nix
index a5eaf6714d3b..6f1dcac5822d 100644
--- a/pkgs/development/python-modules/stemming/default.nix
+++ b/pkgs/development/python-modules/stemming/default.nix
@@ -2,16 +2,13 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  setuptools,
 }:
-let
+buildPythonPackage {
   pname = "stemming";
   version = "1.0.1";
-in
-buildPythonPackage {
-  inherit version pname;
-  format = "setuptools";
+  pyproject = true;
 
-  # Pypi source package doesn't contain tests
   src = fetchFromGitHub {
     owner = "nmstoker";
     repo = "stemming";
@@ -19,8 +16,12 @@ buildPythonPackage {
     hash = "sha256-wnmBCbxnCZ9mN1J7sLcN7OynMcvqgAnhEgpAwW2/xz4=";
   };
 
+  build-system = [ setuptools ];
+
   pythonImportsCheck = [ "stemming" ];
 
+  doCheck = false; # source doesn't contain tests
+
   meta = {
     description = "Python implementations of various stemming algorithms";
     homepage = "https://github.com/nmstoker/stemming";
diff --git a/pkgs/development/python-modules/testscenarios/default.nix b/pkgs/development/python-modules/testscenarios/default.nix
index 1daf777f6ede..7cc142fd2344 100644
--- a/pkgs/development/python-modules/testscenarios/default.nix
+++ b/pkgs/development/python-modules/testscenarios/default.nix
@@ -5,7 +5,6 @@
 
   # build-system
   pbr,
-  setuptools,
 
   # dependencies
   testtools,
@@ -32,7 +31,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     pbr
-    setuptools
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/testtools/default.nix b/pkgs/development/python-modules/testtools/default.nix
index 0ea71bcbe6af..0ceb7f1b7db5 100644
--- a/pkgs/development/python-modules/testtools/default.nix
+++ b/pkgs/development/python-modules/testtools/default.nix
@@ -7,9 +7,6 @@
   # build-system
   hatchling,
   hatch-vcs,
-
-  # dependencies
-  setuptools,
 }:
 
 buildPythonPackage rec {
@@ -29,8 +26,6 @@ buildPythonPackage rec {
 
   pythonRemoveDeps = [ "fixtures" ];
 
-  propagatedBuildInputs = lib.optionals (pythonAtLeast "3.12") [ setuptools ];
-
   # testscenarios has a circular dependency on testtools
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/textual-fastdatatable/default.nix b/pkgs/development/python-modules/textual-fastdatatable/default.nix
index d1df2b9395a3..616205aa401f 100644
--- a/pkgs/development/python-modules/textual-fastdatatable/default.nix
+++ b/pkgs/development/python-modules/textual-fastdatatable/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "textual-fastdatatable";
-  version = "0.17.1";
+  version = "0.19.0";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -30,7 +30,7 @@ buildPythonPackage (finalAttrs: {
     owner = "tconbeer";
     repo = "textual-fastdatatable";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-no2iLZmlQKSWLzHE9w5c6VRpHEQpPmVzrnBSvrwhgPI=";
+    hash = "sha256-o+lM682bLwhirNMOJ4AXzdgaA1ggysBkWFnDqTOj1s0=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/typing-inspection/default.nix b/pkgs/development/python-modules/typing-inspection/default.nix
index 2da9cae3ad60..f763f5f68778 100644
--- a/pkgs/development/python-modules/typing-inspection/default.nix
+++ b/pkgs/development/python-modules/typing-inspection/default.nix
@@ -7,16 +7,16 @@
   typing-extensions,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "typing-inspection";
-  version = "0.4.2";
+  version = "0.4.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "typing-inspection";
-    tag = "v${version}";
-    hash = "sha256-aGScO+FLEJ5IyI6hBqdsiKJRN7vEG36V5131nhVZEbc=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-jNAMYV9mpUnClLOahQyLisBkOfELcmjKavKJgyxkQr4=";
   };
 
   build-system = [ hatchling ];
@@ -31,17 +31,11 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  disabledTests = [
-    # broken by intentional 3.14.7 behavior change
-    # reported upstream: https://github.com/pydantic/typing-inspection/issues/55
-    "test_literal_values_unhashable_type"
-  ];
-
   meta = {
-    changelog = "https://github.com/pydantic/typing-inspection/blob/${src.tag}/HISTORY.md";
+    changelog = "https://github.com/pydantic/typing-inspection/blob/${finalAttrs.src.tag}/HISTORY.md";
     description = "Runtime typing introspection tools";
     homepage = "https://github.com/pydantic/typing-inspection";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ dotlambda ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/unicodedata2/default.nix b/pkgs/development/python-modules/unicodedata2/default.nix
index d4a809922cab..cdff4b2fc877 100644
--- a/pkgs/development/python-modules/unicodedata2/default.nix
+++ b/pkgs/development/python-modules/unicodedata2/default.nix
@@ -3,18 +3,21 @@
   buildPythonPackage,
   fetchPypi,
   pytestCheckHook,
+  setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "unicodedata2";
   version = "17.0.1";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
-    inherit version pname;
+    inherit (finalAttrs) version pname;
     sha256 = "sha256-15lD0VP19r++P1Wl7GEZhRhL2jf87bPsx1Mi2CrmrTs=";
   };
 
+  build-system = [ setuptools ];
+
   nativeCheckInputs = [ pytestCheckHook ];
 
   pythonImportsCheck = [ "unicodedata2" ];
@@ -22,8 +25,8 @@ buildPythonPackage rec {
   meta = {
     description = "Backport and updates for the unicodedata module";
     homepage = "https://github.com/mikekap/unicodedata2";
-    changelog = "https://github.com/fonttools/unicodedata2/releases/tag/${version}";
+    changelog = "https://github.com/fonttools/unicodedata2/releases/tag/${finalAttrs.version}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ sternenseemann ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/wasmtime/default.nix b/pkgs/development/python-modules/wasmtime/default.nix
index 3cc70aebe1b4..5ce35598793e 100644
--- a/pkgs/development/python-modules/wasmtime/default.nix
+++ b/pkgs/development/python-modules/wasmtime/default.nix
@@ -18,14 +18,14 @@ let
 in
 buildPythonPackage (finalAttrs: {
   pname = "wasmtime";
-  version = "47.0.1";
+  version = "48.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = "wasmtime-py";
     tag = finalAttrs.version;
-    hash = "sha256-EtozWiHv354jDu0pHAI2vnx1c53Ldq4WBhTSFPZICSs=";
+    hash = "sha256-OpA/LCCYAYNULiIqcXY070wjO5vNQ/ek35wDwgjoKj0=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/rocq-modules/ITree/default.nix b/pkgs/development/rocq-modules/ITree/default.nix
index 610d33115a8e..8f830bba2c94 100644
--- a/pkgs/development/rocq-modules/ITree/default.nix
+++ b/pkgs/development/rocq-modules/ITree/default.nix
@@ -17,7 +17,7 @@ mkCoqDerivation {
     in
     with lib.versions;
     lib.switch coq.version [
-      (case (range "8.14" "9.1") "5.2.1")
+      (case (range "8.14" "9.2") "5.2.1")
       (case (isEq "8.13") "5.2.0+20241009")
       (case (range "8.10" "8.16") "4.0.0")
     ] null;
diff --git a/pkgs/development/rocq-modules/math-classes/default.nix b/pkgs/development/rocq-modules/math-classes/default.nix
index 1d5b42eb7ef2..0c156dce69f0 100644
--- a/pkgs/development/rocq-modules/math-classes/default.nix
+++ b/pkgs/development/rocq-modules/math-classes/default.nix
@@ -11,24 +11,17 @@ mkCoqDerivation {
   pname = "math-classes";
   inherit version;
   defaultVersion =
+    let
+      case = case: out: { inherit case out; };
+    in
     with lib.versions;
     lib.switch coq.coq-version [
-      {
-        case = range "8.17" "8.20";
-        out = "8.19.0";
-      }
-      {
-        case = range "8.12" "8.18";
-        out = "8.18.0";
-      }
-      {
-        case = range "8.12" "8.17";
-        out = "8.17.0";
-      }
-      {
-        case = range "8.6" "8.16";
-        out = "8.15.0";
-      }
+      (case (range "9.0" "9.3") "9.2.0")
+      (case (range "9.0" "9.1") "9.0.0")
+      (case (range "8.17" "8.20") "8.19.0")
+      (case (range "8.12" "8.18") "8.18.0")
+      (case (range "8.12" "8.17") "8.17.0")
+      (case (range "8.6" "8.16") "8.15.0")
     ] null;
   release."8.12.0".hash = "sha256:14nd6a08zncrl5yg2gzk0xf4iinwq4hxnsgm4fyv07ydbkxfb425";
   release."8.13.0".hash = "sha256:1ln7ziivfbxzbdvlhbvyg3v30jgblncmwcsam6gg3d1zz6r7cbby";
@@ -36,6 +29,8 @@ mkCoqDerivation {
   release."8.17.0".hash = "sha256-WklL8pgYTd0l4TGt7h7tWj1qcFcXvoPn25+XKF1pIKA=";
   release."8.18.0".hash = "sha256-0WwPss8+Vr37zX616xeuS4TvtImtSbToFQkQostIjO8=";
   release."8.19.0".hash = "sha256-rsV96W9MPFi/DKsepNPm1QnC2DMemio+uALIgzVYw0w=";
+  release."9.0.0".hash = "sha256-b8GPb1MRg5ZLieDTaoozy6ju10FhVdb6/XhKmyac1V4=";
+  release."9.2.0".hash = "sha256-NdmZcaNg0AmJXRsB3reyxrOYOnj/ZHgv3kF9Bxw+Q3I=";
 
   mlPlugin = true; # uses coq-bignums.plugin
 
diff --git a/pkgs/development/rocq-modules/mathcomp-word/default.nix b/pkgs/development/rocq-modules/mathcomp-word/default.nix
index 42c411a43d87..2cac066398bf 100644
--- a/pkgs/development/rocq-modules/mathcomp-word/default.nix
+++ b/pkgs/development/rocq-modules/mathcomp-word/default.nix
@@ -73,7 +73,7 @@ mkCoqDerivation {
     lib.switch
       [ coq.coq-version mathcomp.version ]
       [
-        (case (range "8.16" "9.1") (isGe "2.0") "3.5")
+        (case (range "8.16" "9.3") (isGe "2.0") "3.5")
         (case (range "8.12" "8.20") (range "1.12" "1.19") "2.4")
       ]
       null;
diff --git a/pkgs/development/tools/misc/autoconf/2.69.nix b/pkgs/development/tools/misc/autoconf/2.69.nix
index 046c885e9955..2c8f7fb75851 100644
--- a/pkgs/development/tools/misc/autoconf/2.69.nix
+++ b/pkgs/development/tools/misc/autoconf/2.69.nix
@@ -6,13 +6,13 @@
   perl,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "autoconf";
   version = "2.69";
 
   src = fetchurl {
-    url = "mirror://gnu/autoconf/autoconf-${version}.tar.xz";
-    sha256 = "113nlmidxy9kjr45kg9x3ngar4951mvag1js2a3j8nxcz34wxsv4";
+    url = "mirror://gnu/autoconf/autoconf-${finalAttrs.version}.tar.xz";
+    hash = "sha256-ZOvOyfisWySHElqGp3YNJZGsnh09vVlIljP53mKldoQ=";
   };
 
   nativeBuildInputs = [
@@ -21,6 +21,8 @@ stdenv.mkDerivation rec {
   ];
   buildInputs = [ m4 ];
 
+  strictDeps = true;
+
   # Work around a known issue in Cygwin.  See
   # http://thread.gmane.org/gmane.comp.sysutils.autoconf.bugs/6822 for
   # details.
@@ -41,6 +43,8 @@ stdenv.mkDerivation rec {
 
   doInstallCheck = false; # fails
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.gnu.org/software/autoconf/";
     description = "Part of the GNU Build System";
@@ -59,4 +63,4 @@ stdenv.mkDerivation rec {
 
     platforms = lib.platforms.all;
   };
-}
+})
diff --git a/pkgs/development/tools/misc/autoconf/default.nix b/pkgs/development/tools/misc/autoconf/default.nix
index 818117f1bb12..c311d32ac713 100644
--- a/pkgs/development/tools/misc/autoconf/default.nix
+++ b/pkgs/development/tools/misc/autoconf/default.nix
@@ -12,7 +12,7 @@
 # cgit) that are needed here should be included directly in Nixpkgs as
 # files.
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "autoconf";
   version = "2.73";
   outputs = [
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   ];
 
   src = fetchurl {
-    url = "mirror://gnu/autoconf/autoconf-${version}.tar.xz";
+    url = "mirror://gnu/autoconf/autoconf-${finalAttrs.version}.tar.xz";
     hash = "sha256-n9ZyschCX6wvpn+gR3uZCYcmi5D/NtXwFtrle+DWtS4=";
   };
 
@@ -57,6 +57,8 @@ stdenv.mkDerivation rec {
     export TESTSUITEFLAGS="-j$NIX_BUILD_CORES"
   '';
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.gnu.org/software/autoconf/";
     description = "Part of the GNU Build System";
@@ -75,4 +77,4 @@ stdenv.mkDerivation rec {
 
     platforms = lib.platforms.all;
   };
-}
+})
diff --git a/pkgs/development/tools/misc/automake/automake-1.16.x.nix b/pkgs/development/tools/misc/automake/automake-1.16.x.nix
index 8751317729fa..11ca834015a7 100644
--- a/pkgs/development/tools/misc/automake/automake-1.16.x.nix
+++ b/pkgs/development/tools/misc/automake/automake-1.16.x.nix
@@ -7,13 +7,13 @@
   updateAutotoolsGnuConfigScriptsHook,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "automake";
   version = "1.16.5";
 
   src = fetchurl {
-    url = "mirror://gnu/automake/automake-${version}.tar.xz";
-    sha256 = "0sdl32qxdy7m06iggmkkvf7j520rmmgbsjzbm7fgnxwxdp6mh7gh";
+    url = "mirror://gnu/automake/automake-${finalAttrs.version}.tar.xz";
+    hash = "sha256-8B1YzW2dd/vcqetLvV6tGYgij9tz1veiAfX41rEYtGk=";
   };
 
   strictDeps = true;
@@ -36,6 +36,8 @@ stdenv.mkDerivation rec {
   # "fixed" path in generated files!
   dontPatchShebangs = true;
 
+  __structuredAttrs = true;
+
   meta = {
     branch = "1.16";
     homepage = "https://www.gnu.org/software/automake/";
@@ -48,4 +50,4 @@ stdenv.mkDerivation rec {
     '';
     platforms = lib.platforms.all;
   };
-}
+})
diff --git a/pkgs/development/tools/misc/automake/automake-1.18.x.nix b/pkgs/development/tools/misc/automake/automake-1.18.x.nix
index 7d1a496081db..1149cf78bde1 100644
--- a/pkgs/development/tools/misc/automake/automake-1.18.x.nix
+++ b/pkgs/development/tools/misc/automake/automake-1.18.x.nix
@@ -7,12 +7,12 @@
   updateAutotoolsGnuConfigScriptsHook,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "automake";
   version = "1.18.1";
 
   src = fetchurl {
-    url = "mirror://gnu/automake/automake-${version}.tar.xz";
+    url = "mirror://gnu/automake/automake-${finalAttrs.version}.tar.xz";
     hash = "sha256-FoqjYyeDUbia9WaERI9SWlvOUHnQtoQr2RD90/FkaIc=";
   };
 
@@ -36,6 +36,8 @@ stdenv.mkDerivation rec {
   # "fixed" path in generated files!
   dontPatchShebangs = true;
 
+  __structuredAttrs = true;
+
   meta = {
     branch = "1.18";
     homepage = "https://www.gnu.org/software/automake/";
@@ -48,4 +50,4 @@ stdenv.mkDerivation rec {
     '';
     platforms = lib.platforms.all;
   };
-}
+})
diff --git a/pkgs/development/tools/misc/libtool/default.nix b/pkgs/development/tools/misc/libtool/default.nix
index 2fcc7a03626d..7258279ff072 100644
--- a/pkgs/development/tools/misc/libtool/default.nix
+++ b/pkgs/development/tools/misc/libtool/default.nix
@@ -6,23 +6,27 @@
   perl,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libtool";
   version = "1.5.26";
 
   src = fetchurl {
-    url = "mirror://gnu/${pname}/${pname}-${version}.tar.gz";
+    url = "mirror://gnu/libtool/libtool-${finalAttrs.version}.tar.gz";
     sha256 = "029ggq5kri1gjn6nfqmgw4w920gyfzscjjxbsxxidal5zqsawd8w";
   };
 
   nativeBuildInputs = [ m4 ];
   buildInputs = [ perl ];
 
+  strictDeps = true;
+
   # Don't fixup "#! /bin/sh" in Libtool, otherwise it will use the
   # "fixed" path in generated files!
   dontPatchShebangs = true;
   dontFixLibtool = true;
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Generic library support script";
 
@@ -43,4 +47,4 @@ stdenv.mkDerivation rec {
 
     mainProgram = "libtool";
   };
-}
+})
diff --git a/pkgs/development/tools/misc/libtool/libtool2.nix b/pkgs/development/tools/misc/libtool/libtool2.nix
index 43bc3f4e4852..6f63c5a25249 100644
--- a/pkgs/development/tools/misc/libtool/libtool2.nix
+++ b/pkgs/development/tools/misc/libtool/libtool2.nix
@@ -13,12 +13,12 @@
 # cgit) that are needed here should be included directly in Nixpkgs as
 # files.
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libtool";
   version = "2.6.2";
 
   src = fetchurl {
-    url = "mirror://gnu/libtool/${pname}-${version}.tar.gz";
+    url = "mirror://gnu/libtool/libtool-${finalAttrs.version}.tar.gz";
     hash = "sha256-JK2zqprgNccPq6NEr1fXMhXriSgQRa9sfM0wd1H4sL8=";
   };
 
@@ -68,6 +68,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  __structuredAttrs = true;
+
   meta = {
     description = "GNU Libtool, a generic library support script";
     longDescription = ''
@@ -85,4 +87,4 @@ stdenv.mkDerivation rec {
     platforms = lib.platforms.unix;
     mainProgram = "libtool";
   };
-}
+})
diff --git a/pkgs/development/tools/misc/patchelf/default.nix b/pkgs/development/tools/misc/patchelf/default.nix
index 086e18e94185..041e18531cb9 100644
--- a/pkgs/development/tools/misc/patchelf/default.nix
+++ b/pkgs/development/tools/misc/patchelf/default.nix
@@ -9,13 +9,13 @@
 # cgit) that are needed here should be included directly in Nixpkgs as
 # files.
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "patchelf";
   version = "0.15.2";
 
   src = fetchurl {
-    url = "https://github.com/NixOS/${pname}/releases/download/${version}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-F3RfVkFZyOIo/EEtplogSLhGxLa0Igt3y/IkFuAvLXw=";
+    url = "https://github.com/NixOS/patchelf/releases/download/${finalAttrs.version}/patchelf-${finalAttrs.version}.tar.bz2";
+    hash = "sha256-F3RfVkFZyOIo/EEtplogSLhGxLa0Igt3y/IkFuAvLXw=";
   };
 
   strictDeps = true;
@@ -27,6 +27,8 @@ stdenv.mkDerivation rec {
   # fails 8 out of 24 tests, problems when loading libc.so.6
   doCheck = stdenv.name == "stdenv-linux";
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://github.com/NixOS/patchelf";
     license = lib.licenses.gpl3Plus;
@@ -35,4 +37,4 @@ stdenv.mkDerivation rec {
     maintainers = [ ];
     platforms = lib.platforms.all;
   };
-}
+})
diff --git a/pkgs/development/tools/misc/texinfo/common.nix b/pkgs/development/tools/misc/texinfo/common.nix
index 00dd5a5811a5..7b406eb8bf00 100644
--- a/pkgs/development/tools/misc/texinfo/common.nix
+++ b/pkgs/development/tools/misc/texinfo/common.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation {
   patches =
     patches
     ++ optional (
-      interactive && versionAtLeast version "7.2"
+      interactive && versionAtLeast version "7.2" && versionOlder version "7.3"
     ) ./fix-test-suite-failures-with-perl-5.42.patch
     ++ optional crossBuildTools ./cross-tools-flags.patch;
 
@@ -141,6 +141,8 @@ stdenv.mkDerivation {
     done
   '';
 
+  __structuredAttrs = true;
+
   meta = meta // {
     branch = version;
   };
diff --git a/pkgs/development/tools/misc/texinfo/packages.nix b/pkgs/development/tools/misc/texinfo/packages.nix
index c7c49d788643..5208d62ffb71 100644
--- a/pkgs/development/tools/misc/texinfo/packages.nix
+++ b/pkgs/development/tools/misc/texinfo/packages.nix
@@ -66,7 +66,7 @@ let
 in
 {
   texinfo7 = buildTexinfo {
-    version = "7.2";
-    hash = "sha256-AynXeI++8RP6gsuAiJyhl6NEzg33ZG/gAJdMXXFDY6Y=";
+    version = "7.3";
+    hash = "sha256-UfdOsPUc+phzuFJk391dRuiVfslbiPD7di9j2eFkxy4=";
   };
 }
diff --git a/pkgs/development/web/nodejs/v22.nix b/pkgs/development/web/nodejs/v22.nix
index d80eb73a7e84..0d5558cc85ca 100644
--- a/pkgs/development/web/nodejs/v22.nix
+++ b/pkgs/development/web/nodejs/v22.nix
@@ -57,6 +57,18 @@ buildNodejs {
       ./use-correct-env-in-tests.patch
       ./bin-sh-node-run-v22.patch
       ./use-nix-codesign.patch
+
+      # TODO: remove when support for Ada 4.x has landed upstream
+      (fetchpatch2 {
+        url = "https://github.com/nodejs/node/commit/eb1a49b0aec9e05cbb59f093d38f0a92818b7de1.patch?full_index=1";
+        hash = "sha256-LmLbsRZKkOGXzqDQxNrK/B8TGIrsr4pXIUEv3P6C9Sc=";
+        excludes = [ "deps/*" ];
+      })
+      (fetchpatch2 {
+        url = "https://github.com/nodejs/node/commit/064e2eee1ec7b17c4bc6e36befc2935eee80d0f7.patch?full_index=1";
+        hash = "sha256-RcmWiTpWYwA952nNmhaiq4zw/iuVAXFnuTeuB6ltR1U=";
+        includes = [ "test/fixtures/wpt/url/resources/urltestdata.json" ];
+      })
     ]
     ++ lib.optionals (!stdenv.hostPlatform.isStatic) [
       # Fix builds with shared llhttp
diff --git a/pkgs/development/web/nodejs/v24.nix b/pkgs/development/web/nodejs/v24.nix
index 578c94262c53..61e2ce946883 100644
--- a/pkgs/development/web/nodejs/v24.nix
+++ b/pkgs/development/web/nodejs/v24.nix
@@ -53,6 +53,18 @@ buildNodejs {
       ./use-correct-env-in-tests.patch
       ./bin-sh-node-run-v22.patch
       ./use-nix-codesign.patch
+
+      # TODO: remove when support for Ada 4.x has landed upstream
+      (fetchpatch2 {
+        url = "https://github.com/nodejs/node/commit/eb1a49b0aec9e05cbb59f093d38f0a92818b7de1.patch?full_index=1";
+        hash = "sha256-LmLbsRZKkOGXzqDQxNrK/B8TGIrsr4pXIUEv3P6C9Sc=";
+        excludes = [ "deps/*" ];
+      })
+      (fetchpatch2 {
+        url = "https://github.com/nodejs/node/commit/064e2eee1ec7b17c4bc6e36befc2935eee80d0f7.patch?full_index=1";
+        hash = "sha256-RcmWiTpWYwA952nNmhaiq4zw/iuVAXFnuTeuB6ltR1U=";
+        includes = [ "test/fixtures/wpt/url/resources/urltestdata.json" ];
+      })
     ]
     ++ gypPatches
     ++ lib.optionals (!stdenv.buildPlatform.isDarwin) [
diff --git a/pkgs/kde/lib/mk-kde-derivation.nix b/pkgs/kde/lib/mk-kde-derivation.nix
index 389d8d46031b..35ce81fe0b6e 100644
--- a/pkgs/kde/lib/mk-kde-derivation.nix
+++ b/pkgs/kde/lib/mk-kde-derivation.nix
@@ -116,6 +116,7 @@ let
     ]
     ++ lib.optionals hasPythonBindings [
       python3Packages.shiboken6
+      python3Packages.shiboken6-generator
       (python3.withPackages (ps: [
         ps.build
         ps.setuptools
diff --git a/pkgs/kde/plasma/kwin/default.nix b/pkgs/kde/plasma/kwin/default.nix
index 55538a99fba5..2d4a2861240a 100644
--- a/pkgs/kde/plasma/kwin/default.nix
+++ b/pkgs/kde/plasma/kwin/default.nix
@@ -17,6 +17,7 @@
   lcms2,
   pipewire,
   python3,
+  fetchpatch,
 }:
 mkKdeDerivation {
   pname = "kwin";
@@ -24,6 +25,13 @@ mkKdeDerivation {
   patches = [
     ./0003-plugins-qpa-allow-using-nixos-wrapper.patch
     ./0001-NixOS-Unwrap-executable-name-for-.desktop-search.patch
+
+    # backport crash fix with latest Mesa
+    # FIXME: remove in next update
+    (fetchpatch {
+      url = "https://invent.kde.org/plasma/kwin/-/commit/2d0613acd044544e79b034b1cbc248664edf2884.diff";
+      hash = "sha256-dpflStJ01aChNYDO+dfI67LhLWoC3sovaAza1AIck1E=";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/kernel-headers/default.nix b/pkgs/os-specific/linux/kernel-headers/default.nix
index e5952533eb02..d74c405ca284 100644
--- a/pkgs/os-specific/linux/kernel-headers/default.nix
+++ b/pkgs/os-specific/linux/kernel-headers/default.nix
@@ -108,7 +108,7 @@ let
       # Skip clean on darwin, case-sensitivity issues.
       buildPhase =
         lib.optionalString (!stdenvNoCC.buildPlatform.isDarwin) ''
-          make mrproper $makeFlags
+          make mrproper "''${makeFlags[@]}"
         ''
         + (
           if stdenvNoCC.hostPlatform.isAndroid then
@@ -118,12 +118,12 @@ let
             ''
           else
             ''
-              make headers $makeFlags
+              make headers "''${makeFlags[@]}"
             ''
         );
 
       checkPhase = ''
-        make headers_check $makeFlags
+        make headers_check "''${makeFlags[@]}"
       '';
 
       # The following command requires rsync:
@@ -144,6 +144,8 @@ let
 
       inherit passthru;
 
+      __structuredAttrs = true;
+
       meta = {
         description = "Header files and scripts for Linux kernel";
         license = lib.licenses.gpl2Only;
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/binutils/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/binutils/default.nix
index eb34c121e9da..b87911c27e31 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/binutils/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/binutils/default.nix
@@ -20,11 +20,11 @@ let
   # Based on https://github.com/ZilchOS/bootstrap-from-tcc/blob/2e0c68c36b3437386f786d619bc9a16177f2e149/using-nix/2a1-static-binutils.nix
   inherit (import ./common.nix { inherit lib; }) meta;
   pname = "binutils";
-  version = "2.46.0";
+  version = "2.47";
 
   src = fetchurl {
     url = "mirror://gnu/binutils/binutils-${version}.tar.xz";
-    hash = "sha256-11qU9Nc+ekCG91E+Z+Q56Pzcu3Jv/mP0ZhdE5iVrLPI=";
+    hash = "sha256-FUqyO2AHDo8nATwil38RKUJdZ9HorNbhMBDmF4EeTP8=";
   };
 
   patches = [
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix
index 92f8e2dea338..740d286fe7a4 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix
@@ -20,11 +20,11 @@
 let
   inherit (import ./common.nix { inherit lib; }) meta;
   pname = "binutils-static";
-  version = "2.46.0";
+  version = "2.47";
 
   src = fetchurl {
     url = "mirror://gnu/binutils/binutils-${version}.tar.xz";
-    hash = "sha256-11qU9Nc+ekCG91E+Z+Q56Pzcu3Jv/mP0ZhdE5iVrLPI=";
+    hash = "sha256-FUqyO2AHDo8nATwil38RKUJdZ9HorNbhMBDmF4EeTP8=";
   };
 
   patches = [
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/coreutils/musl.nix b/pkgs/os-specific/linux/minimal-bootstrap/coreutils/musl.nix
index 1eb87b40cdae..e0ece9d12347 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/coreutils/musl.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/coreutils/musl.nix
@@ -15,11 +15,11 @@
 let
   inherit (import ./common.nix { inherit lib; }) meta;
   pname = "bootstrap-coreutils-musl";
-  version = "9.10";
+  version = "9.11";
 
   src = fetchurl {
     url = "mirror://gnu/coreutils/coreutils-${version}.tar.gz";
-    hash = "sha256-4L3h+2hQlEf8cjzyUX6KjH+kZ2mRm7dJDtNQoukjhWI=";
+    hash = "sha256-IDO4owScBr/0mp486nK99Gg7zQy+uXUhHdVtuvi3Nq4=";
   };
 
   configureFlags = [
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/coreutils/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/coreutils/static.nix
index 6c92f12bf58b..934510e9d8ac 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/coreutils/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/coreutils/static.nix
@@ -19,11 +19,11 @@
 let
   inherit (import ./common.nix { inherit lib; }) meta;
   pname = "coreutils-static";
-  version = "9.10";
+  version = "9.11";
 
   src = fetchurl {
     url = "mirror://gnu/coreutils/coreutils-${version}.tar.gz";
-    hash = "sha256-4L3h+2hQlEf8cjzyUX6KjH+kZ2mRm7dJDtNQoukjhWI=";
+    hash = "sha256-IDO4owScBr/0mp486nK99Gg7zQy+uXUhHdVtuvi3Nq4=";
   };
 
   configureFlags = [
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/findutils/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/findutils/default.nix
index 96531fbbe67d..1025f6b246c0 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/findutils/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/findutils/default.nix
@@ -14,11 +14,11 @@
 }:
 let
   pname = "findutils";
-  version = "4.10.0";
+  version = "4.11.0";
 
   src = fetchurl {
     url = "mirror://gnu/findutils/findutils-${version}.tar.xz";
-    hash = "sha256-E4fgtn/yR9Kr3pmPkN+/cMFJE5Glnd/suK5ph4nwpPU=";
+    hash = "sha256-v9GcsGzHHzNS1WfpAoTYzawCrIl3S76t8LUzsMEUMv0=";
   };
 in
 bash.runCommand "${pname}-${version}"
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/findutils/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/findutils/static.nix
index b183888ce033..23075374a189 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/findutils/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/findutils/static.nix
@@ -17,11 +17,11 @@
 }:
 let
   pname = "findutils-static";
-  version = "4.10.0";
+  version = "4.11.0";
 
   src = fetchurl {
     url = "mirror://gnu/findutils/findutils-${version}.tar.xz";
-    hash = "sha256-E4fgtn/yR9Kr3pmPkN+/cMFJE5Glnd/suK5ph4nwpPU=";
+    hash = "sha256-v9GcsGzHHzNS1WfpAoTYzawCrIl3S76t8LUzsMEUMv0=";
   };
 in
 bash.runCommand "${pname}-${version}"
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gawk/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/gawk/default.nix
index 551c2029bee0..91158c05a727 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gawk/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gawk/default.nix
@@ -7,6 +7,7 @@
   tinycc,
   gnumake,
   gnugrep,
+  gnupatch,
   gnused,
   gnutar,
   gzip,
@@ -15,12 +16,16 @@
 let
   inherit (import ./common.nix { inherit lib; }) meta;
   pname = "gawk";
-  version = "5.3.2";
+
+  version = "5.4.1";
 
   src = fetchurl {
     url = "mirror://gnu/gawk/gawk-${version}.tar.gz";
-    hash = "sha256-hjmhqI+0EaG+AmY3OdA+kCptMTtcb+Ak0L/rM0GhmhE=";
+    hash = "sha256-izsOqDkwMRo/MJBdPOiY0yxhA8L+INapC0A0EXGxdN4=";
   };
+  patches = [
+    ./node-struct-without-gmp-mpfr.patch
+  ];
 in
 bash.runCommand "${pname}-${version}"
   {
@@ -28,6 +33,7 @@ bash.runCommand "${pname}-${version}"
 
     nativeBuildInputs = [
       tinycc.compiler
+      gnupatch
       gnumake
       gnused
       gnugrep
@@ -48,6 +54,9 @@ bash.runCommand "${pname}-${version}"
     tar xzf ${src}
     cd gawk-${version}
 
+    # Patch
+    ${lib.concatMapStringsSep "\n" (f: "patch -Np1 -i ${f}") patches}
+
     # Configure
     export CC="tcc -B ${tinycc.libs}/lib"
     export AR="tcc -ar"
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gawk/node-struct-without-gmp-mpfr.patch b/pkgs/os-specific/linux/minimal-bootstrap/gawk/node-struct-without-gmp-mpfr.patch
new file mode 100644
index 000000000000..01f660c191e8
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gawk/node-struct-without-gmp-mpfr.patch
@@ -0,0 +1,79 @@
+From bf85f8a3175af703597082d4c7e0abc2066a44d3 Mon Sep 17 00:00:00 2001
+From: "Arnold D. Robbins" <arnold@skeeve.com>
+Date: Tue, 14 Jul 2026 10:14:50 +0300
+Subject: [PATCH] Workaround fix for systems without MPFR and GMP.
+
+---
+ ChangeLog |  8 ++++++++
+ awk.h     | 23 ++++++++++++++---------
+ 2 files changed, 22 insertions(+), 9 deletions(-)
+
+diff --git a/ChangeLog b/ChangeLog
+index 6a955eed..42bd2c48 100644
+--- a/ChangeLog
++++ b/ChangeLog
+@@ -3,6 +3,14 @@
+ 	* builtin.c (do_dump_node): Add the size of each object to
+ 	the printout.
+ 
++	Unrelated: Make things works when built on systems without
++	the GMP and MPFR libraries.  Thanks to Thomas Trepl <ttrepl@yahoo.de>
++	and Bruce Dubbs <bdubbs@linuxfromscratch.org> for the reports.
++
++	* awk.h (struct exp_node): Add alignment padding when we don't
++	have MPFR. This is a hack, pending a total refactoring of
++	the NODE structure.
++
+ 2026-07-08         Arnold D. Robbins     <arnold@skeeve.com>
+ 
+ 	* 5.4.1: Release tar ball made.
+diff --git a/awk.h b/awk.h
+index dbad0d81..f4a84300 100644
+--- a/awk.h
++++ b/awk.h
+@@ -406,17 +406,24 @@ typedef struct exp_node {
+ 		} nodep;
+ 
+ 		struct {
+-#ifdef HAVE_MPFR
+ 			union {
+ 				AWKNUM fltnum;
++#ifdef HAVE_MPFR
+ 				mpfr_t mpnum;
+ 				mpz_t mpi;
+-			} nm;
+-			int rndmode;
+ #else
+-			AWKNUM fltnum;
+-			int for_alignment_only;	// especially on 32-bit
+-#endif
++				// 7/2026:
++				// This is a workaround for systems that build
++				// gawk without MPFR and GMP.  The NODE struct
++				// desperately needs to be refactored.
++#if SIZEOF_VOID_P == 4
++				char alignment[28];
++#else	// SIZEOF_VOID_P != 4
++				char alignment[48];
++#endif	// SIZEOF_VOID_P != 4
++#endif	// HAVE_MPFR
++			} nm;
++			int rndmode;	// only used for MPFR.
+ 			char *sp;
+ 			size_t slen;
+ 			int idx;
+@@ -561,10 +568,8 @@ typedef struct exp_node {
+ #ifdef HAVE_MPFR
+ #define mpg_numbr	sub.val.nm.mpnum
+ #define mpg_i		sub.val.nm.mpi
+-#define numbr		sub.val.nm.fltnum
+-#else
+-#define numbr		sub.val.fltnum
+ #endif
++#define numbr		sub.val.nm.fltnum
+ #define typed_re	sub.val.typre
+ 
+ /*
+-- 
+2.54.0
+
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gawk/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/gawk/static.nix
index d35bb47674d6..861d4a7f36b7 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gawk/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gawk/static.nix
@@ -6,6 +6,7 @@
   bash,
   gcc,
   binutils,
+  gnupatch,
   gnumake,
   gnused,
   gnugrep,
@@ -18,12 +19,15 @@
 let
   inherit (import ./common.nix { inherit lib; }) meta;
   pname = "gawk-static";
-  version = "5.3.2";
+  version = "5.4.1";
 
   src = fetchurl {
     url = "mirror://gnu/gawk/gawk-${version}.tar.gz";
-    hash = "sha256-hjmhqI+0EaG+AmY3OdA+kCptMTtcb+Ak0L/rM0GhmhE=";
+    hash = "sha256-izsOqDkwMRo/MJBdPOiY0yxhA8L+INapC0A0EXGxdN4=";
   };
+  patches = [
+    ./node-struct-without-gmp-mpfr.patch
+  ];
 in
 bash.runCommand "${pname}-${version}"
   {
@@ -32,6 +36,7 @@ bash.runCommand "${pname}-${version}"
     nativeBuildInputs = [
       gcc
       binutils
+      gnupatch
       gnumake
       gnused
       gnugrep
@@ -55,6 +60,9 @@ bash.runCommand "${pname}-${version}"
     tar xf ${src}
     cd gawk-${version}
 
+    # Patch
+    ${lib.concatMapStringsSep "\n" (f: "patch -Np1 -i ${f}") patches}
+
     # Configure
     bash ./configure \
       --prefix=$out \
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnused/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnused/static.nix
index 90346ee634ba..e8a39c7fbc67 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gnused/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnused/static.nix
@@ -13,16 +13,17 @@
   diffutils,
   findutils,
   gnutar,
+  linux-headers,
   xz,
 }:
 let
   inherit (import ./common.nix { inherit lib; }) meta;
   pname = "gnused-static";
-  version = "4.9";
+  version = "4.10";
 
   src = fetchurl {
     url = "mirror://gnu/sed/sed-${version}.tar.xz";
-    hash = "sha256-biJrcy4c1zlGStaGK9Ghq6QteYKSLaelNRljHSSXUYE=";
+    hash = "sha256-uOchgrLslqNXTimYxHt6qmTMIM4ADY6awxPMB87PKMc=";
   };
 in
 bash.runCommand "${pname}-${version}"
@@ -60,7 +61,8 @@ bash.runCommand "${pname}-${version}"
       --build=${buildPlatform.config} \
       --host=${hostPlatform.config} \
       --disable-dependency-tracking \
-      --disable-nls
+      --disable-nls \
+      CFLAGS="-I${linux-headers}/include"
 
     # Build
     make -j $NIX_BUILD_CORES
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/patchelf/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/patchelf/static.nix
index 622dc2846468..b84c0ae20b28 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/patchelf/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/patchelf/static.nix
@@ -17,11 +17,11 @@
 }:
 let
   pname = "patchelf-static";
-  version = "0.18.0";
+  version = "0.19.1";
 
   src = fetchurl {
     url = "https://github.com/NixOS/patchelf/releases/download/${version}/patchelf-${version}.tar.gz";
-    sha256 = "sha256-ZN4Q5Ma4uDedt+h/WAMPM26nR8BRXzgRMugQ2/hKhuc=";
+    sha256 = "sha256-SREIco8SDOBbU5k0tBp1AjUDGm34q8a0flev994VCU0=";
   };
 in
 bash.runCommand "${pname}-${version}"
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/python/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/python/default.nix
index ff04626a6336..0b870ca6d3d1 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/python/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/python/default.nix
@@ -19,11 +19,11 @@
 }:
 let
   pname = "python";
-  version = "3.14.4";
+  version = "3.14.6";
 
   src = fetchurl {
     url = "https://www.python.org/ftp/python/${version}/Python-${version}.tar.xz";
-    hash = "sha256-2SPFEwPjjiSRNvwb3zVo1W7LAyFO/e9IUWF209f6rvg=";
+    hash = "sha256-FDsd3e+uw70uIeO4ObNKK3+5hCJyiDxXZCDWBenzDGM=";
   };
 
   patches = [
diff --git a/pkgs/os-specific/linux/net-tools/default.nix b/pkgs/os-specific/linux/net-tools/default.nix
index cad8c516b766..719014c1a04c 100644
--- a/pkgs/os-specific/linux/net-tools/default.nix
+++ b/pkgs/os-specific/linux/net-tools/default.nix
@@ -5,13 +5,13 @@
   fetchpatch,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "net-tools";
   version = "2.10";
 
   src = fetchurl {
-    url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-smJDWlJB6Jv6UcPKvVEzdTlS96e3uT8y4Iy52W9YDWk=";
+    url = "mirror://sourceforge/net-tools/net-tools-${finalAttrs.version}.tar.xz";
+    hash = "sha256-smJDWlJB6Jv6UcPKvVEzdTlS96e3uT8y4Iy52W9YDWk=";
   };
 
   patches = [
@@ -44,10 +44,14 @@ stdenv.mkDerivation rec {
     "man"
   ];
 
+  strictDeps = true;
+
+  __structuredAttrs = true;
+
   meta = {
     homepage = "http://net-tools.sourceforge.net/";
     description = "Set of tools for controlling the network subsystem in Linux";
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/os-specific/linux/procps-ng/default.nix b/pkgs/os-specific/linux/procps-ng/default.nix
index ff53296d9aba..78374bdbbfb1 100644
--- a/pkgs/os-specific/linux/procps-ng/default.nix
+++ b/pkgs/os-specific/linux/procps-ng/default.nix
@@ -23,12 +23,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "procps";
-  version = "4.0.6";
+  version = "4.0.7";
 
   # The project's releases are on SF, but git repo on gitlab.
   src = fetchurl {
     url = "mirror://sourceforge/procps-ng/procps-ng-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Z76m+8OkKlNaAjDJ6JHl3ftNnTlCLUZWWimQ0azhUhY=";
+    hash = "sha256-nSAh9HpFAcZnhiyZQqktGVNpSyHRG80XAug+tZTj1n0=";
   };
 
   outputs = [
diff --git a/pkgs/os-specific/linux/scx/scx_rustscheds.nix b/pkgs/os-specific/linux/scx/scx_rustscheds.nix
index 68b2774882d2..6d1b52807861 100644
--- a/pkgs/os-specific/linux/scx/scx_rustscheds.nix
+++ b/pkgs/os-specific/linux/scx/scx_rustscheds.nix
@@ -15,16 +15,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "scx_rustscheds";
-  version = "1.1.3";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "sched-ext";
     repo = "scx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LK0go5blWgCtDpS5xm9BQc7C2NvbfrW+Jp66ImIThxA=";
+    hash = "sha256-igrmrfimVOEJnFxMr9ghN6lAHwEBSFLLVrB2MQ72PXI=";
   };
 
-  cargoHash = "sha256-vEsbpor52DEUpYO5OubFPMzRltO5kUXjqAoO/9hsKXc=";
+  cargoHash = "sha256-CTEVdvw6aG/fFas2Fk3x9o4Sp2k3lHO/OLwUM8t9UjE=";
 
   nativeBuildInputs = [
     pkg-config
@@ -95,7 +95,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "scx_lavd"
     "scx_layered"
     "scx_mitosis"
-    "scx_mlfq"
     "scx_p2dq"
     "scx_pandemonium"
     "scx_rlfifo"
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 6a24d4bdc385..b0e4d139e6af 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -5,6 +5,7 @@
   pkgsCross,
   testers,
   fetchFromGitHub,
+  fetchpatch,
   buildPackages,
   makeBinaryWrapper,
   ninja,
@@ -203,13 +204,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   inherit pname;
-  version = "261.1";
+  version = "261.2";
 
   src = fetchFromGitHub {
     owner = "systemd";
     repo = "systemd";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4iOitWGdRmGgJjEXGWtq2lEhPtGguma+qrjTShrps2g=";
+    hash = "sha256-w0Fxx+zYBs806whyaKBytGwSgn89ARdukAm6Hp+XlQQ=";
   };
 
   # PATCH POLICY
@@ -239,6 +240,13 @@ stdenv.mkDerivation (finalAttrs: {
     ./0003-add-rootprefix-to-lookup-dir-paths.patch
     ./0004-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
     ./0005-core-don-t-taint-on-unmerged-usr.patch
+    # Remove this with v262
+    # Fixes an issue for switch-to-configuration
+    (fetchpatch {
+      name = "postpone-d-bus-queue-dispatch.patch";
+      url = "https://github.com/systemd/systemd/commit/266b3e50218e2b27cd67d2371c165bf53ad3bf00.patch";
+      hash = "sha256-dEEzZUqicnmgDuXVBV1y0BxzgKbb6Q47Dmxj+O71bFE=";
+    })
   ]
   ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isGnu) [
     ./0006-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
diff --git a/pkgs/servers/http/nginx/modules/lua-upstream/package.nix b/pkgs/servers/http/nginx/modules/lua-upstream/package.nix
index 02e24a2dae9d..8467c16d66e9 100644
--- a/pkgs/servers/http/nginx/modules/lua-upstream/package.nix
+++ b/pkgs/servers/http/nginx/modules/lua-upstream/package.nix
@@ -19,8 +19,6 @@ mkNginxPlugin (finalAttrs: {
 
   buildInputs = [ luajit_openresty ];
 
-  allowMemoryWriteExecute = true;
-
   meta = {
     description = "Expose Lua API to ngx_lua for Nginx upstreams";
     homepage = "https://github.com/openresty/lua-upstream-nginx-module";
diff --git a/pkgs/servers/http/nginx/modules/lua/package.nix b/pkgs/servers/http/nginx/modules/lua/package.nix
index aa191c8f85b5..b9923478be51 100644
--- a/pkgs/servers/http/nginx/modules/lua/package.nix
+++ b/pkgs/servers/http/nginx/modules/lua/package.nix
@@ -26,8 +26,6 @@ mkNginxPlugin (finalAttrs: {
     export LUAJIT_INC="$(realpath ${luajit_openresty}/include/luajit-*)"
   '';
 
-  allowMemoryWriteExecute = true;
-
   passthru.tests = {
     inherit (nixosTests) nginx-lua;
   };
diff --git a/pkgs/servers/nosql/mongodb/7.0.nix b/pkgs/servers/nosql/mongodb/7.0.nix
index b4254c47be61..32b1c935c26b 100644
--- a/pkgs/servers/nosql/mongodb/7.0.nix
+++ b/pkgs/servers/nosql/mongodb/7.0.nix
@@ -21,8 +21,8 @@ let
 in
 buildMongoDB {
   inherit avxSupport;
-  version = "7.0.39";
-  hash = "sha256-VB20nhb0mMf9xVs/R4i+4wWoqHoDNWNouDw3FRehBP8=";
+  version = "7.0.40";
+  hash = "sha256-0KDqI/tMxklGkOvXcehmufiWvmNrf8Jj2llCH91gNlw=";
   patches = [
     # ModuleNotFoundError: No module named 'mongo_tooling_metrics':
     # NameError: name 'SConsToolingMetrics' is not defined:
diff --git a/pkgs/servers/samba/4.x.nix b/pkgs/servers/samba/4.x.nix
index 0501e150e708..7e3454207f77 100644
--- a/pkgs/servers/samba/4.x.nix
+++ b/pkgs/servers/samba/4.x.nix
@@ -21,7 +21,7 @@
   zlib,
   liburing,
   gnutls,
-  systemd,
+  systemdLibs,
   samba,
   talloc,
   jansson,
@@ -167,7 +167,7 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ optionals stdenv.hostPlatform.isLinux [
     liburing
-    systemd
+    systemdLibs
   ]
   ++ optionals stdenv.hostPlatform.isDarwin [ libiconv ]
   ++ optionals enableLDAP [
diff --git a/pkgs/servers/sql/postgresql/libpq.nix b/pkgs/servers/sql/postgresql/libpq.nix
index 5ea0c5113225..96c05fdf54c6 100644
--- a/pkgs/servers/sql/postgresql/libpq.nix
+++ b/pkgs/servers/sql/postgresql/libpq.nix
@@ -40,14 +40,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libpq";
-  version = "18.4";
+  version = "18.6";
 
   src = fetchFromGitHub {
     owner = "postgres";
     repo = "postgres";
     # rev, not tag, on purpose: see generic.nix.
-    rev = "refs/tags/REL_18_4";
-    hash = "sha256-Ac/Dqcj8vjcW3my5vsnKaMiQqTq/HPtUzckJ3SMyrfA=";
+    rev = "refs/tags/REL_18_6";
+    hash = "sha256-ySffxlG7jlNyzx++BmIN+WuaQ9TMAJt/qER9wIjd6B8=";
   };
 
   __structuredAttrs = true;
diff --git a/pkgs/shells/bash/5.nix b/pkgs/shells/bash/5.nix
index 5e89c04d4934..07726320556e 100644
--- a/pkgs/shells/bash/5.nix
+++ b/pkgs/shells/bash/5.nix
@@ -261,6 +261,8 @@ lib.warnIf (withDocs != null)
       });
     };
 
+    __structuredAttrs = true;
+
     meta = {
       homepage = "https://www.gnu.org/software/bash/";
       description =
diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index 3948fc5f71ca..c0f33a9efde7 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -502,6 +502,7 @@ in
             dontUnpack = true;
             dontBuild = true;
             strictDeps = true;
+            __structuredAttrs = true;
             # We wouldn't need to *copy* all, but it's easier and the result is temporary anyway.
             installPhase = ''
               mkdir -p "$out"/bin
@@ -516,12 +517,13 @@ in
 
         # TODO(amjoseph): It is not yet entirely clear why this is necessary.
         # Something strange is going on with xgcc and libstdc++ on pkgsMusl.
-        patchelf = super.patchelf.overrideAttrs (
-          previousAttrs:
-          lib.optionalAttrs super.stdenv.hostPlatform.isMusl {
-            NIX_CFLAGS_COMPILE = (previousAttrs.NIX_CFLAGS_COMPILE or "") + " -static-libstdc++";
-          }
-        );
+        patchelf = super.patchelf.overrideAttrs (previousAttrs: {
+          env =
+            previousAttrs.env or { }
+            // lib.optionalAttrs super.stdenv.hostPlatform.isMusl {
+              NIX_CFLAGS_COMPILE = (previousAttrs.env.NIX_CFLAGS_COMPILE or "") + " -static-libstdc++";
+            };
+        });
 
       };
     }
@@ -850,7 +852,6 @@ in
               inherit (self)
                 stdenv
                 runCommandLocal
-                patchelf
                 libunistring
                 ;
             };
diff --git a/pkgs/stdenv/linux/stage0.nix b/pkgs/stdenv/linux/stage0.nix
index 9fa4bb162efd..e423f7208f05 100644
--- a/pkgs/stdenv/linux/stage0.nix
+++ b/pkgs/stdenv/linux/stage0.nix
@@ -70,6 +70,7 @@ if minbootSupported then
             ln -s ${libcPackage}/lib $out/lib
             ln -s ${libcPackage}/include $out/include
           '';
+          __structuredAttrs = true;
           passthru.isFromBootstrapFiles = true;
         };
         gcc-unwrapped = compilerPackage;
@@ -157,6 +158,7 @@ else
           + lib.optionalString (localSystem.libc == "musl") ''
             ln -s ${bootstrapTools}/include-libc $out/include
           '';
+          __structuredAttrs = true;
           passthru.isFromBootstrapFiles = true;
         };
         gcc-unwrapped = bootstrapTools;
diff --git a/pkgs/test/auto-patchelf-hook-relativize-rpath/default.nix b/pkgs/test/auto-patchelf-hook-relativize-rpath/default.nix
new file mode 100644
index 000000000000..1d1d93025ba9
--- /dev/null
+++ b/pkgs/test/auto-patchelf-hook-relativize-rpath/default.nix
@@ -0,0 +1,88 @@
+{
+  lib,
+  stdenv,
+  tests,
+  autoPatchelfHook,
+  patchelf,
+  python3,
+}:
+
+let
+  foo = tests.stdenv-inputs.foo;
+
+  # Produce a tree containing lib/{baz.so,libs/foo.so},
+  # with src/lib/libbaz.so calling code from src/lib/libs/libfoo.so.
+  # These have absolute paths.
+  baz-bundle = stdenv.mkDerivation {
+    name = "baz-bundle";
+
+    buildCommand = ''
+      mkdir -p $out/lib/libs
+      cp ${(lib.getDev foo)}/lib/libfoo.so $out/lib/libs/
+
+      mkdir -p $out/lib/
+      $CC -shared -lfoo -L$out/lib/libs -o $out/lib/libbaz.so ${./lib-baz.c}
+    '';
+
+    # No references to the foo store path.
+    disallowedReferences = [
+      (lib.getDev foo)
+    ];
+  };
+
+  # Make baz-bundle relocatable, by running autopatchelf with the `--relativize-rpath` flag.
+  # This will replace the `RPATH` of `$out/lib/libbaz.so` from `$out/lib/libs` to `$ORIGIN/libs`.
+  baz-bundle-relocatable = stdenv.mkDerivation {
+    name = "baz-bundle-relocatable";
+
+    nativeBuildInputs = [
+      autoPatchelfHook
+    ];
+
+    autoPatchelfFlags = [ "--relativize-rpath" ];
+
+    dontUnpack = true;
+
+    # we don't set buildCommand because we want to ensure fixupPhase
+    # (containing autoPatchelfHook) is run.
+    installPhase = ''
+      mkdir -p $out
+      cp -R ${baz-bundle}/lib $out/lib
+    '';
+
+    # Now these two .so files refer neither to `baz-bundle`, nor contain self-references.
+    disallowedReferences = [
+      baz-bundle
+      "out"
+    ];
+  };
+
+in
+# Pretend a user consumed `baz-bundle-relocatable` as an artifact,
+# copied to ./libs/baz-bundle, and calls `baz` from `libbaz.so` from their code.
+# Ensure this works, which requires `baz()` to still be able to find `foo()`.
+stdenv.mkDerivation {
+  name = "auto-patchelf-hook-relativize-rpath";
+  nativeBuildInputs = [
+    patchelf
+    python3
+  ];
+
+  buildCommand = ''
+    mkdir -p libs/baz-bundle
+    cp -R ${baz-bundle-relocatable}/lib/* libs/baz-bundle/
+
+    echo "RPATHs:"
+    echo -n "libs/baz-bundle/libbaz.so:     "
+    patchelf --print-rpath libs/baz-bundle/libbaz.so
+    echo -n "libs/baz-bundle/lib/libfoo.so: "
+    patchelf --print-rpath libs/baz-bundle/libs/libfoo.so
+
+    cp ${./main.py} main.py
+    python main.py |& tee /dev/stderr | grep -q "foo returned 42"
+
+    touch $out
+  '';
+
+  meta.platforms = lib.platforms.linux;
+}
diff --git a/pkgs/test/auto-patchelf-hook-relativize-rpath/lib-baz.c b/pkgs/test/auto-patchelf-hook-relativize-rpath/lib-baz.c
new file mode 100644
index 000000000000..e1f62fc5979c
--- /dev/null
+++ b/pkgs/test/auto-patchelf-hook-relativize-rpath/lib-baz.c
@@ -0,0 +1,10 @@
+#include <stdio.h>
+
+extern unsigned int foo(void);
+
+extern unsigned int baz(void)
+{
+    fprintf(stderr, "about to call foo()\n");
+    fprintf(stderr, "foo returned %d\n", foo());
+    return 0;
+}
diff --git a/pkgs/test/auto-patchelf-hook-relativize-rpath/main.py b/pkgs/test/auto-patchelf-hook-relativize-rpath/main.py
new file mode 100644
index 000000000000..cae15e3da5f0
--- /dev/null
+++ b/pkgs/test/auto-patchelf-hook-relativize-rpath/main.py
@@ -0,0 +1,10 @@
+from pathlib import Path
+import ctypes
+
+lib_path = Path(__file__).parent / "libs/baz-bundle/libbaz.so"
+lib = ctypes.CDLL(str(lib_path))
+
+lib.baz.restype = ctypes.c_uint
+lib.baz.argtypes = []
+
+lib.baz()
diff --git a/pkgs/test/default.nix b/pkgs/test/default.nix
index a44e8de628c9..d872ec067a7c 100644
--- a/pkgs/test/default.nix
+++ b/pkgs/test/default.nix
@@ -247,6 +247,8 @@ in
 
   auto-patchelf-hook-preserve-origin = callPackage ./auto-patchelf-hook-preserve-origin { };
 
+  auto-patchelf-hook-relativize-rpath = callPackage ./auto-patchelf-hook-relativize-rpath { };
+
   # Accumulate all passthru.tests from arrayUtilities into a single attribute set.
   arrayUtilities = recurseIntoAttrs (
     concatMapAttrs (
diff --git a/pkgs/tools/compression/gzip/default.nix b/pkgs/tools/compression/gzip/default.nix
index 6aafcf6481df..707a46ad6efe 100644
--- a/pkgs/tools/compression/gzip/default.nix
+++ b/pkgs/tools/compression/gzip/default.nix
@@ -44,6 +44,8 @@ stdenv.mkDerivation (finalAttrs: {
   ];
   buildInputs = [ runtimeShellPackage ];
 
+  strictDeps = true;
+
   makeFlags = [
     "SHELL=/bin/sh"
     "GREP=grep"
@@ -87,6 +89,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru.tests.makecheck = gzip.overrideAttrs { doCheck = true; };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.gnu.org/software/gzip/";
     description = "GNU zip compression program";
diff --git a/pkgs/tools/compression/zstd/default.nix b/pkgs/tools/compression/zstd/default.nix
index 03d06ce67bcf..4000a273168d 100644
--- a/pkgs/tools/compression/zstd/default.nix
+++ b/pkgs/tools/compression/zstd/default.nix
@@ -38,13 +38,15 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "zstd";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-tNFWIT9ydfozB8dWcmTMuZLCQmQudTFJIkSr0aG7S44=";
   };
 
   nativeBuildInputs = [ cmake ] ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
   buildInputs = lib.optional stdenv.hostPlatform.isUnix bashNonInteractive;
 
+  strictDeps = true;
+
   patches = [
     # This patches makes sure we do not attempt to use the MD5 implementation
     # of the host platform when running the tests
@@ -144,6 +146,8 @@ stdenv.mkDerivation (finalAttrs: {
     };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Zstandard real-time compression algorithm";
     longDescription = ''
diff --git a/pkgs/tools/misc/findutils/default.nix b/pkgs/tools/misc/findutils/default.nix
index 5e2d0fbe6f3c..7540239528f0 100644
--- a/pkgs/tools/misc/findutils/default.nix
+++ b/pkgs/tools/misc/findutils/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   postPatch = ''
-    substituteInPlace xargs/xargs.c --replace 'char default_cmd[] = "echo";' 'char default_cmd[] = "${lib.getExe' coreutils "echo"}";'
+    substituteInPlace xargs/xargs.c --replace-fail 'char default_cmd[] = "echo";' 'char default_cmd[] = "${lib.getExe' coreutils "echo"}";'
   '';
 
   patches = [
@@ -31,6 +31,8 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ];
   buildInputs = [ coreutils ]; # bin/updatedb script needs to call sort
 
+  strictDeps = true;
+
   # Since glibc-2.25 the i686 tests hang reliably right after test-sleep.
   doCheck =
     !stdenv.hostPlatform.isDarwin
@@ -79,6 +81,8 @@ stdenv.mkDerivation (finalAttrs: {
   # or you can check libc/include/sys/cdefs.h in bionic source code
   hardeningDisable = lib.optional (stdenv.hostPlatform.libc == "bionic") "fortify";
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.gnu.org/software/findutils/";
     changelog = "https://cgit.git.savannah.gnu.org/cgit/findutils.git/tree/NEWS?h=v${finalAttrs.version}";
diff --git a/pkgs/tools/package-management/lix/common-lix.nix b/pkgs/tools/package-management/lix/common-lix.nix
index 42c3bc93e405..b783fe1671d5 100644
--- a/pkgs/tools/package-management/lix/common-lix.nix
+++ b/pkgs/tools/package-management/lix/common-lix.nix
@@ -312,6 +312,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   propagatedBuildInputs = [
     boehmgc
+    boost
     nlohmann_json
   ];
 
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index 1aadb3212d92..83280a2a6a4a 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -208,12 +208,12 @@ lib.makeExtensible (
           src = fetchFromGitHub {
             owner = "NixOS";
             repo = "nix";
-            rev = "f8bb823a23bf6d62f4c8feb792a77702d7a49fe1";
-            hash = "sha256-eWBQ01zjUjTF6VyWzmt6fN6jI+vlCDtqYaJG1McIKpc=";
+            rev = "d8c24e6118d6fb323d4fcd2f311cda9c748452fa";
+            hash = "sha256-SbXYrP5NKa1ySGHvPWE0e39PMOczcyeiXTaxMFsv1vs=";
           };
         in
         (nixDependencies.callPackage ./modular/packages.nix {
-          version = "2.35pre20260619_${lib.substring 0 8 src.rev}";
+          version = "2.36pre20260804_${lib.substring 0 8 src.rev}";
           inherit teams;
           otherSplices = generateSplicesForNixComponents "nixComponents_git";
           src = removeFunctionalTests commonDisabledTests src;
diff --git a/pkgs/tools/text/gawk/default.nix b/pkgs/tools/text/gawk/default.nix
index 87d2946e6160..955c6b8d892f 100644
--- a/pkgs/tools/text/gawk/default.nix
+++ b/pkgs/tools/text/gawk/default.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  fetchpatch,
   removeReferencesTo,
   runtimeShellPackage,
   texinfo,
@@ -24,12 +23,12 @@
 
 assert (doCheck && stdenv.hostPlatform.isLinux) -> glibcLocales != null;
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "gawk" + lib.optionalString interactive "-interactive";
   version = "5.4.1";
 
   src = fetchurl {
-    url = "mirror://gnu/gawk/gawk-${version}.tar.xz";
+    url = "mirror://gnu/gawk/gawk-${finalAttrs.version}.tar.xz";
     hash = "sha256-B/b3NCt/6+QxP8LCVCrZPWT+IK2HFyABCfEFqCb1/Tc=";
   };
 
@@ -50,7 +49,9 @@ stdenv.mkDerivation rec {
   ]
   ++ lib.optional (!interactive) "man";
 
+  __structuredAttrs = true;
   strictDeps = true;
+  enableParallelBuilding = true;
 
   # no-pma fix
   nativeBuildInputs = [
@@ -129,4 +130,4 @@ stdenv.mkDerivation rec {
     ];
     mainProgram = "gawk";
   };
-}
+})
diff --git a/pkgs/tools/text/gnused/default.nix b/pkgs/tools/text/gnused/default.nix
index 7f1cfe514425..ba45205c1359 100644
--- a/pkgs/tools/text/gnused/default.nix
+++ b/pkgs/tools/text/gnused/default.nix
@@ -6,13 +6,13 @@
   perl,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "gnused";
   version = "4.10";
 
   src = fetchurl {
-    url = "mirror://gnu/sed/sed-${version}.tar.xz";
-    sha256 = "sha256-uOchgrLslqNXTimYxHt6qmTMIM4ADY6awxPMB87PKMc=";
+    url = "mirror://gnu/sed/sed-${finalAttrs.version}.tar.xz";
+    hash = "sha256-uOchgrLslqNXTimYxHt6qmTMIM4ADY6awxPMB87PKMc=";
   };
 
   outputs = [
@@ -24,6 +24,10 @@ stdenv.mkDerivation rec {
     updateAutotoolsGnuConfigScriptsHook
     perl
   ];
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
   preConfigure = "patchShebangs ./build-aux/help2man";
 
   # Prevents attempts of running 'help2man' on cross-built binaries.
@@ -50,4 +54,4 @@ stdenv.mkDerivation rec {
     maintainers = with lib.maintainers; [ mic92 ];
     mainProgram = "sed";
   };
-}
+})
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index d39835dec229..092e2f61a55e 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -610,6 +610,7 @@ mapAliases {
   cotton = throw "'cotton' has been removed since it is vulnerable to CVE-2025-62518 and upstream is unmaintained"; # Added 2025-10-26
   cpp2a-kernel = cpp20-kernel; # Added 2026-06-30, xeus-cling removed in favour of xeus-cpp
   cpp-ipfs-api = throw "'cpp-ipfs-api' has been renamed to/replaced by 'cpp-ipfs-http-client'"; # Converted to throw 2025-10-27
+  cpp-netlib = throw "'cpp-netlib' has been removed as it was unmaintained uptream and relied on several outdated versions of dependencies."; # Added 2026-08-25
   cpr = warnAlias "'cpr' has been renamed to/replaced by 'libcpr'" libcpr; # Added 2025-11-17
   cqrlog = throw "'cqrlog' was removed due to lack of maintenance and relying on gtk2"; # Added 2025-12-02
   crabfit-api = throw "'crabfit-api' has been removed because it is unmaintained upstream and insecure."; # Added 2025-11-29
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 13536604e8d6..93ad5f3623be 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10755,7 +10755,7 @@ with pkgs;
     dart-source
     ;
 
-  dart = if stdenv.hostPlatform.isLinux then dart-source else dart-bin;
+  dart = if lib.meta.availableOn stdenv.hostPlatform dart-source then dart-source else dart-bin;
 
   pub2nix = recurseIntoAttrs (callPackage ../build-support/dart/pub2nix { });
 
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 9033b1d1f387..c0cb0ffb63d0 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -116,11 +116,11 @@ with self;
 
   ack = buildPerlPackage rec {
     pname = "ack";
-    version = "3.9.0";
+    version = "3.10.0";
 
     src = fetchurl {
       url = "mirror://cpan/authors/id/P/PE/PETDANCE/ack-v${version}.tar.gz";
-      hash = "sha256-lO1Hfjs/lNEmzscynw6DmfHQzoLHxNiCqUrbFQ5//JA=";
+      hash = "sha256-Zeg8+zinH8pyXpoUqCAe6HHmKfxrECMeEwPdNQG6Vjo=";
     };
 
     outputs = [
@@ -3352,18 +3352,11 @@ with self;
 
   CatalystAuthenticationCredentialHTTP = buildPerlModule {
     pname = "Catalyst-Authentication-Credential-HTTP";
-    version = "1.018";
+    version = "1.019";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/E/ET/ETHER/Catalyst-Authentication-Credential-HTTP-1.018.tar.gz";
-      hash = "sha256-b6GBbe5kSw216gzBXF5xHcLO0gg2JavOcJZSHx1lpSk=";
+      url = "mirror://cpan/authors/id/A/AB/ABRAXXA/Catalyst-Authentication-Credential-HTTP-1.019.tar.gz";
+      hash = "sha256-7IHpbCo/ZYbqQdCI6o6AGx80ABqxnMmmXe+KOMOaW9o=";
     };
-    patches = [
-      (fetchpatch {
-        name = "CVE-2025-40920.patch";
-        url = "https://github.com/perl-catalyst/Catalyst-Authentication-Credential-HTTP/commit/ad2c03aad95406db4ce35dfb670664ebde004c18.patch";
-        hash = "sha256-WI6JwvY6i3KkQO9HbbSvHPX8mgM8I2cF0UTjF1D14T4=";
-      })
-    ];
     buildInputs = [
       ModuleBuildTiny
       TestException
@@ -3374,7 +3367,6 @@ with self;
       CatalystPluginAuthentication
       ClassAccessor
       CryptSysRandom
-      DataUUID
       StringEscape
     ];
     meta = {
@@ -4627,12 +4619,15 @@ with self;
 
   CGISession = buildPerlModule {
     pname = "CGI-Session";
-    version = "4.48";
+    version = "4.49";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/M/MA/MARKSTOS/CGI-Session-4.48.tar.gz";
-      hash = "sha256-RnVkYcJM52ZrgQjduW26thJpnfMBLIDvEQFmGf4VVPc=";
+      url = "mirror://cpan/authors/id/M/MA/MARKSTOS/CGI-Session-4.49.tar.gz";
+      hash = "sha256-X9iKgwo19UUmeH8DauXkp9FLYcQUzSmthjG/RuaXEgc=";
     };
-    propagatedBuildInputs = [ CGI ];
+    propagatedBuildInputs = [
+      CGI
+      CryptSysRandom
+    ];
     meta = {
       description = "Persistent session data in CGI applications";
       license = lib.licenses.artistic1;
@@ -7121,16 +7116,15 @@ with self;
 
   CryptDSA = buildPerlPackage {
     pname = "Crypt-DSA";
-    version = "1.21";
+    version = "1.24";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/T/TI/TIMLEGGE/Crypt-DSA-1.21.tar.gz";
-      hash = "sha256-pGIB6DkOi6O75RER12SJ8x2v2g9qYLCrkxndUr0rMrA=";
+      url = "mirror://cpan/authors/id/T/TI/TIMLEGGE/Crypt-DSA-1.24.tar.gz";
+      hash = "sha256-ChY4tvK07+ktbuL0kBzKAtenBWf2uw9Iapu19pvnZ2Y=";
     };
     propagatedBuildInputs = [
       ConvertASN1
       ConvertPEM
       CryptSysRandom
-      CryptURandom
       DataBuffer
       FileWhich
     ];
@@ -7969,10 +7963,10 @@ with self;
 
   CSSMinifierXS = buildPerlPackage {
     pname = "CSS-Minifier-XS";
-    version = "0.13";
+    version = "0.15";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/G/GT/GTERMARS/CSS-Minifier-XS-0.13.tar.gz";
-      hash = "sha256-xBnjCM3IKvHCXWuNB7L/JjR6Yit6Y+wghWq+jbQFH4I=";
+      url = "mirror://cpan/authors/id/G/GT/GTERMARS/CSS-Minifier-XS-0.15.tar.gz";
+      hash = "sha256-iprSIxYtpGceP4EsSlXyl3OUg70xar2kH0wn6K3XhVM=";
     };
     buildInputs = [ TestDiagINC ];
     meta = {
@@ -8230,16 +8224,16 @@ with self;
 
   DataEntropy = buildPerlPackage {
     pname = "Data-Entropy";
-    version = "0.008";
+    version = "0.010";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/R/RR/RRWO/Data-Entropy-0.008.tar.gz";
-      hash = "sha256-GKUrE4boLGuM2zhKOYYdYCIKRCp5DgdwEL5y3YU7Z7M=";
+      url = "mirror://cpan/authors/id/R/RR/RRWO/Data-Entropy-0.010.tar.gz";
+      hash = "sha256-0M8s2wKCAuidw2K42Qtw00WFApOwGQDZoYgqDG8g+Dc=";
     };
     propagatedBuildInputs = [
       CryptRijndael
       CryptURandom
       DataFloat
-      HTTPLite
+      DevelDeprecate
       ParamsClassify
     ];
     meta = {
@@ -9677,6 +9671,24 @@ with self;
     };
   };
 
+  DevelDeprecate = buildPerlPackage {
+    pname = "Devel-Deprecate";
+    version = "0.01";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/O/OV/OVID/Devel-Deprecate-0.01.tar.gz";
+      hash = "sha256-xQLEGoL+JU6XFRJ3ytOk8KQHrTydP2I9J3sDA6PhoS8=";
+    };
+    buildInputs = [ SubOverride ];
+    propagatedBuildInputs = [ DateTime ];
+    meta = {
+      description = "Create deprecation schedules in your code";
+      license = with lib.licenses; [
+        artistic1
+        gpl1Plus
+      ];
+    };
+  };
+
   DevelDeprecationsEnvironmental = buildPerlPackage {
     pname = "Devel-Deprecations-Environmental";
     version = "1.101";
@@ -10117,11 +10129,11 @@ with self;
 
   DBI = buildPerlPackage {
     pname = "DBI";
-    version = "1.648";
+    version = "1.651";
 
     src = fetchurl {
-      url = "mirror://cpan/authors/id/H/HM/HMBRAND/DBI-1.648.tgz";
-      hash = "sha256-7yZqrWAQzi6rt+Rl69c8owILxYFQ9pib2Jwrj5usaoY=";
+      url = "mirror://cpan/authors/id/H/HM/HMBRAND/DBI-1.651.tgz";
+      hash = "sha256-2mIaI/po4eBPrIJM/T1B6P+6sqs+umQqEkmSQui+UlM=";
     };
 
     env = lib.optionalAttrs stdenv.cc.isGNU {
@@ -13618,14 +13630,11 @@ with self;
 
   FileFindRule = buildPerlPackage {
     pname = "File-Find-Rule";
-    version = "0.34";
+    version = "0.35";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/R/RC/RCLAMP/File-Find-Rule-0.34.tar.gz";
-      hash = "sha256-fm8WzDPrHyn/Jb7lHVE/S4qElHu/oY7bLTzECi1kyv4=";
+      url = "mirror://cpan/authors/id/R/RC/RCLAMP/File-Find-Rule-0.35.tar.gz";
+      hash = "sha256-K9VWKJptRK0u50gDJYuwsAUNJG8egcqrCyY8MDrPDII=";
     };
-    patches = [
-      ../development/perl-modules/FileFindRule-CVE-2011-10007.patch
-    ];
     propagatedBuildInputs = [
       NumberCompare
       TextGlob
@@ -16245,10 +16254,10 @@ with self;
 
   HTMLGumbo = buildPerlModule {
     pname = "HTML-Gumbo";
-    version = "0.18";
+    version = "0.20";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/R/RU/RUZ/HTML-Gumbo-0.18.tar.gz";
-      hash = "sha256-v1C2HCRlbMP8lYYC2AqcfQFyR6842Nv6Dp3sW3VCXV8=";
+      url = "mirror://cpan/authors/id/B/BP/BPS/HTML-Gumbo-0.20.tar.gz";
+      hash = "sha256-ImEK+8bIfgZ92E9/EZo9J4Ie1kEwNFU8Ga694iEdiDU=";
     };
     propagatedBuildInputs = [ AlienLibGumbo ];
     meta = {
@@ -16777,10 +16786,10 @@ with self;
 
   HTTPDate = buildPerlPackage {
     pname = "HTTP-Date";
-    version = "6.06";
+    version = "6.08";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/O/OA/OALDERS/HTTP-Date-6.06.tar.gz";
-      hash = "sha256-e2hRkcasw+dz0fwCyV7h+frpT3d4MXX154wYHMktK1I=";
+      url = "mirror://cpan/authors/id/O/OA/OALDERS/HTTP-Date-6.08.tar.gz";
+      hash = "sha256-tX2Aym2CHGlJykiydGfUWrp6nHc0ZWIwb6zKeBoAPkQ=";
     };
     propagatedBuildInputs = [ TimeDate ];
     meta = {
@@ -17207,10 +17216,10 @@ with self;
 
   Imager = buildPerlPackage rec {
     pname = "Imager";
-    version = "1.031";
+    version = "1.034";
     src = fetchurl {
       url = "mirror://cpan/authors/id/T/TO/TONYC/Imager-${version}.tar.gz";
-      hash = "sha256-kL59G9/F7bfxfPgreeamYUxbAuv+Mm67b2afzaeRNAE=";
+      hash = "sha256-hrWizXGna4QJJJFSGl1WI4Qo8sN1AYMsmVxaMxJg+AM=";
     };
     buildInputs = [
       pkgs.freetype
@@ -18498,12 +18507,11 @@ with self;
 
   JSONXS = buildPerlPackage {
     pname = "JSON-XS";
-    version = "4.03";
+    version = "4.04";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/M/ML/MLEHMANN/JSON-XS-4.03.tar.gz";
-      hash = "sha256-UVU29F8voafojIgkUzdY0BIdJnq5y0U6G1iHyKVrkGg=";
+      url = "mirror://cpan/authors/id/M/ML/MLEHMANN/JSON-XS-4.04.tar.gz";
+      hash = "sha256-jv8enzBMViW1mre0IlhBX20+NoHB3atrclUYoBin9eA=";
     };
-    patches = [ ../development/perl-modules/JSON-XS-CVE-2025-40928.patch ];
     propagatedBuildInputs = [ TypesSerialiser ];
     buildInputs = [ CanaryStability ];
     meta = {
@@ -22717,10 +22725,10 @@ with self;
 
   Mojolicious = buildPerlPackage {
     pname = "Mojolicious";
-    version = "9.46";
+    version = "9.48";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/S/SR/SRI/Mojolicious-9.46.tar.gz";
-      hash = "sha256-/kc9LK5tLe/pUBgCggc2VoJa0F20TwvIxIQhXi1xaqw=";
+      url = "mirror://cpan/authors/id/S/SR/SRI/Mojolicious-9.48.tar.gz";
+      hash = "sha256-Jv8EFSgR/VsaNrR9mewhnFiZW6jnsVugKzPQdwpe7pg=";
     };
     meta = {
       description = "Real-time web framework";
@@ -23082,13 +23090,16 @@ with self;
 
   MojoJWT = buildPerlModule {
     pname = "Mojo-JWT";
-    version = "0.09";
+    version = "1.02";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/J/JB/JBERGER/Mojo-JWT-0.09.tar.gz";
-      hash = "sha256-wE4DmD4MbyvORdCOoucph5yWee+mNLDmjLa4t7SoWIY=";
+      url = "mirror://cpan/authors/id/J/JB/JBERGER/Mojo-JWT-1.02.tar.gz";
+      hash = "sha256-yBHXkoWMJBFQNyDxJDbjNDZ0k2dUO/vCqV1PgDzmCHQ=";
     };
     buildInputs = [ ModuleBuildTiny ];
-    propagatedBuildInputs = [ Mojolicious ];
+    propagatedBuildInputs = [
+      CryptX
+      Mojolicious
+    ];
     meta = {
       description = "JSON Web Token the Mojo way";
       homepage = "https://github.com/jberger/Mojo-JWT";
@@ -32046,14 +32057,13 @@ with self;
     };
   };
 
-  StringUtil = buildPerlModule {
+  StringUtil = buildPerlPackage {
     pname = "String-Util";
-    version = "1.34";
+    version = "1.36";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/B/BA/BAKERSCOT/String-Util-1.34.tar.gz";
-      hash = "sha256-MZzozWZTQeVlIfoVXZYqGTKOkNn3A2dlklzN4mclxGk=";
+      url = "mirror://cpan/authors/id/B/BA/BAKERSCOT/String-Util-1.36.tar.gz";
+      hash = "sha256-UXsasyVm/U1ei+I9mTOc47/+4pEsX/KfXclYcP9Pyw4=";
     };
-    buildInputs = [ ModuleBuildTiny ];
     meta = {
       description = "String processing utility functions";
       homepage = "https://github.com/scottchiefbaker/String-Util";
@@ -39468,6 +39478,11 @@ with self;
       MojoliciousPluginOpenAPI
       RoleTiny
     ];
+    # Mojolicious 9.48 enforces CSRF token validation (CVE-2026-15747); these
+    # tests drive forms without a token and fail with 400 "CSRF token failure".
+    preCheck = ''
+      rm t/plugin/auth/github.t t/plugin/form/bootstrap4.t
+    '';
     meta = {
       homepage = "http://preaction.me/yancy/";
       description = "Best Web Framework Deserves the Best CMS";
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index b25dd07de114..5c0aebbe0614 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -172,6 +172,7 @@ mapAliases {
   CommonMark = throw "'CommonMark' has been renamed to/replaced by 'commonmark'"; # Converted to throw 2025-10-29
   ConfigArgParse = throw "'ConfigArgParse' has been renamed to/replaced by 'configargparse'"; # Converted to throw 2025-10-29
   configshell = throw "'configshell' has been renamed to/replaced by 'configshell-fb'"; # Converted to throw 2025-10-29
+  crontab = throw "'crontab' has been removed, migrate to either 'python-crontab' or 'parse-crontab'"; # Added 2026-08-25
   cx_Freeze = throw "'cx_Freeze' has been renamed to/replaced by 'cx-freeze'"; # Converted to throw 2025-10-29
   cx_oracle = throw "'cx_oracle' has been renamed to/replaced by 'cx-oracle'"; # Converted to throw 2025-10-29
   dalle-mini = throw "'dalle-mini' has been removed due to lack of upstream maintenance"; # added 2026-02-26
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 2f1e98da4130..65be08a898ce 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3765,8 +3765,6 @@ self: super: with self; {
 
   cronsim = callPackage ../development/python-modules/cronsim { };
 
-  crontab = callPackage ../development/python-modules/crontab { };
-
   cross-web = callPackage ../development/python-modules/cross-web { };
 
   crossandra = callPackage ../development/python-modules/crossandra { };
@@ -20768,8 +20766,8 @@ self: super: with self; {
         # Tcl/Tk 9.0 support in Tkinter is not quite ready yet:
         # - https://github.com/python/cpython/issues/124111
         # - https://github.com/python/cpython/issues/104568
-        tcl = pkgs.tcl-8_6;
-        tk = pkgs.tk-8_6;
+        tcl = if pythonAtLeast "3.14" then pkgs.tcl-9_0 else pkgs.tcl-8_6;
+        tk = if pythonAtLeast "3.14" then pkgs.tk-9_0 else pkgs.tk-8_6;
       };
 
   tkinter-gl = callPackage ../development/python-modules/tkinter-gl { };
diff --git a/pkgs/top-level/release-haskell.nix b/pkgs/top-level/release-haskell.nix
index cb15ab9003af..51ab40e2a409 100644
--- a/pkgs/top-level/release-haskell.nix
+++ b/pkgs/top-level/release-haskell.nix
@@ -26,6 +26,26 @@ let
     pkgs
     ;
 
+  # Helper function which traverses a (nested) set
+  # of derivations produced by mapTestOn and flattens
+  # it to a list of derivations suitable to be passed
+  # to `releaseTools.aggregate` as constituents.
+  # Removes all non derivations from the input jobList.
+  #
+  # accumulateDerivations :: [ Either Derivation AttrSet ] -> [ Derivation ]
+  #
+  # > accumulateDerivations [ drv1 "string" { foo = drv2; bar = { baz = drv3; }; } ]
+  # [ drv1 drv2 drv3 ]
+  accumulateDerivations =
+    jobList:
+    lib.concatMap (
+      attrs:
+      if lib.isDerivation attrs then
+        [ attrs ]
+      else
+        lib.optionals (lib.isAttrs attrs) (accumulateDerivations (lib.attrValues attrs))
+    ) jobList;
+
   # names of all subsets of `pkgs.haskell.packages`
   #
   # compilerNames looks like the following:
@@ -640,35 +660,34 @@ let
           '';
           teams = [ lib.teams.haskell ];
         };
-        globConstituents = true;
-        constituents = [
+        constituents = accumulateDerivations [
           # haskell specific tests
-          "tests.haskell.*"
+          jobs.tests.haskell
           # important top-level packages
-          "cabal-install.*"
-          "cabal2nix.*"
-          "cachix.*"
-          "darcs.*"
-          "haskell-language-server.*"
-          "hledger.*"
-          "hledger-ui.*"
-          "hpack.*"
-          "niv.*"
-          "pandoc.*"
-          "stack.*"
-          "stylish-haskell.*"
-          "shellcheck.*"
+          jobs.cabal-install
+          jobs.cabal2nix
+          jobs.cachix
+          jobs.darcs
+          jobs.haskell-language-server
+          jobs.hledger
+          jobs.hledger-ui
+          jobs.hpack
+          jobs.niv
+          jobs.pandoc
+          jobs.stack
+          jobs.stylish-haskell
+          jobs.shellcheck
           # important haskell (library) packages
-          "haskellPackages.cabal-plan.*"
-          "haskellPackages.distribution-nixpkgs.*"
-          "haskellPackages.hackage-db.*"
-          "haskellPackages.xmonad.*"
-          "haskellPackages.xmonad-contrib.*"
+          jobs.haskellPackages.cabal-plan
+          jobs.haskellPackages.distribution-nixpkgs
+          jobs.haskellPackages.hackage-db
+          jobs.haskellPackages.xmonad
+          jobs.haskellPackages.xmonad-contrib
           # haskell packages maintained by @peti
           # imported from the old hydra jobset
-          "haskellPackages.hopenssl.*"
-          "haskellPackages.hsemail.*"
-          "haskellPackages.hsyslog.*"
+          jobs.haskellPackages.hopenssl
+          jobs.haskellPackages.hsemail
+          jobs.haskellPackages.hsyslog
         ];
       };
       maintained = pkgs.releaseTools.aggregate {
@@ -677,8 +696,9 @@ let
           description = "Aggregate jobset of all haskell packages with a maintainer";
           teams = [ lib.teams.haskell ];
         };
-        globConstituents = true;
-        constituents = map (name: "haskellPackages.${name}.*") (maintainedPkgNames pkgs.haskellPackages);
+        constituents = accumulateDerivations (
+          map (name: jobs.haskellPackages."${name}") (maintainedPkgNames pkgs.haskellPackages)
+        );
       };
 
       muslGHCs = pkgs.releaseTools.aggregate {
@@ -689,10 +709,9 @@ let
             nh2
           ];
         };
-        globConstituents = true;
-        constituents = [
-          "pkgsMusl.haskell.compiler.ghcHEAD.*"
-          "pkgsMusl.haskell.compiler.native-bignum.ghcHEAD.*"
+        constituents = accumulateDerivations [
+          jobs.pkgsMusl.haskell.compiler.ghcHEAD
+          jobs.pkgsMusl.haskell.compiler.native-bignum.ghcHEAD
         ];
       };
 
@@ -705,10 +724,9 @@ let
             lib.maintainers.rnhmjoj
           ];
         };
-        globConstituents = true;
-        constituents = [
-          "pkgsStatic.haskell.packages.native-bignum.ghc948.*" # non-hadrian
-          "pkgsStatic.haskellPackages.*"
+        constituents = accumulateDerivations [
+          jobs.pkgsStatic.haskell.packages.native-bignum.ghc948 # non-hadrian
+          jobs.pkgsStatic.haskellPackages
         ];
       };
     }
diff --git a/pkgs/top-level/release-python.nix b/pkgs/top-level/release-python.nix
index 51faf69aec8b..51407db2654f 100644
--- a/pkgs/top-level/release-python.nix
+++ b/pkgs/top-level/release-python.nix
@@ -53,14 +53,14 @@ let
       name = "python-tested";
       meta.description = "Release-critical packages from the python package sets";
       constituents = [
-        "nixos-render-docs.x86_64-linux" # Used in nixos manual
-        "remarshal.x86_64-linux" # Used in pkgs.formats.yaml_1_1
-        "python313Packages.afdko.x86_64-linux" # Used in noto-fonts-color-emoji
-        "python313Packages.buildcatrust.x86_64-linux" # Used in pkgs.cacert
-        "python313Packages.colorama.x86_64-linux" # Used in nixos test-driver
-        "python313Packages.ptpython.x86_64-linux" # Used in nixos test-driver
-        "python313Packages.requests.x86_64-linux" # Almost ubiquous package
-        "python313Packages.sphinx.x86_64-linux" # Document creation for many packages
+        jobs.nixos-render-docs.x86_64-linux # Used in nixos manual
+        jobs.remarshal.x86_64-linux # Used in pkgs.formats.yaml_1_1
+        jobs.python313Packages.afdko.x86_64-linux # Used in noto-fonts-color-emoji
+        jobs.python313Packages.buildcatrust.x86_64-linux # Used in pkgs.cacert
+        jobs.python313Packages.colorama.x86_64-linux # Used in nixos test-driver
+        jobs.python313Packages.ptpython.x86_64-linux # Used in nixos test-driver
+        jobs.python313Packages.requests.x86_64-linux # Almost ubiquous package
+        jobs.python313Packages.sphinx.x86_64-linux # Document creation for many packages
       ];
     };
 
diff --git a/pkgs/top-level/release.nix b/pkgs/top-level/release.nix
index b277da8b043a..a6b22fba574e 100644
--- a/pkgs/top-level/release.nix
+++ b/pkgs/top-level/release.nix
@@ -77,12 +77,13 @@ let
   inherit (release-lib) mapTestOn pkgs;
 
   inherit (release-lib.lib)
-    concatMap
+    collect
     elem
     genAttrs
     hasInfix
     hasSuffix
     id
+    isDerivation
     optionals
     ;
 
@@ -112,49 +113,49 @@ let
           name = "nixpkgs-darwin-${jobs.tarball.version}";
           meta.description = "Release-critical builds for the Nixpkgs darwin channel";
           constituents = [
-            "tarball"
-            "release-checks"
+            jobs.tarball
+            jobs.release-checks
           ]
           ++ optionals supportDarwin [
-            "cabal2nix.aarch64-darwin"
-            "ghc.aarch64-darwin"
-            "git.aarch64-darwin"
-            "go.aarch64-darwin"
-            "mariadb.aarch64-darwin"
-            "nix.aarch64-darwin"
-            "nixpkgs-review.aarch64-darwin"
-            "nix-info.aarch64-darwin"
-            "nix-info-tested.aarch64-darwin"
-            "openssh.aarch64-darwin"
-            "openssl.aarch64-darwin"
-            "pandoc.aarch64-darwin"
-            "postgresql.aarch64-darwin"
-            "python3.aarch64-darwin"
-            "ruby.aarch64-darwin"
-            "rustc.aarch64-darwin"
+            jobs.cabal2nix.aarch64-darwin
+            jobs.ghc.aarch64-darwin
+            jobs.git.aarch64-darwin
+            jobs.go.aarch64-darwin
+            jobs.mariadb.aarch64-darwin
+            jobs.nix.aarch64-darwin
+            jobs.nixpkgs-review.aarch64-darwin
+            jobs.nix-info.aarch64-darwin
+            jobs.nix-info-tested.aarch64-darwin
+            jobs.openssh.aarch64-darwin
+            jobs.openssl.aarch64-darwin
+            jobs.pandoc.aarch64-darwin
+            jobs.postgresql.aarch64-darwin
+            jobs.python3.aarch64-darwin
+            jobs.ruby.aarch64-darwin
+            jobs.rustc.aarch64-darwin
             # blocking ofBorg CI 2020-02-28
-            # "stack.aarch64-darwin"
-            "stdenv.aarch64-darwin"
-            "vim.aarch64-darwin"
-            "cachix.aarch64-darwin"
-            "darwin.linux-builder.aarch64-darwin"
+            # jobs.stack.aarch64-darwin
+            jobs.stdenv.aarch64-darwin
+            jobs.vim.aarch64-darwin
+            jobs.cachix.aarch64-darwin
+            jobs.darwin.linux-builder.aarch64-darwin
 
             # UI apps
-            # "firefox-unwrapped.aarch64-darwin"
-            "qt5.qtmultimedia.aarch64-darwin"
-            "inkscape.aarch64-darwin"
-            "gimp2.aarch64-darwin" # FIXME replace with gimp once https://github.com/NixOS/nixpkgs/issues/411189 is resolved
-            "emacs.aarch64-darwin"
-            "wireshark.aarch64-darwin"
+            # jobs.firefox-unwrapped.aarch64-darwin
+            jobs.qt5.qtmultimedia.aarch64-darwin
+            jobs.inkscape.aarch64-darwin
+            jobs.gimp2.aarch64-darwin # FIXME replace with gimp once https://github.com/NixOS/nixpkgs/issues/411189 is resolved
+            jobs.emacs.aarch64-darwin
+            jobs.wireshark.aarch64-darwin
 
             # Tests
             /*
-              "tests.cc-wrapper.default.aarch64-darwin"
-              "tests.cc-wrapper.llvmPackages.clang.aarch64-darwin"
-              "tests.cc-wrapper.llvmPackages.libcxx.aarch64-darwin"
-              "tests.stdenv-inputs.aarch64-darwin"
-              "tests.macOSSierraShared.aarch64-darwin"
-              "tests.stdenv.hooks.patch-shebangs.aarch64-darwin"
+              jobs.tests.cc-wrapper.default.aarch64-darwin
+              jobs.tests.cc-wrapper.llvmPackages.clang.aarch64-darwin
+              jobs.tests.cc-wrapper.llvmPackages.libcxx.aarch64-darwin
+              jobs.tests.stdenv-inputs.aarch64-darwin
+              jobs.tests.macOSSierraShared.aarch64-darwin
+              jobs.tests.stdenv.hooks.patch-shebangs.aarch64-darwin
             */
           ];
         }
@@ -165,71 +166,68 @@ let
       name = "nixpkgs-${jobs.tarball.version}";
       meta.description = "Release-critical builds for the Nixpkgs unstable channel";
       constituents = [
-        "tarball"
-        "release-checks"
-        "metrics"
-        "manual"
-        "tests.lib-tests.x86_64-linux"
-        "tests.pkgs-lib.formats-tests.x86_64-linux"
-        "stdenv.x86_64-linux"
-        "cargo.x86_64-linux"
-        "go.x86_64-linux"
-        "linux.x86_64-linux"
-        "nix.x86_64-linux"
-        "pandoc.x86_64-linux"
-        "python3.x86_64-linux"
+        jobs.tarball
+        jobs.release-checks
+        jobs.metrics
+        jobs.manual
+        jobs.tests.lib-tests.x86_64-linux
+        jobs.tests.pkgs-lib.formats-tests.x86_64-linux
+        jobs.stdenv.x86_64-linux
+        jobs.cargo.x86_64-linux
+        jobs.go.x86_64-linux
+        jobs.linux.x86_64-linux
+        jobs.nix.x86_64-linux
+        jobs.pandoc.x86_64-linux
+        jobs.python3.x86_64-linux
         # Needed by contributors to test PRs (by inclusion of the PR template)
-        "nixpkgs-review.x86_64-linux"
+        jobs.nixpkgs-review.x86_64-linux
         # Needed for support
-        "nix-info.x86_64-linux"
-        "nix-info-tested.x86_64-linux"
+        jobs.nix-info.x86_64-linux
+        jobs.nix-info-tested.x86_64-linux
         # Ensure that X11/GTK are in order.
-        "firefox-unwrapped.x86_64-linux"
-        "cachix.x86_64-linux"
-        "devenv.x86_64-linux"
+        jobs.firefox-unwrapped.x86_64-linux
+        jobs.cachix.x86_64-linux
+        jobs.devenv.x86_64-linux
 
         /*
           TODO: re-add tests; context: https://github.com/NixOS/nixpkgs/commit/36587a587ab191eddd868179d63c82cdd5dee21b
 
-          "tests.cc-wrapper.default.x86_64-linux"
+          jobs.tests.cc-wrapper.default.x86_64-linux
 
           # broken see issue #40038
 
-          "tests.cc-wrapper.llvmPackages.clang.x86_64-linux"
-          "tests.cc-wrapper.llvmPackages.libcxx.x86_64-linux"
-          "tests.cc-multilib-gcc.x86_64-linux"
-          "tests.cc-multilib-clang.x86_64-linux"
-          "tests.stdenv-inputs.x86_64-linux"
-          "tests.stdenv.hooks.patch-shebangs.x86_64-linux"
+          jobs.tests.cc-wrapper.llvmPackages.clang.x86_64-linux
+          jobs.tests.cc-wrapper.llvmPackages.libcxx.x86_64-linux
+          jobs.tests.cc-multilib-gcc.x86_64-linux
+          jobs.tests.cc-multilib-clang.x86_64-linux
+          jobs.tests.stdenv-inputs.x86_64-linux
+          jobs.tests.stdenv.hooks.patch-shebangs.x86_64-linux
         */
       ]
-      ++ concatMap (config: [
-        "stdenvBootstrapTools.${config}.build"
-        "stdenvBootstrapTools.${config}.test"
-      ]) bootstrapConfigs
+      ++ collect isDerivation jobs.stdenvBootstrapTools
       ++ optionals supportDarwin [
-        "stdenv.aarch64-darwin"
-        "cargo.aarch64-darwin"
-        "cachix.aarch64-darwin"
-        "devenv.aarch64-darwin"
-        "go.aarch64-darwin"
-        "python3.aarch64-darwin"
-        "nixpkgs-review.aarch64-darwin"
-        "nix.aarch64-darwin"
-        "nix-info.aarch64-darwin"
-        "nix-info-tested.aarch64-darwin"
-        "git.aarch64-darwin"
-        "mariadb.aarch64-darwin"
-        "vim.aarch64-darwin"
-        "inkscape.aarch64-darwin"
-        "qt5.qtmultimedia.aarch64-darwin"
-        "darwin.linux-builder.aarch64-darwin"
+        jobs.stdenv.aarch64-darwin
+        jobs.cargo.aarch64-darwin
+        jobs.cachix.aarch64-darwin
+        jobs.devenv.aarch64-darwin
+        jobs.go.aarch64-darwin
+        jobs.python3.aarch64-darwin
+        jobs.nixpkgs-review.aarch64-darwin
+        jobs.nix.aarch64-darwin
+        jobs.nix-info.aarch64-darwin
+        jobs.nix-info-tested.aarch64-darwin
+        jobs.git.aarch64-darwin
+        jobs.mariadb.aarch64-darwin
+        jobs.vim.aarch64-darwin
+        jobs.inkscape.aarch64-darwin
+        jobs.qt5.qtmultimedia.aarch64-darwin
+        jobs.darwin.linux-builder.aarch64-darwin
         /*
-          "tests.cc-wrapper.default.aarch64-darwin"
-          "tests.cc-wrapper.llvmPackages.clang.aarch64-darwin"
-          "tests.cc-wrapper.llvmPackages.libcxx.aarch64-darwin"
-          "tests.stdenv-inputs.aarch64-darwin"
-          "tests.stdenv.hooks.patch-shebangs.aarch64-darwin"
+          jobs.tests.cc-wrapper.default.aarch64-darwin
+          jobs.tests.cc-wrapper.llvmPackages.clang.aarch64-darwin
+          jobs.tests.cc-wrapper.llvmPackages.libcxx.aarch64-darwin
+          jobs.tests.stdenv-inputs.aarch64-darwin
+          jobs.tests.stdenv.hooks.patch-shebangs.aarch64-darwin
         */
       ];
     };