diff --git a/lib/licenses/licenses.nix b/lib/licenses/licenses.nix
index da253f7db94b..37197cf4e2e6 100644
--- a/lib/licenses/licenses.nix
+++ b/lib/licenses/licenses.nix
@@ -703,11 +703,6 @@ lib.mapAttrs mkLicense (
       url = "https://www.schristiancollins.com/generaluser.php"; # license included in sources
     };
 
-    gfl = {
-      fullName = "GUST Font License";
-      url = "https://www.gust.org.pl/projects/e-foundry/licenses/GUST-FONT-LICENSE.txt";
-    };
-
     gfsl = {
       fullName = "GUST Font Source License";
       url = "https://www.gust.org.pl/projects/e-foundry/licenses/GUST-FONT-SOURCE-LICENSE.txt";
diff --git a/nixos/modules/programs/wayland/noctalia.nix b/nixos/modules/programs/wayland/noctalia.nix
index 8230bb71f9e1..ee0505fe7f67 100644
--- a/nixos/modules/programs/wayland/noctalia.nix
+++ b/nixos/modules/programs/wayland/noctalia.nix
@@ -33,7 +33,13 @@ in
   config = lib.mkIf cfg.enable (
     lib.mkMerge [
       {
-        environment.systemPackages = [ cfg.package ];
+        environment.systemPackages = [
+          cfg.package
+        ];
+
+        # Needed to add the freedesktop sound theme
+        # It's only a runtime dependency for noctalia, so it's not made a package dependency.
+        xdg.sounds.enable = true;
 
         systemd.user.services.noctalia = lib.mkIf cfg.systemd.enable {
           description = "Noctalia Wayland desktop shell";
diff --git a/nixos/modules/services/networking/nebula.nix b/nixos/modules/services/networking/nebula.nix
index 7ef930fff68f..6f7d69cb6f99 100644
--- a/nixos/modules/services/networking/nebula.nix
+++ b/nixos/modules/services/networking/nebula.nix
@@ -292,7 +292,7 @@ in
     assertions = lib.mapAttrsToList (netName: netCfg: {
       # IFNAMSIZ caps network device names to 16 chars (including NULL terminator).
       # Without this check, users might end up with a truncated interface name.
-      assertion = !netCfg.tun.disable && builtins.stringLength netCfg.tun.device <= 15;
+      assertion = netCfg.tun.disable || builtins.stringLength netCfg.tun.device <= 15;
       message = ''
         Network device names can't be longer than 15 chars.
         `config.services.nebula.networks.${netName}.tun.device` is set to "${netCfg.tun.device}" which is above the limit.
diff --git a/nixos/tests/nebula/connectivity.nix b/nixos/tests/nebula/connectivity.nix
index 3e96f613b11f..b7782815dc1c 100644
--- a/nixos/tests/nebula/connectivity.nix
+++ b/nixos/tests/nebula/connectivity.nix
@@ -1,6 +1,9 @@
-{ pkgs, lib, ... }:
+{
+  pkgs,
+  lib,
+  ...
+}:
 let
-
   # We'll need to be able to trade cert files between nodes via scp.
   inherit (import ../ssh-keys.nix pkgs)
     snakeOilPrivateKey
@@ -44,13 +47,11 @@ let
       }
       extraConfig
     ];
-
 in
 {
   name = "nebula";
 
   nodes = {
-
     lighthouse =
       { ... }@args:
       makeNebulaNode args "lighthouse" {
@@ -97,6 +98,24 @@ in
             };
           };
         };
+
+        # A lighthouse can run without a tun interface, no device name = skip length check pr 565501
+        services.nebula.networks.tunless = {
+          ca = "/etc/nebula/ca.crt";
+          cert = "/etc/nebula/lighthouse.crt";
+          key = "/etc/nebula/lighthouse.key";
+          isLighthouse = true;
+          listen = {
+            host = "0.0.0.0";
+            port = 4243;
+          };
+          tun = {
+            disable = true;
+            device = "nebula.tunless-too-long";
+          };
+          user = "nebula-smoke";
+          group = "nebula-smoke";
+        };
       };
 
     allowAny =
@@ -265,12 +284,10 @@ in
           };
         };
       };
-
   };
 
   testScript =
     let
-
       setUpPrivateKey = name: ''
         ${name}.start()
         ${name}.succeed(
@@ -379,6 +396,11 @@ in
       lighthouse.wait_until_succeeds("ping -c1 -W1 10.0.100.1", timeout=10)
       lighthouse.wait_until_succeeds("ping -c1 -W1 2001:db8::1", timeout=10)
 
+      # The tunless network starts without a tun device despite its (deliberately over-long) configured device name. pr 565501
+      lighthouse.wait_for_unit("nebula@tunless.service")
+      lighthouse.wait_until_succeeds("ss -lun | grep -q ':4243'", timeout=10)
+      lighthouse.fail("ip link show nebula.tunless-too-long")
+
       # Start all the machines to be set up
       allowAny.start()
       allowFromLighthouse.start()
diff --git a/pkgs/applications/networking/browsers/brave/packages/brave-origin.nix b/pkgs/applications/networking/browsers/brave/packages/brave-origin.nix
index fba197e06281..6c33ffcad623 100644
--- a/pkgs/applications/networking/browsers/brave/packages/brave-origin.nix
+++ b/pkgs/applications/networking/browsers/brave/packages/brave-origin.nix
@@ -1,21 +1,21 @@
 # Expression generated by update.py; do not edit it by hand!
 rec {
   pname = "brave-origin";
-  version = "1.95.104";
+  version = "1.96.59";
   flavor = "origin";
 
   archives = {
     aarch64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-origin_${version}_arm64.deb";
-      sha256 = "3efe3d4325b241a19449348a3e32af574be9842b2b0fae1eb942a87bb50333a7";
+      sha256 = "b088a568b3d98893b737a2bfdd5a3769ebb67798100b413e6cce555d42d65f57";
     };
     x86_64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-origin_${version}_amd64.deb";
-      sha256 = "fe6a88b3301eb8a08ed062d32bde01786d1b666e5ab842b5625c854eb11f2886";
+      sha256 = "447bc5ac4b2a2bfa71260cdf9d52d2fab694f59e15a4b9a907980f5b3ec45613";
     };
     aarch64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/Brave-Origin-arm64.dmg";
-      sha256 = "2f59547e4b53ac300450cb4f56f292bcbf508b20fdfa06c6341e5fd976d66859";
+      sha256 = "71f88f231526d99c7eb18d809dfe56a04899a97a3713c0a4476df2fe4132cdbd";
     };
   };
 }
diff --git a/pkgs/applications/networking/browsers/brave/packages/brave.nix b/pkgs/applications/networking/browsers/brave/packages/brave.nix
index 7322e17e1ccf..db1281f388a7 100644
--- a/pkgs/applications/networking/browsers/brave/packages/brave.nix
+++ b/pkgs/applications/networking/browsers/brave/packages/brave.nix
@@ -1,20 +1,20 @@
 # Expression generated by update.py; do not edit it by hand!
 rec {
   pname = "brave";
-  version = "1.95.104";
+  version = "1.96.59";
 
   archives = {
     aarch64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb";
-      sha256 = "251ee83fa383db6106ae6140df0975689b226d15ceb96cdb4147cb90cd7c25ba";
+      sha256 = "b82a7a488c9bc0c7b18fea1a2da8acb49f42b4a856493d6a4ce75a0b9a49fee3";
     };
     x86_64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-      sha256 = "e09e3c3e9fc84f75e65048a0be830c7c4907744a402b5790530d2206b276426e";
+      sha256 = "b05129c6907670b2029e2f01773d192c8b87c3075b25873ea3bc226bb0f15f1e";
     };
     aarch64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/Brave-Browser-arm64.dmg";
-      sha256 = "f6823d53b3e9a287b8f8830b728ba9b34fe2d4a9f6ee4e05b3bcd4a21ee25eaf";
+      sha256 = "57690cf24e5ce5e15768b220d46621e575e0caabd3d651bdad5afc2b184f118a";
     };
   };
 }
diff --git a/pkgs/by-name/ba/badness/package.nix b/pkgs/by-name/ba/badness/package.nix
index c71dc71e4af5..226ad41598bc 100644
--- a/pkgs/by-name/ba/badness/package.nix
+++ b/pkgs/by-name/ba/badness/package.nix
@@ -9,7 +9,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "badness";
-  version = "0.23.0";
+  version = "0.24.0";
 
   __structuredAttrs = true;
 
@@ -17,10 +17,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "jolars";
     repo = "badness";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rPIdpescZTHCDZffevgJbh83NjuDZjxzx3EXSa/I/6U=";
+    hash = "sha256-kc+gM3Vr2gyySwXLBunuL5uihlkYhPi6VW4IhpkigMs=";
   };
 
-  cargoHash = "sha256-Mi6/2ijc43wkzJzxTJafqh8+gygf3HJnyAq/uVcn3hY=";
+  cargoHash = "sha256-IeYGMF+iG/gSPs4HSaqm0ekZ1WMeKuf1qjNF6EMWvsI=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/ch/chromaprint/package.nix b/pkgs/by-name/ch/chromaprint/package.nix
index f08c1c0e914e..5c437790af35 100644
--- a/pkgs/by-name/ch/chromaprint/package.nix
+++ b/pkgs/by-name/ch/chromaprint/package.nix
@@ -10,7 +10,6 @@
   testers,
   validatePkgConfig,
   nix-update-script,
-  withExamples ? true,
   withTools ? true,
 }:
 
@@ -80,6 +79,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://acoustid.org/chromaprint";
     description = "AcoustID audio fingerprinting library";
     license = lib.licenses.lgpl21Plus;
+    maintainers = [ lib.maintainers.quantenzitrone ];
     platforms = lib.platforms.unix;
     pkgConfigModules = [ "libchromaprint" ];
   }
diff --git a/pkgs/by-name/cl/clifm/package.nix b/pkgs/by-name/cl/clifm/package.nix
index e185ee09f9b7..83fec9c0fd97 100644
--- a/pkgs/by-name/cl/clifm/package.nix
+++ b/pkgs/by-name/cl/clifm/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "clifm";
-  version = "1.28";
+  version = "1.29";
 
   src = fetchFromGitHub {
     owner = "leo-arch";
     repo = "clifm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-w2hUwyQvGlYrSfpKNkUhs7WHsn+WgBk2t7t9dUOGST4=";
+    hash = "sha256-SOsyKaAYy32FIy4I63NRZJ1RawDAlAub/W9+7AZA1XA=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/co/codex-security/package.nix b/pkgs/by-name/co/codex-security/package.nix
new file mode 100644
index 000000000000..06f85f59a1d4
--- /dev/null
+++ b/pkgs/by-name/co/codex-security/package.nix
@@ -0,0 +1,151 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchurl,
+  fetchPnpmDeps,
+  pnpm_11,
+  nodejs,
+  pnpmConfigHook,
+  makeWrapper,
+  autoPatchelfHook,
+  git,
+  ncurses,
+  python3,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
+  nix-update-script,
+}:
+
+let
+  nativePluginTarget =
+    {
+      aarch64-darwin = "darwin-arm64";
+      aarch64-linux = "linux-arm64-gnu";
+      x86_64-darwin = "darwin-x64";
+      x86_64-linux = "linux-x64-gnu";
+    }
+    .${stdenv.hostPlatform.system};
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "codex-security";
+  version = "0.1.31";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "openai";
+    repo = "codex-security";
+    tag = "npm-v${finalAttrs.version}";
+    hash = "sha256-TA0dxV9VYvvmPU2ZqI5i0XGHaIzNYhqlkLPztZMbtCQ=";
+  };
+
+  npmPackage = fetchurl {
+    url = "https://registry.npmjs.org/@openai/codex-security/-/codex-security-${finalAttrs.version}.tgz";
+    hash = "sha512-XdxIQ+JQH3iysFPW2VdFcKAJJo+M+G4hR9x/KlVimMcbmocDVtQT+trjjfNPqZUdb2ZHrW7HHGepeRhMbMvCHQ==";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/sdk/typescript";
+
+  pnpmDeps = fetchPnpmDeps {
+    inherit (finalAttrs)
+      pname
+      version
+      src
+      sourceRoot
+      ;
+    pnpm = pnpm_11;
+    fetcherVersion = 4;
+    hash = "sha256-7gu3a76l+5XgIbpjr2NFt5Wcp/+LRjUNAaxZ0cW8T8c=";
+  };
+
+  nativeBuildInputs = [
+    nodejs
+    pnpm_11
+    pnpmConfigHook
+    makeWrapper
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ];
+
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    stdenv.cc.cc.lib
+    ncurses
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    pnpm run build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    # Reinstall with only the production dependencies to keep the closure small.
+    rm -rf node_modules
+    pnpm install --force --offline --prod --ignore-scripts --frozen-lockfile
+
+    mkdir -p "$out/lib/codex-security"
+    cp -r bin dist node_modules package.json LICENSE README.md \
+      "$out/lib/codex-security/"
+
+    # The plugin bundle is generated during npm prepack and is not in the source tag.
+    tar --extract --gzip --file=${finalAttrs.npmPackage} \
+      --directory="$out/lib/codex-security" --strip-components=1 \
+      package/_bundled_plugin
+
+    find "$out/lib/codex-security/_bundled_plugin/mcp/native" \
+      -mindepth 1 -maxdepth 1 -type d \
+      ! -name licenses ! -name ${lib.escapeShellArg nativePluginTarget} \
+      -exec rm --recursive --force {} +
+
+    find "$out/lib/codex-security/node_modules" -name "*.android*" -delete
+
+    makeWrapper "${lib.getExe nodejs}" "$out/bin/codex-security" \
+      --add-flags "$out/lib/codex-security/bin/codex-security.mjs" \
+      --prefix PATH : "${
+        lib.makeBinPath [
+          git
+          python3
+        ]
+      }"
+
+    runHook postInstall
+  '';
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
+  ];
+  versionCheckProgramArg = "--version";
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "npm-v(.*)"
+    ];
+  };
+
+  meta = {
+    description = "CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities in your code";
+    homepage = "https://github.com/openai/codex-security";
+    changelog = "https://github.com/openai/codex-security/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ sheeeng ];
+    mainProgram = "codex-security";
+    platforms = [
+      "aarch64-darwin"
+      "aarch64-linux"
+      "x86_64-darwin"
+      "x86_64-linux"
+    ];
+    sourceProvenance = with lib.sourceTypes; [
+      fromSource
+      binaryNativeCode
+    ];
+  };
+})
diff --git a/pkgs/by-name/da/dae/package.nix b/pkgs/by-name/da/dae/package.nix
index 844bd9eea49a..a407f36aa2cb 100644
--- a/pkgs/by-name/da/dae/package.nix
+++ b/pkgs/by-name/da/dae/package.nix
@@ -10,17 +10,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "dae";
-  version = "2.0.0";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "daeuniverse";
     repo = "dae";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hzX3b86BHvxXQZotSteiHoyBMF/P4WubeuJ6xpxa8ac=";
+    hash = "sha256-+Gls/lFhOjzfPisgWS96mEevI0mMtQ139Zf4NIik2X8=";
     fetchSubmodules = true;
   };
 
-  vendorHash = "sha256-S2dNFvMeZqGhzu+sIBGeaET4bQXfeucao6XR4QSTpog=";
+  vendorHash = "sha256-N2noQXRV9Vewie4PiWkjDeX6U2+kF1kQ9L10kZ5X/LI=";
 
   proxyVendor = true;
 
diff --git a/pkgs/by-name/ea/easyrsa/package.nix b/pkgs/by-name/ea/easyrsa/package.nix
index 91d458c54ca3..bb7ea5194629 100644
--- a/pkgs/by-name/ea/easyrsa/package.nix
+++ b/pkgs/by-name/ea/easyrsa/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "easyrsa";
-  version = "3.2.6";
+  version = "3.2.7";
 
   src = fetchFromGitHub {
     owner = "OpenVPN";
     repo = "easy-rsa";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-xzCaUR97kS5pbUCTyV9i4lF59nudPJqnI7T2VkReJko=";
+    hash = "sha256-3uGAFb5nrW+35hdwMoESi3Xu8SIuwZ22B9ZAfyd9MSY=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/es/essh/package.nix b/pkgs/by-name/es/essh/package.nix
index 038d67584121..208719da1055 100644
--- a/pkgs/by-name/es/essh/package.nix
+++ b/pkgs/by-name/es/essh/package.nix
@@ -10,18 +10,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "essh";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "matthart1983";
     repo = "essh";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+NBKATXTaKaXjkVIrXJvYibI/Xbcuh048kuMZShVjo8=";
+    hash = "sha256-amv4//HWf928oKHiZEdhJo4EzeFDCDXSz2fy7PT0CIs=";
   };
 
   __structuredAttrs = true;
 
-  cargoHash = "sha256-IU9TNPJPGT+KgrCTt6tcgLHudNpJeAtus4NAcjaQYAE=";
+  cargoHash = "sha256-DWWzQ4T2FiOy8JzepAgsV0fr73RMSaNuoCDp55vaaJo=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/ev/evcc/package.nix b/pkgs/by-name/ev/evcc/package.nix
index b32e65d09031..dc623113f5ba 100644
--- a/pkgs/by-name/ev/evcc/package.nix
+++ b/pkgs/by-name/ev/evcc/package.nix
@@ -17,13 +17,13 @@
 }:
 
 let
-  version = "0.316.0";
+  version = "0.316.1";
 
   src = fetchFromGitHub {
     owner = "evcc-io";
     repo = "evcc";
     tag = version;
-    hash = "sha256-oIdZ+BInnC9sIEPNNMmxJNvomcNq16CakvoZu3WMa1Q=";
+    hash = "sha256-WGg2XaaPS0zuRp/6hhLytKDZEfcMVmPF2Z0xDiGq8Ks=";
   };
 
   vendorHash = "sha256-X5MnC0lsJkgxa60IzGA2xZ+x81XqFRDmQvKqG+DnWYk=";
diff --git a/pkgs/by-name/fr/framework-tool-tui/package.nix b/pkgs/by-name/fr/framework-tool-tui/package.nix
index e3468a432221..0466dd3684cb 100644
--- a/pkgs/by-name/fr/framework-tool-tui/package.nix
+++ b/pkgs/by-name/fr/framework-tool-tui/package.nix
@@ -7,16 +7,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "framework-tool-tui";
-  version = "0.8.5";
+  version = "0.8.6";
 
   src = fetchFromGitHub {
     owner = "grouzen";
     repo = "framework-tool-tui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-AvxLx3BoAcbL7iekRZwlSA04VdBN3EVZYOCsPfZ9ZFc=";
+    hash = "sha256-8fnpgO6iOkOldh1LWrk7lgLR51lk5vKC1k9/qbrhuC8=";
   };
 
-  cargoHash = "sha256-y+QJ4gKZ17oYxDLnt3UrGRmdEF1OJqzxvsJTKsYNOFw=";
+  cargoHash = "sha256-+Baf6BFb8DtRoVBM/P2pVidiq+BA+tWt0XqKYwsSh7o=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ udev ];
diff --git a/pkgs/by-name/fr/fromager/package.nix b/pkgs/by-name/fr/fromager/package.nix
index a6b9f603f211..d11b51be70e5 100644
--- a/pkgs/by-name/fr/fromager/package.nix
+++ b/pkgs/by-name/fr/fromager/package.nix
@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "fromager";
-  version = "0.95.0";
+  version = "0.97.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "python-wheel-build";
     repo = "fromager";
     tag = finalAttrs.version;
-    hash = "sha256-9+JYWEVfqG8e0OYE0AxTTtGESLTR/xcZhQMsDEuAM34=";
+    hash = "sha256-u+avrDFOWhpPMXjY5ZlAprjinkUxY1nUqbGtndrbMkY=";
   };
 
   build-system = with python3Packages; [
@@ -55,6 +55,15 @@ python3Packages.buildPythonApplication (finalAttrs: {
     writableTmpDirAsHomeHook
   ];
 
+  # Some tests launch ignored background requests to placeholder URLs. Avoid
+  # backoff retries: https://github.com/python-wheel-build/fromager/pull/1348
+  env.FROMAGER_HTTP_RETRIES = 0;
+
+  # Tests share repository directories and race during setup:
+  # https://github.com/python-wheel-build/fromager/pull/1349
+  dontUsePytestXdist = true;
+  pytestFlags = [ "--numprocesses=0" ];
+
   pythonImportsCheck = [
     "fromager"
   ];
diff --git a/pkgs/by-name/gl/glpi-agent/package.nix b/pkgs/by-name/gl/glpi-agent/package.nix
index acba7fdad11d..8b5ec8ead59a 100644
--- a/pkgs/by-name/gl/glpi-agent/package.nix
+++ b/pkgs/by-name/gl/glpi-agent/package.nix
@@ -16,13 +16,13 @@
 
 perlPackages.buildPerlPackage rec {
   pname = "glpi-agent";
-  version = "1.19";
+  version = "1.20";
 
   src = fetchFromGitHub {
     owner = "glpi-project";
     repo = "glpi-agent";
     tag = version;
-    hash = "sha256-KAvGfuHk/B4uDYuZqG9NMCrqWfW04nkTmN4NF5Wr1mw=";
+    hash = "sha256-2q1Isx7wFfAcyhhg4lMLV6cOXpfH+zHI9/E5rba/mSA=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/go/gogup/package.nix b/pkgs/by-name/go/gogup/package.nix
index ab0d76bc81c5..afaa813ef632 100644
--- a/pkgs/by-name/go/gogup/package.nix
+++ b/pkgs/by-name/go/gogup/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gogup";
-  version = "1.9.3";
+  version = "1.10.2";
 
   src = fetchFromGitHub {
     owner = "nao1215";
     repo = "gup";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Y2DjbngL0Xp8oleTfRK7SwcPkE6QmpdzZdwI//IL0Qg=";
+    hash = "sha256-rPIO4MqqVDbf8dtKEvC5fhWnrdeI/QdHq3nQZayGEO0=";
   };
 
-  vendorHash = "sha256-u5fP8nBwtoSAVNI6NBlPpMjCc27oZ9/By6wMxHudgR4=";
+  vendorHash = "sha256-8Y/XBNfo/XgKXrBmOK1+yydTMbdbtUzD1toubS9xC6Q=";
   doCheck = false;
 
   ldflags = [
diff --git a/pkgs/by-name/gv/gvm-libs/package.nix b/pkgs/by-name/gv/gvm-libs/package.nix
index f3741658d495..c3eb06b4e2fc 100644
--- a/pkgs/by-name/gv/gvm-libs/package.nix
+++ b/pkgs/by-name/gv/gvm-libs/package.nix
@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gvm-libs";
-  version = "23.10.1";
+  version = "23.11.0";
 
   src = fetchFromGitHub {
     owner = "greenbone";
     repo = "gvm-libs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-f5pqUrpBEErBOLo0yO0CDNkJunSoF5Fvs0e8cDllBMI=";
+    hash = "sha256-GsZMk5Z0epLtRFfR2duzXgkparu5JMY3uUm8uNnyI9w=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/ia/iaito/package.nix b/pkgs/by-name/ia/iaito/package.nix
index 7afcfb5d4d0d..8229e85d6d45 100644
--- a/pkgs/by-name/ia/iaito/package.nix
+++ b/pkgs/by-name/ia/iaito/package.nix
@@ -8,7 +8,6 @@
   qt6Packages,
   radare2,
   xvfb-run,
-  breakpointHook,
   writableTmpDirAsHomeHook,
   stdenv,
 }:
@@ -50,7 +49,6 @@ stdenv.mkDerivation (finalAttrs: {
     python3
     qt6Packages.qttools
     qt6Packages.wrapQtAppsHook
-    breakpointHook
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/in/intel-oneapi-toolkit/package.nix b/pkgs/by-name/in/intel-oneapi-toolkit/package.nix
index 1d75f25e20fa..ad57f90a5876 100644
--- a/pkgs/by-name/in/intel-oneapi-toolkit/package.nix
+++ b/pkgs/by-name/in/intel-oneapi-toolkit/package.nix
@@ -329,6 +329,7 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [
       balsoft
       kilyanni
+      recutita
     ];
     platforms = [ "x86_64-linux" ];
   };
diff --git a/pkgs/by-name/is/isponsorblocktv/package.nix b/pkgs/by-name/is/isponsorblocktv/package.nix
index 9e8085e18880..541520b16b54 100644
--- a/pkgs/by-name/is/isponsorblocktv/package.nix
+++ b/pkgs/by-name/is/isponsorblocktv/package.nix
@@ -1,5 +1,6 @@
 {
   fetchFromGitHub,
+  fetchpatch,
   lib,
   python3Packages,
 }:
@@ -16,6 +17,14 @@ python3Packages.buildPythonApplication (finalAttrs: {
     hash = "sha256-VbhkSrF18JluKAKqUsFKkjC0jdYsvjFotYr0aJ4BTKs=";
   };
 
+  patches = [
+    # Fix iSponsorBlockTV with async-cache 2.x - https://github.com/dmunozv04/iSponsorBlockTV/pull/505
+    (fetchpatch {
+      url = "https://github.com/lukegb/iSponsorBlockTV/commit/110ce5de788ccb262a323f743543e37af914f7fa.patch";
+      hash = "sha256-AW9VwFBMDKo3pJCNc/r5b8vrqpcL1bV8jUl/z85x+jE=";
+    })
+  ];
+
   build-system = with python3Packages; [
     hatchling
     hatch-requirements-txt
diff --git a/pkgs/by-name/ku/kubernetes-polaris/package.nix b/pkgs/by-name/ku/kubernetes-polaris/package.nix
index 5ab1d74f6189..dd88cd04f856 100644
--- a/pkgs/by-name/ku/kubernetes-polaris/package.nix
+++ b/pkgs/by-name/ku/kubernetes-polaris/package.nix
@@ -1,23 +1,23 @@
 {
   lib,
   stdenv,
-  buildGoModule,
+  buildGo127Module,
   fetchFromGitHub,
   installShellFiles,
 }:
 
-buildGoModule (finalAttrs: {
+buildGo127Module (finalAttrs: {
   pname = "kubernetes-polaris";
-  version = "10.1.7";
+  version = "10.2.5";
 
   src = fetchFromGitHub {
     owner = "FairwindsOps";
     repo = "polaris";
-    rev = finalAttrs.version;
-    sha256 = "sha256-0uz5Q7RvPTDIo6R6YIsK2jr1UIq1OJN0+IjyWciyA28=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-SY7w7ltpoQNEA76ONqSSsDmkcK5s82NIpB/g3DQoCqs=";
   };
 
-  vendorHash = "sha256-M+/Jtw+SiLY+G3UKtRCFX1j6tH35FIQMX33YgacJAec=";
+  vendorHash = "sha256-MRNqMINPdc1ifhl6fiLb6sO34m50/QsBrCEjy8CiMdA=";
 
   nativeBuildInputs = [ installShellFiles ];
 
@@ -28,6 +28,11 @@ buildGoModule (finalAttrs: {
     "-X main.Commit=${finalAttrs.version}"
   ];
 
+  # These tests don't work in the build sandbox.
+  checkFlags = lib.optionals stdenv.hostPlatform.isDarwin [
+    "-skip=^TestConfig(FromURL|NoServerError)$"
+  ];
+
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd polaris \
       --bash <($out/bin/polaris completion bash) \
diff --git a/pkgs/by-name/li/librice/package.nix b/pkgs/by-name/li/librice/package.nix
index 464ccad81ed0..a4028f2e0195 100644
--- a/pkgs/by-name/li/librice/package.nix
+++ b/pkgs/by-name/li/librice/package.nix
@@ -11,22 +11,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "librice";
-  # Cannot bump to 0.4.0 because it breaks webkitgtk_4_1's enableExperimental build.
-  # /build/webkitgtk-2.52.1/Source/WebCore/platform/rice/GRefPtrRice.h:34:47: error: use of undeclared identifier 'rice_turn_config_ref'; did you mean 'rice_turn_config_free'?
-  # 34 | WTF_DEFINE_GREF_TRAITS_INLINE(RiceTurnConfig, rice_turn_config_ref, rice_turn_config_unref)
-  #    |                                               ^~~~~~~~~~~~~~~~~~~~
-  #    |                                               rice_turn_config_free
-  # Unpin when https://gitlab.gnome.org/GNOME/gnome-build-meta/-/blob/gnome-50/elements/sdk/librice.bst moves to newer version.
-  version = "0.3.0";
+  # Update when https://gitlab.gnome.org/GNOME/gnome-build-meta/-/blob/gnome-50/elements/sdk/librice.bst moves to newer version.
+  version = "0.4.3";
 
   src = fetchFromGitHub {
     owner = "ystreet";
     repo = "librice";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CM+YoeVdWfnT/RjkHP0ILwMOkFEylFaN83B71r+S5Ik=";
+    hash = "sha256-VBbqRBzRifXtDUuvoOEwzvkyqgWSH+pw309uQiUzQsI=";
   };
 
-  cargoHash = "sha256-GNqzAFAnOYP5tCE4qb9F9XAlinX1xV4QyBWJjqXb5VE=";
+  cargoHash = "sha256-lrg21Bd+xK3xDGBjVUD+Q5m/EBIXe5po2TBsOenY8vE=";
 
   nativeBuildInputs = [
     cargo-c
diff --git a/pkgs/by-name/mi/microcode-intel/package.nix b/pkgs/by-name/mi/microcode-intel/package.nix
index 1adb9b442f38..9ce24a7edb98 100644
--- a/pkgs/by-name/mi/microcode-intel/package.nix
+++ b/pkgs/by-name/mi/microcode-intel/package.nix
@@ -9,7 +9,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "microcode-intel";
-  version = "20260812";
+  version = "20260925";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -18,7 +18,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     owner = "intel";
     repo = "Intel-Linux-Processor-Microcode-Data-Files";
     tag = "microcode-${finalAttrs.version}";
-    hash = "sha256-Rw40SNaVSnGenRIkuspVzsFXt17GxPUTsRP86aMI4RM=";
+    hash = "sha256-FR3MB7lA6gaJD/cbTTOxqrQaksr9jXpowtmuFWaHoTs=";
   };
 
   nativeBuildInputs = [ libarchive ];
diff --git a/pkgs/by-name/mu/muso/package.nix b/pkgs/by-name/mu/muso/package.nix
index 727f2725624e..3f2d0b70b91a 100644
--- a/pkgs/by-name/mu/muso/package.nix
+++ b/pkgs/by-name/mu/muso/package.nix
@@ -9,7 +9,9 @@
 
 rustPlatform.buildRustPackage {
   pname = "muso";
-  version = "unstable-2021-09-02";
+  version = "2.0.0-unstable-2021-09-02";
+
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "quebin31";
diff --git a/pkgs/by-name/ne/nest-cli/package.nix b/pkgs/by-name/ne/nest-cli/package.nix
index 66aebff89310..af4d887d4094 100644
--- a/pkgs/by-name/ne/nest-cli/package.nix
+++ b/pkgs/by-name/ne/nest-cli/package.nix
@@ -9,16 +9,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "nest-cli";
-  version = "12.0.3";
+  version = "12.0.7";
 
   src = fetchFromGitHub {
     owner = "nestjs";
     repo = "nest-cli";
     tag = finalAttrs.version;
-    hash = "sha256-cy1fXc0ZUtIRlFRJfsK2Sols9CPQIJ39Kf+1wgIJH+Q=";
+    hash = "sha256-bR4+0i3Cck29Y9i3l43i5oh76A2N0GbGg1xw8ZekVqk=";
   };
 
-  npmDepsHash = "sha256-gyRquPh4lOicS73J9WkWZ1NTbDndaU4yYDgpiDqkKug=";
+  npmDepsHash = "sha256-UY4hpx1BxqcNtwfNNPqV1r5+OE7JsL142eOMrxPnSQI=";
   npmFlags = [ "--legacy-peer-deps" ];
 
   env = {
diff --git a/pkgs/by-name/no/noctalia-greeter/package.nix b/pkgs/by-name/no/noctalia-greeter/package.nix
index d3951e5f4394..474c37db2488 100644
--- a/pkgs/by-name/no/noctalia-greeter/package.nix
+++ b/pkgs/by-name/no/noctalia-greeter/package.nix
@@ -32,7 +32,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "noctalia-greeter";
-  version = "1.5.0";
+  version = "1.6.0";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "noctalia-dev";
     repo = "noctalia-greeter";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JgPgbmlUOKlgCX/KDfRF+z9ID80+Q7CcdaJFh5eaFjU=";
+    hash = "sha256-agpHRmhsUL4ZNFseCNilGSiC/cc0S2tC1ZvC5rXmgtY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/no/noctalia/package.nix b/pkgs/by-name/no/noctalia/package.nix
index 44956da4b8ff..0071d6b1d0af 100644
--- a/pkgs/by-name/no/noctalia/package.nix
+++ b/pkgs/by-name/no/noctalia/package.nix
@@ -56,13 +56,13 @@ stdenv.mkDerivation (finalAttrs: {
   __structuredAttrs = true;
 
   pname = "noctalia";
-  version = "5.1.0";
+  version = "5.2.0";
 
   src = fetchFromGitHub {
     owner = "noctalia-dev";
     repo = "noctalia";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-A7ehoEnAJw4k1Qwpr/WkOkLXWZAVU970uB+sm6nBxP0=";
+    hash = "sha256-RfRxWi9PfJVSyoLrLj5mQ5vo24FjkgfBIi+UmE96zZo=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/ol/olympus-unwrapped/package.nix b/pkgs/by-name/ol/olympus-unwrapped/package.nix
index f28947dc0e8c..bc6eb851361b 100644
--- a/pkgs/by-name/ol/olympus-unwrapped/package.nix
+++ b/pkgs/by-name/ol/olympus-unwrapped/package.nix
@@ -22,9 +22,9 @@ let
 
   phome = "$out/lib/olympus";
   # The following variables are to be updated by the update script.
-  version = "26.09.15.05";
-  buildId = "5878"; # IMPORTANT: This line is matched with regex in update.sh.
-  rev = "2472132ac23a30701c1eb928dbd95858113ded25";
+  version = "26.09.27.01";
+  buildId = "5915"; # IMPORTANT: This line is matched with regex in update.sh.
+  rev = "1c0163a5b03708cee1fc5d53d5e9869ad9e14f22";
 in
 buildDotnetModule {
   pname = "olympus-unwrapped";
@@ -37,7 +37,7 @@ buildDotnetModule {
     owner = "EverestAPI";
     repo = "Olympus";
     fetchSubmodules = true; # Required. See upstream's README.
-    hash = "sha256-pQjRiVVpF2J7qR6BfvdC/jkHGVcUJsXmq1tUTs7GmmY=";
+    hash = "sha256-fVyhX2A/aBDUq/jdkkocM5XkLBk12ZoBrMKDOOzL+/0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pd/pdfid/package.nix b/pkgs/by-name/pd/pdfid/package.nix
index 67d233a12a47..8486a9814095 100644
--- a/pkgs/by-name/pd/pdfid/package.nix
+++ b/pkgs/by-name/pd/pdfid/package.nix
@@ -38,7 +38,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     homepage = "https://blog.didierstevens.com/programs/pdf-tools/";
     license = lib.licenses.free;
     mainProgram = "pdfid";
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ eljamm ];
     platforms = lib.platforms.unix;
   };
 })
diff --git a/pkgs/by-name/po/podman-desktop/package.nix b/pkgs/by-name/po/podman-desktop/package.nix
index 052d934c2a54..11432d1c8e9a 100644
--- a/pkgs/by-name/po/podman-desktop/package.nix
+++ b/pkgs/by-name/po/podman-desktop/package.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
   version = "1.29.3";
 
   passthru.updateScript = _experimental-update-script-combinators.sequence [
-    (nix-update-script { })
+    (nix-update-script { extraArgs = [ "--use-github-releases" ]; })
     (lib.getExe (writeShellApplication {
       name = "podman-desktop-dependencies-updater";
       runtimeInputs = [
diff --git a/pkgs/by-name/ra/radicle-explorer/package.nix b/pkgs/by-name/ra/radicle-explorer/package.nix
index 1107a148070b..237d8771692e 100644
--- a/pkgs/by-name/ra/radicle-explorer/package.nix
+++ b/pkgs/by-name/ra/radicle-explorer/package.nix
@@ -10,13 +10,13 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "radicle-explorer";
-  version = "0-unstable-2026-09-14";
+  version = "0-unstable-2026-09-25";
 
   src = fetchFromRadicle {
     seed = "seed.radicle.dev";
     repo = "z4V1sjrXqjvFdnCUbxPFqd5p4DtH5";
-    rev = "f1ee718886061b90fac69c53000613eeccbab09f";
-    hash = "sha256-BeZ5xtJVkoSXYggiT/tmJPUcPQoQMQg2FkCkuQvHZC0=";
+    rev = "00f079d0d9fb4828e570bc568ffde1dcd43ebb25";
+    hash = "sha256-+tODL7EpQ765GqlOYVFGx48+iclK/1rwUnXzfqTy7z8=";
   };
 
   npmDepsHash = "sha256-Bwlrh4DivqWhxuHcbJGJtatsGRI0V8BwTT3RtqoJ7lU=";
diff --git a/pkgs/by-name/ra/ramalama/package.nix b/pkgs/by-name/ra/ramalama/package.nix
index 87396ca35f70..4deb67ba3bcd 100644
--- a/pkgs/by-name/ra/ramalama/package.nix
+++ b/pkgs/by-name/ra/ramalama/package.nix
@@ -17,14 +17,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "ramalama";
-  version = "0.22.0";
+  version = "0.25.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "ramalama";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-k3VfZ9+ATu2Cwx531D0WVagjn1ZMIKR1i3yyq+3IGJ4=";
+    hash = "sha256-AwlB2JeOMFCXoIovqfr9nhy36QWC2m42kHFIGg4dJFo=";
   };
 
   build-system = with python3Packages; [
@@ -77,6 +77,8 @@ python3Packages.buildPythonApplication (finalAttrs: {
     writableTmpDirAsHomeHook
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   preCheck = ''
     export PATH="$out/bin:$PATH"
   '';
diff --git a/pkgs/by-name/ra/ramalama/tests/podman-images.json b/pkgs/by-name/ra/ramalama/tests/podman-images.json
index f9fc27251a61..4d83358b30f7 100644
--- a/pkgs/by-name/ra/ramalama/tests/podman-images.json
+++ b/pkgs/by-name/ra/ramalama/tests/podman-images.json
@@ -1,15 +1,15 @@
 {
   "imageName": "quay.io/ramalama/ramalama",
-  "imageTag": "0.22",
-  "imageDigest": "sha256:01f652adb2d7bed7c3eb960ee3fe1dc9b6addff003ed58932048cee01db78302",
+  "imageTag": "0.25",
+  "imageDigest": "sha256:d60dfda3113e127071d2b2679921c763d0eb7a0733596f68bf93a4ef1ca1216e",
   "images": {
     "x86_64-linux": {
       "arch": "amd64",
-      "hash": "sha256-Llykx761YUa50nsckZELxNSbjeDxBElWWshT7KQd5pE="
+      "hash": "sha256-CCEvlPHwq4R/gDDJGZS43rU1aEJojutatigGx1KMcSM="
     },
     "aarch64-linux": {
       "arch": "arm64",
-      "hash": "sha256-9It9EuYxmZ2UThQYr9FD63C/uBVS1ufP7bnZeA9psqI="
+      "hash": "sha256-lHe+3SDmAcdgZf42JIX+eTv3aJRcwepdz1qhKqr93Ng="
     }
   }
 }
diff --git a/pkgs/by-name/rn/rnm/package.nix b/pkgs/by-name/rn/rnm/package.nix
index 23f69f186ba8..b8dcd5b7457d 100644
--- a/pkgs/by-name/rn/rnm/package.nix
+++ b/pkgs/by-name/rn/rnm/package.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   meta = {
-    homepage = "https://neurobin.org/projects/softwares/unix/rnm/";
+    homepage = "https://github.com/neurobin/rnm";
     description = "Bulk rename utility";
     changelog = "https://github.com/neurobin/rnm/blob/${finalAttrs.version}/ChangeLog";
     platforms = lib.platforms.all;
diff --git a/pkgs/by-name/ru/ruri/package.nix b/pkgs/by-name/ru/ruri/package.nix
index d9908eab4453..b020df5e0176 100644
--- a/pkgs/by-name/ru/ruri/package.nix
+++ b/pkgs/by-name/ru/ruri/package.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Self-contained Linux container implementation";
-    homepage = "https://wiki.crack.moe/ruri";
+    homepage = "https://ruri.zip";
     downloadPage = "https://github.com/RuriOSS/ruri";
     changelog = "https://github.com/RuriOSS/ruri/releases/tag/${finalAttrs.src.tag}";
     mainProgram = "ruri";
diff --git a/pkgs/by-name/sc/scipopt-gcg/package.nix b/pkgs/by-name/sc/scipopt-gcg/package.nix
index d484f66315fe..8b90f53c481d 100644
--- a/pkgs/by-name/sc/scipopt-gcg/package.nix
+++ b/pkgs/by-name/sc/scipopt-gcg/package.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
     changelog = "https://gcg.or.rwth-aachen.de/doc-3.5.0/RN${lib.versions.major version}${lib.versions.minor version}.html";
     description = "Branch-and-Price & Column Generation for Everyone";
     license = lib.licenses.lgpl3Plus;
-    homepage = "https://gcg.zib.de";
+    homepage = "https://gcg.or.rwth-aachen.de";
     mainProgram = "gcg";
   };
 }
diff --git a/pkgs/by-name/se/seamly2d/package.nix b/pkgs/by-name/se/seamly2d/package.nix
index 1084c0b480b5..88c4c1a12b21 100644
--- a/pkgs/by-name/se/seamly2d/package.nix
+++ b/pkgs/by-name/se/seamly2d/package.nix
@@ -81,7 +81,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Open source patternmaking software";
-    homepage = "https://seamly.net/";
+    homepage = "https://seamly.io/";
     license = lib.licenses.gpl3;
     platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [ WhittlesJr ];
diff --git a/pkgs/by-name/se/selinux-python/package.nix b/pkgs/by-name/se/selinux-python/package.nix
index 168c10ad62a4..e40c121ddb9d 100644
--- a/pkgs/by-name/se/selinux-python/package.nix
+++ b/pkgs/by-name/se/selinux-python/package.nix
@@ -105,7 +105,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "SELinux policy core utilities written in Python";
     license = lib.licenses.gpl2Plus;
-    homepage = "https://selinuxproject.org";
+    homepage = "https://github.com/SELinuxProject/selinux";
     inherit (libsepol.meta) maintainers;
     platforms = lib.platforms.linux;
   };
diff --git a/pkgs/by-name/se/selinux-sandbox/package.nix b/pkgs/by-name/se/selinux-sandbox/package.nix
index 72dd5ea60172..1fcd25e74235 100644
--- a/pkgs/by-name/se/selinux-sandbox/package.nix
+++ b/pkgs/by-name/se/selinux-sandbox/package.nix
@@ -100,7 +100,7 @@ stdenv.mkDerivation (finalAttrs: {
     mainProgram = "sandbox";
     description = "SELinux sandbox utility";
     license = lib.licenses.gpl2Only;
-    homepage = "https://selinuxproject.org";
+    homepage = "https://github.com/SELinuxProject/selinux";
     platforms = lib.platforms.linux;
     inherit (selinux-python.meta) maintainers;
   };
diff --git a/pkgs/by-name/se/sequelpro/package.nix b/pkgs/by-name/se/sequelpro/package.nix
index 8ded5e56349a..ac602b82d48f 100644
--- a/pkgs/by-name/se/sequelpro/package.nix
+++ b/pkgs/by-name/se/sequelpro/package.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "MySQL database management for macOS";
-    homepage = "http://www.sequelpro.com/";
+    homepage = "https://github.com/sequelpro/sequelpro";
     license = lib.licenses.mit;
     platforms = lib.platforms.darwin;
   };
diff --git a/pkgs/by-name/sh/shc/package.nix b/pkgs/by-name/sh/shc/package.nix
index bc2c656e4911..fb4149e86cda 100644
--- a/pkgs/by-name/sh/shc/package.nix
+++ b/pkgs/by-name/sh/shc/package.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = {
-    homepage = "https://neurobin.org/projects/softwares/unix/shc/";
+    homepage = "https://github.com/neurobin/shc";
     description = "Shell Script Compiler";
     mainProgram = "shc";
     platforms = lib.platforms.all;
diff --git a/pkgs/by-name/si/sigal/package.nix b/pkgs/by-name/si/sigal/package.nix
index bbff6c991b0e..e47435629112 100644
--- a/pkgs/by-name/si/sigal/package.nix
+++ b/pkgs/by-name/si/sigal/package.nix
@@ -54,7 +54,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
   meta = {
     description = "Yet another simple static gallery generator";
     mainProgram = "sigal";
-    homepage = "http://sigal.saimon.org/";
+    homepage = "https://sigal.readthedocs.io";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       matthiasbeyer
diff --git a/pkgs/by-name/si/signify/package.nix b/pkgs/by-name/si/signify/package.nix
index 22c68623fbd5..d7c290685fba 100644
--- a/pkgs/by-name/si/signify/package.nix
+++ b/pkgs/by-name/si/signify/package.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
       OpenBSDs signing tool, which uses the Ed25519 public key signature system
       for fast signing and verification of messages using small public keys.
     '';
-    homepage = "https://www.tedunangst.com/flak/post/signify";
+    homepage = "https://codeberg.org/aperezdc/signify";
     license = lib.licenses.isc;
     maintainers = [ lib.maintainers.rlupton20 ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/sk/skills/package.nix b/pkgs/by-name/sk/skills/package.nix
index 99d42142a66c..de29b7ed3d43 100644
--- a/pkgs/by-name/sk/skills/package.nix
+++ b/pkgs/by-name/sk/skills/package.nix
@@ -14,13 +14,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "skills";
-  version = "1.6.0";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "vercel-labs";
     repo = "skills";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-nbRboP1tM7Jf0XcBgusg+7oPe9IwWwjRdqVO+cPagxs=";
+    hash = "sha256-/B2el3+KYXohGCM4JaHl2EUx1c6mlYdUNrWiE0z/7lA=";
   };
 
   pnpmDeps = fetchPnpmDeps {
diff --git a/pkgs/by-name/so/soju/package.nix b/pkgs/by-name/so/soju/package.nix
index e10d3ee9d61b..2e10d75e20ab 100644
--- a/pkgs/by-name/so/soju/package.nix
+++ b/pkgs/by-name/so/soju/package.nix
@@ -12,13 +12,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "soju";
-  version = "0.11.0";
+  version = "0.11.1";
 
   src = fetchFromCodeberg {
     owner = "emersion";
     repo = "soju";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pen7Lb/aUWY67Y8KBCGfBkG1pX3sdQ8+D9L7xw8afaQ=";
+    hash = "sha256-OoFAdHnExm6Li5bTAmS/KdRkkpHPLP321GAYYqByrNI=";
   };
 
   vendorHash = "sha256-LiTr+ilKYRA3K93RjVGsmWm2jvImmt9YIYTZPtXv6cE=";
diff --git a/pkgs/by-name/so/soundfont-fluid/package.nix b/pkgs/by-name/so/soundfont-fluid/package.nix
index f128f2522801..65fb2750e9b3 100644
--- a/pkgs/by-name/so/soundfont-fluid/package.nix
+++ b/pkgs/by-name/so/soundfont-fluid/package.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Frank Wen's pro-quality GM/GS soundfont";
-    homepage = "http://www.hammersound.net/";
+    homepage = "https://www.ibiblio.org/thammer/HammerSound/hs_frontpage.html";
     license = lib.licenses.mit;
     platforms = lib.platforms.all;
     maintainers = [ ];
diff --git a/pkgs/by-name/so/source-han-code-jp/package.nix b/pkgs/by-name/so/source-han-code-jp/package.nix
index 6417ee01db21..d2c2bce4a824 100644
--- a/pkgs/by-name/so/source-han-code-jp/package.nix
+++ b/pkgs/by-name/so/source-han-code-jp/package.nix
@@ -25,7 +25,7 @@ stdenvNoCC.mkDerivation rec {
     description = "Monospaced Latin font suitable for coding";
     maintainers = with lib.maintainers; [ mt-caret ];
     platforms = with lib.platforms; all;
-    homepage = "https://blogs.adobe.com/CCJKType/2015/06/source-han-code-jp.html";
+    homepage = "https://ccjktype.fonts.adobe.com/2015/06/source-han-code-jp.html";
     license = lib.licenses.ofl;
   };
 }
diff --git a/pkgs/by-name/sp/spatial-shell/package.nix b/pkgs/by-name/sp/spatial-shell/package.nix
index 1147698930ec..bf89a5f29948 100644
--- a/pkgs/by-name/sp/spatial-shell/package.nix
+++ b/pkgs/by-name/sp/spatial-shell/package.nix
@@ -28,7 +28,7 @@ ocamlPackages.buildDunePackage rec {
 
   meta = {
     description = "Implementing a spatial model inspired by Material Shell, for i3 and sway";
-    homepage = "https://spatial-shell.app";
+    homepage = "https://github.com/lthms/spatial-shell";
     changelog = "https://github.com/lthms/spatial-shell/blob/${src.rev}/CHANGES.md";
     license = lib.licenses.mpl20;
     maintainers = with lib.maintainers; [ fgaz ];
diff --git a/pkgs/by-name/ss/ssdeep/package.nix b/pkgs/by-name/ss/ssdeep/package.nix
index 00f7c0e87487..c30f3ed87a05 100644
--- a/pkgs/by-name/ss/ssdeep/package.nix
+++ b/pkgs/by-name/ss/ssdeep/package.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Program for calculating fuzzy hashes";
     mainProgram = "ssdeep";
-    homepage = "http://www.ssdeep.sf.net";
+    homepage = "https://ssdeep-project.github.io/ssdeep/index.html";
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.unix;
     maintainers = [ lib.maintainers.thoughtpolice ];
diff --git a/pkgs/by-name/st/streamlink/package.nix b/pkgs/by-name/st/streamlink/package.nix
index 3d97ad75639b..d265da0ceda0 100644
--- a/pkgs/by-name/st/streamlink/package.nix
+++ b/pkgs/by-name/st/streamlink/package.nix
@@ -11,12 +11,12 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "streamlink";
-  version = "8.6.0";
+  version = "8.6.1";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-lNp9AXalVh5FUYN24LGQe1lfecfuifMb/fsp2squjoA=";
+    hash = "sha256-Kbp27W1pE8nmm8cw/FhLWBsoYAIq8YZhodCMja7gNkI=";
   };
 
   patches = [
diff --git a/pkgs/by-name/sw/swh_lv2/package.nix b/pkgs/by-name/sw/swh_lv2/package.nix
index b8d6427ccfbe..a9588df4f712 100644
--- a/pkgs/by-name/sw/swh_lv2/package.nix
+++ b/pkgs/by-name/sw/swh_lv2/package.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
   installPhase = "make install-system";
 
   meta = {
-    homepage = "http://plugin.org.uk";
+    homepage = "https://github.com/swh/lv2";
     description = "LV2 version of Steve Harris' SWH plugins";
     longDescription = ''
       SWH plugins include:
diff --git a/pkgs/by-name/sw/swift-quit/package.nix b/pkgs/by-name/sw/swift-quit/package.nix
index d66cad90aa6e..cf694d6207a3 100644
--- a/pkgs/by-name/sw/swift-quit/package.nix
+++ b/pkgs/by-name/sw/swift-quit/package.nix
@@ -27,7 +27,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Automatic quitting of macOS apps when closing their windows";
-    homepage = "https://swiftquit.com/";
+    homepage = "https://github.com/onebadidea/swiftquit";
     license = lib.licenses.gpl3;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     maintainers = with lib.maintainers; [ Enzime ];
diff --git a/pkgs/by-name/sy/sympa/package.nix b/pkgs/by-name/sy/sympa/package.nix
index eee7f173fb12..dac375f0bee4 100644
--- a/pkgs/by-name/sy/sympa/package.nix
+++ b/pkgs/by-name/sy/sympa/package.nix
@@ -122,7 +122,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Open source mailing list manager";
-    homepage = "https://www.sympa.org";
+    homepage = "https://www.sympa.community/sympa/";
     license = lib.licenses.gpl2Plus;
     maintainers = with lib.maintainers; [
       sorki
diff --git a/pkgs/by-name/t-/t-rex/package.nix b/pkgs/by-name/t-/t-rex/package.nix
index b202a5e52763..62dfe3aa4491 100644
--- a/pkgs/by-name/t-/t-rex/package.nix
+++ b/pkgs/by-name/t-/t-rex/package.nix
@@ -32,7 +32,7 @@ rustPlatform.buildRustPackage rec {
 
   meta = {
     description = "Vector tile server specialized on publishing MVT tiles";
-    homepage = "https://t-rex.tileserver.ch/";
+    homepage = "https://t-rex.bbox.earth/";
     changelog = "https://github.com/t-rex-tileserver/t-rex/blob/v${version}/CHANGELOG.md";
     license = lib.licenses.mit;
     teams = [ lib.teams.geospatial ];
diff --git a/pkgs/by-name/tb/tbox/package.nix b/pkgs/by-name/tb/tbox/package.nix
index a9295eee79e3..a402f05ca4b6 100644
--- a/pkgs/by-name/tb/tbox/package.nix
+++ b/pkgs/by-name/tb/tbox/package.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Glib-like multi-platform c library";
-    homepage = "https://docs.tboox.org";
+    homepage = "https://tboox.top";
     license = lib.licenses.asl20;
     platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [ wineee ];
diff --git a/pkgs/by-name/tr/trealla/package.nix b/pkgs/by-name/tr/trealla/package.nix
index 4ad453b8cb29..74d3398b2639 100644
--- a/pkgs/by-name/tr/trealla/package.nix
+++ b/pkgs/by-name/tr/trealla/package.nix
@@ -24,13 +24,13 @@ assert lib.elem lineEditingLibrary [
 ];
 stdenv.mkDerivation (finalAttrs: {
   pname = "trealla";
-  version = "3.10.3";
+  version = "3.11.4";
 
   src = fetchFromGitHub {
     owner = "trealla-prolog";
     repo = "trealla";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-QWjFbBnIHBTplx2nmD5mGL1bfhUy5o2T4izAPeiy2XE=";
+    hash = "sha256-67VZDwwRieFhxw0/9mkFkqWR79Nm70C0LJTvtLbGcik=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/tr/trufflehog/package.nix b/pkgs/by-name/tr/trufflehog/package.nix
index 57060c3c0a47..5dc67bbb4e7d 100644
--- a/pkgs/by-name/tr/trufflehog/package.nix
+++ b/pkgs/by-name/tr/trufflehog/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "trufflehog";
-  version = "3.97.5";
+  version = "3.97.9";
 
   src = fetchFromGitHub {
     owner = "trufflesecurity";
     repo = "trufflehog";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zlB41Jv+Ypzl2Hm8jYn15KdC2ZzoWuspIodo2++nqag=";
+    hash = "sha256-SpKBUoaP7ZoNzybFL9EUcywV0bkx+bSFNyhyBCqwz5Y=";
   };
 
-  vendorHash = "sha256-5KvlWAa1ZYQ9R29ZsVLLWdTvlMC9rnOpMEKP9kXehLc=";
+  vendorHash = "sha256-JfymijrnTsoHqrltauqFU/ccPGjySEufkS9LoymCGuQ=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/by-name/um/umap/package.nix b/pkgs/by-name/um/umap/package.nix
index 51bc507df87a..ca8c897b3a8f 100644
--- a/pkgs/by-name/um/umap/package.nix
+++ b/pkgs/by-name/um/umap/package.nix
@@ -19,7 +19,7 @@ let
 in
 python.pkgs.buildPythonApplication (finalAttrs: {
   pname = "umap";
-  version = "3.7.3";
+  version = "3.8.1";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -28,7 +28,7 @@ python.pkgs.buildPythonApplication (finalAttrs: {
     owner = "umap-project";
     repo = "umap";
     tag = finalAttrs.version;
-    hash = "sha256-rM1o83/udkqiVD0nSiAjNVAzriJr2ztvSXh45wxmYzU=";
+    hash = "sha256-uhWa8CqNjqUAaPALWq6YiOFHahNmw4AVQWhAyfs18CU=";
   };
 
   build-system = [
@@ -43,6 +43,7 @@ python.pkgs.buildPythonApplication (finalAttrs: {
       django-environ
       django-probes
       django-storages
+      httpx
       pillow
       psycopg
       pydantic
@@ -95,6 +96,7 @@ python.pkgs.buildPythonApplication (finalAttrs: {
     with python.pkgs;
     [
       pytest
+      pytest-asyncio
       pytest-django
       pytest-playwright
       pytest-xdist
@@ -122,10 +124,22 @@ python.pkgs.buildPythonApplication (finalAttrs: {
   ];
 
   disabledTests = [
-    # The proxy_request tests require network
+    # Needs network: umap.utils.validate_url resolves the target hostname to
+    # reject private IPs, so every AjaxProxy test fails DNS in the sandbox.
     "proxy_request_with"
-    "test_good_request_passes"
     "test_valid_proxy_request"
+    "test_invalid_ttl_is_coerced_to_default"
+    "test_proxy_caches_response"
+    "test_proxy_clears_stale_semaphore"
+    "test_proxy_does_not_cache_upstream_error"
+    "test_proxy_falls_back_when_no_content_type"
+    "test_proxy_fast_path_ignores_held_semaphore"
+    "test_proxy_long_url_does_not_exceed_filename_limit"
+    "test_proxy_long_urls_with_common_prefix_do_not_collide"
+    "test_proxy_sets_nosniff"
+    "test_proxy_tolerates_raw_spaces_in_url"
+    # Needs network: fetches a real URL
+    "test_good_request_passes"
   ];
 
   meta = {
diff --git a/pkgs/by-name/us/user-scanner/package.nix b/pkgs/by-name/us/user-scanner/package.nix
index 272fc0a16ada..3df38582d538 100644
--- a/pkgs/by-name/us/user-scanner/package.nix
+++ b/pkgs/by-name/us/user-scanner/package.nix
@@ -8,7 +8,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "user-scanner";
-  version = "1.5.1";
+  version = "1.5.2";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -17,7 +17,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "kaifcodec";
     repo = "user-scanner";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lBVKCIpvdYRz80BoaSbFcizs2tLEWankcLeOqu9u4iM=";
+    hash = "sha256-Jg40VMWEL7dW67M45S35phiVHygZUxcM9CmIT7WWdDY=";
   };
 
   build-system = with python3Packages; [ flit-core ];
diff --git a/pkgs/by-name/xp/xpra/package.nix b/pkgs/by-name/xp/xpra/package.nix
index 0abf548e580a..4ec43d2f9c31 100644
--- a/pkgs/by-name/xp/xpra/package.nix
+++ b/pkgs/by-name/xp/xpra/package.nix
@@ -104,14 +104,14 @@ let
 in
 effectiveBuildPythonApplication rec {
   pname = "xpra";
-  version = "6.5.3";
+  version = "6.5.4";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "Xpra-org";
     repo = "xpra";
     tag = "v${version}";
-    hash = "sha256-UDKnkynWoS1feUBRRHXl7emksUmufBL16gmVFslMHpM=";
+    hash = "sha256-OXcZs2bt+ub59buDkw56A3gfOnDHSYP7RBAFOBvwrKY=";
   };
 
   patches = [
diff --git a/pkgs/development/interpreters/supercollider/default.nix b/pkgs/development/interpreters/supercollider/default.nix
index 6b73cdf7f5f3..a61dadb5f49e 100644
--- a/pkgs/development/interpreters/supercollider/default.nix
+++ b/pkgs/development/interpreters/supercollider/default.nix
@@ -21,7 +21,6 @@
   gitUpdater,
   supercollider-with-plugins,
   supercolliderPlugins,
-  writeText,
   runCommand,
 }:
 
@@ -87,25 +86,29 @@ stdenv.mkDerivation rec {
     };
 
     tests = {
-      # test to make sure sclang runs and included plugins are successfully found
+      # Check both language classes and server UGens, without an audio device.
       sclang-sc3-plugins =
         let
           supercollider-with-test-plugins = supercollider-with-plugins.override {
             plugins = with supercolliderPlugins; [ sc3-plugins ];
           };
-          testsc = writeText "test.sc" ''
-            var err = 0;
-            try {
-            MdaPiano.name.postln;
-            } {
-            err = 1;
-            };
-            err.exit;
-          '';
         in
-        runCommand "sclang-sc3-plugins-test" { } ''
-          timeout 60s env XDG_CONFIG_HOME="$(mktemp -d)" QT_QPA_PLATFORM=minimal ${supercollider-with-test-plugins}/bin/sclang ${testsc} >$out
-        '';
+        runCommand "sclang-sc3-plugins-test"
+          {
+            QT_QPA_PLATFORM = "offscreen";
+          }
+          ''
+            export XDG_CONFIG_HOME="$TMPDIR/config"
+            export XDG_DATA_HOME="$TMPDIR/data"
+            export XDG_CACHE_HOME="$TMPDIR/cache"
+            mkdir -p "$out"
+            timeout 60s ${supercollider-with-test-plugins}/bin/sclang \
+              ${./tests/sc3-plugins.scd} "$out" 2>&1 | tee "$out/log"
+            grep -Fq 'SC3 plugins rendered successfully' "$out/log"
+            if grep -E 'ERROR|FAILURE|duplicate' "$out/log"; then
+              exit 1
+            fi
+          '';
     };
   };
 
diff --git a/pkgs/development/interpreters/supercollider/tests/sc3-plugins.scd b/pkgs/development/interpreters/supercollider/tests/sc3-plugins.scd
new file mode 100644
index 000000000000..bcd9152e3cf0
--- /dev/null
+++ b/pkgs/development/interpreters/supercollider/tests/sc3-plugins.scd
@@ -0,0 +1,58 @@
+var output = thisProcess.argv[0];
+var definition, score;
+
+try {
+    // Resolve symbols at runtime: an undefined class literal prevents the entire
+    // script (including its error handler and exit) from being compiled.
+    [\MembraneHexagon, \MdaPiano].do { |name|
+        if(name.asClass.isNil) {
+            Error("Missing SC3 class: " ++ name).throw;
+        };
+    };
+
+    definition = SynthDef(\sc3PluginsTest, {
+        // Give each UGen its own output channel so neither can mask a failure.
+        Out.ar(0, \MembraneHexagon.asClass.ar(Impulse.ar(0)));
+        Out.ar(1, \MdaPiano.asClass.ar.sum);
+    });
+    score = Score([
+        [0, [\d_recv, definition.asBytes]],
+        [0, [\s_new, definition.name, 1000, 0, 0]],
+        [1, [\n_free, 1000]]
+    ]);
+
+    score.recordNRT(
+        oscFilePath: output +/+ "score.osc",
+        outputFilePath: output +/+ "sc3.wav",
+        headerFormat: "WAV",
+        sampleFormat: "float",
+        options: ServerOptions.new.numInputBusChannels_(0).numOutputBusChannels_(2),
+        action: { |exitCode|
+            var file, samples;
+            try {
+                if(exitCode != 0) { Error("scsynth exited with " ++ exitCode).throw };
+                file = SoundFile.openRead(output +/+ "sc3.wav");
+                if(file.isNil) { Error("No rendered audio").throw };
+                if(file.numChannels != 2) { Error("Expected two audio channels").throw };
+                if(file.numFrames < 44100) { Error("Incomplete rendered audio").throw };
+                samples = FloatArray.newClear(file.numFrames * file.numChannels);
+                file.readData(samples);
+                file.close;
+                samples.clump(2).flop.do { |channel|
+                    if(channel.any { |sample| sample.isNaN or: { sample.abs == inf } }) {
+                        Error("Invalid SC3 UGen output").throw;
+                    };
+                    if(channel.abs.maxItem <= 0.00001) { Error("Silent SC3 UGen output").throw };
+                };
+                "SC3 plugins rendered successfully".postln;
+                0.exit;
+            } { |error|
+                error.reportError;
+                1.exit;
+            };
+        }
+    );
+} { |error|
+    error.reportError;
+    1.exit;
+};
diff --git a/pkgs/development/interpreters/supercollider/wrapper.nix b/pkgs/development/interpreters/supercollider/wrapper.nix
index 01f3c592ad9b..4eeff4c1c188 100644
--- a/pkgs/development/interpreters/supercollider/wrapper.nix
+++ b/pkgs/development/interpreters/supercollider/wrapper.nix
@@ -1,4 +1,5 @@
 {
+  lib,
   symlinkJoin,
   makeWrapper,
   supercollider,
@@ -12,10 +13,19 @@ symlinkJoin {
   nativeBuildInputs = [ makeWrapper ];
 
   postBuild = ''
+    # --include-path adds to the paths from the user's language configuration,
+    # including an explicit -l configuration (as used by tidal-cycles-full).
+    if [ -d "$out/share/SuperCollider/Extensions" ]; then
+      wrapProgram "$out/bin/sclang" \
+        --add-flags "--include-path $out/share/SuperCollider/Extensions"
+    fi
+
     for exe in $out/bin/*; do
-      wrapProgram $exe \
-        --set SC_PLUGIN_DIR "$out/lib/SuperCollider/plugins" \
-        --set SC_DATA_DIR   "$out/share/SuperCollider"
+      # scide launches sclang, and sclang launches scsynth, through PATH.
+      # The server already loads its core UGens from its compiled-in path.
+      wrapProgram "$exe" \
+        --prefix PATH : "$out/bin" \
+        --prefix SC_PLUGIN_PATH : "${lib.makeSearchPath "lib/SuperCollider/plugins" plugins}"
     done
   '';
 
diff --git a/pkgs/development/interpreters/tcl/generic.nix b/pkgs/development/interpreters/tcl/generic.nix
index 535ac2bd30d0..a44f3ed88e9d 100644
--- a/pkgs/development/interpreters/tcl/generic.nix
+++ b/pkgs/development/interpreters/tcl/generic.nix
@@ -193,7 +193,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Tcl scripting language";
-    homepage = "https://www.tcl.tk/";
+    homepage = "https://www.tcl-lang.org/";
     license = lib.licenses.tcltk;
     platforms = lib.platforms.all;
     mainProgram = "tclsh";
diff --git a/pkgs/development/libraries/tk/generic.nix b/pkgs/development/libraries/tk/generic.nix
index eab95e8e5f3a..27429f06f83f 100644
--- a/pkgs/development/libraries/tk/generic.nix
+++ b/pkgs/development/libraries/tk/generic.nix
@@ -97,7 +97,7 @@ tcl.mkTclDerivation {
 
   meta = {
     description = "Widget toolkit that provides a library of basic elements for building a GUI in many different programming languages";
-    homepage = "https://www.tcl.tk/";
+    homepage = "https://www.tcl-lang.org/";
     license = lib.licenses.tcltk;
     platforms = lib.platforms.all;
     mainProgram = "wish";
diff --git a/pkgs/development/ocaml-modules/apron/default.nix b/pkgs/development/ocaml-modules/apron/default.nix
index a57e4a1007ef..b57476302def 100644
--- a/pkgs/development/ocaml-modules/apron/default.nix
+++ b/pkgs/development/ocaml-modules/apron/default.nix
@@ -60,7 +60,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     license = lib.licenses.lgpl21;
-    homepage = "http://apron.cri.ensmp.fr/library/";
+    homepage = "https://github.com/antoinemine/apron";
     maintainers = [ lib.maintainers.vbgl ];
     description = "Numerical abstract domain library";
     inherit (ocaml.meta) platforms;
diff --git a/pkgs/development/ocaml-modules/ocurl/default.nix b/pkgs/development/ocaml-modules/ocurl/default.nix
index aed74a0360bf..6b760091428d 100644
--- a/pkgs/development/ocaml-modules/ocurl/default.nix
+++ b/pkgs/development/ocaml-modules/ocurl/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "OCaml bindings to libcurl (deprecated)";
     license = lib.licenses.mit;
-    homepage = "http://ygrek.org.ua/p/ocurl/";
+    homepage = "https://ygrek.org/p/ocurl/";
     maintainers = with lib.maintainers; [
       dandellion
       bennofs
diff --git a/pkgs/development/ocaml-modules/piqi-ocaml/default.nix b/pkgs/development/ocaml-modules/piqi-ocaml/default.nix
index cdcde0f4f924..c67cdaf47d47 100644
--- a/pkgs/development/ocaml-modules/piqi-ocaml/default.nix
+++ b/pkgs/development/ocaml-modules/piqi-ocaml/default.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Universal schema language and a collection of tools built around it. These are the ocaml bindings";
-    homepage = "https://piqi.org";
+    homepage = "https://github.com/alavrik/piqi";
     license = lib.licenses.asl20;
     maintainers = [ lib.maintainers.maurer ];
     mainProgram = "piqic-ocaml";
diff --git a/pkgs/development/ocaml-modules/piqi/default.nix b/pkgs/development/ocaml-modules/piqi/default.nix
index 7456581b8971..520e07e5dc37 100644
--- a/pkgs/development/ocaml-modules/piqi/default.nix
+++ b/pkgs/development/ocaml-modules/piqi/default.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
   ];
 
   meta = {
-    homepage = "https://piqi.org";
+    homepage = "https://github.com/alavrik/piqi";
     description = "Universal schema language and a collection of tools built around it";
     license = lib.licenses.asl20;
     maintainers = [ lib.maintainers.maurer ];
diff --git a/pkgs/development/ocaml-modules/sawja/default.nix b/pkgs/development/ocaml-modules/sawja/default.nix
index 197e1627d1ff..0d7409e747ea 100644
--- a/pkgs/development/ocaml-modules/sawja/default.nix
+++ b/pkgs/development/ocaml-modules/sawja/default.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Library written in OCaml, relying on Javalib to provide a high level representation of Java bytecode programs";
-    homepage = "http://sawja.inria.fr/";
+    homepage = "https://github.com/javalib-team/sawja";
     license = lib.licenses.gpl3Plus;
     maintainers = [ lib.maintainers.vbgl ];
     inherit (ocaml.meta) platforms;
diff --git a/pkgs/development/ocaml-modules/sosa/default.nix b/pkgs/development/ocaml-modules/sosa/default.nix
index 9eb2da21118b..2182e1ba4ce6 100644
--- a/pkgs/development/ocaml-modules/sosa/default.nix
+++ b/pkgs/development/ocaml-modules/sosa/default.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
   doCheck = true;
 
   meta = {
-    homepage = "http://www.hammerlab.org/docs/sosa/master/index.html";
+    homepage = "https://github.com/hammerlab/sosa";
     description = "Sane OCaml String API";
     license = lib.licenses.isc;
     maintainers = [ ];
diff --git a/pkgs/development/ocaml-modules/ssl/default.nix b/pkgs/development/ocaml-modules/ssl/default.nix
index 163daa0e66fa..7b86332a77d1 100644
--- a/pkgs/development/ocaml-modules/ssl/default.nix
+++ b/pkgs/development/ocaml-modules/ssl/default.nix
@@ -35,7 +35,7 @@ buildDunePackage rec {
   '';
 
   meta = {
-    homepage = "http://savonet.rastageeks.org/";
+    homepage = "https://www.liquidsoap.info/ocaml-ssl/ssl/index.html";
     description = "OCaml bindings for libssl";
     license = with lib.licenses; [
       lgpl21Plus
diff --git a/pkgs/development/ocaml-modules/xml-light/default.nix b/pkgs/development/ocaml-modules/xml-light/default.nix
index 8d0bf0dd9be2..755aea2c1ab8 100644
--- a/pkgs/development/ocaml-modules/xml-light/default.nix
+++ b/pkgs/development/ocaml-modules/xml-light/default.nix
@@ -25,7 +25,7 @@ buildDunePackage rec {
       entirely written in OCaml, hence it does not require additional C
       library.
     '';
-    homepage = "http://tech.motion-twin.com/xmllight.html";
+    homepage = "https://github.com/ncannasse/xml-light";
     license = lib.licenses.lgpl21;
     maintainers = [ lib.maintainers.romildo ];
   };
diff --git a/pkgs/development/ocaml-modules/zmq/default.nix b/pkgs/development/ocaml-modules/zmq/default.nix
index af8c78cb9938..6426b435172b 100644
--- a/pkgs/development/ocaml-modules/zmq/default.nix
+++ b/pkgs/development/ocaml-modules/zmq/default.nix
@@ -23,6 +23,6 @@ buildDunePackage rec {
     description = "ZeroMQ bindings for OCaml";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ akavel ];
-    homepage = "https://engineering.issuu.com/ocaml-zmq/";
+    homepage = "https://github.com/issuu/ocaml-zmq";
   };
 }
diff --git a/pkgs/development/python-modules/aqualogic/default.nix b/pkgs/development/python-modules/aqualogic/default.nix
index 86fd35963f42..cca8f5b9e8a2 100644
--- a/pkgs/development/python-modules/aqualogic/default.nix
+++ b/pkgs/development/python-modules/aqualogic/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "aqualogic";
-  version = "3.10";
+  version = "3.11";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "swilson";
     repo = "aqualogic";
     tag = finalAttrs.version;
-    hash = "sha256-M/08Wu9ANFQlev2nOzlG9R40Nuw5hy5T288dWaqV98g=";
+    hash = "sha256-9+auDJaXCEpANYm2FzsDCvr8jXmIMZFIQs1Za2BIriY=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/asyncmy/default.nix b/pkgs/development/python-modules/asyncmy/default.nix
index 7ff890e5003a..f2077d83491f 100644
--- a/pkgs/development/python-modules/asyncmy/default.nix
+++ b/pkgs/development/python-modules/asyncmy/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "asyncmy";
-  version = "0.2.14";
+  version = "0.2.15";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "long2ice";
     repo = "asyncmy";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bUpuFHfHW5mDtcbLk7Ro2gGq48sw3v3adY8tQ23e460=";
+    hash = "sha256-wAhw2V/7N7UzxSAXzggZekP6BWW3WPGTcs3LDUi9TgA=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/genai-prices/default.nix b/pkgs/development/python-modules/genai-prices/default.nix
index 100535ed84f8..3d223f03035e 100644
--- a/pkgs/development/python-modules/genai-prices/default.nix
+++ b/pkgs/development/python-modules/genai-prices/default.nix
@@ -4,7 +4,8 @@
   fetchFromGitHub,
 
   # build-system
-  uv-build,
+  hatchling,
+  uv-dynamic-versioning,
 
   # dependencies
   httpx2,
@@ -13,20 +14,21 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "genai-prices";
-  version = "0.1.3";
+  version = "0.1.9";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "genai-prices";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9fXJ+ZcQ7v2EjRx5LQVNsOSK32T4h0cAp4dKTTDRlpo=";
+    hash = "sha256-DNNFYB2+Rvq/QTjBSf0bGrTpIm8VmmjIuojvNg+Hbxk=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/packages/python";
 
   build-system = [
-    uv-build
+    hatchling
+    uv-dynamic-versioning
   ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index 3c329097a05b..436a8f682699 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202609261";
+  version = "0.1.202609271";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JRCoF2h1gas4i/7BoN+No6wz+SzbProPo38id9Q+3ok=";
+    hash = "sha256-P3aUN/WHgN9zAql0lhWPohHGkJ9LA2EZWOg3QgvQQsA=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/imgw-pib/default.nix b/pkgs/development/python-modules/imgw-pib/default.nix
index 5b29b4593a74..0252ced3508b 100644
--- a/pkgs/development/python-modules/imgw-pib/default.nix
+++ b/pkgs/development/python-modules/imgw-pib/default.nix
@@ -12,19 +12,19 @@
   pytest-asyncio,
   pytestCheckHook,
   setuptools,
-  syrupy,
+  syrupy_6,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "imgw-pib";
-  version = "2.5.1";
+  version = "2.5.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bieniu";
     repo = "imgw-pib";
     tag = finalAttrs.version;
-    hash = "sha256-nxQeYLDf7TEbbvbEygssH0X/sXLnoXoB1teZM8w70jQ=";
+    hash = "sha256-pvPPdtTO4Eq2fge8gjXMPrFTtw+qnUvVN+FqimFLQqg=";
   };
 
   build-system = [ setuptools ];
@@ -51,7 +51,7 @@ buildPythonPackage (finalAttrs: {
     freezegun
     pytest-asyncio
     pytestCheckHook
-    syrupy
+    syrupy_6
   ];
 
   meta = {
diff --git a/pkgs/development/python-modules/mplhep-data/default.nix b/pkgs/development/python-modules/mplhep-data/default.nix
index 0a6ea1f76c7f..1279a9e19e37 100644
--- a/pkgs/development/python-modules/mplhep-data/default.nix
+++ b/pkgs/development/python-modules/mplhep-data/default.nix
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     homepage = "https://github.com/scikit-hep/mplhep_data";
     license = with lib.licenses; [
       mit
-      gfl
+      lppl13c
       ofl
     ];
     maintainers = with lib.maintainers; [ veprbl ];
diff --git a/pkgs/development/python-modules/odl-renderer/default.nix b/pkgs/development/python-modules/odl-renderer/default.nix
new file mode 100644
index 000000000000..3e133d7446ad
--- /dev/null
+++ b/pkgs/development/python-modules/odl-renderer/default.nix
@@ -0,0 +1,96 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  hatchling,
+
+  # dependencies
+  aiohttp,
+  pillow,
+  qrcode,
+  resize-image,
+
+  # optional-dependencies
+  hypothesis,
+  imagehash,
+  syrupy,
+
+  # tests
+  pytest-asyncio,
+  pytestCheckHook,
+  pytest-cov-stub,
+  pytest-xdist,
+  time-machine,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "odl-renderer";
+  version = "0.5.12";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "OpenDisplay";
+    repo = "odl-renderer";
+    tag = "odl-renderer-v${finalAttrs.version}";
+    hash = "sha256-3XTP5ymW6kbNnBQV9UysCG2O4gqQ6+4TmrIpTiu7JJ0=";
+  };
+
+  build-system = [
+    hatchling
+  ];
+
+  dependencies = [
+    aiohttp
+    pillow
+    qrcode
+    resize-image
+  ];
+
+  optional-dependencies = {
+    property = [
+      hypothesis
+    ];
+    visual = [
+      imagehash
+      syrupy
+    ];
+  };
+
+  nativeCheckInputs = [
+    pytest-asyncio
+    pytestCheckHook
+    pytest-cov-stub
+    pytest-xdist
+    time-machine
+  ]
+  ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies;
+
+  disabledTestPaths = [
+    # likely pillow mismatch, they test exact raw image output match
+    "tests/visual/test_color_rendering.py::TestGrayColorVisualRegression::test_gray_text_inline_markup"
+    "tests/visual/test_layouts.py::TestLayoutVisualRegression::test_dashboard_layout"
+    "tests/visual/test_plot_rendering.py::TestPlotVisualRegression::test_plot_right_legend"
+    "tests/visual/test_plot_rendering.py::TestPlotVisualRegression::test_plot_with_axes_and_legend"
+    "tests/visual/test_text_rendering.py::TestTextVisualRegression::test_basic_text"
+    "tests/visual/test_text_rendering.py::TestTextVisualRegression::test_text_colors"
+    "tests/visual/test_text_rendering.py::TestTextVisualRegression::test_text_size"
+    "tests/visual/test_text_rendering.py::TestTextVisualRegression::test_text_sizes"
+    "tests/visual/test_transform_rendering.py::TestTransformVisualRegression::test_rotated_text"
+  ];
+
+  pythonImportsCheck = [
+    "odl_renderer"
+  ];
+
+  __structuredAttrs = true;
+
+  meta = {
+    description = "";
+    homepage = "https://github.com/OpenDisplay/odl-renderer";
+    changelog = "https://github.com/OpenDisplay/odl-renderer/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ hexa ];
+  };
+})
diff --git a/pkgs/development/python-modules/pydantic-ai-slim/default.nix b/pkgs/development/python-modules/pydantic-ai-slim/default.nix
index b5e6e8fcddbe..0cc14086d222 100644
--- a/pkgs/development/python-modules/pydantic-ai-slim/default.nix
+++ b/pkgs/development/python-modules/pydantic-ai-slim/default.nix
@@ -10,9 +10,10 @@
   uv-dynamic-versioning,
 
   # dependencies
+  anyio,
   genai-prices,
   griffelib,
-  httpx,
+  httpx2,
   opentelemetry-api,
   pydantic-graph,
   pydantic,
@@ -22,14 +23,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pydantic-ai-slim";
-  version = "2.31.1";
+  version = "2.51.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "pydantic-ai";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9kAUDDstOJP+s/eRZ6DtS7tZ16zIz7yxDpNJtAYiEmw=";
+    hash = "sha256-vrbBnSFnmIzqFJUVd2dZ8tDaO4/XXsVZvUUH+idttw8=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/pydantic_ai_slim";
@@ -40,9 +41,10 @@ buildPythonPackage (finalAttrs: {
   ];
 
   dependencies = [
+    anyio
     genai-prices
     griffelib
-    httpx
+    httpx2
     opentelemetry-api
     pydantic-graph
     pydantic
diff --git a/pkgs/development/python-modules/pydantic-graph/default.nix b/pkgs/development/python-modules/pydantic-graph/default.nix
index 86b783960c69..2f6dcc2c83bb 100644
--- a/pkgs/development/python-modules/pydantic-graph/default.nix
+++ b/pkgs/development/python-modules/pydantic-graph/default.nix
@@ -8,7 +8,7 @@
   uv-dynamic-versioning,
 
   # dependencies
-  httpx,
+  anyio,
   logfire-api,
   pydantic,
   typing-inspection,
@@ -19,14 +19,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pydantic-graph";
-  version = "2.31.1";
+  version = "2.51.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "pydantic-ai";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9kAUDDstOJP+s/eRZ6DtS7tZ16zIz7yxDpNJtAYiEmw=";
+    hash = "sha256-vrbBnSFnmIzqFJUVd2dZ8tDaO4/XXsVZvUUH+idttw8=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/pydantic_graph";
@@ -37,7 +37,7 @@ buildPythonPackage (finalAttrs: {
   ];
 
   dependencies = [
-    httpx
+    anyio
     logfire-api
     pydantic
     typing-inspection
diff --git a/pkgs/development/python-modules/pydrawise/default.nix b/pkgs/development/python-modules/pydrawise/default.nix
index 95932fa50f3c..0fcb575ef3d4 100644
--- a/pkgs/development/python-modules/pydrawise/default.nix
+++ b/pkgs/development/python-modules/pydrawise/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pydrawise";
-  version = "2026.9.0";
+  version = "2026.9.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "dknowles2";
     repo = "pydrawise";
     tag = finalAttrs.version;
-    hash = "sha256-5p93vbrpOLCm2Kir2fTv4kx4UcgobVuU4FTkWxmG6T0=";
+    hash = "sha256-KlQ1SGqCx2PD+x0OfHYCgOemRZJovsXHg6UbAIf1QSs=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pyenphase/default.nix b/pkgs/development/python-modules/pyenphase/default.nix
index eadd66c81bbc..fa72c04b7e8b 100644
--- a/pkgs/development/python-modules/pyenphase/default.nix
+++ b/pkgs/development/python-modules/pyenphase/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pyenphase";
-  version = "4.0.5";
+  version = "4.0.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pyenphase";
     repo = "pyenphase";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JsKB6sSfUhhMeF6j0MP+sbPmKeCz6c3wlm7TIL5Ls2I=";
+    hash = "sha256-N9jNlLJDRThCshbbe/9eP77L3+KoJUIFxfgoQHd0ock=";
   };
 
   pythonRelaxDeps = [ "tenacity" ];
diff --git a/pkgs/development/python-modules/resize-image/default.nix b/pkgs/development/python-modules/resize-image/default.nix
new file mode 100644
index 000000000000..eeaac9ca7021
--- /dev/null
+++ b/pkgs/development/python-modules/resize-image/default.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+  pillow,
+  python-resize-image,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "resize-image";
+  version = "0.4.0";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit (finalAttrs) pname version;
+    hash = "sha256-nlJvyKSUKUNLcleBfrNH3wKh0Q97+d8laIa5POm7IeM=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    pillow
+    python-resize-image
+  ];
+
+  doCheck = false; # no tests
+
+  pythonImportsCheck = [
+    "resize"
+  ];
+
+  __structuredAttrs = true;
+
+  meta = {
+    description = "Commandline utility to resize an image";
+    homepage = "https://github.com/jaymu53/resize-image";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ hexa ];
+  };
+})
diff --git a/pkgs/development/python-modules/smartthings-local/default.nix b/pkgs/development/python-modules/smartthings-local/default.nix
index 5cdc71f7d9d2..a89f2a57b292 100644
--- a/pkgs/development/python-modules/smartthings-local/default.nix
+++ b/pkgs/development/python-modules/smartthings-local/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "smartthings-local";
-  version = "0.1.16";
+  version = "0.1.20";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -21,7 +21,7 @@ buildPythonPackage (finalAttrs: {
     owner = "QuiteYellow";
     repo = "SmartThings-Local";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-o6e/+mj0o3wSpHtONBoUu+aEQKQ8SRLikx5LpHAhaiM=";
+    hash = "sha256-l1zCNdshRxUrUp5kYcgZBRO8ZWlz1rWRnxAtmVM2LpY=";
   };
 
   build-system = [
@@ -42,6 +42,11 @@ buildPythonPackage (finalAttrs: {
   disabledTests = [
     # import can't find pyopenssl for some reason
     "test_smartthings_local_imports_without_mqtt_demo_present"
+    # timezone handling issues
+    # assert 'GMT' in "clock sync (periodic) skipped: host clock reads 2000-01-01T00:00:00 Europe, outside the plausible window -- writing it could break the appliance's certificate verification"
+    "test_a_skipped_write_names_the_zone_too"
+    # AssertionError: assert '14:30:05 BST ->' in 'clock sync (periodic) /configuration/vs/0 = 2026-09-08T14:30:05 Europe -> 2.04'
+    "test_the_log_line_names_the_zone_the_stamp_came_from"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 25e0b21bd05a..e236f273cbd4 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,7 +1,7 @@
 {
     "testing": {
-        "version": "7.3-rc4",
-        "hash": "sha256:0bsd7w8xsd06g1kf5ildf6jnsryk5s2w5838ihp3237fh2sz8agr",
+        "version": "7.3-rc5",
+        "hash": "sha256:1slzmxyadz75p6lbk373x1waapyr6ggm6mz999sy5xkmidzg5d1n",
         "lts": false
     },
     "6.1": {
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 9d282c78b370..8ebb86717a0c 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2026.9.3";
+  version = "2026.9.4";
   components = {
     "3_day_blinds" =
       ps: with ps; [
diff --git a/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix b/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix
index b162a0733285..f346d1d93954 100644
--- a/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix
@@ -14,13 +14,13 @@
 buildHomeAssistantComponent rec {
   owner = "luuquangvu";
   domain = "blueprints_updater";
-  version = "2.14.6";
+  version = "2.15.0";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "blueprints-updater";
     tag = version;
-    hash = "sha256-udj68ZlkSR2oldFfCEJh5A1gHF8GWb/iNluDrZ8L6us=";
+    hash = "sha256-ZfPfMrnUSaIEstkoocweit+wpk+/r+/L04uVGwZmKYc=";
   };
 
   patches = [
@@ -46,6 +46,11 @@ buildHomeAssistantComponent rec {
     pytestCheckHook
   ];
 
+  disabledTests = [
+    # validate_compatibility.py: error: Invalid --verify-pair-python: Python executable not found at .venv/bin/python
+    "test_compatibility_main_configures_global_uv_before_verification"
+  ];
+
   meta = {
     description = "Automatically update Home Assistant blueprints via native update entities";
     homepage = "https://github.com/luuquangvu/blueprints-updater/";
diff --git a/pkgs/servers/home-assistant/custom-components/cover_time_based/package.nix b/pkgs/servers/home-assistant/custom-components/cover_time_based/package.nix
index 585c25686555..366b92014de8 100644
--- a/pkgs/servers/home-assistant/custom-components/cover_time_based/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/cover_time_based/package.nix
@@ -9,13 +9,13 @@
 buildHomeAssistantComponent (finalAttrs: {
   owner = "Sese-Schneider";
   domain = "cover_time_based";
-  version = "4.11.0";
+  version = "4.13.0";
 
   src = fetchFromGitHub {
     inherit (finalAttrs) owner;
     repo = "ha-cover-time-based";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-x6+xQCR3UmoIDp9JCnl86g8HTJMlo9Jz+eXXpu/oMGU=";
+    hash = "sha256-J5yTdjJTIOzq5miC5GpLshMAkklEYnajEyPN4AyyHIU=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/servers/home-assistant/custom-components/econet300/package.nix b/pkgs/servers/home-assistant/custom-components/econet300/package.nix
index e15dfd811d8e..0132a3f10f47 100644
--- a/pkgs/servers/home-assistant/custom-components/econet300/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/econet300/package.nix
@@ -5,7 +5,7 @@
 }:
 
 buildHomeAssistantComponent (finalAttrs: {
-  version = "1.3.2";
+  version = "1.3.3";
   domain = "econet300";
   owner = "jontofront";
 
@@ -13,7 +13,7 @@ buildHomeAssistantComponent (finalAttrs: {
     owner = "jontofront";
     repo = "ecoNET-300-Home-Assistant-Integration";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Kbtp5yTsi7QEVaHrK+g/JcS9B3xS1TsH3t54lTPNgAI=";
+    hash = "sha256-nJ0xoSGmvPNqGKl8nYoNGfL5phXRbDzFsG/0HihLRmk=";
   };
 
   meta = {
@@ -21,6 +21,6 @@ buildHomeAssistantComponent (finalAttrs: {
     description = "Home Assistant component for Plum ecoNET300 devices";
     homepage = "https://github.com/jontofront/ecoNET-300-Home-Assistant-Integration";
     maintainers = with lib.maintainers; [ implr ];
-    license = lib.licenses.unfree;
+    license = lib.licenses.mit;
   };
 })
diff --git a/pkgs/servers/home-assistant/custom-components/elegoo_printer/package.nix b/pkgs/servers/home-assistant/custom-components/elegoo_printer/package.nix
index c5b9a4ee0da8..4db2dffa1ad4 100644
--- a/pkgs/servers/home-assistant/custom-components/elegoo_printer/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/elegoo_printer/package.nix
@@ -11,6 +11,7 @@
   websockets,
 
   # tests
+  pytest-asyncio,
   pytestCheckHook,
   aiohttp,
   home-assistant,
@@ -19,13 +20,13 @@
 buildHomeAssistantComponent rec {
   owner = "danielcherubini";
   domain = "elegoo_printer";
-  version = "2.12.2";
+  version = "2.13.1";
 
   src = fetchFromGitHub {
     owner = "danielcherubini";
     repo = "elegoo-homeassistant";
     tag = "v${version}";
-    hash = "sha256-iso1y8fjX88esIJPtgKQIOLlNYnj6zf9W/WlftQzewU=";
+    hash = "sha256-L3oFUCqxkygiwTTeHR9MMneA5q4+YFHBoNAxqbqp/Sk=";
   };
 
   dependencies = [
@@ -37,11 +38,17 @@ buildHomeAssistantComponent rec {
   ];
 
   nativeCheckInputs = [
+    pytest-asyncio
     pytestCheckHook
     aiohttp
     home-assistant
   ];
 
+  disabledTestPaths = [
+    # https://github.com/danielcherubini/elegoo-homeassistant/issues/419
+    "custom_components/elegoo_printer/tests/test_coordinator.py"
+  ];
+
   meta = {
     changelog = "https://github.com/danielcherubini/elegoo-homeassistant/releases/tag/v${version}";
     description = "Home Assistant integration for Elegoo 3D printers using the SDCP protocol";
diff --git a/pkgs/servers/home-assistant/custom-components/localthings/package.nix b/pkgs/servers/home-assistant/custom-components/localthings/package.nix
index 0f7c8e8a9bf1..45a3f532d769 100644
--- a/pkgs/servers/home-assistant/custom-components/localthings/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/localthings/package.nix
@@ -12,13 +12,13 @@
 buildHomeAssistantComponent (finalAttrs: {
   owner = "mbillow";
   domain = "localthings";
-  version = "0.26.1";
+  version = "0.29.0";
 
   src = fetchFromGitHub {
     owner = "mbillow";
     repo = "localthings";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7hFLCqZWiE3lo08wehXsqNdiddE4lAp02nQhzsDO0hs=";
+    hash = "sha256-/WOVkF7/crcHuNAzK+zfNkOxmk6Q+S+gOhMlydRio/o=";
   };
 
   dependencies = [
diff --git a/pkgs/servers/home-assistant/custom-components/meshcore/package.nix b/pkgs/servers/home-assistant/custom-components/meshcore/package.nix
index 72074dbc23a0..8088a811b432 100644
--- a/pkgs/servers/home-assistant/custom-components/meshcore/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/meshcore/package.nix
@@ -8,19 +8,20 @@
   paho-mqtt,
   pynacl,
   pytest-asyncio,
+  pytest-homeassistant-custom-component,
   pytestCheckHook,
 }:
 
 buildHomeAssistantComponent (finalAttrs: {
   owner = "meshcore-dev";
   domain = "meshcore";
-  version = "2.8.0";
+  version = "2.10.0";
 
   src = fetchFromGitHub {
     owner = "meshcore-dev";
     repo = "meshcore-ha";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-K1DYBcuAilcKBzQVSUQvoA9OoxUbtfISYNY8IwgUdZk=";
+    hash = "sha256-I4AUa66/XmXSb40suDGab6om2m/qJiUysXQdniT42bw=";
   };
 
   dependencies = [
@@ -37,9 +38,22 @@ buildHomeAssistantComponent (finalAttrs: {
 
   nativeCheckInputs = [
     pytest-asyncio
+    pytest-homeassistant-custom-component
     pytestCheckHook
   ];
 
+  disabledTestPaths = [
+    # https://github.com/meshcore-dev/meshcore-ha/issues/363
+    "tests_integration/test_dedup_eviction.py"
+    "tests_integration/test_execute_command_authorization.py"
+    "tests_integration/test_repeater_firmware_button.py"
+    "tests_integration/test_multihub_messaging.py"
+    "tests_integration/test_create_contact_sensor.py"
+    "tests_integration/test_config_flow.py"
+    "tests/test_cli_command.py::test_command_ui_records_when_flag_set"
+    "tests/test_cli_command.py::test_command_ui_noop_on_empty_input"
+  ];
+
   meta = {
     changelog = "https://github.com/meshcore-dev/meshcore-ha/releases/tag/${finalAttrs.src.tag}";
     description = "Home Assistant integration for MeshCore";
diff --git a/pkgs/servers/home-assistant/custom-components/octopus_energy/package.nix b/pkgs/servers/home-assistant/custom-components/octopus_energy/package.nix
index e7d9fffcbd72..eb58d28c4b3c 100644
--- a/pkgs/servers/home-assistant/custom-components/octopus_energy/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/octopus_energy/package.nix
@@ -11,13 +11,13 @@
 buildHomeAssistantComponent rec {
   owner = "BottlecapDave";
   domain = "octopus_energy";
-  version = "19.1.0";
+  version = "19.2.1";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "HomeAssistant-OctopusEnergy";
     tag = "v${version}";
-    hash = "sha256-mUQXW6oW7JBDgDV+Sw3EGwVvBhwukEdNJmsxs8TK03Q=";
+    hash = "sha256-KkQxLmp/5X/Z1WwklLzOCvL49Tn6ZinID2Rf2GZngXI=";
   };
 
   dependencies = [ pydantic ];
diff --git a/pkgs/servers/home-assistant/custom-components/openai-tts/package.nix b/pkgs/servers/home-assistant/custom-components/openai-tts/package.nix
index 2369a961b870..e7da3a5e5520 100644
--- a/pkgs/servers/home-assistant/custom-components/openai-tts/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/openai-tts/package.nix
@@ -9,13 +9,13 @@
 buildHomeAssistantComponent (finalAttrs: {
   owner = "sfortis";
   domain = "openai_tts";
-  version = "3.9.1";
+  version = "3.9.2";
 
   src = fetchFromGitHub {
     inherit (finalAttrs) owner;
     repo = "openai_tts";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hpGKSUMJuW2XSAGuqmCIXTtN4Qh2nwOFJWAg5X9JljA=";
+    hash = "sha256-z7PB1/UFdj8GvRIaAgDOBDSXjxfMky63/FRbr4Euj4w=";
   };
 
   dependencies = [ sentence-stream ];
diff --git a/pkgs/servers/home-assistant/custom-components/opendisplay/package.nix b/pkgs/servers/home-assistant/custom-components/opendisplay/package.nix
index ce0781ea8beb..353d7a03086a 100644
--- a/pkgs/servers/home-assistant/custom-components/opendisplay/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/opendisplay/package.nix
@@ -8,13 +8,19 @@
   bleak-retry-connector,
   python-resize-image,
   numpy,
+  odl-renderer,
   qrcode,
+  py-opendisplay,
   requests-toolbelt,
+  silabs-ble-ota,
   websocket-client,
   websockets,
 
   # tests
+  home-assistant,
   pytest-asyncio,
+  pytest-cov-stub,
+  pytest-freezegun,
   pytest-homeassistant-custom-component,
   pytestCheckHook,
 }:
@@ -22,22 +28,25 @@
 buildHomeAssistantComponent (finalAttrs: {
   owner = "OpenDisplay";
   domain = "opendisplay";
-  version = "2.0.2";
+  version = "3.0.2";
 
   src = fetchFromGitHub {
     inherit (finalAttrs) owner;
     repo = "Home_Assistant_Integration";
     tag = finalAttrs.version;
-    hash = "sha256-EmcDY31cTWK+JRErM6EWO0jrQvIaxKXgeI6i5qiwYGU=";
+    hash = "sha256-m76Ie6yBs5evTZ4Myp+YvFzbWnAOBUREoy2R0cKlwuw=";
   };
 
   dependencies = [
     bleak
     bleak-retry-connector
     numpy
+    odl-renderer
     python-resize-image
     qrcode
+    py-opendisplay
     requests-toolbelt
+    silabs-ble-ota
     websocket-client
     websockets
   ]
@@ -50,9 +59,12 @@ buildHomeAssistantComponent (finalAttrs: {
 
   nativeCheckInputs = [
     pytest-asyncio
+    pytest-cov-stub
+    pytest-freezegun
     pytest-homeassistant-custom-component
     pytestCheckHook
-  ];
+  ]
+  ++ (home-assistant.getPackages "usb" home-assistant.python3Packages);
 
   disabledTestPaths = [
     # Probably mismatch in fontconfig priorities
diff --git a/pkgs/servers/home-assistant/custom-components/powercalc/package.nix b/pkgs/servers/home-assistant/custom-components/powercalc/package.nix
index cf1e956547ec..563063c4fcfd 100644
--- a/pkgs/servers/home-assistant/custom-components/powercalc/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/powercalc/package.nix
@@ -19,13 +19,13 @@
 buildHomeAssistantComponent rec {
   owner = "bramstroker";
   domain = "powercalc";
-  version = "1.25.4";
+  version = "1.26.0";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "homeassistant-powercalc";
     tag = "v${version}";
-    hash = "sha256-TNXXUdfivIhE5ZfzjFrSCVz/T7BoydTWd2jWfpTOiX4=";
+    hash = "sha256-XUHQYHZ4PMkxobENb3xo2W7MGju/vN+iJfI6NVaP+RM=";
   };
 
   dependencies = [ numpy ];
diff --git a/pkgs/servers/home-assistant/custom-components/simple_pid_controller/package.nix b/pkgs/servers/home-assistant/custom-components/simple_pid_controller/package.nix
index cf10586862d2..6169e738f171 100644
--- a/pkgs/servers/home-assistant/custom-components/simple_pid_controller/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/simple_pid_controller/package.nix
@@ -12,13 +12,13 @@
 buildHomeAssistantComponent (finalAttrs: {
   owner = "bvweerd";
   domain = "simple_pid_controller";
-  version = "1.6.0";
+  version = "1.6.1";
 
   src = fetchFromGitHub {
     owner = "bvweerd";
     repo = "simple_pid_controller";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-k/JT3sdGNYETWMat5hoiGv81N77Qz7Ks354vtk5PnvQ=";
+    hash = "sha256-Vn74nhT5hHZ2U+XKx/Ejkdja2r0AR6Z7HUtaKozDrd4=";
   };
 
   dependencies = [ simple-pid ];
diff --git a/pkgs/servers/home-assistant/custom-components/solax_modbus/package.nix b/pkgs/servers/home-assistant/custom-components/solax_modbus/package.nix
index f0032d2cbc1f..14224d9c8ecd 100644
--- a/pkgs/servers/home-assistant/custom-components/solax_modbus/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/solax_modbus/package.nix
@@ -9,13 +9,13 @@
 buildHomeAssistantComponent rec {
   owner = "wills106";
   domain = "solax_modbus";
-  version = "2026.09.2";
+  version = "2026.09.3";
 
   src = fetchFromGitHub {
     owner = "wills106";
     repo = "homeassistant-solax-modbus";
     tag = version;
-    hash = "sha256-WxSzlcnwQ32qN1azPKjcfDaPTP1Vpfmc8FbF9XEK9kk=";
+    hash = "sha256-gGShJ61NlMYBvtaIFms9DHXJfwQ13EwQxLBIUXW2/M8=";
   };
 
   ignoreVersionRequirement = [
diff --git a/pkgs/servers/home-assistant/custom-components/spook/package.nix b/pkgs/servers/home-assistant/custom-components/spook/package.nix
index 372cd281a10d..88df1249ade0 100644
--- a/pkgs/servers/home-assistant/custom-components/spook/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/spook/package.nix
@@ -7,13 +7,13 @@
 buildHomeAssistantComponent rec {
   owner = "frenck";
   domain = "spook";
-  version = "5.5.0";
+  version = "5.5.1";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = domain;
     tag = "v${version}";
-    hash = "sha256-AWz8hQLKmhe4mugTCIsvRutknBwgdZS7omBkyFtSEOQ=";
+    hash = "sha256-FT8hpWz3pv63hjUr/kiIJOzT7z/6tclj7CZ2XpQ2JYY=";
   };
 
   patches = [ ./remove-sub-integration-symlink-hack.patch ];
diff --git a/pkgs/servers/home-assistant/custom-components/tuya_local/package.nix b/pkgs/servers/home-assistant/custom-components/tuya_local/package.nix
index 4a68b4db095a..bc1eb6011717 100644
--- a/pkgs/servers/home-assistant/custom-components/tuya_local/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/tuya_local/package.nix
@@ -11,13 +11,13 @@
 buildHomeAssistantComponent rec {
   owner = "make-all";
   domain = "tuya_local";
-  version = "2026.9.1";
+  version = "2026.9.2-rel";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "tuya-local";
     tag = version;
-    hash = "sha256-RYAmRAbGMh+xWKXK3bTPjH9IvhvY7sNnl+19N0IcG5E=";
+    hash = "sha256-x0cMuTjXAujHj+fVeuwjvEfFPgK8Nx2Z59Axb2C5lig=";
   };
 
   dependencies = [
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/bubble-card/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/bubble-card/package.nix
index 7deaec663e29..6467ce5653df 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/bubble-card/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/bubble-card/package.nix
@@ -6,13 +6,13 @@
 
 buildNpmPackage rec {
   pname = "bubble-card";
-  version = "3.4.0";
+  version = "3.4.1";
 
   src = fetchFromGitHub {
     owner = "Clooos";
     repo = "Bubble-Card";
     rev = "v${version}";
-    hash = "sha256-Lo1PEC/wteUGci/FpBEbC2fqIQOlpfzzt26SigH1Teo=";
+    hash = "sha256-Pxc0fenLIjDdmxJGQulkqqgmISeodwOPRucIhrp15Ms=";
   };
 
   npmDepsHash = "sha256-oEkd6qK2YR0roDsXvNMBhMoOuMfcqzYh85tjFjvhwX8=";
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/clock-weather-card/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/clock-weather-card/package.nix
index d819c312e0cf..c88f80cc2b34 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/clock-weather-card/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/clock-weather-card/package.nix
@@ -9,18 +9,18 @@
 }:
 stdenvNoCC.mkDerivation rec {
   pname = "clock-weather-card";
-  version = "2.9.4";
+  version = "2.9.5";
 
   src = fetchFromGitHub {
     owner = "pkissling";
     repo = "clock-weather-card";
     tag = "v${version}";
-    hash = "sha256-lqJF4Hql2uZmVRldcfsHiykFVUiudjfr4xrnERwkI+s=";
+    hash = "sha256-aNX2vbLVvL9TO8PWERyy7z0SWY4JJ5khCrNPqa01DWA=";
   };
 
   offlineCache = fetchYarnDeps {
     yarnLock = src + "/yarn.lock";
-    hash = "sha256-nXgqGQfnTLYy24iqz6VnHTpys1RA9vYbpDzlCsj1OPg=";
+    hash = "sha256-1ZmsuAKYa0iSjI+vYbonWZglx8/QNnRTJv4K+LmVfq4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/meshcore-card/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/meshcore-card/package.nix
index f8db118c5c75..309df29cc82f 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/meshcore-card/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/meshcore-card/package.nix
@@ -7,17 +7,17 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "meshcore-card";
-  version = "1.0.0";
+  version = "0.4.3";
   strictDeps = true;
 
   src = fetchFromGitHub {
     owner = "jpettitt";
     repo = "meshcore-card";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-B2W3B8cd9OrTOxLEWUV8Aercektfwh7/Ik3/U/Lwz48=";
+    hash = "sha256-Ad7XKqShvnYL8ty1fgGnPCxXF7ivsMsVS8F8r00UfeI=";
   };
 
-  npmDepsHash = "sha256-/CtYdDFo8Sbq3FEm6ND8b/CNcfsUgoT23F6RVfYtYDg=";
+  npmDepsHash = "sha256-niMUu9NQSs2Jb3EDoIWXiRyZ5Oq4AEBGIh1Rbl1+dm4=";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/multiple-entity-row/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/multiple-entity-row/package.nix
index deef1c685f91..e98431d86579 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/multiple-entity-row/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/multiple-entity-row/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "multiple-entity-row";
-  version = "4.11.1";
+  version = "4.12.0";
 
   src = fetchFromGitHub {
     owner = "benct";
     repo = "lovelace-multiple-entity-row";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rHgB5eFImfQisfyz9AB/ArqqwlpboovnU9iO88sx31c=";
+    hash = "sha256-LlpxVanOD+rbEwSzfrA4GsgYfyEtP+CFfdJV+t2Oxjs=";
   };
 
   offlineCache = fetchYarnDeps {
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/tankerkoenig-card/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/tankerkoenig-card/package.nix
index ba9c48ee6e6b..4717b6c2ebd9 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/tankerkoenig-card/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/tankerkoenig-card/package.nix
@@ -6,16 +6,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "tankerkoenig-card";
-  version = "1.8.2";
+  version = "1.9.0";
 
   src = fetchFromGitHub {
     owner = "timmaurice";
     repo = "lovelace-tankerkoenig-card";
     tag = finalAttrs.version;
-    hash = "sha256-GMX6kIyoZN26NCgqPTj44TC3Yo+zTcmSm5ToakgIojA=";
+    hash = "sha256-wRwTr7sMS32NIrVqF7+oFwlB1/h8pR908Nd0K8IbRts=";
   };
 
-  npmDepsHash = "sha256-OrEQjE2XMcumCyfdKKMkFWO1vgOytVjsguTuU6AkZr0=";
+  npmDepsHash = "sha256-QbvLeAVTp7V185hens+TPpW0Wo0PwFdCMRF2akxZJ9I=";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index b8dd2c3526e2..a075201e6b16 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -251,7 +251,7 @@ let
   extraBuildInputs = extraPackages python3Packages;
 
   # Don't forget to run update-component-packages.py after updating
-  hassVersion = "2026.9.3";
+  hassVersion = "2026.9.4";
 
 in
 python3Packages.buildPythonApplication rec {
@@ -272,13 +272,13 @@ python3Packages.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     tag = version;
-    hash = "sha256-oqgvO3mjsHsdujlGp0lwAfH6r0dGBxf0R+lILCTueeQ=";
+    hash = "sha256-DoJ0Y0v6Q+ZoXGcLWHxiPw0ZVAELCTGp/9k3FlgZbm8=";
   };
 
   # Secondary source is pypi sdist for translations
   sdist = fetchPypi {
     inherit pname version;
-    hash = "sha256-J+G3e9jJxdmn9aw4pg9G5qD5QTVKUJkVomLw1Lz/84g=";
+    hash = "sha256-MKb9e2NJnJlZvpVnxLffuMFzFGbeZ6sm5VmKutGrv/c=";
   };
 
   build-system = with python3Packages; [
@@ -306,6 +306,9 @@ python3Packages.buildPythonApplication rec {
     # No scaring our users about our install method
     ./patches/nixos-was-never-supported.patch
 
+    # Fix portainer hang due to missing fixture autouse
+    ./patches/portainer-fixture-autouse.patch
+
     # Patch path to ffmpeg binary
     (replaceVars ./patches/ffmpeg-path.patch {
       ffmpeg = "${lib.getExe ffmpeg-headless}";
diff --git a/pkgs/servers/home-assistant/patches/portainer-fixture-autouse.patch b/pkgs/servers/home-assistant/patches/portainer-fixture-autouse.patch
new file mode 100644
index 000000000000..05ab53871194
--- /dev/null
+++ b/pkgs/servers/home-assistant/patches/portainer-fixture-autouse.patch
@@ -0,0 +1,13 @@
+diff --git a/tests/components/portainer/conftest.py b/tests/components/portainer/conftest.py
+index 83840884f64..e87cae0e210 100644
+--- a/tests/components/portainer/conftest.py
++++ b/tests/components/portainer/conftest.py
+@@ -139,7 +139,7 @@ def mock_portainer_client(mock_portainer_watcher: MagicMock) -> Generator[AsyncM
+         yield client
+ 
+ 
+-@pytest.fixture
++@pytest.fixture(autouse=True)
+ def mock_portainer_event_listeners() -> Generator[dict[int, MagicMock]]:
+     """Mock PortainerEventListener; one MagicMock instance per endpoint_id."""
+     instances: dict[int, MagicMock] = {}
diff --git a/pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix b/pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix
index e0b844a9c776..8ec6a656be3f 100644
--- a/pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix
+++ b/pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "pytest-homeassistant-custom-component";
-  version = "0.13.366";
+  version = "0.13.367";
   pyproject = true;
 
   disabled = pythonOlder "3.13";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "MatthewFlamm";
     repo = "pytest-homeassistant-custom-component";
     tag = version;
-    hash = "sha256-XNzVIBamQGDUhABw+ml5ZT0jDP8yPSu/OLgKODZsVAc=";
+    hash = "sha256-XVpmQaDhN/CnazYMn23VDLwFnL1E5R8jv57wqADjp2w=";
   };
 
   patches = [
diff --git a/pkgs/servers/home-assistant/stubs.nix b/pkgs/servers/home-assistant/stubs.nix
index 3407e92e028d..444cb1d759e6 100644
--- a/pkgs/servers/home-assistant/stubs.nix
+++ b/pkgs/servers/home-assistant/stubs.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "homeassistant-stubs";
-  version = "2026.9.3";
+  version = "2026.9.4";
   pyproject = true;
 
   disabled = python.version != home-assistant.python3Packages.python.version;
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "KapJI";
     repo = "homeassistant-stubs";
     tag = version;
-    hash = "sha256-D02IDJwl3kQRi8OGNCvofGU+ICiyDyFxWnP2S8ZZrv8=";
+    hash = "sha256-EO1X4HPz6dDLjvstacr9YF0I1xrpe4MYTkOEkqm55YM=";
   };
 
   build-system = [
diff --git a/pkgs/servers/sql/postgresql/19.nix b/pkgs/servers/sql/postgresql/19.nix
index 1b42f5fc9226..c02973c2f764 100644
--- a/pkgs/servers/sql/postgresql/19.nix
+++ b/pkgs/servers/sql/postgresql/19.nix
@@ -1,7 +1,7 @@
 {
-  version = "19beta3";
-  rev = "refs/tags/REL_19_BETA3";
-  hash = "sha256-Mcf46ksAzOn9hqCiF5kUwNskfFCBxrzqvznnxdwHfnM=";
+  version = "19beta4";
+  rev = "refs/tags/REL_19_BETA4";
+  hash = "sha256-D9Oxe7I9JyAaByRY/z8jYlIlydykJF2YvUZ2ScSD9i4=";
   muslPatches = {
     dont-use-locale-a = {
       url = "https://git.alpinelinux.org/aports/plain/main/postgresql17/dont-use-locale-a-on-musl.patch?id=d69ead2c87230118ae7f72cef7d761e761e1f37e";
diff --git a/pkgs/servers/sql/postgresql/ext/citus.nix b/pkgs/servers/sql/postgresql/ext/citus.nix
index 7dd9874a2821..0dcc15df71c1 100644
--- a/pkgs/servers/sql/postgresql/ext/citus.nix
+++ b/pkgs/servers/sql/postgresql/ext/citus.nix
@@ -1,7 +1,6 @@
 {
   curl,
   fetchFromGitHub,
-  fetchpatch,
   lib,
   lz4,
   postgresql,
@@ -9,32 +8,53 @@
   postgresqlTestExtension,
 }:
 
+let
+  # "Our soft policy for Postgres version compatibility is to support Citus'
+  # latest release with Postgres' 3 latest releases."
+  # https://www.citusdata.com/updates/v12-0/#deprecated_features
+  sources = {
+    "18" = {
+      version = "14.2.0";
+      hash = "sha256-iJb+aUcTeN9BLil72/KG8jObU79Cmyl49UDz7iCUAMk=";
+    };
+    "17" = {
+      version = "14.2.0";
+      hash = "sha256-iJb+aUcTeN9BLil72/KG8jObU79Cmyl49UDz7iCUAMk=";
+    };
+    "16" = {
+      version = "14.2.0";
+      hash = "sha256-iJb+aUcTeN9BLil72/KG8jObU79Cmyl49UDz7iCUAMk=";
+    };
+    "15" = {
+      version = "13.4.0";
+      hash = "sha256-o3RFtOlkBvgFFfT1+BlTD6XbAOiSzBPaMi6/m8i7+9k=";
+    };
+  };
+
+  source =
+    sources.${lib.versions.major postgresql.version} or {
+      version = "";
+      hash = throw "Source for citus is not available for ${postgresql.version}";
+    };
+in
 postgresqlBuildExtension (finalAttrs: {
   pname = "citus";
-  version = "13.0.3";
+  inherit (source) version;
 
   src = fetchFromGitHub {
     owner = "citusdata";
     repo = "citus";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tQ2YkMUeziz+dhfXtfuK0x8PWH3vfoJiVbE+YvQ/Gzc=";
+    inherit (source) hash;
   };
 
-  patches = [
-    # Even though this commit is on main since Sep 2023, it hasn't made its way to the release-13.0 branch, yet.
-    # https://github.com/citusdata/citus/pull/7221
-    # Fixes build for PG 16 + 17 on darwin
-    (fetchpatch {
-      url = "https://github.com/citusdata/citus/commit/0f28a69f12418d211ffba5f7ddd222fd0c47daeb.patch";
-      hash = "sha256-8JAM+PUswzbdlAZUpRApgO0eBsMbUHFdFGsdATsG88I=";
-    })
-  ];
-
   buildInputs = [
     curl
     lz4
   ];
 
+  enableUpdateScript = false;
+
   passthru.tests.extension = postgresqlTestExtension {
     inherit (finalAttrs) finalPackage;
     postgresqlExtraSettings = ''
@@ -63,22 +83,12 @@ postgresqlBuildExtension (finalAttrs: {
   };
 
   meta = {
-    # "Our soft policy for Postgres version compatibility is to support Citus'
-    # latest release with Postgres' 3 latest releases."
-    # https://www.citusdata.com/updates/v12-0/#deprecated_features
-    broken =
-      lib.versionOlder postgresql.version "15"
-      ||
-        # PostgreSQL 18 support issue upstream: https://github.com/citusdata/citus/issues/7978
-        # Check after next package update.
-        lib.warnIf (finalAttrs.version != "13.0.3") "Is postgresql18Packages.citus still broken?" (
-          lib.versionAtLeast postgresql.version "18"
-        );
+    broken = !builtins.elem (lib.versions.major postgresql.version) (builtins.attrNames sources);
     description = "Distributed PostgreSQL as an extension";
     homepage = "https://www.citusdata.com/";
-    changelog = "https://github.com/citusdata/citus/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    changelog = "https://github.com/citusdata/citus/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.agpl3Only;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ anish ];
     inherit (postgresql.meta) platforms;
   };
 })
diff --git a/pkgs/tools/typesetting/tex/texlive/default.nix b/pkgs/tools/typesetting/tex/texlive/default.nix
index 9faca1c147b2..5042bf84cfe4 100644
--- a/pkgs/tools/typesetting/tex/texlive/default.nix
+++ b/pkgs/tools/typesetting/tex/texlive/default.nix
@@ -350,7 +350,6 @@ let
     scheme-basic = [
       cc-by-sa-40
       free
-      gfl
       gpl1Only
       gpl2Only
       gpl2Plus
@@ -369,7 +368,6 @@ let
       cc-by-sa-40
       fdl13Only
       free
-      gfl
       gpl1Only
       gpl2Only
       gpl2Plus
@@ -389,7 +387,6 @@ let
       eupl12
       fdl13Only
       free
-      gfl
       gfsl
       gpl1Only
       gpl2Only
@@ -427,7 +424,6 @@ let
       eupl12
       fdl13Only
       free
-      gfl
       gfsl
       gpl1Only
       gpl2Only
@@ -459,7 +455,6 @@ let
       eupl12
       fdl13Only
       free
-      gfl
       gfsl
       gpl1Only
       gpl2Only
@@ -495,7 +490,6 @@ let
       eupl12
       fdl13Only
       free
-      gfl
       gpl1Only
       gpl2Only
       gpl2Plus
@@ -536,7 +530,6 @@ let
       eupl12
       fdl13Only
       free
-      gfl
       gpl1Only
       gpl2Only
       gpl2Plus
@@ -569,7 +562,6 @@ let
       eupl12
       fdl13Only
       free
-      gfl
       gpl1Only
       gpl2Only
       gpl2Plus
diff --git a/pkgs/tools/typesetting/tex/texlive/tl2nix.sed b/pkgs/tools/typesetting/tex/texlive/tl2nix.sed
index 9eef947402db..1ec6812449e9 100644
--- a/pkgs/tools/typesetting/tex/texlive/tl2nix.sed
+++ b/pkgs/tools/typesetting/tex/texlive/tl2nix.sed
@@ -70,6 +70,7 @@ $a}
       s/"collection"/"free"/g   # used for collections of individual packages with distinct licenses. As TeXlive only contains free software, we can use "free" as a catchall
       s/"eupl"/"eupl12"/g
       s/"fdl"/"fdl13Only"/g
+      s/"gfl"/"lppl13c"/g       # gfl just some fancy text saying you should use lppl13c+
       s/"gpl"/"gpl1Only"/g
       s/"gpl([1-3])"/"gpl\1Only"/g
       s/"gpl2\+"/"gpl2Plus"/g
diff --git a/pkgs/tools/typesetting/tex/texlive/tlpdb.nix b/pkgs/tools/typesetting/tex/texlive/tlpdb.nix
index 1b078df39bad..a24a17c1f262 100644
--- a/pkgs/tools/typesetting/tex/texlive/tlpdb.nix
+++ b/pkgs/tools/typesetting/tex/texlive/tlpdb.nix
@@ -574,7 +574,7 @@
     sha512.doc = "ece447f4c12da8509be155f2743ca52988f32ce62edb361a85fdcd7733bb401cf8ecbbc0fa6bbd7d1662593f1084aa89a29b2f1b822a765bc6f7e581b46bc153";
     sha512.source = "cb628c51f7f4d972f81b2e23495e7ac6e82e422c7e85ffcdd7c3cbb753b055178adb9ea386bb4b1f1f1c4d2cdc561eba27cd82c7ef33830db0cde9af99e7730f";
     license = [
-      "gfl"
+      "lppl13c"
       "gpl3Plus"
     ];
     version = "1";
@@ -927,7 +927,7 @@
     shortdesc = "Arabic-Latin Modern Fixed extends TeX-Gyre Latin Modern Mono 10 Regular to full Arabic Unicode support";
     stripPrefix = 0;
     sha512.doc = "f51af6e63070fbf94a3f8ed756d544dc7d9460f37b016fcded0d2c56a6cf672d2e60c7b2cb8be9f9942f43e46b5ff2bfb59c6ae301a5d88a8858d6e60a3fbaa9";
-    license = [ "gfl" ];
+    license = [ "lppl13c" ];
     version = "0.92";
     sha512.run = "1a5e41cac48a33c4336fe03576c49165b47a0bec606b0a15a3563922b964a9a3c2de735cd88cf10423b054b5131193441fbcd64fb2edc47d4944ff33cf6367ef";
   };
@@ -15559,7 +15559,7 @@
       "Map cyklop.map"
     ];
     sha512.doc = "547abc1404bd1b7d16d738554f8594c21a5c7a838ab0107bdc5ee9f900e2f3aff51c8e172e485ad0011b3ba03d166bbad4d7a0b37ff6e06d637f1443ed5b0075";
-    license = [ "gfl" ];
+    license = [ "lppl13c" ];
     version = "0.915";
     sha512.run = "9043b05db99d8013f423b2224fe0f289a675d3a103e8e9b685f9440e5d2bbe19a6611b62c1436408ace651c6d47b0e639dd4eb7a4bd9c7e049398f5fa4455c72";
   };
@@ -27769,7 +27769,7 @@
       "Map iwona.map"
     ];
     sha512.doc = "650a01e7432380eb2124547c0e00b63e5a38cd52fa6f4242894cfe30132ebedb853403290dda4ed62664a86aac922a5d1c26a98c51d8c96661113a8b71c3bcb8";
-    license = [ "gfl" ];
+    license = [ "lppl13c" ];
     version = "0.995b";
     sha512.run = "354e4d877a493b45ee48382bc12ce0da96cce046c2a5b7e7d76c1de39fae434f2ea63325f9fce9400b033b5ca0327047ce35812d825c26d4cea7a664e5e37b75";
   };
@@ -29075,7 +29075,7 @@
       "Map kurier.map"
     ];
     sha512.doc = "3ae2d3f1192c36be372090ebbf76ace680e52e6eb24f274a2550dc11487ddee22e3360e18afd0d59a6955421806d59cd00007ca30c73961bf9db17f4c37911f5";
-    license = [ "gfl" ];
+    license = [ "lppl13c" ];
     version = "0.995b";
     sha512.run = "66bd4a620cd3e6d7b59390df07a95afd6d720657c3f3aad93f00c5a185eeeaada5d82008e9d34bd927ef1d570872091dae9e04a6b4782ace2f2b9d1f56b6f268";
   };
@@ -31199,7 +31199,7 @@
       "Map lm.map"
     ];
     sha512.doc = "232d070d59563d339a5c59e6dac93d7662280f6186cc591f5b520322a879a97214af2fee3a006c85660864635773355b357f6aa1eb48b9a10a50bfa4702208e6";
-    license = [ "gfl" ];
+    license = [ "lppl13c" ];
     version = "2.005";
     sha512.run = "bacdb541c99bcf1b25fdfd87094a98ce48642e534e0017676fccdc81843f9f1e64af271180589a96513915dfa15a782458e151c760ddb26929a29ba0b9e141ef";
   };
@@ -31208,7 +31208,7 @@
     shortdesc = "OpenType maths fonts for Latin Modern";
     stripPrefix = 0;
     sha512.doc = "fb1800349628229dd522d4dffa182ffd2bc9411803f5b349c88f4046d81117d050a3b681e3021a514a6ada5bc49b648b8dda8b553f9294f6d4fc317db0cd5990";
-    license = [ "gfl" ];
+    license = [ "lppl13c" ];
     version = "1.959";
     sha512.run = "2fad475b347824d564525de51ed5bd1cc7ab2fc27fd826a00e86ebabd7d85afce2f7a4c85d9620c9b66d14ea0c813a269a13843a0b27eb7d0ca3e294114aad26";
   };
@@ -36308,7 +36308,7 @@
     shortdesc = "Computer Modern fonts including matching non-latin alphabets";
     stripPrefix = 0;
     sha512.doc = "53c08c7ed1e48259bf4d2795aece253081b1e3fc1920d670ee905a1ee5bd0a8724dd716cc7e2837813d6550ddedf84db8a67ea3411ad5e2eef6374ece0a172fe";
-    license = [ "gfl" ];
+    license = [ "lppl13c" ];
     version = "7.1.1";
     sha512.run = "897ca5aa04f2517482db7a0c6b7b657b2b3f8bf1592768163d46ab64fbe267b182e55fc301b18ca3f33d160b9bff2df59992cfa1a1417c9aa5ffb8978c59ef64";
   };
@@ -36372,7 +36372,7 @@
     sha512.source = "2280bc1acd7b0b5a091cb2fc9dea593f9c14249af05f2949a81474ef98e1c2c03411f5e63658e0e5dcdb006bb4c3821bc46c1c6828b218498a4c1782c11fec3a";
     license = [
       "lppl13c"
-      "gfl"
+      "lppl13c"
     ];
     version = "1.551";
     sha512.run = "b30fc096da4b1a8b377a8f6a78f86c497228237b103c4788a95112f9aee3f3a13872cefb68edb9d447f9f9e95789c167825b5787b38d7c3a2b588536bdcdd575";
@@ -37407,7 +37407,7 @@
     sha512.doc = "0ab232aa7af2a308f92701d901690d1315c64ff7cb868deca6097ed7b59c9a40fb19a781ee142e1a7af0b625870e1e867306eb06bc8478c7e36f05171d4d08be";
     license = [
       "ofl"
-      "gfl"
+      "lppl13c"
       "lppl13c"
       "fdl13Only"
     ];
@@ -40340,7 +40340,7 @@
       "Map ap.map"
     ];
     sha512.doc = "0e1506e25c75d7da08d0f35f50bb5b6b8a9cde365b6ad9a19cdb90a71c4b086189b59474961e499625fa19f33173279a2dabdf58259a1151d81eff721b5c9a96";
-    license = [ "gfl" ];
+    license = [ "lppl13c" ];
     version = "1.101";
     sha512.run = "ee05ea8e1e992b9f08b62ee02da4090d2bc965445e6357cda3c9b5cded34387c290aed7d6119e7a73731ba99547ebdfb276a0b7e9ba8917218e8d9cdeb011c5b";
   };
@@ -47917,7 +47917,7 @@
     shortdesc = "A Greek cult font from the eighties";
     stripPrefix = 0;
     sha512.doc = "9bdbd72f86e0b957580bb008ba349eb428721913010e9fe2cd9ee9b01733d6259914712b60a4a7f0f5804041e6cf876d8bdda2910de1b191715c1d9c8d8fbf77";
-    license = [ "gfl" ];
+    license = [ "lppl13c" ];
     version = "1.0";
     sha512.run = "50a35159c65afa43900ee8633d2b86effa5aec6a430f2e8fa85f77442da35b140012b27959155564e29286aba465d9bab17c9f5ce5ec0a889ec4ed5dff1b4dcb";
   };
@@ -48346,7 +48346,7 @@
     ];
     sha512.doc = "db2bcc8da6d3bfb6f2165c1fb127b2b4a7471e41a0cebb851ce5465a18740d34948ce8292b4f6bd359621166602cf62a978bb179346dbd1dcfada49cc7972686";
     sha512.source = "e958408e6e64a54b25fa89b38de181c96fffb9eb8762959209799c39cead7a5525f220b7b3cd278e35cb9e3e49c1c85d565d518ffacb0695b0c3c09ede935266";
-    license = [ "gfl" ];
+    license = [ "lppl13c" ];
     version = "2.501";
     sha512.run = "5422f349d15233e6f49576fe3a65f8afb5cae6a3c51e5ad7cb56617d7d064e9cf574f233f789c029c04bbfc24e5948c115b2d33569e881373d68615ac709153f";
   };
@@ -48356,7 +48356,7 @@
     stripPrefix = 0;
     sha512.doc = "cd346226dc36bb4fb5324a43dfab7790cd80ec6bba992849dfcca74ea6fe8d85fe7e0ac66408a41ac1ef644e6b32c9b06d337c4f394fbfd8fba4153fbc1abfe9";
     sha512.source = "3c58821e5307257578ec149317cb621331aafa00bfa465eeb055f1f93691ce57a489a32a7eea068b12b70228433031de33c0ffe36b0e8e10b368e0ef5e33fe24";
-    license = [ "gfl" ];
+    license = [ "lppl13c" ];
     sha512.run = "a50a9eaa30cfd7754ae702a3bd6fced2d07fac858215b913945665940c71a0aafd2b59a0d0baa0fb9d5090773ef69a86864cc11126a5e30adc3d0e94cdbd2594";
   };
   tex-ini-files = {
@@ -52806,7 +52806,7 @@
     shortdesc = "Font definitions for the variable Latin Modern fonts";
     stripPrefix = 0;
     sha512.doc = "56bbeff2f9cb4a99c05416d7fae7cea8cef81e712092ae8b5d1ca644769debdd95c443fb6af7edc034fe9d778147e1b37da50d951278a7f64c407dead5f6e7cb";
-    license = [ "gfl" ];
+    license = [ "lppl13c" ];
     version = "1.2";
     sha512.run = "1c34d4afa65db4993f3098cb32b604c68a75bc2c0b56b026a6d50c2de61392d4bace210dab2fb5ca0c15253e7486406aa3aa5084e2296bd5e8f1e9c953419627";
   };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 8f78942ed2c1..f46b6fb8fceb 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -12426,6 +12426,8 @@ self: super: with self; {
 
   odfpy = callPackage ../development/python-modules/odfpy { };
 
+  odl-renderer = callPackage ../development/python-modules/odl-renderer { };
+
   odp-amsterdam = callPackage ../development/python-modules/odp-amsterdam { };
 
   odsgenerator = callPackage ../development/python-modules/odsgenerator { };
@@ -18100,6 +18102,8 @@ self: super: with self; {
 
   resend = callPackage ../development/python-modules/resend { };
 
+  resize-image = callPackage ../development/python-modules/resize-image { };
+
   resize-right = callPackage ../development/python-modules/resize-right { };
 
   resolvelib = callPackage ../development/python-modules/resolvelib { };