diff --git a/doc/release-notes/rl-2611.section.md b/doc/release-notes/rl-2611.section.md
index b8fe1e754205..36f2eda94a47 100644
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@@ -318,6 +318,9 @@
 
 - `typescript` 7.0.2 now uses the Golang implementation. The [announcement document](https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/) has information on what was changed.
 
+- `macaulay2` no longer installs Emacs files.
+  Users can now get the files from an Emacs lisp package, like `emacs.pkgs.withPackages (epkgs: [ epkgs.m2 ])`.
+
 - `navidrome`'s plugin infrastructure has significantly changed. `buildNavidromePlugin` is renamed to `buildNavidromeGoPlugin` to allow for other language types. Plugins must now be sourced from `pkgsCross.wasi32.navidromePlugins.<name>`.
 
 - `navidromePlugins.apple-music` now uses a `bundleName` attribute which sets the plugin's name to match the plugin's documentation for easier use. You will need to update your Agent from `apple-music-plugin` to `apple-music` as noted in [their docs](https://github.com/navidrome/apple-music-plugin#installation).
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 356b6ef2a6c7..6fc197b56e96 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -9520,6 +9520,12 @@
     github = "fkautz";
     githubId = 135706;
   };
+  fkokosinski = {
+    name = "Filip Kokosiński";
+    email = "filip@kokosinski.me";
+    github = "fkokosinski";
+    githubId = 19800410;
+  };
   fkomarek = {
     name = "Filip Komárek";
     github = "filip2cz";
@@ -13655,6 +13661,12 @@
     githubId = 474643;
     name = "José Miguel Martínez Carrasco";
   };
+  jm5905938 = {
+    email = "jm5905938@gmail.com";
+    github = "jm5905938";
+    githubId = 187073435;
+    name = "Aveline Noir";
+  };
   jmagnusj = {
     email = "jmagnusj@gmail.com";
     github = "magnusjonsson";
@@ -15345,6 +15357,13 @@
     githubId = 231780064;
     name = "Klea";
   };
+  kleiner3 = {
+    name = "kleiner3";
+    email = "nixos@dasriley.de";
+    github = "kleiner3";
+    githubId = 49880817;
+    matrix = "@riley:catgirl.industries";
+  };
   klntsky = {
     email = "klntsky@gmail.com";
     name = "Vladimir Kalnitsky";
@@ -18766,6 +18785,13 @@
     github = "mfairley";
     githubId = 4374785;
   };
+  mfocko = {
+    name = "Matej Focko";
+    github = "mfocko";
+    githubId = 8149784;
+    email = "me@mfocko.xyz";
+    matrix = "@mfocko:fedora.im";
+  };
   mfossen = {
     email = "msfossen@gmail.com";
     github = "mfossen";
@@ -26010,6 +26036,12 @@
     githubId = 11632726;
     name = "Arijit Basu";
   };
+  saylesss88 = {
+    email = "saylesss87@proton.me";
+    github = "saylesss88";
+    githubId = 209646716;
+    name = "T. Sawyer";
+  };
   sb0 = {
     email = "sb@m-labs.hk";
     github = "sbourdeauducq";
@@ -26725,6 +26757,11 @@
     github = "shimunn";
     githubId = 41011289;
   };
+  shinbunbun = {
+    name = "shinbunbun";
+    github = "shinbunbun";
+    githubId = 34409044;
+  };
   shiphan = {
     email = "timlin940511@gmail.com";
     name = "Shiphan";
diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index c0c9169150de..26a2ab83da50 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -332,6 +332,41 @@
 
 - The `shell_interact()` function on interactive runs of NixOS VM tests has been deprecated. Use the SSH backdoor instead.
 
+- The {option}`programs.fish.shellFunctions` option can now be used to create custom fish functions in a structured manner, as opposed to concatenating strings with {option}`program.fish.interactiveShellInit`.
+:::{.example}
+# Migrating fish functions to `programs.fish.shellFunctions`
+
+Custom fish functions have historically been defined like so:
+
+```nix
+{
+  programs.fish.interactiveShellInit = ''
+    function backup --argument filename --description "Creates a backup copy of a file in the current directory."
+      cp $filename $filename.bak
+    end
+  '';
+}
+```
+
+The above example can be migrated via the following structured code block:
+
+```nix
+{
+  programs.fish.shellFunctions = {
+    backup = {
+      modifiers = {
+        description = "Creates a backup copy of a file in the current directory.";
+        argument = "filename";
+      };
+      body = ''
+        cp $filename $filename.bak
+      '';
+    };
+  };
+}
+```
+:::
+
 - NixOS VM tests now prefer to express durations and timeouts as `datetime.timedelta` values instead of bare numbers. Methods such as `machine.wait_until_succeeds`, `machine.sleep`, `retry`, and `polling_condition` now accept a `timedelta` (e.g., `machine.wait_for_unit("sshd.service", timeout=datetime.timedelta(minutes=1))`). Passing an `int`/`float` as seconds still works but now emits a deprecation warning. Argument names that explicitly defined units were preserved but have had `timedelta` equivalents introduced (`timeout_seconds` → `timeout`, `secs` → `duration`, `seconds_interval` → `interval`).
 
 - `darwin.linux-builder-vz` has been added: a variant of `darwin.linux-builder` that runs the builder guest on Apple's Virtualization.framework via the new `vzvm` package, translating `x86_64-linux` builds with Rosetta instead of emulating them. Apple silicon hosts only. As part of this, the `nixos/modules/profiles/nix-builder-vm.nix` profile has been split into the backend-neutral `nixos/modules/profiles/nix-builder.nix` and a QEMU-specific part. Existing imports of `nix-builder-vm.nix` keep working unchanged.
diff --git a/nixos/modules/services/monitoring/telegraf.nix b/nixos/modules/services/monitoring/telegraf.nix
index bcdd2ece5718..8ad6830f2a60 100644
--- a/nixos/modules/services/monitoring/telegraf.nix
+++ b/nixos/modules/services/monitoring/telegraf.nix
@@ -11,6 +11,10 @@ let
   configFile = settingsFormat.generate "config.toml" cfg.extraConfig;
 in
 {
+  meta = {
+    inherit (pkgs.telegraf.meta) maintainers;
+  };
+
   ###### interface
   options = {
     services.telegraf = {
diff --git a/nixos/modules/services/web-apps/akkoma.nix b/nixos/modules/services/web-apps/akkoma.nix
index 55cbdb4947c2..cc02ba2530d4 100644
--- a/nixos/modules/services/web-apps/akkoma.nix
+++ b/nixos/modules/services/web-apps/akkoma.nix
@@ -1167,17 +1167,16 @@ in
   };
 
   config = mkIf cfg.enable {
-    assertions =
-      optionals
-        (
+    assertions = [
+      {
+        assertion =
           cfg.config.":pleroma".":media_proxy".enabled
-          && cfg.config.":pleroma".":media_proxy".base_url == null
-        )
-        [
-          ''
-            `services.akkoma.config.":pleroma".":media_proxy".base_url` must be set when the media proxy is enabled.
-          ''
-        ];
+          -> cfg.config.":pleroma".":media_proxy".base_url != null;
+        message = ''
+          `services.akkoma.config.":pleroma".":media_proxy".base_url` must be set to a URL with a different host component (domain name) than the web endpoint when the media proxy is enabled.
+        '';
+      }
+    ];
     warnings =
       optionals (with config.security; cfg.installWrapper && (!sudo.enable) && (!sudo-rs.enable))
         [
diff --git a/nixos/modules/system/boot/stratisroot.nix b/nixos/modules/system/boot/stratisroot.nix
index 349133ab540c..07d21b846cc2 100644
--- a/nixos/modules/system/boot/stratisroot.nix
+++ b/nixos/modules/system/boot/stratisroot.nix
@@ -34,6 +34,7 @@ in
           thin_repair = "${pkgs."thin-provisioning-tools"}/bin/thin_repair";
           thin_metadata_size = "${pkgs."thin-provisioning-tools"}/bin/thin_metadata_size";
           stratis-min = "${pkgs.stratisd}/bin/stratis-min";
+          cryptsetup = "${pkgs.cryptsetup}/bin/cryptsetup";
         };
         services = lib.attrsets.mapAttrs' (mountPoint: fileSystem: {
           name = "stratis-setup-${fileSystem.stratis.poolUuid}";
diff --git a/nixos/tests/installer.nix b/nixos/tests/installer.nix
index 59f8df3ea571..c3319c00dcc1 100644
--- a/nixos/tests/installer.nix
+++ b/nixos/tests/installer.nix
@@ -1861,7 +1861,7 @@ in
     createPartitions = ''
       installer.succeed(
         "sgdisk --zap-all /dev/vda",
-        "sgdisk --new=1:0:+100M --typecode=0:ef00 /dev/vda", # /boot
+        "sgdisk --new=1:0:+200M --typecode=0:ef00 /dev/vda", # /boot
         "sgdisk --new=2:0:+1G --typecode=0:8200 /dev/vda", # swap
         "sgdisk --new=3:0:+5G --typecode=0:8300 /dev/vda", # /
         "udevadm settle",
diff --git a/nixos/tests/linux-builder-vz-store-gc.nix b/nixos/tests/linux-builder-vz-store-gc.nix
index 93bf0c078ca9..604ea177de4e 100644
--- a/nixos/tests/linux-builder-vz-store-gc.nix
+++ b/nixos/tests/linux-builder-vz-store-gc.nix
@@ -1,12 +1,15 @@
-{ lib, ... }:
+{ hostPkgs, lib, ... }:
 
 {
   # Strictly speaking, this is not a precise test for VZ builder, but we don't
   # have vzvm backend for nixos tests, so we use qemu here, with config that
   # matches linux-builder-vz disk layout.
   name = "linux-builder-vz-store-gc";
+  meta.maintainers = hostPkgs.darwin.linux-builder-vz.meta.maintainers;
 
   nodes.machine = {
+    nix.enable = true;
+
     virtualisation = {
       # Match the vz-vm drive order: the read-only store image is /dev/vda,
       # followed by the writable data disk at /dev/vdb.
diff --git a/nixos/tests/telegraf.nix b/nixos/tests/telegraf.nix
index 68abd2f5f158..36bee01c98e3 100644
--- a/nixos/tests/telegraf.nix
+++ b/nixos/tests/telegraf.nix
@@ -1,8 +1,8 @@
 { pkgs, ... }:
 {
   name = "telegraf";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [ mic92 ];
+  meta = {
+    inherit (pkgs.telegraf.meta) maintainers;
   };
 
   containers.machine =
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/ebuild-mode/package.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/ebuild-mode/package.nix
index cd6450de564b..cff3f6205861 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/ebuild-mode/package.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/ebuild-mode/package.nix
@@ -6,11 +6,11 @@
 
 melpaBuild (finalAttrs: {
   pname = "ebuild-mode";
-  version = "1.85";
+  version = "1.86";
 
   src = fetchzip {
     url = "https://gitweb.gentoo.org/proj/ebuild-mode.git/snapshot/ebuild-mode-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-LSXDf4LHqk8+ga36BIQ+LHIaJQRpen293di1rNrMunE=";
+    hash = "sha256-wuUZce+9VE5pthm6QPrPJFUGML6Tuv2mnY9cqkSFZo8=";
   };
 
   meta = {
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/m2/package.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/m2/package.nix
new file mode 100644
index 000000000000..cad83545d098
--- /dev/null
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/m2/package.nix
@@ -0,0 +1,31 @@
+{
+  lib,
+  melpaBuild,
+  fetchFromGitHub,
+  macaulay2,
+}:
+melpaBuild {
+  pname = "m2";
+  ename = "M2";
+
+  version = "1.26.6";
+
+  src = fetchFromGitHub {
+    owner = "Macaulay2";
+    repo = "M2-emacs";
+    rev = "ae882ab04da19f62c62462ef9604251a0b30a9f5";
+    hash = "sha256-8qnPzLR616Oypb6YGUm1cVj8jd1QDdeajHkVaTaEnX4=";
+  };
+
+  postPatch = ''
+    substituteInPlace M2.el \
+      --replace-fail 'defcustom M2-exe "M2"' 'defcustom M2-exe "${lib.getExe macaulay2}"'
+  '';
+
+  meta = {
+    inherit (macaulay2.meta) maintainers platforms;
+    description = "Major mode for editing Macaulay2 source code";
+    homepage = "https://github.com/Macaulay2/M2-emacs";
+    license = lib.licenses.gpl3Plus;
+  };
+}
diff --git a/pkgs/applications/editors/vim/plugins/aliases.nix b/pkgs/applications/editors/vim/plugins/aliases.nix
index 423895d4e41b..33f4a01ef76d 100644
--- a/pkgs/applications/editors/vim/plugins/aliases.nix
+++ b/pkgs/applications/editors/vim/plugins/aliases.nix
@@ -17,16 +17,8 @@ let
   # sets from building on Hydra.
   removeDistribute = alias: if lib.isDerivation alias then lib.dontDistribute alias else alias;
 
-  # Make sure that we are not shadowing something from
-  # all-packages.nix.
-  checkInPkgs =
-    n: alias: if builtins.hasAttr n prev then throw "Alias ${n} is still in vim-plugins" else alias;
-
   mapAliases =
-    aliases:
-    lib.mapAttrs (
-      n: alias: removeDistribute (removeRecurseForDerivations (checkInPkgs n alias))
-    ) aliases;
+    aliases: lib.mapAttrs (_: alias: removeDistribute (removeRecurseForDerivations alias)) aliases;
 
   deprecations = lib.mapAttrs (
     old: info:
@@ -64,7 +56,7 @@ mapAliases (
     playground = throw "'vimPlugins.playground' has been archived"; # Added 2025-12-18
     pure-lua = lib.warnOnInstantiate "Please replace 'vimPlugins.pure-lua' with 'vimPlugins.moonlight-nvim' as this name was an error" moonlight-nvim; # Added 2025-11-17
     registers-nvim = throw "'vimPlugins.registers-nvim' has been removed: the upstream repository got deleted"; # Added 2026-04-30
-    rust-tools-nvim = lib.warnOnInstantiate "'vimPlugins.rust-tools-nvim' is abandoned by upstream; you should use 'vimPlugins.rustaceanvim'" rust-tools-nvim; # Added 2026-02-04
+    rust-tools-nvim = throw "'vimPlugins.rust-tools-nvim' has been removed: abandoned by upstream. Use rustaceanvim"; # Added 2026-09-28
     Spacegray-vim = throw "'vimPlugins.Spacegray-vim' has been removed: abandoned by upstream"; # Added 2025-03-24
     SpaceVim = throw "'vimPlugins.SpaceVim' didn't work properly in vimPlugins, please use top-level 'spacevim' instead"; # Added 2024-11-27
     spacevim = throw "'vimPlugins.spacevim' was unmaintained for the last 6 years, please use top-level 'spacevim'"; # Added 2024-11-27
diff --git a/pkgs/applications/editors/vim/plugins/default.nix b/pkgs/applications/editors/vim/plugins/default.nix
index 9630944dc0d3..7ace8d226c77 100644
--- a/pkgs/applications/editors/vim/plugins/default.nix
+++ b/pkgs/applications/editors/vim/plugins/default.nix
@@ -55,7 +55,14 @@ let
     inherit llvmPackages;
   };
 
-  aliases = if config.allowAliases then (import ./aliases.nix lib) else final: prev: { };
+  aliases =
+    final: prev:
+    let
+      defined = import ./aliases.nix lib final prev;
+      shadowed = builtins.attrNames (builtins.intersectAttrs prev defined);
+    in
+    assert lib.assertMsg (shadowed == [ ]) "vimPlugins aliases shadow plugins: ${toString shadowed}";
+    lib.optionalAttrs config.allowAliases defined;
 in
 lib.pipe initialPackages [
   (extends plugins)
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 87cd750901e0..71aeb852fea1 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -461,12 +461,12 @@ final: prev: {
 
   SchemaStore-nvim = buildVimPlugin {
     pname = "SchemaStore.nvim";
-    version = "0-unstable-2026-09-24";
+    version = "0-unstable-2026-09-28";
     src = fetchFromGitHub {
       owner = "b0o";
       repo = "SchemaStore.nvim";
-      rev = "12dd0de1f15d598db2cc0d075f4f0d13a3290d4d";
-      hash = "sha256-CwAbTCSjMb85sSNNEFu0Cm09qj55WzNsw/01Yi1itKo=";
+      rev = "411163b2be396495c76788a016cb1354f1e8acd0";
+      hash = "sha256-x+nym6jprfHZSUH8qT+1JHmV/nG66BAhwMENxTah2pI=";
     };
     meta.homepage = "https://github.com/b0o/SchemaStore.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -1653,12 +1653,12 @@ final: prev: {
 
   base46 = buildVimPlugin {
     pname = "base46";
-    version = "0-unstable-2026-09-18";
+    version = "0-unstable-2026-09-25";
     src = fetchFromGitHub {
       owner = "nvchad";
       repo = "base46";
-      rev = "91b29a33670e77b3705001804670511a17c0c1dc";
-      hash = "sha256-d3jSfJU0KS0MG0sm6aYJlqRxajwe3rMWlffufrGj1IE=";
+      rev = "7df2bd89295db00b649cbc49bdf6fe5a1cc5df3b";
+      hash = "sha256-LIYAurLRSHnGtDUvxUvIE0PJ1cZ6L0M4nQ+a1H2SgJg=";
     };
     meta.homepage = "https://github.com/nvchad/base46/";
     meta.license = unfree;
@@ -3513,12 +3513,12 @@ final: prev: {
 
   coc-nvim = buildVimPlugin {
     pname = "coc.nvim";
-    version = "0.0.82-unstable-2026-09-22";
+    version = "0.0.82-unstable-2026-09-28";
     src = fetchFromGitHub {
       owner = "neoclide";
       repo = "coc.nvim";
-      rev = "f5910295483bfbe8b58e6f2002e9ae280e5b700e";
-      hash = "sha256-fXxJRSEfj/o/43fd+iADJl7ARYOZd01iLbSYnFHG1Sc=";
+      rev = "eda4d09170fd9bd08dd9abbe300f1f5bcaae0a20";
+      hash = "sha256-4chqsnJIuNyjNN6r7ct48qjQhZfJQRPCKkaWIOOj3/Y=";
     };
     meta.homepage = "https://github.com/neoclide/coc.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -3611,12 +3611,12 @@ final: prev: {
 
   codecompanion-nvim = buildVimPlugin {
     pname = "codecompanion.nvim";
-    version = "19.25.0";
+    version = "19.26.0";
     src = fetchFromGitHub {
       owner = "olimorris";
       repo = "codecompanion.nvim";
-      tag = "v19.25.0";
-      hash = "sha256-PTvllgZji45JdW1NW9YmRDJqiEvdmbpeB2QGvu10jbM=";
+      tag = "v19.26.0";
+      hash = "sha256-KS3F/h1UCYSsztWKy2RouS89I46+y7uB/qykHJ4lIf0=";
     };
     meta.homepage = "https://github.com/olimorris/codecompanion.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -5334,6 +5334,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  direnv-nvim = buildVimPlugin {
+    pname = "direnv.nvim";
+    version = "0-unstable-2026-06-28";
+    src = fetchFromGitHub {
+      owner = "NotAShelf";
+      repo = "direnv.nvim";
+      rev = "9258f9f10c4c729d8296fce0e3ecb12543daad06";
+      hash = "sha256-b5PpmkYWaDGLNcu+36tRR5ycATHYBjs9WrV8/jfmooQ=";
+    };
+    meta.homepage = "https://github.com/NotAShelf/direnv.nvim/";
+    meta.license = getLicenseFromSpdxId "MPL-2.0";
+    meta.hydraPlatforms = [ ];
+  };
+
   direnv-vim = buildVimPlugin {
     pname = "direnv.vim";
     version = "0-unstable-2023-12-02";
@@ -5448,12 +5462,12 @@ final: prev: {
 
   dropbar-nvim = buildVimPlugin {
     pname = "dropbar.nvim";
-    version = "14.2.1-unstable-2026-05-31";
+    version = "14.2.1-unstable-2026-09-25";
     src = fetchFromGitHub {
       owner = "Bekaboo";
       repo = "dropbar.nvim";
-      rev = "808ba31cde89aec8833e9789f5e04557cd31c9e1";
-      hash = "sha256-S9TD5PkHKHoo2jfjOXkQoNtyr/PNtR/eljXB+8PtGU8=";
+      rev = "f7c6fa21e2a7c32576e7a1791774a3736987f467";
+      hash = "sha256-bxlbejtkSwKUQ0+H/+6k83hqUeBq29iHanpVxv7+cZk=";
     };
     meta.homepage = "https://github.com/Bekaboo/dropbar.nvim/";
     meta.license = getLicenseFromSpdxId "GPL-3.0-only";
@@ -6220,12 +6234,12 @@ final: prev: {
 
   flutter-tools-nvim = buildVimPlugin {
     pname = "flutter-tools.nvim";
-    version = "3.0.1";
+    version = "3.1.0";
     src = fetchFromGitHub {
       owner = "nvim-flutter";
       repo = "flutter-tools.nvim";
-      tag = "v3.0.1";
-      hash = "sha256-rdwusVC1/1FTY3dTLkjZ6d1pjubt+fBgRZexih7ClsM=";
+      tag = "v3.1.0";
+      hash = "sha256-eJPZSO7ioKULD66n5A7Yb6lpKQft+p3R4h4AriybA0s=";
     };
     meta.homepage = "https://github.com/nvim-flutter/flutter-tools.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -6473,12 +6487,12 @@ final: prev: {
 
   fzf-vim = buildVimPlugin {
     pname = "fzf.vim";
-    version = "0-unstable-2026-09-07";
+    version = "0-unstable-2026-09-26";
     src = fetchFromGitHub {
       owner = "junegunn";
       repo = "fzf.vim";
-      rev = "8a0068127ac9ee23d71dab2944ce995726bef462";
-      hash = "sha256-nv/C0UMpVLzu0mYODVnByMkWnNlILdoqkl4KkLGSfjk=";
+      rev = "a630ef91e1e050574e703f506cd0812b18d26939";
+      hash = "sha256-QgHHnwpchIyP3H8cP3aMHjXcOm6cCsVDwo/uOzYZAtQ=";
     };
     meta.homepage = "https://github.com/junegunn/fzf.vim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -8323,12 +8337,13 @@ final: prev: {
   jsonfly-nvim = buildVimPlugin {
     pname = "jsonfly.nvim";
     version = "0-unstable-2025-11-02";
-    src = fetchgit {
-      url = "https://git.myzel394.app/Myzel394/jsonfly.nvim";
+    src = fetchFromGitHub {
+      owner = "Myzel394";
+      repo = "jsonfly.nvim";
       rev = "3d58635cb195a5435743e7882c6ac7cff710204f";
-      hash = "sha256-bTh/6zmYQ+XqBsccKo8i149nU5bBfFv+8UKMayHIoo4=";
+      hash = "sha256-qTxLDQKqmsf/DrgzhfrmtY2LUVhPcGNFU/Iq4ew29lA=";
     };
-    meta.homepage = "https://git.myzel394.app/Myzel394/jsonfly.nvim";
+    meta.homepage = "https://github.com/Myzel394/jsonfly.nvim";
     meta.license = unfree;
     meta.hydraPlatforms = [ ];
   };
@@ -8783,11 +8798,11 @@ final: prev: {
 
   leap-nvim = buildVimPlugin {
     pname = "leap.nvim";
-    version = "0-unstable-2026-09-19";
+    version = "0-unstable-2026-09-27";
     src = fetchgit {
       url = "https://codeberg.org/andyg/leap.nvim/";
-      rev = "32bde2e932417e8a065f039f00f0cebdd0da4710";
-      hash = "sha256-SXtPDUdu5cju3CQW64Pi21Ry4Swlbki5Qjwb5bizJnA=";
+      rev = "277e04fad21e3af05a55cc414757b09a704f2a92";
+      hash = "sha256-Yd64QLzeKWcfJEWkvr9944aKPkgNmlsN/OpARVFRBes=";
     };
     meta.homepage = "https://codeberg.org/andyg/leap.nvim/";
     meta.license = unfree;
@@ -10714,12 +10729,12 @@ final: prev: {
 
   modus-themes-nvim = buildVimPlugin {
     pname = "modus-themes.nvim";
-    version = "1.4.4";
+    version = "1.6.0";
     src = fetchFromGitHub {
       owner = "miikanissi";
       repo = "modus-themes.nvim";
-      tag = "v1.4.4";
-      hash = "sha256-j10BCRHN6cTDx1+zBxgo6drtA9XoZAqaZg+1uTDQH4M=";
+      tag = "v1.6.0";
+      hash = "sha256-/HWmToZL9HnAYCjVNfpIu5IX21O+nuCzweqbah8pA/A=";
     };
     meta.homepage = "https://github.com/miikanissi/modus-themes.nvim/";
     meta.license = getLicenseFromSpdxId "GPL-3.0-only";
@@ -11218,12 +11233,12 @@ final: prev: {
 
   neoconf-nvim = buildVimPlugin {
     pname = "neoconf.nvim";
-    version = "1.4.0-unstable-2026-09-24";
+    version = "1.4.0-unstable-2026-09-28";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "neoconf.nvim";
-      rev = "03fad132dfb3f8a61b55b4731ee62d6fa7db9f2f";
-      hash = "sha256-JVprbeJUCAIXMw8vS5CW5qz0jR2DL5G/Fc9nYEfdUcM=";
+      rev = "4b39a6d9f2d3d481225eedcf85d04506e2cb997e";
+      hash = "sha256-iTBInA4dtl6aMioAxY2paZqV97jPYyi8hXX1N7SVkYY=";
     };
     meta.homepage = "https://github.com/folke/neoconf.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -11302,12 +11317,12 @@ final: prev: {
 
   neogit = buildVimPlugin {
     pname = "neogit";
-    version = "3.0.0-unstable-2026-08-22";
+    version = "3.0.0-unstable-2026-09-28";
     src = fetchFromGitHub {
       owner = "NeogitOrg";
       repo = "neogit";
-      rev = "5adc81b26232954cd7a90f158aa7844c18fc3165";
-      hash = "sha256-s0yrtTweFrrUsxVjLjr+1uNHTlhcxGI7JUvOkrpt13g=";
+      rev = "c51a1dc7e0e0f40c4c396a2b1ceaa44b44e96032";
+      hash = "sha256-ZAchwF5J+ftB5pk2Z+gBaNpNWMmT6wh/cf+z51vO6g0=";
     };
     meta.homepage = "https://github.com/NeogitOrg/neogit/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -12102,12 +12117,12 @@ final: prev: {
 
   nfnl = buildVimPlugin {
     pname = "nfnl";
-    version = "1.4.0-unstable-2026-08-14";
+    version = "1.4.0-unstable-2026-09-25";
     src = fetchFromGitHub {
       owner = "Olical";
       repo = "nfnl";
-      rev = "a4c47a1e7e52aaf234b358f73135acf783054e35";
-      hash = "sha256-AVxppifATGlZqtyOTuD6Ral4DcvVisbu1MAjdMlaExs=";
+      rev = "abf41f588ee6e3612816ec70402a4b182ddbbd51";
+      hash = "sha256-kx2Gto4x5fvEEhJ/oRcyJxDzePyAe4mH0zGXu0Qbd6M=";
     };
     meta.homepage = "https://github.com/Olical/nfnl/";
     meta.license = getLicenseFromSpdxId "Unlicense";
@@ -12283,12 +12298,12 @@ final: prev: {
 
   no-neck-pain-nvim = buildVimPlugin {
     pname = "no-neck-pain.nvim";
-    version = "3.0.1";
+    version = "3.0.4";
     src = fetchFromGitHub {
       owner = "shortcuts";
       repo = "no-neck-pain.nvim";
-      tag = "v3.0.1";
-      hash = "sha256-RUCBdraqR1M9iYIXR8Rwp/9jj2gSPSzucAUJi5aYEUU=";
+      tag = "v3.0.4";
+      hash = "sha256-QR4gLwkv1/DLxhoOGiqXfAzeRrjNQDioUaKrGPy5ffY=";
     };
     meta.homepage = "https://github.com/shortcuts/no-neck-pain.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -12437,12 +12452,12 @@ final: prev: {
 
   numb-nvim = buildVimPlugin {
     pname = "numb.nvim";
-    version = "1.2.1";
+    version = "1.3.0";
     src = fetchFromGitHub {
       owner = "nacro90";
       repo = "numb.nvim";
-      tag = "v1.2.1";
-      hash = "sha256-HlMAZhrM+HnMDwBqXhEjD26y0hkWq6orNDDuUMO0KGM=";
+      tag = "v1.3.0";
+      hash = "sha256-+3QZ4rjkDKdOGd1ck4U4oe4vHq2HTQyS7uuiqIlrrsA=";
     };
     meta.homepage = "https://github.com/nacro90/numb.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -13327,12 +13342,12 @@ final: prev: {
 
   nvim-lsp-file-operations = buildVimPlugin {
     pname = "nvim-lsp-file-operations";
-    version = "1.0.0";
+    version = "1.1.0";
     src = fetchFromGitHub {
       owner = "antosha417";
       repo = "nvim-lsp-file-operations";
-      tag = "v1.0.0";
-      hash = "sha256-FObv42EGkIao2Rmq9CG+G4JsntO+00CFNaNIXc7IK7A=";
+      tag = "v1.1.0";
+      hash = "sha256-8wEIGdxMvnlXhQcqKBl0AwINGzfJr5DiLwaOggrQBR8=";
     };
     meta.homepage = "https://github.com/antosha417/nvim-lsp-file-operations/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -13971,12 +13986,12 @@ final: prev: {
 
   nvim-treesitter = buildVimPlugin {
     pname = "nvim-treesitter";
-    version = "0.10.0-unstable-2026-09-19";
+    version = "0.10.0-unstable-2026-09-27";
     src = fetchFromGitHub {
       owner = "nvim-treesitter";
       repo = "nvim-treesitter";
-      rev = "f603a2f4da48728f80257fb5fbb90145fd1dc173";
-      hash = "sha256-fXBJhWvjzBGivIiAys9oy2JB9h99CNIk+AdGkGgHgPg=";
+      rev = "728e031f6b11d03d1f0708b7dc4fb0f1d9c8a137";
+      hash = "sha256-z6e3Dvp8TQDjTRglfVq0B+7Ejozwnw/zSvpGuSy6rbY=";
     };
     meta.homepage = "https://github.com/nvim-treesitter/nvim-treesitter/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -14377,12 +14392,12 @@ final: prev: {
 
   obsidian-nvim = buildVimPlugin {
     pname = "obsidian.nvim";
-    version = "3.16.7";
+    version = "3.16.8";
     src = fetchFromGitHub {
       owner = "obsidian-nvim";
       repo = "obsidian.nvim";
-      tag = "v3.16.7";
-      hash = "sha256-aOq0cg86hHgK4M/D1YCCyPNVusmsifUtxfAT9avhu7w=";
+      tag = "v3.16.8";
+      hash = "sha256-VQBopv4Lwjie5KyGD/n16V5fKmfn/PPRNBhoQ9E8/vI=";
     };
     meta.homepage = "https://github.com/obsidian-nvim/obsidian.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -15807,12 +15822,12 @@ final: prev: {
 
   remember-nvim = buildVimPlugin {
     pname = "remember.nvim";
-    version = "1.5.1";
+    version = "1.5.2";
     src = fetchFromGitHub {
       owner = "vladdoster";
       repo = "remember.nvim";
-      tag = "v1.5.1";
-      hash = "sha256-kJABTjY6p+wFlNZ9VLmK5LvusHcbD/0aaZP6yOpR1Zc=";
+      tag = "v1.5.2";
+      hash = "sha256-qZnSzOr6ImGZ6uiV4GQCQGUPsSxYHdjHlAlAjMz83sE=";
     };
     meta.homepage = "https://github.com/vladdoster/remember.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -16071,20 +16086,6 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
-  rust-tools-nvim = buildVimPlugin {
-    pname = "rust-tools.nvim";
-    version = "0-unstable-2024-01-03";
-    src = fetchFromGitHub {
-      owner = "simrat39";
-      repo = "rust-tools.nvim";
-      rev = "676187908a1ce35ffcd727c654ed68d851299d3e";
-      hash = "sha256-kFane5ze7VDiOzF7jdmXkr50XQsNvdb+a9HQtybEVE0=";
-    };
-    meta.homepage = "https://github.com/simrat39/rust-tools.nvim/";
-    meta.license = getLicenseFromSpdxId "MIT";
-    meta.hydraPlatforms = [ ];
-  };
-
   rust-vim = buildVimPlugin {
     pname = "rust.vim";
     version = "0-unstable-2022-11-27";
@@ -16564,12 +16565,12 @@ final: prev: {
 
   smear-cursor-nvim = buildVimPlugin {
     pname = "smear-cursor.nvim";
-    version = "0.6.1";
+    version = "0.6.2";
     src = fetchFromGitHub {
       owner = "sphamba";
       repo = "smear-cursor.nvim";
-      tag = "v0.6.1";
-      hash = "sha256-OVdgXkaj498iejXDuX00E9aAKCJuqb45oTUQh0+UOfU=";
+      tag = "v0.6.2";
+      hash = "sha256-PI83Zvgx90Fvd52Ng1pmB1kL7SGIkq7R/T1awCUqKdY=";
     };
     meta.homepage = "https://github.com/sphamba/smear-cursor.nvim/";
     meta.license = getLicenseFromSpdxId "GPL-3.0-only";
@@ -20857,12 +20858,12 @@ final: prev: {
 
   vim-emoji = buildVimPlugin {
     pname = "vim-emoji";
-    version = "0-unstable-2018-01-30";
+    version = "0-unstable-2026-09-26";
     src = fetchFromGitHub {
       owner = "junegunn";
       repo = "vim-emoji";
-      rev = "9ed6515401a6e20a9781ba508db7d67a5e4e231f";
-      hash = "sha256-3gdd2lFAMKJTqV9IV3CL7809RLkITa0Wi91dcMqvfC8=";
+      rev = "72c8bc4fe1a3a27e7a488a897b141599a6a7f385";
+      hash = "sha256-AMgSBJXk2PfRFoLH93Cpi73FzpMF7A7lTfDsQRToJtE=";
     };
     meta.homepage = "https://github.com/junegunn/vim-emoji/";
     meta.license = unfree;
@@ -24330,12 +24331,12 @@ final: prev: {
 
   vim-spirv = buildVimPlugin {
     pname = "vim-spirv";
-    version = "0.5.2-unstable-2026-09-19";
+    version = "0.5.2-unstable-2026-09-25";
     src = fetchFromGitHub {
       owner = "kbenzie";
       repo = "vim-spirv";
-      rev = "5b199dcd521795cf78f50574e8f5ec3b8bcc6c10";
-      hash = "sha256-9kdpolFI57NFcuHiX5FJvspDsUylO0YtXDewYPSsCCI=";
+      rev = "8543d5adb87eb173ec2dee6bb1ad6dbb011741c4";
+      hash = "sha256-AExOpjZ+aoGl8RxR+2mlPKjLJtpyKH8MrL1KIviMD1s=";
     };
     meta.homepage = "https://github.com/kbenzie/vim-spirv/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -26235,12 +26236,12 @@ final: prev: {
 
   yazi-nvim = buildVimPlugin {
     pname = "yazi.nvim";
-    version = "14.0.0";
+    version = "14.0.2";
     src = fetchFromGitHub {
       owner = "mikavilpas";
       repo = "yazi.nvim";
-      tag = "v14.0.0";
-      hash = "sha256-aCFCtSu7qD0HhNLS9o/W7vsh3EimQy6QcMtdXLPa5Zc=";
+      tag = "v14.0.2";
+      hash = "sha256-f+ymPNSEBkloZzgnpn6Zq3jkmuhzH8jPrGZB8tfxs78=";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/mikavilpas/yazi.nvim/";
diff --git a/pkgs/applications/editors/vim/plugins/non-generated/macaulay2/default.nix b/pkgs/applications/editors/vim/plugins/non-generated/macaulay2/default.nix
new file mode 100644
index 000000000000..ecf66cdd1c83
--- /dev/null
+++ b/pkgs/applications/editors/vim/plugins/non-generated/macaulay2/default.nix
@@ -0,0 +1,47 @@
+{
+  fetchFromGitHub,
+  lib,
+  vimUtils,
+  writableTmpDirAsHomeHook,
+  macaulay2,
+}:
+vimUtils.buildVimPlugin {
+  pname = "macaulay2";
+  inherit (macaulay2) version;
+
+  # we don't need the whole (rather large) repo
+  src = fetchFromGitHub {
+    inherit (macaulay2.src) repo owner tag;
+    rootDir = "M2/Macaulay2/editors/vim";
+    hash = "sha256-F/Vo8tOA/ZRczZJiUHY0Sr3ibRXHBLtqqSYIamqjk18=";
+  };
+
+  postPatch = ''
+    substituteInPlace "ftplugin/m2.vim" \
+      --replace-fail "'M2'" "'${lib.getExe macaulay2}'"
+  '';
+
+  nativeBuildInputs = [
+    writableTmpDirAsHomeHook
+  ];
+
+  buildPhase = ''
+    ${lib.getExe macaulay2} <<EOF
+      needsPackage "Style"
+      generateGrammar("dict/m2.vim.dict", demark_" ")
+      generateGrammar("syntax/m2.vim", demark_" ")
+    EOF
+  '';
+
+  meta = {
+    inherit (macaulay2.meta) maintainers platforms;
+    description = "Syntax highlighting and key mappings to send code to a running Macaulay2 session.";
+    homepage = "https://github.com/Macaulay2/M2/tree/stable/M2/Macaulay2/editors/vim";
+    license =
+      with lib.licenses;
+      OR [
+        publicDomain
+        gpl2Plus
+      ];
+  };
+}
diff --git a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
index b9f7aebd0bc1..e685a8ba94eb 100644
--- a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
@@ -786,12 +786,12 @@
     };
     fidl = buildGrammar {
       language = "fidl";
-      version = "0.0.0+rev=0a8910f";
+      version = "0.0.0+rev=3faeeae";
       src = fetchFromGitHub {
         owner = "google";
         repo = "tree-sitter-fidl";
-        rev = "0a8910f293268e27ff554357c229ba172b0eaed2";
-        hash = "sha256-QFAkxQo2w/+OR7nZn9ldBk2yHOd23kzciAcQvIZ5hrY=";
+        rev = "3faeeae0dbe66b54be0086daa0e0af4da44e7d68";
+        hash = "sha256-G2a0NGfMnY4e8WbH7QIiX4kaZ7G2Plzt2KO0HXf6vcQ=";
       };
       meta.homepage = "https://github.com/google/tree-sitter-fidl";
     };
@@ -1725,12 +1725,12 @@
     };
     ledger = buildGrammar {
       language = "ledger";
-      version = "0.0.0+rev=22a1ab8";
+      version = "0.0.0+rev=d5f3973";
       src = fetchFromGitHub {
         owner = "cbarrete";
         repo = "tree-sitter-ledger";
-        rev = "22a1ab8195c1f6e808679f803007756fe7638c6f";
-        hash = "sha256-62xgcEavI5RKi77sbEnx9f3hA4faFeUCw0/uec8Nx3k=";
+        rev = "d5f3973cfe2d42f98819336ce6334ada75b7696f";
+        hash = "sha256-+BgSLNGbtRsQZkw4gBe2K2pcGynDDv8bh9upN3lDPAg=";
       };
       meta.homepage = "https://github.com/cbarrete/tree-sitter-ledger";
     };
@@ -1769,12 +1769,12 @@
     };
     liquidsoap = buildGrammar {
       language = "liquidsoap";
-      version = "0.0.0+rev=301f669";
+      version = "0.0.0+rev=a094345";
       src = fetchFromGitHub {
         owner = "savonet";
         repo = "tree-sitter-liquidsoap";
-        rev = "301f66950622949f630fef9fa758ba69f66cf97a";
-        hash = "sha256-BPRaHi/TqU7s/XsrVz9+1aSfelmesOKr98ynELBgWM0=";
+        rev = "a094345ace46277b23dbcb81a5d8cd972df32183";
+        hash = "sha256-MtLdRTujZ/LOUkzcitgS0k8gIh08E14mWNFSFL61e/w=";
       };
       meta.homepage = "https://github.com/savonet/tree-sitter-liquidsoap";
     };
@@ -1931,12 +1931,12 @@
     };
     mlir = buildGrammar {
       language = "mlir";
-      version = "0.0.0+rev=eb0541b";
+      version = "0.0.0+rev=d93ac1b";
       src = fetchFromGitHub {
         owner = "artagnon";
         repo = "tree-sitter-mlir";
-        rev = "eb0541bba21c4ebb3661f02332d1f087d72dbc7c";
-        hash = "sha256-QQeii7jaaM0CtrFau50zMFkTsAxI4LhZRinvFYuy1ew=";
+        rev = "d93ac1b150580040d16e183ea8bf9daa7841bcc4";
+        hash = "sha256-yN+NJ1ZuoLKQHN/E9m59Ltv5BPqutxDFe2ZcJjVRwHE=";
       };
       generate = true;
       meta.homepage = "https://github.com/artagnon/tree-sitter-mlir";
@@ -2012,12 +2012,12 @@
     };
     nix = buildGrammar {
       language = "nix";
-      version = "0.0.0+rev=17f290c";
+      version = "0.0.0+rev=a2cd7f4";
       src = fetchFromGitHub {
         owner = "nix-community";
         repo = "tree-sitter-nix";
-        rev = "17f290c8b5104d9aba8a1ba7383a2ca83c3d14c4";
-        hash = "sha256-yWbf/Ms5y3x7qhpu2aGjX0R76Rzg3UH3nehHft2K87w=";
+        rev = "a2cd7f4011c6e5830c0c9af5aa35441b3ddd5fba";
+        hash = "sha256-IOanyzxBlLzlCOmLQa7hn+n1Yyc30upbmeuth7M4VcA=";
       };
       meta.homepage = "https://github.com/nix-community/tree-sitter-nix";
     };
@@ -2070,24 +2070,24 @@
     };
     ocaml = buildGrammar {
       language = "ocaml";
-      version = "0.0.0+rev=e3c9cf3";
+      version = "0.0.0+rev=3b2e14e";
       src = fetchFromGitHub {
         owner = "tree-sitter";
         repo = "tree-sitter-ocaml";
-        rev = "e3c9cf368f68bffd2f81188229aefa7b434eda65";
-        hash = "sha256-l2MTyECFscDh79fcCrz7WrJFok9WrXI2LgL+1Sc/pwk=";
+        rev = "3b2e14e0697d405c9aa0beddfa09b71f45abc504";
+        hash = "sha256-LCo26uRKZk0vnvkqXBpH1RofJXf16YfqMaBe0bfxyBY=";
       };
       location = "grammars/ocaml";
       meta.homepage = "https://github.com/tree-sitter/tree-sitter-ocaml";
     };
     ocaml_interface = buildGrammar {
       language = "ocaml_interface";
-      version = "0.0.0+rev=e3c9cf3";
+      version = "0.0.0+rev=3b2e14e";
       src = fetchFromGitHub {
         owner = "tree-sitter";
         repo = "tree-sitter-ocaml";
-        rev = "e3c9cf368f68bffd2f81188229aefa7b434eda65";
-        hash = "sha256-l2MTyECFscDh79fcCrz7WrJFok9WrXI2LgL+1Sc/pwk=";
+        rev = "3b2e14e0697d405c9aa0beddfa09b71f45abc504";
+        hash = "sha256-LCo26uRKZk0vnvkqXBpH1RofJXf16YfqMaBe0bfxyBY=";
       };
       location = "grammars/interface";
       passthru.requires = [
@@ -2097,12 +2097,12 @@
     };
     ocamllex = buildGrammar {
       language = "ocamllex";
-      version = "0.0.0+rev=33722b8";
+      version = "0.0.0+rev=64d543e";
       src = fetchFromGitHub {
         owner = "atom-ocaml";
         repo = "tree-sitter-ocamllex";
-        rev = "33722b8be73079946a7c6dd9598e3f57956ed36d";
-        hash = "sha256-mqp/qHr1zWMJinlMJ0HNAKuFUQ4NqQiLzKx0DoN4wGI=";
+        rev = "64d543e98b4092e2efe5d0c93d78ff4db9cbff39";
+        hash = "sha256-11fcvNtvz06HpkCe+Y37y8LhSgta9O5LSIB0sMKzOZg=";
       };
       generate = true;
       meta.homepage = "https://github.com/atom-ocaml/tree-sitter-ocamllex";
@@ -2165,12 +2165,12 @@
     };
     php = buildGrammar {
       language = "php";
-      version = "0.0.0+rev=3fda2fb";
+      version = "0.0.0+rev=92b5271";
       src = fetchFromGitHub {
         owner = "tree-sitter";
         repo = "tree-sitter-php";
-        rev = "3fda2fb9577166c6399834917f9844f30370beea";
-        hash = "sha256-JnDMQx4S3Z/BMuxa9Trv2pV9QQzpUoVLHzAGppuqbN4=";
+        rev = "92b5271b60bec77fb65b5e5bc41561e8dac81299";
+        hash = "sha256-EkKYb9jatSl0/o+7tO2O3vx44ufDmZ4YJ/6t4il/Yk0=";
       };
       location = "php";
       passthru.requires = [
@@ -2180,12 +2180,12 @@
     };
     php_only = buildGrammar {
       language = "php_only";
-      version = "0.0.0+rev=3fda2fb";
+      version = "0.0.0+rev=92b5271";
       src = fetchFromGitHub {
         owner = "tree-sitter";
         repo = "tree-sitter-php";
-        rev = "3fda2fb9577166c6399834917f9844f30370beea";
-        hash = "sha256-JnDMQx4S3Z/BMuxa9Trv2pV9QQzpUoVLHzAGppuqbN4=";
+        rev = "92b5271b60bec77fb65b5e5bc41561e8dac81299";
+        hash = "sha256-EkKYb9jatSl0/o+7tO2O3vx44ufDmZ4YJ/6t4il/Yk0=";
       };
       location = "php_only";
       meta.homepage = "https://github.com/tree-sitter/tree-sitter-php";
@@ -2214,12 +2214,12 @@
     };
     pkl = buildGrammar {
       language = "pkl";
-      version = "0.0.0+rev=9eaf196";
+      version = "0.0.0+rev=c95d828";
       src = fetchFromGitHub {
         owner = "apple";
         repo = "tree-sitter-pkl";
-        rev = "9eaf196bb1cb9ce862036ed28b188ab6664a2492";
-        hash = "sha256-BG7BLzUOepbhkCI30iCwpw126R7upNDX3wDWp+dvtvs=";
+        rev = "c95d8284940f5e1da2cd0d8f1ee45d7ef9ef75d1";
+        hash = "sha256-dnGqTZ7Kga1sIJkzRSbqkhvIrPJMxOEhHnDKJuLyudM=";
       };
       meta.homepage = "https://github.com/apple/tree-sitter-pkl";
     };
@@ -2325,12 +2325,12 @@
     };
     proto = buildGrammar {
       language = "proto";
-      version = "0.0.0+rev=6c878d1";
+      version = "0.0.0+rev=be5691c";
       src = fetchFromGitHub {
         owner = "coder3101";
         repo = "tree-sitter-proto";
-        rev = "6c878d18628ebbff3474479d2fdd6d8ba1954c3e";
-        hash = "sha256-N7GpIolkFkmVs1wLtx22HZ1+CmeXDSI2J1FmohtnY7M=";
+        rev = "be5691cf82ca284f83e68b9c8cdc4cac5d7fa208";
+        hash = "sha256-AdaEJPzekM5olFNrwqQXXnE1jvI/U2/zDgN8dyZbtnY=";
       };
       meta.homepage = "https://github.com/coder3101/tree-sitter-proto";
     };
@@ -2582,12 +2582,12 @@
     };
     rescript = buildGrammar {
       language = "rescript";
-      version = "0.0.0+rev=19ed8a8";
+      version = "0.0.0+rev=90643a6";
       src = fetchFromGitHub {
         owner = "rescript-lang";
         repo = "tree-sitter-rescript";
-        rev = "19ed8a8e6bcc844b71c37e9edaffc60c77f74d7c";
-        hash = "sha256-mQJSmb9Qy5pFS+nNz4+C7RPs1mpAoxxqbx7seYo8+JI=";
+        rev = "90643a6302057b969c51e1bf235b8ecf1da49232";
+        hash = "sha256-k510+GOLhputcgoo3l8JyoaI9IAtDw+aEKoPjMjRyWI=";
       };
       meta.homepage = "https://github.com/rescript-lang/tree-sitter-rescript";
     };
@@ -2725,12 +2725,12 @@
     };
     scheme = buildGrammar {
       language = "scheme";
-      version = "0.0.0+rev=c6cb7c7";
+      version = "0.0.0+rev=1b112d9";
       src = fetchFromGitHub {
         owner = "6cdh";
         repo = "tree-sitter-scheme";
-        rev = "c6cb7c7d7a04b3f5d999c28e2e9c0c31b2d50ece";
-        hash = "sha256-aFonUd15PJkQmz5lDJthtd1rU+8OXNknHDlgqH2s+OA=";
+        rev = "1b112d9571e4f62fb3d095d52a51f1da7756fb94";
+        hash = "sha256-7bMxrSeJpIIYkD8brP6oIW2F9ePYRsx1l2ZRfx6yGwM=";
       };
       meta.homepage = "https://github.com/6cdh/tree-sitter-scheme";
     };
@@ -2984,12 +2984,12 @@
     };
     superhtml = buildGrammar {
       language = "superhtml";
-      version = "0.0.0+rev=23ef2f4";
+      version = "0.0.0+rev=f0deee8";
       src = fetchFromGitHub {
         owner = "kristoff-it";
         repo = "superhtml";
-        rev = "23ef2f44ca0df2d2e05a0be3874370553c5b591d";
-        hash = "sha256-+M8eRsadeIQmW3pWTZ5WprJ1glQ18Pu8AgOeLvrLagY=";
+        rev = "f0deee80ae422938d5cdc43a5598c417670db38b";
+        hash = "sha256-xeM7uPqGVVuAHHwA94TOKrwpLbBH0Ruy2XnZsb35K54=";
       };
       location = "tree-sitter-superhtml";
       meta.homepage = "https://github.com/kristoff-it/superhtml";
@@ -3029,12 +3029,12 @@
     };
     swift = buildGrammar {
       language = "swift";
-      version = "0.0.0+rev=00bbb0a";
+      version = "0.0.0+rev=187fd4d";
       src = fetchFromGitHub {
         owner = "alex-pinkus";
         repo = "tree-sitter-swift";
-        rev = "00bbb0a2550f8bc0023a2a4992922d51ae045626";
-        hash = "sha256-1HZ6LNvBWUntNONR1aNxbN8zHsnLQisgh+k2Fp/XpXk=";
+        rev = "187fd4d3e55e2088da9cb31e414a2bac866292e8";
+        hash = "sha256-Qzl3rs1dOokT4gU14uaXCBG7RFgieoFWu24pEh8gPfU=";
       };
       generate = true;
       meta.homepage = "https://github.com/alex-pinkus/tree-sitter-swift";
@@ -3141,12 +3141,12 @@
     };
     tera = buildGrammar {
       language = "tera";
-      version = "0.0.0+rev=3a38c36";
+      version = "0.0.0+rev=54b3f8b";
       src = fetchFromGitHub {
         owner = "uncenter";
         repo = "tree-sitter-tera";
-        rev = "3a38c368e806268daac9923a27e72bcafbbc16bb";
-        hash = "sha256-JyH5iBaqW+qylqkZEN+JmG3NkMc5NKGwHp/xJ3NRR2Y=";
+        rev = "54b3f8b43aecdbcf12a7366920f0bc8274af1dd0";
+        hash = "sha256-lFNfLFLoRQwxzRfvnWaGSa1aUOgyIJcRBPkN60pZ8Kg=";
       };
       meta.homepage = "https://github.com/uncenter/tree-sitter-tera";
     };
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index 0d65ee512787..9094a4d71f80 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -4144,10 +4144,6 @@ assertNoAdditions {
     };
   });
 
-  rust-tools-nvim = super.rust-tools-nvim.overrideAttrs {
-    dependencies = [ self.nvim-lspconfig ];
-  };
-
   rustaceanvim = super.rustaceanvim.overrideAttrs {
     checkInputs = [
       # Optional integration
diff --git a/pkgs/applications/editors/vim/plugins/utils/build-vim-plugin.nix b/pkgs/applications/editors/vim/plugins/utils/build-vim-plugin.nix
index 9b426edb593e..1faf3bf64c02 100644
--- a/pkgs/applications/editors/vim/plugins/utils/build-vim-plugin.nix
+++ b/pkgs/applications/editors/vim/plugins/utils/build-vim-plugin.nix
@@ -43,7 +43,7 @@
 
             target=$out/${rtpPath}/${path}
             mkdir -p $out/${rtpPath}
-            cp -r . $target
+            ${lib.optionalString (!(attrs.dontUnpack or false)) "cp -r . $target"}
 
             runHook postInstall
           '';
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 772ea9f1a312..1437d8e4dbfc 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -379,6 +379,7 @@ https://github.com/barrettruth/diffs.nvim/,,
 https://github.com/dlyongemallo/diffview-plus.nvim/,,
 https://github.com/sindrets/diffview.nvim/,,
 https://github.com/elihunter173/dirbuf.nvim/,,
+https://github.com/NotAShelf/direnv.nvim/,,
 https://github.com/direnv/direnv.vim/,,
 https://github.com/chipsenkbeil/distant.nvim/,,
 https://github.com/doki-theme/doki-theme-vim/,,
@@ -592,7 +593,7 @@ https://github.com/HiPhish/jinja.vim/,,
 https://github.com/NicolasGB/jj.nvim/,,
 https://github.com/vito-c/jq.vim/,,
 https://github.com/neoclide/jsonc.vim/,,
-https://git.myzel394.app/Myzel394/jsonfly.nvim,,
+https://github.com/Myzel394/jsonfly.nvim/,,
 https://github.com/yannvanhalewyn/jujutsu.nvim/,,
 https://github.com/julelang/jule.nvim/,,
 https://github.com/JuliaEditorSupport/julia-vim/,,
@@ -1146,7 +1147,6 @@ https://github.com/keith/rspec.vim/,,
 https://github.com/ccarpita/rtorrent-syntax-file/,,
 https://codeberg.org/ssnoer/run.nvim,,
 https://github.com/TheLazyCat00/runner-nvim/,,
-https://github.com/simrat39/rust-tools.nvim/,,
 https://github.com/rust-lang/rust.vim/,,
 https://github.com/tris203/rzls.nvim/,,
 https://github.com/hauleth/sad.vim/,,
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index e9923dcadbcf..1f66d46837c3 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1776,8 +1776,8 @@ let
         mktplcRef = {
           name = "vscode-jest-runner";
           publisher = "firsttris";
-          version = "0.4.148";
-          hash = "sha256-bqyi1uk4Y1PMOjVv+io3WxJMrJb7UKy368xt6TiySPg=";
+          version = "0.4.149";
+          hash = "sha256-bGDU3/5Pysagt8aoEJJH6VVvR4Oy8IU12AmaAvnKnY8=";
         };
         meta = {
           description = "Simple way to run or debug a single (or multiple) tests from context-menu";
@@ -2047,8 +2047,8 @@ let
         mktplcRef = {
           name = "gitlab-workflow";
           publisher = "gitlab";
-          version = "6.90.3";
-          hash = "sha256-/6R/3FUXuvy836YeZSbw6HMrrIXdPbKqdNFBl4z36Y0=";
+          version = "6.92.0";
+          hash = "sha256-DR0g4aHAWePu46IHNPvxrFDBHoYmHMmiEm4z4AvB4mQ=";
         };
         meta = {
           description = "GitLab extension for Visual Studio Code";
diff --git a/pkgs/applications/editors/vscode/extensions/nomicfoundation.hardhat-solidity/default.nix b/pkgs/applications/editors/vscode/extensions/nomicfoundation.hardhat-solidity/default.nix
index dc2e3c526d28..1ec00e0ccc3e 100644
--- a/pkgs/applications/editors/vscode/extensions/nomicfoundation.hardhat-solidity/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/nomicfoundation.hardhat-solidity/default.nix
@@ -4,8 +4,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "hardhat-solidity";
     publisher = "nomicfoundation";
-    version = "0.9.1";
-    hash = "sha256-PlqYeUe6qbyP/ec2EwxG8Uxg6wmJhayUzt4HpInpLAg=";
+    version = "0.9.2";
+    hash = "sha256-iaTVu2IVPfprOf44OAhwFla5k6+WSYMFlagKkZCMhDw=";
   };
 
   meta = {
diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index 6bcce46df499..950ba1d311df 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -1,10 +1,10 @@
 {
   "chromium": {
-    "version": "154.0.8037.57",
+    "version": "154.0.8037.92",
     "chromedriver": {
-      "version": "154.0.8037.58",
-      "hash_darwin": "sha256-oMomlVZiLv+QQGHNq0Ao5tq++wCt1wAQmmddj0ARUKU=",
-      "hash_darwin_aarch64": "sha256-9Yy5BKjSdTr44fZp15lHPgXV9nMynXjF6Srw6CoAlAY="
+      "version": "154.0.8037.93",
+      "hash_darwin": "sha256-98b3h7D4+HHaZ7sLsr8v4Uv0xc3TqJLI2DWd8jchMCY=",
+      "hash_darwin_aarch64": "sha256-RVAlxmcKbxi7VPYXOwJlup3CLwLE/YPpISWDlaYQdPI="
     },
     "deps": {
       "depot_tools": {
@@ -21,8 +21,8 @@
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "73c14f6228d7cd537c855007e8f88678969cc0eb",
-        "hash": "sha256-LqS0Up2B1g7YWGx9N85hwMDQ2SktPjvxlJDfo8gxFOg=",
+        "rev": "334b65d254ccc35df4fca82706d1753227b01039",
+        "hash": "sha256-UtjuCxGPAHukLFqtwvyW7QRlOah4N1xJ5bHAT1hYUVA=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -92,8 +92,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "1ff8799c596d4fc9acea28343610b1f33650a6fa",
-        "hash": "sha256-aNsNXGV9V3tE9Xj0eb80EdPGi4gYJzmgQk3BIo/wxmY="
+        "rev": "802a8704ca940b633b731493ee192e0661eb8cdd",
+        "hash": "sha256-HqMu7GkWXTyIj/a4SY6f8x1wS/ficMQYyI/g0zuTlvM="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -132,8 +132,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "8597a1aaec546a7f19e8e662a49ebf03b2e91308",
-        "hash": "sha256-zCY7dE1C2PGb2pQ/H6oNGjpSHUhhRTfTFkAgdJm3efE="
+        "rev": "38bc7fb0b3a024d05212958ae843e4ddf8c44ff1",
+        "hash": "sha256-l1naz112kynSTtFsE0LrpLSzvdGLxJJ19UMNfHvUkmw="
       },
       "src/third_party/dawn/third_party/glfw3/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -847,8 +847,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "671f7c27ac0403ceb8074a8dfbcc02cdd7369c3f",
-        "hash": "sha256-0eEMZgbwW5edL4as79OibOVQidQL5rWYcGSdpq7ZPQo="
+        "rev": "31fac3bef58c3def36b0760e4ddc54ec77099596",
+        "hash": "sha256-hJfc8TsOIGi9pBXwDcxLoaO6RxczIn9mwYJAQoGBnI0="
       },
       "src/agents/shared": {
         "url": "https://chromium.googlesource.com/chromium/agents.git",
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 37a9c0e5cebc..47944ed054a2 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -218,13 +218,13 @@
     "vendorHash": "sha256-scHNFyHn4VYm8wtuBdVCpgKCzwPhzrC3KBs1YHXPwos="
   },
   "cloudflare_cloudflare": {
-    "hash": "sha256-F/Qkcu9XHxWrVbGVqWw2/AB1CDcY4hKm5cGDDtnsxP8=",
+    "hash": "sha256-cazO/sszoutiwMYjM709aHNzKIpOzZbB/5nHDEgbm08=",
     "homepage": "https://registry.terraform.io/providers/cloudflare/cloudflare",
     "owner": "cloudflare",
     "repo": "terraform-provider-cloudflare",
-    "rev": "v5.25.0",
+    "rev": "v5.26.0",
     "spdx": "Apache-2.0",
-    "vendorHash": "sha256-FGt4e+WyF5Wx3jw+U+L2kdybOnnAW/AA+mBeVbRQI0Y="
+    "vendorHash": "sha256-9blJRFzwwOcdFAB93C109qqXsh2tYft1bTOldvW0a/Y="
   },
   "cloudfoundry-community_cloudfoundry": {
     "hash": "sha256-1nYncJLVU/f9WD6Quh9IieIXgixPzbPk4zbtI1zmf9g=",
@@ -1148,13 +1148,13 @@
     "vendorHash": "sha256-6M6jTrukO0VhyZRdYbbICm22upbGyOkUSuHqMLTPcEM="
   },
   "rootlyhq_rootly": {
-    "hash": "sha256-bn5QMl+9okXzkfZDOdbYPpMs5x0JDL22cwW6AXFkE5A=",
+    "hash": "sha256-sWCG6mD7fYi2Yon5Wu/54+m+T8KcUYd38yDt8M3LS+E=",
     "homepage": "https://registry.terraform.io/providers/rootlyhq/rootly",
     "owner": "rootlyhq",
     "repo": "terraform-provider-rootly",
-    "rev": "v5.21.1",
+    "rev": "v5.23.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-2zHDQyIQQm9ySpPSjobQXTXFopT4290b1O0y+lvVD88="
+    "vendorHash": "sha256-Lusa+8VL8wQGIHYMiuiNTy4tqza4zO1A4ROpZ7X42KM="
   },
   "rundeck_rundeck": {
     "hash": "sha256-g8unbz8+UGLiAOJju6E2bLkygvZgHkv173PdMDefmrc=",
diff --git a/pkgs/by-name/aa/aarch64-esr-decoder/package.nix b/pkgs/by-name/aa/aarch64-esr-decoder/package.nix
index e19d6cda1acb..88cf4d355118 100644
--- a/pkgs/by-name/aa/aarch64-esr-decoder/package.nix
+++ b/pkgs/by-name/aa/aarch64-esr-decoder/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "aarch64-esr-decoder";
-  version = "0.2.4";
+  version = "0.2.5";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "aarch64-esr-decoder";
     tag = finalAttrs.version;
-    hash = "sha256-ZpSrz7iwwzNrK+bFTMn5MPx4Zjceao9NKhjAyjuPLWY=";
+    hash = "sha256-DO/MS/Mt5KBFEEQt9BuJHF1J9UWqDJ3eWKzsw3X75jc=";
   };
 
-  cargoHash = "sha256-xOBJ8QYiWu5vmkRpttN2CXCXi4bNj+qph31hSkDadjI=";
+  cargoHash = "sha256-pbBIvenBe0+tt3VPuoTtFTDFy6yO5bju0FS2hXJtGZU=";
 
   meta = {
     description = "Utility for decoding aarch64 ESR register values";
diff --git a/pkgs/by-name/ac/acme-sh/package.nix b/pkgs/by-name/ac/acme-sh/package.nix
index d3d79a5828f6..abf863117e55 100644
--- a/pkgs/by-name/ac/acme-sh/package.nix
+++ b/pkgs/by-name/ac/acme-sh/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "acme.sh";
-  version = "3.1.5";
+  version = "3.1.6";
 
   src = fetchFromGitHub {
     owner = "acmesh-official";
     repo = "acme.sh";
     tag = finalAttrs.version;
-    hash = "sha256-wybDNQ0shmRPvYpBkMWZA0UQjh866+yFclqyMAlNeiE=";
+    hash = "sha256-x7V4yIFODVH2H9cjH3xMi4dFrQUKeRJBM+ckpmnvD+0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ag/agentaps/package.nix b/pkgs/by-name/ag/agentaps/package.nix
new file mode 100644
index 000000000000..e7f88d07a8c3
--- /dev/null
+++ b/pkgs/by-name/ag/agentaps/package.nix
@@ -0,0 +1,89 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  fetchpatch,
+  git,
+  pkg-config,
+  makeWrapper,
+  versionCheckHook,
+  fontconfig,
+  freetype,
+  libGL,
+  libxcb,
+  libxkbcommon,
+  vulkan-loader,
+  wayland,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "agentaps";
+  version = "0.3.1";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "domenkozar";
+    repo = "agentaps";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-pHESE5ML5zeDylz07t8k1jJop/IGyIhTTffPN4dWrY0=";
+  };
+
+  cargoHash = "sha256-ko+ytnpQGLIA41+aurIcY5Rp0Aemf7Z4PFC5GdLFLvw=";
+
+  patches = [
+    # Add --version support until the next release.
+    (fetchpatch {
+      url = "https://github.com/domenkozar/agentaps/commit/1665c2792929226d675d427e0eef42cd3ede7a71.patch";
+      hash = "sha256-+wL5G6Ln9uuWxt2fRW2QPbD54Zif51hGxcNAC3Q3f84=";
+      includes = [ "src/main.rs" ];
+    })
+  ];
+
+  nativeBuildInputs = [
+    makeWrapper
+    pkg-config
+  ];
+
+  buildInputs = [
+    fontconfig
+    freetype
+    libGL
+    libxcb
+    libxkbcommon
+    vulkan-loader
+    wayland
+  ];
+
+  nativeCheckInputs = [ git ];
+
+  # The login shell test requires /bin/sh and /usr/bin/env, which are absent in the sandbox.
+  checkFlags = [ "--skip=shell_env::tests::reads_path_from_a_login_shell" ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  postFixup = ''
+    wrapProgram "$out/bin/agentaps" \
+      --suffix LD_LIBRARY_PATH : "${
+        lib.makeLibraryPath [
+          libGL
+          libxcb
+          libxkbcommon
+          vulkan-loader
+          wayland
+        ]
+      }"
+  '';
+
+  meta = {
+    description = "Desktop client for Agent Client Protocol agents";
+    homepage = "https://github.com/domenkozar/agentaps";
+    changelog = "https://github.com/domenkozar/agentaps/blob/v${finalAttrs.version}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    mainProgram = "agentaps";
+    maintainers = with lib.maintainers; [ domenkozar ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/ag/agentsploit/package.nix b/pkgs/by-name/ag/agentsploit/package.nix
index c4bdc75cd5ea..07a01380434c 100644
--- a/pkgs/by-name/ag/agentsploit/package.nix
+++ b/pkgs/by-name/ag/agentsploit/package.nix
@@ -63,6 +63,8 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   passthru.updateScript = nix-update-script { };
 
+  __darwinAllowLocalNetworking = true;
+
   meta = {
     description = "Offensive security framework for AI agents and MCP servers";
     homepage = "https://github.com/agentsploit/agentsploit";
diff --git a/pkgs/by-name/an/ansible-navigator/package.nix b/pkgs/by-name/an/ansible-navigator/package.nix
index 3d69e035e6ad..f48a06f7344b 100644
--- a/pkgs/by-name/an/ansible-navigator/package.nix
+++ b/pkgs/by-name/an/ansible-navigator/package.nix
@@ -8,13 +8,13 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "ansible-navigator";
-  version = "26.8.0";
+  version = "26.9.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) version;
     pname = "ansible_navigator";
-    hash = "sha256-V5UyoCrLr4iZvDeFQUIcXSxTWP1G3TmCJUdhWQIpn+Q=";
+    hash = "sha256-MLzoipI+LPjNmFAC56ITwr1iUuxJYmDaYlMUaw2hi5Y=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/as/aseprite/package.nix b/pkgs/by-name/as/aseprite/package.nix
index 836b169fad16..a04b5ccc69ad 100644
--- a/pkgs/by-name/as/aseprite/package.nix
+++ b/pkgs/by-name/as/aseprite/package.nix
@@ -34,21 +34,21 @@
 
 clangStdenv.mkDerivation (finalAttrs: {
   pname = "aseprite";
-  version = "1.3.18.5";
+  version = "1.3.18.6";
 
   src = fetchFromGitHub {
     owner = "aseprite";
     repo = "aseprite";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-8BLbAX+wif4vJySv11/NGzGrwRIsK3tvKhpkX2Zoci0=";
+    hash = "sha256-oeTO93T/BQcM0PkrFVMw+kLDG6w3uT2798Kzgua4gsE=";
   };
 
   asepriteStrings = fetchFromGitHub {
     owner = "aseprite";
     repo = "strings";
-    rev = "b43be33343efa40c1c4bda00f985b8cd83bddf2a";
-    hash = "sha256-JxNEtWnP3RtntXM3CmJLXyByW6dri98COp2O0A6ZwBA=";
+    rev = "c6a218e3629ab5c0924682425091be6dec87f489";
+    hash = "sha256-JAKKxkWXJGchPYyr504vQs7QqF4c2Q7RYqFJ/AhOw9A=";
   };
 
   # Translation files are copied without overwriting existing ones to preserve
diff --git a/pkgs/by-name/at/atmos/package.nix b/pkgs/by-name/at/atmos/package.nix
index 6789eebfc1fa..3a22a2c933ed 100644
--- a/pkgs/by-name/at/atmos/package.nix
+++ b/pkgs/by-name/at/atmos/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "atmos";
-  version = "1.229.0";
+  version = "1.230.0";
 
   src = fetchFromGitHub {
     owner = "cloudposse";
     repo = "atmos";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-N/IFSgMg1w1uH7p7TBahBpIHjSww0MZSEf5mt3r6DzQ=";
+    hash = "sha256-2iyRkQQ+NKER60jBiGrcq+QKBO8+pt3nfHm9Tn3e+iU=";
   };
 
   vendorHash = "sha256-J5TNPXzEz4gaNi2mEqkQ+t1JzmocbRRLwUwzLgAZU40=";
diff --git a/pkgs/by-name/au/audiobookshelf/client.nix b/pkgs/by-name/au/audiobookshelf/client.nix
new file mode 100644
index 000000000000..92d4469d7231
--- /dev/null
+++ b/pkgs/by-name/au/audiobookshelf/client.nix
@@ -0,0 +1,23 @@
+{
+  src,
+  version,
+
+  buildNpmPackage,
+  nodejs,
+}:
+buildNpmPackage {
+  pname = "audiobookshelf-client";
+  inherit version nodejs;
+
+  src = "${src}/client";
+
+  npmDepsHash = "sha256-l7vdcggcVs9LYQ7DLumUUh67lxZ5giVMrtwUU6prfwI=";
+
+  env = {
+    # don't download the Cypress binary
+    CYPRESS_INSTALL_BINARY = 0;
+    NODE_OPTIONS = "--openssl-legacy-provider";
+  };
+
+  npmBuildScript = "generate";
+}
diff --git a/pkgs/by-name/au/audiobookshelf/package.nix b/pkgs/by-name/au/audiobookshelf/package.nix
index 6126e97ee04d..541bc7c82941 100644
--- a/pkgs/by-name/au/audiobookshelf/package.nix
+++ b/pkgs/by-name/au/audiobookshelf/package.nix
@@ -2,51 +2,21 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  runCommand,
   buildNpmPackage,
-  nodejs_22,
+  callPackage,
+  nodejs_24,
   ffmpeg_8-full,
   nunicode,
   util-linux,
   python3,
   getopt,
   nixosTests,
+  nix-update-script,
 }:
 
 let
   ffmpeg-full = ffmpeg_8-full;
-
-  source = {
-    version = "2.36.1";
-    hash = "sha256-HBaTTfZEbhR2n/XafScZB/gX29erTQHZ+IdErwhA11A=";
-    npmDepsHash = "sha256-kp0LbSKaHTBppeyfLAFrGYnSWS3V2trO5yaZWoxVPo8=";
-    clientNpmDepsHash = "sha256-g3Y/4UU2YH/CeU8Z/NNkLP0OTeBM+4/rQfL406uVdio=";
-  };
-
-  src = fetchFromGitHub {
-    owner = "advplyr";
-    repo = "audiobookshelf";
-    tag = "v${source.version}";
-    inherit (source) hash;
-  };
-
-  client = buildNpmPackage {
-    pname = "audiobookshelf-client";
-    inherit (source) version;
-
-    nodejs = nodejs_22;
-
-    src = runCommand "cp-source" { } ''
-      cp -r ${src}/client $out
-    '';
-
-    # don't download the Cypress binary
-    CYPRESS_INSTALL_BINARY = 0;
-    NODE_OPTIONS = "--openssl-legacy-provider";
-
-    npmBuildScript = "generate";
-    npmDepsHash = source.clientNpmDepsHash;
-  };
+  nodejs = nodejs_24;
 
   wrapper = import ./wrapper.nix {
     inherit
@@ -56,14 +26,21 @@ let
       getopt
       ;
   };
-
 in
-buildNpmPackage {
+buildNpmPackage (finalAttrs: {
   pname = "audiobookshelf";
+  version = "2.37.0";
 
-  inherit src;
-  inherit (source) npmDepsHash version;
-  nodejs = nodejs_22;
+  src = fetchFromGitHub {
+    owner = "advplyr";
+    repo = "audiobookshelf";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-zo9xByg1QMdqfy161rnmfJ0Mt5CJvKbZIMijj2kQpQM=";
+  };
+
+  npmDepsHash = "sha256-S9RGAc5ge+ULtRMbiY1ZOaxY5Ra2ltZdCHcGbkhUxzs=";
+
+  inherit nodejs;
 
   buildInputs = [ util-linux ];
   nativeBuildInputs = [ python3 ];
@@ -71,16 +48,18 @@ buildNpmPackage {
   dontNpmBuild = true;
   npmInstallFlags = [ "--only-production" ];
 
+  client = callPackage ./client.nix { inherit (finalAttrs) src version nodejs; };
+
   installPhase = ''
     runHook preInstall
 
     mkdir -p $out/opt/client
     cp -r index.js server package* node_modules $out/opt/
-    cp -r ${client}/lib/node_modules/audiobookshelf-client/dist $out/opt/client/dist
+    cp -r ${finalAttrs.client}/lib/node_modules/audiobookshelf-client/dist $out/opt/client/dist
     mkdir $out/bin
 
     echo '${wrapper}' > $out/bin/audiobookshelf
-    echo "  exec ${nodejs_22}/bin/node $out/opt/index.js" >> $out/bin/audiobookshelf
+    echo "  exec ${finalAttrs.nodejs}/bin/node $out/opt/index.js" >> $out/bin/audiobookshelf
 
     chmod +x $out/bin/audiobookshelf
 
@@ -89,13 +68,13 @@ buildNpmPackage {
 
   passthru = {
     tests.basic = nixosTests.audiobookshelf;
-    updateScript = ./update.sh;
+    updateScript = nix-update-script { extraArgs = [ "--subpackage=client" ]; };
   };
 
   meta = {
     homepage = "https://www.audiobookshelf.org/";
     description = "Self-hosted audiobook and podcast server";
-    changelog = "https://github.com/advplyr/audiobookshelf/releases/tag/v${source.version}";
+    changelog = "https://github.com/advplyr/audiobookshelf/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.gpl3;
     maintainers = with lib.maintainers; [
       jvanbruegge
@@ -105,4 +84,4 @@ buildNpmPackage {
     platforms = lib.platforms.linux;
     mainProgram = "audiobookshelf";
   };
-}
+})
diff --git a/pkgs/by-name/au/audiobookshelf/update.sh b/pkgs/by-name/au/audiobookshelf/update.sh
deleted file mode 100755
index b59b186f9c65..000000000000
--- a/pkgs/by-name/au/audiobookshelf/update.sh
+++ /dev/null
@@ -1,42 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl gnused nix-prefetch-git common-updater-scripts jq prefetch-npm-deps ripgrep
-
-set -euo pipefail
-
-ROOT="$(dirname "$(readlink -f "$0")")"
-NIX_DRV="$ROOT/package.nix"
-if [ ! -f "$NIX_DRV" ]; then
-  echo "ERROR: cannot find package.nix in $ROOT"
-  exit 1
-fi
-
-REPO="advplyr/audiobookshelf"
-
-NEW_VER=$(list-git-tags --url=https://github.com/$REPO | rg 'v[0-9\.]*$' | sed -e 's/^v//' | sort -V | tail -n 1)
-OLD_VER=$(nix-instantiate --eval --raw -A audiobookshelf.version)
-
-if [ "$NEW_VER" == "$OLD_VER" ]; then
-  echo "No update needed."
-  exit 0
-fi
-
-replace_hash() {
-  sed -i "s#$1 = \"sha256-.\{44\}\"#$1 = \"$2\"#" "$NIX_DRV"
-}
-
-get_npm_hash() {
-  pushd "$(mktemp -d)" >/dev/null
-  curl -s "https://raw.githubusercontent.com/$REPO/v$NEW_VER/$1" -o package-lock.json
-  prefetch-npm-deps package-lock.json
-  rm -f package-lock.json
-  popd >/dev/null
-}
-
-src_hash() {
-  nix-prefetch-git --url https://github.com/$REPO --rev "refs/tags/v${NEW_VER}" | jq --exit-status --raw-output .hash
-}
-
-sed -i "s/version = \".*\"/version = \"$NEW_VER\"/" "$NIX_DRV"
-replace_hash "hash" "$(src_hash)"
-replace_hash "npmDepsHash" "$(get_npm_hash "package-lock.json")"
-replace_hash "clientNpmDepsHash" "$(get_npm_hash "client/package-lock.json")"
diff --git a/pkgs/by-name/ba/babashka-unwrapped/package.nix b/pkgs/by-name/ba/babashka-unwrapped/package.nix
index db741db7ab61..5b127dce018d 100644
--- a/pkgs/by-name/ba/babashka-unwrapped/package.nix
+++ b/pkgs/by-name/ba/babashka-unwrapped/package.nix
@@ -10,11 +10,11 @@
 
 buildGraalvmNativeImage (finalAttrs: {
   pname = "babashka-unwrapped";
-  version = "1.13.220";
+  version = "1.13.223";
 
   src = fetchurl {
     url = "https://github.com/babashka/babashka/releases/download/v${finalAttrs.version}/babashka-${finalAttrs.version}-standalone.jar";
-    sha256 = "sha256-0fpvbrEJU89mMo9A9IM7kAqiGCdnexrEslGtjt+iBxg=";
+    sha256 = "sha256-DaDYD5pCV05/UwRre5xRxc2dAZJqkc1snKzEOTmM+Rs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ba/babashka/clojure-tools.nix b/pkgs/by-name/ba/babashka/clojure-tools.nix
index eb35f8d1c2bb..7941aaafe7d0 100644
--- a/pkgs/by-name/ba/babashka/clojure-tools.nix
+++ b/pkgs/by-name/ba/babashka/clojure-tools.nix
@@ -7,10 +7,10 @@
 }:
 clojure.overrideAttrs (previousAttrs: {
   pname = "babashka-clojure-tools";
-  version = "1.12.5.1664";
+  version = "1.12.6.1673";
 
   src = fetchurl {
     url = previousAttrs.src.url;
-    hash = "sha256-d91oaJSAdK3Mk+g6eW+OjxWhqSvLG5AC1xX9IhDkdvM=";
+    hash = "sha256-/pGUhY511a8TwuKv+S1xBnTVvFEF8rQvkKfZTYLsAjw=";
   };
 })
diff --git a/pkgs/by-name/ba/balena-compose-parser/package.nix b/pkgs/by-name/ba/balena-compose-parser/package.nix
index 211ab2b2b193..b6f258e94e98 100644
--- a/pkgs/by-name/ba/balena-compose-parser/package.nix
+++ b/pkgs/by-name/ba/balena-compose-parser/package.nix
@@ -6,13 +6,13 @@
 buildGoModule rec {
   __structuredAttrs = true;
   pname = "balena-compose-parser";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "balena-io-modules";
     repo = "balena-compose-parser";
     rev = "v${version}";
-    hash = "sha256-fEvLu2xZlYoILM4DThiSQHG2gbGOB5IQVgmwcLKsKwo=";
+    hash = "sha256-agZQjtkXBVMk7UAcQXPa7cRBq/H2uyCE5AC9hEfSWDM=";
   };
 
   modRoot = "lib";
diff --git a/pkgs/by-name/ca/capa/package.nix b/pkgs/by-name/ca/capa/package.nix
index fad27bfb2801..f9b436fcaf4b 100644
--- a/pkgs/by-name/ca/capa/package.nix
+++ b/pkgs/by-name/ca/capa/package.nix
@@ -1 +1 @@
-{ python3Packages }: with python3Packages; toPythonApplication capa
+{ python3Packages }: with python3Packages; toPythonApplication flare-capa
diff --git a/pkgs/by-name/ce/certigo/package.nix b/pkgs/by-name/ce/certigo/package.nix
index 8b48559cb5be..e935b739957f 100644
--- a/pkgs/by-name/ce/certigo/package.nix
+++ b/pkgs/by-name/ce/certigo/package.nix
@@ -6,20 +6,21 @@
 
 buildGoModule (finalAttrs: {
   pname = "certigo";
-  version = "1.18.0";
+  version = "1.18.1";
 
   src = fetchFromGitHub {
     owner = "square";
     repo = "certigo";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-U+VbtY34lxLBHWI1BjkPxzSS6q41R9DQkGvDvSDX9WY=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Y2m+uO/jxwWdutry859Y6IdNJpXjjkrlJ+LJrjS616Y=";
   };
 
-  vendorHash = "sha256-5DpgOb0YxZ/os23y+siCB73dUwutxXIW5RlCZqdbxao=";
+  vendorHash = "sha256-u10YSa2xFswJk/2iC7eyfQ51oTaa30/6JA5aLk5021k=";
 
   meta = {
     description = "Utility to examine and validate certificates in a variety of formats";
     homepage = "https://github.com/square/certigo";
+    changelog = "https://github.com/square/certigo/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = [ ];
     mainProgram = "certigo";
diff --git a/pkgs/by-name/ch/cht-sh/package.nix b/pkgs/by-name/ch/cht-sh/package.nix
index 994885f42358..a6d6b68164d6 100644
--- a/pkgs/by-name/ch/cht-sh/package.nix
+++ b/pkgs/by-name/ch/cht-sh/package.nix
@@ -12,15 +12,15 @@
 
 stdenv.mkDerivation {
   pname = "cht.sh";
-  version = "0-unstable-2025-12-23";
+  version = "0-unstable-2026-09-22";
 
   nativeBuildInputs = [ makeWrapper ];
 
   src = fetchFromGitHub {
     owner = "chubin";
     repo = "cheat.sh";
-    rev = "031a5d3887f035aaa3bf1a3f83dff4fde2aac53d";
-    sha256 = "T6v58bmdA3EvC4QUgCR+FJLonN3QdHpkdvNGauq/i5Q=";
+    rev = "06af0000259bde1a347da368225c5962d7ffed3e";
+    sha256 = "v9NpTSBMAYIt14jSAQJQAUsBUvVjRQDo6VUc2p1lwBE=";
   };
 
   # Fix ".cht.sh-wrapped" in the help message
diff --git a/pkgs/by-name/ci/ciphey/package.nix b/pkgs/by-name/ci/ciphey/package.nix
new file mode 100644
index 000000000000..c95df89ebfa4
--- /dev/null
+++ b/pkgs/by-name/ci/ciphey/package.nix
@@ -0,0 +1,66 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  nix-update-script,
+  oniguruma,
+  openssl,
+  pkg-config,
+  rustPlatform,
+  sqlite,
+  writableTmpDirAsHomeHook,
+  zstd,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "ciphey";
+  version = "0.12.1";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "bee-san";
+    repo = "Ciphey";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-jaI++uyAHXbx/o0qqbrDtVQbYjffecfKXAb4NCSXIRU=";
+  };
+
+  # cargo-nextest is only used as the upstream test runner. It is not needed
+  # by the test suite itself, and its nextest-runner dependency pulls in usdt,
+  # which fails to build on Darwin.
+  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    substituteInPlace Cargo.toml \
+      --replace-fail 'cargo-nextest = "0.9.117"' ""
+  '';
+
+  cargoHash = "sha256-Kn2lHsw4SGV8kE6AxjryL+To9OMq5loUE7GCndVbyWI=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    oniguruma
+    openssl
+    sqlite
+    zstd
+  ];
+
+  env = {
+    LIBSQLITE3_SYS_USE_PKG_CONFIG = true;
+    RUSTONIG_SYSTEM_LIBONIG = true;
+    ZSTD_SYS_USE_PKG_CONFIG = true;
+  };
+
+  nativeCheckInputs = [ writableTmpDirAsHomeHook ];
+
+  passthru.updateScript = nix-update-script { };
+
+  __darwinAllowLocalNetworking = true;
+
+  meta = {
+    description = "Tool to automatically decrypt encryptions or hashes";
+    homepage = "https://github.com/bee-san/Ciphey";
+    changelog = "https://github.com/bee-san/Ciphey/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "ciphey";
+  };
+})
diff --git a/pkgs/by-name/ci/circup/package.nix b/pkgs/by-name/ci/circup/package.nix
index f4b0917e23ec..1059c9c3e6ed 100644
--- a/pkgs/by-name/ci/circup/package.nix
+++ b/pkgs/by-name/ci/circup/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "circup";
-  version = "3.0.4";
+  version = "3.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "adafruit";
     repo = "circup";
     tag = finalAttrs.version;
-    hash = "sha256-sv+ixo5S9JRuVu8JkKt29Kpn1ioRIwGW4Ss/A77YiFU=";
+    hash = "sha256-+/1lL5mVeVPFFLitLYIGzSxmnoizNxjb6+MYWreSijw=";
   };
 
   pythonRelaxDeps = [ "semver" ];
diff --git a/pkgs/by-name/cl/cloudfoundry-cli/package.nix b/pkgs/by-name/cl/cloudfoundry-cli/package.nix
index fa1c9634b4db..415dba74842e 100644
--- a/pkgs/by-name/cl/cloudfoundry-cli/package.nix
+++ b/pkgs/by-name/cl/cloudfoundry-cli/package.nix
@@ -4,6 +4,8 @@
   fetchFromGitHub,
   fetchurl,
   installShellFiles,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
 }:
 
 buildGoModule (finalAttrs: {
@@ -32,8 +34,9 @@ buildGoModule (finalAttrs: {
   ldflags = [
     "-s"
     "-w"
-    "-X code.cloudfoundry.org/cli/version.binaryBuildDate=1970-01-01"
-    "-X code.cloudfoundry.org/cli/version.binaryVersion=${finalAttrs.version}"
+    "-X code.cloudfoundry.org/cli/v8/version.binaryBuildDate=1970-01-01"
+    "-X code.cloudfoundry.org/cli/v8/version.binaryVersion=${finalAttrs.version}"
+    "-X code.cloudfoundry.org/cli/v8/version.binarySHA=${finalAttrs.src.rev}"
   ];
 
   postInstall = ''
@@ -41,6 +44,15 @@ buildGoModule (finalAttrs: {
     installShellCompletion --bash $bashCompletionScript
   '';
 
+  doInstallCheck = true;
+
+  versionCheckKeepEnvironment = [ "HOME" ];
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
+  ];
+
   meta = {
     description = "Official command line client for Cloud Foundry";
     homepage = "https://github.com/cloudfoundry/cli";
diff --git a/pkgs/by-name/co/codex-acp/package.nix b/pkgs/by-name/co/codex-acp/package.nix
index e521bc061e8e..f5d13b5b1e14 100644
--- a/pkgs/by-name/co/codex-acp/package.nix
+++ b/pkgs/by-name/co/codex-acp/package.nix
@@ -10,16 +10,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "codex-acp";
-  version = "1.12.0";
+  version = "1.13.1";
 
   src = fetchFromGitHub {
     owner = "agentclientprotocol";
     repo = "codex-acp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GIMJm+kifPEMb7XLPSssUu87eEE+aaBr2jZUk8aPD2s=";
+    hash = "sha256-lVsj8RqE8XwCblOBSk3B4Nckx4h1o1BHMRrmpkhrIEw=";
   };
 
-  npmDepsHash = "sha256-BeRj6LpIpGV4ONEHE//nYXTfkB1nfVQpPeJF3LRlyRM=";
+  npmDepsHash = "sha256-jXXvfg2bPZlvkNBZUw3ptpoOy9wOcvl2B8J0HnpX79c=";
 
   nativeBuildInputs = [ makeBinaryWrapper ];
 
diff --git a/pkgs/by-name/co/codex/package.nix b/pkgs/by-name/co/codex/package.nix
index 06998cd9229f..643f3d395853 100644
--- a/pkgs/by-name/co/codex/package.nix
+++ b/pkgs/by-name/co/codex/package.nix
@@ -29,18 +29,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "codex";
-  version = "0.158.0";
+  version = "0.159.1";
 
   src = fetchFromGitHub {
     owner = "openai";
     repo = "codex";
     tag = "rust-v${finalAttrs.version}";
-    hash = "sha256-6ogqs75pG4+hxG6RqwBwJPWd3wGks2wBID/epha9+Ds=";
+    hash = "sha256-74sN8GM4W+u8bMxOenSp9tmIDqAtrABCmU5J8IsqZWA=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/codex-rs";
 
-  cargoHash = "sha256-D8+caV6Q9H2JnZNhazV1kqgV0dePh3qQyXnRMgeSYak=";
+  cargoHash = "sha256-3X4gmzAZG10DDcI667k9Zf+r3IvzeAAWD1NbTdQZyGY=";
 
   __structuredAttrs = true;
 
diff --git a/pkgs/by-name/co/compress-pptx/package.nix b/pkgs/by-name/co/compress-pptx/package.nix
index de14932e44a8..603c87380094 100644
--- a/pkgs/by-name/co/compress-pptx/package.nix
+++ b/pkgs/by-name/co/compress-pptx/package.nix
@@ -11,14 +11,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "compress-pptx";
-  version = "1.3.1";
+  version = "1.3.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "slhck";
     repo = "compress-pptx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+67EdAEWsRY11Pkie6AOz7Sl7MSTMGxZoQYS+M2x07Y=";
+    hash = "sha256-DTN/R8ioSp63txLB4ac8P0k3CXQN1ikr9qgYeP2dQSM=";
   };
 
   patches = [
diff --git a/pkgs/by-name/co/cook-cli/package.nix b/pkgs/by-name/co/cook-cli/package.nix
index bc2241469da7..38cf3ca4e31d 100644
--- a/pkgs/by-name/co/cook-cli/package.nix
+++ b/pkgs/by-name/co/cook-cli/package.nix
@@ -11,16 +11,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cook-cli";
-  version = "0.36.0";
+  version = "0.37.0";
 
   src = fetchFromGitHub {
     owner = "cooklang";
     repo = "cookcli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ihsVvlyp//A4pNlt1+DlYWyz52enHVeU6uST7bxcwqw=";
+    hash = "sha256-tHPVKigUqHZo84E+2wnky21UQfE7bQ1ZB1vZZNPlm7E=";
   };
 
-  cargoHash = "sha256-e47x9XzABpXO+qvTydrBOPU9KTZTYJkbJvWvpUUh7Bo=";
+  cargoHash = "sha256-DOXHQMYWyuArVwS+odyjImGCfzS4flNZM7NRSnLkLfc=";
 
   # Build without the self-updating feature
   buildNoDefaultFeatures = true;
diff --git a/pkgs/by-name/co/copilot-language-server/package.nix b/pkgs/by-name/co/copilot-language-server/package.nix
index 9b8a3c25a982..f3c3afdf4874 100644
--- a/pkgs/by-name/co/copilot-language-server/package.nix
+++ b/pkgs/by-name/co/copilot-language-server/package.nix
@@ -13,14 +13,14 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "copilot-language-server";
-  version = "1.547.0";
+  version = "1.551.2";
 
   strictDeps = true;
   __structuredAttrs = true;
 
   src = fetchzip {
     url = "https://github.com/github/copilot-language-server-release/releases/download/${finalAttrs.version}/copilot-language-server-js-${finalAttrs.version}.zip";
-    hash = "sha256-JFAv+Trz8XUuk9x9ZXWINdfrZ8Mglwjy8ay/EX0gOPo=";
+    hash = "sha256-wDV1F8rzO49sp2XxcZdvwyWKSzu+2CWahZ2kLoVoGRE=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/co/copybara/package.nix b/pkgs/by-name/co/copybara/package.nix
index 26eff83c1435..77ba28ff559a 100644
--- a/pkgs/by-name/co/copybara/package.nix
+++ b/pkgs/by-name/co/copybara/package.nix
@@ -2,13 +2,14 @@
   lib,
   stdenv,
   fetchurl,
-  jdk21_headless,
+  jdk25_headless,
   makeWrapper,
   git,
   gnused,
   gnugrep,
   gawk,
   which,
+  versionCheckHook,
   nix-update-script,
 }:
 stdenv.mkDerivation (finalAttrs: {
@@ -24,10 +25,6 @@ stdenv.mkDerivation (finalAttrs: {
     makeWrapper
   ];
 
-  buildInputs = [
-    jdk21_headless
-  ];
-
   runtimeDeps = [
     git
     gnused
@@ -45,13 +42,17 @@ stdenv.mkDerivation (finalAttrs: {
     cp $src $out/share/java/copybara.jar
 
     mkdir -p $out/bin
-    makeWrapper ${jdk21_headless}/bin/java $out/bin/copybara \
+    makeWrapper ${jdk25_headless}/bin/java $out/bin/copybara \
       --add-flags "-jar $out/share/java/copybara.jar" \
       --prefix PATH : ${lib.makeBinPath finalAttrs.runtimeDeps}
 
     runHook postInstall
   '';
 
+  doInstallCheck = !stdenv.hostPlatform.isDarwin;
+  versionCheckProgramArg = "version";
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
   passthru.updateScript = nix-update-script { };
 
   meta = {
@@ -69,8 +70,8 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/google/copybara";
     changelog = "https://github.com/google/copybara/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.asl20;
-    maintainers = [ ];
-    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ shinbunbun ];
+    inherit (jdk25_headless.meta) platforms;
     mainProgram = "copybara";
     sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
   };
diff --git a/pkgs/by-name/db/dbcsr/package.nix b/pkgs/by-name/db/dbcsr/package.nix
index 8024f9c45ea4..0520eb4ce21d 100644
--- a/pkgs/by-name/db/dbcsr/package.nix
+++ b/pkgs/by-name/db/dbcsr/package.nix
@@ -1,41 +1,69 @@
 {
-  stdenv,
   lib,
+  stdenv,
   fetchFromGitHub,
+  fetchpatch,
+
+  # nativeBuildInputs
   cmake,
-  mpiCheckPhaseHook,
-  pkg-config,
   fypp,
   gfortran,
+  mpi,
+  pkg-config,
+  python3,
+
+  # buildInputs
   blas,
   lapack,
-  python3,
   libxsmm,
-  mpi,
+
+  # nativeCheckInputs
+  mpiCheckPhaseHook,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dbcsr";
   version = "2.10.0";
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   src = fetchFromGitHub {
     owner = "cp2k";
     repo = "dbcsr";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-BgZmc81TzgU3ifv4RHh2pfjbkUyxMIIpBrHCtnLF3p0=";
   };
 
+  patches = [
+    # Explicitly export the C API symbols, otherwise hidden with GCC 16
+    # https://github.com/cp2k/dbcsr/pull/1027
+    (fetchpatch {
+      name = "expose-c-api-procedures.patch";
+      url = "https://github.com/cp2k/dbcsr/commit/a5d9bcfcd487e3181b981687334da1b89bc61dce.patch";
+      hash = "sha256-a4glOtMx1EUzYdoQb66bZaRnCgatVFWTqvcQlvU3oIc=";
+    })
+  ];
+
   postPatch = ''
     patchShebangs .
-
-    # Force build of shared library, otherwise just static.
+  ''
+  # Force build of shared library, otherwise just static.
+  + ''
     substituteInPlace src/CMakeLists.txt \
-      --replace 'add_library(dbcsr ''${DBCSR_SRCS})' 'add_library(dbcsr SHARED ''${DBCSR_SRCS})' \
-      --replace 'add_library(dbcsr_c ''${DBCSR_C_SRCS})' 'add_library(dbcsr_c SHARED ''${DBCSR_C_SRCS})'
-
-    # Avoid calling the fypp wrapper script with python again. The nix wrapper took care of that.
+      --replace-fail \
+        'add_library(dbcsr ''${DBCSR_SRCS})' \
+        'add_library(dbcsr SHARED ''${DBCSR_SRCS})' \
+      --replace-fail \
+        'add_library(dbcsr_c ''${DBCSR_C_SRCS})' \
+        'add_library(dbcsr_c SHARED ''${DBCSR_C_SRCS})'
+  ''
+  # Avoid calling the fypp wrapper script with python again. The nix wrapper took care of that.
+  + ''
     substituteInPlace cmake/fypp-sources.cmake \
-      --replace 'COMMAND ''${Python_EXECUTABLE} ''${FYPP_EXECUTABLE}' 'COMMAND ''${FYPP_EXECUTABLE}'
+      --replace-fail \
+        'COMMAND ''${Python_EXECUTABLE} ''${FYPP_EXECUTABLE}' \
+        'COMMAND ''${FYPP_EXECUTABLE}'
   '';
 
   outputs = [
@@ -44,11 +72,12 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   nativeBuildInputs = [
-    gfortran
-    python3
     cmake
-    pkg-config
     fypp
+    gfortran
+    mpi
+    pkg-config
+    python3
   ];
 
   buildInputs = [
@@ -60,17 +89,17 @@ stdenv.mkDerivation (finalAttrs: {
   propagatedBuildInputs = [ mpi ];
 
   cmakeFlags = [
-    "-DUSE_OPENMP=ON"
-    "-DUSE_SMM=libxsmm"
-    "-DWITH_C_API=ON"
-    "-DBUILD_TESTING=ON"
-    "-DTEST_OMP_THREADS=2"
-    "-DTEST_MPI_RANKS=2"
-    "-DENABLE_SHARED=ON"
-    "-DUSE_MPI=ON"
+    (lib.cmakeBool "USE_OPENMP" true)
+    (lib.cmakeFeature "USE_SMM" "libxsmm")
+    (lib.cmakeBool "WITH_C_API" true)
+    (lib.cmakeBool "BUILD_TESTING" true)
+    (lib.cmakeFeature "TEST_OMP_THREADS" "2")
+    (lib.cmakeFeature "TEST_MPI_RANKS" "2")
+    (lib.cmakeBool "ENABLE_SHARED" true)
+    (lib.cmakeBool "USE_MPI" true)
   ];
 
-  checkInputs = [
+  nativeCheckInputs = [
     mpiCheckPhaseHook
   ];
 
@@ -80,6 +109,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Distributed Block Compressed Sparse Row matrix library";
     license = lib.licenses.gpl2Only;
     homepage = "https://github.com/cp2k/dbcsr";
+    changelog = "https://github.com/cp2k/dbcsr/releases/tag/${finalAttrs.src.tag}";
     maintainers = [ lib.maintainers.sheepforce ];
   };
 })
diff --git a/pkgs/by-name/db/dbeaver-bin/package.nix b/pkgs/by-name/db/dbeaver-bin/package.nix
index cb6091c0a997..83c161878825 100644
--- a/pkgs/by-name/db/dbeaver-bin/package.nix
+++ b/pkgs/by-name/db/dbeaver-bin/package.nix
@@ -19,7 +19,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "dbeaver-bin";
-  version = "26.2.0";
+  version = "26.2.1";
 
   src =
     let
@@ -31,9 +31,9 @@ stdenvNoCC.mkDerivation (finalAttrs: {
         aarch64-darwin = "macos-aarch64.dmg";
       };
       hash = selectSystem {
-        x86_64-linux = "sha256-9QTnCnR2OqAuC2PWhCuFymRSb2gr5Fez8w4zDMEHSO0=";
-        aarch64-linux = "sha256-atqAOjnAcvyPHHdwZpKY6So1AXRKbh/5GXlKDe35WWM=";
-        aarch64-darwin = "sha256-YqA6qIQp1O7zV2VQOXquddJXagEt7aDIPUtE9fvNSj8=";
+        x86_64-linux = "sha256-Fte9AehPjNj0bWl2rBJ/olZ47AEJU8m03OQZM68gZ+g=";
+        aarch64-linux = "sha256-dvrR2QZNDtra33rIEbM7Z17KeXoQjcRqjjgtoiOZzI4=";
+        aarch64-darwin = "sha256-K/9ehDV8pe4mY/SEI9o52zg9EZbAhvl6oiYYj0qiwKA=";
       };
     in
     fetchurl {
diff --git a/pkgs/by-name/de/deno/package.nix b/pkgs/by-name/de/deno/package.nix
index ca06a0e755f3..1d81a9101d75 100644
--- a/pkgs/by-name/de/deno/package.nix
+++ b/pkgs/by-name/de/deno/package.nix
@@ -36,7 +36,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "deno";
-  version = "2.9.6";
+  version = "2.9.7";
 
   __structuredAttrs = true;
 
@@ -51,10 +51,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     repo = "deno";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true; # required for tests
-    hash = "sha256-4X7IfQk9NJizhZKqH2EuDnSfk8axkKFyiZEv1FOfWTM=";
+    hash = "sha256-GOhud8uXlsDdyAN84WscakxK2qCFTEYSUwR5Wt2QPAs=";
   };
 
-  cargoHash = "sha256-EKRC+wqIos9O0GHaxjmb/ghyzV6oCi1qwhO2tjszWR4=";
+  cargoHash = "sha256-VSWkdTJiSX8O3+Kpu7RKnydxB3OcbwG9+NJCvLdFl68=";
 
   patches = [
     ./patches/0002-tests-replace-hardcoded-paths.patch
diff --git a/pkgs/by-name/do/doh-proxy-rust/package.nix b/pkgs/by-name/do/doh-proxy-rust/package.nix
index 1d55facdf152..e30144bedae7 100644
--- a/pkgs/by-name/do/doh-proxy-rust/package.nix
+++ b/pkgs/by-name/do/doh-proxy-rust/package.nix
@@ -9,15 +9,15 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "doh-proxy-rust";
-  version = "0.9.16";
+  version = "0.10.0";
 
   src = fetchCrate {
     inherit (finalAttrs) version;
     crateName = "doh-proxy";
-    hash = "sha256-V/mWMKBsCStQovgvMtRP66+OsNF2TC0GarYY51C/Zik=";
+    hash = "sha256-dRff1YWDqSf9naRkwPAX5GeLYIwlUD481+/TWnsM/p4=";
   };
 
-  cargoHash = "sha256-daXXjD789tJBph00FPlm2C5gW3jwcTTAZ5TVeDJz8lU=";
+  cargoHash = "sha256-YtcfOr7RseVRTgyQq43tQ8GWhLpOW2pQeReCBD+Ez6c=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     libiconv
diff --git a/pkgs/by-name/dt/dtop/package.nix b/pkgs/by-name/dt/dtop/package.nix
index 3d1301e1fa26..7c1422ddb5aa 100644
--- a/pkgs/by-name/dt/dtop/package.nix
+++ b/pkgs/by-name/dt/dtop/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "dtop";
-  version = "0.9.3";
+  version = "0.9.4";
 
   src = fetchFromGitHub {
     owner = "amir20";
     repo = "dtop";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7APbKhXiqJyb0xAhUou0PfkdZFJvUTb3Ek/94bah7Lg=";
+    hash = "sha256-Z1Kcb5s8UtvtFm0314PV8YZn/FiGDu8tfp8/HlVDeMs=";
   };
 
-  cargoHash = "sha256-NTFWtlFiHHQoiy3IdGZeVy7q75OvHeZ2LBbY7EKHru8=";
+  cargoHash = "sha256-8Lk0PdX39WCqjRSklQ+oM9qJ/IzhJUkbzCtJZGLZ/7E=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = "--version";
diff --git a/pkgs/by-name/du/duckdb-odbc/package.nix b/pkgs/by-name/du/duckdb-odbc/package.nix
index bf07b8d21c4f..7d9c1035344f 100644
--- a/pkgs/by-name/du/duckdb-odbc/package.nix
+++ b/pkgs/by-name/du/duckdb-odbc/package.nix
@@ -12,13 +12,13 @@ stdenv.mkDerivation (finalAttrs: {
   __structuredAttrs = true;
 
   pname = "duckdb-odbc";
-  version = "1.5.5.0";
+  version = "1.5.6.0";
 
   src = fetchFromGitHub {
     owner = "duckdb";
     repo = "duckdb-odbc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-uh4Jle/gbHyd4rUfoyW0u35fx9dcvEEzTg8QnuHdiwY=";
+    hash = "sha256-EaDwmQ0kb7oZLRm5le6sz63wT4RIMX2NW4lr0RARKRU=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/du/dusklight/package.nix b/pkgs/by-name/du/dusklight/package.nix
index 8d3088368eb9..d6f4cfb9b4d5 100644
--- a/pkgs/by-name/du/dusklight/package.nix
+++ b/pkgs/by-name/du/dusklight/package.nix
@@ -12,7 +12,7 @@
   freetype,
   libGL,
   libglvnd,
-  libjpeg_turbo,
+  libpng,
   libpulseaudio,
   libusb1,
   libx11,
@@ -34,6 +34,7 @@
   vulkan-loader,
   wayland,
   xxhash,
+  zlib,
   zstd,
 }:
 
@@ -41,18 +42,24 @@ let
   auroraSrc = fetchFromGitHub {
     owner = "encounter";
     repo = "aurora";
-    rev = "22351fb0b76a4f4f2c4a4dff95aa300101e861aa";
-    hash = "sha256-gDY09IKlTu1Pj7mKw4eQYVXFDJ7j/aTp0iT/Ke93s6s=";
+    rev = "08122911e8621acb7ded6563813b264bec1494b5";
+    hash = "sha256-vdeHq7b+RHEwHN60pGU/FEWW/CqYZMJ2MC86CnF3iMg=";
+  };
+  borealisSrc = fetchFromGitHub {
+    owner = "encounter";
+    repo = "borealis";
+    rev = "8a1c87eb89c8448183e8d9054bcb1efac380940c";
+    hash = "sha256-dwqUh1fhDAmc1JBv0D6c8TSCNdrsDulmfhUD7GEw8EA=";
   };
   dawnSrc = fetchzip (
     {
       x86_64-linux = {
-        url = "https://github.com/encounter/dawn-build/releases/download/v20260603.191052/dawn-linux-x86_64.tar.gz";
-        hash = "sha256-yTanM4TUIv6akgpt2tai/2W6q4RAt48CxKobRgxK8WU=";
+        url = "https://github.com/encounter/dawn/releases/download/v20260807.225922/dawn-linux-x86_64.tar.gz";
+        hash = "sha256-deRtiZ221q6PO9zejJBwa56fCM63KEh6y2p7nM+MOYU=";
       };
       aarch64-linux = {
-        url = "https://github.com/encounter/dawn-build/releases/download/v20260603.191052/dawn-linux-aarch64.tar.gz";
-        hash = "sha256-EiNj16S0sIOWzOByiecsl2bZScBA5MOK348sqyxDchc=";
+        url = "https://github.com/encounter/dawn/releases/download/v20260807.225922/dawn-linux-aarch64.tar.gz";
+        hash = "sha256-WUs7dDxNbQtt5x8AIDmVuFWhcZVgSyUUuRJvr5yrREo=";
       };
     }
     .${stdenv.hostPlatform.system}
@@ -71,19 +78,30 @@ let
     hash = "sha256-pNMR8zxaaqfAzQ0AQBOXMct4usdjey1Q0Gnitg06UhM=";
   };
   rmluiSrc = fetchzip {
-    url = "https://github.com/mikke89/RmlUi/archive/f9b8c9e2935d5df2c7dff2c190d3968e99b0c3dc.tar.gz";
-    hash = "sha256-g4O/JZUrrcseOz8o2QJRt+2CeuiLnVeuDJc906xvuIg=";
+    url = "https://github.com/encounter/RmlUi/archive/215513c51ee1b3b75fc794518dda0576c462279f.tar.gz";
+    hash = "sha256-erJDGImoTfgr6IeZDYTsqK2bOTgVRm3F3iQGXhch5YA=";
+  };
+  minizSrc = fetchzip {
+    url = "https://github.com/richgel999/miniz/releases/download/3.0.2/miniz-3.0.2.zip";
+    hash = "sha256-DXysXkQEmoDAMMg1F8KexkwpXNyiHNzLJqXR9SMEkxk=";
+    stripRoot = false;
+  };
+  picosha2Src = fetchFromGitHub {
+    owner = "okdshin";
+    repo = "PicoSHA2";
+    tag = "v1.0.1";
+    hash = "sha256-3psCzbrwR+vO9TyTKOx+gEaWuHDx6pSgLOQ3DqrJsnI=";
   };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "dusklight";
-  version = "1.4.1";
+  version = "2.0.2";
 
   src = fetchFromGitHub {
     owner = "TwilitRealm";
     repo = "dusklight";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wrbsgK9lAiO3+qfQcQ/o+6zEFS27CymJm76FAEanrdM=";
+    hash = "sha256-STM59AiwArcuVzZVyk4DsrM3aRfKdLCvd1zui/3cx5M=";
   };
 
   strictDeps = true;
@@ -106,7 +124,7 @@ stdenv.mkDerivation (finalAttrs: {
     freetype
     libGL
     libglvnd
-    libjpeg_turbo
+    libpng
     libpulseaudio
     libusb1
     libx11
@@ -120,28 +138,35 @@ stdenv.mkDerivation (finalAttrs: {
     nlohmann_json
     nodtool
     sdl3
-    tracy
     vulkan-loader
     wayland
     xxhash
+    zlib
     zstd
   ];
 
   postUnpack = ''
     chmod -R u+w "$sourceRoot"
-    mkdir -p "$sourceRoot/extern/aurora"
+    mkdir -p "$sourceRoot/extern/aurora" "$sourceRoot/extern/borealis"
     cp -rT --no-preserve=mode "${auroraSrc}" "$sourceRoot/extern/aurora"
+    cp -rT --no-preserve=mode "${borealisSrc}" "$sourceRoot/extern/borealis"
     sed -i '/add_subdirectory(tests)/d' "$sourceRoot/extern/aurora/CMakeLists.txt"
   '';
 
+  postPatch = ''
+    sed -i '1i #include <nlohmann/json.hpp>' src/dusk/imgui/ImGuiStateShare.cpp
+  '';
+
   cmakeBuildType = "RelWithDebInfo";
 
   cmakeFlags = [
-    (lib.cmakeFeature "DUSK_WC_DESCRIBE" "v${finalAttrs.version}")
+    (lib.cmakeFeature "BOREALIS_APP_DESCRIBE" "v${finalAttrs.version}")
     (lib.cmakeBool "CMAKE_DISABLE_FIND_PACKAGE_Git" true)
     (lib.cmakeBool "FETCHCONTENT_FULLY_DISCONNECTED" true)
     (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_CXXOPTS" cxxopts.src.outPath)
-    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_JSON" nlohmann_json.src.outPath)
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_NLOHMANN_JSON" nlohmann_json.src.outPath)
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_MINIZ" minizSrc.outPath)
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_PICOSHA2" picosha2Src.outPath)
     (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_DAWN_PREBUILT" dawnSrc.outPath)
     (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_XXHASH" xxhash.src.outPath)
     (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_FMT" fmt.src.outPath)
@@ -157,7 +182,8 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeFeature "CMAKE_CXX_FLAGS_INIT" "-include cstring")
     (lib.cmakeBool "BUILD_SHARED_LIBS" false)
     (lib.cmakeBool "CMAKE_CROSSCOMPILING" true)
-    (lib.cmakeBool "DUSK_ENABLE_SENTRY_NATIVE" false)
+    (lib.cmakeBool "DUSK_ENABLE_CODE_MODS" false)
+    (lib.cmakeFeature "BOREALIS_HTTP_BACKEND" "none")
   ];
 
   installPhase = ''
diff --git a/pkgs/by-name/el/elpa/package.nix b/pkgs/by-name/el/elpa/package.nix
index 0a8e5366a971..442a21b28b19 100644
--- a/pkgs/by-name/el/elpa/package.nix
+++ b/pkgs/by-name/el/elpa/package.nix
@@ -5,6 +5,7 @@
   autoreconfHook,
   mpiCheckPhaseHook,
   perl,
+  python3,
   mpi,
   blas,
   lapack,
@@ -43,11 +44,13 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   postPatch = ''
-    patchShebangs ./fdep/fortran_dependencies.pl
-    patchShebangs ./test-driver
+    patchShebangs --build ./fdep/fortran_dependencies.pl
 
     # Fix the test script generator
     substituteInPlace Makefile.am --replace '#!/bin/bash' '#!${stdenv.shell}'
+  ''
+  + lib.optionalString enableCuda ''
+    patchShebangs --build ./nvcc_wrap ./manual_cpp
   '';
 
   outputs = [
@@ -61,7 +64,11 @@ stdenv.mkDerivation (finalAttrs: {
     autoreconfHook
     perl
   ]
-  ++ lib.optionals enableCuda [ cudaPackages.cuda_nvcc ];
+  ++ lib.optionals enableCuda [
+    cudaPackages.cuda_nvcc
+    cudaPackages.libcusolver
+    python3
+  ];
 
   buildInputs = [
     mpi
@@ -74,26 +81,28 @@ stdenv.mkDerivation (finalAttrs: {
     cudaPackages.libcublas
   ];
 
-  preConfigure = ''
-    export FC="mpifort"
-    export CC="mpicc"
-    export CXX="mpicxx"
-    export CPP="cpp"
-
-    # These need to be set for configure to succeed
-    export FCFLAGS="${
-      lib.optionalString stdenv.hostPlatform.isx86_64 "-msse3 "
-      + lib.optionalString avxSupport "-mavx "
-      + lib.optionalString avx2Support "-mavx2 -mfma "
-      + lib.optionalString avx512Support "-mavx512"
-    }"
-
-    export CFLAGS=$FCFLAGS
-  '';
+  env =
+    let
+      optFlags =
+        lib.optionalString stdenv.hostPlatform.isx86_64 "-msse3 "
+        + lib.optionalString avxSupport "-mavx "
+        + lib.optionalString avx2Support "-mavx2 -mfma "
+        + lib.optionalString avx512Support "-mavx512";
+    in
+    {
+      FC = "mpifort";
+      CC = "mpicc";
+      CXX = "mpicxx";
+      CPP = "cpp";
+      FCFLAGS = optFlags;
+      CFLAGS = optFlags;
+    }
+    # elpa's CUDA support pulls in a custom compiler wrapper
+    # that does not distinguish gcc/g++
+    // lib.optionalAttrs enableCuda { LDFLAGS = "-lstdc++"; };
 
   configureFlags = [
     "--with-mpi"
-    "--enable-openmp"
     "--without-threading-support-check-during-build"
   ]
   ++ lib.optional blas.isILP64 "--enable-64bit-integer-math-support"
@@ -103,6 +112,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optional (!stdenv.hostPlatform.isx86_64) "--disable-sse"
   ++ lib.optional (!stdenv.hostPlatform.isx86_64) "--disable-sse-assembly"
   ++ lib.optional stdenv.hostPlatform.isx86_64 "--enable-sse-assembly"
+  ++ lib.optional (!enableCuda) "--enable-openmp"
   ++ lib.optionals enableCuda [
     "--enable-nvidia-gpu"
     "--with-NVIDIA-GPU-compute-capability=${nvidiaArch}"
@@ -114,8 +124,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeCheckInputs = [ mpiCheckPhaseHook ];
   preCheck = ''
-    #patchShebangs ./
-
     # Reduce test problem sizes
     export TEST_FLAGS="1500 50 16"
   '';
diff --git a/pkgs/by-name/ev/evolis-card-printer/package.nix b/pkgs/by-name/ev/evolis-card-printer/package.nix
new file mode 100644
index 000000000000..9b5bc3b5f6df
--- /dev/null
+++ b/pkgs/by-name/ev/evolis-card-printer/package.nix
@@ -0,0 +1,51 @@
+{
+  stdenv,
+  fetchurl,
+
+  lib,
+  cups,
+  dpkg,
+  autoPatchelfHook,
+}:
+
+stdenv.mkDerivation {
+  pname = "evolis-card-printer";
+  version = "4.12.8"; # driver version
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  src = fetchurl {
+    # archive.org used as mirror as evolis does not provide simple download links
+    # original copies can be optained at https://myplace.evolis.com/s/product/pebble-4/01t5p00000CXScZAAX?language=en_US&tabset-100fe=2
+    # deb drivers have weird problems described on archive.org page
+    # TLDR: use portrait as landscape and vice versa
+
+    url = "https://archive.org/download/evolisprinter-4.12.8.8/64%20bit%20version%20-%20evolisprinter-4.12.8.8.amd64.deb";
+    hash = "sha256-xldAk9FunkIcStu6hAS6onlRS3JdWIVftkbj8Bxtx8c=";
+  };
+
+  nativeBuildInputs = [
+    dpkg
+    autoPatchelfHook
+  ];
+
+  buildInputs = [
+    cups
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    cp -r usr $out
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Evolis printer drivers, for Pebble, Badgy, Dualys, Primacy, Quantum, Securion, Tattoo, Tatoo2 and Zenus card printers";
+    homepage = "https://myplace.evolis.com/s/product/pebble-4/01t5p00000CXScZAAX?language=en_US&tabset-100fe=2";
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [
+      kleiner3
+    ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/by-name/ex/exoscale-cli/package.nix b/pkgs/by-name/ex/exoscale-cli/package.nix
index e98feab76f46..8df96bb6b7b9 100644
--- a/pkgs/by-name/ex/exoscale-cli/package.nix
+++ b/pkgs/by-name/ex/exoscale-cli/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "exoscale-cli";
-  version = "1.99.0";
+  version = "1.101.0";
 
   src = fetchFromGitHub {
     owner = "exoscale";
     repo = "cli";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-n7o15s2aqGGMqL6kyiIVxgJGeOUjM6WIVsEQAWOQ8b8=";
+    sha256 = "sha256-lJOwFqBtvjHLcPa+/az0x+okqOdP+WrsXbkEG1CMQbk=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/fl/flaresolverr/package.nix b/pkgs/by-name/fl/flaresolverr/package.nix
index a5ae56b3d9eb..b944a2d1f3e5 100644
--- a/pkgs/by-name/fl/flaresolverr/package.nix
+++ b/pkgs/by-name/fl/flaresolverr/package.nix
@@ -31,13 +31,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "flaresolverr";
-  version = "3.5.0";
+  version = "3.5.2";
 
   src = fetchFromGitHub {
     owner = "FlareSolverr";
     repo = "FlareSolverr";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-gOrfxFGNlxZWScfYEw7zfy7oVWhYEygYgP7mkO4cs/w=";
+    hash = "sha256-iTFoixNcEjhTCWpfDAJoLclspiyozZnQrRfkevLzd2o=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/fl/flatpak/package.nix b/pkgs/by-name/fl/flatpak/package.nix
index c18e8c656407..4c91deefc4cd 100644
--- a/pkgs/by-name/fl/flatpak/package.nix
+++ b/pkgs/by-name/fl/flatpak/package.nix
@@ -80,7 +80,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "flatpak";
-  version = "1.18.1";
+  version = "1.18.4";
 
   # TODO: split out lib once we figure out what to do with triggerdir
   outputs = [
@@ -98,7 +98,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://github.com/flatpak/flatpak/releases/download/${finalAttrs.version}/flatpak-${finalAttrs.version}.tar.xz";
-    hash = "sha256-vGg/yRbtIcBSS7Bk81jCrBhYa47IjHby9/KJh3UhYxw=";
+    hash = "sha256-uJmnoAxI0sYmy47DP+VWcgs3bCWAXXIiQwwP3KTGrI0=";
   };
 
   patches = [
@@ -288,7 +288,7 @@ stdenv.mkDerivation (finalAttrs: {
       version = testers.testVersion { package = finalAttrs.finalPackage; };
     };
 
-    updateScript = nix-update-script { };
+    updateScript = nix-update-script { extraArgs = [ "--use-github-releases" ]; };
   };
 
   meta = {
diff --git a/pkgs/by-name/fl/flexget/package.nix b/pkgs/by-name/fl/flexget/package.nix
index 8860251732f0..b4aba362cf39 100644
--- a/pkgs/by-name/fl/flexget/package.nix
+++ b/pkgs/by-name/fl/flexget/package.nix
@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "flexget";
-  version = "3.21.0";
+  version = "3.21.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Flexget";
     repo = "Flexget";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Xf+nFDC1dNyFXeK8gZYWiE3kZKYNB4lCdBoI24+b/gA=";
+    hash = "sha256-Nl02DbyRj52OZz07tZ2Y8EVcgyELVI0LJ8GJbgm2mco=";
   };
 
   pythonRelaxDeps = true;
diff --git a/pkgs/by-name/fl/fluere/package.nix b/pkgs/by-name/fl/fluere/package.nix
new file mode 100644
index 000000000000..3798ca47a063
--- /dev/null
+++ b/pkgs/by-name/fl/fluere/package.nix
@@ -0,0 +1,58 @@
+{
+  lib,
+  fetchFromGitHub,
+  libgit2,
+  libpcap,
+  nix-update-script,
+  openssl,
+  pkg-config,
+  rustPlatform,
+  versionCheckHook,
+  zlib,
+  zstd,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "fluere";
+  version = "0.8.1";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "SkuldNorniern";
+    repo = "fluere";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-311VCO+8xoWblt6zBOLd+7xmmBO7sE0KeUKO1Qwg9SI=";
+  };
+
+  cargoHash = "sha256-nMh4hO9kHCpE/+K1DNZT3UYe0iGUU6HRZUg00T6f+CM=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    libgit2
+    libpcap
+    openssl
+    zlib
+    zstd
+  ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  doInstallCheck = true;
+
+  env = {
+    LIBGIT2_NO_VENDOR = true;
+    ZSTD_SYS_USE_PKG_CONFIG = true;
+  };
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Tool designed for network monitoring and analysis";
+    homepage = "https://github.com/SkuldNorniern/fluere";
+    changelog = "https://github.com/SkuldNorniern/fluere/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "fluere";
+  };
+})
diff --git a/pkgs/by-name/fr/frigate/package.nix b/pkgs/by-name/fr/frigate/package.nix
index bdf4fb1931d4..d97e1be68719 100644
--- a/pkgs/by-name/fr/frigate/package.nix
+++ b/pkgs/by-name/fr/frigate/package.nix
@@ -141,7 +141,9 @@ python3Packages.buildPythonApplication (finalAttrs: {
       --replace-fail "/labelmap.txt" "${placeholder "out"}/share/frigate/labelmap.txt"
 
     substituteInPlace frigate/events/audio.py \
-      --replace-fail "/cpu_audio_model.tflite" "${frigate.models.tflite.yamnet_classification_v1.model}" \
+      --replace-fail "/cpu_audio_model.tflite" "${frigate.models.tflite.yamnet_classification_v1.model}"
+
+    substituteInPlace frigate/events/audio.py frigate/api/app.py \
       --replace-fail "/audio-labelmap.txt" "${placeholder "out"}/share/frigate/audio-labelmap.txt"
   '';
 
diff --git a/pkgs/by-name/ga/gallery-dl/package.nix b/pkgs/by-name/ga/gallery-dl/package.nix
index 6d1fb54ec554..c5fb8ff7cdfc 100644
--- a/pkgs/by-name/ga/gallery-dl/package.nix
+++ b/pkgs/by-name/ga/gallery-dl/package.nix
@@ -8,14 +8,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "gallery-dl";
-  version = "1.32.10";
+  version = "1.32.14";
   pyproject = true;
 
   src = fetchFromCodeberg {
     owner = "mikf";
     repo = "gallery-dl";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-va081Uqrtj6INE3YOa07jXcdvg5VyePYQ7E26tc+Fgk=";
+    hash = "sha256-nEzHp5LYklzEdNKcCJagphGA5U2LNR2/Vb3ZOoxNc68=";
   };
 
   build-system = [ python3Packages.setuptools ];
diff --git a/pkgs/by-name/gh/gh-dash/package.nix b/pkgs/by-name/gh/gh-dash/package.nix
index 2a8ffea396f5..ba5ed685264c 100644
--- a/pkgs/by-name/gh/gh-dash/package.nix
+++ b/pkgs/by-name/gh/gh-dash/package.nix
@@ -1,23 +1,23 @@
 {
   lib,
   fetchFromGitHub,
-  buildGoModule,
+  buildGo127Module,
   versionCheckHook,
   writableTmpDirAsHomeHook,
 }:
 
-buildGoModule (finalAttrs: {
+buildGo127Module (finalAttrs: {
   pname = "gh-dash";
-  version = "4.25.2";
+  version = "4.26.0";
 
   src = fetchFromGitHub {
     owner = "dlvhdr";
     repo = "gh-dash";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-3iUBuMvA2Xh7UjTiFNEs3tuZMCnSt/bIhTSEDD92yCU=";
+    hash = "sha256-NWJEe6ocC1FdXNLLGgVAcWlzjWqtgrMLnpnJrgbR7U4=";
   };
 
-  vendorHash = "sha256-Teu+8jiZE2gZ+0ErKsunhotY9W4Hjg6PAeFkFLgESIk=";
+  vendorHash = "sha256-edFzZpM1DIwFnMLQlOuh5c8CFzYm3X2YheGFDgOLZ0I=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/gh/ghosthound/package.nix b/pkgs/by-name/gh/ghosthound/package.nix
new file mode 100644
index 000000000000..735b6e92e66f
--- /dev/null
+++ b/pkgs/by-name/gh/ghosthound/package.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  fetchFromGitHub,
+  nix-update-script,
+  openssl,
+  pkg-config,
+  rustPlatform,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "ghosthound";
+  version = "0.1.2";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "JVBotelho";
+    repo = "ghosthound";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-UI01b0oiIiH9dIQClgnagTqb6OJgvmhXqIifh1aelDM=";
+  };
+
+  cargoHash = "sha256-ut6qwKdLvQgL66G5PQ817QMBCMz72aWNHK7MLpz5ql0=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ openssl ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  env = {
+    OPENSSL_NO_VENDOR = true;
+  };
+
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "BloodHound OpenGraph extension that surfaces Active Directory";
+    homepage = "https://github.com/JVBotelho/ghosthound";
+    changelog = "https://github.com/JVBotelho/ghosthound/releases/tag/${finalAttrs.src.tag}";
+    license =
+      with lib.licenses;
+      OR [
+        asl20
+        mit
+      ];
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "ghosthound";
+  };
+})
diff --git a/pkgs/by-name/gi/git-interactive-rebase-tool/package.nix b/pkgs/by-name/gi/git-interactive-rebase-tool/package.nix
index 2e6aa0342f1b..d4cac8660998 100644
--- a/pkgs/by-name/gi/git-interactive-rebase-tool/package.nix
+++ b/pkgs/by-name/gi/git-interactive-rebase-tool/package.nix
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     homepage = "https://github.com/MitMaro/git-interactive-rebase-tool";
     description = "Native cross platform full feature terminal based sequence editor for git interactive rebase";
     changelog = "https://github.com/MitMaro/git-interactive-rebase-tool/releases/tag/${finalAttrs.version}";
-    license = lib.licenses.mit;
+    license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [
       SuperSandro2000
       zowoq
diff --git a/pkgs/by-name/gi/git-privacy/package.nix b/pkgs/by-name/gi/git-privacy/package.nix
index ecd8ed84e55c..3cb8dfae2460 100644
--- a/pkgs/by-name/gi/git-privacy/package.nix
+++ b/pkgs/by-name/gi/git-privacy/package.nix
@@ -1,6 +1,7 @@
 {
   lib,
   fetchFromGitHub,
+  fetchpatch,
   git,
   python3,
 }:
@@ -17,6 +18,16 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     hash = "sha256-b2RkRL8/mZwqc3xCs+oltzualhQtp/7F9POlLlT3UUU=";
   };
 
+  patches = [
+    # Fix: pkg_resources is deprecated
+    (fetchpatch {
+      name = "fix-pkg_resources-is-deprecated.patch";
+      url = "https://github.com/EMPRI-DEVOPS/git-privacy/commit/a54d7a8b9ce6a48db5383e09711059b5025bcb18.patch";
+      excludes = [ ".github/workflows/pytest.yml" ];
+      hash = "sha256-uorH+EomVS6wMoykwazSIstz43CCjU8tJLgxyINqxU4=";
+    })
+  ];
+
   build-system = with python3.pkgs; [
     setuptools
   ];
diff --git a/pkgs/by-name/gi/gitlab/package.nix b/pkgs/by-name/gi/gitlab/package.nix
index ddeb9be9bbdb..aa70fd9bb534 100644
--- a/pkgs/by-name/gi/gitlab/package.nix
+++ b/pkgs/by-name/gi/gitlab/package.nix
@@ -23,6 +23,9 @@
   rustc,
   rustPlatform,
 
+  # gitlab-glaz
+  buildPackages,
+
   # gpgme
   pkg-config,
 
@@ -67,46 +70,57 @@ let
         buildFlags = [ "--enable-system-libraries" ];
       };
 
-      gitlab-glaz = attrs: {
-        cargoDeps = rustPlatform.fetchCargoVendor {
-          src = stdenv.mkDerivation {
-            inherit (buildRubyGem { inherit (attrs) gemName version source; })
-              name
-              src
-              unpackPhase
-              nativeBuildInputs
-              ;
-            dontBuilt = true;
-            installPhase = ''
-              cp -R ext/glaz $out
-              cp Cargo.lock $out
-            '';
+      gitlab-glaz =
+        attrs:
+        {
+          cargoDeps = rustPlatform.fetchCargoVendor {
+            src = stdenv.mkDerivation {
+              inherit (buildRubyGem { inherit (attrs) gemName version source; })
+                name
+                src
+                unpackPhase
+                nativeBuildInputs
+                ;
+              dontBuilt = true;
+              installPhase = ''
+                cp -R ext/glaz $out
+                cp Cargo.lock $out
+              '';
+            };
+            hash = "sha256-5fGoW6TpkIQ8OIXjt2fLGzG9xhZ2TT+v2zLH1ecItII=";
           };
-          hash = "sha256-5fGoW6TpkIQ8OIXjt2fLGzG9xhZ2TT+v2zLH1ecItII=";
+
+          dontBuild = false;
+
+          nativeBuildInputs = [
+            cargo
+            rustc
+            rustPlatform.cargoSetupHook
+            rustPlatform.bindgenHook
+          ];
+
+          disallowedReferences = [
+            rustc.unwrapped
+          ];
+
+          preInstall = ''
+            export CARGO_HOME="$PWD/../.cargo/"
+          '';
+
+          postInstall = ''
+            find $out -type f -name .rustc_info.json -delete
+          '';
+        }
+        // lib.optionalAttrs stdenv.hostPlatform.isRiscV64 {
+          # protoc-bin-vendored ships no riscv64 protoc
+          postPatch = ''
+            substituteInPlace $cargoDepsCopy/source-*/glaz-proto-*/build.rs \
+              --replace-fail 'protoc_bin_vendored::protoc_bin_path()?' \
+                'std::path::PathBuf::from(std::env::var("PROTOC")?)'
+          '';
+          PROTOC = lib.getExe' buildPackages.protobuf "protoc";
         };
 
-        dontBuild = false;
-
-        nativeBuildInputs = [
-          cargo
-          rustc
-          rustPlatform.cargoSetupHook
-          rustPlatform.bindgenHook
-        ];
-
-        disallowedReferences = [
-          rustc.unwrapped
-        ];
-
-        preInstall = ''
-          export CARGO_HOME="$PWD/../.cargo/"
-        '';
-
-        postInstall = ''
-          find $out -type f -name .rustc_info.json -delete
-        '';
-      };
-
       gitlab-glfm-markdown = attrs: {
         cargoDeps = rustPlatform.fetchCargoVendor {
           src = stdenv.mkDerivation {
diff --git a/pkgs/by-name/go/gogh/package.nix b/pkgs/by-name/go/gogh/package.nix
index cf262b16c5ab..36ff47a3ce4f 100644
--- a/pkgs/by-name/go/gogh/package.nix
+++ b/pkgs/by-name/go/gogh/package.nix
@@ -25,13 +25,13 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "gogh";
-  version = "1235";
+  version = "1247";
 
   src = fetchFromGitHub {
     owner = "Gogh-Co";
     repo = "Gogh";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1AaV1nauYQUeV2VLIuWvCHc3c0H595yqHTcFuKsEbjw=";
+    hash = "sha256-OB41buqusd+4ki0K28wK4DFJbQp3LsJ7ZU8qJNHprWs=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/go/golines/package.nix b/pkgs/by-name/go/golines/package.nix
index c1e30e4fd9e5..230e28e90455 100644
--- a/pkgs/by-name/go/golines/package.nix
+++ b/pkgs/by-name/go/golines/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "golines";
-  version = "0.15.0";
+  version = "0.16.0";
 
   src = fetchFromGitHub {
     owner = "golangci";
     repo = "golines";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-gjm76dGbFTisQdiM0GAQJRcAreQUWIBuqYbLU2ruCNk=";
+    sha256 = "sha256-NveivuTEy+lvgsu32YuBE9lHhV4aTcI04BkMlZiIEGw=";
   };
 
-  vendorHash = "sha256-cLzCpjifb0lc6UaDW2JZBQABixz98EJ4syLapX7I8y8=";
+  vendorHash = "sha256-bn4C1d7EdAfBJZkWJByOQns+ng7F15eUs8BgYExB/g8=";
 
   subPackages = [
     "."
diff --git a/pkgs/by-name/go/google-chrome/package.nix b/pkgs/by-name/go/google-chrome/package.nix
index d2f3785d8caa..92a6810e5fdd 100644
--- a/pkgs/by-name/go/google-chrome/package.nix
+++ b/pkgs/by-name/go/google-chrome/package.nix
@@ -180,7 +180,7 @@ let
 
   linux = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta;
-    version = "154.0.8037.57";
+    version = "154.0.8037.92";
 
     src =
       let
@@ -195,8 +195,8 @@ let
         url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_${debArch}.deb";
         hash =
           {
-            amd64 = "sha256-ZsBkX2oZhxurKES4U3wRoNsufTvqjvhaHHy1KlTmWj4=";
-            arm64 = "sha256-dBi2+a2THLdOsNydZrXsf06fhoctNAOUVFtRUICCduc=";
+            amd64 = "sha256-aeP2rApIEfRonKI/H9XMWywBVQiBkos+GWqXExFlxKI=";
+            arm64 = "sha256-mGYQvLwfWO7t6UkhCGrbs8HfLm08tNo5WxoY5xt963c=";
           }
           .${debArch};
       };
@@ -306,11 +306,11 @@ let
 
   darwin = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta;
-    version = "154.0.8037.58";
+    version = "154.0.8037.93";
 
     src = fetchurl {
-      url = "https://dl.google.com/release2/chrome/esexjcwror2yyct27xsikjz3bq_154.0.8037.58/GoogleChrome-154.0.8037.58.dmg";
-      hash = "sha256-LfRnubv1+pPio7WbeZBqjr2eNnfRthhX9snZnmLqy0M=";
+      url = "https://dl.google.com/release2/chrome/adufpe5jsoouz6tduwoz7auvmjhq_154.0.8037.93/GoogleChrome-154.0.8037.93.dmg";
+      hash = "sha256-qTZ7anig56Qt8DLyQRJ029rKsbQVol/oaLvDMa7Jm7w=";
     };
 
     dontPatch = true;
diff --git a/pkgs/by-name/gr/greenmask/package.nix b/pkgs/by-name/gr/greenmask/package.nix
index 4612afc48551..af6c65f50846 100644
--- a/pkgs/by-name/gr/greenmask/package.nix
+++ b/pkgs/by-name/gr/greenmask/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "greenmask";
-  version = "0.2.23";
+  version = "0.2.24";
 
   src = fetchFromGitHub {
     owner = "GreenmaskIO";
     repo = "greenmask";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3ZY0Bj8Lest1CuyElR+Vh4+OVolcfXgvw0Xq/Wdjemg=";
+    hash = "sha256-nzhsbMQUSNW7iYsPYmhjELmjgq+2Vaa9vDmiMp2iEXg=";
   };
 
   vendorHash = "sha256-OelcviMjEEJAIYzCgGFj6uJB+GTnkf1rxqjtz8ppHjs=";
diff --git a/pkgs/by-name/he/hexora/package.nix b/pkgs/by-name/he/hexora/package.nix
new file mode 100644
index 000000000000..e4ad7d16238c
--- /dev/null
+++ b/pkgs/by-name/he/hexora/package.nix
@@ -0,0 +1,62 @@
+{
+  lib,
+  cargo,
+  fetchFromGitHub,
+  nix-update-script,
+  pkg-config,
+  python3Packages,
+  rustc,
+  rustPlatform,
+  zstd,
+}:
+
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "hexora";
+  version = "0.3.1";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "rushter";
+    repo = "hexora";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-xBg8Rrtwgg8Obi7JOPwdRXwoQKL8skCY72vLJA/VPRk=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-Xc6CcJ6s8X7T04W2SP7XT2rKGh2TatkaCxP2sSUC+2Y=";
+  };
+
+  build-system = [
+    cargo
+    pkg-config
+    python3Packages.setuptools
+    python3Packages.setuptools-rust
+    python3Packages.wheel
+    rustPlatform.cargoSetupHook
+    rustc
+  ];
+
+  buildInputs = [ zstd ];
+
+  # Project has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "hexora" ];
+
+  env = {
+    ZSTD_SYS_USE_PKG_CONFIG = true;
+  };
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Static analysis of malicious Python code";
+    homepage = "https://github.com/rushter/hexora";
+    changelog = "https://github.com/rushter/hexora/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "hexora";
+  };
+})
diff --git a/pkgs/by-name/ho/honggfuzz/package.nix b/pkgs/by-name/ho/honggfuzz/package.nix
index 7de83d8baf72..d4b41dd7ccab 100644
--- a/pkgs/by-name/ho/honggfuzz/package.nix
+++ b/pkgs/by-name/ho/honggfuzz/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "honggfuzz";
-  version = "2.6-unstable-2026-06-19";
+  version = "2.6-unstable-2026-09-25";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "honggfuzz";
-    rev = "cf8b66a4d09f4d4d786d96e3c46d9141fb4e98e2";
-    hash = "sha256-cu7VLQvdmgYIbWhAiZjG5wkO/b5+FoBmXp/SlYmykF0=";
+    rev = "940b958dfeb6f9131fd846cae31fcc0fe996ae98";
+    hash = "sha256-cfCG1rGfiAs7Oq+dJ904kaW6NmvOPG3cfmSgQFW42FU=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/ht/httplib/package.nix b/pkgs/by-name/ht/httplib/package.nix
index 72b323b02c28..53e833888327 100644
--- a/pkgs/by-name/ht/httplib/package.nix
+++ b/pkgs/by-name/ht/httplib/package.nix
@@ -9,13 +9,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "httplib";
-  version = "0.56.0";
+  version = "0.58.0";
 
   src = fetchFromGitHub {
     owner = "yhirose";
     repo = "cpp-httplib";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-m5APBj01htJNljiANt8T9gZ1nupOkgFatpQseSgCADU=";
+    hash = "sha256-FMWqkFolKr+piiu2kekFQlrddEWyunoyXYDWKn26jaw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/im/immich/package.nix b/pkgs/by-name/im/immich/package.nix
index 77680ff05cab..1ba6f6727185 100644
--- a/pkgs/by-name/im/immich/package.nix
+++ b/pkgs/by-name/im/immich/package.nix
@@ -110,7 +110,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "immich";
-  version = "3.2.2";
+  version = "3.2.4";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -119,7 +119,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "immich-app";
     repo = "immich";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-napG+EMZbbbeq7R8FtnuDsDwdpxItkwTVWztnw07DfA=";
+    hash = "sha256-/wWep6A/ryocuGMOElcD1lOEwT6tJDdwa5HAcCZUXSs=";
   };
 
   pnpmDeps = fetchPnpmDeps {
diff --git a/pkgs/by-name/in/inter/package.nix b/pkgs/by-name/in/inter/package.nix
index 1378a93ff670..d633128504c1 100644
--- a/pkgs/by-name/in/inter/package.nix
+++ b/pkgs/by-name/in/inter/package.nix
@@ -4,12 +4,12 @@
   fetchzip,
   installFonts,
 }:
-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "inter";
   version = "4.1";
 
   src = fetchzip {
-    url = "https://github.com/rsms/inter/releases/download/v${version}/Inter-${version}.zip";
+    url = "https://github.com/rsms/inter/releases/download/v${finalAttrs.version}/Inter-${finalAttrs.version}.zip";
     stripRoot = false;
     hash = "sha256-5vdKKvHAeZi6igrfpbOdhZlDX2/5+UvzlnCQV6DdqoQ=";
   };
@@ -21,6 +21,8 @@ stdenvNoCC.mkDerivation rec {
 
   dontInstallWebfonts = true;
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://rsms.me/inter/";
     description = "Typeface specially designed for user interfaces";
@@ -28,4 +30,4 @@ stdenvNoCC.mkDerivation rec {
     platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [ demize ];
   };
-}
+})
diff --git a/pkgs/by-name/kb/kbld/package.nix b/pkgs/by-name/kb/kbld/package.nix
index 01ad70b02fc2..038b658cdf69 100644
--- a/pkgs/by-name/kb/kbld/package.nix
+++ b/pkgs/by-name/kb/kbld/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "kbld";
-  version = "0.47.3";
+  version = "0.49.1";
 
   src = fetchFromGitHub {
     owner = "carvel-dev";
     repo = "kbld";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-BuISF6PmtFPHTYmByJ021WICGXVVc+ZNjxeb40J7exA=";
+    hash = "sha256-YjyBuB/CG/ocPOl2/P9fpXa1JTJPnRR5uRLyMbLrIJg=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/ku/kubescape/package.nix b/pkgs/by-name/ku/kubescape/package.nix
index 0a64714095a9..33e30bb943bb 100644
--- a/pkgs/by-name/ku/kubescape/package.nix
+++ b/pkgs/by-name/ku/kubescape/package.nix
@@ -9,18 +9,18 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "kubescape";
-  version = "4.0.14";
+  version = "4.0.15";
 
   src = fetchFromGitHub {
     owner = "kubescape";
     repo = "kubescape";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QdWnwjvXsABcTsf+xzIYZ7GgwukzvyPQOppm7SDCK64=";
+    hash = "sha256-4WQvIdUPkiN4buqFDJRzY2CHe6EfJcOv1tT2/IETilE=";
     fetchSubmodules = true;
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-y0iwBSUVh2pBEaiS1cGmW7F0/geGDuSdSHMmvhW5c9o=";
+  vendorHash = "sha256-dpci0KYQBuUTgGdQ95rQqahX4TtkycJ3ZcEmQXrCLu0=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/le/ledger-live-desktop/package.nix b/pkgs/by-name/le/ledger-live-desktop/package.nix
index 534ac688a68d..50110d05f3e9 100644
--- a/pkgs/by-name/le/ledger-live-desktop/package.nix
+++ b/pkgs/by-name/le/ledger-live-desktop/package.nix
@@ -8,11 +8,11 @@
 
 let
   pname = "ledger-live-desktop";
-  version = "4.19.1";
+  version = "4.21.1";
 
   src = fetchurl {
     url = "https://download.live.ledger.com/${pname}-${version}-linux-x86_64.AppImage";
-    hash = "sha256-zPaMkbU36HwcMUHy9nrocCOJfZ4k/CXj/3gd4BZUV0M=";
+    hash = "sha256-Em+VT8sDCyKgrJxrdrAIVpbdLdSPwqoBgIRXeEj1TXY=";
   };
 
   appimageContents = appimageTools.extract {
diff --git a/pkgs/by-name/le/lefthook/package.nix b/pkgs/by-name/le/lefthook/package.nix
index abd267bf0050..954b727188f6 100644
--- a/pkgs/by-name/le/lefthook/package.nix
+++ b/pkgs/by-name/le/lefthook/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "lefthook";
-  version = "2.1.14";
+  version = "2.1.15";
 
   src = fetchFromGitHub {
     owner = "evilmartians";
     repo = "lefthook";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-UknO4ka3fjldpsp9V+GPkPYvhmlF4e6nd6dW9Uwjc2o=";
+    hash = "sha256-gBgydS6E35Jd3r8Tp1hvCk3c6E39kcNE5Gu60RCtLw4=";
   };
 
-  vendorHash = "sha256-G+v6ZqnkcFdPDzXlN89oqD7mOnHfq1tvIkFxdoVnBNo=";
+  vendorHash = "sha256-61w4BJKInUbQOInbqjshWiwyrpGSM+/JziMRmK9pik4=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/li/libdeltachat/package.nix b/pkgs/by-name/li/libdeltachat/package.nix
index e0fdff5fb4e8..e7d1c3d07b90 100644
--- a/pkgs/by-name/li/libdeltachat/package.nix
+++ b/pkgs/by-name/li/libdeltachat/package.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libdeltachat";
-  version = "2.61.0";
+  version = "2.62.0";
 
   src = fetchFromGitHub {
     owner = "chatmail";
     repo = "core";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lePHfmq4bUxb1reQe2BOMC0WUDdH7cZ33Fu8TLkb+xs=";
+    hash = "sha256-qjbxxcOvHkb8g4IMWXYXmnYhbEx3G5ptiysOvpTcCCI=";
   };
 
   patches = [
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
   cargoDeps = rustPlatform.fetchCargoVendor {
     pname = "chatmail-core";
     inherit (finalAttrs) version src;
-    hash = "sha256-VZkrewx54/M1XXs9j9asLdLNEez+XIUvFfgAjo8w09c=";
+    hash = "sha256-ceXhO8/k3+dphPQ74S+ZgEZzUWjgqBm6wcePvTqxHrE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/libretroPackages/cores/prboom.nix b/pkgs/by-name/li/libretroPackages/cores/prboom.nix
index bc7e03a25c05..d7374d35b858 100644
--- a/pkgs/by-name/li/libretroPackages/cores/prboom.nix
+++ b/pkgs/by-name/li/libretroPackages/cores/prboom.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "prboom";
-  version = "0-unstable-2026-09-15";
+  version = "0-unstable-2026-09-28";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "libretro-prboom";
-    rev = "d20300de2d32e5b8e8b0a0f15b1e1a889583d248";
-    hash = "sha256-56A6JEOoorKi2yitpVk+iXCzZLAkjzYM3jcxPqOtuXE=";
+    rev = "e5db549b6c85fc500b3a559efe2dc00870521c5d";
+    hash = "sha256-UodAMvRuHGIfAUHLi0DCXT2ZPe4UfI7t+0bv15pkpIs=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/by-name/li/libsecretspec-resolver/package.nix b/pkgs/by-name/li/libsecretspec-resolver/package.nix
index 58096b372347..17526ed556c1 100644
--- a/pkgs/by-name/li/libsecretspec-resolver/package.nix
+++ b/pkgs/by-name/li/libsecretspec-resolver/package.nix
@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libsecretspec-resolver";
-  version = "0.21.0";
+  version = "0.21.1";
   strictDeps = true;
   __structuredAttrs = true;
 
@@ -19,7 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "cachix";
     repo = "secretspec";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-12jIhLZhtyQwkt2vKHqjGOuKSwwevcxzp8Ii02RTMLY=";
+    hash = "sha256-8OC1WS8VWTSwUJlT/qWx9CCPmO90G2OWJxEKZGUgXqM=";
   };
 
   cmakeDir = "../libsecretspec-resolver";
diff --git a/pkgs/by-name/li/libsecretspec/package.nix b/pkgs/by-name/li/libsecretspec/package.nix
index bd9c639e718d..c939dd26415b 100644
--- a/pkgs/by-name/li/libsecretspec/package.nix
+++ b/pkgs/by-name/li/libsecretspec/package.nix
@@ -13,17 +13,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "libsecretspec";
-  version = "0.21.0";
+  version = "0.21.1";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "cachix";
     repo = "secretspec";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-12jIhLZhtyQwkt2vKHqjGOuKSwwevcxzp8Ii02RTMLY=";
+    hash = "sha256-8OC1WS8VWTSwUJlT/qWx9CCPmO90G2OWJxEKZGUgXqM=";
   };
 
-  cargoHash = "sha256-yqBAhnHBwKbSyH8sEDo6y0xGUdKJgHd3Gsr1sTS/bRc=";
+  cargoHash = "sha256-48k3UKeT8qjRRLrf5yqmxULIynD6FgXiW063VEoTqmU=";
 
   nativeBuildInputs = [ cargo-c ];
 
diff --git a/pkgs/by-name/li/lint-staged/package.nix b/pkgs/by-name/li/lint-staged/package.nix
index 6207c396a863..17accc7f8053 100644
--- a/pkgs/by-name/li/lint-staged/package.nix
+++ b/pkgs/by-name/li/lint-staged/package.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "lint-staged";
-  version = "17.5.1";
+  version = "17.6.0";
 
   src = fetchFromGitHub {
     owner = "lint-staged";
     repo = "lint-staged";
     rev = "v${version}";
-    hash = "sha256-9fx514c0ZblPZaJmAGdmb2QbIodsaDS9MOoveUXwA2Q=";
+    hash = "sha256-dUZMViPdT0mjqAs5boofuJs8qSH0QPZVts7PRJrIa6k=";
   };
 
-  npmDepsHash = "sha256-y8PSiJm3U9i5XaIkC06N/vjm/+OnqAHASRAMHlOVsGU=";
+  npmDepsHash = "sha256-Utc/SknTuV706dNjVUwE6ad85O3Ud4HRVDBiKblgdw0=";
 
   dontNpmBuild = true;
 
diff --git a/pkgs/by-name/li/liquidwar/package.nix b/pkgs/by-name/li/liquidwar/package.nix
index 35761a6e8d8d..51fe6b6de60a 100644
--- a/pkgs/by-name/li/liquidwar/package.nix
+++ b/pkgs/by-name/li/liquidwar/package.nix
@@ -90,21 +90,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   hardeningDisable = [ "format" ];
 
-  env.NIX_CFLAGS_COMPILE = toString (
-    lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
-      # Needed with GCC 12 but problematic with some old GCCs
-      "-Wno-error=address"
-      "-Wno-error=use-after-free"
-      "-std=gnu17"
-      # Fix build w/ glibc-2.44
-      "-Wno-error=discarded-qualifiers"
-    ]
-    ++ [
-      "-Wno-error=deprecated-declarations"
-      # Avoid GL_GLEXT_VERSION double definition
-      " -DNO_SDL_GLEXT"
-    ]
-  );
+  env.NIX_CFLAGS_COMPILE = toString [
+    # gcc-12 and above generate many benign warnings
+    "-Wno-error"
+    "-std=gnu17"
+    # Avoid GL_GLEXT_VERSION double definition
+    "-DNO_SDL_GLEXT"
+  ];
 
   # To avoid problems finding SDL_types.h.
   configureFlags = [ "CFLAGS=-I${lib.getDev SDL}/include/SDL" ];
diff --git a/pkgs/by-name/ma/macaulay2/package.nix b/pkgs/by-name/ma/macaulay2/package.nix
index ec4e5dfa3c59..425886aaf2cf 100644
--- a/pkgs/by-name/ma/macaulay2/package.nix
+++ b/pkgs/by-name/ma/macaulay2/package.nix
@@ -17,7 +17,6 @@
   cohomcalg,
   csdp,
   eigen,
-  emacs-nox,
   fflas-ffpack,
   flex,
   flint,
@@ -70,8 +69,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "Macaulay2";
     repo = "M2";
     tag = "release-${finalAttrs.version}";
-    hash = "sha256-2e39qzBO63Ft+yw+tJChLsupeinalTkDwXp3WBF2wms=";
-    fetchSubmodules = true;
+    hash = "sha256-kYxqbMKW+7r6nI4i3o7vvJVf0TGRVLaDviZTFx3PTBI=";
   };
 
   docs = fetchurl {
@@ -122,13 +120,14 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     autoreconfHook
     bison
-    emacs-nox
     flex
+    flint
     gdbm
     getconf
     gfortran
     makeWrapper
     pkg-config
+    R
     texinfo
     which
 
@@ -152,10 +151,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   postPatch = ''
     sed -i 's/AC_SUBST(REL,.*uname -r.*)/AC_SUBST(REL,"")/' configure.ac
-    substituteInPlace configure.ac \
-      --replace-fail "[\$gfan_version], [ge], [0.8]" "[\$gfan_version], [ge], [0.6]"
-    substituteInPlace Macaulay2/packages/gfanInterface.m2 \
-      --replace-fail 'MinimumVersion => ("0.8"' 'MinimumVersion => ("0.6"'
+    # remove editor stuff from Makefiles
+    substituteInPlace Macaulay2/Makefile.in \
+      --replace-fail "all-in-editors" "" \
+      --replace-fail "editors" ""
   '';
 
   preConfigure = ''
@@ -286,6 +285,7 @@ stdenv.mkDerivation (finalAttrs: {
       decomposition of ideals, integral closure of rings, and more.
     '';
     homepage = "https://macaulay2.com/";
+    changelog = "https://macaulay2.com/doc/Macaulay2/share/doc/Macaulay2/Macaulay2Doc/html/_changes_cm_sp${finalAttrs.version}.html";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ coolcuber ];
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
diff --git a/pkgs/by-name/ma/markuplinkchecker/package.nix b/pkgs/by-name/ma/markuplinkchecker/package.nix
index ad363af36cba..45fd80303276 100644
--- a/pkgs/by-name/ma/markuplinkchecker/package.nix
+++ b/pkgs/by-name/ma/markuplinkchecker/package.nix
@@ -6,7 +6,7 @@
   openssl,
 }:
 let
-  version = "1.2.0";
+  version = "1.2.2";
 in
 rustPlatform.buildRustPackage {
   pname = "markuplinkchecker";
@@ -16,10 +16,10 @@ rustPlatform.buildRustPackage {
     owner = "becheran";
     repo = "mlc";
     rev = "v${version}";
-    hash = "sha256-6v4tRCtoABbb0bwOagEGHk2QoUs3u/AnME5g7vhbkI4=";
+    hash = "sha256-abm44HA/S8F7BBQDFOedx5FmNujeuBzjLKZwvW///gk=";
   };
 
-  cargoHash = "sha256-W4aOrKnRDAvHC4c+7e/XYSOgB/wFExqQhimaPJNiJk8=";
+  cargoHash = "sha256-KsVLRAWS96/CixiaXRo09BrYIn+RIIUI6ldge30H7Ow=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/ma/matrix-conduit/package.nix b/pkgs/by-name/ma/matrix-conduit/package.nix
index 9debe7777978..f03587fb25c7 100644
--- a/pkgs/by-name/ma/matrix-conduit/package.nix
+++ b/pkgs/by-name/ma/matrix-conduit/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "matrix-conduit";
-  version = "0.10.13";
+  version = "0.10.14";
 
   src = fetchFromGitLab {
     owner = "famedly";
     repo = "conduit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1j3q/n6sC3bIVwbcZfegJQO9WaLPfJWqgibO/XNmj6s=";
+    hash = "sha256-A7Gryk1ZWDu751n3rBfv9HUTiokoGhBol/ve9mWwRjA=";
   };
 
-  cargoHash = "sha256-YfgvcY1yYwlQuoEl21XEAxDR/SDce+OHhZOzp6tkzR0=";
+  cargoHash = "sha256-afYD2cR6VyFSa1M33ktuNcg2/r/Ag3HNKSz95gRCwuE=";
 
   # Conduit enables rusqlite's bundled feature by default, but we'd rather use our copy of SQLite.
   preBuild = ''
diff --git a/pkgs/by-name/mc/mcp-searxng/package.nix b/pkgs/by-name/mc/mcp-searxng/package.nix
index e9db284baf97..c839d0f1834f 100644
--- a/pkgs/by-name/mc/mcp-searxng/package.nix
+++ b/pkgs/by-name/mc/mcp-searxng/package.nix
@@ -6,7 +6,7 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "mcp-searxng";
-  version = "2.4.0";
+  version = "2.5.0";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -15,10 +15,10 @@ buildNpmPackage (finalAttrs: {
     owner = "ihor-sokoliuk";
     repo = "mcp-searxng";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1ZGo6150O8cn2b4pYLqPWs+l11L+SpeH+ATKE470Hwo=";
+    hash = "sha256-yfxnYD1onNw5J6yLq2RxqAtlNnH319DWD1Zu3JM8eq0=";
   };
 
-  npmDepsHash = "sha256-21mw8/qUgLuAhF9KYZU7N+K4af7OBVwBHGqnr7p6lDE=";
+  npmDepsHash = "sha256-QhUqB/+R3BGwx8gH0MDn+PiMEtira3vZdosJj8oMsaI=";
 
   meta = {
     description = "Private web search for AI assistants via SearXNG — supports Claude, Cursor, and any MCP client";
diff --git a/pkgs/by-name/md/mdbook-rss-feed/package.nix b/pkgs/by-name/md/mdbook-rss-feed/package.nix
index 759d495ae00d..676585ef6255 100644
--- a/pkgs/by-name/md/mdbook-rss-feed/package.nix
+++ b/pkgs/by-name/md/mdbook-rss-feed/package.nix
@@ -38,6 +38,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
       matthiasbeyer
+      saylesss88
       pinage404
     ];
     mainProgram = "mdbook-rss-feed";
diff --git a/pkgs/by-name/mi/microsoft-edge/update.sh b/pkgs/by-name/mi/microsoft-edge/update.sh
index ac352ca9f7d3..78c9b7ab348b 100755
--- a/pkgs/by-name/mi/microsoft-edge/update.sh
+++ b/pkgs/by-name/mi/microsoft-edge/update.sh
@@ -215,10 +215,11 @@ update_msedgedriver() {
     # msedgedriver/package.nix
     declare -A hashes=(
         [mac64_m1]=""
+        [mac64]=""
         [linux64]=""
     )
 
-    for driver_arch in mac64_m1 linux64; do
+    for driver_arch in mac64_m1 mac64 linux64; do
         url="https://msedgedriver.microsoft.com/${version}/edgedriver_${driver_arch}.zip"
 
         new_hash="$(
@@ -238,7 +239,7 @@ update_msedgedriver() {
         "/pname = \"msedgedriver\";/,/^  meta = {/s/version = \".*\"/version = \"$version\"/" \
         "$DRIVER_NIX"
 
-    for driver_arch in mac64_m1 linux64; do
+    for driver_arch in mac64_m1 mac64 linux64; do
         sed -i \
             "/pname = \"msedgedriver\";/,/^  meta = {/s|${driver_arch} = \".*\"|${driver_arch} = \"${hashes[$driver_arch]}\"|" \
             "$DRIVER_NIX"
diff --git a/pkgs/by-name/mi/mithril/package.nix b/pkgs/by-name/mi/mithril/package.nix
index 1e8e84afa88b..85cd6181c8de 100644
--- a/pkgs/by-name/mi/mithril/package.nix
+++ b/pkgs/by-name/mi/mithril/package.nix
@@ -9,7 +9,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mithril";
-  version = "0.1.3";
+  version = "0.2.1";
   __structuredAttrs = true;
   strictDeps = true;
 
@@ -17,7 +17,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "nmatt0";
     repo = "mithril";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GsJFTsW34e1W4b+zBmy9XfY2y/eGdsg0YANZAd733i4=";
+    hash = "sha256-j0bdYI08yv6QUgMoVI8fGiTkFPg1LMjFjCpUGfUnx5M=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/mo/moka-icon-theme/package.nix b/pkgs/by-name/mo/moka-icon-theme/package.nix
index 6ce987e42127..fe57299b97e0 100644
--- a/pkgs/by-name/mo/moka-icon-theme/package.nix
+++ b/pkgs/by-name/mo/moka-icon-theme/package.nix
@@ -13,13 +13,16 @@
 
 stdenvNoCC.mkDerivation {
   pname = "moka-icon-theme";
-  version = "unstable-2019-05-29";
+  version = "5.4.0-unstable-2019-05-30";
+
+  strictDeps = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "snwh";
     repo = "moka-icon-theme";
     rev = "c0355ea31e5cfdb6b44d8108f602d66817546a09";
-    sha256 = "0m4kfarkl94wdhsds2q1l9x5hfa9l3117l8j6j7qm7sf7yzr90c8";
+    hash = "sha256-iIGUvz9On4qPNBLRE8KgSTlYeqIBC900bJwkOrNyk1Q=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/mo/moria/package.nix b/pkgs/by-name/mo/moria/package.nix
index 3affbca79d9b..f20cf4464abd 100644
--- a/pkgs/by-name/mo/moria/package.nix
+++ b/pkgs/by-name/mo/moria/package.nix
@@ -13,7 +13,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "moria";
-  version = "0.1.0";
+  version = "0.2.1";
   __structuredAttrs = true;
   strictDeps = true;
 
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "nmatt0";
     repo = "moria";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tzBJEUl2AbzZh4exjlhw7yv4JsgTj80DYngoRofJjgY=";
+    hash = "sha256-okeAzE2qUO6i1a4kyp+IjsH7OOyBCAMQv+dzgBR73o8=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/mo/mosh/package.nix b/pkgs/by-name/mo/mosh/package.nix
index 11c6b1c66e62..3f97099ccea1 100644
--- a/pkgs/by-name/mo/mosh/package.nix
+++ b/pkgs/by-name/mo/mosh/package.nix
@@ -9,10 +9,10 @@
   makeWrapper,
   perl,
   openssl,
+  autoconf-archive,
   autoreconfHook,
   openssh,
   bash-completion,
-  fetchpatch,
   withUtempter ? stdenv.hostPlatform.isLinux,
   libutempter,
   # build server binary only when set to false (useful for perlless systems)
@@ -31,6 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   nativeBuildInputs = [
+    autoconf-archive
     autoreconfHook
     pkg-config
     makeWrapper
@@ -58,15 +59,15 @@ stdenv.mkDerivation (finalAttrs: {
     ./mosh-client_path.patch
     # Fix build with bash-completion 2.10
     ./bash_completion_datadir.patch
-
-    # Fixes build with protobuf3 23.x
-    (fetchpatch {
-      url = "https://github.com/mobile-shell/mosh/commit/eee1a8cf413051c2a9104e8158e699028ff56b26.patch";
-      hash = "sha256-CouLHWSsyfcgK3k7CvTK3FP/xjdb1pfsSXYYQj3NmCQ=";
-    })
   ];
 
+  # remove the m4 directory, as it contains only ancient versions of macros
+  # from autoconf-archive or pkg-config. instead, we fetch up-to-date versions
+  # from the packages which provide them. this allows selecting modern C++
+  # standard versions, which is important with e.g. GCC 16.
   postPatch = ''
+    rm -rf m4
+
     substituteInPlace scripts/mosh.pl \
       --subst-var-by ssh "${openssh}/bin/ssh" \
       --subst-var-by mosh-client "$out/bin/mosh-client"
diff --git a/pkgs/by-name/ms/msedgedriver/package.nix b/pkgs/by-name/ms/msedgedriver/package.nix
index 376901f228c5..cd1fadbe6dd9 100644
--- a/pkgs/by-name/ms/msedgedriver/package.nix
+++ b/pkgs/by-name/ms/msedgedriver/package.nix
@@ -19,6 +19,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       driverArch =
         {
           aarch64-darwin = "mac64_m1";
+          x86_64-darwin = "mac64";
           x86_64-linux = "linux64";
         }
         .${stdenvNoCC.hostPlatform.system};
@@ -28,6 +29,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       hash =
         {
           mac64_m1 = "sha256-6nwe/vRPh5MkQLTiZNXepfFsLtILwoK925mgLCUUVNg=";
+          mac64 = "sha256-p/cnNKQub6sSEWPz2fJ+FoU7rgzeoZQMkv3PphvvHLw=";
           linux64 = "sha256-XbOQl9FyckF3Qybb+40474ImJDKahBkekPoydf/TxV0=";
         }
         .${driverArch};
diff --git a/pkgs/by-name/mu/mullvad-browser/package.nix b/pkgs/by-name/mu/mullvad-browser/package.nix
index 7278216666bd..076e87580fa9 100644
--- a/pkgs/by-name/mu/mullvad-browser/package.nix
+++ b/pkgs/by-name/mu/mullvad-browser/package.nix
@@ -97,7 +97,7 @@ let
     ++ lib.optionals mediaSupport [ ffmpeg_7 ]
   );
 
-  version = "15.0.23";
+  version = "15.0.24";
 
   sources = {
     x86_64-linux = fetchurl {
@@ -109,7 +109,7 @@ let
         "https://tor.eff.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"
         "https://tor.calyxinstitute.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"
       ];
-      hash = "sha256-Bzd0atOeqHFhmIlpN3cbGogkwg6SwpNhn5m4yscpIzo=";
+      hash = "sha256-vKVlZ2t9S66AZQ82fUw+csRQtMvOJLrJbbetS33Fb+o=";
     };
   };
 
diff --git a/pkgs/by-name/ne/neovim-node-client/package.nix b/pkgs/by-name/ne/neovim-node-client/package.nix
index 0a1ba9a98d14..3afc39d7c1aa 100644
--- a/pkgs/by-name/ne/neovim-node-client/package.nix
+++ b/pkgs/by-name/ne/neovim-node-client/package.nix
@@ -23,6 +23,10 @@ buildNpmPackage rec {
     hash = "sha256-Vl6VPcwDrYAC4HWeY+6eWPl/2+Mw6fkScS5fsrLlWxw=";
   };
 
+  # Prevent unrs-resolver's postinstall script from running,
+  # which tries to download binaries on exotic platforms and fails
+  npmRebuildFlags = [ "--ignore-scripts" ];
+
   buildPhase = ''
     runHook preBuild
     npm run build
diff --git a/pkgs/by-name/ne/netclient/package.nix b/pkgs/by-name/ne/netclient/package.nix
index 16821a0fd79e..8b3cecc71167 100644
--- a/pkgs/by-name/ne/netclient/package.nix
+++ b/pkgs/by-name/ne/netclient/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "netclient";
-  version = "1.6.0";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "gravitl";
     repo = "netclient";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-3vljlrWmetQfAwemRsC76e7DqlFVQKxnV1mpx/NtYvc=";
+    hash = "sha256-OgCKcfNU0AKAbe+jrmLZ9o7J7xYxIYxcLfdtN6yYEfg=";
   };
 
-  vendorHash = "sha256-fnXekqGK1c6pf8UY1F44RYbU+wc9kZJQg3hmRPcBFCE=";
+  vendorHash = "sha256-SAJkeuDEVOqNDAUTY8ywSrnbq/lPYIbLtLGGGk882TM=";
 
   buildInputs = lib.optional stdenv.hostPlatform.isLinux libx11;
 
diff --git a/pkgs/by-name/ne/nextvi/package.nix b/pkgs/by-name/ne/nextvi/package.nix
index 7133e49b6532..6bf93eb8f063 100644
--- a/pkgs/by-name/ne/nextvi/package.nix
+++ b/pkgs/by-name/ne/nextvi/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nextvi";
-  version = "7.6";
+  version = "7.8";
 
   src = fetchFromGitHub {
     owner = "kyx0r";
     repo = "nextvi";
     tag = finalAttrs.version;
-    hash = "sha256-Qzd+zOv0lFWZU6M91XR38JXUu6q+m9fbDtx98V2TIOs=";
+    hash = "sha256-heIsBDxCx+DKft6slKDw2YG8AdK887e27WlqrUV87bM=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/by-name/ni/nix-fast-build/package.nix b/pkgs/by-name/ni/nix-fast-build/package.nix
index 58e3db685e2c..6fe54a243187 100644
--- a/pkgs/by-name/ni/nix-fast-build/package.nix
+++ b/pkgs/by-name/ni/nix-fast-build/package.nix
@@ -9,7 +9,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "nix-fast-build";
-  version = "2.0.3";
+  version = "2.0.4";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -17,7 +17,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "Mic92";
     repo = "nix-fast-build";
     tag = finalAttrs.version;
-    hash = "sha256-L4HfADUq4Imq1LnvmjBPFBEAZAIKD9Pnj6ExRkVqHC4=";
+    hash = "sha256-sc/NZIHkRhgyAzK8Xn6G++vGrl/Uf7QHh+J5fnZ/o4s=";
   };
 
   build-system = [ python3Packages.setuptools ];
diff --git a/pkgs/by-name/ni/nixos-option/nixos-option.nix b/pkgs/by-name/ni/nixos-option/nixos-option.nix
index 9ffe7beb62c6..b7c892980bd5 100644
--- a/pkgs/by-name/ni/nixos-option/nixos-option.nix
+++ b/pkgs/by-name/ni/nixos-option/nixos-option.nix
@@ -125,7 +125,7 @@ let
     in
     lib.concatStringsSep "\n\n" (
       lib.concatLists [
-        (entry true "Value" (toPretty value))
+        (entry true "Value" (safeToPretty value))
         (entry (option ? default) "Default" (toPretty option.default))
         (entry (option ? type) "Type" (option.type.description))
         (entry (option ? description) "Description" (lib.removeSuffix "\n" option.description))
diff --git a/pkgs/by-name/ob/objdiff/package.nix b/pkgs/by-name/ob/objdiff/package.nix
index 9d1e71f66cba..2deb843cda5a 100644
--- a/pkgs/by-name/ob/objdiff/package.nix
+++ b/pkgs/by-name/ob/objdiff/package.nix
@@ -17,17 +17,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "objdiff";
-  version = "3.8.0";
+  version = "3.8.1";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "encounter";
     repo = "objdiff";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DuU7NJJSIPoePNrG6HH/IEmJtUEio7067jQNDOPX7nA=";
+    hash = "sha256-zLf2vElF39HrCWbq++3ytU9vIO+G5d/vUwJj1Z8asGk=";
   };
 
-  cargoHash = "sha256-ckF4N4GqdQxInLrmpTBgh2bdtMjFbmkjZzEZUUpxhbs=";
+  cargoHash = "sha256-5LE5g8KgOxIBt6lTnn2m8wvfNj2T4Ap06jLVeSo2feQ=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/om/omp/package.nix b/pkgs/by-name/om/omp/package.nix
index 6f4f51e9dd0b..34326ba15067 100644
--- a/pkgs/by-name/om/omp/package.nix
+++ b/pkgs/by-name/om/omp/package.nix
@@ -32,7 +32,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "omp";
-  version = "18.4.2";
+  version = "18.4.4";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -41,12 +41,12 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "can1357";
     repo = "oh-my-pi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ULo5rPVhEFfOnIlkv61UzzPt3LBKqIki+G0xoYLcY1A=";
+    hash = "sha256-S8Oz/xYEJCIc36S9u2UWXqYYQhjFxKMMzgFiB9PRVcY=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src;
-    hash = "sha256-esJIhawsgBmJPCV2yiM5S1pamOPHSK0xaszYaBMikCw=";
+    hash = "sha256-8iLC2HfeYFWF8QJJGxPeveogLP5k+Tyik/ozgzZpXXo=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/op/open-websearch/package.nix b/pkgs/by-name/op/open-websearch/package.nix
index a90c445b1761..a7249417cef8 100644
--- a/pkgs/by-name/op/open-websearch/package.nix
+++ b/pkgs/by-name/op/open-websearch/package.nix
@@ -5,7 +5,7 @@
 }:
 buildNpmPackage (finalAttrs: {
   pname = "open-websearch";
-  version = "2.1.9";
+  version = "2.2.0";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -14,10 +14,10 @@ buildNpmPackage (finalAttrs: {
     owner = "Aas-ee";
     repo = "open-webSearch";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ZS56Eoy9IePLeyopv4AK6FU8+b1E8r/WPK6RYDvy6yA=";
+    hash = "sha256-5Hf1e3AgSC0brQqMqAbTt718ly1Ms5GoV0JuDAE1BCc=";
   };
 
-  npmDepsHash = "sha256-Ua20YOYr/D06eMQsgBgfN/W7F74wfjjHXL10XIB0nFA=";
+  npmDepsHash = "sha256-fcRKZroEokDjEY1xiIu5kOqthIK0zx6ZnjpWMkzyIj0=";
 
   meta = {
     description = "Web search MCP server";
diff --git a/pkgs/by-name/op/opendht/package.nix b/pkgs/by-name/op/opendht/package.nix
index cfe6f6b147f0..fc6ec39b75db 100644
--- a/pkgs/by-name/op/opendht/package.nix
+++ b/pkgs/by-name/op/opendht/package.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "opendht";
-  version = "4.4.0";
+  version = "4.4.1";
 
   src = fetchFromGitHub {
     owner = "savoirfairelinux";
     repo = "opendht";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zPyMQk93nD5pueWtKYvuJ1mk4j2wmI7OgpMG+/sG1bQ=";
+    hash = "sha256-T9p/tWSNrU/MTkrLT3J33pO6q58YCmmHNOb/tbxk3YE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/op/openfga-cli/package.nix b/pkgs/by-name/op/openfga-cli/package.nix
index 56a58e10a7bd..f8ae86c2b88b 100644
--- a/pkgs/by-name/op/openfga-cli/package.nix
+++ b/pkgs/by-name/op/openfga-cli/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "openfga-cli";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "openfga";
     repo = "cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-zpWA7+uveWQPWV7eCqqf5C1Juubpu11qm2svIHMt2N0=";
+    hash = "sha256-/m0lWsws1LtutiTM+RSG30Yv3D60uFAy54mKXqcYFUU=";
   };
 
-  vendorHash = "sha256-wxQG7MzVzwY9PBZ3DJ8TiOW5xJsMXXU7MaxmBfNAm30=";
+  vendorHash = "sha256-865bFtlvmEb2fvEpTfrVLXNLqxY/PtAN5c90eLwQx38=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/op/openvino/package.nix b/pkgs/by-name/op/openvino/package.nix
index 5b97a543359d..7cbea42f8597 100644
--- a/pkgs/by-name/op/openvino/package.nix
+++ b/pkgs/by-name/op/openvino/package.nix
@@ -5,7 +5,6 @@
   cudaSupport ? opencv.cudaSupport or false,
 
   # build
-  scons,
   addDriverRunpath,
   autoPatchelfHook,
   cmake,
@@ -37,9 +36,6 @@ let
     getLib
     ;
 
-  # prevent scons from leaking in the default python version
-  scons' = scons.override { inherit python3Packages; };
-
   python = python3Packages.python.withPackages (
     ps: with ps; [
       cython
@@ -83,7 +79,6 @@ stdenv.mkDerivation (finalAttrs: {
     patchelf
     pkg-config
     python
-    scons'
   ]
   ++ lib.optionals cudaSupport [
     cudaPackages.cuda_nvcc
@@ -98,21 +93,6 @@ stdenv.mkDerivation (finalAttrs: {
     ./gcc-16-fix.patch
   ];
 
-  # Fix arm computelib ar/ranlib toolchain paths for LTO awareness
-  postPatch = ''
-    substituteInPlace src/plugins/intel_cpu/thirdparty/ComputeLibrary/SConstruct \
-      --replace-fail \
-        "env['AR'] = toolchain_prefix + \"ar\"" \
-        "env['AR'] = \"${lib.getExe' stdenv.cc.cc "gcc-ar"}\"" \
-      --replace-fail \
-        "env['RANLIB'] = toolchain_prefix + \"ranlib\"" \
-        "env['RANLIB'] = \"${lib.getExe' stdenv.cc.cc "gcc-ranlib"}\""
-  '';
-
-  dontUseSconsCheck = true;
-  dontUseSconsBuild = true;
-  dontUseSconsInstall = true;
-
   cmakeFlags = [
     "-Wno-dev"
     "-DCMAKE_MODULE_PATH:PATH=${placeholder "out"}/lib/cmake"
@@ -159,6 +139,7 @@ stdenv.mkDerivation (finalAttrs: {
     (cmakeBool "ENABLE_SYSTEM_PUGIXML" true)
     (cmakeBool "ENABLE_SYSTEM_SNAPPY" true)
     (cmakeBool "ENABLE_SYSTEM_TBB" true)
+    (cmakeBool "ENABLE_ARM_COMPUTE_CMAKE" true)
   ];
 
   # src/graph/src/plugins/intel_gpu/src/graph/include/reorder_inst.h:24:8: error: type 'struct typed_program_node' violates the C++ One Definition Rule [-Werror=odr]
@@ -193,6 +174,10 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail "exec_prefix=\''${prefix}/" "exec_prefix="
   '';
 
+  disallowedRequisites = [
+    stdenv.cc.cc
+  ];
+
   meta = {
     changelog = "https://github.com/openvinotoolkit/openvino/releases/tag/${finalAttrs.src.tag}";
     description = "Open-source toolkit for optimizing and deploying AI inference";
diff --git a/pkgs/by-name/ov/ov/package.nix b/pkgs/by-name/ov/ov/package.nix
index ba985ef0cb09..914e90ec6993 100644
--- a/pkgs/by-name/ov/ov/package.nix
+++ b/pkgs/by-name/ov/ov/package.nix
@@ -12,7 +12,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "ov";
-  version = "0.54.0";
+  version = "0.55.0";
 
   __structuredAttrs = true;
 
@@ -20,10 +20,10 @@ buildGoModule (finalAttrs: {
     owner = "noborus";
     repo = "ov";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cIjtu4T9It+u/ZVC+XoUacvnYw51QSnbTNge1QaHr0s=";
+    hash = "sha256-zYxgXVUHLBY1VBh1JNyeIhkU444UFak77+rEZ1TTSGI=";
   };
 
-  vendorHash = "sha256-eQh/S2isNvT9l+A4uK+/APcw+krsFL54OD5E6yEduxU=";
+  vendorHash = "sha256-KFx2ZCh0DT5a5cp/CG3dnPwTLQgl5we43usyVdf/ihU=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/pe/peertube/package.nix b/pkgs/by-name/pe/peertube/package.nix
index f84fc3996d9b..6349e5c23f3e 100644
--- a/pkgs/by-name/pe/peertube/package.nix
+++ b/pkgs/by-name/pe/peertube/package.nix
@@ -22,7 +22,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "peertube";
-  version = "8.3.0";
+  version = "8.3.1";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "Chocobozzz";
     repo = "PeerTube";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gHWtQRpbYV1oW7/V2dpAsiTZhV/vtCkuBF23T1Or3Qc=";
+    hash = "sha256-9Arq6gvMZV+0WcHWGwFnMjtnZzW+hWPPsHkJDwMFZCM=";
   };
 
   outputs = [
@@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_10;
     fetcherVersion = 3;
-    hash = "sha256-fadktAeQEjjGm06Re0gQuXUxsqEF7tWBf4KNrsF5pfI=";
+    hash = "sha256-HbscF8sjgFCICJnpWopW5VWcD67XdzKOONWn+RHZThI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ph/phoenixd/package.nix b/pkgs/by-name/ph/phoenixd/package.nix
index f718ba742e22..c36b9a837a70 100644
--- a/pkgs/by-name/ph/phoenixd/package.nix
+++ b/pkgs/by-name/ph/phoenixd/package.nix
@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "phoenixd";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src =
     let
@@ -27,9 +27,9 @@ stdenv.mkDerivation (finalAttrs: {
     fetchurl {
       url = "https://github.com/ACINQ/phoenixd/releases/download/v${finalAttrs.version}/phoenixd-${finalAttrs.version}-${suffix}.zip";
       hash = selectSystem {
-        aarch64-darwin = "sha256-NQyHyQzfkdLPpQnuSP09cSZwITA9Q1ml7q2haU3qm5o=";
-        x86_64-linux = "sha256-2eVLk4E/F3GwcslsWulo/7WwUvLKHEJ2K2biy4A2Kg8=";
-        aarch64-linux = "sha256-yAbw2AWKSHKEFzU2rMupBBF2+CF/jITOWbbpfQSoizE=";
+        aarch64-darwin = "sha256-LSPejXZgqXy7W2TXizv6B2FJOAY9vB5u4/pMbYqzwlc=";
+        x86_64-linux = "sha256-zLT8+0X4OUgdEtn5zfPbHU9pZV+O9vVpy0OzRe1VIc4=";
+        aarch64-linux = "sha256-T+W/SA+/sQbA57JcrW42nEjwfBKfwRHBL2U1fjULxLw=";
       };
     };
 
diff --git a/pkgs/by-name/ph/phpunit/package.nix b/pkgs/by-name/ph/phpunit/package.nix
index 863597cc9341..5e9177d0367d 100644
--- a/pkgs/by-name/ph/phpunit/package.nix
+++ b/pkgs/by-name/ph/phpunit/package.nix
@@ -8,16 +8,16 @@
 
 php.buildComposerProject2 (finalAttrs: {
   pname = "phpunit";
-  version = "13.3.2";
+  version = "13.3.5";
 
   src = fetchFromGitHub {
     owner = "sebastianbergmann";
     repo = "phpunit";
     tag = finalAttrs.version;
-    hash = "sha256-pqLjCE7tW7NOAzgFe5grPlRfXTrEXqx1OcFOBCJuO7M=";
+    hash = "sha256-3tbre+82kk8ngpN4JfMEe36YQQZDtY6PgFBUECmUa8o=";
   };
 
-  vendorHash = "sha256-jxV72scmud977MHDItY7wSmZ5j9fUEafty4foSiGH4Y=";
+  vendorHash = "sha256-Pv5O63wsTaQX5owW0XpyQbcSajaGmesorIatfrgZKJk=";
 
   passthru = {
     updateScript = nix-update-script { };
diff --git a/pkgs/by-name/pi/pi-coding-agent/package.nix b/pkgs/by-name/pi/pi-coding-agent/package.nix
index 5ec40d5ee1cb..a11c292c441a 100644
--- a/pkgs/by-name/pi/pi-coding-agent/package.nix
+++ b/pkgs/by-name/pi/pi-coding-agent/package.nix
@@ -13,16 +13,16 @@
 }:
 buildNpmPackage (finalAttrs: {
   pname = "pi-coding-agent";
-  version = "0.87.1";
+  version = "0.99.1";
 
   src = fetchFromGitHub {
     owner = "earendil-works";
     repo = "pi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GUhlq6t+l6iiViOZ0bkV28v3ZDqcLvEwpZpYZ5JAyDk=";
+    hash = "sha256-bLDEt1sKiS6ReQ6Uch0tOSLU8aykKl3UwN7WVkRE9Og=";
   };
 
-  npmDepsHash = "sha256-JBIYoP2vvRNz1HONNvDJ1U3c+nmCJ7/VgNthRTkrkIA=";
+  npmDepsHash = "sha256-eKtv1fN7X4ukuYbsj7hduGZ3W2FdmO/fAnoaWJp7MQQ=";
 
   # The provider model catalog (packages/ai/src/providers/data/) is generated by
   # a network fetch (models.dev plus provider APIs) and is gitignored upstream,
@@ -31,7 +31,7 @@ buildNpmPackage (finalAttrs: {
   # under dist/providers/data/. Bump this hash alongside version.
   modelData = fetchurl {
     url = "https://registry.npmjs.org/@earendil-works/pi-ai/-/pi-ai-${finalAttrs.version}.tgz";
-    hash = "sha256-NbRDLyfMJmX4a+67mvajmxJRlwiDwwRL2L5PToxzHKA=";
+    hash = "sha256-+fRGkhV9C/VnnEoXMEoxACgjHX2q6q6jtzJS9LeiZNM=";
   };
 
   preConfigure = ''
@@ -51,22 +51,12 @@ buildNpmPackage (finalAttrs: {
     makeBinaryWrapper
   ];
 
-  # Build workspace dependencies in order, then the coding-agent.
-  # We invoke tsgo directly for workspace deps to skip pi-ai's
-  # generate-models script, which requires network access; the model
-  # catalog it would produce is supplied via modelData above.
+  # Build workspace dependencies in order, then the coding-agent, using the
+  # model catalog supplied via modelData instead of fetching it during build.
   buildPhase = ''
     runHook preBuild
 
-    npx tsgo -p packages/chord/tsconfig.build.json
-    npx tsgo -p packages/tui/tsconfig.build.json
-    npx tsgo -p packages/telemetry/tsconfig.build.json
-    npx tsgo -p packages/ai/tsconfig.build.json
-    npx tsgo -p packages/agent/tsconfig.build.json
-    npx tsgo -p packages/protocol/tsconfig.build.json
-    npx tsgo -p packages/client/tsconfig.build.json
-    npx tsgo -p packages/server/tsconfig.build.json
-    npm run build --workspace=packages/coding-agent
+    npm run build:offline
 
     runHook postBuild
   '';
@@ -88,6 +78,8 @@ buildNpmPackage (finalAttrs: {
               @earendil-works/pi-ai:packages/ai \
               @earendil-works/pi-agent-core:packages/agent \
               @earendil-works/pi-client:packages/client \
+              @earendil-works/pi-codemode:packages/codemode \
+              @earendil-works/pi-mcp:packages/mcp \
               @earendil-works/pi-protocol:packages/protocol \
               @earendil-works/pi-telemetry:packages/telemetry \
               @earendil-works/pi-tui:packages/tui; do
diff --git a/pkgs/by-name/pl/plink2/package.nix b/pkgs/by-name/pl/plink2/package.nix
index b4138a904c7b..f46a193e8eec 100644
--- a/pkgs/by-name/pl/plink2/package.nix
+++ b/pkgs/by-name/pl/plink2/package.nix
@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "plink2";
-  version = "2.0.0-a.7.7";
+  version = "2.0.0-a.7.9";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -20,7 +20,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "chrchang";
     repo = "plink-ng";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6mCUSXllfu5puG7oVHC+bAYIBwiFDienFz2r6otjkNc=";
+    hash = "sha256-HWa1mD++kIYI/BL3RYP06nBjvx4Fa+nS4neDOg+pTgg=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/2.0/build_dynamic";
diff --git a/pkgs/by-name/pl/plumed/package.nix b/pkgs/by-name/pl/plumed/package.nix
index e0ea4f987d02..a8cdeed578a2 100644
--- a/pkgs/by-name/pl/plumed/package.nix
+++ b/pkgs/by-name/pl/plumed/package.nix
@@ -3,6 +3,10 @@
   lib,
   fetchFromGitHub,
   blas,
+
+  # passthru
+  python3Packages,
+  nix-update-script,
 }:
 
 assert !blas.isILP64;
@@ -11,6 +15,9 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "plumed";
   version = "2.10.1";
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   src = fetchFromGitHub {
     owner = "plumed";
     repo = "plumed2";
@@ -26,10 +33,19 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
+  passthru = {
+    tests = {
+      pythonPackage = python3Packages.plumed;
+    };
+
+    updateScript = nix-update-script { };
+  };
+
   meta = {
     description = "Molecular metadynamics library";
     homepage = "https://github.com/plumed/plumed2";
     license = lib.licenses.lgpl3Only;
     maintainers = [ lib.maintainers.sheepforce ];
+    mainProgram = "plumed";
   };
 })
diff --git a/pkgs/by-name/po/polysh/package.nix b/pkgs/by-name/po/polysh/package.nix
index 73dcd1b11c2a..53557cf57204 100644
--- a/pkgs/by-name/po/polysh/package.nix
+++ b/pkgs/by-name/po/polysh/package.nix
@@ -5,7 +5,7 @@
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "polysh";
-  version = "1.0.4";
+  version = "1.0.6";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -13,7 +13,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "innogames";
     repo = "polysh";
     tag = "polysh-${finalAttrs.version}";
-    hash = "sha256-fmcu3lWSV5aft+gX5QjypdK5pyfdVd0HDNekiFVdlBI=";
+    hash = "sha256-t24Z5ftfQwkw9iB6T63kM/Mc9w66Szezig1e5PAlqiQ=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/pr/pretix/package.nix b/pkgs/by-name/pr/pretix/package.nix
index 9bc17d212b33..7236a8150c30 100644
--- a/pkgs/by-name/pr/pretix/package.nix
+++ b/pkgs/by-name/pr/pretix/package.nix
@@ -56,14 +56,14 @@ let
 in
 pythonPackages.buildPythonApplication (finalAttrs: {
   pname = "pretix";
-  version = "2026.7.0";
+  version = "2026.7.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pretix";
     repo = "pretix";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ozgsveEstgX3Wy24EaYhpbTUQrwbm+cIWFE0F2YIqfw=";
+    hash = "sha256-3qQE85O678Gkv3By3bCqwgHLIEi5oEAelS0erv/i2P4=";
   };
 
   patches = [
diff --git a/pkgs/by-name/re/redis-plus-plus/package.nix b/pkgs/by-name/re/redis-plus-plus/package.nix
index 5188c3bcc6da..530f2d05ad9a 100644
--- a/pkgs/by-name/re/redis-plus-plus/package.nix
+++ b/pkgs/by-name/re/redis-plus-plus/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch2,
   cmake,
   hiredis,
   enableShared ? !stdenv.hostPlatform.isStatic,
@@ -24,6 +25,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     ./0001-Fix-pkg-config-paths.patch
+
+    # https://github.com/sewenew/redis-plus-plus/issues/678
+    (fetchpatch2 {
+      name = "walk-around-gcc-16-bug.patch";
+      url = "https://github.com/sewenew/redis-plus-plus/commit/4b4cd0dc2931e96842ef05e165673b8679e32f48.patch?full_index=1";
+      hash = "sha256-neZj/J9nRg3Ft/+wQcRzvTjwm41odNnEfHnrs8/KiL4=";
+    })
   ];
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/rg/rgrc/package.nix b/pkgs/by-name/rg/rgrc/package.nix
index aa5160bc4bc1..4daa3d120858 100644
--- a/pkgs/by-name/rg/rgrc/package.nix
+++ b/pkgs/by-name/rg/rgrc/package.nix
@@ -10,7 +10,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rgrc";
-  version = "0.6.34";
+  version = "0.6.35";
 
   __structuredAttrs = true;
 
@@ -18,10 +18,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "lazywalker";
     repo = "rgrc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-awjRCCuO+3vK4CjeU8ZNJAkmfwidxpPO9MCbdowz7Hg=";
+    hash = "sha256-xoA4mtVhSPUfKEsU9bo5hFD7qPgL8LP1CggMpK+K7xI=";
   };
 
-  cargoHash = "sha256-v3PHi6qts5+VQmfEOkB/bls/Qrd/hXsW39N/H2SEyOo=";
+  cargoHash = "sha256-LpjmD+qfyNnehdBNLtSEvI41HSezA+Ht8B1UB07WSM8=";
 
   buildFeatures = [ "embed-configs" ];
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/by-name/ri/ripwire/package.nix b/pkgs/by-name/ri/ripwire/package.nix
index 8bba0f62dc78..87053062b64a 100644
--- a/pkgs/by-name/ri/ripwire/package.nix
+++ b/pkgs/by-name/ri/ripwire/package.nix
@@ -10,7 +10,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ripwire";
-  version = "0.6.1";
+  version = "0.6.5";
   __structuredAttrs = true;
   strictDeps = true;
 
@@ -18,7 +18,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "redhat-et";
     repo = "ripwire";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2a4J9lS0rdJyhkXkpQSkFrSf+NsMyeI2mJJNIYvgA8Y=";
+    hash = "sha256-6TeiT79KcEMhJI0HJIDTIOtrjmWgUxz8t8mkLpa2InQ=";
   };
 
   # Unvendor tree-sitter
diff --git a/pkgs/by-name/rn/rnr/package.nix b/pkgs/by-name/rn/rnr/package.nix
index 5092905a8ec1..6a4c9698ba67 100644
--- a/pkgs/by-name/rn/rnr/package.nix
+++ b/pkgs/by-name/rn/rnr/package.nix
@@ -23,6 +23,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     homepage = "https://github.com/ismaelgv/rnr";
     changelog = "https://github.com/ismaelgv/rnr/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.mit;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ jm5905938 ];
   };
 })
diff --git a/pkgs/by-name/ru/runn/package.nix b/pkgs/by-name/ru/runn/package.nix
index 9bccbd709745..1587a9f56ba5 100644
--- a/pkgs/by-name/ru/runn/package.nix
+++ b/pkgs/by-name/ru/runn/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "runn";
-  version = "1.10.0";
+  version = "1.11.1";
 
   src = fetchFromGitHub {
     owner = "k1LoW";
     repo = "runn";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-H9x4Jwc24qnDX5EnWhbWht5KdT/tkeceQp2GgmPJ7nE=";
+    hash = "sha256-UKqjPNZmljzWlM6/vgXcUAhe9ggd46WprwvBhYpagj0=";
   };
 
-  vendorHash = "sha256-59hDW3BKdhgSLQ9FgFtKcdy8Z1aW27YbAx4O5snU1WU=";
+  vendorHash = "sha256-yrrn3/NcH35L9u56XWbGRKaHCQv8hIFhoULAZKFzR6w=";
 
   subPackages = [ "cmd/runn" ];
 
diff --git a/pkgs/by-name/sc/schroedinger/package.nix b/pkgs/by-name/sc/schroedinger/package.nix
index 69909bf83141..ba0911a95f46 100644
--- a/pkgs/by-name/sc/schroedinger/package.nix
+++ b/pkgs/by-name/sc/schroedinger/package.nix
@@ -35,6 +35,9 @@ stdenv.mkDerivation (finalAttrs: {
 
   patchFlags = [ "-p0" ];
   patches = [
+    # force orc C backup code on RISC-V: the RVV JIT miscompiles the encoder
+    ./riscv64-orc-backup.patch
+
     (fetchpatch {
       url = "https://raw.githubusercontent.com/macports/macports-ports/master/multimedia/schroedinger/files/patch-testsuite-Makefile.am.diff";
       sha256 = "0cc8ymvgjgwy7ghca2dd8m8pxpinf27s2i8krf2m3fzv2ckq09v3";
diff --git a/pkgs/by-name/sc/schroedinger/riscv64-orc-backup.patch b/pkgs/by-name/sc/schroedinger/riscv64-orc-backup.patch
new file mode 100644
index 000000000000..8aec532c8e86
--- /dev/null
+++ b/pkgs/by-name/sc/schroedinger/riscv64-orc-backup.patch
@@ -0,0 +1,13 @@
+--- schroedinger/schro.c
++++ schroedinger/schro.c
+@@ -31,6 +31,10 @@
+ 
+   inited = TRUE;
+ 
++#if defined(__riscv)
++  setenv ("ORC_CODE", "backup,emulate", 0);
++#endif
++
+   orc_init ();
+   schro_orc_init ();
+ 
diff --git a/pkgs/by-name/sd/sdl_gamecontrollerdb/package.nix b/pkgs/by-name/sd/sdl_gamecontrollerdb/package.nix
index 58340dd57132..fea0d4ac7176 100644
--- a/pkgs/by-name/sd/sdl_gamecontrollerdb/package.nix
+++ b/pkgs/by-name/sd/sdl_gamecontrollerdb/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "sdl_gamecontrollerdb";
-  version = "0-unstable-2026-09-11";
+  version = "0-unstable-2026-09-27";
 
   src = fetchFromGitHub {
     owner = "mdqinc";
     repo = "SDL_GameControllerDB";
-    rev = "5a12daa568d19344f9b6e9286ef5929833b25c7c";
-    hash = "sha256-jH7glM8qOrZ2rffzxclAorO+gnzvhQ0p+xPfgL7ZYHM=";
+    rev = "94c48e92e0c969b438263bc4a7c74ba2ee2103da";
+    hash = "sha256-GzmC9PrMTjAGUDz4kLN9eyDFrjmSZqSBsh/wOn4tIio=";
   };
 
   dontBuild = true;
diff --git a/pkgs/by-name/se/seaweedfs/package.nix b/pkgs/by-name/se/seaweedfs/package.nix
index 73f6a06105c8..c7831560491c 100644
--- a/pkgs/by-name/se/seaweedfs/package.nix
+++ b/pkgs/by-name/se/seaweedfs/package.nix
@@ -9,7 +9,7 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "seaweedfs";
-  version = "4.47";
+  version = "4.48";
 
   src = fetchFromGitHub {
     owner = "seaweedfs";
@@ -22,10 +22,10 @@ buildGoModule (finalAttrs: {
       find "$out" -name .git -print0 | xargs -0 rm -rf
       popd
     '';
-    hash = "sha256-NEDQos7TF2RsbBLdg6bf1FumIa3KxqrpDFLB0avJpC8=";
+    hash = "sha256-c+VIgtFZTYn0aeBtx6mc9HAyQhJD/ZzQCpvDYUiFjsI=";
   };
 
-  vendorHash = "sha256-xDTcGTiGQdpOdLKvLmMrkiKlkcGdEtE52jWpcC+sOm4=";
+  vendorHash = "sha256-h+M0+RBqYTOUj4ALBxQyAEJkgFnaZrBbptCYqaUJYic=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/sh/shaarli/package.nix b/pkgs/by-name/sh/shaarli/package.nix
index fd933712c2ff..524139031ba6 100644
--- a/pkgs/by-name/sh/shaarli/package.nix
+++ b/pkgs/by-name/sh/shaarli/package.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "shaarli";
-  version = "0.16.6";
+  version = "0.16.7";
 
   src = fetchurl {
     url = "https://github.com/shaarli/Shaarli/releases/download/v${finalAttrs.version}/shaarli-v${finalAttrs.version}-full.zip";
-    sha256 = "sha256-hFi3Ouh+aPOnVZRLzU2yVkzsBFma96dWUmw+o0l6vao=";
+    sha256 = "sha256-ADnP/wcyDMUh9lsXeffNZCku27LyKjdCwdrJ8+K1zI4=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/sh/shipwright/package.nix b/pkgs/by-name/sh/shipwright/package.nix
index d1c4f44aa6ac..4fd7198d0c11 100644
--- a/pkgs/by-name/sh/shipwright/package.nix
+++ b/pkgs/by-name/sh/shipwright/package.nix
@@ -37,6 +37,7 @@
   bzip2,
   libx11,
   sdl_gamecontrollerdb,
+  fetchpatch,
 }:
 
 let
@@ -132,6 +133,16 @@ stdenv.mkDerivation (finalAttrs: {
   patches = [
     ./darwin-fixes.patch
     ./disable-downloading-stb_image.patch
+
+    # Fix building with gcc16
+    # Remove after 9.2.3
+    (fetchpatch {
+      name = "libultraship-fix-gcc16.patch";
+      url = "https://github.com/Kenix3/libultraship/commit/42ecb8ed48e4b15c21fe2e0d7e34cb5c02efa23d.patch";
+      stripLen = 1;
+      extraPrefix = "libultraship/";
+      hash = "sha256-LuaYeBdYf+pzRxUhZfFup4/r6oYzWi0YpAZzW1SR8Wk=";
+    })
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/si/simplebluez/package.nix b/pkgs/by-name/si/simplebluez/package.nix
index b0d3d7488b00..528f6a5d39e7 100644
--- a/pkgs/by-name/si/simplebluez/package.nix
+++ b/pkgs/by-name/si/simplebluez/package.nix
@@ -10,13 +10,13 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "simplebluez";
 
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "simpleble";
     repo = "SimpleBLE";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-GNLD62w5zTfW7CaknaZmU0jBro92HFw3gA29KJqOHGA=";
+    hash = "sha256-yA/InInNmK77/VxIX8CH0Nkqy9MJZr0Ci6xrVo76DK4=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/sn/snapraid/package.nix b/pkgs/by-name/sn/snapraid/package.nix
index 9a161810d458..a7821ccae434 100644
--- a/pkgs/by-name/sn/snapraid/package.nix
+++ b/pkgs/by-name/sn/snapraid/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "snapraid";
-  version = "14.9";
+  version = "14.10";
 
   src = fetchFromGitHub {
     owner = "amadvance";
     repo = "snapraid";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-z4ycepeh8ZKqJ9vUBhZMQImBmPAxRXMgtX/apgWXatI=";
+    hash = "sha256-vM1qPNrMbMaiMTRtpIJr2WdpIDXH5EydmgPeiZ4FrwQ=";
   };
 
   env.VERSION = finalAttrs.version;
diff --git a/pkgs/by-name/sp/spruce/package.nix b/pkgs/by-name/sp/spruce/package.nix
index 0344cc2f70ee..0ec96e387526 100644
--- a/pkgs/by-name/sp/spruce/package.nix
+++ b/pkgs/by-name/sp/spruce/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "spruce";
-  version = "1.35.19";
+  version = "1.35.20";
 
   src = fetchFromGitHub {
     owner = "geofffranks";
     repo = "spruce";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-wlquuVTVXnlo3fWLVxUn6jkxNoiKskY/Nt2/0aBE68s=";
+    hash = "sha256-kuJE25P0Jz2dL13V/1ohKIWrUB3meO/lv/llQR499Eg=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/ss/sscg/package.nix b/pkgs/by-name/ss/sscg/package.nix
index b5e566793798..9ed828dccbca 100644
--- a/pkgs/by-name/ss/sscg/package.nix
+++ b/pkgs/by-name/ss/sscg/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sscg";
-  version = "4.0.3";
+  version = "4.0.4";
 
   src = fetchFromGitHub {
     owner = "sgallagher";
     repo = "sscg";
     tag = "sscg-${finalAttrs.version}";
-    hash = "sha256-0t3ntUxfh1jFukWGwmdbt0axFfUiH1QEq6wFrGoI7Jk=";
+    hash = "sha256-lfb7sMREF3KEfUu6a2NW50F8ke7pG6ZokfBDlH1+K7o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/st/stackit-cli/package.nix b/pkgs/by-name/st/stackit-cli/package.nix
index 91f1c2966cc5..5d64b53ace51 100644
--- a/pkgs/by-name/st/stackit-cli/package.nix
+++ b/pkgs/by-name/st/stackit-cli/package.nix
@@ -12,16 +12,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "stackit-cli";
-  version = "0.73.0";
+  version = "0.74.0";
 
   src = fetchFromGitHub {
     owner = "stackitcloud";
     repo = "stackit-cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ZA/mmuF0svJOGps32K659NxGGLtcnobY1V7jsqzuROU=";
+    hash = "sha256-bpxHim1wE47qLGxqHR2qiT/povkge9KU5gtNxV1LEAQ=";
   };
 
-  vendorHash = "sha256-1uNrYr8wr00SlNfxZNVRkpc7OUp4K+nQ+0Gl90PHuxg=";
+  vendorHash = "sha256-tWNLBJbgokFQTWOZIHBl7TFSu2sO/dhIzvesl+bGsXw=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/st/stamp/package.nix b/pkgs/by-name/st/stamp/package.nix
index 153791f16c48..024c3b7ab8f1 100644
--- a/pkgs/by-name/st/stamp/package.nix
+++ b/pkgs/by-name/st/stamp/package.nix
@@ -21,7 +21,7 @@
 
 stdenv.mkDerivation {
   pname = "stamp";
-  version = "0-unstable-2026-09-04";
+  version = "0-unstable-2026-09-12";
   __structuredAttrs = true;
   strictDeps = true;
 
@@ -29,8 +29,8 @@ stdenv.mkDerivation {
     domain = "gitlab.gnome.org";
     owner = "jbrummer";
     repo = "stamp";
-    rev = "7fe72d3493854d7329fb861c186b5dd00f735a42";
-    hash = "sha256-xob7Subh6ZgqrkFtd0X8kq0gDMWIn5P4/Jw/Nd1RPJw=";
+    rev = "0ea93b7bce71a586274a835ffeae69ebc014641b";
+    hash = "sha256-GSAYL5nw3oaHHtNX/EOOD1lkKxOPuSzlo9uaVrDupNk=";
   };
 
   dontUseCmakeConfigure = true;
diff --git a/pkgs/by-name/st/stratis-cli/package.nix b/pkgs/by-name/st/stratis-cli/package.nix
index 745d8dbdb514..1f6f0c190223 100644
--- a/pkgs/by-name/st/stratis-cli/package.nix
+++ b/pkgs/by-name/st/stratis-cli/package.nix
@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "stratis-cli";
-  version = "3.8.3";
+  version = "3.9.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "stratis-storage";
     repo = "stratis-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wkFInG/sbHxyi5UIjIANxsTd9BrIHuyAfYG4DvqLsmU=";
+    hash = "sha256-XrzTFkr/VHP4eJts6wu6RhKaaMaqHWVQWHesbDSjx6A=";
   };
 
   build-system = with python3Packages; [
@@ -37,13 +37,11 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   disabledTestPaths = [
     # tests below require dbus daemon
-    "tests/whitebox/integration"
+    "tests/integration"
   ];
 
   pythonImportsCheck = [ "stratis_cli" ];
 
-  env.STRATIS_STRICT_POOL_FEATURES = "1"; # required for unit tests
-
   passthru.tests = nixosTests.stratis;
 
   meta = {
diff --git a/pkgs/by-name/st/stratisd/package.nix b/pkgs/by-name/st/stratisd/package.nix
index 47730158964f..afe225bcdc7d 100644
--- a/pkgs/by-name/st/stratisd/package.nix
+++ b/pkgs/by-name/st/stratisd/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   rustPlatform,
   cargo,
   rustc,
@@ -31,28 +30,20 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "stratisd";
-  version = "3.8.6";
+  version = "3.9.3";
 
   src = fetchFromGitHub {
     owner = "stratis-storage";
     repo = "stratisd";
     tag = "stratisd-v${finalAttrs.version}";
-    hash = "sha256-Kky/6sgvA8NDDGLQLS3sjPJWTCxkoTP/ow+netnK6tY=";
+    hash = "sha256-8PZiJgecssQYTSBnCj2mumUqdTZPouRRB0sW4pVrQAU=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-zA+GEKmg5iV1PaGh0yjNb4h52PH7PwpN53xLV8P9Gac=";
+    hash = "sha256-tkHxokc289mgczrJWlKIQVdkNeqhGV2d68t9uJZG2oI=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "0001-fixes_for_rust_1_9_2";
-      url = "https://github.com/stratis-storage/stratisd/commit/d65c3b7a7f9d7a332b4c59089b8fa96ff1fefb45.patch";
-      sha256 = "sha256-cNbx9+JgQgyO+o5YX7sLDe64qNWfpDr5itux+LZSgxs=";
-    })
-  ];
-
   postPatch = ''
     substituteInPlace udev/61-stratisd.rules \
       --replace-fail stratis-base32-decode "$out/lib/udev/stratis-base32-decode" \
@@ -98,12 +89,12 @@ stdenv.mkDerivation (finalAttrs: {
     [
       xfsprogs
       thin-provisioning-tools
+      cryptsetup
     ]
     ++ lib.optionals clevisSupport [
       clevis
       jose
       jq
-      cryptsetup
       curl
       tpm2-tools
       coreutils
diff --git a/pkgs/by-name/su/surge-downloader/package.nix b/pkgs/by-name/su/surge-downloader/package.nix
index d67ee52f40d4..30162cfe1493 100644
--- a/pkgs/by-name/su/surge-downloader/package.nix
+++ b/pkgs/by-name/su/surge-downloader/package.nix
@@ -8,16 +8,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "surge-downloader";
-  version = "0.12.1";
+  version = "0.12.2";
 
   src = fetchFromGitHub {
     owner = "SurgeDM";
     repo = "Surge";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cUJwt4gRdlQvMnrEvYG7JZe/2oz4cN9k35TEur13Sks=";
+    hash = "sha256-LojzHquVeXAI8/k5qYSdGExWw/Y6sgVRNjNagRot5gY=";
   };
 
-  vendorHash = "sha256-Ei2i7dQ9s42Gg6f2iLABbTG7OQspjHoRnqIhkfcNvFo=";
+  vendorHash = "sha256-Z1eNKci0MzXvKs49kOEYXr/JEO7AJB9kHdFTyNbxkw4=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/sy/syncthing-macos/package.nix b/pkgs/by-name/sy/syncthing-macos/package.nix
index 811acd40881e..1a5e286bab0c 100644
--- a/pkgs/by-name/sy/syncthing-macos/package.nix
+++ b/pkgs/by-name/sy/syncthing-macos/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "syncthing-macos";
-  version = "2.0.14-1";
+  version = "2.1.5-1";
 
   src = fetchurl {
     url = "https://github.com/syncthing/syncthing-macos/releases/download/v${finalAttrs.version}/Syncthing-${finalAttrs.version}.dmg";
-    hash = "sha256-5BjYwS2xcANqEXWadbppUwIGNd1UTQjzhWIAyATwWEU=";
+    hash = "sha256-UJA6KmIhhW4cNuPFxf856JcFPSmqH2ha1XZiLJMGnog=";
   };
 
   nativeBuildInputs = [ undmg ];
diff --git a/pkgs/by-name/ta/tail-tray/package.nix b/pkgs/by-name/ta/tail-tray/package.nix
index 0baba5fbc0c8..472a3d964333 100644
--- a/pkgs/by-name/ta/tail-tray/package.nix
+++ b/pkgs/by-name/ta/tail-tray/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tail-tray";
-  version = "0.2.34";
+  version = "0.2.35";
 
   src = fetchFromGitHub {
     owner = "SneWs";
     repo = "tail-tray";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-dKDEi5tGbhreCu1KdVxZB5ZdGX94+b8J0QgpbSpyixY=";
+    hash = "sha256-iv4uWeF3fHnuaqt1TWOT8rPeO5jG2a22ZzK+X+KJF90=";
   };
 
   nativeBuildInputs = with kdePackages; [
diff --git a/pkgs/by-name/ta/tailcat/network-up-before-first-netcheck.patch b/pkgs/by-name/ta/tailcat/network-up-before-first-netcheck.patch
new file mode 100644
index 000000000000..51b3e04bfe12
--- /dev/null
+++ b/pkgs/by-name/ta/tailcat/network-up-before-first-netcheck.patch
@@ -0,0 +1,29 @@
+Mark magicsock's network up before SetPrivateKey starts the first netcheck.
+
+With no non-loopback interface (e.g. the Nix build sandbox) the engine
+starts with magicsock's network down. SetPrivateKey and SetDERPMap kick
+off endpoint updates in the background, and if one of them runs before
+the later SetNetworkUp(true), updateNetInfo bails out on networkDown()
+without ever picking a home DERP. A server then is not reachable over
+DERP until the periodic re-STUN 20-26s later, and clients give up after
+10s with "tailcat Ping: context deadline exceeded".
+
+diff --git a/tailcat.go b/tailcat.go
+--- a/tailcat.go
++++ b/tailcat.go
+@@ -1577,6 +1577,7 @@ func (lb *locoBackend) Start() error {
+ 	mc := lb.sys.MagicSock.Get()
+ 	lb.logf("disco pub key: %v", mc.DiscoPublicKey())
+ 
++	mc.SetNetworkUp(true)
+ 	mc.SetPrivateKey(lb.priv)
+ 	mc.SetDERPMap(lb.dm)
+ 
+@@ -1632,7 +1633,6 @@ func (lb *locoBackend) Start() error {
+ 	mc.SetNetworkMap(nm.SelfNode, nm.Peers)
+ 	e.SetSelfNode(nm.SelfNode)
+ 	lb.sys.Netstack.Get().UpdateNetstackIPs(nm)
+-	mc.SetNetworkUp(true)
+ 	lb.logf("NetworkMap: %v", logger.AsJSON(nm))
+ 
+ 	// Install the live per-peer config sources. WireGuard peers are
diff --git a/pkgs/by-name/ta/tailcat/package.nix b/pkgs/by-name/ta/tailcat/package.nix
index 1a405e5f0303..9c52cbf50dff 100644
--- a/pkgs/by-name/ta/tailcat/package.nix
+++ b/pkgs/by-name/ta/tailcat/package.nix
@@ -8,7 +8,7 @@
 
 buildGo127Module (finalAttrs: {
   pname = "tailcat";
-  version = "0.6.0";
+  version = "0.7.0";
 
   __structuredAttrs = true;
 
@@ -16,10 +16,18 @@ buildGo127Module (finalAttrs: {
     owner = "tailscale";
     repo = "tailcat";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TwrEezNpn9ylDl7+Vo4XS/SaVOgU6h6PO1UWSrXnBWk=";
+    hash = "sha256-Hue5NZAmAf8mxFqgoDcjt7YHiROeudpAoanxSFnZkTk=";
   };
 
-  vendorHash = "sha256-hpFVgsUKswE7g69EieoeKGPR1nVkcRmBhDKbnB2CDBg=";
+  patches = [
+    # The sandbox has no non-loopback interface, so magicsock starts with
+    # its network down. The server's first netcheck can then run before
+    # SetNetworkUp(true) and it never picks a home DERP, which makes the
+    # e2e tests time out on "tailcat Ping: context deadline exceeded".
+    ./network-up-before-first-netcheck.patch
+  ];
+
+  vendorHash = "sha256-yfOl/gWIijLlqchXFiTRZ7vlgS/kn0xOmv52TFMYs+E=";
 
   subPackages = [ "cmd/tailcat" ];
 
diff --git a/pkgs/by-name/ta/taze/package.nix b/pkgs/by-name/ta/taze/package.nix
index 729a71fe3f20..ca249412e1e9 100644
--- a/pkgs/by-name/ta/taze/package.nix
+++ b/pkgs/by-name/ta/taze/package.nix
@@ -12,20 +12,20 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "taze";
-  version = "21.1.0";
+  version = "21.2.0";
 
   src = fetchFromGitHub {
     owner = "antfu-collective";
     repo = "taze";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5fn6iUlcqgHxOqLMQKntmXGpoD3scgyOBUsR7yHffmg=";
+    hash = "sha256-raAtOH9fVaN8BuQASXailJLMWKUKi0zhZ+/rECcgAQo=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_11;
     fetcherVersion = 4;
-    hash = "sha256-PT6KN/9sMxh2BVgvutpQ2aFplD9CBskOL5I0uwU0oLk=";
+    hash = "sha256-aML7uHmW3JWYkCaZnQV1OnVWiueQZ3ilT9KH6l6vGJA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/tb/tbls/package.nix b/pkgs/by-name/tb/tbls/package.nix
index 53f633a71b3d..f3e664cdc1fe 100644
--- a/pkgs/by-name/tb/tbls/package.nix
+++ b/pkgs/by-name/tb/tbls/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "tbls";
-  version = "1.96.0";
+  version = "1.96.1";
 
   src = fetchFromGitHub {
     owner = "k1LoW";
     repo = "tbls";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-API/Zz1PQRpKs7pU244VEZ2PlRcNR6EGI1LXSAcNDac=";
+    hash = "sha256-FOjl35IBnklln9BYpoLUnq/uRYnAXZ9CH0aLnFtdb78=";
   };
 
-  vendorHash = "sha256-v+0xdoIdBSW9Nn5CL/tmQkJsMcdINFvisO6siKgmIWk=";
+  vendorHash = "sha256-4cQYUwxwgj0iDUFfNdT6P2E63Jfsxeg2BZCdo8cJnng=";
 
   excludedPackages = [ "scripts/jsonschema" ];
 
diff --git a/pkgs/by-name/te/terminal-space-program/package.nix b/pkgs/by-name/te/terminal-space-program/package.nix
index 65749b1aaff8..dd99a9d08c3f 100644
--- a/pkgs/by-name/te/terminal-space-program/package.nix
+++ b/pkgs/by-name/te/terminal-space-program/package.nix
@@ -7,14 +7,14 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "terminal-space-program";
-  version = "0.43.0";
+  version = "0.44.3";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "jasonfen";
     repo = "terminal-space-program";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-XlPwwQheWkLANeB0cY4giEaxSVoxvkbEntNb69AZha8=";
+    hash = "sha256-GhmPYIdCHuHm9nC7ZZyHYiYIGU2tJOPTY3N9zlr85os=";
   };
 
   vendorHash = "sha256-5bhIP7It6rqOFvXRBUIP6/nGz4X+dzm3/BjVeo3nw4I=";
diff --git a/pkgs/by-name/te/terraform/package.nix b/pkgs/by-name/te/terraform/package.nix
index de82b4783f6f..ba5ea23b5289 100644
--- a/pkgs/by-name/te/terraform/package.nix
+++ b/pkgs/by-name/te/terraform/package.nix
@@ -15,16 +15,16 @@
 let
   package = buildGo127Module rec {
     pname = "terraform";
-    version = "1.16.3";
+    version = "1.16.4";
 
     src = fetchFromGitHub {
       owner = "hashicorp";
       repo = "terraform";
       rev = "v${version}";
-      hash = "sha256-XfVzSAMx/Y/gqDSXkRtGupGQB0ytBp907zHcsA0IUKw=";
+      hash = "sha256-RfN/uQryR+mA2OYhWvaFvwK+63+LN9iZ7PoLj0YSA90=";
     };
 
-    vendorHash = "sha256-e3j9PSptoqUV+/CQWLcy3/0E9qhdWbXUe3f+ZB5WsHI=";
+    vendorHash = "sha256-1NR5xhfZrHvG8VUwAJMgKCRvfs2AA8y5KPB/IYQiQB0=";
 
     patches = [ ./provider-path-0_15.patch ];
 
diff --git a/pkgs/by-name/tf/tfswitch/package.nix b/pkgs/by-name/tf/tfswitch/package.nix
index 3dbb8f032bd4..552287e18488 100644
--- a/pkgs/by-name/tf/tfswitch/package.nix
+++ b/pkgs/by-name/tf/tfswitch/package.nix
@@ -5,16 +5,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "tfswitch";
-  version = "1.19.0";
+  version = "1.20.0";
 
   src = fetchFromGitHub {
     owner = "warrensbox";
     repo = "terraform-switcher";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-4a7noh05dA0alPnOtkDTFHynfwtf0MR74NNptgLGdKI=";
+    sha256 = "sha256-L6k3Hf9A9hL6+rlAvqCEIypSNSkAFUcDUlzvUKsby84=";
   };
 
-  vendorHash = "sha256-wUWEGRyF6gyitTBfEcEsylczI/uTMfgI4gx/N91n08w=";
+  vendorHash = "sha256-KEFg4sncUvNBhjEnuj/FG3jyGQvEZq4eucl5aGuwYOk=";
 
   # Disable tests since it requires network access and relies on the
   # presence of release.hashicorp.com
diff --git a/pkgs/by-name/tf/tft-cli/package.nix b/pkgs/by-name/tf/tft-cli/package.nix
new file mode 100644
index 000000000000..d821a0357625
--- /dev/null
+++ b/pkgs/by-name/tf/tft-cli/package.nix
@@ -0,0 +1,61 @@
+{
+  lib,
+  fetchFromGitLab,
+  python3Packages,
+  versionCheckHook,
+}:
+
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "tft-cli";
+  version = "0.0.38";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitLab {
+    owner = "testing-farm";
+    repo = "cli";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-guoZfFkx9VNXiJy61Cg08G/H4HIcSZ66J+US69SsioM=";
+  };
+
+  build-system = with python3Packages; [
+    poetry-core
+    poetry-dynamic-versioning
+  ];
+
+  dependencies = with python3Packages; [
+    click
+    typer
+    dynaconf
+    colorama
+    requests
+    rich
+    ruamel-yaml
+    shellingham
+    pendulum
+    python-dotenv
+    keyring
+    cryptography
+  ];
+
+  pythonImportsCheck = [ "tft" ];
+
+  nativeCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "version";
+  doInstallCheck = true;
+
+  meta = {
+    homepage = "https://testing-farm.io/";
+    changelog = "https://gitlab.com/testing-farm/cli/-/releases/${finalAttrs.src.tag}";
+    description = "Command-line interface for Testing Farm";
+
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [
+      mfocko
+      thrix
+    ];
+    mainProgram = "testing-farm";
+  };
+})
diff --git a/pkgs/by-name/tg/tgrep/package.nix b/pkgs/by-name/tg/tgrep/package.nix
index 4db313978896..620b9adf463a 100644
--- a/pkgs/by-name/tg/tgrep/package.nix
+++ b/pkgs/by-name/tg/tgrep/package.nix
@@ -10,7 +10,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tgrep";
-  version = "1.0.10";
+  version = "1.0.11";
   __structuredAttrs = true;
   __darwinAllowLocalNetworking = true;
 
@@ -18,10 +18,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "microsoft";
     repo = "tgrep";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/IprzLxZR/DL9ny+wPyh/iJoxvjC+50U5w3EP560KL4=";
+    hash = "sha256-TkllXBOyxEl1NVXIRmRYOVlUqm65GRCNnoetGcR7kyE=";
   };
 
-  cargoHash = "sha256-tJ3+aWOsRS3WD9VUYGQ/emOsLPAURVg7/WnUxdTRz50=";
+  cargoHash = "sha256-xPXLkW/YeCBbRCGf4+VYLQqm4D5WkKo2yIJhkLOxO+s=";
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
@@ -44,6 +44,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "--skip=watcher_indexes_files_in_directories_created_after_startup"
     "--skip=watcher_reconciles_forced_add_and_rm_cached_inside_an_ignored_tree"
     "--skip=native_watcher_tracks_hidden_updates_ignore_transitions_and_restart"
+    "--skip=git_metadata_stays_out_of_native_and_persisted_indexes"
   ];
 
   passthru.updateScript = nix-update-script { };
diff --git a/pkgs/by-name/to/tonelib-zoom/package.nix b/pkgs/by-name/to/tonelib-zoom/package.nix
index a1dc82ebf3d6..924ccbca1d9d 100644
--- a/pkgs/by-name/to/tonelib-zoom/package.nix
+++ b/pkgs/by-name/to/tonelib-zoom/package.nix
@@ -68,7 +68,7 @@ stdenv.mkDerivation rec {
     homepage = "https://tonelib.net/";
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ fkokosinski ];
     platforms = [ "x86_64-linux" ];
     mainProgram = "ToneLib-Zoom";
   };
diff --git a/pkgs/by-name/to/tor-browser/package.nix b/pkgs/by-name/to/tor-browser/package.nix
index ac99bd764408..f46ebcbd6753 100644
--- a/pkgs/by-name/to/tor-browser/package.nix
+++ b/pkgs/by-name/to/tor-browser/package.nix
@@ -102,7 +102,7 @@ let
     ++ lib.optionals mediaSupport [ ffmpeg_7 ]
   );
 
-  version = "15.0.23";
+  version = "15.0.24";
 
   sources = {
     x86_64-linux = fetchurl {
@@ -112,7 +112,7 @@ let
         "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
         "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
       ];
-      hash = "sha256-D2L41lx/w03UuGy6t/yq7HOBVz3aNGrHsX5WjiK0vzk=";
+      hash = "sha256-sD7vtuvirLU6HWT4LJXA3wztnA+dYmWG6MbIHZgF1gQ=";
     };
 
     i686-linux = fetchurl {
@@ -122,7 +122,7 @@ let
         "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
         "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
       ];
-      hash = "sha256-EXCHkprnH1ylopayMN/kckEpYJAePWnzmUlldSqVswk=";
+      hash = "sha256-Dusy1rVGcT31aEq4fi+YRMnAr3Kmw5YkIabb2bC3wIQ=";
     };
   };
 
diff --git a/pkgs/by-name/tp/tpnote/package.nix b/pkgs/by-name/tp/tpnote/package.nix
index 252d27c74980..e4cfee8a071c 100644
--- a/pkgs/by-name/tp/tpnote/package.nix
+++ b/pkgs/by-name/tp/tpnote/package.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tpnote";
-  version = "1.27.1";
+  version = "1.27.2";
 
   src = fetchFromGitHub {
     owner = "getreu";
     repo = "tp-note";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-SfgsD/vvSPTRZQx7ZEJ5qOvCE+BUsplaZUhYidg+DvA=";
+    hash = "sha256-Wm4t28AHghn1H/zr7mMaEH74YpxdnztQWgDFMmZ5kQo=";
   };
 
-  cargoHash = "sha256-SVWp0BHAfR9KRrk3tBzt0XeybXPDu89E1nQ9io+RWIg=";
+  cargoHash = "sha256-tDO2FRbXwKT74cpF8oxomgLc97o0jljwgwUhANYujrg=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index cfd403da8296..a4636c939505 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -2587,10 +2587,10 @@
   };
 
   rescript = {
-    version = "6.0.0-unstable-2026-07-13";
+    version = "6.0.0-unstable-2026-09-25";
     url = "github:rescript-lang/tree-sitter-rescript";
-    rev = "19ed8a8e6bcc844b71c37e9edaffc60c77f74d7c";
-    hash = "sha256-mQJSmb9Qy5pFS+nNz4+C7RPs1mpAoxxqbx7seYo8+JI=";
+    rev = "90643a6302057b969c51e1bf235b8ecf1da49232";
+    hash = "sha256-k510+GOLhputcgoo3l8JyoaI9IAtDw+aEKoPjMjRyWI=";
     meta = {
       license = lib.licenses.mit;
       maintainers = with lib.maintainers; [
diff --git a/pkgs/by-name/tr/tree-sitter/package.nix b/pkgs/by-name/tr/tree-sitter/package.nix
index f16b467c5821..ebd2c362f222 100644
--- a/pkgs/by-name/tr/tree-sitter/package.nix
+++ b/pkgs/by-name/tr/tree-sitter/package.nix
@@ -193,6 +193,13 @@ rustPlatform.buildRustPackage (finalAttrs: {
       substituteInPlace ./Makefile \
           --replace-fail 'all: libtree-sitter.a libtree-sitter.$(SOEXT) tree-sitter.pc' 'all: libtree-sitter.a tree-sitter.pc'
       sed -i '/^install:/,/^[^[:space:]]/ { /$(SOEXT/d; }' ./Makefile
+    ''
+    # rquickjs-sys passes the raw rust target to clang, which does not know riscv64gc
+    + lib.optionalString stdenv.hostPlatform.isRiscV64 ''
+      substituteInPlace $cargoDepsCopy/source-*/rquickjs-sys-*/build.rs \
+        --replace-fail \
+          'let mut cflags = vec![format!("--target={}", target)];' \
+          'let mut cflags = vec![format!("--target={}", target.replace("riscv64gc", "riscv64"))];'
     '';
 
   # The Makefile install can't enable the wasm feature.
diff --git a/pkgs/by-name/tu/tuios/package.nix b/pkgs/by-name/tu/tuios/package.nix
index ec7edcb649c4..77582e52e8ac 100644
--- a/pkgs/by-name/tu/tuios/package.nix
+++ b/pkgs/by-name/tu/tuios/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "tuios";
-  version = "0.7.0";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "Gaurav-Gosain";
     repo = "tuios";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-XPcgUDlIbwp278Kc9B0aXxxIX2XnsJpFzxHDaop9cLs=";
+    hash = "sha256-PQtdcaJbn+Q386h0j9WhOx17MduE5qg0QS+L84qtP+o=";
   };
 
-  vendorHash = "sha256-98XZe60gcRWyP0ApUV+qCJ0UoAExx7X0FPtFL0Tr0a4=";
+  vendorHash = "sha256-mgVS2X9j+2qepgNNlCQLyBHnjrYWpJtJyqIfTq/nYcU=";
 
   ldflags = [
     "-s"
@@ -30,12 +30,25 @@ buildGoModule (finalAttrs: {
     "-X=main.builtBy=nixpkgs"
   ];
 
+  subPackages = [
+    "cmd/tuios"
+    "cmd/tuios-web"
+  ];
+
   nativeBuildInputs = [ installShellFiles ];
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
   versionCheckProgramArg = "--version";
 
+  checkFlags =
+    let
+      skippedTests = [
+        "TestCheckTransferShapeRefusesWhatBundleWorktreeCannotSend" # needs a repo
+      ];
+    in
+    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
+
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd ${finalAttrs.meta.mainProgram} \
       --bash <($out/bin/${finalAttrs.meta.mainProgram} completion bash) \
diff --git a/pkgs/by-name/tu/turso-cli/package.nix b/pkgs/by-name/tu/turso-cli/package.nix
index 33ae80e60c9b..d9daac2d337c 100644
--- a/pkgs/by-name/tu/turso-cli/package.nix
+++ b/pkgs/by-name/tu/turso-cli/package.nix
@@ -4,13 +4,14 @@
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
-  writableTmpDirAsHomeHook,
-  versionCheckHook,
   nix-update-script,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
 }:
+
 buildGoModule (finalAttrs: {
   pname = "turso-cli";
-  version = "1.0.31";
+  version = "1.0.32";
 
   __structuredAttrs = true;
 
@@ -18,16 +19,16 @@ buildGoModule (finalAttrs: {
     owner = "tursodatabase";
     repo = "turso-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-B1sm1RBJneSoNYUrXTXMzB7n+UAmn6RlFtV1BZpOdZM=";
+    hash = "sha256-hRmDoyj6rdqB+P0nAS+Xxg/6gUjxJm3qetiSGn+Nuaw=";
   };
 
-  vendorHash = "sha256-4OIJVL3N2mWOw7ZDP4xFCxa9zmUTPCA8N79TVoi1lys=";
+  vendorHash = "sha256-wutbVEWWoTdgwtG6IXgCYEGn/rdmaPbLGcFeCTS2VNE=";
 
   nativeBuildInputs = [ installShellFiles ];
 
   ldflags = [
     "-s"
-    "-X github.com/tursodatabase/turso-cli/internal/cmd.version=v${finalAttrs.version}"
+    "-X=github.com/tursodatabase/turso-cli/internal/cmd.version=v${finalAttrs.version}"
   ];
 
   nativeCheckInputs = [ writableTmpDirAsHomeHook ];
@@ -40,13 +41,15 @@ buildGoModule (finalAttrs: {
   '';
 
   nativeInstallCheckInputs = [ versionCheckHook ];
+
   doInstallCheck = true;
 
   passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "CLI for Turso";
-    homepage = "https://turso.tech";
+    homepage = "https://github.com/tursodatabase/turso-cli";
+    changelog = "https://github.com/tursodatabase/turso-cli/releases/tag/${finalAttrs.src.tag}";
     mainProgram = "turso";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
diff --git a/pkgs/by-name/uu/uutils-procps/package.nix b/pkgs/by-name/uu/uutils-procps/package.nix
index 8130bec53155..67aca8842c16 100644
--- a/pkgs/by-name/uu/uutils-procps/package.nix
+++ b/pkgs/by-name/uu/uutils-procps/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "uutils-procps";
-  version = "0.0.1-unstable-2026-09-18";
+  version = "0.0.1-unstable-2026-09-24";
 
   src = fetchFromGitHub {
     owner = "uutils";
     repo = "procps";
-    rev = "dcec30bf9d9b83f993968db82a6ebf03aa8fc2fe";
-    hash = "sha256-8kq+yLYHatsyTCqsL+iYH2GYu2v9N8f5CwrGND15PY0=";
+    rev = "da9b8ee9b11cbd1b63061c51fd7a712433385b3a";
+    hash = "sha256-+Rm3OifQzgb965S9czYbJXH5nl2dAHrSBCfvpaQpwRM=";
   };
 
-  cargoHash = "sha256-Ykq6+hAT2960k3FTxgGmJxl0+K9uroinrwgV4mzo9hc=";
+  cargoHash = "sha256-hsIs218ti7/93dstPlHG7tSO31SSq7Okme04LEY22Z4=";
 
   cargoBuildFlags = [ "--workspace" ];
 
diff --git a/pkgs/by-name/uu/uutils-sed/package.nix b/pkgs/by-name/uu/uutils-sed/package.nix
index c89ac96235db..835c6cba4d30 100644
--- a/pkgs/by-name/uu/uutils-sed/package.nix
+++ b/pkgs/by-name/uu/uutils-sed/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "uutils-sed";
-  version = "0.1.1";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "uutils";
     repo = "sed";
     tag = finalAttrs.version;
-    hash = "sha256-y1X9nj/quBtisp+6MHFjVKFHrdFnujWTxLWNLvdrADA=";
+    hash = "sha256-KBeZcVFFoiMblonSvtfA9I9udYj9VP5NtjbcLvhQchM=";
   };
 
-  cargoHash = "sha256-N5wwNPjOL3U4bPSONGpjmOBU31Nt/sCVth+JH3xmz/g=";
+  cargoHash = "sha256-5Zo9IvIAjwzW7QY4YDxUN8+Fudz9xhQiwPMuXZ8wx/A=";
 
   meta = {
     changelog = "https://github.com/uutils/sed/releases/tag/${finalAttrs.version}";
diff --git a/pkgs/by-name/v2/v2ray-domain-list-community/package.nix b/pkgs/by-name/v2/v2ray-domain-list-community/package.nix
index 7c5ccc900c9e..2c3d93acf505 100644
--- a/pkgs/by-name/v2/v2ray-domain-list-community/package.nix
+++ b/pkgs/by-name/v2/v2ray-domain-list-community/package.nix
@@ -9,12 +9,12 @@
 let
   generator = pkgsBuildBuild.buildGoModule rec {
     pname = "v2ray-domain-list-community";
-    version = "20260914091725";
+    version = "20260925234224";
     src = fetchFromGitHub {
       owner = "v2fly";
       repo = "domain-list-community";
       rev = version;
-      hash = "sha256-DN0/cSe63sYhQXMQH5tWEkVh09r3195YMk21UEAI9VU=";
+      hash = "sha256-IyEsnu5Yp+qAVUssVOv3cu12JAS07qxUuFTYnKJhhVA=";
     };
     vendorHash = "sha256-GwZTwdgAMGgsrpCzrqbaRjZEeDUPSHRwXHDaKDCu3Fw=";
     meta = {
diff --git a/pkgs/by-name/va/vacask/package.nix b/pkgs/by-name/va/vacask/package.nix
index f19644872509..013d1ed05e59 100644
--- a/pkgs/by-name/va/vacask/package.nix
+++ b/pkgs/by-name/va/vacask/package.nix
@@ -16,6 +16,35 @@
   boost188,
   suitesparse,
   tomlplusplus,
+
+  # VACASK's device models are compiled by OpenVAF, a Verilog-A compiler.
+  #
+  # By default, OpenVAF's `--target_cpu native` tells it to use every CPU
+  # instruction available on the machine doing the build (e.g. AVX-512, if the
+  # builder happens to have it). If the resulting binary is then run on a
+  # different, older CPU that doesn't support those instructions, it crashes
+  # with "illegal instruction" (SIGILL).
+  #
+  # To avoid this, we detect which instruction set the CPU we're building for
+  # actually supports and tell OpenVAF to target that instead, which keeps the
+  # compiled models runnable on other x86_64 machines as well.
+  #
+  # See:
+  #   - https://codeberg.org/arpadbuermen/VACASK/src/commit/bf59752fbfdfed18dc7fe2e3e11a9c02f8de28a0/README.md#installation-from-pre-built-packages
+  #   - https://github.com/NixOS/nixpkgs/blob/dc36b3c506df17272cdca29e85d0d0190b068981/lib/systems/architectures.nix
+  openvafTargetCpu ?
+    with stdenv.hostPlatform;
+    if isx86_64 then
+      if avx512Support then
+        "x86-64-v4"
+      else if avx2Support then
+        "x86-64-v3"
+      else if sse4_2Support then
+        "x86-64-v2"
+      else
+        "x86-64"
+    else
+      "generic",
 }:
 
 let
@@ -69,6 +98,7 @@ stdenv.mkDerivation (finalAttrs: {
   cmakeFlags = [
     (lib.cmakeFeature "FLEX_INCLUDE_DIR" "${flex}/include")
     (lib.cmakeFeature "TOMLPP_DIR" "${tomlplusplus}")
+    (lib.cmakeFeature "OPENVAF_OPTIONS" "--target_cpu ${openvafTargetCpu}")
   ];
 
   doCheck = true;
diff --git a/pkgs/by-name/we/wesnoth/package.nix b/pkgs/by-name/we/wesnoth/package.nix
index 34edbac94248..13c9e8a9aa44 100644
--- a/pkgs/by-name/we/wesnoth/package.nix
+++ b/pkgs/by-name/we/wesnoth/package.nix
@@ -10,6 +10,9 @@
   SDL2_net,
   makeBinaryWrapper,
   SDL2_ttf,
+  sdl3,
+  sdl3-image,
+  sdl3-mixer,
   pango,
   gettext,
   boost186,
@@ -22,12 +25,30 @@
   lua5_4,
   curl,
   nix-update-script,
+  versionCheckHook,
   enableDevel ? false,
 }:
 
 let
   boost = boost186;
   suffix = lib.optionalString enableDevel "-devel";
+
+  sdl =
+    if enableDevel then
+      [
+        sdl3
+        sdl3-image
+        sdl3-mixer
+      ]
+    else
+      [
+        SDL2
+        SDL2_image
+        SDL2_mixer
+        SDL2_net
+        SDL2_ttf
+      ];
+
   # wesnoth requires lua built with c++, see https://github.com/wesnoth/wesnoth/pull/8234
   lua = lua5_4.override {
     postConfigure = ''
@@ -38,7 +59,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wesnoth${suffix}";
-  version = if enableDevel then "1.19.24" else "1.18.8";
+  version = if enableDevel then "1.19.28" else "1.18.8";
 
   src = fetchFromGitHub {
     owner = "wesnoth";
@@ -46,11 +67,17 @@ stdenv.mkDerivation (finalAttrs: {
     tag = finalAttrs.version;
     hash =
       if enableDevel then
-        "sha256-q6gdzHDPkG/RqpJxIHqWsxD0n8dzKajDhAT49bjmq78="
+        "sha256-5S2kgqn+HZIPguQP+FYaK79Cvx0IRnmcGSeWPQflt/g="
       else
         "sha256-Tgp3y120j5nqoBrDo7D9C0FcVO3TH5lf+/SoCjR+ikc=";
   };
 
+  strictDeps = true;
+  doInstallCheck = true;
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgram = "${placeholder "out"}/bin/wesnothd${suffix}";
+
   nativeBuildInputs = [
     cmake
     pkg-config
@@ -58,11 +85,6 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals stdenv.hostPlatform.isDarwin [ makeBinaryWrapper ];
 
   buildInputs = [
-    SDL2
-    SDL2_image
-    SDL2_mixer
-    SDL2_net
-    SDL2_ttf
     pango
     gettext
     boost
@@ -74,7 +96,8 @@ stdenv.mkDerivation (finalAttrs: {
     icu
     lua
     curl
-  ];
+  ]
+  ++ sdl;
 
   cmakeFlags = [
     (lib.cmakeBool "ENABLE_SYSTEM_LUA" true)
diff --git a/pkgs/by-name/wk/wkhtmltopdf/package.nix b/pkgs/by-name/wk/wkhtmltopdf/package.nix
index 9dd7399ef9eb..8da4f0137ed7 100644
--- a/pkgs/by-name/wk/wkhtmltopdf/package.nix
+++ b/pkgs/by-name/wk/wkhtmltopdf/package.nix
@@ -128,7 +128,5 @@ stdenv.mkDerivation (
     };
   }
   // lib.optionalAttrs (stdenv.hostPlatform.isDarwin) darwinAttrs
-  //
-    lib.optionalAttrs (stdenv.hostPlatform.isLinux)
-      linuxAttrs.${stdenv.system} or (throw "Unsupported system: ${stdenv.system}")
+  // lib.optionalAttrs (stdenv.hostPlatform.isLinux) (linuxAttrs.${stdenv.system} or { })
 )
diff --git a/pkgs/by-name/wl/wlc/package.nix b/pkgs/by-name/wl/wlc/package.nix
index 499fa76dfacb..2c508d2a76cf 100644
--- a/pkgs/by-name/wl/wlc/package.nix
+++ b/pkgs/by-name/wl/wlc/package.nix
@@ -6,12 +6,12 @@
 
 python3.pkgs.buildPythonPackage rec {
   pname = "wlc";
-  version = "2.1.1";
+  version = "2.2.1";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-z0Ig+SuJ5XdZkDb3I5AXziVFjMAMCIly2vcQRqx62sw=";
+    hash = "sha256-8d5KOfHDY+4gUOc9lGNAayn8IBD5p706lGXpSuskKOU=";
   };
 
   build-system = with python3.pkgs; [ setuptools ];
diff --git a/pkgs/by-name/xp/xprin/package.nix b/pkgs/by-name/xp/xprin/package.nix
index 4935d1e2b3b9..3ab5143cc964 100644
--- a/pkgs/by-name/xp/xprin/package.nix
+++ b/pkgs/by-name/xp/xprin/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "xprin";
-  version = "0.2.0";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "crossplane-contrib";
     repo = "xprin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5qRPzrMAW7gw5fv5rgR9hOrZreeWXj/UFyMQAzpCA0s=";
+    hash = "sha256-VGeX1tKERq9sTv36UeYhxqf8hG+nUczVDseT6iDnRJM=";
   };
 
-  vendorHash = "sha256-mFICxQ0WHPFxHJ5wmElqcRMOvExKWmX2XXCRQCWbXoI=";
+  vendorHash = "sha256-8trj5T6ShvHXFB3W8F++ton71F8XDn2kyoZPIdPmEyo=";
 
   subPackages = [
     "cmd/xprin"
diff --git a/pkgs/by-name/ya/yara-x/package.nix b/pkgs/by-name/ya/yara-x/package.nix
index fd51b4b8fbfd..ceaf42b33d33 100644
--- a/pkgs/by-name/ya/yara-x/package.nix
+++ b/pkgs/by-name/ya/yara-x/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "yara-x";
-  version = "1.20.0";
+  version = "1.21.0";
 
   src = fetchFromGitHub {
     owner = "VirusTotal";
     repo = "yara-x";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TR9P4QYDxHSpAmPShiRNdNK1c4v3hGAx8mNOEhAo/HQ=";
+    hash = "sha256-OFDNOskhhX0ch0QmIV/2SHrTJUt5pEoJBin8Lu68f+w=";
   };
 
-  cargoHash = "sha256-/D4/H/+O1bCHecEO92aq05U3lPG2P/CFTWVlHekuH98=";
+  cargoHash = "sha256-mvMhxRXSq6IFZaGXn7mwe2XlkyZhgJffUoWruWC6Yj0=";
 
   env = {
     CARGO_PROFILE_RELEASE_LTO = "fat";
diff --git a/pkgs/by-name/ze/zennotes-desktop/package.nix b/pkgs/by-name/ze/zennotes-desktop/package.nix
index 92e2c6b7d5c0..81e03daeebea 100644
--- a/pkgs/by-name/ze/zennotes-desktop/package.nix
+++ b/pkgs/by-name/ze/zennotes-desktop/package.nix
@@ -13,14 +13,14 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "zennotes-desktop";
-  version = "2.45.0";
-  npmDepsHash = "sha256-+5eIwbSTpRupYj4gR33MDeJEEDBlt+K4idnlZFWG4Z4=";
+  version = "2.57.0";
+  npmDepsHash = "sha256-mblscdXgrIV2D3MjIqR+uqHh304mGnEKDDqsiFZZrB4=";
 
   src = fetchFromGitHub {
     owner = "ZenNotes";
     repo = "zennotes";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/HoSAgt7INT5Hharc+ltb2ya8InAuZmhS8Tmftl0VOo=";
+    hash = "sha256-ECRkAs8QhwCp2wEyqGzZ6F9sG9hXaomVEShKXO34tEg=";
   };
 
   npmWorkspace = "apps/desktop";
diff --git a/pkgs/by-name/zo/zond/package.nix b/pkgs/by-name/zo/zond/package.nix
new file mode 100644
index 000000000000..658402bceb4b
--- /dev/null
+++ b/pkgs/by-name/zo/zond/package.nix
@@ -0,0 +1,49 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  nix-update-script,
+  libpcap,
+  pkg-config,
+  rustPlatform,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "zond";
+  version = "0.18.0";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "zond-rs";
+    repo = "zond";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-onWvfTPc7GBH/mN5HPz5mIAOJFUi2l45Z2dXD0ea1xg=";
+  };
+
+  cargoHash = "sha256-V2+7//z64mKODelryd2SEWJLrQoxPsNOT6vFBV1Yl7c=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ libpcap ];
+
+  checkFlagsArray = [
+    # Test requires raw socket/packet capture
+    "--skip=the_reason_flag_shows_the_packet_behind_a_verdict"
+  ];
+
+  __darwinAllowLocalNetworking = true;
+
+  # Some tests fail in strict sandbox on darwin
+  doCheck = !stdenv.hostPlatform.isDarwin;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "CLI for Zond Engine";
+    homepage = "https://github.com/zond-rs/zond";
+    changelog = "https://github.com/zond-rs/zond/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "zond";
+  };
+})
diff --git a/pkgs/development/beam-modules/hooks/mix-release-setup-hook.sh b/pkgs/development/beam-modules/hooks/mix-release-setup-hook.sh
index 81bd142fcc70..5057a1debade 100644
--- a/pkgs/development/beam-modules/hooks/mix-release-setup-hook.sh
+++ b/pkgs/development/beam-modules/hooks/mix-release-setup-hook.sh
@@ -54,6 +54,7 @@ mixReleaseRemoveErlangReferences() {
     # use bbe to substitute strings in binary files, because using substituteInPlace
     # on binaries will raise errors
     bbe -e "s|${erlang}/lib/erlang|$out|" -o "$file".tmp "$file"
+    chmod --reference="$file" "$file".tmp
     rm -f "$file"
     mv "$file".tmp "$file"
   done
@@ -75,11 +76,11 @@ mixReleaseStripDebugHook() {
 }
 
 if [ -z "${dontMixReleaseFixup-}" ]; then
-  preFixupHooks+=(mixReleaseFixupHook)
+  postFixupHooks+=(mixReleaseFixupHook)
 fi
 
 if [ -n "${removeCookie-1}" ]; then
-  preFixupHooks+=(mixReleaseRemoveCookieHook)
+  postFixupHooks+=(mixReleaseRemoveCookieHook)
 fi
 
 if [ -n "${stripDebug-}" ]; then
diff --git a/pkgs/development/compilers/gcc/patches/13/gnat13-aarch64-darwin-trampoline.patch b/pkgs/development/compilers/gcc/patches/13/gnat13-aarch64-darwin-trampoline.patch
index 2065a90d136a..6e14d0ba2f52 100644
--- a/pkgs/development/compilers/gcc/patches/13/gnat13-aarch64-darwin-trampoline.patch
+++ b/pkgs/development/compilers/gcc/patches/13/gnat13-aarch64-darwin-trampoline.patch
@@ -1,4 +1,4 @@
-From a41f0707bdcc9fb6dab39eb8ce7e392138d16dc0 Mon Sep 17 00:00:00 2001
+From 0089a264f255fbbb5476df2b65a783d595cc9dde Mon Sep 17 00:00:00 2001
 From: zinzilulo <214774502+zinzilulo@users.noreply.github.com>
 Date: Wed, 27 May 2026 18:25:14 +0100
 Subject: [PATCH] Allow GNAT 13 bootstrap on aarch64-darwin with nested
@@ -19,14 +19,13 @@ between the Alire/GNAT-FSF-build GNAT 13.2.0-2 compiler and the
 IainS/gcc-13-branch 13.4-darwin-r0 source tree.
 ---
  gcc/builtins.def                        | 4 ++--
- gcc/config/darwin.h                     | 8 ++++----
  gcc/doc/invoke.texi                     | 4 ++--
  gcc/tree.cc                             | 8 ++++----
  libgcc/config/aarch64/heap-trampoline.c | 8 ++++----
  libgcc/config/i386/heap-trampoline.c    | 8 ++++----
  libgcc/libgcc-std.ver.in                | 4 ++--
  libgcc/libgcc2.h                        | 4 ++--
- 8 files changed, 24 insertions(+), 24 deletions(-)
+ 7 files changed, 20 insertions(+), 20 deletions(-)
 
 diff --git a/gcc/builtins.def b/gcc/builtins.def
 index 448cf837ec8..5bf4769ae47 100644
@@ -43,30 +42,11 @@ index 448cf837ec8..5bf4769ae47 100644
  
  /* Implementing __builtin_setjmp.  */
  DEF_BUILTIN_STUB (BUILT_IN_SETJMP_SETUP, "__builtin_setjmp_setup")
-diff --git a/gcc/config/darwin.h b/gcc/config/darwin.h
-index 0cc6f021365..47bca6f1db1 100644
---- a/gcc/config/darwin.h
-+++ b/gcc/config/darwin.h
-@@ -433,10 +433,10 @@ extern GTY(()) int darwin_ms_struct;
- 	   ___emutls_get_address -exported_symbol ___emutls_get_address \
- 	  -U ___emutls_register_common \
- 	  -exported_symbol ___emutls_register_common \
--	  -U ___gcc_nested_func_ptr_created \
--	  -exported_symbol ___gcc_nested_func_ptr_created \
--	  -U ___gcc_nested_func_ptr_deleted \
--	  -exported_symbol ___gcc_nested_func_ptr_deleted \
-+	  -U ___builtin_nested_func_ptr_created \
-+	  -exported_symbol ___builtin_nested_func_ptr_created \
-+	  -U ___builtin_nested_func_ptr_deleted \
-+	  -exported_symbol ___builtin_nested_func_ptr_deleted \
-       }} \
-     }}}\
-     %{!r:%{!nostdlib:%{!nostartfiles:%E}}} %{T*} %{F*} "\
 diff --git a/gcc/doc/invoke.texi b/gcc/doc/invoke.texi
-index 8f82ba0ecfa..4d5bba42fcd 100644
+index 5607481acb9..b36e95efa2b 100644
 --- a/gcc/doc/invoke.texi
 +++ b/gcc/doc/invoke.texi
-@@ -18718,8 +18718,8 @@ for nested functions.
+@@ -18722,8 +18722,8 @@ for nested functions.
  By default, trampolines are generated on stack.  However, certain platforms
  (such as the Apple M1) do not permit an executable stack.  Compiling with
  @option{-ftrampoline-impl=heap} generate calls to
@@ -78,10 +58,10 @@ index 8f82ba0ecfa..4d5bba42fcd 100644
  implemented in libgcc, and will only be provided on specific targets:
  x86_64 Darwin, x86_64 and aarch64 Linux.  @emph{PLEASE NOTE}: Heap
 diff --git a/gcc/tree.cc b/gcc/tree.cc
-index 032b87ee1c8..54abc791c88 100644
+index 806dd0ef8ae..701a6fbb39f 100644
 --- a/gcc/tree.cc
 +++ b/gcc/tree.cc
-@@ -9874,17 +9874,17 @@ build_common_builtin_nodes (void)
+@@ -9888,17 +9888,17 @@ build_common_builtin_nodes (void)
  					ptr_type_node, // void *func
  					ptr_ptr_type_node, // void **dst
  					NULL_TREE);
@@ -198,5 +178,5 @@ index a7a5dff0184..ac7eaab4f01 100644
  extern int __gcc_bcmp (const unsigned char *, const unsigned char *, size_t);
  extern void __clear_cache (void *, void *);
 -- 
-2.50.1 (Apple Git-155)
+2.55.0
 
diff --git a/pkgs/development/cuda-modules/buildRedist/buildRedistHook.bash b/pkgs/development/cuda-modules/buildRedist/buildRedistHook.bash
index 2a2ca6d257a4..b4ff85f0a4c0 100644
--- a/pkgs/development/cuda-modules/buildRedist/buildRedistHook.bash
+++ b/pkgs/development/cuda-modules/buildRedist/buildRedistHook.bash
@@ -24,9 +24,6 @@ buildRedistHookRegistration() {
   postInstallCheckHooks+=(checkCudaNonEmptyOutputs)
   nixLog "added checkCudaNonEmptyOutputs to postInstallCheckHooks"
 
-  preFixupHooks+=(fixupPropagatedBuildOutputsForMultipleOutputs)
-  nixLog "added fixupPropagatedBuildOutputsForMultipleOutputs to preFixupHooks"
-
   postFixupHooks+=(fixupCudaPropagatedBuildOutputsToOut)
   nixLog "added fixupCudaPropagatedBuildOutputsToOut to postFixupHooks"
 
@@ -193,16 +190,6 @@ checkCudaHasStubsIffIncludeRemoveStubsFromRunpathHook() {
   return 0
 }
 
-# TODO(@connorbaker): https://github.com/NixOS/nixpkgs/issues/323126.
-# _multioutPropagateDev() currently expects a space-separated string rather than an array.
-# NOTE: Because _multioutPropagateDev is a postFixup hook, we correct it in preFixup.
-fixupPropagatedBuildOutputsForMultipleOutputs() {
-  nixLog "converting propagatedBuildOutputs to a space-separated string"
-  # shellcheck disable=SC2124
-  export propagatedBuildOutputs="${propagatedBuildOutputs[@]}"
-  return 0
-}
-
 # The multiple outputs setup hook only propagates build outputs to dev.
 # We want to propagate them to out as well, in case the user interpolates
 # the package into a string -- in such a case, the dev output is not selected
@@ -217,7 +204,7 @@ fixupCudaPropagatedBuildOutputsToOut() {
   mkdir -p "${out:?}/nix-support"
 
   # NOTE: We must use printWords to ensure the output is a single line.
-  for output in $propagatedBuildOutputs; do
+  for output in "${propagatedBuildOutputs[@]}"; do
     # Propagate the other components to the out output
     nixLog "adding ${!output:?} to propagatedBuildInputs of ${out:?}"
     printWords "${!output:?}" >>"${out:?}/nix-support/propagated-build-inputs"
diff --git a/pkgs/development/interpreters/lua-5/default.nix b/pkgs/development/interpreters/lua-5/default.nix
index 50843b9a6583..68642e38678a 100644
--- a/pkgs/development/interpreters/lua-5/default.nix
+++ b/pkgs/development/interpreters/lua-5/default.nix
@@ -4,6 +4,8 @@
   lib,
   callPackage,
   fetchFromGitHub,
+  fetchpatch2,
+  applyPatches,
   makeBinaryWrapper,
 }:
 
@@ -199,6 +201,13 @@ rec {
 
   luajit_openresty = import ../luajit/openresty.nix {
     self = luajit_openresty;
-    inherit callPackage fetchFromGitHub passthruFun;
+    inherit
+      callPackage
+      fetchFromGitHub
+      fetchpatch2
+      applyPatches
+      stdenv
+      passthruFun
+      ;
   };
 }
diff --git a/pkgs/development/interpreters/luajit/openresty.nix b/pkgs/development/interpreters/luajit/openresty.nix
index 4316871f8f97..856bad91c6ae 100644
--- a/pkgs/development/interpreters/luajit/openresty.nix
+++ b/pkgs/development/interpreters/luajit/openresty.nix
@@ -2,23 +2,45 @@
   self,
   callPackage,
   fetchFromGitHub,
+  fetchpatch2,
+  applyPatches,
+  stdenv,
   passthruFun,
 }:
 
-callPackage ./default.nix rec {
-  version = "2.1-20260724";
+let
+  version = "2.1-20260824";
 
   src = fetchFromGitHub {
     owner = "openresty";
     repo = "luajit2";
-    rev = "v${version}";
-    hash = "sha256-cvy9FgHWFuacCFl7/conLwNuMgaol1LnIUiqcnXy9H8=";
+    tag = "v${version}";
+    hash = "sha256-IynlDQOyjCr1C3qibLg3OJ9Qd/Rb5jzjy30ETKdKvFM=";
   };
 
+  # upstream LuaJIT has no riscv64.
+  # port submitted at https://github.com/openresty/luajit2/pull/236 same as Debian
+  srcWithRiscv64Port = applyPatches {
+    inherit src;
+    patches = [
+      (fetchpatch2 {
+        url = "https://github.com/openresty/luajit2/compare/v2.1-20260824...ce14aff834d8d62220fc730a16042c52451f41cc.diff";
+        hash = "sha256-VHDTUr7PWpthmhO3BokCbdL1cricAnX6BjZGTi1wr3Q=";
+      })
+    ];
+  };
+in
+callPackage ./default.nix {
+  inherit version;
+
+  # default luaAttr would be luajit_2_1, the wrong interpreter for the lua package set
+  luaAttr = "luajit_openresty";
+
+  src = if stdenv.hostPlatform.isRiscV64 then srcWithRiscv64Port else src;
+
   extraMeta = {
     badPlatforms = [
       "loongarch64-linux" # See https://github.com/LuaJIT/LuaJIT/issues/1278
-      "riscv64-linux" # See https://github.com/LuaJIT/LuaJIT/issues/628
       # 64-bit POWER (LE and BE, either ELF ABI version on the latter) *is* supported, but ELFv1 powerpc64-linux has an
       # issue with memory allocation
       # https://github.com/openresty/luajit2/issues/258
diff --git a/pkgs/development/libraries/mpich/default.nix b/pkgs/development/libraries/mpich/default.nix
index 88f5673a4494..2cc3c4b360e2 100644
--- a/pkgs/development/libraries/mpich/default.nix
+++ b/pkgs/development/libraries/mpich/default.nix
@@ -46,11 +46,11 @@ assert (ch4backend.pname == "ucx" || ch4backend.pname == "libfabric");
 
 stdenv.mkDerivation rec {
   pname = "mpich";
-  version = "5.0.1";
+  version = "5.0.2";
 
   src = fetchurl {
     url = "https://www.mpich.org/static/downloads/${version}/mpich-${version}.tar.gz";
-    hash = "sha256-jBgyoT3azwcWhQafX639Hyh3op4aYoZSiSxlIRsfMyc=";
+    hash = "sha256-kowvGNNQqRRD/oAkrQHOLGAJ6cVR4Kc+eX/FZ/EZE30=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/argos-translate-files/default.nix b/pkgs/development/python-modules/argos-translate-files/default.nix
index 6003dd24a067..87c76ef7d43f 100644
--- a/pkgs/development/python-modules/argos-translate-files/default.nix
+++ b/pkgs/development/python-modules/argos-translate-files/default.nix
@@ -62,7 +62,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Translate files using Argos Translate";
     homepage = "https://www.argosopentech.com";
-    license = lib.licenses.mit;
+    license = lib.licenses.agpl3Only;
     maintainers = with lib.maintainers; [ misuzu ];
   };
 })
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index 88ff2d140bed..2ec630790f7d 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -358,13 +358,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "boto3-stubs";
-  version = "1.43.103";
+  version = "1.43.104";
   pyproject = true;
 
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit (finalAttrs) version;
-    hash = "sha256-dvmbE8or8t09z8a0b78FGp2g7D+gzOrfwygjN1DioeA=";
+    hash = "sha256-0Yg+1KeCgrBy43vwjEz7qLIgyP6xNxaB6zU5mxiREaM=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/colcon-notification/default.nix b/pkgs/development/python-modules/colcon-notification/default.nix
index 782916c5d6cd..44fe2636970c 100644
--- a/pkgs/development/python-modules/colcon-notification/default.nix
+++ b/pkgs/development/python-modules/colcon-notification/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "colcon-notification";
-  version = "0.3.1";
+  version = "0.3.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "colcon";
     repo = "colcon-notification";
     tag = version;
-    hash = "sha256-gKi5xl2ln+6CCwynUzh+WI87A4KHcrwbjkLJ6LmOoxk=";
+    hash = "sha256-5cnuUVHHjn85RMz9r24/zRQdvDt+JETAWOW1Fw6WEtM=";
   };
   build-system = [ setuptools ];
   dependencies = [
diff --git a/pkgs/development/python-modules/cv2-enumerate-cameras/default.nix b/pkgs/development/python-modules/cv2-enumerate-cameras/default.nix
index e64310f29f0d..929a0fb2ce88 100644
--- a/pkgs/development/python-modules/cv2-enumerate-cameras/default.nix
+++ b/pkgs/development/python-modules/cv2-enumerate-cameras/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "cv2_enumerate_cameras";
-  version = "1.3.3";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "lukehugh";
     repo = "cv2_enumerate_cameras";
     tag = "v${version}";
-    hash = "sha256-4QB/yWpurH/ai49PBRECdCfRRQ0tAvzGnpXj+DeP1pE=";
+    hash = "sha256-49/Zhfam/wrEwkEJ63PEcjA0eERL5OwsDTVgyvzCx5Q=";
   };
 
   pyproject = true;
diff --git a/pkgs/development/python-modules/django-health-check/default.nix b/pkgs/development/python-modules/django-health-check/default.nix
index 66cae7acffe8..90b1fe80417a 100644
--- a/pkgs/development/python-modules/django-health-check/default.nix
+++ b/pkgs/development/python-modules/django-health-check/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "django-health-check";
-  version = "4.5.1";
+  version = "4.6.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "codingjoe";
     repo = "django-health-check";
     tag = finalAttrs.version;
-    hash = "sha256-PbimG445XclS7A4SBAZ+9W0WpoerhpqOI4A36Vyqscc=";
+    hash = "sha256-ZWYLbsFeDM219rUde12tp3bXKxQpb8VjyZ4iUAJM9X8=";
   };
 
   build-system = [
@@ -66,6 +66,9 @@ buildPythonPackage (finalAttrs: {
   disabledTests = [
     # require online DNS resolution
     "test_run_check__dns_working"
+    "test_run_check__custom_nameservers"
+    "test_run_check__custom_record_type"
+    "test_run_check__custom_record_type_str"
     "test_check_status__nonexistent_hostname"
     "test_check_status__no_answer"
     # not reproducible
diff --git a/pkgs/development/python-modules/capa/default.nix b/pkgs/development/python-modules/flare-capa/default.nix
similarity index 91%
rename from pkgs/development/python-modules/capa/default.nix
rename to pkgs/development/python-modules/flare-capa/default.nix
index 4aeb280f6ad1..450c6624282d 100644
--- a/pkgs/development/python-modules/capa/default.nix
+++ b/pkgs/development/python-modules/flare-capa/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   colorama,
   deptry,
@@ -45,7 +46,7 @@
 }:
 
 buildPythonPackage (finalAttrs: {
-  pname = "capa";
+  pname = "flare-capa";
   version = "9.4.0";
   pyproject = true;
 
@@ -127,5 +128,8 @@ buildPythonPackage (finalAttrs: {
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "capa";
+    # Never built on darwin since first introduction in nixpkgs
+    # see https://hydra.nixos.org/build/345235630
+    broken = stdenv.hostPlatform.isDarwin;
   };
 })
diff --git a/pkgs/development/python-modules/homematicip/default.nix b/pkgs/development/python-modules/homematicip/default.nix
index 76905233a92e..e48f96461c43 100644
--- a/pkgs/development/python-modules/homematicip/default.nix
+++ b/pkgs/development/python-modules/homematicip/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "homematicip";
-  version = "2.17.0";
+  version = "2.18.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "hahn-th";
     repo = "homematicip-rest-api";
     tag = finalAttrs.version;
-    hash = "sha256-PtqSwHEwFeryYM3e455PKsLAYqs7TVVi0N/Pbq1SHp8=";
+    hash = "sha256-I3D83Pdsdz0eWrebFgRtq/ejfJh8kN8w7Z82HJcjsjQ=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/jupyter-book/default.nix b/pkgs/development/python-modules/jupyter-book/default.nix
index d6c7434e385a..cd94bcf70589 100644
--- a/pkgs/development/python-modules/jupyter-book/default.nix
+++ b/pkgs/development/python-modules/jupyter-book/default.nix
@@ -26,19 +26,20 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "jupyter-book";
-  version = "2.1.6";
+  version = "2.1.7";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "jupyter-book";
     repo = "jupyter-book";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-J0WzzKg46+0mvZ4goUPfkjO70HsAXQGv1JaoFs8JZ18=";
+    hash = "sha256-8jOPjF9tFwXmq5iWGW3V8qif7UdPPrDZW4cVjtSdbYY=";
   };
 
   npmDeps = fetchNpmDeps {
     inherit (finalAttrs) src;
-    hash = "sha256-y0QCZhsgcdFlgsjsCZFvLOQP27e5JD0QL0uP2XmpQEs=";
+    hash = "sha256-xbDn7jDDd/nWKVvx2R6uJIaWQMSOktCeKv2EBkkzhTY=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/jupyter-server-ydoc/default.nix b/pkgs/development/python-modules/jupyter-server-ydoc/default.nix
index 59ff7bc1f8a9..82001c4abf1b 100644
--- a/pkgs/development/python-modules/jupyter-server-ydoc/default.nix
+++ b/pkgs/development/python-modules/jupyter-server-ydoc/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "jupyter-server-ydoc";
-  version = "3.0.3";
+  version = "3.0.4";
   pyproject = true;
   __structuredAttrs = true;
 
   src = fetchPypi {
     pname = "jupyter_server_ydoc";
     inherit (finalAttrs) version;
-    hash = "sha256-ndjyC6jrkZu0wPWIMkPb4iCXJqtLfMgpM1xQWv6/nFw=";
+    hash = "sha256-8ATHnGxKzgPt/5F2u4aV+WmWYJzToCxNAZeQWikyM4c=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/loro/default.nix b/pkgs/development/python-modules/loro/default.nix
index 6f19967bd437..9353247324eb 100644
--- a/pkgs/development/python-modules/loro/default.nix
+++ b/pkgs/development/python-modules/loro/default.nix
@@ -8,17 +8,17 @@
 
 buildPythonPackage rec {
   pname = "loro";
-  version = "1.13.2";
+  version = "1.16.2";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ekTbRQvuxxz6Ehkt0RzDJ+NwySD85g1I8gyHHB4z2Ak=";
+    hash = "sha256-s+MLjZqtxgBmKs0x6Qrk2puEyYkAIlqgRNTCjBQKEs4=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-qlN+ivmnHuTakqydLKjwPwJm4c2q5TywE6yaj/dWiXs=";
+    hash = "sha256-qBew1JPbuDVqzoeBvKHARhwgnXNkjDBtrXKZU/dfbaY=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/mlx-vlm/default.nix b/pkgs/development/python-modules/mlx-vlm/default.nix
index 7c97f38f7267..62375d7a6a56 100644
--- a/pkgs/development/python-modules/mlx-vlm/default.nix
+++ b/pkgs/development/python-modules/mlx-vlm/default.nix
@@ -96,5 +96,6 @@ buildPythonPackage (finalAttrs: {
     changelog = "https://github.com/Blaizzy/mlx-vlm/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ GaetanLepage ];
+    broken = true;
   };
 })
diff --git a/pkgs/development/python-modules/mlx/default.nix b/pkgs/development/python-modules/mlx/default.nix
index ee9a3195b4a8..911ff6789118 100644
--- a/pkgs/development/python-modules/mlx/default.nix
+++ b/pkgs/development/python-modules/mlx/default.nix
@@ -27,6 +27,7 @@
   numpy,
   pytestCheckHook,
   python,
+  sysctl,
 }:
 
 let
@@ -41,7 +42,7 @@ let
 in
 buildPythonPackage (finalAttrs: {
   pname = "mlx";
-  version = "0.32.0";
+  version = "0.32.1";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -49,7 +50,7 @@ buildPythonPackage (finalAttrs: {
     owner = "ml-explore";
     repo = "mlx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yHpTyRf9FOPbdyDWSM7b6VC72STnUpgCMLbDxLbdaqs=";
+    hash = "sha256-VstsaBOAvqHJhTNXczjFavG4l5VTJdJWT0VKuzmwIEA=";
   };
 
   patches = [
@@ -106,6 +107,7 @@ buildPythonPackage (finalAttrs: {
   nativeCheckInputs = [
     numpy
     pytestCheckHook
+    sysctl
   ];
 
   enabledTestPaths = [
diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index da325f716712..552727dd6bd8 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -335,8 +335,8 @@ in
       "sha256-3JYcWKFk0dKJg/qn+EBvxeAO5xh5PXCU3dTEWDr1oXI=";
 
   mypy-boto3-connect =
-    buildMypyBoto3Package "connect" "1.43.103"
-      "sha256-YTuqPk2igTabqCfBYBY9HEVXDwTk4V2I/rZftoacGEA=";
+    buildMypyBoto3Package "connect" "1.43.104"
+      "sha256-R/TX5Uy1ovNtkmBVX+qXAfjeYB/z/f5YMQ+gIlqujC8=";
 
   mypy-boto3-connect-contact-lens =
     buildMypyBoto3Package "connect-contact-lens" "1.43.79"
@@ -443,8 +443,8 @@ in
       "sha256-dXNkOcMonYrBh4yzeubd+v3mW42s9XpmpfvgbtgoJgY=";
 
   mypy-boto3-ec2 =
-    buildMypyBoto3Package "ec2" "1.43.100"
-      "sha256-DABqoQz7/al+1GnoP8EjE3Gv2DhKIc2/jYFpBhnA8Ac=";
+    buildMypyBoto3Package "ec2" "1.43.104"
+      "sha256-UnX0kzhTGa7YoOBfAfQDPGUz5A68QcIvN8we3dwpaHo=";
 
   mypy-boto3-ec2-instance-connect =
     buildMypyBoto3Package "ec2-instance-connect" "1.43.0"
@@ -467,8 +467,8 @@ in
       "sha256-11KpPRxGId76g/I4jXwMQ55kwGEQVsasgvMUXsiLbM4=";
 
   mypy-boto3-eks =
-    buildMypyBoto3Package "eks" "1.43.88"
-      "sha256-SqRuidD6RQLjGow/AXhpvYiM5+tkBBDBT6F9nAhHs6I=";
+    buildMypyBoto3Package "eks" "1.43.104"
+      "sha256-4gkAjSwpfK+HNPfUOxPS2wQIXtHhi2fmIuWQL+ndPBM=";
 
   mypy-boto3-elastic-inference =
     buildMypyBoto3Package "elastic-inference" "1.36.0"
@@ -555,8 +555,8 @@ in
       "sha256-C7V/8x9FgRwUaudSDWK9+VdHoR0Xcc8l4W5KzFTKzDk=";
 
   mypy-boto3-fsx =
-    buildMypyBoto3Package "fsx" "1.43.0"
-      "sha256-4roB3AEdN4zXGceUNkrmarmTThmPbS9SltvHG6kF+84=";
+    buildMypyBoto3Package "fsx" "1.43.104"
+      "sha256-FSdU6KXKHsoHGiMWHkf5PhuYMOyzZ2ldWfQkFr1rOr4=";
 
   mypy-boto3-gamelift =
     buildMypyBoto3Package "gamelift" "1.43.66"
@@ -571,8 +571,8 @@ in
       "sha256-vMz4YKm78XMavlPUNiSVAYmAbyUBrJhUXbFrhxIvUJA=";
 
   mypy-boto3-glue =
-    buildMypyBoto3Package "glue" "1.43.103"
-      "sha256-W7dNtzxPbQ0MGXAnnO0U92YNokwfveIAYm27ftgpH/Y=";
+    buildMypyBoto3Package "glue" "1.43.104"
+      "sha256-hcNGgpHqSt3oStW1K3q4blmrMUWJirbXuBgvcAao9yQ=";
   mypy-boto3-grafana =
     buildMypyBoto3Package "grafana" "1.43.11"
       "sha256-XJOSLyL1+uEweZ9zER7IhH3DFLaLtpJKvuRIn8Ri+P4=";
@@ -590,8 +590,8 @@ in
       "sha256-+DDeD9YWo98meLZU2Mzu5AE0S7HFg6kfxeUWUh9XcQA=";
 
   mypy-boto3-guardduty =
-    buildMypyBoto3Package "guardduty" "1.43.97"
-      "sha256-USNbCGnD5BF9gsG6vqytRxO+kR6kEI+yIX569syS6Yw=";
+    buildMypyBoto3Package "guardduty" "1.43.104"
+      "sha256-TDkTHKBpQKWaoh7hUH/e+j2ti7SUPcIbDWrM5DKhBv4=";
 
   mypy-boto3-health =
     buildMypyBoto3Package "health" "1.43.0"
@@ -1290,8 +1290,8 @@ in
       "sha256-Psjh5lHoMK/89/4VGy4wkLjqmNc8sGkFOwnKTH9MhjY=";
 
   mypy-boto3-ssm =
-    buildMypyBoto3Package "ssm" "1.43.53"
-      "sha256-8govEDWg1YthZHxvXIg+BYFSrNzNipfn0ZFkdtyOfHs=";
+    buildMypyBoto3Package "ssm" "1.43.104"
+      "sha256-Gx4Ydi5rnOr3NegWWm29eJsQ2U9W9wTvAQ0Mi77wWcw=";
 
   mypy-boto3-ssm-contacts =
     buildMypyBoto3Package "ssm-contacts" "1.43.0"
diff --git a/pkgs/development/python-modules/otcextensions/default.nix b/pkgs/development/python-modules/otcextensions/default.nix
index d8ef6ce8f48c..a2e9094e752b 100644
--- a/pkgs/development/python-modules/otcextensions/default.nix
+++ b/pkgs/development/python-modules/otcextensions/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "otcextensions";
-  version = "0.34.7";
+  version = "0.34.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "opentelekomcloud";
     repo = "python-otcextensions";
     tag = version;
-    hash = "sha256-VOBeSAoHTqKjoWno16+aHOOfbst2wUjtAqz7MvGRT6U=";
+    hash = "sha256-dkAF0UXD0cpktSqDsYbpHO8IzKRdHx85MOp4aelbbgo=";
   };
 
   env.PBR_VERSION = version;
diff --git a/pkgs/development/python-modules/plumed/default.nix b/pkgs/development/python-modules/plumed/default.nix
new file mode 100644
index 000000000000..327c41e6cc97
--- /dev/null
+++ b/pkgs/development/python-modules/plumed/default.nix
@@ -0,0 +1,58 @@
+{
+  lib,
+  stdenv,
+  buildPythonPackage,
+  plumed,
+
+  # build-system
+  cython,
+  setuptools,
+
+  # tests
+  numpy,
+  pandas,
+  pytestCheckHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "plumed";
+  inherit (plumed) version src;
+  pyproject = true;
+  __structuredAttrs = true;
+
+  sourceRoot = "${finalAttrs.src.name}/python";
+
+  env = {
+    plumed_version = finalAttrs.version;
+    plumed_include_dir = "${lib.getDev plumed}/include/plumed/wrapper";
+
+    # Hardcode the path to the kernel so that PLUMED_KERNEL does not need to be set at runtime
+    plumed_default_kernel = "${lib.getLib plumed}/lib/libplumedKernel${stdenv.hostPlatform.extensions.sharedLibrary}";
+  };
+
+  build-system = [
+    cython
+    setuptools
+  ];
+
+  buildInputs = [
+    plumed
+  ];
+
+  pythonImportsCheck = [ "plumed" ];
+
+  nativeCheckInputs = [
+    numpy
+    pandas
+    pytestCheckHook
+  ];
+
+  enabledTestPaths = [ "test" ];
+
+  meta = {
+    description = "Python wrappers for plumed";
+    homepage = "https://github.com/plumed/plumed2/tree/master/python";
+    license = lib.licenses.lgpl3Plus;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+})
diff --git a/pkgs/development/python-modules/pypdf/default.nix b/pkgs/development/python-modules/pypdf/default.nix
index dd15dd6c44bc..930b1dc6d421 100644
--- a/pkgs/development/python-modules/pypdf/default.nix
+++ b/pkgs/development/python-modules/pypdf/default.nix
@@ -26,7 +26,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pypdf";
-  version = "6.18.1";
+  version = "6.19.0";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -35,7 +35,7 @@ buildPythonPackage (finalAttrs: {
     tag = finalAttrs.version;
     # fetch sample files used in tests
     fetchSubmodules = true;
-    hash = "sha256-BfscatAwiiPQfbgTSBE3CM2As2LkcNh0zkr5jIq45Ww=";
+    hash = "sha256-9idq59BNXL0fqQOxk2+Joj4q3khEGv5uGUpbjrokHHs=";
   };
 
   outputs = [
diff --git a/pkgs/development/python-modules/sigima/default.nix b/pkgs/development/python-modules/sigima/default.nix
index 3a67da084def..a967ae74198a 100644
--- a/pkgs/development/python-modules/sigima/default.nix
+++ b/pkgs/development/python-modules/sigima/default.nix
@@ -47,15 +47,16 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "sigima";
-  version = "1.1.6";
+  version = "1.2.0";
   pyproject = true;
+  __darwinAllowLocalNetworking = true;
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "DataLab-Platform";
     repo = "Sigima";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Z4U+l2SUqGvKV8+I1/j+OfymmyFKTiBy5Rr6iiz31xY=";
+    hash = "sha256-pKI1xODYR0ZanXEI3r3UhKj2FvrBA8MWVwSpcg+GBls=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index dd3ad10c813b..505821eb1a1e 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "tencentcloud-sdk-python";
-  version = "3.1.182";
+  version = "3.1.183";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = finalAttrs.version;
-    hash = "sha256-eLB77nZKECb4nDLQHYu0JtFjE15I6pPp8k4Ois7UN50=";
+    hash = "sha256-peCCsqmUG+mYes18wpzLB0DhTVqtG3t6S+W6sMkkYeM=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/twilio/default.nix b/pkgs/development/python-modules/twilio/default.nix
index d58dc1581647..c9ca0849c5e7 100644
--- a/pkgs/development/python-modules/twilio/default.nix
+++ b/pkgs/development/python-modules/twilio/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "twilio";
-  version = "9.11.1";
+  version = "9.11.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "twilio";
     repo = "twilio-python";
     tag = finalAttrs.version;
-    hash = "sha256-GS8Okhxd2T9BG9bFh6uZY4zPmHDYT++wpYq4A2sy1ek=";
+    hash = "sha256-RbamHPCGYGZgkipYf8Wz0D7cOB7AsGhxPRJC/BXR1qE=";
   };
 
   # https://github.com/twilio/twilio-python/pull/919
diff --git a/pkgs/development/rocq-modules/jasmin/default.nix b/pkgs/development/rocq-modules/jasmin/default.nix
index a8d25735c385..c6894217ea7b 100644
--- a/pkgs/development/rocq-modules/jasmin/default.nix
+++ b/pkgs/development/rocq-modules/jasmin/default.nix
@@ -20,12 +20,13 @@
     in
     with lib.versions;
     lib.switch coq.coq-version [
-      (case (range "8.20" "9.1") "2026.03.1")
+      (case (range "8.20" "9.1") "2026.03.3")
       (case (isEq "8.19") "2025.02.2")
       (case (isEq "8.18") "2024.07.4")
     ] null;
   releaseRev = v: "v${v}";
 
+  release."2026.03.3".hash = "sha256-LY3683WHT0A3pXpszGAl8tkc7fCy5RufuPBVedBk298=";
   release."2026.03.1".hash = "sha256-CE+WbcG0lgKvaV/OSMlTp3fG+v82X41z/w7ynsM/LLg=";
   release."2026.03.0".hash = "sha256-MzdVbZhXlb9JFLsf+23yJNFiGJDBJZGbX6Ox3/U1EzA=";
   release."2025.06.1".hash = "sha256-wEL1tN0HUa1Eb7FiQOBA6sAkuonrAMdkqq8gu9/CED0=";
diff --git a/pkgs/development/ruby-modules/gem-config/default.nix b/pkgs/development/ruby-modules/gem-config/default.nix
index 422c973fe2de..31f930ef1086 100644
--- a/pkgs/development/ruby-modules/gem-config/default.nix
+++ b/pkgs/development/ruby-modules/gem-config/default.nix
@@ -1045,6 +1045,20 @@ in
     buildFlags = [ "--with-ssh" ];
   };
 
+  rbtrace =
+    attrs:
+    # unpack the vendored msgpack so the gnu-config hook can refresh its old config.{guess,sub}
+    lib.optionalAttrs (stdenv.hostPlatform.isRiscV64 || stdenv.hostPlatform.isLoongArch64) {
+      dontBuild = false;
+      postPatch = ''
+        tar -xzf ext/src/msgpack-1.1.0.tar.gz -C ext/src
+      '';
+      preConfigure = ''
+        tar -czf ext/src/msgpack-1.1.0.tar.gz -C ext/src msgpack-1.1.0
+        rm -r ext/src/msgpack-1.1.0
+      '';
+    };
+
   sassc = attrs: {
     nativeBuildInputs = [ rake ];
     dontBuild = false;
diff --git a/pkgs/kde/misc/kirigami-addons/default.nix b/pkgs/kde/misc/kirigami-addons/default.nix
index f040099047f1..fdeffab2c7d0 100644
--- a/pkgs/kde/misc/kirigami-addons/default.nix
+++ b/pkgs/kde/misc/kirigami-addons/default.nix
@@ -10,11 +10,11 @@
 }:
 mkKdeDerivation rec {
   pname = "kirigami-addons";
-  version = "1.14.0";
+  version = "1.14.2";
 
   src = fetchurl {
     url = "mirror://kde/stable/kirigami-addons/kirigami-addons-${version}.tar.xz";
-    hash = "sha256-SunvnPH8Vf71kyjSWnCyhXK29qeHOUw9KS9e03jxmEA=";
+    hash = "sha256-Hks0Atf4dEyQOwwLkH+jeTebhI3tpBO1qUDbr0cUyzI=";
   };
 
   extraNativeBuildInputs = [ qttools ];
diff --git a/pkgs/misc/uboot/default.nix b/pkgs/misc/uboot/default.nix
index 95d589220a20..ae9dcb727dd4 100644
--- a/pkgs/misc/uboot/default.nix
+++ b/pkgs/misc/uboot/default.nix
@@ -82,6 +82,13 @@ let
           '') (builtins.attrNames pythonScriptsToInstall)}
           patchShebangs tools
           patchShebangs scripts
+        ''
+        # This warning got removed in
+        # https://git.kernel.org/pub/scm/utils/dtc/dtc.git/commit/?id=cba90ce82064ad1e6d25f20d8eaa940bd2fc97ed
+        + ''
+          for f in scripts/Makefile.lib dts/upstream/Makefile; do
+            substituteInPlace "$f" --replace-fail -Wno-graph_child_address ""
+          done
         '';
 
         nativeBuildInputs = [
diff --git a/pkgs/servers/klipper/default.nix b/pkgs/servers/klipper/default.nix
index f7dc705d40bd..4d1d1359483b 100644
--- a/pkgs/servers/klipper/default.nix
+++ b/pkgs/servers/klipper/default.nix
@@ -14,13 +14,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "klipper";
-  version = "0.13.0-unstable-2026-08-18";
+  version = "0.13.0-unstable-2026-09-28";
 
   src = fetchFromGitHub {
     owner = "Klipper3d";
     repo = "klipper";
-    rev = "60fc7aa67a8da9abb43a2bad825d4992294ebf3f";
-    sha256 = "sha256-qs60qBwlD7A0xneNzeNcKfWc8II5rG2oj+tvuhn/aWw=";
+    rev = "7bc4d09465d31cd30fc0822e8d0abe02cc8c547f";
+    sha256 = "sha256-DcRYuS2pxM3clbmk93GZhWAFjwoDVF7ZqNBTq2fm8x0=";
   };
 
   sourceRoot = "${src.name}/klippy";
diff --git a/pkgs/shells/fish/plugins/exercism-cli-fish-wrapper.nix b/pkgs/shells/fish/plugins/exercism-cli-fish-wrapper.nix
index 9a5ce9ca3c66..6437ab515eb9 100644
--- a/pkgs/shells/fish/plugins/exercism-cli-fish-wrapper.nix
+++ b/pkgs/shells/fish/plugins/exercism-cli-fish-wrapper.nix
@@ -6,13 +6,13 @@
 }:
 buildFishPlugin {
   pname = "exercism-cli-fish-wrapper";
-  version = "0-unstable-2026-09-17";
+  version = "0-unstable-2026-09-29";
 
   src = fetchFromGitHub {
     owner = "glennj";
     repo = "exercism-cli-fish-wrapper";
-    rev = "e7758253934122b91858ff72a5ad4a2c59c575ec";
-    hash = "sha256-VBgN/qs4nBezfq+Nd0CVeyRNCZ6ilDeFiaQpjEnVrMo=";
+    rev = "36cf30be3fa00a69382d00af514ff3222626394f";
+    hash = "sha256-51mC2IOwSvH6QZpYNfpp2DofN69JRxDZjSXfzNM1Qm0=";
   };
 
   passthru.updateScript = unstableGitUpdater { };
diff --git a/pkgs/test/vim/default.nix b/pkgs/test/vim/default.nix
index 296409a7e035..4b0c770f0a85 100644
--- a/pkgs/test/vim/default.nix
+++ b/pkgs/test/vim/default.nix
@@ -25,6 +25,26 @@ lib.recurseIntoAttrs {
     vimrcConfig.packages.myVimPackage.start = with vimPlugins; [ vim-nix ];
   };
 
+  test_vim_plugin_dont_unpack =
+    let
+      plugin = vimUtils.buildVimPlugin {
+        pname = "vim-plugin-dont-unpack-test";
+        version = "0";
+        src = pkgs.writeText "probe.vim" "";
+        dontUnpack = true;
+        buildPhase = ''
+          install -D "$src" "$out/colors/probe.vim"
+        '';
+      };
+    in
+    pkgs.runCommand "vim-plugin-dont-unpack-test" { } ''
+      test -f ${plugin}/colors/probe.vim
+      for file in env-vars .attrs.json .attrs.sh; do
+        test ! -e ${plugin}/"$file"
+      done
+      mkdir -p "$out"
+    '';
+
   # test that all vimPlugins have `passthru.vimPlugin = true`
   test-all-plugins-have-vimPlugin-true =
     let
diff --git a/pkgs/tools/networking/iroh/default.nix b/pkgs/tools/networking/iroh/default.nix
index 4314d6ffd7ff..c3e6aa625a08 100644
--- a/pkgs/tools/networking/iroh/default.nix
+++ b/pkgs/tools/networking/iroh/default.nix
@@ -12,16 +12,16 @@ let
     }:
     rustPlatform.buildRustPackage rec {
       pname = name;
-      version = "1.2.0";
+      version = "1.3.0";
 
       src = fetchFromGitHub {
         owner = "n0-computer";
         repo = "iroh";
         rev = "v${version}";
-        hash = "sha256-BmunhUBXqTJuxth5asENVV7y8wooTh8W/+gzgq1fNVI=";
+        hash = "sha256-ugGYRESccGgkI8evd21NE3jzNgULDEHwuf0UWdqKp6A=";
       };
 
-      cargoHash = "sha256-2KqLC8c0ii3cGk27N7n8yfH0Jw3JM3OwECanqArXJhI=";
+      cargoHash = "sha256-L0OnbXUC8JNW+/Xm0Q/8EjSlGmKYGvQQM+SqrRLb8mQ=";
 
       buildFeatures = cargoFeatures;
       cargoBuildFlags = [
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 887d91321019..2158dcedf311 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4393,7 +4393,7 @@ with pkgs;
 
   luaPackages = lua52Packages;
 
-  luajit = luajit_2_1;
+  luajit = if stdenv.hostPlatform.isRiscV64 then luajit_openresty else luajit_2_1;
 
   luarocks = luaPackages.luarocks;
   luarocks-nix = luaPackages.luarocks-nix;
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index b550b21f511a..00815e899f45 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -156,6 +156,7 @@ mapAliases {
   bz2file = throw "'bz2file' has beem removed, as it was not longed maintained upstream since 2020"; # added 2025-08-26
   calysto-scheme = throw "'calysto-scheme' has been removed as it is no longer maintained upstream"; # Added 2026-01-31
   can = throw "'can' has been renamed to/replaced by 'python-can'"; # Converted to throw 2025-10-29
+  capa = flare-capa; # added 2026-09-29
   casbin = pycasbin; # added 2025-06-12
   cchardet = throw "'cchardet' has been renamed to/replaced by 'faust-cchardet'"; # Converted to throw 2025-10-29
   chai = throw "'chai' has been removed as it is no longer maintained upstream and the repository was archived"; # Added 2026-06-08
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index ef18a7b2f4d5..fdd9d676c094 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2877,8 +2877,6 @@ self: super: with self; {
 
   cantools = callPackage ../development/python-modules/cantools { };
 
-  capa = callPackage ../development/python-modules/capa { };
-
   capstone = callPackage ../development/python-modules/capstone { inherit (pkgs) capstone; };
 
   capstone_4 = callPackage ../development/python-modules/capstone/4.nix {
@@ -6201,6 +6199,8 @@ self: super: with self; {
 
   flammkuchen = callPackage ../development/python-modules/flammkuchen { };
 
+  flare-capa = callPackage ../development/python-modules/flare-capa { };
+
   flasgger = callPackage ../development/python-modules/flasgger { };
 
   flash-attn = callPackage ../development/python-modules/flash-attn { };
@@ -13804,6 +13804,10 @@ self: super: with self; {
 
   plumbum = callPackage ../development/python-modules/plumbum { };
 
+  plumed = callPackage ../development/python-modules/plumed {
+    inherit (pkgs) plumed;
+  };
+
   pluralizer = callPackage ../development/python-modules/pluralizer { };
 
   pluthon = callPackage ../development/python-modules/pluthon { };