diff --git a/nixos/modules/programs/wayland/dwl.nix b/nixos/modules/programs/wayland/dwl.nix
index 5e3ac932b212..792166066672 100644
--- a/nixos/modules/programs/wayland/dwl.nix
+++ b/nixos/modules/programs/wayland/dwl.nix
@@ -61,11 +61,10 @@ in
         #!${pkgs.runtimeShell}
         # Import environment variables
         ${cfg.extraSessionCommands}
-        # Setup systemd user environment
-        systemctl --user import-environment DISPLAY WAYLAND_DISPLAY
-        systemctl --user start dwl-session.target
-        # Start dwl
-        exec ${lib.getExe cfg.package}
+        # Start dwl, then set up the systemd user environment once dwl
+        # has actually set WAYLAND_DISPLAY (see dwl(1) -s), instead of
+        # importing it before dwl exists.
+        exec ${lib.getExe cfg.package} -s "systemctl --user import-environment DISPLAY WAYLAND_DISPLAY; systemctl --user start dwl-session.target"
       '';
       mode = "0755"; # Make it executable
     };
diff --git a/nixos/modules/services/networking/iscsi/initiator.nix b/nixos/modules/services/networking/iscsi/initiator.nix
index 7a4ca5d58254..d7ebe927aea6 100644
--- a/nixos/modules/services/networking/iscsi/initiator.nix
+++ b/nixos/modules/services/networking/iscsi/initiator.nix
@@ -20,6 +20,24 @@ in
       default = null;
       description = "Portal to discover targets on";
     };
+
+    discoverType = mkOption {
+      description = ''
+        Target discovery type.
+        Change this if you want to discover your targes via an iSNS server
+        or use the targets provided via firmware settings.
+        See {manpage}`iscsiadm(8)`.
+      '';
+      default = "sendtargets";
+      example = "sendtargets";
+      type = enum [
+        "st"
+        "sendtargets"
+        "isns"
+        "fw"
+      ];
+    };
+
     name = mkOption {
       type = str;
       description = "Name of this iscsi initiator";
@@ -81,7 +99,7 @@ in
       wantedBy = [ "remote-fs.target" ];
       serviceConfig.ExecStartPre =
         mkIf (cfg.discoverPortal != null)
-          "${cfg.package}/bin/iscsiadm --mode discoverydb --type sendtargets --portal ${escapeShellArg cfg.discoverPortal} --discover";
+          "${cfg.package}/bin/iscsiadm --mode discoverydb --type ${cfg.discoverType} --portal ${escapeShellArg cfg.discoverPortal} --discover";
     };
 
     environment.systemPackages = [ cfg.package ];
diff --git a/nixos/modules/services/networking/iscsi/root-initiator.nix b/nixos/modules/services/networking/iscsi/root-initiator.nix
index 86396ae1e24f..9a93bfc0ed4f 100644
--- a/nixos/modules/services/networking/iscsi/root-initiator.nix
+++ b/nixos/modules/services/networking/iscsi/root-initiator.nix
@@ -43,6 +43,23 @@ in
       type = nullOr str;
     };
 
+    discoverType = mkOption {
+      description = ''
+        Target discovery type.
+        Change this if you want to discover your targes via an iSNS server
+        or use the targets provided via firmware settings.
+        See {manpage}`iscsiadm(8)`.
+      '';
+      default = "sendtargets";
+      example = "sendtargets";
+      type = enum [
+        "st"
+        "sendtargets"
+        "isns"
+        "fw"
+      ];
+    };
+
     target = mkOption {
       description = ''
         Name of the iSCSI target to boot from.
@@ -168,7 +185,7 @@ in
 
           iscsid --foreground --no-pid-file --debug ${toString cfg.logLevel} &
           iscsiadm --mode discoverydb \
-            --type sendtargets \
+            --type ${cfg.discoverType} \
             --discover \
             --portal ${escapeShellArg cfg.discoverPortal} \
             --debug ${toString cfg.logLevel}
diff --git a/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el b/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
index 50715f7e5d27..30735966656d 100644
--- a/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
+++ b/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
@@ -9,25 +9,7 @@
 
 ;; Try to make tests cause no side-effects.
 
-;;;; Tests that can be run in a batch Emacs
-
-(ert-deftest with-packages-requested-packages-are-available ()
-  (should (package-installed-p 'dash))
-  (should (package-installed-p 'flx-ido)))
-
-(ert-deftest with-packages-deps-of-requested-packages-are-available ()
-  "Test https://github.com/NixOS/nixpkgs/issues/388829."
-  (should (package-installed-p 'flx))
-  (should (package-installed-p 'flx-ido)))
-
-(ert-deftest with-packages-info-manual-of-requested-packages-is-available ()
-  "Test https://debbugs.gnu.org/cgi/bugreport.cgi?bug=81105."
-  ;; `package-activate-all' makes package info manuals available.
-  ;; It is called at startup normally, but not in batch mode.
-  ;; We call it if needed to emulate the "normal" case.
-  (unless package--activated
-    (package-activate-all))
-  (should (Info-find-file "dash" t)))
+;;;; Utils
 
 (defun with-packages--nix-store-dir ()
   "Return nix store dir.
@@ -56,6 +38,36 @@ which is generated by nix when building this elisp package."
   "Locate the natively-compiled LIBRARY file."
   (locate-eln-file (comp-el-to-eln-rel-filename (find-library-name library))))
 
+(defun with-packages-unwrapped-site-start-is-loaded ()
+  (fboundp 'nix--profile-paths))
+
+(defun with-packages-eval-in-sub-emacs (form)
+  "Evaluate FORM in a subprocess Emacs and return its result."
+  (pcase-exhaustive
+      (process-lines "emacs" "--batch"
+                     "--eval" (format "(prin1 %S)" form))
+    (`(,result) (read result))))
+
+;;;; Tests that can be run in a batch Emacs
+
+(ert-deftest with-packages-requested-packages-are-available ()
+  (should (package-installed-p 'dash))
+  (should (package-installed-p 'flx-ido)))
+
+(ert-deftest with-packages-deps-of-requested-packages-are-available ()
+  "Test https://github.com/NixOS/nixpkgs/issues/388829."
+  (should (package-installed-p 'flx))
+  (should (package-installed-p 'flx-ido)))
+
+(ert-deftest with-packages-info-manual-of-requested-packages-is-available ()
+  "Test https://debbugs.gnu.org/cgi/bugreport.cgi?bug=81105."
+  ;; `package-activate-all' makes package info manuals available.
+  ;; It is called at startup normally, but not in batch mode.
+  ;; We call it if needed to emulate the "normal" case.
+  (unless package--activated
+    (package-activate-all))
+  (should (Info-find-file "dash" t)))
+
 (ert-deftest with-packages-aot-native-comp-eln-files-are-available ()
   (skip-unless (native-comp-available-p))
   (ert-info ("search eln files of Emacs proper")
@@ -63,14 +75,27 @@ which is generated by nix when building this elisp package."
   (ert-info ("search eln files of requested packages")
     (should (with-packages--nix-store-file-p (with-packages--locate-eln-file "dash")))))
 
-(defun with-packages-unwrapped-site-start-is-loaded ()
-  (fboundp 'nix--profile-paths))
-
 (ert-deftest with-packages-unwrapped-site-start-is-loaded ()
   (should (with-packages-unwrapped-site-start-is-loaded)))
 
-(ert-deftest with-packages-bin-dirs-of-requested-packages-are-added-to-exec-path ()
-  (should (executable-find "cowsay")))
+(ert-deftest with-packages-binaries-of-requested-packages-are-available ()
+  (ert-info ("find binary via PATH")
+    (should (equal (call-process-shell-command "cowsay") 0)))
+  (ert-info ("find binary via exec-path")
+    (should (executable-find "cowsay")))
+  (ert-info ("each item is unique")
+    (cl-flet ((item-should-be-unique (items)
+                (should (equal items
+                               (cl-remove-duplicates items :test #'string=)))))
+      (ert-info ("PATH of this Emacs")
+        (item-should-be-unique (parse-colon-path (getenv "PATH"))))
+      (ert-info ("PATH of sub-Emacs")
+        (item-should-be-unique
+         (parse-colon-path (with-packages-eval-in-sub-emacs '(getenv "PATH")))))
+      (ert-info ("exec-path of this Emacs")
+        (item-should-be-unique exec-path))
+      (ert-info ("exec-path of sub-Emacs")
+        (item-should-be-unique (with-packages-eval-in-sub-emacs 'exec-path))))))
 
 (ert-deftest with-packages-tree-sitter-dir-is-added-to-treesit-extra-load-path ()
   (skip-unless (treesit-available-p))
diff --git a/pkgs/applications/editors/emacs/build-support/wrapper.nix b/pkgs/applications/editors/emacs/build-support/wrapper.nix
index 051e5923d6b0..1f9fbb240c5a 100644
--- a/pkgs/applications/editors/emacs/build-support/wrapper.nix
+++ b/pkgs/applications/editors/emacs/build-support/wrapper.nix
@@ -171,16 +171,6 @@ runCommand (lib.appendToName "with-packages" emacs).name
           cat >"$siteStart" <<EOF
           ;;; -*- lexical-binding: t -*-
           (load "$emacs/share/emacs/site-lisp/site-start" nil t)
-          ;; "$out/share/emacs/site-lisp" is added to load-path in wrapper.sh
-          ;; "$out/share/emacs/native-lisp" is added to native-comp-eln-load-path in wrapper.sh
-          (add-to-list 'exec-path "$out/bin")
-          ;; Also expose extra package binaries via PATH so that subprocesses
-          ;; which rebuild their environment from PATH (e.g. direnv/envrc) can
-          ;; still find them. See https://github.com/purcell/envrc/issues/9
-          (let ((deps-bin "$out/bin")
-                (current-path (or (getenv "PATH") "")))
-            (unless (member deps-bin (split-string current-path path-separator))
-              (setenv "PATH" (concat deps-bin path-separator current-path))))
           ${lib.optionalString withTreeSitter ''
             (add-to-list 'treesit-extra-load-path "$out/lib/")
           ''}
@@ -220,6 +210,7 @@ runCommand (lib.appendToName "with-packages" emacs).name
         --subst-var-by bash ${emacs.stdenv.shell} \
         --subst-var-by wrapperSiteLisp "$deps/share/emacs/site-lisp" \
         --subst-var-by wrapperSiteLispNative "$deps/share/emacs/native-lisp" \
+        --subst-var-by wrapperBinDir "$deps/bin" \
         --subst-var-by wrapperInvocationDirectory "$out/bin/" \
         --subst-var-by wrapperInvocationName "$progname" \
         --subst-var prog
@@ -246,6 +237,7 @@ runCommand (lib.appendToName "with-packages" emacs).name
         --subst-var-by bash ${emacs.stdenv.shell} \
         --subst-var-by wrapperSiteLisp "$deps/share/emacs/site-lisp" \
         --subst-var-by wrapperSiteLispNative "$deps/share/emacs/native-lisp" \
+        --subst-var-by wrapperBinDir "$deps/bin" \
         --subst-var-by wrapperInvocationDirectory "$out/Applications/Emacs.app/Contents/MacOS/" \
         --subst-var-by wrapperInvocationName "Emacs" \
         --subst-var-by prog "$emacs/Applications/Emacs.app/Contents/MacOS/Emacs"
diff --git a/pkgs/applications/editors/emacs/build-support/wrapper.sh b/pkgs/applications/editors/emacs/build-support/wrapper.sh
index e83308bf5b32..fb334eaf32e4 100755
--- a/pkgs/applications/editors/emacs/build-support/wrapper.sh
+++ b/pkgs/applications/editors/emacs/build-support/wrapper.sh
@@ -53,4 +53,9 @@ export emacsWithPackages_siteLispNative=@wrapperSiteLispNative@
 export emacsWithPackages_invocationDirectory=@wrapperInvocationDirectory@
 export emacsWithPackages_invocationName=@wrapperInvocationName@
 
+if [[ ${PATH-} != *"@wrapperBinDir@":* ]]
+then
+    export PATH="@wrapperBinDir@${PATH:+:$PATH}"
+fi
+
 exec @prog@ "$@"
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 1f66d46837c3..560836c1053b 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -2751,8 +2751,8 @@ let
         mktplcRef = {
           name = "intellij-idea-keybindings";
           publisher = "k--kato";
-          version = "1.7.7";
-          hash = "sha256-+XF+Odb9nMKclQkB/lwFuVpCHlVq6LNG/gQATVBcrYc=";
+          version = "1.7.8";
+          hash = "sha256-771I7W5jrYVtN25N4jnKudPqhlX1ohGP5dI1vUciYXs=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/k--kato.intellij-idea-keybindings/changelog";
diff --git a/pkgs/applications/misc/sweethome3d/default.nix b/pkgs/applications/misc/sweethome3d/default.nix
index f0a220d8733d..976be3b8e862 100644
--- a/pkgs/applications/misc/sweethome3d/default.nix
+++ b/pkgs/applications/misc/sweethome3d/default.nix
@@ -33,6 +33,8 @@ let
       "aarch64-darwin"
     ];
     mainProgram = "sweethome3d";
+    # last successful hydra build on darwin was in 2025
+    broken = stdenv.hostPlatform.isDarwin;
   };
 in
 {
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index abbeeecb1dac..079812d971b5 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -679,13 +679,13 @@
     "vendorHash": "sha256-hfSLa5MrrQ0JFZntykbU33TQnuAoYYFasOzUOzi1RV8="
   },
   "hashicorp_time": {
-    "hash": "sha256-kdCdph+H3fWizMh+7AGBEscKpCwP7naj+3NSmPK25Us=",
+    "hash": "sha256-7els7FaCojWzXp+0YP9YYJTAKS2PqpR1SMC1WxsfVb0=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/time",
     "owner": "hashicorp",
     "repo": "terraform-provider-time",
-    "rev": "v0.14.1",
+    "rev": "v0.14.2",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-pIuZNark35Aqstd2hDf5QGmegzfFa439+5zI/qBsWLA="
+    "vendorHash": "sha256-t20uPPaKr43Al7ExOPD+cw1hVwaVwxljHHR0tVPmrYw="
   },
   "hashicorp_tls": {
     "hash": "sha256-lUaVcnN+1Siz78XqrPLUlpUPRNLzp1VtWxgZEysL3pM=",
diff --git a/pkgs/build-support/writers/scripts.nix b/pkgs/build-support/writers/scripts.nix
index b58bd053e14f..c27938f78b1e 100644
--- a/pkgs/build-support/writers/scripts.nix
+++ b/pkgs/build-support/writers/scripts.nix
@@ -877,12 +877,16 @@ rec {
   */
   writeNu =
     name: argsOrScript:
+    # Separate the shebang from doc comments attached to `main`.
     if lib.isAttrs argsOrScript && !lib.isDerivation argsOrScript then
+      script:
       makeScriptWriter (
         argsOrScript // { interpreter = "${lib.getExe pkgs.nushell} --no-config-file"; }
-      ) name
+      ) name "\n${script}"
     else
-      makeScriptWriter { interpreter = "${lib.getExe pkgs.nushell} --no-config-file"; } name argsOrScript;
+      makeScriptWriter {
+        interpreter = "${lib.getExe pkgs.nushell} --no-config-file";
+      } name "\n${argsOrScript}";
 
   /**
     Like writeScriptBin but the first line is a shebang to nu
diff --git a/pkgs/build-support/writers/test.nix b/pkgs/build-support/writers/test.nix
index 996aaa01e9af..63623f8ba236 100644
--- a/pkgs/build-support/writers/test.nix
+++ b/pkgs/build-support/writers/test.nix
@@ -254,6 +254,23 @@ recurseIntoAttrs {
       ''
     );
 
+    nuDocComment =
+      let
+        script = writeNu "test-writers-nushell-doc-comment" ''
+          # Doc comment example
+          def main [] {}
+        '';
+      in
+      runCommand "test-writers-nushell-doc-comment" { } ''
+        ${script} --help > help
+        grep -F "Doc comment example" help
+        if grep -F "#!" help; then
+          echo "shebang included in Nushell doc comment" >&2
+          exit 1
+        fi
+        touch $out
+      '';
+
     babashka = expectSuccess (
       writeBabashka "test-writers-babashka" { } ''
         (println "success")
diff --git a/pkgs/by-name/al/all-the-package-names/package.nix b/pkgs/by-name/al/all-the-package-names/package.nix
index eb4767f51872..25db9428b5cd 100644
--- a/pkgs/by-name/al/all-the-package-names/package.nix
+++ b/pkgs/by-name/al/all-the-package-names/package.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "all-the-package-names";
-  version = "2.0.2568";
+  version = "2.0.2578";
 
   src = fetchFromGitHub {
     owner = "nice-registry";
     repo = "all-the-package-names";
     tag = "v${version}";
-    hash = "sha256-9Okp0Fli+MyVYqOQDg867ic/t+bOJr86MVIshntiy78=";
+    hash = "sha256-fFJuN1MPpnpYCotAiQoRU5qEsyC6HjOTrjxfnyWj/+o=";
   };
 
-  npmDepsHash = "sha256-YOvzCKN2PqbyOgR5qhshI52/grQT2DStbdJgWBrVvsI=";
+  npmDepsHash = "sha256-8xzyypPgtfxYxPcVIJYLNL0a6EE7L93eISanWqPFGM4=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/aw/aws-vault/package.nix b/pkgs/by-name/aw/aws-vault/package.nix
index 2ce145a242df..47ca4c11ea3c 100644
--- a/pkgs/by-name/aw/aws-vault/package.nix
+++ b/pkgs/by-name/aw/aws-vault/package.nix
@@ -10,17 +10,17 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "aws-vault";
-  version = "7.14.0";
+  version = "7.15.0";
 
   src = fetchFromGitHub {
     owner = "ByteNess";
     repo = "aws-vault";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Adb0k6Cb0Jq4LTexNYmCHThE+/4ariIutwy7pH2onoU=";
+    hash = "sha256-SwV0eEABEhZoDGYFsGmpXOJMbCABYxwBZ76+ZS2pTvo=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-vdgQS4ziTzLHWVaIiHORlSEOYPEbMF3fsSabEJh26t0=";
+  vendorHash = "sha256-Ilv0kg0RsPbV2TRiGyEbq9C7UowXXPZ5xQprY2ZbK04=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/ba/bark-server/package.nix b/pkgs/by-name/ba/bark-server/package.nix
index 1bd83a305a2f..b6b47dbc58f7 100644
--- a/pkgs/by-name/ba/bark-server/package.nix
+++ b/pkgs/by-name/ba/bark-server/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "bark-server";
-  version = "2.3.5";
+  version = "2.3.7";
 
   src = fetchFromGitHub {
     owner = "Finb";
     repo = "bark-server";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-s02nLAlKO5SGX0Nx5z/5fZBf6R0kkY4IofbGW8ica50=";
+    hash = "sha256-uuMeBGCp15Rnw9rl6DX/mSG8dM4j0qqSoFv7LPXsVvw=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -27,7 +27,7 @@ buildGoModule (finalAttrs: {
     '';
   };
 
-  vendorHash = "sha256-+WyTKyWVzJAgCQ6bXbOjrJUZkw5XVrvAdgALL2eXU64=";
+  vendorHash = "sha256-9bG2spKX2UTgPenWWNUGOmJLuQFbJE8CgMpKZvLYSHE=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ca/cargo-tally/package.nix b/pkgs/by-name/ca/cargo-tally/package.nix
index d02786237009..8da0d9960d99 100644
--- a/pkgs/by-name/ca/cargo-tally/package.nix
+++ b/pkgs/by-name/ca/cargo-tally/package.nix
@@ -6,14 +6,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-tally";
-  version = "1.0.77";
+  version = "1.0.78";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-bkikJU5qyq+6+PYCJrEmdZHIsPGz4prOt6g69hOIZ8o=";
+    hash = "sha256-+zAi4Cgfi7rO0OcWv50Y7q3NiebLrdaPUR/SFKerrRA=";
   };
 
-  cargoHash = "sha256-hVkQdWOhM/R0hcrtzvlSFtw51jSRKNPmhDCNUbiK3rI=";
+  cargoHash = "sha256-iYb2K70+jVJTdS65bZmcxE4eJstcqtx10NisU7NaW/Q=";
 
   meta = {
     description = "Graph the number of crates that depend on your crate over time";
diff --git a/pkgs/by-name/ci/ciel/package.nix b/pkgs/by-name/ci/ciel/package.nix
index 71eabaf828c5..4af1b04521b2 100644
--- a/pkgs/by-name/ci/ciel/package.nix
+++ b/pkgs/by-name/ci/ciel/package.nix
@@ -16,16 +16,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ciel";
-  version = "3.10.4";
+  version = "3.11.0";
 
   src = fetchFromGitHub {
     owner = "AOSC-Dev";
     repo = "ciel-rs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-oKYPhevy0o5IxxqMneWAamRyZr7yForbsuhszWDUaQk=";
+    hash = "sha256-Axb41MJr59NTT1WruGpYlTOXnCa0cIgC8i4uhDkv6FI=";
   };
 
-  cargoHash = "sha256-hrjZKowkTQaNDrwOYM6pvUomcBrMrvlgvLl0UreeW8U=";
+  cargoHash = "sha256-VLTPcPmdUpa/6A/iaL8Oe8/QmeQMMP40j8J4nEEAeTQ=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/ci/cine/package.nix b/pkgs/by-name/ci/cine/package.nix
index f9dbd8f71472..f568dcac7258 100644
--- a/pkgs/by-name/ci/cine/package.nix
+++ b/pkgs/by-name/ci/cine/package.nix
@@ -19,14 +19,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "cine";
-  version = "1.8.4";
+  version = "1.8.6";
   pyproject = false;
 
   src = fetchFromGitHub {
     owner = "diegopvlk";
     repo = "Cine";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zUsfAe8PdfBv9XzJ0mY+ELIcl+x35v11THj9gtG/fxg=";
+    hash = "sha256-wtHrKrDpjMVOP1XZ4q+KQ5UBPRq/MNxyKTKuJpryU6o=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/cl/clblas/package.nix b/pkgs/by-name/cl/clblas/package.nix
deleted file mode 100644
index f77834528d23..000000000000
--- a/pkgs/by-name/cl/clblas/package.nix
+++ /dev/null
@@ -1,83 +0,0 @@
-{
-  lib,
-  stdenv,
-  llvmPackages_19,
-  fetchFromGitHub,
-  fetchpatch,
-  cmake,
-  gfortran,
-  blas,
-  boost,
-  python3,
-  ocl-icd,
-  opencl-headers,
-}:
-
-let
-  stdenv' = if stdenv.hostPlatform.isDarwin then llvmPackages_19.stdenv else stdenv;
-in
-
-stdenv'.mkDerivation (finalAttrs: {
-  pname = "clblas";
-  version = "2.12";
-
-  src = fetchFromGitHub {
-    owner = "clMathLibraries";
-    repo = "clBLAS";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-Wq5oBl3TW3qpK0cyNWVgJMS5/s8xY1dulqDCkkX5lZQ=";
-  };
-
-  patches = [
-    ./platform.patch
-    (fetchpatch {
-      url = "https://github.com/clMathLibraries/clBLAS/commit/68ce5f0b824d7cf9d71b09bb235cf219defcc7b4.patch";
-      hash = "sha256-XoVcHgJ0kTPysZbM83mUX4/lvXVHKbl7s2Q8WWiUnMs=";
-    })
-  ];
-
-  postPatch = ''
-    sed -i -re 's/(set\(\s*Boost_USE_STATIC_LIBS\s+).*/\1OFF\ \)/g' src/CMakeLists.txt
-
-    substituteInPlace src/CMakeLists.txt \
-      --replace-fail "cmake_minimum_required(VERSION 2.8)" "cmake_minimum_required(VERSION 3.10)"
-    substituteInPlace src/library/tools/tplgen/CMakeLists.txt \
-      --replace-fail "cmake_minimum_required(VERSION 2.6)" "cmake_minimum_required(VERSION 3.10)"
-  '';
-
-  preConfigure = ''
-    cd src
-  '';
-
-  cmakeFlags = [
-    "-DBUILD_TEST=OFF"
-  ];
-
-  nativeBuildInputs = [
-    cmake
-    gfortran
-    python3
-  ];
-  buildInputs = [
-    blas
-    boost
-  ]
-  ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
-    ocl-icd
-    opencl-headers
-  ];
-
-  strictDeps = true;
-
-  meta = {
-    homepage = "https://github.com/clMathLibraries/clBLAS";
-    description = "Software library containing BLAS functions written in OpenCL";
-    longDescription = ''
-      This package contains a library of BLAS functions on top of OpenCL.
-    '';
-    license = lib.licenses.asl20;
-    maintainers = [ ];
-    platforms = lib.platforms.unix;
-  };
-
-})
diff --git a/pkgs/by-name/cl/clblas/platform.patch b/pkgs/by-name/cl/clblas/platform.patch
deleted file mode 100644
index 87404a426a4b..000000000000
--- a/pkgs/by-name/cl/clblas/platform.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-diff --git a/src/library/tools/ktest/config.cpp b/src/library/tools/ktest/config.cpp
-index 8b20128..faf9bde 100644
---- a/src/library/tools/ktest/config.cpp
-+++ b/src/library/tools/ktest/config.cpp
-@@ -24,8 +24,6 @@
- 
- using namespace clMath;
- 
--static const char DEFAULT_PLATFORM_NAME[] = "AMD Accelerated Parallel Processing";
--
- Config::Config() :
-     defaultConfig_(""),
-     cpp_("ktest.cpp"),
-@@ -35,7 +33,10 @@ Config::Config() :
-     hasFuncID_(false), hasSubdims_(false),
-     skipAccuracy_(false)
- {
--    setPlatform(DEFAULT_PLATFORM_NAME);
-+    platform_ = NULL;
-+    setPlatform("");
-+
-+    device_ = NULL;
-     setDevice("");
- 
-     memset(&kargs_, 0, sizeof(kargs_));
-@@ -262,7 +263,7 @@ Config::setPlatform(const std::string& name)
-             continue;
-         }
-         if (name.empty()) {
--            found = (strcmp(pname, DEFAULT_PLATFORM_NAME) == 0);
-+	    found = true;
-         }
-         else {
-             found = (strcmp(pname, name.c_str()) == 0);
diff --git a/pkgs/by-name/cl/clmagma/package.nix b/pkgs/by-name/cl/clmagma/package.nix
deleted file mode 100644
index dbcbd91dc96f..000000000000
--- a/pkgs/by-name/cl/clmagma/package.nix
+++ /dev/null
@@ -1,86 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  gfortran,
-  opencl-headers,
-  clblas,
-  ocl-icd,
-  mkl,
-  intel-ocl,
-}:
-
-let
-  incfile = builtins.toFile "make.inc.custom" ''
-    CC        = g++
-    FORT      = gfortran
-
-    ARCH      = ar
-    ARCHFLAGS = cr
-    RANLIB    = ranlib
-
-    OPTS      = -fPIC -O3 -DADD_ -Wall
-    FOPTS     = -fPIC -O3 -DADD_ -Wall -x f95-cpp-input
-    F77OPTS   = -fPIC -O3 -DADD_ -Wall
-    LDOPTS    = -fPIC
-
-    -include make.check-mkl
-    -include make.check-clblas
-
-    # Gnu mkl is not available I guess?
-    #LIB       = -lmkl_gf_lp64 -lmkl_gnu_thread -lmkl_core -lpthread -lm -fopenmp
-    LIB        = -lmkl_intel_lp64 -lmkl_intel_thread -lmkl_core -liomp5 -lm -fopenmp
-    LIB       += -lclBLAS -lOpenCL
-
-    LIBDIR    = -L$(MKLROOT)/lib/intel64 \
-                -L$(MKLROOT)/../compiler/lib/intel64 \
-                -L$(clBLAS)/lib64
-
-    INC       = -I$(clBLAS)/include
-               #-I$(AMDAPP)/include
-  '';
-in
-stdenv.mkDerivation rec {
-  pname = "clmagma";
-  version = "1.3.0";
-  src = fetchurl {
-    url = "https://icl.cs.utk.edu/projectsfiles/magma/cl/clmagma-${version}.tar.gz";
-    sha256 = "1n27ny0xhwirw2ydn46pfcwy53gzia9zbam4irx44fd4d7f9ydv7";
-    name = "clmagma-${version}.tar.gz";
-  };
-
-  buildInputs = [
-    gfortran
-    clblas
-    opencl-headers
-    ocl-icd
-    mkl
-    intel-ocl
-  ];
-
-  enableParallelBuilding = true;
-
-  env = {
-    MKLROOT = mkl;
-    clBLAS = clblas;
-
-    # Otherwise build looks for it in /run/opengl-driver/etc/OpenCL/vendors,
-    # which is not available.
-    OPENCL_VENDOR_PATH = "${intel-ocl}/etc/OpenCL/vendors";
-  };
-
-  preBuild = ''
-    # By default it tries to use GPU, and thus fails for CPUs
-    sed -i "s/CL_DEVICE_TYPE_GPU/CL_DEVICE_TYPE_DEFAULT/" interface_opencl/clmagma_runtime.cpp
-    sed -i "s%/usr/local/clmagma%/$out%" Makefile.internal
-    cp ${incfile} make.inc
-  '';
-
-  meta = {
-    description = "Matrix Algebra on GPU and Multicore Architectures, OpenCL port";
-    license = lib.licenses.bsd3;
-    homepage = "https://icl.cs.utk.edu/magma/index.html";
-    platforms = lib.platforms.linux;
-    maintainers = with lib.maintainers; [ volhovm ];
-  };
-}
diff --git a/pkgs/by-name/co/coroot/package.nix b/pkgs/by-name/co/coroot/package.nix
index 2e93aa479259..0bc90511d7da 100644
--- a/pkgs/by-name/co/coroot/package.nix
+++ b/pkgs/by-name/co/coroot/package.nix
@@ -11,19 +11,19 @@
 
 buildGoModule (finalAttrs: {
   pname = "coroot";
-  version = "1.26.8";
+  version = "1.27.0";
 
   src = fetchFromGitHub {
     owner = "coroot";
     repo = "coroot";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6vnJsj3PMRsC/Mal76tWcMVIf7EmvBQj4W0OzZSEUdc=";
+    hash = "sha256-06DvjcUnr36Ae7ivSlXPwdgjiXjbGwCOKvZIa+NtfA8=";
   };
 
   vendorHash = "sha256-QB5jz+ks9naRM7KvlxXUkMcTTtmy0SQXkfxGx/vh3W4=";
   npmDeps = fetchNpmDeps {
     src = "${finalAttrs.src}/front";
-    hash = "sha256-QFuEdsyQUmvFGXGBJyOd5UKJv7JEWQ24YM3BwTMUNGU=";
+    hash = "sha256-NrlZ4Lri43fkD7JclYlyLMKfRzNr2RIt4krGbZuJc68=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/du/dutctl/package.nix b/pkgs/by-name/du/dutctl/package.nix
index 6f4da80cd92b..26f0227d9678 100644
--- a/pkgs/by-name/du/dutctl/package.nix
+++ b/pkgs/by-name/du/dutctl/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "dutctl";
-  version = "1.0.0-alpha.3-unstable-2026-09-09";
+  version = "1.0.0-alpha.4-unstable-2026-09-29";
 
   src = fetchFromGitHub {
     owner = "BlindspotSoftware";
     repo = "dutctl";
-    rev = "231342b09d8314e4f92360f3e0ae3769ecb94e17";
-    hash = "sha256-orjt8xF34gSdXKdwVt5DdzyqoLxKQieCn7Blow2TA0Y=";
+    rev = "f2d2aec5ad1f54b4380ab2b1d8c3aa4d270fd5d5";
+    hash = "sha256-SbPOoaH0qOJMYEX73RxQuY0vwnMiw2Aez2BN3Eb0kr8=";
   };
 
-  vendorHash = "sha256-Hrye9URJ1WW1qQIDxSqgfvMzfhZMeQrffsoGbGU5HmY=";
+  vendorHash = "sha256-trdOZfYUbw11/OT168WYyYGkwXkosSnL8h8z3tN9um0=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/dw/dwarfs/package.nix b/pkgs/by-name/dw/dwarfs/package.nix
index 3882933f20e3..5e8758958e17 100644
--- a/pkgs/by-name/dw/dwarfs/package.nix
+++ b/pkgs/by-name/dw/dwarfs/package.nix
@@ -33,14 +33,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dwarfs";
-  version = "0.15.7";
+  version = "0.15.8";
 
   src = fetchFromGitHub {
     owner = "mhx";
     repo = "dwarfs";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-oC5Ki0Fc8c+PD39rRTzc2WErXkxEBZM+k9Ac5Xptats=";
+    hash = "sha256-dz7fIBcVBBzGs9IWJ5stmyxJvtWXU2zTxJX/Tm+A6Zk=";
   };
 
   cmakeFlags = [
diff --git a/pkgs/by-name/ej/ejson/package.nix b/pkgs/by-name/ej/ejson/package.nix
index c8c94d72a917..0d95290506e5 100644
--- a/pkgs/by-name/ej/ejson/package.nix
+++ b/pkgs/by-name/ej/ejson/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "ejson";
-  version = "1.5.5";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "Shopify";
     repo = "ejson";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-t0IjL+gB1bfHwS1eoMy/yKgayswECxpXyK8xq6iGMCg=";
+    sha256 = "sha256-Tkr/o2hjbUiaoTBPesQ+ZIPeJteS/rsqGJBo2dvfqEc=";
   };
 
   vendorHash = "sha256-vT9A4d+e+iOie5TNbu5EyPi5OZJ/m8Not3tCQc7Xwn8=";
diff --git a/pkgs/by-name/ek/eksctl/package.nix b/pkgs/by-name/ek/eksctl/package.nix
index 6aafffebedec..f534c279c038 100644
--- a/pkgs/by-name/ek/eksctl/package.nix
+++ b/pkgs/by-name/ek/eksctl/package.nix
@@ -4,6 +4,7 @@
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
+  versionCheckHook,
 }:
 
 buildGoModule (finalAttrs: {
@@ -30,7 +31,6 @@ buildGoModule (finalAttrs: {
 
   ldflags = [
     "-s"
-    "-w"
     "-X github.com/weaveworks/eksctl/pkg/version.gitCommit=${finalAttrs.src.rev}"
     "-X github.com/weaveworks/eksctl/pkg/version.buildDate=19700101-00:00:00"
   ];
@@ -44,6 +44,10 @@ buildGoModule (finalAttrs: {
       --zsh  <($out/bin/eksctl completion zsh)
   '';
 
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "version";
+  doInstallCheck = true;
+
   meta = {
     description = "CLI for Amazon EKS";
     homepage = "https://github.com/eksctl-io/eksctl";
diff --git a/pkgs/by-name/fa/fable/package.nix b/pkgs/by-name/fa/fable/package.nix
index 0eedba44c840..df4d3cf7ffc2 100644
--- a/pkgs/by-name/fa/fable/package.nix
+++ b/pkgs/by-name/fa/fable/package.nix
@@ -7,9 +7,9 @@
 
 buildDotnetGlobalTool (finalAttrs: {
   pname = "fable";
-  version = "5.17.2";
+  version = "5.18.0";
 
-  nugetHash = "sha256-XJB59cqLDsEtcyAvbbuhSkjkooFKiHiwp9jrKouPPtk=";
+  nugetHash = "sha256-zaa7UJnn5IM7fhGUBmogRUDe/2rpH79UR+k6dym7kmQ=";
 
   dotnet-sdk = dotnetCorePackages.sdk_10_0;
   dotnet-runtime = dotnetCorePackages.runtime_10_0;
diff --git a/pkgs/by-name/fi/fido2-manage/package.nix b/pkgs/by-name/fi/fido2-manage/package.nix
index 9cd1a5375c2a..8da3bb92d37e 100644
--- a/pkgs/by-name/fi/fido2-manage/package.nix
+++ b/pkgs/by-name/fi/fido2-manage/package.nix
@@ -71,8 +71,6 @@ stdenv.mkDerivation rec {
     libcouchbase
   ];
 
-  cmakeFlags = [ "-USE_PCSC=ON" ];
-
   postPatch = ''
     substituteInPlace ./src/libfido2.pc.in \
       --replace-fail "\''${prefix}/@CMAKE_INSTALL_LIBDIR@" "@CMAKE_INSTALL_FULL_LIBDIR@"
diff --git a/pkgs/by-name/fo/fosrl-newt/package.nix b/pkgs/by-name/fo/fosrl-newt/package.nix
index 9aa722a140ea..edd0317d2dc5 100644
--- a/pkgs/by-name/fo/fosrl-newt/package.nix
+++ b/pkgs/by-name/fo/fosrl-newt/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "newt";
-  version = "1.17.0";
+  version = "1.18.0";
 
   src = fetchFromGitHub {
     owner = "fosrl";
     repo = "newt";
     tag = finalAttrs.version;
-    hash = "sha256-lwDywGs1Wh5jl9xwEd7KvXqEkLw7gCas44SbHtKx8Ps=";
+    hash = "sha256-1ZS3KmEldOq2r+p4ayF852IS94/Wmkhqdw/Jx/W0Wcg=";
   };
 
   vendorHash = "sha256-VOXZWcPnBSc8EKYLKhsrQTHSjXvpaEYoewYLCxJ8Nk8=";
diff --git a/pkgs/by-name/fo/fosrl-olm/package.nix b/pkgs/by-name/fo/fosrl-olm/package.nix
index 9b878044e642..c50a3040218f 100644
--- a/pkgs/by-name/fo/fosrl-olm/package.nix
+++ b/pkgs/by-name/fo/fosrl-olm/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "olm";
-  version = "1.9.1";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "fosrl";
     repo = "olm";
     tag = finalAttrs.version;
-    hash = "sha256-LsT+Dt6Ozp447VtLKc/2MH9HGkfMwrOFIEp43DsNaXY=";
+    hash = "sha256-A3SpDzl/cW/4tCVFWrRpWoaLmBD8J3eniKf/p9ZX/g8=";
   };
 
-  vendorHash = "sha256-1lZoB27aedPGxsiZrKy0++QN1OobCXc69r3j+0XhCjM=";
+  vendorHash = "sha256-p4ClY6MT7JNGYI4qOdLBAGyyEAqW4DVlwRta+xSmd9E=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
 
diff --git a/pkgs/by-name/gh/ghr/package.nix b/pkgs/by-name/gh/ghr/package.nix
index c077e5e5e44e..7715806d054e 100644
--- a/pkgs/by-name/gh/ghr/package.nix
+++ b/pkgs/by-name/gh/ghr/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "ghr";
-  version = "0.18.4";
+  version = "0.18.5";
 
   src = fetchFromGitHub {
     owner = "tcnksm";
     repo = "ghr";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-zgRtu8RYyfBwSRs1nCOONyFLCRS6wCKqSLmqOLdJ9H0=";
+    sha256 = "sha256-uUVZ26GE73LKQ/s0I4VX60EC5dLGA5UotJw0ndpSv0k=";
   };
 
   vendorHash = "sha256-j5wa8rK4+gjjdJP7BlixDlztHdvSHzUeTuJKitQzc1M=";
diff --git a/pkgs/by-name/gi/gitlab-ci-local/package.nix b/pkgs/by-name/gi/gitlab-ci-local/package.nix
index 12cd2ddc199c..1643be053bbc 100644
--- a/pkgs/by-name/gi/gitlab-ci-local/package.nix
+++ b/pkgs/by-name/gi/gitlab-ci-local/package.nix
@@ -15,13 +15,13 @@
 
 let
   pname = "gitlab-ci-local";
-  version = "4.75.1";
+  version = "4.76.0";
 
   src = fetchFromGitHub {
     owner = "firecow";
     repo = "gitlab-ci-local";
     rev = version;
-    hash = "sha256-2zCfLLOtFTsiW1TGujOa9JGOetlVTzY477pUa2wt2qw=";
+    hash = "sha256-K03nw+8SNnqm4ouOIa3ejUmcsUdVzdGn2jMZY5bKVOI=";
   };
 
   node_modules = stdenv.mkDerivation {
@@ -57,7 +57,7 @@ let
       runHook postInstall
     '';
 
-    outputHash = "sha256-AqO7FeCtd5INzASBjMgSXYI1WPjqtk3Uipd5TjocYX4=";
+    outputHash = "sha256-yx1ev37/78bjaNcA1/tSxKEn2cHx0CexZByL16AAUvw=";
 
     outputHashAlgo = "sha256";
     outputHashMode = "recursive";
diff --git a/pkgs/by-name/go/goflow2/package.nix b/pkgs/by-name/go/goflow2/package.nix
index b720a9f48de6..12b3a20c1b22 100644
--- a/pkgs/by-name/go/goflow2/package.nix
+++ b/pkgs/by-name/go/goflow2/package.nix
@@ -4,7 +4,7 @@
   fetchFromGitHub,
 }:
 let
-  version = "2.2.6";
+  version = "2.2.7";
 in
 buildGoModule {
   pname = "goflow2";
@@ -14,7 +14,7 @@ buildGoModule {
     owner = "netsampler";
     repo = "goflow2";
     rev = "v${version}";
-    hash = "sha256-PGXBsUDooYEq5RuLRwmTMOxYuXCxhfAo9Ef/75TWPc0=";
+    hash = "sha256-a8o9d8L4qkavCQang6Ukm5ColFAEn1DXow0BWoUJXms=";
   };
 
   ldflags = [
diff --git a/pkgs/by-name/go/gotestwaf/package.nix b/pkgs/by-name/go/gotestwaf/package.nix
index 0e583c1c3718..b0494ed810d6 100644
--- a/pkgs/by-name/go/gotestwaf/package.nix
+++ b/pkgs/by-name/go/gotestwaf/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "gotestwaf";
-  version = "0.5.9";
+  version = "0.5.10";
 
   src = fetchFromGitHub {
     owner = "wallarm";
     repo = "gotestwaf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KQG47T1wd6uaJgm15vRqx1HB1jVNVIEZI90eHMlXMlg=";
+    hash = "sha256-KF9fg60iPkIIrk6WI1jdxcebUc0SO2vBWkAY8nGX6rs=";
   };
 
   vendorHash = "sha256-tGpgQ1c5mdstq5LX5egmm/ntmjuq2R6eWphsxV5q2b8=";
diff --git a/pkgs/by-name/ja/jay/package.nix b/pkgs/by-name/ja/jay/package.nix
index e30691a57fbb..41a6b3365afc 100644
--- a/pkgs/by-name/ja/jay/package.nix
+++ b/pkgs/by-name/ja/jay/package.nix
@@ -53,12 +53,13 @@ rustPlatform.buildRustPackage (finalAttrs: {
   ];
 
   checkFlags = [
-    # these 5 tests fail in the lix sandbox because they rely on io_uring
+    # these tests fail in the lix sandbox because they rely on io_uring
     "--skip=cpu_worker::tests::cancel"
     "--skip=cpu_worker::tests::complete"
     "--skip=eventfd_cache::tests::test"
-    "--skip=io_uring::ops::read_write_no_cancel::tests::cancel_in_kernel"
-    "--skip=io_uring::ops::read_write_no_cancel::tests::cancel_in_userspace"
+    "--skip=io_uring::"
+    "--skip=utils::client_trace::"
+    "--skip=utils::cross_process_ring_buffer::"
   ];
 
   postInstall = ''
diff --git a/pkgs/by-name/ki/kitops/package.nix b/pkgs/by-name/ki/kitops/package.nix
index b278e420f683..79461b6f11d8 100644
--- a/pkgs/by-name/ki/kitops/package.nix
+++ b/pkgs/by-name/ki/kitops/package.nix
@@ -8,16 +8,16 @@
 buildGoModule (finalAttrs: {
   __structuredAttrs = true;
   pname = "kitops";
-  version = "1.15.0";
+  version = "1.16.0";
 
   src = fetchFromGitHub {
     owner = "kitops-ml";
     repo = "kitops";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ySn91TIkWOd3myjcscmcN0jhbjp0mAYm9R2nG0bnTVo=";
+    hash = "sha256-YunOq5loW+fmfWKPHZDWIpsQjrMJRs66zF1+w0iJz9I=";
   };
 
-  vendorHash = "sha256-lT1xSuwEZMVjy18pQSuqybfgULyagJX4hCWUYdNrQ8M=";
+  vendorHash = "sha256-zSAB58nR7cFbYzFHoaq4CJdzmHbxLtyGSpQ8U/Pjcn8=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/li/libretroPackages/cores/nestopia.nix b/pkgs/by-name/li/libretroPackages/cores/nestopia.nix
index 65a0bfb67259..8cf2da22b91b 100644
--- a/pkgs/by-name/li/libretroPackages/cores/nestopia.nix
+++ b/pkgs/by-name/li/libretroPackages/cores/nestopia.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "nestopia";
-  version = "0-unstable-2026-09-18";
+  version = "0-unstable-2026-09-25";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "nestopia";
-    rev = "92578fdc9445f61dd376138329a938e01d8ba50e";
-    hash = "sha256-PBBSAz6hMioHZTOeAspoxjf7Cz/bcr3ppEYqkGcIlz4=";
+    rev = "8f00f500912a847062de432e38765c7285483e62";
+    hash = "sha256-xUOH7Dbm1BW+sCUFOCP6lJnWYi9dMlCRHbYU1ngvYkM=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/by-name/ly/lycheeslicer/package.nix b/pkgs/by-name/ly/lycheeslicer/package.nix
index a4dd7bc86188..4e1ffac76ba4 100644
--- a/pkgs/by-name/ly/lycheeslicer/package.nix
+++ b/pkgs/by-name/ly/lycheeslicer/package.nix
@@ -22,7 +22,7 @@ let
     comment = "All-in-one 3D slicer for Resin and Filament";
     desktopName = "LycheeSlicer";
     noDisplay = false;
-    exec = "lycheeslicer";
+    exec = "lycheeslicer %U";
     terminal = false;
     mimeTypes = [
       "model/stl"
diff --git a/pkgs/by-name/nw/nwg-look/package.nix b/pkgs/by-name/nw/nwg-look/package.nix
index 70a2a01ead6e..a934c7555333 100644
--- a/pkgs/by-name/nw/nwg-look/package.nix
+++ b/pkgs/by-name/nw/nwg-look/package.nix
@@ -14,16 +14,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "nwg-look";
-  version = "1.1.1";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = "nwg-look";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-YAFZZIUd/nvDwa3dXBoBL+dmPOVgJKv/taOjLMP4owI=";
+    hash = "sha256-a/e1IjkNVtPBNZyXFYWwwe0Zl8eUDPts+oRKapTu328=";
   };
 
-  vendorHash = "sha256-9jyR7RLpqdDvwgqlrvToKQlClRbk9ELxapbgb/OUB4I=";
+  vendorHash = "sha256-cJTs/tlyF7bcRdkVSepcIQiVJLdZy47GzEi17mSQDmw=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ow/owocr/package.nix b/pkgs/by-name/ow/owocr/package.nix
index fed2260b6573..3f976a578e98 100644
--- a/pkgs/by-name/ow/owocr/package.nix
+++ b/pkgs/by-name/ow/owocr/package.nix
@@ -64,7 +64,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     description = "Optical character recognition for Japanese text";
     homepage = "https://github.com/AuroraWright/owocr";
     changelog = "https://github.com/AuroraWright/owocr/releases/tag/${finalAttrs.src.tag}";
-    license = lib.licenses.asl20;
+    license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ sigmanificient ];
     mainProgram = "owocr";
   };
diff --git a/pkgs/by-name/pa/parla/package.nix b/pkgs/by-name/pa/parla/package.nix
index a21d31f32ba5..cbbf2efeb413 100644
--- a/pkgs/by-name/pa/parla/package.nix
+++ b/pkgs/by-name/pa/parla/package.nix
@@ -12,11 +12,14 @@
   pkg-config,
   stdenv,
   vala,
+  gst_all_1,
+  webkitgtk_6_0,
+  wrapGAppsHook4,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "parla";
-  version = "0.8.2";
+  version = "0.9.8";
   __structuredAttrs = true;
   strictDeps = true;
 
@@ -24,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "trufae";
     repo = "parla";
     tag = finalAttrs.version;
-    hash = "sha256-BdmIbqYG5Ht4gH300j/BVPx+TKCxce/DippezOVa0m0=";
+    hash = "sha256-7A77iywQfi+C1s6gZhrYPyHykUSOEd/bDGHjDT+vEvA=";
   };
 
   nativeBuildInputs = [
@@ -32,6 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
     ninja
     pkg-config
     vala
+    wrapGAppsHook4
   ];
 
   mesonFlags = [
@@ -43,7 +47,14 @@ stdenv.mkDerivation (finalAttrs: {
     gtk4
     json-glib
     libadwaita
-  ];
+    webkitgtk_6_0
+  ]
+  ++ (with gst_all_1; [
+    gstreamer
+    gst-plugins-base
+    gst-plugins-good
+    gst-plugins-bad
+  ]);
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/pr/pretix/package.nix b/pkgs/by-name/pr/pretix/package.nix
index 7236a8150c30..75f87f9ffc0a 100644
--- a/pkgs/by-name/pr/pretix/package.nix
+++ b/pkgs/by-name/pr/pretix/package.nix
@@ -56,14 +56,14 @@ let
 in
 pythonPackages.buildPythonApplication (finalAttrs: {
   pname = "pretix";
-  version = "2026.7.2";
+  version = "2026.8.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pretix";
     repo = "pretix";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3qQE85O678Gkv3By3bCqwgHLIEi5oEAelS0erv/i2P4=";
+    hash = "sha256-6/9Q8IxLdKb7p3LJUe+blLhETE0tI7zLUFdgrphieGo=";
   };
 
   patches = [
@@ -93,7 +93,7 @@ pythonPackages.buildPythonApplication (finalAttrs: {
 
   npmDeps = fetchNpmDeps {
     inherit (finalAttrs) src;
-    hash = "sha256-3sF6TmzDBu3UJASNaPL6zkJNRCHZIHzFTjJWmfkMeAo=";
+    hash = "sha256-iHtQrZLqjz9RbcIAhFrY+mrIe5pqzE9vCOH0u7cC4MU=";
   };
 
   nativeBuildInputs = [
@@ -260,6 +260,7 @@ pythonPackages.buildPythonApplication (finalAttrs: {
     with pythonPackages;
     [
       libredirect.hook
+      pypdfium2
       pytestCheckHook
       pytest-xdist
       pytest-mock
diff --git a/pkgs/by-name/pr/pretix/plugins/fontpack-free/package.nix b/pkgs/by-name/pr/pretix/plugins/fontpack-free/package.nix
index 2c4b91cc706f..5e445d42015b 100644
--- a/pkgs/by-name/pr/pretix/plugins/fontpack-free/package.nix
+++ b/pkgs/by-name/pr/pretix/plugins/fontpack-free/package.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pretix-fontpack-free";
-  version = "1.11.1";
+  version = "1.11.2";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -16,7 +16,7 @@ buildPythonPackage (finalAttrs: {
     owner = "pretix";
     repo = "pretix-fontpack-free";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-eeU8awLf/PSsLuAOobZhXVyQ3KM7jOEIz1ZLt4eDxzQ=";
+    hash = "sha256-FXMzD1r5xegz10JbeXJDLy9oxUhAIjYknZz/y2Og4Dw=";
   };
 
   build-system = [
diff --git a/pkgs/by-name/pr/pretix/plugins/mollie/package.nix b/pkgs/by-name/pr/pretix/plugins/mollie/package.nix
index 156b243a660a..3065606255db 100644
--- a/pkgs/by-name/pr/pretix/plugins/mollie/package.nix
+++ b/pkgs/by-name/pr/pretix/plugins/mollie/package.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pretix-mollie";
-  version = "2.5.8";
+  version = "2.5.9";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pretix";
     repo = "pretix-mollie";
     tag = "v${version}";
-    hash = "sha256-92nlq5EGI/AQ5RxDK1go/p4ZMtTDtzTFlWXsnVPvsg0=";
+    hash = "sha256-Ao5FndMfIN4lky0UwKMngA0EMggsWQW7DkFx8rNix1Q=";
   };
 
   build-system = [
diff --git a/pkgs/by-name/pr/pretix/plugins/sepadebit/package.nix b/pkgs/by-name/pr/pretix/plugins/sepadebit/package.nix
index d144f137a7d3..59b91a075a91 100644
--- a/pkgs/by-name/pr/pretix/plugins/sepadebit/package.nix
+++ b/pkgs/by-name/pr/pretix/plugins/sepadebit/package.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "pretix-sepadebit";
-  version = "2.7.0";
+  version = "2.7.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pretix";
     repo = "pretix-sepadebit";
     tag = "v${version}";
-    hash = "sha256-Xnp7aic+Xf4wJzJbWqhsfMajT4AOQGQMIGIewJ5B37o=";
+    hash = "sha256-CHhen9rtg3tu0UtlbXzee714fVc5tU4Y1rDqdMlzPYY=";
   };
 
   build-system = [
diff --git a/pkgs/by-name/pr/pretix/plugins/zugferd/package.nix b/pkgs/by-name/pr/pretix/plugins/zugferd/package.nix
index 50d4dc179d88..5712895131d3 100644
--- a/pkgs/by-name/pr/pretix/plugins/zugferd/package.nix
+++ b/pkgs/by-name/pr/pretix/plugins/zugferd/package.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "pretix-zugferd";
-  version = "2.6.3";
+  version = "2.6.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pretix";
     repo = "pretix-zugferd";
     rev = "v${version}";
-    hash = "sha256-HE3L5VS0n1NL/jprcnMwaNriFKIN1pogPM2cDw2ZPdk=";
+    hash = "sha256-qNCyI7sqHC+eqeSLeeyLUIoI/JOmv/i4tsacMzceKa0=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/qo/qoi/package.nix b/pkgs/by-name/qo/qoi/package.nix
index 0d5f73e68041..ec5c1405ad5e 100644
--- a/pkgs/by-name/qo/qoi/package.nix
+++ b/pkgs/by-name/qo/qoi/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "qoi";
-  version = "0-unstable-2026-05-29"; # no upstream version yet.
+  version = "0-unstable-2026-09-27"; # no upstream version yet.
 
   src = fetchFromGitHub {
     owner = "phoboslab";
     repo = "qoi";
-    rev = "97bacc86a9c4abf5a2d452102dc26546c4c670b9";
-    hash = "sha256-9R43rWfpB2J6TXHoTt0u0LLiTY9XYmmph+pb7Y6aU84=";
+    rev = "ffb2d2cb74a1de60819b21b939f7209aa53e91c1";
+    hash = "sha256-iA5ohbiafJxqRuMrJ/JfcDOOzcI3HstfK1W8HRpJKIw=";
   };
 
   patches = [
diff --git a/pkgs/by-name/ri/ristate/package.nix b/pkgs/by-name/ri/ristate/package.nix
index ad948e4a787c..8a15be457f16 100644
--- a/pkgs/by-name/ri/ristate/package.nix
+++ b/pkgs/by-name/ri/ristate/package.nix
@@ -3,6 +3,7 @@
   rustPlatform,
   fetchFromGitLab,
   nix-update-script,
+  stdenv, # for meta.broken
 }:
 
 rustPlatform.buildRustPackage {
@@ -26,5 +27,7 @@ rustPlatform.buildRustPackage {
     license = lib.licenses.mit;
     maintainers = [ ];
     mainProgram = "ristate";
+    # last successful hydra build on darwin was in 2025
+    broken = stdenv.hostPlatform.isDarwin;
   };
 }
diff --git a/pkgs/by-name/ro/rocksdb/package.nix b/pkgs/by-name/ro/rocksdb/package.nix
index 0162fa8da010..1a762263ab49 100644
--- a/pkgs/by-name/ro/rocksdb/package.nix
+++ b/pkgs/by-name/ro/rocksdb/package.nix
@@ -127,7 +127,12 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://rocksdb.org";
     description = "Library that provides an embeddable, persistent key-value store for fast storage";
     changelog = "https://github.com/facebook/rocksdb/raw/v${finalAttrs.version}/HISTORY.md";
-    license = lib.licenses.asl20;
+    license =
+      with lib.licenses;
+      OR [
+        gpl2Plus
+        asl20
+      ];
     platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [
       adev
diff --git a/pkgs/by-name/rs/rsop/package.nix b/pkgs/by-name/rs/rsop/package.nix
index e8954bdf26cb..8ec440887b54 100644
--- a/pkgs/by-name/rs/rsop/package.nix
+++ b/pkgs/by-name/rs/rsop/package.nix
@@ -7,6 +7,7 @@
   nix-update-script,
   testers,
   rsop,
+  stdenv, # for meta.broken
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -44,5 +45,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     ];
     maintainers = with lib.maintainers; [ nikstur ];
     mainProgram = "rsop";
+    # last successful hydra build on darwin was in 2025
+    broken = stdenv.hostPlatform.isDarwin;
   };
 })
diff --git a/pkgs/by-name/se/servo/package.nix b/pkgs/by-name/se/servo/package.nix
index 67cd8eae20af..1f2b79ea74b1 100644
--- a/pkgs/by-name/se/servo/package.nix
+++ b/pkgs/by-name/se/servo/package.nix
@@ -69,13 +69,13 @@ in
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "servo";
-  version = "0.5.0";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "servo";
     repo = "servo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cJtmh/gzwno1gIqHPFgDsynGi//BvV9UyevuAbllRtg=";
+    hash = "sha256-inhpSzLQExTD5VT7hCzoycYMa2U4oZv8fz7NhZAlP2I=";
     # Breaks reproducibility depending on whether the picked commit
     # has other ref-names or not, which may change over time, i.e. with
     # "ref-names: HEAD -> main" as long this commit is the branch HEAD
@@ -85,7 +85,23 @@ rustPlatform.buildRustPackage (finalAttrs: {
     '';
   };
 
-  cargoHash = "sha256-zZeHqxBvs5M0/TO/ifM1m5F0mSdT4cTJzoW2ja1+s28=";
+  cargoHash = "sha256-hjea0ze+GO3i+x1HZxSpWfXc57kvVVjmTWl2ytQYxco=";
+
+  postPatch = ''
+    # The mozjs crates all use cbindgen with `cargo metadata` invocations,
+    # which looks up the nearest cargo config.
+    # In our case, that's $cargoDepsCopy/.cargo/config.toml, which is the
+    # template of the config cargo-setup-hook creates in the build directory.
+    # The easiest workaround is to copy the final config back into $cargoDepsCopy,
+    # so `cargo metadata` invoked inside the mozjs crates finds the correct vendor path.
+    cp .cargo/config.toml $cargoDepsCopy/.cargo/config.toml
+    # We also need to make sure that `cargo metadata` knows what versions each of the
+    # mozjs crates' dependencies resolve to in our dependency cache, which can be achieved
+    # by copying our lockfile into the mozjs crate directories.
+    for mozjs_dir in $cargoDepsCopy/*/mozjs_*/; do
+      cp Cargo.lock $mozjs_dir
+    done
+  '';
 
   # set `HOME` to a temp dir for write access
   # Fix invalid option errors during linking (https://github.com/mozilla/nixpkgs-mozilla/commit/c72ff151a3e25f14182569679ed4cd22ef352328)
@@ -137,11 +153,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     vulkan-loader
   ];
 
-  # Builds with additional features for aarch64, see https://github.com/servo/servo/issues/36819
-  buildFeatures = lib.optionals stdenv.hostPlatform.isAarch64 [
-    "servo-allocator/use-system-allocator"
-  ];
-
   env.NIX_CFLAGS_COMPILE = toString (
     [
       # mozjs-sys fails with:
@@ -176,7 +187,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     homepage = "https://servo.org";
     license = lib.licenses.mpl20;
     maintainers = with lib.maintainers; [
-      hexa
+      niklaskorz
     ];
     teams = with lib.teams; [ ngi ];
     mainProgram = "servoshell";
diff --git a/pkgs/by-name/sh/shards/package.nix b/pkgs/by-name/sh/shards/package.nix
index 53b7a1b54c7f..73d5352cf72d 100644
--- a/pkgs/by-name/sh/shards/package.nix
+++ b/pkgs/by-name/sh/shards/package.nix
@@ -27,7 +27,10 @@ crystal.buildCrystalPackage rec {
     description = "Dependency manager for the Crystal language";
     mainProgram = "shards";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ peterhoeg ];
+    maintainers = with lib.maintainers; [
+      peterhoeg
+      Fijxu
+    ];
     inherit (crystal.meta) homepage platforms;
   };
 }
diff --git a/pkgs/by-name/sh/shopify-cli/package.nix b/pkgs/by-name/sh/shopify-cli/package.nix
index 56a6e6427a72..50fc3e1aef07 100644
--- a/pkgs/by-name/sh/shopify-cli/package.nix
+++ b/pkgs/by-name/sh/shopify-cli/package.nix
@@ -19,13 +19,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "shopify";
-  version = "4.8.0";
+  version = "4.8.3";
 
   src = fetchFromGitHub {
     owner = "shopify";
     repo = "cli";
     tag = finalAttrs.version;
-    hash = "sha256-I/VkGxyvlJpUHumxhkTFyj8owa7DVKdlK/aj8shDb7w=";
+    hash = "sha256-y3HAuoXHmC9tX+PK7JMS0c4PpwhRVvxFnTIgobInTfE=";
   };
 
   pnpmDeps = fetchPnpmDeps {
diff --git a/pkgs/by-name/sn/snpeff/package.nix b/pkgs/by-name/sn/snpeff/package.nix
index 77c25fd8008e..56d8c56ea04f 100644
--- a/pkgs/by-name/sn/snpeff/package.nix
+++ b/pkgs/by-name/sn/snpeff/package.nix
@@ -45,6 +45,8 @@ stdenv.mkDerivation (finalAttrs: {
     sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
     maintainers = with lib.maintainers; [ jbedo ];
     platforms = lib.platforms.all;
+    # last successful hydra build on darwin was in 2025
+    broken = stdenv.hostPlatform.isDarwin;
   };
 
 })
diff --git a/pkgs/by-name/ta/taktuk/package.nix b/pkgs/by-name/ta/taktuk/package.nix
index 32cd20582323..94e9eb2233ad 100644
--- a/pkgs/by-name/ta/taktuk/package.nix
+++ b/pkgs/by-name/ta/taktuk/package.nix
@@ -7,8 +7,8 @@
   buildPackages,
 }:
 
-stdenv.mkDerivation {
-  version = "3.7.7";
+stdenv.mkDerivation (finalAttrs: {
+  version = "3.7.8";
   pname = "taktuk";
 
   nativeBuildInputs = [
@@ -22,8 +22,8 @@ stdenv.mkDerivation {
     domain = "gitlab.inria.fr";
     owner = "taktuk";
     repo = "taktuk";
-    rev = "dcd763e389a414f540b43674cbc63752176f1ce3"; # does not tag releases
-    hash = "sha256-CerOBn1VDiKFLaW2WXv6wLxfcqy1H3dlF70lrequbog=";
+    tag = "version-${finalAttrs.version}";
+    hash = "sha256-/Xr2Jl3WbL68ZunBpko7jLbgAbDkERnrtuJnS0m59qY=";
   };
 
   preBuild = ''
@@ -53,4 +53,4 @@ stdenv.mkDerivation {
     maintainers = [ lib.maintainers.bzizou ];
     platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/by-name/ta/task-master-ai/package.nix b/pkgs/by-name/ta/task-master-ai/package.nix
index 44f2e3b52847..4f9f46fa8bc9 100644
--- a/pkgs/by-name/ta/task-master-ai/package.nix
+++ b/pkgs/by-name/ta/task-master-ai/package.nix
@@ -5,6 +5,7 @@
   nodejs,
   nix-update-script,
   versionCheckHook,
+  stdenv, # for meta.broken
 }:
 buildNpmPackage (finalAttrs: {
   pname = "task-master-ai";
@@ -49,5 +50,7 @@ buildNpmPackage (finalAttrs: {
     mainProgram = "task-master-ai";
     maintainers = [ lib.maintainers.repparw ];
     platforms = lib.platforms.all;
+    # last successful hydra build on darwin was in 2025
+    broken = stdenv.hostPlatform.isDarwin;
   };
 })
diff --git a/pkgs/by-name/te/tea-dash/package.nix b/pkgs/by-name/te/tea-dash/package.nix
index 47e0984b7328..d91d1645ca92 100644
--- a/pkgs/by-name/te/tea-dash/package.nix
+++ b/pkgs/by-name/te/tea-dash/package.nix
@@ -9,17 +9,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "tea-dash";
-  version = "0.3.8";
+  version = "0.3.9";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "gbarany";
     repo = "tea-dash";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0MUzkbQzyp1TRZaHnCmIR+1MjBzmqBndaBmVTBMCPGI=";
+    hash = "sha256-g7dQ3WPL1GUzrN/uqWNT0Ud8RE8rkremYQN/5OzWBaQ=";
   };
 
-  vendorHash = "sha256-CNty+TgwujfTguhwIXurtz2ILBnGYonVjgrJOtXO644=";
+  vendorHash = "sha256-gvjy23OFXQoqNAlDgKurEgV/F60wvboPuCK9Wq6wjiU=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/te/term39/package.nix b/pkgs/by-name/te/term39/package.nix
index 11844b144293..2b855db21428 100644
--- a/pkgs/by-name/te/term39/package.nix
+++ b/pkgs/by-name/te/term39/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   rustPlatform,
   fetchFromGitHub,
   pkg-config,
@@ -8,33 +9,44 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "term39";
-  version = "1.5.1";
+  version = "1.6.0";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "alejandroqh";
     repo = "term39";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-IFJXBTjGedDl+FY7HDE5p+jYqA3c5EHHxQfn8hPY/es=";
+    hash = "sha256-LyrlbxiFBpnCkzOtgASX1WKrJ1BajaXdOsJJEO9Cq18=";
   };
 
-  cargoHash = "sha256-RguJr5xtuLcn4OO/8hmg06AmUT6WPzGtCpB0J+xw8+I=";
+  cargoHash = "sha256-TSSUetkXACBLxou5CXsmpGLKuY9fEFYGbGmhBcm9JQY=";
 
   nativeBuildInputs = [
     pkg-config
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    # pam-sys (lockscreen) generates its bindings with bindgen; Linux only
     rustPlatform.bindgenHook
   ];
 
-  buildInputs = [
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
     pam
   ];
 
+  checkFlags = lib.optionals stdenv.hostPlatform.isDarwin [
+    # Reads the USER environment variable, which is unset in the sandbox
+    "--skip=lockscreen::auth::macos_auth::tests::test_get_username"
+    # Checks for /usr/bin/dscl, which is not visible in the sandbox
+    "--skip=lockscreen::auth::macos_auth::tests::test_macos_available"
+  ];
+
   meta = {
     description = "Modern, retro-styled terminal multiplexer with a classic MS-DOS aesthetic";
     homepage = "https://github.com/alejandroqh/term39";
+    changelog = "https://github.com/alejandroqh/term39/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ alejandroqh ];
     mainProgram = "term39";
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
   };
 })
diff --git a/pkgs/by-name/ti/time-decode/package.nix b/pkgs/by-name/ti/time-decode/package.nix
index 5b821396eb3a..2adfe3474382 100644
--- a/pkgs/by-name/ti/time-decode/package.nix
+++ b/pkgs/by-name/ti/time-decode/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "time-decode";
-  version = "10.4.0";
+  version = "10.4.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "digitalsleuth";
     repo = "time_decode";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-MZ876fQ1Si3P+OOaO7G3uQY7WGcTQMryig5rM4nvGrc=";
+    hash = "sha256-icSMwPtJShFtzbzo0HaMaaq8yUdzJsuwJc3sHAzhsf4=";
   };
 
   build-system = with python3.pkgs; [ setuptools ];
diff --git a/pkgs/by-name/to/tor/package.nix b/pkgs/by-name/to/tor/package.nix
index 1c62636bbfff..3576369e75af 100644
--- a/pkgs/by-name/to/tor/package.nix
+++ b/pkgs/by-name/to/tor/package.nix
@@ -103,6 +103,9 @@ stdenv.mkDerivation (finalAttrs: {
   # https://gitlab.torproject.org/tpo/core/tor/-/issues/40912
   doCheck = !(stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch32);
 
+  # some tests (e.g. util/socketpair_ersatz) fail in the darwin sandbox otherwise.
+  __darwinAllowLocalNetworking = true;
+
   postInstall = ''
     mkdir -p $geoip/share/tor
     mv $out/share/tor/geoip{,6} $geoip/share/tor
diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index a4636c939505..2b626ef3801e 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -1205,9 +1205,9 @@
   };
 
   haskell = {
-    version = "0.23.1";
+    version = "0.24.1";
     url = "github:tree-sitter/tree-sitter-haskell";
-    hash = "sha256-bggXKbV4vTWapQAbERPUszxpQtpC1RTujNhwgbjY7T4=";
+    hash = "sha256-R4KAAaBoDUGuQtR2U+0xdB9iLclWBrm+/blqsCX5ZjQ=";
     meta = {
       license = lib.licenses.mit;
     };
diff --git a/pkgs/by-name/tt/ttchat/package.nix b/pkgs/by-name/tt/ttchat/package.nix
index 6381f73f6ce9..5c5a58dff703 100644
--- a/pkgs/by-name/tt/ttchat/package.nix
+++ b/pkgs/by-name/tt/ttchat/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "ttchat";
-  version = "0.1.10";
+  version = "0.1.11";
 
   src = fetchFromGitHub {
     owner = "atye";
     repo = "ttchat";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Ezlqji/j6nyCzc1jrfB1MZR4ugKAa5D5CL6wfuP6PsY=";
+    hash = "sha256-JQprOoC/+FlKOBlBAjKTU7vwNSIz6bE4euw7fHxbIAU=";
   };
 
-  vendorHash = "sha256-6GcbEGC1O+lcTO+GsaVXOO69yIHMPywXJy7OFX15/eI=";
+  vendorHash = "sha256-0/VmQahglmGgdmCR/iRMM3S0cSMt4LLgN1zU9/IWZDA=";
 
   meta = {
     description = "Connect to a Twitch channel's chat from your terminal";
diff --git a/pkgs/by-name/tu/tun2proxy/package.nix b/pkgs/by-name/tu/tun2proxy/package.nix
index ebeccf17580a..df81e4310ef8 100644
--- a/pkgs/by-name/tu/tun2proxy/package.nix
+++ b/pkgs/by-name/tu/tun2proxy/package.nix
@@ -8,15 +8,15 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tun2proxy";
-  version = "0.8.3";
+  version = "0.8.4";
 
   src = fetchCrate {
     pname = "tun2proxy";
     inherit (finalAttrs) version;
-    hash = "sha256-TuO7mYK58V4Wedk+jVtrvXXPQ0s8u9vABk3hmrBRm6I=";
+    hash = "sha256-NlmVgE4gQm/CZa92/UBD+kOrKCnYNalsGpGIMx0hcQM=";
   };
 
-  cargoHash = "sha256-MJYaNxG8vPpdMCPVRDdZM8juyuOxlLOn6wEDjK6QIJ0=";
+  cargoHash = "sha256-tbp67p3sqdg+qDmVTWIsPsd+igvLJnNb8WCyupFEikg=";
 
   env.GIT_HASH = "000000000000000000000000000000000000000000000000000";
 
diff --git a/pkgs/by-name/uc/ucode/package.nix b/pkgs/by-name/uc/ucode/package.nix
index ed014133c91d..f0300d937b25 100644
--- a/pkgs/by-name/uc/ucode/package.nix
+++ b/pkgs/by-name/uc/ucode/package.nix
@@ -50,5 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.isc;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ mkg20001 ];
+    # last successful hydra build on darwin was in 2025
+    broken = stdenv.hostPlatform.isDarwin;
   };
 })
diff --git a/pkgs/by-name/un/unshieldv3/package.nix b/pkgs/by-name/un/unshieldv3/package.nix
index d16290f29a20..14c1b9da81e4 100644
--- a/pkgs/by-name/un/unshieldv3/package.nix
+++ b/pkgs/by-name/un/unshieldv3/package.nix
@@ -37,5 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
     mainProgram = "unshieldv3";
     maintainers = [ lib.maintainers.jchw ];
+    # last successful hydra build on darwin was in 2025
+    broken = stdenv.hostPlatform.isDarwin;
   };
 })
diff --git a/pkgs/by-name/vc/vcdimager/package.nix b/pkgs/by-name/vc/vcdimager/package.nix
index 98f1cbf88f83..8bcc98e7f3f2 100644
--- a/pkgs/by-name/vc/vcdimager/package.nix
+++ b/pkgs/by-name/vc/vcdimager/package.nix
@@ -42,5 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Full-featured mastering suite for authoring, disassembling and analyzing Video CDs and Super Video CDs";
     platforms = lib.platforms.unix;
     license = lib.licenses.gpl2;
+    # last successful hydra build on darwin was in 2025
+    broken = stdenv.hostPlatform.isDarwin;
   };
 })
diff --git a/pkgs/by-name/vi/vixl/package.nix b/pkgs/by-name/vi/vixl/package.nix
index e91479f9c45e..1b009f511aba 100644
--- a/pkgs/by-name/vi/vixl/package.nix
+++ b/pkgs/by-name/vi/vixl/package.nix
@@ -39,5 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.bsd3;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ onny ];
+    # last successful hydra build on darwin was in 2025
+    broken = stdenv.hostPlatform.isDarwin;
   };
 })
diff --git a/pkgs/by-name/vu/vunnel/package.nix b/pkgs/by-name/vu/vunnel/package.nix
index f33309884a0c..06bcca512525 100644
--- a/pkgs/by-name/vu/vunnel/package.nix
+++ b/pkgs/by-name/vu/vunnel/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "vunnel";
-  version = "0.63.1";
+  version = "0.64.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = "vunnel";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HdMpJRFwTK5iiIuAogoDD7V5lbdMkMx1jYmmIKNb9iE=";
+    hash = "sha256-D5AUtTXzizUIjR/nMjyb2VC26ZcsrUTwHJ5KE7SM5Cw=";
     leaveDotGit = true;
   };
 
@@ -77,12 +77,10 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
   disabledTests = [
     # Compare output
     "test_status"
-    # TypeError
-    "test_parser"
-    # Test require network access
-    "test_rhel_provider_supports_ignore_hydra_errors"
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   meta = {
     description = "Tool for collecting vulnerability data from various sources";
     homepage = "https://github.com/anchore/vunnel";
diff --git a/pkgs/by-name/we/webdav/package.nix b/pkgs/by-name/we/webdav/package.nix
index 4f57a27bbeaa..59f5294ced2a 100644
--- a/pkgs/by-name/we/webdav/package.nix
+++ b/pkgs/by-name/we/webdav/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "webdav";
-  version = "5.16.0";
+  version = "5.16.1";
 
   src = fetchFromGitHub {
     owner = "hacdias";
     repo = "webdav";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cqjHh+eHBH1F715xfnDK3FEPaRDVP3+g7/w98rhzing=";
+    hash = "sha256-YVOg5AlK/Z92ef/P2ATRnJzeYGJsEWbL82Kr+eDvbxU=";
   };
 
-  vendorHash = "sha256-nS4RFmiMdHxGW1kStVTzMLRZ21q9IMaxHOF1HQ6jYQA=";
+  vendorHash = "sha256-YsqShEnOmK46UbNMV0MloKmCFX/1qlk+BWCdDQapv2Y=";
 
   __darwinAllowLocalNetworking = true;
 
diff --git a/pkgs/by-name/wi/wireplumber/package.nix b/pkgs/by-name/wi/wireplumber/package.nix
index 1809bdb7d1c4..9ec266988f5f 100644
--- a/pkgs/by-name/wi/wireplumber/package.nix
+++ b/pkgs/by-name/wi/wireplumber/package.nix
@@ -25,7 +25,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wireplumber";
-  version = "0.5.17";
+  version = "0.5.18";
 
   outputs = [
     "out"
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "pipewire";
     repo = "wireplumber";
     tag = finalAttrs.version;
-    hash = "sha256-BlAHB656Bl1hhB80R6EuhdFvx5R3kOLFZmo32idPFYE=";
+    hash = "sha256-VIa11ynYJsr4zqZ7XogPin4Ks0oEDltCjo51aWVMH8c=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/wo/wownero/package.nix b/pkgs/by-name/wo/wownero/package.nix
index 325a794cfe0e..1091140a44a9 100644
--- a/pkgs/by-name/wo/wownero/package.nix
+++ b/pkgs/by-name/wo/wownero/package.nix
@@ -108,5 +108,7 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.bsd3;
     maintainers = [ ];
     platforms = lib.platforms.unix;
+    # last successful hydra build on darwin was in 2025
+    broken = stdenv.hostPlatform.isDarwin;
   };
 })
diff --git a/pkgs/by-name/xs/xstow/package.nix b/pkgs/by-name/xs/xstow/package.nix
index d978a376fdce..250219918d2c 100644
--- a/pkgs/by-name/xs/xstow/package.nix
+++ b/pkgs/by-name/xs/xstow/package.nix
@@ -38,5 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.gpl2Only;
     maintainers = with lib.maintainers; [ nzbr ];
     platforms = lib.platforms.unix;
+    # last successful hydra build on darwin was in 2025
+    broken = stdenv.hostPlatform.isDarwin;
   };
 })
diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index 0c0dca28a392..10ae572947c0 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -99,7 +99,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "1.21.0";
+  version = "1.22.0";
 
   outputs = [
     "out"
@@ -112,7 +112,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-RQttvkWuyWnPHsZ3FWzffklbUFjgALMYt7Kh9+N7tLE=";
+    hash = "sha256-XdWQjtdkbSqyEP/c2bGycPFEHS37tonSzTeVxyK1AHw=";
   };
 
   postPatch = ''
@@ -135,7 +135,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail 'builder.include(&glib_path_config);' 'builder.include("${lib.getLib glib}/lib/glib-2.0/include");'
   '';
 
-  cargoHash = "sha256-4Q8ig8mGlcj60N8kKYIr0CWll/766a2lJkMNDk0ZIIA=";
+  cargoHash = "sha256-9EjEMN+oyUE2HdhC42dxPk4q20qhB49qRBTqg4iY/b8=";
 
   __structuredAttrs = true;
 
diff --git a/pkgs/by-name/ze/zeroclaw/package.nix b/pkgs/by-name/ze/zeroclaw/package.nix
index 906ed02cd0b1..7f31ef76f098 100644
--- a/pkgs/by-name/ze/zeroclaw/package.nix
+++ b/pkgs/by-name/ze/zeroclaw/package.nix
@@ -12,6 +12,8 @@
   gitMinimal,
   jq,
   versionCheckHook,
+  makeBinaryWrapper,
+  which,
   nix-update-script,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -27,6 +29,15 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoHash = "sha256-Pycl0MMyxWtfcssoFhvDT4UQJuVVBDNzN536eBFlND4=";
 
+  # zerocode is a separate workspace member and expects the daemon beside it.
+  cargoBuildFlags = [
+    "--package"
+    "zeroclawlabs"
+    "--package"
+    "zerocode"
+  ];
+  cargoTestFlags = finalAttrs.cargoBuildFlags;
+
   npmDeps = fetchNpmDeps {
     inherit (finalAttrs) src;
     sourceRoot = "${finalAttrs.src.name}/web";
@@ -50,6 +61,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     protobuf
     nodejs
     npmHooks.npmConfigHook
+    makeBinaryWrapper
   ];
 
   buildInputs = [
@@ -68,6 +80,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     writableTmpDirAsHomeHook
     gitMinimal
     jq
+    which
   ];
 
   # wiremock tests require socket binding, which is denied in the darwin sandbox
@@ -87,6 +100,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   postInstall = ''
     mkdir -p $out/bin/web
     cp -r web/dist $out/bin/web/dist
+    wrapProgram $out/bin/zerocode --prefix PATH : ${lib.makeBinPath [ which ]}
   '';
 
   doInstallCheck = true;
diff --git a/pkgs/by-name/zf/zf/package.nix b/pkgs/by-name/zf/zf/package.nix
index 2b235464a26b..a188f3cd86ba 100644
--- a/pkgs/by-name/zf/zf/package.nix
+++ b/pkgs/by-name/zf/zf/package.nix
@@ -66,5 +66,7 @@ stdenv.mkDerivation (finalAttrs: {
       mmlb
     ];
     mainProgram = "zf";
+    # last successful hydra build on darwin was in 2025
+    broken = stdenv.hostPlatform.isDarwin;
   };
 })
diff --git a/pkgs/by-name/zi/zigfetch/package.nix b/pkgs/by-name/zi/zigfetch/package.nix
index 9c753642d70e..2bac951b5fbf 100644
--- a/pkgs/by-name/zi/zigfetch/package.nix
+++ b/pkgs/by-name/zi/zigfetch/package.nix
@@ -44,5 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [ heisfer ];
     mainProgram = "zigfetch";
     inherit (zig_0_16.meta) platforms;
+    # last successful hydra build on darwin was in 2025
+    broken = stdenv.hostPlatform.isDarwin;
   };
 })
diff --git a/pkgs/development/compilers/swift/by-name/sw/swift-collections/package.nix b/pkgs/development/compilers/swift/by-name/sw/swift-collections/package.nix
index b9ba08469736..2457bd35eb4b 100644
--- a/pkgs/development/compilers/swift/by-name/sw/swift-collections/package.nix
+++ b/pkgs/development/compilers/swift/by-name/sw/swift-collections/package.nix
@@ -5,6 +5,7 @@
   gitUpdater,
   ninja,
   stdenv,
+  stdlib,
   swift-minimal,
 }:
 
@@ -59,6 +60,16 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail '@include@' "''${!outputDev}" \
       --replace-fail '@lib@' "''${!outputLib}" \
       --replace-fail '@swiftPlatform@' ${stdenv.hostPlatform.swift.platform}
+  ''
+  # The CMake build doesn’t include the Span backdeploy, but we need it to support all supported deployment targets.
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    for dylib in "''${!outputLib}/lib"/*.dylib; do
+      if otool -L "$dylib" | grep -q "libswiftCompatibilitySpan.dylib"; then
+        install_name_tool "$dylib" \
+          -add_rpath /usr/lib/swift \
+          -add_rpath ${lib.escapeShellArg (lib.getLib stdlib)}/lib/swift-6.2/macosx
+      fi
+    done
   '';
 
   __structuredAttrs = true;
diff --git a/pkgs/development/compilers/yosys/plugins/ghdl.nix b/pkgs/development/compilers/yosys/plugins/ghdl.nix
index abd396b8d02c..a36bddb5ffa7 100644
--- a/pkgs/development/compilers/yosys/plugins/ghdl.nix
+++ b/pkgs/development/compilers/yosys/plugins/ghdl.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation {
   meta = {
     description = "GHDL plugin for Yosys";
     homepage = "https://github.com/ghdl/ghdl-yosys-plugin";
-    license = lib.licenses.isc;
+    license = lib.licenses.gpl3Plus;
     platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [ thoughtpolice ];
   };
diff --git a/pkgs/development/python-modules/adafruit-pureio/default.nix b/pkgs/development/python-modules/adafruit-pureio/default.nix
index d690991c3c34..33c08d4b6905 100644
--- a/pkgs/development/python-modules/adafruit-pureio/default.nix
+++ b/pkgs/development/python-modules/adafruit-pureio/default.nix
@@ -1,22 +1,26 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   setuptools-scm,
+  pyprojectVersionPatchHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "adafruit-pureio";
-  version = "1.1.11";
+  version = "1.1.12";
   pyproject = true;
 
-  src = fetchPypi {
-    pname = "Adafruit_PureIO";
-    inherit version;
-    hash = "sha256-xM+7NlcxlC0fEJKhFvR9/a4K7xjFsn8QcrWCStXqjHw=";
+  src = fetchFromGitHub {
+    owner = "adafruit";
+    repo = "Adafruit_Python_PureIO";
+    tag = finalAttrs.version;
+    hash = "sha256-yuDPQ30W8tU6kdruE3I0estRIoMU0RyXlowXsgP2r1I=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
+  build-system = [ setuptools-scm ];
+
+  nativeBuildInputs = [ pyprojectVersionPatchHook ];
 
   # Physical SMBus is not present
   doCheck = false;
@@ -26,8 +30,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python interface to Linux IO including I2C and SPI";
     homepage = "https://github.com/adafruit/Adafruit_Python_PureIO";
-    changelog = "https://github.com/adafruit/Adafruit_Python_PureIO/releases/tag/${version}";
+    changelog = "https://github.com/adafruit/Adafruit_Python_PureIO/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/aioflo/default.nix b/pkgs/development/python-modules/aioflo/default.nix
index c143a921b017..0f8b9978e8c3 100644
--- a/pkgs/development/python-modules/aioflo/default.nix
+++ b/pkgs/development/python-modules/aioflo/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "aioflo";
-  version = "2026.09.3";
+  version = "2026.09.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bachya";
     repo = "aioflo";
     tag = finalAttrs.version;
-    hash = "sha256-VZ0kHqv+SAZ5JfXJRN6kFFYl2V5ahJJCDdf1kdzIj/Q=";
+    hash = "sha256-tyNZcQIr50rXMZiBZSWKRqvro7xW6wlqmCd61mXDLu4=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/django-statici18n/default.nix b/pkgs/development/python-modules/django-statici18n/default.nix
index d94b1d1c4cab..8ca6ab80e04b 100644
--- a/pkgs/development/python-modules/django-statici18n/default.nix
+++ b/pkgs/development/python-modules/django-statici18n/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "django-statici18n";
-  version = "2.7.1";
+  version = "2.8.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "zyegfryed";
     repo = "django-statici18n";
     tag = "v${version}";
-    hash = "sha256-e6sCH/9h+Ki96hfG4ftuLo34HfZbwImThi9YxmZOmRc=";
+    hash = "sha256-t3Spxs+A+iQ0+F3eCIE0Ym8wxZE6oZPsl7bFSwA2B0Y=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/energieleser/default.nix b/pkgs/development/python-modules/energieleser/default.nix
index ec82ab412e1e..2f3a374b0960 100644
--- a/pkgs/development/python-modules/energieleser/default.nix
+++ b/pkgs/development/python-modules/energieleser/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "energieleser";
-  version = "0.1.6";
+  version = "0.1.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "nineti-GmbH";
     repo = "energieleser.py";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bg+XdASeegWLWU7kjywmMSih3SarVB3Mc2YHVCnU93w=";
+    hash = "sha256-u2Nu9zYd8dDRM0R/fU2AwMu8Y0xDa5ark2hNA6mvK64=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/entsoe-apy/default.nix b/pkgs/development/python-modules/entsoe-apy/default.nix
index de2f580cd45e..f0ec823bad6f 100644
--- a/pkgs/development/python-modules/entsoe-apy/default.nix
+++ b/pkgs/development/python-modules/entsoe-apy/default.nix
@@ -12,13 +12,13 @@
 
 buildPythonPackage rec {
   pname = "entsoe-apy";
-  version = "1.1.1";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "berrij";
     repo = "entsoe-apy";
     tag = "v${version}";
-    hash = "sha256-IzZ20ZCdJRxzCQDLX5Gs78ynPHGp5kdTbDA+fsdVhlM=";
+    hash = "sha256-I4M5IwQ/5o+LnHNMjpEM2Cjh81sq8oudDS05CleQXG8=";
   };
 
   pyproject = true;
diff --git a/pkgs/development/python-modules/env-canada/default.nix b/pkgs/development/python-modules/env-canada/default.nix
index 7a21b331aa9a..10fc9e22f702 100644
--- a/pkgs/development/python-modules/env-canada/default.nix
+++ b/pkgs/development/python-modules/env-canada/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "env-canada";
-  version = "0.20.3";
+  version = "0.20.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "michaeldavie";
     repo = "env_canada";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-c8EfYhlEeyCinsK+8TixCfIwTRD1CV5WyfiEbUJsFMg=";
+    hash = "sha256-b+lf75c+bvhH0c8gj+PKlVq/B6x1iG5m1r4Vf5wXKDM=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-tasks/default.nix b/pkgs/development/python-modules/google-cloud-tasks/default.nix
index a623b074b4ff..ab5c98271127 100644
--- a/pkgs/development/python-modules/google-cloud-tasks/default.nix
+++ b/pkgs/development/python-modules/google-cloud-tasks/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-tasks";
-  version = "2.24.0";
+  version = "2.25.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_tasks";
     inherit version;
-    hash = "sha256-qk+HZOWxV8urga9hnMT9nxTr7Oi2nlOUplfDKKg2Yig=";
+    hash = "sha256-UeG5GBiSUSTD73KAGbFA8NSlBo2HHw8noXxtqAMy8eQ=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/hist/default.nix b/pkgs/development/python-modules/hist/default.nix
index 91e7f0278943..14ec4083611b 100644
--- a/pkgs/development/python-modules/hist/default.nix
+++ b/pkgs/development/python-modules/hist/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "hist";
-  version = "2.11.0";
+  version = "2.12.0";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -28,7 +28,7 @@ buildPythonPackage (finalAttrs: {
     owner = "scikit-hep";
     repo = "hist";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vAaP8oaZUUofymLu0uId94X+vt4o4XyRj5gITxs0ASs=";
+    hash = "sha256-rlUZJj9hER0oNSNlEpQ0623MMlh4b/3W1Do8dQLdi10=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index 90ab25b9b373..700e28e4e316 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202609281";
+  version = "0.1.202609301";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vh+KVvkg1B6EV/9EabnEJvnWk+yycxVnIH2xO2g/F/o=";
+    hash = "sha256-wbDqwoaxEOMhbRBUwKVnZ+1MVEVORQhSmn1g6L1KVds=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/ihcsdk/default.nix b/pkgs/development/python-modules/ihcsdk/default.nix
index b7a51c034f68..4bc5ad24fc92 100644
--- a/pkgs/development/python-modules/ihcsdk/default.nix
+++ b/pkgs/development/python-modules/ihcsdk/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "ihcsdk";
-  version = "2.8.12";
+  version = "2.8.13";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "dingusdk";
     repo = "PythonIhcSdk";
     tag = "v${version}";
-    hash = "sha256-k1WKfW/qweRdcaczqf47iNlqeOe7ULa57kqsTF4W2Zs=";
+    hash = "sha256-yFCLxe+BzG6+blEEmUHX+KZZVokyLxw7GD7q/GOEzGU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/loqedapi/default.nix b/pkgs/development/python-modules/loqedapi/default.nix
index 453ced453d90..d46d4b8ad7dd 100644
--- a/pkgs/development/python-modules/loqedapi/default.nix
+++ b/pkgs/development/python-modules/loqedapi/default.nix
@@ -5,21 +5,25 @@
   buildPythonPackage,
   fetchFromGitHub,
   setuptools,
+  setuptools-scm,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "loqedapi";
-  version = "2.1.11";
+  version = "2.1.15";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cpolhout";
     repo = "loqedAPI";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DLnjIq0YQIspPWYP9KT0UZ9UPGg5SOjYuVM7XqCUqTo=";
+    hash = "sha256-i6suZdme6M1lNVsI1zd23I8JQNfVmiCooQTkQCeOJYU=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
 
   dependencies = [
     aiohttp
diff --git a/pkgs/development/python-modules/moyopy/default.nix b/pkgs/development/python-modules/moyopy/default.nix
index 8c9f6689eedd..509a9917311c 100644
--- a/pkgs/development/python-modules/moyopy/default.nix
+++ b/pkgs/development/python-modules/moyopy/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "moyopy";
-  version = "0.19.0";
+  version = "0.21.0";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -24,7 +24,7 @@ buildPythonPackage (finalAttrs: {
     owner = "spglib";
     repo = "moyo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4nekU6i89TCSbi+FIT2su28sX4byEiIpdtHr+RP4Kgk=";
+    hash = "sha256-Eay/MjFy27FVcLLA9k28SzkUoj6KMd2mYYYhMa7vjfo=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/moyopy";
@@ -47,7 +47,7 @@ buildPythonPackage (finalAttrs: {
       sourceRoot
       cargoRoot
       ;
-    hash = "sha256-sYeHaEEPjw6ectOtvK4Swhz9HUOzTgWZhp6PVprx3SA=";
+    hash = "sha256-OAL8LG3uvVcRRomWBRhtlc3bBeG5rhEH4ToHWl+1HGI=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/openrgb-python/default.nix b/pkgs/development/python-modules/openrgb-python/default.nix
index 702c4f725bd1..1c8d731f9ef2 100644
--- a/pkgs/development/python-modules/openrgb-python/default.nix
+++ b/pkgs/development/python-modules/openrgb-python/default.nix
@@ -1,18 +1,20 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "openrgb-python";
-  version = "0.3.6";
+  version = "0.3.7";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-86jy8hoOgQocdCeapjaRFO9PKx/TW9kcN16UKSWNVps=";
+  src = fetchFromGitHub {
+    owner = "jath03";
+    repo = "openrgb-python";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Xvx0gl0kPC1/yJrSO9STPEPxw5lRlV8sLNwCUsvIGvI=";
   };
 
   build-system = [ setuptools ];
@@ -25,8 +27,8 @@ buildPythonPackage rec {
   meta = {
     description = "Module for the OpenRGB SDK";
     homepage = "https://openrgb-python.readthedocs.io/";
-    changelog = "https://github.com/jath03/openrgb-python/releases/tag/v${version}";
+    changelog = "https://github.com/jath03/openrgb-python/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/pillow-jxl-plugin/default.nix b/pkgs/development/python-modules/pillow-jxl-plugin/default.nix
index 395cb68d412c..c5baea6da8cf 100644
--- a/pkgs/development/python-modules/pillow-jxl-plugin/default.nix
+++ b/pkgs/development/python-modules/pillow-jxl-plugin/default.nix
@@ -9,6 +9,8 @@
   packaging,
   pillow,
   numpy,
+  openexr,
+  pyexiv2,
 }:
 
 buildPythonPackage (finalAttrs: {
@@ -44,13 +46,18 @@ buildPythonPackage (finalAttrs: {
     pillow
   ];
 
-  doCheck = false;
-
   nativeCheckInputs = [
     pytestCheckHook
     numpy
+    openexr
+    pyexiv2
   ];
 
+  # Remove source so tests don't try to import from it
+  preCheck = ''
+    rm -r pillow_jxl
+  '';
+
   pythonImportsCheck = [
     "pillow_jxl"
   ];
diff --git a/pkgs/development/python-modules/python-ldap/default.nix b/pkgs/development/python-modules/python-ldap/default.nix
index 23186b37e8db..adcf0813ebe0 100644
--- a/pkgs/development/python-modules/python-ldap/default.nix
+++ b/pkgs/development/python-modules/python-ldap/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "python-ldap";
-  version = "3.4.7";
+  version = "3.4.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "python-ldap";
     repo = "python-ldap";
     tag = "python-ldap-${finalAttrs.version}";
-    hash = "sha256-uSP8c5gid5TBenBaNVdlteHatkctAafz6yFHuIYKiTY=";
+    hash = "sha256-EvLH8Yyx2iEde4OFk9MkzPtPr/n7NnGxAb8xJTo8Tn8=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pyweatherflowudp/default.nix b/pkgs/development/python-modules/pyweatherflowudp/default.nix
index e6b8596bb55f..19e840019d13 100644
--- a/pkgs/development/python-modules/pyweatherflowudp/default.nix
+++ b/pkgs/development/python-modules/pyweatherflowudp/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pyweatherflowudp";
-  version = "1.6.1";
+  version = "1.6.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "briis";
     repo = "pyweatherflowudp";
     tag = finalAttrs.version;
-    hash = "sha256-79AfUVd+UuAYIkb+wTU6JvV/sASXha4LDG1BQk/ihs0=";
+    hash = "sha256-9qpbLDoDDFGe3rIbiMuKd7LgspxTwCmZBhtQYvaxlZE=";
   };
 
   build-system = [
@@ -49,6 +49,8 @@ buildPythonPackage (finalAttrs: {
     "test_invalid_messages"
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   meta = {
     description = "Library to receive UDP Packets from Weatherflow Weatherstations";
     homepage = "https://github.com/briis/pyweatherflowudp";
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index 505821eb1a1e..72e9cd5df6c7 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "tencentcloud-sdk-python";
-  version = "3.1.183";
+  version = "3.1.184";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = finalAttrs.version;
-    hash = "sha256-peCCsqmUG+mYes18wpzLB0DhTVqtG3t6S+W6sMkkYeM=";
+    hash = "sha256-4+4r7QAto7oqicN6wEJ4sh3IoLRnBlI+U/jmDPfEW50=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/rocq-modules/deriving/default.nix b/pkgs/development/rocq-modules/deriving/default.nix
index 5a1614e7414c..fa5a2b60718d 100644
--- a/pkgs/development/rocq-modules/deriving/default.nix
+++ b/pkgs/development/rocq-modules/deriving/default.nix
@@ -26,10 +26,7 @@ mkCoqDerivation {
     lib.switch
       [ coq.coq-version ssreflect.version ]
       [
-        (case (range "8.17" "9.1") (range "2.0.0" "2.5.0") "0.2.3")
-        (case (range "8.17" "9.1") (range "2.0.0" "2.5.0") "0.2.2")
-        (case (range "8.17" "9.0") (range "2.0.0" "2.3.0") "0.2.1")
-        (case (range "8.17" "8.20") (range "2.0.0" "2.2.0") "0.2.0")
+        (case (range "8.17" "9.2") (range "2.0.0" "2.6.0") "0.2.3")
         (case (range "8.11" "8.20") (isLe "2.0.0") "0.1.1")
       ]
       null;
diff --git a/pkgs/servers/monitoring/grafana/plugins/grafana-lokiexplore-app/default.nix b/pkgs/servers/monitoring/grafana/plugins/grafana-lokiexplore-app/default.nix
index f9b7fa3653a1..08692eaffd73 100644
--- a/pkgs/servers/monitoring/grafana/plugins/grafana-lokiexplore-app/default.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/grafana-lokiexplore-app/default.nix
@@ -2,8 +2,8 @@
 
 grafanaPlugin {
   pname = "grafana-lokiexplore-app";
-  version = "2.5.2";
-  zipHash = "sha256-MVqubd7CpUhUeFahvYhGUVB9ouGC81gZGYg3n2Ui0F0=";
+  version = "2.6.0";
+  zipHash = "sha256-G05EoSVBC/w3c6q3CKT23y3I3bQuogTHbAtgCBGcr8M=";
   meta = {
     description = "Browse Loki logs without the need for writing complex queries";
     license = lib.licenses.agpl3Only;
diff --git a/pkgs/servers/varnish/default.nix b/pkgs/servers/varnish/default.nix
index 1c7d0a8b6d7f..e0ec561e0ac0 100644
--- a/pkgs/servers/varnish/default.nix
+++ b/pkgs/servers/varnish/default.nix
@@ -120,7 +120,9 @@ let
           lib.maintainers.osnyx
         ];
         platforms = lib.platforms.unix;
-        broken = stdenv.hostPlatform.isDarwin && version == "8.0.1"; # https://github.com/NixOS/nixpkgs/issues/495368
+        # last successful hydra build on darwin was in 2025
+        # see https://github.com/NixOS/nixpkgs/issues/495368
+        broken = stdenv.hostPlatform.isDarwin;
       };
     };
 in
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 4d37d58656ef..4d652df3ba29 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -569,6 +569,7 @@ mapAliases {
   classads = throw "'classads' has been removed, as it is unmaintained both upstream and in nixpkgs"; # Added 2026-06-27
   claude-code-acp = warnAlias "'claude-code-acp' has been renamed to 'claude-agent-acp'" claude-agent-acp; # Added 2026-03-31
   claude-code-bin = warnAlias "'claude-code-bin' has been merged into 'claude-code'" claude-code; # Added 2026-04-18
+  clblas = throw "'clblas' has been removed as it was unmaintained upstream"; # Added 2026-09-02
   clearlyU = clearly-u; # Added 2026-02-08
   clerk = throw "'clerk' has been removed as the upstream repository has been archived"; # Added 2026-09-21
   cli-visualizer = throw "'cli-visualizer' has been removed as the upstream repository is gone"; # Added 2025-06-05
@@ -577,6 +578,7 @@ mapAliases {
   clipbuzz = throw "clipbuzz has been removed, as it does not build with supported Zig versions"; # Added 2025-08-09
   clipgrab = throw "'clipgrab' has been removed, as it was unmaintained in nixpkgs since 2022 and depended on vulnerable qt5 webengine."; # Added 2026-02-11
   clipit = throw "'clipit' has been removed as it is unmaintained upstream and broken"; # Added 2026-05-16
+  clmagma = throw "'clmagma' has been removed as it was unmaintained upstream"; # Added 2026-09-02
   clorinde = throw "'clorinde' has been merged into 'cornucopia'"; # Added 2026-06-03
   cloudlogoffline = throw "cloudlogoffline has been removed"; # Added 2025-05-18
   clucene_core = warnAlias "'clucene_core' has been renamed to 'clucene-core'" clucene-core; # Added 2026-01-12