diff --git a/nixos/modules/services/networking/syncthing.nix b/nixos/modules/services/networking/syncthing.nix
index fc990106ddd0..97893d2fccb5 100644
--- a/nixos/modules/services/networking/syncthing.nix
+++ b/nixos/modules/services/networking/syncthing.nix
@@ -262,7 +262,15 @@ let
                   If it does, write the ignore patterns to the rest API.
                 */
                 + lib.optionalString ((conf_type == "dirs") && (new_cfg.ignorePatterns != null)) ''
-                  curl -d '{"ignore": ${builtins.toJSON new_cfg.ignorePatterns}}' -X POST ${s.ignoreAddress}?folder=${lib.strings.escapeURL new_cfg.id}
+                  curl -d ${
+                    lib.pipe new_cfg.ignorePatterns [
+                      (patterns: {
+                        ignore = patterns;
+                      })
+                      builtins.toJSON
+                      lib.escapeShellArg
+                    ]
+                  } -X POST ${s.ignoreAddress}?folder=${lib.strings.escapeURL new_cfg.id}
                 ''
               ))
               (lib.concatStringsSep "\n")
diff --git a/nixos/tests/syncthing/folders.nix b/nixos/tests/syncthing/folders.nix
index 46b4b4488e44..1a182da4c845 100644
--- a/nixos/tests/syncthing/folders.nix
+++ b/nixos/tests/syncthing/folders.nix
@@ -103,6 +103,9 @@ in
               ];
               ignorePatterns = [
                 "notB"
+                # Just test that an apostrophe doesn't break the curl config
+                # commands. See: https://github.com/NixOS/nixpkgs/issues/554744
+                "apostrophe'"
               ];
             };
           };
diff --git a/pkgs/applications/networking/browsers/brave/packages/brave-origin.nix b/pkgs/applications/networking/browsers/brave/packages/brave-origin.nix
index c8c53ce41bbf..f3dddcf388bf 100644
--- a/pkgs/applications/networking/browsers/brave/packages/brave-origin.nix
+++ b/pkgs/applications/networking/browsers/brave/packages/brave-origin.nix
@@ -1,21 +1,21 @@
 # Expression generated by update.sh; do not edit it by hand!
 rec {
   pname = "brave-origin";
-  version = "1.93.138";
+  version = "1.94.117";
   flavor = "origin";
 
   archives = {
     aarch64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-origin_${version}_arm64.deb";
-      hash = "sha256-0IEoUxiJa0sycjNJnPQTYG5l5IG/J9NyU6xva5ch02o=";
+      hash = "sha256-/r9jWo+QMiJeqwRjKNx8mXYMD4tITth2cHxDedXFzKc=";
     };
     x86_64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-origin_${version}_amd64.deb";
-      hash = "sha256-CbI1dW4m/3fjgMe7uvP/Pk/jcXDBEIq0/ttHKrlG5CU=";
+      hash = "sha256-xY1483jABvhlaCVSh9yDAwrXQ08EoE++wQcJalTVvuY=";
     };
     aarch64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-origin-v${version}-darwin-arm64.zip";
-      hash = "sha256-+V9fF33k+R/n7O+mbXIXq+9NDJ3smgoGbKOBXpYAb1U=";
+      hash = "sha256-RNiCmwQe7fm4ces5viTBkxQV4RGK8GFSbNNN38e1Y5o=";
     };
   };
 }
diff --git a/pkgs/applications/networking/browsers/brave/packages/brave.nix b/pkgs/applications/networking/browsers/brave/packages/brave.nix
index 7e42aa2907bc..c5dbc8b60da0 100644
--- a/pkgs/applications/networking/browsers/brave/packages/brave.nix
+++ b/pkgs/applications/networking/browsers/brave/packages/brave.nix
@@ -1,20 +1,20 @@
 # Expression generated by update.sh; do not edit it by hand!
 rec {
   pname = "brave";
-  version = "1.93.138";
+  version = "1.94.117";
 
   archives = {
     aarch64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb";
-      hash = "sha256-WWXn2Q2axhh9/KU67v6wf4vmRRXuYmJHbNmyOvvvg9c=";
+      hash = "sha256-4LTeb3BOBv+oRzC409UmSnFQDC3XRtKWmkPUcHOTkuM=";
     };
     x86_64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-      hash = "sha256-zxiy1EPwZyQeE2YkhMS5Uj8T/wibofwnyI9nkRWGrJ8=";
+      hash = "sha256-ZAAX6ZNZS0ogFRjDfmyAoWo4NbXckswHY7Amfh3skyQ=";
     };
     aarch64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-arm64.zip";
-      hash = "sha256-UdT5CHZM4VZbT81gkF4i+4aXVADXtU+M1kfv2rqYcjw=";
+      hash = "sha256-OHPEARZoRW1/svXUTP+5rWTyNu6xOYisBkSJy+Z4Vzo=";
     };
   };
 }
diff --git a/pkgs/by-name/ac/actual-server/package.nix b/pkgs/by-name/ac/actual-server/package.nix
index 3c5ef242e763..505933076cad 100644
--- a/pkgs/by-name/ac/actual-server/package.nix
+++ b/pkgs/by-name/ac/actual-server/package.nix
@@ -15,13 +15,13 @@
 let
   nodejs = nodejs_22;
   yarn-berry = yarn-berry_4.override { inherit nodejs; };
-  version = "26.8.1";
+  version = "26.9.0";
   src = fetchFromGitHub {
     name = "actualbudget-actual-source";
     owner = "actualbudget";
     repo = "actual";
     tag = "v${version}";
-    hash = "sha256-xOvcp4B3yz+v/XAx4wVQ5PgBia6z/7SWRGkFDlcc6J0=";
+    hash = "sha256-dUuCLG3u3Wg5/IRF24JuZ/ysdWva1Du3tiZfUwyFA54=";
   };
   translations = fetchFromGitHub {
     name = "actualbudget-translations-source";
@@ -29,8 +29,8 @@ let
     repo = "translations";
     # Note to updaters: this repo is not tagged, so just update this to the Git
     # tip at the time the update is performed.
-    rev = "f5a3541768632052e2e2039f977e3dc608ef0b60";
-    hash = "sha256-NTEStwU6UzbrGpYoEosbwstoQAXvZYqgK2HCF6Jf6Ak=";
+    rev = "a76613b91248f6eb0e76aecfa6b9b7dcc1909f94";
+    hash = "sha256-oP0DCjI9MTscZAsdktnjGLeONv7huaSpnArf/Lq/TAw=";
   };
 
 in
@@ -112,7 +112,7 @@ stdenv.mkDerivation (finalAttrs: {
   missingHashes = ./missing-hashes.json;
   offlineCache = yarn-berry.fetchYarnBerryDeps {
     inherit (finalAttrs) src missingHashes;
-    hash = "sha256-wYBRDhf1lu1xiNdWh7jXM2Ecimj/aETI863G0PlFLRU=";
+    hash = "sha256-CMNchystIhRLJJUqITL4gLOtxTJFmhUTWRgy+jMBrX4=";
   };
 
   pname = "actual-server";
diff --git a/pkgs/by-name/ai/airtame/package.nix b/pkgs/by-name/ai/airtame/package.nix
index 1dd38809bce8..54ca7d7333a7 100644
--- a/pkgs/by-name/ai/airtame/package.nix
+++ b/pkgs/by-name/ai/airtame/package.nix
@@ -71,11 +71,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "airtame-application";
-  version = "4.15.0";
+  version = "4.16.0";
 
   src = fetchurl {
     url = "https://downloads.airtame.com/app/latest/linux/Airtame-${finalAttrs.version}.deb";
-    hash = "sha256-NCk//XCtn5wguMh2FjGpW28ksfUg2+euEln4gczBweY=";
+    hash = "sha256-wjWuPqXXonxbaobwl6dpYmUHA5W3+LXYskFJLUsjDf8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/aw/aws-workspaces/package.nix b/pkgs/by-name/aw/aws-workspaces/package.nix
index 2d7d2ee6bce5..360c8f7eedb7 100644
--- a/pkgs/by-name/aw/aws-workspaces/package.nix
+++ b/pkgs/by-name/aw/aws-workspaces/package.nix
@@ -4,7 +4,7 @@
   writeShellApplication,
   buildFHSEnv,
   webkitgtk_4_1,
-  ffmpeg_7,
+  ffmpeg_8,
   gtk4,
   libepoxy,
   wayland,
@@ -39,7 +39,7 @@ let
           exit 1
       fi
 
-      echo "Release: 22.04"
+      echo "Release: 24.04"
     '';
   };
 in
@@ -59,7 +59,7 @@ buildFHSEnv {
     libepoxy
     libxcb
     libxi
-    ffmpeg_7
+    ffmpeg_8
     pango
     atk
     cairo
diff --git a/pkgs/by-name/aw/aws-workspaces/workspacesclient.nix b/pkgs/by-name/aw/aws-workspaces/workspacesclient.nix
index d50cd4c1ae14..f5f3b8a16009 100644
--- a/pkgs/by-name/aw/aws-workspaces/workspacesclient.nix
+++ b/pkgs/by-name/aw/aws-workspaces/workspacesclient.nix
@@ -14,13 +14,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "workspacesclient";
-  version = "2025.1.5526-1";
+  version = "2026.0.5677-1";
 
   src = fetchurl {
     urls = [
       "https://d3nt0h4h6pmmc4.cloudfront.net/ubuntu/dists/noble/main/binary-amd64/workspacesclient_${finalAttrs.version}_amd64.ubuntu2404.deb"
     ];
-    hash = "sha256-iGYKpbpzGNeEUKgozhSwVd9dWRgQEbozIAWRu7wu2D8=";
+    hash = "sha256-11bSNQANgLIoi2FbAtJSlEXzKe9KPRlbFdbLQAPQQ5g=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/bu/buildbox/package.nix b/pkgs/by-name/bu/buildbox/package.nix
index 96811863d55d..e38b11b77fe7 100644
--- a/pkgs/by-name/bu/buildbox/package.nix
+++ b/pkgs/by-name/bu/buildbox/package.nix
@@ -23,13 +23,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "buildbox";
-  version = "1.4.18";
+  version = "1.4.21";
 
   src = fetchFromGitLab {
     owner = "BuildGrid";
     repo = "buildbox/buildbox";
     tag = finalAttrs.version;
-    hash = "sha256-HQws9hgCop77+WzJ/EnSD0C8WPgFuAky+GIgGRxU744=";
+    hash = "sha256-Kg7aiVeOMA+hke481r0btUpzk/K0h7qA9l6DuLR+OAM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ch/check-if-email-exists/package.nix b/pkgs/by-name/ch/check-if-email-exists/package.nix
new file mode 100644
index 000000000000..f78daac02127
--- /dev/null
+++ b/pkgs/by-name/ch/check-if-email-exists/package.nix
@@ -0,0 +1,58 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+  openssl,
+  pkg-config,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "check-if-email-exists";
+  version = "0.11.7";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "reacherhq";
+    repo = "check-if-email-exists";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-KRnSTufgpmT6Yo+7NcaRARjtXOCwvbcXXX4or8YTmjo=";
+  };
+
+  cargoHash = "sha256-syuwY4qpnvWTXDZ6onnpFSmiEs1GCttSDtR5+vzuUDY=";
+
+  # upstream forgot to bump crate version
+  postPatch = ''
+    substituteInPlace cli/Cargo.toml \
+      --replace-fail 'version = "0.11.6"' 'version = "${finalAttrs.version}"'
+  '';
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ openssl ];
+
+  env.OPENSSL_NO_VENDOR = 1;
+
+  # require network
+  checkFlags = [
+    "--skip=smtp::tests::should_timeout"
+    "--skip=tests::test_input_foo_bar_baz"
+  ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Check if an email address exists without sending any email";
+    homepage = "https://github.com/reacherhq/check-if-email-exists";
+    changelog = "https://github.com/reacherhq/check-if-email-exists/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ stepbrobd ];
+    mainProgram = "check_if_email_exists";
+  };
+})
diff --git a/pkgs/by-name/cr/cri-tools/package.nix b/pkgs/by-name/cr/cri-tools/package.nix
index 7e2bd44954eb..a22446f895a6 100644
--- a/pkgs/by-name/cr/cri-tools/package.nix
+++ b/pkgs/by-name/cr/cri-tools/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "cri-tools";
-  version = "1.36.0";
+  version = "1.37.0";
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
     repo = "cri-tools";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Ae0CL/BZdIBzZr+Tttg6sNhn1eS2E1odR6fGpbFRVjI=";
+    hash = "sha256-8TjS7cZXgiaSD7tEQbZmQIQUBkniIHjgAqyMEVqQrd0=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/da/dawarich/0002-rails-CVE-2026-66066.diff b/pkgs/by-name/da/dawarich/0002-rails-CVE-2026-66066.diff
deleted file mode 100644
index 08feece3072b..000000000000
--- a/pkgs/by-name/da/dawarich/0002-rails-CVE-2026-66066.diff
+++ /dev/null
@@ -1,180 +0,0 @@
-diff --git a/Gemfile b/Gemfile
-index 538d7431..3e53d850 100644
---- a/Gemfile
-+++ b/Gemfile
-@@ -51,7 +51,7 @@ gem 'pundit', '>= 2.5.1'
- gem 'rack-attack'
- gem 'rack-cors'
- gem 'rack-session', '>= 2.1.2'
--gem 'rails', '~> 8.1.3'
-+gem 'rails', '~> 8.1.3.1'
- gem 'rails_icons'
- gem 'redis'
- gem 'resolv-replace', '~> 0.2.0'
-diff --git a/Gemfile.lock b/Gemfile.lock
-index 49b5e58c..0ad5f2a0 100644
---- a/Gemfile.lock
-+++ b/Gemfile.lock
-@@ -12,29 +12,29 @@ GEM
-   specs:
-     action_text-trix (2.1.19)
-       railties
--    actioncable (8.1.3)
--      actionpack (= 8.1.3)
--      activesupport (= 8.1.3)
-+    actioncable (8.1.3.1)
-+      actionpack (= 8.1.3.1)
-+      activesupport (= 8.1.3.1)
-       nio4r (~> 2.0)
-       websocket-driver (>= 0.6.1)
-       zeitwerk (~> 2.6)
--    actionmailbox (8.1.3)
--      actionpack (= 8.1.3)
--      activejob (= 8.1.3)
--      activerecord (= 8.1.3)
--      activestorage (= 8.1.3)
--      activesupport (= 8.1.3)
-+    actionmailbox (8.1.3.1)
-+      actionpack (= 8.1.3.1)
-+      activejob (= 8.1.3.1)
-+      activerecord (= 8.1.3.1)
-+      activestorage (= 8.1.3.1)
-+      activesupport (= 8.1.3.1)
-       mail (>= 2.8.0)
--    actionmailer (8.1.3)
--      actionpack (= 8.1.3)
--      actionview (= 8.1.3)
--      activejob (= 8.1.3)
--      activesupport (= 8.1.3)
-+    actionmailer (8.1.3.1)
-+      actionpack (= 8.1.3.1)
-+      actionview (= 8.1.3.1)
-+      activejob (= 8.1.3.1)
-+      activesupport (= 8.1.3.1)
-       mail (>= 2.8.0)
-       rails-dom-testing (~> 2.2)
--    actionpack (8.1.3)
--      actionview (= 8.1.3)
--      activesupport (= 8.1.3)
-+    actionpack (8.1.3.1)
-+      actionview (= 8.1.3.1)
-+      activesupport (= 8.1.3.1)
-       nokogiri (>= 1.8.5)
-       rack (>= 2.2.4)
-       rack-session (>= 1.0.1)
-@@ -42,39 +42,39 @@ GEM
-       rails-dom-testing (~> 2.2)
-       rails-html-sanitizer (~> 1.6)
-       useragent (~> 0.16)
--    actiontext (8.1.3)
-+    actiontext (8.1.3.1)
-       action_text-trix (~> 2.1.15)
--      actionpack (= 8.1.3)
--      activerecord (= 8.1.3)
--      activestorage (= 8.1.3)
--      activesupport (= 8.1.3)
-+      actionpack (= 8.1.3.1)
-+      activerecord (= 8.1.3.1)
-+      activestorage (= 8.1.3.1)
-+      activesupport (= 8.1.3.1)
-       globalid (>= 0.6.0)
-       nokogiri (>= 1.8.5)
--    actionview (8.1.3)
--      activesupport (= 8.1.3)
-+    actionview (8.1.3.1)
-+      activesupport (= 8.1.3.1)
-       builder (~> 3.1)
-       erubi (~> 1.11)
-       rails-dom-testing (~> 2.2)
-       rails-html-sanitizer (~> 1.6)
--    activejob (8.1.3)
--      activesupport (= 8.1.3)
-+    activejob (8.1.3.1)
-+      activesupport (= 8.1.3.1)
-       globalid (>= 0.3.6)
--    activemodel (8.1.3)
--      activesupport (= 8.1.3)
--    activerecord (8.1.3)
--      activemodel (= 8.1.3)
--      activesupport (= 8.1.3)
-+    activemodel (8.1.3.1)
-+      activesupport (= 8.1.3.1)
-+    activerecord (8.1.3.1)
-+      activemodel (= 8.1.3.1)
-+      activesupport (= 8.1.3.1)
-       timeout (>= 0.4.0)
-     activerecord-postgis-adapter (11.1.1)
-       activerecord (~> 8.1.0)
-       rgeo-activerecord (~> 8.1.0)
--    activestorage (8.1.3)
--      actionpack (= 8.1.3)
--      activejob (= 8.1.3)
--      activerecord (= 8.1.3)
--      activesupport (= 8.1.3)
-+    activestorage (8.1.3.1)
-+      actionpack (= 8.1.3.1)
-+      activejob (= 8.1.3.1)
-+      activerecord (= 8.1.3.1)
-+      activesupport (= 8.1.3.1)
-       marcel (~> 1.0)
--    activesupport (8.1.3)
-+    activesupport (8.1.3.1)
-       base64
-       bigdecimal
-       concurrent-ruby (~> 1.0, >= 1.3.1)
-@@ -457,20 +457,20 @@ GEM
-       rack (>= 1.3)
-     rackup (2.3.1)
-       rack (>= 3)
--    rails (8.1.3)
--      actioncable (= 8.1.3)
--      actionmailbox (= 8.1.3)
--      actionmailer (= 8.1.3)
--      actionpack (= 8.1.3)
--      actiontext (= 8.1.3)
--      actionview (= 8.1.3)
--      activejob (= 8.1.3)
--      activemodel (= 8.1.3)
--      activerecord (= 8.1.3)
--      activestorage (= 8.1.3)
--      activesupport (= 8.1.3)
-+    rails (8.1.3.1)
-+      actioncable (= 8.1.3.1)
-+      actionmailbox (= 8.1.3.1)
-+      actionmailer (= 8.1.3.1)
-+      actionpack (= 8.1.3.1)
-+      actiontext (= 8.1.3.1)
-+      actionview (= 8.1.3.1)
-+      activejob (= 8.1.3.1)
-+      activemodel (= 8.1.3.1)
-+      activerecord (= 8.1.3.1)
-+      activestorage (= 8.1.3.1)
-+      activesupport (= 8.1.3.1)
-       bundler (>= 1.15.0)
--      railties (= 8.1.3)
-+      railties (= 8.1.3.1)
-     rails-dom-testing (2.3.0)
-       activesupport (>= 5.0.0)
-       minitest
-@@ -481,9 +481,9 @@ GEM
-     rails_icons (1.9.0)
-       icons (~> 0.9.0)
-       rails (>= 7.0)
--    railties (8.1.3)
--      actionpack (= 8.1.3)
--      activesupport (= 8.1.3)
-+    railties (8.1.3.1)
-+      actionpack (= 8.1.3.1)
-+      activesupport (= 8.1.3.1)
-       irb (~> 1.13)
-       rackup (>= 1.0.0)
-       rake (>= 12.2)
-@@ -780,7 +780,7 @@ DEPENDENCIES
-   rack-attack
-   rack-cors
-   rack-session (>= 2.1.2)
--  rails (~> 8.1.3)
-+  rails (~> 8.1.3.1)
-   rails_icons
-   redis
-   resolv-replace (~> 0.2.0)
diff --git a/pkgs/by-name/da/dawarich/gemset.nix b/pkgs/by-name/da/dawarich/gemset.nix
index 870212ff4057..4ce10fbc6b93 100644
--- a/pkgs/by-name/da/dawarich/gemset.nix
+++ b/pkgs/by-name/da/dawarich/gemset.nix
@@ -1366,10 +1366,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0ay31y1yl208xrpcsw6b0k4q309magq7q5prmdbb0lm9ampbqqlk";
+      sha256 = "0shwgjqbj856mb6m9kgkpy08nhym2gdvc2yaprlimfmky9y3n78z";
       type = "gem";
     };
-    version = "2.20.0";
+    version = "2.21.2";
   };
   json-jwt = {
     dependencies = [
@@ -1556,10 +1556,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0ha9sgkfqna62c1basc17dkx91yk7ppgjq32k4nhrikirlz6g9kg";
+      sha256 = "1s30l5z7jkazgi4m6l6mh80rgsyhh2pp1pa5h70xclsj8z54wmq6";
       type = "gem";
     };
-    version = "2.9.0";
+    version = "2.9.1";
   };
   marcel = {
     groups = [ "default" ];
diff --git a/pkgs/by-name/da/dawarich/package.nix b/pkgs/by-name/da/dawarich/package.nix
index c68bc1547b37..bb841683497d 100644
--- a/pkgs/by-name/da/dawarich/package.nix
+++ b/pkgs/by-name/da/dawarich/package.nix
@@ -35,11 +35,6 @@ stdenv.mkDerivation (finalAttrs: {
     patches = [
       # bundix and bundlerEnv fail with system-specific gems
       ./0001-build-ffi-gem.diff
-      # Ensure fix for CVE-2026-66066
-      # https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm
-      # While Dawarich 1.10.3 already unintentionally patches this vulnerability,
-      # it is safer to bump rails to a fixed version.
-      ./0002-rails-CVE-2026-66066.diff
     ];
     postPatch = ''
       substituteInPlace ./Gemfile \
diff --git a/pkgs/by-name/da/dawarich/sources.json b/pkgs/by-name/da/dawarich/sources.json
index 3268087118d6..c8bcf767ccc2 100644
--- a/pkgs/by-name/da/dawarich/sources.json
+++ b/pkgs/by-name/da/dawarich/sources.json
@@ -1,5 +1,5 @@
 {
-  "version": "1.10.3",
-  "hash": "sha256-y4i4NJHoYAczMM3f8VQTNaFTP7jZiRxMZcCvmUIEIR4=",
-  "npmHash": "sha256-roVYRsYBOuDQf8vWiYIWevogArEZ1xre9sQues5E5VM="
+  "version": "1.14.0",
+  "hash": "sha256-ZIwhjWp+5R6EgvQ61U3nKByGPvYQVZd7izzgwwWpCOk=",
+  "npmHash": "sha256-WXwDi3K9s77+d/1lEOmUKeOZkcvUEsh8YnPztaqKHjk="
 }
diff --git a/pkgs/by-name/do/dockerfile-pin/package.nix b/pkgs/by-name/do/dockerfile-pin/package.nix
index 6300d8438938..1f2adb1b0061 100644
--- a/pkgs/by-name/do/dockerfile-pin/package.nix
+++ b/pkgs/by-name/do/dockerfile-pin/package.nix
@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "dockerfile-pin";
-  version = "1.3.0";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "azu";
     repo = "dockerfile-pin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vBBcLQ4ZgiLbUMuDvn8Um24yB9EknuUeU+sxMdg+qoc=";
+    hash = "sha256-iryIIYt1sNa9FYk7myrt/vylp9sMG1riqyYNzAytME4=";
   };
 
   vendorHash = "sha256-CgMFIYoM+nWiZ5NXtTlXHhrjzVYxoVg0YVpQq3LLrjI=";
diff --git a/pkgs/by-name/fi/firecrawl-cli/package.nix b/pkgs/by-name/fi/firecrawl-cli/package.nix
index 9a8ed8aa750e..769d5f633c5a 100644
--- a/pkgs/by-name/fi/firecrawl-cli/package.nix
+++ b/pkgs/by-name/fi/firecrawl-cli/package.nix
@@ -15,7 +15,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "firecrawl-cli";
-  version = "1.21.1";
+  version = "1.23.3";
   __structuredAttrs = true;
   strictDeps = true;
 
@@ -28,7 +28,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     owner = "firecrawl";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zFtXf+3vj/xcodCTbyEvQsNqNqnnnOvnrWFn65+heS0=";
+    hash = "sha256-2BPD48hnJpUPppV57lDRjHQNh6t+QEsOU4tOepUtyc4=";
   };
 
   patches = [
diff --git a/pkgs/by-name/gi/git-credential-gopass/package.nix b/pkgs/by-name/gi/git-credential-gopass/package.nix
index c5b2ad2852db..2c9ec2ea8619 100644
--- a/pkgs/by-name/gi/git-credential-gopass/package.nix
+++ b/pkgs/by-name/gi/git-credential-gopass/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "git-credential-gopass";
-  version = "1.16.1";
+  version = "1.17.0";
 
   src = fetchFromGitHub {
     owner = "gopasspw";
     repo = "git-credential-gopass";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-IEur3Sw2zRYJxlwAhgpb2OnBt+FcC+OdeT7M/LzJwoY=";
+    hash = "sha256-V+SEkV4I925S6sL9YC0QtEp76xENUaQO+XixWzsSqvs=";
   };
 
-  vendorHash = "sha256-mtJIm7dH3jP7p0R0KxN0Yf7mi9rkJ73u8biy2Ygvk3k=";
+  vendorHash = "sha256-OgwsQQRaJSwdh0+n1FdqAJzJ4pyggaejwg7oMEzEd9Q=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/go/gomuks-web/package.nix b/pkgs/by-name/go/gomuks-web/package.nix
index 0ee8671cb9a6..c6f53fcf3a09 100644
--- a/pkgs/by-name/go/gomuks-web/package.nix
+++ b/pkgs/by-name/go/gomuks-web/package.nix
@@ -11,17 +11,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "gomuks-web";
-  version = "26.07";
+  version = "26.08";
 
   src = fetchFromGitHub {
     owner = "gomuks";
     repo = "gomuks";
     tag = "v0.${lib.replaceStrings [ "." ] [ "" ] finalAttrs.version}.0";
-    hash = "sha256-OgcmRBuVFTPzAVgNVDUZcfdgxHi4mtUcbmfTRPx/f9M=";
+    hash = "sha256-2HjMHd6qUkRiF/XdP/iW7TT55tHnJHsLRCIakTf4DQc=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-wNscq9FDJb9+WqKCBZ9YD+EQ/Sc2PAznunKP6hrs+Ms=";
+  vendorHash = "sha256-EAzCVLxxB5n3exq/NXY3ORMcrHRh6LqONAzXp1n3sgg=";
 
   nativeBuildInputs = [
     nodejs
@@ -37,7 +37,7 @@ buildGoModule (finalAttrs: {
     npmRoot = "web";
     npmDeps = fetchNpmDeps {
       src = "${finalAttrs.src}/web";
-      hash = "sha256-C+zEMI2wmO3EvefpswTk9Tq3AV1Acfi+w3oO5WpxLIQ=";
+      hash = "sha256-2QXKaUXe15svQQia1sWwab42vI68He3pBN7xiOZ+UKE=";
     };
   };
 
diff --git a/pkgs/by-name/go/gotenberg/5.patch b/pkgs/by-name/go/gotenberg/5.patch
new file mode 100644
index 000000000000..8e6db3242adc
--- /dev/null
+++ b/pkgs/by-name/go/gotenberg/5.patch
@@ -0,0 +1,41 @@
+From 4d74bc8e315c92cd6b2d51b246e37ed07fb92f69 Mon Sep 17 00:00:00 2001
+From: Sandro <sandro.jaeckel@gmail.com>
+Date: Mon, 31 Aug 2026 01:20:37 +0200
+Subject: [PATCH] Remove compatibility fixes for very old LO/OO.
+
+Based on https://github.com/NixOS/nixpkgs/blob/master/pkgs/by-name/un/unoconv/0001-Remove-compatibility-fixes-for-very-old-LO-OO.patch
+---
+ unoconv | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/unoconv b/unoconv
+index 40fb840..b95137a 100644
+--- a/unoconv
++++ b/unoconv
+@@ -16,7 +16,6 @@
+ 
+ from __future__ import print_function
+ 
+-from distutils.version import LooseVersion
+ import getopt
+ import glob
+ import os
+@@ -873,10 +872,7 @@ class Convertor:
+             info(3, "Launching our own listener using %s." % office.binary)
+             try:
+                 product = self.svcmgr.createInstance("com.sun.star.configuration.ConfigurationProvider").createInstanceWithArguments("com.sun.star.configuration.ConfigurationAccess", UnoProps(nodepath="/org.openoffice.Setup/Product"))
+-                if product.ooName not in ('LibreOffice', 'LOdev') or LooseVersion(product.ooSetupVersion) <= LooseVersion('3.3'):
+-                    args = [office.binary, "-headless", "-invisible", "-nocrashreport", "-nodefault", "-nofirststartwizard", "-nologo", "-norestore", "-accept=%s" % op.connection]
+-                else:
+-                    args = [office.binary, "--headless", "--invisible", "--nocrashreport", "--nodefault", "--nofirststartwizard", "--nologo", "--norestore", "--accept=%s" % op.connection]
++                args = [office.binary, "--headless", "--invisible", "--nocrashreport", "--nodefault", "--nofirststartwizard", "--nologo", "--norestore", "--accept=%s" % op.connection]
+                 if op.userProfile:
+                     args.append("-env:UserInstallation=file://" + realpath(op.userProfile))
+                 info(2, '%s listener arguments are %s.' % (product.ooName, args))
+@@ -1489,4 +1485,4 @@ if __name__ == '__main__':
+         main()
+     except KeyboardInterrupt:
+         die(6, 'Exiting on user request')
+-    die(exitcode)
+\ No newline at end of file
++    die(exitcode)
diff --git a/pkgs/by-name/go/gotenberg/package.nix b/pkgs/by-name/go/gotenberg/package.nix
index fac4e22a632a..4b047515d881 100644
--- a/pkgs/by-name/go/gotenberg/package.nix
+++ b/pkgs/by-name/go/gotenberg/package.nix
@@ -7,20 +7,65 @@
   makeBinaryWrapper,
   pdftk,
   qpdf,
-  unoconv,
   mktemp,
   makeFontsConf,
   liberation_ttf_v2,
   exiftool,
   pdfcpu,
+  makeWrapper,
   nixosTests,
   nix-update-script,
+  stdenvNoCC,
 }:
 let
   fontsConf = makeFontsConf { fontDirectories = [ liberation_ttf_v2 ]; };
   jre' = libreoffice.unwrapped.jdk;
   libreoffice' = "${libreoffice}/lib/libreoffice/program/soffice.bin";
   inherit (lib) getExe;
+
+  unoconverter = stdenvNoCC.mkDerivation (finalAttrs: {
+    pname = "unoconverter";
+    version = "0.4.0";
+
+    src = fetchFromGitHub {
+      owner = "gotenberg";
+      repo = "unoconverter";
+      tag = "v${finalAttrs.version}";
+      hash = "sha256-K3d/6jvj0Tt1e83hVTHZ0N7FzPgJsjxlUBS1nbp82zw=";
+    };
+
+    patches = [
+      # Remove compatibility fixes for very old LO/OO
+      # https://github.com/gotenberg/unoconverter/pull/5
+      ./5.patch
+    ];
+
+    postPatch = ''
+      substituteInPlace unoconv \
+        --replace-fail "#!/usr/bin/env python" "#!${libreoffice.unwrapped.python.interpreter}"
+    '';
+
+    nativeBuildInputs = [
+      makeWrapper
+    ];
+
+    installPhase = ''
+      runHook preInstall
+
+      install -Dt $out/bin unoconv
+      wrapProgram "$out/bin/unoconv" \
+        --set-default UNO_PATH "${libreoffice.unwrapped}/lib/libreoffice/program/"
+
+      runHook postInstall
+    '';
+
+    meta = {
+      description = "Python script for interacting with LibreOffice";
+      homepage = "https://github.com/gotenberg/unoconverter";
+      license = lib.licenses.mit;
+      mainProgram = "unoconv";
+    };
+  });
 in
 buildGo126Module (finalAttrs: {
   pname = "gotenberg";
@@ -42,6 +87,12 @@ buildGo126Module (finalAttrs: {
 
   postPatch = ''
     find ./pkg -name '*_test.go' -exec sed -i -e 's#/tests#${finalAttrs.src}#g' {} \;
+
+    if ! grep -q "https://raw.githubusercontent.com/gotenberg/unoconverter/v${unoconverter.version}/unoconv" build/Dockerfile; then
+      unoconverter_version=$(grep -oP 'https://raw\.githubusercontent\.com/gotenberg/unoconverter/v\K[0-9]+\.[0-9]+\.[0-9]+(?=/unoconv)' build/Dockerfile)
+      echo "Our unoconverter version ${unoconverter.version} does not match upstream's version $unoconverter_version"
+      exit 1
+    fi
   '';
 
   nativeBuildInputs = [ makeBinaryWrapper ];
@@ -57,7 +108,7 @@ buildGo126Module (finalAttrs: {
     libreoffice
     pdftk
     qpdf
-    unoconv
+    unoconverter
     pdfcpu
     mktemp
     jre'
@@ -67,7 +118,7 @@ buildGo126Module (finalAttrs: {
     export CHROMIUM_BIN_PATH=${getExe chromium}
     export PDFTK_BIN_PATH=${getExe pdftk}
     export QPDF_BIN_PATH=${getExe qpdf}
-    export UNOCONVERTER_BIN_PATH=${getExe unoconv}
+    export UNOCONVERTER_BIN_PATH=${getExe unoconverter}
     export EXIFTOOL_BIN_PATH=${getExe exiftool}
     export PDFCPU_BIN_PATH=${getExe pdfcpu}
     # LibreOffice needs all of these set to work properly
@@ -100,7 +151,7 @@ buildGo126Module (finalAttrs: {
       --set PDFCPU_BIN_PATH "${getExe pdfcpu}" \
       --set PDFTK_BIN_PATH "${getExe pdftk}" \
       --set QPDF_BIN_PATH "${getExe qpdf}" \
-      --set UNOCONVERTER_BIN_PATH "${getExe unoconv}"
+      --set UNOCONVERTER_BIN_PATH "${getExe unoconverter}"
   '';
 
   passthru.updateScript = nix-update-script { };
diff --git a/pkgs/by-name/ic/icm/package.nix b/pkgs/by-name/ic/icm/package.nix
index 7779232862f0..4c8a0c7ef18b 100644
--- a/pkgs/by-name/ic/icm/package.nix
+++ b/pkgs/by-name/ic/icm/package.nix
@@ -13,17 +13,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "icm";
-  version = "0.10.61";
+  version = "0.10.63";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "rtk-ai";
     repo = "icm";
     tag = "icm-v${finalAttrs.version}";
-    hash = "sha256-dIZxq29umqRt81g0Y7RY90oAgf+ockrKfwPvFd8k8tU=";
+    hash = "sha256-gj0zqfJWrn9LyYTSi2IdIP01yDs6aQvlsFUZQ9pBokI=";
   };
 
-  cargoHash = "sha256-1YZ1GYnRxxbXXIG7d0+Nd8z2MhL8JQuuLexWNCmA+Ic=";
+  cargoHash = "sha256-f+j9SmxI046GFscyBwuZxwMZOtUk3cTePlCI6QIa+xw=";
 
   nativeBuildInputs = [
     makeBinaryWrapper
diff --git a/pkgs/by-name/km/kmscon/package.nix b/pkgs/by-name/km/kmscon/package.nix
index 2e78d3f1c692..080dba722166 100644
--- a/pkgs/by-name/km/kmscon/package.nix
+++ b/pkgs/by-name/km/kmscon/package.nix
@@ -33,13 +33,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "kmscon";
-  version = "10.0.2";
+  version = "10.0.3";
 
   src = fetchFromGitHub {
     owner = "kmscon";
     repo = "kmscon";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xUqPVI6pX0Chltq4Yt/J2HMv+zQ+IKI6kAbZrkd0wY4=";
+    hash = "sha256-qSxEdgHT8jVLWhx23w+VrT0IvJa8RjbzhCs6rvFBkTM=";
   };
 
   strictDeps = true;
@@ -80,15 +80,6 @@ stdenv.mkDerivation (finalAttrs: {
     zlib
   ];
 
-  # remove in next release
-  patches = [
-    (fetchpatch2 {
-      name = "fix-use-after-free-in-seat-remove-video.patch";
-      url = "https://github.com/kmscon/kmscon/commit/eb353401f56c21cc602a738c3edaece30e5639d6.patch?full_index=1";
-      hash = "sha256-NbuRfwBHK7AMlBOrzZYp4bbpOeTTEwh+uYtWBzQo2fs=";
-    })
-  ];
-
   outputs = [
     "out"
     "man"
diff --git a/pkgs/by-name/li/libretroPackages/cores/desmume.nix b/pkgs/by-name/li/libretroPackages/cores/desmume.nix
index d29d892714c5..bd12fc589965 100644
--- a/pkgs/by-name/li/libretroPackages/cores/desmume.nix
+++ b/pkgs/by-name/li/libretroPackages/cores/desmume.nix
@@ -10,13 +10,13 @@
 }:
 mkLibretroCore {
   core = "desmume";
-  version = "0-unstable-2026-05-16";
+  version = "0-unstable-2026-08-23";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "desmume";
-    rev = "ae0f7f51f96d9b5741b47b425505a4a4224b91fa";
-    hash = "sha256-M8Z2Zk9wjEuOOg++Tk68A8hgCmE63nh9+oJhu4fsQsk=";
+    rev = "8f6b32cb9a5e310bd38520e7087ce7fa14765f15";
+    hash = "sha256-u1YTW7thPzmcse0XDs7WOu3foL7kf+urplOufQqawW8=";
   };
 
   extraBuildInputs = [
diff --git a/pkgs/by-name/li/libretroPackages/cores/vba-m.nix b/pkgs/by-name/li/libretroPackages/cores/vba-m.nix
index f5b26fe8b8e8..9c12225d1a7c 100644
--- a/pkgs/by-name/li/libretroPackages/cores/vba-m.nix
+++ b/pkgs/by-name/li/libretroPackages/cores/vba-m.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "vbam";
-  version = "0-unstable-2026-04-10";
+  version = "0-unstable-2026-08-23";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "vbam-libretro";
-    rev = "e8b2875d6cad10fc3c7c9f57bb5f1acc324d7c10";
-    hash = "sha256-tq2MxjPwVPkZotaZAKxmiz7Zjws22E8tK+FPcS+uujk=";
+    rev = "115defb3a318258ab84746d45258a1aec19d0b4b";
+    hash = "sha256-17Od/qXD3dy0JOi0FX46AvGGiJxN++qaXWzMfMX3q7M=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/by-name/lu/lukesmithxyz-st/package.nix b/pkgs/by-name/lu/lukesmithxyz-st/package.nix
deleted file mode 100644
index c79e7fe8aced..000000000000
--- a/pkgs/by-name/lu/lukesmithxyz-st/package.nix
+++ /dev/null
@@ -1,52 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fontconfig,
-  harfbuzz,
-  libx11,
-  libxext,
-  libxft,
-  ncurses,
-  pkg-config,
-}:
-
-stdenv.mkDerivation {
-  pname = "lukesmithxyz-st";
-  version = "0-unstable-2026-04-09";
-
-  src = fetchFromGitHub {
-    owner = "LukeSmithxyz";
-    repo = "st";
-    rev = "48b8ee6e181643800fe83353ec554f503020a8fa";
-    hash = "sha256-XFf48+6I3IHcRKGHRJIJb9u2sTKWyuWTb5lN+BILYYc=";
-  };
-
-  nativeBuildInputs = [
-    pkg-config
-  ];
-  buildInputs = [
-    fontconfig
-    harfbuzz
-    libx11
-    libxext
-    libxft
-    ncurses
-  ];
-
-  installPhase = ''
-    runHook preInstall
-
-    TERMINFO=$out/share/terminfo make install PREFIX=$out
-
-    runHook postInstall
-  '';
-
-  meta = {
-    homepage = "https://github.com/LukeSmithxyz/st";
-    description = "Luke Smith's fork of st";
-    license = lib.licenses.mit;
-    maintainers = [ ];
-    platforms = lib.platforms.linux;
-  };
-}
diff --git a/pkgs/by-name/mo/moon/package.nix b/pkgs/by-name/mo/moon/package.nix
index 6ad59470145b..ecacfffee8d5 100644
--- a/pkgs/by-name/mo/moon/package.nix
+++ b/pkgs/by-name/mo/moon/package.nix
@@ -15,16 +15,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "moon";
-  version = "2.5.2";
+  version = "2.5.3";
 
   src = fetchFromGitHub {
     owner = "moonrepo";
     repo = "moon";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HR9C76TBmxLElZzNC/+Eyt61T2HYn6ElOGG50Oj3Eng=";
+    hash = "sha256-tDJjEpQBCo6rpAJBITuxkzXWa0B/k10ZbWR/I7e+KAw=";
   };
 
-  cargoHash = "sha256-6SgCcaPLQ6pj7bJU6iBV8mk8EsulCpFDL+26ip6TSgY=";
+  cargoHash = "sha256-j80p+Lfpa17gPPmEzJOpQz2vmI73AodxEUiZt31x9To=";
 
   env = {
     RUSTFLAGS = "-C strip=symbols";
diff --git a/pkgs/by-name/ne/netassert/package.nix b/pkgs/by-name/ne/netassert/package.nix
index a025fbc7610a..89dbadb292c4 100644
--- a/pkgs/by-name/ne/netassert/package.nix
+++ b/pkgs/by-name/ne/netassert/package.nix
@@ -6,15 +6,15 @@
 
 buildGoModule (finalAttrs: {
   pname = "netassert";
-  version = "2.1.6";
+  version = "2.1.7";
 
   src = fetchFromGitHub {
     owner = "controlplaneio";
     repo = "netassert";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-QI2QIj9Hrfp8vNPv0est0NiL956xSZOi2KN7tAFOEtw=";
+    hash = "sha256-ef4KRsbgqhYMSuddBBa9J5+FQ7mG1MtjVhqwE91v77A=";
   };
-  vendorHash = "sha256-sMG34WOQD4dPExq+UjnPkvxj3w8bzfAa3azvUvHAMZM=";
+  vendorHash = "sha256-eathx5R8iYLNitpt7YHZz7xRs6u2hVBNskxAfphvQ40=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ne/nextcloud-client/package.nix b/pkgs/by-name/ne/nextcloud-client/package.nix
index a22aaf59207c..21423c053820 100644
--- a/pkgs/by-name/ne/nextcloud-client/package.nix
+++ b/pkgs/by-name/ne/nextcloud-client/package.nix
@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nextcloud-client";
-  version = "34.0.2";
+  version = "34.0.3";
 
   outputs = [
     "out"
@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "nextcloud-releases";
     repo = "desktop";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wAgHN8MDqRtSiy/AV+0j5FYiFgM53Sh3gThQLxc6BA8=";
+    hash = "sha256-sxo4AV+4AouAHuNZqc0VjFpNaB1Ubsi4zes48WhAhFY=";
   };
 
   patches = [
diff --git a/pkgs/by-name/op/opa-envoy-plugin/package.nix b/pkgs/by-name/op/opa-envoy-plugin/package.nix
index 9fb7e2178def..0dc5ab93ef77 100644
--- a/pkgs/by-name/op/opa-envoy-plugin/package.nix
+++ b/pkgs/by-name/op/opa-envoy-plugin/package.nix
@@ -14,16 +14,16 @@ assert
 
 buildGoModule (finalAttrs: {
   pname = "opa-envoy-plugin";
-  version = "1.19.1-envoy";
+  version = "1.20.1-envoy";
 
   src = fetchFromGitHub {
     owner = "open-policy-agent";
     repo = "opa-envoy-plugin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NmQB3FDVEYqmkMSzorDtKycqBOspHSt99O0OywiDUPg=";
+    hash = "sha256-bQDBb1Gqzf9Nh5qpwHJIavoP8XbqfrZztcuAV3y2oyE=";
   };
 
-  vendorHash = "sha256-CWIzQHlx5YoRbP+CLBoZPeIaNHY3/LWH9LSgKxDUjk4=";
+  vendorHash = "sha256-Lb2keeNffmWmSyuuSRxEEgLBp9JU7NCZEGCXQyq1uLg=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/ou/outline/package.nix b/pkgs/by-name/ou/outline/package.nix
index be0800e50df1..add6d2fc50a2 100644
--- a/pkgs/by-name/ou/outline/package.nix
+++ b/pkgs/by-name/ou/outline/package.nix
@@ -49,8 +49,12 @@ stdenv.mkDerivation (finalAttrs: {
   installPhase = ''
     runHook preInstall
 
+    yarn workspaces focus --production
+
     mkdir -p $out/bin $out/share/outline
     mv build server public node_modules $out/share/outline/
+    find $out/share/outline/node_modules -name "*.map" -delete
+    find $out/share/outline/node_modules -name "*.d.ts" -delete
 
     node_modules=$out/share/outline/node_modules
     build=$out/share/outline/build
diff --git a/pkgs/by-name/pa/paperless-ngx/package.nix b/pkgs/by-name/pa/paperless-ngx/package.nix
index a8f2da47499d..22552fd10ac0 100644
--- a/pkgs/by-name/pa/paperless-ngx/package.nix
+++ b/pkgs/by-name/pa/paperless-ngx/package.nix
@@ -70,14 +70,14 @@ let
 in
 pythonPackages.buildPythonApplication (finalAttrs: {
   pname = "paperless-ngx";
-  version = "3.1.0";
+  version = "3.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "paperless-ngx";
     repo = "paperless-ngx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-SipdhPxnGpCM/U0K5O59fdaKUuMLWiaXRE+XS3lpb/c=";
+    hash = "sha256-IOGwlATlS4T90dXufxkwI/MJGFGLXmlbqNB/OJbPLrY=";
   };
 
   postPatch = ''
@@ -272,19 +272,17 @@ pythonPackages.buildPythonApplication (finalAttrs: {
     # FileNotFoundError(2, 'No such file or directory'): /build/tmp...
     "test_script_with_output"
     "test_script_exit_non_zero"
-    # Something broken with new Tesseract and inline RTL/LTR overrides?
-    "test_rtl_language_detection"
-    # Favicon tests fail due to static file handling in the test environment
-    # https://github.com/NixOS/nixpkgs/issues/421393
-    "test_favicon_view"
-    "test_favicon_view_missing_file"
-    # Requires DNS
+    # Requires internet
     "test_send_webhook_data_or_json"
-    # execnet.gateway_base.DumpError: can't serialize <class 'pathlib._local.PosixPath'>
-    # https://github.com/pytest-dev/pytest-xdist/issues/384
-    "test_subdirectory_upload"
-    # AssertionError: 4 != 3
-    "testNormalOperation"
+  ];
+
+  disabledTestPaths = [
+    # flaky test
+    #   AssertionError: Expected 'apply_async' to not have been called.
+    "src/documents/tests/test_management_consumer.py::TestCommandWatchEdgeCases::test_handles_deleted_before_stable"
+    # flaky test:
+    #   ValueError: Failed to open file for read: 'FileDoesNotExist("meta.json")'
+    "src/documents/tests/test_permission_filtering_security.py::TestTrashRestorePermissionBoundary::test_restore_allows_document_with_explicit_delete_permission"
   ];
 
   doCheck = !stdenv.hostPlatform.isDarwin;
diff --git a/pkgs/by-name/pa/paq/package.nix b/pkgs/by-name/pa/paq/package.nix
index 43c9a9d073dc..b0ea3853eb73 100644
--- a/pkgs/by-name/pa/paq/package.nix
+++ b/pkgs/by-name/pa/paq/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "paq";
-  version = "1.4.1";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "gregl83";
     repo = "paq";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-L9hjTdpV7j1qKX9GSo9Nb+nA1mPKz2aftAquiBuUbn4=";
+    hash = "sha256-KGUnbLmAqxhBoaxF2uaXeVsI0ykzpZNQmNpkZCjlg+Y=";
   };
 
-  cargoHash = "sha256-LjAPCdPZI/qGISb4/kY2fRG0G0d/VwHeISAmfZSF4sI=";
+  cargoHash = "sha256-wOu2f98Jbyr4j6sJ5J/gd3wAtzY6BcFI4PyWD+txGbM=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
diff --git a/pkgs/by-name/pi/pixi-pack/package.nix b/pkgs/by-name/pi/pixi-pack/package.nix
index 5c87f6ab1292..9cdccb849178 100644
--- a/pkgs/by-name/pi/pixi-pack/package.nix
+++ b/pkgs/by-name/pi/pixi-pack/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "pixi-pack";
-  version = "0.7.10";
+  version = "0.7.11";
 
   src = fetchFromGitHub {
     owner = "Quantco";
     repo = "pixi-pack";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5PU+ro+uE1iiBkgQocMYlHZmiS8+bScP1rF3VVXpn/c=";
+    hash = "sha256-WzfNE6gw58rZ/BS8Nbb6vx83kzOk39Xhf/1GDjN97ac=";
   };
 
-  cargoHash = "sha256-9Of4qnt+MFrW42daZiLdHrbH5Z7tYpcN6Sg95FUlcQc=";
+  cargoHash = "sha256-kiXpwas+UpANDgmh7wdd0v14FX8DhJBr9UipJhVDTsk=";
 
   buildInputs = [ openssl ];
 
diff --git a/pkgs/by-name/pl/plantuml/deps.json b/pkgs/by-name/pl/plantuml/deps.json
index 3c10b58c3714..6381244bfa36 100644
--- a/pkgs/by-name/pl/plantuml/deps.json
+++ b/pkgs/by-name/pl/plantuml/deps.json
@@ -14,23 +14,23 @@
    "module": "sha256-odP1Wo5FZ29u3RbZV+PJZhFwMbBowcX6bVoOjgYFj/E=",
    "pom": "sha256-g3hMiCuNZ54y7T9KjrFNLyxQWYBKd0oCKqOICrWJE1Q="
   },
-  "org/graalvm/buildtools#graalvm-reachability-metadata/1.1.1": {
-   "jar": "sha256-49kdIF5gL2Zwxp96p4JPDHvBbbjFL9eQHPt5tqbMdPI=",
-   "module": "sha256-wPx0q3CWYheJTM43jIBNveKymsKwhpcFlLXZmeGi6eg=",
-   "pom": "sha256-tPhjwtr/0qdWtraRLrKDNXp3NMQGDs+aUvUIAwpmq4U="
+  "org/graalvm/buildtools#graalvm-reachability-metadata/1.1.10": {
+   "jar": "sha256-r2Cqh6Toa7ZDKlzBRGl4zds6NGnrbDIaZ7iqAsIohvM=",
+   "module": "sha256-o0enOSRAd4oMYqJId1pjUrJbH6qNbeKxh4KB1/O5HqY=",
+   "pom": "sha256-kNVmNJ2Ma3p7IN9GNMSBiAQ8niEqXmTtL+eI8j0IRcM="
   },
-  "org/graalvm/buildtools#native-gradle-plugin/1.1.1": {
-   "jar": "sha256-aVdozJrEMDHq/9T2SEJhDk6RE7bJaQvJZFyDRgZ45b4=",
-   "module": "sha256-ZsCVVt236Y3rpPSlSrlD/Y2VfYGzun2nXEX2+2ualfw=",
-   "pom": "sha256-zsfVtLAkkN5zAW1RyhCBZABdexo7lR5tjIMJOMlmBps="
+  "org/graalvm/buildtools#native-gradle-plugin/1.1.10": {
+   "jar": "sha256-d8YzLkb7Pqz/z789BPr2IzTQJOhTclqnxvsRUBrVEKA=",
+   "module": "sha256-lHdacyaLgcn2XfuNYWfIk3qkhH9Qcz9e4oOXmfuezGQ=",
+   "pom": "sha256-oeJ5zA2iDyV1flL6XnYSfyqUvW+y2VDcUj1NI3usrlA="
   },
-  "org/graalvm/buildtools#utils/1.1.1": {
-   "jar": "sha256-ygJMeo1UAffRiKNw3eaLtQS9j402yWGSs1u91fViIUA=",
-   "module": "sha256-OfX++C0DuzAbrqZfqGPC6TSgXjS2Pgqo2xyFAqImYOk=",
-   "pom": "sha256-DKRaTFTAxJvaum3Ag5k2Hn8qzB5xFVIVdGwcnHZo+cU="
+  "org/graalvm/buildtools#utils/1.1.10": {
+   "jar": "sha256-yl0lGQl7QphgoVY+tCLalv1SiEFcH3SgmL/Xqgoq3pU=",
+   "module": "sha256-f7UetY5MvIDm35FMmSlwsCXk0VvbpVIIbuND8X1waNw=",
+   "pom": "sha256-BqNtT3qOcublDG+7a8lKjpyHGpGKa4ShSgpRJsIjqjE="
   },
-  "org/graalvm/buildtools/native#org.graalvm.buildtools.native.gradle.plugin/1.1.1": {
-   "pom": "sha256-l+KGY3FFqL5BBpnlqt0sWXWAYq+iGnLlKB2NX4DBuME="
+  "org/graalvm/buildtools/native#org.graalvm.buildtools.native.gradle.plugin/1.1.10": {
+   "pom": "sha256-4+QPF3sPb7LsyO+x7g8fe0ajVF+q7QXw3e1dSeSbkIw="
   },
   "org/teavm#org.teavm.gradle.plugin/0.14.1": {
    "pom": "sha256-YVfRIq/uwUBl8UtUIyZGL+4dAABSMDrwgEQa5Yh+FJo="
@@ -118,63 +118,33 @@
    "jar": "sha256-fymNRNu3aIQZ8Bee4d+g5ENmMycrBdOKX686K40IaXs=",
    "pom": "sha256-ayiyQncMtQgQOoVWFbsflqD8Y5iMJqFrlhVglqXZCi4="
   },
-  "com/fasterxml#oss-parent/28": {
-   "pom": "sha256-xMNp42uIIK0m0ubHD/RK2Z76/hk5ml0ReOnqgvTS/Tg="
-  },
-  "com/fasterxml#oss-parent/34": {
-   "pom": "sha256-mnXz4yv51uAGeNlEes5N6FlqLSIa9c9bvH9XHKx5UAY="
-  },
   "com/fasterxml#oss-parent/61": {
    "pom": "sha256-NklRPPWX6RhtoIVZhqjFQ+Er29gF7e75wSTbVt0DZUQ="
   },
   "com/fasterxml/jackson#jackson-base/2.18.2": {
    "pom": "sha256-71dLcvW0iUgET2g3a4dMiK4JoCncjgX2Shwwvftt4Uo="
   },
-  "com/fasterxml/jackson#jackson-base/2.9.8": {
-   "pom": "sha256-aR1TBl2htSK+rw/Q0TIm31bE7bumqmm2V8vhp+9JYiM="
-  },
   "com/fasterxml/jackson#jackson-bom/2.18.2": {
    "pom": "sha256-UkfNwwFyXT9n9+8EkDconVr3CdaXK89LFwluRUjSlWs="
   },
-  "com/fasterxml/jackson#jackson-bom/2.9.8": {
-   "pom": "sha256-++5Wc1iqe2oQoLWcdaEa39sSijp93E9AnqcQmzS0Ufk="
-  },
   "com/fasterxml/jackson#jackson-parent/2.18.1": {
    "pom": "sha256-0IIvrBoCJoRLitRFySDEmk9hkWnQmxAQp9/u0ZkQmYw="
   },
-  "com/fasterxml/jackson#jackson-parent/2.9.0": {
-   "pom": "sha256-AAUIth3RJDh+WBmfueIRPBtdizhsW/eokbLeYEHrHVI="
-  },
-  "com/fasterxml/jackson#jackson-parent/2.9.1.2": {
-   "pom": "sha256-lRfkBcazuKA1IVrVcnATo1Get1kXQ/4dzATfZjVoPPk="
-  },
   "com/fasterxml/jackson/core#jackson-annotations/2.18.2": {
    "jar": "sha256-WBvWEADvdkiUP3gcoFaJ5W0D9gUnSDZajis6m10/oy8=",
    "module": "sha256-4Ruvm1NubflNqmNaEBPsPgabhmuOES3cKqBEahVQUNw=",
    "pom": "sha256-CyvWlOqJJn7qSBJqilskplI0xkM4dULSRGnRlb+6HPg="
   },
-  "com/fasterxml/jackson/core#jackson-annotations/2.9.0": {
-   "jar": "sha256-RdMqxh74p0S0ZMVMKzQUvlcQFt1Gv8K+wiZ2HPeuRXo=",
-   "pom": "sha256-7eudm/ynJrRBv64Jtp2UtduZzVqdpfSgYbkOcrZAkFw="
-  },
   "com/fasterxml/jackson/core#jackson-core/2.18.2": {
    "jar": "sha256-2AVK58DRwtL1XSjkYCbr5YkogfP6tfQ5IzGEOBw7Sh8=",
    "module": "sha256-ynjGBDZ2f8w2zhRrd05PUKnLn2MtExcsRLrojgwDz6I=",
    "pom": "sha256-4GWwA50h9N/ORr1DEEx9dtWFa9cy4qqGDMWkonDtct4="
   },
-  "com/fasterxml/jackson/core#jackson-core/2.9.8": {
-   "jar": "sha256-2TTasL1ImU7uosG0k8tUcVijOKgLWMT7yOhfsJBeEF8=",
-   "pom": "sha256-lW1Cz9uEZVMbz6mXSjbFeUTHVC43qu6IFBM3DDGQAx8="
-  },
   "com/fasterxml/jackson/core#jackson-databind/2.18.2": {
    "jar": "sha256-SzZOaFDciRcvzx1N0muP9UiO2kT/RlfiLdJlID3Vqzw=",
    "module": "sha256-jH2sL3J4GNiEeoKqTqxrAXTXnPBN+Q3iJGBy5t005wA=",
    "pom": "sha256-STo9tkR7eo7Ls3JCNMbOZ31y20sE9roAjw6+rqe+Wp0="
   },
-  "com/fasterxml/jackson/core#jackson-databind/2.9.8": {
-   "jar": "sha256-I1HD66c6VF25B59dbXaDR61yZmU3NiyCIP4+lQpVqGQ=",
-   "pom": "sha256-kOOaDOZzrddqcfogGTwMBnAjerQ7KmJezfVpxnbRG9k="
-  },
   "com/github/davidmoten#sonatype-parent/0.1": {
    "pom": "sha256-9Q5Goo6n4j+EMErZ/xsqWJskdSy0R9nq7eb1r4T56s4="
   },
@@ -185,12 +155,12 @@
    "jar": "sha256-KnDGAkuxC2GStLkdi7WB3iS3dqeZow71uHdI5UrKIUQ=",
    "pom": "sha256-taT+ZEgeTRD7mpnuLQ9XSb0P2WQM5+jFTvjeuuk7R6Q="
   },
-  "com/google/errorprone#error_prone_annotations/2.47.0": {
-   "jar": "sha256-U2S8byLnLpgZXkBqWNO6HAn/oR3qBylZLLhw3C3kBW0=",
-   "pom": "sha256-2AyImkpvcR9pRfvueeBewkexeKVn6dWr9Y6ybr8KB1I="
+  "com/google/errorprone#error_prone_annotations/2.50.0": {
+   "jar": "sha256-RmdySHfx03pokgLaGR4j76dlfGLu+TzNrEBuzP5c3Qo=",
+   "pom": "sha256-caBoDSdzJLq0a+xLAPbxEcG3lKkx0NjNp5vLkkaYL5I="
   },
-  "com/google/errorprone#error_prone_parent/2.47.0": {
-   "pom": "sha256-I2ipkMemMJXh0NREWdWkCS8Osx+FYr0SzfDhyHe2poU="
+  "com/google/errorprone#error_prone_parent/2.50.0": {
+   "pom": "sha256-q/RaAZ2xJbUP9VE07Cr5SuNRl2EDit8KYLm9e0uLYlQ="
   },
   "com/google/guava#failureaccess/1.0.3": {
    "jar": "sha256-y/w5BrGbj1XdfP1t/gqkUy6DQlDX8IC9jSEaPiRrWcs=",
@@ -202,13 +172,13 @@
   "com/google/guava#guava-parent/33.4.0-android": {
    "pom": "sha256-ciDt5hAmWW+8cg7kuTJG+i0U8ygFhTK1nvBT3jl8fYM="
   },
-  "com/google/guava#guava-parent/33.6.0-jre": {
-   "pom": "sha256-N0vTH2Gxz2Er7pqy5NcLvfd92FpJtDH4CdT73JAfLdQ="
+  "com/google/guava#guava-parent/33.7.1-jre": {
+   "pom": "sha256-QBXmFaVnR1XIjYES2LvXY+iv3lYb52xnkGme211WCPU="
   },
-  "com/google/guava#guava/33.6.0-jre": {
-   "jar": "sha256-3Fc+H8pP1UVPSl/T19ot8DACh2pBdbr8FKlZgN13E7M=",
-   "module": "sha256-K69zzoOa5I5LngCD4law5Y/Dv4/Hj8P755e7yJARIW4=",
-   "pom": "sha256-tFt4lEKABUMRxT2pJwgJ+0Dcq8QIzmbOVXMAmbT1fTI="
+  "com/google/guava#guava/33.7.1-jre": {
+   "jar": "sha256-eW2OKKxk6DpHxMWTWo/sxGgmUKBLverXOO8PWjoObEY=",
+   "module": "sha256-wBLsy/seEqDAbtIxdczNGcig3LQ/GhaUdxWDqQbZXlY=",
+   "pom": "sha256-tbOA2yMtjZVkV/Ekpf+O00lY4HTc0gZRQEtSKYau/tw="
   },
   "com/google/guava#listenablefuture/9999.0-empty-to-avoid-conflict-with-guava": {
    "jar": "sha256-s3KgN9QjCqV/vv/e8w/WEj+cDC24XQrO0AyRuXTzP5k=",
@@ -217,8 +187,8 @@
   "com/google/guava/guava/maven-metadata": {
    "xml": {
     "groupId": "com.google.guava",
-    "lastUpdated": "20260414193116",
-    "release": "33.6.0-jre"
+    "lastUpdated": "20260818035315",
+    "release": "33.7.1-jre"
    }
   },
   "com/google/j2objc#j2objc-annotations/3.1": {
@@ -233,21 +203,6 @@
    "jar": "sha256-35C7oP48tYa38WTnj+j49No/LdXCf6ZF+IgQDMwl3XI=",
    "pom": "sha256-vb34EHLBkO6aixgaXFj1vZF6dQ+xOiVt679T9dvTOio="
   },
-  "io/github/benas#random-beans-parent/3.9.0": {
-   "pom": "sha256-nQdK1CBncLvQdxo54UxKjF3WIqgOQbSgB4uZ9dQUm/o="
-  },
-  "io/github/benas#random-beans/3.9.0": {
-   "jar": "sha256-6+JedLsVx8pWidK775f45/pc4K+AKqfMo1lkF/yqeyg=",
-   "pom": "sha256-Lklbyrq0pn53f/HusmevzyIujdKPxgyAiwcoevfimxM="
-  },
-  "io/github/classgraph#classgraph/4.6.18": {
-   "jar": "sha256-uqP7yzgIzoPM+yVGz9bXWEW3JDY4X4UayQwQK44Oy4o=",
-   "pom": "sha256-XyTYCwAD9UC4uoPPvyuabb1nb3Xe97gh+cLNq+ZaBmA="
-  },
-  "io/github/glytching#junit-extensions/2.6.0": {
-   "jar": "sha256-35MhQGaFW25u4e9R5Esp4DiWULKyDevWn/S0jHrsGwM=",
-   "pom": "sha256-2JYwFiyV1RSnj7Lpis/bAapDv72tw4SvzSIwpmvLTCc="
-  },
   "javax/annotation#javax.annotation-api/1.3.2": {
    "jar": "sha256-4EulGVvNVV3JVlD3zGFNFR5LzVLSmhC4qiGX86uJq5s=",
    "pom": "sha256-RqSiUcpAbnjkhT16K66DKChEpJkoUUOe6aHyNxbwa5c="
@@ -275,20 +230,6 @@
    "jar": "sha256-jU2AetyOkqg5E9nM1h5jS0kHx42I8wFtBrOz0rR5WgI=",
    "pom": "sha256-mphCu1VpGRaS5ycHZtAoLzZwa9SYMxDtyjG8kvKyy80="
   },
-  "net/bytebuddy#byte-buddy-agent/1.17.7": {
-   "jar": "sha256-qbqIfcolKtYbfVFTKU805vO99LJzawQ3PRNhWmlfwP8=",
-   "pom": "sha256-gU7kLWsBF/S40etrHWLBbbTAtZfYOzrY2qV4HrFF19w="
-  },
-  "net/bytebuddy#byte-buddy-parent/1.17.7": {
-   "pom": "sha256-ilfiDczgDaccM+8+GdndhY/p0gQsouK8onhxcA1SaYw="
-  },
-  "net/bytebuddy#byte-buddy-parent/1.18.3": {
-   "pom": "sha256-kOpTFzFQjup1/5KVFBxQjX+aU9GgX0W4D49JmVIUJu8="
-  },
-  "net/bytebuddy#byte-buddy/1.18.3": {
-   "jar": "sha256-14OW48W84/KGXJGGZHSB5VidNMrMYySEcVtoYQjRfGY=",
-   "pom": "sha256-cVe2IqDWiFy1UmoQ8SIN3wkNu1LKL+OMMsxpxPFTB4g="
-  },
   "net/java#jvnet-parent/3": {
    "pom": "sha256-MPV4nvo53b+WCVqto/wSYMRWH68vcUaGcXyy3FBJR1o="
   },
@@ -317,10 +258,6 @@
    "module": "sha256-4IAoExN1s1fR0oc06aT7QhbahLJAZByz7358fWKCI/w=",
    "pom": "sha256-MjVQgdEJCVw9XTdNWkO09MG3XVSemD71ByPidy5TAqA="
   },
-  "org/assertj#assertj-core/3.27.7": {
-   "jar": "sha256-xKRFQmw8KGFmaGO4QsxOx7uxxCJv79NwttL+g9bE/w8=",
-   "pom": "sha256-laENz7O6mq1NC16cUjqNWDN3vuXs1Lo34Z5Vo0Zn8Hk="
-  },
   "org/eclipse/elk#org.eclipse.elk.alg.common/0.10.0": {
    "jar": "sha256-UPvIemw4zd0+b9awU7wvpEsXY42x/1Yjl2rVRffeMTY=",
    "pom": "sha256-VjZ2YA4U587qBGUIv1jqQnCLYg241zOyjbYQngM1xRM="
@@ -471,10 +408,14 @@
    "pom": "sha256-AA3WFimK69IanVcxh03wg9cphCS5HgN7c8vdB+vIPg4="
   },
   "org/jspecify#jspecify/1.0.0": {
-   "jar": "sha256-H61ua+dVd4Hk0zcp1Jrhzcj92m/kd7sMxozjUer9+6s=",
    "module": "sha256-0wfKd6VOGKwe8artTlu+AUvS9J8p4dL4E+R8J4KDGVs=",
    "pom": "sha256-zauSmjuVIR9D0gkMXi0N/oRllg43i8MrNYQdqzJEM6Y="
   },
+  "org/jspecify#jspecify/1.0.1": {
+   "jar": "sha256-Bw118mH+TFuCAlCDZnFffy1GYPiMjvfm01deSMloO2Y=",
+   "module": "sha256-aDXWrHYqmchebDumyUK+LGmXquyY8H3t/pkX2uIr2pY=",
+   "pom": "sha256-VbOL8aex2OpRjPL0866aqiNuYbvwtr0x/7SXU6BZ3V4="
+  },
   "org/junit#junit-bom/5.10.2": {
    "module": "sha256-3iOxFLPkEZqP5usXvtWjhSgWaYus5nBxV51tkn67CAo=",
    "pom": "sha256-Fp3ZBKSw9lIM/+ZYzGIpK/6fPBSpifqSEgckzeQ6mWg="
@@ -491,85 +432,49 @@
    "module": "sha256-M8B6uXJHkKblhZugfWkResUwQ5ckVFqBxBeeMnLHXeg=",
    "pom": "sha256-+mhFHqgwVy7UP/5R11tqBfel5mWmAqUfSda+AgY6ZfM="
   },
-  "org/junit#junit-bom/6.1.0": {
-   "module": "sha256-SCB/lc3sO/tc5sy/GNUqzlHoFfIRBp3BbgKDslWmTZo=",
-   "pom": "sha256-97Zl5dVzsBr21DTT0kUKpbdBtoPz8QFy8etEo9DQrAw="
+  "org/junit#junit-bom/6.1.3": {
+   "module": "sha256-n11X2tz6B/ezjvz7IrBS7OGIkiod92tamORKHfencBs=",
+   "pom": "sha256-qQAAQ2EKPpDIUud5prGo63JKnzEs9ffd1XhisBDGXcg="
   },
   "org/junit-pioneer#junit-pioneer/2.3.0": {
    "jar": "sha256-iwnbMsjPWyESoAJiQRzNTvbKO65pWgAV7K1N7yPeqf0=",
    "module": "sha256-SBB4hWmbOh4gcsCmXwU3NMiRzVrSRFva2RryL9epSFk=",
    "pom": "sha256-gG65m+uJFnD3Ro6pL4QXKVIe+78W1bPMci3kUazYiLg="
   },
-  "org/junit/jupiter#junit-jupiter-api/6.1.0": {
-   "jar": "sha256-UPl+uADC6Ij6ojegb1oO9EX67VVn+ZTawMK50niprSA=",
-   "module": "sha256-HQFsKC2GuCGvWz2zd7cJrZI4tUyJSzMjzRsj6lMSl9Y=",
-   "pom": "sha256-000J8MyNqqQOMC26REEyf8BF+gvV39qC0ho3IBj3i4c="
+  "org/junit/jupiter#junit-jupiter-api/6.1.3": {
+   "jar": "sha256-VV1s8g+hcQiE3QG4bMV4U5e6c+Ia2i1LeE9fGhTcr8Q=",
+   "module": "sha256-rZkJwfqIpXmyghoJGhlsRahLzQ9PxzV5kP3HPTgByKU=",
+   "pom": "sha256-qdY0faAym/EY6YeGF+ULVTfrnsPF/NCIUmUHE4MtGsE="
   },
-  "org/junit/jupiter#junit-jupiter-engine/6.1.0": {
-   "jar": "sha256-6nB7lkcIRhmg/JEc77JQN1QNWLKAD46tH8aiuvWLHaU=",
-   "module": "sha256-qxcPpDeU24cKcgzDt6LWdi3MRXcyjv2vizCOaNLH79E=",
-   "pom": "sha256-h+13EyLIt6c55oZct+WGTqwoj9IL1qP8Vjtiov8sSVo="
+  "org/junit/jupiter#junit-jupiter-engine/6.1.3": {
+   "jar": "sha256-QUVZ54u/o72y6rAJrDqx4iNprDERfCcKC9Zm2hFcXGw=",
+   "module": "sha256-Ymop8obDbQ9vNkCWRDceEqP+K/y7iB4T+CZayd6Wu3c=",
+   "pom": "sha256-BR/GXZfBXnzWRoMTaK+K/sWQsAjIBNKTr/EUx0oeJTA="
   },
-  "org/junit/jupiter#junit-jupiter-params/6.1.0": {
-   "jar": "sha256-uYfuoyBRhadvNlmjnmdQPLe2gti3vgO+S5+StxDw7sA=",
-   "module": "sha256-evPVYvC8fWUmA2HlcT5vzVVQuZcqGA1vxM2itoJM4pc=",
-   "pom": "sha256-ZOXfB1ZYuUmh2lSyEp6jHOY87fodJTEHWgBxlJnOwEY="
+  "org/junit/jupiter#junit-jupiter-params/6.1.3": {
+   "jar": "sha256-BcUc7bosBql3Bwc5HgBs7oJYdpN96lgLlKJlzhRdSTk=",
+   "module": "sha256-nsd5X0rrklePtNQ7anPDJP/yFsqXHzkQM1BziCx4oWc=",
+   "pom": "sha256-EPfoW1zlMBTJRrFMdQsJCXvtGJLsryzqBdEqq26Gd9I="
   },
-  "org/junit/jupiter#junit-jupiter/6.1.0": {
-   "jar": "sha256-pOQgtcboFwMjtMXJeuNbyg1iC+n5z+NwBoIPU5MfJ6M=",
-   "module": "sha256-Kl2tWs4texVUiGguY6LrDxS7YA+fbx+75B3QGylMZ0g=",
-   "pom": "sha256-Rme8comEZvz6eQGJJmuiXGtmrV4WpOVgJgM5euWn4q0="
+  "org/junit/jupiter#junit-jupiter/6.1.3": {
+   "jar": "sha256-awoUB1x0Ih3lMEfjY4YLfRn86AK+vBUt8sNcQInGw3k=",
+   "module": "sha256-ynt91FCNV6ncEFECqpP7W8lgsglWAVNLkxH5Uf+zmXk=",
+   "pom": "sha256-6//7QYYasczJid4snC0Rkk5d3e0nKLBT9fL93IQJwOE="
   },
-  "org/junit/platform#junit-platform-commons/6.1.0": {
-   "jar": "sha256-HZBGqxfsftr7C8eUXS5Z1xgP/08oxzS4I7UQAedp9xs=",
-   "module": "sha256-eVv++8OD8DMoadK4AUJSK65GKjkFu6ntSbe8NcQf64A=",
-   "pom": "sha256-yRmWB2BYBu8YXQT9RpVRsrShUQos6twHTbRBvXf23TY="
+  "org/junit/platform#junit-platform-commons/6.1.3": {
+   "jar": "sha256-pHdK6SPBCVRANK6ufHYs8Bf7zdE0JAO6kOCSGYS2CMM=",
+   "module": "sha256-pvEhhhY0G1mfaqApo3aMb5VqsdMhbtclDkvl15rfzn0=",
+   "pom": "sha256-paOhrslhE7HpU1RcPYxRF/8CIMVvcpPG//fTWxzTfBQ="
   },
-  "org/junit/platform#junit-platform-engine/6.1.0": {
-   "jar": "sha256-P7a+dsJqsPlP4ITj/Qo54dJeIhKZKaYbKb2AoFK5PqU=",
-   "module": "sha256-OnbyFfpzfJbOlycTqva0UYePpzOVX/IbDNao+I3LIhI=",
-   "pom": "sha256-NgVWdVmFVdSVuvtVezXukYzbF2pnUxALABtO7thfJsU="
+  "org/junit/platform#junit-platform-engine/6.1.3": {
+   "jar": "sha256-Ia1606Nb7aFjh5eTF74YM6cqcdgS+aZu5LmnuvtWM0w=",
+   "module": "sha256-cPUCCttMkVdQJUmagEsmbo/C0Ceqbnj+v6NyvjqIzvU=",
+   "pom": "sha256-UZTa0l2HiYVkaknfcb2YXo0t1Ma2dlcXCTrIoxvbMuQ="
   },
-  "org/junit/platform#junit-platform-launcher/6.1.0": {
-   "jar": "sha256-CZXm7SRNZhlsvaAZ4vh5UE0LSJce2unMPepGobMcA3c=",
-   "module": "sha256-f4PRJdcb5Z4JVD1LUGn6h9jKchyqQ9FKq+gm+x2xuME=",
-   "pom": "sha256-on93QpSA4V22Cwlf21lfULa6VylfIqXCZEuo1BitM54="
-  },
-  "org/mockito#mockito-core/5.23.0": {
-   "jar": "sha256-rilb69XRH6uXqyl4Fdx2FxiLhgA8vOPf1cDVw6bMSgw=",
-   "pom": "sha256-wC4pALknetv+EnVtfQuUcua55Zcq4fKNGaQaplE3d+M="
-  },
-  "org/mockito#mockito-junit-jupiter/5.23.0": {
-   "jar": "sha256-ZZOFJv3DEbs6HAAV6xyKC+gVFaqZjyK59OkvG2aOT2M=",
-   "pom": "sha256-tm0N+BqrLtL6U8mQ6pDC8fkVAxvIXkGGAt5M+40q1+g="
-  },
-  "org/mockito/mockito-core/maven-metadata": {
-   "xml": {
-    "groupId": "org.mockito",
-    "lastUpdated": "20260311211200",
-    "release": "5.23.0"
-   }
-  },
-  "org/mockito/mockito-junit-jupiter/maven-metadata": {
-   "xml": {
-    "groupId": "org.mockito",
-    "lastUpdated": "20260311211207",
-    "release": "5.23.0"
-   }
-  },
-  "org/objenesis#objenesis-parent/3.0.1": {
-   "pom": "sha256-Uzctvo7DgUNwk3qHwDtCtw+stbpXD5n4nBJpN9HYu88="
-  },
-  "org/objenesis#objenesis-parent/3.3": {
-   "pom": "sha256-MFw4SqLx4cf+U6ltpBw+w1JDuX1CjSSo93mBjMEL5P8="
-  },
-  "org/objenesis#objenesis/3.0.1": {
-   "jar": "sha256-eo/3gLn/SEFdfHBfYAMLCsqmFuf4I8mO7eO2NQjU6YQ=",
-   "pom": "sha256-PcE3flcJdObxgqahaA0yhDNbXVzzqP6nvsGlQ4u9r/g="
-  },
-  "org/objenesis#objenesis/3.3": {
-   "jar": "sha256-At/QsEOaVZHjW3CO0vVHTrCUj1Or90Y36Vm45O9pv+s=",
-   "pom": "sha256-ugxA2iZpoEi24k73BmpHHw+8v8xQnmo+hWyk3fphStM="
+  "org/junit/platform#junit-platform-launcher/6.1.3": {
+   "jar": "sha256-HexksfwLfEehEwKqW0032BYMBBs5bicGdwnOd1YBp7Y=",
+   "module": "sha256-YtIZijp3nFQxa76DnlFiOzpr0RHmctWG3Zo7uyIlaeY=",
+   "pom": "sha256-La87Q2C6ngc0QhDM8ptr6XA9Crxm3kEh9l2QEZ/plso="
   },
   "org/opentest4j#opentest4j/1.3.0": {
    "jar": "sha256-SOLfY2yrZWPO1k3N/4q7I1VifLI27wvzdZhoLd90Lxs=",
@@ -735,12 +640,12 @@
   "org/testcontainers#testcontainers-bom/1.20.1": {
    "pom": "sha256-CKrS6R3QXKeycG0t/Ap66AxLXFBHAweZyLzbcyfLL0A="
   },
-  "org/xmlunit#xmlunit-core/2.12.0": {
-   "jar": "sha256-sml+UuOoJOCHSzaYsMT2dsc2MBvCjoKFtnq1OFYE1P4=",
-   "pom": "sha256-wGBihxLa4boR0f33W3XdCuE7vJZQ8zFC1qVzmTWHOy8="
+  "org/xmlunit#xmlunit-core/2.13.0": {
+   "jar": "sha256-DI9zvjvdTrwiAg+GyJ4IvRUjA21nZcHo7qyvIuMRIZs=",
+   "pom": "sha256-te01DZF8qLjLwAAaMsOj/5rCRph52oCdVdiy/0Kkmhw="
   },
-  "org/xmlunit#xmlunit-parent/2.12.0": {
-   "pom": "sha256-WCtCHp/i/LSkO36xJgt5xG2L+tGORxYp8ntnLhmLrBI="
+  "org/xmlunit#xmlunit-parent/2.13.0": {
+   "pom": "sha256-jFwg0BmVsmKENqGGOahipr473fP8l8LQ53c5lIeMxBQ="
   }
  }
 }
diff --git a/pkgs/by-name/pl/plantuml/package.nix b/pkgs/by-name/pl/plantuml/package.nix
index 66cf7d4365d6..d5f7137beb20 100644
--- a/pkgs/by-name/pl/plantuml/package.nix
+++ b/pkgs/by-name/pl/plantuml/package.nix
@@ -14,13 +14,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "plantuml";
-  version = "1.2026.6";
+  version = "1.2026.7";
 
   src = fetchFromGitHub {
     owner = "plantuml";
     repo = "plantuml";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-p1F84oIp/CGO/nb6uxvP5GRJYog3Fp3EH192IhzNcgs=";
+    hash = "sha256-kvaHpE9IgqkpAUv5t70K74h02qBA09kqNR/jCLB7+7I=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pr/prometheus-kvrocks-exporter/package.nix b/pkgs/by-name/pr/prometheus-kvrocks-exporter/package.nix
index f6c20231785d..79e8eae155ab 100644
--- a/pkgs/by-name/pr/prometheus-kvrocks-exporter/package.nix
+++ b/pkgs/by-name/pr/prometheus-kvrocks-exporter/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "prometheus-kvrocks-exporter";
-  version = "1.0.9";
+  version = "1.0.11";
 
   src = fetchFromGitHub {
     owner = "RocksLabs";
     repo = "kvrocks_exporter";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-nyNdQfSXD6mAusO5VCEfvKuyvNawH4C5xDGOZSnTn7A=";
+    hash = "sha256-GP7TNXGP3Z/17LLolTBfOPyd4N42j97bzGv1Lln9VYg=";
   };
 
   vendorHash = "sha256-QVbcHQQr6o3jnF3CWw2NCCeRkGBDdA8OkmDd/GPfHuI=";
diff --git a/pkgs/by-name/ri/rio/package.nix b/pkgs/by-name/ri/rio/package.nix
index f3f1479636b0..0ef545a39692 100644
--- a/pkgs/by-name/ri/rio/package.nix
+++ b/pkgs/by-name/ri/rio/package.nix
@@ -51,16 +51,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rio";
-  version = "0.5.25";
+  version = "0.5.27";
 
   src = fetchFromGitHub {
     owner = "raphamorim";
     repo = "rio";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YMG1kKYvRkKQUK5ux5W7tNXEIaHgxaJocwA7Pbp1XBc=";
+    hash = "sha256-NkuuhH5ygCH45ZP71mZ4+16TSQJLlCoLuqobHX8INSI=";
   };
 
-  cargoHash = "sha256-UK4QZP1LFd90lSMvWiN+8RrGJA53EbKQFOa9P2YhhuM=";
+  cargoHash = "sha256-iIKZTv2PdSD33Tfeg5p//00XSHAkBusEYXCi5jhP3iY=";
 
   nativeBuildInputs = [
     rustPlatform.bindgenHook
diff --git a/pkgs/by-name/se/secretspec/package.nix b/pkgs/by-name/se/secretspec/package.nix
index 80a06fdb4243..31189571a4ab 100644
--- a/pkgs/by-name/se/secretspec/package.nix
+++ b/pkgs/by-name/se/secretspec/package.nix
@@ -4,6 +4,7 @@
   fetchCrate,
   fetchurl,
   cacert,
+  gitMinimal,
   jq,
   sops,
   nix-update-script,
@@ -11,21 +12,21 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "secretspec";
-  version = "0.19.1";
+  version = "0.20.0";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-hntOPTOrCfVWE4MaNmXfPQ4WAlOG1CFG5/ykSyviJ3A=";
+    hash = "sha256-UuXCDQ/DiC1xDs63+kbJNC01ZQfsh2j5/qRP76MVle8=";
   };
 
-  cargoHash = "sha256-KRC3b6AqSYxjSInULchYNQGm9hw97lDws0+stFZasmc=";
+  cargoHash = "sha256-41UxtnzpDMYpWshpopXLIXyz6rzikJkqKbvxHVua1oo=";
 
   postPatch = ''
     mkdir -p ../tests/fixtures
     cp ${
       fetchurl {
         url = "https://raw.githubusercontent.com/cachix/secretspec/v${finalAttrs.version}/tests/fixtures/bw-shim.sh";
-        hash = "sha256-Xg1d8h2DOA6p0Hn9xP9TYzFN1863Wyk3QuQlFk+Y0ME=";
+        hash = "sha256-wHXeJk3KYu01J73BEdll9lCcjOD4+8g8rlWUw93Cyok=";
       }
     } ../tests/fixtures/bw-shim.sh
     chmod +x ../tests/fixtures/bw-shim.sh
@@ -33,12 +34,14 @@ rustPlatform.buildRustPackage (finalAttrs: {
   '';
 
   nativeCheckInputs = [
+    gitMinimal
     jq
     sops
   ];
 
   preCheck = ''
     export HOME="$TMPDIR"
+    export NO_COLOR=1
     export SSL_CERT_FILE="${cacert}/etc/ssl/certs/ca-bundle.crt"
   '';
 
diff --git a/pkgs/by-name/sh/shader-slang/package.nix b/pkgs/by-name/sh/shader-slang/package.nix
index b34ee44db102..1c0270c8b220 100644
--- a/pkgs/by-name/sh/shader-slang/package.nix
+++ b/pkgs/by-name/sh/shader-slang/package.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "shader-slang";
-  version = "2026.16";
+  version = "2026.16.1";
 
   src = fetchFromGitHub {
     owner = "shader-slang";
     repo = "slang";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ggmQbskdTaDZQcMLsE6DwmsMuAWDWJfv2HwNuZj/ti4=";
+    hash = "sha256-717T51iQVGavMkNoAsp+RXdWX5+dY+62H/swMExcZlg=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/sh/shellnoob/package.nix b/pkgs/by-name/sh/shellnoob/package.nix
index 0987c6844485..4d77baaa05c1 100644
--- a/pkgs/by-name/sh/shellnoob/package.nix
+++ b/pkgs/by-name/sh/shellnoob/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "shellnoob";
-  version = "unstable-2022-03-16";
+  version = "2.1-unstable-2022-03-16";
 
   src = fetchFromGitHub {
     owner = "reyammer";
     repo = "shellnoob";
     rev = "72cf49804d8ea3de1faa7fae5794449301987bff";
-    sha256 = "xF9OTFFe8godW4+z9MFaFEkjE9FB42bKWwdl9xRcmEo=";
+    hash = "sha256-xF9OTFFe8godW4+z9MFaFEkjE9FB42bKWwdl9xRcmEo=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/si/sigsum/package.nix b/pkgs/by-name/si/sigsum/package.nix
index dcf2145b1718..3e5a9e20ff92 100644
--- a/pkgs/by-name/si/sigsum/package.nix
+++ b/pkgs/by-name/si/sigsum/package.nix
@@ -1,12 +1,13 @@
 {
   lib,
-  buildGo125Module,
+  buildGoModule,
   fetchFromGitLab,
+  fetchpatch2,
   versionCheckHook,
   nix-update-script,
 }:
 
-buildGo125Module (finalAttrs: {
+buildGoModule (finalAttrs: {
   pname = "sigsum";
   version = "0.14.1";
 
@@ -19,6 +20,22 @@ buildGo125Module (finalAttrs: {
     hash = "sha256-ZiU5eEI2pKknpjc3HU9EqQu6u1ZD/N7sOD0DyTma0/g=";
   };
 
+  # FIXME: remove in next release
+  patches = [
+    (fetchpatch2 {
+      url = "https://github.com/sigsum/sigsum-go/commit/f96375480607612154814e0442b3428696cf35f5.patch?full_index=1";
+      hash = "sha256-MR151ZVfrYniyDGzVonLNKcBAHEflAgjULBfp+vhFvg=";
+    })
+    (fetchpatch2 {
+      url = "https://github.com/sigsum/sigsum-go/commit/bbf212c19dfc9af66f102f3932381e9476428966.patch?full_index=1";
+      hash = "sha256-fPMIdcH22hVMKiARPQSJ3W/1q74LuALbaf9B5TtzD/o=";
+    })
+    (fetchpatch2 {
+      url = "https://github.com/sigsum/sigsum-go/commit/5e7b309d82a34d60872441573eb843c343bc43ba.patch?full_index=1";
+      hash = "sha256-yvKkeJxaGi353X+zlrbpLiYj/q34cuGcuVWn1ghab1s=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace internal/version/version.go \
       --replace-fail "info.Main.Version" '"${finalAttrs.version}"'
diff --git a/pkgs/by-name/st/strace-tui/package.nix b/pkgs/by-name/st/strace-tui/package.nix
new file mode 100644
index 000000000000..3d65d1ffa14f
--- /dev/null
+++ b/pkgs/by-name/st/strace-tui/package.nix
@@ -0,0 +1,40 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "strace-tui";
+  version = "1.0.1";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "Rodrigodd";
+    repo = "strace-tui";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-VHBXZ1b5emqroFI5OswxXXq1BFNbm6iJlAAso93+Nr4=";
+  };
+
+  cargoHash = "sha256-8911bjw1v4pq/84L+B+x+WnKxGbTi5Og1xOxcwn9vHI=";
+
+  checkFlags = [
+    "--skip=test_cli_parse_subcommand"
+    "--skip=test_cli_trace_subcommand"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "A terminal user interface (TUI) for visualizing and exploring strace output";
+    homepage = "https://github.com/Rodrigodd/strace-tui";
+    changelog = "https://github.com/Rodrigodd/strace-tui/releases/tag/${finalAttrs.src.tag}";
+    license = with lib.licenses; [
+      asl20
+      mit
+    ];
+    maintainers = with lib.maintainers; [ drupol ];
+    mainProgram = "strace-tui";
+  };
+})
diff --git a/pkgs/by-name/um/umbriel/package.nix b/pkgs/by-name/um/umbriel/package.nix
index e813bdec3c13..7999820f1602 100644
--- a/pkgs/by-name/um/umbriel/package.nix
+++ b/pkgs/by-name/um/umbriel/package.nix
@@ -30,7 +30,7 @@
 }:
 stdenv.mkDerivation {
   pname = "umbriel";
-  version = "0-unstable-2026-08-25";
+  version = "0-unstable-2026-08-31";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -39,9 +39,8 @@ stdenv.mkDerivation {
     owner = "noctalia-dev";
     repo = "umbriel";
     # No tagged releases yet
-    rev = "af351dfa7564eaa0e73d215d057eb0b209cba057";
-    fetchSubmodules = true;
-    hash = "sha256-y/ofPV9De3qxrLsmmAUs4fX/ZaNBquqvm6VvnnNXXhA=";
+    rev = "729e7eb521c2207dd562ca1284bc0fbf9aecd270";
+    hash = "sha256-eTEgrUJ1ywm0wQcqG+8AqLC+prds9loid0SX4Ncz61E=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/vo/vopono/package.nix b/pkgs/by-name/vo/vopono/package.nix
index badd6837506c..02bb0b288a4f 100644
--- a/pkgs/by-name/vo/vopono/package.nix
+++ b/pkgs/by-name/vo/vopono/package.nix
@@ -6,14 +6,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "vopono";
-  version = "0.10.21";
+  version = "1.0.1";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-JGzTebfh1cFPSy4+pkQRFop7wIxsogHVUAG7M7sHvOs=";
+    hash = "sha256-hYrA6A0pB8WW+/Q3gaBKBQ4pJp7kNvt+nRh66l14SRg=";
   };
 
-  cargoHash = "sha256-I9pQ6hktej+zc4cKFfkxBQewUljG/g1/B8RkMuCTsjM=";
+  cargoHash = "sha256-vCHYYUXLhVZq09GPEBEtyumgJEMPqDTKuv7HIY65ToM=";
 
   meta = {
     description = "Run applications through VPN connections in network namespaces";
diff --git a/pkgs/by-name/wi/winboat/package.nix b/pkgs/by-name/wi/winboat/package.nix
index a4abea5bc934..c55e0307e7f6 100644
--- a/pkgs/by-name/wi/winboat/package.nix
+++ b/pkgs/by-name/wi/winboat/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  electron_40,
+  electron_43,
   zip,
   makeWrapper,
   udev,
@@ -17,17 +17,17 @@
 }:
 
 let
-  electron = electron_40;
+  electron = electron_43;
 in
 buildNpmPackage (finalAttrs: {
   pname = "winboat";
-  version = "0.9.0";
+  version = "0.9.2";
 
   src = fetchFromGitHub {
     owner = "TibixDev";
     repo = "winboat";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DgH6CAZf+XIgBav2xd2FF2MGRgGIyOs/98vqWHA3XYw=";
+    hash = "sha256-B+Pbi3nQsY3sHACGoaL8PhbHrTjlQbEDgVRWabwm8Iw=";
   };
 
   postPatch = ''
@@ -44,10 +44,12 @@ buildNpmPackage (finalAttrs: {
   buildInputs = [ udev ];
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = 1;
-  npmDepsHash = "sha256-DLkI9a030uM2X1et94e4nd/HEyw5ugtK8NEAn/J8p9U=";
+  npmDepsHash = "sha256-38hDI0z3lrdSvMTUZAotIuT7Kt/NZcl8UdrYpum1i1M=";
   makeCacheWritable = true;
 
-  guest-server = pkgsCross.mingwW64.callPackage ./guest-server.nix { };
+  guest-server = pkgsCross.mingwW64.callPackage ./guest-server.nix {
+    winboat = finalAttrs.finalPackage;
+  };
   passthru = {
     guest-server = finalAttrs.guest-server;
     updateScript = nix-update-script {
diff --git a/pkgs/by-name/xd/xdg-desktop-portal-umbriel/package.nix b/pkgs/by-name/xd/xdg-desktop-portal-umbriel/package.nix
index a73e30f5ad60..807505633980 100644
--- a/pkgs/by-name/xd/xdg-desktop-portal-umbriel/package.nix
+++ b/pkgs/by-name/xd/xdg-desktop-portal-umbriel/package.nix
@@ -21,7 +21,7 @@
 }:
 stdenv.mkDerivation {
   pname = "xdg-desktop-portal-umbriel";
-  version = "0-unstable-2026-08-24";
+  version = "0-unstable-2026-08-31";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -30,8 +30,8 @@ stdenv.mkDerivation {
     owner = "noctalia-dev";
     repo = "xdg-desktop-portal-umbriel";
     # No tagged releases yet
-    rev = "515c9f70f13ba4b4b9e19930b3e899c4ac8a50a4";
-    hash = "sha256-fqU58lZeFchlY5aqyQgIfrN5ec/jqbhXNwNxyL2lp/g=";
+    rev = "d996f0c2bd4e8c868c0a143f0c9ce060f3c47ed5";
+    hash = "sha256-1mKBFkIO9RA3ERsLo1QZhyvS6bFSjG1lBpegQnPbIUY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/zi/zi/package.nix b/pkgs/by-name/zi/zi/package.nix
index 98c8ee1be38a..1a67e03e578b 100644
--- a/pkgs/by-name/zi/zi/package.nix
+++ b/pkgs/by-name/zi/zi/package.nix
@@ -7,7 +7,7 @@
 
 stdenvNoCC.mkDerivation {
   pname = "zi";
-  version = "unstable-2022-04-09";
+  version = "1.0.0-unstable-2022-04-09";
   src = fetchFromGitHub {
     owner = "z-shell";
     repo = "zi";
diff --git a/pkgs/by-name/zw/zwave-js-ui/package.nix b/pkgs/by-name/zw/zwave-js-ui/package.nix
index 36994e536098..c4604e443cfd 100644
--- a/pkgs/by-name/zw/zwave-js-ui/package.nix
+++ b/pkgs/by-name/zw/zwave-js-ui/package.nix
@@ -7,15 +7,15 @@
 
 buildNpmPackage rec {
   pname = "zwave-js-ui";
-  version = "11.22.3";
+  version = "11.23.0";
 
   src = fetchFromGitHub {
     owner = "zwave-js";
     repo = "zwave-js-ui";
     tag = "v${version}";
-    hash = "sha256-0UT5+hgdehs3W6SP0qoGfqqro/kw+90kXuDKs2Jcffs=";
+    hash = "sha256-BDUutMwzbqdhpdDLpHMF1lfFAK2lE9fS1qnQJLZ9BMU=";
   };
-  npmDepsHash = "sha256-TIoKyOODZfDckxJQBAmbP3BMAhfbCFpb9QACvFOIoA4=";
+  npmDepsHash = "sha256-9Cv26hEenftt1uRbag+3/UgLGDoidG8Jl6H+N67+a08=";
 
   passthru.tests.zwave-js-ui = nixosTests.zwave-js-ui;
 
diff --git a/pkgs/development/ocaml-modules/bstr/default.nix b/pkgs/development/ocaml-modules/bstr/default.nix
index c6f7b2b44d28..9ec7bb335456 100644
--- a/pkgs/development/ocaml-modules/bstr/default.nix
+++ b/pkgs/development/ocaml-modules/bstr/default.nix
@@ -6,19 +6,22 @@
 
 buildDunePackage (finalAttrs: {
   pname = "bstr";
-  version = "0.0.2";
+  version = "0.0.4";
 
   minimalOCamlVersion = "4.13";
 
   src = fetchurl {
     url = "https://github.com/robur-coop/bstr/releases/download/v${finalAttrs.version}/bstr-${finalAttrs.version}.tbz";
-    hash = "sha256-/zvzCBzT014OesTmxGBDB98ZRU++YNDLUZ8uaDK3keM=";
+    hash = "sha256-ZAg28VstVVvfI2b213g5JuEVmK1+lFV7Fnx4WyVfSFY=";
   };
 
   meta = {
     description = "A simple library for bigstrings";
     homepage = "https://git.robur.coop/robur/bstr";
-    license = lib.licenses.mit;
+    license = [
+      lib.licenses.mit
+      lib.licenses.isc
+    ];
     maintainers = [ lib.maintainers.vbgl ];
   };
 })
diff --git a/pkgs/development/ocaml-modules/dscheck/default.nix b/pkgs/development/ocaml-modules/dscheck/default.nix
index 70bd80043c77..10bdfc44d3be 100644
--- a/pkgs/development/ocaml-modules/dscheck/default.nix
+++ b/pkgs/development/ocaml-modules/dscheck/default.nix
@@ -2,27 +2,20 @@
   lib,
   fetchurl,
   buildDunePackage,
-  containers,
-  oseq,
   alcotest,
 }:
 
 buildDunePackage (finalAttrs: {
   pname = "dscheck";
-  version = "0.5.0";
+  version = "0.6.0";
 
-  minimalOCamlVersion = "5.0";
+  minimalOCamlVersion = "5.2";
 
   src = fetchurl {
     url = "https://github.com/ocaml-multicore/dscheck/releases/download/${finalAttrs.version}/dscheck-${finalAttrs.version}.tbz";
-    hash = "sha256-9Rm2DmdvVeCkgAWCvkYdQTj94wmU7JkY8UI3fReIaG0=";
+    hash = "sha256-//li4+7Y1kWjU5V3uTUF1kLZr+M7KeJPkOZx03UOe6w=";
   };
 
-  propagatedBuildInputs = [
-    containers
-    oseq
-  ];
-
   doCheck = true;
   checkInputs = [ alcotest ];
 
diff --git a/pkgs/development/python-modules/ayla-iot-unofficial/default.nix b/pkgs/development/python-modules/ayla-iot-unofficial/default.nix
index 318c7ffb74db..14d2df490fa2 100644
--- a/pkgs/development/python-modules/ayla-iot-unofficial/default.nix
+++ b/pkgs/development/python-modules/ayla-iot-unofficial/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "ayla-iot-unofficial";
-  version = "1.5.1";
+  version = "1.5.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "rewardone";
     repo = "ayla-iot-unofficial";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-N13xC2riZ31J1DzwP9vFXvz69w1DVbwEtbFubX5dvwQ=";
+    hash = "sha256-reKXctSmGk1H3kEnvcC7AiDWLwr2fdezZqM5HI2qdYU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/bumble/default.nix b/pkgs/development/python-modules/bumble/default.nix
index 6f4e267702ab..6a27dedbd7a3 100644
--- a/pkgs/development/python-modules/bumble/default.nix
+++ b/pkgs/development/python-modules/bumble/default.nix
@@ -28,14 +28,14 @@
 
 buildPythonPackage rec {
   pname = "bumble";
-  version = "0.0.233";
+  version = "0.0.234";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "bumble";
     tag = "v${version}";
-    hash = "sha256-WTikxDp+V+H2RPN+myWg+CRgqncJY5v3zhwotfa8CCU=";
+    hash = "sha256-7GtmFpnaCSAXMc58X6NMTVzZWblAghKEs8x3nEPykNc=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/django-axes/default.nix b/pkgs/development/python-modules/django-axes/default.nix
index 909cb5ac014c..23a9f61ad356 100644
--- a/pkgs/development/python-modules/django-axes/default.nix
+++ b/pkgs/development/python-modules/django-axes/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "django-axes";
-  version = "8.3.1";
+  version = "8.3.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jazzband";
     repo = "django-axes";
     tag = version;
-    hash = "sha256-DcoKXNldTXNcJTauI1torupjnKNvqmTo4/BbFXBZyFA=";
+    hash = "sha256-jH/A3ZuuBI/S9xZ1VmOoB/8NnxSa5NgnSzY9N02GmD0=";
   };
 
   build-system = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/gassist-text/default.nix b/pkgs/development/python-modules/gassist-text/default.nix
index ed6815858bff..4f5910c49ea1 100644
--- a/pkgs/development/python-modules/gassist-text/default.nix
+++ b/pkgs/development/python-modules/gassist-text/default.nix
@@ -11,21 +11,23 @@
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "gassist-text";
-  version = "0.0.14";
+  version = "0.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tronikos";
     repo = "gassist_text";
-    tag = version;
-    hash = "sha256-Nk2GwqColX/d1nUL+YvolLH/1g1FTDZbExhBGot/EV0=";
+    tag = finalAttrs.version;
+    hash = "sha256-KrlStBYsE8PwAH7C7WzLezLffBFcmj/1cA0YJq/hkkU=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  __darwinAllowLocalNetworking = true;
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     beautifulsoup4
     google-auth
     grpcio
@@ -40,8 +42,8 @@ buildPythonPackage rec {
   meta = {
     description = "Module for interacting with Google Assistant API via text";
     homepage = "https://github.com/tronikos/gassist_text";
-    changelog = "https://github.com/tronikos/gassist_text/releases/tag/${version}";
+    changelog = "https://github.com/tronikos/gassist_text/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/hyprland-config/default.nix b/pkgs/development/python-modules/hyprland-config/default.nix
index 694cfc4bdfcb..84020f5a2e8d 100644
--- a/pkgs/development/python-modules/hyprland-config/default.nix
+++ b/pkgs/development/python-modules/hyprland-config/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "hyprland-config";
-  version = "0.9.14";
+  version = "0.9.16";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "BlueManCZ";
     repo = "hyprland-config";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Jgh/X7M+hdp0NPuA0YnfdYU/sxY9hfl/OCihnzobvm8=";
+    hash = "sha256-wfxZqqBdA4P8uBuuFpr0MlmeSGg0jkUwkENqYiPdhHA=";
   };
 
   # The Lua reader shells out to an interpreter it looks up on PATH at runtime.
diff --git a/pkgs/development/python-modules/hyprland-state/default.nix b/pkgs/development/python-modules/hyprland-state/default.nix
index 5087734434bf..4576bce398e7 100644
--- a/pkgs/development/python-modules/hyprland-state/default.nix
+++ b/pkgs/development/python-modules/hyprland-state/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "hyprland-state";
-  version = "0.4.4";
+  version = "0.4.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "BlueManCZ";
     repo = "hyprland-state";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Vb6LIH3DC/6/mbh3Bji/qpil5r0Xp+WiELQ+rL+S6UU=";
+    hash = "sha256-XeD01ER5PDGFqdYerx0OlWXtn0WEUVwspwObWscz6W8=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/llama-index-embeddings-openai-like/default.nix b/pkgs/development/python-modules/llama-index-embeddings-openai-like/default.nix
index e6198daeeeae..f0b662f88bf6 100644
--- a/pkgs/development/python-modules/llama-index-embeddings-openai-like/default.nix
+++ b/pkgs/development/python-modules/llama-index-embeddings-openai-like/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "llama-index-embeddings-openai-like";
-  version = "0.3.1";
+  version = "0.4.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "llama_index_embeddings_openai_like";
     inherit (finalAttrs) version;
-    hash = "sha256-zvevS84oTo5nMFMtvQqjJedzmKXVUk7bLS46yxIvtbY=";
+    hash = "sha256-7BUfc+rPF0du2pZIHrlYFd4Ox8VZ63/nRdNYnPo4RvI=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/llama-index-vector-stores-faiss/default.nix b/pkgs/development/python-modules/llama-index-vector-stores-faiss/default.nix
index fdc0a13cfab1..462016785e7d 100644
--- a/pkgs/development/python-modules/llama-index-vector-stores-faiss/default.nix
+++ b/pkgs/development/python-modules/llama-index-vector-stores-faiss/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "llama-index-vector-stores-faiss";
-  version = "0.6.0";
+  version = "0.7.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "llama_index_vector_stores_faiss";
     inherit (finalAttrs) version;
-    hash = "sha256-AL/rbLdXHg6FZWbLTxDIm0FbYQjxUdmtSO6cMdpWP14=";
+    hash = "sha256-ZTHrDeP72ogqFuRCvu7tWQIJxf16CfLPI1l32U6X/WM=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/python-glanceclient/default.nix b/pkgs/development/python-modules/python-glanceclient/default.nix
index 1090b0dabd55..274dbf67dc17 100644
--- a/pkgs/development/python-modules/python-glanceclient/default.nix
+++ b/pkgs/development/python-modules/python-glanceclient/default.nix
@@ -22,7 +22,7 @@
 }:
 let
   pname = "python-glanceclient";
-  version = "4.11.0";
+  version = "4.13.0";
 
   disabledTests = [
     # Skip tests which require networking.
@@ -39,7 +39,7 @@ buildPythonPackage {
   src = fetchPypi {
     pname = "python_glanceclient";
     inherit version;
-    hash = "sha256-XOIRi/50YpNIBZFmF+U3vFsA/UyrP7e7iKT5JTlwVi0=";
+    hash = "sha256-+jNZvIvZPnrryjctr+yOGQA7TB9kSZ4uuCsncdqPpBw=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/tcia-utils/default.nix b/pkgs/development/python-modules/tcia-utils/default.nix
index 71ee5c7821de..1f774381b2ec 100644
--- a/pkgs/development/python-modules/tcia-utils/default.nix
+++ b/pkgs/development/python-modules/tcia-utils/default.nix
@@ -49,6 +49,6 @@ buildPythonPackage (finalAttrs: {
     description = "Python utilities for interacting with The Cancer Imaging Archive (TCIA)";
     homepage = "https://github.com/kirbyju/tcia_utils";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ sgomezsal ];
+    maintainers = [ ];
   };
 })
diff --git a/pkgs/development/python-modules/unstructured-client/default.nix b/pkgs/development/python-modules/unstructured-client/default.nix
index 60a62567e972..83d200513acf 100644
--- a/pkgs/development/python-modules/unstructured-client/default.nix
+++ b/pkgs/development/python-modules/unstructured-client/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "unstructured-client";
-  version = "0.46.1";
+  version = "0.46.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Unstructured-IO";
     repo = "unstructured-python-client";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Q1REvlD14WYQS8r51XsjheK8BZMSgSvQZQx5wmNjkXo=";
+    hash = "sha256-rR9bykzH6/Ckbg3aEFd4IdnYU4s2rCWeqC+Lp1yRLo8=";
   };
 
   preBuild = ''
diff --git a/pkgs/development/tools/pnpm/default.nix b/pkgs/development/tools/pnpm/default.nix
index b8a5e914c232..a02214ecbb3d 100644
--- a/pkgs/development/tools/pnpm/default.nix
+++ b/pkgs/development/tools/pnpm/default.nix
@@ -23,6 +23,8 @@ let
         "CVE-2026-59194"
         "CVE-2026-59195"
         "CVE-2026-59196"
+        "CVE-2026-82392"
+        "CVE-2026-82393"
       ];
     };
     # 10.34.1 made a breaking change that causes
@@ -38,6 +40,8 @@ let
         "CVE-2026-59194"
         "CVE-2026-59195"
         "CVE-2026-59196"
+        "CVE-2026-82392"
+        "CVE-2026-82393"
       ];
     };
     "10" = {
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index df670a253f07..f45807ca51d3 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1568,6 +1568,7 @@ mapAliases {
   LPCNet = throw "'LPCNet' has been renamed to/replaced by 'lpcnet'"; # Converted to throw 2025-10-27
   lttv = throw "'lttv' has been removed, as it is broken and unmaintained. Upstream suggests using 'tracecompass' or 'babeltrace2' instead"; # Added 2026-05-04
   luci-go = throw "luci-go has been removed since it was unused and failing to build for 5 months"; # Added 2025-08-27
+  lukesmithx-st = throw "'lukesmithxyz-st' has been removed, as it is unmaintained"; # Added 2026-08-31
   luminanceHDR = throw "'luminanceHDR' has been removed as it depended on EOL qt5 webengine and was unmaintained"; # Added 2026-04-17
   lunarvim = throw "'lunarvim' has been removed since it was abandoned upstream and relied on an older version of 'neovim' to work properly"; # Added 2026-02-05
   lunatic = throw "'lunatic' has been removed, as it is unmaintained"; # Added 2026-05-04