diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 6e56cc1a792c..69c707270f17 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -957,7 +957,6 @@ The following situations are fully or partially exempt:
 
 If you believe that someone is using automation without appropriate disclosure and review, you can politely ask them if that’s the case and point them to this policy as appropriate.
 Please assume good faith and remain civil; it’s not always possible to determine, and it is more likely that someone overlooked this policy than deliberately violated it.
-If you think someone is continuing to break the policy after this, please escalate to the [Nixpkgs core team](https://nixos.org/community/teams/nixpkgs-core/) rather than fighting over it.
 
 If a contribution is clearly in violation of the policy (e.g. the contributor admits it was not followed, or there are AI tool attributions that do not meet our required format), it can be closed or hidden, preferably after informing the contributor of the policy and giving them a chance to address the violations.
 Deliberate violations of this policy are considered to break the [Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) clause against “Wasting other people’s time with low quality contributions, including but not limited to LLM and bot spam”.
diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index 24921c79fa4c..d921a1ec1cb2 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -108,6 +108,8 @@
 
 - [Umbriel](https://docs.noctalia.dev/umbriel/), a Wayland compositor built on wlroots and SceneFX. Available as [programs.umbriel](#opt-programs.umbriel.enable).
 
+- [Rundeck](https://www.rundeck.com), Self-Service Operations [services.rundeck](#opt-services.rundeck.enable).
+
 ## Backward Incompatibilities {#sec-release-26.11-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -207,6 +209,10 @@
 
 - `chatgpt` has been retargeted to OpenAI's new ChatGPT desktop app, while the previous app has been renamed to `chatgpt-classic`.
 
+- NetBox was updated to `>= 4.6.8`. Have a look at the breaking changes
+  of the [4.6 release](https://github.com/netbox-community/netbox/releases/tag/v4.6.0),
+  make the required changes to your database, if needed, then upgrade by setting `services.netbox.package = pkgs.netbox_4_6;` in your configuration.
+
 ## Other Notable Changes {#sec-release-26.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index a7a07eff0c22..5c77c2014238 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1824,6 +1824,7 @@
   ./services/web-apps/romm.nix
   ./services/web-apps/rss-bridge.nix
   ./services/web-apps/rsshub.nix
+  ./services/web-apps/rundeck.nix
   ./services/web-apps/rustical.nix
   ./services/web-apps/rutorrent.nix
   ./services/web-apps/screego.nix
diff --git a/nixos/modules/services/web-apps/netbox.nix b/nixos/modules/services/web-apps/netbox.nix
index d74c9c926b80..657de456db11 100644
--- a/nixos/modules/services/web-apps/netbox.nix
+++ b/nixos/modules/services/web-apps/netbox.nix
@@ -434,11 +434,12 @@ in
     package = lib.mkOption {
       type = types.package;
       default =
-        if lib.versionAtLeast config.system.stateVersion "26.05" then pkgs.netbox_4_5 else pkgs.netbox_4_4;
+        if lib.versionAtLeast config.system.stateVersion "26.11" then pkgs.netbox_4_6 else pkgs.netbox_4_5;
       defaultText = lib.literalExpression ''
-        if lib.versionAtLeast config.system.stateVersion "26.05"
-        then pkgs.netbox_4_5
-        else pkgs.netbox_4_4;
+        if lib.versionAtLeast config.system.stateVersion "26.11" then
+          pkgs.netbox_4_6
+        else
+          pkgs.netbox_4_5;
       '';
       description = ''
         NetBox package to use.
diff --git a/nixos/modules/services/web-apps/rundeck.nix b/nixos/modules/services/web-apps/rundeck.nix
new file mode 100644
index 000000000000..71526d651a82
--- /dev/null
+++ b/nixos/modules/services/web-apps/rundeck.nix
@@ -0,0 +1,651 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.rundeck;
+  settingsFormat = pkgs.formats.javaProperties { };
+  effectivePort = if cfg.ssl.enable then cfg.ssl.port else cfg.serverPort;
+  scheme = if cfg.ssl.enable then "https" else "http";
+
+  configFile = settingsFormat.generate "rundeck-config.properties" cfg.settings;
+  frameworkFile = settingsFormat.generate "framework.properties" cfg.frameworkSettings;
+
+  realmFile = pkgs.writeText "realm.properties" ''
+    ${cfg.adminUser}:@ADMIN_PASSWORD@,user,admin
+  '';
+
+  replaceSecret =
+    placeholder: file: target:
+    "replace-secret ${
+      lib.escapeShellArgs [
+        placeholder
+        file
+        target
+      ]
+    }";
+
+  rundeckStartScript = pkgs.writeShellScript "start-rundeck" ''
+    # Generate SSH
+    if [ ! -f ${cfg.dataDir}/.ssh/id_${cfg.sshKeyType} ]; then
+      umask 0077
+      ${lib.getExe' pkgs.openssh "ssh-keygen"} -t ${cfg.sshKeyType} ${
+        lib.optionalString (cfg.sshKeyType == "rsa") "-b 4096"
+      } -N "" -f ${cfg.dataDir}/.ssh/id_${cfg.sshKeyType}
+      chmod 644 ${cfg.dataDir}/.ssh/id_${cfg.sshKeyType}.pub
+      chown ${cfg.user}:${cfg.group} ${cfg.dataDir}/.ssh/id_${cfg.sshKeyType} ${cfg.dataDir}/.ssh/id_${cfg.sshKeyType}.pub
+    fi
+
+    ${lib.getExe cfg.package} \
+      --skipinstall \
+      -b ${cfg.dataDir} \
+      -c ${cfg.configDir} \
+      -p ${cfg.dataDir}/projects
+  '';
+in
+{
+  options = {
+    services.rundeck = {
+      enable = lib.mkEnableOption "Rundeck service";
+
+      package = lib.mkPackageOption pkgs "rundeck" { };
+
+      adminUser = lib.mkOption {
+        type = lib.types.str;
+        default = "admin";
+        description = "Username for the Rundeck admin user";
+        example = "rundeck-admin";
+      };
+
+      adminPasswordFile = lib.mkOption {
+        type = lib.types.path;
+        description = "Path to a file containing the admin password";
+        example = "/run/secrets/rundeck-admin-password";
+      };
+
+      user = lib.mkOption {
+        type = lib.types.str;
+        default = "rundeck";
+        description = "User account under which Rundeck runs";
+      };
+
+      group = lib.mkOption {
+        type = lib.types.str;
+        default = "rundeck";
+        description = "Group account under which Rundeck runs";
+      };
+
+      serverHostname = lib.mkOption {
+        type = lib.types.str;
+        default = "localhost";
+        description = "Hostname for the Rundeck server";
+      };
+
+      serverURL = lib.mkOption {
+        type = lib.types.str;
+        default = "${scheme}://${cfg.serverHostname}:${toString effectivePort}";
+        defaultText = lib.literalMD ''
+          `<scheme>://<serverHostname>:<port>`, where scheme is `https` when
+          `ssl.enable` else `http`, and port is `ssl.port` when `ssl.enable`
+          else `serverPort`.
+        '';
+        description = "Complete Grails server URL";
+        example = "https://myhost:4443/rundeck";
+      };
+
+      serverPort = lib.mkOption {
+        type = lib.types.port;
+        default = 4440;
+        description = "Port on which Rundeck will listen";
+      };
+
+      serverUUID = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+        description = "UUID for the Rundeck server (automatically generated if not specified)";
+      };
+
+      dataDir = lib.mkOption {
+        type = lib.types.path;
+        default = "/var/lib/rundeck";
+        description = "Directory for Rundeck runtime data (RDECK_BASE)";
+      };
+
+      configDir = lib.mkOption {
+        type = lib.types.path;
+        default = "/etc/rundeck";
+        description = "Directory for Rundeck configuration files";
+      };
+
+      javaOpts = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [
+          "-Xmx1024m"
+          "-Xms256m"
+          "-XX:MaxMetaspaceSize=256m"
+          "-server"
+        ];
+        description = "Additional Java options for Rundeck";
+      };
+
+      aclPolicies = lib.mkOption {
+        type = lib.types.attrsOf lib.types.str;
+        default = { };
+        description = "ACL policies for Rundeck, where the attribute name is the filename and the value is the policy content";
+        example = lib.literalExpression ''
+          {
+            "admin.aclpolicy" = '''
+              description: Admin access for administrators
+              context:
+                project: '.*'
+              for:
+                resource:
+                  - allow: '*'
+                job:
+                  - allow: '*'
+                node:
+                  - allow: '*'
+              by:
+                group: admin
+              ---
+              description: Admin access in application scope
+              context:
+                application: 'rundeck'
+              for:
+                resource:
+                  - allow: '*'
+                project:
+                  - allow: '*'
+              by:
+                group: admin
+            ''';
+          }
+        '';
+      };
+
+      sshKeyType = lib.mkOption {
+        type = lib.types.enum [
+          "rsa"
+          "ed25519"
+        ];
+        default = "rsa";
+        description = "Type of SSH key to generate (rsa for compatibility, ed25519 for better security)";
+      };
+
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Whether to open the Rundeck port in the firewall";
+      };
+
+      startTimeout = lib.mkOption {
+        type = lib.types.int;
+        default = 180;
+        description = "Timeout in seconds before systemd considers the service startup as failed";
+        example = 120;
+      };
+
+      database = {
+        type = lib.mkOption {
+          type = lib.types.enum [
+            "h2"
+            "postgresql"
+            "mysql"
+          ];
+          default = "h2";
+          description = "Database type to use (h2, postgresql, or mysql)";
+        };
+
+        host = lib.mkOption {
+          type = lib.types.str;
+          default = "localhost";
+          description = "Database host";
+        };
+
+        port = lib.mkOption {
+          type = lib.types.nullOr lib.types.port;
+          default =
+            if cfg.database.type == "postgresql" then
+              5432
+            else if cfg.database.type == "mysql" then
+              3306
+            else
+              null;
+          defaultText = lib.literalExpression ''
+            if config.services.rundeck.database.type == "postgresql" then
+              5432
+            else if config.services.rundeck.database.type == "mysql" then
+              3306
+            else
+              null
+          '';
+          description = "Database port (defaults: PostgreSQL: 5432, MySQL: 3306)";
+        };
+
+        name = lib.mkOption {
+          type = lib.types.str;
+          default = "rundeck";
+          description = "Database name";
+        };
+
+        username = lib.mkOption {
+          type = lib.types.str;
+          default = "rundeck";
+          description = "Database username";
+        };
+
+        passwordFile = lib.mkOption {
+          type = lib.types.nullOr lib.types.path;
+          default = null;
+          description = "Path to a file containing the database password";
+          example = "/run/secrets/rundeck-db-password";
+        };
+      };
+
+      settings = lib.mkOption {
+        type = lib.types.submodule {
+          freeformType = settingsFormat.type;
+        };
+        default = { };
+        description = ''
+          Configuration written to `rundeck-config.properties`.
+          See <https://docs.rundeck.com/docs/administration/configuration/config-file-reference.html>
+          for available options.
+
+          Secrets must not be set here, as this ends up world-readable in the Nix
+          store. Use the dedicated `*File` options instead.
+        '';
+        example = lib.literalExpression ''
+          {
+            "rundeck.feature.repository.enabled" = "true";
+            "rundeck.projectsStorageType" = "db";
+            "rundeck.gui.title" = "My Rundeck Instance";
+            "rdeck.security.useHMacRequestTokens" = "true";
+            "rundeck.web.jetty.servlet.MaxFormKeys" = "2000";
+          }
+        '';
+      };
+
+      frameworkSettings = lib.mkOption {
+        type = lib.types.submodule {
+          freeformType = settingsFormat.type;
+        };
+        default = { };
+        description = ''
+          Configuration written to `framework.properties`.
+          See <https://docs.rundeck.com/docs/administration/configuration/config-file-reference.html>
+          for available options.
+        '';
+        example = lib.literalExpression ''
+          {
+            "framework.ssh.timeout" = "120";
+            "framework.ssh.user" = "deploy";
+          }
+        '';
+      };
+
+      ssl = {
+        enable = lib.mkEnableOption "SSL support";
+
+        port = lib.mkOption {
+          type = lib.types.port;
+          default = 4443;
+          description = "Port on which Rundeck will listen for HTTPS when ssl.enable is true";
+        };
+
+        keyStore = lib.mkOption {
+          type = lib.types.path;
+          example = "/etc/rundeck/ssl/keystore";
+          description = "Path to the keystore containing the SSL certificate";
+        };
+
+        keyStorePasswordFile = lib.mkOption {
+          type = lib.types.path;
+          description = "Path to a file containing the SSL keystore password";
+          example = "/run/secrets/rundeck-keystore-password";
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+
+    assertions = [
+      {
+        assertion =
+          cfg.database.type == "h2"
+          || (cfg.database.host != "" && cfg.database.username != "" && cfg.database.passwordFile != null);
+        message = "When using external database (PostgreSQL/MySQL), host, username, and passwordFile must be provided";
+      }
+      {
+        assertion = cfg.database.type == "h2" || cfg.database.port != null;
+        message = "Database port must be set when using an external database";
+      }
+    ];
+
+    services.rundeck.settings = {
+      "server.address" = lib.mkDefault "0.0.0.0";
+      "server.port" = lib.mkDefault (toString cfg.serverPort);
+      "grails.serverURL" = lib.mkDefault cfg.serverURL;
+      "logging.config" = lib.mkDefault "${cfg.configDir}/log4j2.properties";
+      "dataSource.url" = lib.mkDefault (
+        if cfg.database.type == "h2" then
+          "jdbc:h2:file:${cfg.dataDir}/data/rundeckdb;DB_CLOSE_ON_EXIT=FALSE;NON_KEYWORDS=MONTH,HOUR,MINUTE,YEAR,SECONDS"
+        else if cfg.database.type == "postgresql" then
+          "jdbc:postgresql://${cfg.database.host}:${toString cfg.database.port}/${cfg.database.name}"
+        else
+          "jdbc:mysql://${cfg.database.host}:${toString cfg.database.port}/${cfg.database.name}?autoReconnect=true&useSSL=false"
+      );
+      "dataSource.driverClassName" = lib.mkDefault (
+        if cfg.database.type == "h2" then
+          "org.h2.Driver"
+        else if cfg.database.type == "postgresql" then
+          "org.postgresql.Driver"
+        else
+          "org.mariadb.jdbc.Driver"
+      );
+      "dataSource.username" = lib.mkDefault cfg.database.username;
+    }
+    // lib.optionalAttrs (cfg.database.passwordFile != null) {
+      "dataSource.password" = lib.mkDefault "@DB_PASSWORD@";
+    }
+    // lib.optionalAttrs (cfg.database.type == "h2") {
+      "dataSource.dialect" = lib.mkDefault "org.hibernate.dialect.H2Dialect";
+    }
+    // lib.optionalAttrs (cfg.database.type == "mysql") {
+      "dataSource.dialect" = lib.mkDefault "org.hibernate.dialect.MariaDB103Dialect";
+    }
+    // lib.optionalAttrs cfg.ssl.enable {
+      "server.https.port" = lib.mkDefault (toString cfg.ssl.port);
+      "server.ssl.keyStore" = lib.mkDefault (toString cfg.ssl.keyStore);
+      "server.ssl.keyStorePassword" = lib.mkDefault "@KEYSTORE_PASSWORD@";
+    };
+
+    services.rundeck.frameworkSettings = {
+      "framework.server.name" = lib.mkDefault cfg.serverHostname;
+      "framework.server.hostname" = lib.mkDefault cfg.serverHostname;
+      "framework.server.port" = lib.mkDefault (toString effectivePort);
+      "framework.server.url" = lib.mkDefault cfg.serverURL;
+      "framework.ssh.keypath" = lib.mkDefault "${cfg.dataDir}/.ssh/id_${cfg.sshKeyType}";
+      "framework.ssh.user" = lib.mkDefault cfg.user;
+      "framework.ssh.timeout" = lib.mkDefault "60";
+      "rdeck.base" = cfg.dataDir;
+      "framework.projects.dir" = "${cfg.dataDir}/projects";
+      "framework.etc.dir" = toString cfg.configDir;
+      "framework.var.dir" = "${cfg.dataDir}/var";
+      "framework.tmp.dir" = "${cfg.dataDir}/var/tmp";
+      "framework.logs.dir" = "${cfg.dataDir}/var/logs";
+      "framework.libext.dir" = "${cfg.dataDir}/libext";
+      "rundeck.server.uuid" = if cfg.serverUUID != "" then cfg.serverUUID else "@SERVER_UUID@";
+    };
+
+    users.users.${cfg.user} = {
+      isSystemUser = true;
+      group = cfg.group;
+      home = cfg.dataDir;
+      createHome = true;
+    };
+
+    users.groups.${cfg.group} = { };
+
+    systemd.tmpfiles.settings."10-rundeck" = {
+      "${cfg.dataDir}" = {
+        d = {
+          mode = "0750";
+          user = cfg.user;
+          group = cfg.group;
+        };
+      };
+
+      "${cfg.dataDir}/etc" = {
+        d = {
+          mode = "0750";
+          user = cfg.user;
+          group = cfg.group;
+        };
+      };
+
+      "${cfg.dataDir}/data" = {
+        d = {
+          mode = "0750";
+          user = cfg.user;
+          group = cfg.group;
+        };
+      };
+
+      "${cfg.dataDir}/projects" = {
+        d = {
+          mode = "0750";
+          user = cfg.user;
+          group = cfg.group;
+        };
+      };
+
+      "${cfg.dataDir}/libext" = {
+        d = {
+          mode = "0750";
+          user = cfg.user;
+          group = cfg.group;
+        };
+      };
+
+      "${cfg.dataDir}/var" = {
+        d = {
+          mode = "0750";
+          user = cfg.user;
+          group = cfg.group;
+        };
+      };
+
+      "${cfg.dataDir}/var/logs" = {
+        d = {
+          mode = "0750";
+          user = cfg.user;
+          group = cfg.group;
+        };
+      };
+
+      "${cfg.dataDir}/var/tmp" = {
+        d = {
+          mode = "0750";
+          user = cfg.user;
+          group = cfg.group;
+        };
+      };
+
+      "${cfg.dataDir}/.ssh" = {
+        d = {
+          mode = "0700";
+          user = cfg.user;
+          group = cfg.group;
+        };
+      };
+
+      "${cfg.configDir}" = {
+        d = {
+          mode = "0750";
+          user = cfg.user;
+          group = cfg.group;
+        };
+      };
+
+      "${cfg.configDir}/ssl" = {
+        d = {
+          mode = "0750";
+          user = cfg.user;
+          group = cfg.group;
+        };
+      };
+
+      "/var/log/rundeck" = {
+        L = {
+          argument = "${cfg.dataDir}/var/logs";
+        };
+      };
+    };
+
+    environment.etc."rundeck/jaas-loginmodule.conf" = {
+      mode = "0640";
+      user = cfg.user;
+      group = cfg.group;
+      text = ''
+        RDpropertyfilelogin {
+          org.eclipse.jetty.jaas.spi.PropertyFileLoginModule required
+          debug="true"
+          file="/etc/rundeck/realm.properties";
+        };
+      '';
+    };
+
+    environment.etc."rundeck/log4j2.properties" = {
+      mode = "0640";
+      user = cfg.user;
+      group = cfg.group;
+      text = ''
+        status = info
+        name = RundeckPro
+
+        appender.console.type = Console
+        appender.console.name = STDOUT
+        appender.console.layout.type = PatternLayout
+        appender.console.layout.pattern = %d{DEFAULT} %-5p %c{1} - %m%n
+
+        appender.file.type = RollingFile
+        appender.file.name = FILE
+        appender.file.fileName = ${cfg.dataDir}/var/logs/rundeck.log
+        appender.file.filePattern = ${cfg.dataDir}/var/logs/rundeck.%d{yyyy-MM-dd}.log
+        appender.file.layout.type = PatternLayout
+        appender.file.layout.pattern = %d{DEFAULT} [%t] %-5p %c{1} - %m%n
+        appender.file.policies.type = Policies
+        appender.file.policies.time.type = TimeBasedTriggeringPolicy
+        appender.file.policies.time.interval = 1
+        appender.file.policies.time.modulate = true
+
+        rootLogger.level = info
+        rootLogger.appenderRef.stdout.ref = STDOUT
+        rootLogger.appenderRef.file.ref = FILE
+
+        logger.hibernate.name = org.hibernate
+        logger.hibernate.level = ERROR
+      '';
+    };
+
+    systemd.services.rundeck = {
+      description = "Rundeck Service";
+      wantedBy = [ "multi-user.target" ];
+      after = [
+        "network.target"
+      ]
+      ++ lib.optional (cfg.database.type == "mysql") "mysql.service"
+      ++ lib.optional (cfg.database.type == "postgresql") "postgresql.service";
+      wants =
+        lib.optional (cfg.database.type == "mysql") "mysql.service"
+        ++ lib.optional (cfg.database.type == "postgresql") "postgresql.service";
+
+      environment = {
+        RDECK_BASE = cfg.dataDir;
+        RUNDECK_CONFIG_DIR = cfg.configDir;
+        JAVA_OPTS = lib.concatStringsSep " " cfg.javaOpts;
+      };
+
+      path = [ pkgs.replace-secret ];
+
+      serviceConfig = {
+        User = cfg.user;
+        Group = cfg.group;
+        ExecStart = rundeckStartScript;
+        WorkingDirectory = cfg.dataDir;
+        RuntimeDirectory = "rundeck";
+        RuntimeDirectoryMode = "0750";
+        UMask = "0027";
+
+        LimitNOFILE = 65536;
+        ReadWritePaths = [
+          cfg.dataDir
+          cfg.configDir
+        ];
+        RestartSec = "10s";
+        Restart = "always";
+        TimeoutStartSec = "${toString cfg.startTimeout}s";
+
+        CapabilityBoundingSet = [ "CAP_SYS_ADMIN" ];
+        AmbientCapabilities = [ "CAP_SYS_ADMIN" ];
+
+        LimitCORE = 0;
+        LockPersonality = true;
+        MemorySwapMax = 0;
+        MemoryZSwapMax = 0;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [
+          "AF_UNIX"
+          "AF_INET"
+          "AF_INET6"
+          "AF_NETLINK"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+      };
+
+      preStart = ''
+        ${lib.optionalString (cfg.serverUUID == "") ''
+          # Generate UUID
+          UUID_FILE="${cfg.dataDir}/.uuid"
+          if [ ! -f "$UUID_FILE" ]; then
+            umask 0137
+            ${lib.getExe' pkgs.util-linux "uuidgen"} > "$UUID_FILE"
+          fi
+        ''}
+
+
+        install -m 0640 ${configFile} ${cfg.configDir}/rundeck-config.properties
+        install -m 0640 ${frameworkFile} ${cfg.configDir}/framework.properties
+        install -m 0600 ${realmFile} ${cfg.configDir}/realm.properties
+
+        ${replaceSecret "@ADMIN_PASSWORD@" cfg.adminPasswordFile "${cfg.configDir}/realm.properties"}
+
+        ${lib.optionalString (cfg.database.passwordFile != null) (
+          replaceSecret "@DB_PASSWORD@" cfg.database.passwordFile "${cfg.configDir}/rundeck-config.properties"
+        )}
+
+        ${lib.optionalString cfg.ssl.enable (
+          replaceSecret "@KEYSTORE_PASSWORD@" cfg.ssl.keyStorePasswordFile
+            "${cfg.configDir}/rundeck-config.properties"
+        )}
+
+        ${lib.optionalString (cfg.serverUUID == "") (
+          replaceSecret "@SERVER_UUID@" "${cfg.dataDir}/.uuid" "${cfg.configDir}/framework.properties"
+        )}
+
+        if [ -f ${cfg.dataDir}/etc/framework.properties ]; then
+          install -m 0640 ${cfg.configDir}/framework.properties ${cfg.dataDir}/etc/framework.properties
+        fi
+
+        ${lib.concatStringsSep "\n" (
+          lib.mapAttrsToList (
+            name: content:
+            "install -m 0640 ${pkgs.writeText "rundeck-${name}" content} ${cfg.dataDir}/etc/${name}"
+          ) cfg.aclPolicies
+        )}
+      '';
+    };
+
+    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [
+      (if cfg.ssl.enable then cfg.ssl.port else cfg.serverPort)
+    ];
+  };
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index d480c9263a77..c3165c3ea4d3 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1156,6 +1156,7 @@ in
   netbox-upgrade = runTest ./web-apps/netbox-upgrade.nix;
   netbox_4_4 = handleTest ./web-apps/netbox/default.nix { netbox = pkgs.netbox_4_4; };
   netbox_4_5 = handleTest ./web-apps/netbox/default.nix { netbox = pkgs.netbox_4_5; };
+  netbox_4_6 = handleTest ./web-apps/netbox/default.nix { netbox = pkgs.netbox_4_6; };
   netdata = runTest ./netdata.nix;
   netfoil = runTest ./netfoil.nix;
   netplan = runTest ./netplan.nix;
@@ -1553,6 +1554,7 @@ in
   rsyslogd = handleTest ./rsyslogd.nix { };
   rtkit = runTest ./rtkit.nix;
   rtorrent = runTest ./rtorrent.nix;
+  rundeck = runTest ./rundeck.nix;
   rush = runTest ./rush.nix;
   rustfs = runTest ./rustfs.nix;
   rustical = runTest ./web-apps/rustical.nix;
diff --git a/nixos/tests/rundeck.nix b/nixos/tests/rundeck.nix
new file mode 100644
index 000000000000..8bfd209816f3
--- /dev/null
+++ b/nixos/tests/rundeck.nix
@@ -0,0 +1,111 @@
+{
+  name = "rundeck";
+
+  nodes = {
+    rundeck =
+      { pkgs, ... }:
+      {
+        environment.etc."rundeck-admin-password" = {
+          text = "testpassword";
+          mode = "0400";
+          user = "rundeck";
+          group = "rundeck";
+        };
+
+        services.rundeck = {
+          enable = true;
+          serverHostname = "rundeck";
+          adminUser = "testadmin";
+          adminPasswordFile = "/etc/rundeck-admin-password";
+          serverPort = 4441;
+          database.type = "h2";
+          openFirewall = true;
+        };
+
+        environment.systemPackages = with pkgs; [
+          curl
+          jq
+        ];
+      };
+  };
+
+  testScript = ''
+    start_all()
+
+    def login_and_verify_api(machine, host, port, user, password, timeout=300):
+        """Authenticate via Rundeck form login and verify API access."""
+        machine.wait_until_succeeds(
+            f"curl -s -c /tmp/cookies -L"
+            f" -d 'j_username={user}&j_password={password}'"
+            f" http://{host}:{port}/j_security_check -o /dev/null"
+            f" && curl -s -b /tmp/cookies -H 'Accept: application/json'"
+            f" http://{host}:{port}/api/26/system/info"
+            f" | jq -e '.system.rundeck.version'",
+            timeout=timeout,
+        )
+
+    def properties(machine, path):
+        return machine.succeed(f"cat {path}").replace("\\", "").replace(" = ", "=")
+
+    with subtest("Rundeck starts and serves homepage"):
+        rundeck.wait_for_unit("rundeck.service")
+        rundeck.wait_for_open_port(4441)
+        rundeck.wait_until_succeeds(
+            "curl -sL http://rundeck:4441 | grep -qi Rundeck"
+        )
+
+    with subtest("Regression - port is included in generated URLs"):
+        config = properties(rundeck, "/etc/rundeck/rundeck-config.properties")
+        framework = properties(rundeck, "/etc/rundeck/framework.properties")
+
+        assert "grails.serverURL=http://rundeck:4441" in config, config
+        assert "server.port=4441" in config, config
+        assert "framework.server.url=http://rundeck:4441" in framework, framework
+
+    with subtest("Structural settings end up in the generated config"):
+        config = properties(rundeck, "/etc/rundeck/rundeck-config.properties")
+
+        assert "dataSource.driverClassName=org.h2.Driver" in config, config
+        assert "dataSource.dialect=org.hibernate.dialect.H2Dialect" in config, config
+
+    with subtest("Server UUID is generated and substituted"):
+        framework = properties(rundeck, "/etc/rundeck/framework.properties")
+
+        assert "@SERVER_UUID@" not in framework, framework
+        rundeck.succeed(
+            "grep -qE '^rundeck\\.server\\.uuid = [0-9a-f-]{36}$'"
+            " /etc/rundeck/framework.properties"
+        )
+
+    with subtest("Secrets are substituted and not world-readable"):
+        rundeck.succeed(
+            "grep -qxF 'testadmin:testpassword,user,admin'"
+            " /etc/rundeck/realm.properties"
+        )
+        rundeck.fail("grep -q '@ADMIN_PASSWORD@' /etc/rundeck/realm.properties")
+        rundeck.succeed(
+            "[ \"$(stat -c %a /etc/rundeck/realm.properties)\" = 600 ]"
+        )
+        rundeck.succeed(
+            "[ \"$(stat -c %U /etc/rundeck/realm.properties)\" = rundeck ]"
+        )
+
+    with subtest("API authentication via form login"):
+        login_and_verify_api(rundeck, "rundeck", 4441, "testadmin", "testpassword")
+
+        rundeck.succeed(
+            "curl -s -b /tmp/cookies -X POST"
+            " -H 'Accept: application/json'"
+            " -H 'Content-Type: application/json'"
+            " -d '{\"name\":\"test-project\",\"config\":{}}'"
+            " http://rundeck:4441/api/26/projects"
+            " | jq -e '.name == \"test-project\"'"
+        )
+
+        rundeck.succeed(
+            "curl -s -b /tmp/cookies -H 'Accept: application/json'"
+            " http://rundeck:4441/api/26/projects"
+            " | jq -e 'any(.[]; .name == \"test-project\")'"
+        )
+  '';
+}
diff --git a/nixos/tests/web-apps/netbox-upgrade.nix b/nixos/tests/web-apps/netbox-upgrade.nix
index ffea21a648cd..49bedc973b01 100644
--- a/nixos/tests/web-apps/netbox-upgrade.nix
+++ b/nixos/tests/web-apps/netbox-upgrade.nix
@@ -1,7 +1,7 @@
 { lib, pkgs, ... }:
 let
-  oldNetbox = "netbox_4_4";
-  newNetbox = "netbox_4_5";
+  oldNetbox = "netbox_4_5";
+  newNetbox = "netbox_4_6";
 
   apiVersion =
     version:
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 960824b0d57d..c72447887f00 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -4591,8 +4591,8 @@ let
         mktplcRef = {
           name = "svelte-vscode";
           publisher = "svelte";
-          version = "110.3.0";
-          hash = "sha256-vVLnjFOpOmfmkwP0Yz7zONrBgpNDFfFZ0TAAicxdZ64=";
+          version = "110.3.1";
+          hash = "sha256-C3lJ7MO6GTJIotBa71vQN/L6A8iWZ9viYNniT6I2DMQ=";
         };
         meta = {
           changelog = "https://github.com/sveltejs/language-tools/releases";
diff --git a/pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix b/pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix
index 34b2842cbfcb..9e0cd0bee502 100644
--- a/pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix
+++ b/pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-pce-fast";
-  version = "0-unstable-2026-07-31";
+  version = "0-unstable-2026-08-21";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-pce-fast-libretro";
-    rev = "b211204c7026dff6e86e79b00185512e2421fff8";
-    hash = "sha256-NfVgWG76T6cbb44F8Qva7rlwlsuhF8H6WtKjLPNfs7k=";
+    rev = "bebe2b13a840fbfd45cb501f5cd0efe01bdb1735";
+    hash = "sha256-z30s5uYhqBht7ZviljAu5WZlOCTS9sYqWBD2/hbWUbs=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/emulators/libretro/cores/beetle-supafaust.nix b/pkgs/applications/emulators/libretro/cores/beetle-supafaust.nix
index 836b2f1dca2c..0e713e6f46da 100644
--- a/pkgs/applications/emulators/libretro/cores/beetle-supafaust.nix
+++ b/pkgs/applications/emulators/libretro/cores/beetle-supafaust.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-supafaust";
-  version = "0-unstable-2026-07-22";
+  version = "0-unstable-2026-08-23";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "supafaust";
-    rev = "d6187e5337e6c2646d003db3ab1936727ca75301";
-    hash = "sha256-r9sZGTpJo+jiEDZnzSgcwzBerI4BHL2p/WvJQpdW31g=";
+    rev = "642d1d1b6684aa7e306a02a89885f3f5456a5157";
+    hash = "sha256-malpQAapdRY/V4y2Csm36+Bo1WCRcAWnx4C4okC5S4k=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 44cb50762d66..6e0825105bbd 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1400,11 +1400,11 @@
     "vendorHash": "sha256-kM5itT82W2uy/y5uJkZsMH308LjRMSNKBJC09e5k5+8="
   },
   "turbot_turbot": {
-    "hash": "sha256-sJODPeFzU3vaiHbKlGe1dR5Pi7aS56JcmZUe8Yg1BcQ=",
+    "hash": "sha256-Az+eTY+eksfH89DGqTd8RVwD8KDztz6Bctm0Mt7GBN4=",
     "homepage": "https://registry.terraform.io/providers/turbot/turbot",
     "owner": "turbot",
     "repo": "terraform-provider-turbot",
-    "rev": "v1.13.3",
+    "rev": "v1.14.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
diff --git a/pkgs/by-name/ad/adhammer/package.nix b/pkgs/by-name/ad/adhammer/package.nix
new file mode 100644
index 000000000000..a7d137916a74
--- /dev/null
+++ b/pkgs/by-name/ad/adhammer/package.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  fetchFromGitHub,
+  nix-update-script,
+  openssl,
+  pkg-config,
+  rustPlatform,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "adhammer";
+  version = "1.3.10";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "icedracon";
+    repo = "adhammer";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-QQjiyvj3e5unEsh17UyKck2rs8oKeLO5eodBG7cn1LQ=";
+  };
+
+  cargoHash = "sha256-Ebkvxl/JyiZ84ucv7FmOluHTqYd14I3B6z53QNmVQZw=";
+
+  nativeBuildInputs = [
+    pkg-config
+    rustPlatform.bindgenHook
+  ];
+
+  buildInputs = [ openssl ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Active Directory security-assessment toolkit";
+    homepage = "https://github.com/icedracon/adhammer";
+    changelog = "https://github.com/icedracon/adhammer/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "adhammer";
+  };
+})
diff --git a/pkgs/by-name/ar/art/package.nix b/pkgs/by-name/ar/art/package.nix
index 87f4cbc96fc9..8afeb8325884 100644
--- a/pkgs/by-name/ar/art/package.nix
+++ b/pkgs/by-name/ar/art/package.nix
@@ -39,13 +39,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "art";
-  version = "1.26.7";
+  version = "1.26.8";
 
   src = fetchFromGitHub {
     owner = "artraweditor";
     repo = "ART";
     tag = finalAttrs.version;
-    hash = "sha256-HuXDdrfb3r8B5u4Ifvb3EfbF/b1mMbDAunOIBtEaKtk=";
+    hash = "sha256-kgDmGxdmKK/19vxruTQ0845iaRSWthlkYoeAFVaju2U=";
   };
 
   # Fix the build with CMake 4.
diff --git a/pkgs/by-name/ba/baidupcs-go/package.nix b/pkgs/by-name/ba/baidupcs-go/package.nix
index 1a96bac0c207..5633933f6a1b 100644
--- a/pkgs/by-name/ba/baidupcs-go/package.nix
+++ b/pkgs/by-name/ba/baidupcs-go/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "baidupcs-go";
-  version = "4.0.1";
+  version = "4.0.2";
 
   src = fetchFromGitHub {
     owner = "qjfoidnh";
     repo = "BaiduPCS-Go";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-AvwdAOjuQxdmhg+IJxQ9e9iMXqveLjoF/W7ntZZmES4=";
+    hash = "sha256-o0Oh6zLJT25+smEgWy7E8fTigJ2FLpBXoaZSYCRFvic=";
   };
 
-  vendorHash = "sha256-oOZeBCHpAasi9K77xA+8HxZErGWKwb4OaWzWhHagtQE=";
+  vendorHash = "sha256-3kvB5QxtWuElhDIFFr3Awf5myf6l2Hx0M2k53ltQYeQ=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/cf/cfitsio/package.nix b/pkgs/by-name/cf/cfitsio/package.nix
index 8fa03db0bf78..2499a2c4159c 100644
--- a/pkgs/by-name/cf/cfitsio/package.nix
+++ b/pkgs/by-name/cf/cfitsio/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cfitsio";
-  version = "4.6.4";
+  version = "4.7.0";
 
   src = fetchFromGitHub {
     owner = "HEASARC";
     repo = "cfitsio";
     tag = "cfitsio-${finalAttrs.version}";
-    hash = "sha256-8AFPTr8j8f+x1h78IXOV8GHkDPWvI8w8aRxyke3Dras=";
+    hash = "sha256-k05ylMYf+hsYur3BgNAweMeDc89rsBBtie+P7bd+7qg=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/cl/cloudflared/package.nix b/pkgs/by-name/cl/cloudflared/package.nix
index 76bcdc037604..e9dc4f04a16d 100644
--- a/pkgs/by-name/cl/cloudflared/package.nix
+++ b/pkgs/by-name/cl/cloudflared/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "cloudflared";
-  version = "2026.7.3";
+  version = "2026.8.2";
 
   src = fetchFromGitHub {
     owner = "cloudflare";
     repo = "cloudflared";
     tag = finalAttrs.version;
-    hash = "sha256-hIDx9Nd7CKlM0vCKqkVHxBMj4QzvnnsYYMjhzOqcECU=";
+    hash = "sha256-6pepcjGOLbG+lJ/sGCU8tJVW4nVq7/xGkZ7lLz3KHRQ=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/co/corrode-scanner/package.nix b/pkgs/by-name/co/corrode-scanner/package.nix
new file mode 100644
index 000000000000..484b944fef1a
--- /dev/null
+++ b/pkgs/by-name/co/corrode-scanner/package.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "corrode-scanner";
+  version = "0.5.1";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "ul0gic";
+    repo = "corrode";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-cxmX0UOEI78P9K4glTh7B2b+/Uc5pHY961RamarvZm0=";
+  };
+
+  cargoHash = "sha256-f+gwucHpQu5IJqll/DmGYkNwu/5a2esl9URpwj7c3Pc=";
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Security scanner for finding exposed credentials, secrets, and vulnerabilities";
+    homepage = "https://github.com/ul0gic/corrode";
+    changelog = "https://github.com/ul0gic/corrode/releases/tag/${finalAttrs.src.tag}";
+    license = with lib.licenses; [
+      asl20
+      mit
+    ];
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "corrode-scanner";
+  };
+})
diff --git a/pkgs/by-name/cu/cubelify/package.nix b/pkgs/by-name/cu/cubelify/package.nix
index 40ffb90e59ca..f831ee00ebdf 100644
--- a/pkgs/by-name/cu/cubelify/package.nix
+++ b/pkgs/by-name/cu/cubelify/package.nix
@@ -6,11 +6,11 @@
 }:
 appimageTools.wrapType2 rec {
   pname = "cubelify";
-  version = "1.25.13";
+  version = "1.25.14";
 
   src = fetchurl {
     url = "https://storage.cubelify.com/overlay/v1/Cubelify%20Overlay-${version}.AppImage";
-    hash = "sha512-1gNMoaEdh5qAySgRl9rjrFPLFpdTt6YxMaYdry4AJpQhNYxv45M1pq7D5HqJ4xgZHQZxfERPo+Wvfzk1rwaWog==";
+    hash = "sha512-R2J1u+XAeOwNe6lzsntXzIU0wk7UEXa4QBncpMnc3qgp/uYzaV+rBbk5+NyL+GBjLEVPkUDoMjoL2K2iCZpdYw==";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/da/dapr-cli/package.nix b/pkgs/by-name/da/dapr-cli/package.nix
index b174557a716a..a3d2a0760ed0 100644
--- a/pkgs/by-name/da/dapr-cli/package.nix
+++ b/pkgs/by-name/da/dapr-cli/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "dapr-cli";
-  version = "1.18.1";
+  version = "1.18.2";
 
   src = fetchFromGitHub {
     owner = "dapr";
     repo = "cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-lMHuXf4v4xcCcvTqVVXwszMjQ/C3P80J1hXh4Py/jls=";
+    hash = "sha256-A21Fk5WzlyMcHG2wpPQVChwkDdcCrDx3zhzl0KZLBS0=";
   };
 
   vendorHash = "sha256-P7zrfUcb/Hxo7QbIQfq9JSf2d7meZShQ++GG8HkEoLE=";
diff --git a/pkgs/by-name/de/decker/package.nix b/pkgs/by-name/de/decker/package.nix
index 59aeddfe8e62..d90c9c6607db 100644
--- a/pkgs/by-name/de/decker/package.nix
+++ b/pkgs/by-name/de/decker/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "decker";
-  version = "1.69";
+  version = "1.70";
 
   src = fetchFromGitHub {
     owner = "JohnEarnest";
     repo = "Decker";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-N1g+jaINbUZcTazvgfBc3G0QD4fevJMINRGL9Lp27us=";
+    hash = "sha256-QVv5kLwQZojTCUgnGTX2r622YOoYzIDjrWbj8mkFubE=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/dr/dracula-theme/package.nix b/pkgs/by-name/dr/dracula-theme/package.nix
index b3266ada4dc5..0ca9cedd91f0 100644
--- a/pkgs/by-name/dr/dracula-theme/package.nix
+++ b/pkgs/by-name/dr/dracula-theme/package.nix
@@ -10,7 +10,7 @@ let
 in
 stdenvNoCC.mkDerivation {
   pname = "dracula-theme";
-  version = "4.0.0-unstable-2026-03-01";
+  version = "4.0.0-unstable-2026-05-21";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -18,8 +18,8 @@ stdenvNoCC.mkDerivation {
   src = fetchFromGitHub {
     owner = "dracula";
     repo = "gtk";
-    rev = "1188c8eabdfc33c42738862b91caf7fab884c767";
-    hash = "sha256-Z3dMgkk5SvpCWjxdm8hd5FBeEvq0uCJuj3zC5boQEdk=";
+    rev = "81d0287950e8093dd8f8c753347763bce8588465";
+    hash = "sha256-gbotOIGG55oqQZZNDkc9s5fPXvJQr+YHqxt5ZWS5bF8=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/et/etlegacy-assets/package.nix b/pkgs/by-name/et/etlegacy-assets/package.nix
index d0259a237b2d..67b16e00ca79 100644
--- a/pkgs/by-name/et/etlegacy-assets/package.nix
+++ b/pkgs/by-name/et/etlegacy-assets/package.nix
@@ -6,7 +6,7 @@
 
 stdenv.mkDerivation {
   pname = "etlegacy-assets";
-  version = "2.83.2";
+  version = "2.85.0";
 
   srcs =
     let
diff --git a/pkgs/by-name/et/etlegacy-unwrapped/package.nix b/pkgs/by-name/et/etlegacy-unwrapped/package.nix
index 25b878fa6369..81c0bd7aeaad 100644
--- a/pkgs/by-name/et/etlegacy-unwrapped/package.nix
+++ b/pkgs/by-name/et/etlegacy-unwrapped/package.nix
@@ -22,7 +22,7 @@
   versionCheckHook,
 }:
 let
-  version = "2.84.0";
+  version = "2.85.0";
   fakeGit = writeScriptBin "git" ''
     if [ "$1" = "describe" ]; then
       echo "${version}"
@@ -49,7 +49,7 @@ stdenv.mkDerivation {
     owner = "etlegacy";
     repo = "etlegacy";
     tag = "v${version}";
-    hash = "sha256-E1eR0OIfXn2QkSGYNu1JFXDIVrkz+pxM7IU0GVkvAFQ=";
+    hash = "sha256-oOgoM5BLBnmrmbdXFGYkVcQLYq8tVpLgnzJXax7g3vI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/et/etlegacy/package.nix b/pkgs/by-name/et/etlegacy/package.nix
index 28d3f0aff364..e4f3daf27a00 100644
--- a/pkgs/by-name/et/etlegacy/package.nix
+++ b/pkgs/by-name/et/etlegacy/package.nix
@@ -20,7 +20,7 @@ let
 in
 symlinkJoin {
   pname = "etlegacy";
-  version = "2.84.0";
+  version = "2.85.0";
 
   paths = [
     etlegacy-assets
diff --git a/pkgs/by-name/fl/flux9s/package.nix b/pkgs/by-name/fl/flux9s/package.nix
index 508c542d780d..746e20eaf876 100644
--- a/pkgs/by-name/fl/flux9s/package.nix
+++ b/pkgs/by-name/fl/flux9s/package.nix
@@ -9,17 +9,17 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "flux9s";
-  version = "1.0.2";
+  version = "1.0.3";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "dgunzy";
     repo = "flux9s";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4D5gR4d6+typ7W9OYAsETO9q3tnfP0PweuxZSlXWQyI=";
+    hash = "sha256-9xk46wwQUegUJJWOLG3EkeTgHQ4qfhGISqcDUcsdBos=";
   };
 
-  cargoHash = "sha256-Z3vhRCvlfzLxYw/fWri0eil6+H+gPHHA8tMxPqSU7ok=";
+  cargoHash = "sha256-VXWg6NrKNFRPwK6A3ttrwUSzLx3BjMDthtRwLX9Zrsg=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/gi/gitify/package.nix b/pkgs/by-name/gi/gitify/package.nix
index 1725c5bd322a..de3018b5f38d 100644
--- a/pkgs/by-name/gi/gitify/package.nix
+++ b/pkgs/by-name/gi/gitify/package.nix
@@ -20,13 +20,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gitify";
-  version = "7.3.3";
+  version = "7.5.0";
 
   src = fetchFromGitHub {
     owner = "gitify-app";
     repo = "gitify";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Kr4+U6UD/cfbAzIZ8GrPgxGmV8ktENxd9o2/x3C4v+c=";
+    hash = "sha256-ogF9YrnSaT31AnoxtvA0jnK5wHhlAvIj3T+TaKZM80U=";
   };
 
   nativeBuildInputs = [
@@ -46,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 4;
-    hash = "sha256-Uxta96e9t0jOfsgR82fMuzc1V5KC0t1n2TJ90qv73wg=";
+    hash = "sha256-aG34cZF1xwPM5L/+OXUgOmJwLGcpNU59aobVSmTIvLw=";
   };
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = 1;
diff --git a/pkgs/by-name/go/goshs/package.nix b/pkgs/by-name/go/goshs/package.nix
index 1d62b8a352dc..a34eb5e38b90 100644
--- a/pkgs/by-name/go/goshs/package.nix
+++ b/pkgs/by-name/go/goshs/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "goshs";
-  version = "2.1.5";
+  version = "2.1.6";
 
   src = fetchFromGitHub {
     owner = "goshs-labs";
     repo = "goshs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mVgBY1QhQ+tDQnfangqylNeCbBJTSJaM0y7vZ95BU3Y=";
+    hash = "sha256-0d4iB6Mtann0OZd/KyWnwq7+fCcWEibAzHSYe30Mce0=";
   };
 
-  vendorHash = "sha256-LLYgb0DIFx97+ZXOlQc4yVdjjiw7ebXx76hADfWnlkw=";
+  vendorHash = "sha256-E+GZn7Trnz3KqzTsEfavWxP1dhsGPx4PyYYae8wjCb4=";
 
   patches = [
     # No upstream fix yet; remove when updating to a release that uses goldmark 1.7.17 or later.
diff --git a/pkgs/by-name/he/hedgedoc/missing-hashes.json b/pkgs/by-name/he/hedgedoc/missing-hashes.json
index 359be9190056..c744913aff57 100644
--- a/pkgs/by-name/he/hedgedoc/missing-hashes.json
+++ b/pkgs/by-name/he/hedgedoc/missing-hashes.json
@@ -1,28 +1,28 @@
 {
-  "@esbuild/aix-ppc64@npm:0.28.1": "98a9325bec976ebe1cbbf2441fdbe895b36733919b9df7d62e7b73a1e199810affeac17d172cc5cf61196c9b1ede8073ca5d088ca52b14800b76f49bacc480b3",
-  "@esbuild/android-arm64@npm:0.28.1": "ec3e3c62bc684a09393ca10a0f64b166938f66e4b1972f6db63bf55463bf039736549d9808e50996eb0fedea70744b466aeb816c44e78f2b5d232aeb9929e3ac",
-  "@esbuild/android-arm@npm:0.28.1": "cda56884826ac2aa5dd3be5df9e89834df3b46515cf14099ddfc5bcfc80122d4f8d74b3831a0ac447d87dda73ae90fba49dc4e352b11240c2b055cdca69a0a02",
-  "@esbuild/android-x64@npm:0.28.1": "7f2ba14ba06fd3f2faff467e6fceb2466cd44d1d6039ae1c01f24336a5a1ad0f9c3721000331ded3f250587e4be5e7194d68dd33c55339dc26e1200e13e16d2d",
-  "@esbuild/darwin-arm64@npm:0.28.1": "9798bd013921f8dc5126eb12eba4ddfce9198d11eba6ae844f66d25919d5d26be2aa46b4da8d442ad0e7673e88b2f3d9e505d71692cd030bda9a7b762921c05d",
-  "@esbuild/darwin-x64@npm:0.28.1": "aaddefac25e025e309c71dc5c7074d8c295f44779e41add06dbf65d48b2a6a72b579266748e7f0ab3b2be1ed07be8d541e954f75dda2a2992f36f4c805d91fe1",
-  "@esbuild/freebsd-arm64@npm:0.28.1": "a325b7833f978b62bf25157ea5a951e29b9b0a1db9665ee52498644c9b250977ab6f21c049137d0a271bb0442b3e6d6148c257bace84476196b46570ce837d62",
-  "@esbuild/freebsd-x64@npm:0.28.1": "f092ddacd0bc715f443b62382dd8ba8f85d272f62caa47f603e85b9c5b14fef67c610523006ca88cae19e2829fe41a2a0ae92b7c158ef1038c714552dea57554",
-  "@esbuild/linux-arm64@npm:0.28.1": "bfda225d3101bb3ed5a74f979d50564a17ccf3799ad65fb968c5b15c9ceb9077c105a9bb5763d42f33f1917ac709e5779cd2112e5420188963568e80ac8439f8",
-  "@esbuild/linux-arm@npm:0.28.1": "b440cf89adf6dd1079bcf7d9aa915f70f467002bbb69bda21f4a3d160c9ae93bc6d8eb73b2831c8607fb1527d8ada288d907440e36969cb60000e4df85b7c549",
-  "@esbuild/linux-ia32@npm:0.28.1": "4329d81cf06331e537c8ebb571a9d4ca968811bee7c7cb4f975b8343c9f7649a8b2b9902b0974be0e2224656b1a0d21f3b191304db8cec52d006b80061faf4c2",
-  "@esbuild/linux-loong64@npm:0.28.1": "76b4d0f2cf716576181065e3fd2d6ffa9b0d0c39987e8d3d1b8d1e8aaa2563779cd4f861c881e3e7a9302f2d03d5543b8f726a99603e6aa754c8154772d0f434",
-  "@esbuild/linux-mips64el@npm:0.28.1": "59825a73d04187818c6fb53b22e2915a4c0e6c8fee9017d75dcafbdc66699f2765377faf801495d69952230935557f58360481a7edd78073816270aa8bd0cbee",
-  "@esbuild/linux-ppc64@npm:0.28.1": "3186d54b33d9b4849d6fe4fa2aeed4966a4117f9a27bf2d59f07f3ea651a9724a2eb9aaaf98813aac6dc726710a337bfc2472dd714262894fabf498a369fbd74",
-  "@esbuild/linux-riscv64@npm:0.28.1": "f01572cf6398b466d44bfa68dbc5f56a37b74e645673198f7ba157d215ccba35ea46e220a2526008d5679cef47a4368dd46480d4ba4c7330a491d215fe3f649f",
-  "@esbuild/linux-s390x@npm:0.28.1": "aad20d457c0441d7bf2f6c8dbe74297d4c3a3c90cf709a971a4a19b2c70497bf91ac4a80fa6168ccf6063eb284ea0f41f2293283e8351348369af551ffe6f3cf",
-  "@esbuild/linux-x64@npm:0.28.1": "d361ac73388af397803dc26242265c8f00fce91d9dd587b04d230c686294585c541f43dee706e23f8d56754e3a3da653b00b3f55855182d60deabc024acf19f7",
-  "@esbuild/netbsd-arm64@npm:0.28.1": "73e2d620958bcb61367849046397dee40dbd9bd6d0d4172bb87ef90ad644ed16e48386debd1ef0323648358fc617c0d8fae58be984774a2e8622712c7ab7f04b",
-  "@esbuild/netbsd-x64@npm:0.28.1": "663a35913d3d3a2f566d31ec00477954cc570f386d56a5ffffa1d7bb58bccfbe241780fc429c2e41463cef5d1d422ca02fe174df970932b46d225ff0bd333b65",
-  "@esbuild/openbsd-arm64@npm:0.28.1": "8add19644eca9a23cefc2a109644df802c626cc3460adef6f030ce72d1fcb127a4ff2b14a21cb51bbd68ec5a652f0bd7105c1a0d76a30f44fbf822c010096cd9",
-  "@esbuild/openbsd-x64@npm:0.28.1": "ad12be1ed38cc61410aa6210f88b8aa8dc3e6ee717dce32dba6e7cbaa57414af6e5314e7cdf9baa4affafe2d6a88e230d361a0ddadf76d06070b63bbf0a97cb2",
-  "@esbuild/openharmony-arm64@npm:0.28.1": "5ecd637058887c8458ebc7e95c67adee2397ebd8e5f6c302c17816eeb77963b1feeaff4e3f7823c0d85f0fc10771caa96175e2f0909b00e60ca5d90d22690a15",
-  "@esbuild/sunos-x64@npm:0.28.1": "e3286191315e30471e9cc176281a5d7acf5b877a95ea2868195024548a984e08b0214ea90e504e5bb5c595f9d3da9a5b961b52f79988702036b59233378580c4",
-  "@esbuild/win32-arm64@npm:0.28.1": "55e83fa2b63511bc3d2138ff84091b452936072b5b8e24405a5669f04355263b3f452861c13fc0c01ad80ebeb0df069da0318631386c9d66cda8ccbeca0fa82e",
-  "@esbuild/win32-ia32@npm:0.28.1": "dcd2579f97b8b5217e807d3a069461635ff6c1f13bc6e678fb0e385db4bf569afbbfe9f54ee512f0e120c6cc2689889725b8e2efdb17e3bb1603cffb58a4b6b3",
-  "@esbuild/win32-x64@npm:0.28.1": "1d7e7661663e2b0d814550e461fd06b814b3ac1ffda1e84468da3b7c29a1ad8a6067a8b7dcf6e66e38918b43a440c6302052f1bdb40c48a6d49a82c616e12f2d"
+  "@esbuild/aix-ppc64@npm:0.28.2": "18ffc469b906f4639372614d41def04925cfccf6726818f1afd2d3eb5f062f1cd54500f5ad5d0f47dcbc913a4898745f5faf7deed71e199724610481c8b7d661",
+  "@esbuild/android-arm64@npm:0.28.2": "8b33309c4a4eff21f119098df601dde2d2b124f80e60680140c2f07157ae7d43f03a954563b823d1381edeca73fce8cfba01a22b9451cb15b24ff20a19731a6d",
+  "@esbuild/android-arm@npm:0.28.2": "e36e4134a04a1a753a24174f732b87d8288edc09e566f32d5ed1b03a0d703991c0286f006dd95de1ee29542b57558a47cbfdd9f46f26b5f3620a3ff099c67e00",
+  "@esbuild/android-x64@npm:0.28.2": "ec47bb2fb9e3a3c5b31c82511eb1a1141aa2747bef617977b7f50076bece97a61ae7de8a67b082fc88adb25cb34aa70567497306a19e6f93dc3d593961771683",
+  "@esbuild/darwin-arm64@npm:0.28.2": "1dc2f3613b0394d465db5999ab69ca7d2f5a7454e2d811735e5b34b7da7f1580d74aea6befd4501bef46eb28d68ff09741a500a352e2bd263d03c4962b04da7c",
+  "@esbuild/darwin-x64@npm:0.28.2": "7a83f9fe251dfd96a03d9a88b6b1278350b9f93c23c3cac6085ef70821932c941784794557c8e53343ced33a328e74a1a67f5e108f97f508fe266dfabbea6d5c",
+  "@esbuild/freebsd-arm64@npm:0.28.2": "685a5bb96c8ae53ab47fb829148ae44ca88d7f2414df3c85f0ec6d5f2146a389e96f4e7601fec1395303b7d0e14d8cdc08aaceeb4bf87c6528cb52a001e1ebcb",
+  "@esbuild/freebsd-x64@npm:0.28.2": "4c6515cda584dc87c40bb52403e8bdb64ff4e70988e552bcbbf0ea63db46271639b320c0edbceda6a31acf0160f58f3644aa11a8a61db3a04ca00b77c773fba5",
+  "@esbuild/linux-arm64@npm:0.28.2": "5a27e1ede494c2fdb049f9173d647fe7f987379e20f59014b069dfeed536bf72d0d596552a2c99e8781d9ae99557023f5b7613fba44b50ef1e06d4ea93f47751",
+  "@esbuild/linux-arm@npm:0.28.2": "b129de26545ee3e31934101b24b5d5c574d7da62acd580dfce81676978b5c779d815af7f24f60c1dacadff94d592a5ecee59e74b0c985a43db0bd0d590b5c48c",
+  "@esbuild/linux-ia32@npm:0.28.2": "c8c7ac9bd8e7162b8bac9f49dc695245356eeaca5b8327a8fd30f7ff323f59abad3286cf5fb5e7df00f58cdb2fca90f2f56c92fe03f2d27e43d7e24e602903a7",
+  "@esbuild/linux-loong64@npm:0.28.2": "2ea7ab75e2ba2e47e914eae905e6355a908629aeb15d090e53d4a2f7203eca06eeec60d82d0803e0e5c4c844d5b40b4190cefc3e3098ff2265db2e2f3158b24f",
+  "@esbuild/linux-mips64el@npm:0.28.2": "6977e4ea84b6e8736ce7f3dffd4154c04bc12b581f86655656a9969a08645eeb38836e90f2873baab085449548df0e3a276943d860f31fa65d018133f816b5f5",
+  "@esbuild/linux-ppc64@npm:0.28.2": "4f7215f686c425d0eeab1e8d76156a6640f3a6ea3bdc1c07777012618d1dd44c51f2260dfd83f37c36ba4c6df2053dc11f013806b7ac862d23799180103da8be",
+  "@esbuild/linux-riscv64@npm:0.28.2": "4035119fd362aa46652298da5ad659c33322e24ba6183d0b46bd411ef74689286539c4395f41c8ff994e555e88fd2f77e0ea4e518348d8f6dcd42697bb323c17",
+  "@esbuild/linux-s390x@npm:0.28.2": "cbc618cbd9aacd5648239c5f0625d156cb08e9097e6cb527365aee23504eb4883539268d34b6a40a2c3736146b8ae0b513616bc6f9a18e2312935a5eb373d901",
+  "@esbuild/linux-x64@npm:0.28.2": "87a9da362e944ac296cb9e7082aa8c34357e5274b986d0c2eaa2056b7dde43d93a72d249f93a696059630c81bf3a1a285981419fe25619656bf05466f91c61a4",
+  "@esbuild/netbsd-arm64@npm:0.28.2": "ddda9f430a486bb80e2eabe92642446a759573125fe2444a68e73a4c4da2e7f595d5948009ad4aca06c604ad65840001ee11e5192c626b5494cc14e69485dbe6",
+  "@esbuild/netbsd-x64@npm:0.28.2": "57789330e50f7c37dc0732958e8ce95d99961c4e667bf4513cd0957f0561ca015081926e6e9d8d0730961a4bdaf81516f5aaeee48fc2b74ed053ea2641598714",
+  "@esbuild/openbsd-arm64@npm:0.28.2": "5616d7b13e2a81a65e723553d23404b40c7e323c816bf6ad2176f4f0977dc6f4a329b90b42be6286e80efaa565b4d6f45d081d3f3bbd96e5024c110c321ac7d3",
+  "@esbuild/openbsd-x64@npm:0.28.2": "bc889ffd7784145b09624eea6ab781af08b439d627653668f6cca49101c5108a1b604f2c3fbfcc5278a5e22eba21b30685e9f0f98180265e7b511d27fb7a9b67",
+  "@esbuild/openharmony-arm64@npm:0.28.2": "0b879a2605598deb49cd0161b4e8f7bf3f7860fbda1c429d2f1dd4847e0afa441f40b74ef09131165477c053051682f2cb6b654077b7e8b374f8fc1a309bd5f1",
+  "@esbuild/sunos-x64@npm:0.28.2": "efc7fde222fe2eec0ced86cc10796df6a11268229073b3e6395482dd016b04aac701734ab59f927929e5e26c5316f6acecc152e1ac4dbb0228a0fe70fc8a5dd9",
+  "@esbuild/win32-arm64@npm:0.28.2": "a7d1d272c9ecaf0d7aec021ed2c4f9f31b93e276f482fa917c7fbab1e1c1420e57dcd72db841bc1e5131f7f7d98a0e3d96ee3d05b244b973b1b0c59bfec24af6",
+  "@esbuild/win32-ia32@npm:0.28.2": "462cfb1e452a5ec70b74713758557f504ed62ad2b4318eae690e9c59c02f57dc25dcafee7784b67f9c38c03f52d7db827176a2caa3a7ea94cd5f2023f7540b94",
+  "@esbuild/win32-x64@npm:0.28.2": "c97fb5efdc1f3b861338115db13576bc7135b76528a8e554604ada34d5016eebad951cce7db96620b17c39d55ac29d64211aba25a043c36202379dbc8e41f704"
 }
diff --git a/pkgs/by-name/he/hedgedoc/package.nix b/pkgs/by-name/he/hedgedoc/package.nix
index 89c8db8952ff..a0173a2f6fa9 100644
--- a/pkgs/by-name/he/hedgedoc/package.nix
+++ b/pkgs/by-name/he/hedgedoc/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hedgedoc";
-  version = "1.11.1";
+  version = "1.12.0";
 
   src = fetchFromGitHub {
     owner = "hedgedoc";
     repo = "hedgedoc";
     tag = finalAttrs.version;
-    hash = "sha256-Xvz2kU1+DVp+BRa4zHM9e/xHjy41br7gZtBOpoaun0o=";
+    hash = "sha256-QYWDgQuSsMf8xElSK0MpthOMAB6EJXcxfOWcHrR4ODU=";
   };
 
   patches = [
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   offlineCache = yarn-berry_4.fetchYarnBerryDeps {
     inherit (finalAttrs) src missingHashes patches;
-    hash = "sha256-SkUWghEBq8WyKuSDyM7OZBVSyXxqKpxIaoFMsaY10A4=";
+    hash = "sha256-2qwTV9GRKnVIhK6dsSfis+JOTfjcdwW0RVdrJZa/uJc=";
   };
 
   nativeBuildInputs = [
@@ -85,6 +85,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Realtime collaborative markdown notes on all platforms";
     license = lib.licenses.agpl3Only;
     homepage = "https://hedgedoc.org";
+    changelog = "https://github.com/hedgedoc/hedgedoc/releases/tag/${finalAttrs.src.tag}";
     mainProgram = "hedgedoc";
     maintainers = with lib.maintainers; [ SuperSandro2000 ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/ho/homepage-dashboard/package.nix b/pkgs/by-name/ho/homepage-dashboard/package.nix
index b958398961f6..c4e5bb656783 100644
--- a/pkgs/by-name/ho/homepage-dashboard/package.nix
+++ b/pkgs/by-name/ho/homepage-dashboard/package.nix
@@ -31,13 +31,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "homepage-dashboard";
-  version = "1.13.2";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "gethomepage";
     repo = "homepage";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-d6NNtaThDfVErGx7fFdqLdjx4UZXMN6CZUBpMZFZYhQ=";
+    hash = "sha256-VBrLAfAWFyvuIM54+V0YXUc77WQxRpMQ4kiC/d0BrJ4=";
   };
 
   pnpmDeps = fetchPnpmDeps {
@@ -48,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
       ;
     pnpm = pnpm_10;
     fetcherVersion = 3;
-    hash = "sha256-jAcAbi++Wbyi07YdPuIhDAeNT4fJVAIxp51boD30x3k=";
+    hash = "sha256-kv468v/5H1alTmFntl05cfgDz9zc2Tg5OMDrEXOUK/o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/in/introspectme/package.nix b/pkgs/by-name/in/introspectme/package.nix
new file mode 100644
index 000000000000..dcf617a1e2e4
--- /dev/null
+++ b/pkgs/by-name/in/introspectme/package.nix
@@ -0,0 +1,49 @@
+{
+  lib,
+  fetchFromGitHub,
+  nix-update-script,
+  openssl,
+  pkg-config,
+  rustPlatform,
+  zstd,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "introspectme";
+  version = "0.0.2";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "bountyyfi";
+    repo = "IntrospectMe";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-PQSfIbcY3vgJhi2OcG6wqFH6xiWcBylJhr1kWdlr0go=";
+  };
+
+  cargoHash = "sha256-UAcIwBrHuU7AbLXoSCwpT7cetioVNboG2rpDMPbnvR8=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    openssl
+    zstd
+  ];
+
+  env = {
+    ZSTD_SYS_USE_PKG_CONFIG = true;
+  };
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Tool for introspecting and analyzing GraphQL field suggestion errors";
+    homepage = "https://github.com/bountyyfi/IntrospectMe";
+    changelog = "https://github.com/bountyyfi/IntrospectMe/releases/tag/${finalAttrs.src.tag}";
+    # SOURCE-AVAILABLE LICENSE, Version 0.0.1 - Effective February 15, 2026
+    # https://github.com/bountyyfi/IntrospectMe/blob/main/LICENSE
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "introspectme";
+  };
+})
diff --git a/pkgs/by-name/ka/kanban/package.nix b/pkgs/by-name/ka/kanban/package.nix
index e2732bc08258..853533d0db2b 100644
--- a/pkgs/by-name/ka/kanban/package.nix
+++ b/pkgs/by-name/ka/kanban/package.nix
@@ -7,18 +7,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "kanban";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "fulsomenko";
     repo = "kanban";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qvjUeYNJ4ODO5dxAaWuWIIpqmFjE6t3ZeuSvZcp5xaI=";
+    hash = "sha256-HJb52Qskyqzjcjp6SlM81OSL2GtpMEYxuuYWy9yLxYQ=";
   };
 
   env.GIT_COMMIT_HASH = finalAttrs.src.rev;
 
-  cargoHash = "sha256-YO1brjDNQxt155VtxIpniAdhEvv22vQlk8CUMz2f9Qs=";
+  cargoHash = "sha256-o+C8TsE/5myoKGhSIWG+OIHliTOM5dQBY1E3a5KFcxs=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/ki/kiro-cli-unwrapped/package.nix b/pkgs/by-name/ki/kiro-cli-unwrapped/package.nix
index 2aa1f5c104a7..bc14368b8648 100644
--- a/pkgs/by-name/ki/kiro-cli-unwrapped/package.nix
+++ b/pkgs/by-name/ki/kiro-cli-unwrapped/package.nix
@@ -17,7 +17,7 @@
 # That is handled by the kiro-cli package, which wraps this one in an FHS env.
 stdenv.mkDerivation (finalAttrs: {
   pname = "kiro-cli-unwrapped";
-  version = "2.18.1";
+  version = "2.19.1";
 
   __structuredAttrs = true;
 
@@ -25,15 +25,15 @@ stdenv.mkDerivation (finalAttrs: {
     {
       x86_64-linux = fetchurl {
         url = "https://desktop-release.q.us-east-1.amazonaws.com/${finalAttrs.version}/kirocli-x86_64-linux.tar.gz";
-        hash = "sha256-AX/jbX3rTdPwOClRqOeVl/dhU3Rf91Ckj0hrQxou3Wc=";
+        hash = "sha256-sSE96keJd5fCA43vnVmc2rfkfaq/nSLopho8JaWbXdA=";
       };
       aarch64-linux = fetchurl {
         url = "https://desktop-release.q.us-east-1.amazonaws.com/${finalAttrs.version}/kirocli-aarch64-linux.tar.gz";
-        hash = "sha256-jzUKXpNi8aHLzRAA9CH23amGLZbhRnO4sfu8MZPnT6c=";
+        hash = "sha256-AuzdWswVpErj3tlYwjbXegA7bC6wwYtgZwZIeYo2htM=";
       };
       aarch64-darwin = fetchurl {
         url = "https://desktop-release.q.us-east-1.amazonaws.com/${finalAttrs.version}/Kiro%20CLI.dmg";
-        hash = "sha256-B4k+lHfI0pbrxlMZJkh3L9MFcY2kvzqXWDcY4SLEcGE=";
+        hash = "sha256-YA4geK4IcQXnQkWD9f7e2Wx0aaihi5y8gCsogJ4D5DM=";
       };
     }
     .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
diff --git a/pkgs/by-name/ma/matrix-synapse-unwrapped/plugins/s3-storage-provider.nix b/pkgs/by-name/ma/matrix-synapse-unwrapped/plugins/s3-storage-provider.nix
index 5a8519b6929a..f0108cfafbd7 100644
--- a/pkgs/by-name/ma/matrix-synapse-unwrapped/plugins/s3-storage-provider.nix
+++ b/pkgs/by-name/ma/matrix-synapse-unwrapped/plugins/s3-storage-provider.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "matrix-synapse-s3-storage-provider";
-  version = "1.6.1";
+  version = "1.7.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "matrix-org";
     repo = "synapse-s3-storage-provider";
     tag = "v${version}";
-    hash = "sha256-vRDjN9BDp7Rta/F91OVEH8FWyiwxR67PQSqBCs3bDkM=";
+    hash = "sha256-QeSzaxUQdwCiA4Mvc8ZQMFjyRFKcLRb8dQXykI5AFD4=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/ne/netbox_4_5/package.nix b/pkgs/by-name/ne/netbox_4_5/package.nix
index c0a82ee477e4..29d961f48691 100644
--- a/pkgs/by-name/ne/netbox_4_5/package.nix
+++ b/pkgs/by-name/ne/netbox_4_5/package.nix
@@ -139,6 +139,9 @@ py.pkgs.buildPythonApplication rec {
     description = "IP address management (IPAM) and data center infrastructure management (DCIM) tool";
     mainProgram = "netbox";
     license = lib.licenses.asl20;
+    knownVulnerabilities = [
+      "Netbox Version ${version} is EOL; please upgrade by following the current release notes instructions"
+    ];
     maintainers = with lib.maintainers; [
       minijackson
       transcaffeine
diff --git a/pkgs/by-name/ne/netbox_4_6/custom-static-root.patch b/pkgs/by-name/ne/netbox_4_6/custom-static-root.patch
new file mode 100644
index 000000000000..1e295fa7e65e
--- /dev/null
+++ b/pkgs/by-name/ne/netbox_4_6/custom-static-root.patch
@@ -0,0 +1,13 @@
+diff --git a/netbox/netbox/settings.py b/netbox/netbox/settings.py
+index f334a73a7..8e8d76f0e 100644
+--- a/netbox/netbox/settings.py
++++ b/netbox/netbox/settings.py
+@@ -604,7 +604,7 @@ X_FRAME_OPTIONS = 'SAMEORIGIN'
+ 
+ # Static files (CSS, JavaScript, Images)
+ # STATIC_ROOT is deliberately not a configuration parameter; static files are collected to <NETBOX_ROOT>/static.
+-STATIC_ROOT = os.path.join(NETBOX_ROOT, 'static')
++STATIC_ROOT = getattr(configuration, 'STATIC_ROOT', os.path.join(NETBOX_ROOT, 'static')).rstrip('/')
+ STATIC_URL = f'/{BASE_PATH}static/'
+ STATICFILES_DIRS = (
+     os.path.join(BASE_DIR, 'project-static', 'dist'),
diff --git a/pkgs/by-name/ne/netbox_4_6/package.nix b/pkgs/by-name/ne/netbox_4_6/package.nix
new file mode 100644
index 000000000000..73f3a1afd295
--- /dev/null
+++ b/pkgs/by-name/ne/netbox_4_6/package.nix
@@ -0,0 +1,149 @@
+{
+  lib,
+  fetchFromGitHub,
+  python3,
+  fetchpatch2,
+  plugins ? _ps: [ ],
+  nixosTests,
+  nix-update-script,
+}:
+let
+  py = python3.override {
+    self = py;
+    packageOverrides = _final: prev: { django = prev.django_6; };
+  };
+
+  extraBuildInputs = plugins py.pkgs;
+in
+py.pkgs.buildPythonApplication (finalAttrs: {
+  __structuredAttrs = true;
+
+  pname = "netbox";
+  version = "4.6.8";
+  pyproject = false;
+
+  src = fetchFromGitHub {
+    owner = "netbox-community";
+    repo = "netbox";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-fhEcQBYL5R9Tv9CpAf3Ce1oIzsXCjtH5j+dP9sD6kdg=";
+  };
+
+  patches = [
+    ./custom-static-root.patch
+    # TODO: remove before upgrading to NetBox v4.7
+    (fetchpatch2 {
+      name = "upgrade-django-tables2-v3.0.patch";
+      url = "https://github.com/netbox-community/netbox/commit/d57346d9f0eef8126eafcd5033ea43864faeaf0d.patch";
+      hash = "sha256-6/wdd8wDVT4eqDKMNx8tmoPTDvw8OE7atf9nzg3LZzk=";
+    })
+  ];
+
+  dependencies =
+    (
+      with py.pkgs;
+      [
+        colorama
+        django
+        django-cors-headers
+        django-debug-toolbar
+        django-filter
+        django-graphiql-debug-toolbar
+        django-htmx
+        django-mptt
+        django-pglocks
+        django-prometheus
+        django-redis
+        django-rq
+        django-storages
+        django-tables2
+        django-taggit
+        django-timezone-field
+        djangorestframework
+        drf-spectacular
+        drf-spectacular-sidecar
+        feedparser
+        jinja2
+        markdown
+        netaddr
+        nh3
+        pillow
+        psycopg
+        pyyaml
+        requests
+        social-auth-core
+        social-auth-app-django
+        sorl-thumbnail
+        strawberry-graphql
+        strawberry-graphql-django
+        svgwrite
+        tablib
+
+        # Optional dependencies, kept here for backward compatibility
+
+        # for the S3 data source backend
+        boto3
+        # for Git data source backend
+        dulwich
+        # for error reporting
+        sentry-sdk
+      ]
+      ++ psycopg.optional-dependencies.c
+      ++ psycopg.optional-dependencies.pool
+      ++ social-auth-core.optional-dependencies.openidconnect
+    )
+    ++ extraBuildInputs;
+
+  nativeBuildInputs = with py.pkgs; [
+    mkdocs-material
+    mkdocs-material-extensions
+    mkdocstrings
+    mkdocstrings-python
+  ];
+
+  postBuild = ''
+    PYTHONPATH=$PYTHONPATH:netbox/
+    ${py.pythonOnBuildForHost.interpreter} -m mkdocs build
+  '';
+
+  installPhase = ''
+    mkdir -p $out/opt/netbox
+    cp -r . $out/opt/netbox
+    chmod +x $out/opt/netbox/netbox/manage.py
+    makeWrapper $out/opt/netbox/netbox/manage.py $out/bin/netbox \
+      --prefix PYTHONPATH : "$PYTHONPATH"
+  '';
+
+  passthru = {
+    python = py;
+    # PYTHONPATH of all dependencies used by the package
+    pythonPath = py.pkgs.makePythonPath finalAttrs.passthru.dependencies;
+    inherit (py.pkgs) gunicorn;
+    tests = {
+      netbox = nixosTests.netbox_4_6;
+      inherit (nixosTests) netbox-upgrade;
+    };
+    updateScript = nix-update-script { };
+    plugins = lib.recurseIntoAttrs (
+      lib.makeExtensible (
+        self:
+        lib.packagesFromDirectoryRecursive {
+          inherit (py.pkgs) callPackage;
+          directory = ./plugins;
+        }
+      )
+    );
+  };
+
+  meta = {
+    homepage = "https://github.com/netbox-community/netbox";
+    changelog = "https://github.com/netbox-community/netbox/blob/${finalAttrs.src.tag}/docs/release-notes/version-${lib.versions.majorMinor finalAttrs.version}.md";
+    description = "IP address management (IPAM) and data center infrastructure management (DCIM) tool";
+    mainProgram = "netbox";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
+      minijackson
+      transcaffeine
+    ];
+  };
+})
diff --git a/pkgs/by-name/ne/netbox_4_6/plugins/netbox-attachments/package.nix b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-attachments/package.nix
new file mode 100644
index 000000000000..eff058bf72cc
--- /dev/null
+++ b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-attachments/package.nix
@@ -0,0 +1,51 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  python,
+  netbox,
+  django,
+  netaddr,
+}:
+buildPythonPackage (finalAttrs: {
+  __structuredAttrs = true;
+
+  pname = "netbox-attachments";
+  version = "11.2.3";
+  pyproject = true;
+
+  disabled = python.pythonVersion != netbox.python.pythonVersion;
+
+  src = fetchFromGitHub {
+    owner = "Kani999";
+    repo = "netbox-attachments";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-zuRwUKYywiyIm7qvOUmbxYfct+ZR+GmaQ4oxf3gMVY4=";
+  };
+
+  build-system = [ setuptools ];
+
+  nativeCheckInputs = [
+    netbox
+    django
+    netaddr
+  ];
+
+  preFixup = ''
+    export PYTHONPATH=${netbox}/opt/netbox/netbox:$PYTHONPATH
+  '';
+
+  pythonImportsCheck = [ "netbox_attachments" ];
+
+  passthru.pluginName = "netbox_attachments";
+
+  meta = {
+    description = "Plugin to manage attachments for any model";
+    homepage = "https://github.com/Kani999/netbox-attachments";
+    changelog = "https://github.com/Kani999/netbox-attachments/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ felbinger ];
+  };
+})
diff --git a/pkgs/by-name/ne/netbox_4_6/plugins/netbox-bgp/package.nix b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-bgp/package.nix
new file mode 100644
index 000000000000..0e79cf2632fb
--- /dev/null
+++ b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-bgp/package.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  netbox,
+  python,
+}:
+buildPythonPackage (finalAttrs: {
+  __structuredAttrs = true;
+
+  pname = "netbox-bgp";
+  version = "0.19.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "netbox-community";
+    repo = "netbox-bgp";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-6LZLsUPC9L9L19KeXJilJvmZYcl6YwqysGO8nFAUmcI=";
+  };
+
+  build-system = [ setuptools ];
+
+  nativeCheckInputs = [ netbox ];
+
+  preFixup = ''
+    export PYTHONPATH=${netbox}/opt/netbox/netbox:$PYTHONPATH
+  '';
+
+  dontUsePythonImportsCheck = python.pythonVersion != netbox.python.pythonVersion;
+  pythonImportsCheck = [ "netbox_bgp" ];
+
+  passthru.pluginName = "netbox_bgp";
+
+  meta = {
+    description = "NetBox plugin for BGP related objects documentation";
+    homepage = "https://github.com/netbox-community/netbox-bgp";
+    changelog = "https://github.com/netbox-community/netbox-bgp/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ felbinger ];
+  };
+})
diff --git a/pkgs/by-name/ne/netbox_4_6/plugins/netbox-config-backup/package.nix b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-config-backup/package.nix
new file mode 100644
index 000000000000..7ac13e79d45f
--- /dev/null
+++ b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-config-backup/package.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  netbox,
+  python,
+  netbox-napalm-plugin,
+  pydriller,
+}:
+buildPythonPackage (finalAttrs: {
+  __structuredAttrs = true;
+
+  pname = "netbox-config-backup";
+  version = "2.2.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "DanSheps";
+    repo = "netbox-config-backup";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-PT7/RCpB7SAinQ8McQV59b9ouqqUSoEqEj0ultL37cs=";
+  };
+
+  build-system = [ setuptools ];
+
+  pythonRemoveDeps = [ "uuid" ]; # python builtin
+
+  dependencies = [
+    netbox-napalm-plugin
+    pydriller
+  ];
+
+  nativeCheckInputs = [ netbox ];
+
+  preFixup = ''
+    export PYTHONPATH=${netbox}/opt/netbox/netbox:$PYTHONPATH
+  '';
+
+  dontUsePythonImportsCheck = python.pythonVersion != netbox.python.pythonVersion;
+  pythonImportsCheck = [ "netbox_config_backup" ];
+
+  passthru.pluginName = "netbox_config_backup";
+
+  meta = {
+    description = "NetBox plugin for configuration backups using napalm";
+    homepage = "https://github.com/DanSheps/netbox-config-backup";
+    changelog = "https://github.com/DanSheps/netbox-config-backup/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ felbinger ];
+  };
+})
diff --git a/pkgs/by-name/ne/netbox_4_6/plugins/netbox-contextmenus/package.nix b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-contextmenus/package.nix
new file mode 100644
index 000000000000..8fb8565f6e3d
--- /dev/null
+++ b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-contextmenus/package.nix
@@ -0,0 +1,34 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+}:
+buildPythonPackage (finalAttrs: {
+  __structuredAttrs = true;
+
+  pname = "netbox-contextmenus";
+  version = "1.4.14";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "PieterL75";
+    repo = "netbox_contextmenus";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-YqyxZaHKXhMLDdBTAAKQsCBBSXikxBgcOvXEfa6f+0Y=";
+  };
+
+  build-system = [ setuptools ];
+
+  # pythonImportsCheck fails due to improperly configured django app
+
+  passthru.pluginName = "netbox_contextmenus";
+
+  meta = {
+    description = "Netbox plugin to add context buttons to the links, making navigating less clicky";
+    homepage = "https://github.com/PieterL75/netbox_contextmenus/";
+    changelog = "https://github.com/PieterL75/netbox_contextmenus/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ felbinger ];
+  };
+})
diff --git a/pkgs/by-name/ne/netbox_4_6/plugins/netbox-contract/package.nix b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-contract/package.nix
new file mode 100644
index 000000000000..62ab7b4be746
--- /dev/null
+++ b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-contract/package.nix
@@ -0,0 +1,57 @@
+{
+  lib,
+  buildPythonPackage,
+  python,
+  fetchFromGitHub,
+  setuptools,
+  python-dateutil,
+  drf-yasg,
+  netbox,
+  netaddr,
+}:
+buildPythonPackage (finalAttrs: {
+  __structuredAttrs = true;
+
+  pname = "netbox-contract";
+  version = "2.4.6";
+  pyproject = true;
+
+  disabled = python.pythonVersion != netbox.python.pythonVersion;
+
+  src = fetchFromGitHub {
+    owner = "mlebreuil";
+    repo = "netbox-contract";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-e8DYjU2UtlWu044e4b5eJWOA/fXDRKLl5AVtaepG0sg=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    python-dateutil
+    drf-yasg
+  ];
+
+  # running tests requires initialized django project
+  nativeCheckInputs = [
+    netbox
+    netaddr
+  ];
+
+  preFixup = ''
+    export PYTHONPATH=${netbox}/opt/netbox/netbox:$PYTHONPATH
+  '';
+
+  pythonImportsCheck = [ "netbox_contract" ];
+
+  passthru.pluginName = "netbox_contract";
+
+  meta = {
+    description = "Contract plugin for netbox";
+    homepage = "https://github.com/mlebreuil/netbox-contract";
+    changelog = "https://github.com/mlebreuil/netbox-contract/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ felbinger ];
+  };
+})
diff --git a/pkgs/by-name/ne/netbox_4_6/plugins/netbox-custom-objects/package.nix b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-custom-objects/package.nix
new file mode 100644
index 000000000000..2ecfd630ce93
--- /dev/null
+++ b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-custom-objects/package.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  netbox,
+  python,
+}:
+buildPythonPackage (finalAttrs: {
+  __structuredAttrs = true;
+
+  pname = "netbox-custom-objects";
+  version = "0.6.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "netboxlabs";
+    repo = "netbox-custom-objects";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-HnA2CJL0EOJctQpsu/G+9fULBIa8rrrYNiT0aaDw/rI=";
+  };
+
+  build-system = [ setuptools ];
+
+  nativeCheckInputs = [ netbox ];
+
+  preFixup = ''
+    export PYTHONPATH=${netbox}/opt/netbox/netbox:$PYTHONPATH
+  '';
+
+  dontUsePythonImportsCheck = python.pythonVersion != netbox.python.pythonVersion;
+  dontCheckPythonMetadata = true;
+  pythonImportsCheck = [ "netbox_custom_objects" ];
+  passthru.pluginName = "netbox_custom_objects";
+
+  meta = {
+    description = "NetBox plugin to create new object types";
+    homepage = "https://github.com/netboxlabs/netbox-custom-objects";
+    changelog = "https://github.com/netboxlabs/netbox-custom-objects/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.netboxLimitedUse;
+    maintainers = with lib.maintainers; [ felbinger ];
+  };
+})
diff --git a/pkgs/by-name/ne/netbox_4_6/plugins/netbox-data-flows/package.nix b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-data-flows/package.nix
new file mode 100644
index 000000000000..f665277196de
--- /dev/null
+++ b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-data-flows/package.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  netbox,
+  python,
+}:
+buildPythonPackage (finalAttrs: {
+  __structuredAttrs = true;
+
+  pname = "netbox-data-flows";
+  version = "1.5.3";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "Alef-Burzmali";
+    repo = "netbox-data-flows";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-LrClGEmei1IHK/mv0MkZQnEzbH4afg46W5miMLM9a0g=";
+  };
+
+  build-system = [ setuptools ];
+
+  nativeCheckInputs = [ netbox ];
+
+  preFixup = ''
+    export PYTHONPATH=${netbox}/opt/netbox/netbox:$PYTHONPATH
+  '';
+
+  dontUsePythonImportsCheck = python.pythonVersion != netbox.python.pythonVersion;
+  pythonImportsCheck = [ "netbox_data_flows" ];
+
+  passthru.pluginName = "netbox_data_flows";
+
+  meta = {
+    description = "NetBox plugin to document data flows between systems and applications";
+    homepage = "https://github.com/Alef-Burzmali/netbox-data-flows";
+    changelog = "https://github.com/Alef-Burzmali/netbox-data-flows/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ felbinger ];
+  };
+})
diff --git a/pkgs/by-name/ne/netbox_4_6/plugins/netbox-dns/package.nix b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-dns/package.nix
new file mode 100644
index 000000000000..376dd27d979e
--- /dev/null
+++ b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-dns/package.nix
@@ -0,0 +1,40 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  dnspython,
+}:
+buildPythonPackage (finalAttrs: {
+  __structuredAttrs = true;
+
+  pname = "netbox-plugin-dns";
+  version = "1.5.10";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "peteeckel";
+    repo = "netbox-plugin-dns";
+    tag = finalAttrs.version;
+    hash = "sha256-wxTW/qiwp+1CXUeCDJnllEW2oCTjlFVUot7JfWPooaw=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    dnspython
+  ];
+
+  # pythonImportsCheck fails due to improperly configured django app
+
+  passthru.pluginName = "netbox_dns";
+
+  meta = {
+    description = "Netbox plugin for managing DNS data";
+    homepage = "https://github.com/peteeckel/netbox-plugin-dns";
+    changelog = "https://github.com/peteeckel/netbox-plugin-dns/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ felbinger ];
+  };
+})
diff --git a/pkgs/by-name/ne/netbox_4_6/plugins/netbox-documents/package.nix b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-documents/package.nix
new file mode 100644
index 000000000000..c57ff4dcaaa6
--- /dev/null
+++ b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-documents/package.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  drf-extra-fields,
+  python,
+  netbox,
+}:
+buildPythonPackage (finalAttrs: {
+  __structuredAttrs = true;
+
+  pname = "netbox-documents";
+  version = "0.8.5";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "jasonyates";
+    repo = "netbox-documents";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-hupJ5gbRj/70oslEosob4gT2y2le5vOrq30t3NWl0nQ=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ drf-extra-fields ];
+
+  nativeCheckInputs = [ netbox ];
+
+  preFixup = ''
+    export PYTHONPATH=${netbox}/opt/netbox/netbox:$PYTHONPATH
+  '';
+
+  dontUsePythonImportsCheck = python.pythonVersion != netbox.python.pythonVersion;
+  pythonImportsCheck = [ "netbox_documents" ];
+
+  passthru.pluginName = "netbox_documents";
+
+  meta = {
+    description = "Plugin designed to faciliate the storage of site, circuit, device type and device specific documents within NetBox";
+    homepage = "https://github.com/jasonyates/netbox-documents";
+    changelog = "https://github.com/jasonyates/netbox-documents/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ felbinger ];
+  };
+})
diff --git a/pkgs/by-name/ne/netbox_4_6/plugins/netbox-floorplan-plugin/package.nix b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-floorplan-plugin/package.nix
new file mode 100644
index 000000000000..ee15b3fe9501
--- /dev/null
+++ b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-floorplan-plugin/package.nix
@@ -0,0 +1,51 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  netbox,
+  django,
+  netaddr,
+  python,
+}:
+buildPythonPackage (finalAttrs: {
+  __structuredAttrs = true;
+
+  pname = "netbox-floorplan-plugin";
+  version = "0.9.2";
+  pyproject = true;
+
+  disabled = python.pythonVersion != netbox.python.pythonVersion;
+
+  src = fetchFromGitHub {
+    owner = "netbox-community";
+    repo = "netbox-floorplan-plugin";
+    tag = finalAttrs.version;
+    hash = "sha256-I7cz0IONU+RESCA8C57Yxg5ieheryZ31ed9N9OxSeLA=";
+  };
+
+  build-system = [ setuptools ];
+
+  nativeCheckInputs = [
+    netbox
+    django
+    netaddr
+  ];
+
+  preFixup = ''
+    export PYTHONPATH=${netbox}/opt/netbox/netbox:$PYTHONPATH
+  '';
+
+  dontUsePythonImportsCheck = python.pythonVersion != netbox.python.pythonVersion;
+  pythonImportsCheck = [ "netbox_floorplan" ];
+
+  passthru.pluginName = "netbox_floorplan";
+
+  meta = {
+    description = "Netbox plugin providing floorplan mapping capability for locations and sites";
+    homepage = "https://github.com/netbox-community/netbox-floorplan-plugin";
+    changelog = "https://github.com/netbox-community/netbox-floorplan-plugin/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.lgpl3;
+    maintainers = with lib.maintainers; [ cobalt ];
+  };
+})
diff --git a/pkgs/by-name/ne/netbox_4_6/plugins/netbox-interface-synchronization/package.nix b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-interface-synchronization/package.nix
new file mode 100644
index 000000000000..c736e9605b24
--- /dev/null
+++ b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-interface-synchronization/package.nix
@@ -0,0 +1,65 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  setuptools,
+
+  # dependencies
+  django,
+  netaddr,
+  numpy,
+  psycopg,
+  requests,
+
+  # tests
+  netbox,
+  python,
+}:
+
+buildPythonPackage (finalAttrs: {
+  __structuredAttrs = true;
+
+  pname = "netbox-interface-synchronization";
+  version = "4.5.8";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "NetTech2001";
+    repo = "netbox-interface-synchronization";
+    tag = finalAttrs.version;
+    hash = "sha256-DZ1xOfHop/rASWbBzVILVqvll94tQM7tRiSXwOo/QQI=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    django
+    netaddr
+    requests
+    numpy
+    psycopg # not specified in pyproject.toml, but required at import time
+  ];
+
+  # netbox is required for the pythonImportsCheck; plugin does not provide unit tests
+  nativeCheckInputs = [ netbox ];
+
+  preFixup = ''
+    export PYTHONPATH=${netbox}/opt/netbox/netbox:$PYTHONPATH
+  '';
+
+  dontUsePythonImportsCheck = python.pythonVersion != netbox.python.pythonVersion;
+  pythonImportsCheck = [ "netbox_interface_synchronization" ];
+
+  passthru.pluginName = "netbox_interface_synchronization";
+
+  meta = {
+    description = "Netbox plugin to compare and synchronize interfaces between devices and device types";
+    homepage = "https://github.com/NetTech2001/netbox-interface-synchronization";
+    changelog = "https://github.com/NetTech2001/netbox-interface-synchronization/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ felbinger ];
+  };
+})
diff --git a/pkgs/by-name/ne/netbox_4_6/plugins/netbox-inventory/package.nix b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-inventory/package.nix
new file mode 100644
index 000000000000..a280e7aacd84
--- /dev/null
+++ b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-inventory/package.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  netbox,
+  python,
+}:
+buildPythonPackage (finalAttrs: {
+  __structuredAttrs = true;
+
+  pname = "netbox-inventory";
+  version = "2.6.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "ArnesSI";
+    repo = "netbox-inventory";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-NTo9WYkjY4BdE3gSkzNKxjHiWVnLQGVZQ5s8e9u3VY0=";
+  };
+
+  build-system = [ setuptools ];
+
+  nativeCheckInputs = [ netbox ];
+
+  preFixup = ''
+    export PYTHONPATH=${netbox}/opt/netbox/netbox:$PYTHONPATH
+  '';
+
+  dontUsePythonImportsCheck = python.pythonVersion != netbox.python.pythonVersion;
+  pythonImportsCheck = [ "netbox_inventory" ];
+
+  passthru.pluginName = "netbox_inventory";
+
+  meta = {
+    description = "NetBox plugin to manage hardware inventory";
+    homepage = "https://github.com/ArnesSI/netbox-inventory";
+    changelog = "https://github.com/ArnesSI/netbox-inventory/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ felbinger ];
+  };
+})
diff --git a/pkgs/by-name/ne/netbox_4_6/plugins/netbox-lifecycle/package.nix b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-lifecycle/package.nix
new file mode 100644
index 000000000000..bbfc4c2702c3
--- /dev/null
+++ b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-lifecycle/package.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  netbox,
+  python,
+  django-polymorphic,
+}:
+buildPythonPackage (finalAttrs: {
+  __structuredAttrs = true;
+
+  pname = "netbox-lifecycle";
+  version = "1.1.9";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "DanSheps";
+    repo = "netbox-lifecycle";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-iCBlwhaf6IFdni7FQyRPtRJVwt04w0Jc4R0CeQlIWCY=";
+  };
+
+  build-system = [ setuptools ];
+
+  nativeCheckInputs = [ netbox ];
+
+  preFixup = ''
+    export PYTHONPATH=${netbox}/opt/netbox/netbox:$PYTHONPATH
+  '';
+
+  dontUsePythonImportsCheck = python.pythonVersion != netbox.python.pythonVersion;
+  pythonImportsCheck = [ "netbox_lifecycle" ];
+
+  dependencies = [ django-polymorphic ];
+
+  passthru.pluginName = "netbox_lifecycle";
+
+  meta = {
+    description = "NetBox plugin for managing Hardware EOL/EOS, and Support Contracts";
+    homepage = "https://github.com/DanSheps/netbox-lifecycle";
+    changelog = "https://github.com/DanSheps/netbox-lifecycle/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ felbinger ];
+  };
+})
diff --git a/pkgs/by-name/ne/netbox_4_6/plugins/netbox-lists/package.nix b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-lists/package.nix
new file mode 100644
index 000000000000..83d38b775256
--- /dev/null
+++ b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-lists/package.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  hatchling,
+  netbox,
+  python,
+}:
+
+buildPythonPackage (finalAttrs: {
+  __structuredAttrs = true;
+
+  pname = "netbox-lists";
+  version = "4.0.4";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "devon-mar";
+    repo = "netbox-lists";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-RRUuvoeB3xfqlZr1v1zpRdmVZK9av52ZsADOh9s4toQ=";
+  };
+
+  build-system = [ hatchling ];
+
+  nativeCheckInputs = [ netbox ];
+
+  preFixup = ''
+    export PYTHONPATH=${netbox}/opt/netbox/netbox:$PYTHONPATH
+  '';
+
+  dontUsePythonImportsCheck = python.pythonVersion != netbox.python.pythonVersion;
+  pythonImportsCheck = [ "netbox_lists" ];
+
+  passthru.pluginName = "netbox_lists";
+
+  meta = {
+    description = "NetBox plugin to generate IP and prefix lists. Integrates with Ansible, Terraform, Prometheus, Oxidized and more";
+    homepage = "https://github.com/devon-mar/netbox-lists";
+    changelog = "https://github.com/devon-mar/netbox-lists/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ felbinger ];
+  };
+})
diff --git a/pkgs/by-name/ne/netbox_4_6/plugins/netbox-napalm-plugin/package.nix b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-napalm-plugin/package.nix
new file mode 100644
index 000000000000..ab2b70078627
--- /dev/null
+++ b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-napalm-plugin/package.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  netbox,
+  python,
+  napalm,
+  django,
+}:
+buildPythonPackage (finalAttrs: {
+  __structuredAttrs = true;
+
+  pname = "netbox-napalm-plugin";
+  version = "0.3.5";
+  pyproject = true;
+
+  disabled = python.pythonVersion != netbox.python.pythonVersion;
+
+  src = fetchFromGitHub {
+    owner = "netbox-community";
+    repo = "netbox-napalm-plugin";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-dtoiA6gvWL6aGBHmHTwqK8L0qRyA83GcUCGAmg9Xo8w=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ napalm ];
+
+  nativeCheckInputs = [
+    netbox
+    django
+  ];
+
+  preFixup = ''
+    export PYTHONPATH=${netbox}/opt/netbox/netbox:$PYTHONPATH
+  '';
+
+  pythonImportsCheck = [ "netbox_napalm_plugin" ];
+
+  passthru.pluginName = "netbox_napalm_plugin";
+
+  meta = {
+    description = "Netbox plugin for Napalm integration";
+    homepage = "https://github.com/netbox-community/netbox-napalm-plugin";
+    changelog = "https://github.com/netbox-community/netbox-napalm-plugin/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ felbinger ];
+  };
+})
diff --git a/pkgs/by-name/ne/netbox_4_6/plugins/netbox-plugin-prometheus-sd/package.nix b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-plugin-prometheus-sd/package.nix
new file mode 100644
index 000000000000..3480a252638c
--- /dev/null
+++ b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-plugin-prometheus-sd/package.nix
@@ -0,0 +1,55 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  poetry-core,
+
+  # dependencies
+  django,
+  netaddr,
+  netbox,
+  psycopg,
+}:
+
+buildPythonPackage (finalAttrs: {
+  __structuredAttrs = true;
+
+  pname = "netbox-plugin-prometheus-sd";
+  version = "2.0.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "FlxPeters";
+    repo = "netbox-plugin-prometheus-sd";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-/TvpRRtyCNPmAuFk+wmcJldDniHEkV1t4Vvwa9Sl5eg=";
+  };
+
+  build-system = [ poetry-core ];
+
+  dependencies = [
+    django
+    netaddr
+    psycopg # not specified in pyproject.toml, but required at import time
+  ];
+
+  nativeCheckInputs = [ netbox ];
+
+  preFixup = ''
+    export PYTHONPATH=${netbox}/opt/netbox/netbox:$PYTHONPATH
+  '';
+
+  pythonImportsCheck = [ "netbox_prometheus_sd" ];
+
+  passthru.pluginName = "netbox_prometheus_sd";
+
+  meta = {
+    description = "Netbox plugin to provide Netbox entires to Prometheus HTTP service discovery";
+    homepage = "https://github.com/FlxPeters/netbox-plugin-prometheus-sd";
+    changelog = "https://github.com/FlxPeters/netbox-plugin-prometheus-sd/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ xanderio ];
+  };
+})
diff --git a/pkgs/by-name/ne/netbox_4_6/plugins/netbox-qrcode/package.nix b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-qrcode/package.nix
new file mode 100644
index 000000000000..c43388e2513d
--- /dev/null
+++ b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-qrcode/package.nix
@@ -0,0 +1,66 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  setuptools,
+
+  # dependencies
+  pillow,
+  qrcode,
+  psycopg2,
+
+  # nativeCheckInputs
+  django,
+  netaddr,
+  netbox,
+  python,
+}:
+
+buildPythonPackage (finalAttrs: {
+  __structuredAttrs = true;
+
+  pname = "netbox-qrcode";
+  version = "0.0.21";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "netbox-community";
+    repo = "netbox-qrcode";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-A4qjpbfTULzS0UchUN9eX8jZmwoX/ej/18L/YAB8dKA=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    qrcode
+    pillow
+  ];
+
+  nativeCheckInputs = [
+    django
+    netaddr
+    netbox
+    psycopg2 # not specified in pyproject.toml, but required at import time
+  ];
+
+  preFixup = ''
+    export PYTHONPATH=${netbox}/opt/netbox/netbox:$PYTHONPATH
+  '';
+
+  dontUsePythonImportsCheck = python.pythonVersion != netbox.python.pythonVersion;
+  pythonImportsCheck = [ "netbox_qrcode" ];
+
+  passthru.pluginName = "netbox_qrcode";
+
+  meta = {
+    description = "Netbox plugin for generate QR codes for objects: Rack, Device, Cable";
+    homepage = "https://github.com/netbox-community/netbox-qrcode";
+    changelog = "https://github.com/netbox-community/netbox-qrcode/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ felbinger ];
+  };
+})
diff --git a/pkgs/by-name/ne/netbox_4_6/plugins/netbox-reorder-rack/package.nix b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-reorder-rack/package.nix
new file mode 100644
index 000000000000..a4d25dfc1fc4
--- /dev/null
+++ b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-reorder-rack/package.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  netbox,
+  python,
+}:
+buildPythonPackage (finalAttrs: {
+  __structuredAttrs = true;
+
+  pname = "netbox-reorder-rack";
+  version = "1.1.4";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "netbox-community";
+    repo = "netbox-reorder-rack";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-lWC+Br66POJe3M8L+Pt5D1pWBr9qSpRLn2TcVMXKje4=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  checkInputs = [ netbox ];
+
+  preFixup = ''
+    export PYTHONPATH=${netbox}/opt/netbox/netbox:$PYTHONPATH
+  '';
+
+  dontUsePythonImportsCheck = python.pythonVersion != netbox.python.pythonVersion;
+  pythonImportsCheck = [ "netbox_reorder_rack" ];
+
+  passthru.pluginName = "netbox_reorder_rack";
+
+  meta = {
+    description = "NetBox plugin to allow users to reorder devices within a rack using a drag and drop UI";
+    homepage = "https://github.com/netbox-community/netbox-reorder-rack";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ minijackson ];
+  };
+})
diff --git a/pkgs/by-name/ne/netbox_4_6/plugins/netbox-routing/package.nix b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-routing/package.nix
new file mode 100644
index 000000000000..76f3da9f2291
--- /dev/null
+++ b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-routing/package.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  netbox,
+  python,
+  django-polymorphic,
+}:
+buildPythonPackage (finalAttrs: {
+  __structuredAttrs = true;
+
+  pname = "netbox-routing";
+  version = "0.4.3";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "DanSheps";
+    repo = "netbox-routing";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-3biANhaAi3uRtaXnAw4i6nWnHkARkkBVqyBHLXIMOdA=";
+  };
+
+  build-system = [ setuptools ];
+
+  nativeCheckInputs = [ netbox ];
+
+  preFixup = ''
+    export PYTHONPATH=${netbox}/opt/netbox/netbox:$PYTHONPATH
+  '';
+
+  dontUsePythonImportsCheck = python.pythonVersion != netbox.python.pythonVersion;
+  pythonImportsCheck = [ "netbox_routing" ];
+
+  dependencies = [ django-polymorphic ];
+
+  passthru.pluginName = "netbox_routing";
+
+  meta = {
+    description = "NetBox plugin for tracking all kinds of routing information";
+    homepage = "https://github.com/DanSheps/netbox-routing";
+    changelog = "https://github.com/DanSheps/netbox-routing/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ benley ];
+  };
+})
diff --git a/pkgs/by-name/ne/netbox_4_6/plugins/netbox-secrets/package.nix b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-secrets/package.nix
new file mode 100644
index 000000000000..afcc328a0efe
--- /dev/null
+++ b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-secrets/package.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  netbox,
+  python,
+  pycryptodome,
+}:
+
+buildPythonPackage (finalAttrs: {
+  __structuredAttrs = true;
+
+  pname = "netbox-secrets";
+  version = "3.1.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "Onemind-Services-LLC";
+    repo = "netbox-secrets";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-XB4upeu2C2ok0jmLX47tOjrjV4b/WXCpgtlRz9+MgAs=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ pycryptodome ];
+
+  nativeCheckInputs = [ netbox ];
+
+  preFixup = ''
+    export PYTHONPATH=${netbox}/opt/netbox/netbox:$PYTHONPATH
+  '';
+
+  dontUsePythonImportsCheck = python.pythonVersion != netbox.python.pythonVersion;
+  pythonImportsCheck = [ "netbox_secrets" ];
+
+  passthru.pluginName = "netbox_secrets";
+
+  meta = {
+    description = "NetBox plugin to enhance secret management with encrypted storage and flexible, user-friendly features";
+    homepage = "https://github.com/Onemind-Services-LLC/netbox-secrets";
+    changelog = "https://github.com/Onemind-Services-LLC/netbox-secrets/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ felbinger ];
+  };
+})
diff --git a/pkgs/by-name/ne/netbox_4_6/plugins/netbox-security/package.nix b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-security/package.nix
new file mode 100644
index 000000000000..ea2c490b0c57
--- /dev/null
+++ b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-security/package.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  netbox,
+  python,
+}:
+buildPythonPackage (finalAttrs: {
+  __structuredAttrs = true;
+
+  pname = "netbox-security";
+  version = "1.5.10";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "andy-shady-org";
+    repo = "netbox-security";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-DOutzFIF/ey2o9M3sb15rmbGJyzsTXfiwC5Rqks8vxc=";
+  };
+
+  build-system = [ setuptools ];
+
+  nativeCheckInputs = [ netbox ];
+
+  preFixup = ''
+    export PYTHONPATH=${netbox}/opt/netbox/netbox:$PYTHONPATH
+  '';
+
+  dontUsePythonImportsCheck = python.pythonVersion != netbox.python.pythonVersion;
+  pythonImportsCheck = [ "netbox_security" ];
+
+  passthru.pluginName = "netbox_security";
+
+  meta = {
+    description = "NetBox plugin covering various security and NAT related models";
+    homepage = "https://github.com/andy-shady-org/netbox-security";
+    changelog = "https://github.com/andy-shady-org/netbox-security/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ felbinger ];
+  };
+})
diff --git a/pkgs/by-name/ne/netbox_4_6/plugins/netbox-topology-views/package.nix b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-topology-views/package.nix
new file mode 100644
index 000000000000..4e06008e1773
--- /dev/null
+++ b/pkgs/by-name/ne/netbox_4_6/plugins/netbox-topology-views/package.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  netbox,
+  django,
+  netaddr,
+  python,
+}:
+buildPythonPackage (finalAttrs: {
+  __structuredAttrs = true;
+
+  pname = "netbox-topology-views";
+  version = "4.5.1";
+  pyproject = true;
+
+  disabled = python.pythonVersion != netbox.python.pythonVersion;
+
+  src = fetchFromGitHub {
+    owner = "netbox-community";
+    repo = "netbox-topology-views";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-uKxIu8IPeEwBdRbtQaLWGwLnxvFyJ5FrScsU/ufyTuM=";
+  };
+
+  build-system = [ setuptools ];
+
+  nativeCheckInputs = [
+    netbox
+    django
+    netaddr
+  ];
+
+  preFixup = ''
+    export PYTHONPATH=${netbox}/opt/netbox/netbox:$PYTHONPATH
+  '';
+
+  dontUsePythonImportsCheck = python.pythonVersion != netbox.python.pythonVersion;
+  pythonImportsCheck = [ "netbox_topology_views" ];
+
+  passthru.pluginName = "netbox_topology_views";
+
+  meta = {
+    description = "Netbox plugin for generate topology views/maps from your devices";
+    homepage = "https://github.com/netbox-community/netbox-topology-views";
+    changelog = "https://github.com/netbox-community/netbox-topology-views/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ felbinger ];
+  };
+})
diff --git a/pkgs/by-name/nu/nuclei-templates/package.nix b/pkgs/by-name/nu/nuclei-templates/package.nix
index 8026cd47bd41..9571b19d466f 100644
--- a/pkgs/by-name/nu/nuclei-templates/package.nix
+++ b/pkgs/by-name/nu/nuclei-templates/package.nix
@@ -6,13 +6,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "nuclei-templates";
-  version = "10.4.7";
+  version = "10.4.8";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "nuclei-templates";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Jaa5q6I8v3BpLaBzjLhNHCUd4wB3RRNfFoUe9BArh9o=";
+    hash = "sha256-9PkgU7k+Xy9Bj7pfKjgrIpHLoso0yV8vqPbScVIYUJ0=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/oa/oauth2-proxy/package.nix b/pkgs/by-name/oa/oauth2-proxy/package.nix
index 3ca4a13be3ed..8fa1a9f8de78 100644
--- a/pkgs/by-name/oa/oauth2-proxy/package.nix
+++ b/pkgs/by-name/oa/oauth2-proxy/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "oauth2-proxy";
-  version = "7.15.3";
+  version = "7.15.4";
 
   src = fetchFromGitHub {
     repo = "oauth2-proxy";
     owner = "oauth2-proxy";
-    sha256 = "sha256-HpWmIOqyE3L0JYAQh+bd30Gr2dDpTGH8DwFJo5XwflY=";
+    sha256 = "sha256-G1luz0CjcAGMCFBzMQMA18mPh02lwQMV4CwSWDCq1gA=";
     rev = "v${version}";
   };
 
-  vendorHash = "sha256-o4JWhqLbfHmlIY1XhaupIhYLfXJNguFueH+SpAe9xaw=";
+  vendorHash = "sha256-N8S+l9Jwik3lrsAQGXNVbw6UkfmRoVovRQCWn7/X2mg=";
 
   # Taken from https://github.com/oauth2-proxy/oauth2-proxy/blob/master/Makefile
   ldflags = [ "-X github.com/oauth2-proxy/oauth2-proxy/v7/pkg/version.VERSION=v${version}" ];
diff --git a/pkgs/by-name/ot/otpclient/package.nix b/pkgs/by-name/ot/otpclient/package.nix
index 07fddaa9524f..b9752da70634 100644
--- a/pkgs/by-name/ot/otpclient/package.nix
+++ b/pkgs/by-name/ot/otpclient/package.nix
@@ -20,7 +20,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "otpclient";
-  version = "5.1.7";
+  version = "5.1.8";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "paolostivanin";
     repo = "otpclient";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-UDEsCdkIRAAtGCuXXJdse6HrIl2wiaapKUvcI0GDGWM=";
+    hash = "sha256-8I74ip2ysPa5ll1R1O9kgZEwR2wMW6oAzcE3g1SMwvA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/py/pyscan/package.nix b/pkgs/by-name/py/pyscan/package.nix
new file mode 100644
index 000000000000..7482b3eb7691
--- /dev/null
+++ b/pkgs/by-name/py/pyscan/package.nix
@@ -0,0 +1,60 @@
+{
+  lib,
+  cargo,
+  fetchFromGitHub,
+  nix-update-script,
+  openssl,
+  pkg-config,
+  python3Packages,
+  rustc,
+  rustPlatform,
+  versionCheckHook,
+}:
+
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "pyscan";
+  version = "0.1.4";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "ohaswin";
+    repo = "pyscan";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-n1mwOYntWyW7lPKPLgG7PteTRh3mly5vqbKy2R/9xnw=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-QzFUoHfvjd6ZMkKIsGXIVyks2LxdJblIiQccsOoYcJs=";
+  };
+
+  build-system = [
+    cargo
+    pkg-config
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+    rustc
+  ];
+
+  buildInputs = [ openssl ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  # Project has no test
+  doCheck = false;
+
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Python dependency vulnerability scanner";
+    homepage = "https://github.com/ohaswin/pyscan";
+    changelog = "https://github.com/ohaswin/pyscan/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "pyscan";
+  };
+})
diff --git a/pkgs/by-name/ra/raycast-beta/package.nix b/pkgs/by-name/ra/raycast-beta/package.nix
deleted file mode 100644
index 9f624a65edf6..000000000000
--- a/pkgs/by-name/ra/raycast-beta/package.nix
+++ /dev/null
@@ -1,82 +0,0 @@
-{
-  lib,
-  stdenvNoCC,
-  fetchurl,
-  writeShellApplication,
-  cacert,
-  curl,
-  openssl,
-  undmg,
-}:
-
-stdenvNoCC.mkDerivation (finalAttrs: {
-  pname = "raycast-beta";
-  version = "0.71.5.0";
-
-  __structuredAttrs = true;
-  strictDeps = true;
-
-  src =
-    {
-      aarch64-darwin = fetchurl {
-        name = "Raycast_Beta.dmg";
-        url = "https://x-r2.raycast-releases.com/Raycast_Beta_0.71.5.0_7520eff523_arm64.dmg";
-        hash = "sha256-KveiWuyeNuMGwDAeyPMqUxMzFTei23NnEOBVL5HKXMk=";
-      };
-    }
-    .${stdenvNoCC.system} or (throw "raycast-beta: ${stdenvNoCC.system} is unsupported.");
-
-  dontPatch = true;
-  dontConfigure = true;
-  dontBuild = true;
-  dontFixup = true;
-
-  nativeBuildInputs = [ undmg ];
-
-  sourceRoot = "Raycast Beta.app";
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p "$out/Applications/Raycast Beta.app"
-    cp -R . "$out/Applications/Raycast Beta.app"
-    mkdir -p "$out/bin"
-    ln -s "$out/Applications/Raycast Beta.app/Contents/MacOS/Raycast Beta" "$out/bin/raycast-beta"
-
-    runHook postInstall
-  '';
-
-  passthru.updateScript = lib.getExe (writeShellApplication {
-    name = "raycast-beta-update-script";
-    runtimeInputs = [
-      cacert
-      curl
-      openssl
-    ];
-    text = ''
-      url=$(curl --silent "https://www.raycast.com/new" | grep -o 'https://x-r2\.raycast-releases\.com/Raycast_Beta_[^"]*_arm64\.dmg' | head -n1)
-      version=$(echo "$url" | sed -E 's|.*/Raycast_Beta_([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)_[^/]+_arm64\.dmg|\1|')
-      hash="sha256-$(curl -sL "$url" | openssl dgst -sha256 -binary | openssl base64)"
-
-      sed -i -E \
-        -e 's|(version = )"[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+";|\1"'"$version"'";|' \
-        -e 's|url = "https://x-r2\.raycast-releases\.com/Raycast_Beta_[^"]*_arm64\.dmg";|url = "'"$url"'";|' \
-        -e 's|(hash = )"sha256-[A-Za-z0-9+/]+=";|\1"'"$hash"'";|' \
-        ./pkgs/by-name/ra/raycast-beta/package.nix
-    '';
-  });
-
-  meta = {
-    description = "Control your tools with a few keystrokes - beta release";
-    homepage = "https://raycast.app/new";
-    changelog = "https://www.raycast.com/changelog/macos-beta";
-    license = lib.licenses.unfree;
-    mainProgram = "raycast-beta";
-    maintainers = with lib.maintainers; [
-      _4evy
-      Br1ght0ne
-    ];
-    platforms = [ "aarch64-darwin" ];
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-  };
-})
diff --git a/pkgs/by-name/ra/raycast/package.nix b/pkgs/by-name/ra/raycast/package.nix
index 6113908e4aec..2448f1990245 100644
--- a/pkgs/by-name/ra/raycast/package.nix
+++ b/pkgs/by-name/ra/raycast/package.nix
@@ -5,19 +5,21 @@
   writeShellApplication,
   cacert,
   curl,
-  jq,
   openssl,
   undmg,
 }:
 
-stdenvNoCC.mkDerivation (finalAttrs: {
+stdenvNoCC.mkDerivation {
   pname = "raycast";
-  version = "1.104.24";
+  version = "2.0.5.0";
+
+  __structuredAttrs = true;
+  strictDeps = true;
 
   src = fetchurl {
     name = "Raycast.dmg";
-    url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=arm";
-    hash = "sha256-kn9bZYSeASKj23NYiWX76OIRXCTonAbUCATyYhPdGgo=";
+    url = "https://x-r2.raycast-releases.com/Raycast_2.0.5.0_7ecbc62a97_arm64.dmg";
+    hash = "sha256-8/EJVGTfTVqN+4U9vT84TLpo137RWnD2YtFTtYK7tH0=";
   };
 
   dontPatch = true;
@@ -32,8 +34,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out/Applications/Raycast.app
-    cp -R . $out/Applications/Raycast.app
+    mkdir -p "$out/Applications/Raycast.app"
+    cp -R . "$out/Applications/Raycast.app"
+    mkdir -p "$out/bin"
+    ln -s "$out/Applications/Raycast.app/Contents/MacOS/Raycast" "$out/bin/raycast"
 
     runHook postInstall
   '';
@@ -43,19 +47,20 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     runtimeInputs = [
       cacert
       curl
-      jq
       openssl
     ];
     text = ''
-      url=$(curl --silent "https://releases.raycast.com/releases/latest?build=universal")
-      version=$(echo "$url" | jq -r '.version')
-
-      arm_url="https://releases.raycast.com/releases/$version/download?build=arm"
-      arm_hash="sha256-$(curl -sL "$arm_url" | openssl dgst -sha256 -binary | openssl base64)"
+      download_url="https://x.raycast-releases.com/download?platform=macos&architecture=arm64"
+      url=$(curl --fail --silent --show-error --head --output /dev/null --write-out '%{redirect_url}' "$download_url")
+      filename="''${url##*/}"
+      version="''${filename#Raycast_}"
+      version="''${version%%_*}"
+      hash="sha256-$(curl --fail --silent --show-error --location "$url" | openssl dgst -sha256 -binary | openssl base64)"
 
       sed -i -E \
-        -e 's|(version = )"[0-9]+\.[0-9]+\.[0-9]+";|\1"'"$version"'";|' \
-        -e '/src = fetchurl/,/};/ s|(hash = )"sha256-[A-Za-z0-9+/]+=";|\1"'"$arm_hash"'";|' \
+        -e 's|(version = )"[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+";|\1"'"$version"'";|' \
+        -e 's|url = "https://x-r2\.raycast-releases\.com/Raycast_[^"]*_arm64\.dmg";|url = "'"$url"'";|' \
+        -e 's|(hash = )"sha256-[A-Za-z0-9+/]+=";|\1"'"$hash"'";|' \
         ./pkgs/by-name/ra/raycast/package.nix
     '';
   });
@@ -64,6 +69,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     description = "Control your tools with a few keystrokes";
     homepage = "https://raycast.app/";
     license = lib.licenses.unfree;
+    mainProgram = "raycast";
     maintainers = with lib.maintainers; [
       lovesegfault
       stepbrobd
@@ -75,4 +81,4 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     ];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
   };
-})
+}
diff --git a/pkgs/by-name/sp/spade/package.nix b/pkgs/by-name/sp/spade/package.nix
index ba08513aa2c9..118f0f6d770c 100644
--- a/pkgs/by-name/sp/spade/package.nix
+++ b/pkgs/by-name/sp/spade/package.nix
@@ -16,18 +16,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "spade";
-  version = "0.19.0";
+  version = "0.20.0";
 
   src = fetchFromGitLab {
     owner = "spade-lang";
     repo = "spade";
     rev = "v${version}";
-    hash = "sha256-HSRttrf4Dsl9iatqVr9YH4MoKPwe9XJWJYqNRchFLY0=";
+    hash = "sha256-POMt+uTSaP+XADFbAwWLxzm6FZiyoMIrDFfTtBMPIgs=";
     # only needed for vatch, which contains test data
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-koMnkwgQtVMvxlslvC5dZAhr3K/66XWyp5UPW7yZtio=";
+  cargoHash = "sha256-j/h9UzcsojELd/bYX6/w54PwuqMViEAOKE9tsmQOhXY=";
 
   # TODO: somehow respect https://nixos.org/manual/nixpkgs/stable/#var-passthru-updateScript-commit
   passthru.updateScript = _experimental-update-script-combinators.sequence [
diff --git a/pkgs/by-name/sq/squawk/package.nix b/pkgs/by-name/sq/squawk/package.nix
index 7e671967e84f..68f22ab30b20 100644
--- a/pkgs/by-name/sq/squawk/package.nix
+++ b/pkgs/by-name/sq/squawk/package.nix
@@ -10,16 +10,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "squawk";
-  version = "2.62.0";
+  version = "2.63.0";
 
   src = fetchFromGitHub {
     owner = "sbdchd";
     repo = "squawk";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-XazgQu5Ot1Vknn+tN9qWLfNlRefoA6yXerjrF0H/Mso=";
+    hash = "sha256-9ZcidQphREqvIw+AiToSCybFNuWic7zFTmOvNI+zpgQ=";
   };
 
-  cargoHash = "sha256-Z8VNk8ZN0e7UOOTNAz0p8bt5a3F9g4IGi7l7t7+rZ/Q=";
+  cargoHash = "sha256-wHf4TDVFkd0vt60BiF0qh56j/kSkryaLfvyAy3XlQt0=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/sq/squeezelite/package.nix b/pkgs/by-name/sq/squeezelite/package.nix
index f13d69be4aed..31f83eefa3a2 100644
--- a/pkgs/by-name/sq/squeezelite/package.nix
+++ b/pkgs/by-name/sq/squeezelite/package.nix
@@ -39,13 +39,13 @@ stdenv.mkDerivation {
   pname = binName;
   # versions are specified in `squeezelite.h`
   # see https://github.com/ralph-irving/squeezelite/issues/29
-  version = "2.0.0.1586";
+  version = "2.0.0.1595";
 
   src = fetchFromGitHub {
     owner = "ralph-irving";
     repo = "squeezelite";
-    rev = "de709765072a1ef270f63956370c5b25a1ea1159";
-    hash = "sha256-sAjZ0o6sRh8+oFRDlG2YRDS3qzCL6bzybwZkkWPG2Kw=";
+    rev = "c7c4248ddd70e47dbfeba0bf4a8a7ec08d8a995c";
+    hash = "sha256-XCYlD0NliyM+CQCB7SA2LA+XqBvmhgKIW/hVAWVLFCo=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/st/stash-clipboard/package.nix b/pkgs/by-name/st/stash-clipboard/package.nix
index 591130116460..f052f283975a 100644
--- a/pkgs/by-name/st/stash-clipboard/package.nix
+++ b/pkgs/by-name/st/stash-clipboard/package.nix
@@ -7,16 +7,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "stash-clipboard";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "NotAShelf";
     repo = "stash";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-L5UfPKzdU8qQIyXSCMglLhv22J7xInxg3NNKCLkxszM=";
+    hash = "sha256-G31RXNllgbC5SqRMVj5L9/hCpsKuK/s4Byq+TT8a7X4=";
   };
 
-  cargoHash = "sha256-iXL3G1H8tNS1oPAoEvvx7qwWUef95NBU3dwlEe+34zw=";
+  cargoHash = "sha256-biKZ2qIAiNuvEuI8cJV2zuRXusuUlkd8MKq/M9J+FJs=";
 
   __structuredAttrs = true;
 
diff --git a/pkgs/by-name/sw/swim/package.nix b/pkgs/by-name/sw/swim/package.nix
index 26cfc74f1cee..16a016956bb5 100644
--- a/pkgs/by-name/sw/swim/package.nix
+++ b/pkgs/by-name/sw/swim/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "swim";
-  version = "0.19.0";
+  version = "0.20.0";
 
   src = fetchFromGitLab {
     owner = "spade-lang";
     repo = "swim";
     rev = "v${version}";
-    hash = "sha256-5/yIucyErZpY5iN/6r8JNAfsrYPxh+lBHDBD6cnjbHQ=";
+    hash = "sha256-pd/ej6WCS36gHlzkHM+pSyV2e87jIAk/kR8OU+nmrDk=";
   };
 
-  cargoHash = "sha256-+znzedDuB7hMzaRtAvLNUC9gG0Q2R8Fn61D64udAyAM=";
+  cargoHash = "sha256-7yQytwWDmb58aQzVb4EJZ1e7212qfaPXUhvO6fzbg/M=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/te/terser/package.nix b/pkgs/by-name/te/terser/package.nix
index d01feea2671e..e4fb5de61865 100644
--- a/pkgs/by-name/te/terser/package.nix
+++ b/pkgs/by-name/te/terser/package.nix
@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "terser";
-  version = "5.49.2";
+  version = "5.50.0";
 
   src = fetchFromGitHub {
     owner = "terser";
     repo = "terser";
     rev = "v${version}";
-    hash = "sha256-leC95D+bBI9CvPlenOr/2+3LkL9HgK3iCu3FNxBUaOk=";
+    hash = "sha256-7odcHOVjrj73suP0Uz8kcchvHqQxu0RVY0KwEQ73Tsw=";
   };
 
-  npmDepsHash = "sha256-wkvMDyWiPtQXaLDkPUCcVTQJXZ30QqPHdQXzMXrtHkY=";
+  npmDepsHash = "sha256-d0J7DPZaxn4ILMJ7rwf2MAVVCL2GI6/GLxkX78smUsU=";
 
   meta = {
     description = "JavaScript parser, mangler and compressor toolkit for ES6+";
diff --git a/pkgs/by-name/te/tetro-tui/package.nix b/pkgs/by-name/te/tetro-tui/package.nix
index 438034625972..a4f97c1410a3 100644
--- a/pkgs/by-name/te/tetro-tui/package.nix
+++ b/pkgs/by-name/te/tetro-tui/package.nix
@@ -9,17 +9,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tetro-tui";
-  version = "3.6.1";
+  version = "3.6.2";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "Strophox";
     repo = "tetro-tui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-i/d+i6E0ClMAAjC6zB9Lt26LYEcjvR01MCzGne2EXNQ=";
+    hash = "sha256-tlZYvk9PrdkuN8m+tu/sPrG88k9L58T/QDk2fLZmM34=";
   };
 
-  cargoHash = "sha256-LTHokF9T7nRvvzfQWSL9igTHmvV+w40Pm4z/i0y7goA=";
+  cargoHash = "sha256-AF5aerbBhBJ8Ommrq27GjSeGE/smTvVdEoXS1XLktRE=";
 
   nativeBuildInputs = [
     copyDesktopItems
diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index b4e4c2e39960..9b77c61f9966 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -2300,9 +2300,13 @@
   };
 
   regex = {
-    version = "1.0.0";
+    # Note: if you see an attempt to update tree-sitter-regex to version 1.0.0,
+    # check if https://github.com/tree-sitter/tree-sitter-regex/tags is actually
+    # a recent version. After v1.0.0, tree-sitter-regex confusingly released
+    # v0.20.0, v0.21.0, etc.
+    version = "0.25.0";
     url = "github:tree-sitter/tree-sitter-regex";
-    hash = "sha256-3D+LOWRUamAdbegVfWD5yFcCjBucthPogOL/zWR78PY=";
+    hash = "sha256-bR0K6SR19QuQwDUic+CJ69VQTSGqry5a5IOpPTVJFlo=";
     meta = {
       license = lib.licenses.mit;
     };
diff --git a/pkgs/by-name/ve/versatiles/package.nix b/pkgs/by-name/ve/versatiles/package.nix
index 7a843a45a67b..039a9bb3f510 100644
--- a/pkgs/by-name/ve/versatiles/package.nix
+++ b/pkgs/by-name/ve/versatiles/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "versatiles";
-  version = "4.7.0";
+  version = "4.9.1";
 
   src = fetchFromGitHub {
     owner = "versatiles-org";
     repo = "versatiles-rs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WgC5KO6Uz0FQt4Fh08FhZh1RMfDA32Bq70pfMGoDvxU=";
+    hash = "sha256-WPn96f9wN1p0uDtWzOQVx5fqBwKM1l93dVwNSReBkwc=";
   };
 
-  cargoHash = "sha256-HzTpvnuODTl+fTgYFdbkerquWjjrFw440+pJDGzRnFk=";
+  cargoHash = "sha256-WFUIIjb+bXq/Sz7tTI2Z5Fyqrnjac0F3fVNTxCQeUT0=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/we/wezterm/package.nix b/pkgs/by-name/we/wezterm/package.nix
index 34c2669a6421..cc956ca4b09a 100644
--- a/pkgs/by-name/we/wezterm/package.nix
+++ b/pkgs/by-name/we/wezterm/package.nix
@@ -29,14 +29,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wezterm";
-  version = "0-unstable-2026-08-12";
+  version = "0-unstable-2026-08-23";
 
   src = fetchFromGitHub {
     owner = "wezterm";
     repo = "wezterm";
-    rev = "fe3006aefcdc4c22924e7bce966b2c430dade4f1";
+    rev = "f93d90350075d3e42566e0557ca36e82ffdcbec1";
     fetchSubmodules = true;
-    hash = "sha256-aPMO7QeefsZMbb+w+DJMAFWfJV+usGROKhqEXkwndPE=";
+    hash = "sha256-er8IRmDZ65Axr+9qKDrqba6Qbj9MVdiBEH52xmp2ZHo=";
   };
 
   postPatch = ''
@@ -59,7 +59,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   # https://github.com/wezterm/wezterm/blob/main/nix/flake.nix#L134
   auditable = false;
 
-  cargoHash = "sha256-4jm0uMj0/6fcLHSvd7y12h1QjQ/VavkmNc5L/ebQez0=";
+  cargoHash = "sha256-R47aufhkCuHDSKSV8A7n3eGz0S3s0/HP2Sw0keaEX5s=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/wl/wl-screenrec/package.nix b/pkgs/by-name/wl/wl-screenrec/package.nix
index 9db0e7a9e8d8..ae4e9e3812d7 100644
--- a/pkgs/by-name/wl/wl-screenrec/package.nix
+++ b/pkgs/by-name/wl/wl-screenrec/package.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wl-screenrec";
-  version = "0.2.0";
+  version = "0.3.2";
 
   src = fetchFromGitHub {
     owner = "russelltg";
     repo = "wl-screenrec";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-sLuhVeyzFp6sFKGK7Y7DPAPk7IdFAqAtjm56zhrX3fA=";
+    hash = "sha256-x311y/0wRBXvpmVNRh6/TbLgHYvl1y589PNRjW2NCJc=";
   };
 
-  cargoHash = "sha256-atfWEAo6tMLEzFtiLlxp8fyVKa1cF/4SZFMYStDYZwU=";
+  cargoHash = "sha256-3/yVWVNLu03PhgJTwyeatSVY3cvGtWhwEwpvPdBGnKs=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/xs/xsser/package.nix b/pkgs/by-name/xs/xsser/package.nix
new file mode 100644
index 000000000000..ab4cbe99223f
--- /dev/null
+++ b/pkgs/by-name/xs/xsser/package.nix
@@ -0,0 +1,89 @@
+{
+  lib,
+  stdenv,
+  python3Packages,
+  fetchFromGitHub,
+  nix-update-script,
+  geckodriver,
+  curl,
+  versionCheckHook,
+}:
+
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "xsser";
+  version = "1.9";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "epsylon";
+    repo = "xsser";
+    tag = "xsser-v${finalAttrs.version}";
+    hash = "sha256-wq8BGeBxDW/ux1X5seUTb6bGdKUTBgkRVeqkm3sVLPU=";
+  };
+
+  postPatch = ''
+    substituteInPlace core/curlcontrol.py \
+      --replace-fail 'open("core/fuzzing/user-agents.txt")' 'open(os.path.join(os.path.dirname(__file__), "fuzzing", "user-agents.txt"))' \
+      --replace-fail 'open("fuzzing/user-agents.txt")' 'open(os.path.join(os.path.dirname(__file__), "fuzzing", "user-agents.txt"))'
+
+    substituteInPlace core/dork.py \
+      --replace-fail 'import urllib.request, urllib.error, urllib.parse, traceback, re, random, time, ssl, base64, warnings' 'import os, urllib.request, urllib.error, urllib.parse, traceback, re, random, time, ssl, base64, warnings' \
+      --replace-fail 'open("core/fuzzing/user-agents.txt")' 'open(os.path.join(os.path.dirname(__file__), "fuzzing", "user-agents.txt"))' \
+      --replace-fail 'open("fuzzing/user-agents.txt")' 'open(os.path.join(os.path.dirname(__file__), "fuzzing", "user-agents.txt"))'
+
+    substituteInPlace core/main.py \
+      --replace-fail 'open("core/fuzzing/user-agents.txt")' 'open(os.path.join(os.path.dirname(__file__), "fuzzing", "user-agents.txt"))' \
+      --replace-fail 'open("fuzzing/user-agents.txt")' 'open(os.path.join(os.path.dirname(__file__), "fuzzing", "user-agents.txt"))' \
+      --replace-fail "open('core/fuzzing/dorks.txt')" "open(os.path.join(os.path.dirname(__file__), 'fuzzing', 'dorks.txt'))" \
+      --replace-fail "os.path.exists('core/fuzzing/dorks.txt')" "os.path.exists(os.path.join(os.path.dirname(__file__), 'fuzzing', 'dorks.txt'))"
+  '';
+
+  postInstall = ''
+    install -Dm644 core/fuzzing/user-agents.txt "$out/${python3Packages.python.sitePackages}/core/fuzzing/user-agents.txt"
+    install -Dm644 core/fuzzing/dorks.txt "$out/${python3Packages.python.sitePackages}/core/fuzzing/dorks.txt"
+  '';
+
+  build-system = with python3Packages; [ setuptools ];
+
+  dependencies =
+    with python3Packages;
+    [
+      beautifulsoup4
+      ddgs
+      fpdf2
+      geoip
+      pygobject3
+      pycurl
+      selenium
+    ]
+    ++ [ geckodriver ];
+
+  nativeCheckInputs = with python3Packages; [ pytestCheckHook ] ++ [ curl ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  doInstallCheck = true;
+
+  preFixup = ''
+    makeWrapperArgs+=(--prefix PATH : ${
+      lib.makeBinPath [
+        geckodriver
+        curl
+      ]
+    })
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Automatic framework to detect, exploit and report XSS vulnerabilities in web-based applications";
+    homepage = "https://github.com/epsylon/xsser";
+    changelog = "https://github.com/epsylon/xsser/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "xsser";
+    broken = stdenv.hostPlatform.isDarwin;
+  };
+})
diff --git a/pkgs/development/ocaml-modules/jsont/default.nix b/pkgs/development/ocaml-modules/jsont/default.nix
index 70a88865a76d..b4ebf6925ba1 100644
--- a/pkgs/development/ocaml-modules/jsont/default.nix
+++ b/pkgs/development/ocaml-modules/jsont/default.nix
@@ -13,13 +13,13 @@
 
 buildTopkgPackage rec {
   pname = "jsont";
-  version = "0.2.0";
+  version = "0.3.0";
 
   minimalOCamlVersion = "4.14.0";
 
   src = fetchzip {
     url = "https://erratique.ch/software/jsont/releases/jsont-${version}.tbz";
-    hash = "sha256-dXHl+bLuIrlrQ5Np37+uVuETFBb3j8XeDVEK9izoQFk=";
+    hash = "sha256-Gojblihb+So/0KpQHbIWuE33Ir2a4w5DdY+F3S9+qBk=";
   };
 
   buildInputs = lib.optional withCmdliner cmdliner;
diff --git a/pkgs/development/perl-modules/MojoSAML-select-PKCS-1-padding.patch b/pkgs/development/perl-modules/MojoSAML-select-PKCS-1-padding.patch
new file mode 100644
index 000000000000..b894586077ee
--- /dev/null
+++ b/pkgs/development/perl-modules/MojoSAML-select-PKCS-1-padding.patch
@@ -0,0 +1,44 @@
+From 7dcb837f5f953206eead3d28144c3d0e2af85c2c Mon Sep 17 00:00:00 2001
+From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
+Date: Mon, 20 Jul 2026 22:48:38 -0400
+Subject: [PATCH] Select PKCS#1 padding for XML signatures
+
+The rsa-sha* XML Signature algorithms require RSASSA-PKCS1-v1_5.
+Select that padding explicitly instead of relying on the RSA module's
+signing default, which is PSS in recent releases.
+
+Require Crypt::OpenSSL::RSA 0.38, the first release whose signing path
+honors the explicit padding choice.
+
+Assisted-by: Codex
+---
+ cpanfile           | 2 +-
+ lib/Mojo/XMLSig.pm | 1 +
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/cpanfile b/cpanfile
+index 6c56caf..149f4a6 100644
+--- a/cpanfile
++++ b/cpanfile
+@@ -1,5 +1,5 @@
+ requires 'Mojolicious', '7.78'; # tag_to_html
+-requires 'Crypt::OpenSSL::RSA';
++requires 'Crypt::OpenSSL::RSA', '0.38';
+ requires 'Crypt::OpenSSL::X509';
+ requires 'Data::GUID';
+ requires 'Digest::SHA';
+diff --git a/lib/Mojo/XMLSig.pm b/lib/Mojo/XMLSig.pm
+index 3ee9db3..2498bbe 100644
+--- a/lib/Mojo/XMLSig.pm
++++ b/lib/Mojo/XMLSig.pm
+@@ -91,6 +91,7 @@ my $set_algo = sub {
+     unless $key->$isa('Crypt::OpenSSL::RSA');
+   Carp::croak 'Unsupported RSA algorithm'
+     unless my $method = $key->can("use_${algo}_hash");
++  $key->use_pkcs1_padding;
+   $key->$method;
+   return $key;
+ };
+-- 
+2.54.0
+
diff --git a/pkgs/development/python-modules/ansible-compat/default.nix b/pkgs/development/python-modules/ansible-compat/default.nix
index 8a8f55e7ef7a..b3cfec2cd671 100644
--- a/pkgs/development/python-modules/ansible-compat/default.nix
+++ b/pkgs/development/python-modules/ansible-compat/default.nix
@@ -30,7 +30,11 @@ buildPythonPackage rec {
     owner = "ansible";
     repo = "ansible-compat";
     tag = "v${version}";
-    hash = "sha256-QTn1W+XxiK5ZCkUfYJZrI/mk0gFduTWClIH3ztHcerg=";
+    postFetch = ''
+      # export-subst prevents reproducibility
+      rm $out/.git_archival.txt
+    '';
+    hash = "sha256-12t/iLtha5FACVpXFqrz6vIiVmtHPPqdfHogXuAe2F4=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/coveralls/default.nix b/pkgs/development/python-modules/coveralls/default.nix
index 56e089c52984..1d0750548a97 100644
--- a/pkgs/development/python-modules/coveralls/default.nix
+++ b/pkgs/development/python-modules/coveralls/default.nix
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "TheKevJames";
     repo = "coveralls-python";
     tag = version;
-    hash = "sha256-c7YV1SAbxmqfVI/wGtfdr+S4T7G2q7tf0FhuyCJaPDg=";
+    hash = "sha256-sr3pR3t21nMZczwugFNAioSry/RxIWAzGdGG070YXGw=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/django-leaflet/default.nix b/pkgs/development/python-modules/django-leaflet/default.nix
index 4aa698bc448a..a43c5f6ae9d6 100644
--- a/pkgs/development/python-modules/django-leaflet/default.nix
+++ b/pkgs/development/python-modules/django-leaflet/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "django-leaflet";
-  version = "0.33.0";
+  version = "0.34.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "django_leaflet";
     inherit version;
-    hash = "sha256-tRxx5xee7ZlhSE39V7h70ezjsf977k37f01XAiBrLso=";
+    hash = "sha256-gzbnKnu/8LNjBUmC8CrB16O8srL6S8oyYBTd3q63xRU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/django-silk/default.nix b/pkgs/development/python-modules/django-silk/default.nix
index 5f30356c1724..5879f64772bb 100644
--- a/pkgs/development/python-modules/django-silk/default.nix
+++ b/pkgs/development/python-modules/django-silk/default.nix
@@ -27,14 +27,14 @@
 
 buildPythonPackage rec {
   pname = "django-silk";
-  version = "5.5.1";
+  version = "5.5.2";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "jazzband";
     repo = "django-silk";
     tag = version;
-    hash = "sha256-Ee0U8PVdyXppqLAbQF3V01VIxn6q94eDp+6GvqbeD5g=";
+    hash = "sha256-1m6HvwN9n35q9p0LUD8ihbbQ5FRRr8KoDvRLed9RIMQ=";
   };
 
   # "test_time_taken" tests aren't suitable for reproducible execution, but Django's
diff --git a/pkgs/development/python-modules/fabric/default.nix b/pkgs/development/python-modules/fabric/default.nix
index b2f7013432be..33330393af63 100644
--- a/pkgs/development/python-modules/fabric/default.nix
+++ b/pkgs/development/python-modules/fabric/default.nix
@@ -17,6 +17,7 @@ buildPythonPackage rec {
   pname = "fabric";
   version = "3.2.3";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "fabric";
diff --git a/pkgs/development/python-modules/gradient/default.nix b/pkgs/development/python-modules/gradient/default.nix
index 6045a2d21105..7b1242cf70b8 100644
--- a/pkgs/development/python-modules/gradient/default.nix
+++ b/pkgs/development/python-modules/gradient/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "gradient";
-  version = "3.12.1";
+  version = "3.12.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "digitalocean";
     repo = "gradient-python";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-4BJMUxNryePXIAG92JOX7pTbDN6FQzmYRu1+2bKEwX0=";
+    hash = "sha256-2blzsP8KJfCbqBmoaWgQRCmiR5Dj3ofbd65fJqQpfAI=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index 3a914a6d304e..251a4a99f7c1 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202608231";
+  version = "0.1.202608241";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-R92NYZ1Wco/vMdI31Hw7pUpJ7GDAv13pd0pQIrVTIJ8=";
+    hash = "sha256-IBVOk3VLGpn4xKbmbDPj70qM3H/KuKT9X52e4HVsNtQ=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/kivy/default.nix b/pkgs/development/python-modules/kivy/default.nix
index 710985352263..ddf14b3be159 100644
--- a/pkgs/development/python-modules/kivy/default.nix
+++ b/pkgs/development/python-modules/kivy/default.nix
@@ -3,7 +3,6 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch,
   pkg-config,
   cython,
   docutils,
@@ -23,33 +22,24 @@
   filetype,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "kivy";
-  version = "2.3.1";
+  version = "2.3.1-unstable-2026-07-11";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kivy";
     repo = "kivy";
-    tag = version;
-    hash = "sha256-q8BoF/pUTW2GMKBhNsqWDBto5+nASanWifS9AcNRc8Q=";
+    rev = "d8e642fec15894ce338b0c9773c3f58b41b75f09";
+    hash = "sha256-i+4qsCIWOddfkw4fseHyTZRj29cdPX84uaPMORE6Gp4=";
   };
 
-  patches = [
-    # Fix compat with newer Cython
-    (fetchpatch {
-      name = "0001-kivy-Remove-old-Python-2-long.patch";
-      url = "https://github.com/kivy/kivy/commit/5a1b27d7d3bdee6cedb55440bfae9c4e66fb3c68.patch";
-      hash = "sha256-GDNYL8dC1Rh4KJ8oPiIjegOJGzRQ1CsgWQeAvx9+Rc8=";
-    })
-  ];
-
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace-fail "setuptools~=69.2.0" "setuptools" \
-      --replace-fail "wheel~=0.44.0" "wheel" \
-      --replace-fail "cython>=0.29.1,<=3.0.11" "cython" \
-      --replace-fail "packaging~=24.0" packaging
+      --replace-fail "setuptools~=82.0.0" "setuptools" \
+      --replace-fail "wheel~=0.47.0" "wheel" \
+      --replace-fail "cython>=0.29.1,<=3.2.0" "cython" \
+      --replace-fail "packaging~=26.0" packaging
   ''
   + lib.optionalString stdenv.hostPlatform.isLinux ''
     substituteInPlace kivy/lib/mtdev.py \
@@ -122,10 +112,9 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "kivy" ];
 
   meta = {
-    changelog = "https://github.com/kivy/kivy/releases/tag/${src.tag}";
     description = "Library for rapid development of hardware-accelerated multitouch applications";
     homepage = "https://github.com/kivy/kivy";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ risson ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/liger-kernel/default.nix b/pkgs/development/python-modules/liger-kernel/default.nix
index acdbecffe2ee..fe51e8678605 100644
--- a/pkgs/development/python-modules/liger-kernel/default.nix
+++ b/pkgs/development/python-modules/liger-kernel/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "liger-kernel";
-  version = "0.8.1";
+  version = "0.8.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "linkedin";
     repo = "liger-kernel";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HSNhm/NwzjL3XQcKot/Bg1i3zuPEy6aNkWo2ukLL4VY=";
+    hash = "sha256-cUgVfUe2UxULHiU0OeSJX9KHShRJ5W6fhqmgB+PUD4c=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/linuxpy/default.nix b/pkgs/development/python-modules/linuxpy/default.nix
index e67d61ea51bc..1defd64f32ba 100644
--- a/pkgs/development/python-modules/linuxpy/default.nix
+++ b/pkgs/development/python-modules/linuxpy/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "linuxpy";
-  version = "0.24.0";
+  version = "0.25.0";
 
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-K0RDTSjUklfoWaSDAmeiWqS1Gx0in5X3nQJa5/Gl0w4=";
+    sha256 = "sha256-eyNCkbq8YXah/iOWJPjhkH/IncX3OXgJNg5Q4FMcd1I=";
   };
 
   pythonImportsCheck = [ "linuxpy" ];
diff --git a/pkgs/development/python-modules/llama-cloud/default.nix b/pkgs/development/python-modules/llama-cloud/default.nix
index fae398022cc7..615cf1912e0f 100644
--- a/pkgs/development/python-modules/llama-cloud/default.nix
+++ b/pkgs/development/python-modules/llama-cloud/default.nix
@@ -25,13 +25,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "llama-cloud";
-  version = "2.14.0";
+  version = "2.14.1";
   pyproject = true;
 
   src = fetchPypi {
     pname = "llama_cloud";
     inherit (finalAttrs) version;
-    hash = "sha256-oiLNJIZ8BYtp01z490S7WxmuNEQqQXTYKl8FCU4feIo=";
+    hash = "sha256-QtnBF5KtSQlyXM/85Y38jkf12cafUXhFSwn7N0gxh5Q=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/nice-go/default.nix b/pkgs/development/python-modules/nice-go/default.nix
index 2d88c5695aab..33eeb229afe4 100644
--- a/pkgs/development/python-modules/nice-go/default.nix
+++ b/pkgs/development/python-modules/nice-go/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "nice-go";
-  version = "1.0.2";
+  version = "1.0.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "IceBotYT";
     repo = "nice-go";
     tag = version;
-    hash = "sha256-09Tc2fFXUevQNgJmXyeXy1sBg9Cr9OV/15Feh9tlRug=";
+    hash = "sha256-KrsAs5aMkrhxv6PtFTm+8e0h2hAD/bc4ADam2jT2oAc=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/pixel-font-builder/default.nix b/pkgs/development/python-modules/pixel-font-builder/default.nix
index 8b4494ad72ff..377b72e92aa6 100644
--- a/pkgs/development/python-modules/pixel-font-builder/default.nix
+++ b/pkgs/development/python-modules/pixel-font-builder/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "pixel-font-builder";
-  version = "0.0.47";
+  version = "0.0.55";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TakWolf";
     repo = "pixel-font-builder";
     tag = version;
-    hash = "sha256-a25JKZy5XaBfpeFwH7YnSTY28hQF8dLa/AGEOXHN94I=";
+    hash = "sha256-WMwmhGspseqTkGUPrMNR16sZBB+n/lvthHX7JTtdlsQ=";
   };
 
   build-system = [ uv-build ];
diff --git a/pkgs/development/python-modules/python-mpv-jsonipc/default.nix b/pkgs/development/python-modules/python-mpv-jsonipc/default.nix
index 64824a764f22..9022caf8b6d3 100644
--- a/pkgs/development/python-modules/python-mpv-jsonipc/default.nix
+++ b/pkgs/development/python-modules/python-mpv-jsonipc/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "python-mpv-jsonipc";
-  version = "1.2.3";
+  version = "1.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "iwalton3";
     repo = "python-mpv-jsonipc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-drXPu355wXznB9oTF2mmjXoByLs1gzUuBxWT6wUFMTA=";
+    hash = "sha256-i21Pzaidoi2MLb6Le9pA37IRy804MeC0yVV4KONb3mk=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index d44eca09d60f..112cdb8dd7e1 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "tencentcloud-sdk-python";
-  version = "3.1.162";
+  version = "3.1.163";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = finalAttrs.version;
-    hash = "sha256-ap6wIzL2G+Ogbsf53tKgkkYQNRVsUUymlm+A/B7F3Tc=";
+    hash = "sha256-Y6xQ3UWmpvwZfLerrc2urtA6c0AT1474DI0ZvxGcxzM=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index fcdaceae74e6..0d8d5919790a 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -18,7 +18,7 @@ in
 buildLinux (
   args
   // rec {
-    version = "7.1.9";
+    version = "7.1.10";
     pname = "linux-zen";
     modDirVersion = lib.versions.pad 3 "${version}-${suffix}";
     isZen = true;
@@ -27,7 +27,7 @@ buildLinux (
       owner = "zen-kernel";
       repo = "zen-kernel";
       rev = "v${version}-${suffix}";
-      sha256 = "0r1c6qpmcdhqdzx27v1wrk6mzwyvwb0ff98bjhf2f1qk9cjk701q";
+      sha256 = "0c01cnamvl3mdc1rm7pjpcy5s6s9yamfkg413zn7k2xwkjig8b08";
     };
 
     # This is based on the following source:
diff --git a/pkgs/servers/klipper/klipper-flash.nix b/pkgs/servers/klipper/klipper-flash.nix
index f50b684b5aa7..9b024becf75e 100644
--- a/pkgs/servers/klipper/klipper-flash.nix
+++ b/pkgs/servers/klipper/klipper-flash.nix
@@ -17,12 +17,17 @@ let
     field:
     with builtins;
     let
-      matches = match ''^[^#\r\n]*${field}="([a-zA-Z0-9_]+)".*$'' (readFile firmwareConfig);
+      lines = lib.splitString "\n" (readFile firmwareConfig);
+      matchLine = line: match ''${field}="?([a-zA-Z0-9_]+)"?.*'' (lib.trim line);
+      matched = lib.findFirst (line: matchLine line != null) null lines;
     in
-    if matches != null then head matches else null;
+    if matched != null then head (matchLine matched) else null;
   matchPlatform = getConfigField "CONFIG_BOARD_DIRECTORY";
   matchBoard = getConfigField "CONFIG_MCU";
   matchAvrdudeProtocol = getConfigField "CONFIG_AVRDUDE_PROTOCOL";
+  matchFlashApplicationAddress = getConfigField "CONFIG_FLASH_APPLICATION_ADDRESS";
+  # Only stm32's require -s/--start (flash_stm32f4 in scripts/flash_usb.py)
+  flashStartAddress = if matchPlatform == "stm32" then matchFlashApplicationAddress else null;
   flashUsbSupportedBoards = [
     "sam3"
     "sam4"
@@ -69,7 +74,9 @@ writeShellApplication {
         && matchPlatform != null
       then
         ''
-          ${klipper}/lib/scripts/flash_usb.py -t ${matchBoard} -d ${flashDevice} ${klipper-firmware}/klipper.bin "$@"
+          ${klipper}/lib/scripts/flash_usb.py -t ${matchBoard} -d ${flashDevice}${
+            lib.optionalString (flashStartAddress != null) " -s ${flashStartAddress}"
+          } ${klipper-firmware}/klipper.bin "$@"
         ''
       else if matchPlatform == "avr" && matchAvrdudeProtocol != null && matchBoard != null then
         ''
diff --git a/pkgs/servers/monitoring/grafana/plugins/grafana-clock-panel/default.nix b/pkgs/servers/monitoring/grafana/plugins/grafana-clock-panel/default.nix
index 0b9b3b062202..d95ccd233cff 100644
--- a/pkgs/servers/monitoring/grafana/plugins/grafana-clock-panel/default.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/grafana-clock-panel/default.nix
@@ -2,8 +2,8 @@
 
 grafanaPlugin {
   pname = "grafana-clock-panel";
-  version = "3.2.2";
-  zipHash = "sha256-VjOg6qJXxhDAl8xYWD9ZZSNqSELMoREuyv+LX5xFOgM=";
+  version = "3.2.3";
+  zipHash = "sha256-qNX6LTg+WKjoJIWX7Mc2IRnWVpoZZsiZQzQqR2u1Q10=";
   meta = {
     description = "Clock panel for Grafana";
     license = lib.licenses.mit;
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 1ff3f5e68e80..c727ff8c2d88 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -793,6 +793,7 @@ mapAliases {
   expidus = throw "'expidus' has been removed from nixpkgs due to it not being maintained"; # Added 2026-07-28
   ext4fuse = throw "'ext4fuse' has been removed as it is unmaintained, and depends on the unmaintained fuse2 library"; # added 2026-08-12
   f3d_egl = warnAlias "'f3d' now build with egl support by default, so `f3d_egl` is deprecated, consider using 'f3d' instead." f3d; # Added 2025-07-18
+  Fabric = fabric; # Added 2026-06-29
   fabs = throw "'fabs' has been removed due to being broken for more than a year; see RFC 180"; # Added 2026-02-05
   falcon = throw "'falcon' has been removed as it is unmaintained and depends on pcre, which is deprecated"; # Added 2026-06-16
   fancontrol-gui = throw "'fancontrol-gui' has been removed due to outdated KF5 dependencies"; # Added 2026-05-01
@@ -2142,6 +2143,7 @@ mapAliases {
   rambox-pro = throw "'rambox-pro' has been renamed to/replaced by 'rambox'"; # Converted to throw 2025-10-27
   rapidjson-unstable = throw "'rapidjson-unstable' has been renamed to/replaced by 'rapidjson'"; # Converted to throw 2025-10-27
   rar2fs = throw "'rar2fs' has been removed as it is unmaintained, and depends on the unmaintained fuse2 library"; # Added 2026-05-19
+  raycast-beta = throw "'raycast-beta' has been removed because Raycast 2.0 is out of beta. Use 'raycast' instead."; # Added 2026-08-24
   react-static = throw "'react-static' has been removed due to lack of maintenance upstream"; # Added 2025-11-04
   recurseIntoAttrs = warnAlias "'recurseIntoAttrs' has been removed from pkgs, use `lib.recurseIntoAttrs` instead" lib.recurseIntoAttrs; # Added 2025-10-30
   redict = throw "'redict' has been removed due to lack of nixpkgs maintenance and a slow upstream development pace. Consider using 'valkey'."; # Added 2025-10-16
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 65b5569dfecf..0a2f91c1858b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1978,7 +1978,7 @@ with pkgs;
 
   expect = tcl8Packages.expect_5;
 
-  Fabric = with python3Packages; toPythonApplication fabric;
+  fabric = with python3Packages; toPythonApplication fabric;
 
   flatpak-builder = callPackage ../development/tools/flatpak-builder {
     binutils = binutils-unwrapped;
@@ -2513,7 +2513,7 @@ with pkgs;
   ioskeley-mono = recurseIntoAttrs (callPackage ../data/fonts/ioskeley-mono { });
 
   # Not in aliases because it wouldn't get picked up by callPackage
-  netbox = netbox_4_5;
+  netbox = netbox_4_6;
 
   netboxPlugins = recurseIntoAttrs netbox.plugins;
 
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 072df08390af..c0cb0ffb63d0 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -7765,17 +7765,21 @@ with self;
 
   CryptOpenSSLRSA = buildPerlPackage {
     pname = "Crypt-OpenSSL-RSA";
-    version = "0.35";
+    version = "0.41";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/T/TO/TODDR/Crypt-OpenSSL-RSA-0.35.tar.gz";
-      hash = "sha256-XuvVWsBxY0yGSo549c+vuq9Dz4TAQyOgm3Hddr8CXMI=";
+      url = "mirror://cpan/authors/id/T/TI/TIMLEGGE/Crypt-OpenSSL-RSA-0.41.tar.gz";
+      hash = "sha256-gvqDmJe4jpwkW2Jl874m07yHnK5MeoFR+tSjB8M2aCI=";
     };
-    propagatedBuildInputs = [ CryptOpenSSLRandom ];
+    propagatedBuildInputs = [
+      CryptOpenSSLBignum
+      CryptOpenSSLRandom
+    ];
     env.NIX_CFLAGS_COMPILE = "-I${pkgs.openssl.dev}/include";
     env.NIX_CFLAGS_LINK = "-L${lib.getLib pkgs.openssl}/lib -lcrypto";
     env.OPENSSL_PREFIX = pkgs.openssl;
     buildInputs = [ CryptOpenSSLGuess ];
     meta = {
+      homepage = "https://github.com/cpan-authors/Crypt-OpenSSL-RSA";
       description = "RSA encoding and decoding, using the openSSL libraries";
       license = with lib.licenses; [
         artistic1
@@ -22976,6 +22980,9 @@ with self;
       url = "mirror://cpan/authors/id/J/JB/JBERGER/Mojo-SAML-0.07.tar.gz";
       hash = "sha256-csJMrNtvHXp14uqgBDfHFKv1eafSENSqTT8g8e/0cQ0=";
     };
+    patches = [
+      ../development/perl-modules/MojoSAML-select-PKCS-1-padding.patch
+    ];
     buildInputs = [ ModuleBuildTiny ];
     propagatedBuildInputs = [
       CryptOpenSSLRSA