diff --git a/lib/fileset/internal.nix b/lib/fileset/internal.nix
index 675027c1fee0..3d32c5fc3ef7 100644
--- a/lib/fileset/internal.nix
+++ b/lib/fileset/internal.nix
@@ -349,24 +349,33 @@ rec {
     ```
   */
   _normaliseTreeFilter =
-    path: tree:
-    if tree == "directory" || isAttrs tree then
-      let
-        entries = _directoryEntries path tree;
-        normalisedSubtrees = mapAttrs (name: _normaliseTreeFilter (path + "/${name}")) entries;
-        subtreeValues = attrValues normalisedSubtrees;
-      in
-      # This triggers either when all files in a directory are filtered out
-      # Or when the directory doesn't contain any files at all
-      if all isNull subtreeValues then
-        null
-      # Triggers when we have the same as a `readDir path`, so we can turn it back into an equivalent "directory".
-      else if all isString subtreeValues then
-        "directory"
-      else
-        normalisedSubtrees
-    else
-      tree;
+    let
+      # Recurses into a tree that's already known to be a directory (either a "directory" or an attrset).
+      #
+      # Only directories need to be recursed into:
+      # Files are either null (excluded) or a file type string (included), which are already normalised.
+      #
+      # Checking this in the caller instead of here also avoids the thunk allocation for the path concatenation below.
+      recurse =
+        path: tree:
+        let
+          normalisedSubtrees = mapAttrs (
+            name: subtree:
+            if subtree == "directory" || isAttrs subtree then recurse (path + "/${name}") subtree else subtree
+          ) (_directoryEntries path tree);
+          subtreeValues = attrValues normalisedSubtrees;
+        in
+        # This triggers either when all files in a directory are filtered out
+        # Or when the directory doesn't contain any files at all
+        if all isNull subtreeValues then
+          null
+        # Triggers when we have the same as a `readDir path`, so we can turn it back into an equivalent "directory".
+        else if all isString subtreeValues then
+          "directory"
+        else
+          normalisedSubtrees;
+    in
+    path: tree: if tree == "directory" || isAttrs tree then recurse path tree else tree;
 
   /**
     A minimal normalisation of a filesetTree, intended for pretty-printing:
@@ -526,6 +535,9 @@ rec {
         else
           "/" + concatStringsSep "/" fileset._internalBaseComponents + "/";
 
+      getBaseStringPrefix = substring 0 baseLength;
+      removeBaseStringPrefix = substring baseLength (-1);
+
       baseLength = stringLength baseString;
 
       # Check whether a list of path components under the base path exists in the tree.
@@ -551,7 +563,12 @@ rec {
               # or a string ("directory" or "regular", etc.) in which case it's included
               localTree != null;
         in
-        recurse 0 tree;
+        # Start by recursing into the first element. This is guaranteed to be
+        # safe. components will never be empty (builtins.split can't make an
+        # empty list). Tree can be something other than an attrset, but if so,
+        # the isAttrs check will fail when being passed `or tree`, and the index
+        # being ahead doesn't matter.
+        recurse 2 (tree.${head components} or tree);
 
       # Filter suited when there's no files
       empty = _: _: false;
@@ -569,25 +586,34 @@ rec {
           pathSlash = path + "/";
         in
         (
+          # Same as `hasPrefix baseString pathSlash`, but more efficient.
+          # The path is either the base itself or underneath it,
+          # but only on the few paths above it, so its checked first.
+          # With base /foo/bar this matches /foo/bar and /foo/bar/baz
+          # hasPrefix "/foo/bar/" "/foo/bar/baz/"
+          if getBaseStringPrefix pathSlash == baseString then
+            if pathSlash == baseString then
+              # The path is the base directory itself, which is always included
+              true
+            else
+              # Same as `removePrefix baseString path`, but more efficient.
+              # From the above code we know that hasPrefix baseString pathSlash holds, so this is safe.
+              # We don't use pathSlash here because we only needed the trailing slash for the prefix matching.
+              # With base /foo and path /foo/bar/baz this gives
+              # inTree (split "/" (removePrefix "/foo/" "/foo/bar/baz"))
+              # == inTree (split "/" "bar/baz")
+              # == inTree [ "bar" "baz" ]
+              inTree (split "/" (removeBaseStringPrefix path))
           # Same as `hasPrefix pathSlash baseString`, but more efficient.
+          # The path is a proper ancestor of the base, which needs to be included for the base to be reachable:
           # With base /foo/bar we need to include /foo:
           # hasPrefix "/foo/" "/foo/bar/"
-          if substring 0 (stringLength pathSlash) baseString == pathSlash then
+          else if substring 0 (stringLength pathSlash) baseString == pathSlash then
             true
-          # Same as `! hasPrefix baseString pathSlash`, but more efficient.
-          # With base /foo/bar we need to exclude /baz
-          # ! hasPrefix "/baz/" "/foo/bar/"
-          else if substring 0 baseLength pathSlash != baseString then
-            false
           else
-            # Same as `removePrefix baseString path`, but more efficient.
-            # From the above code we know that hasPrefix baseString pathSlash holds, so this is safe.
-            # We don't use pathSlash here because we only needed the trailing slash for the prefix matching.
-            # With base /foo and path /foo/bar/baz this gives
-            # inTree (split "/" (removePrefix "/foo/" "/foo/bar/baz"))
-            # == inTree (split "/" "bar/baz")
-            # == inTree [ "bar" "baz" ]
-            inTree (split "/" (substring baseLength (-1) path))
+            # The path is unrelated to the base, so nothing from it is included
+            # With base /foo/bar this matches e.g. /baz
+            false
         )
         # This is a way have an additional check in case the above is true without any significant performance cost
         && (
@@ -802,21 +828,34 @@ rec {
   */
   _unionTrees =
     trees:
-    let
-      stringIndex = findFirstIndex isString null trees;
-      withoutNull = filter (tree: tree != null) trees;
-    in
-    if stringIndex != null then
+    if length trees == 1 then
+      # The union of a single tree simply returns the first element
+      head trees
+    else
+      let
+        # Like lib.findFirstIndex but without indexing.
+        # This is a hot path so the indexing arithmetic adds up.
+        firstStr = foldl' (
+          found: tree:
+          if found != null then
+            found
+          else if isString tree then
+            tree
+          else
+            found # null
+        ) null trees;
+        nonNulls = filter (tree: tree != null) trees;
+      in
       # If there's a string, it's always a fully included tree (dir or file),
       # no need to look at other elements
-      elemAt trees stringIndex
-    else if withoutNull == [ ] then
-      # If all trees are null, then the resulting tree is also null
-      null
-    else
-      # The non-null elements have to be attribute sets representing partial trees
-      # We need to recurse into those
-      zipAttrsWith (name: _unionTrees) withoutNull;
+      if firstStr != null then
+        firstStr
+      else if nonNulls == [ ] then
+        null
+      else
+        # The non-null elements have to be attribute sets representing partial trees
+        # We need to recurse into those
+        zipAttrsWith (name: _unionTrees) nonNulls;
 
   /**
     Computes the intersection of two filesets.
diff --git a/lib/systems/default.nix b/lib/systems/default.nix
index 262cb722a090..77e7a8f99ef4 100644
--- a/lib/systems/default.nix
+++ b/lib/systems/default.nix
@@ -151,7 +151,24 @@ let
           );
 
         # Derived meta-data
-        useLLVM = final.isFreeBSD || final.isOpenBSD;
+        useLLVM =
+          final.isFreeBSD
+          || final.isOpenBSD
+          || final.isUefi
+          || final.isMsvc
+          ||
+            # because GCC does not support this platform yet
+            (with final; isWindows && isAarch64);
+
+        # Use the split GCC package set (`gccNGPackages`) instead of the
+        # monolithic `gcc`. No platform selects it yet; it is opt-in, set
+        # explicitly on a platform spec, so that the split set can be exercised
+        # before anything depends on it.
+        #
+        # I (@Ericson2314) plan on making obscure low-tier platforms (e.g.
+        # NetBSD) use it soon, so we can dogfood GCC NG and thereby iron out its
+        # bugs.
+        useGccNG = false;
 
         libc =
           if final.isDarwin then
@@ -176,9 +193,7 @@ let
             "uclibc"
           else if final.isAndroid then
             "bionic"
-          else if
-            final.isLinux # default
-          then
+          else if final.isLinux then
             "glibc"
           else if final.isFreeBSD then
             "fblibc"
@@ -190,6 +205,8 @@ let
             "avrlibc"
           else if final.isGhcjs then
             null
+          else if final.isUefi then
+            null
           else if final.isNone then
             "newlib"
           # TODO(@Ericson2314) think more about other operating systems
diff --git a/lib/systems/examples.nix b/lib/systems/examples.nix
index d0eac0eb030a..88207cb845c1 100644
--- a/lib/systems/examples.nix
+++ b/lib/systems/examples.nix
@@ -93,7 +93,6 @@ rec {
     config = "aarch64-unknown-linux-android";
     androidSdkVersion = "35";
     androidNdkVersion = "27";
-    libc = "bionic";
     useAndroidPrebuilt = false;
     useLLVM = true;
   };
@@ -169,22 +168,18 @@ rec {
 
   riscv64-embedded = {
     config = "riscv64-none-elf";
-    libc = "newlib";
   };
 
   riscv32-embedded = {
     config = "riscv32-none-elf";
-    libc = "newlib";
   };
 
   mips64-embedded = {
     config = "mips64-none-elf";
-    libc = "newlib";
   };
 
   mips-embedded = {
     config = "mips-none-elf";
-    libc = "newlib";
   };
 
   # https://github.com/loongson/la-softdev-convention/blob/master/la-softdev-convention.adoc#10-operating-system-package-build-requirements
@@ -201,17 +196,17 @@ rec {
 
   mmix = {
     config = "mmix-unknown-mmixware";
+    # Not `isNone`: the OS here is `mmixware`, so the bare-metal default does
+    # not apply.
     libc = "newlib";
   };
 
   rx-embedded = {
     config = "rx-none-elf";
-    libc = "newlib";
   };
 
   msp430 = {
     config = "msp430-elf";
-    libc = "newlib";
   };
 
   avr = {
@@ -220,12 +215,10 @@ rec {
 
   vc4 = {
     config = "vc4-elf";
-    libc = "newlib";
   };
 
   or1k = {
     config = "or1k-elf";
-    libc = "newlib";
   };
 
   m68k = {
@@ -250,7 +243,6 @@ rec {
 
   arm-embedded = {
     config = "arm-none-eabi";
-    libc = "newlib";
   };
   arm-embedded-nano = {
     config = "arm-none-eabi";
@@ -258,7 +250,6 @@ rec {
   };
   armhf-embedded = {
     config = "arm-none-eabihf";
-    libc = "newlib";
     # GCC8+ does not build without this
     # (https://www.mail-archive.com/gcc-bugs@gcc.gnu.org/msg552339.html):
     gcc = {
@@ -269,38 +260,31 @@ rec {
 
   aarch64-embedded = {
     config = "aarch64-none-elf";
-    libc = "newlib";
     rust.rustcTarget = "aarch64-unknown-none";
   };
 
   aarch64be-embedded = {
     config = "aarch64_be-none-elf";
-    libc = "newlib";
   };
 
   ppc-embedded = {
     config = "powerpc-none-eabi";
-    libc = "newlib";
   };
 
   ppcle-embedded = {
     config = "powerpcle-none-eabi";
-    libc = "newlib";
   };
 
   i686-embedded = {
     config = "i686-elf";
-    libc = "newlib";
   };
 
   x86_64-embedded = {
     config = "x86_64-elf";
-    libc = "newlib";
   };
 
   microblaze-embedded = {
     config = "microblazeel-none-elf";
-    libc = "newlib";
   };
 
   #
@@ -338,16 +322,10 @@ rec {
 
   x86_64-unknown-uefi = {
     config = "x86_64-unknown-uefi";
-    libc = null;
-    useLLVM = true;
-    linker = "lld";
   };
 
   aarch64-unknown-uefi = {
     config = "aarch64-unknown-uefi";
-    libc = null;
-    useLLVM = true;
-    linker = "lld";
   };
 
   #
@@ -382,12 +360,11 @@ rec {
   };
 
   # mingw-w64 with ucrt for Aarch64, default compiler (which is LLVM
-  # because GCC does not support this platform yet).
+  # see ./default.nix).
   mingw-ucrt-aarch64 = {
     config = "aarch64-w64-mingw32";
     libc = "ucrt";
     rust.rustcTarget = "aarch64-pc-windows-gnullvm";
-    useLLVM = true;
   };
 
   # mingw-64 back compat
@@ -400,12 +377,10 @@ rec {
   # Target the MSVC ABI
   x86_64-windows = {
     config = "x86_64-pc-windows-msvc";
-    useLLVM = true;
   };
 
   aarch64-windows = {
     config = "aarch64-pc-windows-msvc";
-    useLLVM = true;
   };
 
   x86_64-cygwin = {
@@ -416,12 +391,10 @@ rec {
 
   aarch64-freebsd = {
     config = "aarch64-unknown-freebsd";
-    useLLVM = true;
   };
 
   x86_64-freebsd = {
     config = "x86_64-unknown-freebsd";
-    useLLVM = true;
   };
 
   x86_64-netbsd = {
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 067dadb64638..a51f0db04b84 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -63,6 +63,12 @@
 {
   # keep-sorted start case=no numeric=no block=yes
 
+  "3mp3ri0r" = {
+    email = "christoforus@xendit.co";
+    github = "3mp3ri0r";
+    githubId = 3140815;
+    name = "Christoforus Surjoputro";
+  };
   _0b11stan = {
     name = "Tristan Auvinet Pinaudeau";
     email = "tristan@tic.sh";
@@ -616,6 +622,11 @@
       { fingerprint = "CE85 54F7 B9BC AC0D D648  5661 AB5F C04C 3C94 443F"; }
     ];
   };
+  ad-si = {
+    name = "Adrian Sieber";
+    github = "ad-si";
+    githubId = 36796532;
+  };
   ad030 = {
     name = "Alex Dam";
     github = "ad030";
@@ -2325,6 +2336,12 @@
     githubId = 8049011;
     name = "Arik Grahl";
   };
+  arison = {
+    email = "arison@duck.com";
+    github = "ArisoN-ext";
+    githubId = 181835726;
+    name = "ArisoN";
+  };
   ariutta = {
     email = "anders.riutta@gmail.com";
     github = "ariutta";
@@ -7123,6 +7140,12 @@
     githubId = 15774340;
     name = "Thomas Depierre";
   };
+  dibenzepin = {
+    name = "Fumnanya";
+    email = "fmowete@outlook.com";
+    github = "dibenzepin";
+    githubId = 87488715;
+  };
   DictXiong = {
     email = "me@beardic.cn";
     github = "DictXiong";
@@ -11273,11 +11296,6 @@
     githubId = 58676303;
     name = "hhydraa";
   };
-  hibiday = {
-    name = "Katsumi Takeuchi";
-    github = "hibiday";
-    githubId = 137286929;
-  };
   higebu = {
     name = "Yuya Kusakabe";
     email = "yuya.kusakabe@gmail.com";
@@ -22807,12 +22825,6 @@
     githubId = 4201956;
     name = "pongo1231";
   };
-  poopsicles = {
-    name = "Fumnanya";
-    email = "fmowete@outlook.com";
-    github = "dibenzepin";
-    githubId = 87488715;
-  };
   PopeRigby = {
     name = "PopeRigby";
     github = "poperigby";
@@ -23872,6 +23884,12 @@
       { fingerprint = "01D7 5486 3A6D 64EA AC77 0D26 FBF1 9A98 2CCE 0048"; }
     ];
   };
+  recutita = {
+    name = "Katsumi Takeuchi";
+    email = "contact@recutita.com";
+    github = "recutita";
+    githubId = 137286929;
+  };
   redfish64 = {
     email = "engler@gmail.com";
     github = "redfish64";
diff --git a/maintainers/scripts/luarocks-packages.csv b/maintainers/scripts/luarocks-packages.csv
index dd50dc7154e1..55b1ad758c92 100644
--- a/maintainers/scripts/luarocks-packages.csv
+++ b/maintainers/scripts/luarocks-packages.csv
@@ -23,6 +23,7 @@ digestif,,,,,5.3,
 dkjson,,,,,,
 enet,,,,,,ulysseszhan
 etlua,,,,,,ulysseszhan
+fallo,,,,,,mrcjkb
 fennel,,,,,,misterio77
 fidget.nvim,,,,,5.1,mrcjkb
 fifo,,,,,,
diff --git a/nixos/doc/manual/development/settings-options.section.md b/nixos/doc/manual/development/settings-options.section.md
index e5532f00f371..3b03a087e834 100644
--- a/nixos/doc/manual/development/settings-options.section.md
+++ b/nixos/doc/manual/development/settings-options.section.md
@@ -395,7 +395,7 @@ have a predefined type and string generator already declared under
 
     `mkRaw pythonCode`
 
-    :   Outputs the given string as raw Python code
+    :   Outputs the given string as raw Python code. Note that the final result will be stripped of any comments.
 
     `_imports`
 
diff --git a/nixos/doc/manual/development/state-revision.section.md b/nixos/doc/manual/development/state-revision.section.md
new file mode 100644
index 000000000000..8a8f13aeda74
--- /dev/null
+++ b/nixos/doc/manual/development/state-revision.section.md
@@ -0,0 +1,57 @@
+# State revision {#sec-state-revision}
+
+NixOS includes a {option}`system.stateVersion` option, used by some modules for a
+variety of reasons related to non-backward-compatible changes to software or
+the module itself.
+Module authors are discouraged from adding new uses of
+{option}`system.stateVersion` to their module.
+
+However, when the alternatives are impractical, modules that wish to consume
+{option}`system.stateVersion` should instead define their own `stateRevision`
+option using `utils.mkStateRevisionOption`.
+There should be no uses of `config.system.stateVersion` directly in the module.
+
+(Note the name difference: the {option}`system.stateVersion` option, with a V,
+takes a value that looks like "YY.MM".
+A `stateRevision` option, with an R, takes a non-negative integer value.)
+
+Modules should also add the value of their `stateRevision` option to
+`system.moduleStateRevisions."your.module.stateRevision"`, when the module is
+enabled.
+This is a purely informative option that exists to help describe the effects of
+changing {option}`system.stateVersion`.
+
+Example:
+
+```nix
+{
+  lib,
+  config,
+  utils,
+  ...
+}:
+let
+  cfg = config.services.whatever;
+in
+{
+  options.services.whatever = {
+    enable = lib.mkEnableOption "whatever, a service that does whatever";
+    stateRevision = utils.mkStateRevisionOption {
+      descriptionName = "the whatever service";
+      migrations = {
+        "26.05" = "Rename `/var/lib/old_name` to `/var/lib/new_name`.";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.whatever = {
+      # ...
+      serviceConfig.StateDirectory = if cfg.stateRevision < 1 then "old_name" else "new_name";
+    };
+
+    # Important: this is inside the `lib.mkIf cfg.enable`
+    system.moduleStateRevisions."services.whatever.stateRevision" = cfg.stateRevision;
+  };
+}
+```
diff --git a/nixos/doc/manual/development/writing-modules.chapter.md b/nixos/doc/manual/development/writing-modules.chapter.md
index a58ebb1709ab..626834fc3e66 100644
--- a/nixos/doc/manual/development/writing-modules.chapter.md
+++ b/nixos/doc/manual/development/writing-modules.chapter.md
@@ -220,4 +220,5 @@ importing-modules.section.md
 replace-modules.section.md
 freeform-modules.section.md
 settings-options.section.md
+state-revision.section.md
 ```
diff --git a/nixos/doc/manual/redirects.json b/nixos/doc/manual/redirects.json
index 6e8a587f02c4..9901e543a346 100644
--- a/nixos/doc/manual/redirects.json
+++ b/nixos/doc/manual/redirects.json
@@ -253,6 +253,9 @@
   "sec-override-nixos-test": [
     "index.html#sec-override-nixos-test"
   ],
+  "sec-state-revision": [
+    "index.html#sec-state-revision"
+  ],
   "sec-wireless-declarative": [
     "index.html#sec-wireless-declarative"
   ],
diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index e84c3bfbbd63..a837dc7d2bd6 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -28,6 +28,10 @@
   firewall, is available through
   [services.portmaster](#opt-services.portmaster.enable).
 
+- [btrfs-heatmap](https://github.com/knorrie/btrfs-heatmap), setcap wrapper for `btrfs-heatmap` package, a visualizer of how a btrfs filesystem is using the underlying disk space of the block devices. Available as [programs.btrfs-heatmap](#opt-programs.btrfs-heatmap.enable)
+
+- [compsize](https://github.com/kilobyte/compsize), setcap wrapper for `compsize` package, a cli utility to to inspect compression type/ratio on BTRFS filesystems. Available as [programs.compsize](#opt-programs.compsize.enable)
+
 - [tranquil](https://tangled.org/tranquil.farm/tranquil-pds) is an ATProto PDS (personal data server) implementation in Rust. A featureful, spec conscious and community driven alternative to the Bluesky reference implementation PDS. Available as [services.tranquil-pds](#opt-services.tranquil-pds.enable).
 
 - [Moonlight Qt](https://moonlight-stream.org/), a client for playing your PC games on almost any device. Available as [programs.moonlight-qt](#opt-programs.moonlight-qt.enable).
@@ -62,6 +66,8 @@
 
 - [Zapret2](https://github.com/bol-van/zapret2), an extensible DPI bypass program. Available as [services.zapret2](#opt-services.zapret2.enable).
 
+- [Solaar](https://github.com/pwr-Solaar/Solaar), a program to control logitech devices.
+
 - [FlapAlerted](https://github.com/Kioubit/FlapAlerted), detects BGP flapping events and provides statistics based on BGP update messages. Available as [services.flap-alerted](#opt-services.flap-alerted.enable).
 
 - [gocron](https://github.com/flohoss/gocron), a task scheduler with web interface. Available as [services.gocron](#opt-services.gocron.enable).
@@ -84,6 +90,8 @@
 
 - [Entropy](https://github.com/ergohaven/entropy), a configurator for programmable keyboards and input devices running Vial-QMK/RMK firmware. Available as [programs.entropy](#opt-programs.entropy.enable).
 
+- [Kvrocks](https://kvrocks.apache.org/), a distributed key value NoSQL database compatible with the Redis protocol. Available as [services.kvrocks](#opt-services.kvrocks.enable).
+
 ## Backward Incompatibilities {#sec-release-26.11-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -118,6 +126,8 @@
 
 - Rustical migrates from `settings.http.host` and `settings.http.port` to `settings.http.bind` to support UNIX domain sockets as well as TCP sockets in one setting.
 
+- The `jetty_11` package has been removed as it reached end of life. Use `jetty_12` instead.
+
 - The Mullvad VPN service now has a separate toggle to enable the Mullvad VPN graphical user interface. If you have previously used Mullvad on a desktop by setting `services.mullvad-vpn.package` to `pkgs.mullvad-vpn`, you should now **unset that option**, and enable `services.mullvad-vpn.gui.enable`. The VPN will not work if `services.mullvad-vpn.package` is set to `pkgs.mullvad-vpn`, as `pkgs.mullvad-vpn` no longer contains the Mullvad Daemon; please ensure that `services.mullvad-vpn.package` is set to `pkgs.mullvad`, regardless if you plan to enable the graphical user interface or not.
 
 - A number of options for `services.llama-cpp` have been removed in favor of the structured [](#opt-services.llama-cpp.settings) option, attributes from which are used as arguments to `llama-server` executable, you can see all available options by running `llama-server --help`. Configuring model presets using Nix attribute set via `services.llama-cpp.modelsPreset` is no longer supported, please use `services.llama-cpp.settings.models-preset` with a path to an INI file containing desired options.
@@ -237,3 +247,5 @@
 - `trilium-desktop` and `trilium-server` have been updated to 0.104.0. This release includes security hardening fixes that may break functionality. [See upstream release note for details](https://github.com/TriliumNext/Trilium/releases/tag/v0.104.0).
 
 - `nix` now supports running in "daemonless" mode by setting `nix.daemon.enable = false`. Under this mode all store operations must go through the [local store type](https://nix.dev/manual/nix/latest/store/types/local-store), which typically requires root permissions.
+
+- [Hister](https://github.com/asciimoo/hister), a web history service offering blazing fast, content-based search across visited websites. Available as [services.hister](#opt-services.hister.enable).
diff --git a/nixos/lib/test-driver/default.nix b/nixos/lib/test-driver/default.nix
index efc7d8fa9a85..b2221e06629c 100644
--- a/nixos/lib/test-driver/default.nix
+++ b/nixos/lib/test-driver/default.nix
@@ -60,7 +60,7 @@ buildPythonApplication {
     util-linux
     vde2
   ]
-  ++ lib.optionals stdenv.isLinux [
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
     vhost-device-vsock
   ]
   ++ lib.optionals enableNspawn [
diff --git a/nixos/lib/testing/testScript.nix b/nixos/lib/testing/testScript.nix
index e9da13d20c75..2ba9b682d3cb 100644
--- a/nixos/lib/testing/testScript.nix
+++ b/nixos/lib/testing/testScript.nix
@@ -8,12 +8,12 @@ testModuleArgs@{
 }:
 let
   inherit (lib) mkOption types;
-  inherit (types) either str functionTo;
+  inherit (types) either lines functionTo;
 in
 {
   options = {
     testScript = mkOption {
-      type = either str (functionTo str);
+      type = either lines (functionTo lines);
       apply =
         v:
         if lib.isFunction v then
@@ -27,7 +27,7 @@ in
       '';
     };
     testScriptString = mkOption {
-      type = str;
+      type = lines;
       readOnly = true;
       internal = true;
     };
diff --git a/nixos/lib/utils.nix b/nixos/lib/utils.nix
index 487b20f53d8c..224d7ad90330 100644
--- a/nixos/lib/utils.nix
+++ b/nixos/lib/utils.nix
@@ -6,8 +6,10 @@
 
 let
   inherit (lib)
+    all
     any
     attrNames
+    concatImapStringsSep
     concatMapStringsSep
     concatStringsSep
     elem
@@ -27,8 +29,11 @@ let
     isList
     isPath
     isString
+    length
     listToAttrs
+    literalMD
     mapAttrs
+    mkOption
     nameValuePair
     optionalString
     removePrefix
@@ -36,8 +41,10 @@ let
     splitString
     stringToCharacters
     types
+    versionOlder
     ;
 
+  inherit (lib.lists) findFirstIndex;
   inherit (lib.strings) toJSON escapeC;
 in
 
@@ -604,6 +611,122 @@ let
         lib.listToAttrs
       ];
     };
+
+    /**
+      Creates a per-module `stateRevision` option that takes an int value, with a
+      default that is derived from `system.stateVersion`.
+
+      # Inputs
+
+      `descriptionName`
+      : A human-friendly name for your module, used for the description of the
+        created option.
+
+      `migrations`
+      : Attribute set that maps from values of `system.stateVersion`
+        (representing the breakpoints at which the default value of this option
+        will change) to Markdown instructions to users for manually migrating
+        their data to this breakpoint. The migration instructions will be
+        included in the NixOS documentation for this option. (These instructions
+        must only contain Markdown inlines, because they will be rendered as
+        items in an ordered list. In particular, nested lists will not render
+        correctly.)
+
+        `migrations` will also be exposed as an attribute on the result.
+
+      # Examples
+      :::{.example}
+      ## `lib.options.mkStateRevisionOption` usage example
+
+      ```nix
+      exampleModule =
+        { lib, config, utils, ... }:
+        {
+          options.services.whatever = {
+            stateRevision = utils.mkStateRevisionOption {
+              descriptionName = "the whatever service";
+              migrations = {
+                "26.05" = "Rename `/var/lib/old_name` to `/var/lib/new_name`.";
+                "26.11" = "Run the `upgrade_whatever` utility.";
+                };
+              };
+            };
+          };
+        }
+
+      (pkgs.nixos [
+        exampleModule
+        { system.stateVersion = "25.11"; }
+      ]).config.services.whatever.stateRevision # => 0
+      (pkgs.nixos [
+        exampleModule
+        { system.stateVersion = "26.05"; }
+      ]).config.services.whatever.stateRevision # => 1
+      (pkgs.nixos [
+        exampleModule
+        { system.stateVersion = "27.05"; }
+      ]).config.services.whatever.stateRevision # => 2
+      ```
+
+      :::
+
+      Modules should use this function when they change how data managed by the
+      module is persisted on the system between NixOS releases.
+
+      The default value of the option will be the number of attributes in the
+      `migrations` parameter with name less than or equal to the value of
+      `system.stateVersion`.
+
+      When using this function, don't forget to add the option's value to
+      `system.moduleStateRevisions."your.module.stateRevision"` when your module is
+      enabled.
+    */
+    mkStateRevisionOption =
+      {
+        descriptionName,
+        migrations,
+      }:
+      let
+        versions = attrNames migrations;
+        maxVal = length versions;
+      in
+      assert all (v: builtins.match "[0-9]{2}\\.[0-9]{2}" v != null) versions;
+      mkOption {
+        type = types.ints.between 0 maxVal;
+        description = ''
+          This option versions the format of state persisted by
+          ${descriptionName}. Its default value depends on the value of
+          {option}`system.stateVersion`.
+
+          Users who wish to increment this option will need to take manual
+          migration steps to preserve their data. **If you perform these
+          migrations, rolling back to an older generation will require also
+          reversing the migrations to the state expected by that generation.**
+          The migrations needed to advance to each value of this option are as
+          follows (perform all instructions after the row for the current
+          `stateRevision`, up to and including the row for the new
+          `stateRevision`):
+
+          0. (none)
+          ${concatImapStringsSep "\n" (
+            v: sv: "${toString v}. ${replaceStrings [ "\n" ] [ " " ] migrations.${sv}}"
+          ) versions}
+
+          Note that you do **not** need to change {option}`system.stateVersion`
+          in order to update this option. {option}`system.stateVersion` only
+          determines the default value of this option. Most users should not
+          change {option}`system.stateVersion` at all.
+        '';
+        default = findFirstIndex (versionOlder config.system.stateVersion) maxVal versions;
+        defaultText = literalMD ''
+          If {option}`system.stateVersion` is:
+          ${concatImapStringsSep "\n" (v: sv: "* &lt;${sv}: ${toString (v - 1)}") versions}
+          * otherwise: ${toString maxVal}
+        '';
+      }
+      // {
+        inherit migrations;
+      };
   };
 in
 utils
diff --git a/nixos/modules/hardware/logitech.nix b/nixos/modules/hardware/logitech.nix
index 74c8a230bc46..07adf77a9965 100644
--- a/nixos/modules/hardware/logitech.nix
+++ b/nixos/modules/hardware/logitech.nix
@@ -19,8 +19,8 @@ in
       [ "hardware" "logitech" "wireless" "enable" ]
     )
     (lib.mkRenamedOptionModule
-      [ "hardware" "logitech" "enableGraphical" ]
       [ "hardware" "logitech" "wireless" "enableGraphical" ]
+      [ "programs" "solaar" "enable" ]
     )
   ];
 
@@ -56,20 +56,11 @@ in
 
     wireless = {
       enable = lib.mkEnableOption "support for Logitech Wireless Devices";
-
-      enableGraphical = lib.mkOption {
-        type = lib.types.bool;
-        default = false;
-        description = "Enable graphical support applications.";
-      };
     };
   };
 
   config = lib.mkIf (cfg.wireless.enable || cfg.lcd.enable) {
-    environment.systemPackages =
-      [ ]
-      ++ lib.optional cfg.wireless.enable pkgs.ltunify
-      ++ lib.optional cfg.wireless.enableGraphical pkgs.solaar;
+    environment.systemPackages = lib.optional cfg.wireless.enable pkgs.ltunify;
 
     services.udev = {
       # ltunifi and solaar both provide udev rules but the most up-to-date have been split
diff --git a/nixos/modules/hardware/video/nvidia.nix b/nixos/modules/hardware/video/nvidia.nix
index dc3d6cb134f7..bd553409cff6 100644
--- a/nixos/modules/hardware/video/nvidia.nix
+++ b/nixos/modules/hardware/video/nvidia.nix
@@ -482,7 +482,7 @@ in
               combineIcdPkgs =
                 icd: pkgs:
                 pkgs.symlinkJoin {
-                  name = "nvidia-egl-external-platforms${lib.optionalString pkgs.stdenv.is32bit "-x32"}";
+                  name = "nvidia-egl-external-platforms${lib.optionalString pkgs.stdenv.hostPlatform.is32bit "-x32"}";
                   paths = lib.attrVals icd pkgs;
                   # Remediate reversed priorities in pre-595 drivers,
                   # https://github.com/NixOS/nixpkgs/pull/497342#issuecomment-4034876793
diff --git a/nixos/modules/misc/version.nix b/nixos/modules/misc/version.nix
index b61e00d647b2..6270eb663db8 100644
--- a/nixos/modules/misc/version.nix
+++ b/nixos/modules/misc/version.nix
@@ -254,6 +254,30 @@ in
       '';
     };
 
+    moduleStateRevisions = mkOption {
+      type =
+        let
+          baseType = types.attrsOf types.ints.unsigned;
+          isStateRevisionOption = x: lib.isOption x && x ? migrations;
+        in
+        types.addCheck baseType (
+          attrs:
+          builtins.all (
+            attrPath: isStateRevisionOption (lib.attrByPath (lib.splitString "." attrPath) null options)
+          ) (builtins.attrNames attrs)
+        )
+        // {
+          description = "${baseType.description}, in which every attribute name is the path to an option created with mkStateRevisionOption";
+        };
+      default = { };
+      internal = true;
+      description = ''
+        NixOS modules should set attributes on this option. Users should leave
+        it alone. Future tooling may use it to determine the consequences of
+        updating {option}`system.stateVersion`.
+      '';
+    };
+
     configurationRevision = mkOption {
       type = types.nullOr types.str;
       default = null;
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 953343df682e..3f6378485322 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -185,6 +185,7 @@
   ./programs/bcc.nix
   ./programs/benchexec.nix
   ./programs/browserpass.nix
+  ./programs/btrfs-heatmap.nix
   ./programs/calls.nix
   ./programs/captive-browser.nix
   ./programs/ccache.nix
@@ -196,6 +197,7 @@
   ./programs/cnping.nix
   ./programs/comma.nix
   ./programs/command-not-found/command-not-found.nix
+  ./programs/compsize.nix
   ./programs/coolercontrol.nix
   ./programs/corefreq.nix
   ./programs/cpu-energy-meter.nix
@@ -326,6 +328,7 @@
   ./programs/skim.nix
   ./programs/slock.nix
   ./programs/sniffnet.nix
+  ./programs/solaar.nix
   ./programs/soundmodem.nix
   ./programs/ssh.nix
   ./programs/starship.nix
@@ -548,6 +551,7 @@
   ./services/databases/hbase-standalone.nix
   ./services/databases/influxdb2.nix
   ./services/databases/influxdb.nix
+  ./services/databases/kvrocks.nix
   ./services/databases/lldap.nix
   ./services/databases/memcached.nix
   ./services/databases/monetdb.nix
@@ -1711,6 +1715,7 @@
   ./services/web-apps/haven.nix
   ./services/web-apps/healthchecks.nix
   ./services/web-apps/hedgedoc.nix
+  ./services/web-apps/hister.nix
   ./services/web-apps/hledger-web.nix
   ./services/web-apps/homebox.nix
   ./services/web-apps/homer.nix
diff --git a/nixos/modules/programs/btrfs-heatmap.nix b/nixos/modules/programs/btrfs-heatmap.nix
new file mode 100644
index 000000000000..1c6ef694cde6
--- /dev/null
+++ b/nixos/modules/programs/btrfs-heatmap.nix
@@ -0,0 +1,32 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+{
+  meta.maintainers = with lib.maintainers; [ sandarukasa ];
+
+  options = {
+    programs.btrfs-heatmap = {
+      enable = lib.mkEnableOption "btrfs-heatmap + setcap wrapper";
+      package = lib.mkPackageOption pkgs "btrfs-heatmap" { };
+    };
+  };
+
+  config =
+    let
+      cfg = config.programs.btrfs-heatmap;
+    in
+    lib.mkIf cfg.enable {
+      # for the man page
+      environment.systemPackages = [ cfg.package ];
+
+      security.wrappers.btrfs-heatmap = {
+        owner = config.users.users.root.name;
+        group = config.users.users.root.group;
+        capabilities = "cap_sys_admin+p";
+        source = lib.getExe cfg.package;
+      };
+    };
+}
diff --git a/nixos/modules/programs/compsize.nix b/nixos/modules/programs/compsize.nix
new file mode 100644
index 000000000000..25cd531a65be
--- /dev/null
+++ b/nixos/modules/programs/compsize.nix
@@ -0,0 +1,32 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+{
+  meta.maintainers = with lib.maintainers; [ sandarukasa ];
+
+  options = {
+    programs.compsize = {
+      enable = lib.mkEnableOption "compsize + setcap wrapper";
+      package = lib.mkPackageOption pkgs "compsize" { };
+    };
+  };
+
+  config =
+    let
+      cfg = config.programs.compsize;
+    in
+    lib.mkIf cfg.enable {
+      # for the man page
+      environment.systemPackages = [ cfg.package ];
+
+      security.wrappers.compsize = {
+        owner = config.users.users.root.name;
+        group = config.users.users.root.group;
+        capabilities = "cap_sys_admin+p";
+        source = lib.getExe cfg.package;
+      };
+    };
+}
diff --git a/nixos/modules/programs/solaar.nix b/nixos/modules/programs/solaar.nix
new file mode 100644
index 000000000000..320e8559b8db
--- /dev/null
+++ b/nixos/modules/programs/solaar.nix
@@ -0,0 +1,93 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.programs.solaar;
+  inherit (lib)
+    mkEnableOption
+    mkIf
+    mkOption
+    types
+    maintainers
+    mkPackageOption
+    ;
+in
+{
+  options.programs.solaar = {
+    enable = mkEnableOption "Solaar, the open source driver for Logitech devices.";
+
+    package = mkPackageOption pkgs "solaar" { };
+
+    userService = {
+      enable = mkEnableOption "Enable the solaar systemd service for each user.";
+
+      window = mkOption {
+        type = types.enum [
+          "show"
+          "hide"
+          "only"
+        ];
+        default = "hide";
+        description = ''
+          Start with window showing / hidden / only (no tray icon).
+        '';
+      };
+
+      batteryIcons = mkOption {
+        type = types.enum [
+          "regular"
+          "symbolic"
+          "solaar"
+        ];
+        default = "regular";
+        description = ''
+          Prefer regular battery / symbolic battery / solaar icons.
+        '';
+      };
+
+      extraArgs = mkOption {
+        type = types.listOf types.str;
+        default = [ ];
+        example = [ "--restart-on-wake-up" ];
+        description = ''
+          Extra arguments to pass to Solaar.
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    hardware.logitech.wireless.enable = lib.mkDefault true;
+    environment.systemPackages = [ cfg.package ];
+
+    systemd.user.services.solaar = mkIf cfg.userService.enable {
+      description = "Solaar, the open source driver for Logitech devices";
+      wantedBy = [ "graphical-session.target" ];
+      partOf = [ "graphical-session.target" ];
+      after = [ "dbus.service" ];
+      serviceConfig = {
+        Type = "simple";
+        ExecStart = lib.escapeShellArgs (
+          [
+            (lib.getExe cfg.package)
+            "--window"
+            cfg.userService.window
+            "--battery-icons"
+            cfg.userService.batteryIcons
+          ]
+          ++ cfg.userService.extraArgs
+        );
+        Restart = "on-failure";
+        RestartSec = "5";
+      };
+    };
+  };
+
+  meta = {
+    maintainers = [ maintainers.Svenum ];
+  };
+}
diff --git a/nixos/modules/programs/zoxide.nix b/nixos/modules/programs/zoxide.nix
index de85259d0100..d93e44f86093 100644
--- a/nixos/modules/programs/zoxide.nix
+++ b/nixos/modules/programs/zoxide.nix
@@ -6,7 +6,7 @@
 }:
 let
   inherit (lib.options) mkEnableOption mkPackageOption mkOption;
-  inherit (lib.modules) mkIf;
+  inherit (lib.modules) mkIf mkAfter;
   inherit (lib.meta) getExe;
   inherit (lib.types) listOf str;
   inherit (lib.strings) concatStringsSep;
@@ -52,15 +52,15 @@ in
     environment.systemPackages = [ cfg.package ];
 
     programs = {
-      zsh.interactiveShellInit = mkIf cfg.enableZshIntegration ''
+      zsh.interactiveShellInit = mkIf cfg.enableZshIntegration (mkAfter ''
         eval "$(${getExe cfg.package} init zsh ${cfgFlags} )"
-      '';
-      bash.interactiveShellInit = mkIf cfg.enableBashIntegration ''
+      '');
+      bash.interactiveShellInit = mkIf cfg.enableBashIntegration (mkAfter ''
         eval "$(${getExe cfg.package} init bash ${cfgFlags} )"
-      '';
-      fish.interactiveShellInit = mkIf cfg.enableFishIntegration ''
+      '');
+      fish.interactiveShellInit = mkIf cfg.enableFishIntegration (mkAfter ''
         ${getExe cfg.package} init fish ${cfgFlags} | source
-      '';
+      '');
       xonsh.config = ''
         execx($(${getExe cfg.package} init xonsh ${cfgFlags}), 'exec', __xonsh__.ctx, filename='zoxide')
       '';
diff --git a/nixos/modules/security/isolate.nix b/nixos/modules/security/isolate.nix
index 9f0060e305ac..88dde22b31cf 100644
--- a/nixos/modules/security/isolate.nix
+++ b/nixos/modules/security/isolate.nix
@@ -79,7 +79,7 @@ in
     };
 
     firstUid = mkOption {
-      type = types.numbers.between 1000 65533;
+      type = types.ints.between 1000 65533;
       default = 60000;
       description = ''
         Start of block of UIDs reserved for sandboxes.
@@ -87,7 +87,7 @@ in
     };
 
     firstGid = mkOption {
-      type = types.numbers.between 1000 65533;
+      type = types.ints.between 1000 65533;
       default = 60000;
       description = ''
         Start of block of GIDs reserved for sandboxes.
@@ -95,7 +95,7 @@ in
     };
 
     numBoxes = mkOption {
-      type = types.numbers.between 1000 65533;
+      type = types.ints.between 1000 65533;
       default = 1000;
       description = ''
         Number of UIDs and GIDs to reserve, starting from
diff --git a/nixos/modules/services/databases/kvrocks.nix b/nixos/modules/services/databases/kvrocks.nix
new file mode 100644
index 000000000000..d6bb3a1361c5
--- /dev/null
+++ b/nixos/modules/services/databases/kvrocks.nix
@@ -0,0 +1,278 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.kvrocks;
+
+  format = pkgs.formats.keyValue {
+    # Emit list values as repeated keys (e.g. rename-command), matching MultiStringField.
+    listsAsDuplicateKeys = true;
+    mkKeyValue = lib.generators.mkKeyValueDefault {
+      mkValueString = v: if lib.isBool v then lib.boolToYesNo v else toString v;
+    } " ";
+  };
+
+  defaultDir = "/var/lib/kvrocks";
+  dataDir = cfg.settings.dir;
+  isDefaultDir = dataDir == defaultDir;
+
+  # Defaults match upstream Config field defaults (config.cc).
+  workers = cfg.settings.workers or 8;
+  maxBackgroundJobs = cfg.settings."rocksdb.max_background_jobs" or 4;
+  maxclients = cfg.settings.maxclients or 10240;
+  maxOpenFiles = cfg.settings."rocksdb.max_open_files" or 8096;
+
+  # Thread inventory from server.cc ("Kvrocks threads list") + Server::Start:
+  #   always-on: main, workers, task-runner (1), server-cron, compact-check,
+  #              rocksdb background (bounded by max_background_jobs)
+  #   optional:  master-repl (+ ≤4 parallel fetch via std::async on full sync),
+  #              feed-slave per replica, slot-migrate (cluster)
+  alwaysOnThreads = 1 + workers + 1 + 1 + 1 + maxBackgroundJobs;
+  # 1 master-repl + 4 fetch + 1 slot-migrate + ~16 replicas + misc (jemalloc, …)
+  dynamicThreadMargin = 32;
+
+  # From Server::AdjustOpenFilesLimit:
+  #   max_files = maxclients + rocksdb.max_open_files + min_reserved_fds
+  #   min_reserved_fds = 128  (listen sockets, logs, persistence, misc)
+  openFilesReserved = 128;
+
+  hasUnixSocket = cfg.settings.unixsocket != "";
+  hasTcp = lib.length cfg.settings.bind > 0;
+  configFile = format.generate "kvrocks.conf" (
+    {
+      daemonize = "no";
+      supervised = "systemd";
+    }
+    // (builtins.removeAttrs cfg.settings [
+      "bind"
+      "unixsocket"
+    ])
+    // lib.optionalAttrs (hasTcp && !cfg.socketActivation) {
+      bind = lib.concatStringsSep " " cfg.settings.bind;
+    }
+    // lib.optionalAttrs hasUnixSocket {
+      unixsocket = cfg.settings.unixsocket;
+    }
+    // lib.optionalAttrs cfg.socketActivation {
+      socket-fd = 3;
+    }
+  );
+in
+{
+  meta.maintainers = pkgs.kvrocks.meta.maintainers;
+
+  options = {
+    services.kvrocks = {
+      enable = lib.mkEnableOption "the Kvrocks server";
+
+      package = lib.mkPackageOption pkgs "kvrocks" { };
+
+      user = lib.mkOption {
+        type = lib.types.str;
+        default = "kvrocks";
+        description = "User account under which Kvrocks runs.";
+      };
+
+      group = lib.mkOption {
+        type = lib.types.str;
+        default = "kvrocks";
+        description = "Group under which Kvrocks runs.";
+      };
+
+      socketActivation = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = ''
+          Enable systemd socket activation for TCP.
+          Requires exactly one address in {option}`services.kvrocks.settings.bind`.
+        '';
+      };
+
+      settings = lib.mkOption {
+        type = lib.types.submodule {
+          freeformType = format.type;
+
+          options = {
+            bind = lib.mkOption {
+              type = lib.types.listOf lib.types.str;
+              default = [
+                "127.0.0.1"
+                "::1"
+              ];
+              description = "The addresses to bind to.";
+            };
+
+            port = lib.mkOption {
+              type = lib.types.port;
+              default = 6666;
+              description = "Accept connections on the specified port.";
+            };
+
+            unixsocket = lib.mkOption {
+              type = lib.types.str;
+              default = "";
+              example = "/run/kvrocks/kvrocks.sock";
+              description = "Unix socket path.";
+            };
+
+            dir = lib.mkOption {
+              type = lib.types.str;
+              default = defaultDir;
+              description = "Directory for database files.";
+            };
+          };
+        };
+        default = { };
+        example = {
+          workers = 8;
+          maxclients = 10000;
+          rename-command = [
+            "KEYS \"\""
+            "FLUSHDB \"\""
+          ];
+        };
+        description = ''
+          Configuration for kvrocks.
+          See <https://github.com/apache/kvrocks/blob/unstable/kvrocks.conf> for supported options.
+
+          List values are emitted as repeated keys (for example `rename-command`),
+          except {option}`services.kvrocks.settings.bind` which is space-separated
+          on a single line.
+        '';
+      };
+
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Whether to open the firewall for the kvrocks port.";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = hasTcp || hasUnixSocket;
+        message = "services.kvrocks: set settings.bind and/or settings.unixsocket.";
+      }
+      {
+        assertion = cfg.socketActivation -> builtins.length cfg.settings.bind == 1;
+        message = "services.kvrocks.socketActivation requires exactly one settings.bind address.";
+      }
+    ];
+
+    networking.firewall.allowedTCPPorts = lib.mkIf (cfg.openFirewall && hasTcp) [
+      cfg.settings.port
+    ];
+
+    systemd.tmpfiles.settings."10-kvrocks" = lib.mkIf (!isDefaultDir) {
+      ${dataDir}.d = {
+        user = cfg.user;
+        group = cfg.group;
+        mode = "0700";
+      };
+    };
+
+    systemd.sockets.kvrocks = lib.mkIf cfg.socketActivation {
+      description = "Kvrocks socket";
+      wantedBy = [ "sockets.target" ];
+      listenStreams =
+        let
+          addr = builtins.head cfg.settings.bind;
+          port = toString cfg.settings.port;
+          listenStream = if lib.hasInfix ":" addr then "[${addr}]:${port}" else "${addr}:${port}";
+        in
+        lib.singleton listenStream;
+      socketConfig = {
+        Accept = false;
+        SocketUser = cfg.user;
+        SocketGroup = cfg.group;
+      };
+    };
+
+    systemd.services.kvrocks = {
+      description = "Kvrocks - Distributed key value database";
+      documentation = [ "https://kvrocks.apache.org/" ];
+      wantedBy = lib.mkIf (!cfg.socketActivation) [ "multi-user.target" ];
+      after = [ "network.target" ] ++ lib.optionals cfg.socketActivation [ "kvrocks.socket" ];
+      requires = lib.optionals cfg.socketActivation [ "kvrocks.socket" ];
+
+      serviceConfig = {
+        Type = "notify";
+        ExecStart = "${lib.getExe cfg.package} -c ${configFile}";
+        Restart = "on-failure";
+        RestartSec = "10s";
+        User = cfg.user;
+        Group = cfg.group;
+        StateDirectory = lib.mkIf isDefaultDir "kvrocks";
+        StateDirectoryMode = "0700";
+        RuntimeDirectory = "kvrocks";
+        RuntimeDirectoryMode = "0755";
+        BindPaths = lib.mkIf (!isDefaultDir) [ dataDir ];
+        LimitNPROC = lib.mkDefault (alwaysOnThreads + dynamicThreadMargin);
+        # When rocksdb.max_open_files is -1 (unlimited), fall back to a high limit.
+        LimitNOFILE = lib.mkDefault (
+          if maxOpenFiles < 0 then 1048576 else maxclients + maxOpenFiles + openFilesReserved
+        );
+        TimeoutSec = 300;
+        NonBlocking = lib.mkIf cfg.socketActivation true;
+        # Capabilities
+        CapabilityBoundingSet = "";
+        # Security
+        NoNewPrivileges = true;
+        # Sandboxing
+        TemporaryFileSystem = [ "/:ro" ];
+        BindReadOnlyPaths = [
+          builtins.storeDir
+          "/etc"
+        ];
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectControlGroups = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        PrivateMounts = true;
+        SocketBindDeny = [ "any" ];
+        SocketBindAllow = lib.optionals (hasTcp && !cfg.socketActivation) [
+          "tcp:${toString cfg.settings.port}"
+        ];
+        # System Call Filtering
+        SystemCallArchitectures = "native";
+        SystemCallFilter = "~@cpu-emulation @debug @keyring @memlock @mount @obsolete @privileged @resources @setuid";
+      };
+    };
+
+    users = {
+      users = lib.mkIf (cfg.user == "kvrocks") {
+        kvrocks = {
+          isSystemUser = true;
+          group = cfg.group;
+          description = "Kvrocks daemon user";
+        };
+      };
+      groups = lib.mkIf (cfg.group == "kvrocks") {
+        kvrocks = { };
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/home-automation/openthread-border-router.nix b/nixos/modules/services/home-automation/openthread-border-router.nix
index 6ca8c8ffdc6d..5be4facce644 100644
--- a/nixos/modules/services/home-automation/openthread-border-router.nix
+++ b/nixos/modules/services/home-automation/openthread-border-router.nix
@@ -181,6 +181,9 @@ in
     # ot-ctl can be used to query the router instance
     environment.systemPackages = [ cfg.package ];
 
+    # Shared by the agent and web interface for the OpenThread control socket.
+    users.groups.otbr = { };
+
     # Make sure we have ipv6 support, and that forwarding is enabled
     networking.enableIPv6 = true;
     networking.firewall.allowedTCPPorts =
@@ -217,6 +220,7 @@ in
           THREAD_IF = cfg.interfaceName;
         };
         serviceConfig = {
+          Group = "otbr";
           ExecStartPre = "${utils.escapeSystemdExecArg (lib.getExe' cfg.package "otbr-firewall")} start";
           ExecStart = lib.concatStringsSep " " (
             lib.concatLists [
@@ -269,7 +273,7 @@ in
           RestrictRealtime = true;
           RestrictSUIDSGID = true;
           SystemCallArchitectures = "native";
-          UMask = "0077";
+          UMask = "0007";
 
           CapabilityBoundingSet = [
             "CAP_NET_ADMIN"
@@ -288,6 +292,7 @@ in
         after = [ "otbr-agent.service" ];
         wantedBy = [ "multi-user.target" ];
         serviceConfig = {
+          Group = "otbr";
           ExecStart = lib.concatStringsSep " " (
             lib.concatLists [
               [
diff --git a/nixos/modules/services/misc/paperless.nix b/nixos/modules/services/misc/paperless.nix
index 7d4182799c15..37acac016c7a 100644
--- a/nixos/modules/services/misc/paperless.nix
+++ b/nixos/modules/services/misc/paperless.nix
@@ -574,7 +574,7 @@ in
               # and automatically migrates when needed (e.g. with v2 -> v3 swapping from Whoosh to Tantivy)
               ${lib.getExe cfg.package} document_index reindex --if-needed --no-progress-bar
 
-            if ${lib.boolToString (cfg.passwordFile != null)} || [[ -n $PAPERLESS_ADMIN_PASSWORD ]]; then
+            if ${lib.boolToString (cfg.passwordFile != null)} || [[ -n ''${PAPERLESS_ADMIN_PASSWORD-} ]]; then
               export PAPERLESS_ADMIN_USER="''${PAPERLESS_ADMIN_USER:-admin}"
               if [[ -e $CREDENTIALS_DIRECTORY/PAPERLESS_ADMIN_PASSWORD ]]; then
                 PAPERLESS_ADMIN_PASSWORD=$(cat "$CREDENTIALS_DIRECTORY/PAPERLESS_ADMIN_PASSWORD")
diff --git a/nixos/modules/services/misc/rsync.nix b/nixos/modules/services/misc/rsync.nix
index f0768bf2771c..29f75fc392eb 100644
--- a/nixos/modules/services/misc/rsync.nix
+++ b/nixos/modules/services/misc/rsync.nix
@@ -137,6 +137,7 @@ in
 
           services.${systemdName} = {
             inherit description;
+            path = [ config.programs.ssh.package ];
 
             serviceConfig = {
               Type = "oneshot";
diff --git a/nixos/modules/services/misc/seerr.nix b/nixos/modules/services/misc/seerr.nix
index fc91fd8ba30d..e194216e1fc7 100644
--- a/nixos/modules/services/misc/seerr.nix
+++ b/nixos/modules/services/misc/seerr.nix
@@ -2,13 +2,14 @@
   config,
   pkgs,
   lib,
+  utils,
   ...
 }:
 let
   cfg = config.services.seerr;
-  # 26.05 introduced a breaking change which is guarded behind stateVersion to avoid
-  # breaking users.
-  useNewConfigLocation = lib.versionAtLeast config.system.stateVersion "26.05";
+  # 26.05 introduced a breaking change which is guarded behind stateRevision to
+  # avoid breaking users.
+  useNewConfigLocation = cfg.stateRevision >= 1;
 in
 {
   imports = [
@@ -39,8 +40,23 @@ in
     configDir = lib.mkOption {
       type = lib.types.path;
       default = if useNewConfigLocation then "/var/lib/seerr/" else "/var/lib/jellyseerr/config";
+      defaultText = lib.literalMD "{file}`/var/lib/seerr` (or {file}`/var/lib/jellyseerr/config` if {option}`services.seerr.stateRevision` < 1)";
       description = "Config data directory";
     };
+
+    stateRevision = utils.mkStateRevisionOption {
+      descriptionName = "Seerr";
+      migrations = {
+        "26.05" = ''
+          Move {file}`/var/lib/private/jellyseerr/config` to
+          {file}`/var/lib/private/seerr`, if you have not set
+          {option}`services.seerr.configDir`. (If you have set
+          {option}`services.seerr.configDir`, you should also have forced
+          {option}`systemd.services.seerr.serviceConfig.StateDirectory`, and in
+          that case `stateRevision` does not affect your configuration.)
+        '';
+      };
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -81,5 +97,7 @@ in
     networking.firewall = lib.mkIf cfg.openFirewall {
       allowedTCPPorts = [ cfg.port ];
     };
+
+    system.moduleStateRevisions."services.seerr.stateRevision" = cfg.stateRevision;
   };
 }
diff --git a/nixos/modules/services/monitoring/uptime-kuma.nix b/nixos/modules/services/monitoring/uptime-kuma.nix
index 5c2100607c73..e1b4bcf15c10 100644
--- a/nixos/modules/services/monitoring/uptime-kuma.nix
+++ b/nixos/modules/services/monitoring/uptime-kuma.nix
@@ -73,6 +73,7 @@ in
         PrivateMounts = true;
         PrivateTmp = true;
         PrivateUsers = true;
+        ProcSubset = "pid";
         ProtectClock = true;
         ProtectControlGroups = "strict";
         ProtectHome = true;
diff --git a/nixos/modules/services/networking/eternal-terminal.nix b/nixos/modules/services/networking/eternal-terminal.nix
index 0c1a339929bd..a8e16728d8ec 100644
--- a/nixos/modules/services/networking/eternal-terminal.nix
+++ b/nixos/modules/services/networking/eternal-terminal.nix
@@ -53,6 +53,14 @@ in
           The maximum log size.
         '';
       };
+
+      telemetry = lib.mkOption {
+        default = false;
+        type = lib.types.bool;
+        description = ''
+          Collects anonymous usage data and crash reports.
+        '';
+      };
     };
   };
 
@@ -71,8 +79,8 @@ in
         wantedBy = [ "multi-user.target" ];
         after = [ "network.target" ];
         serviceConfig = {
-          Type = "forking";
-          ExecStart = "${pkgs.eternal-terminal}/bin/etserver --daemon --cfgfile=${pkgs.writeText "et.cfg" ''
+          Type = "exec";
+          ExecStart = "${pkgs.eternal-terminal}/bin/etserver --logtostdout --cfgfile=${pkgs.writeText "et.cfg" ''
             ; et.cfg : Config file for Eternal Terminal
             ;
 
@@ -83,15 +91,15 @@ in
             verbose = ${toString cfg.verbosity}
             silent = ${if cfg.silent then "1" else "0"}
             logsize = ${toString cfg.logSize}
+            telemetry = ${lib.boolToString cfg.telemetry}
           ''}";
           Restart = "on-failure";
-          KillMode = "process";
         };
       };
     };
   };
 
   meta = {
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ tomasrivera ];
   };
 }
diff --git a/nixos/modules/services/networking/godns.nix b/nixos/modules/services/networking/godns.nix
index e69460ba14c8..5e0484f638b3 100644
--- a/nixos/modules/services/networking/godns.nix
+++ b/nixos/modules/services/networking/godns.nix
@@ -29,10 +29,8 @@ in
       };
 
       description = ''
-        Configuration for GoDNS. Refer to the [configuration section](1) in the
+        Configuration for GoDNS. Refer to the [configuration section](https://github.com/TimothyYe/godns?tab=readme-ov-file#configuration) in the
         GoDNS GitHub repository for details.
-
-        [1]: https://github.com/TimothyYe/godns?tab=readme-ov-file#configuration
       '';
 
       example = {
diff --git a/nixos/modules/services/web-apps/docuseal.nix b/nixos/modules/services/web-apps/docuseal.nix
index d0a468f53a14..e6921b584a10 100644
--- a/nixos/modules/services/web-apps/docuseal.nix
+++ b/nixos/modules/services/web-apps/docuseal.nix
@@ -132,6 +132,7 @@ in
         SystemCallFilter = [
           "@system-service"
           "~@privileged"
+          "@chown"
         ];
         # User and group
         DynamicUser = true;
diff --git a/nixos/modules/services/web-apps/hister.nix b/nixos/modules/services/web-apps/hister.nix
new file mode 100644
index 000000000000..8b0ecab66a94
--- /dev/null
+++ b/nixos/modules/services/web-apps/hister.nix
@@ -0,0 +1,224 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.hister;
+
+  yamlFormat = pkgs.formats.yaml { };
+
+  dataDir = if cfg.dataDir != null then cfg.dataDir else "/var/lib/hister";
+  generatedConfig = yamlFormat.generate "hister-config.yml" cfg.settings;
+  hasConfig = cfg.configPath != null || cfg.settings != { };
+  runtimeConfigSource = if cfg.settings != { } then generatedConfig else cfg.configPath;
+  runtimeConfig = "/run/hister/config.yml";
+
+  histerEnv =
+    lib.optionalAttrs (cfg.port != null) {
+      HISTER_PORT = toString cfg.port;
+    }
+    // lib.optionalAttrs hasConfig {
+      HISTER_CONFIG = runtimeConfig;
+    }
+    // {
+      HISTER_DATA_DIR = dataDir;
+    };
+
+  privilegedPort = cfg.port != null && cfg.port < 1024;
+in
+{
+  meta.maintainers = with lib.maintainers; [ _4evy ];
+
+  options.services.hister = {
+    enable = lib.mkEnableOption "Hister, a web history service with content-based search";
+
+    package = lib.mkPackageOption pkgs "hister" { };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = "hister";
+      description = "User account under which Hister runs.";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = "hister";
+      description = "Group under which Hister runs.";
+    };
+
+    dataDir = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      example = "/var/lib/hister";
+      description = ''
+        Directory where Hister stores its data. When `null` (the default), the
+        service is isolated under `/var/lib/hister` via systemd's
+        `StateDirectory=`. When set to an explicit path, that path is created
+        with `systemd-tmpfiles` and granted via `ReadWritePaths=` instead.
+      '';
+    };
+
+    port = lib.mkOption {
+      type = lib.types.nullOr lib.types.port;
+      default = null;
+      example = 4433;
+      description = ''
+        Port on which Hister listens. When set, this overrides the port in
+        `server.address` from the configuration file via the `HISTER_PORT`
+        environment variable.
+      '';
+    };
+
+    openFirewall = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Whether to open {option}`services.hister.port` in the firewall. Has no
+        effect if `port` is `null`.
+      '';
+    };
+
+    configPath = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      example = "/etc/hister/config.yml";
+      description = ''
+        Path to an existing Hister configuration file mounted read-only into
+        the service runtime directory and passed via `HISTER_CONFIG`. Mutually
+        exclusive with {option}`services.hister.settings`.
+      '';
+    };
+
+    environmentFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      example = "/run/secrets/hister.env";
+      description = ''
+        Path to an environment file (read at service start) used to inject
+        secrets such as `HISTER__APP__ACCESS_TOKEN` without placing them in the
+        world-readable Nix store.
+      '';
+    };
+
+    settings = lib.mkOption {
+      type = yamlFormat.type;
+      default = { };
+      description = ''
+        Hister configuration rendered to YAML and passed via `HISTER_CONFIG`.
+        Accepts any structure the server accepts: see the `app`, `server`,
+        `indexer`, `crawler`, `hotkeys`, `extractors`, `semantic_search`, and
+        `sensitive_content_patterns` blocks documented upstream.
+      '';
+      example = lib.literalExpression ''
+        {
+          app = {
+            search_url = "https://google.com/search?q={query}";
+            log_level = "info";
+          };
+          server = {
+            address = "127.0.0.1:4433";
+            database = "db.sqlite3";
+          };
+          hotkeys.web = {
+            "/" = "focus_search_input";
+            "enter" = "open_result";
+          };
+        }
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = !(cfg.configPath != null && cfg.settings != { });
+        message = "Only one of services.hister.configPath and services.hister.settings can be set";
+      }
+    ];
+
+    environment.systemPackages = [ cfg.package ];
+
+    users.users = lib.mkIf (cfg.user == "hister") {
+      hister = {
+        description = "Hister web history service";
+        group = cfg.group;
+        isSystemUser = true;
+      };
+    };
+
+    users.groups = lib.mkIf (cfg.group == "hister") {
+      hister = { };
+    };
+
+    systemd.tmpfiles.settings."10-hister"."${dataDir}".d = lib.mkIf (cfg.dataDir != null) {
+      user = cfg.user;
+      group = cfg.group;
+      mode = "0750";
+    };
+
+    systemd.services.hister = {
+      description = "Hister web history service";
+      after = [
+        "network.target"
+        "systemd-tmpfiles-setup.service"
+        "systemd-tmpfiles-resetup.service"
+      ];
+      wantedBy = [ "multi-user.target" ];
+
+      environment = histerEnv;
+
+      serviceConfig = {
+        ExecStart = "${lib.getExe cfg.package} listen";
+        Restart = "on-failure";
+        User = cfg.user;
+        Group = cfg.group;
+        RuntimeDirectory = lib.mkIf hasConfig "hister";
+        RuntimeDirectoryMode = lib.mkIf hasConfig "0750";
+        BindReadOnlyPaths = lib.mkIf hasConfig [ "${runtimeConfigSource}:${runtimeConfig}" ];
+        StateDirectory = lib.mkIf (cfg.dataDir == null) "hister";
+        StateDirectoryMode = lib.mkIf (cfg.dataDir == null) "0750";
+        ReadWritePaths = lib.mkIf (cfg.dataDir != null) [ cfg.dataDir ];
+        EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
+
+        AmbientCapabilities = lib.mkIf privilegedPort [ "CAP_NET_BIND_SERVICE" ];
+        CapabilityBoundingSet = if privilegedPort then [ "CAP_NET_BIND_SERVICE" ] else [ "" ];
+
+        NoNewPrivileges = true;
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectKernelLogs = true;
+        ProtectControlGroups = true;
+        ProtectClock = true;
+        ProtectHostname = true;
+        ProtectProc = "invisible";
+        ProcSubset = "pid";
+        LockPersonality = true;
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        RemoveIPC = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+        ];
+        MemoryDenyWriteExecute = true;
+        UMask = "0077";
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = lib.mkIf (cfg.openFirewall && cfg.port != null) [ cfg.port ];
+  };
+}
diff --git a/nixos/modules/services/web-apps/miniflux.nix b/nixos/modules/services/web-apps/miniflux.nix
index ebc77394ad53..585f00b9891e 100644
--- a/nixos/modules/services/web-apps/miniflux.nix
+++ b/nixos/modules/services/web-apps/miniflux.nix
@@ -208,7 +208,13 @@ in
       abi <abi/4.0>,
       include <tunables/global>
 
-      profile ${cfg.package}/bin/miniflux {
+      # Flag `attach_disconnected` is necessary
+      # because the PostgreSQL socket path appears
+      # as a "disconnected" path: `run/postgresql/.s.PGSQL.XXXX`,
+      # without the trailing slash, which AppArmor can't resolve.
+      # The flag prepends a `/`, which isn't recommended,
+      # but there aren't any alternative currently.
+      profile ${cfg.package}/bin/miniflux flags=(attach_disconnected) {
         include <abstractions/base>
         include <abstractions/nameservice>
         include <abstractions/ssl_certs>
@@ -216,6 +222,8 @@ in
         include "${pkgs.apparmorRulesFromClosure { name = "miniflux"; } cfg.package}"
         ${cfg.package}/bin/miniflux r,
         /run/miniflux/** rw,
+        /run/postgresql/.s.PGSQL.* rw,
+        /run/credentials/** r,
         include if exists <local/bin.miniflux>
       }
     '';
diff --git a/nixos/modules/services/web-apps/readeck.nix b/nixos/modules/services/web-apps/readeck.nix
index 4c2c921b5a7c..45e1be487a08 100644
--- a/nixos/modules/services/web-apps/readeck.nix
+++ b/nixos/modules/services/web-apps/readeck.nix
@@ -66,7 +66,9 @@ in
         WorkingDirectory = "/var/lib/readeck";
         EnvironmentFile = lib.optional (cfg.environmentFile != null) cfg.environmentFile;
         DynamicUser = true;
-        ExecStart = "${lib.getExe cfg.package} serve -config ${configFile}";
+        # readeck opens config.toml as writable in case it needs to add a secret key...
+        ExecStartPre = "${lib.getExe' pkgs.coreutils "cp"} --no-preserve=all ${configFile} config.toml";
+        ExecStart = "${lib.getExe cfg.package} serve -config config.toml";
         ProtectSystem = "full";
         SystemCallArchitectures = "native";
         MemoryDenyWriteExecute = true;
diff --git a/nixos/modules/services/web-servers/apache-httpd/default.nix b/nixos/modules/services/web-servers/apache-httpd/default.nix
index a2474fcfa6f2..f102db4b3c0d 100644
--- a/nixos/modules/services/web-servers/apache-httpd/default.nix
+++ b/nixos/modules/services/web-servers/apache-httpd/default.nix
@@ -90,6 +90,7 @@ let
     "unixd"
     "slotmem_shm"
     "socache_shmcb"
+    "systemd"
     "mpm_${cfg.mpm}"
   ]
   ++ (if cfg.mpm == "prefork" then [ "cgi" ] else [ "cgid" ])
@@ -992,12 +993,12 @@ in
       '';
 
       serviceConfig = {
-        ExecStart = "@${pkg}/bin/httpd httpd -f /etc/httpd/httpd.conf";
-        ExecStop = "${pkg}/bin/httpd -f /etc/httpd/httpd.conf -k graceful-stop";
+        ExecStart = "${pkg}/bin/httpd -D FOREGROUND -f /etc/httpd/httpd.conf";
         ExecReload = "${pkg}/bin/httpd -f /etc/httpd/httpd.conf -k graceful";
+        KillMode = "mixed";
         User = cfg.user;
         Group = cfg.group;
-        Type = "forking";
+        Type = "notify";
         PIDFile = "${runtimeDir}/httpd.pid";
         Restart = "always";
         RestartSec = "5s";
diff --git a/nixos/modules/services/x11/desktop-managers/xfce.nix b/nixos/modules/services/x11/desktop-managers/xfce.nix
index 3dcc5431e7c8..332c78b3658a 100644
--- a/nixos/modules/services/x11/desktop-managers/xfce.nix
+++ b/nixos/modules/services/x11/desktop-managers/xfce.nix
@@ -166,7 +166,7 @@ in
       ++ lib.optional cfg.enableScreensaver xfce4-screensaver
     ) excludePackages;
 
-    programs.gnupg.agent.pinentryPackage = mkDefault pkgs.pinentry-gtk2;
+    programs.gnupg.agent.pinentryPackage = mkDefault pkgs.pinentry-gnome3;
     programs.xfconf.enable = true;
     programs.thunar.enable = true;
     programs.labwc.enable = mkDefault (
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index b426fb633b52..d1264176df3e 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -793,6 +793,7 @@ in
   hibernate-systemd-stage-1 = handleTestOn [ "x86_64-linux" ] ./hibernate.nix {
     systemdStage1 = true;
   };
+  hister = runTest ./hister.nix;
   hitch = handleTest ./hitch { };
   hledger-web = runTest ./hledger-web.nix;
   hockeypuck = runTest ./hockeypuck.nix;
@@ -918,6 +919,7 @@ in
     inherit runTest;
     inherit (pkgs) lib;
   };
+  kvrocks = runTest ./kvrocks.nix;
   labgrid = runTest ./labgrid.nix;
   lact = runTest ./lact.nix;
   ladybird = runTest ./ladybird.nix;
@@ -967,7 +969,9 @@ in
   livekit = runTest ./networking/livekit.nix;
   lix = runTest ./lix.nix;
   lk-jwt-service = runTest ./matrix/lk-jwt-service.nix;
-  llama-swap = runTest ./web-servers/llama-swap.nix;
+  llama-swap = import ./web-servers/llama-swap.nix {
+    inherit pkgs runTest;
+  };
   lldap = runTest ./lldap.nix;
   local-content-share = runTest ./local-content-share.nix;
   locale = runTest ./locale.nix;
@@ -1057,6 +1061,7 @@ in
   modularService = pkgs.callPackage ../modules/system/service/systemd/test.nix {
     inherit evalSystem;
   };
+  moduleStateRevisions = pkgs.callPackage ./moduleStateRevisions.nix { };
   molly-brown = runTest ./molly-brown.nix;
   mollysocket = runTest ./mollysocket.nix;
   monado = runTest ./monado.nix;
@@ -1232,6 +1237,7 @@ in
   ntfy-sh-migration = handleTest ./ntfy-sh-migration.nix { };
   ntpd = runTest ./ntpd.nix;
   ntpd-rs = runTest ./ntpd-rs.nix;
+  nullmailer = runTest ./nullmailer.nix;
   nushell = runTest ./nushell.nix;
   nvidia-container-toolkit = runTest ./nvidia-container-toolkit.nix;
   nvme-rs = runTest ./nvme-rs.nix;
@@ -1839,7 +1845,7 @@ in
   userborn-mutable-users = runTest ./userborn-mutable-users.nix;
   userborn-static = runTest ./userborn-static.nix;
   ustreamer = runTest ./ustreamer.nix;
-  utils = import ./utils { inherit runTest; };
+  utils = pkgs.callPackage ./utils { inherit runTest; };
   utmp = runTest ./utmp.nix;
   uwsgi = runTest ./uwsgi.nix;
   v2ray = runTest ./v2ray.nix;
diff --git a/nixos/tests/hister.nix b/nixos/tests/hister.nix
new file mode 100644
index 000000000000..9958581f180a
--- /dev/null
+++ b/nixos/tests/hister.nix
@@ -0,0 +1,146 @@
+{ lib, pkgs, ... }:
+let
+  configPathConfig = pkgs.writeText "hister-config.yml" ''
+    app:
+      title: NixOS Hister Config Path
+      search_url: https://config.example.invalid/?q={query}
+    hotkeys:
+      web:
+        alt+c: open_query_in_search_engine
+  '';
+in
+{
+  name = "hister";
+
+  meta = {
+    maintainers = with lib.maintainers; [ _4evy ];
+  };
+
+  nodes.machine = {
+    environment.systemPackages = [ pkgs.jq ];
+
+    systemd.tmpfiles.settings."10-hister-env"."/run/hister.env"."f" = {
+      mode = "0600";
+      user = "root";
+      group = "root";
+      argument = "HISTER__APP__ACCESS_TOKEN=test-token";
+    };
+
+    specialisation = {
+      inline_settings.configuration.services.hister = {
+        enable = true;
+        port = 4433;
+        environmentFile = "/run/hister.env";
+        settings = {
+          app = {
+            log_level = "debug";
+            title = "NixOS Hister";
+            search_url = "https://search.example.invalid/?q={query}";
+            open_results_on_new_tab = true;
+          };
+          hotkeys.web."alt+n" = "open_query_in_search_engine";
+        };
+      };
+
+      config_file.configuration.services.hister = {
+        enable = true;
+        port = 4434;
+        configPath = configPathConfig;
+      };
+
+      custom_data_dir.configuration.services.hister = {
+        enable = true;
+        port = 4435;
+        dataDir = "/srv/hister-data";
+        settings.app.title = "NixOS Hister Custom Data";
+      };
+    };
+  };
+
+  testScript =
+    { nodes, ... }:
+    let
+      switchTo =
+        name:
+        "${nodes.machine.system.build.toplevel}/specialisation/${name}/bin/switch-to-configuration test";
+    in
+    ''
+      start_all()
+
+      with subtest("inline settings"):
+        machine.succeed("${switchTo "inline_settings"}")
+        machine.systemctl("restart hister.service")
+        machine.wait_for_unit("hister.service")
+        machine.wait_for_open_port(4433)
+        machine.succeed("curl -fsS http://localhost:4433/ | grep -F '<title>Hister</title>'")
+        machine.succeed("test $(stat -c %a /var/lib/hister) = 750")
+        machine.succeed("test $(stat -c %a /run/hister) = 750")
+        machine.succeed("test -s /run/hister/tui.yaml")
+        machine.succeed("test -s /var/lib/hister/db.sqlite3")
+        machine.succeed("test -s /var/lib/hister/.secret_key")
+        machine.succeed("test -s /var/lib/hister/rules.json")
+        machine.succeed(
+            "curl -fsS http://localhost:4433/api/config"
+            + " | jq -e "
+            + "'"
+            + '.baseUrl == "http://127.0.0.1:4433"'
+            + ' and .title == "NixOS Hister"'
+            + ' and .searchUrl == "https://search.example.invalid/?q={query}"'
+            + ' and .openResultsOnNewTab == true'
+            + ' and .hotkeys."alt+n" == "open_query_in_search_engine"'
+            + ' and .authMode == "token"'
+            + "'"
+        )
+        machine.fail("journalctl -u hister.service | grep -F 'Failed to create tui.yaml'")
+
+      with subtest("configPath"):
+        machine.succeed("${switchTo "config_file"}")
+        machine.systemctl("restart hister.service")
+        machine.wait_for_unit("hister.service")
+        machine.wait_for_open_port(4434)
+        machine.succeed("curl -fsS http://localhost:4434/ >/dev/null")
+        machine.succeed("test $(stat -c %a /run/hister) = 750")
+        machine.succeed("test -s /run/hister/tui.yaml")
+        machine.succeed("test -s /var/lib/hister/db.sqlite3")
+        machine.succeed("test -s /var/lib/hister/.secret_key")
+        machine.succeed("test -s /var/lib/hister/rules.json")
+        machine.succeed(
+            "curl -fsS http://localhost:4434/api/config"
+            + " | jq -e "
+            + "'"
+            + '.baseUrl == "http://127.0.0.1:4434"'
+            + ' and .title == "NixOS Hister Config Path"'
+            + ' and .searchUrl == "https://config.example.invalid/?q={query}"'
+            + ' and .hotkeys."alt+c" == "open_query_in_search_engine"'
+            + ' and .authMode == "none"'
+            + "'"
+        )
+        machine.fail("journalctl -u hister.service | grep -F 'Failed to create tui.yaml'")
+
+      with subtest("custom dataDir"):
+        machine.systemctl("stop hister.service")
+        machine.succeed("rm -rf /var/lib/hister")
+        machine.succeed("${switchTo "custom_data_dir"}")
+        machine.systemctl("restart hister.service")
+        machine.wait_for_unit("hister.service")
+        machine.wait_for_open_port(4435)
+        machine.succeed("curl -fsS http://localhost:4435/ >/dev/null")
+        machine.succeed("test $(stat -c %U:%G:%a /srv/hister-data) = hister:hister:750")
+        machine.succeed("test $(stat -c %a /run/hister) = 750")
+        machine.succeed("test -s /run/hister/tui.yaml")
+        machine.succeed("test -s /srv/hister-data/db.sqlite3")
+        machine.succeed("test -s /srv/hister-data/.secret_key")
+        machine.succeed("test -s /srv/hister-data/rules.json")
+        machine.succeed("test ! -e /var/lib/hister")
+        machine.succeed(
+            "curl -fsS http://localhost:4435/api/config"
+            + " | jq -e "
+            + "'"
+            + '.baseUrl == "http://127.0.0.1:4435"'
+            + ' and .title == "NixOS Hister Custom Data"'
+            + ' and .authMode == "none"'
+            + "'"
+        )
+        machine.fail("journalctl -u hister.service | grep -F 'Failed to create tui.yaml'")
+    '';
+}
diff --git a/nixos/tests/kvrocks.nix b/nixos/tests/kvrocks.nix
new file mode 100644
index 000000000000..4472baac4806
--- /dev/null
+++ b/nixos/tests/kvrocks.nix
@@ -0,0 +1,122 @@
+{ lib, pkgs, ... }:
+
+{
+  name = "kvrocks";
+  meta.maintainers = with lib.maintainers; [ xyenon ];
+
+  nodes.machine = {
+    services.kvrocks = {
+      enable = true;
+      settings.log-level = "debug";
+    };
+
+    specialisation."nonDefaultDataDir".configuration = {
+      services.kvrocks.settings.dir = "/var/lib/kvrocks-custom";
+    };
+
+    specialisation."unixSocket".configuration = {
+      services.kvrocks.settings.bind = [ ];
+      services.kvrocks.settings.unixsocket = "/run/kvrocks/kvrocks.sock";
+    };
+
+    specialisation."tcpAndUnix".configuration = {
+      services.kvrocks.settings.unixsocket = "/run/kvrocks/kvrocks.sock";
+    };
+
+    specialisation."socketActivation".configuration = {
+      services.kvrocks = {
+        socketActivation = true;
+        settings.bind = [ "127.0.0.1" ];
+      };
+    };
+
+    specialisation."socketActivationAndUnix".configuration = {
+      services.kvrocks = {
+        socketActivation = true;
+        settings = {
+          bind = [ "127.0.0.1" ];
+          unixsocket = "/run/kvrocks/kvrocks.sock";
+        };
+      };
+    };
+  };
+
+  testScript =
+    { nodes, ... }:
+    let
+      inherit (nodes.machine.services) kvrocks;
+      port = toString kvrocks.settings.port;
+      redisCliTcp = "${pkgs.redis}/bin/redis-cli -p ${port}";
+      unixsocket = "/run/kvrocks/kvrocks.sock";
+      redisCliUnix = "${pkgs.redis}/bin/redis-cli -s ${unixsocket}";
+      switchTo =
+        name:
+        "${nodes.machine.system.build.toplevel}/specialisation/${name}/bin/switch-to-configuration test";
+    in
+    ''
+      start_all()
+      machine.wait_for_unit("kvrocks.service")
+      machine.wait_for_open_port(${port})
+      machine.succeed("${redisCliTcp} ping | grep PONG")
+
+      with subtest("Test normal usage"):
+        machine.succeed("${redisCliTcp} set k1 v1 | grep OK")
+        machine.succeed("${redisCliTcp} get k1 | grep v1")
+        machine.systemctl("restart kvrocks")
+        machine.wait_for_unit("kvrocks.service")
+        machine.wait_for_open_port(${port})
+        machine.succeed("${redisCliTcp} get k1 | grep v1")
+
+      with subtest("Test usage with non-default data directory"):
+        machine.succeed("${switchTo "nonDefaultDataDir"}")
+        machine.wait_for_unit("kvrocks.service")
+        machine.wait_for_open_port(${port})
+        machine.succeed("test -d /var/lib/kvrocks-custom")
+        machine.succeed("${redisCliTcp} set k2 v2 | grep OK")
+        machine.succeed("${redisCliTcp} get k2 | grep v2")
+        machine.systemctl("restart kvrocks")
+        machine.wait_for_unit("kvrocks.service")
+        machine.wait_for_open_port(${port})
+        machine.succeed("${redisCliTcp} get k2 | grep v2")
+
+      with subtest("Test usage with unix socket only"):
+        machine.succeed("${switchTo "unixSocket"}")
+        machine.wait_for_unit("kvrocks.service")
+        machine.wait_for_file("${unixsocket}")
+        machine.succeed("${redisCliUnix} set k3 v3 | grep OK")
+        machine.succeed("${redisCliUnix} get k3 | grep v3")
+        machine.systemctl("restart kvrocks")
+        machine.wait_for_unit("kvrocks.service")
+        machine.wait_for_file("${unixsocket}")
+        machine.succeed("${redisCliUnix} get k3 | grep v3")
+
+      with subtest("Test usage with TCP and unix socket"):
+        machine.succeed("${switchTo "tcpAndUnix"}")
+        machine.wait_for_unit("kvrocks.service")
+        machine.wait_for_open_port(${port})
+        machine.wait_for_file("${unixsocket}")
+        machine.succeed("${redisCliTcp} set k4 v4 | grep OK")
+        machine.succeed("${redisCliTcp} get k4 | grep v4")
+        machine.succeed("${redisCliUnix} get k4 | grep v4")
+
+      with subtest("Test usage with socket activation"):
+        machine.succeed("${switchTo "socketActivation"}")
+        machine.wait_for_unit("kvrocks.socket")
+        machine.wait_until_succeeds("${redisCliTcp} ping | grep PONG")
+        machine.wait_for_unit("kvrocks.service")
+        machine.wait_for_open_port(${port})
+        machine.succeed("${redisCliTcp} set k5 v5 | grep OK")
+        machine.succeed("${redisCliTcp} get k5 | grep v5")
+
+      with subtest("Test usage with socket activation and unix socket"):
+        machine.succeed("${switchTo "socketActivationAndUnix"}")
+        machine.wait_for_unit("kvrocks.socket")
+        machine.wait_until_succeeds("${redisCliTcp} ping | grep PONG")
+        machine.wait_for_unit("kvrocks.service")
+        machine.wait_for_open_port(${port})
+        machine.wait_for_file("${unixsocket}")
+        machine.succeed("${redisCliTcp} set k6 v6 | grep OK")
+        machine.succeed("${redisCliTcp} get k6 | grep v6")
+        machine.succeed("${redisCliUnix} get k6 | grep v6")
+    '';
+}
diff --git a/nixos/tests/miniflux.nix b/nixos/tests/miniflux.nix
index 3bdf4480e7e2..549dd4966439 100644
--- a/nixos/tests/miniflux.nix
+++ b/nixos/tests/miniflux.nix
@@ -29,6 +29,7 @@ in
     default =
       { ... }:
       {
+        security.apparmor.enable = true;
         services.miniflux = {
           enable = true;
           inherit adminCredentialsFile;
@@ -38,6 +39,7 @@ in
     withoutSudo =
       { ... }:
       {
+        security.apparmor.enable = true;
         services.miniflux = {
           enable = true;
           inherit adminCredentialsFile;
@@ -48,6 +50,7 @@ in
     customized =
       { ... }:
       {
+        security.apparmor.enable = true;
         services.miniflux = {
           enable = true;
           config = {
@@ -82,6 +85,7 @@ in
     externalDb =
       { ... }:
       {
+        security.apparmor.enable = true;
         services.miniflux = {
           enable = true;
           createDatabaseLocally = false;
@@ -105,6 +109,7 @@ in
       machine.succeed(
           f"curl 'http://localhost:{port}/v1/me' -u '{user}' -H Content-Type:application/json | grep '\"is_admin\":true'"
       )
+      machine.fail('journalctl -b --no-pager --grep "^audit: .*apparmor=\\"DENIED\\""')
 
     default.start()
     withoutSudo.start()
diff --git a/nixos/tests/moduleStateRevisions.nix b/nixos/tests/moduleStateRevisions.nix
new file mode 100644
index 000000000000..3bce4c312488
--- /dev/null
+++ b/nixos/tests/moduleStateRevisions.nix
@@ -0,0 +1,25 @@
+{
+  lib,
+  emptyFile,
+  nixos,
+}:
+let
+  evalModuleStateRevisions =
+    cfg:
+    (nixos [
+      { system.stateVersion = lib.trivial.release; }
+      cfg
+    ]).config.system.moduleStateRevisions;
+
+  # For modules that follow the <module>.enable, <module>.stateRevision pattern:
+  testModule =
+    path:
+    evalModuleStateRevisions (lib.setAttrByPath path { enable = true; })
+    ? "${builtins.concatStringsSep "." path}.stateRevision";
+in
+assert evalModuleStateRevisions { } == { };
+assert testModule [
+  "services"
+  "seerr"
+];
+emptyFile
diff --git a/nixos/tests/nixops/legacy/base-configuration.nix b/nixos/tests/nixops/legacy/base-configuration.nix
index f7c15f3fe1ff..13fc9ad6cd28 100644
--- a/nixos/tests/nixops/legacy/base-configuration.nix
+++ b/nixos/tests/nixops/legacy/base-configuration.nix
@@ -20,6 +20,7 @@ in
 {
   imports = [
     (modulesPath + "/virtualisation/qemu-vm.nix")
+    (modulesPath + "/virtualisation/guest-networking-options.nix")
     (modulesPath + "/testing/test-instrumentation.nix")
   ];
   virtualisation.writableStore = true;
diff --git a/nixos/tests/nixos-rebuild-target-host.nix b/nixos/tests/nixos-rebuild-target-host.nix
index ae872a205a0e..7245dbc1c0bd 100644
--- a/nixos/tests/nixos-rebuild-target-host.nix
+++ b/nixos/tests/nixos-rebuild-target-host.nix
@@ -116,6 +116,7 @@
             { lib, modulesPath, ... }: {
               imports = [
                 (modulesPath + "/virtualisation/qemu-vm.nix")
+                (modulesPath + "/virtualisation/guest-networking-options.nix")
                 (modulesPath + "/testing/test-instrumentation.nix")
                 (modulesPath + "/../tests/common/user-account.nix")
                 (lib.modules.importJSON ./target-configuration.json)
diff --git a/nixos/tests/nullmailer.nix b/nixos/tests/nullmailer.nix
new file mode 100644
index 000000000000..19e941226429
--- /dev/null
+++ b/nixos/tests/nullmailer.nix
@@ -0,0 +1,85 @@
+{ lib, ... }:
+{
+  name = "nullmailer";
+
+  meta = {
+    maintainers = with lib.maintainers; [ h7x4 ];
+  };
+
+  nodes = {
+    mail =
+      { config, ... }:
+      {
+        imports = [ ./common/user-account.nix ];
+
+        virtualisation.vlans = [ 1 ];
+
+        networking = {
+          useNetworkd = true;
+          useDHCP = false;
+          firewall.allowedTCPPorts = [ 25 ];
+          domain = "example.com";
+          hosts."10.0.0.2" = [ "machine.example.com" ];
+        };
+
+        systemd.network.networks."01-eth1" = {
+          name = "eth1";
+          networkConfig.Address = "10.0.0.1/24";
+        };
+
+        services.postfix = {
+          enable = true;
+
+          localRecipients = [ "alice" ];
+
+          settings = {
+            main = {
+              myhostname = config.networking.hostName;
+              mydomain = config.networking.domain;
+              mynetworks = [ "0.0.0.0/0" ];
+              mydestination = [ "$mydomain" ];
+
+              smtpd_recipient_restrictions = "permit_mynetworks, reject";
+            };
+          };
+        };
+      };
+
+    machine =
+      { config, ... }:
+      {
+        virtualisation.vlans = [ 1 ];
+
+        networking = {
+          useNetworkd = true;
+          useDHCP = false;
+          domain = "example.com";
+          hosts."10.0.0.1" = [ "mail.example.com" ];
+        };
+
+        systemd.network.networks."01-eth1" = {
+          name = "eth1";
+          networkConfig.Address = "10.0.0.2/24";
+        };
+
+        services.nullmailer = {
+          enable = true;
+          config = {
+            me = "${config.networking.fqdn}";
+            remotes = "mail.example.com smtp --port=25";
+          };
+        };
+      };
+  };
+
+  testScript = ''
+    start_all()
+
+    machine.wait_for_open_port(25, "mail.example.com")
+    machine.wait_for_unit("nullmailer.service")
+    machine.succeed('printf "To: alice@example.com\r\n\r\nthis is the body of the email" | sendmail -t -i -f sender@example.com')
+
+    mail.wait_for_console_text("delivered to maildir")
+    print(mail.succeed("grep 'this is the body of the email' /var/spool/mail/alice/new/*"))
+  '';
+}
diff --git a/nixos/tests/opencloud.nix b/nixos/tests/opencloud.nix
index 919ed99f4b5d..25bd5295f68c 100644
--- a/nixos/tests/opencloud.nix
+++ b/nixos/tests/opencloud.nix
@@ -21,12 +21,14 @@ let
         from selenium.webdriver.common.by import By
         from selenium.webdriver import Firefox
         from selenium.webdriver.firefox.options import Options
+        from selenium.webdriver.firefox.service import Service
         from selenium.webdriver.support.ui import WebDriverWait
         from selenium.webdriver.support import expected_conditions as EC
 
         options = Options()
         options.add_argument('--headless')
-        driver = Firefox(options=options)
+        service = Service(executable_path="${lib.getExe pkgs.geckodriver}")
+        driver = Firefox(options=options, service=service)
 
         host = sys.argv[1]
         user = sys.argv[2]
@@ -71,6 +73,7 @@ in
       environment = {
         ADMIN_PASSWORD = adminPassword;
         IDM_CREATE_DEMO_USERS = "true";
+        IDM_LDAPS_ADDR = "127.0.0.1:9235";
         IDM_LDAPS_CERT = "${certs.${domain}.cert}";
         IDM_LDAPS_KEY = "${certs.${domain}.key}";
         OC_INSECURE = "false";
diff --git a/nixos/tests/rosenpass.nix b/nixos/tests/rosenpass.nix
index 10c25a070d5b..f05b7ea17ef1 100644
--- a/nixos/tests/rosenpass.nix
+++ b/nixos/tests/rosenpass.nix
@@ -41,6 +41,7 @@ in
             };
           };
 
+          networking.useNetworkd = true;
           networking.firewall.allowedUDPPorts = [ 9999 ];
 
           systemd.network = {
@@ -72,6 +73,7 @@ in
       server = {
         imports = [ (shared server) ];
 
+        networking.useNetworkd = true;
         networking.firewall.allowedUDPPorts = [ server.wg.listen ];
 
         systemd.network.netdevs."10-${deviceName}" = {
@@ -118,7 +120,7 @@ in
   testScript =
     { ... }:
     ''
-      from os import system
+      import subprocess
 
       # Full path to rosenpass in the store, to avoid fiddling with `$PATH`.
       rosenpass = "${pkgs.rosenpass}/bin/rosenpass"
@@ -137,7 +139,10 @@ in
 
       for (name, machine, remote) in [("server", server, client), ("client", client, server)]:
           pk, sk = f"{name}.pqpk", f"{name}.pqsk"
-          system(f"{rosenpass} gen-keys --force --secret-key {sk} --public-key {pk}")
+          subprocess.run(
+              [rosenpass, "gen-keys", "--force", "--secret-key", sk, "--public-key", pk],
+              check=True,
+          )
           machine.copy_from_host(sk, f"{etc}/pqsk")
           machine.copy_from_host(pk, f"{etc}/pqpk")
           remote.copy_from_host(pk, f"{etc}/peers/{name}/pqpk")
diff --git a/nixos/tests/utils/default.nix b/nixos/tests/utils/default.nix
index a7c5f242c822..fdcf766ffbac 100644
--- a/nixos/tests/utils/default.nix
+++ b/nixos/tests/utils/default.nix
@@ -1,5 +1,9 @@
-{ runTest }:
+{
+  callPackage,
+  runTest,
+}:
 
 {
   genJqSecretsReplacement = runTest ./genJqSecretsReplacement.nix;
+  mkStateRevisionOption = callPackage ./mkStateRevisionOption.nix { };
 }
diff --git a/nixos/tests/utils/mkStateRevisionOption.nix b/nixos/tests/utils/mkStateRevisionOption.nix
new file mode 100644
index 000000000000..b32a27cec266
--- /dev/null
+++ b/nixos/tests/utils/mkStateRevisionOption.nix
@@ -0,0 +1,39 @@
+{
+  emptyFile,
+  nixos,
+}:
+let
+  result = nixos (
+    { utils, ... }:
+    {
+      options = {
+        stateRevision1 = utils.mkStateRevisionOption {
+          descriptionName = "...";
+          migrations = {
+            "27.05" = "...";
+          };
+        };
+        stateRevision2 = utils.mkStateRevisionOption {
+          descriptionName = "...";
+          migrations = {
+            "26.11" = "...";
+          };
+        };
+        stateRevision3 = utils.mkStateRevisionOption {
+          descriptionName = "...";
+          migrations = {
+            "24.05" = "...";
+            "27.05" = "...";
+          };
+        };
+      };
+      config.system.stateVersion = "26.11";
+    }
+  );
+  inherit (result) config options;
+in
+assert config.stateRevision1 == 0;
+assert config.stateRevision2 == 1;
+assert config.stateRevision3 == 1;
+assert options.stateRevision1.migrations == { "27.05" = "..."; };
+emptyFile
diff --git a/nixos/tests/web-servers/llama-swap.nix b/nixos/tests/web-servers/llama-swap.nix
index 90766b74c1ed..1e80f6ab233c 100644
--- a/nixos/tests/web-servers/llama-swap.nix
+++ b/nixos/tests/web-servers/llama-swap.nix
@@ -1,261 +1,295 @@
-{ pkgs, lib, ... }:
+{
+  pkgs,
+  lib ? pkgs.lib,
+  runTest,
+  ...
+}:
 
 let
-  wrapSrc = attrs: pkgs.runCommand "${attrs.pname}-${attrs.version}" attrs "ln -s $src $out";
+  makeLlamaSwapTest =
+    name:
+    {
+      withUI ? true,
+      # opt in for e2e test with a small LLM
+      withLLM ? false,
+    }:
+    (
+      let
+        wrapSrc = attrs: pkgs.runCommand "${attrs.pname}-${attrs.version}" attrs "ln -s $src $out";
 
-  smollm2-135m = wrapSrc rec {
-    pname = "smollm2-135m";
-    version = "9e6855bc4be717fca1ef21360a1db4b29d5c559a";
-    src = pkgs.fetchurl {
-      url = "https://huggingface.co/unsloth/SmolLM2-135M-Instruct-GGUF/resolve/${version}/SmolLM2-135M-Instruct-Q4_K_M.gguf";
-      hash = "sha256-7V+jDEh7KC7BVsKQYvEiLlwgh1qUSsmCidvSQulH90c=";
+        smollm2-135m = wrapSrc rec {
+          pname = "smollm2-135m";
+          version = "9e6855bc4be717fca1ef21360a1db4b29d5c559a";
+          src = pkgs.fetchurl {
+            url = "https://huggingface.co/unsloth/SmolLM2-135M-Instruct-GGUF/resolve/${version}/SmolLM2-135M-Instruct-Q4_K_M.gguf";
+            hash = "sha256-7V+jDEh7KC7BVsKQYvEiLlwgh1qUSsmCidvSQulH90c=";
+          };
+
+          meta.license = with lib.licenses; [
+            asl20 # actual license of the model weights
+            unfree # to force an opt-in - do not remove
+          ];
+        };
+
+        # grab allowUnfreePredicate if it exists or default deny
+        allowUnfreePredicate =
+          if builtins.hasAttr "allowUnfreePredicate" pkgs.config then
+            pkgs.config.allowUnfreePredicate
+          else
+            (_: false);
+
+        # check if we can use smollm2-135m taking either globally allowUnfree or
+        # explicit allow with predicate
+        # or the test explicitly opts in
+        useSmollm2-135m = withLLM || pkgs.config.allowUnfree || allowUnfreePredicate smollm2-135m;
+      in
+      {
+        name = "llama-swap-${name}";
+        meta.maintainers = with lib.maintainers; [
+          jk
+          podium868909
+        ];
+
+        nodes = {
+          machine =
+            { pkgs, ... }:
+            {
+              # running models can be memory intensive but
+              # default `virtualisation.memorySize` is fine
+
+              services.llama-swap = {
+                enable = true;
+                settings =
+                  # config for basic tests
+                  if !useSmollm2-135m then
+                    { }
+                  # config for extended tests using SmolLM2
+                  else
+                    let
+                      llama-cpp = pkgs.llama-cpp;
+                      llama-server = lib.getExe' llama-cpp "llama-server";
+                    in
+                    {
+                      # more useful logging output
+                      logLevel = "debug";
+                      logToStdout = "both";
+
+                      hooks.on_startup.preload = [
+                        "smollm2"
+                      ];
+                      # temperature and top-k important for SmolLM2 performance/accuracy
+                      models = {
+                        "smollm2" = {
+                          ttl = 10;
+                          cmd = "${llama-server} --port \${PORT} -m ${smollm2-135m} --alias smollm2 --no-webui --temp 0.2 --top-k 9";
+                        };
+                        "smollm2-group-1" = {
+                          cmd = "${llama-server} --port \${PORT} -m ${smollm2-135m} --alias smollm2-group-1 --no-webui --temp 0.2 --top-k 9 -c 1024";
+                        };
+                        "smollm2-group-2" = {
+                          proxy = "http://127.0.0.1:5802";
+                          cmd = "${llama-server} --port 5802 -m ${smollm2-135m} --alias smollm2-group-2 --no-webui --temp 0.2 --top-k 9 -c 1024";
+                        };
+                      };
+                      groups = {
+                        "standalone" = {
+                          swap = true;
+                          exclusive = true;
+                          members = [
+                            "smollm2"
+                          ];
+                        };
+                        "group" = {
+                          swap = false;
+                          exclusive = true;
+                          members = [
+                            "smollm2-group-1"
+                            "smollm2-group-2"
+                          ];
+                        };
+                      };
+                    };
+              };
+            };
+        };
+
+        testScript =
+          { nodes, ... }:
+          ''
+            # core tests
+            import json
+
+            def get_json(route):
+              args = [
+                '-v',
+                '-s',
+                '--fail',
+                '-H "Content-Type: application/json"'
+              ]
+              return json.loads(machine.succeed("curl {args} http://localhost:8080{route}".format(args=" ".join(args), route=route)))
+
+            def post_json(route, data):
+              args = [
+                '-v',
+                '-s',
+                '--fail',
+                '-H "Content-Type: application/json"',
+                "-d '{d}'".format(d=json.dumps(data))
+              ]
+              return json.loads(machine.succeed('curl {args} http://localhost:8080{route}'.format(args=" ".join(args), route=route)))
+
+            machine.wait_for_unit('llama-swap')
+            machine.wait_for_open_port(8080)
+
+          ''
+          + lib.optionalString withUI ''
+            with subtest('check is serving ui'):
+              machine.succeed('curl --fail http:/localhost:8080/ui/')
+
+          ''
+          + ''
+            with subtest('check is healthy'):
+              response_healthy = machine.wait_until_succeeds('curl --silent --fail http://localhost:8080/health')
+              assert 'OK' in response_healthy, '/health was not OK'
+
+          ''
+          + lib.optionalString useSmollm2-135m ''
+            # extended tests using SmolLM2
+            with subtest('check `/running` for preloaded smollm2'):
+              machine.wait_until_succeeds('curl --silent --fail http://localhost:8080/running | grep "smollm2"')
+              running_response = get_json('/running')
+              assert len(running_response['running']) == 1, f'running doesn\'t have one entry as expected: {running_response}'
+              running_model = running_response['running'][0]
+              assert running_model['model'] == 'smollm2', f'running model is not smollm2: {running_response}'
+              assert running_model['state'] == 'ready', f'running smollm2 is not ready: {running_response}'
+
+            with subtest('runs smollm2'):
+              response = None
+              with subtest('send request to smollm2'):
+                data = {
+                  'model': 'smollm2',
+                  'messages': [
+                    {
+                      'role': 'user',
+                      'content': 'Say hello'
+                    }
+                  ]
+                }
+                response = post_json('/v1/chat/completions', data)
+
+              with subtest('response is from smollm2'):
+                assert response['model'] == 'smollm2', f'response was not from smollm2: {response['model']}'
+
+              with subtest('response contains at least one item in "choices"'):
+                assert len(response['choices']) >= 1, f'response had no choices: {response}'
+
+              assistant_choices = None
+              with subtest('response contains at least one "assistant" message'):
+                assistant_choices = [c for c in response['choices'] if c['message']['role'] == 'assistant']
+                assert len(assistant_choices) >= 1, f'response had no assistant message: {response}'
+
+              with subtest('first message (lowercase) starts with "hello"'):
+                assert assistant_choices[0]['message']['content'].lower()[:5] == 'hello', f'response didn\'t start with hello: {response}'
+
+              with subtest('check `/running` for just smollm2'):
+                running_response = get_json('/running')
+                assert len(running_response['running']) == 1, f'running doesn\'t have one entry as expected: {running_response}'
+                running_model = running_response['running'][0]
+                assert running_model['model'] == 'smollm2', f'running model is not smollm2: {running_response}'
+                assert running_model['state'] == 'ready', f'running smollm2 is not ready: {running_response}'
+
+            with subtest('check `/running` for smollm2 to timeout'):
+              machine.wait_until_succeeds('curl --silent --fail http://localhost:8080/running | grep -v "smollm2"', timeout=11)
+              running_response = get_json('/running')
+              assert len(running_response['running']) == 0, "smollm2 was still running after timeout"
+
+            with subtest('runs smollm2-group-1 and smollm2-group-2'):
+              response_1 = None
+              with subtest('send request to smollm2-group-1'):
+                data = {
+                  'model': 'smollm2-group-1',
+                  'messages': [
+                    {
+                      'role': 'user',
+                      'content': 'Say hello'
+                    }
+                  ]
+                }
+                response_1 = post_json('/v1/chat/completions', data)
+
+              with subtest('response 1 is from smollm2-group-1'):
+                assert response_1['model'] == 'smollm2-group-1', f'response was not from smollm2-group-1: {response_1['model']}'
+
+              with subtest('response 1 contains at least one item in "choices"'):
+                assert len(response_1['choices']) >= 1, f'response had no choices: {response_1}'
+
+              assistant_choices_1 = None
+              with subtest('response 1 contains at least one "assistant" message'):
+                assistant_choices_1 = [c for c in response_1['choices'] if c['message']['role'] == 'assistant']
+                assert len(assistant_choices_1) >= 1, f'response had no assistant message: {response_1}'
+
+              with subtest('first message (lowercase) in response 1 starts with "hello"'):
+                assert assistant_choices_1[0]['message']['content'].lower()[:5] == 'hello', f'response didn\'t start with hello: {response_1}'
+
+              with subtest('check `/running` for just smollm2-group-1'):
+                running_response = get_json('/running')
+                assert len(running_response['running']) == 1, f'running doesn\'t have one entry as expected: {running_response}'
+                running_model = running_response['running'][0]
+                assert running_model['model'] == 'smollm2-group-1', f'running model is not smollm2-group-1: {running_response}'
+                assert running_model['state'] == 'ready', f'running smollm2-group-1 is not ready: {running_response}'
+
+              response_2 = None
+              with subtest('send request to smollm2-group-2'):
+                data = {
+                  'model': 'smollm2-group-2',
+                  'messages': [
+                    {
+                      'role': 'user',
+                      'content': 'Say hello'
+                    }
+                  ]
+                }
+                response_2 = post_json('/v1/chat/completions', data)
+
+              with subtest('response 2 is from smollm2-group-2'):
+                assert response_2['model'] == 'smollm2-group-2', f'response was not from smollm2-group-2: {response_2['model']}'
+
+              with subtest('response 2 contains at least one item in "choices"'):
+                assert len(response_2['choices']) >= 1, f'response had no choices: {response_2}'
+
+              assistant_choices_2 = None
+              with subtest('response 2 contains at least one "assistant" message'):
+                assistant_choices_2 = [c for c in response_2['choices'] if c['message']['role'] == 'assistant']
+                assert len(assistant_choices_2) >= 1, f'response had no assistant message: {response_2}'
+
+              with subtest('first message (lowercase) in response 1 starts with "hello"'):
+                assert assistant_choices_2[0]['message']['content'].lower()[:5] == 'hello', f'response didn\'t start with hello: {response_2}'
+
+              with subtest('check `/running` for both smollm2-group-1 and smollm2-group-2'):
+                running_response = get_json('/running')['running']
+                assert len(running_response) == 2, 'expected both in smollm2 group to be running'
+                assert len([
+                  rm for rm in running_response
+                  if rm['state'] == 'ready' and rm['model'] == 'smollm2-group-1'
+                ]) == 1, f'smollm2-group-1 not in running group and ready {running_response}'
+                assert len([
+                  rm for rm in running_response
+                  if rm['state'] == 'ready' and rm['model'] == 'smollm2-group-2'
+                ]) == 1, f'smollm2-group-2 not in running group and ready {running_response}'
+          '';
+      }
+    );
+in
+lib.recurseIntoAttrs (
+  builtins.mapAttrs (k: v: runTest (makeLlamaSwapTest k v)) {
+    full = { };
+    minimal = {
+      withUI = false;
     };
 
-    meta.license = with lib.licenses; [
-      asl20 # actual license of the model
-      unfree # to force an opt-in - do not remove
-    ];
-  };
-
-  # grab allowUnfreePredicate if it exists or default deny
-  allowUnfreePredicate =
-    if builtins.hasAttr "allowUnfreePredicate" pkgs.config then
-      pkgs.config.allowUnfreePredicate
-    else
-      (_: false);
-
-  # check if we can use smollm2-135m taking either globally allowUnfree or
-  # explicit allow with predicate
-  useSmollm2-135m = pkgs.config.allowUnfree || allowUnfreePredicate smollm2-135m;
-in
-{
-  name = "llama-swap";
-  meta.maintainers = with lib.maintainers; [
-    jk
-    podium868909
-  ];
-
-  nodes = {
-    machine =
-      { pkgs, ... }:
-      {
-        # running models can be memory intensive but
-        # default `virtualisation.memorySize` is fine
-
-        services.llama-swap = {
-          enable = true;
-          settings =
-            # config for basic tests
-            if !useSmollm2-135m then
-              { }
-            # config for extended tests using SmolLM2
-            else
-              let
-                llama-cpp = pkgs.llama-cpp;
-                llama-server = lib.getExe' llama-cpp "llama-server";
-              in
-              {
-                # more useful logging output
-                logLevel = "debug";
-                logToStdout = "both";
-
-                hooks.on_startup.preload = [
-                  "smollm2"
-                ];
-                # temperature and top-k important for SmolLM2 performance/accuracy
-                models = {
-                  "smollm2" = {
-                    ttl = 10;
-                    cmd = "${llama-server} --port \${PORT} -m ${smollm2-135m} --alias smollm2 --no-webui --temp 0.2 --top-k 9";
-                  };
-                  "smollm2-group-1" = {
-                    cmd = "${llama-server} --port \${PORT} -m ${smollm2-135m} --alias smollm2-group-1 --no-webui --temp 0.2 --top-k 9 -c 1024";
-                  };
-                  "smollm2-group-2" = {
-                    proxy = "http://127.0.0.1:5802";
-                    cmd = "${llama-server} --port 5802 -m ${smollm2-135m} --alias smollm2-group-2 --no-webui --temp 0.2 --top-k 9 -c 1024";
-                  };
-                };
-                groups = {
-                  "standalone" = {
-                    swap = true;
-                    exclusive = true;
-                    members = [
-                      "smollm2"
-                    ];
-                  };
-                  "group" = {
-                    swap = false;
-                    exclusive = true;
-                    members = [
-                      "smollm2-group-1"
-                      "smollm2-group-2"
-                    ];
-                  };
-                };
-              };
-        };
-      };
-  };
-
-  testScript =
-    { nodes, ... }:
-    ''
-      # core tests
-      import json
-
-      def get_json(route):
-        args = [
-          '-v',
-          '-s',
-          '--fail',
-          '-H "Content-Type: application/json"'
-        ]
-        return json.loads(machine.succeed("curl {args} http://localhost:8080{route}".format(args=" ".join(args), route=route)))
-
-      def post_json(route, data):
-        args = [
-          '-v',
-          '-s',
-          '--fail',
-          '-H "Content-Type: application/json"',
-          "-d '{d}'".format(d=json.dumps(data))
-        ]
-        return json.loads(machine.succeed('curl {args} http://localhost:8080{route}'.format(args=" ".join(args), route=route)))
-
-      machine.wait_for_unit('llama-swap')
-      machine.wait_for_open_port(8080)
-
-      with subtest('check is serving ui'):
-        machine.succeed('curl --fail http:/localhost:8080/ui/')
-
-      with subtest('check is healthy'):
-        response_healthy = machine.wait_until_succeeds('curl --silent --fail http://localhost:8080/health')
-        assert 'OK' in response_healthy, '/health was not OK'
-
-    ''
-    + lib.optionalString useSmollm2-135m ''
-      # extended tests using SmolLM2
-      with subtest('check `/running` for preloaded smollm2'):
-        machine.wait_until_succeeds('curl --silent --fail http://localhost:8080/running | grep "smollm2"')
-        running_response = get_json('/running')
-        assert len(running_response['running']) == 1, f'running doesn\'t have one entry as expected: {running_response}'
-        running_model = running_response['running'][0]
-        assert running_model['model'] == 'smollm2', f'running model is not smollm2: {running_response}'
-        assert running_model['state'] == 'ready', f'running smollm2 is not ready: {running_response}'
-
-      with subtest('runs smollm2'):
-        response = None
-        with subtest('send request to smollm2'):
-          data = {
-            'model': 'smollm2',
-            'messages': [
-              {
-                'role': 'user',
-                'content': 'Say hello'
-              }
-            ]
-          }
-          response = post_json('/v1/chat/completions', data)
-
-        with subtest('response is from smollm2'):
-          assert response['model'] == 'smollm2', f'response was not from smollm2: {response['model']}'
-
-        with subtest('response contains at least one item in "choices"'):
-          assert len(response['choices']) >= 1, f'response had no choices: {response}'
-
-        assistant_choices = None
-        with subtest('response contains at least one "assistant" message'):
-          assistant_choices = [c for c in response['choices'] if c['message']['role'] == 'assistant']
-          assert len(assistant_choices) >= 1, f'response had no assistant message: {response}'
-
-        with subtest('first message (lowercase) starts with "hello"'):
-          assert assistant_choices[0]['message']['content'].lower()[:5] == 'hello', f'response didn\'t start with hello: {response}'
-
-        with subtest('check `/running` for just smollm2'):
-          running_response = get_json('/running')
-          assert len(running_response['running']) == 1, f'running doesn\'t have one entry as expected: {running_response}'
-          running_model = running_response['running'][0]
-          assert running_model['model'] == 'smollm2', f'running model is not smollm2: {running_response}'
-          assert running_model['state'] == 'ready', f'running smollm2 is not ready: {running_response}'
-
-      with subtest('check `/running` for smollm2 to timeout'):
-        machine.wait_until_succeeds('curl --silent --fail http://localhost:8080/running | grep -v "smollm2"', timeout=11)
-        running_response = get_json('/running')
-        assert len(running_response['running']) == 0, "smollm2 was still running after timeout"
-
-      with subtest('runs smollm2-group-1 and smollm2-group-2'):
-        response_1 = None
-        with subtest('send request to smollm2-group-1'):
-          data = {
-            'model': 'smollm2-group-1',
-            'messages': [
-              {
-                'role': 'user',
-                'content': 'Say hello'
-              }
-            ]
-          }
-          response_1 = post_json('/v1/chat/completions', data)
-
-        with subtest('response 1 is from smollm2-group-1'):
-          assert response_1['model'] == 'smollm2-group-1', f'response was not from smollm2-group-1: {response_1['model']}'
-
-        with subtest('response 1 contains at least one item in "choices"'):
-          assert len(response_1['choices']) >= 1, f'response had no choices: {response_1}'
-
-        assistant_choices_1 = None
-        with subtest('response 1 contains at least one "assistant" message'):
-          assistant_choices_1 = [c for c in response_1['choices'] if c['message']['role'] == 'assistant']
-          assert len(assistant_choices_1) >= 1, f'response had no assistant message: {response_1}'
-
-        with subtest('first message (lowercase) in response 1 starts with "hello"'):
-          assert assistant_choices_1[0]['message']['content'].lower()[:5] == 'hello', f'response didn\'t start with hello: {response_1}'
-
-        with subtest('check `/running` for just smollm2-group-1'):
-          running_response = get_json('/running')
-          assert len(running_response['running']) == 1, f'running doesn\'t have one entry as expected: {running_response}'
-          running_model = running_response['running'][0]
-          assert running_model['model'] == 'smollm2-group-1', f'running model is not smollm2-group-1: {running_response}'
-          assert running_model['state'] == 'ready', f'running smollm2-group-1 is not ready: {running_response}'
-
-        response_2 = None
-        with subtest('send request to smollm2-group-2'):
-          data = {
-            'model': 'smollm2-group-2',
-            'messages': [
-              {
-                'role': 'user',
-                'content': 'Say hello'
-              }
-            ]
-          }
-          response_2 = post_json('/v1/chat/completions', data)
-
-        with subtest('response 2 is from smollm2-group-2'):
-          assert response_2['model'] == 'smollm2-group-2', f'response was not from smollm2-group-2: {response_2['model']}'
-
-        with subtest('response 2 contains at least one item in "choices"'):
-          assert len(response_2['choices']) >= 1, f'response had no choices: {response_2}'
-
-        assistant_choices_2 = None
-        with subtest('response 2 contains at least one "assistant" message'):
-          assistant_choices_2 = [c for c in response_2['choices'] if c['message']['role'] == 'assistant']
-          assert len(assistant_choices_2) >= 1, f'response had no assistant message: {response_2}'
-
-        with subtest('first message (lowercase) in response 1 starts with "hello"'):
-          assert assistant_choices_2[0]['message']['content'].lower()[:5] == 'hello', f'response didn\'t start with hello: {response_2}'
-
-        with subtest('check `/running` for both smollm2-group-1 and smollm2-group-2'):
-          running_response = get_json('/running')['running']
-          assert len(running_response) == 2, 'expected both in smollm2 group to be running'
-          assert len([
-            rm for rm in running_response
-            if rm['state'] == 'ready' and rm['model'] == 'smollm2-group-1'
-          ]) == 1, f'smollm2-group-1 not in running group and ready {running_response}'
-          assert len([
-            rm for rm in running_response
-            if rm['state'] == 'ready' and rm['model'] == 'smollm2-group-2'
-          ]) == 1, f'smollm2-group-2 not in running group and ready {running_response}'
-    '';
-}
+    # opt in to smollm2-135m
+    full-with-llm = {
+      withLLM = true;
+    };
+  }
+)
diff --git a/pkgs/applications/audio/deadbeef/plugins/musical-spectrum.nix b/pkgs/applications/audio/deadbeef/plugins/musical-spectrum.nix
index 4a25d26d7068..eac2c211ad69 100644
--- a/pkgs/applications/audio/deadbeef/plugins/musical-spectrum.nix
+++ b/pkgs/applications/audio/deadbeef/plugins/musical-spectrum.nix
@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation {
   pname = "deadbeef-musical-spectrum-plugin";
-  version = "unstable-2020-07-01";
+  version = "0-unstable-2020-07-01";
 
   src = fetchFromGitHub {
     owner = "cboxdoerfer";
diff --git a/pkgs/applications/audio/deadbeef/plugins/playlist-manager.nix b/pkgs/applications/audio/deadbeef/plugins/playlist-manager.nix
index 23e5d09955e6..6e75d3ee5475 100644
--- a/pkgs/applications/audio/deadbeef/plugins/playlist-manager.nix
+++ b/pkgs/applications/audio/deadbeef/plugins/playlist-manager.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation {
   pname = "deadbeef-playlist-manager-plugin";
-  version = "unstable-2021-05-02";
+  version = "1-unstable-2021-05-02";
 
   src = fetchFromGitHub {
     owner = "kpcee";
     repo = "deadbeef-playlist-manager";
     rev = "b1393022b2d9ea0a19b845420146e0fc56cd9c0a";
-    sha256 = "sha256-dsKthlQ0EuX4VhO8K9VTyX3zN8ytzDUbSi/xSMB4xRw=";
+    hash = "sha256-dsKthlQ0EuX4VhO8K9VTyX3zN8ytzDUbSi/xSMB4xRw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/editors/android-studio/default.nix b/pkgs/applications/editors/android-studio/default.nix
index d082850488d9..b0db814d0bd8 100644
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@@ -26,9 +26,9 @@ let
     url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.3.6/android-studio-quail3-rc2-linux.tar.gz";
   };
   latestVersion = {
-    version = "2026.1.4.3"; # "Android Studio Quail 4 | 2026.1.4 Canary 3"
-    sha256Hash = "sha256-2rJp5PBxBrp6poIsBDPwGZ7BshBaBPkLaKfe6fACl2Q=";
-    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.4.3/android-studio-quail4-canary3-linux.tar.gz";
+    version = "2026.1.4.4"; # "Android Studio Quail 4 | 2026.1.4 Canary 4"
+    sha256Hash = "sha256-gcVlZzJ1/euSsKVrmYLXHt1Ym2kNghTzIk6crZXhGKQ=";
+    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.4.4/android-studio-quail4-canary4-linux.tar.gz";
   };
 in
 {
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 85781847e374..64617dcc6b1c 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1190,8 +1190,8 @@ let
         mktplcRef = {
           publisher = "DanielSanMedium";
           name = "dscodegpt";
-          version = "3.24.39";
-          hash = "sha256-r1XkER09s+38uCbUxK9MM5bHRNp3UnMj6VJCHUMZM1Q=";
+          version = "3.24.43";
+          hash = "sha256-Y3pCg0qauVu4K6qz610QGRizyodnRpDigGSSIn6m6gw=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/DanielSanMedium.dscodegpt/changelog";
@@ -1242,8 +1242,8 @@ let
         mktplcRef = {
           name = "databricks";
           publisher = "databricks";
-          version = "2.12.4";
-          hash = "sha256-29xG0/AhBhidM8Hd7vHUWxESCDt8MwACIkBpmfvhD2Q=";
+          version = "2.13.0";
+          hash = "sha256-4Fa1UABo7JUO7+IECjsYEq9zyscHTGUlrUCa3aBdhoI=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/databricks.databricks/changelog";
diff --git a/pkgs/applications/editors/vscode/extensions/james-yu.latex-workshop/default.nix b/pkgs/applications/editors/vscode/extensions/james-yu.latex-workshop/default.nix
index f6987618f128..2d52dc2e40ef 100644
--- a/pkgs/applications/editors/vscode/extensions/james-yu.latex-workshop/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/james-yu.latex-workshop/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "latex-workshop";
     publisher = "James-Yu";
-    version = "10.16.1";
-    hash = "sha256-QhqBCQjWADmuPK9ryMCoQPWE1pyIeO9XfYvN40ipL0Y=";
+    version = "10.18.0";
+    hash = "sha256-nuBx5ujJPbKvXRvIbUaPaIgoUeeYp4XwHwOdAjCVqUY=";
   };
   meta = {
     changelog = "https://marketplace.visualstudio.com/items/James-Yu.latex-workshop/changelog";
diff --git a/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix b/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
index 1175bcc1faf7..70ecd8305e72 100644
--- a/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "claude-dev";
     publisher = "saoudrizwan";
-    version = "4.1.3";
-    hash = "sha256-z1TrY/GWPkB14LSbFBALotU/WY2qHW6aj92PxCn4Uhc=";
+    version = "4.1.8";
+    hash = "sha256-bhLnEsoifDQGHKCECTZ/BkAjuFQ9O9tODxzO2WMdybo=";
   };
 
   meta = {
diff --git a/pkgs/applications/editors/vscode/extensions/tekumara.typos-vscode/default.nix b/pkgs/applications/editors/vscode/extensions/tekumara.typos-vscode/default.nix
index f7aafb38d63a..abda3122d485 100644
--- a/pkgs/applications/editors/vscode/extensions/tekumara.typos-vscode/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/tekumara.typos-vscode/default.nix
@@ -14,15 +14,15 @@ let
     {
       x86_64-linux = {
         arch = "linux-x64";
-        hash = "sha256-jAQJh1JqomJDUFeb2N452ICo0azFelT8vHvEsBqXi8w=";
+        hash = "sha256-3FE2tZtkDZttZlD7foqt1qgcb1w37mT0/RC30HYEvNA=";
       };
       aarch64-linux = {
         arch = "linux-arm64";
-        hash = "sha256-Z3cRojI4mCCS2t3aLojgImULQOobq5liDwoeHuzKEhY=";
+        hash = "sha256-xxniWRtMkh3NE9OWJkR9xUARJTBnQkoTRlXrQa95K/k=";
       };
       aarch64-darwin = {
         arch = "darwin-arm64";
-        hash = "sha256-rHgMl71YCs9ea0nFnx+E2U8isL4zQzIvvE9tgxM7IiA=";
+        hash = "sha256-/pj6HPuqvAYXrBVX/FoOZRDYL5xvdnM+PPM27/5+hxw=";
       };
     }
     .${system} or (throw "Unsupported system: ${system}");
@@ -34,7 +34,7 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
     # Please update the corresponding binary (typos-lsp)
     # when updating this extension.
     # See pkgs/by-name/ty/typos-lsp/package.nix
-    version = "0.1.51";
+    version = "0.1.55";
     inherit (extInfo) hash arch;
   };
 
diff --git a/pkgs/applications/editors/vscode/extensions/tombi-toml.tombi/default.nix b/pkgs/applications/editors/vscode/extensions/tombi-toml.tombi/default.nix
index 7ccbd7c83281..6424a435994e 100644
--- a/pkgs/applications/editors/vscode/extensions/tombi-toml.tombi/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/tombi-toml.tombi/default.nix
@@ -7,15 +7,15 @@
 let
   supported = {
     x86_64-linux = {
-      hash = "sha256-LuES+anP3Kd1uOZrteb3yy5nsec5gAX0PYeslJ8orBg=";
+      hash = "sha256-Fy745lZuOz7lLPRp6XXmHGr9asLj2kynlJbaHe6kgCg=";
       arch = "linux-x64";
     };
     aarch64-linux = {
-      hash = "sha256-vMLc5Yhtif8jN9V7DXER8BxFxYYv3sY7yKNMvse6CmQ=";
+      hash = "sha256-AULA4binavpDoxwpfpdBnl81HshNuChYiyOjte+aQw4=";
       arch = "linux-arm64";
     };
     aarch64-darwin = {
-      hash = "sha256-0ktwL6NkSGrpIUzc0IARoql2hxcluxvK0CTZkX4UEUE=";
+      hash = "sha256-DKu+dUPCDNOCm1KlpNIeIPmIAFYbVQLD8w4Q3dy3pPI=";
       arch = "darwin-arm64";
     };
   };
@@ -30,7 +30,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = base // {
     name = "tombi";
     publisher = "tombi-toml";
-    version = "1.2.5";
+    version = "1.2.8";
   };
   meta = {
     description = "TOML Language Server";
diff --git a/pkgs/applications/emulators/libretro/cores/beetle-saturn.nix b/pkgs/applications/emulators/libretro/cores/beetle-saturn.nix
index 86cee8ba3efb..daf1a62026ac 100644
--- a/pkgs/applications/emulators/libretro/cores/beetle-saturn.nix
+++ b/pkgs/applications/emulators/libretro/cores/beetle-saturn.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-saturn";
-  version = "0-unstable-2026-07-30";
+  version = "0-unstable-2026-08-11";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-saturn-libretro";
-    rev = "5231aa238ff2bf61b1ed88775711b71692c8e37c";
-    hash = "sha256-vVAnNXTyHpVImkwtCc8h0l/thxre08M7jyzZWk81pVY=";
+    rev = "ed549bdac0e1a830bb794fa720e45c225a45355c";
+    hash = "sha256-uRmkeRuOM2JN5OvuImAxyRyRPjXxCHeAl828304hF0o=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/emulators/libretro/cores/snes9x.nix b/pkgs/applications/emulators/libretro/cores/snes9x.nix
index ac4657b975c3..676248f17e4e 100644
--- a/pkgs/applications/emulators/libretro/cores/snes9x.nix
+++ b/pkgs/applications/emulators/libretro/cores/snes9x.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "snes9x";
-  version = "0-unstable-2026-07-13";
+  version = "0-unstable-2026-08-09";
 
   src = fetchFromGitHub {
     owner = "snes9xgit";
     repo = "snes9x";
-    rev = "b5cc7651f9fc02189cb51b5a43848877db5aec42";
-    hash = "sha256-htwL5m49J+ku7h79Eu4y74LKiHkbL3UE3+LAXE52ZY8=";
+    rev = "2ab06b3695bce429a074ced6f5193eb1c7acefaf";
+    hash = "sha256-L4j6wzYFiDQr+uKxLgPEEKecdeoPwED2U2TICZGvSuc=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index 2fe7c7ab6701..26ca26ba96be 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -1,10 +1,10 @@
 {
   "chromium": {
-    "version": "151.0.7922.108",
+    "version": "151.0.7922.137",
     "chromedriver": {
-      "version": "151.0.7922.109",
-      "hash_darwin": "sha256-VzMu90gOs02icI3PgvpNYXeE5c0QjCVB9CpM287roZo=",
-      "hash_darwin_aarch64": "sha256-5djEbPAayOVr8hr2VfXvlU4W6F+Kd/wiCt5NvQtgoOY="
+      "version": "151.0.7922.138",
+      "hash_darwin": "sha256-SW+gKW+GuPwVrJwFdFw6WmECOVXzfRT6tWCIRHoYrok=",
+      "hash_darwin_aarch64": "sha256-qUVhQo3JTPU5MP0RkVSAyk3iQTy/MWvE7Kab1BoI+Vg="
     },
     "deps": {
       "depot_tools": {
@@ -21,8 +21,8 @@
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "4744b886309d987d292e43232776d2206cccb13d",
-        "hash": "sha256-1i2IAA5sXyMPBzh6xOIY3CllEDtIS9Buk8Z2Vm1JnYw=",
+        "rev": "8f5d36bc16f57115aeeff34baf4ad6aa964d509c",
+        "hash": "sha256-OSqLGAnfiGRVC4RRMnjXFx0JvKh2qY+9zlf2xJZT19Q=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -657,8 +657,8 @@
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "86bb2f25f46f4d620b4a26e738f59a9b6c22d2eb",
-        "hash": "sha256-tnUcFuwWtw0uGNIsU38M54V1MAYFs7/2yjP9Cs1fEHo="
+        "rev": "66cca05ab345fb894cc80ed412e2fa79f687f5d9",
+        "hash": "sha256-lDMn7ReDCdGKGmypIZszE29DWGFebJemFPluKZYeg7k="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -827,8 +827,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "20ad8d002c17ccc7ccfbefc6c4dcf1242fe80921",
-        "hash": "sha256-J2dblSPMoZTpotDpuPp6beRYv+KtCirqNxEGEQKpqcQ="
+        "rev": "00c2754b59cf5f79b323950c63b07cfb1a8377d4",
+        "hash": "sha256-dXWiFX049YVnrtNdEznEiwT8lDyGJn9BEehB2yhCxqI="
       },
       "src/agents/shared": {
         "url": "https://chromium.googlesource.com/chromium/agents.git",
@@ -838,7 +838,7 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "151.0.7922.108",
+    "version": "151.0.7922.137",
     "deps": {
       "depot_tools": {
         "rev": "94e89b10b92cc9d6e58fc8d1b6474b7d29e8a114",
@@ -850,16 +850,16 @@
         "hash": "sha256-T2LdISIkp8fcUli5ZetTqrESBAc7coJhWdJv7I+o9kk="
       },
       "ungoogled-patches": {
-        "rev": "151.0.7922.108-1",
-        "hash": "sha256-EhnX4fkuKTTIF6wztKWitrjNzKUf36fAnr7lUkJqJtQ="
+        "rev": "151.0.7922.137-1",
+        "hash": "sha256-QIkhRquVqD22P1UBJ+Qv0LEI118v7PDt3hQCIl1ScQ4="
       },
       "npmHash": "sha256-pF0JtwFpPC4/fodbhSJnQKkczA9WlDg4VqEAy9aDVLg="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "4744b886309d987d292e43232776d2206cccb13d",
-        "hash": "sha256-1i2IAA5sXyMPBzh6xOIY3CllEDtIS9Buk8Z2Vm1JnYw=",
+        "rev": "8f5d36bc16f57115aeeff34baf4ad6aa964d509c",
+        "hash": "sha256-OSqLGAnfiGRVC4RRMnjXFx0JvKh2qY+9zlf2xJZT19Q=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -1494,8 +1494,8 @@
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "86bb2f25f46f4d620b4a26e738f59a9b6c22d2eb",
-        "hash": "sha256-tnUcFuwWtw0uGNIsU38M54V1MAYFs7/2yjP9Cs1fEHo="
+        "rev": "66cca05ab345fb894cc80ed412e2fa79f687f5d9",
+        "hash": "sha256-lDMn7ReDCdGKGmypIZszE29DWGFebJemFPluKZYeg7k="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -1664,8 +1664,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "20ad8d002c17ccc7ccfbefc6c4dcf1242fe80921",
-        "hash": "sha256-J2dblSPMoZTpotDpuPp6beRYv+KtCirqNxEGEQKpqcQ="
+        "rev": "00c2754b59cf5f79b323950c63b07cfb1a8377d4",
+        "hash": "sha256-dXWiFX049YVnrtNdEznEiwT8lDyGJn9BEehB2yhCxqI="
       },
       "src/agents/shared": {
         "url": "https://chromium.googlesource.com/chromium/agents.git",
diff --git a/pkgs/applications/networking/cluster/helm/default.nix b/pkgs/applications/networking/cluster/helm/default.nix
index be3010316f0f..c909d8890e61 100644
--- a/pkgs/applications/networking/cluster/helm/default.nix
+++ b/pkgs/applications/networking/cluster/helm/default.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "kubernetes-helm";
-  version = "4.2.3";
+  version = "4.2.4";
 
   src = fetchFromGitHub {
     owner = "helm";
     repo = "helm";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-t7cdJjazG38T49y+x2B1akBNvZNXhN2ig3eNnHirV2g=";
+    hash = "sha256-Q9+0K65qwmebkXlsIByEX2zE4hSaZWYGTWGgwVkcJNs=";
   };
 
-  vendorHash = "sha256-6TJWtGTdTtzOpPvWsk4rtJwxZxkIxIA6QSAemOnHcJ4=";
+  vendorHash = "sha256-AFiniy+SM1svofkNWjowIE0BPmYa6TUcK9LPQahP+S4=";
 
   subPackages = [ "cmd/helm" ];
   ldflags = [
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 3ef1c691bc9b..948d3443e874 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -337,13 +337,13 @@
     "vendorHash": "sha256-fP6brpY/wRI1Yjgapzi+FfOci65gxWeOZulXbGdilrE="
   },
   "dnsimple_dnsimple": {
-    "hash": "sha256-8ZanbgHaszFiorzY/ulpVvUesmyx7O3SKXmwOi5WUSU=",
+    "hash": "sha256-YkoBGPcNKBeAHWcsRldHSsZ/hvWngCiySjK5zzI9jNE=",
     "homepage": "https://registry.terraform.io/providers/dnsimple/dnsimple",
     "owner": "dnsimple",
     "repo": "terraform-provider-dnsimple",
-    "rev": "v2.1.2",
+    "rev": "v2.2.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-1CpswocnTe6aj4TP7fMGy6mv0d/yX8FcYAKkAW5k7kk="
+    "vendorHash": "sha256-SuwDjQMgzcnNsBf/wXZvys6VINgnFeaWcV7jIMbNXo8="
   },
   "dnsmadeeasy_dme": {
     "hash": "sha256-JH9YcM9Fvd1x0BJpLUZCm6a9hZZxySrkFVLP89FO3fU=",
@@ -409,13 +409,13 @@
     "vendorHash": null
   },
   "fastly_fastly": {
-    "hash": "sha256-fblscW6k/iWGr3HTLASrfD11asYsssDuXkGUnzGoUFY=",
+    "hash": "sha256-n1C/sRIPaZJJ/0irMNhDbi+hzXaof0+Kgu7XgDkGS3o=",
     "homepage": "https://registry.terraform.io/providers/fastly/fastly",
     "owner": "fastly",
     "repo": "terraform-provider-fastly",
-    "rev": "v9.4.0",
+    "rev": "v9.6.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-DhETt9f9GaAI5V/A53H3Bhph9uZyffUM1bsWDrW4CLE="
+    "vendorHash": "sha256-tDiNj7Xbda10gUBYJ1bwzlYsrwa2ZSK9ZxsbXziI2pU="
   },
   "flexibleenginecloud_flexibleengine": {
     "hash": "sha256-yEZ9JiUSqFFbfqzOOD59ZBv4yFCeUBBKlp6aiUqDqiM=",
@@ -733,13 +733,13 @@
     "vendorHash": null
   },
   "ibm-cloud_ibm": {
-    "hash": "sha256-hDLD3h+640IRIL5lDegn4W2tOuSef6Bi5JWdlLbtqoM=",
+    "hash": "sha256-r34ih6c5UVovef14tNMkZA/QjJxVDTpfreeJPLE3fP8=",
     "homepage": "https://registry.terraform.io/providers/IBM-Cloud/ibm",
     "owner": "IBM-Cloud",
     "repo": "terraform-provider-ibm",
-    "rev": "v2.4.0",
+    "rev": "v2.5.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-/UNr2OiDlq0gX3D77mbruDj9WMnS/0AxkoEaBcWlFHU="
+    "vendorHash": "sha256-e58CRr7mqENnAoF3eQyaypbsFr1sflrWHkx8U/JxCNA="
   },
   "icinga_icinga2": {
     "hash": "sha256-Y/Oq0aTzP+oSKPhHiHY9Leal4HJJm7TNDpcdqkUsCmk=",
@@ -1202,13 +1202,13 @@
     "vendorHash": "sha256-MIO0VHofPtKPtynbvjvEukMNr5NXHgk7BqwIhbc9+u0="
   },
   "selectel_selectel": {
-    "hash": "sha256-Z5Z66WIZur68s0VkmIpbowZr26J2Ngy2l5269I6SxVA=",
+    "hash": "sha256-IewnjIw4MXAcMb3J1TxON8dz0lelClKgRgpJShWj6b8=",
     "homepage": "https://registry.terraform.io/providers/selectel/selectel",
     "owner": "selectel",
     "repo": "terraform-provider-selectel",
-    "rev": "v8.2.4",
+    "rev": "v8.3.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-qDQXedSS41lpV1o+lfCYHs81m3AcqHhku6xlul7725E="
+    "vendorHash": "sha256-pYvj5toBm4XT5TTSECZiyd5tcPbTp+EREYaxyV0mLAM="
   },
   "siderolabs_talos": {
     "hash": "sha256-/NACmEpodBNx+Q2M9y3JnKpw9a3Y1eFDdTQ+48MXAc8=",
@@ -1247,13 +1247,13 @@
     "vendorHash": "sha256-gva4QLCNANCaDSjv84N2oFv9VlsU8oUZOUTx6nTRIcA="
   },
   "splunk-terraform_signalfx": {
-    "hash": "sha256-xdB2VAacBGFAeVd60Zy6MWSmx6BFJ7ciZKSTXYdRZY0=",
+    "hash": "sha256-KoPLEVzR/MtMTrufqvxrOuVsfjCUXQ9UMbqjosAy2oc=",
     "homepage": "https://registry.terraform.io/providers/splunk-terraform/signalfx",
     "owner": "splunk-terraform",
     "repo": "terraform-provider-signalfx",
-    "rev": "v9.33.0",
+    "rev": "v9.34.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-m7Op/K3Xo9nKgVg9bTHmpmPiFpCB6Ek/kgj76P+ViGQ="
+    "vendorHash": "sha256-mNEzE2eACy63BGoFOamG52JD8mvC7okhSN9hMuesTlg="
   },
   "spotinst_spotinst": {
     "hash": "sha256-pkYrrtsbIHSyy/TjoHBegrwwwIi6Vn6aT4Ic3C/QgyY=",
@@ -1283,11 +1283,11 @@
     "vendorHash": "sha256-nbiLH+J051XxTx+z8xGrp/DPYB7g9S4clFSWcZUKnAg="
   },
   "sysdiglabs_sysdig": {
-    "hash": "sha256-VeIgHhCHyNgAcv2NIBAWCJIwGHE3nqYeCxGd4VSUymU=",
+    "hash": "sha256-MfwzmTzikzZAg0U7W5Dmjww6Oadnr4Oq+uIQSZaRHEo=",
     "homepage": "https://registry.terraform.io/providers/sysdiglabs/sysdig",
     "owner": "sysdiglabs",
     "repo": "terraform-provider-sysdig",
-    "rev": "v3.9.0",
+    "rev": "v3.9.1",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-HjrB7C0KaLJz9NVLfZdq5EZbNbF9lJPxSkQwnWUF978="
   },
diff --git a/pkgs/applications/networking/instant-messengers/discord/sources.json b/pkgs/applications/networking/instant-messengers/discord/sources.json
index 0822977a4a5b..16dcbc4048e6 100644
--- a/pkgs/applications/networking/instant-messengers/discord/sources.json
+++ b/pkgs/applications/networking/instant-messengers/discord/sources.json
@@ -1,153 +1,153 @@
 {
   "linux-canary": {
     "distro": {
-      "hash": "sha256-wVyW1GrvmMEM/btexjTf2uFkTt7GNG+dkI3C+dWnrJQ=",
-      "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1635/full.distro"
+      "hash": "sha256-FUuG8LKZwvszmdrKjnEKu+iQT0Ly08aLFO91FGzdGO8=",
+      "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1656/full.distro"
     },
     "kind": "distro",
     "modules": {
       "discord_arborium": {
-        "hash": "sha256-F5zZEtp67OAUM4gLtV0Uhsy4Gj1eqX7vBjIlOn/GzNI=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1635/discord_arborium/1/full.distro",
+        "hash": "sha256-D+NJvpdGsE2IiPB4vl+CDHLNmga8zrHSu1Q9skD2E80=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1656/discord_arborium/1/full.distro",
         "version": 1
       },
       "discord_cloudsync": {
-        "hash": "sha256-Tic8LFWOoX4AyiGmMwYwCr6T807aXLYbamW72/bZwN4=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1635/discord_cloudsync/1/full.distro",
-        "version": 1
+        "hash": "sha256-BopR1WtIPEgfx6b5bhHSSKYtMOSIVxJr34GE6E7rATk=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1656/discord_cloudsync/2/full.distro",
+        "version": 2
       },
       "discord_desktop_core": {
-        "hash": "sha256-zSF6kyKXzCERAEx8LslGt/YYPtWXNgr2Kdpj0Yx05F0=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1635/discord_desktop_core/1/full.distro",
-        "version": 1
+        "hash": "sha256-OWORDE77w5HBh7I5d7bnTjzdU8x7MxOCtzrWoQNX3Zs=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1656/discord_desktop_core/2/full.distro",
+        "version": 2
       },
       "discord_dispatch": {
-        "hash": "sha256-8jJd14m9a3eias4cMCT1wRnu1aT8dzXUXCv5dAMLxN8=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1635/discord_dispatch/1/full.distro",
-        "version": 1
+        "hash": "sha256-SGsUToeQaZ/bQtHy8RMIxHg0dHz8Zhvu5sVckyXUQ18=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1656/discord_dispatch/2/full.distro",
+        "version": 2
       },
       "discord_erlpack": {
-        "hash": "sha256-uhrQCnQC4Dm/XkoYRqVzjUvweYabsJxQrA2LtUxQ7Ac=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1635/discord_erlpack/1/full.distro",
+        "hash": "sha256-P40ZPbTL4FfeoWKjjwAuh+ysQRgtYUBX/a3Oj/2BX1U=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1656/discord_erlpack/1/full.distro",
         "version": 1
       },
       "discord_game_utils": {
-        "hash": "sha256-32OQHDin9330UsgJ6JYWkT2dv+ToyWzbBpxMKnjxEQY=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1635/discord_game_utils/1/full.distro",
-        "version": 1
+        "hash": "sha256-sHzwAS6iQ7XiRw9RzIsOzgHyK/D0gMwmlwez29EGGMA=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1656/discord_game_utils/2/full.distro",
+        "version": 2
       },
       "discord_krisp": {
-        "hash": "sha256-2SfBfbzwcl2yhKikIiaw95qqixa/hm8apwhVnks/3cM=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1635/discord_krisp/1/full.distro",
-        "version": 1
+        "hash": "sha256-JY+82GDMUzdL7yQ+55F1r2+kU86wHnfW1HSRGA+gs44=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1656/discord_krisp/2/full.distro",
+        "version": 2
       },
       "discord_modules": {
-        "hash": "sha256-PmTRUml1bZY45GNEfZqMWDl3eNHdGrkM2f/kASSoFEQ=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1635/discord_modules/1/full.distro",
-        "version": 1
+        "hash": "sha256-NodXtAgXZZl3EOO4Rak1gCYpkxmJbJ9P4HHS3W/AW5A=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1656/discord_modules/2/full.distro",
+        "version": 2
       },
       "discord_rpc": {
-        "hash": "sha256-n4WUN1e2mYwyd4TEa5AEOFv9OhXlimkTCNe6cWucH3s=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1635/discord_rpc/1/full.distro",
-        "version": 1
+        "hash": "sha256-USuVJtYZG+V3mZahEmcn0r+Pc45xCYqBk8gxKZB+4ZY=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1656/discord_rpc/2/full.distro",
+        "version": 2
       },
       "discord_spellcheck": {
-        "hash": "sha256-koi/kVLiq9lSGlhiCXl2Cbw0O812+PPkgC2aBH0kKwU=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1635/discord_spellcheck/1/full.distro",
+        "hash": "sha256-BL7UkZR2O5562UUmkadrxOVifL2d/vqRqzaW9k+lUks=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1656/discord_spellcheck/1/full.distro",
         "version": 1
       },
       "discord_utils": {
-        "hash": "sha256-c9HSxlOz9RMvwSie5nEjHsI51cLyC+mInQrSwFbuHAo=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1635/discord_utils/1/full.distro",
-        "version": 1
+        "hash": "sha256-IS7WwTqJwx/+OYgO2ZP3TxsVTXscLQOn5bEWLOBGOzY=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1656/discord_utils/2/full.distro",
+        "version": 2
       },
       "discord_voice": {
-        "hash": "sha256-KBesDj1E++Ty2JO3CXKr81RR4DOfL+26sYi1F6oZJfo=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1635/discord_voice/1/full.distro",
-        "version": 1
+        "hash": "sha256-g2oiDEFwq0qbbeVlMM0xHKAGFjVTwSl4reDaDQGcZUU=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1656/discord_voice/2/full.distro",
+        "version": 2
       },
       "discord_zstd": {
-        "hash": "sha256-Q5KpWnY3TaE9R9qXw/1E1m5wu1UXegFlfWY7rh2iQ3g=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1635/discord_zstd/1/full.distro",
-        "version": 1
+        "hash": "sha256-hqysSEE+kDmW2VWt6PyVUW4lUMZfu6OH2KtmchMil8E=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1656/discord_zstd/2/full.distro",
+        "version": 2
       }
     },
-    "version": "1.0.1635"
+    "version": "1.0.1656"
   },
   "linux-development": {
     "distro": {
-      "hash": "sha256-yrpyHVaPpM5uPbB+iCApdeQmkyyGaqN1LrT6ZYHbhbY=",
-      "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.1008/full.distro"
+      "hash": "sha256-tmjpT2oZ+1BefLhh4Bxipi0xLTO3JjOzzGLdVcmyuvE=",
+      "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.1009/full.distro"
     },
     "kind": "distro",
     "modules": {
       "discord_arborium": {
-        "hash": "sha256-ONuhQI6g6BmU+TpWAPlijXyqn3nIvaPkT0sydfxvZao=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.1008/discord_arborium/1/full.distro",
+        "hash": "sha256-yEK2W6Fp0pcF6FSCZYgopcKMTC7ofswVq1G3SK/TOWY=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.1009/discord_arborium/1/full.distro",
         "version": 1
       },
       "discord_cloudsync": {
-        "hash": "sha256-KOOtLoQpgQN+ZB6jJ/dHVX6GsdY+Rwbs6Lg7XAaIMs8=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.1008/discord_cloudsync/1/full.distro",
+        "hash": "sha256-hNSSWkwjEaqaKYqFBBh3v8PBEHB0YEa2bZJd6Lt0xbc=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.1009/discord_cloudsync/1/full.distro",
         "version": 1
       },
       "discord_desktop_core": {
-        "hash": "sha256-OFRRyIG92N+w0uH5i4oKrQjfaSMFLn1+XdCQlx2MLhQ=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.1008/discord_desktop_core/1/full.distro",
+        "hash": "sha256-TYzmzahlesOKI6sUNGNq2fr6++sJpRycLWZRUAhtfhc=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.1009/discord_desktop_core/1/full.distro",
         "version": 1
       },
       "discord_dispatch": {
-        "hash": "sha256-LPnrtss4ahqkSsJLbi7oNv4w6fGtRYEbwwJAkM6lXDs=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.1008/discord_dispatch/1/full.distro",
+        "hash": "sha256-xZ2d7lTbZunbHcQJKPm9Z0NQE7Oq3qH4uR2zq71IdOs=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.1009/discord_dispatch/1/full.distro",
         "version": 1
       },
       "discord_erlpack": {
-        "hash": "sha256-W8qd42fl2vbwC0QR4QrJjPC+mgT/a7aZ0C9IRNOOlI8=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.1008/discord_erlpack/1/full.distro",
+        "hash": "sha256-LC1cBf23zXmSfpW6I7UxuLi30y6m0l+2NwqJsSCt4Cw=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.1009/discord_erlpack/1/full.distro",
         "version": 1
       },
       "discord_game_utils": {
-        "hash": "sha256-IMqtXTj2vZKhRpS/WstkhLDjltFFXlGEOqbaz6ex+5I=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.1008/discord_game_utils/1/full.distro",
+        "hash": "sha256-zrxP8s1Npfs6GSHW5q8MuWkhFeINzXwi9A+S93o9vD8=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.1009/discord_game_utils/1/full.distro",
         "version": 1
       },
       "discord_krisp": {
-        "hash": "sha256-AoKbpqRFOZDNDOFSJegmvRbTKnQeLWmLYXA5XNZz3qE=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.1008/discord_krisp/1/full.distro",
+        "hash": "sha256-ulpY2VnZwBFbEBcwXXO8cNhGgWEqkoBVEbMn/ictKQg=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.1009/discord_krisp/1/full.distro",
         "version": 1
       },
       "discord_modules": {
-        "hash": "sha256-itja8snUwlNzic87xWv9LM3ppB63QlzZalOyCdNELsE=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.1008/discord_modules/1/full.distro",
+        "hash": "sha256-BCrN7APbCd0bw55cL51umhfpYBUpkEIBxHF8IZaEpRM=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.1009/discord_modules/1/full.distro",
         "version": 1
       },
       "discord_rpc": {
-        "hash": "sha256-Lj+Cwc8M1nyIlMwQryv8tmw9Doyq/tYBqG9KFCW1Zh4=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.1008/discord_rpc/1/full.distro",
+        "hash": "sha256-RsWNLlNSyuIhnFqpSG374vlmLqfFEZRAL8XcmiI3JPE=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.1009/discord_rpc/1/full.distro",
         "version": 1
       },
       "discord_spellcheck": {
-        "hash": "sha256-QU4mP0bNQHh/+Y18vI8jsTDSmTlRGbnDjU41gjSfYTg=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.1008/discord_spellcheck/1/full.distro",
+        "hash": "sha256-KyeC+llmxpjjbjJGf7F4RYXnIQxnhDnvgixHeubM27Y=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.1009/discord_spellcheck/1/full.distro",
         "version": 1
       },
       "discord_utils": {
-        "hash": "sha256-Eua48+eBqqsFXJZnfM6mup3PstbdOt/1IxL/THhM+l0=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.1008/discord_utils/1/full.distro",
+        "hash": "sha256-iKsHKmIlzSTbmsbtNTUwhClJLNf/dF55A/S0ZHuwLUg=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.1009/discord_utils/1/full.distro",
         "version": 1
       },
       "discord_voice": {
-        "hash": "sha256-QNYGjzAsete+b2i4izZxGGiqBj70IX33SLdFYNQHR1g=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.1008/discord_voice/1/full.distro",
+        "hash": "sha256-tWiXPoJUXHGmZE7d+oS5hD5LfuqK6NQOKVPILFmvGLY=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.1009/discord_voice/1/full.distro",
         "version": 1
       },
       "discord_zstd": {
-        "hash": "sha256-3z2OmC0r9JpkzcDOPWwNlK+qrgyaQjKn7rkB+Jb/XGY=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.1008/discord_zstd/1/full.distro",
+        "hash": "sha256-s4fndo1YnagUsY1Nb9CLb/goaxID8+cPJKOzf0NAXh0=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/linux/x64/1.0.1009/discord_zstd/1/full.distro",
         "version": 1
       }
     },
-    "version": "1.0.1008"
+    "version": "1.0.1009"
   },
   "linux-ptb": {
     "distro": {
@@ -226,258 +226,258 @@
   },
   "linux-stable": {
     "distro": {
-      "hash": "sha256-3P0AC0nzWyxUCZZfqeeZj8p57E8bD6dfAnC7rYCUch4=",
-      "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.152/full.distro"
+      "hash": "sha256-AzcQ2f6fsLAOvamgJMxMVJbhVh3JSkHeeLRsCwNqsnw=",
+      "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.153/full.distro"
     },
     "kind": "distro",
     "modules": {
       "discord_arborium": {
-        "hash": "sha256-EctcvW6AClcKnx+WMc1Az6XBD3Gr12H20sJrwJggjkU=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.152/discord_arborium/1/full.distro",
+        "hash": "sha256-wOodeJufXbDUDSsSyrG8+OJ/OxBPFfg3r7utbI7slms=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.153/discord_arborium/1/full.distro",
         "version": 1
       },
       "discord_cloudsync": {
-        "hash": "sha256-b7WtS7VLHO7wUIXRbUqD5e4Kg22bAa8z71n0akkjSs8=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.152/discord_cloudsync/1/full.distro",
+        "hash": "sha256-Z9AHOO66v3eo/l9dMNE6FPduXwk7itn/ux+IBHKyUNw=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.153/discord_cloudsync/1/full.distro",
         "version": 1
       },
       "discord_desktop_core": {
-        "hash": "sha256-YNJiO7xyeAMEYioARzVTTYcnBQtqqeQLi/y6eOpZ7oc=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.152/discord_desktop_core/2/full.distro",
-        "version": 2
+        "hash": "sha256-Zis/QM7anwCebhJVXeO+kYQ+82JVxE/l/9DSFvbE0M8=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.153/discord_desktop_core/1/full.distro",
+        "version": 1
       },
       "discord_dispatch": {
-        "hash": "sha256-A+1g70FYSe+CY9/a/S7BSIGy5OMfFbOrbnoJTPVAUyU=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.152/discord_dispatch/1/full.distro",
+        "hash": "sha256-rpF8mVEsRC9sR+OiihCV9EhJF1c0JwuEFlKxaeREhYY=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.153/discord_dispatch/1/full.distro",
         "version": 1
       },
       "discord_erlpack": {
-        "hash": "sha256-Uz8QoOc8c6fMUXEHyLZ80nOKDMb26IxdHGw7Pw8ZEp8=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.152/discord_erlpack/1/full.distro",
+        "hash": "sha256-MMcPGHruTeb/Fu9syNn5/XTxUR0JTNqAesGTLbAi20s=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.153/discord_erlpack/1/full.distro",
         "version": 1
       },
       "discord_game_utils": {
-        "hash": "sha256-HdWOJQy25w1l8Rmt4EwlJh06w5LxLVpfcLHhV8FZaRI=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.152/discord_game_utils/1/full.distro",
+        "hash": "sha256-UkZ7f/Ckc2oDKSI1tdZU/2YBukkVV1eugtOCQ5ShVgk=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.153/discord_game_utils/1/full.distro",
         "version": 1
       },
       "discord_krisp": {
-        "hash": "sha256-wcLDDaaNbyjBZGiN+OwIGsKPob5nHYVY2Qy1vAY11ss=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.152/discord_krisp/1/full.distro",
+        "hash": "sha256-rFGeGhR5d7Y7Jo1R3netJNz0aAkHd8uBfRtbcK3mZFg=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.153/discord_krisp/1/full.distro",
         "version": 1
       },
       "discord_modules": {
-        "hash": "sha256-Ih6vth/F4DTkNs15nhtvLmb5cUCQRRERaVUBAuqc3F8=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.152/discord_modules/1/full.distro",
+        "hash": "sha256-9/KdLuTux8f5mWoQBSpqNkcU/PvodaMVmAuGRkHW72c=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.153/discord_modules/1/full.distro",
         "version": 1
       },
       "discord_rpc": {
-        "hash": "sha256-3YCXPhC1WoakCT5nYBrrilwh8Pzn34lz2mT1aRYOReQ=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.152/discord_rpc/1/full.distro",
+        "hash": "sha256-8AgyHPFu3ixeCi71M1W4hjcZHvacWZK2vPNhqRMFqZs=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.153/discord_rpc/1/full.distro",
         "version": 1
       },
       "discord_spellcheck": {
-        "hash": "sha256-LHGbGj/Tg3Xqt9VSvVZ12SNE+rgEwX8EcSsMGBqdA5I=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.152/discord_spellcheck/1/full.distro",
+        "hash": "sha256-lZZitgtDkVaznkda2t7/5krxfOh3hF2R6ID9oHfaNos=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.153/discord_spellcheck/1/full.distro",
         "version": 1
       },
       "discord_utils": {
-        "hash": "sha256-To64PXhcM77MPEgvs5iHCGi/lxnTykLUR45wZ9fYA/M=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.152/discord_utils/1/full.distro",
+        "hash": "sha256-bi74t/4DTAL4X8LIiRvx95UlvPy1b1ORgVo49S5iGrA=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.153/discord_utils/1/full.distro",
         "version": 1
       },
       "discord_voice": {
-        "hash": "sha256-i5oAPf1e/FMD0E6nIXaxXWxC/VWBBOREMQxWaMUkvxs=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.152/discord_voice/1/full.distro",
+        "hash": "sha256-o8dEAGCZbwy7MNGX3XlEb1/2cfSwW6t9NUS5S4ePd5o=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.153/discord_voice/1/full.distro",
         "version": 1
       },
       "discord_zstd": {
-        "hash": "sha256-vxFw1kpEiPAyt9oFCnGKrnXo9JsqQEwlv2OnRW4mWC8=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.152/discord_zstd/1/full.distro",
+        "hash": "sha256-wPVbgwlzi7qvim3+VeXvk1oXBYVniNi7tilH1R3/Xm4=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.153/discord_zstd/1/full.distro",
         "version": 1
       }
     },
-    "version": "1.0.152"
+    "version": "1.0.153"
   },
   "osx-canary": {
     "distro": {
-      "hash": "sha256-6zmHOjqyBufB6xXawxcSJKoQm1pWdYkIp5ISAeHjfe0=",
-      "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1259/full.distro"
+      "hash": "sha256-oMoOhtB5M0BbSKhHbomjp5vCyNYCAh8UtEpINCi4wlc=",
+      "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1263/full.distro"
     },
     "kind": "distro",
     "modules": {
       "discord_arborium": {
-        "hash": "sha256-jy9RTaxyDXIpZbdC+5bx9uju0PeDxQaNTKgxFzVIZpM=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1259/discord_arborium/1/full.distro",
+        "hash": "sha256-6NYHxQfprHHdZGknYMxEl0lo29pt0ryrR9sDvYHO05s=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1263/discord_arborium/1/full.distro",
         "version": 1
       },
       "discord_cloudsync": {
-        "hash": "sha256-TV5AuV66V9CI7K9leE3sO569mGYLXnloaUz621Wg1Ow=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1259/discord_cloudsync/1/full.distro",
+        "hash": "sha256-+PHB1wpTO5+R3zA9dufE3xLy0syuQYSS+a0jsCNGNjs=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1263/discord_cloudsync/1/full.distro",
         "version": 1
       },
       "discord_desktop_core": {
-        "hash": "sha256-DNiXFsfr0KZbeoZbMNdZr8rEu1kqosTVlMBw8N7UvzI=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1259/discord_desktop_core/1/full.distro",
-        "version": 1
+        "hash": "sha256-bxAGSMxQr9Bp5/N8VVMIg3ro7Z/lHtlEmaIm56qgg+k=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1263/discord_desktop_core/2/full.distro",
+        "version": 2
       },
       "discord_dispatch": {
-        "hash": "sha256-908gzkHlwxHhoipBf2KveaKEQQTg+KMCID0smEM4SWw=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1259/discord_dispatch/1/full.distro",
+        "hash": "sha256-2DKqLoaZtxY5LhYOPPejnsVq43mv5spxuMXAhCiq/NM=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1263/discord_dispatch/1/full.distro",
         "version": 1
       },
       "discord_erlpack": {
-        "hash": "sha256-k29XwPhAnWFK9Y2KkXHI5LoRZuUAmF464OMQvSD8kzw=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1259/discord_erlpack/1/full.distro",
+        "hash": "sha256-nBObSAmMDKQKGYvgnsV8j/D1Z6z/zVHK7yIt7JnD/Zs=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1263/discord_erlpack/1/full.distro",
         "version": 1
       },
       "discord_game_utils": {
-        "hash": "sha256-vsPbERMnUxRFaQi/4K6ncqpvUshKN1q8boE2RUne0j0=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1259/discord_game_utils/1/full.distro",
+        "hash": "sha256-7KQ38od6K27ycVkvOnaH7SLv/Jx6hPYOE84nzFH1dXI=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1263/discord_game_utils/1/full.distro",
         "version": 1
       },
       "discord_intents": {
-        "hash": "sha256-QG63psMwtqLpVxUhL5Qw89kyyAafzRIFC2u8pMmzyS0=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1259/discord_intents/1/full.distro",
+        "hash": "sha256-APCh8BArgt5RevI2QJOVLAssgYS/cjdFpIHs8JPTTAg=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1263/discord_intents/1/full.distro",
         "version": 1
       },
       "discord_krisp": {
-        "hash": "sha256-t6GDZyGfX5YLvSBaNRFzaMOsdYHEX3XoX2yXQr1STKs=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1259/discord_krisp/1/full.distro",
+        "hash": "sha256-fLU6kopr2sQUkXG4A+atBY+AVxjHSxfYAR6TGBdZLvY=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1263/discord_krisp/1/full.distro",
         "version": 1
       },
       "discord_modules": {
-        "hash": "sha256-lvD9cYkx4qV2dPC880HEYmyE3cR3kQOCnLzHFin+nec=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1259/discord_modules/1/full.distro",
+        "hash": "sha256-rC8XQ2jm17GBY9FCZXjVILpEIqW20wGs7jauzX7f87A=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1263/discord_modules/1/full.distro",
         "version": 1
       },
       "discord_notifications": {
-        "hash": "sha256-zCpbLLX6VSkTbltrJTViCRmnR3dBxeU8rcPhOCxl2LQ=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1259/discord_notifications/1/full.distro",
+        "hash": "sha256-RUDniZB+PdGPlDcVRYlsJYeHvaYokmZ2BZNRO3KOJH4=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1263/discord_notifications/1/full.distro",
         "version": 1
       },
       "discord_rpc": {
-        "hash": "sha256-urpWdkMSqKioIOxpdjNT3JJZcikDvs0dSsVUkUG4PY0=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1259/discord_rpc/1/full.distro",
+        "hash": "sha256-ruTPBYzfG71eKxnglHyC6OkhZQryh1ftqFNMWOJ/3CU=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1263/discord_rpc/1/full.distro",
         "version": 1
       },
       "discord_spellcheck": {
-        "hash": "sha256-/50/mm6byljJ8MC6SalU+lRggcF1CKy9cwclpbMsrAk=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1259/discord_spellcheck/1/full.distro",
+        "hash": "sha256-DQryV7MY/Xz2XL8agjM3iJY2wY4LYsjQ5ImYfEnUvnQ=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1263/discord_spellcheck/1/full.distro",
         "version": 1
       },
       "discord_utils": {
-        "hash": "sha256-zXams2ljKyMGgco9hvSQHC3HD42TQCVKfMyG/PF9ubw=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1259/discord_utils/5/full.distro",
-        "version": 5
+        "hash": "sha256-zbCFs+lEaT4s4cBw+UeOaxtWM9cIf4Sh/YnFX1DdUkA=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1263/discord_utils/9/full.distro",
+        "version": 9
       },
       "discord_voice": {
-        "hash": "sha256-waDSMuxHPQLNzTdIzoELL0erZjFJej4KWOIYzSDVNvU=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1259/discord_voice/2/full.distro",
-        "version": 2
+        "hash": "sha256-Ud+AaFDH01n1ArYaMSyvx7JKv/CFqXahe5+49rPi3Rk=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1263/discord_voice/4/full.distro",
+        "version": 4
       },
       "discord_webauthn": {
-        "hash": "sha256-YhBNYnuXHlr17VqnOpMlH0p4TyDMZmr63Y0v/1efwJk=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1259/discord_webauthn/1/full.distro",
+        "hash": "sha256-4iSifUx00540kHxVmTRUELc7CTdeQlrzumL6PoZ5UYc=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1263/discord_webauthn/1/full.distro",
         "version": 1
       },
       "discord_zstd": {
-        "hash": "sha256-xN5RNiSGDbpt7qrJkhhf4cn3XA/Z2P/Ro1xdkBulzB4=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1259/discord_zstd/1/full.distro",
+        "hash": "sha256-IAfkqNAHP1nGZ1mavrRYVnkNwyfTchb70XLuFAiTB+I=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1263/discord_zstd/1/full.distro",
         "version": 1
       }
     },
-    "version": "0.0.1259"
+    "version": "0.0.1263"
   },
   "osx-development": {
     "distro": {
-      "hash": "sha256-5kbK9PeDcx16e8R1cdvy5UTPfurhJw9G6M4N09XDczU=",
-      "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.1015/full.distro"
+      "hash": "sha256-h+90ma3vDxyFepJafVMPt+xnnwhlHp8xyWiEy4e8BtE=",
+      "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.1017/full.distro"
     },
     "kind": "distro",
     "modules": {
       "discord_arborium": {
-        "hash": "sha256-SePXBJQn09OPdGk8C1kkNSWz35GXi18PJn6Uj9xzR0w=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.1015/discord_arborium/1/full.distro",
+        "hash": "sha256-0CSXXOysVTXkOIX+PGiLxhO5TF52RbnAeAdaUt8gIsA=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.1017/discord_arborium/1/full.distro",
         "version": 1
       },
       "discord_cloudsync": {
-        "hash": "sha256-oTarTEo+9DXqiA4vFObY7Db/TXvOGQs0iVi1LLNmalQ=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.1015/discord_cloudsync/1/full.distro",
+        "hash": "sha256-OTFs1oZxifyZQCSawl15uwmUGEtdMmfn3IirfqNM7Dg=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.1017/discord_cloudsync/1/full.distro",
         "version": 1
       },
       "discord_desktop_core": {
-        "hash": "sha256-EsGnAbLFwGZxvVu2vQdOLqwHDFRt2tItlsaSdQ835NA=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.1015/discord_desktop_core/1/full.distro",
+        "hash": "sha256-ZdfclWKmnf4LDp3bZuHa8yOLoH/nQJg1HXY97yz2+Zs=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.1017/discord_desktop_core/1/full.distro",
         "version": 1
       },
       "discord_dispatch": {
-        "hash": "sha256-X9Fln640uCRnnpg09U5o32uDiCDwoizjck7VNcwY1W0=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.1015/discord_dispatch/1/full.distro",
+        "hash": "sha256-TdKvrQD5QEdU91Iuk6Bj0zahMHzebLp/+9iJ6YVcQos=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.1017/discord_dispatch/1/full.distro",
         "version": 1
       },
       "discord_erlpack": {
-        "hash": "sha256-v1uDvFN/lwwgDsIpVfQyNiuaSBsgsCrkQhT1uwSzBXY=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.1015/discord_erlpack/1/full.distro",
+        "hash": "sha256-8mo1PxrdfoACT0ue1Vnn+9V66iYWYo0sAKpbPV/Z9AA=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.1017/discord_erlpack/1/full.distro",
         "version": 1
       },
       "discord_game_utils": {
-        "hash": "sha256-hLFkB034tOioo8QqSESbExeKvYQWO4lFK83gyNqfODk=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.1015/discord_game_utils/1/full.distro",
+        "hash": "sha256-q6iYGIUMgn6ONBiP+uYB+NOoqtAIWf8kAJGHBOSPHCY=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.1017/discord_game_utils/1/full.distro",
         "version": 1
       },
       "discord_intents": {
-        "hash": "sha256-l8XAfLol1w9UdPz0sYbZF5DBjEAalM7+pugIwZdIiKE=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.1015/discord_intents/1/full.distro",
+        "hash": "sha256-cSWAEnxpiN2L3OqYo+WXW/CGgUs+fK0c5WqgwC+/PV0=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.1017/discord_intents/1/full.distro",
         "version": 1
       },
       "discord_krisp": {
-        "hash": "sha256-EUKEYMfWE7BF2ttIvhyJFnJQ2dhXqXphTT1QQjQz/iQ=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.1015/discord_krisp/1/full.distro",
+        "hash": "sha256-S7oaSuskr7Tlb//L6+oU9UTEnvME63h/UQ6WClPjr4U=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.1017/discord_krisp/1/full.distro",
         "version": 1
       },
       "discord_modules": {
-        "hash": "sha256-YdUOQ+JcpHDBc7HQsm8iQ60a8Afa4M000AcerwhHqT0=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.1015/discord_modules/1/full.distro",
+        "hash": "sha256-WvuQBFrzhJXvUWpeD44VTEWT9fx9SJShfBSvkI1G32M=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.1017/discord_modules/1/full.distro",
         "version": 1
       },
       "discord_notifications": {
-        "hash": "sha256-ku7VBMlahg0WHlv6FoLgyqPMKJwcJU5HzaigW+8qL0g=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.1015/discord_notifications/1/full.distro",
+        "hash": "sha256-56laGA0e4UDYLDvympNDYhzYN/xpdXxZwOI7tQ5wQFM=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.1017/discord_notifications/1/full.distro",
         "version": 1
       },
       "discord_rpc": {
-        "hash": "sha256-YiZ/PJyP0qHpRxHjguS3XWtwYlnl9Wf19IoToEIyFOA=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.1015/discord_rpc/1/full.distro",
+        "hash": "sha256-Hxkf9GgMO3oHZXAgrzVp14xunA+QPcq+esKiVaAhvJU=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.1017/discord_rpc/1/full.distro",
         "version": 1
       },
       "discord_spellcheck": {
-        "hash": "sha256-6adzIekyegQdXwBkd8jgmhJIl8RwmQs4kxQe1iuTbJ4=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.1015/discord_spellcheck/1/full.distro",
+        "hash": "sha256-VFwm5bLjYbbc7g4VDKHuO51/Hu9JQbvEGnm4SBAnf3U=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.1017/discord_spellcheck/1/full.distro",
         "version": 1
       },
       "discord_utils": {
-        "hash": "sha256-y/sDjwW2VHJmLfhFORQwzR/fyV65RmyDI1AsWGJdX8w=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.1015/discord_utils/1/full.distro",
+        "hash": "sha256-7MIIqJEPA3Fw13kQS1mCoQNeKoOa9X8RlpwIjf1ug38=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.1017/discord_utils/1/full.distro",
         "version": 1
       },
       "discord_voice": {
-        "hash": "sha256-prXIjXQAR5IvOMf+eezdBltr9rKN+EOKjEM6sEpNgO0=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.1015/discord_voice/1/full.distro",
+        "hash": "sha256-X7Ao2wuOSbYEjbVqLxHzWDq19QpVuKseo1lAUCSn4YQ=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.1017/discord_voice/1/full.distro",
         "version": 1
       },
       "discord_webauthn": {
-        "hash": "sha256-5ngUr7GKUW372bvByaP0Dy3EEsSHJS2DPwcITOIFjfA=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.1015/discord_webauthn/1/full.distro",
+        "hash": "sha256-UoXmSxoU0lrk8KYHTlOY2pGYdNEp/E5dxINq/b3J5HQ=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.1017/discord_webauthn/1/full.distro",
         "version": 1
       },
       "discord_zstd": {
-        "hash": "sha256-V6lNy0S9ECxQBSVa8Ly1gqdV5pBXpwvqKlnStxp57cE=",
-        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.1015/discord_zstd/1/full.distro",
+        "hash": "sha256-cUu9IJje2A7eqGAOTYdCADN81zE2hZSH3hnWUsUynEA=",
+        "url": "https://development.dl2.discordapp.net/distro/app/development/osx/universal/1.0.1017/discord_zstd/1/full.distro",
         "version": 1
       }
     },
-    "version": "1.0.1015"
+    "version": "1.0.1017"
   },
   "osx-ptb": {
     "distro": {
@@ -571,92 +571,92 @@
   },
   "osx-stable": {
     "distro": {
-      "hash": "sha256-Xs01Ui0u96n2Fpc/T5qObZWjqmbNuU4WTa9Z8OOtNk0=",
-      "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.406/full.distro"
+      "hash": "sha256-v1xV1DYVKfwelYbYMVhL3BDKAfsXe9Npny4kqpX6qDs=",
+      "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.407/full.distro"
     },
     "kind": "distro",
     "modules": {
       "discord_arborium": {
-        "hash": "sha256-15EkIwQbVXPCnv65FpUc05Y+W/LfiIcFD8BJ0DehqEg=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.406/discord_arborium/1/full.distro",
+        "hash": "sha256-4PVxJjyYtSGI9StNjMKeaUSbYIifEYWTz7kktr5cPOk=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.407/discord_arborium/1/full.distro",
         "version": 1
       },
       "discord_cloudsync": {
-        "hash": "sha256-z8yUwMAWanKhcs1dEIB2Xn05KPjPqDInE56pbbHis+c=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.406/discord_cloudsync/1/full.distro",
+        "hash": "sha256-ffvvOuTkACsGgnBmubB6XDibYpeihr2i/lmlOGOa7VE=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.407/discord_cloudsync/1/full.distro",
         "version": 1
       },
       "discord_desktop_core": {
-        "hash": "sha256-jtzoHhXgMlPRkyd6FO52IyMyTjVzonJslADK1G4toiU=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.406/discord_desktop_core/2/full.distro",
-        "version": 2
+        "hash": "sha256-y46vUEzpmwRnRCs/KGzD/pRRSLA0/5l11VKJsEoridQ=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.407/discord_desktop_core/1/full.distro",
+        "version": 1
       },
       "discord_dispatch": {
-        "hash": "sha256-FteG3F0mMpOiLburBCySJ/DacqT01T2jfx4m5UW1UF8=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.406/discord_dispatch/1/full.distro",
+        "hash": "sha256-LEm7zYYCVLB9l5JdlsIhJ6zVR3eCiyJfhvsMKvK6yTI=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.407/discord_dispatch/1/full.distro",
         "version": 1
       },
       "discord_erlpack": {
-        "hash": "sha256-p83ovML/oSDeEsdjuP9RH27ehXzbLLjVwAS1a58ItZ8=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.406/discord_erlpack/1/full.distro",
+        "hash": "sha256-ClyKJPwYhHXW2p2nCVsa1Kf5Faeuxur4H0CI7xpnBdA=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.407/discord_erlpack/1/full.distro",
         "version": 1
       },
       "discord_game_utils": {
-        "hash": "sha256-o+zjv5zskYrhoFtHq2UnvKkPkg66JSCnhV1h210Bt+w=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.406/discord_game_utils/1/full.distro",
+        "hash": "sha256-aUVuPOS5zxnzVXUs+pstMWt9rkJsecvrBSruTNjHKyY=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.407/discord_game_utils/1/full.distro",
         "version": 1
       },
       "discord_intents": {
-        "hash": "sha256-6aIKC5/mFx1Xy2hvckMGEZOJaZjbosbiccPVfvncZUg=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.406/discord_intents/1/full.distro",
+        "hash": "sha256-qWgjn5WOjl78GVTAO/J/RA8ljlFrmYynfpEAXqYbGAo=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.407/discord_intents/1/full.distro",
         "version": 1
       },
       "discord_krisp": {
-        "hash": "sha256-AnVRy1f8PyTnHZ0xYtickRJFWcbvpQl5PKoCg3WlUxU=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.406/discord_krisp/1/full.distro",
+        "hash": "sha256-RtQS0+jCoeBt0V2CGRkwjuTEar9+JxOv1V864e64cHk=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.407/discord_krisp/1/full.distro",
         "version": 1
       },
       "discord_modules": {
-        "hash": "sha256-VKN53f0QD8mavsVN1iJASDyBEbQWbrKzGMKCtZzoCFA=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.406/discord_modules/1/full.distro",
+        "hash": "sha256-De6mRVFdakXVDk5IMLTdCTXVnVkNfmvcLLPRvtj3XAY=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.407/discord_modules/1/full.distro",
         "version": 1
       },
       "discord_notifications": {
-        "hash": "sha256-kwzPD9lHU+IIoq44dF8rKs3fRqh5UI0N4uz2LC8UrGQ=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.406/discord_notifications/1/full.distro",
+        "hash": "sha256-AzLpxosut9r3acJPPBVw1pumW/le24+hMVlYDSu2u48=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.407/discord_notifications/1/full.distro",
         "version": 1
       },
       "discord_rpc": {
-        "hash": "sha256-YgeTVunMN9Rk5uodwkJclD43ApqzO/6dGad02XZtsgo=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.406/discord_rpc/1/full.distro",
+        "hash": "sha256-bPvnC2DfmRETFYJFDQviXdFF2YI8gWRz5FcgZr8CX8A=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.407/discord_rpc/1/full.distro",
         "version": 1
       },
       "discord_spellcheck": {
-        "hash": "sha256-Wk9cUfZspD2PtcbyO7pmT/351SvNa7z+5bwP5kKlEuA=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.406/discord_spellcheck/1/full.distro",
+        "hash": "sha256-K6JoXsJNim/VOAVjqHU5Izaj1n4HZiDKTDU8HRFDQaU=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.407/discord_spellcheck/1/full.distro",
         "version": 1
       },
       "discord_utils": {
-        "hash": "sha256-G0WtNX4hbO4iB9Xz8rY43ZEmeSUFU0m3XlLrlOhAzZE=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.406/discord_utils/1/full.distro",
+        "hash": "sha256-GkcdoGruyIOzokHgd/jeCPkPsGtHAry1c3WrOaRuHYI=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.407/discord_utils/1/full.distro",
         "version": 1
       },
       "discord_voice": {
-        "hash": "sha256-EzRy0SjuEzkMvFlH7w6GyVDEh22hSeikw7hD5s7lsw8=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.406/discord_voice/1/full.distro",
+        "hash": "sha256-9B1pjqlvOM5Pit1JImYrVOzIAURyJN4pwIS+NBLaqvI=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.407/discord_voice/1/full.distro",
         "version": 1
       },
       "discord_webauthn": {
-        "hash": "sha256-fivCWaJhxbouKbhWPRgrXqv/7FKL+RpS8Qn9lIHngnc=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.406/discord_webauthn/1/full.distro",
+        "hash": "sha256-tqxA5qhMdUjKUWSRChBUnE5ul4obLxodxZPuSUE6+Sw=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.407/discord_webauthn/1/full.distro",
         "version": 1
       },
       "discord_zstd": {
-        "hash": "sha256-IEHHrGPCcxWjKTPY7hYEQzk6Zh5UsC6rTCANgF77mjI=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.406/discord_zstd/1/full.distro",
+        "hash": "sha256-QJ46FR7YP7eAmbs844t3ueQtcKNK9PJm3jNEPKCx0Vw=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.407/discord_zstd/1/full.distro",
         "version": 1
       }
     },
-    "version": "0.0.406"
+    "version": "0.0.407"
   }
 }
diff --git a/pkgs/applications/video/kodi/addons/osmc-skin/default.nix b/pkgs/applications/video/kodi/addons/osmc-skin/default.nix
index 3a00631e900b..507f18ca6034 100644
--- a/pkgs/applications/video/kodi/addons/osmc-skin/default.nix
+++ b/pkgs/applications/video/kodi/addons/osmc-skin/default.nix
@@ -6,7 +6,7 @@
 buildKodiAddon rec {
   pname = "osmc-skin";
   namespace = "skin.osmc";
-  version = "21.1.1";
+  version = "21.2.1";
 
   src = fetchFromGitHub {
     owner = "osmc";
diff --git a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hypr-darkwindow.nix b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hypr-darkwindow.nix
index c165932cf0b4..85d0fb434740 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hypr-darkwindow.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hypr-darkwindow.nix
@@ -7,7 +7,7 @@
 
 mkHyprlandPlugin (finalAttrs: {
   pluginName = "hypr-darkwindow";
-  version = "0.56.1";
+  version = "0.56.2";
 
   src = fetchFromGitHub {
     owner = "micha4w";
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index bf079f1b0e53..d926d85425a3 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -804,9 +804,15 @@ stdenvNoCC.mkDerivation {
       include -cxx-isystem "${getDev libcxx}/include/c++/v1" >> $out/nix-support/libcxx-cxxflags
       echo "-stdlib=libc++" >> $out/nix-support/libcxx-ldflags
     ''
-    # GCC NG friendly libc++
+    # This is the GCC NG case, libstdc++ is being built as a separate package.
+    #
+    # Point at `include-cxx`, not `include`. `libcxx` is also a propagated
+    # target-target dep, so the generic setup hook puts its `include` on the *C*
+    # include path -- and libstdc++ ships headers named after C headers
+    # (`math.h`, `stdlib.h`, `stdckdint.h`, ...) that are only meant to shadow
+    # the C ones in C++. A sibling directory the setup hook ignores is enough.
     + optionalString (libcxx != null && libcxx.isGNU or false) ''
-      include -isystem "${getDev libcxx}/include" >> $out/nix-support/libcxx-cxxflags
+      include -isystem "${getDev libcxx}/include-cxx" >> $out/nix-support/libcxx-cxxflags
     ''
 
     ##
diff --git a/pkgs/build-support/nix-gitignore/default.nix b/pkgs/build-support/nix-gitignore/default.nix
index fa9bbc1ca8c4..67c6b52d4059 100644
--- a/pkgs/build-support/nix-gitignore/default.nix
+++ b/pkgs/build-support/nix-gitignore/default.nix
@@ -254,5 +254,5 @@ rec {
     else
       gitignoreFilterSource (_: _: true) patterns;
 
-  gitignoreRecursiveSource = gitignoreFilterSourcePure (_: _: true);
+  gitignoreRecursiveSource = gitignoreFilterRecursiveSource (_: _: true);
 }
diff --git a/pkgs/by-name/_1/_1password-cli/package.nix b/pkgs/by-name/_1/_1password-cli/package.nix
index 6595b170e8e3..c1756687e2c5 100644
--- a/pkgs/by-name/_1/_1password-cli/package.nix
+++ b/pkgs/by-name/_1/_1password-cli/package.nix
@@ -24,13 +24,13 @@ let
     if extension == "zip" then fetchzip args else fetchurl args;
 
   pname = "1password-cli";
-  version = "2.34.1";
+  version = "2.38.1";
   sources = {
-    aarch64-linux = fetch "linux_arm64" "sha256-uEukRq71eeayvNguD9XepvP1Br5AkE2Ag/Chv2idf4A=" "zip";
-    i686-linux = fetch "linux_386" "sha256-p/F3YZLJnlimrVE2qxTHvIB4m47kuwhoCWTC40VIvMs=" "zip";
-    x86_64-linux = fetch "linux_amd64" "sha256-oAABMlwwv5X91TT6FK2aPpg+e2CvmHT1rqIVRTjQNCQ=" "zip";
+    aarch64-linux = fetch "linux_arm64" "sha256-RmpJkrrLrKwbmbw50+sTg0aFa0+M2EFPZ6+QSc3aV5M=" "zip";
+    i686-linux = fetch "linux_386" "sha256-hnpVsbNgofmfw/XobVZ2MnbGIcAjxH1MvVJNc5T1kuk=" "zip";
+    x86_64-linux = fetch "linux_amd64" "sha256-k268YiTC/2MJZhVqMI/e9bsrf4Sr4Wj8M/h/hbmmcqY=" "zip";
     aarch64-darwin =
-      fetch "apple_universal" "sha256-vp1Y1M6DUanx1CAVhLrqgBovwws6Y/5jOgnwTZE8Hhc="
+      fetch "apple_universal" "sha256-pLlEsqCL5j9QCuLkQxK/Mmz647lKbCYhOUiPch2MMuE="
         "pkg";
   };
   platforms = builtins.attrNames sources;
diff --git a/pkgs/by-name/_1/_1password-cli/update.sh b/pkgs/by-name/_1/_1password-cli/update.sh
index 4f04279fcea6..0ef07bf6ab48 100755
--- a/pkgs/by-name/_1/_1password-cli/update.sh
+++ b/pkgs/by-name/_1/_1password-cli/update.sh
@@ -27,7 +27,7 @@ replace_sha() {
   sed -i "s|\"$1\" \"sha256-.\{44\}\"|\"$1\" \"$2\"|" "$NIX_DRV"
 }
 
-CLI_VERSION="$(curl -Ls https://app-updates.agilebits.com/product_history/CLI2 | xq -q 'h3' | head -n1)"
+CLI_VERSION="$(curl -Ls https://app-updates.agilebits.com/product_history/CLI2 | xq -q 'article:not(.beta) h3' | head -n1)"
 
 CLI_LINUX_AARCH64_SHA256=$(fetch_linux "$CLI_VERSION" "linux_arm64")
 CLI_LINUX_I686_SHA256=$(fetch_linux "$CLI_VERSION" "linux_386")
diff --git a/pkgs/by-name/_1/_1password-gui/sources.json b/pkgs/by-name/_1/_1password-gui/sources.json
index af3cd2a106a2..3e30f21ef8e8 100644
--- a/pkgs/by-name/_1/_1password-gui/sources.json
+++ b/pkgs/by-name/_1/_1password-gui/sources.json
@@ -1,28 +1,28 @@
 {
   "stable": {
     "linux": {
-      "version": "8.12.30",
+      "version": "8.12.32",
       "sources": {
         "x86_64": {
-          "url": "https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.12.30.x64.tar.gz",
-          "hash": "sha256-jZuPdQo5KPvbYqN5YXFq3lAEqJccWhi6ROFOSvjiWuU="
+          "url": "https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.12.32.x64.tar.gz",
+          "hash": "sha256-dg42SQNMS77+393sDP66weZ33VVIKjOQEZwaK82ifZc="
         },
         "aarch64": {
-          "url": "https://downloads.1password.com/linux/tar/stable/aarch64/1password-8.12.30.arm64.tar.gz",
-          "hash": "sha256-s4wmVQ7JXV0cakDhueawkQWTjicxOVzdrHQll6zNwvI="
+          "url": "https://downloads.1password.com/linux/tar/stable/aarch64/1password-8.12.32.arm64.tar.gz",
+          "hash": "sha256-pjSX6FWMZh1PN/lNMEbPQ2+hZs47tiNC0ptHJGZL3rQ="
         }
       }
     },
     "darwin": {
-      "version": "8.12.30",
+      "version": "8.12.33",
       "sources": {
         "x86_64": {
-          "url": "https://downloads.1password.com/mac/1Password-8.12.30-x86_64.zip",
-          "hash": "sha256-LuRoGXVGG5r6Bpg9PC39zICVc4pEgvAh7yY/nlQgnVI="
+          "url": "https://downloads.1password.com/mac/1Password-8.12.33-x86_64.zip",
+          "hash": "sha256-jIvE1S4oP5/nVnmxQyrzW14kwnAI5zB9eKjms29XikI="
         },
         "aarch64": {
-          "url": "https://downloads.1password.com/mac/1Password-8.12.30-aarch64.zip",
-          "hash": "sha256-7qX2UjUaEfJA2Cn8RwcjEkDX6RR4S487B8zYYUKp+mw="
+          "url": "https://downloads.1password.com/mac/1Password-8.12.33-aarch64.zip",
+          "hash": "sha256-CT+3Sn9AyyxHyTRXhajCwsO9n9eqxou3kD1RJ2RZUpk="
         }
       }
     }
diff --git a/pkgs/by-name/_4/_4ti2/package.nix b/pkgs/by-name/_4/_4ti2/package.nix
index 989042f52e41..5a5a29ddc3ba 100644
--- a/pkgs/by-name/_4/_4ti2/package.nix
+++ b/pkgs/by-name/_4/_4ti2/package.nix
@@ -12,6 +12,9 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "4ti2";
   version = "1.6.15";
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   src = fetchFromGitHub {
     owner = "4ti2";
     repo = "4ti2";
@@ -34,6 +37,8 @@ stdenv.mkDerivation (finalAttrs: {
     gmp
   ];
 
+  enableParallelBuilding = true;
+
   installFlags = [ "install-exec" ];
 
   meta = {
diff --git a/pkgs/by-name/ac/actual-client/package.nix b/pkgs/by-name/ac/actual-client/package.nix
new file mode 100644
index 000000000000..61c60768f608
--- /dev/null
+++ b/pkgs/by-name/ac/actual-client/package.nix
@@ -0,0 +1,166 @@
+{
+  lib,
+  actual-server,
+  copyDesktopItems,
+  electron_41,
+  imagemagick,
+  jq,
+  makeDesktopItem,
+  makeWrapper,
+  removeReferencesTo,
+  stdenv,
+}:
+let
+  electron = electron_41;
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "actual-client";
+
+  inherit (actual-server)
+    srcs
+    version
+    sourceRoot
+    offlineCache
+    env
+    patches
+    ;
+  inherit (actual-server.offlineCache) missingHashes;
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  postPatch =
+    actual-server.postPatch
+    +
+    # bash
+    ''
+      cat <<< $(${lib.getExe jq} 'del(.build.beforePack, .build.electronFuses)' packages/desktop-electron/package.json) > packages/desktop-electron/package.json
+    '';
+
+  nativeBuildInputs = actual-server.nativeBuildInputs ++ [
+    copyDesktopItems
+    makeWrapper
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    # verify electron version
+    upstreamElectronMajor=$(${lib.getExe jq} -r '.devDependencies.electron | match("[0-9]+").string' packages/desktop-electron/package.json)
+    if [[ "$upstreamElectronMajor" != "${lib.versions.major electron.version}" ]]; then
+      echo "Electron major version mismatch: Actual expects $upstreamElectronMajor, nixpkgs provides ${electron.version}" >&2
+      exit 1
+    fi
+
+    export HOME=$(mktemp -d)
+
+    # lage hashes source files via `git ls-tree HEAD`, so it needs a repo with
+    # at least one commit.
+    git -c init.defaultBranch=main init -q
+    git add -A
+    git -c user.email=nix@localhost -c user.name=nix commit -q --allow-empty -m "snapshot"
+
+    # rebuild better-sqlite3; copied from splayer package
+    # we need to use headers from electron to avoid ABI mismatches.
+    pushd node_modules/better-sqlite3
+    npm run build-release --offline --nodedir="${electron.headers}"
+    rm -rf build/Release/{.deps,obj,obj.target,test_extension.node}
+    find build -type f -exec \
+      ${lib.getExe removeReferencesTo} \
+      -t "${electron.headers}" {} \;
+    popd
+
+    ./bin/package-electron --skip-translations --skip-exe-build
+
+    pushd packages/desktop-electron/
+
+    yarn run electron-builder \
+      --dir \
+      -c.electronDist=${electron.dist} \
+      -c.electronVersion=${electron.version} \
+      -c.mac.identity=null
+    popd
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    # The shared electron package will be used so only install the application resources produced by electron-builder
+    mkdir -p "$out/share/lib/actual/resources"
+    cp -Pr --no-preserve=ownership \
+      packages/desktop-electron/dist/*-unpacked/resources/{app.asar,app.asar.unpacked,extra-resources} \
+      "$out/share/lib/actual/resources/"
+
+    mkdir icons
+    declare -a icon_sizes=(16x16 32x32 48x48 64x64 128x128 256x256 512x512)
+    for size in "''${icon_sizes[@]}"; do
+      ${lib.getExe imagemagick} \
+        -background none \
+        packages/desktop-electron/icons/icon.png \
+        -resize "!$size" \
+        "icons/$size.png"
+      install -D "icons/$size.png" \
+        "$out/share/icons/hicolor/$size/apps/com.actualbudget.actual.png"
+    done
+
+    # We set ELECTRON_FORCE_IS_PACKAGED because Usually electron apps have
+    # a different executable name. Since we use the nixpkgs electron, it thinks
+    # it has no app packaged into it even though we do add the resources for
+    # Actual.
+
+    makeShellWrapper ${lib.getExe electron} "$out/bin/actual" \
+      --add-flags "$out/share/lib/actual/resources/app.asar" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true --wayland-text-input-version=3}}" \
+      --set-default ELECTRON_IS_DEV 0 \
+      --set-default ELECTRON_FORCE_IS_PACKAGED 1 \
+      --inherit-argv0
+
+    runHook postInstall
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "com.actualbudget.actual";
+      desktopName = "Actual";
+      exec = "actual %U";
+      terminal = false;
+      type = "Application";
+      icon = "com.actualbudget.actual";
+      startupWMClass = "Actual";
+      comment = "Super fast privacy-focused app for managing your finances";
+      categories = [
+        "Office"
+        "Finance"
+      ];
+      keywords = [
+        "Budget"
+        "Finance"
+        "Money"
+        "Expenses"
+        "Savings"
+      ];
+    })
+  ];
+
+  passthru = {
+    inherit (finalAttrs) offlineCache;
+  };
+
+  meta = {
+    changelog = "https://actualbudget.org/docs/releases";
+    description = "Super fast privacy-focused app for managing your finances";
+    homepage = "https://actualbudget.org/";
+    mainProgram = "actual";
+    license = lib.licenses.mit;
+    # I don't have a GUI Mac, so I am not confident in my ability to support darwin
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+    ];
+    maintainers = [
+      lib.maintainers.PerchunPak
+    ];
+  };
+})
diff --git a/pkgs/by-name/ac/actual-server/package.nix b/pkgs/by-name/ac/actual-server/package.nix
index a38702637924..6cb075ab821e 100644
--- a/pkgs/by-name/ac/actual-server/package.nix
+++ b/pkgs/by-name/ac/actual-server/package.nix
@@ -74,7 +74,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     # Patch all references to `git` to a no-op `true`. This neuter automatic
     # translation update.
-    substituteInPlace bin/package-browser \
+    substituteInPlace bin/package-browser bin/package-electron \
       --replace-fail "git" "true"
 
     # Allow `remove-untranslated-languages` to do its job.
@@ -147,7 +147,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   passthru = {
-    inherit (finalAttrs) offlineCache;
+    inherit (finalAttrs) offlineCache env;
     inherit translations;
     tests = nixosTests.actual;
     updateScript = ./update.sh;
diff --git a/pkgs/by-name/ad/adscan/package.nix b/pkgs/by-name/ad/adscan/package.nix
index a15ee762d12e..c5090cb4dec1 100644
--- a/pkgs/by-name/ad/adscan/package.nix
+++ b/pkgs/by-name/ad/adscan/package.nix
@@ -7,7 +7,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "adscan";
-  version = "11.0.0";
+  version = "11.1.0";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -16,7 +16,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "ADScanPro";
     repo = "adscan";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CuBbppx3lTj1mCJiXO3559AJPuPUesSSdfvymm9EGW0=";
+    hash = "sha256-GMvuCdr9gA3cs5L31PHHls5uHos7VdjS9XblM6F1Z3I=";
   };
 
   pythonRelaxDeps = [ "credsweeper" ];
diff --git a/pkgs/by-name/ak/aks-mcp-server/package.nix b/pkgs/by-name/ak/aks-mcp-server/package.nix
index 49cee658330d..3d27238a9789 100644
--- a/pkgs/by-name/ak/aks-mcp-server/package.nix
+++ b/pkgs/by-name/ak/aks-mcp-server/package.nix
@@ -11,16 +11,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "aks-mcp-server";
-  version = "0.0.19";
+  version = "0.0.20";
 
   src = fetchFromGitHub {
     owner = "Azure";
     repo = "aks-mcp";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Zu/caWrTuyzS4ejJ5LTOCyLTsmJOFrkX0kUGM0zDfFs=";
+    hash = "sha256-K0BVDH0HT4kQBGMpVDtLihDCPlpcVpdGEF7f5DY8SvQ=";
   };
 
-  vendorHash = "sha256-eipcHVKKHBOey2fUGB4lf2pE/wdwGgsbYvCrvDG1JK8=";
+  vendorHash = "sha256-EdDiLibw3OXtTmAaD6PIi6xiW7+x8TUeAezdjpu8IjY=";
 
   subPackages = [ "cmd/aks-mcp" ];
 
diff --git a/pkgs/by-name/am/amberol/package.nix b/pkgs/by-name/am/amberol/package.nix
index 14ce60286c2d..490b191a0fc6 100644
--- a/pkgs/by-name/am/amberol/package.nix
+++ b/pkgs/by-name/am/amberol/package.nix
@@ -35,8 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
-    name = "amberol-${finalAttrs.version}";
+    inherit (finalAttrs) pname version src;
     hash = "sha256-OFZd9nKRqXJMHSIIP8tlSNtFAQzk/f/6SBeEvbdPVK0=";
   };
 
diff --git a/pkgs/by-name/an/angular-language-server/package.nix b/pkgs/by-name/an/angular-language-server/package.nix
index c61788c306c8..48fad603a5d3 100644
--- a/pkgs/by-name/an/angular-language-server/package.nix
+++ b/pkgs/by-name/an/angular-language-server/package.nix
@@ -15,11 +15,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "angular-language-server";
-  version = "22.0.1";
+  version = "22.1.0";
   src = fetchurl {
     name = "angular-language-server-${finalAttrs.version}.zip";
     url = "https://github.com/angular/angular/releases/download/vsix-${finalAttrs.version}/ng-template-${finalAttrs.version}.vsix";
-    hash = "sha256-IaaqFb0YLJcVqoV5QT9fZmYd5GbfQCUlK68SF76Y/dY=";
+    hash = "sha256-/PftUvaE9EjsKRc0TnF0lftOgp5fzKmR+KGhocXEMrk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/an/antigravity-cli/package.nix b/pkgs/by-name/an/antigravity-cli/package.nix
index 763777c444ee..bbbbe0e8a6f5 100644
--- a/pkgs/by-name/an/antigravity-cli/package.nix
+++ b/pkgs/by-name/an/antigravity-cli/package.nix
@@ -6,8 +6,8 @@
   versionCheckHook,
 }:
 let
-  version = "1.1.11";
-  buildId = "6181354723999744";
+  version = "1.1.13";
+  buildId = "6068529322131456";
   wholeVersion = "${version}-${buildId}";
 
   throwSystem = throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}";
@@ -15,15 +15,15 @@ let
   sourceData = {
     x86_64-linux = fetchurl {
       url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/${wholeVersion}/linux-x64/cli_linux_x64.tar.gz";
-      hash = "sha256-8kOw7R3wtXxw1n5FA76FjmppB8oLFmu8h9Rh5sJaLK0=";
+      hash = "sha256-6X92AldCzlcWQ4ON2t2jEFNsqwIX4YAbpUh6cRz8/uY=";
     };
     aarch64-linux = fetchurl {
       url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/${wholeVersion}/linux-arm/cli_linux_arm64.tar.gz";
-      hash = "sha256-m6mj3gLwDPFTcQF22hofNpC06doHEzcSLl/QYlXoPew=";
+      hash = "sha256-CcNHggD96vwkVl8s09HPlMIv3ayzWVEFK1YwVv7EFR4=";
     };
     aarch64-darwin = fetchurl {
       url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/${wholeVersion}/darwin-arm/cli_mac_arm64.tar.gz";
-      hash = "sha256-SK+7wgNOVGjmyt60Kj6XY1kSU85u5Y42WQ8bi7w4vX0=";
+      hash = "sha256-ZkgCqzy6zU1XaxDJvdYPEs6JKDBeNFFHw22Rhbugkps=";
     };
   };
 in
diff --git a/pkgs/by-name/ap/aptakube/darwin.nix b/pkgs/by-name/ap/aptakube/darwin.nix
deleted file mode 100644
index 0ce9e3b29047..000000000000
--- a/pkgs/by-name/ap/aptakube/darwin.nix
+++ /dev/null
@@ -1,36 +0,0 @@
-{
-  stdenvNoCC,
-  fetchurl,
-  undmg,
-
-  pname,
-  version,
-  meta,
-}:
-stdenvNoCC.mkDerivation {
-  inherit
-    pname
-    version
-    meta
-    ;
-
-  src = fetchurl {
-    url = "https://github.com/aptakube/aptakube/releases/download/${version}/Aptakube_${version}_universal.dmg";
-    sha256 = "89828e1ac030f9532ba24afdd91d357280b32fcc475830b6667d5066e7a576ac";
-  };
-
-  nativeBuildInputs = [ undmg ];
-
-  unpackPhase = ''
-    runHook preUnpack
-    undmg $src
-    runHook postUnpack
-  '';
-
-  installPhase = ''
-    runHook preInstall
-    mkdir -p $out/Applications
-    cp -r Aptakube.app $out/Applications/Aptakube.app
-    runHook postInstall
-  '';
-}
diff --git a/pkgs/by-name/ap/aptakube/linux.nix b/pkgs/by-name/ap/aptakube/linux.nix
deleted file mode 100644
index 52f0f164a813..000000000000
--- a/pkgs/by-name/ap/aptakube/linux.nix
+++ /dev/null
@@ -1,43 +0,0 @@
-{
-  stdenvNoCC,
-  fetchurl,
-  dpkg,
-  autoPatchelfHook,
-  webkitgtk_4_1,
-
-  pname,
-  version,
-  meta,
-}:
-stdenvNoCC.mkDerivation {
-  inherit
-    pname
-    version
-    meta
-    ;
-
-  src = fetchurl {
-    url = "https://github.com/aptakube/aptakube/releases/download/${version}/aptakube_${version}_amd64.deb";
-    sha256 = "9660c87da400dad1451f685defff774c6f5af9b3f713ad1cbd48284e965457dd";
-  };
-
-  nativeBuildInputs = [
-    autoPatchelfHook
-    dpkg
-  ];
-
-  buildInputs = [ webkitgtk_4_1 ];
-
-  unpackPhase = ''
-    runHook preUnpack
-    dpkg -X $src .
-    runHook postUnpack
-  '';
-
-  installPhase = ''
-    runHook preInstall
-    mkdir -p $out
-    cp -r usr/share usr/bin $out
-    runHook postInstall
-  '';
-}
diff --git a/pkgs/by-name/ap/aptakube/package.nix b/pkgs/by-name/ap/aptakube/package.nix
index be0b76fd852c..792507ac2a29 100644
--- a/pkgs/by-name/ap/aptakube/package.nix
+++ b/pkgs/by-name/ap/aptakube/package.nix
@@ -1,33 +1,137 @@
 {
   lib,
-  stdenv,
-  callPackage,
+  stdenvNoCC,
+  fetchurl,
+
+  autoPatchelfHook,
+  dpkg,
+  makeBinaryWrapper,
+  undmg,
+  wrapGAppsHook3,
+
+  glib-networking,
+  webkitgtk_4_1,
+
+  kubectl,
+  kubernetes-helm,
+  extraPath ? [ ],
 }:
-let
-  pname = "aptakube";
-  version = "1.13.0";
-  meta = {
-    homepage = "https://aptakube.com/";
-    description = "Modern, lightweight and multi-cluster Kubernetes GUI";
-    license = lib.licenses.unfree;
-    maintainers = [ lib.maintainers.juliamertz ];
-    platforms = lib.platforms.darwin ++ [ "x86_64-linux" ];
-    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
-  };
-in
-if stdenv.hostPlatform.isDarwin then
-  callPackage ./darwin.nix {
-    inherit
-      pname
-      version
-      meta
-      ;
-  }
-else
-  callPackage ./linux.nix {
-    inherit
-      pname
-      version
-      meta
-      ;
+
+stdenvNoCC.mkDerivation (
+  finalAttrs:
+  let
+    sources = {
+      aarch64-darwin = {
+        name = "Aptakube_${finalAttrs.version}_universal.dmg";
+        hash = "sha256-JWDwsvqZnEQc6Ne+aC2WbdMaEO20f8AEK7SlC3lEzUk=";
+      };
+      x86_64-linux = {
+        name = "aptakube_${finalAttrs.version}_amd64.deb";
+        hash = "sha256-JooC/fwy1zaIU2UAmDooejEbBmCChVrJ2rTsn0M8WaI=";
+      };
+    };
+
+    source =
+      sources.${stdenvNoCC.hostPlatform.system}
+        or (throw "aptakube: unsupported system ${stdenvNoCC.hostPlatform.system}");
+
+    runtimePath = extraPath ++ [
+      kubectl
+      kubernetes-helm
+    ];
+  in
+  {
+    pname = "aptakube";
+    version = "1.18.8";
+
+    __structuredAttrs = true;
+    strictDeps = true;
+
+    src = fetchurl {
+      url = "https://github.com/aptakube/aptakube/releases/download/${finalAttrs.version}/${source.name}";
+      inherit (source) hash;
+    };
+
+    sourceRoot = if stdenvNoCC.hostPlatform.isDarwin then "." else "root";
+
+    nativeBuildInputs =
+      lib.optionals stdenvNoCC.hostPlatform.isLinux [
+        autoPatchelfHook
+        dpkg
+        wrapGAppsHook3
+      ]
+      ++ lib.optionals stdenvNoCC.hostPlatform.isDarwin [
+        makeBinaryWrapper
+        undmg
+      ];
+
+    buildInputs = lib.optionals stdenvNoCC.hostPlatform.isLinux [
+      glib-networking
+      webkitgtk_4_1
+    ];
+
+    dontConfigure = true;
+    dontBuild = true;
+
+    installPhase =
+      if stdenvNoCC.hostPlatform.isLinux then
+        ''
+          runHook preInstall
+
+          mkdir -p $out
+          mv usr/bin usr/share $out/
+          substituteInPlace $out/share/applications/aptakube.desktop \
+            --replace-fail 'Name=aptakube' 'Name=Aptakube'
+
+          runHook postInstall
+        ''
+      else
+        ''
+          runHook preInstall
+
+          mkdir -p $out/Applications $out/bin
+          cp -R Aptakube.app $out/Applications/
+          makeWrapper $out/Applications/Aptakube.app/Contents/MacOS/Aptakube \
+            $out/bin/aptakube \
+            --suffix PATH : ${lib.makeBinPath runtimePath}
+
+          runHook postInstall
+        '';
+
+    preFixup = lib.optionalString stdenvNoCC.hostPlatform.isLinux ''
+      gappsWrapperArgs+=(--suffix PATH : ${lib.makeBinPath runtimePath})
+    '';
+
+    passthru = {
+      inherit sources;
+      updateScript = ./update.sh;
+    };
+
+    meta = {
+      description = "Multi-cluster Kubernetes UI";
+      longDescription = ''
+        Aptakube is proprietary software with a 15-day free trial.
+
+        Some operations use `kubectl` or Helm from `PATH`. If they are not in
+        `PATH`, packaged binaries will be used.
+
+        Any kubeconfig exec-auth helpers are loaded from `PATH`. Use `extraPath`
+        to modify `PATH` specifically for this package.
+      '';
+
+      homepage = "https://aptakube.com/";
+      downloadPage = "https://github.com/aptakube/aptakube/releases";
+      changelog = "https://github.com/aptakube/aptakube/releases/tag/${finalAttrs.version}";
+
+      license = lib.licenses.unfree;
+      sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+
+      mainProgram = "aptakube";
+      maintainers = with lib.maintainers; [
+        juliamertz
+        maximsmol
+      ];
+      platforms = builtins.attrNames sources;
+    };
   }
+)
diff --git a/pkgs/by-name/ap/aptakube/update.sh b/pkgs/by-name/ap/aptakube/update.sh
new file mode 100755
index 000000000000..44429f007d3a
--- /dev/null
+++ b/pkgs/by-name/ap/aptakube/update.sh
@@ -0,0 +1,108 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p common-updater-scripts curl jq nix
+# shellcheck shell=bash
+
+set \
+  -o errexit \
+  -o pipefail \
+  -o nounset \
+  -o errtrace
+
+shopt -s \
+  inherit_errexit \
+  shift_verbose
+
+curl_args=(
+  --fail
+  --location
+  --silent
+  --show-error
+)
+
+if [[ -n "${GITHUB_TOKEN:-}" ]]; then
+  curl_args+=(--user ":${GITHUB_TOKEN}")
+fi
+
+release="$(
+  curl \
+    "${curl_args[@]}" \
+    https://api.github.com/repos/aptakube/aptakube/releases/latest
+)"
+version="$(
+  jq \
+    --exit-status \
+    --raw-output \
+    '.tag_name | select(type == "string")' \
+    <<<"${release}"
+)"
+
+get_hash() {
+  local name="$1"
+  local digest
+
+  digest="$(
+    jq \
+      --arg name "${name}" \
+      --exit-status \
+      --raw-output \
+      '.assets[] | select(.name == $name) | .digest | select(type == "string" and startswith("sha256:"))' \
+      <<<"${release}"
+  )"
+
+  nix hash convert \
+    --hash-algo sha256 \
+    --to sri \
+    "${digest#sha256:}"
+}
+
+get_url() {
+  local system="$1"
+
+  nix-instantiate \
+    --argstr system "${system}" \
+    --argstr version "${version}" \
+    --eval \
+    --expr '
+      { system, version }:
+      let
+        package = (import ./. { inherit system; }).aptakube.overrideAttrs (_: {
+          inherit version;
+          __intentionallyOverridingVersion = true;
+        });
+      in
+      package.src.url
+    ' \
+    --raw
+}
+
+cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../../../.."
+printf 'Updating aptakube to %s\n' "${version}"
+
+platforms="$(
+  nix-instantiate \
+    --eval \
+    --json \
+    --strict \
+    --attr aptakube.meta.platforms
+)"
+systems="$(
+  jq \
+    --exit-status \
+    --raw-output \
+    '.[] | select(type == "string")' \
+    <<<"${platforms}"
+)"
+
+while IFS= read -r system; do
+  url="$(get_url "${system}")"
+  name="${url##*/}"
+  hash="$(get_hash "${name}")"
+
+  update-source-version \
+    aptakube \
+    "${version}" \
+    "${hash}" \
+    --ignore-same-hash \
+    --ignore-same-version \
+    --system="${system}"
+done <<<"${systems}"
diff --git a/pkgs/by-name/ar/arcanist/package.nix b/pkgs/by-name/ar/arcanist/package.nix
index 4c76f60e4fb6..287a40c7d53c 100644
--- a/pkgs/by-name/ar/arcanist/package.nix
+++ b/pkgs/by-name/ar/arcanist/package.nix
@@ -57,7 +57,7 @@ stdenv.mkDerivation {
     php
   ];
 
-  postPatch = lib.optionalString stdenv.isAarch64 ''
+  postPatch = lib.optionalString stdenv.hostPlatform.isAarch64 ''
     substituteInPlace support/xhpast/Makefile \
       --replace "-minline-all-stringops" ""
   '';
diff --git a/pkgs/by-name/ar/arity/package.nix b/pkgs/by-name/ar/arity/package.nix
index 89c88c7d0c5e..172b1abd2d87 100644
--- a/pkgs/by-name/ar/arity/package.nix
+++ b/pkgs/by-name/ar/arity/package.nix
@@ -9,7 +9,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "arity";
-  version = "0.13.0";
+  version = "0.18.0";
 
   __structuredAttrs = true;
 
@@ -17,10 +17,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "jolars";
     repo = "arity";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-PveNcJisds0obKzUDzZ409kinWvhFO8qpvwCzhfdla8=";
+    hash = "sha256-ZB/1SgJFom4U5KztBAfMztXsG0/T5tETQZxsRt6N8jY=";
   };
 
-  cargoHash = "sha256-7Mvw9reJFmBPs8Ksn/mbSbeizdT8GhwvXT06NMlCXxc=";
+  cargoHash = "sha256-uwQlfK6YXqXNRyZaYTnoEzXn21l01k1Fuw903Gn/7AU=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/as/aseprite/package.nix b/pkgs/by-name/as/aseprite/package.nix
index 39d79cd41f4c..858afc4b8ce9 100644
--- a/pkgs/by-name/as/aseprite/package.nix
+++ b/pkgs/by-name/as/aseprite/package.nix
@@ -34,21 +34,21 @@
 
 clangStdenv.mkDerivation (finalAttrs: {
   pname = "aseprite";
-  version = "1.3.18.1";
+  version = "1.3.18.2";
 
   src = fetchFromGitHub {
     owner = "aseprite";
     repo = "aseprite";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-uItjmYg21Ph2QIYFKm0N6kVwJtedH0aVKm8hSbQcJIM=";
+    hash = "sha256-Blv/OXnQSofbwzjng24HwLjEViXx13EqkAZvBSjnB3Y=";
   };
 
   asepriteStrings = fetchFromGitHub {
     owner = "aseprite";
     repo = "strings";
-    rev = "417074f649f359f98511fc87a707c276d87f5739";
-    hash = "sha256-5bB7yK4eJHhkUwGYtIFYdFXpRrBt69VBbTh7EmPFI08=";
+    rev = "b43be33343efa40c1c4bda00f985b8cd83bddf2a";
+    hash = "sha256-JxNEtWnP3RtntXM3CmJLXyByW6dri98COp2O0A6ZwBA=";
   };
 
   # Translation files are copied without overwriting existing ones to preserve
@@ -104,6 +104,10 @@ clangStdenv.mkDerivation (finalAttrs: {
     substituteInPlace src/ver/CMakeLists.txt \
       --replace-fail '"1.x-dev"' '"${finalAttrs.version}"'
 
+    # fmt 12.2 no longer exposes fmt::format through fmt/core.h.
+    substituteInPlace src/app/i18n/strings.h \
+      --replace-fail '"fmt/core.h"' '"fmt/format.h"'
+
     # Fix build on Darwin with `-Werror=format-security`
     # (NSLog requires a string-literal format)
     substituteInPlace laf/os/osx/logger.mm \
diff --git a/pkgs/by-name/at/atuin-desktop/package.nix b/pkgs/by-name/at/atuin-desktop/package.nix
index 19f73fd2d716..20742726a04a 100644
--- a/pkgs/by-name/at/atuin-desktop/package.nix
+++ b/pkgs/by-name/at/atuin-desktop/package.nix
@@ -31,7 +31,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoRoot = "./.";
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
+    inherit (finalAttrs) pname version src;
     hash = "sha256-68yQkgIVpqUo5tOcvxKh6NOkW565V94zHIZeI4q7nNA=";
   };
 
diff --git a/pkgs/by-name/aw/awk-language-server/package.nix b/pkgs/by-name/aw/awk-language-server/package.nix
index 0d16e1e253aa..d0c861ef3ade 100644
--- a/pkgs/by-name/aw/awk-language-server/package.nix
+++ b/pkgs/by-name/aw/awk-language-server/package.nix
@@ -12,7 +12,7 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  name = "awk-language-server";
+  pname = "awk-language-server";
   version = "0.10.6";
 
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/be/beammp-launcher/package.nix b/pkgs/by-name/be/beammp-launcher/package.nix
index ce29078fa3b4..8613a9f5d1b7 100644
--- a/pkgs/by-name/be/beammp-launcher/package.nix
+++ b/pkgs/by-name/be/beammp-launcher/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "beammp-launcher";
-  version = "2.8.0";
+  version = "2.8.1";
 
   src = fetchFromGitHub {
     owner = "BeamMP";
     repo = "BeamMP-Launcher";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xg6lHsfIYRC9OxrI+A7MXYCxGbZrGHb/9gR7Dno6Pwk=";
+    hash = "sha256-9zfagbDUyhUBLtZ18QNztaf1A5GMqqSa7fLAGih4y8k=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/be/beekeeper-studio/package.nix b/pkgs/by-name/be/beekeeper-studio/package.nix
index 48ef88a3e9d9..2f057b48ec80 100644
--- a/pkgs/by-name/be/beekeeper-studio/package.nix
+++ b/pkgs/by-name/be/beekeeper-studio/package.nix
@@ -40,7 +40,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "beekeeper-studio";
-  version = "5.9.3";
+  version = "6.0.0";
 
   src =
     let
@@ -54,9 +54,9 @@ stdenv.mkDerivation (finalAttrs: {
     fetchurl {
       url = "https://github.com/beekeeper-studio/beekeeper-studio/releases/download/v${finalAttrs.version}/${asset}";
       hash = selectSystem {
-        x86_64-linux = "sha256-ngVE7hjtr/a6CBASwZA3gmvk7+WR2okQy+ywXbEUQpk=";
-        aarch64-linux = "sha256-aAoputvhCHqekT+pdaZEmps4aa48gz9DDCgomJvWQSw=";
-        aarch64-darwin = "sha256-SCttC+P3ZSAlU8mBWfPpT4wAVtwcvpgePhJp+sbsvU8=";
+        x86_64-linux = "sha256-mTS5elz54AbbYF6AtPaeZvbR7ysB6a6iu+lbaTrwv5k=";
+        aarch64-linux = "sha256-KSz60oSR5UcVM5p8swRqBCZknGob7/MEMtAI2UmN2Q0=";
+        aarch64-darwin = "sha256-71xe4uWRb83WgvZvwqv52tubZ+8CKKuU1/zQnV0aSGw=";
       };
     };
 
diff --git a/pkgs/by-name/be/bella/package.nix b/pkgs/by-name/be/bella/package.nix
index 99e8b4e43b1a..93887c383316 100644
--- a/pkgs/by-name/be/bella/package.nix
+++ b/pkgs/by-name/be/bella/package.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bella";
-  version = "0.1.10";
+  version = "0.1.11";
 
   src = fetchFromGitHub {
     owner = "josephmawa";
     repo = "Bella";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DlhDaeZxNi9uXfST18eap0CWenSj+PzbKflJmITQ//M=";
+    hash = "sha256-FIk0U3z9+h3erGQP8Rc6dUAJjTf5HagH7Bzu9piHvgQ=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/be/bencher-cli/package.nix b/pkgs/by-name/be/bencher-cli/package.nix
index 8ca9025518ea..fa7d8bdc979f 100644
--- a/pkgs/by-name/be/bencher-cli/package.nix
+++ b/pkgs/by-name/be/bencher-cli/package.nix
@@ -66,6 +66,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       The Nix derivation does not compile the proprietary features.
     '';
     homepage = "https://bencher.dev";
+    changelog = "https://github.com/bencherdev/bencher/releases/tag/v${finalAttrs.version}";
     license =
       if finalAttrs.buildNoDefaultFeatures then
         lib.licenses.OR [
diff --git a/pkgs/by-name/bi/biome/package.nix b/pkgs/by-name/bi/biome/package.nix
index 7401778c1396..73dd7bf922d9 100644
--- a/pkgs/by-name/bi/biome/package.nix
+++ b/pkgs/by-name/bi/biome/package.nix
@@ -11,16 +11,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "biome";
-  version = "2.5.6";
+  version = "2.5.8";
 
   src = fetchFromGitHub {
     owner = "biomejs";
     repo = "biome";
     rev = "@biomejs/biome@${finalAttrs.version}";
-    hash = "sha256-jutNefPBi39eM/Db04IHA6RId+Un7xLBv/L7tMaC3iI=";
+    hash = "sha256-ZEOaJGrVnZRZBDuVqQgmCD07ZUvBa8COgsj0XvfKRZM=";
   };
 
-  cargoHash = "sha256-pPX9sbVYfN9k3LeTBY1SMXU1xOFlYmQCkvSg8U9dL+w=";
+  cargoHash = "sha256-mMQM7koZlKfgTPDXWan0qi2LGk2gksM2ZDC0m2/X+1M=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/bl/blast/package.nix b/pkgs/by-name/bl/blast/package.nix
index 7096ef83ed36..32480e38aac6 100644
--- a/pkgs/by-name/bl/blast/package.nix
+++ b/pkgs/by-name/bl/blast/package.nix
@@ -105,7 +105,7 @@ stdenv.mkDerivation (finalAttrs: {
     bzip2
     sqlite
   ]
-  ++ lib.optionals stdenv.isDarwin [
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
     llvmPackages.openmp
   ];
 
diff --git a/pkgs/by-name/bl/blesh/package.nix b/pkgs/by-name/bl/blesh/package.nix
index 78d9aca9f693..55a7251a0c87 100644
--- a/pkgs/by-name/bl/blesh/package.nix
+++ b/pkgs/by-name/bl/blesh/package.nix
@@ -88,7 +88,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [
       aiotter
-      hibiday
+      recutita
       matthiasbeyer
     ];
     platforms = lib.platforms.unix;
diff --git a/pkgs/by-name/bl/blobs_gg/package.nix b/pkgs/by-name/bl/blobs_gg/package.nix
index 19e429ebf54f..07dbc06250cb 100644
--- a/pkgs/by-name/bl/blobs_gg/package.nix
+++ b/pkgs/by-name/bl/blobs_gg/package.nix
@@ -10,10 +10,10 @@ let
 in
 stdenvNoCC.mkDerivation {
   pname = "blobs.gg";
-  version = "unstable-2019-07-24";
+  version = "0-unstable-2019-07-24";
 
   src = fetchurl {
-    url = "https://git.pleroma.social/pleroma/emoji-index/-/raw/${rev}/packs/blobs_gg.zip";
+    url = "https://git.pleroma.social/pleroma/emoji-index/raw/commit/${rev}/packs/blobs_gg.zip";
     hash = "sha256-OhLzoYFnjVs1hKYglUEbDWCjNRGBNZENh5kg+K3lpX8=";
   };
 
diff --git a/pkgs/by-name/bo/bootdev-cli/package.nix b/pkgs/by-name/bo/bootdev-cli/package.nix
index a3f7ea187781..3094ac5c16cd 100644
--- a/pkgs/by-name/bo/bootdev-cli/package.nix
+++ b/pkgs/by-name/bo/bootdev-cli/package.nix
@@ -7,17 +7,18 @@
   nix-update-script,
   versionCheckHook,
   writableTmpDirAsHomeHook,
+  coreutils,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "bootdev-cli";
-  version = "1.29.6";
+  version = "1.31.1";
 
   src = fetchFromGitHub {
     owner = "bootdotdev";
     repo = "bootdev";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-uoFnhcJvvY+lb8VLv0kPI8hp4H8XfQOY5R83Rj17gfw=";
+    hash = "sha256-0koZYMQxCHPtB44OYhiD9+nYAyHWXbyQd2xhdqnOqEw=";
   };
 
   vendorHash = "sha256-ZDioEU5uPCkd+kC83cLlpgzyOsnpj2S7N+lQgsQb8uY=";
@@ -32,6 +33,14 @@ buildGoModule (finalAttrs: {
     writableTmpDirAsHomeHook
   ];
 
+  # TestGetLatestVersionHasOverallTimeout writes a fake go helper that runs
+  # /bin/sleep; that path is missing in the Nix sandbox, and the test also
+  # resets PATH so a bare "sleep" would not help. Point at store sleep.
+  postPatch = ''
+    substituteInPlace version/version_test.go \
+      --replace-fail 'exec /bin/sleep 5' 'exec ${lib.getExe' coreutils "sleep"} 5'
+  '';
+
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     for shell in bash fish zsh; do
       installShellCompletion --cmd bootdev --"$shell" <($out/bin/bootdev completion "$shell")
@@ -42,6 +51,9 @@ buildGoModule (finalAttrs: {
   versionCheckProgram = "${placeholder "out"}/bin/bootdev";
   doInstallCheck = true;
 
+  # checks tests use httptest.NewServer (bind localhost)
+  __darwinAllowLocalNetworking = true;
+
   passthru.updateScript = nix-update-script { };
 
   meta = {
diff --git a/pkgs/by-name/bo/bottles-unwrapped/package.nix b/pkgs/by-name/bo/bottles-unwrapped/package.nix
index f250c351bf1a..4e4609ff6b5f 100644
--- a/pkgs/by-name/bo/bottles-unwrapped/package.nix
+++ b/pkgs/by-name/bo/bottles-unwrapped/package.nix
@@ -32,6 +32,7 @@
   obs-studio-plugins,
   nix-update-script,
   removeWarningPopup ? false,
+  withObsVkCapture ? false,
 }:
 
 python3Packages.buildPythonApplication (finalAttrs: {
@@ -114,13 +115,13 @@ python3Packages.buildPythonApplication (finalAttrs: {
       mangohud
       vmtouch
       fvs2
-      obs-studio-plugins.obs-vkcapture
 
       # Undocumented (subprocess.Popen())
       lsb-release
       pciutils
       procps
-    ];
+    ]
+    ++ lib.optional withObsVkCapture obs-studio-plugins.obs-vkcapture;
 
   pyproject = false;
   dontWrapGApps = true; # prevent double wrapping
diff --git a/pkgs/by-name/bo/bottles/package.nix b/pkgs/by-name/bo/bottles/package.nix
index b8391ec48998..18294079be11 100644
--- a/pkgs/by-name/bo/bottles/package.nix
+++ b/pkgs/by-name/bo/bottles/package.nix
@@ -5,6 +5,7 @@
   extraPkgs ? pkgs: [ ],
   extraLibraries ? pkgs: [ ],
   removeWarningPopup ? false,
+  withObsVkCapture ? false,
 }:
 
 let
@@ -17,7 +18,7 @@ let
       pkgs:
       with pkgs;
       [
-        (bottles-unwrapped.override { inherit removeWarningPopup; })
+        (bottles-unwrapped.override { inherit removeWarningPopup withObsVkCapture; })
         # This only allows to enable the toggle, vkBasalt won't work if not installed with environment.systemPackages (or nix-env)
         # See https://github.com/bottlesdevs/Bottles/issues/2401
         vkbasalt
diff --git a/pkgs/by-name/br/breitbandmessung/sources.nix b/pkgs/by-name/br/breitbandmessung/sources.nix
index ce7b303d73ee..25da7cb0580c 100644
--- a/pkgs/by-name/br/breitbandmessung/sources.nix
+++ b/pkgs/by-name/br/breitbandmessung/sources.nix
@@ -1,11 +1,11 @@
 {
-  version = "3.12.0";
+  version = "3.12.1";
   x86_64-linux = {
-    url = "https://download.breitbandmessung.de/bbm/Breitbandmessung-3.12.0-linux.deb";
-    sha256 = "sha256-3wQVUNTjFgoFBpy0Gl1r/FEdgqRrdjM3SFqPpl6z6O4=";
+    url = "https://download.breitbandmessung.de/bbm/Breitbandmessung-3.12.1-linux.deb";
+    sha256 = "sha256-uUgzGk6N8Py91vus5Yh3DmK0xh5+J5xqD3nvWB3ggPE=";
   };
   aarch64-darwin = {
-    url = "https://download.breitbandmessung.de/bbm/Breitbandmessung-3.12.0-mac.dmg";
-    sha256 = "sha256-QuJaNTyBAVQb3SCHNjnhd5klxTrH/9/J56Mxl6l/sKs=";
+    url = "https://download.breitbandmessung.de/bbm/Breitbandmessung-3.12.1-mac.dmg";
+    sha256 = "sha256-8zzsQ86udXf4NeTYrxgrb28N5wwRaYrAAtZ5H/1T5w4=";
   };
 }
diff --git a/pkgs/by-name/bu/buildbox/package.nix b/pkgs/by-name/bu/buildbox/package.nix
index 7ffd120dbced..0e0e8be70684 100644
--- a/pkgs/by-name/bu/buildbox/package.nix
+++ b/pkgs/by-name/bu/buildbox/package.nix
@@ -23,13 +23,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "buildbox";
-  version = "1.4.15";
+  version = "1.4.17";
 
   src = fetchFromGitLab {
     owner = "BuildGrid";
     repo = "buildbox/buildbox";
     tag = finalAttrs.version;
-    hash = "sha256-V/dKo/ynKL37NNCY36D5NvepeIbE470qg3qPKH1jLoY=";
+    hash = "sha256-AnvwnBcc6LlJ9TlepLFNhvyinK0NYwjBPFQLqUZSdCk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ca/calibre/dont_build_unrar_plugin.patch b/pkgs/by-name/ca/calibre/dont_build_unrar_plugin.patch
deleted file mode 100644
index e501844516f7..000000000000
--- a/pkgs/by-name/ca/calibre/dont_build_unrar_plugin.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/src/calibre/ebooks/metadata/archive.py b/src/calibre/ebooks/metadata/archive.py
-index 83a549d3b6..a4c5fe5ce5 100644
---- a/src/calibre/ebooks/metadata/archive.py
-+++ b/src/calibre/ebooks/metadata/archive.py
-@@ -127,7 +127,7 @@ class ArchiveExtract(FileTypePlugin):
-     name = 'Archive Extract'
-     author = 'Kovid Goyal'
-     description = _('Extract common e-book formats from archive files (ZIP/RAR/7z). Also try to autodetect if they are actually CBZ/CBR/CB7 files.')
--    file_types = {'zip', 'rar', '7z'}
-+    file_types = {'zip', '7z'}
-     supported_platforms = ['windows', 'osx', 'linux']
-     on_import = True
- 
diff --git a/pkgs/by-name/ca/calibre/package.nix b/pkgs/by-name/ca/calibre/package.nix
index 0fc66990b504..0b06900d6ab9 100644
--- a/pkgs/by-name/ca/calibre/package.nix
+++ b/pkgs/by-name/ca/calibre/package.nix
@@ -29,6 +29,7 @@
   qt6,
   speechd-minimal,
   sqlite,
+  versionCheckHook,
   xdg-utils,
   wrapGAppsHook3,
   popplerSupport ? true,
@@ -42,6 +43,9 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "calibre";
   version = "9.13.0";
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   src = fetchurl {
     url = "https://download.calibre-ebook.com/${finalAttrs.version}/calibre-${finalAttrs.version}.tar.xz";
     hash = "sha256-ONfYjXq8vGLG/jV1SD+1STzpYtJhqXihpNtNWLxLN5M=";
@@ -64,8 +68,17 @@ stdenv.mkDerivation (finalAttrs: {
         url = "https://github.com/debian-calibre/calibre/raw/refs/tags/debian/${debian-tag}/debian/patches/hardening/0007-Hardening-Qt-code.patch";
         hash = "sha256-ItJalYmBhK4Qgz6QDGbPpBMaa6oGQetQvg5ie3oxFMM=";
       })
-    ]
-    ++ lib.optional (!unrarSupport) ./dont_build_unrar_plugin.patch;
+    ];
+
+  postPatch =
+    lib.optionalString (!unrarSupport)
+      # Don't build the unrar plugin
+      ''
+        substituteInPlace src/calibre/ebooks/metadata/archive.py \
+          --replace-fail \
+            "file_types = {'zip', 'rar', '7z'}" \
+            "file_types = {'zip', '7z'}"
+      '';
 
   prePatch = ''
     sed -i "s@\[tool.sip.project\]@[tool.sip.project]\nsip-include-dirs = [\"${python3Packages.pyqt6}/${python3Packages.python.sitePackages}/PyQt6/bindings\"]@g" \
@@ -82,10 +95,14 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     cmake
     pkg-config
+    # `pdftotext`/`pdftohtml` are run by the test suite
+    poppler-utils
     python3Packages.python
     qt6.qmake
     qt6.wrapQtAppsHook
     wrapGAppsHook3
+    # `xdg-icon-resource` & co. are run by the desktop integration setup in `installPhase`
+    xdg-utils
   ];
 
   buildInputs = [
@@ -236,6 +253,11 @@ stdenv.mkDerivation (finalAttrs: {
   installCheckInputs = with python3Packages; [
     psutil
   ];
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  # `calibre --version` drops a trailing `.0`, so check against a binary reporting the full version
+  versionCheckProgram = "${placeholder "out"}/bin/ebook-convert";
   installCheckPhase =
     let
       excludedTestNames = [
@@ -245,6 +267,10 @@ stdenv.mkDerivation (finalAttrs: {
         "test_import_of_all_python_modules" # explores actual file paths, gets confused
         "test_websocket_basic" # flaky
 
+        # Flaky: asserts on page-granularity RSS deltas, which are 0 (assertion skipped)
+        # on most runs and allocator noise otherwise
+        "test_mem_leaks"
+
         # hangs with cuda enabled, also:
         # eglInitialize: Failed to get system egl display
         # Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory
@@ -289,6 +315,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     homepage = "https://calibre-ebook.com";
     description = "Comprehensive e-book software";
+    mainProgram = "calibre";
     longDescription = ''
       calibre is a powerful and easy to use e-book manager. Users say it’s
       outstanding and a must-have. It’ll allow you to do nearly everything and
diff --git a/pkgs/by-name/ca/cargo-chef/package.nix b/pkgs/by-name/ca/cargo-chef/package.nix
index 9936be8c8032..23f14bdbec5f 100644
--- a/pkgs/by-name/ca/cargo-chef/package.nix
+++ b/pkgs/by-name/ca/cargo-chef/package.nix
@@ -6,14 +6,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-chef";
-  version = "0.1.77";
+  version = "0.1.78";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-R2on81B11ploV9QwiV5VCvRUCLQWbP21dazNliqkhGA=";
+    hash = "sha256-gFtmKaznJNlmhlCzpHraEdZfDV5fAwYVphJo29qcftw=";
   };
 
-  cargoHash = "sha256-iOZjyqoykCwrNsXN7nMF6deuSSlyD6r2+atxPeNmX2c=";
+  cargoHash = "sha256-m29qIc/TsmropBMFeyEPIWwQgFh9PKqUexFRrbGFHSg=";
 
   meta = {
     description = "Cargo-subcommand to speed up Rust Docker builds using Docker layer caching";
diff --git a/pkgs/by-name/ca/cargo-flamegraph/package.nix b/pkgs/by-name/ca/cargo-flamegraph/package.nix
index 7d71c6786d68..f880f9c15e8e 100644
--- a/pkgs/by-name/ca/cargo-flamegraph/package.nix
+++ b/pkgs/by-name/ca/cargo-flamegraph/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-flamegraph";
-  version = "0.6.13";
+  version = "0.6.14";
 
   src = fetchFromGitHub {
     owner = "flamegraph-rs";
     repo = "flamegraph";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-XB0/ltiiYZpOlQWoyEPyNFhHqolDgIq0waIjQwT3L88=";
+    sha256 = "sha256-tjphY9qZaKkqrbwm8lszyyIBpaKZx644LudBq81qngU=";
   };
 
-  cargoHash = "sha256-OxPvye1HjcQOazAWn7VIa+twWC7uKXeyXkicPiWVe6I=";
+  cargoHash = "sha256-mSItpfrGRFL9L3Rlqsvx+FdYyJL8rcWWS8Abyixto7c=";
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ makeWrapper ];
 
diff --git a/pkgs/by-name/ca/cargo-rdme/package.nix b/pkgs/by-name/ca/cargo-rdme/package.nix
index 6cea4afc2800..cc681ad2c34c 100644
--- a/pkgs/by-name/ca/cargo-rdme/package.nix
+++ b/pkgs/by-name/ca/cargo-rdme/package.nix
@@ -6,14 +6,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-rdme";
-  version = "2.1.0";
+  version = "2.2.0";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-U5JD3VMuIagaMKxHoRRhbFyl7keuaJ0zNzD3Hjhxe/Y=";
+    hash = "sha256-f0MxJVWTcBNiURJFE60Xbv0/xcj51ZoZmJEzvIP79f4=";
   };
 
-  cargoHash = "sha256-Es1K4MmThAS9whsfSQ8dUtjPjunCDCQc5FU8vsbeJPw=";
+  cargoHash = "sha256-U2tw/tzFSktrKAIUk4fxyRCMVuw98uHXDkZ/YpC2aCA=";
 
   meta = {
     description = "Cargo command to create the README.md from your crate's documentation";
diff --git a/pkgs/by-name/ca/cargo-shear/package.nix b/pkgs/by-name/ca/cargo-shear/package.nix
index 4d10d49e4521..4905f7e5dc59 100644
--- a/pkgs/by-name/ca/cargo-shear/package.nix
+++ b/pkgs/by-name/ca/cargo-shear/package.nix
@@ -8,15 +8,15 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-shear";
-  version = "1.13.3";
+  version = "1.13.4";
 
   src = fetchCrate {
     pname = "cargo-shear";
     version = finalAttrs.version;
-    hash = "sha256-Qaq3nBZZR0biG5kVL15zhI8GwLEWBNzgeD3rHeZZOeU=";
+    hash = "sha256-bTTNiDWkbyjxFo59Hkeah23lQEGiuH5Xrm6z7SUNtoQ=";
   };
 
-  cargoHash = "sha256-3YMdOCCK+rVx0XZfBqiMAw+aep1TBU5Ok6//c433h4o=";
+  cargoHash = "sha256-Mhxrcc9ErTYIV+yuIROuMdhbxrFdZZ2yAAXK0WRWcRI=";
 
   env = {
     # https://github.com/Boshen/cargo-shear/blob/v1.6.2/src/lib.rs#L51-L54
diff --git a/pkgs/by-name/ca/carps-cups/package.nix b/pkgs/by-name/ca/carps-cups/package.nix
index efed07a5e156..6b27271c275e 100644
--- a/pkgs/by-name/ca/carps-cups/package.nix
+++ b/pkgs/by-name/ca/carps-cups/package.nix
@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation {
   pname = "carps-cups";
-  version = "unstable-2018-03-05";
+  version = "0-unstable-2018-03-05";
 
   src = fetchFromGitHub {
     owner = "ondrej-zary";
@@ -35,8 +35,8 @@ stdenv.mkDerivation {
 
   meta = {
     description = "CUPS Linux drivers for Canon printers";
-    homepage = "https://www.canon.com/";
-    license = lib.licenses.gpl3Plus;
+    homepage = "https://github.com/ondrej-zary/carps-cups";
+    license = lib.licenses.gpl3Only;
     broken = stdenv.hostPlatform.isDarwin;
     maintainers = with lib.maintainers; [
       ewok
diff --git a/pkgs/by-name/ce/ceph/patches/0002-s3select-std-span.patch b/pkgs/by-name/ce/ceph/patches/0002-s3select-std-span.patch
new file mode 100644
index 000000000000..418d384252dd
--- /dev/null
+++ b/pkgs/by-name/ce/ceph/patches/0002-s3select-std-span.patch
@@ -0,0 +1,98 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Gaetan Lepage <gaetan.lepage00@gmail.com>
+Date: Sun, 9 Aug 2026 21:46:14 +0000
+Subject: [PATCH] s3select: use std::span in the vendored parquet encryption
+ headers
+
+arrow-cpp 24 dropped the `arrow/util/span.h` header and switched the
+parquet encryption API from `arrow::util::span` to `std::span`.
+
+The vendored copies of the parquet encryption headers that s3select
+carries for arrow >= 20 still target the old API, so building against
+arrow-cpp 24 fails. Include `<span>` and use `std::span` instead.
+---
+ src/s3select/include/encryption_internal_20.h | 28 +++++++++----------
+ .../include/internal_file_decryptor_20.h      |  5 ++--
+ 2 files changed, 17 insertions(+), 16 deletions(-)
+
+diff --git a/src/s3select/include/encryption_internal_20.h b/src/s3select/include/encryption_internal_20.h
+index 062527495..005ed332f 100644
+--- a/src/s3select/include/encryption_internal_20.h
++++ b/src/s3select/include/encryption_internal_20.h
+@@ -18,10 +18,10 @@
+ #pragma once
+ 
+ #include <memory>
++#include <span>
+ #include <string>
+ #include <vector>
+ 
+-#include "arrow/util/span.h"
+ #include "parquet/properties.h"
+ #include "parquet/types.h"
+ 
+@@ -62,17 +62,17 @@ class PARQUET_EXPORT AesEncryptor {
+ 
+   /// Encrypts plaintext with the key and aad. Key length is passed only for validation.
+   /// If different from value in constructor, exception will be thrown.
+-  int32_t Encrypt(::arrow::util::span<const uint8_t> plaintext,
+-                  ::arrow::util::span<const uint8_t> key,
+-                  ::arrow::util::span<const uint8_t> aad,
+-                  ::arrow::util::span<uint8_t> ciphertext);
++  int32_t Encrypt(std::span<const uint8_t> plaintext,
++                  std::span<const uint8_t> key,
++                  std::span<const uint8_t> aad,
++                  std::span<uint8_t> ciphertext);
+ 
+   /// Encrypts plaintext footer, in order to compute footer signature (tag).
+-  int32_t SignedFooterEncrypt(::arrow::util::span<const uint8_t> footer,
+-                              ::arrow::util::span<const uint8_t> key,
+-                              ::arrow::util::span<const uint8_t> aad,
+-                              ::arrow::util::span<const uint8_t> nonce,
+-                              ::arrow::util::span<uint8_t> encrypted_footer);
++  int32_t SignedFooterEncrypt(std::span<const uint8_t> footer,
++                              std::span<const uint8_t> key,
++                              std::span<const uint8_t> aad,
++                              std::span<const uint8_t> nonce,
++                              std::span<uint8_t> encrypted_footer);
+ 
+  private:
+   // PIMPL Idiom
+@@ -107,10 +107,10 @@ class PARQUET_EXPORT AesDecryptor {
+   /// validation. If different from value in constructor, exception will be thrown.
+   /// The caller is responsible for ensuring that the plaintext buffer is at least as
+   /// large as PlaintextLength(ciphertext_len).
+-  int32_t Decrypt(::arrow::util::span<const uint8_t> ciphertext,
+-                  ::arrow::util::span<const uint8_t> key,
+-                  ::arrow::util::span<const uint8_t> aad,
+-                  ::arrow::util::span<uint8_t> plaintext);
++  int32_t Decrypt(std::span<const uint8_t> ciphertext,
++                  std::span<const uint8_t> key,
++                  std::span<const uint8_t> aad,
++                  std::span<uint8_t> plaintext);
+ 
+  private:
+   // PIMPL Idiom
+diff --git a/src/s3select/include/internal_file_decryptor_20.h b/src/s3select/include/internal_file_decryptor_20.h
+index cc0e315e0..2573cb99b 100644
+--- a/src/s3select/include/internal_file_decryptor_20.h
++++ b/src/s3select/include/internal_file_decryptor_20.h
+@@ -19,6 +19,7 @@
+ 
+ #include <memory>
+ #include <mutex>
++#include <span>
+ #include <string>
+ #include <vector>
+ 
+@@ -50,8 +51,8 @@ class PARQUET_EXPORT Decryptor {
+ 
+   [[nodiscard]] int32_t PlaintextLength(int32_t ciphertext_len) const;
+   [[nodiscard]] int32_t CiphertextLength(int32_t plaintext_len) const;
+-  int32_t Decrypt(::arrow::util::span<const uint8_t> ciphertext,
+-                  ::arrow::util::span<uint8_t> plaintext);
++  int32_t Decrypt(std::span<const uint8_t> ciphertext,
++                  std::span<uint8_t> plaintext);
+ 
+  private:
+   std::unique_ptr<encryption::AesDecryptor> aes_decryptor_;
diff --git a/pkgs/by-name/ce/ceph/python-common.nix b/pkgs/by-name/ce/ceph/python-common.nix
index 6d2dae9720de..5782719df6b2 100644
--- a/pkgs/by-name/ce/ceph/python-common.nix
+++ b/pkgs/by-name/ce/ceph/python-common.nix
@@ -4,15 +4,25 @@
   ceph-src,
 }:
 
-ceph-python.pkgs.buildPythonPackage {
-  pname = "ceph-common";
+ceph-python.pkgs.buildPythonPackage (finalAttrs: {
+  pname = "ceph";
   inherit (ceph-src) version;
   src = ceph-src;
 
   pyproject = true;
+  __structuredAttrs = true;
 
   sourceRoot = "${ceph-src.name}/src/python-common";
 
+  postPatch =
+    # upstream hardcodes a placeholder version which does not track the Ceph release
+    ''
+      substituteInPlace setup.py \
+        --replace-fail \
+          "version='1.0.0'" \
+          "version='${finalAttrs.version}'"
+    '';
+
   build-system = with ceph-python.pkgs; [
     setuptools
   ];
@@ -21,6 +31,8 @@ ceph-python.pkgs.buildPythonPackage {
     pyyaml
   ];
 
+  pythonImportsCheck = [ "ceph" ];
+
   nativeCheckInputs = with ceph-python.pkgs; [
     pytestCheckHook
   ];
@@ -31,4 +43,4 @@ ceph-python.pkgs.buildPythonPackage {
   ];
 
   meta = ceph-meta "Ceph common module for code shared by manager modules";
-}
+})
diff --git a/pkgs/by-name/ce/ceph/src.nix b/pkgs/by-name/ce/ceph/src.nix
index f5280271b250..acac0d1278be 100644
--- a/pkgs/by-name/ce/ceph/src.nix
+++ b/pkgs/by-name/ce/ceph/src.nix
@@ -23,6 +23,11 @@ applyPatches (final: {
       stripLen = 1;
       hash = "sha256-0jn5X4jIdluCufFXWHeO6skMz6XQpliHkC1tPLK6dbk=";
     })
+    # arrow-cpp 24 dropped the `arrow/util/span.h` header and switched its
+    # parquet encryption API from `arrow::util::span` to `std::span`.
+    # Must be applied on top of the s3select patch above, which introduces the
+    # vendored headers this touches.
+    ./patches/0002-s3select-std-span.patch
     # fixes issues when python3 is not on the PATH
     # See: https://github.com/ceph/ceph/pull/67904
     ./patches/0001-mgr-python-interpreter.patch
diff --git a/pkgs/by-name/ch/chance/package.nix b/pkgs/by-name/ch/chance/package.nix
index 310994e29800..5ed6bf072f4d 100644
--- a/pkgs/by-name/ch/chance/package.nix
+++ b/pkgs/by-name/ch/chance/package.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
+    inherit (finalAttrs) pname version src;
     hash = "sha256-ObT3l/Exk6UzUGmzCed7mJ7hVzg8CsQIT3fe1RIUfIM=";
   };
 
diff --git a/pkgs/by-name/ch/checkmate/package.nix b/pkgs/by-name/ch/checkmate/package.nix
index 5c5c23b600f9..9699ecf5017f 100644
--- a/pkgs/by-name/ch/checkmate/package.nix
+++ b/pkgs/by-name/ch/checkmate/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "checkmate";
-  version = "1.3.3";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "adedayo";
     repo = "checkmate";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-FxBDeFdLORh76oHqrB+NXhz2nVH4bHJEF7ioSx+fngM=";
+    hash = "sha256-9RgX0jWXMPRcTz8kGKNHnQLJDiKqVh6ugmgXJapc99Q=";
   };
 
-  vendorHash = "sha256-RM1jgnnCdGb06Uu7xoujjVjhYZSjGozesg+DFOjib1I=";
+  vendorHash = "sha256-JJR0+fnERLfUIxyfdb2jlH9xHsyvfyycVazoZ3RE4C8=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/ch/chiri/package.nix b/pkgs/by-name/ch/chiri/package.nix
index ffa912d6876d..50d10beedcb0 100644
--- a/pkgs/by-name/ch/chiri/package.nix
+++ b/pkgs/by-name/ch/chiri/package.nix
@@ -41,21 +41,21 @@ rustPlatform.buildRustPackage (
   in
   {
     pname = "chiri";
-    version = "0.9.2";
+    version = "1.0.0";
 
     src = fetchFromGitHub {
       owner = "chiriapp";
       repo = "chiri";
       tag = "app-v${finalAttrs.version}";
-      hash = "sha256-zBv/egEvmsZXklhKtN5fd2DOKH+UWcaGUUkFxz0G+JI=";
+      hash = "sha256-ASmDHMlp+jNA/8uJ78SLv/2plG41KYkKdel2WpMGwq8=";
     };
 
-    cargoHash = "sha256-69r9ILhSov7A9zdWcPphGMXur/8lYyZYo7qSGPW9IzM=";
+    cargoHash = "sha256-BeEpTFKWr81vNBUhHOnfrJ/yNgpZGDExnaxvIbwkBMs=";
 
     pnpmDeps = fetchPnpmDeps {
       inherit (finalAttrs) pname version src;
       pnpm = pnpm-patched;
-      hash = "sha256-1S1XR/E611LGivXpIK0kvkvXWPNqDzvFKPT7a1Qu1zg=";
+      hash = "sha256-IQgYbkGsPC0TbqcDxhOgVWFmpxprCCwrQI7QJx4IpAc=";
       fetcherVersion = 4;
     };
 
diff --git a/pkgs/by-name/ch/chirpstack-mqtt-forwarder/package.nix b/pkgs/by-name/ch/chirpstack-mqtt-forwarder/package.nix
index 93dfb45c5c24..020d80780142 100644
--- a/pkgs/by-name/ch/chirpstack-mqtt-forwarder/package.nix
+++ b/pkgs/by-name/ch/chirpstack-mqtt-forwarder/package.nix
@@ -9,16 +9,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "chirpstack-mqtt-forwarder";
-  version = "4.6.0";
+  version = "4.6.1";
 
   src = fetchFromGitHub {
     owner = "chirpstack";
     repo = "chirpstack-mqtt-forwarder";
     rev = "v${version}";
-    hash = "sha256-frEwQrGfB1J7ZY5jSkmgAyyCJwWUyu29QuZqMWlOPSk=";
+    hash = "sha256-xt94DxiDkyS0o9sSV6ye1vRi08ey4rmh1acpNI38fUE=";
   };
 
-  cargoHash = "sha256-5/8f5eSLfCu8fOfT+jTEfJj+fSB6rJt34C6eJwyFIfo=";
+  cargoHash = "sha256-qGN6AhPV6EOEo5xdwlHCENUmKzWhquOXCvXP7X0Y2WE=";
 
   nativeBuildInputs = [ protobuf ];
 
diff --git a/pkgs/by-name/ch/chrony/package.nix b/pkgs/by-name/ch/chrony/package.nix
index 9a8cda9e9610..892ae4217962 100644
--- a/pkgs/by-name/ch/chrony/package.nix
+++ b/pkgs/by-name/ch/chrony/package.nix
@@ -77,7 +77,7 @@ stdenv.mkDerivation (finalAttrs: {
         darwin
         illumos
       ];
-    broken = stdenv.isDarwin;
+    broken = stdenv.hostPlatform.isDarwin;
     maintainers = with lib.maintainers; [
       thoughtpolice
       vifino
diff --git a/pkgs/by-name/cl/clamav/package.nix b/pkgs/by-name/cl/clamav/package.nix
index e699e3fa2c5f..9966d9f1f6b2 100644
--- a/pkgs/by-name/cl/clamav/package.nix
+++ b/pkgs/by-name/cl/clamav/package.nix
@@ -26,11 +26,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "clamav";
-  version = "1.5.2";
+  version = "1.5.4";
 
   src = fetchurl {
     url = "https://www.clamav.net/downloads/production/clamav-${finalAttrs.version}.tar.gz";
-    hash = "sha256-80AYzyLwW92dGhV0ygcZPj4DDKUgUMPlwiDiOjIxSWU=";
+    hash = "sha256-GvEReiKPG1vH+pGg2rw3hIqZ59JRiOm+gEMzLOch39M=";
   };
 
   patches = [
diff --git a/pkgs/by-name/cl/clapgrep/package.nix b/pkgs/by-name/cl/clapgrep/package.nix
index 31325d53b528..10ea06dc0f4b 100644
--- a/pkgs/by-name/cl/clapgrep/package.nix
+++ b/pkgs/by-name/cl/clapgrep/package.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
+    inherit (finalAttrs) pname version src;
     hash = "sha256-iNGYFyAF3Qo6x2VaBsyrLTSYPn6OZ6TWfXDTXqbovhE=";
   };
 
diff --git a/pkgs/by-name/cl/cliamp/package.nix b/pkgs/by-name/cl/cliamp/package.nix
index 7aed65a237b4..25812ca0bb5f 100644
--- a/pkgs/by-name/cl/cliamp/package.nix
+++ b/pkgs/by-name/cl/cliamp/package.nix
@@ -16,13 +16,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "cliamp";
-  version = "1.62.0";
+  version = "1.63.1";
 
   src = fetchFromGitHub {
     owner = "bjarneo";
     repo = "cliamp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gGTSU4J3U9aojcfK9lE2qNDtye9N8WfJi0pIVk0ndJQ=";
+    hash = "sha256-FnuopBWRXDwKrDbHbX1qtMxP3Lm3C5Wi2ECP2TRHW/o=";
   };
 
   vendorHash = "sha256-KYjP6qEINdSlcDSEMKxMwDfXzuQPAQSe4oZh+o4PrFs=";
diff --git a/pkgs/by-name/cl/clickhouse/package.nix b/pkgs/by-name/cl/clickhouse/package.nix
index 8c38f87f27cd..48dcfad383ca 100644
--- a/pkgs/by-name/cl/clickhouse/package.nix
+++ b/pkgs/by-name/cl/clickhouse/package.nix
@@ -1,6 +1,6 @@
 import ./generic.nix {
-  version = "26.7.1.1315-stable";
-  rev = "a6156303df65c307bdb8b66e9e9cc5637346a6b8";
-  hash = "sha256-jCUSLYmhRLIUvDw3JYDtqmcjW92aJBzfFHyCAtxvlsY=";
+  version = "26.7.3.19-stable";
+  rev = "c3c4a420478c7e8fbbde863bba1b0dc4ae0eec6b";
+  hash = "sha256-kPQhcObSNl967MQF2OrMf0+QH4cjXOixRZQ/aajRCVc=";
   lts = false;
 }
diff --git a/pkgs/by-name/cl/clj-kondo/package.nix b/pkgs/by-name/cl/clj-kondo/package.nix
index c341414d1b21..34a45e30faa3 100644
--- a/pkgs/by-name/cl/clj-kondo/package.nix
+++ b/pkgs/by-name/cl/clj-kondo/package.nix
@@ -6,11 +6,11 @@
 
 buildGraalvmNativeImage (finalAttrs: {
   pname = "clj-kondo";
-  version = "2026.08.03";
+  version = "2026.08.04";
 
   src = fetchurl {
     url = "https://github.com/clj-kondo/clj-kondo/releases/download/v${finalAttrs.version}/clj-kondo-${finalAttrs.version}-standalone.jar";
-    sha256 = "sha256-EXZJtX1855Tz8m7a9gxI1+DGw9zbPF0oVgX0ZoMuKmg=";
+    sha256 = "sha256-iElpFiQzzKwbYKi7gIRXc81C38ix3s4vvuEwcP0gos0=";
   };
 
   extraNativeImageBuildArgs = [
diff --git a/pkgs/by-name/cl/cloudquery/package.nix b/pkgs/by-name/cl/cloudquery/package.nix
index fb602644e68a..0d31291d2dea 100644
--- a/pkgs/by-name/cl/cloudquery/package.nix
+++ b/pkgs/by-name/cl/cloudquery/package.nix
@@ -9,19 +9,19 @@
 
 buildGoModule (finalAttrs: {
   pname = "cloudquery";
-  version = "6.41.0";
+  version = "6.41.1";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "cloudquery";
     repo = "cloudquery";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ybHyZnJTtOacywgjJ+PiH8KJNn1DgBNJ4yMMtu4y/vw=";
+    hash = "sha256-7NM9EFkvQRXp0gHvK1/9EhAoPrNf/g0yCXaVtEMGloQ=";
   };
 
   modRoot = "cli";
 
-  vendorHash = "sha256-zXYYheZtWFuOZ/9AH+h/Qjf4+UZ6RRb9grk/mrJZxTU=";
+  vendorHash = "sha256-uAe+zbRtMfFU1CH5D9wzlO7Sx/ckkziQIxecgwDM+Kk=";
 
   subPackages = [
     "."
diff --git a/pkgs/by-name/co/coc-rust-analyzer/package.nix b/pkgs/by-name/co/coc-rust-analyzer/package.nix
index 71710a3d9fff..98d53b5d158b 100644
--- a/pkgs/by-name/co/coc-rust-analyzer/package.nix
+++ b/pkgs/by-name/co/coc-rust-analyzer/package.nix
@@ -7,13 +7,13 @@
 
 buildNpmPackage {
   pname = "coc-rust-analyzer";
-  version = "0-unstable-2026-08-01";
+  version = "0-unstable-2026-08-11";
 
   src = fetchFromGitHub {
     owner = "fannheyward";
     repo = "coc-rust-analyzer";
-    rev = "a61a0231ca424760a5c5a7498e52dfb16132d386";
-    hash = "sha256-zMYOrdnpSI3uQuO3qb+SPcAw3lVhBPev5LXcUJ6cw6s=";
+    rev = "f61f4f712c9902ea6362c73e25e70ec552deb0e5";
+    hash = "sha256-Hm3TGc/6DPEqGwZ1KIHFlCP0BipJCoaKBg05cnjVv04=";
   };
 
   npmDepsHash = "sha256-Td6TdFxrWTZE+2NKxTABChAB/YaN8MjL/uemda+AYfc=";
diff --git a/pkgs/by-name/co/codeql/package.nix b/pkgs/by-name/co/codeql/package.nix
index 89504db1a450..af5c32f4ef71 100644
--- a/pkgs/by-name/co/codeql/package.nix
+++ b/pkgs/by-name/co/codeql/package.nix
@@ -15,7 +15,7 @@
 
 stdenv.mkDerivation rec {
   pname = "codeql";
-  version = "2.25.6";
+  version = "2.26.3";
 
   dontConfigure = true;
   dontBuild = true;
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
 
   src = fetchzip {
     url = "https://github.com/github/codeql-cli-binaries/releases/download/v${version}/codeql.zip";
-    hash = "sha256-1VLmiheNtN6EkPZfgP35hnAiIKhpnuFhigQd6W5DbxU=";
+    hash = "sha256-WXiiTl1nsKP8EVI84H8Pb4JeB0MUSdkhOJF/K0Vy1QE=";
   };
 
   nativeBuildInputs = [
@@ -61,7 +61,10 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Semantic code analysis engine";
     homepage = "https://codeql.github.com";
-    maintainers = [ lib.maintainers.dump_stack ];
+    maintainers = with lib.maintainers; [
+      dump_stack
+      tree-sapii
+    ];
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
     license = lib.licenses.unfree;
   };
diff --git a/pkgs/by-name/co/comfyui/package.nix b/pkgs/by-name/co/comfyui/package.nix
index f540d6a23797..85aff9f52f0b 100644
--- a/pkgs/by-name/co/comfyui/package.nix
+++ b/pkgs/by-name/co/comfyui/package.nix
@@ -74,7 +74,7 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "comfyui";
-  version = "0.31.1";
+  version = "0.32.0";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -83,7 +83,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     owner = "Comfy-Org";
     repo = "ComfyUI";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zo5XPU10liF5SvVQ4WpRDmx0QfuZ0CNh6EjCa60/9hc=";
+    hash = "sha256-LlJHF/wEL8HhJAKw2DaxsoMltLpV3DtFWDlTW3AZZuI=";
   };
 
   nativeBuildInputs = [ makeBinaryWrapper ];
diff --git a/pkgs/by-name/co/conjure-tor/package.nix b/pkgs/by-name/co/conjure-tor/package.nix
index 98794f2791c8..f60265eda626 100644
--- a/pkgs/by-name/co/conjure-tor/package.nix
+++ b/pkgs/by-name/co/conjure-tor/package.nix
@@ -6,17 +6,17 @@
 }:
 buildGoModule {
   pname = "conjure-tor";
-  version = "0-unstable-2024-11-11";
+  version = "0-unstable-2026-01-13";
 
   src = fetchFromGitLab {
     domain = "gitlab.torproject.org";
     owner = "tpo";
     repo = "anti-censorship/pluggable-transports/conjure";
-    rev = "a773daab19928f37caf2ec4181f0da2e0d20d35a";
-    hash = "sha256-WC9QEgwhu7ynf2p8SXzMf8JNp6ZzF4S9Lk2SjUWj2lU=";
+    rev = "0090962226b82aa4a8fc38506f9b98de67d0781e";
+    hash = "sha256-WGyzoc03QqPtLiZrUMCRMlPNm6JVSOnZv2a8KeZt7P4=";
   };
 
-  vendorHash = "sha256-vdcpNYa2gjacK0DMQ6VP9kX6f10JOHn8+Wr1Ql+lI7o=";
+  vendorHash = "sha256-6m/qNRrbWMREdDK/VpDAILynplyzbicdplxDrcTipSc=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/co/consul/package.nix b/pkgs/by-name/co/consul/package.nix
index 4b9033b0334c..2e206cf48ab5 100644
--- a/pkgs/by-name/co/consul/package.nix
+++ b/pkgs/by-name/co/consul/package.nix
@@ -8,7 +8,7 @@
 
 buildGoModule rec {
   pname = "consul";
-  version = "2.0.2";
+  version = "2.0.3";
 
   # Note: Currently only release tags are supported, because they have the Consul UI
   # vendored. See
@@ -22,7 +22,7 @@ buildGoModule rec {
     owner = "hashicorp";
     repo = "consul";
     tag = "v${version}";
-    hash = "sha256-Xt9Rch4pSSUb1/KI+W3fn++Jlm7ZtYNxSo9hOjXXEhw=";
+    hash = "sha256-VhjTMHfsbo9MFw/YkQ3AGcxEIM2Cq4LoTbDI6se0xHY=";
   };
 
   # This corresponds to paths with package main - normally unneeded but consul
@@ -32,7 +32,7 @@ buildGoModule rec {
     "connect/certgen"
   ];
 
-  vendorHash = "sha256-C532h7n/2E2vYQO02EcznnF8s/eI5r7qGoB5NEiiHEg=";
+  vendorHash = "sha256-MzbMG9mg/7RsQyAL50ob06Y/PZdF1W30e3Pfe9XAvvo=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/co/cosmic-ext-applet-sysinfo/package.nix b/pkgs/by-name/co/cosmic-ext-applet-sysinfo/package.nix
index 6c4167b684af..6ccf1eaf01a7 100644
--- a/pkgs/by-name/co/cosmic-ext-applet-sysinfo/package.nix
+++ b/pkgs/by-name/co/cosmic-ext-applet-sysinfo/package.nix
@@ -9,13 +9,13 @@
 }:
 rustPlatform.buildRustPackage {
   pname = "cosmic-ext-applet-sysinfo";
-  version = "0-unstable-2026-08-02";
+  version = "0-unstable-2026-08-10";
 
   src = fetchFromGitHub {
     owner = "cosmic-utils";
     repo = "cosmic-ext-applet-sysinfo";
-    rev = "950713d02883f8ea2c0d980e9220c88409087255";
-    hash = "sha256-ePGpJBRF+0kk9HxsajEYaWlQ1CzN/cLCIYziR7e7wwM=";
+    rev = "bf9d7473c6ebff0d0062837021640d55eb0b4154";
+    hash = "sha256-UZGILff2NqT9UtxVyDgCftuk+GkCEPHBO6tWZjzoxGU=";
   };
 
   cargoHash = "sha256-txUuPLwts10Qn8c9Ix48NaOe7/3k8cd27rwYbgGcRfE=";
diff --git a/pkgs/by-name/cp/cp2k/package.nix b/pkgs/by-name/cp/cp2k/package.nix
index 42775a325526..6190c7d294a2 100644
--- a/pkgs/by-name/cp/cp2k/package.nix
+++ b/pkgs/by-name/cp/cp2k/package.nix
@@ -6,6 +6,7 @@
   cmake,
   python3,
   gfortran,
+  boost,
   blas,
   lapack,
   dbcsr,
@@ -131,7 +132,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "cp2k";
-  version = "2026.1-unstable-2026-06-16";
+  version = "2026.2";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -139,8 +140,8 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "cp2k";
     repo = "cp2k";
-    rev = "c28f603b5956aa638ef130b21b091da4e3a17639";
-    hash = "sha256-LIghR2gCYbJDux4bFfeKCi+a+VDVbjcZfcVpYwjPkEg=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-ojG00n6KiaDW9vLgw/sIrhS8ceyh1mmlxgacw8KfMnA=";
     fetchSubmodules = true;
   };
 
@@ -167,6 +168,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
+    boost
     fftw
     gsl
     libint
diff --git a/pkgs/by-name/cp/cpond/package.nix b/pkgs/by-name/cp/cpond/package.nix
index 95fb3e96bd1b..733478e6ecdf 100644
--- a/pkgs/by-name/cp/cpond/package.nix
+++ b/pkgs/by-name/cp/cpond/package.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
     substituteInPlace Makefile \
       --replace-fail '$(eflags)$(ncursesw_macros)' '$(eflags) $(ncursesw_macros)'
   ''
-  + lib.optionalString stdenv.isDarwin ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
     substituteInPlace Makefile \
       --replace-fail '-lncursesw' '-lncurses'
   '';
diff --git a/pkgs/by-name/cr/croncpp/package.nix b/pkgs/by-name/cr/croncpp/package.nix
index 5f41addad414..981e8edc6601 100644
--- a/pkgs/by-name/cr/croncpp/package.nix
+++ b/pkgs/by-name/cr/croncpp/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "croncpp";
-  version = "2023.03.30";
+  version = "2026.08.12";
 
   src = fetchFromGitHub {
     owner = "mariusbancila";
     repo = "croncpp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-SBjNzy54OGEMemBp+c1gaH90Dc7ySL915z4E64cBWTI=";
+    hash = "sha256-qdl9494mpmozt6Rmd20MUeGeILWmNGHaxDgW2JnlUvs=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/cs/csfml_2/package.nix b/pkgs/by-name/cs/csfml_2/package.nix
index 0011871c2bb7..f0f169dc97c0 100644
--- a/pkgs/by-name/cs/csfml_2/package.nix
+++ b/pkgs/by-name/cs/csfml_2/package.nix
@@ -42,6 +42,6 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     license = lib.licenses.zlib;
     maintainers = [ lib.maintainers.jpdoyle ];
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
   };
 })
diff --git a/pkgs/by-name/cu/cutecosmic/package.nix b/pkgs/by-name/cu/cutecosmic/package.nix
index 12835a8cc0f5..fd242a7d3df7 100644
--- a/pkgs/by-name/cu/cutecosmic/package.nix
+++ b/pkgs/by-name/cu/cutecosmic/package.nix
@@ -25,8 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
-    name = "${finalAttrs.pname}-${finalAttrs.version}";
+    inherit (finalAttrs) pname version src;
     sourceRoot = "${finalAttrs.src.name}/bindings";
     hash = "sha256-+1z0VoxDeOYSmb7BoFSdrwrfo1mmwkxeuEGP+CGFc8Y=";
   };
diff --git a/pkgs/by-name/cy/cyan-skillfish-governor-smu/package.nix b/pkgs/by-name/cy/cyan-skillfish-governor-smu/package.nix
new file mode 100644
index 000000000000..25b1970b3c96
--- /dev/null
+++ b/pkgs/by-name/cy/cyan-skillfish-governor-smu/package.nix
@@ -0,0 +1,60 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  libdrm,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "cyan-skillfish-governor-smu";
+  version = "0.4.12";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "filippor";
+    repo = "cyan-skillfish-governor";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-yer2MlLnj9lx2cEBeYqAktbx0BqQEK/eFPiga5gXCr8=";
+  };
+
+  cargoHash = "sha256-zlAVGLGnub2Gc0Bkzb5GU9NBAJ2YWLhIG8JOa+1wHx8=";
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ libdrm ];
+
+  env.CYAN_SKILLFISH_GOVERNOR_VERSION = finalAttrs.version;
+
+  postInstall = ''
+    install -Dm755 scripts/cyan-skillfish-performance-mode \
+      $out/bin/cyan-skillfish-performance-mode
+
+    install -Dm644 com.cyanskillfish.Governor.conf \
+      $out/share/dbus-1/system.d/com.cyanskillfish.Governor.conf
+
+    install -Dm644 default-config.toml \
+      $out/share/cyan-skillfish-governor-smu/default-config.toml
+  '';
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "SMU-based GPU governor for the AMD Cyan Skillfish APU (ASRock BC-250)";
+    homepage = "https://github.com/filippor/cyan-skillfish-governor";
+    changelog = "https://github.com/filippor/cyan-skillfish-governor/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    platforms = [ "x86_64-linux" ];
+    maintainers = with lib.maintainers; [ liberodark ];
+    mainProgram = "cyan-skillfish-governor-smu";
+  };
+})
diff --git a/pkgs/by-name/da/daktari/package.nix b/pkgs/by-name/da/daktari/package.nix
index 60ea1fbec636..d31305cdb913 100644
--- a/pkgs/by-name/da/daktari/package.nix
+++ b/pkgs/by-name/da/daktari/package.nix
@@ -7,7 +7,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "daktari";
-  version = "0.0.347";
+  version = "0.0.348";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -15,7 +15,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "genio-learn";
     repo = "daktari";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-G9xTH13YkPMZooCxOrPQ40TMCIluYXHAMI83X9f5J5o=";
+    hash = "sha256-d1wSzz+GiH5R/8SzIlsd32Dz/FJxuYeMSLFGnL6aMPY=";
   };
 
   patches = [ ./optional-pyclip.patch ];
diff --git a/pkgs/by-name/da/dasher/package.nix b/pkgs/by-name/da/dasher/package.nix
index fb3456dbd295..8e5803893aa6 100644
--- a/pkgs/by-name/da/dasher/package.nix
+++ b/pkgs/by-name/da/dasher/package.nix
@@ -21,14 +21,14 @@
 
 stdenv.mkDerivation {
   pname = "dasher";
-  version = "unstable-2021-04-25";
+  version = "5.0-beta-unstable-2021-04-25";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "GNOME";
     repo = "dasher";
     rev = "90c753b87564fa3f42cb2d04e1eb6662dc8e0f8f";
-    sha256 = "sha256-aM05CV68pCRlhfIPyhuHWeRL+tDroB3fVsoX08OU8hY=";
+    hash = "sha256-aM05CV68pCRlhfIPyhuHWeRL+tDroB3fVsoX08OU8hY=";
   };
 
   prePatch = ''
diff --git a/pkgs/by-name/da/dataform/package-lock.json b/pkgs/by-name/da/dataform/package-lock.json
index c89d0faa0138..d0ead8fcf7d7 100644
--- a/pkgs/by-name/da/dataform/package-lock.json
+++ b/pkgs/by-name/da/dataform/package-lock.json
@@ -1,12 +1,12 @@
 {
     "name": "@dataform/cli",
-    "version": "3.0.63",
+    "version": "3.0.64",
     "lockfileVersion": 3,
     "requires": true,
     "packages": {
         "": {
             "name": "@dataform/cli",
-            "version": "3.0.63",
+            "version": "3.0.64",
             "license": "Apache-2.0",
             "dependencies": {
                 "@google-cloud/bigquery": "~8.3.0",
@@ -21,7 +21,7 @@
                 "object-sizeof": "^1.6.1",
                 "parse-duration": "^1.0.0",
                 "promise-pool-executor": "^1.1.1",
-                "protobufjs": "^7.6.3",
+                "protobufjs": "^7.6.5",
                 "readline-sync": "^1.4.9",
                 "semver": "^7.5.2",
                 "tarjan-graph": "^2.0.0",
@@ -151,9 +151,9 @@
             }
         },
         "node_modules/@isaacs/cliui/node_modules/ansi-regex": {
-            "version": "6.2.2",
-            "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.2.2.tgz",
-            "integrity": "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg==",
+            "version": "6.3.0",
+            "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.3.0.tgz",
+            "integrity": "sha512-WpDfL7NO6j7tH88IDBNVdUJxDh9nmCteAVW9dsep846XdwF4naCBK+/tGLX3KJgcpgMRXCFlTM2hKGoK9FsdrQ==",
             "license": "MIT",
             "engines": {
                 "node": ">=12"
@@ -303,9 +303,9 @@
             "license": "BSD-3-Clause"
         },
         "node_modules/@types/node": {
-            "version": "26.1.2",
-            "resolved": "https://registry.npmjs.org/@types/node/-/node-26.1.2.tgz",
-            "integrity": "sha512-Vu4a5UFA9rIIFJ7rB/Vaafh9lrCQszopTCx6KjFboXTGQbPNasehVR5TEiithSDGyd1DEiUByggTZsg8jukeIg==",
+            "version": "26.2.0",
+            "resolved": "https://registry.npmjs.org/@types/node/-/node-26.2.0.tgz",
+            "integrity": "sha512-5IviulTZeRNp2vAJ514cc/HUlY5nZ9fCbq9DMyC52BrhFZACo3nI0R7qBxhQmo/d27NFe96ur/b7Wwxklda+kg==",
             "license": "MIT",
             "dependencies": {
                 "undici-types": "~8.3.0"
@@ -853,9 +853,9 @@
             }
         },
         "node_modules/gaxios": {
-            "version": "7.3.0",
-            "resolved": "https://registry.npmjs.org/gaxios/-/gaxios-7.3.0.tgz",
-            "integrity": "sha512-RB5vLV+vvQeoFPCX4QMK6/hjVkbIamPp1QSUD0CiZcnj12qbpiL+pLbYtgD+oZkWl0tl9z+o2Utp+MpM3QRhBA==",
+            "version": "7.3.1",
+            "resolved": "https://registry.npmjs.org/gaxios/-/gaxios-7.3.1.tgz",
+            "integrity": "sha512-kB3rzJV7d9juLZh8/56QTXCwQfxyhdOMdyYk1HdQKFtF8TJTDTZQJtixWIwXdE9Jji91mC41DUNpjleo4L4eAQ==",
             "license": "Apache-2.0",
             "dependencies": {
                 "extend": "^3.0.2",
diff --git a/pkgs/by-name/da/dataform/package.nix b/pkgs/by-name/da/dataform/package.nix
index 7d969162fee2..f1a5735d8ea1 100644
--- a/pkgs/by-name/da/dataform/package.nix
+++ b/pkgs/by-name/da/dataform/package.nix
@@ -13,7 +13,7 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "dataform";
-  version = "3.0.63";
+  version = "3.0.64";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -22,7 +22,7 @@ buildNpmPackage (finalAttrs: {
 
   src = fetchurl {
     url = "https://registry.npmjs.org/@dataform/cli/-/cli-${finalAttrs.version}.tgz";
-    hash = "sha256-WAVTcWCZ99y+i7KTKWaqE5oMG+Uc/4d5h3Y6k9Bqhuo=";
+    hash = "sha256-ump4LsQzxkSsRzbBbJA4XxHW0C2abhfG+Wf10EZLt5g=";
   };
 
   # Inject the locally committed lockfile into the extracted source
@@ -30,7 +30,7 @@ buildNpmPackage (finalAttrs: {
     cp ${./package-lock.json} package-lock.json
   '';
 
-  npmDepsHash = "sha256-GLzkgs8ohGcWlNf55ktW4N1Q6HRJ+rse7wzBXC/xBno=";
+  npmDepsHash = "sha256-2Uzh78D9KQzJSpDYOSi2DmJBeKqXbZpLYXlSy+a3Bs4=";
 
   dontNpmBuild = true;
 
diff --git a/pkgs/by-name/da/davinci-resolve/package.nix b/pkgs/by-name/da/davinci-resolve/package.nix
index 0569e5991ab3..fa369141cf79 100644
--- a/pkgs/by-name/da/davinci-resolve/package.nix
+++ b/pkgs/by-name/da/davinci-resolve/package.nix
@@ -56,7 +56,7 @@ let
   davinci = (
     stdenv.mkDerivation rec {
       pname = "davinci-resolve${lib.optionalString studioVariant "-studio"}";
-      version = "21.0.3";
+      version = "21.0.4";
 
       nativeBuildInputs = [
         appimageTools.appimage-exec
@@ -78,9 +78,9 @@ let
             outputHashAlgo = "sha256";
             outputHash =
               if studioVariant then
-                "sha256-pEJF+FQlBngEi5YlKq/pFNCzBiQgqjQrTnfrlKEEi6s="
+                "sha256-FwaSnK3DAIRGCz6kiWxE4o0Cd0en2qoyuWCDHat1xHQ="
               else
-                "sha256-3SymaLm3ibyk8yOWcUS9fOfnKEmgVA5XXc5tls27qfo=";
+                "sha256-oX/abUHhnl1AW3xb53x8l7WIdSKc9e2Ocp0qtGAOv/A=";
 
             impureEnvVars = lib.fetchers.proxyImpureEnvVars;
 
diff --git a/pkgs/by-name/dd/ddrescueview/package.nix b/pkgs/by-name/dd/ddrescueview/package.nix
index 9dd6ca8b32d3..d97a414a4664 100644
--- a/pkgs/by-name/dd/ddrescueview/package.nix
+++ b/pkgs/by-name/dd/ddrescueview/package.nix
@@ -8,9 +8,11 @@
   cairo,
   gdk-pixbuf,
   glib,
-  gtk2,
+  gtk3,
+  harfbuzz,
   libx11,
   pango,
+  writableTmpDirAsHomeHook,
 }:
 
 stdenv.mkDerivation rec {
@@ -26,6 +28,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     fpc
     lazarus
+    writableTmpDirAsHomeHook
   ];
 
   buildInputs = [
@@ -33,7 +36,8 @@ stdenv.mkDerivation rec {
     cairo
     gdk-pixbuf
     glib
-    gtk2
+    gtk3
+    harfbuzz
     libx11
     pango
   ];
@@ -45,7 +49,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildPhase = ''
-    lazbuild --lazarusdir=${lazarus}/share/lazarus ddrescueview.lpi
+    lazbuild --lazarusdir=${lazarus}/share/lazarus --ws=gtk3 ddrescueview.lpi
   '';
 
   installPhase = ''
diff --git a/pkgs/by-name/de/debian-archive-keyring/package.nix b/pkgs/by-name/de/debian-archive-keyring/package.nix
new file mode 100644
index 000000000000..6aacf70c37c6
--- /dev/null
+++ b/pkgs/by-name/de/debian-archive-keyring/package.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  fetchFromGitLab,
+  stdenvNoCC,
+  nix-update-script,
+  jetring,
+  gnupg,
+}:
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "debian-archive-keyring";
+  version = "2025.1";
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitLab {
+    domain = "salsa.debian.org";
+    owner = "release-team";
+    repo = "debian-archive-keyring";
+    tag = finalAttrs.version;
+    hash = "sha256-NaVbca1mx0j4hfSncX8hh8PbtB92yGeZUUdp4Nx9JoY=";
+  };
+
+  nativeBuildInputs = [
+    jetring
+    gnupg
+  ];
+
+  makeFlags = [ "DESTDIR=$(out)" ];
+
+  postInstall = ''
+    mv $out/usr/share $out/share
+    rm -d $out/usr
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "GnuPG archive keys of the Debian archive";
+    homepage = "https://salsa.debian.org/release-team/debian-archive-keyring";
+    license = lib.licenses.publicDomain;
+    platforms = lib.platforms.all;
+    maintainers = [ lib.maintainers.skyesoss ];
+  };
+})
diff --git a/pkgs/by-name/de/deja/package.nix b/pkgs/by-name/de/deja/package.nix
index 6b7a3b33d4cc..14a49275625a 100644
--- a/pkgs/by-name/de/deja/package.nix
+++ b/pkgs/by-name/de/deja/package.nix
@@ -7,16 +7,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "deja";
-  version = "0.4.0";
+  version = "0.4.1";
   __structuredAttrs = true;
   src = fetchFromGitHub {
     owner = "Giammarco-Ferranti";
     repo = "deja";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-SAn/9OM5ivUkJpiBXgV2o01ww85xRo3fQKZp0spwe/w=";
+    hash = "sha256-NDTiesARUyZJQGm+ePZQgofkZYFe/07ztQQcruIkXuE=";
   };
 
-  vendorHash = "sha256-KmLdMK94cGOXMPJwWS6NgLB5OiNmJbszHdnLzauqJm8=";
+  vendorHash = "sha256-XHcZUtx82zT3yPCYzJG+a7zfARPW4clbMn77/4luskw=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/de/dejagnu/package.nix b/pkgs/by-name/de/dejagnu/package.nix
index c0fc616b9892..ced881d1030f 100644
--- a/pkgs/by-name/de/dejagnu/package.nix
+++ b/pkgs/by-name/de/dejagnu/package.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
   configureScript = "../configure";
 
-  doCheck = !(with stdenv; isDarwin && isAarch64);
+  doCheck = !(with stdenv.hostPlatform; isDarwin && isAarch64);
 
   # Note: The test-suite *requires* /dev/pts among the `build-chroot-dirs' of
   # the build daemon when building in a chroot.  See
diff --git a/pkgs/by-name/de/delineate/package.nix b/pkgs/by-name/de/delineate/package.nix
index 7bdf8e5d48a6..905d52bda6dc 100644
--- a/pkgs/by-name/de/delineate/package.nix
+++ b/pkgs/by-name/de/delineate/package.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
+    inherit (finalAttrs) pname version src;
     hash = "sha256-G7K3aeSBnKcJHOlQQIHd3Kzoe/ienFVycTWOKOSRhZc=";
   };
 
diff --git a/pkgs/by-name/de/devin-desktop/info.json b/pkgs/by-name/de/devin-desktop/info.json
index a760ba80f3a4..cfe982ef1a1e 100644
--- a/pkgs/by-name/de/devin-desktop/info.json
+++ b/pkgs/by-name/de/devin-desktop/info.json
@@ -1,14 +1,14 @@
 {
   "aarch64-darwin": {
-    "version": "3.6.27",
+    "version": "3.7.16",
     "vscodeVersion": "1.126.0",
-    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/0becb483ee8498d49deadf6aefe8c24f58b8007e/Devin-darwin-arm64-3.6.27.zip",
-    "sha256": "a683913ce3164a3112bf0be0aaf1c52973cf1995b745a42fc0c32007fd108088"
+    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/355c3c9ee32dad08f605d5ee8f9a7e6786316d4c/Devin-darwin-arm64-3.7.16.zip",
+    "sha256": "a5f8ff8e467dfae13ab11a3ccf0550ba7ddffd29efdfa6013949e84cfb14d766"
   },
   "x86_64-linux": {
-    "version": "3.6.27",
+    "version": "3.7.16",
     "vscodeVersion": "1.126.0",
-    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/0becb483ee8498d49deadf6aefe8c24f58b8007e/Devin-linux-x64-3.6.27.tar.gz",
-    "sha256": "c80c5068e401cb641980dd94b721c7f15847bf6e33840170ff05e809d1462f50"
+    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/355c3c9ee32dad08f605d5ee8f9a7e6786316d4c/Devin-linux-x64-3.7.16.tar.gz",
+    "sha256": "7ce94e6a720a476b91a6a24c6618a7c670c9b4f76b8bb91f7c84b2c63bcf6435"
   }
 }
diff --git a/pkgs/by-name/di/diffoscope/package.nix b/pkgs/by-name/di/diffoscope/package.nix
index 3fb5bc7fe196..b0a7726746fa 100644
--- a/pkgs/by-name/di/diffoscope/package.nix
+++ b/pkgs/by-name/di/diffoscope/package.nix
@@ -112,12 +112,12 @@ in
 # Note: when upgrading this package, please run the list-missing-tools.sh script as described below!
 python.pkgs.buildPythonApplication rec {
   pname = "diffoscope";
-  version = "326";
+  version = "327";
   pyproject = true;
 
   src = fetchurl {
     url = "https://diffoscope.org/archive/diffoscope-${version}.tar.bz2";
-    hash = "sha256-Km0CvLx8BQ44Nwzxd9kHVFgVOnWPc+vly3ThcENGMOQ=";
+    hash = "sha256-WCEyBp4HQ0BhxyP/GACQOBH+GMo2GuR13U1RXBEVz94=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/di/direvent/fix-darwin.patch b/pkgs/by-name/di/direvent/fix-darwin.patch
new file mode 100644
index 000000000000..69ff95cddb04
--- /dev/null
+++ b/pkgs/by-name/di/direvent/fix-darwin.patch
@@ -0,0 +1,12 @@
+diff --git i/src/direvent.h w/src/direvent.h
+index 18ab4c8..3c49500 100644
+--- i/src/direvent.h
++++ w/src/direvent.h
+@@ -313,6 +313,7 @@ int sigv_set_all(void (*handler)(int), int sigc, int *sigv,
+ 		 struct sigaction *retsa);
+ int sigv_set_tab(int sigc, struct sigtab *sigtab, struct sigaction *retsa);
+ int sigv_set_action_tab(int sigc, struct sigtab *sigtab, struct sigaction *sa);
++int sigv_restore_tab(int sigc, struct sigtab *sigtab, struct sigaction *sa);
+ 
+ struct grecs_locus;
+ int filpatlist_add(filpatlist_t *fptr, char const *arg,
diff --git a/pkgs/by-name/di/direvent/package.nix b/pkgs/by-name/di/direvent/package.nix
index f500c4d1e4fb..c7ad63aa944e 100644
--- a/pkgs/by-name/di/direvent/package.nix
+++ b/pkgs/by-name/di/direvent/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  autoreconfHook,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -13,6 +14,17 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-DhbAtLPm92c+m08x2BqwEjatIvg1OFEvOy9Y+flv3Lc=";
   };
 
+  patches = [
+    ./fix-darwin.patch
+    ./use-nonosleep-if-clock-nanosleep-not-available.patch
+  ];
+
+  nativeBuildInputs = [
+    # The nanosleep patch about modifies configure.ac so we use autoreconfHook.
+    # We should be able to remove this when we drop the nanosleep patch.
+    autoreconfHook
+  ];
+
   meta = {
     description = "Directory event monitoring daemon";
     mainProgram = "direvent";
diff --git a/pkgs/by-name/di/direvent/use-nonosleep-if-clock-nanosleep-not-available.patch b/pkgs/by-name/di/direvent/use-nonosleep-if-clock-nanosleep-not-available.patch
new file mode 100644
index 000000000000..9002a6026394
--- /dev/null
+++ b/pkgs/by-name/di/direvent/use-nonosleep-if-clock-nanosleep-not-available.patch
@@ -0,0 +1,89 @@
+commit f6042ca2e240a27a20e405de49755f350ca95e7b
+Author: Sergey Poznyakoff <gray@gnu.org>
+Date:   Sat Jul 25 22:15:56 2026 +0300
+
+    Use nanosleep on systems lacking clock_nanosleep.
+    
+    * configure.ac: Check for clock_nanosleep.
+    * src/progman.c (abswait): New function.
+    (process_drain): Use it to wait till the specified absolute timestamp.
+
+diff --git a/configure.ac b/configure.ac
+index 336aa2a..a4fcedc 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -41,7 +41,7 @@ AC_CHECK_HEADERS([sys/inotify.h sys/event.h])
+ # Checks for typedefs, structures, and compiler characteristics.
+ 
+ # Checks for library functions.
+-AC_CHECK_FUNCS([inotify_init kqueue rfork getgrouplist])
++AC_CHECK_FUNCS([inotify_init kqueue rfork getgrouplist clock_nanosleep])
+ 
+ if test "$ac_cv_header_sys_inotify_h/$ac_cv_func_inotify_init" = yes/yes; then
+   iface=inotify
+diff --git a/src/progman.c b/src/progman.c
+index 86c3edf..743b97f 100644
+--- a/src/progman.c
++++ b/src/progman.c
+@@ -244,12 +244,40 @@ timespec_add(struct timespec *a, struct timespec *b)
+ 	}
+ }
+ 
++static inline void
++timespec_sub(struct timespec *a, struct timespec const *b)
++{
++	struct timespec d;
++
++	a->tv_sec -= b->tv_sec;
++	a->tv_nsec -= b->tv_nsec;
++	if (a->tv_nsec < 0) {
++		--a->tv_sec;
++		a->tv_nsec += NANOSEC;
++	}
++}
++
++static int
++abswait(struct timespec const *ts)
++{
++#if HAVE_CLOCK_NANOSLEEP
++	return clock_nanosleep(CLOCK_MONOTONIC, TIMER_ABSTIME, ts, NULL);
++#else
++	struct timespec now, t = *ts;
++	clock_gettime(CLOCK_MONOTONIC, &now);
++	timespec_sub(&t, &now);
++	if (t.tv_sec < 0)
++		return 0;
++	return nanosleep(&t, NULL);
++#endif
++}
++
+ void
+ process_drain(void)
+ {
+ 	struct process *p;
+ 	struct timespec ts;
+-	
++
+ 	/* Send all processes the TERM signal. */
+ 	for (p = proc_list; p; p = p->next) {
+ 		if (p->type == PROC_HANDLER)
+@@ -257,15 +285,13 @@ process_drain(void)
+ 	}
+ 	/* Wait for all processes to terminate. */
+ 	diag(LOG_INFO, _("waiting for processes to terminate"));
+-		     
++
+ 	clock_gettime (CLOCK_MONOTONIC, &ts);
+ 	timespec_add (&ts, &shutdown_timeout);
+-	
+-	do {		
+-		process_cleanup(1);
+-	} while (proc_list &&
+-		 clock_nanosleep(CLOCK_MONOTONIC, TIMER_ABSTIME, &ts, NULL));
+ 
++	do {
++		process_cleanup(1);
++	} while (proc_list && abswait(&ts));
+ 
+ 	if (proc_list) {
+ 		diag(LOG_INFO,
diff --git a/pkgs/by-name/di/direwolf-unstable/package.nix b/pkgs/by-name/di/direwolf-unstable/package.nix
index 17b7a2d54c86..b4e9f3c49996 100644
--- a/pkgs/by-name/di/direwolf-unstable/package.nix
+++ b/pkgs/by-name/di/direwolf-unstable/package.nix
@@ -12,13 +12,13 @@
   inherit hamlibSupport gpsdSupport extraScripts;
 }).overrideAttrs
   (oldAttrs: {
-    version = "1.8.1-unstable-2026-07-19";
+    version = "1.8.1-unstable-2026-08-10";
 
     src = fetchFromGitHub {
       owner = "wb2osz";
       repo = "direwolf";
-      rev = "e8ab49a5e4d3edd49cfa9b7b9d65334693d2da5d";
-      hash = "sha256-+HYcfdMTDAzm5quT67YhsH4TuUcsHSRBPiucCk+qgDw=";
+      rev = "a821a0e4ffc2eb3ce94aafe1a9131aac7053042f";
+      hash = "sha256-aFrKFErFVXoXX5bqNQj1rkwlaS67rIPGa7MNf8Wtal4=";
     };
 
     dontVersionCheck = true;
diff --git a/pkgs/by-name/di/disk_indicator/package.nix b/pkgs/by-name/di/disk_indicator/package.nix
index 01cb82f987ce..848ebeaf590d 100644
--- a/pkgs/by-name/di/disk_indicator/package.nix
+++ b/pkgs/by-name/di/disk_indicator/package.nix
@@ -3,11 +3,15 @@
   stdenv,
   fetchFromGitHub,
   libx11,
+  installShellFiles,
 }:
 
 stdenv.mkDerivation {
   pname = "disk-indicator";
-  version = "unstable-2018-12-18";
+  version = "0.2.1-unstable-2018-12-18";
+
+  strictDeps = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "MeanEYE";
@@ -18,30 +22,27 @@ stdenv.mkDerivation {
 
   buildInputs = [ libx11 ];
 
+  nativeBuildInputs = [ installShellFiles ];
+
   postPatch = ''
     # avoid -Werror
-    substituteInPlace Makefile --replace "-Werror" ""
+    substituteInPlace Makefile --replace-fail "-Werror" ""
     # avoid host-specific options
-    substituteInPlace Makefile --replace "-march=native" ""
+    substituteInPlace Makefile --replace-fail "-march=native" ""
     # fix signal handler signature
     substituteInPlace src/main.c --replace-fail "void handle_signal()" "void handle_signal(int sig)"
   '';
 
-  postConfigure = ''
-    patchShebangs ./configure.sh
-    ./configure.sh --all
-  '';
+  configureScript = "./configure.sh";
 
   makeFlags = [
-    "COMPILER=${stdenv.cc.targetPrefix}cc"
+    "COMPILER=${lib.getExe stdenv.cc}"
   ];
 
   installPhase = ''
     runHook preInstall
-
-    mkdir -p "$out/bin"
-    cp ./disk_indicator "$out/bin/"
-
+    mkdir -p $out/bin
+    installBin disk_indicator
     runHook postInstall
   '';
 
@@ -53,7 +54,7 @@ stdenv.mkDerivation {
       Small program for Linux that will turn your Scroll, Caps or Num Lock LED
       or LED on your ThinkPad laptop into a hard disk activity indicator.
     '';
-    license = lib.licenses.gpl3;
+    license = lib.licenses.gpl3Plus;
     platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/by-name/di/disko/package.nix b/pkgs/by-name/di/disko/package.nix
index 8e76815b5976..692ebc38d660 100644
--- a/pkgs/by-name/di/disko/package.nix
+++ b/pkgs/by-name/di/disko/package.nix
@@ -28,7 +28,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     cp -r install-cli.nix cli.nix default.nix disk-deactivate lib $out/share/disko
 
     scripts=(disko)
-    ${lib.optionalString (!stdenvNoCC.isDarwin) ''
+    ${lib.optionalString (!stdenvNoCC.hostPlatform.isDarwin) ''
       scripts+=(disko-install)
     ''}
 
@@ -44,7 +44,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
               coreutils
               xcp
             ]
-            ++ lib.optional (!stdenvNoCC.isDarwin) nixos-install
+            ++ lib.optional (!stdenvNoCC.hostPlatform.isDarwin) nixos-install
           )
         }
     done
@@ -54,7 +54,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   installCheckPhase = ''
     runHook preInstallCheck
     $out/bin/disko --help
-    ${lib.optionalString (!stdenvNoCC.isDarwin) ''
+    ${lib.optionalString (!stdenvNoCC.hostPlatform.isDarwin) ''
       $out/bin/disko-install --help
     ''}
     runHook postInstallCheck
diff --git a/pkgs/by-name/dn/dnsi/package.nix b/pkgs/by-name/dn/dnsi/package.nix
index 1779c0c4f051..7b96aedec543 100644
--- a/pkgs/by-name/dn/dnsi/package.nix
+++ b/pkgs/by-name/dn/dnsi/package.nix
@@ -31,6 +31,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     description = "Command line tool to investigate the Domain Name System";
     mainProgram = "dnsi";
     homepage = "https://nlnetlabs.nl/projects/domain/dnsi/";
+    changelog = "https://github.com/NLnetLabs/dnsi/blob/v${finalAttrs.version}/Changelog.md";
     license = lib.licenses.bsd3;
     maintainers = [ lib.maintainers.skyesoss ];
   };
diff --git a/pkgs/by-name/dn/dnst/package.nix b/pkgs/by-name/dn/dnst/package.nix
index ae7164e53545..099b7647a114 100644
--- a/pkgs/by-name/dn/dnst/package.nix
+++ b/pkgs/by-name/dn/dnst/package.nix
@@ -47,6 +47,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     description = "Toolset to assist DNS operators with zone and nameserver maintenance";
     mainProgram = "dnst";
     homepage = "https://nlnetlabs.nl/projects/domain/dnst/";
+    changelog = "https://github.com/NLnetLabs/dnst/blob/v${finalAttrs.version}/Changelog.md";
     license = lib.licenses.bsd3;
     maintainers = [ lib.maintainers.skyesoss ];
   };
diff --git a/pkgs/by-name/do/docuseal/Gemfile b/pkgs/by-name/do/docuseal/Gemfile
index f1c15e33d37d..3ba25b4364ab 100644
--- a/pkgs/by-name/do/docuseal/Gemfile
+++ b/pkgs/by-name/do/docuseal/Gemfile
@@ -20,11 +20,9 @@ gem 'faraday'
 gem 'faraday-follow_redirects'
 gem 'google-cloud-storage', require: false
 gem 'hexapdf'
-gem 'image_processing'
 gem 'jwt', require: false
 gem 'lograge'
 gem 'numo-narray-alt', require: false
-gem 'oj'
 gem 'onnxruntime', require: false
 gem 'pagy'
 gem 'pg', require: false
diff --git a/pkgs/by-name/do/docuseal/Gemfile.lock b/pkgs/by-name/do/docuseal/Gemfile.lock
index 67f58c8782ef..09959a116b7d 100644
--- a/pkgs/by-name/do/docuseal/Gemfile.lock
+++ b/pkgs/by-name/do/docuseal/Gemfile.lock
@@ -1,31 +1,31 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    action_text-trix (2.1.18)
+    action_text-trix (2.1.19)
       railties
-    actioncable (8.1.3)
-      actionpack (= 8.1.3)
-      activesupport (= 8.1.3)
+    actioncable (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
       zeitwerk (~> 2.6)
-    actionmailbox (8.1.3)
-      actionpack (= 8.1.3)
-      activejob (= 8.1.3)
-      activerecord (= 8.1.3)
-      activestorage (= 8.1.3)
-      activesupport (= 8.1.3)
+    actionmailbox (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      activejob (= 8.1.3.1)
+      activerecord (= 8.1.3.1)
+      activestorage (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
       mail (>= 2.8.0)
-    actionmailer (8.1.3)
-      actionpack (= 8.1.3)
-      actionview (= 8.1.3)
-      activejob (= 8.1.3)
-      activesupport (= 8.1.3)
+    actionmailer (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      actionview (= 8.1.3.1)
+      activejob (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
       mail (>= 2.8.0)
       rails-dom-testing (~> 2.2)
-    actionpack (8.1.3)
-      actionview (= 8.1.3)
-      activesupport (= 8.1.3)
+    actionpack (8.1.3.1)
+      actionview (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
       nokogiri (>= 1.8.5)
       rack (>= 2.2.4)
       rack-session (>= 1.0.1)
@@ -33,36 +33,36 @@ GEM
       rails-dom-testing (~> 2.2)
       rails-html-sanitizer (~> 1.6)
       useragent (~> 0.16)
-    actiontext (8.1.3)
+    actiontext (8.1.3.1)
       action_text-trix (~> 2.1.15)
-      actionpack (= 8.1.3)
-      activerecord (= 8.1.3)
-      activestorage (= 8.1.3)
-      activesupport (= 8.1.3)
+      actionpack (= 8.1.3.1)
+      activerecord (= 8.1.3.1)
+      activestorage (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
       globalid (>= 0.6.0)
       nokogiri (>= 1.8.5)
-    actionview (8.1.3)
-      activesupport (= 8.1.3)
+    actionview (8.1.3.1)
+      activesupport (= 8.1.3.1)
       builder (~> 3.1)
       erubi (~> 1.11)
       rails-dom-testing (~> 2.2)
       rails-html-sanitizer (~> 1.6)
-    activejob (8.1.3)
-      activesupport (= 8.1.3)
+    activejob (8.1.3.1)
+      activesupport (= 8.1.3.1)
       globalid (>= 0.3.6)
-    activemodel (8.1.3)
-      activesupport (= 8.1.3)
-    activerecord (8.1.3)
-      activemodel (= 8.1.3)
-      activesupport (= 8.1.3)
+    activemodel (8.1.3.1)
+      activesupport (= 8.1.3.1)
+    activerecord (8.1.3.1)
+      activemodel (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
       timeout (>= 0.4.0)
-    activestorage (8.1.3)
-      actionpack (= 8.1.3)
-      activejob (= 8.1.3)
-      activerecord (= 8.1.3)
-      activesupport (= 8.1.3)
+    activestorage (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      activejob (= 8.1.3.1)
+      activerecord (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
       marcel (~> 1.0)
-    activesupport (8.1.3)
+    activesupport (8.1.3.1)
       base64
       bigdecimal
       concurrent-ruby (~> 1.0, >= 1.3.1)
@@ -116,7 +116,7 @@ GEM
       erubi (~> 1.4)
       parser (>= 2.4)
       smart_properties
-    bigdecimal (4.1.0)
+    bigdecimal (4.1.2)
     bindex (0.8.1)
     bootsnap (1.23.0)
       msgpack (~> 1.2)
@@ -144,12 +144,12 @@ GEM
     cldr-plurals-runtime-rb (1.1.0)
     cmdparse (3.0.7)
     coderay (1.1.3)
-    concurrent-ruby (1.3.6)
+    concurrent-ruby (1.3.8)
     connection_pool (3.0.2)
     crack (1.0.1)
       bigdecimal
       rexml
-    crass (1.0.6)
+    crass (1.0.7)
     csv (3.3.5)
     csv-safe (3.3.1)
       csv (~> 3.0)
@@ -161,7 +161,7 @@ GEM
       irb (~> 1.10)
       reline (>= 0.3.8)
     declarative (0.0.20)
-    devise (5.0.3)
+    devise (5.0.4)
       bcrypt (~> 3.0)
       orm_adapter (~> 0.1)
       railties (>= 7.0)
@@ -179,7 +179,7 @@ GEM
     dotenv (3.2.0)
     drb (2.2.3)
     email_typo (0.2.3)
-    erb (6.0.4)
+    erb (6.0.6)
     erb_lint (0.9.0)
       activesupport
       better_html (>= 2.0.1)
@@ -195,13 +195,13 @@ GEM
       railties (>= 6.1.0)
     faker (3.6.1)
       i18n (>= 1.8.11, < 2)
-    faraday (2.14.1)
+    faraday (2.14.3)
       faraday-net_http (>= 2.0, < 3.5)
       json
       logger
     faraday-follow_redirects (0.5.0)
       faraday (>= 1, < 3)
-    faraday-net_http (3.4.2)
+    faraday-net_http (3.4.4)
       net-http (~> 0.5)
     ferrum (0.17.2)
       addressable (~> 2.5)
@@ -216,7 +216,7 @@ GEM
     foreman (0.90.0)
       thor (~> 1.4)
     geom2d (0.4.1)
-    globalid (1.3.0)
+    globalid (1.4.0)
       activesupport (>= 6.1)
     google-apis-core (1.0.2)
       addressable (~> 2.8, >= 2.8.7)
@@ -261,20 +261,17 @@ GEM
       geom2d (~> 0.4, >= 0.4.1)
       openssl (>= 2.2.1)
       strscan (>= 3.1.2)
-    i18n (1.14.8)
+    i18n (1.15.2)
       concurrent-ruby (~> 1.0)
-    image_processing (1.14.0)
-      mini_magick (>= 4.9.5, < 6)
-      ruby-vips (>= 2.0.17, < 3)
     io-console (0.8.2)
-    irb (1.17.0)
+    irb (1.18.0)
       pp (>= 0.6.0)
       prism (>= 1.3.0)
       rdoc (>= 4.0.0)
       reline (>= 0.4.2)
     jmespath (1.6.2)
-    json (2.19.3)
-    jwt (3.1.2)
+    json (2.21.1)
+    jwt (3.2.0)
       base64
     language_server-protocol (3.17.0.5)
     launchy (3.1.1)
@@ -295,30 +292,28 @@ GEM
       activesupport (>= 4)
       railties (>= 4)
       request_store (~> 1.0)
-    loofah (2.25.1)
+    loofah (2.25.2)
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
-    mail (2.9.0)
+    mail (2.9.1)
       logger
       mini_mime (>= 0.1.1)
       net-imap
       net-pop
       net-smtp
-    marcel (1.1.0)
+    marcel (1.2.1)
     matrix (0.4.3)
     method_source (1.1.0)
-    mini_magick (5.3.1)
-      logger
     mini_mime (1.1.5)
     mini_portile2 (2.8.9)
-    minitest (6.0.3)
+    minitest (6.0.6)
       drb (~> 2.0)
       prism (~> 1.5)
-    msgpack (1.8.0)
+    msgpack (1.8.4)
     multi_json (1.19.1)
     net-http (0.9.1)
       uri (>= 0.11.1)
-    net-imap (0.6.4)
+    net-imap (0.6.6)
       date
       net-protocol
     net-pop (0.1.2)
@@ -328,19 +323,16 @@ GEM
     net-smtp (0.5.1)
       net-protocol
     nio4r (2.7.5)
-    nokogiri (1.19.3)
+    nokogiri (1.19.4)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
-    nokogiri (1.19.3-aarch64-linux-musl)
+    nokogiri (1.19.4-aarch64-linux-musl)
       racc (~> 1.4)
-    nokogiri (1.19.3-arm64-darwin)
+    nokogiri (1.19.4-arm64-darwin)
       racc (~> 1.4)
-    nokogiri (1.19.3-x86_64-linux-musl)
+    nokogiri (1.19.4-x86_64-linux-musl)
       racc (~> 1.4)
     numo-narray-alt (0.10.3)
-    oj (3.16.16)
-      bigdecimal (>= 3.0)
-      ostruct (>= 0.2)
     onnxruntime (0.10.1)
       ffi
     onnxruntime (0.10.1-aarch64-linux)
@@ -352,9 +344,8 @@ GEM
     openssl (4.0.1)
     orm_adapter (0.5.0)
     os (1.1.4)
-    ostruct (0.6.3)
     package_json (0.2.0)
-    pagy (43.4.4)
+    pagy (43.6.1)
       json
       uri
       yaml
@@ -366,7 +357,7 @@ GEM
     pg (1.6.3-aarch64-linux-musl)
     pg (1.6.3-arm64-darwin)
     pg (1.6.3-x86_64-linux-musl)
-    pp (0.6.3)
+    pp (0.6.4)
       prettyprint
     pretender (1.0.0)
       actionpack (>= 7.2)
@@ -378,11 +369,8 @@ GEM
       reline (>= 0.6.0)
     pry-rails (0.3.11)
       pry (>= 0.13.0)
-    psych (5.3.1)
-      date
-      stringio
     public_suffix (7.0.5)
-    puma (7.2.0)
+    puma (8.0.2)
       nio4r (~> 2.0)
     racc (1.8.1)
     rack (3.2.6)
@@ -395,33 +383,33 @@ GEM
       rack (>= 1.3)
     rackup (2.3.1)
       rack (>= 3)
-    rails (8.1.3)
-      actioncable (= 8.1.3)
-      actionmailbox (= 8.1.3)
-      actionmailer (= 8.1.3)
-      actionpack (= 8.1.3)
-      actiontext (= 8.1.3)
-      actionview (= 8.1.3)
-      activejob (= 8.1.3)
-      activemodel (= 8.1.3)
-      activerecord (= 8.1.3)
-      activestorage (= 8.1.3)
-      activesupport (= 8.1.3)
+    rails (8.1.3.1)
+      actioncable (= 8.1.3.1)
+      actionmailbox (= 8.1.3.1)
+      actionmailer (= 8.1.3.1)
+      actionpack (= 8.1.3.1)
+      actiontext (= 8.1.3.1)
+      actionview (= 8.1.3.1)
+      activejob (= 8.1.3.1)
+      activemodel (= 8.1.3.1)
+      activerecord (= 8.1.3.1)
+      activestorage (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
       bundler (>= 1.15.0)
-      railties (= 8.1.3)
+      railties (= 8.1.3.1)
     rails-dom-testing (2.3.0)
       activesupport (>= 5.0.0)
       minitest
       nokogiri (>= 1.6)
-    rails-html-sanitizer (1.7.0)
-      loofah (~> 2.25)
+    rails-html-sanitizer (1.7.1)
+      loofah (~> 2.25, >= 2.25.2)
       nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
     rails-i18n (8.1.0)
       i18n (>= 0.7, < 2)
       railties (>= 8.0.0, < 9)
-    railties (8.1.3)
-      actionpack (= 8.1.3)
-      activesupport (= 8.1.3)
+    railties (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
       irb (~> 1.13)
       rackup (>= 1.0.0)
       rake (>= 12.2)
@@ -429,12 +417,17 @@ GEM
       tsort (>= 0.2)
       zeitwerk (~> 2.6)
     rainbow (3.1.1)
-    rake (13.3.1)
-    rdoc (7.2.0)
-      erb
-      psych (>= 4.0.0)
+    rake (13.4.2)
+    rbs (4.1.0)
+      logger
+      prism (>= 1.6.0)
       tsort
-    redis-client (0.28.0)
+    rdoc (8.0.0)
+      erb
+      prism (>= 1.6.0)
+      rbs (>= 4.0.0)
+      tsort
+    redis-client (0.29.0)
       connection_pool
     regexp_parser (2.11.3)
     reline (0.6.3)
@@ -516,12 +509,12 @@ GEM
       rack-proxy (>= 0.6.1)
       railties (>= 5.2)
       semantic_range (>= 2.3.0)
-    sidekiq (8.1.2)
+    sidekiq (8.1.6)
       connection_pool (>= 3.0.0)
       json (>= 2.16.0)
       logger (>= 1.7.0)
       rack (>= 3.2.0)
-      redis-client (>= 0.26.0)
+      redis-client (>= 0.29.0)
     signet (0.21.0)
       addressable (~> 2.8)
       faraday (>= 0.17.5, < 3.a)
@@ -534,12 +527,11 @@ GEM
     simplecov-html (0.13.2)
     simplecov_json_formatter (0.1.4)
     smart_properties (1.17.0)
-    sqlite3 (2.9.2)
+    sqlite3 (2.9.5)
       mini_portile2 (~> 2.8.0)
-    sqlite3 (2.9.2-aarch64-linux-musl)
-    sqlite3 (2.9.2-arm64-darwin)
-    sqlite3 (2.9.2-x86_64-linux-musl)
-    stringio (3.2.0)
+    sqlite3 (2.9.5-aarch64-linux-musl)
+    sqlite3 (2.9.5-arm64-darwin)
+    sqlite3 (2.9.5-x86_64-linux-musl)
     strip_attributes (2.0.1)
       activemodel (>= 3.0, < 9.0)
     strscan (3.1.8)
@@ -579,14 +571,14 @@ GEM
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
     webrick (1.9.2)
-    websocket-driver (0.8.0)
+    websocket-driver (0.8.2)
       base64
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.5)
     xpath (3.2.0)
       nokogiri (~> 1.8)
     yaml (0.4.0)
-    zeitwerk (2.7.5)
+    zeitwerk (2.8.2)
 
 PLATFORMS
   aarch64-linux-musl
@@ -623,12 +615,10 @@ DEPENDENCIES
   foreman
   google-cloud-storage
   hexapdf
-  image_processing
   jwt
   letter_opener_web
   lograge
   numo-narray-alt
-  oj
   onnxruntime
   pagy
   pg
diff --git a/pkgs/by-name/do/docuseal/gemset.nix b/pkgs/by-name/do/docuseal/gemset.nix
index 5f509e1ec7a3..b5377542f9a1 100644
--- a/pkgs/by-name/do/docuseal/gemset.nix
+++ b/pkgs/by-name/do/docuseal/gemset.nix
@@ -5,10 +5,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0hinzgbjfwgdjm3dz9mz218sy764gbacv0z2ic4ms57lpzw87nrz";
+      sha256 = "02a0yz97d12cf6wcj5r43ak57mhlcj4r84k5ma2g570046aga4kh";
       type = "gem";
     };
-    version = "2.1.18";
+    version = "2.1.19";
   };
   actioncable = {
     dependencies = [
@@ -22,10 +22,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1w40bbkjd0lds57bfr24hbj9qfkwj9v33x6457g24sjfwispzg75";
+      sha256 = "06yrlf0a6jnlcigvnhdsdskvf368cwi0ypz2vzps6y68jn154673";
       type = "gem";
     };
-    version = "8.1.3";
+    version = "8.1.3.1";
   };
   actionmailbox = {
     dependencies = [
@@ -40,10 +40,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0ndf98dpzmz8xs6m253zpwnhyfrvxdkfyvssxps0vrx0x9sa8zfz";
+      sha256 = "071b1103h7xsrrx73wbdj8mp7b0x99lr6pj3ivg3m13x15r4jw2z";
       type = "gem";
     };
-    version = "8.1.3";
+    version = "8.1.3.1";
   };
   actionmailer = {
     dependencies = [
@@ -61,10 +61,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "13a4329lgrda8s9mqrfbaakvc90i6ak82rfpljmd0w5vj54747w3";
+      sha256 = "0g64lm550x0sx2ad5sgwmx19jg9acj98hih6q33a00pz50dl9sl8";
       type = "gem";
     };
-    version = "8.1.3";
+    version = "8.1.3.1";
   };
   actionpack = {
     dependencies = [
@@ -86,10 +86,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "18r93ii2ayw8n60qsx259dy8nwgbfxf3ndncla0xbia79np8r6dg";
+      sha256 = "1l13fy0y55h5c5ccm7c94mwfhf6bk5xj83qv1d3izs288lavfk4p";
       type = "gem";
     };
-    version = "8.1.3";
+    version = "8.1.3.1";
   };
   actiontext = {
     dependencies = [
@@ -105,10 +105,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1ln7mwflqf7nsgkj9lm1p7bmc6h8yqaa47q1cdj9xsp102f034fj";
+      sha256 = "1wlam4mqrxfsylsyf01yc7907ramis3kisgfn7frr8ni6gc2k9sx";
       type = "gem";
     };
-    version = "8.1.3";
+    version = "8.1.3.1";
   };
   actionview = {
     dependencies = [
@@ -126,10 +126,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0pgxl9p2q2zbwb6626yw7rgpbmv2bvxykq2w1h83inrygy6chiqk";
+      sha256 = "1dng2b5bbjm4c1bcpak7q9w4zh71mz2nkknipszl6yy42j28p9id";
       type = "gem";
     };
-    version = "8.1.3";
+    version = "8.1.3.1";
   };
   activejob = {
     dependencies = [
@@ -143,10 +143,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1lz8bxb6pcf9yvxwyj6355aws3ylxi5rwc577ly4q858d9vb2jd1";
+      sha256 = "0jlm75lxj7bjd67jkgclzlrhlm9sj4ywdzngxq6z83ckvxsx538w";
       type = "gem";
     };
-    version = "8.1.3";
+    version = "8.1.3.1";
   };
   activemodel = {
     dependencies = [ "activesupport" ];
@@ -157,10 +157,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "06c23jww82grgvxw19g4bi9c957aj5hh24wzyyw4jdpg9jz5rh4h";
+      sha256 = "124gi0hlvkabkl5fzfn90ylj7gbyg22rv5208k8p3hxf5z705k4r";
       type = "gem";
     };
-    version = "8.1.3";
+    version = "8.1.3.1";
   };
   activerecord = {
     dependencies = [
@@ -175,10 +175,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1avhmih54xqyj14zrv6ciw2ndpb11bmkwq0fcwm0mfk64ixvw0w0";
+      sha256 = "0fs0q1c35k2bh079kj1xbx9pvqx7q2z4k9d32fqgcf29iz1bcbqa";
       type = "gem";
     };
-    version = "8.1.3";
+    version = "8.1.3.1";
   };
   activestorage = {
     dependencies = [
@@ -192,10 +192,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0k9q8sdlf576r8rp2hgdxy5lpr8f157bpq8mfsk52f8l169wwr05";
+      sha256 = "1vv3c41nfsii6j2nl80mbgffld96s4ak3zfjk6jgy73v717jamgm";
       type = "gem";
     };
-    version = "8.1.3";
+    version = "8.1.3.1";
   };
   activesupport = {
     dependencies = [
@@ -220,10 +220,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "03m2vjhq3nmc8c3hpivxhvkjd8igg16nmv0p2fgdsgacppgy1991";
+      sha256 = "0xhkhdx8svhaf439y398yixik0snzarnnsy43688p92yy9jqfic5";
       type = "gem";
     };
-    version = "8.1.3";
+    version = "8.1.3.1";
   };
   addressable = {
     dependencies = [ "public_suffix" ];
@@ -439,10 +439,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1bkcvp4aavdxh1pmgg65sypyjx5l0w5ffylfsk65di1xm9kpgh3d";
+      sha256 = "1g9zi8c4i7g8zz0c3hxrw6mblrjvgn7akys60clb9si7c1k1gljk";
       type = "gem";
     };
-    version = "4.1.0";
+    version = "4.1.2";
   };
   bindex = {
     groups = [
@@ -627,10 +627,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1aymcakhzl83k77g2f2krz07bg1cbafbcd2ghvwr4lky3rz86mkb";
+      sha256 = "1qfi2ns3zwkgq616fc127xiqhan7g7m7gqpwriwcr34nds1vxwdj";
       type = "gem";
     };
-    version = "1.3.6";
+    version = "1.3.8";
   };
   connection_pool = {
     groups = [
@@ -672,10 +672,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0pfl5c0pyqaparxaqxi6s4gfl21bdldwiawrc0aknyvflli60lfw";
+      sha256 = "15djj19ynz3sbw54fsf8n7y3sha8a333f2mgvjfwhr46jhcqg1ll";
       type = "gem";
     };
-    version = "1.0.6";
+    version = "1.0.7";
   };
   csv = {
     groups = [ "default" ];
@@ -716,7 +716,6 @@
     groups = [
       "default"
       "development"
-      "test"
     ];
     platforms = [ ];
     source = {
@@ -765,10 +764,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0ilmy9wgy57nj3zgal4j4vqx15sc7if7yavvah8wwjnw3h2nbh64";
+      sha256 = "1hacqyck22k7g9qr9n5wwq32vg02hwwjv7kqxrb4xrslb2wg41fn";
       type = "gem";
     };
-    version = "5.0.3";
+    version = "5.0.4";
   };
   devise-two-factor = {
     dependencies = [
@@ -868,10 +867,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1ncmbdjf2bwmk0jf5cxywns9zbxyfiy4h4p3pzi7yddyjhv81qrq";
+      sha256 = "1raacipbb5m0176w05m3n21ip91w7i0cb5zjqhkz2nqgf234kcm9";
       type = "gem";
     };
-    version = "6.0.4";
+    version = "6.0.6";
   };
   erb_lint = {
     dependencies = [
@@ -964,10 +963,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "077n5ss3z3ds4vj54w201kd12smai853dp9c9n7ii7g3q7nwwg54";
+      sha256 = "0y7j6yzv07zggic6g0p2v1ivnvkzsbqjnfdl4215qqb6cxz290hq";
       type = "gem";
     };
-    version = "2.14.1";
+    version = "2.14.3";
   };
   faraday-follow_redirects = {
     dependencies = [ "faraday" ];
@@ -986,10 +985,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0v4hfmc7d4lrqqj2wl366rm9551gd08zkv2ppwwnjlnkc217aizi";
+      sha256 = "125m3qri52vwh5v9dhq0dkqxf8629cxrf99yyc01pva72wasyy0f";
       type = "gem";
     };
-    version = "3.4.2";
+    version = "3.4.4";
   };
   ferrum = {
     dependencies = [
@@ -1051,10 +1050,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "04gzhqvsm4z4l12r9dkac9a75ah45w186ydhl0i4andldsnkkih5";
+      sha256 = "09zl0rkskfq0cwfrk9ypjvflvzanfg3xbhh1slaa1myry7xi4zq3";
       type = "gem";
     };
-    version = "1.3.0";
+    version = "1.4.0";
   };
   google-apis-core = {
     dependencies = [
@@ -1223,24 +1222,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1994i044vdmzzkyr76g8rpl1fq1532wf0sb21xg5r1ilj5iphmr8";
+      sha256 = "1dfikmmd9dllirsfq0kjiyxpmlq0afkxm5sslsr97r9g85ifpy80";
       type = "gem";
     };
-    version = "1.14.8";
-  };
-  image_processing = {
-    dependencies = [
-      "mini_magick"
-      "ruby-vips"
-    ];
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1ys28w0ayq3vl2sl4lpq6jnsy7gd4p9vzimyi449hqn2r5lw2k3m";
-      type = "gem";
-    };
-    version = "1.14.0";
+    version = "1.15.2";
   };
   io-console = {
     groups = [
@@ -1271,10 +1256,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1bishrxfn2anwlagw8rzly7i2yicjnr947f48nh638yqjgdlv30n";
+      sha256 = "1qs8a9vprg7s8krgq4s0pygr91hclqqyz98ik15p0m1sf2h5956y";
       type = "gem";
     };
-    version = "1.17.0";
+    version = "1.18.0";
   };
   jmespath = {
     groups = [ "default" ];
@@ -1295,10 +1280,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0il6qxkxqql7n7sgrws5bi5a36v51dswqcxb6j6gm8aj62shp6r8";
+      sha256 = "10q54a0dkm0050n0zzqiv2ln8w931wszybbhym1i8r4mbpvkv90k";
       type = "gem";
     };
-    version = "2.19.3";
+    version = "2.21.1";
   };
   jwt = {
     dependencies = [ "base64" ];
@@ -1306,10 +1291,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0dfm4bhl4fzn076igh0bmh2v1vphcrxdv6ldc46hdd3bkbqr2sdg";
+      sha256 = "1mqps8z4ly74hpksfajcfamqk1wb79biy187pn10knmi6zzb26al";
       type = "gem";
     };
-    version = "3.1.2";
+    version = "3.2.0";
   };
   language_server-protocol = {
     groups = [
@@ -1430,10 +1415,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "011fdngxzr1p9dq2hxqz7qq1glj2g44xnhaadjqlf48cplywfdnl";
+      sha256 = "062r891hxis58j5q735kk9sj5srxx0rv813f8m95bilsjm3gf1r0";
       type = "gem";
     };
-    version = "2.25.1";
+    version = "2.25.2";
   };
   mail = {
     dependencies = [
@@ -1450,20 +1435,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0ha9sgkfqna62c1basc17dkx91yk7ppgjq32k4nhrikirlz6g9kg";
+      sha256 = "1s30l5z7jkazgi4m6l6mh80rgsyhh2pp1pa5h70xclsj8z54wmq6";
       type = "gem";
     };
-    version = "2.9.0";
+    version = "2.9.1";
   };
   marcel = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1vhb1sbzlq42k2pzd9v0w5ws4kjx184y8h4d63296bn57jiwzkzx";
+      sha256 = "17w53z6vka8ddmxvi936biqv443d5yg0503wj7xfmy9j1qvfjy0n";
       type = "gem";
     };
-    version = "1.1.0";
+    version = "1.2.1";
   };
   matrix = {
     groups = [
@@ -1492,17 +1477,6 @@
     };
     version = "1.1.0";
   };
-  mini_magick = {
-    dependencies = [ "logger" ];
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1i2ilgjfjqc6sw4cwa4g9w3ngs41yvvazr9y82vapp5sfvymsf99";
-      type = "gem";
-    };
-    version = "5.3.1";
-  };
   mini_mime = {
     groups = [
       "default"
@@ -1544,20 +1518,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "048ls6kn009jkwj1rvka2b5vnwq73b0krjz740j6j03cwcfqmb48";
+      sha256 = "1wfnqyfayx9n9j7x871v2ars4hjhfisi1dl24fa64ylq3mns6ghm";
       type = "gem";
     };
-    version = "6.0.3";
+    version = "6.0.6";
   };
   msgpack = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0cnpnbn2yivj9gxkh8mjklbgnpx6nf7b8j2hky01dl0040hy0k76";
+      sha256 = "0yry1bcnbl0c5xwg173n5y647596r8ydmsppa01c5l8d6lnw44a4";
       type = "gem";
     };
-    version = "1.8.0";
+    version = "1.8.4";
   };
   multi_json = {
     groups = [ "default" ];
@@ -1592,10 +1566,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0ax0f0r97jm83q462vsrcbdxprs894fyyc44v62c48ihgb39hmcs";
+      sha256 = "1px886qvws5zvqphy5cysj8vg01lym0w7vs9wq1h41pk1pjlxaln";
       type = "gem";
     };
-    version = "0.6.4";
+    version = "0.6.6";
   };
   net-pop = {
     dependencies = [ "net-protocol" ];
@@ -1662,10 +1636,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1s30b7h7qpyim30m8060xs415mbr3ci7i5hdg09chh1aqfx2qcbq";
+      sha256 = "1d9safb4dly6qmc2g06444l0zifby52yy6j1a5fa1g4j3ihm3jah";
       type = "gem";
     };
-    version = "1.19.3";
+    version = "1.19.4";
   };
   numo-narray-alt = {
     groups = [ "default" ];
@@ -1677,20 +1651,6 @@
     };
     version = "0.10.3";
   };
-  oj = {
-    dependencies = [
-      "bigdecimal"
-      "ostruct"
-    ];
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0g817hjx1rh4zhvcpb9m6lr6l8yyq3n8vnjm9x1rc5wr51hv6d9n";
-      type = "gem";
-    };
-    version = "3.16.16";
-  };
   onnxruntime = {
     dependencies = [ "ffi" ];
     groups = [ "default" ];
@@ -1732,16 +1692,6 @@
     };
     version = "1.1.4";
   };
-  ostruct = {
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "04nrir9wdpc4izqwqbysxyly8y7hsfr4fsv69rw91lfi9d5fv8lm";
-      type = "gem";
-    };
-    version = "0.6.3";
-  };
   package_json = {
     groups = [ "default" ];
     platforms = [ ];
@@ -1762,10 +1712,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1xmywpn5zj99708zhmxx2xf76fnwwffrxa3648igvaqai8r5f6ml";
+      sha256 = "1sz2mj2bawvrwrda45rr7bmqqqwncyl46yqn984q0r4mx9c6mysr";
       type = "gem";
     };
-    version = "43.4.4";
+    version = "43.6.1";
   };
   parallel = {
     groups = [
@@ -1819,10 +1769,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1xlxmg86k5kifci1xvlmgw56x88dmqf04zfzn7zcr4qb8ladal99";
+      sha256 = "0w5mha75hs8gdj75g8vl0sxpyp8rzvwq8a4jcmi4ah8cf370zjyz";
       type = "gem";
     };
-    version = "0.6.3";
+    version = "0.6.4";
   };
   pretender = {
     dependencies = [ "actionpack" ];
@@ -1896,24 +1846,6 @@
     };
     version = "0.3.11";
   };
-  psych = {
-    dependencies = [
-      "date"
-      "stringio"
-    ];
-    groups = [
-      "default"
-      "development"
-      "test"
-    ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0x0r3gc66abv8i4dw0x0370b5hrshjfp6kpp7wbp178cy775fypb";
-      type = "gem";
-    };
-    version = "5.3.1";
-  };
   public_suffix = {
     groups = [
       "default"
@@ -1934,10 +1866,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1a3jd9qakasizrf7dkq5mqv51fjf02r2chybai2nskjaa6mz93mz";
+      sha256 = "1yw6nvkvddriacmva8hm0za0961d6j96dm7zm6748rmyzcfqgvf8";
       type = "gem";
     };
-    version = "7.2.0";
+    version = "8.0.2";
   };
   racc = {
     groups = [
@@ -2045,10 +1977,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1lww7i686rm9s50d34hb596y2kfl46dida2kjy8gr64c6jjpn0bd";
+      sha256 = "0an5r7sxc6011kkalh78vp4w14ff1r6d31fmcsfbywf1pwv1mlfc";
       type = "gem";
     };
-    version = "8.1.3";
+    version = "8.1.3.1";
   };
   rails-dom-testing = {
     dependencies = [
@@ -2082,10 +2014,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "128y5g3fyi8fds41jasrr4va1jrs7hcamzklk1523k7rxb64bc98";
+      sha256 = "1hi25xz5ijz3kjx4vsiywqbq05mlkas7di8pwc3p6mhyn34sg5z7";
       type = "gem";
     };
-    version = "1.7.0";
+    version = "1.7.1";
   };
   rails-i18n = {
     dependencies = [
@@ -2120,10 +2052,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "08nyhsigcvjpj9i3r0s73yi8zm16sxmr2x7xgxlaq2jjrghb0gli";
+      sha256 = "11s4n3zqd7bry5ndraq02f641hskhmnfcza8lkzcw04sawra5213";
       type = "gem";
     };
-    version = "8.1.3";
+    version = "8.1.3.1";
   };
   rainbow = {
     groups = [
@@ -2148,15 +2080,15 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "175iisqb211n0qbfyqd8jz2g01q6xj038zjf4q0nm8k6kz88k7lc";
+      sha256 = "009p524zl0p0kfa65nii8wdmaigkmawv9pbvlcffky7islmmp0nb";
       type = "gem";
     };
-    version = "13.3.1";
+    version = "13.4.2";
   };
-  rdoc = {
+  rbs = {
     dependencies = [
-      "erb"
-      "psych"
+      "logger"
+      "prism"
       "tsort"
     ];
     groups = [
@@ -2167,10 +2099,30 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "14iiyb4yi1chdzrynrk74xbhmikml3ixgdayjma3p700singfl46";
+      sha256 = "0wpx4dlypl5i8bz2zss2pl5mnra904frn3h9l95knr5h128abawb";
       type = "gem";
     };
-    version = "7.2.0";
+    version = "4.1.0";
+  };
+  rdoc = {
+    dependencies = [
+      "erb"
+      "prism"
+      "rbs"
+      "tsort"
+    ];
+    groups = [
+      "default"
+      "development"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0sf4909q2mr9z0rpygv94z12b0yamg07gz8cba2mi5k3m448rgq3";
+      type = "gem";
+    };
+    version = "8.0.0";
   };
   redis-client = {
     dependencies = [ "connection_pool" ];
@@ -2178,10 +2130,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0jw2xjzz24dwn85y8v1jf1vzzpsnypsvs06f1qfa91w7rpwr5248";
+      sha256 = "18xy2nd8mcb186gqd11sy3vfwkq5n85mq26v7l325jkdiwgvyr8c";
       type = "gem";
     };
-    version = "0.28.0";
+    version = "0.29.0";
   };
   regexp_parser = {
     groups = [
@@ -2610,10 +2562,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1szw72f2k9vyyi81c9rv1rj91s849j6jxwvvsxsxdnmi5gr6c4ja";
+      sha256 = "03z48p8asbid67lmlsn12njk1gdb6xqibabyz5na3c94242ws85y";
       type = "gem";
     };
-    version = "8.1.2";
+    version = "8.1.6";
   };
   signet = {
     dependencies = [
@@ -2697,24 +2649,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1cbkgb5s3qsfjgnp75habwxsi97711jg90yh52ihcssbf58430c6";
+      sha256 = "01i6k25fv3w3f5ph5cix9ipg19ajsy6zrzxdm18ashzrldrjjmq4";
       type = "gem";
     };
-    version = "2.9.2";
-  };
-  stringio = {
-    groups = [
-      "default"
-      "development"
-      "test"
-    ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1q92y9627yisykyscv0bdsrrgyaajc2qr56dwlzx7ysgigjv4z63";
-      type = "gem";
-    };
-    version = "3.2.0";
+    version = "2.9.5";
   };
   strip_attributes = {
     dependencies = [ "activemodel" ];
@@ -3002,10 +2940,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0qj9dmkmgahmadgh88kydb7cv15w13l1fj3kk9zz28iwji5vl3gd";
+      sha256 = "0ij19k6034x0c4hw0ywa7wnk5s912r8aq0hhjss10d5z36q5dicp";
       type = "gem";
     };
-    version = "0.8.0";
+    version = "0.8.2";
   };
   websocket-extensions = {
     groups = [
@@ -3053,9 +2991,9 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1pbkiwwla5gldgb3saamn91058nl1sq1344l5k36xsh9ih995nnq";
+      sha256 = "04hx33lsnp4q0qf8982mz0acs1dap5s2bsmihi0n0g08249sc4kj";
       type = "gem";
     };
-    version = "2.7.5";
+    version = "2.8.2";
   };
 }
diff --git a/pkgs/by-name/do/docuseal/package.nix b/pkgs/by-name/do/docuseal/package.nix
index 5866efc1384e..07b4cb72f217 100644
--- a/pkgs/by-name/do/docuseal/package.nix
+++ b/pkgs/by-name/do/docuseal/package.nix
@@ -6,6 +6,7 @@
   nixosTests,
   ruby_4_0,
   pdfium-binaries,
+  leptonica,
   makeWrapper,
   fetchYarnDeps,
   yarn,
@@ -15,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "docuseal";
-  version = "2.5.3";
+  version = "3.2.0";
 
   src = fetchFromGitHub {
     owner = "docusealco";
     repo = "docuseal";
     tag = finalAttrs.version;
-    hash = "sha256-9fDEj9gOBZrn4dNWf+QRCZs3gUv3Mx/YZLRx55ShS7E=";
+    hash = "sha256-yWy5mRrNHMZPimIPIVKyCXQDw5JlEhdgNZjOQ7mq8mY=";
     # https://github.com/docusealco/docuseal/issues/505#issuecomment-3153802333
     postFetch = "rm $out/db/schema.rb";
   };
@@ -107,7 +108,12 @@ stdenv.mkDerivation (finalAttrs: {
 
   postFixup = ''
     wrapProgram $out/bin/rails \
-      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ pdfium-binaries ]}"
+      --prefix LD_LIBRARY_PATH : "${
+        lib.makeLibraryPath [
+          pdfium-binaries
+          leptonica
+        ]
+      }"
   '';
 
   passthru = {
diff --git a/pkgs/by-name/do/dokieli/missing-hashes.json b/pkgs/by-name/do/dokieli/missing-hashes.json
index 8987bc04facd..e12cfdf61fc1 100644
--- a/pkgs/by-name/do/dokieli/missing-hashes.json
+++ b/pkgs/by-name/do/dokieli/missing-hashes.json
@@ -1,28 +1,27 @@
 {
-  "@rolldown/binding-android-arm64@npm:1.0.0-rc.17": "7c821eb984e2dd03b05979be3116d927326a1752e7d04462f6c78721fc47fb33d1a584e8c739b181dbfb5c28170541d05f775ada38e81bb685e43d03d974abe3",
-  "@rolldown/binding-darwin-arm64@npm:1.0.0-rc.17": "ddedec6840b8e32b7c45a4afe9d797bb24ea74ef222a1b443161045f0b53ec3a5752b108552fe6c99182e2553dd53498d96d3b30551cd3f1e8057559f23b1ed7",
-  "@rolldown/binding-darwin-x64@npm:1.0.0-rc.17": "b66ce82e3162261c045027b3aa061cd735c9b1395e77756e06b973f8d0e4256247ddfdb7ee8134363dfcd9d83e665b647b45b666a65c8454babdee19f6d57b40",
-  "@rolldown/binding-freebsd-x64@npm:1.0.0-rc.17": "87b9045771edda717c7d66df105bba2c22c88214254eae48d54ca641f79b4558c2d1ae3db27d8e36b230728263d539c5f6e03e895dbed6e08afa495f634eb42d",
-  "@rolldown/binding-linux-arm-gnueabihf@npm:1.0.0-rc.17": "43e60168d359a5edae352d948a6515c40a8e047fef7541693cbf18a09d80076efb9308a804c5ea7f645883f8f6b7b43e0e14ea677df63fb4016a55ba6f63b947",
-  "@rolldown/binding-linux-arm64-gnu@npm:1.0.0-rc.17": "d6bfe49089d598886e8c9c92e45240a2404e9594c4abc25f303c8655b859e0f0b67c18947e23177ccc5fb81c9b22a1bd32f2ed052531cc41491b4261ed728342",
-  "@rolldown/binding-linux-arm64-musl@npm:1.0.0-rc.17": "be5459bf78de0931993158783af8e349a68d03610876eb131f48fa51414a45683047cd9b4ad7631f385fedc9bb89677e8d12e874104a038b63932aaa1d7bceb3",
-  "@rolldown/binding-linux-ppc64-gnu@npm:1.0.0-rc.17": "e36194c8a39afc6522ca71c2ebf4c038792bf2c0141da76e8a385bebdda077a52f95ece9bd0a3818d5c0023e7e8ce708566d42ecd2ff31296a26a41ed6847aa4",
-  "@rolldown/binding-linux-s390x-gnu@npm:1.0.0-rc.17": "288ce91c69b13e37b2106fcfb663a981aba9de65d3bb4d3cd8c17b9e8193f3de44d08d1201c4d3a18fdeec5a89256d5b3b4d5bb913ff023cb577c403f8889917",
-  "@rolldown/binding-linux-x64-gnu@npm:1.0.0-rc.17": "d532e43e02e0a84c71ff9be34791d7b32b71786bac4921f9e4f92da39a7d5daeabeb4188c7cc088a8a80ab0691dcf1cc9d414396ce7ff6a970b1374e033df8f6",
-  "@rolldown/binding-linux-x64-musl@npm:1.0.0-rc.17": "56aecbe0a2aeaedd558c62a5057a7f915ecada0528a27b5edd80478d948c3645104a56c88121c71edefe9a6af7500f053724103099a90764eb8b84c3ee1f9536",
-  "@rolldown/binding-openharmony-arm64@npm:1.0.0-rc.17": "cc7a806e106f4c0d24400af42155b8b396f712e25d76e13b033895b3b635e21edb2246d3c8592c86989c7aaae1ded1708d36516472555bbed3ccaffc939403a4",
-  "@rolldown/binding-wasm32-wasi@npm:1.0.0-rc.17": "e6fb0aff901de475a4874af6b0473b396bf1bddf6cbb9acbdb6d4c9318ab2fa3e09d80435ecaeb7866b03effea79c57db9a271b5c720007341949e06828c8385",
-  "@rolldown/binding-win32-arm64-msvc@npm:1.0.0-rc.17": "d3724ce9f4117d28f903ae1bfc34e3a3efac853691577e511cef91259eb8355dc24f2f27a832bbbd9ad3323dc1b0c3ddbdc4c791ae2a6dd5e5b0c9051384d4d0",
-  "@rolldown/binding-win32-x64-msvc@npm:1.0.0-rc.17": "6f4a348202955f74481ccf1c0ec5fa96671507353b6a7f680b920c773f0dda4ebd46c1561428efcefacb9b4d279cd550c80a79fa261f8db173b527ae9a671eca",
-  "lightningcss-android-arm64@npm:1.32.0": "1cb326ad39dcb02cf9f45025c167b6900e3a04b08f5149d3c5ee26054b00d08db3736fb69183a6c3ed1cb32dddd148608c784b6631b4777623f7dd0c032c392d",
-  "lightningcss-darwin-arm64@npm:1.32.0": "da954d0c215d0e95f15a92c8717f871017586e1332b98fd40e96196571d2fd3d51a727dc530768afee9f6a04da210510740574dd0c8dbf2ecced79e5996f1a06",
-  "lightningcss-darwin-x64@npm:1.32.0": "b1d298c9173f839e8447d1917ed8bc5ab098ed0fc4e4b419d36ac5afe8b27bf21cb47d00a35c3d2edadcac598086e9b4f26c992a809d79f9681d6865a230d79e",
-  "lightningcss-freebsd-x64@npm:1.32.0": "0eb59f6acf2fcdc944c921b0ac2a16ee803452b9438f573ad6bc41be00040b791ed698698ed5c06f98ef43a6fed0a54987ba3a88da204de9978db2fca96a4a65",
-  "lightningcss-linux-arm-gnueabihf@npm:1.32.0": "7d1ea43986d2370a90cefc920dac3e041e0d19445cc4fdaf244644b57b6937588d7c3a464c31440617231f55a6dad79744cf707912e05f3b46a1694abb5b4e00",
-  "lightningcss-linux-arm64-gnu@npm:1.32.0": "f01ede75f41480a164d18338fa46d9fccdb4a821717174ce848ff8b2aa4badba4f1d331deb3ebec3ee2f0eb95bfa2e35f54877f371427b04e6f36a4783aa1414",
-  "lightningcss-linux-arm64-musl@npm:1.32.0": "38d373f99768f1c5ab6a9c87e1c0ec45eccdb3fe4d216dd5cd06629648c4b0689570ad4e89285d490662cde1790cd36e6b3d176c14e5e31f6869c604aa2df820",
-  "lightningcss-linux-x64-gnu@npm:1.32.0": "0a1433d46a4a010f87b615c3fa43725a456bae259858a2c927899cbf93074f0ae40f49901bf6af6daa30a4d169c86f594f6341fd775bf7b59293b8d7947b81c5",
-  "lightningcss-linux-x64-musl@npm:1.32.0": "a6f48ccc30a73d30563c7b61856d1fd6a8812ce62b1bee797f227e06612df70aab4ccd1908552952f77ca7ff2a51019f62d14ae5310ca67311635eeec55d3a9e",
-  "lightningcss-win32-arm64-msvc@npm:1.32.0": "a919be7fb298c1102bccf18b6f83d54946adfac70ab2ac9c95e4ae38ded76d8f530215b0bcda4d38df4ffc40a70abe3afd91d01d35fd122e7d119ed0e46972d0",
-  "lightningcss-win32-x64-msvc@npm:1.32.0": "5b8d3431aadbdc40a0a7eae32f2415e4f28b547af1a1cd5b35a35d67f772a89492c7fa03e9fc88ce804b14f5f88e412e49fff40d1b0aad67177de815c434207e"
+  "@rolldown/binding-android-arm64@npm:1.2.3": "5181b7152d6b6d20e219fa5a3dc57d258c146f1e41d4c1441482b134a29096d104002cb28f5762029556285c781d829ba67a6fdce842a7ecdae2f9b12ab3bc24",
+  "@rolldown/binding-darwin-arm64@npm:1.2.3": "7ff0488b1b7acc8ae6c8e20b15811b221226000ae8560ac2334f28ca07adf1da6a088804d67cf35c4884779113ab34858043b6fff93f7579fb41675aa22bb685",
+  "@rolldown/binding-darwin-x64@npm:1.2.3": "6b09cf6781128651bca9bbe2ea1f9de129a64717e191c7245140c0a12185498b03e248b0b4028d7dd92f98c22dc282bc44d544edb79a9508c94723d865b966ed",
+  "@rolldown/binding-freebsd-x64@npm:1.2.3": "e52524ae9120e6da7cf85bac985a50ba9c9714aaa34ebfdafb421d94b543de410217a11364ff048acdead2f8c7df24cc17a0dfef4f6f2ccc21e0bd1ad9f32eac",
+  "@rolldown/binding-linux-arm-gnueabihf@npm:1.2.3": "bd27b41ad476b6de2455108b857a627b1df0f47eb885205a9a06a60ea670cffe8b366be89acea13cbc7a55b387331509bcfef2cfad0cb25faa0c1db450e9dbb3",
+  "@rolldown/binding-linux-arm64-gnu@npm:1.2.3": "cf5bd6b0064274cc49f0b720da71672783a5e0cd4820dde5f3475bdcc228c3315791f597d5a75b5ae9d8ddde41d2c81ad67cc6a99c5ae49039fffb54cfcbc764",
+  "@rolldown/binding-linux-arm64-musl@npm:1.2.3": "740ebdac1f806a279f4128f99060e44d6cc4f00a9bed1dc70637aab53d785e96be7a1876a74202268bf73cc3a425aa1f1550da2f86872bbf49cbd46edf09b6d3",
+  "@rolldown/binding-linux-ppc64-gnu@npm:1.2.3": "704536b8de2c6d680153874fb57016c1284d297d87b166a696e53f1af1d9d0176cfc578252b588d7e59849309d71d638f73c6163c3c0714335e8993b8ff2d97f",
+  "@rolldown/binding-linux-s390x-gnu@npm:1.2.3": "a29de0fad1238e97e7700e3df3762872493d0557977ee9e15eacb9f9d3c9c0f29b110d858881eb4bfbf9b43f939bb61687bb33760f52ccb3acad2e998f66a283",
+  "@rolldown/binding-linux-x64-gnu@npm:1.2.3": "a048e32713eae7513d0f68ad675087bc86ed57493d59cb9920bb10f2ad567adbe9fa3e82e786705d2cb26d820ff98b48cd13abcc069e7044a593de4b8b795a9d",
+  "@rolldown/binding-linux-x64-musl@npm:1.2.3": "0b73be9ae16942651c9060ffdc2146677151a496159ca301701174aed4400e27eda8de078f649efd670da3ba208b0429c0130bf627d37c77ff3f23d97c78f6aa",
+  "@rolldown/binding-openharmony-arm64@npm:1.2.3": "5bf6288cbc11e96fdd9dae69dad2828535df0da14ed64373bc80f813b1098f61e7320e6448c36bc573cbd9119cd6855a7e13e76cf5bbab42d9d1586a8a499647",
+  "@rolldown/binding-win32-arm64-msvc@npm:1.2.3": "7a1dbc749f69f50cdf71804bfe8e6af8880b5d9f5c7f8d2e9fb5d1d8702e74b09471b6bbc1bb81051812f187298404c5f46d4bcbf92682a4d0e9a37d850fbed8",
+  "@rolldown/binding-win32-x64-msvc@npm:1.2.3": "5281bbfe23a6ef1938400ea0e1803293b54364489cf1b43d49d9fc346d0f258cec237cc112ceb8539190d7fa12913f6ef749a75b655c8b5bb95ed1ab4830c4e7",
+  "lightningcss-android-arm64@npm:1.33.0": "46c40a0474a7a9ddcdc33e0ea634912894a9360b6ba6f2bc42f1a817d16992784d2fe6f421d293a90ea94fb481503e27fdc54f0540de0b41d7028fe9e9c9e56a",
+  "lightningcss-darwin-arm64@npm:1.33.0": "398b770e33f66db9e4c14e4a45d0e93fa59644bd29ce5082de79ee9560a5946321ac55e896aa7fb3f177d218bef3f2dca530e209a857f0f066bf3296f5dc0742",
+  "lightningcss-darwin-x64@npm:1.33.0": "132bdab8f7b66dc99730f1ccfcb882880e411420e3f9ca764c348c686112d75962d5d7e928f3bbce7088c1be168d00ea8d722fd909033b807eef191b5a2832c0",
+  "lightningcss-freebsd-x64@npm:1.33.0": "05001395776e994ea1254dcc2613f06b44458ba33769e3a1679a0f577e43632af378cc1582f3bd1cb36e480d237066a371bc04233d6c84f8e2fe9979ab4a4032",
+  "lightningcss-linux-arm-gnueabihf@npm:1.33.0": "d0f6d993846992cf6db80f2992d0b89ffddd65a8260bbe6a1534bde28510bcfa214e8831df9ccfef5ede006a6368de1649e1d96a3e122169286647b704e08f5f",
+  "lightningcss-linux-arm64-gnu@npm:1.33.0": "278a5c553e15ed7645d3e83a3b1515060e98a8742b7008af28d610d6495a09368e73ed8b90bcb537b37249bfc2446ef5b9614b3626222f25153c538909488548",
+  "lightningcss-linux-arm64-musl@npm:1.33.0": "7aa2a2ef42e8c713e6e8eb947bf64d5272c6fdbfca7b4eb3adde555357652be27cc0d84d6fef6266543c2d303943a4c4472679d1e258458119b159f0ca868ffe",
+  "lightningcss-linux-x64-gnu@npm:1.33.0": "fa57a09af3340dc5f11fdbff820fbb7b08e306e69350a500b523c88f54c1e3a40b3785fed6043d69e2e18bacd4b72410518c9b817ee987c704a80851d9201e45",
+  "lightningcss-linux-x64-musl@npm:1.33.0": "4b0cad846f8fbe4ec321a45ef9c0d02cf4277980ac34dcfc7b422b34381e7cb11512819401b01bf029d10aa0fb8a35906ce850ba38d9f43605917ccc9b0b5d4a",
+  "lightningcss-win32-arm64-msvc@npm:1.33.0": "5e4b58d7a41fe3c37ce2af7b1a95c3722a6064a84fb6286ba2cf1106651223403b5a5863ecd3eb8fb9732480e612e30d786b859329391b0197dffc88ca18c953",
+  "lightningcss-win32-x64-msvc@npm:1.33.0": "7beb4c8580f9ea45fea6d92a8de42f706c4935b2ca68f4f5163a2bd9f6ed1574f7e53686e4927883078b07a4063a9fffdc4b41968568354259066c7a70c156a4"
 }
diff --git a/pkgs/by-name/do/dokieli/package.nix b/pkgs/by-name/do/dokieli/package.nix
index b3efb73d4b8b..6cb45e4d6366 100644
--- a/pkgs/by-name/do/dokieli/package.nix
+++ b/pkgs/by-name/do/dokieli/package.nix
@@ -16,19 +16,19 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "dokieli";
-  version = "0-unstable-2026-05-08";
+  version = "0-unstable-2026-08-10";
 
   src = fetchFromGitHub {
     owner = "dokieli";
     repo = "dokieli";
-    rev = "f0372663098582c0310c9e16918a55cf000fbaf1";
-    hash = "sha256-jpIQcE1GdjvEsk6HPxjdFLbrxGWvVCaaG7T08HdMj7Y=";
+    rev = "c23e80e4fe54a2ad20f36a9f21a0987f5e3e4505";
+    hash = "sha256-ZwK+MxrTodDvvJuQCIhcDkluor4ri856m/WhcVRwfzo=";
   };
 
   missingHashes = ./missing-hashes.json;
   offlineCache = yarn-berry.fetchYarnBerryDeps {
     inherit (finalAttrs) src missingHashes;
-    hash = "sha256-SEoYmh7oHmJrVhShOjRyaClyQxW9S96GCI3ggRkW+6U=";
+    hash = "sha256-AqmUWgVDksQeBKcC8mpq1xgQ5NcHTjX/YSgm9J+feBs=";
   };
 
   buildPhase = ''
@@ -79,9 +79,9 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Clientside editor for decentralised article publishing, annotations and social interactions";
     homepage = "https://github.com/dokieli/dokieli";
-    license = with lib.licenses; [
-      cc-by-40
-      mit
+    license = lib.licenses.AND [
+      lib.licenses.asl20
+      lib.licenses.cc-by-40
     ];
     platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [ shogo ];
diff --git a/pkgs/by-name/do/dolt/package.nix b/pkgs/by-name/do/dolt/package.nix
index 25b6d11e48f5..e50f124ca4b0 100644
--- a/pkgs/by-name/do/dolt/package.nix
+++ b/pkgs/by-name/do/dolt/package.nix
@@ -7,18 +7,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "dolt";
-  version = "2.2.3";
+  version = "2.2.4";
 
   src = fetchFromGitHub {
     owner = "dolthub";
     repo = "dolt";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KCefzDqFMXpqtPPVOyD41hdM9j7p1kftO1cNaGzDT0w=";
+    hash = "sha256-XAc584mxGsadxmY1Jf4JgaaBAUg9hXainGkaWIgdp5A=";
   };
 
   modRoot = "./go";
   subPackages = [ "cmd/dolt" ];
-  vendorHash = "sha256-CEqdHw9cFLcoewQyd4Y1yXdkSAdaQ/cRyVTxa5qCyMM=";
+  vendorHash = "sha256-k5fpdI1wtZQYpjJEyre3Kh57AC0i3PsU2SIsf8ga1c8=";
   proxyVendor = true;
   doCheck = false;
 
diff --git a/pkgs/by-name/do/domination/package.nix b/pkgs/by-name/do/domination/package.nix
index 736ee6533a8a..c20b07542e65 100644
--- a/pkgs/by-name/do/domination/package.nix
+++ b/pkgs/by-name/do/domination/package.nix
@@ -30,7 +30,7 @@ let
 in
 stdenv.mkDerivation {
   pname = "domination";
-  version = "1.3.4";
+  version = "1.3.5";
 
   # The .zip releases do not contain the build.xml file
   src = fetchsvn {
@@ -40,8 +40,8 @@ stdenv.mkDerivation {
     # https://sourceforge.net/p/domination/code/HEAD/tree/Domination/ChangeLog.txt
     # Alternatively, look for revs like "changelog update",
     # "new version x.y.z info on website", or "website update for x.y.z".
-    rev = "2664";
-    hash = "sha256-bkaHpqJSc3UvwNT7LwuPUT8xN0g6QypfLSHlLmm8nX8=";
+    rev = "2778";
+    hash = "sha256-OsCpSL/0QgaaUAzoyPPrAlJixRlqsLJu2D8FkEuo0Ak=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/dr/dracut/CVE-2026-6893.patch b/pkgs/by-name/dr/dracut/CVE-2026-6893.patch
deleted file mode 100644
index d770c1e9625a..000000000000
--- a/pkgs/by-name/dr/dracut/CVE-2026-6893.patch
+++ /dev/null
@@ -1,126 +0,0 @@
-diff --git a/modules.d/35network-legacy/dhclient-script.sh b/modules.d/35network-legacy/dhclient-script.sh
-index 0cb00ab..ae68952 100755
---- a/modules.d/35network-legacy/dhclient-script.sh
-+++ b/modules.d/35network-legacy/dhclient-script.sh
-@@ -20,11 +20,11 @@ setup_interface() {
-     mask=$new_subnet_mask
-     bcast=$new_broadcast_address
-     gw=${new_routers%%,*}
--    domain=$new_domain_name
-+    domain=$(printf -- "%s" "$new_domain_name" | tr -d '[:cntrl:]')
-     # get rid of control chars
-     search=$(printf -- "%s" "$new_domain_search" | tr -d '[:cntrl:]')
-     namesrv=$new_domain_name_servers
--    hostname=$new_host_name
-+    hostname=$(printf '%s' "$new_host_name" | tr -d -c 'a-zA-Z0-9.-')
-     [ -n "$new_dhcp_lease_time" ] && lease_time=$new_dhcp_lease_time
-     [ -n "$new_max_life" ] && lease_time=$new_max_life
-     preferred_lft=$lease_time
-@@ -56,20 +56,32 @@ setup_interface() {
-         ${preferred_lft:+preferred_lft ${preferred_lft}}
- 
-     if [ -n "$gw" ]; then
--        if [ "$mask" = "255.255.255.255" ]; then
--            # point-to-point connection => set explicit route to gateway
--            echo ip route add "$gw" dev "$netif" > /tmp/net."$netif".gw
--        fi
-+        gw_check=0
-+        for g in $gw; do
-+            case "$g" in
-+                *[!0-9.]*)
-+                    gw_check=1
-+                    break
-+                    ;;
-+            esac
-+        done
- 
--        echo "$gw" | {
--            IFS=' ' read -r main_gw other_gw
--            echo ip route replace default via "$main_gw" dev "$netif" >> /tmp/net."$netif".gw
--            if [ -n "$other_gw" ]; then
--                for g in $other_gw; do
--                    echo ip route add default via "$g" dev "$netif" >> /tmp/net."$netif".gw
--                done
--            fi
--        }
-+        if [ $gw_check -eq 0 ]; then
-+            if [ "$mask" = "255.255.255.255" ]; then
-+                # point-to-point connection => set explicit route to gateway
-+                echo ip route add "$gw" dev "$netif" > /tmp/net."$netif".gw
-+            fi
-+
-+            echo "$gw" | {
-+                IFS=' ' read -r main_gw other_gw
-+                echo ip route replace default via "$main_gw" dev "$netif" >> /tmp/net."$netif".gw
-+                if [ -n "$other_gw" ]; then
-+                    for g in $other_gw; do
-+                        echo ip route add default via "$g" dev "$netif" >> /tmp/net."$netif".gw
-+                    done
-+                fi
-+            }
-+        fi
-     fi
- 
-     if getargbool 1 rd.peerdns; then
-@@ -82,15 +94,15 @@ setup_interface() {
-     fi
-     # Note: hostname can be fqdn OR short hostname, so chop off any
-     # trailing domain name and explicitly add any domain if set.
--    [ -n "$hostname" ] && echo "echo ${hostname%."$domain"}${domain:+.$domain} > /proc/sys/kernel/hostname" > /tmp/net."$netif".hostname
-+    [ -n "$hostname" ] && echo "echo '${hostname%."$domain"}${domain:+.$domain}' > /proc/sys/kernel/hostname" > /tmp/net."$netif".hostname
- }
- 
- setup_interface6() {
--    domain=$new_domain_name
-+    domain=$(printf -- "%s" "$new_domain_name" | tr -d '[:cntrl:]')
-     # get rid of control chars
-     search=$(printf -- "%s" "$new_dhcp6_domain_search" | tr -d '[:cntrl:]')
-     namesrv=$new_dhcp6_name_servers
--    hostname=$new_host_name
-+    hostname=$(printf '%s' "$new_host_name" | tr -d -c 'a-zA-Z0-9.-')
-     [ -n "$new_dhcp_lease_time" ] && lease_time=$new_dhcp_lease_time
-     [ -n "$new_max_life" ] && lease_time=$new_max_life
-     preferred_lft=$lease_time
-@@ -105,7 +117,7 @@ setup_interface6() {
- 
-     # Note: hostname can be fqdn OR short hostname, so chop off any
-     # trailing domain name and explicitly add any domain if set.
--    [ -n "$hostname" ] && echo "echo ${hostname%."$domain"}${domain:+.$domain} > /proc/sys/kernel/hostname" > /tmp/net."$netif".hostname
-+    [ -n "$hostname" ] && echo "echo '${hostname%."$domain"}${domain:+.$domain}' > /proc/sys/kernel/hostname" > /tmp/net."$netif".hostname
- }
- 
- parse_option_121() {
-@@ -113,16 +125,18 @@ parse_option_121() {
-     # Each route is: <mask_width> <dest_octets...> <gateway_4_octets>
-     # mask_width determines how many destination octets follow (0-4)
-     #
--    # This version validates arguments before operations to prevent
--    # "integer expression expected" and "shift count out of range" errors.
-+    # Validate all arguments are numeric upfront to prevent
-+    # shell injection via crafted octets in destination/gateway.
-+    for _octet in "$@"; do
-+        case "$_octet" in
-+            '' | *[!0-9]*) return 0 ;;
-+        esac
-+    done
- 
-     while [ $# -ge 5 ]; do
-         mask="$1"
- 
-         # Validate mask is a number between 0-32
--        case "$mask" in
--            '' | *[!0-9]*) return 0 ;;
--        esac
-         if [ "$mask" -lt 0 ] 2> /dev/null || [ "$mask" -gt 32 ] 2> /dev/null; then
-             return 0
-         fi
-@@ -150,9 +164,6 @@ parse_option_121() {
-         # Check if destination is multicast (224.0.0.0 - 239.255.255.255)
-         multicast=0
-         if [ $need_dest -ge 1 ]; then
--            case "$1" in
--                '' | *[!0-9]*) return 0 ;;
--            esac
-             if [ "$1" -ge 224 ] 2> /dev/null && [ "$1" -lt 240 ] 2> /dev/null; then
-                 multicast=1
-             fi
diff --git a/pkgs/by-name/dr/dracut/package.nix b/pkgs/by-name/dr/dracut/package.nix
index dc479789b0d8..c083b549b618 100644
--- a/pkgs/by-name/dr/dracut/package.nix
+++ b/pkgs/by-name/dr/dracut/package.nix
@@ -2,6 +2,7 @@
   stdenv,
   lib,
   fetchFromGitHub,
+  fetchpatch2,
   gitUpdater,
   makeBinaryWrapper,
   pkg-config,
@@ -29,19 +30,22 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dracut";
-  version = "111";
+  version = "112";
 
   src = fetchFromGitHub {
     owner = "dracut-ng";
     repo = "dracut";
     tag = finalAttrs.version;
-    hash = "sha256-2jdS7/LGuLSBBXv1R/o8yjgwdXl2l2wNbZWxq01wSb0";
+    hash = "sha256-aER+3EbJP3HCBuei+oLHzt/j90fpWj5NgyhMTx3V/YQ=";
   };
 
-  # Patch from https://github.com/dracut-ng/dracut/commit/11577739221ff38c1fd29abbba51a6c797376ed6 included in main branch.
-  # Adapted to version 111 (line number and small formatting diff)
+  # Remove with the first release containing c4d555716d569038ca38365741e94ee07908f261.
   patches = [
-    ./CVE-2026-6893.patch
+    (fetchpatch2 {
+      name = "CVE-2026-15816.patch";
+      url = "https://github.com/dracut-ng/dracut/commit/c4d555716d569038ca38365741e94ee07908f261.patch?full_index=1";
+      hash = "sha256-UpeoiMyQgvwMNOjX39v0IQSIlwvM+MczyPKPRWmT6vQ=";
+    })
   ];
 
   strictDeps = true;
diff --git a/pkgs/by-name/dr/drawpile/package.nix b/pkgs/by-name/dr/drawpile/package.nix
index 70952f5d1eb6..c234efddf0dc 100644
--- a/pkgs/by-name/dr/drawpile/package.nix
+++ b/pkgs/by-name/dr/drawpile/package.nix
@@ -77,7 +77,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
+    inherit (finalAttrs) pname version src;
     hash = "sha256-u9fRbxKeQSou9Umw4EaqzzzDiN4zhyfx9sWnlZpfpxU=";
   };
 
diff --git a/pkgs/by-name/ec/eclipse-mat/package.nix b/pkgs/by-name/ec/eclipse-mat/package.nix
index 3f0dfba9ca2a..ca009a3e19b5 100644
--- a/pkgs/by-name/ec/eclipse-mat/package.nix
+++ b/pkgs/by-name/ec/eclipse-mat/package.nix
@@ -1,135 +1,170 @@
 {
+  lib,
+  stdenvNoCC,
+  bintools,
   fetchurl,
-  fontconfig,
-  freetype,
+  copyDesktopItems,
+  makeDesktopItem,
+  makeWrapper,
+  unzip,
+  jdk,
   glib,
   gsettings-desktop-schemas,
   gtk3,
-  jdk17,
-  lib,
-  libx11,
-  libxrender,
   libxtst,
-  makeDesktopItem,
-  makeWrapper,
-  shared-mime-info,
-  stdenv,
-  unzip,
   webkitgtk_4_1,
-  zlib,
 }:
 
-let
-  pVersion = "1.15.0.20231206";
-  pVersionTriple = lib.splitVersion pVersion;
-  majorVersion = lib.elemAt pVersionTriple 0;
-  minorVersion = lib.elemAt pVersionTriple 1;
-  patchVersion = lib.elemAt pVersionTriple 2;
-  baseVersion = "${majorVersion}.${minorVersion}.${patchVersion}";
-  jdk = jdk17;
-in
-stdenv.mkDerivation rec {
-  pname = "eclipse-mat";
-  version = pVersion;
+stdenvNoCC.mkDerivation (
+  finalAttrs:
+  let
+    baseVersion = lib.versions.pad 3 finalAttrs.version;
 
-  src = fetchurl {
-    url = "https://ftp.halifax.rwth-aachen.de/eclipse//mat/${baseVersion}/rcp/MemoryAnalyzer-${version}-linux.gtk.x86_64.zip";
-    sha256 = "sha256-icmo5zdK0XaH32kXwZUVaQ0VPSGEgvlLr7v7PtdbmCg=";
-  };
+    sources = {
+      x86_64-linux = {
+        suffix = "linux.gtk.x86_64";
+        hash = "sha256-4eqAp5hNQR5MTX37qwktqSVfe3ctaBolamEEm8yIN2c=";
+      };
+      aarch64-linux = {
+        suffix = "linux.gtk.aarch64";
+        hash = "sha256-MJUome0KjXjmjROTTnDbSTSnDKiUGHt6LAZY1giXmQ0=";
+      };
+      aarch64-darwin = {
+        suffix = "macosx.cocoa.aarch64";
+        hash = "sha256-Of/BJTaxD6x0+aNDKeod1RVWG86XFBmk8qdbU/p73qQ=";
+      };
+    };
 
-  desktopItem = makeDesktopItem {
-    name = "eclipse-mat";
-    exec = "eclipse-mat";
-    icon = "eclipse";
-    comment = "Eclipse Memory Analyzer";
-    desktopName = "Eclipse MAT";
-    genericName = "Java Memory Analyzer";
-    categories = [ "Development" ];
-  };
+    inherit (stdenvNoCC.hostPlatform) system;
+    source = sources.${system} or (throw "Unsupported system: ${system}");
+  in
+  {
+    pname = "eclipse-mat";
+    version = "1.17.0.20260601";
 
-  unpackPhase = ''
-    unzip $src
-  '';
+    strictDeps = true;
+    __structuredAttrs = true;
 
-  buildCommand = ''
-    mkdir -p $out
-    unzip $src
-    mv mat $out
+    src = fetchurl {
+      urls = [
+        "https://ftp.halifax.rwth-aachen.de/eclipse/mat/${baseVersion}/rcp/MemoryAnalyzer-${finalAttrs.version}-${source.suffix}.zip"
+        "https://download.eclipse.org/mat/${baseVersion}/rcp/MemoryAnalyzer-${finalAttrs.version}-${source.suffix}.zip"
+      ];
+      inherit (source) hash;
+    };
 
-    # Patch binaries.
-    interpreter=$(echo ${stdenv.cc.libc}/lib/ld-linux*.so.2)
-    libCairo=$out/eclipse/libcairo-swt.so
-    patchelf --set-interpreter $interpreter $out/mat/MemoryAnalyzer
-    [ -f $libCairo ] && patchelf --set-rpath ${
-      lib.makeLibraryPath [
-        freetype
-        fontconfig
-        libx11
-        libxrender
-        zlib
-      ]
-    } $libCairo
+    sourceRoot = ".";
 
-    # Create wrapper script.  Pass -configuration to store settings in ~/.eclipse-mat/<version>
-    makeWrapper $out/mat/MemoryAnalyzer $out/bin/eclipse-mat \
-      --prefix PATH : ${jdk}/bin \
-      --prefix LD_LIBRARY_PATH : ${
-        lib.makeLibraryPath [
-          glib
-          gtk3
-          libxtst
-          webkitgtk_4_1
-        ]
-      } \
-      --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH" \
-      --add-flags "-configuration \$HOME/.eclipse-mat/''${version}/configuration"
+    nativeBuildInputs = [
+      makeWrapper
+      unzip
+    ]
+    ++ lib.optionals stdenvNoCC.hostPlatform.isLinux [
+      copyDesktopItems
+      glib
+    ];
 
-    # Create desktop item.
-    mkdir -p $out/share/applications
-    cp ${desktopItem}/share/applications/* $out/share/applications
-    mkdir -p $out/share/pixmaps
-    find $out/mat/plugins -name 'eclipse*.png' -type f -exec cp {} $out/share/pixmaps \;
-    mv $out/share/pixmaps/eclipse64.png $out/share/pixmaps/eclipse.png
-  '';
+    buildInputs = lib.optionals stdenvNoCC.hostPlatform.isLinux [
+      gsettings-desktop-schemas
+      gtk3
+    ];
 
-  nativeBuildInputs = [
-    unzip
-    makeWrapper
-  ];
-  buildInputs = [
-    fontconfig
-    freetype
-    glib
-    gsettings-desktop-schemas
-    gtk3
-    jdk
-    libx11
-    libxrender
-    libxtst
-    zlib
-    shared-mime-info
-    webkitgtk_4_1
-  ];
+    # Keep the .app's notarized upstream signature valid
+    dontPatchShebangs = stdenvNoCC.hostPlatform.isDarwin;
 
-  dontBuild = true;
-  dontConfigure = true;
+    # The bundle ships JNA natives for every OS, so auditTmpdir finds Linux ELF
+    # objects and calls patchelf, which does not exist on Darwin.
+    noAuditTmpdir = stdenvNoCC.hostPlatform.isDarwin;
 
-  meta = {
-    description = "Fast and feature-rich Java heap analyzer";
-    mainProgram = "eclipse-mat";
-    longDescription = ''
-      The Eclipse Memory Analyzer is a tool that helps you find memory
-      leaks and reduce memory consumption. Use the Memory Analyzer to
-      analyze productive heap dumps with hundreds of millions of
-      objects, quickly calculate the retained sizes of objects, see
-      who is preventing the Garbage Collector from collecting objects,
-      run a report to automatically extract leak suspects.
-    '';
-    homepage = "https://www.eclipse.org/mat";
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    license = lib.licenses.epl20;
-    maintainers = [ lib.maintainers.ktor ];
-    platforms = [ "x86_64-linux" ];
-  };
+    desktopItems = lib.optionals stdenvNoCC.hostPlatform.isLinux [
+      (makeDesktopItem {
+        name = "eclipse-mat";
+        exec = "eclipse-mat";
+        icon = "eclipse-mat";
+        comment = "Eclipse Memory Analyzer";
+        desktopName = "Eclipse MAT";
+        genericName = "Java Memory Analyzer";
+        categories = [
+          "Development"
+          "Profiling"
+        ];
+      })
+    ];
 
-}
+    installPhase =
+      if stdenvNoCC.hostPlatform.isDarwin then
+        ''
+          runHook preInstall
+
+          mkdir -p $out/Applications
+          cp -R MemoryAnalyzer.app $out/Applications/
+
+          makeWrapper $out/Applications/MemoryAnalyzer.app/Contents/MacOS/MemoryAnalyzer $out/bin/eclipse-mat \
+            --prefix PATH : ${lib.makeBinPath [ jdk ]} \
+            --set JAVA_HOME ${jdk.home} \
+            --add-flags "-configuration \$HOME/.eclipse-mat/${finalAttrs.version}/configuration"
+
+          runHook postInstall
+        ''
+      else
+        ''
+          runHook preInstall
+
+          mkdir -p $out
+          cp -r mat $out/mat
+
+          patchelf --set-interpreter ${bintools.dynamicLinker} $out/mat/MemoryAnalyzer
+
+          # Pass -configuration so that settings are written to ~/.eclipse-mat/<version>
+          # instead of the read-only store path.
+          makeWrapper $out/mat/MemoryAnalyzer $out/bin/eclipse-mat \
+            --prefix PATH : ${lib.makeBinPath [ jdk ]} \
+            --set JAVA_HOME ${jdk.home} \
+            --prefix LD_LIBRARY_PATH : ${
+              lib.makeLibraryPath [
+                glib
+                gtk3
+                libxtst
+                webkitgtk_4_1
+              ]
+            } \
+            --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH" \
+            --add-flags "-configuration \$HOME/.eclipse-mat/${finalAttrs.version}/configuration"
+
+          unzip -j -q mat/plugins/org.eclipse.mat.ui.rcp_*.jar "icons/memory_analyzer_*.png" -d icons
+          for size in 32 48 64 128 256; do
+            install -Dm444 icons/memory_analyzer_$size.png \
+              $out/share/icons/hicolor/''${size}x''${size}/apps/eclipse-mat.png
+          done
+
+          runHook postInstall
+        '';
+
+    passthru.updateScript = ./update.sh;
+
+    meta = {
+      description = "Fast and feature-rich Java heap analyzer";
+      longDescription = ''
+        The Eclipse Memory Analyzer is a tool that helps you find memory
+        leaks and reduce memory consumption. Use the Memory Analyzer to
+        analyze productive heap dumps with hundreds of millions of
+        objects, quickly calculate the retained sizes of objects, see
+        who is preventing the Garbage Collector from collecting objects,
+        run a report to automatically extract leak suspects.
+      '';
+      homepage = "https://eclipse.dev/mat/";
+      changelog = "https://eclipse.dev/mat/${baseVersion}/noteworthy.html";
+      sourceProvenance = with lib.sourceTypes; [
+        binaryBytecode
+        binaryNativeCode
+      ];
+      license = lib.licenses.epl20;
+      mainProgram = "eclipse-mat";
+      maintainers = with lib.maintainers; [
+        ktor
+        dfjay
+      ];
+      platforms = lib.attrNames sources;
+    };
+  }
+)
diff --git a/pkgs/by-name/ec/eclipse-mat/update.sh b/pkgs/by-name/ec/eclipse-mat/update.sh
new file mode 100755
index 000000000000..274c14b78791
--- /dev/null
+++ b/pkgs/by-name/ec/eclipse-mat/update.sh
@@ -0,0 +1,43 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -I nixpkgs=./. -i bash -p bash curl gnused coreutils common-updater-scripts
+
+set -euo pipefail
+
+BASEDIR="$(dirname "$(readlink -f "$0")")/../../../.."
+MIRROR="https://ftp.halifax.rwth-aachen.de/eclipse/mat"
+
+baseVersion=$(curl -sL "$MIRROR/" |
+    sed -n 's/.*href="\([0-9]\+\.[0-9]\+\.[0-9]\+\)\/".*/\1/p' |
+    sort -V | tail -1)
+
+latestVersion=$(curl -sL "$MIRROR/$baseVersion/rcp/" |
+    sed -n 's/.*href="MemoryAnalyzer-\([0-9.]\+\)-linux\.gtk\.x86_64\.zip".*/\1/p' |
+    sort -V | tail -1)
+
+currentVersion=$(nix-instantiate --eval -E "with import $BASEDIR {}; lib.getVersion eclipse-mat" | tr -d '"')
+
+echo "latest  version: $latestVersion"
+echo "current version: $currentVersion"
+
+if [[ -z "$latestVersion" ]]; then
+    echo "could not determine the latest version" >&2
+    exit 1
+fi
+
+if [[ "$latestVersion" == "$currentVersion" ]]; then
+    echo "package is up-to-date"
+    exit 0
+fi
+
+for target in \
+    "x86_64-linux:linux.gtk.x86_64" \
+    "aarch64-linux:linux.gtk.aarch64" \
+    "aarch64-darwin:macosx.cocoa.aarch64"; do
+    nixSystem="${target%%:*}"
+    suffix="${target#*:}"
+
+    prefetch=$(nix-prefetch-url "$MIRROR/$baseVersion/rcp/MemoryAnalyzer-$latestVersion-$suffix.zip")
+    hash=$(nix-hash --type sha256 --to-sri "$prefetch")
+
+    (cd "$BASEDIR" && update-source-version eclipse-mat "$latestVersion" "$hash" --system="$nixSystem" --ignore-same-version)
+done
diff --git a/pkgs/by-name/ed/edencommon/glog-0.7.patch b/pkgs/by-name/ed/edencommon/glog-0.7.patch
deleted file mode 100644
index 1c9431c58c86..000000000000
--- a/pkgs/by-name/ed/edencommon/glog-0.7.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 8d7b3454df..2ce7b5af1a 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -50,8 +50,7 @@
-   "${CMAKE_CURRENT_SOURCE_DIR}/build/fbcode_builder/CMake"
-   ${CMAKE_MODULE_PATH})
- 
--find_package(Glog MODULE REQUIRED)
--include_directories(${GLOG_INCLUDE_DIR})
-+find_package(Glog CONFIG REQUIRED)
- 
- find_package(Gflags REQUIRED)
- include_directories(${GFLAGS_INCLUDE_DIR})
-diff --git a/eden/common/testharness/CMakeLists.txt b/eden/common/testharness/CMakeLists.txt
-index bef7421906..f35067efa9 100644
---- a/eden/common/testharness/CMakeLists.txt
-+++ b/eden/common/testharness/CMakeLists.txt
-@@ -19,7 +19,7 @@
-     ${BOOST_LIBRARIES}
-     Folly::folly_test_util
-     ${LIBGMOCK_LIBRARIES}
--    ${GLOG_LIBRARY}
-+    glog::glog
- )
- 
- target_include_directories(
diff --git a/pkgs/by-name/ed/edencommon/increase-test-discovery-timeout.patch b/pkgs/by-name/ed/edencommon/increase-test-discovery-timeout.patch
deleted file mode 100644
index a79efe36d2e4..000000000000
--- a/pkgs/by-name/ed/edencommon/increase-test-discovery-timeout.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-diff --git a/eden/common/os/test/CMakeLists.txt b/eden/common/os/test/CMakeLists.txt
-index a9f71443f8..be1423c455 100644
---- a/eden/common/os/test/CMakeLists.txt
-+++ b/eden/common/os/test/CMakeLists.txt
-@@ -18,4 +18,4 @@
-     ${LIBGMOCK_LIBRARIES}
- )
- 
--gtest_discover_tests(os_test)
-+gtest_discover_tests(os_test DISCOVERY_TIMEOUT 25)
-diff --git a/eden/common/utils/test/CMakeLists.txt b/eden/common/utils/test/CMakeLists.txt
-index 0cac73e569..ff08ecccb8 100644
---- a/eden/common/utils/test/CMakeLists.txt
-+++ b/eden/common/utils/test/CMakeLists.txt
-@@ -34,4 +34,4 @@
-     ${LIBGMOCK_LIBRARIES}
- )
- 
--gtest_discover_tests(utils_test)
-+gtest_discover_tests(utils_test DISCOVERY_TIMEOUT 25)
diff --git a/pkgs/by-name/ed/edencommon/package.nix b/pkgs/by-name/ed/edencommon/package.nix
index 281dcbd89243..7fabc61feba9 100644
--- a/pkgs/by-name/ed/edencommon/package.nix
+++ b/pkgs/by-name/ed/edencommon/package.nix
@@ -20,7 +20,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "edencommon";
-  version = "2026.01.19.00";
+  version = "2026.07.27.00";
 
   outputs = [
     "out"
@@ -31,17 +31,9 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "facebookexperimental";
     repo = "edencommon";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gTf3NgxCYaIJ4ubkPKrPct4D6IsHnTZRAzrDHoErDNM=";
+    hash = "sha256-RcLdBurFB4Zk479EHeGZHdNKvSMO1M54HDbxHVEFa7Y=";
   };
 
-  patches = [
-    ./glog-0.7.patch
-  ]
-  ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
-    # Test discovery timeout is bizarrely flaky on `x86_64-darwin`
-    ./increase-test-discovery-timeout.patch
-  ];
-
   nativeBuildInputs = [
     cmake
     ninja
@@ -93,6 +85,11 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail \
         'find_package(FBThrift CONFIG REQUIRED COMPONENTS cpp2 py)' \
         'find_package(FBThrift CONFIG REQUIRED COMPONENTS cpp2)'
+
+    # this header was missing. this is likely a consequence of fmt v12.2.0
+    # changing the definition of its fmt/core.h header, which is included in
+    # the same file.
+    sed -e '1i #include <string>' -i eden/common/utils/String.h
   '';
 
   passthru.updateScript = nix-update-script { };
diff --git a/pkgs/by-name/ee/eepers/package.nix b/pkgs/by-name/ee/eepers/package.nix
index eed8e26e1191..2f1ed5700410 100644
--- a/pkgs/by-name/ee/eepers/package.nix
+++ b/pkgs/by-name/ee/eepers/package.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postBuild
   '';
 
-  postFixup = lib.optionalString stdenv.isLinux ''
+  postFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
     patchelf $out/bin/eepers \
       --add-needed libwayland-client.so \
       --add-needed libwayland-cursor.so \
diff --git a/pkgs/by-name/em/emu2/package.nix b/pkgs/by-name/em/emu2/package.nix
index fe1b2ab461aa..047ea7d1a971 100644
--- a/pkgs/by-name/em/emu2/package.nix
+++ b/pkgs/by-name/em/emu2/package.nix
@@ -6,7 +6,10 @@
 
 stdenv.mkDerivation {
   pname = "emu2";
-  version = "0.pre+unstable=2021-09-22";
+  version = "2021.01-unstable-2021-09-22";
+
+  strictDeps = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "dmsc";
@@ -22,7 +25,7 @@ stdenv.mkDerivation {
     description = "Simple text-mode x86 + DOS emulator";
     platforms = lib.platforms.linux;
     maintainers = [ ];
-    license = lib.licenses.gpl2Plus;
+    license = lib.licenses.gpl2Only;
     mainProgram = "emu2";
   };
 }
diff --git a/pkgs/by-name/ev/evcc/package.nix b/pkgs/by-name/ev/evcc/package.nix
index 8eb9abbf547c..9fef2f6091b1 100644
--- a/pkgs/by-name/ev/evcc/package.nix
+++ b/pkgs/by-name/ev/evcc/package.nix
@@ -17,13 +17,13 @@
 }:
 
 let
-  version = "0.313.1";
+  version = "0.313.3";
 
   src = fetchFromGitHub {
     owner = "evcc-io";
     repo = "evcc";
     tag = version;
-    hash = "sha256-P/NEP+gGS3Wni9j09NVujmdDYaAz7ntOtrPFZNKy/Bo=";
+    hash = "sha256-mf8Jf+JtbcTQ227Dp0oRKBRpNKg2Gv+jkPsi36+Uogw=";
   };
 
   vendorHash = "sha256-QJsdBqa/JHaBig4bRtU3LqlYwh/BHnP3vg8YM3reuDY=";
diff --git a/pkgs/by-name/ex/ext4fuse/package.nix b/pkgs/by-name/ex/ext4fuse/package.nix
deleted file mode 100644
index 113201fb7f2e..000000000000
--- a/pkgs/by-name/ex/ext4fuse/package.nix
+++ /dev/null
@@ -1,45 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fuse,
-  macfuse-stubs,
-  pkg-config,
-  which,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "ext4fuse";
-  version = "0.1.3";
-
-  src = fetchFromGitHub {
-    owner = "gerard";
-    repo = "ext4fuse";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-bsFo+aaeNceSme9WBUVg4zpE4DzlmLHv+esQIAlTGGU=";
-  };
-
-  nativeBuildInputs = [
-    pkg-config
-    which
-  ];
-
-  buildInputs = [ (if stdenv.hostPlatform.isDarwin then macfuse-stubs else fuse) ];
-
-  installPhase = ''
-    runHook preInstall
-
-    install -Dm555 ext4fuse $out/bin/ext4fuse
-
-    runHook postInstall
-  '';
-
-  meta = {
-    description = "EXT4 implementation for FUSE";
-    mainProgram = "ext4fuse";
-    homepage = "https://github.com/gerard/ext4fuse";
-    maintainers = with lib.maintainers; [ felixalbrigtsen ];
-    platforms = lib.platforms.unix;
-    license = lib.licenses.gpl2Plus;
-  };
-})
diff --git a/pkgs/by-name/fa/fastly/package.nix b/pkgs/by-name/fa/fastly/package.nix
index 3081436ad8cc..2293794dbf92 100644
--- a/pkgs/by-name/fa/fastly/package.nix
+++ b/pkgs/by-name/fa/fastly/package.nix
@@ -12,13 +12,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "fastly";
-  version = "15.5.0";
+  version = "15.6.0";
 
   src = fetchFromGitHub {
     owner = "fastly";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TJ0xF+inAMrtV0l/tX/2gbcZDYP9k5k+q+roWGyffgc=";
+    hash = "sha256-1aZckcD6VGWqygVH1/4dv7yLZjbOtLb4nmWVAiZqPZ8=";
     # The git commit is part of the `fastly version` original output;
     # leave that output the same in nixpkgs. Use the `.git` directory
     # to retrieve the commit SHA, and remove the directory afterwards,
@@ -35,7 +35,7 @@ buildGoModule (finalAttrs: {
     "cmd/fastly"
   ];
 
-  vendorHash = "sha256-tYyjquG1Wo9qeNJGZ5K7Dk47MQKNkGD+A0z3bQM59Wo=";
+  vendorHash = "sha256-GSQJUuQYZMXOFbyjy2cmjbQsY3NzwGD9GnKEWppu548=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/fb/fb303/glog-0.7.patch b/pkgs/by-name/fb/fb303/glog-0.7.patch
deleted file mode 100644
index ef95f550f121..000000000000
--- a/pkgs/by-name/fb/fb303/glog-0.7.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 477b8d6a55..cfeae9ab3f 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -56,7 +56,7 @@
- 
- find_package(Gflags REQUIRED)
- 
--find_package(Glog MODULE REQUIRED)
-+find_package(Glog CONFIG REQUIRED)
- 
- find_package(folly CONFIG REQUIRED)
- 
-@@ -88,7 +88,6 @@
- 
- target_include_directories(fb303 PUBLIC
-   ${GFLAGS_INCLUDE_DIR}
--  ${GLOG_INCLUDE_DIR}
-   ${DOUBLE_CONVERSION_INCLUDE_DIR}
-   $<BUILD_INTERFACE:${CMAKE_SOURCE_DIR}>
-   $<INSTALL_INTERFACE:${INCLUDE_INSTALL_DIR}>
-@@ -98,6 +97,7 @@
-   fb303_thrift_cpp
-   Folly::folly
-   FBThrift::thrift
-+  glog::glog
- )
- 
- install(
diff --git a/pkgs/by-name/fb/fb303/package.nix b/pkgs/by-name/fb/fb303/package.nix
index 44321d906e42..4d390d8fee6b 100644
--- a/pkgs/by-name/fb/fb303/package.nix
+++ b/pkgs/by-name/fb/fb303/package.nix
@@ -19,7 +19,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fb303";
-  version = "2026.01.19.00";
+  version = "2026.07.27.00";
 
   outputs = [
     "out"
@@ -30,13 +30,9 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "facebook";
     repo = "fb303";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mQuTvjaBTbbLG8fmtM19MU1yIbq1O8TjaQ2TLQXpwkQ=";
+    hash = "sha256-euqoTxNizn4cA9UY/U6X6m2bV1owEuqEQIDEiDM9n5w=";
   };
 
-  patches = [
-    ./glog-0.7.patch
-  ];
-
   nativeBuildInputs = [
     cmake
     ninja
diff --git a/pkgs/by-name/fb/fbthrift/glog-0.7.patch b/pkgs/by-name/fb/fbthrift/glog-0.7.patch
deleted file mode 100644
index 482815161012..000000000000
--- a/pkgs/by-name/fb/fbthrift/glog-0.7.patch
+++ /dev/null
@@ -1,87 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 492bcccd9a..9c907a87a8 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -108,7 +108,7 @@
- # Find required dependencies for thrift/lib
- if (THRIFT_LIB_ONLY OR build_all)
-   find_package(Gflags REQUIRED)
--  find_package(Glog REQUIRED)
-+  find_package(Glog CONFIG REQUIRED)
-   find_package(fizz CONFIG REQUIRED)
-   find_package(wangle CONFIG REQUIRED)
-   find_package(ZLIB REQUIRED)
-@@ -120,7 +120,6 @@
-   find_package(Threads)
-   include_directories(
-     ${LIBGFLAGS_INCLUDE_DIR}
--    ${GLOG_INCLUDE_DIRS}
-     ${OPENSSL_INCLUDE_DIR}
-     ${ZSTD_INCLUDE_DIRS}
-     ${Xxhash_INCLUDE_DIR}
-diff --git a/thrift/example/cpp2/CMakeLists.txt b/thrift/example/cpp2/CMakeLists.txt
-index afa28dad61..318860b3d6 100644
---- a/thrift/example/cpp2/CMakeLists.txt
-+++ b/thrift/example/cpp2/CMakeLists.txt
-@@ -28,7 +28,7 @@
-   thriftcpp2
-   chatroom-cpp2
-   ${LIBGFLAGS_LIBRARY}
--  ${GLOG_LIBRARIES}
-+  glog::glog
- )
- install(
-   TARGETS example_server
-diff --git a/thrift/lib/cpp/CMakeLists.txt b/thrift/lib/cpp/CMakeLists.txt
-index 2c65e1f0a8..1e80060100 100644
---- a/thrift/lib/cpp/CMakeLists.txt
-+++ b/thrift/lib/cpp/CMakeLists.txt
-@@ -43,7 +43,7 @@
-   PUBLIC
-     Folly::folly
-     ${LIBGFLAGS_LIBRARY}
--    ${GLOG_LIBRARIES}
-+    glog::glog
- )
- 
- add_library(
-@@ -121,7 +121,7 @@
-     Boost::boost
-     Folly::folly
-     wangle::wangle
--    ${GLOG_LIBRARIES}
-+    glog::glog
-     ${OPENSSL_LIBRARIES}
- )
- 
-@@ -137,7 +137,7 @@
-     thriftprotocol
-     transport
-     Folly::folly
--    ${GLOG_LIBRARIES}
-+    glog::glog
- )
- 
- set(THRIFT1_HEADER_DIRS
-diff --git a/thrift/lib/cpp2/CMakeLists.txt b/thrift/lib/cpp2/CMakeLists.txt
-index 03216f5d6f..5f31fc0c64 100644
---- a/thrift/lib/cpp2/CMakeLists.txt
-+++ b/thrift/lib/cpp2/CMakeLists.txt
-@@ -75,7 +75,7 @@
-     Folly::folly
-     thriftmetadata
-     thriftprotocol
--    ${GLOG_LIBRARIES}
-+    glog::glog
-     ${LIBGFLAGS_LIBRARY}
- )
- 
-@@ -207,7 +207,7 @@
-     thrift
-     Folly::folly
-     wangle::wangle
--    ${GLOG_LIBRARIES}
-+    glog::glog
-     thrift-core
- )
- 
diff --git a/pkgs/by-name/fb/fbthrift/package.nix b/pkgs/by-name/fb/fbthrift/package.nix
index dc0a5d4aa157..141c170c5ef2 100644
--- a/pkgs/by-name/fb/fbthrift/package.nix
+++ b/pkgs/by-name/fb/fbthrift/package.nix
@@ -3,7 +3,6 @@
   stdenv,
 
   fetchFromGitHub,
-  fetchpatch,
 
   cmake,
   ninja,
@@ -25,7 +24,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fbthrift";
-  version = "2026.01.19.00";
+  version = "2026.07.27.00";
 
   outputs = [
     # Trying to split this up further into `bin`, `out`, and `dev`
@@ -39,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "facebook";
     repo = "fbthrift";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jx2jSMeoRBYG7xCWKTzaIpNjrGnbPLiR9vQVO7m3if0=";
+    hash = "sha256-bzi4DRGOQy8HXLQa6roMY3CRqteoJxz2Xo6SsLfOdhY=";
   };
 
   patches = [
@@ -51,7 +50,13 @@ stdenv.mkDerivation (finalAttrs: {
     # incorrect path concatenation.
     ./remove-cmake-install-rpath.patch
 
-    ./glog-0.7.patch
+    # On some machines (potentially those with low parallelism), this build
+    # seems to have a missing dependency and seems to fail with:
+    # "/build/source/build/thrift/lib/thrift/gen-cpp2/any_rep_types.h:12:10:
+    # fatal error: thrift/lib/thrift/gen-cpp2/type_types.h: No such file or
+    # directory"
+    # https://github.com/facebook/fbthrift/pull/709
+    ./thriftmetadata-dependency-type-cpp2-target.patch
   ];
 
   nativeBuildInputs = [
@@ -95,14 +100,6 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeFeature "CMAKE_SHARED_LINKER_FLAGS" "-Wl,-undefined,dynamic_lookup")
   ];
 
-  # Fix a typo introduced by the following commit that causes hundreds
-  # of pointless rebuilds when installing:
-  # <https://github.com/facebook/fbthrift/commit/58038399cefc0c2256ce4ef5444dee37147cbf07>
-  postPatch = ''
-    substituteInPlace ThriftLibrary.cmake \
-      --replace-fail .tcch .tcc
-  '';
-
   # Copied from Homebrew; fixes the following build error:
   #
   #     [ERROR:/nix/var/nix/b/5f3kn8spg6j0z0xlags8va6sq7/source/thrift/lib/thrift/RpcMetadata.thrift:1] unordered_map::at: key not found
diff --git a/pkgs/by-name/fb/fbthrift/scrub-build-directory-from-output.patch b/pkgs/by-name/fb/fbthrift/scrub-build-directory-from-output.patch
index 9fdfc77f2ead..8265b5936d47 100644
--- a/pkgs/by-name/fb/fbthrift/scrub-build-directory-from-output.patch
+++ b/pkgs/by-name/fb/fbthrift/scrub-build-directory-from-output.patch
@@ -1,21 +1,3 @@
-diff --git a/thrift/compiler/generate/t_mstch_cpp2_generator.cc b/thrift/compiler/generate/t_mstch_cpp2_generator.cc
-index d232df5158..96d15efbda 100644
---- a/thrift/compiler/generate/t_mstch_cpp2_generator.cc
-+++ b/thrift/compiler/generate/t_mstch_cpp2_generator.cc
-@@ -1116,6 +1116,13 @@
-   mstch::node autogen_path() {
-     std::string path = service_->program()->path();
-     std::replace(path.begin(), path.end(), '\\', '/');
-+    // Ensure output reproducibility for Nix builds.
-+    if (auto nix_build_top = std::getenv("NIX_BUILD_TOP")) {
-+      auto prefix = std::string(nix_build_top) + "/";
-+      if (path.starts_with(prefix)) {
-+        path.replace(0, prefix.length(), "/build/");
-+      }
-+    }
-     return path;
-   }
-   mstch::node cpp_includes() {
 diff --git a/thrift/compiler/generate/t_whisker_generator.cc b/thrift/compiler/generate/t_whisker_generator.cc
 index 99a6ac14af..fa91a05247 100644
 --- a/thrift/compiler/generate/t_whisker_generator.cc
diff --git a/pkgs/by-name/fb/fbthrift/thriftmetadata-dependency-type-cpp2-target.patch b/pkgs/by-name/fb/fbthrift/thriftmetadata-dependency-type-cpp2-target.patch
new file mode 100644
index 000000000000..cecdfcb9079b
--- /dev/null
+++ b/pkgs/by-name/fb/fbthrift/thriftmetadata-dependency-type-cpp2-target.patch
@@ -0,0 +1,12 @@
+diff --git a/thrift/lib/cpp2/CMakeLists.txt b/thrift/lib/cpp2/CMakeLists.txt
+index dc4dd4e13f..66c50d0f60 100644
+--- a/thrift/lib/cpp2/CMakeLists.txt
++++ b/thrift/lib/cpp2/CMakeLists.txt
+@@ -102,6 +102,7 @@
+   any_rep-cpp2-target
+   protocol-cpp2-target
+   protocol_detail-cpp2-target
++  type-cpp2-target
+   type_id-cpp2-target
+   type_system-cpp2-target
+   schema-cpp2-target
diff --git a/pkgs/by-name/fh/fheroes2/package.nix b/pkgs/by-name/fh/fheroes2/package.nix
index 17dd79292ed6..c5e3848f9c4d 100644
--- a/pkgs/by-name/fh/fheroes2/package.nix
+++ b/pkgs/by-name/fh/fheroes2/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fheroes2";
-  version = "1.1.16";
+  version = "1.1.17";
 
   src = fetchFromGitHub {
     owner = "ihhub";
     repo = "fheroes2";
     rev = finalAttrs.version;
-    hash = "sha256-B4gs+uDS9dCkrS1OLn4dUfWTSKKsUrdQJxAAAJCH7Nw=";
+    hash = "sha256-th5XWNpVweVdfxdNK0XaPL8L3UbuafnIdENRYIgfcXw=";
   };
 
   nativeBuildInputs = [ imagemagick ];
diff --git a/pkgs/by-name/fi/field-monitor/package.nix b/pkgs/by-name/fi/field-monitor/package.nix
index 79efb70f57cb..2a5b27c1583c 100644
--- a/pkgs/by-name/fi/field-monitor/package.nix
+++ b/pkgs/by-name/fi/field-monitor/package.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
+    inherit (finalAttrs) pname version src;
     hash = "sha256-fsrczFhoIilxgZRH2PVXC67YdkMsIjA6zTfix57TTzo=";
   };
 
diff --git a/pkgs/by-name/fi/fizz/glog-0.7.patch b/pkgs/by-name/fi/fizz/glog-0.7.patch
deleted file mode 100644
index 263cce53baa9..000000000000
--- a/pkgs/by-name/fi/fizz/glog-0.7.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-diff --git a/fizz/CMakeLists.txt b/fizz/CMakeLists.txt
-index c60177c2b9..425326c529 100644
---- a/fizz/CMakeLists.txt
-+++ b/fizz/CMakeLists.txt
-@@ -50,7 +50,7 @@
- find_package(fmt CONFIG REQUIRED)
- 
- find_package(OpenSSL REQUIRED)
--find_package(Glog REQUIRED)
-+find_package(Glog CONFIG REQUIRED)
- find_package(Threads REQUIRED)
- find_package(Zstd REQUIRED)
- if (UNIX AND NOT APPLE)
-@@ -198,7 +198,6 @@
-     ${sodium_INCLUDE_DIR}
-     ${ZSTD_INCLUDE_DIR}
-   PRIVATE
--    ${GLOG_INCLUDE_DIRS}
-     ${FIZZ_INCLUDE_DIRECTORIES}
- )
- 
-@@ -212,7 +211,7 @@
-     ZLIB::ZLIB
-     ${ZSTD_LIBRARY}
-   PRIVATE
--    ${GLOG_LIBRARIES}
-+    glog::glog
-     ${GFLAGS_LIBRARIES}
-     ${FIZZ_LINK_LIBRARIES}
-     ${CMAKE_DL_LIBS}
diff --git a/pkgs/by-name/fi/fizz/package.nix b/pkgs/by-name/fi/fizz/package.nix
index d17c43fc9714..cdd5366909aa 100644
--- a/pkgs/by-name/fi/fizz/package.nix
+++ b/pkgs/by-name/fi/fizz/package.nix
@@ -26,7 +26,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fizz";
-  version = "2026.01.19.00";
+  version = "2026.07.27.00";
 
   outputs = [
     "bin"
@@ -38,13 +38,9 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "facebookincubator";
     repo = "fizz";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-fO0lKi8MJe0+RX8Y5shkO0C7NVAFOsXyx+OyoHeMy4c=";
+    hash = "sha256-zOTBC6G7mIVN/s56aUXEqs2FG2z/33jG/W5GUq4GwO0=";
   };
 
-  patches = [
-    ./glog-0.7.patch
-  ];
-
   nativeBuildInputs = [
     cmake
     ninja
diff --git a/pkgs/by-name/fl/florist/package.nix b/pkgs/by-name/fl/florist/package.nix
index 1408ba11e52e..712bdd17f597 100644
--- a/pkgs/by-name/fl/florist/package.nix
+++ b/pkgs/by-name/fl/florist/package.nix
@@ -1,7 +1,7 @@
 {
   stdenv,
-  gnat13,
-  gnat13Packages,
+  gnat,
+  gnatPackages,
   fetchFromGitHub,
   lib,
 }:
@@ -20,8 +20,8 @@ stdenv.mkDerivation (finalAttrs: {
   configureFlags = [ "--enable-shared" ];
 
   nativeBuildInputs = [
-    gnat13
-    gnat13Packages.gprbuild
+    gnat
+    gnatPackages.gprbuild
   ];
 
   meta = {
diff --git a/pkgs/by-name/fl/flux9s/package.nix b/pkgs/by-name/fl/flux9s/package.nix
index 55c7b6438426..a19f06844b0e 100644
--- a/pkgs/by-name/fl/flux9s/package.nix
+++ b/pkgs/by-name/fl/flux9s/package.nix
@@ -10,6 +10,7 @@
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "flux9s";
   version = "1.0.1";
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "dgunzy";
@@ -34,6 +35,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     description = "K9s-inspired terminal UI for monitoring Flux GitOps resources in real-time";
     mainProgram = "flux9s";
     homepage = "https://flux9s.ca/";
+    changelog = "https://github.com/dgunzy/flux9s/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.asl20;
     maintainers = [ lib.maintainers.skyesoss ];
   };
diff --git a/pkgs/by-name/fl/fluxcd/package.nix b/pkgs/by-name/fl/fluxcd/package.nix
index 582c7e3529b5..4982c3c558b8 100644
--- a/pkgs/by-name/fl/fluxcd/package.nix
+++ b/pkgs/by-name/fl/fluxcd/package.nix
@@ -9,10 +9,10 @@
 }:
 
 let
-  version = "2.9.3";
-  srcHash = "sha256-xu+9Ks+Jrzxk+D2GUmw68/mprNf8ynQZiCmMNpVkR4M=";
-  vendorHash = "sha256-h5APVAwqyodfaoNq5SqHF/3Vu3O2XfdlZ9O/apA49pc=";
-  manifestsHash = "sha256-L1dSNLFKtAGS7A+vvz7t68YifOxWoFxPTmNB31iaGoo=";
+  version = "2.9.4";
+  srcHash = "sha256-7Suhsg1tWn6gzkPDQT4BII0hTCM3HCCZTTtFVNumA9A=";
+  vendorHash = "sha256-3CMj5MI5cILnyWoWkcBzD5X626nsQ6nfipeqN35IQEk=";
+  manifestsHash = "sha256-+187K4w//AxtSYcrA3NoVCSFpTkjNqZmfOlbdzD9YmI=";
 
   manifests = fetchzip {
     url = "https://github.com/fluxcd/flux2/releases/download/v${version}/manifests.tar.gz";
diff --git a/pkgs/by-name/fl/fly/package.nix b/pkgs/by-name/fl/fly/package.nix
index 852f5b6a6975..7d3e78482d71 100644
--- a/pkgs/by-name/fl/fly/package.nix
+++ b/pkgs/by-name/fl/fly/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "fly";
-  version = "8.2.5";
+  version = "8.3.0";
 
   src = fetchFromGitHub {
     owner = "concourse";
     repo = "concourse";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-snY4O9W7oxrc2EqyekzkwTvgGRIaTbg0R7ef8gQB8Rw=";
+    hash = "sha256-T52GjR43fvC3BJDFLhYGtALSh8V5o1mAdfIEuIUszrc=";
   };
 
-  vendorHash = "sha256-ZNhGt+nyl7zmQIHT+5f/c2hixyZ8kLmCWO5qa7CAGuY=";
+  vendorHash = "sha256-J+e/UCLK5sdwLEj/AjqEQVD7FZghYxl6Ny65osbDnRg=";
 
   subPackages = [ "fly" ];
 
diff --git a/pkgs/by-name/fl/flycast/fix-darwin-objective-cxx-pch.patch b/pkgs/by-name/fl/flycast/fix-darwin-objective-cxx-pch.patch
new file mode 100644
index 000000000000..8ddae93a59fe
--- /dev/null
+++ b/pkgs/by-name/fl/flycast/fix-darwin-objective-cxx-pch.patch
@@ -0,0 +1,21 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 8340288..7660e07 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -35,6 +35,16 @@ if(APPLE)
+ 	set(ZLIB_LIBRARY "-lz" CACHE STRING "Use generic linker flag for Xcode to support multiple SDKs")
+ endif()
+ 
++if(APPLE AND NOT IOS)
++    set_source_files_properties(
++        shell/apple/common/http_client.mm
++        shell/apple/common/util.mm
++        shell/apple/emulator-osx/emulator-osx/SDLApplicationDelegate.mm
++        shell/apple/emulator-osx/emulator-osx/osx-main.mm
++        PROPERTIES SKIP_PRECOMPILE_HEADERS ON
++    )
++endif()
++
+ if(LIBRETRO)
+ 	project(flycast_libretro)
+ else()
diff --git a/pkgs/by-name/fl/flycast/package.nix b/pkgs/by-name/fl/flycast/package.nix
index c9ab0cfedf83..79498234f9a2 100644
--- a/pkgs/by-name/fl/flycast/package.nix
+++ b/pkgs/by-name/fl/flycast/package.nix
@@ -15,6 +15,7 @@
   SDL2,
   systemdLibs,
   vulkan-loader,
+  moltenvk,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -29,6 +30,10 @@ stdenv.mkDerivation (finalAttrs: {
     fetchSubmodules = true;
   };
 
+  patches = [
+    ./fix-darwin-objective-cxx-pch.patch
+  ];
+
   nativeBuildInputs = [
     cmake
     pkg-config
@@ -36,7 +41,6 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
-    alsa-lib
     curl
     libao
     libpulseaudio
@@ -44,17 +48,39 @@ stdenv.mkDerivation (finalAttrs: {
     lua
     miniupnpc
     SDL2
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    alsa-lib
     systemdLibs
-  ];
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ moltenvk ];
+
+  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail \
+        '"$ENV{VULKAN_SDK}/lib/libMoltenVK.dylib"' \
+        '"${moltenvk}/lib/libMoltenVK.dylib"'
+  '';
 
   cmakeFlags = [
     "-DUSE_HOST_SDL=ON"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    "-DUSE_BREAKPAD=OFF"
+    "-DCMAKE_OSX_ARCHITECTURES=${stdenv.hostPlatform.darwinArch}"
+    "-DZLIB_LIBRARY=" # Unsets broken default for Darwin.
   ];
 
-  postFixup = ''
+  postFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
     wrapProgram $out/bin/flycast --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ vulkan-loader ]}
   '';
 
+  postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    mkdir -p "$out/Applications"
+    mv "$out/bin/Flycast.app" "$out/Applications/"
+    rm -rf "$out/include" "$out/lib" "$out/bin"
+  '';
+
   meta = {
     homepage = "https://github.com/flyinghead/flycast";
     changelog = "https://github.com/flyinghead/flycast/releases/tag/v${finalAttrs.version}";
diff --git a/pkgs/by-name/fo/folly/char_traits.patch b/pkgs/by-name/fo/folly/char_traits.patch
deleted file mode 100644
index f82726384ac9..000000000000
--- a/pkgs/by-name/fo/folly/char_traits.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-diff --git a/folly/memory/test/UninitializedMemoryHacksTest.cpp b/folly/memory/test/UninitializedMemoryHacksTest.cpp
-index 38e27c3..17424af 100644
---- a/folly/memory/test/UninitializedMemoryHacksTest.cpp
-+++ b/folly/memory/test/UninitializedMemoryHacksTest.cpp
-@@ -283,7 +283,7 @@ TEST(UninitializedMemoryHacks, simpleStringWChar) {
- }
- 
- TEST(UninitializedMemoryHacks, simpleStringSChar) {
--  testSimple<std::basic_string<signed char>>();
-+  testSimple<std::basic_string<char>>();
- }
- 
- TEST(UninitializedMemoryHacks, simpleVectorChar) {
-@@ -307,7 +307,7 @@ TEST(UninitializedMemoryHacks, randomStringWChar) {
- }
- 
- TEST(UninitializedMemoryHacks, randomStringSChar) {
--  testRandom<std::basic_string<signed char>>();
-+  testRandom<std::basic_string<char>>();
- }
- 
- TEST(UninitializedMemoryHacks, randomVectorChar) {
-@@ -323,5 +323,5 @@ TEST(UninitializedMemoryHacks, randomVectorInt) {
- }
- 
- // We are deliberately putting this at the bottom to make sure it can follow use
--FOLLY_DECLARE_STRING_RESIZE_WITHOUT_INIT(signed char)
-+//FOLLY_DECLARE_STRING_RESIZE_WITHOUT_INIT(char)
- FOLLY_DECLARE_VECTOR_RESIZE_WITHOUT_INIT(int)
diff --git a/pkgs/by-name/fo/folly/cmake-asm-shared-library.patch b/pkgs/by-name/fo/folly/cmake-asm-shared-library.patch
new file mode 100644
index 000000000000..d2894f919750
--- /dev/null
+++ b/pkgs/by-name/fo/folly/cmake-asm-shared-library.patch
@@ -0,0 +1,15 @@
+diff --git a/folly/external/aor/CMakeLists.txt b/folly/external/aor/CMakeLists.txt
+index e07e58745..1429f54e9 100644
+--- a/folly/external/aor/CMakeLists.txt
++++ b/folly/external/aor/CMakeLists.txt
+@@ -20,6 +20,10 @@
+ # Linux ELF directives (.size, etc.) that Darwin's assembler doesn't support
+ if(IS_AARCH64_ARCH)
+ 
++if(BUILD_SHARED_LIBS)
++  set(CMAKE_ASM_CREATE_SHARED_LIBRARY ${CMAKE_C_CREATE_SHARED_LIBRARY})
++endif()
++
+ folly_add_library(
+   NAME memcpy_aarch64
+   SRCS
diff --git a/pkgs/by-name/fo/folly/folly-fix-glog-0.7.patch b/pkgs/by-name/fo/folly/folly-fix-glog-0.7.patch
deleted file mode 100644
index 4f03cf1541da..000000000000
--- a/pkgs/by-name/fo/folly/folly-fix-glog-0.7.patch
+++ /dev/null
@@ -1,18 +0,0 @@
-diff --git a/CMake/folly-deps.cmake b/CMake/folly-deps.cmake
-index c72273a73..d0408f2b3 100644
---- a/CMake/folly-deps.cmake
-+++ b/CMake/folly-deps.cmake
-@@ -61,10 +61,9 @@ if(LIBGFLAGS_FOUND)
-   set(FOLLY_LIBGFLAGS_INCLUDE ${LIBGFLAGS_INCLUDE_DIR})
- endif()
- 
--find_package(Glog MODULE)
--set(FOLLY_HAVE_LIBGLOG ${GLOG_FOUND})
--list(APPEND FOLLY_LINK_LIBRARIES ${GLOG_LIBRARY})
--list(APPEND FOLLY_INCLUDE_DIRECTORIES ${GLOG_INCLUDE_DIR})
-+find_package(Glog CONFIG REQUIRED)
-+set(FOLLY_HAVE_LIBGLOG True)
-+list(APPEND FOLLY_LINK_LIBRARIES glog::glog)
- 
- find_package(LibEvent MODULE REQUIRED)
- list(APPEND FOLLY_LINK_LIBRARIES ${LIBEVENT_LIB})
diff --git a/pkgs/by-name/fo/folly/memset-benchmark-darwin.patch b/pkgs/by-name/fo/folly/memset-benchmark-darwin.patch
deleted file mode 100644
index 218789a22acb..000000000000
--- a/pkgs/by-name/fo/folly/memset-benchmark-darwin.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/folly/test/MemsetBenchmark.cpp
-+++ b/folly/test/MemsetBenchmark.cpp
-@@ -40,7 +40,7 @@
- 
- template <void* memset_impl(void*, int, size_t)>
- void bmMemset(void* buf, size_t length, size_t iters) {
--#if !defined(__aarch64__)
-+#if !defined(__aarch64__) && !defined(__APPLE__)
-   __asm__ volatile(".align 64\n");
- #endif
- #pragma unroll(1)
diff --git a/pkgs/by-name/fo/folly/memset-memcpy-aarch64.patch b/pkgs/by-name/fo/folly/memset-memcpy-aarch64.patch
index fc254b2291d0..51f4599b7700 100644
--- a/pkgs/by-name/fo/folly/memset-memcpy-aarch64.patch
+++ b/pkgs/by-name/fo/folly/memset-memcpy-aarch64.patch
@@ -1,39 +1,8 @@
-From 9acd1ec8e6890c7f5d86a0dd6941ae3b8692ac9c Mon Sep 17 00:00:00 2001
-From: Lukas Krenz <lkrenz@nvidia.com>
-Date: Tue, 20 Jan 2026 05:59:00 -0800
-Subject: [PATCH] Fix memset/memcpy linkage on aarch64
-
-Otherwise memcpy and memset benchmarks won't compile
----
- folly/CMakeLists.txt | 16 ++++++++++++++++
- 1 file changed, 16 insertions(+)
-
 diff --git a/folly/CMakeLists.txt b/folly/CMakeLists.txt
-index a1bcbdd6e92..51280821a24 100644
+index dc77e24731..cd6635ffd6 100644
 --- a/folly/CMakeLists.txt
 +++ b/folly/CMakeLists.txt
-@@ -879,6 +879,9 @@ folly_add_library(
-   NAME memset-impl
-   SRCS
-     FollyMemset.cpp
-+    $<$<BOOL:${IS_AARCH64_ARCH}>:memset_select_aarch64.cpp>
-+  DEPS
-+    $<$<BOOL:${IS_AARCH64_ARCH}>:folly_external_aor_memset_aarch64>
- )
- 
- folly_add_library(
-@@ -894,12 +897,20 @@ folly_add_library(
-   EXCLUDE_FROM_MONOLITH
-   SRCS
-     FollyMemset.cpp
-+    $<$<BOOL:${IS_AARCH64_ARCH}>:memset_select_aarch64.cpp>
-+  DEPS
-+    $<$<BOOL:${IS_AARCH64_ARCH}>:folly_external_aor_memset_aarch64-use>
-+  COMPILE_OPTIONS
-+    $<$<BOOL:${IS_AARCH64_ARCH}>:-DFOLLY_MEMSET_IS_MEMSET>
- )
- 
- folly_add_library(
+@@ -807,6 +807,9 @@
    NAME memcpy-impl
    SRCS
      FollyMemcpy.cpp
@@ -43,15 +12,13 @@ index a1bcbdd6e92..51280821a24 100644
  )
  
  folly_add_library(
-@@ -915,6 +926,11 @@ folly_add_library(
-   EXCLUDE_FROM_MONOLITH
+@@ -860,6 +868,9 @@
+   NAME memset-impl
    SRCS
-     FollyMemcpy.cpp
-+    $<$<BOOL:${IS_AARCH64_ARCH}>:memcpy_select_aarch64.cpp>
+     FollyMemset.cpp
++    $<$<BOOL:${IS_AARCH64_ARCH}>:memset_select_aarch64.cpp>
 +  DEPS
-+    $<$<BOOL:${IS_AARCH64_ARCH}>:folly_external_aor_memcpy_aarch64-use>
-+  COMPILE_OPTIONS
-+    $<$<BOOL:${IS_AARCH64_ARCH}>:-DFOLLY_MEMCPY_IS_MEMCPY>
++    $<$<BOOL:${IS_AARCH64_ARCH}>:folly_external_aor_memset_aarch64>
  )
  
- # x86 assembly memcpy implementation (not supported on MSVC)
+ folly_add_library(
diff --git a/pkgs/by-name/fo/folly/package.nix b/pkgs/by-name/fo/folly/package.nix
index 0ae344bb364b..3d9c776c858b 100644
--- a/pkgs/by-name/fo/folly/package.nix
+++ b/pkgs/by-name/fo/folly/package.nix
@@ -41,7 +41,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "folly";
-  version = "2026.01.19.00";
+  version = "2026.07.27.00";
 
   # split outputs to reduce downstream closure sizes
   outputs = [
@@ -53,7 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "facebook";
     repo = "folly";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gfmN/9LizPdacUd1eJxFx79I63SwqX0NaWFgbe6vbFk=";
+    hash = "sha256-xxS1FU3thl8UA1DzumVEazelISayLioabFjKlXX67Yk=";
   };
 
   nativeBuildInputs = [
@@ -134,28 +134,11 @@ stdenv.mkDerivation (finalAttrs: {
     # `dev` output’s CMake files.
     ./install-test-certs.patch
 
-    # The base template for std::char_traits has been removed in LLVM 19
-    # https://releases.llvm.org/19.1.0/projects/libcxx/docs/ReleaseNotes.html
-    ./char_traits.patch
-
-    # <https://github.com/facebook/folly/issues/2171>
-    ./folly-fix-glog-0.7.patch
-
     # https://github.com/facebook/folly/pull/2561
     ./memset-memcpy-aarch64.patch
 
-    # `.align 64` is invalid on x86_64 Mach-O, where `.align` takes a
-    # power-of-two exponent (64 means 2^64). The guard only excluded
-    # aarch64, so add !__APPLE__ to also skip x86_64-darwin.
-    ./memset-benchmark-darwin.patch
-
-    # Use feature detection directly instead of private standard library
-    # macros to detect the presence of ASAN and otherwise fallback to
-    # _not_ having ASAN.
-    (fetchpatch2 {
-      url = "https://github.com/facebook/folly/commit/fdde9bc360d525a1b2889b9ba89d671c3a13e72e.patch?full_index=1";
-      hash = "sha256-+1XJRAl4o9YubjqdIgQZpyrMmcb2imBfQUmiHNmFMRE=";
-    })
+    # https://github.com/Homebrew/homebrew-core/blob/1bebfe2c3e393a65c27f3e74f254770219b126f3/Formula/f/folly.rb#L83
+    ./cmake-asm-shared-library.patch
   ];
 
   # https://github.com/NixOS/nixpkgs/issues/144170
@@ -167,19 +150,6 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail \
         ${lib.escapeShellArg "\${prefix}/@CMAKE_INSTALL_INCLUDEDIR@"} \
         '@CMAKE_INSTALL_FULL_INCLUDEDIR@'
-  ''
-  # Fix duplicate symbol errors on aarch64-linux caused by both
-  # memcpy_aarch64 and memcpy_aarch64-use (same for memset) being linked
-  # into libfolly.so. Add EXCLUDE_FROM_MONOLITH to -use variants.
-  # https://github.com/facebook/folly/pull/2562
-  + lib.optionalString stdenv.hostPlatform.isAarch64 ''
-    substituteInPlace folly/external/aor/CMakeLists.txt \
-      --replace-fail \
-        "NAME memcpy_aarch64-use" \
-        "NAME memcpy_aarch64-use EXCLUDE_FROM_MONOLITH" \
-      --replace-fail \
-        "NAME memset_aarch64-use" \
-        "NAME memset_aarch64-use EXCLUDE_FROM_MONOLITH"
   '';
 
   disabledTests = [
diff --git a/pkgs/by-name/fo/fosrl-pangolin/package.nix b/pkgs/by-name/fo/fosrl-pangolin/package.nix
index cd7d05205f09..7f73cd3d3690 100644
--- a/pkgs/by-name/fo/fosrl-pangolin/package.nix
+++ b/pkgs/by-name/fo/fosrl-pangolin/package.nix
@@ -9,6 +9,7 @@
   edition ? "oss",
   environmentVariables ? { },
   nixosTests,
+  nodejs_22,
 }:
 
 assert lib.assertOneOf "databaseType" databaseType [
@@ -47,6 +48,7 @@ buildNpmPackage (finalAttrs: {
     hash = "sha256-LR4UO2xrTLKmemDVsJWtEQoV2bDy6U2ahxTtA+SDymI=";
   };
 
+  nodejs = nodejs_22;
   npmDepsFetcherVersion = 2;
   npmDepsHash = "sha256-EBectG1zNdUb30SlhAzy9rCwF/mYHAV4HZTRbk2CbDY=";
 
diff --git a/pkgs/by-name/fr/fractal/package.nix b/pkgs/by-name/fr/fractal/package.nix
index aacc85b13b3f..c8e01af51032 100644
--- a/pkgs/by-name/fr/fractal/package.nix
+++ b/pkgs/by-name/fr/fractal/package.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
+    inherit (finalAttrs) pname version src;
     hash = "sha256-y3osmwhrB9x2s9V8L9qI1qs2fv2ygynq+mS+cA/KIyA=";
   };
 
diff --git a/pkgs/by-name/fr/free5gc-amf/package.nix b/pkgs/by-name/fr/free5gc-amf/package.nix
new file mode 100644
index 000000000000..692c791470ff
--- /dev/null
+++ b/pkgs/by-name/fr/free5gc-amf/package.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+buildGoModule (finalAttrs: {
+  pname = "free5gc-amf";
+  version = "1.4.3";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "free5gc";
+    repo = "amf";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-oH01ySslrVhreFIYcEGs3jBZy37wylwhtz8f4VjSlgk=";
+  };
+
+  vendorHash = "sha256-plUoCtHK8/cuYmPosV7ISIlqZGJZUJ4L0Fd0cWV+3zo=";
+
+  ldflags = [
+    "-X github.com/free5gc/util/version.VERSION=v${finalAttrs.version}"
+  ];
+
+  postInstall = ''
+    mv -v $out/bin/cmd $out/bin/free5gc-amf
+  '';
+
+  doInstallCheck = true;
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "irrelevant"; # has no version flag, empty string didn't work
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Open source 5G core network based on 3GPP R15";
+    homepage = "https://free5gc.org/";
+    changelog = "https://github.com/free5gc/amf/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ felbinger ];
+    platforms = lib.platforms.linux;
+    mainProgram = "free5gc-amf";
+  };
+})
diff --git a/pkgs/by-name/fr/free5gc-ausf/package.nix b/pkgs/by-name/fr/free5gc-ausf/package.nix
new file mode 100644
index 000000000000..a852c9e22b9a
--- /dev/null
+++ b/pkgs/by-name/fr/free5gc-ausf/package.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+buildGoModule (finalAttrs: {
+  pname = "free5gc-ausf";
+  version = "1.4.3";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "free5gc";
+    repo = "ausf";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-S96QhcerwA2c/fW7J0C4HlcQVeSHrob4VCKOSd4iUpo=";
+  };
+
+  vendorHash = "sha256-8oATdtM8pA8KKgPHFCqsEM0Lo93ZBkoTqLRPfHywCOY=";
+
+  ldflags = [
+    "-X github.com/free5gc/util/version.VERSION=v${finalAttrs.version}"
+  ];
+
+  postInstall = ''
+    mv -v $out/bin/cmd $out/bin/free5gc-ausf
+  '';
+
+  doInstallCheck = true;
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "irrelevant"; # has no version flag, empty string didn't work
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Open source 5G core network based on 3GPP R15";
+    homepage = "https://free5gc.org/";
+    changelog = "https://github.com/free5gc/ausf/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ felbinger ];
+    platforms = lib.platforms.linux;
+    mainProgram = "free5gc-ausf";
+  };
+})
diff --git a/pkgs/by-name/fr/free5gc-bsf/package.nix b/pkgs/by-name/fr/free5gc-bsf/package.nix
new file mode 100644
index 000000000000..40b491758aaa
--- /dev/null
+++ b/pkgs/by-name/fr/free5gc-bsf/package.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+buildGoModule (finalAttrs: {
+  pname = "free5gc-bsf";
+  version = "1.0.2";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "free5gc";
+    repo = "bsf";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-LIsLaAt3EZMUJBIVErFUP/DLrJnFhu+8WJMiKAgxUYE=";
+  };
+
+  vendorHash = "sha256-2T6Al3/Z7TCRIAk96ygT9LOe2hmqsyPfKuXqjW8LGig=";
+
+  ldflags = [
+    "-X github.com/free5gc/util/version.VERSION=v${finalAttrs.version}"
+  ];
+
+  postInstall = ''
+    mv -v $out/bin/cmd $out/bin/free5gc-bsf
+  '';
+
+  doInstallCheck = true;
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "irrelevant"; # has no version flag, empty string didn't work
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Open source 5G core network based on 3GPP R15";
+    homepage = "https://free5gc.org/";
+    changelog = "https://github.com/free5gc/bsf/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ felbinger ];
+    platforms = lib.platforms.linux;
+    mainProgram = "free5gc-bsf";
+  };
+})
diff --git a/pkgs/by-name/fr/free5gc-chf/package.nix b/pkgs/by-name/fr/free5gc-chf/package.nix
new file mode 100644
index 000000000000..6230e7f1010a
--- /dev/null
+++ b/pkgs/by-name/fr/free5gc-chf/package.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+buildGoModule (finalAttrs: {
+  pname = "free5gc-chf";
+  version = "1.2.3";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "free5gc";
+    repo = "chf";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-rKAig3y7rGDoUpMoB5k58eIf+w7S3PhTsxObzLmUrmM=";
+  };
+
+  vendorHash = "sha256-/7GH6f4+Ao183AWxJIv6cndhoVE6Dnishgl8ER0knsQ=";
+
+  ldflags = [
+    "-X github.com/free5gc/util/version.VERSION=v${finalAttrs.version}"
+  ];
+
+  postInstall = ''
+    mv -v $out/bin/cmd $out/bin/free5gc-chf
+  '';
+
+  doInstallCheck = true;
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "irrelevant"; # has no version flag, empty string didn't work
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Open source 5G core network based on 3GPP R15";
+    homepage = "https://free5gc.org/";
+    changelog = "https://github.com/free5gc/chf/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ felbinger ];
+    platforms = lib.platforms.linux;
+    mainProgram = "free5gc-chf";
+  };
+})
diff --git a/pkgs/by-name/fr/free5gc-n3iwf/package.nix b/pkgs/by-name/fr/free5gc-n3iwf/package.nix
new file mode 100644
index 000000000000..1e4b5379778a
--- /dev/null
+++ b/pkgs/by-name/fr/free5gc-n3iwf/package.nix
@@ -0,0 +1,53 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+buildGoModule (finalAttrs: {
+  pname = "free5gc-n3iwf";
+  version = "1.3.3";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "free5gc";
+    repo = "n3iwf";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-BFr+d8YQNXcHcOgYZxuh+IFJ9/nMxEEDtTgbzhiFKCY=";
+  };
+
+  vendorHash = "sha256-tvMyRV/a40ubPoT1uGxZ1g2q4qJ3K9fof7Xt5IN8vC4=";
+
+  ldflags = [
+    "-X github.com/free5gc/util/version.VERSION=v${finalAttrs.version}"
+  ];
+
+  postInstall = ''
+    mv -v $out/bin/cmd $out/bin/free5gc-n3iwf
+  '';
+
+  doInstallCheck = true;
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "irrelevant"; # has no version flag, empty string didn't work
+
+  checkFlags = [
+    "-skip TestCheckIKEMessage"
+    # --- FAIL: TestCheckIKEMessage (0.00s)
+    #     Error Trace:    /build/source/internal/ike/server_test.go:170
+    #     Error:          Received unexpected error: dial udp 10.100.100.2:500: connect: network is unreachable
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Open source 5G core network based on 3GPP R15";
+    homepage = "https://free5gc.org/";
+    changelog = "https://github.com/free5gc/n3iwf/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ felbinger ];
+    platforms = lib.platforms.linux;
+    mainProgram = "free5gc-n3iwf";
+  };
+})
diff --git a/pkgs/by-name/fr/free5gc-nef/package.nix b/pkgs/by-name/fr/free5gc-nef/package.nix
new file mode 100644
index 000000000000..763653b4a191
--- /dev/null
+++ b/pkgs/by-name/fr/free5gc-nef/package.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+buildGoModule (finalAttrs: {
+  pname = "free5gc-nef";
+  version = "1.2.3";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "free5gc";
+    repo = "nef";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-FaLL+RMAub8weCzE68UL6ZpjMf2GRfoekt1X2QjtVEw=";
+  };
+
+  vendorHash = "sha256-GS86eLcF0hlnnMPFsKGfhsUDcnjMQVq30oe0KxEbAzQ=";
+
+  ldflags = [
+    "-X github.com/free5gc/util/version.VERSION=v${finalAttrs.version}"
+  ];
+
+  postInstall = ''
+    mv -v $out/bin/cmd $out/bin/free5gc-nef
+  '';
+
+  doInstallCheck = true;
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "irrelevant"; # has no version flag, empty string didn't work
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Open source 5G core network based on 3GPP R15";
+    homepage = "https://free5gc.org/";
+    changelog = "https://github.com/free5gc/nef/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ felbinger ];
+    platforms = lib.platforms.linux;
+    mainProgram = "free5gc-nef";
+  };
+})
diff --git a/pkgs/by-name/fr/free5gc-nrf/package.nix b/pkgs/by-name/fr/free5gc-nrf/package.nix
new file mode 100644
index 000000000000..660b90b8410b
--- /dev/null
+++ b/pkgs/by-name/fr/free5gc-nrf/package.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+buildGoModule (finalAttrs: {
+  pname = "free5gc-nrf";
+  version = "1.4.3";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "free5gc";
+    repo = "nrf";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-NACwoa5ulIkEPtbHO5sFIyTPu5CDlj+AOCedMgNx3z4=";
+  };
+
+  vendorHash = "sha256-xfrDXKcAJvYYjplBTXS7SezQX9rLhRomNXilFYVUyLM=";
+
+  ldflags = [
+    "-X github.com/free5gc/util/version.VERSION=v${finalAttrs.version}"
+  ];
+
+  postInstall = ''
+    mv -v $out/bin/cmd $out/bin/free5gc-nrf
+  '';
+
+  doInstallCheck = true;
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "irrelevant"; # has no version flag, empty string didn't work
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Open source 5G core network based on 3GPP R15";
+    homepage = "https://free5gc.org/";
+    changelog = "https://github.com/free5gc/nrf/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ felbinger ];
+    platforms = lib.platforms.linux;
+    mainProgram = "free5gc-nrf";
+  };
+})
diff --git a/pkgs/by-name/fr/free5gc-nssf/package.nix b/pkgs/by-name/fr/free5gc-nssf/package.nix
new file mode 100644
index 000000000000..c273390387d4
--- /dev/null
+++ b/pkgs/by-name/fr/free5gc-nssf/package.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+buildGoModule (finalAttrs: {
+  pname = "free5gc-nssf";
+  version = "1.4.3";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "free5gc";
+    repo = "nssf";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ggX4SwQFEYJj8NrlEaQ4I5o+xzJdUQDWAfAMHnNunRU=";
+  };
+
+  vendorHash = "sha256-HqLxGpW15vHRNLyc6lwaFD5J9TVoqFqH+hFFiivgITQ=";
+
+  ldflags = [
+    "-X github.com/free5gc/util/version.VERSION=v${finalAttrs.version}"
+  ];
+
+  postInstall = ''
+    mv -v $out/bin/cmd $out/bin/free5gc-nssf
+  '';
+
+  doInstallCheck = true;
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "irrelevant"; # has no version flag, empty string didn't work
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Open source 5G core network based on 3GPP R15";
+    homepage = "https://free5gc.org/";
+    changelog = "https://github.com/free5gc/nssf/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ felbinger ];
+    platforms = lib.platforms.linux;
+    mainProgram = "free5gc-nssf";
+  };
+})
diff --git a/pkgs/by-name/fr/free5gc-pcf/package.nix b/pkgs/by-name/fr/free5gc-pcf/package.nix
new file mode 100644
index 000000000000..f45a623854af
--- /dev/null
+++ b/pkgs/by-name/fr/free5gc-pcf/package.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+buildGoModule (finalAttrs: {
+  pname = "free5gc-pcf";
+  version = "1.4.3";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "free5gc";
+    repo = "pcf";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-nxs29ikm/NQTnVc2ANzZxMqC9Usui4E+0GrL5taO9aM=";
+  };
+
+  vendorHash = "sha256-m1IqVKnsT7vWJMWHGrA4QB3aXIkGsIJQQ7NAGT/Th38=";
+
+  ldflags = [
+    "-X github.com/free5gc/util/version.VERSION=v${finalAttrs.version}"
+  ];
+
+  postInstall = ''
+    mv -v $out/bin/cmd $out/bin/free5gc-pcf
+  '';
+
+  doInstallCheck = true;
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "irrelevant"; # has no version flag, empty string didn't work
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Open source 5G core network based on 3GPP R15";
+    homepage = "https://free5gc.org/";
+    changelog = "https://github.com/free5gc/pcf/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ felbinger ];
+    platforms = lib.platforms.linux;
+    mainProgram = "free5gc-pcf";
+  };
+})
diff --git a/pkgs/by-name/fr/free5gc-smf/package.nix b/pkgs/by-name/fr/free5gc-smf/package.nix
new file mode 100644
index 000000000000..5b23f42b5bf3
--- /dev/null
+++ b/pkgs/by-name/fr/free5gc-smf/package.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+buildGoModule (finalAttrs: {
+  pname = "free5gc-smf";
+  version = "1.4.3";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "free5gc";
+    repo = "smf";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-V5Z0AZMloCRgsCI0j8j9dnb2a+gKhu3M29Po3wY0RMk=";
+  };
+
+  vendorHash = "sha256-8sVuhlLN00TxTaQFtETvsuAIoW3yjy/CBGF4PQp2XQ4=";
+
+  ldflags = [
+    "-X github.com/free5gc/util/version.VERSION=v${finalAttrs.version}"
+  ];
+
+  postInstall = ''
+    mv -v $out/bin/cmd $out/bin/free5gc-smf
+  '';
+
+  doInstallCheck = true;
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "irrelevant"; # has no version flag, empty string didn't work
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Open source 5G core network based on 3GPP R15";
+    homepage = "https://free5gc.org/";
+    changelog = "https://github.com/free5gc/smf/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ felbinger ];
+    platforms = lib.platforms.linux;
+    mainProgram = "free5gc-smf";
+  };
+})
diff --git a/pkgs/by-name/fr/free5gc-tngf/package.nix b/pkgs/by-name/fr/free5gc-tngf/package.nix
new file mode 100644
index 000000000000..b2986ac668cb
--- /dev/null
+++ b/pkgs/by-name/fr/free5gc-tngf/package.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+buildGoModule (finalAttrs: {
+  pname = "free5gc-tngf";
+  version = "1.1.3";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "free5gc";
+    repo = "tngf";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-rWSx4FCAA1QL7F66swPdhDcDr60TrtMnXhTlVBRR2OY=";
+  };
+
+  vendorHash = "sha256-C0zs4+ypC0LI5tkjrs5ajiWnoArHvdOoXj1iaNqSXM0=";
+
+  ldflags = [
+    "-X github.com/free5gc/util/version.VERSION=v${finalAttrs.version}"
+  ];
+
+  postInstall = ''
+    mv -v $out/bin/cmd $out/bin/free5gc-tngf
+  '';
+
+  doInstallCheck = true;
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "irrelevant"; # has no version flag, empty string didn't work
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Open source 5G core network based on 3GPP R15";
+    homepage = "https://free5gc.org/";
+    changelog = "https://github.com/free5gc/tngf/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ felbinger ];
+    platforms = lib.platforms.linux;
+    mainProgram = "free5gc-tngf";
+  };
+})
diff --git a/pkgs/by-name/fr/free5gc-udm/package.nix b/pkgs/by-name/fr/free5gc-udm/package.nix
new file mode 100644
index 000000000000..aba5838a5fbe
--- /dev/null
+++ b/pkgs/by-name/fr/free5gc-udm/package.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+buildGoModule (finalAttrs: {
+  pname = "free5gc-udm";
+  version = "1.4.3";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "free5gc";
+    repo = "udm";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-sxksDLI3xV/vz48F9s3TUga6hORaqRTwIiCzeNS0Ijs=";
+  };
+
+  vendorHash = "sha256-dl9rNeh4NurAcTFsca2189ReFdg8e5sMjvVGfe8EMWc=";
+
+  ldflags = [
+    "-X github.com/free5gc/util/version.VERSION=v${finalAttrs.version}"
+  ];
+
+  postInstall = ''
+    mv -v $out/bin/cmd $out/bin/free5gc-udm
+  '';
+
+  doInstallCheck = true;
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "irrelevant"; # has no version flag, empty string didn't work
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Open source 5G core network based on 3GPP R15";
+    homepage = "https://free5gc.org/";
+    changelog = "https://github.com/free5gc/udm/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ felbinger ];
+    platforms = lib.platforms.linux;
+    mainProgram = "free5gc-udm";
+  };
+})
diff --git a/pkgs/by-name/fr/free5gc-udr/package.nix b/pkgs/by-name/fr/free5gc-udr/package.nix
new file mode 100644
index 000000000000..2d674c229725
--- /dev/null
+++ b/pkgs/by-name/fr/free5gc-udr/package.nix
@@ -0,0 +1,53 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+buildGoModule (finalAttrs: {
+  pname = "free5gc-udr";
+  version = "1.4.3";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "free5gc";
+    repo = "udr";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ZfZ9amkKSL+C6ArUmZ+ckj7w++qI1/nlJmPHtsxFaf4=";
+  };
+
+  vendorHash = "sha256-LCUT9bkUr7telvQMvg/ZgsLu6352DOP3iy9cBhDjsj8=";
+
+  ldflags = [
+    "-X github.com/free5gc/util/version.VERSION=v${finalAttrs.version}"
+  ];
+
+  postInstall = ''
+    mv -v $out/bin/cmd $out/bin/free5gc-udr
+  '';
+
+  doInstallCheck = true;
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "irrelevant"; # has no version flag, empty string didn't work
+
+  checkFlags = [
+    "-skip TestUDR_InfluData_CreateThenGet"
+    # --- FAIL: TestUDR_InfluData_CreateThenGet (30.00s)
+    #     Error Trace:    /build/source/internal/sbi/api_sanity_test.go:64
+    #     Error:          Expected nil, but got: topology.ServerSelectionError
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Open source 5G core network based on 3GPP R15";
+    homepage = "https://free5gc.org/";
+    changelog = "https://github.com/free5gc/udr/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ felbinger ];
+    platforms = lib.platforms.linux;
+    mainProgram = "free5gc-udr";
+  };
+})
diff --git a/pkgs/by-name/fr/free5gc-upf/package.nix b/pkgs/by-name/fr/free5gc-upf/package.nix
new file mode 100644
index 000000000000..ffb12e735b11
--- /dev/null
+++ b/pkgs/by-name/fr/free5gc-upf/package.nix
@@ -0,0 +1,59 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+buildGoModule (finalAttrs: {
+  pname = "free5gc-upf";
+  version = "1.2.12";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "free5gc";
+    repo = "go-upf";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-MfQbHVEqnoFzUL5FPIE6dQSJxQD7PAZSbAgy/skHs+8=";
+  };
+
+  vendorHash = "sha256-VPm0Z67Sm/liIofVm1bI3/HU+lwYtwkg6zMRdZFZTZ8=";
+
+  ldflags = [
+    "-X github.com/free5gc/util/version.VERSION=v${finalAttrs.version}"
+  ];
+
+  postInstall = ''
+    mv -v $out/bin/cmd $out/bin/free5gc-upf
+  '';
+
+  doInstallCheck = true;
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "irrelevant"; # has no version flag, empty string didn't work
+
+  checkFlags =
+    let
+      # Skip tests that require gtp5g kernel module
+      # result in: create: operation not permitted or get family: no such file or directory
+      skippedTests = [
+        "TestGtp5g_CreateRules"
+        "TestNewFlowDesc"
+        "TestServer"
+        "TestWaitRoutineStopped"
+      ];
+    in
+    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Open source 5G core network based on 3GPP R15";
+    homepage = "https://free5gc.org/";
+    changelog = "https://github.com/free5gc/go-upf/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ felbinger ];
+    platforms = lib.platforms.linux;
+    mainProgram = "free5gc-upf";
+  };
+})
diff --git a/pkgs/by-name/fr/freetube/package.nix b/pkgs/by-name/fr/freetube/package.nix
index ed4e7f35e84e..af3894ffcf7c 100644
--- a/pkgs/by-name/fr/freetube/package.nix
+++ b/pkgs/by-name/fr/freetube/package.nix
@@ -12,23 +12,24 @@
   pnpm_10,
   makeShellWrapper,
   copyDesktopItems,
-  electron,
-
+  darwin,
+  electron_42,
   nixosTests,
 }:
 let
   description = "Open Source YouTube app for privacy";
   pnpm = pnpm_10;
+  electron = electron_42;
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "freetube";
-  version = "0.25.1";
+  version = "0.25.2";
 
   src = fetchFromGitHub {
     owner = "FreeTubeApp";
     repo = "FreeTube";
     tag = "v${finalAttrs.version}-beta";
-    hash = "sha256-CQiwAoOJoAZpcDIwqcOfUAvJHLWTdj8fIInlR3qyjg8=";
+    hash = "sha256-A25I64GP4FRyP21W5QuVvrWpThyU7hDosO25vkIx0UY=";
   };
 
   __structuredAttrs = true;
@@ -57,7 +58,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 4;
-    hash = "sha256-NWCgUjBuSeEl65mmAeJzOyIxCi2ha0Nr5qjOQq+CtMQ=";
+    hash = "sha256-1OnmJi4xCxMALAac4jnLOKg5N/t3pcHgM0AgvF1+DpM=";
   };
 
   nativeBuildInputs = [
@@ -67,6 +68,9 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     pnpm
     makeShellWrapper
     copyDesktopItems
+  ]
+  ++ lib.optionals stdenvNoCC.hostPlatform.isDarwin [
+    darwin.autoSignDarwinBinariesHook
   ];
 
   installPhase = ''
diff --git a/pkgs/by-name/fr/freetube/patch-build-script.patch b/pkgs/by-name/fr/freetube/patch-build-script.patch
index f925f420212a..a4a386c9d6d5 100644
--- a/pkgs/by-name/fr/freetube/patch-build-script.patch
+++ b/pkgs/by-name/fr/freetube/patch-build-script.patch
@@ -11,3 +11,12 @@ index bef1f6f1d..d2ee86611 100644
    appId: `io.freetubeapp.${packageDetails.name}`,
    copyright: 'Copyleft © 2020-2026 freetubeapp@protonmail.com',
    // asar: false,
+@@ -99,7 +101,7 @@ export default {
+     // Enable ad-hoc signing
+     // If we skip signing entirely, macOS says that the application is damaged, which makes users open bug reports.
+     // With an ad-hoc signature it still refuses to launch by default but with the reason that it cannot verify the signature
+-    identity: '-'
++    identity: null
+   },
+   win: {
+     icon: '_icons/icon.ico',
diff --git a/pkgs/by-name/fr/freifunk-meshviewer/package.nix b/pkgs/by-name/fr/freifunk-meshviewer/package.nix
index 30aa0fb80645..712ea00afd05 100644
--- a/pkgs/by-name/fr/freifunk-meshviewer/package.nix
+++ b/pkgs/by-name/fr/freifunk-meshviewer/package.nix
@@ -7,7 +7,7 @@
 buildNpmPackage (finalAttrs: {
   pname = "freifunk-meshviewer";
 
-  version = "13.1.0";
+  version = "13.2.0";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -16,10 +16,10 @@ buildNpmPackage (finalAttrs: {
     owner = "freifunk";
     repo = "meshviewer";
     tag = "v${finalAttrs.version}";
-    sha256 = "sha256-u9lX7B402KFOHyaReyg3f5rDYDshbO/lyMYo7XxgJR8=";
+    sha256 = "sha256-ni5Ln9K+Bqq88oi+nwOyCqibJz3TesVreHDWEec6Xzk=";
   };
 
-  npmDepsHash = "sha256-BaFtFdOu+WArH75nPtasSpecdGjMxTchFcF+K7krNpM=";
+  npmDepsHash = "sha256-gdGaJSwT5EYcrL/VBId4c6VFmyEbQ9v2LEJP1jc8yO8=";
 
   installPhase = ''
     mkdir -p $out/share/freifunk-meshviewer/
diff --git a/pkgs/by-name/fr/fromager/package.nix b/pkgs/by-name/fr/fromager/package.nix
index 34912d3be0d5..cf0f7a4a0906 100644
--- a/pkgs/by-name/fr/fromager/package.nix
+++ b/pkgs/by-name/fr/fromager/package.nix
@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "fromager";
-  version = "0.91.0";
+  version = "0.94.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "python-wheel-build";
     repo = "fromager";
     tag = finalAttrs.version;
-    hash = "sha256-N+4DbKNUpQdkJAfr0vwlfXJS8FLLBOXxuzkLoJblJM4=";
+    hash = "sha256-h+WQlz1JIwlAF2wXVaUWScEE87P/r5bBFcDVMLalsEM=";
   };
 
   build-system = with python3Packages; [
@@ -59,11 +59,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
     "fromager"
   ];
 
-  # Upstream runs pytest with `--log-level DEBUG`, which this test suite
-  # relies on for caplog assertions against INFO records.
-  # Reported: https://github.com/python-wheel-build/fromager/issues/1274
-  pytestFlags = [ "--log-level=DEBUG" ];
-
   meta = {
     description = "Wheel maker";
     homepage = "https://pypi.org/project/fromager/";
diff --git a/pkgs/by-name/ga/gale/package.nix b/pkgs/by-name/ga/gale/package.nix
index 9f729b80a834..9515c56529f3 100644
--- a/pkgs/by-name/ga/gale/package.nix
+++ b/pkgs/by-name/ga/gale/package.nix
@@ -38,13 +38,13 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "gale";
-  version = "1.19.2";
+  version = "1.20.0";
 
   src = fetchFromGitHub {
     owner = "Kesomannen";
     repo = "gale";
     tag = finalAttrs.version;
-    hash = "sha256-L3w9XKIeZik2+ezdNk1DDch6c613qiXhxNHqgU6lZoQ=";
+    hash = "sha256-KQTjQTBrFVMoFBTelbGk03kSO1QLKyb3MhUt1Yhnv8E=";
   };
 
   pnpmDeps = fetchPnpmDeps {
@@ -56,7 +56,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       ;
     pnpm = pnpm_10;
     fetcherVersion = 3;
-    hash = "sha256-/IR+34cdnCt9WpYdMaT92YIC/2JjEe/mZdeQewdWTek=";
+    hash = "sha256-o0Nw1bIA2qPhcYmPDbyMuocltRUrLcFWc50J8yR7CzQ=";
   };
 
   postPatch = ''
@@ -70,7 +70,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   cargoRoot = "src-tauri";
   buildAndTestSubdir = finalAttrs.cargoRoot;
 
-  cargoHash = "sha256-qZCKaVcmgFZJ2s/fyGKqgLJS5kGziaBjrTa3QIvjkPM=";
+  cargoHash = "sha256-pvtL5vDUKm2Ne6f88BgjqkImTBW3dal6G4n2yrFx8yM=";
 
   checkFlags = [
     "--skip=config::bepinex::tests::check_from_string" # Fails a left == right check, even with left and right data being identical
diff --git a/pkgs/by-name/gc/gcc-arm-embedded-15/package.nix b/pkgs/by-name/gc/gcc-arm-embedded-15/package.nix
index f574f312ce7d..00c93775a945 100644
--- a/pkgs/by-name/gc/gcc-arm-embedded-15/package.nix
+++ b/pkgs/by-name/gc/gcc-arm-embedded-15/package.nix
@@ -8,10 +8,7 @@
   zstd,
 }:
 
-stdenv.mkDerivation rec {
-  pname = "gcc-arm-embedded";
-  version = "15.2.rel1";
-
+let
   platform =
     {
       aarch64-darwin = "darwin-arm64";
@@ -19,15 +16,19 @@ stdenv.mkDerivation rec {
       x86_64-linux = "x86_64";
     }
     .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "gcc-arm-embedded";
+  version = "15.3.rel1";
 
   src = fetchurl {
-    url = "https://developer.arm.com/-/media/Files/downloads/gnu/${version}/binrel/arm-gnu-toolchain-${version}-${platform}-arm-none-eabi.tar.xz";
+    url = "https://gitlab.arm.com/api/v4/projects/tooling%2Fgnu-toolchains-for-arm/packages/generic/gnu-toolchain/${finalAttrs.version}/arm-gnu-toolchain-${finalAttrs.version}-${platform}-arm-none-eabi.tar.xz";
     # hashes obtained from location ${url}.sha256asc
     sha256 =
       {
-        aarch64-darwin = "1938a84b7105c192e3fb4fa5e893ba25f425f7ddab40515ae608cd40f68669a8";
-        aarch64-linux = "d061559d814b205ed30c5b7c577c03317ec447ca51cd5a159d26b12a5bbeb20c";
-        x86_64-linux = "597893282ac8c6ab1a4073977f2362990184599643b4c5ee34870a8215783a16";
+        aarch64-darwin = "376808a59ca209c1413236f1c6a509e33da4b29857ab28642b9927cf3048af55";
+        aarch64-linux = "06979e0c8171de58e5dc2a2b2019330a290f30930f27728af98a83e1a7369b3a";
+        x86_64-linux = "563bebb2b97d53382b956d6ee1fe61e2cae26699901417234a37df505ef9b5fa";
       }
       .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
@@ -84,4 +85,4 @@ stdenv.mkDerivation rec {
     ];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
   };
-}
+})
diff --git a/pkgs/by-name/gc/gcli/package.nix b/pkgs/by-name/gc/gcli/package.nix
index 9f1ea40297f7..e8b20d046b56 100644
--- a/pkgs/by-name/gc/gcli/package.nix
+++ b/pkgs/by-name/gc/gcli/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gcli";
-  version = "2.12.0";
+  version = "2.13.0";
 
   src = fetchFromSourcehut {
     owner = "~herrhotzenplotz";
     repo = "gcli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-k691ocg5rkvGJZDp6X9PRIDaNvVPLcJRoXvwPbyxjLE=";
+    hash = "sha256-Ow899ehIln+2E5j/MNA7XCRSBNCeaJ16ePR/u0qXvos=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ge/geopard/package.nix b/pkgs/by-name/ge/geopard/package.nix
index 4fbcb97eb7e7..ed0eb7972136 100644
--- a/pkgs/by-name/ge/geopard/package.nix
+++ b/pkgs/by-name/ge/geopard/package.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
+    inherit (finalAttrs) pname version src;
     hash = "sha256-g7pHEBrR/tdKP+kuYJ44Py7kaAx0tXcMkC4UdsfSfDQ=";
   };
 
diff --git a/pkgs/by-name/ge/gersemi/package.nix b/pkgs/by-name/ge/gersemi/package.nix
index b0e39baf439b..a3c01b42aae7 100644
--- a/pkgs/by-name/ge/gersemi/package.nix
+++ b/pkgs/by-name/ge/gersemi/package.nix
@@ -2,22 +2,39 @@
   lib,
   python3Packages,
   fetchFromGitHub,
+  cargo,
+  rustPlatform,
+  rustc,
 }:
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "gersemi";
-  version = "0.23.2";
+  version = "0.28.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "BlankSpruce";
     repo = "gersemi";
     tag = finalAttrs.version;
-    hash = "sha256-sXgu3KscRi/3Myg/4jarMZ4W7/CaQTmyxxbcu8/0o6Y=";
+    hash = "sha256-92R+jSsE9icZgeNXcPyagZtL4jZNLh2EMCMofM5FFsU=";
   };
 
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) src pname version;
+    sourceRoot = "${finalAttrs.src.name}/gersemi/rust-backend";
+    hash = "sha256-2ukdpS5oNDE9kf0zFrPXyh+6zA/l0ByUhb71xhJJ8nA=";
+  };
+
+  cargoRoot = "gersemi/rust-backend";
+
+  nativeBuildInputs = [
+    cargo
+    rustPlatform.cargoSetupHook
+    rustc
+  ];
+
   build-system = with python3Packages; [
-    setuptools
+    setuptools-rust
   ];
 
   dependencies = with python3Packages; [
@@ -30,6 +47,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
   meta = {
     description = "Formatter to make your CMake code the real treasure";
     homepage = "https://github.com/BlankSpruce/gersemi";
+    changelog = "https://github.com/BlankSpruce/gersemi/blob/${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.mpl20;
     maintainers = with lib.maintainers; [ xeals ];
     mainProgram = "gersemi";
diff --git a/pkgs/by-name/gh/ghr-cli/package.nix b/pkgs/by-name/gh/ghr-cli/package.nix
index 1b5c81832a3f..f8eff30a9c9b 100644
--- a/pkgs/by-name/gh/ghr-cli/package.nix
+++ b/pkgs/by-name/gh/ghr-cli/package.nix
@@ -9,7 +9,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ghr-cli";
-  version = "0.8.2";
+  version = "0.9.0";
 
   __structuredAttrs = true;
 
@@ -17,10 +17,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "chenyukang";
     repo = "ghr";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ELYWoGUP6s2Trtnk9zgDLlT7MtaiHzfsFbzH+LmsKDE=";
+    hash = "sha256-LmQaBPPX+VRWFHDMvzyhtWcoiEZJocNeyu6EKBX4IjI=";
   };
 
-  cargoHash = "sha256-siMxS08K+7L8f9A32gEWwQF9PAQh5UPMA+xTkTlz13o=";
+  cargoHash = "sha256-UCu/z6TzNYV0scWnl5XnN+nj9V9cg9hpUNqFZXlMXaM=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/gi/giada/fmt-12-format-header.patch b/pkgs/by-name/gi/giada/fmt-12-format-header.patch
new file mode 100644
index 000000000000..6ed5ee7982eb
--- /dev/null
+++ b/pkgs/by-name/gi/giada/fmt-12-format-header.patch
@@ -0,0 +1,434 @@
+Include <fmt/format.h> instead of <fmt/core.h>
+
+fmt 12.2.0 made <fmt/core.h> a shim for <fmt/base.h>, which no longer
+declares fmt::format.
+
+diff --git a/src/core/channels/channel.cpp b/src/core/channels/channel.cpp
+index f17693d..5399f97 100644
+--- a/src/core/channels/channel.cpp
++++ b/src/core/channels/channel.cpp
+@@ -30,7 +30,7 @@
+ #if G_DEBUG_MODE
+ #include "src/core/wave.h"
+ #include "src/utils/string.h"
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #endif
+ 
+ namespace giada::m
+diff --git a/src/core/engine.cpp b/src/core/engine.cpp
+index 04cfa95..3ef5f05 100644
+--- a/src/core/engine.cpp
++++ b/src/core/engine.cpp
+@@ -32,7 +32,7 @@
+ #include "src/utils/fs.h"
+ #include "src/utils/log.h"
+ #include "src/utils/string.h"
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <memory>
+ 
+ namespace giada::m
+diff --git a/src/core/model/actions.cpp b/src/core/model/actions.cpp
+index 2c72147..f9b1bb0 100644
+--- a/src/core/model/actions.cpp
++++ b/src/core/model/actions.cpp
+@@ -32,7 +32,7 @@
+ #include <cassert>
+ #include <memory>
+ #if G_DEBUG_MODE
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #endif
+ 
+ namespace utils = mcl::utils;
+diff --git a/src/core/model/channels.cpp b/src/core/model/channels.cpp
+index 857814f..53b2cd2 100644
+--- a/src/core/model/channels.cpp
++++ b/src/core/model/channels.cpp
+@@ -30,7 +30,7 @@
+ #include <cassert>
+ #if G_DEBUG_MODE
+ #include "src/utils/string.h"
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #endif
+ 
+ namespace utils = mcl::utils;
+diff --git a/src/core/model/mixer.cpp b/src/core/model/mixer.cpp
+index b20caaf..2de421d 100644
+--- a/src/core/model/mixer.cpp
++++ b/src/core/model/mixer.cpp
+@@ -27,7 +27,7 @@
+ #include "src/core/model/mixer.h"
+ #include "src/const.h"
+ #if G_DEBUG_MODE
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #endif
+ 
+ namespace giada::m::model
+diff --git a/src/core/model/model.cpp b/src/core/model/model.cpp
+index 316a729..8ac1901 100644
+--- a/src/core/model/model.cpp
++++ b/src/core/model/model.cpp
+@@ -36,7 +36,7 @@
+ #include <cassert>
+ #include <memory>
+ #if G_DEBUG_MODE
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #endif
+ #include <fmt/ostream.h>
+ 
+diff --git a/src/core/model/shared.cpp b/src/core/model/shared.cpp
+index 8603c24..cd01ac7 100644
+--- a/src/core/model/shared.cpp
++++ b/src/core/model/shared.cpp
+@@ -31,7 +31,7 @@
+ #include "src/core/waveFactory.h"
+ #include "src/deps/mcl-utils/src/container.hpp"
+ #if G_DEBUG_MODE
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #endif
+ #include <fmt/ostream.h>
+ 
+diff --git a/src/core/model/track.cpp b/src/core/model/track.cpp
+index c88a0b4..a464483 100644
+--- a/src/core/model/track.cpp
++++ b/src/core/model/track.cpp
+@@ -28,7 +28,7 @@
+ #include "src/core/types.h"
+ #include <cassert>
+ #if G_DEBUG_MODE
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #endif
+ 
+ namespace giada::m::model
+diff --git a/src/core/wave.cpp b/src/core/wave.cpp
+index e21f9af..01c1334 100644
+--- a/src/core/wave.cpp
++++ b/src/core/wave.cpp
+@@ -27,7 +27,7 @@
+ #include "src/core/wave.h"
+ #include "src/deps/mcl-utils/src/fs.hpp"
+ #include <cassert>
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ 
+ namespace utils = mcl::utils;
+ 
+diff --git a/src/core/waveFactory.cpp b/src/core/waveFactory.cpp
+index 73708d4..425f754 100644
+--- a/src/core/waveFactory.cpp
++++ b/src/core/waveFactory.cpp
+@@ -34,7 +34,7 @@
+ #include "src/deps/mcl-utils/src/fs.hpp"
+ #include "src/utils/log.h"
+ #include <cmath>
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <memory>
+ #include <samplerate.h>
+ #include <sndfile.h>
+diff --git a/src/glue/config.cpp b/src/glue/config.cpp
+index e05b483..2856f72 100644
+--- a/src/glue/config.cpp
++++ b/src/glue/config.cpp
+@@ -37,7 +37,7 @@
+ #include "src/gui/elems/config/tabPlugins.h"
+ #include "src/gui/ui.h"
+ #include "src/utils/fs.h"
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ 
+ extern giada::v::Ui*     g_ui;
+ extern giada::m::Engine* g_engine;
+diff --git a/src/gui/dialogs/about.cpp b/src/gui/dialogs/about.cpp
+index 818e219..62b377d 100644
+--- a/src/gui/dialogs/about.cpp
++++ b/src/gui/dialogs/about.cpp
+@@ -32,7 +32,7 @@
+ #include "src/gui/ui.h"
+ #include "src/utils/gui.h"
+ #include "src/utils/string.h"
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ 
+ extern giada::v::Ui* g_ui;
+ 
+diff --git a/src/gui/dialogs/actionEditor/baseActionEditor.cpp b/src/gui/dialogs/actionEditor/baseActionEditor.cpp
+index 5c5e6db..6850a07 100644
+--- a/src/gui/dialogs/actionEditor/baseActionEditor.cpp
++++ b/src/gui/dialogs/actionEditor/baseActionEditor.cpp
+@@ -43,7 +43,7 @@
+ #include <FL/Fl.H>
+ #include <FL/fl_draw.H>
+ #include <cassert>
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <limits>
+ #include <string>
+ 
+diff --git a/src/gui/dialogs/bpmInput.cpp b/src/gui/dialogs/bpmInput.cpp
+index 0b862f8..737ba79 100644
+--- a/src/gui/dialogs/bpmInput.cpp
++++ b/src/gui/dialogs/bpmInput.cpp
+@@ -33,7 +33,7 @@
+ #include "src/gui/ui.h"
+ #include "src/utils/gui.h"
+ #include <cstring>
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ 
+ extern giada::v::Ui* g_ui;
+ 
+diff --git a/src/gui/dialogs/channelRouting.cpp b/src/gui/dialogs/channelRouting.cpp
+index 8b1af7a..daa4661 100644
+--- a/src/gui/dialogs/channelRouting.cpp
++++ b/src/gui/dialogs/channelRouting.cpp
+@@ -37,7 +37,7 @@
+ #include "src/gui/graphics.h"
+ #include "src/gui/ui.h"
+ #include "src/utils/gui.h"
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <ranges>
+ 
+ extern giada::v::Ui* g_ui;
+diff --git a/src/gui/dialogs/mainWindow.cpp b/src/gui/dialogs/mainWindow.cpp
+index 68446b8..ed83e69 100644
+--- a/src/gui/dialogs/mainWindow.cpp
++++ b/src/gui/dialogs/mainWindow.cpp
+@@ -42,7 +42,7 @@
+ #include "src/utils/gui.h"
+ #include <FL/Fl.H>
+ #include <FL/Fl_Tooltip.H>
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ 
+ extern giada::v::Ui* g_ui;
+ 
+diff --git a/src/gui/dialogs/sampleEditor.cpp b/src/gui/dialogs/sampleEditor.cpp
+index c41654f..fe849b7 100644
+--- a/src/gui/dialogs/sampleEditor.cpp
++++ b/src/gui/dialogs/sampleEditor.cpp
+@@ -52,7 +52,7 @@
+ #include <FL/Fl_Group.H>
+ #include <cassert>
+ #include <cmath>
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ 
+ #if G_OS_WINDOWS
+ #undef IN
+diff --git a/src/gui/elems/config/tabAudio.cpp b/src/gui/elems/config/tabAudio.cpp
+index a42422b..6af6802 100644
+--- a/src/gui/elems/config/tabAudio.cpp
++++ b/src/gui/elems/config/tabAudio.cpp
+@@ -35,7 +35,7 @@
+ #include "src/gui/elems/basics/textButton.h"
+ #include "src/gui/ui.h"
+ #include "src/utils/gui.h"
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <string>
+ 
+ extern giada::v::Ui* g_ui;
+diff --git a/src/gui/elems/config/tabMisc.cpp b/src/gui/elems/config/tabMisc.cpp
+index 36b66ae..261538b 100644
+--- a/src/gui/elems/config/tabMisc.cpp
++++ b/src/gui/elems/config/tabMisc.cpp
+@@ -31,7 +31,7 @@
+ #include "src/gui/elems/config/stringMenu.h"
+ #include "src/gui/ui.h"
+ #include "src/utils/gui.h"
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ 
+ constexpr int LABEL_WIDTH = 120;
+ 
+diff --git a/src/gui/elems/config/tabPlugins.cpp b/src/gui/elems/config/tabPlugins.cpp
+index 98305e2..0a1aa60 100644
+--- a/src/gui/elems/config/tabPlugins.cpp
++++ b/src/gui/elems/config/tabPlugins.cpp
+@@ -39,7 +39,7 @@
+ #include "src/utils/gui.h"
+ #include "src/utils/string.h"
+ #include <FL/Fl.H>
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <functional>
+ 
+ extern giada::v::Ui* g_ui;
+diff --git a/src/gui/elems/mainWindow/cpuLoad.cpp b/src/gui/elems/mainWindow/cpuLoad.cpp
+index 19e0cab..087832a 100644
+--- a/src/gui/elems/mainWindow/cpuLoad.cpp
++++ b/src/gui/elems/mainWindow/cpuLoad.cpp
+@@ -30,7 +30,7 @@
+ #include "src/gui/drawing.h"
+ #include "src/gui/elems/basics/box.h"
+ #include "src/gui/elems/basics/progress.h"
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ 
+ namespace giada::v
+ {
+diff --git a/src/gui/elems/mainWindow/keyboard/groupChannel.cpp b/src/gui/elems/mainWindow/keyboard/groupChannel.cpp
+index 961b2de..1c1bcef 100644
+--- a/src/gui/elems/mainWindow/keyboard/groupChannel.cpp
++++ b/src/gui/elems/mainWindow/keyboard/groupChannel.cpp
+@@ -34,7 +34,7 @@
+ #include "src/gui/elems/midiActivity.h"
+ #include "src/gui/graphics.h"
+ #include "src/gui/ui.h"
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ 
+ extern giada::v::Ui* g_ui;
+ 
+diff --git a/src/gui/elems/mainWindow/keyboard/midiChannel.cpp b/src/gui/elems/mainWindow/keyboard/midiChannel.cpp
+index 4ddcca1..ccc7ad4 100644
+--- a/src/gui/elems/mainWindow/keyboard/midiChannel.cpp
++++ b/src/gui/elems/mainWindow/keyboard/midiChannel.cpp
+@@ -35,7 +35,7 @@
+ #include "src/gui/elems/midiActivity.h"
+ #include "src/gui/graphics.h"
+ #include "src/gui/ui.h"
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ 
+ extern giada::v::Ui* g_ui;
+ 
+diff --git a/src/gui/elems/mainWindow/keyboard/midiChannelButton.cpp b/src/gui/elems/mainWindow/keyboard/midiChannelButton.cpp
+index a8da2c8..8025fd2 100644
+--- a/src/gui/elems/mainWindow/keyboard/midiChannelButton.cpp
++++ b/src/gui/elems/mainWindow/keyboard/midiChannelButton.cpp
+@@ -26,7 +26,7 @@
+ 
+ #include "src/gui/elems/mainWindow/keyboard/midiChannelButton.h"
+ #include "src/glue/channel.h"
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ 
+ namespace giada::v
+ {
+diff --git a/src/gui/elems/mainWindow/keyboard/sampleChannel.cpp b/src/gui/elems/mainWindow/keyboard/sampleChannel.cpp
+index 549fbf1..540e342 100644
+--- a/src/gui/elems/mainWindow/keyboard/sampleChannel.cpp
++++ b/src/gui/elems/mainWindow/keyboard/sampleChannel.cpp
+@@ -37,7 +37,7 @@
+ #include "src/gui/elems/midiActivity.h"
+ #include "src/gui/graphics.h"
+ #include "src/gui/ui.h"
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ 
+ extern giada::v::Ui* g_ui;
+ 
+diff --git a/src/gui/elems/mainWindow/mainTimer.cpp b/src/gui/elems/mainWindow/mainTimer.cpp
+index 55361d1..e7a6575 100644
+--- a/src/gui/elems/mainWindow/mainTimer.cpp
++++ b/src/gui/elems/mainWindow/mainTimer.cpp
+@@ -33,7 +33,7 @@
+ #include "src/gui/graphics.h"
+ #include "src/gui/ui.h"
+ #include "src/utils/gui.h"
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ 
+ extern giada::v::Ui* g_ui;
+ 
+diff --git a/src/gui/elems/mainWindow/scenes.cpp b/src/gui/elems/mainWindow/scenes.cpp
+index a2aca20..bb92b06 100644
+--- a/src/gui/elems/mainWindow/scenes.cpp
++++ b/src/gui/elems/mainWindow/scenes.cpp
+@@ -31,7 +31,7 @@
+ #include "src/gui/elems/basics/flex.h"
+ #include "src/gui/elems/playButton.h"
+ #include "src/gui/ui.h"
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ 
+ extern giada::v::Ui* g_ui;
+ 
+diff --git a/src/gui/elems/midiIO/midiLearner.cpp b/src/gui/elems/midiIO/midiLearner.cpp
+index 76746df..87a1c55 100644
+--- a/src/gui/elems/midiIO/midiLearner.cpp
++++ b/src/gui/elems/midiIO/midiLearner.cpp
+@@ -30,7 +30,7 @@
+ #include "src/gui/elems/basics/textButton.h"
+ #include "src/gui/ui.h"
+ #include <cassert>
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ 
+ extern giada::v::Ui* g_ui;
+ 
+diff --git a/src/gui/elems/panTool.cpp b/src/gui/elems/panTool.cpp
+index b431b5f..c282355 100644
+--- a/src/gui/elems/panTool.cpp
++++ b/src/gui/elems/panTool.cpp
+@@ -33,7 +33,7 @@
+ #include "src/utils/gui.h"
+ #include "src/utils/string.h"
+ #include <FL/Fl.H>
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ 
+ extern giada::v::Ui* g_ui;
+ 
+diff --git a/src/gui/elems/plugin/pluginBrowser.cpp b/src/gui/elems/plugin/pluginBrowser.cpp
+index 0b87db5..078c3d1 100644
+--- a/src/gui/elems/plugin/pluginBrowser.cpp
++++ b/src/gui/elems/plugin/pluginBrowser.cpp
+@@ -30,7 +30,7 @@
+ #include "src/gui/elems/basics/boxtypes.h"
+ #include "src/gui/ui.h"
+ #include "src/utils/gui.h"
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ 
+ extern giada::v::Ui* g_ui;
+ 
+diff --git a/src/gui/elems/sampleEditor/pitchTool.cpp b/src/gui/elems/sampleEditor/pitchTool.cpp
+index a9fe895..ec2e0eb 100644
+--- a/src/gui/elems/sampleEditor/pitchTool.cpp
++++ b/src/gui/elems/sampleEditor/pitchTool.cpp
+@@ -37,7 +37,7 @@
+ #include "src/gui/graphics.h"
+ #include "src/gui/ui.h"
+ #include "src/utils/gui.h"
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ 
+ extern giada::v::Ui* g_ui;
+ 
+diff --git a/src/gui/elems/volumeTool.cpp b/src/gui/elems/volumeTool.cpp
+index 22a8673..9e054ac 100644
+--- a/src/gui/elems/volumeTool.cpp
++++ b/src/gui/elems/volumeTool.cpp
+@@ -32,7 +32,7 @@
+ #include "src/gui/elems/basics/input.h"
+ #include "src/gui/elems/basics/textButton.h"
+ #include "src/gui/ui.h"
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ 
+ extern giada::v::Ui* g_ui;
+ 
+diff --git a/src/utils/log.h b/src/utils/log.h
+index f9b1433..a35d894 100644
+--- a/src/utils/log.h
++++ b/src/utils/log.h
+@@ -32,7 +32,7 @@
+ #include "src/const.h"
+ #include "src/core/const.h"
+ #include "src/utils/fs.h"
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <fmt/ostream.h>
+ #include <fstream>
+ #include <string>
diff --git a/pkgs/by-name/gi/giada/package.nix b/pkgs/by-name/gi/giada/package.nix
index 650f37868857..8e92e93ece39 100644
--- a/pkgs/by-name/gi/giada/package.nix
+++ b/pkgs/by-name/gi/giada/package.nix
@@ -45,6 +45,10 @@ stdenv.mkDerivation (finalAttrs: {
     "-Wno-error"
   ];
 
+  # fmt 12.2.0 made <fmt/core.h> a shim for <fmt/base.h>, which no longer
+  # declares fmt::format.
+  patches = [ ./fmt-12-format-header.patch ];
+
   cmakeFlags = [
     "-DCMAKE_INSTALL_BINDIR=bin"
   ];
diff --git a/pkgs/by-name/gi/giflib/package.nix b/pkgs/by-name/gi/giflib/package.nix
index 1fa7deb61a00..61e7d8a80f71 100644
--- a/pkgs/by-name/gi/giflib/package.nix
+++ b/pkgs/by-name/gi/giflib/package.nix
@@ -57,11 +57,9 @@ stdenv.mkDerivation (finalAttrs: {
   ''
   + lib.optionalString stdenv.hostPlatform.isStatic ''
     # Upstream build system does not support NOT building shared libraries.
-    sed -i '/all:/ s/$(LIBGIFSO)//' Makefile
-    sed -i '/all:/ s/$(LIBUTILSO)//' Makefile
-    sed -i '/-m 755 $(LIBGIFSO)/ d' Makefile
-    sed -i '/ln -sf $(LIBGIFSOVER)/ d' Makefile
-    sed -i '/ln -sf $(LIBGIFSOMAJOR)/ d' Makefile
+    substituteInPlace Makefile \
+      --replace-fail "all: shared-lib static-lib $(UTILS)" "all: static-lib $(UTILS)" \
+      --replace-fail "install-lib: install-static-lib install-shared-lib" "install-lib: install-static-lib"
   '';
 
   passthru.tests = {
diff --git a/pkgs/by-name/gi/gimoji/package.nix b/pkgs/by-name/gi/gimoji/package.nix
index c4ec092efaa5..6352b07d1cf9 100644
--- a/pkgs/by-name/gi/gimoji/package.nix
+++ b/pkgs/by-name/gi/gimoji/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "gimoji";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "zeenix";
     repo = "gimoji";
     rev = finalAttrs.version;
-    hash = "sha256-2YalpSPG5qzIW/CHlTVnKcvBi0eqD3B5K/KXE7mJwM0=";
+    hash = "sha256-YfKMawhoLyWXy37/qegpR4EuyrKPIEBxUmnIPtuJnxU=";
   };
 
-  cargoHash = "sha256-t2SE3xvLNVra2hU+Fa81dHbopIbl7GgOcef6tUGdbTE=";
+  cargoHash = "sha256-6RJj1DwZzRVQgExg5E4izrUeHtUdRAXcNQJPAAv3ya0=";
 
   meta = {
     description = "Easily add emojis to your git commit messages";
diff --git a/pkgs/by-name/gi/git-cinnabar/package.nix b/pkgs/by-name/gi/git-cinnabar/package.nix
index 637d68cf2f9e..9ed8b400561e 100644
--- a/pkgs/by-name/gi/git-cinnabar/package.nix
+++ b/pkgs/by-name/gi/git-cinnabar/package.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
+    inherit (finalAttrs) pname version src;
     hash = "sha256-IVizzc2dKZ83dz3KBMDDiaFNdnS40cS++k8AywyvakQ=";
   };
 
diff --git a/pkgs/by-name/gi/git-sim/package.nix b/pkgs/by-name/gi/git-sim/package.nix
index 373a2fb31115..bc6cd307f21e 100644
--- a/pkgs/by-name/gi/git-sim/package.nix
+++ b/pkgs/by-name/gi/git-sim/package.nix
@@ -1,44 +1,31 @@
 {
   lib,
   stdenv,
+  python3Packages,
   fetchFromGitHub,
   installShellFiles,
-  python3,
-
-  # Override Python packages using
-  # self: super: { pkg = super.pkg.overridePythonAttrs (oldAttrs: { ... }); }
-  # Applied after defaultOverrides
-  packageOverrides ? self: super: { },
+  addBinToPathHook,
 }:
-let
-  python = python3.override {
-    self = python;
-    packageOverrides = lib.composeManyExtensions [ packageOverrides ];
-  };
-
-  version = "0.3.5";
-in
-
-with python.pkgs;
-buildPythonApplication {
+python3Packages.buildPythonApplication (finalAttrs: {
   pname = "git-sim";
-  inherit version;
+  version = "0.3.5";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "initialcommit-com";
     repo = "git-sim";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-4jHkAlF2SAzHjBi8pmAJ0TKkcLxw+6EdGsXnHZUMILw=";
   };
 
   patches = [ ./tests.patch ];
 
-  build-system = [ setuptools ];
+  build-system = with python3Packages; [ setuptools ];
 
   pythonRemoveDeps = [ "opencv-python-headless" ];
 
-  dependencies = [
+  dependencies = with python3Packages; [
     gitpython
     manim
     opencv4
@@ -49,35 +36,47 @@ buildPythonApplication {
   ];
 
   # https://github.com/NixOS/nixpkgs/commit/8033561015355dd3c3cf419d81ead31e534d2138
-  makeWrapperArgs = [ "--prefix PYTHONWARNINGS , ignore:::pydub.utils:" ];
+  makeWrapperArgs = [
+    "--prefix"
+    "PYTHONWARNINGS"
+    ","
+    "ignore:::pydub.utils:"
+  ];
 
   nativeBuildInputs = [ installShellFiles ];
 
   postInstall =
     # https://github.com/NixOS/nixpkgs/issues/308283
-    lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-      installShellCompletion --cmd git-sim \
-        --bash <($out/bin/git-sim --show-completion bash) \
-        --fish <($out/bin/git-sim --show-completion fish) \
-        --zsh <($out/bin/git-sim --show-completion zsh)
-    ''
-    + "ln -s ${git-dummy}/bin/git-dummy $out/bin/";
-
-  preCheck = ''
-    PATH=$PATH:$out/bin
-  '';
+    lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform)
+      # Otherwise, typer ignores the requested shell and instead detects it by walking the
+      # process tree, which yields bash on linux and fails outright on darwin:
+      # https://github.com/fastapi/typer/blob/0.25.1/typer/completion.py#L42-L59
+      ''
+        export _TYPER_COMPLETE_TEST_DISABLE_SHELL_DETECTION=1
+        installShellCompletion --cmd git-sim \
+          --bash <($out/bin/git-sim --show-completion bash) \
+          --fish <($out/bin/git-sim --show-completion fish) \
+          --zsh <($out/bin/git-sim --show-completion zsh)
+      ''
+    + ''
+      ln -s ${lib.getExe python3Packages.git-dummy} $out/bin/
+    '';
 
   nativeCheckInputs = [
+    addBinToPathHook
+  ]
+  ++ (with python3Packages; [
     pytestCheckHook
     git-dummy
-  ];
+  ]);
 
   doCheck = false;
 
   meta = {
     description = "Visually simulate Git operations in your own repos with a single terminal command";
     homepage = "https://initialcommit.com/tools/git-sim";
+    changelog = "https://github.com/initialcommit-com/git-sim/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.gpl2Only;
     maintainers = with lib.maintainers; [ mathiassven ];
   };
-}
+})
diff --git a/pkgs/by-name/gi/git-workspace/package.nix b/pkgs/by-name/gi/git-workspace/package.nix
index 3c7615de3170..2b3cada5341f 100644
--- a/pkgs/by-name/gi/git-workspace/package.nix
+++ b/pkgs/by-name/gi/git-workspace/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "git-workspace";
-  version = "1.10.1";
+  version = "1.11.0";
 
   src = fetchFromGitHub {
     owner = "orf";
     repo = "git-workspace";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Twm/z627vXUVqJgAQ4pWjVGTgaSDhncHZVsImilWg4Q=";
+    hash = "sha256-+cTN1TwM/mo1bH3IOeS3f451DfhuXLkNTcaKgzAqmFI=";
   };
 
-  cargoHash = "sha256-ws+dqXGS0lsf+5dvUj/N16eEIH1FhgMhsnvYheYGm7s=";
+  cargoHash = "sha256-NEL9gsvsIBqz2/4GmTRgx7n0s986zVHOeTWQaQyXT4U=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/gn/gnome-boxes/package.nix b/pkgs/by-name/gn/gnome-boxes/package.nix
index 48df56993ca5..0cc0a8d4bf67 100644
--- a/pkgs/by-name/gn/gnome-boxes/package.nix
+++ b/pkgs/by-name/gn/gnome-boxes/package.nix
@@ -132,7 +132,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   meta = {
-    description = "Simple GNOME 3 application to access remote or virtual systems";
+    description = "Simple GNOME application to access virtual systems";
     mainProgram = "gnome-boxes";
     homepage = "https://apps.gnome.org/Boxes/";
     license = lib.licenses.lgpl2Plus;
diff --git a/pkgs/by-name/gn/gnome-robots/package.nix b/pkgs/by-name/gn/gnome-robots/package.nix
index 6e66718a9791..0f00003fedd7 100644
--- a/pkgs/by-name/gn/gnome-robots/package.nix
+++ b/pkgs/by-name/gn/gnome-robots/package.nix
@@ -32,8 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
-    name = "gnome-robots-${finalAttrs.version}";
+    inherit (finalAttrs) pname version src;
     hash = "sha256-T3o4zlRLQzrLexSDI9A98bubehYFwJY1zBVUUNmrc9o=";
   };
 
diff --git a/pkgs/by-name/go/go-ios/package.nix b/pkgs/by-name/go/go-ios/package.nix
index 15aee98d31b1..750f5ea5265c 100644
--- a/pkgs/by-name/go/go-ios/package.nix
+++ b/pkgs/by-name/go/go-ios/package.nix
@@ -11,17 +11,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "go-ios";
-  version = "1.2.0";
+  version = "1.3.2";
 
   src = fetchFromGitHub {
     owner = "danielpaulus";
     repo = "go-ios";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-5fMsHSwJUH/JBaZXyB11rHCNOqzHF3MYI9gg29hj0O4=";
+    sha256 = "sha256-3wVkJm1WDQKZvCCOlsTypOF0jcivmS7AHkOzvMQVBi8=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-Bl9nlRnclqVgFF6mS6DX6oS+1c26DoISqDBY2rMS2yw=";
+  vendorHash = "sha256-u5wuM4DR3zy6bawbflikjsW/8t4CG6776A/q0g4x8mQ=";
 
   excludedPackages = [
     "restapi"
diff --git a/pkgs/by-name/go/golds/package.nix b/pkgs/by-name/go/golds/package.nix
index 7893b9202809..03391b0cb42b 100644
--- a/pkgs/by-name/go/golds/package.nix
+++ b/pkgs/by-name/go/golds/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "golds";
-  version = "0.8.5";
+  version = "0.8.7";
 
   src = fetchFromGitHub {
     owner = "go101";
     repo = "golds";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WYjNvpNT5vuiHqo6TWE+uhptG4fke3eaKkJbeNIwwoU=";
+    hash = "sha256-plzfpH3+zcsiQlTHR1oTj3ImQrWlJmLI/CzCIu2dGqI=";
   };
 
   # nixpkgs is not using the go distpack archive and missing a VERSION file in the source
diff --git a/pkgs/by-name/go/goshs/package.nix b/pkgs/by-name/go/goshs/package.nix
index 75337e167359..1d62b8a352dc 100644
--- a/pkgs/by-name/go/goshs/package.nix
+++ b/pkgs/by-name/go/goshs/package.nix
@@ -52,7 +52,6 @@ buildGoModule (finalAttrs: {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       fab
-      matthiasbeyer
       seiarotg
     ];
     mainProgram = "goshs";
diff --git a/pkgs/by-name/go/gotmplfmt-hugo/package.nix b/pkgs/by-name/go/gotmplfmt-hugo/package.nix
new file mode 100644
index 000000000000..5d19e545ad32
--- /dev/null
+++ b/pkgs/by-name/go/gotmplfmt-hugo/package.nix
@@ -0,0 +1,60 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+
+  nix-update-script,
+  testers,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "gotmplfmt-hugo";
+  version = "0.4.1";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "gohugoio";
+    repo = "gotmplfmt";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-z+Qsg0QWWU4+QZrMg61W5bLRm8Ps5b6IsJdUNoYqJFA=";
+    # populate values that require us to use git. By doing this in postFetch we
+    # can delete .git afterwards and maintain better reproducibility of the src.
+    leaveDotGit = true;
+    postFetch = ''
+      cd "$out"
+      git rev-parse HEAD > $out/COMMIT
+      # 0000-00-00T00:00:00Z
+      date -u -d "@$(git log -1 --pretty=%ct)" "+%Y-%m-%dT%H:%M:%SZ" > $out/SOURCE_DATE_EPOCH
+      find "$out" -name .git -print0 | xargs -0 rm -rf
+    '';
+  };
+
+  vendorHash = "sha256-OEXvKQ/dBxhz6/pbQNDYIjBf3O0x36ZE3Se/FqEgYRg=";
+
+  ldflags = [
+    "-s"
+    "-X=main.tag=${finalAttrs.src.tag}"
+  ];
+
+  preBuild = ''
+    ldflags+=" -X main.commit=$(cat COMMIT)"
+    ldflags+=" -X main.date=$(cat SOURCE_DATE_EPOCH)"
+  '';
+
+  passthru.updateScript = nix-update-script { };
+  passthru.tests.version = testers.testVersion {
+    package = finalAttrs.finalPackage;
+    version = finalAttrs.src.tag;
+  };
+
+  meta = {
+    description = "Format Go templates";
+    homepage = "https://github.com/gohugoio/gotmplfmt";
+    changelog = "https://github.com/gohugoio/gotmplfmt/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [
+      jk
+    ];
+    mainProgram = "gotmplfmt";
+  };
+})
diff --git a/pkgs/by-name/gr/grafana-loki/package.nix b/pkgs/by-name/gr/grafana-loki/package.nix
index e4f85a26f108..9ac2dc1922c1 100644
--- a/pkgs/by-name/gr/grafana-loki/package.nix
+++ b/pkgs/by-name/gr/grafana-loki/package.nix
@@ -9,14 +9,14 @@
 }:
 
 buildGoModule (finalAttrs: {
-  version = "3.7.4";
+  version = "3.7.6";
   pname = "grafana-loki";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "loki";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-sTmez6HBu8rQigToUqVFthYIkQ7E+rFVCSH0e8GBQVw=";
+    hash = "sha256-Wf3VN8qdr//YfF0B0IfPlYkfDllGQO8iKIEwjU6uYQo=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/gr/grype/package.nix b/pkgs/by-name/gr/grype/package.nix
index 745771b55eee..144bcbf5beeb 100644
--- a/pkgs/by-name/gr/grype/package.nix
+++ b/pkgs/by-name/gr/grype/package.nix
@@ -12,7 +12,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "grype";
-  version = "0.116.1";
+  version = "0.117.0";
 
   # required for tests
   __darwinAllowLocalNetworking = true;
@@ -21,7 +21,7 @@ buildGoModule (finalAttrs: {
     owner = "anchore";
     repo = "grype";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-87cFTaBexxwYmAMYM3YOtxtDv5ru/RMwabWlb0J5kFQ=";
+    hash = "sha256-E0Mw7RoA3Q+D/zBF6yttgbVCRL/CIGzEZiinDQsqShM=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -36,7 +36,7 @@ buildGoModule (finalAttrs: {
 
   proxyVendor = true;
 
-  vendorHash = "sha256-c59YdxX8lYp2cJlIBtRYksqSPRfZL/ggt1Hg9TvayRg=";
+  vendorHash = "sha256-laj1lZdz20ad1dO39j7i0BecleGadlUVzhAnnQWd8D4=";
 
   patches = [
     # several test golden files have unstable paths based on the platform
diff --git a/pkgs/by-name/gx/gxmatcheq-lv2/package.nix b/pkgs/by-name/gx/gxmatcheq-lv2/package.nix
index a687a0e2c1bb..c81753a5df49 100644
--- a/pkgs/by-name/gx/gxmatcheq-lv2/package.nix
+++ b/pkgs/by-name/gx/gxmatcheq-lv2/package.nix
@@ -1,20 +1,15 @@
 {
   lib,
   stdenv,
-  gcc13Stdenv,
   fetchFromGitHub,
+  fetchpatch,
   libx11,
   xorgproto,
   cairo,
   lv2,
   pkg-config,
 }:
-let
-  # see: https://github.com/brummer10/GxMatchEQ.lv2/issues/8
-  # Use gcc13 on Linux, but default stdenv (clang) elsewhere
-  buildStdenv = if stdenv.hostPlatform.isLinux then gcc13Stdenv else stdenv;
-in
-buildStdenv.mkDerivation (finalAttrs: {
+stdenv.mkDerivation (finalAttrs: {
   pname = "GxMatchEQ.lv2";
   version = "0.1";
 
@@ -25,6 +20,22 @@ buildStdenv.mkDerivation (finalAttrs: {
     hash = "sha256-4jg6DYkNRuNuQpOnsZfwJAZljBmBRzS6NcJKjv+r7Ss=";
   };
 
+  patches = [
+    # _LV2UI_Descriptor was mistakenly used instead of LV2UI_Descriptor in one
+    # signature.
+    (fetchpatch {
+      name = "use-lv2ui_descriptor-name.patch";
+      url = "https://github.com/brummer10/GxMatchEQ.lv2/commit/4ca70be32220729a5253c0bb46f5aded5ba3d00a.patch";
+      hash = "sha256-EKlv6UptUpP+LOG7S30L21o0/upeDj6WB1PZ44XtNRU=";
+    })
+  ];
+
+  # without the Xresource.h header, compilation on gcc versions > 13 fails with
+  # gui/gx_matcheq_x11ui.c:360:27: error: implicit declaration of function 'XrmUniqueQuark' [-Wimplicit-function-declaration]
+  postPatch = ''
+    sed -e '1i #include <X11/Xresource.h>' -i gui/gx_matcheq_x11ui.c
+  '';
+
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     libx11
diff --git a/pkgs/by-name/ha/ha-mcp/package.nix b/pkgs/by-name/ha/ha-mcp/package.nix
index a8f23eb812a0..8a17ffb58426 100644
--- a/pkgs/by-name/ha/ha-mcp/package.nix
+++ b/pkgs/by-name/ha/ha-mcp/package.nix
@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "ha-mcp";
-  version = "7.8.0";
+  version = "8.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "homeassistant-ai";
     repo = "ha-mcp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+HhtHeSQlK1jd/4/x1d54Etvrs8e+pQkIGvJV39ZZBw=";
+    hash = "sha256-JjZyHfqSbo3T6uMd8JVvEDVpYIDpJQcd4fViNo5wrY8=";
   };
 
   build-system = with python3Packages; [
@@ -29,11 +29,12 @@ python3Packages.buildPythonApplication (finalAttrs: {
       cryptography
       fastmcp
       httpx
+      packaging
       pydantic
       pydantic-monty
       python-dotenv
       truststore
-      websockets
+      tzdata
     ]
     ++ httpx.optional-dependencies.socks;
 
diff --git a/pkgs/by-name/ha/handheld-daemon-ui/package.nix b/pkgs/by-name/ha/handheld-daemon-ui/package.nix
index 8219a4e1d25c..24247f3457f5 100644
--- a/pkgs/by-name/ha/handheld-daemon-ui/package.nix
+++ b/pkgs/by-name/ha/handheld-daemon-ui/package.nix
@@ -33,7 +33,7 @@ appimageTools.wrapType2 {
   meta = {
     description = "UI for the Handheld Daemon";
     homepage = "https://github.com/hhd-dev/hhd-ui";
-    license = lib.licenses.gpl3Only;
+    license = lib.licenses.lgpl21Plus;
     maintainers = with lib.maintainers; [ toast ];
     mainProgram = "hhd-ui";
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/by-name/hi/hister/package.nix b/pkgs/by-name/hi/hister/package.nix
new file mode 100644
index 000000000000..78d213c38f54
--- /dev/null
+++ b/pkgs/by-name/hi/hister/package.nix
@@ -0,0 +1,103 @@
+{
+  lib,
+  buildGoModule,
+  buildNpmPackage,
+  fetchFromGitHub,
+  nodejs_22,
+  sqlite,
+  yt-dlp-light,
+  makeBinaryWrapper,
+  nix-update-script,
+  pkg-config,
+  versionCheckHook,
+  nixosTests,
+}:
+buildGoModule (finalAttrs: {
+  pname = "hister";
+  version = "0.17.0";
+
+  src = fetchFromGitHub {
+    owner = "asciimoo";
+    repo = "hister";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-UIKQVs2hbzalDeRL1ILUgfMQnues5IFrzWn9Eg5sm30=";
+  };
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  vendorHash = "sha256-ozTULKnUrzBy+tK/eSq7exPVjXp43mSzg4EOWG+r1No=";
+  proxyVendor = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    makeBinaryWrapper
+  ];
+  buildInputs = [ sqlite ];
+
+  tags = [ "libsqlite3" ];
+
+  preBuild = ''
+    mkdir -p server/static/app
+    cp -r ${finalAttrs.passthru.frontend}/* server/static/app/
+  '';
+
+  ldflags = [
+    "-s"
+  ];
+
+  subPackages = [ "." ];
+
+  postInstall = ''
+    wrapProgram $out/bin/hister \
+      --prefix PATH : ${lib.makeBinPath [ yt-dlp-light ]}
+  '';
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  passthru = {
+    frontend = (buildNpmPackage.override { nodejs = nodejs_22; }) {
+      pname = "${finalAttrs.pname}-frontend";
+      inherit (finalAttrs) version src;
+
+      strictDeps = true;
+
+      npmWorkspace = "webui/app";
+      npmDepsFetcherVersion = 2;
+      npmDepsHash = "sha256-ueGtZYMrmQeYsJXmA5RRV5GHCEH5Ui+6PDiQ/Nd1quM=";
+
+      # vite 8's rolldown pipeline does a dns.lookup('localhost') during `vite build`
+      # which fails in darwin's relaxed sandbox without loopback access
+      __darwinAllowLocalNetworking = true;
+
+      preBuild = ''
+        patchShebangs webui
+      '';
+
+      installPhase = ''
+        runHook preInstall
+        mkdir -p "$out"
+        cp -r webui/app/build/* "$out/"
+        runHook postInstall
+      '';
+    };
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--subpackage"
+        "frontend"
+      ];
+    };
+    tests = { inherit (nixosTests) hister; };
+  };
+
+  meta = {
+    changelog = "https://github.com/asciimoo/hister/releases/tag/v${finalAttrs.version}";
+    description = "Web history on steroids - blazing fast, content-based search for visited websites";
+    homepage = "https://github.com/asciimoo/hister";
+    license = lib.licenses.agpl3Plus;
+    mainProgram = "hister";
+    maintainers = with lib.maintainers; [ _4evy ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/ho/houdini/runtime.nix b/pkgs/by-name/ho/houdini/runtime.nix
index 21925c008649..32cc25918334 100644
--- a/pkgs/by-name/ho/houdini/runtime.nix
+++ b/pkgs/by-name/ho/houdini/runtime.nix
@@ -1,12 +1,12 @@
 { requireFile, callPackage }:
 
 callPackage ./runtime-build.nix rec {
-  version = "21.0.559";
+  version = "22.0.368";
   eulaDate = "2021-10-13";
   src = requireFile {
-    name = "houdini-${version}-linux_x86_64_gcc11.2.tar.gz";
-    hash = "sha256-bZmoH1NKQhhMAhIl3pTL7irUZ7HrOhS8R7GApLD5514=";
+    name = "houdini-${version}-linux_x86_64_gcc14.2.tar.gz";
+    hash = "sha256-h2UzXwkKgyl2i0FbZLyfuAoNmWOxP2NFWtBC4y01NhY=";
     url = "https://www.sidefx.com/download/daily-builds/?show_launcher=false&production=true&linux=true";
   };
-  outputHash = "sha256-/7ctlMUoyJdPdBQV7rRO9pWcg9bXcnMJsB9TN/Jo8QQ=";
+  outputHash = "sha256-sJwKbkmHykgyP6yio5W8FVxLWm2S0PEQz5RVRF3cbfI=";
 }
diff --git a/pkgs/by-name/ht/hterm/package.nix b/pkgs/by-name/ht/hterm/package.nix
deleted file mode 100644
index 38ca376ee5a5..000000000000
--- a/pkgs/by-name/ht/hterm/package.nix
+++ /dev/null
@@ -1,72 +0,0 @@
-{
-  stdenv,
-  lib,
-  fetchurl,
-  cairo,
-  pango,
-  libpng,
-  expat,
-  fontconfig,
-  gtk2,
-  libsm,
-  autoPatchelfHook,
-}:
-stdenv.mkDerivation (finalAttrs: {
-  pname = "hterm";
-  version = "0.8.9";
-
-  src =
-    let
-      versionWithoutDots = builtins.replaceStrings [ "." ] [ "" ] finalAttrs.version;
-    in
-    if stdenv.targetPlatform.is64bit then
-      fetchurl {
-        url = "https://www.der-hammer.info/terminal/hterm${versionWithoutDots}-linux-64.tgz";
-        hash = "sha256-DY+X7FaU1UBbNf/Kgy4TzBZiocQ4/TpJW3KLW1iu0M0=";
-      }
-    else
-      fetchurl {
-        url = "https://www.der-hammer.info/terminal/hterm${versionWithoutDots}-linux-32.tgz";
-        hash = "sha256-7wJFCpeXNMX94tk0QVc0T22cbv3ODIswFge5Cs0JhI8=";
-      };
-  sourceRoot = ".";
-
-  nativeBuildInputs = [ autoPatchelfHook ];
-
-  buildInputs = [
-    cairo
-    pango
-    libpng
-    expat
-    fontconfig.lib
-    gtk2
-    libsm
-  ];
-
-  installPhase = ''
-    runHook preInstall
-    install -m755 -D hterm $out/bin/hterm
-    install -m644 -D desktop/hterm.png -t $out/share/icons/hicolor/32x32/apps
-    install -m644 -D desktop/hterm.desktop $out/share/applications/hterm.desktop
-    runHook postInstall
-  '';
-
-  passthru = {
-    updateScript = ./update.sh;
-  };
-
-  meta = {
-    homepage = "https://www.der-hammer.info/pages/terminal.html";
-    changelog = "https://www.der-hammer.info/terminal/CHANGELOG.txt";
-    description = "Terminal program for serial communication";
-    # See https://www.der-hammer.info/terminal/LICENSE.txt
-    license = lib.licenses.unfree;
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    platforms = [
-      "x86_64-linux"
-      "i686-linux"
-    ];
-    maintainers = with lib.maintainers; [ zebreus ];
-    mainProgram = "hterm";
-  };
-})
diff --git a/pkgs/by-name/ht/hterm/update.sh b/pkgs/by-name/ht/hterm/update.sh
deleted file mode 100755
index 31966eec66d0..000000000000
--- a/pkgs/by-name/ht/hterm/update.sh
+++ /dev/null
@@ -1,18 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p common-updater-scripts curl
-# shellcheck shell=bash
-
-set -eu -o pipefail
-
-# The first valid version in the changelog should always be the latest version.
-version="$(curl https://www.der-hammer.info/terminal/CHANGELOG.txt | grep -m1 -Po '[0-9]+\.[0-9]+\.[0-9]+')"
-
-function update_hash_for_system() {
-    local system="$1"
-    # Reset the version number so the second architecture update doesn't get ignored.
-    update-source-version hterm 0 "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" --system="$system"
-    update-source-version hterm "$version" --system="$system"
-}
-
-update_hash_for_system x86_64-linux
-update_hash_for_system i686-linux
diff --git a/pkgs/by-name/hu/hunk/package.nix b/pkgs/by-name/hu/hunk/package.nix
index d3a07d79ee59..51ce4609c060 100644
--- a/pkgs/by-name/hu/hunk/package.nix
+++ b/pkgs/by-name/hu/hunk/package.nix
@@ -71,6 +71,16 @@ stdenv.mkDerivation {
     writableTmpDirAsHomeHook
   ];
 
+  # Teach `hunk skill path` to find the FHS layout under share/skills/$pname
+  # (https://github.com/NixOS/nixpkgs/issues/547426) instead of $out/skills.
+  postPatch = ''
+    substituteInPlace src/core/paths.ts \
+      --replace-fail \
+        'join("node_modules", "hunkdiff", HUNK_REVIEW_SKILL_RELATIVE_PATH),' \
+        'join("node_modules", "hunkdiff", HUNK_REVIEW_SKILL_RELATIVE_PATH),
+    join("share", "skills", "hunk", "hunk-review", "SKILL.md"),'
+  '';
+
   configurePhase = ''
     runHook preConfigure
 
@@ -100,9 +110,8 @@ stdenv.mkDerivation {
     runHook preInstall
 
     install -Dm755 hunk $out/bin/hunk
-    mkdir -p $out/share/hunk
-    cp -R skills $out/share/hunk/skills
-    ln -s share/hunk/skills $out/skills
+    mkdir -p $out/share/skills/hunk/hunk-review
+    cp skills/hunk-review/SKILL.md $out/share/skills/hunk/hunk-review/SKILL.md
 
     runHook postInstall
   '';
diff --git a/pkgs/by-name/hw/hwinfo/package.nix b/pkgs/by-name/hw/hwinfo/package.nix
index 9402505a2df6..09c4d8126b3c 100644
--- a/pkgs/by-name/hw/hwinfo/package.nix
+++ b/pkgs/by-name/hw/hwinfo/package.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hwinfo";
-  version = "25.4";
+  version = "25.5";
 
   src = fetchFromGitHub {
     owner = "opensuse";
     repo = "hwinfo";
     rev = finalAttrs.version;
-    hash = "sha256-XFb87IuFXYmFnlrjinz7Q+FhoRtpdToW9tos3pFzQYE=";
+    hash = "sha256-8IzggH+ANAJWP+fxKuE2pI4jc6H23t18W67aeqfzu7M=";
   };
 
   nativeBuildInputs = [
@@ -108,6 +108,7 @@ stdenv.mkDerivation (finalAttrs: {
   postInstall = ''
     moveToOutput bin "$bin"
     moveToOutput lib "$lib"
+    moveToOutput share/bash-completion "$bin"
   '';
 
   passthru = {
diff --git a/pkgs/by-name/hy/hydralauncher/package.nix b/pkgs/by-name/hy/hydralauncher/package.nix
index f534a4eb999a..06f8abdbe33d 100644
--- a/pkgs/by-name/hy/hydralauncher/package.nix
+++ b/pkgs/by-name/hy/hydralauncher/package.nix
@@ -6,10 +6,10 @@
 }:
 let
   pname = "hydralauncher";
-  version = "4.0.6";
+  version = "4.1.1";
   src = fetchurl {
     url = "https://github.com/hydralauncher/hydra/releases/download/v${version}/hydralauncher-${version}.AppImage";
-    hash = "sha256-LQ2z8yUUhKLs98YvHHLnhqqtcJFGIvEQ19kB5l0Ti9E=";
+    hash = "sha256-Xmo8pY5Aj45hOJW2OSvcpw6Jh6bc/znR0Q6jo6AWkVc=";
   };
 
   appimageContents = appimageTools.extract { inherit pname src version; };
diff --git a/pkgs/by-name/hy/hydrus/package.nix b/pkgs/by-name/hy/hydrus/package.nix
index c086f010657a..1961ddbcc75e 100644
--- a/pkgs/by-name/hy/hydrus/package.nix
+++ b/pkgs/by-name/hy/hydrus/package.nix
@@ -7,23 +7,20 @@
   copyDesktopItems,
   makeDesktopItem,
   writableTmpDirAsHomeHook,
-  swftools,
   ffmpeg,
   miniupnpc,
-
-  enableSwftools ? false,
 }:
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "hydrus";
-  version = "681";
+  version = "683";
   pyproject = false;
 
   src = fetchFromGitHub {
     owner = "hydrusnetwork";
     repo = "hydrus";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ZFlYHfWinYTf4aroxMUv5ArXzTwuqtHoqnafgfCJnUg=";
+    hash = "sha256-qvOEAgqP0Vy1OxKlFqvUoqzQTb50njkgO7UoAMAjFRM=";
   };
 
   nativeBuildInputs = [
@@ -35,6 +32,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
   buildInputs = [
     qt6.qtbase
     qt6.qtcharts
+    qt6.qtmultimedia
   ];
 
   desktopItems = [
@@ -53,37 +51,40 @@ python3Packages.buildPythonApplication (finalAttrs: {
     })
   ];
 
-  dependencies = with python3Packages; [
-    beautifulsoup4
-    cbor2
-    chardet
-    cloudscraper
-    dateparser
-    html5lib
-    lxml
-    lz4
-    numpy
-    opencv4
-    olefile
-    pillow
-    pillow-heif
-    psutil
-    psd-tools
-    pympler
-    pyopenssl
-    pyqt6
-    pyqt6-charts
-    pysocks
-    python-dateutil
-    python3Packages.mpv
-    pyyaml
-    qtpy
-    requests
-    show-in-file-manager
-    send2trash
-    service-identity
-    twisted
-  ];
+  dependencies =
+    with python3Packages;
+    [
+      beautifulsoup4
+      cbor2
+      chardet
+      dateparser
+      html5lib
+      lxml
+      lz4
+      mpv
+      numpy
+      opencv4
+      olefile
+      pillow
+      pillow-heif
+      pillow-jxl-plugin
+      psutil
+      pympler
+      pyopenssl
+      pyqt6
+      pyqt6-charts
+      pysocks
+      python-dateutil
+      pyyaml
+      qtpy
+      requests
+      show-in-file-manager
+      send2trash
+      service-identity
+      twisted
+    ]
+    ++ python3Packages.twisted.optional-dependencies.tls
+    ++ python3Packages.twisted.optional-dependencies.http2;
 
   nativeCheckInputs =
     (with python3Packages; [
@@ -121,15 +122,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     # desktop item
     mkdir -p "$out/share/icons/hicolor/scalable/apps"
     ln -s "$doc/share/doc/hydrus/assets/hydrus-white.svg" "$out/share/icons/hicolor/scalable/apps/hydrus-client.svg"
-  ''
-  + lib.optionalString enableSwftools ''
-    mkdir -p $out/${python3Packages.python.sitePackages}/bin
-    # swfrender seems to have to be called sfwrender_linux
-    # not sure if it can be loaded through PATH, but this is simpler
-    # $out/python3Packages.python.sitePackages/bin is correct NOT .../hydrus/bin
-    ln -s ${swftools}/bin/swfrender $out/${python3Packages.python.sitePackages}/bin/swfrender_linux
-  ''
-  + ''
+
     runHook postInstall
   '';
 
@@ -159,6 +152,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   meta = {
     description = "Danbooru-like image tagging and searching system for the desktop";
+    mainProgram = "hydrus-client";
     license = lib.licenses.wtfpl;
     homepage = "https://hydrusnetwork.github.io/hydrus/";
     changelog = "https://github.com/hydrusnetwork/hydrus/releases/tag/${finalAttrs.src.tag}";
diff --git a/pkgs/by-name/hy/hysteria/package.nix b/pkgs/by-name/hy/hysteria/package.nix
index 2e5fb4c8b31f..d10fce2ba061 100644
--- a/pkgs/by-name/hy/hysteria/package.nix
+++ b/pkgs/by-name/hy/hysteria/package.nix
@@ -6,16 +6,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "hysteria";
-  version = "2.11.0";
+  version = "2.12.1";
 
   src = fetchFromGitHub {
     owner = "apernet";
     repo = "hysteria";
     rev = "app/v${finalAttrs.version}";
-    hash = "sha256-9G+kbYLfrucZ9WhLRZmenZUGDXuMjtwR8a91deCAzGk=";
+    hash = "sha256-4GC0tnw9Gb1c2fl9YbJFQmEMoHVq40gTQCF1IMe0Md8=";
   };
 
-  vendorHash = "sha256-oQBdrolZLliesWQ9uqqKp5gXLU/Ze8+b2QTGOamTLjQ=";
+  vendorHash = "sha256-MoYGKPVR39JUG8CFr9aU3kKZdWfv4+rvt0QO0VdZTSI=";
   proxyVendor = true;
 
   ldflags =
diff --git a/pkgs/by-name/ia/iaito/package.nix b/pkgs/by-name/ia/iaito/package.nix
index d0da9ed60fa3..7afcfb5d4d0d 100644
--- a/pkgs/by-name/ia/iaito/package.nix
+++ b/pkgs/by-name/ia/iaito/package.nix
@@ -14,14 +14,14 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "iaito";
-  version = "6.1.8";
+  version = "6.2.0";
 
   srcs = [
     (fetchFromGitHub {
       owner = "radareorg";
       repo = "iaito";
       tag = finalAttrs.version;
-      hash = "sha256-aIJSfr5ZH1Naky66x85C5Y3Ix7sDzoYK84l+oA7Wggs=";
+      hash = "sha256-TvYAwBCmYehOLcitlk8/SCqdq5deVQGppxBYWdb3knQ=";
       name = "main";
     })
     (fetchFromGitHub {
diff --git a/pkgs/by-name/in/inngest/package.nix b/pkgs/by-name/in/inngest/package.nix
index 8a13fb82b684..39ba533076d2 100644
--- a/pkgs/by-name/in/inngest/package.nix
+++ b/pkgs/by-name/in/inngest/package.nix
@@ -10,14 +10,14 @@
   testers,
 }:
 let
-  version = "1.37.0";
+  version = "1.41.1";
   websiteRev = "159c0ac611e85ec85ffe0a8c8bf2c4a0330bdb38";
 
   src = fetchFromGitHub {
     owner = "inngest";
     repo = "inngest";
     tag = "v${version}";
-    hash = "sha256-m9VFmplaMFD3+Z0qioehsuKeJaS6fUSb++liUabDEuM=";
+    hash = "sha256-vP8If2O3JIF6DDGLar8ovKeFAS1wp0ql1nt5m7rKIuA=";
   };
 
   website = fetchFromGitHub {
@@ -42,7 +42,7 @@ let
       pnpm = pnpm_10;
       sourceRoot = "${finalAttrs.src.name}/ui";
       fetcherVersion = 4;
-      hash = "sha256-bt/7cpN9EXf2CZFRAaybr7pgJyInV0fdUy7Rv/UcT/I=";
+      hash = "sha256-9Aud9JUj2C/Bow7lB+P/BgniQXJa2MVqI7TcPICgxrI=";
     };
     pnpmRoot = "ui";
 
diff --git a/pkgs/by-name/in/inspectrum/package.nix b/pkgs/by-name/in/inspectrum/package.nix
index c84fea8d95a1..79e1b5602fe3 100644
--- a/pkgs/by-name/in/inspectrum/package.nix
+++ b/pkgs/by-name/in/inspectrum/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   gnuradioMinimal,
   thrift,
   fetchFromGitHub,
@@ -42,12 +43,16 @@ gnuradioMinimal.pkgs.mkDerivation rec {
     gnuradioMinimal.unwrapped.python.pkgs.thrift
   ];
 
+  postFixup = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    ${stdenv.cc.targetPrefix}install_name_tool -change libliquid.dylib ${lib.getLib liquid-dsp}/lib/libliquid.dylib $out/bin/.inspectrum-wrapped
+  '';
+
   meta = {
     description = "Tool for analysing captured signals from sdr receivers";
     mainProgram = "inspectrum";
     homepage = "https://github.com/miek/inspectrum";
     maintainers = with lib.maintainers; [ mog ];
-    platforms = lib.platforms.linux;
+    platforms = with lib.platforms; linux ++ darwin;
     license = lib.licenses.gpl3Plus;
   };
 }
diff --git a/pkgs/by-name/in/insulator2/package.nix b/pkgs/by-name/in/insulator2/package.nix
index ea9675b86095..5f42e73a124b 100644
--- a/pkgs/by-name/in/insulator2/package.nix
+++ b/pkgs/by-name/in/insulator2/package.nix
@@ -47,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
+    inherit (finalAttrs) pname version src;
     sourceRoot = finalAttrs.src.name + "/backend";
     hash = "sha256-u5WFV7luvqSQQtEJFlN//GH6iNcQpH/o01ME1dPtOB4=";
   };
diff --git a/pkgs/by-name/ir/ironwail/package.nix b/pkgs/by-name/ir/ironwail/package.nix
index 51821de58b41..7e20aec5c355 100644
--- a/pkgs/by-name/ir/ironwail/package.nix
+++ b/pkgs/by-name/ir/ironwail/package.nix
@@ -23,11 +23,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ironwail";
-  version = "0.8.1";
+  version = "0.8.2";
 
   src = fetchurl {
     url = "https://github.com/andrei-drexler/ironwail/archive/refs/tags/v${finalAttrs.version}.tar.gz";
-    hash = "sha256-TlEMuwmpQIoIyjyQo9T/h3T7rPHX+K8TqHKSt+UtMBg=";
+    hash = "sha256-rt+u0oY2W7UzsIUs5Tvd3IcBXsM2Z0UEfXNVLejc06U=";
   };
 
   sourceRoot = "${finalAttrs.pname}-${finalAttrs.version}/Quake";
diff --git a/pkgs/by-name/je/jetbrains-toolbox/package.nix b/pkgs/by-name/je/jetbrains-toolbox/package.nix
index 399fb1df0b43..7576cf210219 100644
--- a/pkgs/by-name/je/jetbrains-toolbox/package.nix
+++ b/pkgs/by-name/je/jetbrains-toolbox/package.nix
@@ -10,7 +10,7 @@
 
 let
   pname = "jetbrains-toolbox";
-  version = "3.6.3.86383";
+  version = "3.6.4.86641";
 
   updateScript = ./update.sh;
 
@@ -57,9 +57,9 @@ let
         aarch64 = "-arm64";
       };
       hash = selectSystem {
-        x86_64-linux = "sha256-RhBZK/86wMqgtFAolk5xubGAaqCewyEUlWjB+HAGEDg=";
-        aarch64-linux = "sha256-qhheArqQpElRoZGHmrl2W4+llDWEq+m4PXfG2XM6uYQ=";
-        aarch64-darwin = "sha256-mvfy8B2sOumvWiUmG8BtHvyZdcBs90BG8bEn21sPs5E=";
+        x86_64-linux = "sha256-UqEhoaH8vB6tcy+GcxUy+VupJPbv//q3wEQ8CwMUdic=";
+        aarch64-linux = "sha256-UQwFDdZNPxjtG/kK5imupGZ0xE4oyThCTLFxb0i2fTw=";
+        aarch64-darwin = "sha256-jPlYLiKabVew1kxd+TJ0W0WuT82R0p+yIAPxuIVEYRA=";
       };
     in
     selectKernel {
diff --git a/pkgs/by-name/je/jetring/package.nix b/pkgs/by-name/je/jetring/package.nix
new file mode 100644
index 000000000000..ebc77c893c40
--- /dev/null
+++ b/pkgs/by-name/je/jetring/package.nix
@@ -0,0 +1,59 @@
+{
+  lib,
+  fetchFromGitLab,
+  stdenvNoCC,
+  nix-update-script,
+  installShellFiles,
+  makeWrapper,
+  perl,
+  gnupg,
+}:
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "jetring";
+  version = "0.32";
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitLab {
+    domain = "salsa.debian.org";
+    owner = "debian";
+    repo = "jetring";
+    tag = "debian/${finalAttrs.version}";
+    hash = "sha256-oaZXy/BO0mDYvDPW0OP38fXZTZSrcUCW7uYuwCMBPDc=";
+  };
+
+  nativeBuildInputs = [
+    installShellFiles
+    makeWrapper
+  ];
+
+  buildInputs = [
+    perl
+  ];
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    installBin jetring-{accept,apply,build,diff,explode,gen,review,signindex,checksum}
+
+    for f in $out/bin/*; do
+      wrapProgram "$f" --prefix PATH : ${lib.makeBinPath [ gnupg ]}
+    done
+
+    installManPage *.{1,7}
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Maintenance of gpg keyrings using changesets";
+    homepage = "https://salsa.debian.org/debian/jetring";
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.all;
+    maintainers = [ lib.maintainers.skyesoss ];
+  };
+})
diff --git a/pkgs/servers/http/jetty/default.nix b/pkgs/by-name/je/jetty/default.nix
similarity index 89%
rename from pkgs/servers/http/jetty/default.nix
rename to pkgs/by-name/je/jetty/default.nix
index c9d6919aeb3f..48a787cf0c62 100644
--- a/pkgs/servers/http/jetty/default.nix
+++ b/pkgs/by-name/je/jetty/default.nix
@@ -6,7 +6,7 @@
 }:
 
 let
-  common =
+  generic =
     { version, hash }:
     stdenvNoCC.mkDerivation rec {
       pname = "jetty";
@@ -51,12 +51,7 @@ let
 
 in
 {
-  jetty_11 = common {
-    version = "11.0.26";
-    hash = "sha256-uJgh/+/uGjchTgtoF38f7jIvbdrwdToAsqqVOlYtMIM=";
-  };
-
-  jetty_12 = common {
+  jetty_12 = generic {
     version = "12.1.11";
     hash = "sha256-fkXPjyO6xFZ/r5RiSzrEPgrrSSXLklQJ52BAmQocvpw=";
   };
diff --git a/pkgs/by-name/je/jetty/package.nix b/pkgs/by-name/je/jetty/package.nix
new file mode 100644
index 000000000000..10d453b24373
--- /dev/null
+++ b/pkgs/by-name/je/jetty/package.nix
@@ -0,0 +1,5 @@
+{
+  jetty_12,
+}:
+
+jetty_12
diff --git a/pkgs/by-name/jp/jpmml-evaluator/package.nix b/pkgs/by-name/jp/jpmml-evaluator/package.nix
index 3ca614f03a80..9436fcc34834 100644
--- a/pkgs/by-name/jp/jpmml-evaluator/package.nix
+++ b/pkgs/by-name/jp/jpmml-evaluator/package.nix
@@ -7,23 +7,37 @@
   nix-update-script,
 }:
 
-let
+maven.buildMavenPackage (finalAttrs: {
   pname = "jpmml-evaluator";
   version = "1.7.7";
-in
-maven.buildMavenPackage {
-  inherit pname version;
+
   strictDeps = true;
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "jpmml";
     repo = "jpmml-evaluator";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-DtI/cHmiKVH0IAp3mWJr2sDDjAzM5d9/cBx4KJm74WM=";
   };
 
-  mvnHash = "sha256-PBkRDMPF/btYROGs4bl71wl2em05N6T2Klf1qFZLHDI=";
+  # Upstream's pom.xml declares commons-math3 and guava as open Maven version
+  # ranges ("[3.1, 3.6.1]", "[19.0, 33.5.0-jre]"), which forces Maven to
+  # query Central's maven-metadata.xml at resolve time to pick the highest
+  # matching version — a live network lookup that produces different results
+  # across machines/times, causing mvnHash drift. Pin them to the exact
+  # upper-bound versions the ranges resolve to today.
+  postPatch = ''
+    substituteInPlace pom.xml \
+      --replace-fail \
+        '<commons-math3.version>[3.1, 3.6.1]</commons-math3.version>' \
+        '<commons-math3.version>3.6.1</commons-math3.version>' \
+      --replace-fail \
+        '<guava.version>[19.0, 33.5.0-jre]</guava.version>' \
+        '<guava.version>33.5.0-jre</guava.version>'
+  '';
+
+  mvnHash = "sha256-xnFwQGjLEX59zeYKX+R7+F9hRRmRXtkP6Xw2hRi6Jbc=";
 
   nativeBuildInputs = [
     makeBinaryWrapper
@@ -35,7 +49,7 @@ maven.buildMavenPackage {
     mkdir -p $out/share/java $out/bin
     cp pmml-evaluator-example/target/pmml-evaluator-example-executable-*.jar $out/share/java/jpmml-evaluator.jar
 
-    makeBinaryWrapper ${jre_headless}/bin/java $out/bin/jpmml-evaluator \
+    makeBinaryWrapper ${lib.getExe jre_headless} $out/bin/jpmml-evaluator \
       --add-flags "-jar $out/share/java/jpmml-evaluator.jar"
 
     runHook postInstall
@@ -43,14 +57,14 @@ maven.buildMavenPackage {
 
   passthru.updateScript = nix-update-script { };
 
-  meta = {
+  meta = with lib; {
     description = "Java Evaluator API for PMML";
     homepage = "https://github.com/jpmml/jpmml-evaluator";
-    changelog = "https://github.com/jpmml/jpmml-evaluator/releases/tag/${version}";
-    license = lib.licenses.agpl3Only;
-    maintainers = [ lib.maintainers.b-rodrigues ];
+    changelog = "https://github.com/jpmml/jpmml-evaluator/releases/tag/${finalAttrs.version}";
+    license = licenses.agpl3Only;
+    maintainers = [ maintainers.b-rodrigues ];
     mainProgram = "jpmml-evaluator";
-    platforms = lib.platforms.all;
-    sourceProvenance = with lib.sourceTypes; [ fromSource ];
+    platforms = platforms.all;
+    sourceProvenance = with sourceTypes; [ fromSource ];
   };
-}
+})
diff --git a/pkgs/by-name/ka/kana/package.nix b/pkgs/by-name/ka/kana/package.nix
index b3287aea80bb..781bc2446070 100644
--- a/pkgs/by-name/ka/kana/package.nix
+++ b/pkgs/by-name/ka/kana/package.nix
@@ -27,8 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
-    name = "kana-${finalAttrs.version}";
+    inherit (finalAttrs) pname version src;
     hash = "sha256-3ODkAstBZQE3eqGmRUdm3xyCoBXV41hK4ndxeDK8+Yc=";
   };
 
diff --git a/pkgs/by-name/ke/keepassxc-go/package.nix b/pkgs/by-name/ke/keepassxc-go/package.nix
index e39c4d894dd9..11356e8dcbfa 100644
--- a/pkgs/by-name/ke/keepassxc-go/package.nix
+++ b/pkgs/by-name/ke/keepassxc-go/package.nix
@@ -8,18 +8,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "keepassxc-go";
-  version = "1.6.0";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "MarkusFreitag";
     repo = "keepassxc-go";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Z4SbPxhs+umsUlby7idxofCjP+uLPvp/2oUCpnAS2/A=";
+    hash = "sha256-0VQw12o4XTzKOz+45sHIKSsIjBxDcdxtgYUItFznsO4=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
 
-  vendorHash = "sha256-+cgf2FxpbLu+Yuhk6T0ZBnDH7We2DVu65xFaruk9I0E=";
+  vendorHash = "sha256-p7Lj2x0+F3kmAMi+2gtBYkg1w8jmgWm3kgYAoIagERs=";
 
   checkFlags = [
     # Test tries to monkey-patch the stdlib, fails with permission denied error.
diff --git a/pkgs/by-name/ke/keepmenu/package.nix b/pkgs/by-name/ke/keepmenu/package.nix
index 76645611964f..9468e009466e 100644
--- a/pkgs/by-name/ke/keepmenu/package.nix
+++ b/pkgs/by-name/ke/keepmenu/package.nix
@@ -10,14 +10,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "keepmenu";
-  version = "1.4.2";
+  version = "1.5.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "firecat53";
     repo = "keepmenu";
     rev = finalAttrs.version;
-    hash = "sha256-Kzt2RqyYvOWnbkflwTHzlnpUaruVQvdGys57DDpH9o8=";
+    hash = "sha256-MUtwQ9V5PcczR2mISMs8EcFGkDAPmuYSvNW+COC4Bhw=";
   };
 
   nativeBuildInputs = with python3Packages; [
diff --git a/pkgs/by-name/ke/key-rack/package.nix b/pkgs/by-name/ke/key-rack/package.nix
index 2f5b9bc356c6..1561b01b5e82 100644
--- a/pkgs/by-name/ke/key-rack/package.nix
+++ b/pkgs/by-name/ke/key-rack/package.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
+    inherit (finalAttrs) pname version src;
     hash = "sha256-iV9ILi3/Uqi8lDHh1Uf2caz6Kc129CDThnqTN9VfUHc=";
   };
 
diff --git a/pkgs/by-name/ki/kime/package.nix b/pkgs/by-name/ki/kime/package.nix
index 2ced131f418d..677f4b5b2100 100644
--- a/pkgs/by-name/ki/kime/package.nix
+++ b/pkgs/by-name/ki/kime/package.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
+    inherit (finalAttrs) pname version src;
     hash = "sha256-U3SOHZvgyPwv98wY41dnwSCUg+DTkb/LY6woffrAli8=";
   };
 
diff --git a/pkgs/by-name/ki/kitty-bin/package.nix b/pkgs/by-name/ki/kitty-bin/package.nix
index f197b6819f5f..66438722447a 100644
--- a/pkgs/by-name/ki/kitty-bin/package.nix
+++ b/pkgs/by-name/ki/kitty-bin/package.nix
@@ -8,14 +8,14 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "kitty-bin";
-  version = "0.47.4";
+  version = "0.48.2";
 
   __structuredAttrs = true;
   strictDeps = true;
 
   src = fetchurl {
     url = "https://github.com/kovidgoyal/kitty/releases/download/v${finalAttrs.version}/kitty-${finalAttrs.version}.dmg";
-    hash = "sha256-tTubGKJ9U61Eol3Wd2/ejEdIe04QOsUNaCrx7o57d+0=";
+    hash = "sha256-+AT1juS2nHb4TrMoHhQHSCaaY/P0qBYBWo3sKgbSsZU=";
   };
 
   # undmg can't read the APFS dmg; -snld keeps the .app's symlinks intact.
diff --git a/pkgs/by-name/kl/klayout/package.nix b/pkgs/by-name/kl/klayout/package.nix
index 7e6ff18cc50b..9629f886cbd4 100644
--- a/pkgs/by-name/kl/klayout/package.nix
+++ b/pkgs/by-name/kl/klayout/package.nix
@@ -19,15 +19,16 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "klayout";
-  version = "0.30.8";
+  version = "0.30.10";
 
   src = fetchFromGitHub {
     owner = "KLayout";
     repo = "klayout";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-RjMH6hrc0jyCLgG1D6cztBp5Fb3W5HgTxVTfI2bxgCs=";
+    hash = "sha256-ruM9+aD0k5RRpHMAzNNGtU5Xb2rmzz6yIsxxyHVcwRs=";
   };
 
+  __structuredAttrs = true;
   strictDeps = true;
 
   postPatch = ''
@@ -128,6 +129,6 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://www.klayout.de/";
     changelog = "https://www.klayout.de/development.html#${finalAttrs.version}";
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.gonsolo ];
   };
 })
diff --git a/pkgs/by-name/kr/krunkit/package.nix b/pkgs/by-name/kr/krunkit/package.nix
index 8048432093ba..9fb76e9fdef8 100644
--- a/pkgs/by-name/kr/krunkit/package.nix
+++ b/pkgs/by-name/kr/krunkit/package.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
+    inherit (finalAttrs) pname version src;
     hash = "sha256-ptMqyCiIJsQfjFyislyc3pR0BGpwnu8Ba3OcQYLJPtM=";
   };
 
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
   dontStrip = true;
 
   passthru = {
-    tests.boot = lib.optional stdenv.isDarwin (
+    tests.boot = lib.optional stdenv.hostPlatform.isDarwin (
       callPackage ./boot-test.nix { krunkit = finalAttrs.finalPackage; }
     );
     updateScript = nix-update-script { };
diff --git a/pkgs/by-name/kr/krunvm/package.nix b/pkgs/by-name/kr/krunvm/package.nix
index 70b8dd4114f0..ccc5c7e136c3 100644
--- a/pkgs/by-name/kr/krunvm/package.nix
+++ b/pkgs/by-name/kr/krunvm/package.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
+    inherit (finalAttrs) pname version src;
     hash = "sha256-MRcQ0Vnd3PJqE2q981JpXPjwMUKT4t+RcOvzWptK7PQ=";
   };
 
diff --git a/pkgs/by-name/ku/kubectl-df-pv/package.nix b/pkgs/by-name/ku/kubectl-df-pv/package.nix
index 5753e802e22f..9fa5a3e3736b 100644
--- a/pkgs/by-name/ku/kubectl-df-pv/package.nix
+++ b/pkgs/by-name/ku/kubectl-df-pv/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "kubectl-df-pv";
-  version = "0.4.1";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "yashbhutwala";
     repo = "kubectl-df-pv";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-dGWGPamVD/26iEgKQcWGKpFIMMlDivFpD/XzmjCr8pQ=";
+    hash = "sha256-avHWyrTQpk4683JoU90i2H5pnzkZ5IoJ6r6TtXUhxvI=";
   };
 
-  vendorHash = "sha256-J15tCwYiVSPa2hSB3DMFtVW9Uer7pFMCD1OpCobnYMc=";
+  vendorHash = "sha256-Xz8ePhvo0yikpIf9b/7DjZHYWynwNFoL0juohyflZEg=";
 
   meta = {
     description = "df-like utility for persistent volumes on Kubernetes";
diff --git a/pkgs/by-name/kv/kvrocks/package.nix b/pkgs/by-name/kv/kvrocks/package.nix
index f11e69b5fb21..70740f1b2ec7 100644
--- a/pkgs/by-name/kv/kvrocks/package.nix
+++ b/pkgs/by-name/kv/kvrocks/package.nix
@@ -4,6 +4,7 @@
   stdenv,
   fetchFromGitHub,
   fetchpatch,
+  nixosTests,
 
   # keep-sorted start
   cmake,
@@ -343,6 +344,7 @@ stdenv.mkDerivation (finalAttrs: {
   passthru = {
     hook = callPackage ./hook.nix { kvrocks = finalAttrs.finalPackage; };
     tests = {
+      inherit (nixosTests) kvrocks;
       hook = callPackage ./hook-test.nix { kvrocks = finalAttrs.finalPackage; };
     };
   };
diff --git a/pkgs/by-name/la/ladybird/package.nix b/pkgs/by-name/la/ladybird/package.nix
index fe41a6487a06..d13e24184894 100644
--- a/pkgs/by-name/la/ladybird/package.nix
+++ b/pkgs/by-name/la/ladybird/package.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
+    inherit (finalAttrs) pname version src;
     hash = "sha256-n0ACVH8NXwe7SIaGFoJ20WIGGR3XjcuLTwPSKGJpT5s=";
   };
 
diff --git a/pkgs/by-name/la/lasuite-meet/frontend.nix b/pkgs/by-name/la/lasuite-meet/frontend.nix
index 56871f8a9134..80a000547394 100644
--- a/pkgs/by-name/la/lasuite-meet/frontend.nix
+++ b/pkgs/by-name/la/lasuite-meet/frontend.nix
@@ -17,7 +17,7 @@ buildNpmPackage (finalAttrs: {
       src
       sourceRoot
       ;
-    hash = "sha256-PArNKjdLqKJSEEKe94mguzKiNSwpYk56inenU3GL1mI=";
+    hash = "sha256-ZvdfLM0GlIZPaKbpDK9ymSgARVMsJE+cop8lKq3R7fE=";
   };
   npmBuildScript = "build";
 
diff --git a/pkgs/by-name/la/lasuite-meet/mail.nix b/pkgs/by-name/la/lasuite-meet/mail.nix
index d1e8e4634d60..dc03dc73bbf5 100644
--- a/pkgs/by-name/la/lasuite-meet/mail.nix
+++ b/pkgs/by-name/la/lasuite-meet/mail.nix
@@ -22,7 +22,7 @@ buildNpmPackage (finalAttrs: {
     pname = "${finalAttrs.pname}-npm-deps";
     inherit version src;
     inherit (finalAttrs) sourceRoot;
-    hash = "sha256-rqtLjMp0nCfo1wDAeB5WxVtmL/TR3Ky3qaMaBohnH1M=";
+    hash = "sha256-Ojk0giCc7tTFAGOIisirMywfe5j7JCKoTnWGk/hR+U8=";
   };
   npmBuildScript = "build";
 
diff --git a/pkgs/by-name/la/lasuite-meet/package.nix b/pkgs/by-name/la/lasuite-meet/package.nix
index 188830cf085b..f27c946dd496 100644
--- a/pkgs/by-name/la/lasuite-meet/package.nix
+++ b/pkgs/by-name/la/lasuite-meet/package.nix
@@ -6,13 +6,13 @@
   python3,
 }:
 let
-  version = "1.25.2";
+  version = "1.26.0";
 
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "meet";
     tag = "v${version}";
-    hash = "sha256-gtChKd6sr2nHEmi0Z/nbuCCNsOD8iVIAFjqonZFgQ/Y=";
+    hash = "sha256-WiyVSqkyKDXYYPvzcA/fHcxQJrUThNGfNu+z/KcHK3g=";
   };
 
   meta = {
diff --git a/pkgs/by-name/la/lazygit/package.nix b/pkgs/by-name/la/lazygit/package.nix
index 992226a265ab..37e92d69d113 100644
--- a/pkgs/by-name/la/lazygit/package.nix
+++ b/pkgs/by-name/la/lazygit/package.nix
@@ -8,13 +8,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "lazygit";
-  version = "0.64.0";
+  version = "0.64.1";
 
   src = fetchFromGitHub {
     owner = "jesseduffield";
     repo = "lazygit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-iN1QEZBS4TxfBMe3+NoYx33wIrgLUSG7I8rNBSTinfc=";
+    hash = "sha256-UYyIrSHk+efKvHvxQs7FsOGA7e0uM9mg+1O1WRJIeEU=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/li/lib25519/environment-variable-tools.patch b/pkgs/by-name/li/lib25519/environment-variable-tools.patch
index 121055201b01..19c7a8685473 100644
--- a/pkgs/by-name/li/lib25519/environment-variable-tools.patch
+++ b/pkgs/by-name/li/lib25519/environment-variable-tools.patch
@@ -1,8 +1,8 @@
 diff --git a/configure b/configure
-index 04042b2..30d1ea9 100755
+index 86b7e88..33c126f 100755
 --- a/configure
 +++ b/configure
-@@ -210,6 +210,17 @@ for arch in sorted(os.listdir('compilers')):
+@@ -255,6 +255,17 @@ for arch in sorted(os.listdir('compilers')):
      with open('compilers/%s' % arch) as f:
        for c in f.readlines():
          c = c.strip()
@@ -20,19 +20,32 @@ index 04042b2..30d1ea9 100755
          cv = compilerversion(c)
          if cv == None:
            log('skipping %s compiler %s' % (arch,c))
+diff --git a/scripts-build/checkinsns b/scripts-build/checkinsns
+index 039a0c5..4e64c96 100755
+--- a/scripts-build/checkinsns
++++ b/scripts-build/checkinsns
+@@ -5,7 +5,7 @@ import sys
+ import subprocess
+ import traceback
+ 
+-objdump = os.getenv('CROSS','')+'objdump'
++objdump = os.getenv('OBJDUMP', os.getenv('CROSS','')+'objdump')
+ 
+ host = sys.argv[1]
+ 
 diff --git a/scripts-build/checknamespace b/scripts-build/checknamespace
-index ae11bed..bd9cb85 100755
+index 2a599e4..d0ae563 100755
 --- a/scripts-build/checknamespace
 +++ b/scripts-build/checknamespace
-@@ -36,7 +36,7 @@ def doit(d):
-   obj2U = {}
+@@ -4,7 +4,7 @@ import os
+ import sys
+ import subprocess
+ 
+-nm = os.getenv('CROSS','')+'nm'
++nm = os.getenv('NM', os.getenv('CROSS','')+'nm')
+ 
+ topnamespace = sys.argv[1]
  
-   try:
--    p = subprocess.Popen(['nm','-ApP']+objs,stdout=subprocess.PIPE,stderr=subprocess.STDOUT,universal_newlines=True)
-+    p = subprocess.Popen([os.getenv('NM', 'nm'),'-ApP']+objs,stdout=subprocess.PIPE,stderr=subprocess.STDOUT,universal_newlines=True)
-     out,err = p.communicate()
-   except Exception as e:
-     warn('nm failure: %s' % e)
 diff --git a/scripts-build/staticlib b/scripts-build/staticlib
 index 7683233..0445bc3 100755
 --- a/scripts-build/staticlib
diff --git a/pkgs/by-name/li/lib25519/package.nix b/pkgs/by-name/li/lib25519/package.nix
index e16d29a4b204..00a45ad0f83d 100644
--- a/pkgs/by-name/li/lib25519/package.nix
+++ b/pkgs/by-name/li/lib25519/package.nix
@@ -5,16 +5,21 @@
   fetchzip,
   testers,
   valgrind,
+  valgrindSupport ?
+    lib.meta.availableOn stdenv.hostPlatform valgrind && !(valgrind.meta.broken or false),
   librandombytes,
   libcpucycles,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "lib25519";
-  version = "20241004";
+  version = "20260614";
+
+  strictDeps = true;
+  __structuredAttrs = true;
 
   src = fetchzip {
     url = "https://lib25519.cr.yp.to/lib25519-${finalAttrs.version}.tar.gz";
-    hash = "sha256-gKLMk+yZ/nDlwohZiCFurSZwHExX3Ge2W1O0JoGQf8M=";
+    hash = "sha256-k6hVfUckgrRGVmvbt5SW3Vg1woscGzPBpOYnfYx5t44=";
   };
 
   patches = [ ./environment-variable-tools.patch ];
@@ -22,6 +27,10 @@ stdenv.mkDerivation (finalAttrs: {
   postPatch = ''
     patchShebangs configure
     patchShebangs scripts-build
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    find . -name '*.S' -type f -exec \
+      sed -i '/^\.section\t\.note\.GNU-stack,"",@progbits/d' {} +
   '';
 
   # NOTE: lib25519 uses a custom Python `./configure`: it does not expect standard
@@ -29,23 +38,33 @@ stdenv.mkDerivation (finalAttrs: {
   # Pass the hostPlatform string
   configurePhase = ''
     runHook preConfigure
-    ./configure --host=${stdenv.buildPlatform.system} --prefix=$out
+    ./configure --host=${stdenv.buildPlatform.system} --prefix=$out ${
+      lib.optionalString (!valgrindSupport) "--no-valgrind"
+    }
     runHook postConfigure
   '';
 
   nativeBuildInputs = [
-    python3
+    (python3.withPackages (ps: [ ps.capstone ]))
+  ]
+  ++ lib.optionals valgrindSupport [
     valgrind
   ];
   buildInputs = [
     librandombytes
     libcpucycles
+  ]
+  ++ lib.optionals valgrindSupport [
+    valgrind
   ];
 
   preFixup = lib.optionalString stdenv.hostPlatform.isDarwin ''
     install_name_tool -id "$out/lib/lib25519.1.dylib" "$out/lib/lib25519.1.dylib"
     for f in $out/bin/*; do
-      install_name_tool -change "lib25519.1.dylib" "$out/lib/lib25519.1.dylib" "$f"
+      # Skip python script, fails on aarch64-darwin otherwise
+      if [[ "$f" != "$out/bin/lib25519-fulltest" ]]; then
+        install_name_tool -change "lib25519.1.dylib" "$out/lib/lib25519.1.dylib" "$f"
+      fi
     done
   '';
 
diff --git a/pkgs/by-name/li/libchewing/package.nix b/pkgs/by-name/li/libchewing/package.nix
index 7258de3b987a..4500c8a770cb 100644
--- a/pkgs/by-name/li/libchewing/package.nix
+++ b/pkgs/by-name/li/libchewing/package.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
+    inherit (finalAttrs) pname version src;
     hash = "sha256-WPB1IIwKTF9lnkdcgNXcOP6kWIwQcUguUf8Nh5vDA5E=";
   };
 
diff --git a/pkgs/by-name/li/libdeltachat/package.nix b/pkgs/by-name/li/libdeltachat/package.nix
index b4e117f1380f..2a87a6f0e27e 100644
--- a/pkgs/by-name/li/libdeltachat/package.nix
+++ b/pkgs/by-name/li/libdeltachat/package.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libdeltachat";
-  version = "2.57.0";
+  version = "2.58.0";
 
   src = fetchFromGitHub {
     owner = "chatmail";
     repo = "core";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-MZhb3w4khWjWGEA9XvXgHjYiY9hQ5jCBWRwu6yMuaho=";
+    hash = "sha256-2ztbUSaxeUHfeDX+nt1uJZ/71no1mxOQphKNYpHNOnY=";
   };
 
   patches = [
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
   cargoDeps = rustPlatform.fetchCargoVendor {
     pname = "chatmail-core";
     inherit (finalAttrs) version src;
-    hash = "sha256-gRtNhrKue2cMhq3J/jFQihJTpa6k1IJeIJ9C5hAbiOM=";
+    hash = "sha256-WZJSx+gswWBaQEXN2NVWLr3xy5uQMtomefEM71nDdlQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/libertinus/package.nix b/pkgs/by-name/li/libertinus/package.nix
index ea11f10d53c0..94d23a1e7d8d 100644
--- a/pkgs/by-name/li/libertinus/package.nix
+++ b/pkgs/by-name/li/libertinus/package.nix
@@ -6,12 +6,15 @@
   zstd,
 }:
 
-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "libertinus";
   version = "7.051";
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   src = fetchurl {
-    url = "https://github.com/alerque/libertinus/releases/download/v${version}/Libertinus-${version}.tar.zst";
+    url = "https://github.com/alerque/libertinus/releases/download/v${finalAttrs.version}/Libertinus-${finalAttrs.version}.tar.zst";
     hash = "sha256-JQZ3ySnTd1owkTZDWUN5ryZKwu8oAQNaody+MLm+I6Y=";
   };
 
@@ -38,4 +41,4 @@ stdenvNoCC.mkDerivation rec {
     maintainers = with lib.maintainers; [ siddharthist ];
     platforms = lib.platforms.all;
   };
-}
+})
diff --git a/pkgs/by-name/li/libfm/package.nix b/pkgs/by-name/li/libfm/package.nix
index 4ef3af6c21d4..6f4a69dcdc92 100644
--- a/pkgs/by-name/li/libfm/package.nix
+++ b/pkgs/by-name/li/libfm/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   autoreconfHook,
   gtk-doc,
   glib,
@@ -11,14 +10,11 @@
   pango,
   pkg-config,
   vala,
-  extraOnly ? false,
-  withGtk3 ? false,
-  gtk2,
   gtk3,
+  extraOnly ? false,
 }:
 
 let
-  gtk = if withGtk3 then gtk3 else gtk2;
   inherit (lib) optional optionalString;
 in
 stdenv.mkDerivation (finalAttrs: {
@@ -41,16 +37,16 @@ stdenv.mkDerivation (finalAttrs: {
   ];
   buildInputs = [
     glib
-    gtk
+    gtk3
     pango
   ]
   ++ optional (!extraOnly) menu-cache;
 
   configureFlags = [
     "--sysconfdir=/etc"
+    "--with-gtk=3"
   ]
-  ++ optional extraOnly "--with-extra-only"
-  ++ optional withGtk3 "--with-gtk=3";
+  ++ optional extraOnly "--with-extra-only";
 
   installFlags = [ "sysconfdir=${placeholder "out"}/etc" ];
 
diff --git a/pkgs/by-name/li/libfprint/package.nix b/pkgs/by-name/li/libfprint/package.nix
index edfc4aa8ea74..ea1a79b01ca2 100644
--- a/pkgs/by-name/li/libfprint/package.nix
+++ b/pkgs/by-name/li/libfprint/package.nix
@@ -22,7 +22,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libfprint";
-  version = "1.94.10";
+  version = "1.94.100";
   outputs = [
     "out"
     "devdoc"
@@ -33,38 +33,9 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "libfprint";
     repo = "libfprint";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-aNBUIKY3PP5A07UNg3N0qq+2cwb6Fk67oKQcXgr2G/4=";
+    hash = "sha256-JwD8U6CjVH+huvVFIxRWRrsWbLOEeqOd1lCMdWgPtrA=";
   };
 
-  patches = [
-    # New hardware support since 1.94.10, just new USB Product IDs
-    (fetchpatch {
-      name = "realtek-3274-9003.patch";
-      url = "https://gitlab.freedesktop.org/libfprint/libfprint/-/commit/a25f71cf97820c51edc4c32f84686fcdc608d9d1.patch";
-      sha256 = "sha256-T9rvT53Ij+5gtiVOp+xfzQwiVkyF0m6lZAUCXWmaugg=";
-    })
-    (fetchpatch {
-      name = "elan-0c58.patch";
-      url = "https://gitlab.freedesktop.org/libfprint/libfprint/-/commit/4610f2285e6373c2fe4ead0dff4ebf8dabe4e532.patch";
-      sha256 = "sha256-VR96V+7FvSa8sE6JpcCx/slZ0MaK9HLuNuAay2P9C6M=";
-    })
-    (fetchpatch {
-      name = "elan-04F3-0C9C.patch";
-      url = "https://gitlab.freedesktop.org/libfprint/libfprint/-/commit/2bdc2b7ca6d8bedc675054934fbc8f8b6a21deac.patch";
-      sha256 = "sha256-LFMip9Mq55uDRgHkW+XeI+j0mILOb7DIHscHjyKe4yE=";
-    })
-    (fetchpatch {
-      name = "focal-077a-079a.patch";
-      url = "https://gitlab.freedesktop.org/libfprint/libfprint/-/commit/2c7842c905147a2d127c1b168b2e9d432b8c91a4.patch";
-      sha256 = "sha256-PuISGITn0/6AWY0WVUfViZtdcQFh+0s+4OLIszqdLUs=";
-    })
-    (fetchpatch {
-      name = "focal-a97a.patch";
-      url = "https://gitlab.freedesktop.org/libfprint/libfprint/-/commit/0dc384b90ed8cd78b3e8d7c0d30a953bd088b98c.patch";
-      sha256 = "sha256-X/wl4MpxfQ7sLlFTkkiDQGyRFQ6lC9pdcy3XPrSeOZw=";
-    })
-  ];
-
   postPatch = ''
     patchShebangs \
       tests/test-runner.sh \
diff --git a/pkgs/by-name/li/libjxl/package.nix b/pkgs/by-name/li/libjxl/package.nix
index c9bd4d79d174..92806f98b041 100644
--- a/pkgs/by-name/li/libjxl/package.nix
+++ b/pkgs/by-name/li/libjxl/package.nix
@@ -173,7 +173,7 @@ stdenv.mkDerivation rec {
 
   # FIXME x86_64-darwin:
   # https://github.com/NixOS/nixpkgs/pull/204030#issuecomment-1352768690
-  doCheck = with stdenv; !(hostPlatform.isi686 || isDarwin && isx86_64);
+  doCheck = with stdenv.hostPlatform; !(isi686 || isDarwin && isx86_64);
 
   disabledTests = lib.optionals stdenv.hostPlatform.isBigEndian [
     # https://github.com/libjxl/libjxl/issues/3629
diff --git a/pkgs/by-name/li/libphidget22/package.nix b/pkgs/by-name/li/libphidget22/package.nix
index bf15bd17871d..ac71b883bd53 100644
--- a/pkgs/by-name/li/libphidget22/package.nix
+++ b/pkgs/by-name/li/libphidget22/package.nix
@@ -7,7 +7,7 @@
 }:
 let
   # This package should be updated together with libphidget22extra
-  version = "1.23.20250925";
+  version = "1.25.20260512";
 in
 stdenv.mkDerivation {
   pname = "libphidget22";
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.phidgets.com/downloads/phidget22/libraries/linux/libphidget22/libphidget22-${version}.tar.gz";
-    hash = "sha256-/2OgjiuoK3+gJ95tSk809OfMABUtKPN9bb4pVH447Ik=";
+    hash = "sha256-wrLPP32gOjXsewdLUCe7lUUqfib3egrOONey9mcUfV8=";
   };
 
   nativeBuildInputs = [ automake ];
diff --git a/pkgs/by-name/li/libphidget22extra/package.nix b/pkgs/by-name/li/libphidget22extra/package.nix
index 0fd2f02137cf..d741723079f0 100644
--- a/pkgs/by-name/li/libphidget22extra/package.nix
+++ b/pkgs/by-name/li/libphidget22extra/package.nix
@@ -9,7 +9,7 @@
 let
 
   # This package should be updated together with libphidget22
-  version = "1.23.20250925";
+  version = "1.25.20260512";
 in
 stdenv.mkDerivation {
   pname = "libphidget22extra";
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.phidgets.com/downloads/phidget22/libraries/linux/libphidget22extra/libphidget22extra-${version}.tar.gz";
-    hash = "sha256-eU/4tO9oa+/Cyy2Ro3zm2m3sAN4s3mCcRblicqSapxs=";
+    hash = "sha256-yN4g32Zx73A35yGAA5xnfEu72Nh8yH3KFmFKP5T3Pao=";
   };
 
   nativeBuildInputs = [ automake ];
diff --git a/pkgs/by-name/li/librelane/package.nix b/pkgs/by-name/li/librelane/package.nix
index d59a446731ef..0366d6972d3b 100644
--- a/pkgs/by-name/li/librelane/package.nix
+++ b/pkgs/by-name/li/librelane/package.nix
@@ -23,14 +23,15 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "librelane";
-  version = "3.0.4";
+  version = "3.0.8";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "librelane";
     repo = "librelane";
     tag = finalAttrs.version;
-    hash = "sha256-y1h2KEbK2rSn54uDuCfH9ouo2FLTFbVxpgOqnR+kwhM=";
+    hash = "sha256-l7zNrx7gSKecBQ/haayJxDfG87477aZzdV64hYsMXO4=";
   };
 
   build-system = [
diff --git a/pkgs/by-name/li/libretro-shaders-slang/package.nix b/pkgs/by-name/li/libretro-shaders-slang/package.nix
index ba57b54b7425..9699ce15d038 100644
--- a/pkgs/by-name/li/libretro-shaders-slang/package.nix
+++ b/pkgs/by-name/li/libretro-shaders-slang/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "libretro-shaders-slang";
-  version = "0-unstable-2026-08-03";
+  version = "0-unstable-2026-08-08";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "slang-shaders";
-    rev = "620114039b453ebb2e3de1a5846b0d9b05676bf4";
-    hash = "sha256-ox5Mo9ShWAVQDT6tboA72Mugny3aCQaN1QLpTs4bR6Y=";
+    rev = "a7f04a0698908015c6f9e3a3f446b3d17083269c";
+    hash = "sha256-Zz5EqEyGZwMZcFgowUpW2b3/cRcmOHL5R/Z78sg4dm8=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/li/libtommath/force_mp_set_double.patch b/pkgs/by-name/li/libtommath/force_mp_set_double.patch
new file mode 100644
index 000000000000..1517ca46dcd7
--- /dev/null
+++ b/pkgs/by-name/li/libtommath/force_mp_set_double.patch
@@ -0,0 +1,14 @@
+diff --git a/bn_mp_set_double.c b/bn_mp_set_double.c
+index a42fc70..4a13539 100644
+--- a/bn_mp_set_double.c
++++ b/bn_mp_set_double.c
+@@ -3,7 +3,8 @@
+ /* LibTomMath, multiple-precision integer library -- Tom St Denis */
+ /* SPDX-License-Identifier: Unlicense */
+ 
+-#if defined(__STDC_IEC_559__) || defined(__GCC_IEC_559)
++#if defined(__STDC_IEC_559__) || defined(__GCC_IEC_559) || \
++     (defined(__APPLE__) && defined(__aarch64__))
+ mp_err mp_set_double(mp_int *a, double b)
+ {
+    uint64_t frac;
diff --git a/pkgs/by-name/li/libtommath/package.nix b/pkgs/by-name/li/libtommath/package.nix
index 52580ffa819e..af133212172d 100644
--- a/pkgs/by-name/li/libtommath/package.nix
+++ b/pkgs/by-name/li/libtommath/package.nix
@@ -14,6 +14,10 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-KWJy2TQ1mRMI63NgdgDANLVYgHoH6CnnURQuZcz6nQg=";
   };
 
+  patches = [
+    ./force_mp_set_double.patch
+  ];
+
   postPatch = ''
     substituteInPlace makefile.shared \
       --replace-fail glibtool libtool \
diff --git a/pkgs/by-name/li/libtorrent-rakshasa/package.nix b/pkgs/by-name/li/libtorrent-rakshasa/package.nix
index 72edce1f6f01..d2e05ad6560a 100644
--- a/pkgs/by-name/li/libtorrent-rakshasa/package.nix
+++ b/pkgs/by-name/li/libtorrent-rakshasa/package.nix
@@ -14,7 +14,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libtorrent-rakshasa";
-  version = "0.16.19";
+  version = "0.16.20";
 
   __structuredAttrs = true;
 
@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "rakshasa";
     repo = "libtorrent";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-D+RPDp8r2ZKhNpiLKpm269h/5MBN+QhHf/qeXEzM92M=";
+    hash = "sha256-PEldSXGOFCOa1zo/9wT3efUvf3ZZ9gqZLqioXOdFnt0=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/li/libtraceevent/package.nix b/pkgs/by-name/li/libtraceevent/package.nix
index 0e4f075a3905..74825f37cc0c 100644
--- a/pkgs/by-name/li/libtraceevent/package.nix
+++ b/pkgs/by-name/li/libtraceevent/package.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libtraceevent";
-  version = "1.9";
+  version = "1.9.0";
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/libs/libtrace/libtraceevent.git";
-    rev = "libtraceevent-${finalAttrs.version}";
+    tag = "libtraceevent-${finalAttrs.version}";
     hash = "sha256-4KuF+UNMWxfxXYVlS0cBY5/p242UQ/NoRRVK+wmn04E=";
   };
 
diff --git a/pkgs/by-name/li/libwignernj/package.nix b/pkgs/by-name/li/libwignernj/package.nix
new file mode 100644
index 000000000000..d98dad2b3131
--- /dev/null
+++ b/pkgs/by-name/li/libwignernj/package.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  fetchFromGitHub,
+  stdenv,
+  cmake,
+  gfortran,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libwignernj";
+  version = "0.8.0";
+
+  src = fetchFromGitHub {
+    owner = "susilehtola";
+    repo = "libwignernj";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-NJcLW+nFgQADOgvmYU8iNffiXYVgmTMeaUkDKbsgHAg=";
+  };
+
+  patches = [
+    ./pkg-config.patch
+  ];
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    gfortran
+  ];
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  postFixup = ''
+    substituteInPlace $dev/lib/cmake/wignernj/wignernjTargets.cmake --replace \
+      'INTERFACE_INCLUDE_DIRECTORIES "''${_IMPORT_PREFIX}/include"' \
+      'INTERFACE_INCLUDE_DIRECTORIES "${placeholder "dev"}/include"'
+  '';
+
+  meta = {
+    description = "Exact evaluation of Wigner symbols and Clebsch-Gordan coefficients in C99";
+    homepage = "https://github.com/susilehtola/libwignernj";
+    license = lib.licenses.bsd3;
+    maintainers = [ lib.maintainers.markuskowa ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/li/libwignernj/pkg-config.patch b/pkgs/by-name/li/libwignernj/pkg-config.patch
new file mode 100644
index 000000000000..f2e7f98c2c9c
--- /dev/null
+++ b/pkgs/by-name/li/libwignernj/pkg-config.patch
@@ -0,0 +1,30 @@
+diff --git a/libwignernj.pc.in b/libwignernj.pc.in
+index 7be95cd..ad1fbfa 100644
+--- a/libwignernj.pc.in
++++ b/libwignernj.pc.in
+@@ -2,8 +2,8 @@
+ # Copyright (c) 2026 Susi Lehtola
+ prefix=@CMAKE_INSTALL_PREFIX@
+ exec_prefix=${prefix}
+-libdir=${prefix}/@CMAKE_INSTALL_LIBDIR@
+-includedir=${prefix}/@CMAKE_INSTALL_INCLUDEDIR@
++libdir=@CMAKE_INSTALL_LIBDIR@
++includedir=@CMAKE_INSTALL_INCLUDEDIR@
+ 
+ Name: libwignernj
+ Description: Exact Wigner 3j/6j/9j symbols and related coefficients via prime factorization
+diff --git a/libwignernj_f03.pc.in b/libwignernj_f03.pc.in
+index 0850d25..10d34e9 100644
+--- a/libwignernj_f03.pc.in
++++ b/libwignernj_f03.pc.in
+@@ -2,8 +2,8 @@
+ # Copyright (c) 2026 Susi Lehtola
+ prefix=@CMAKE_INSTALL_PREFIX@
+ exec_prefix=${prefix}
+-libdir=${prefix}/@CMAKE_INSTALL_LIBDIR@
+-includedir=${prefix}/@CMAKE_INSTALL_INCLUDEDIR@
++libdir=@CMAKE_INSTALL_LIBDIR@
++includedir=@CMAKE_INSTALL_INCLUDEDIR@
+ moddir=${includedir}/wignernj/fortran
+ 
+ Name: libwignernj_f03
diff --git a/pkgs/by-name/li/libxfce4windowing/package.nix b/pkgs/by-name/li/libxfce4windowing/package.nix
index d72e843ed4f5..51192ebdbd25 100644
--- a/pkgs/by-name/li/libxfce4windowing/package.nix
+++ b/pkgs/by-name/li/libxfce4windowing/package.nix
@@ -28,7 +28,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libxfce4windowing";
-  version = "4.20.6";
+  version = "4.20.7";
 
   outputs = [
     "out"
@@ -40,7 +40,8 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "xfce";
     repo = "libxfce4windowing";
     tag = "libxfce4windowing-${finalAttrs.version}";
-    hash = "sha256-lTOCvxUSo0CCok5nPCX7B6RqVoNMYcSb97alR+htBtY=";
+    fetchSubmodules = true;
+    hash = "sha256-4z+JP0da0vzJgw13ZB8hI0RC4SyoaRfZyy26eEIVF8Q=";
   };
 
   patches = [
diff --git a/pkgs/by-name/li/limitcpu/package.nix b/pkgs/by-name/li/limitcpu/package.nix
index 8f9919765675..10ab5b831da5 100644
--- a/pkgs/by-name/li/limitcpu/package.nix
+++ b/pkgs/by-name/li/limitcpu/package.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-Wf/rGjUXr+RZmHFL6EGSYKQ2MvfOwI8LAmwezN/1fPw=";
   };
 
-  buildFlags = with stdenv; [
+  buildFlags = with stdenv.hostPlatform; [
     (
       if isDarwin then
         "osx"
diff --git a/pkgs/by-name/li/liquid-dsp/package.nix b/pkgs/by-name/li/liquid-dsp/package.nix
index 55e7f60d85df..b46e55e5ff2c 100644
--- a/pkgs/by-name/li/liquid-dsp/package.nix
+++ b/pkgs/by-name/li/liquid-dsp/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "liquid-dsp";
-  version = "1.8.0";
+  version = "1.8.2";
 
   src = fetchFromGitHub {
     owner = "jgaeddert";
     repo = "liquid-dsp";
     rev = "v${version}";
-    sha256 = "sha256-IvWtoXuuIvpJfY4cyRUsPHgax2/aytYShSdxEStiPYI=";
+    sha256 = "sha256-WI0GLU/m3PVm1VjOTyPuKcopauiqdSullDyux9WUyKc=";
   };
 
   patches = [
@@ -39,6 +39,9 @@ stdenv.mkDerivation rec {
     # Prevent native cpu arch from leaking into binaries.
     (lib.cmakeBool "ENABLE_SIMD" false)
     (lib.cmakeBool "FIND_SIMD" false)
+    # Some build info is included as of 1.8.1. Most of these are not a problem
+    # or handled by the build sandbox but the hostname should be stripped.
+    (lib.cmakeBool "ENABLE_TIMESTAMPS" false)
   ];
 
   doCheck = true;
diff --git a/pkgs/by-name/li/liteparse/package.nix b/pkgs/by-name/li/liteparse/package.nix
index f67f8d727925..c617a2570b84 100644
--- a/pkgs/by-name/li/liteparse/package.nix
+++ b/pkgs/by-name/li/liteparse/package.nix
@@ -64,14 +64,14 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "liteparse";
-  version = "2.8.0";
+  version = "2.11.1";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "run-llama";
     repo = "liteparse";
     tag = "crates-v${finalAttrs.version}";
-    hash = "sha256-s6NWlr1zHfnZer31fxUZcitHpjZeQpWmQMgB1Myq+qs=";
+    hash = "sha256-F2zajjX55EWpJaH/W1I5ZO7Fi11zdRrX1QsPk1T4h6E=";
   };
 
   postPatch = ''
@@ -106,7 +106,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     tesseract
   ];
 
-  cargoHash = "sha256-0rqhhTsL0Jft13KxhFUzCPIHV5qVt3FKZxne8/Ek3Zk=";
+  cargoHash = "sha256-21t92uT5wzIxFpyFH85dBo0T5BKu6jlaXdObLGYF9i0=";
   cargoBuildFlags = [
     "--package"
     "liteparse"
diff --git a/pkgs/by-name/ll/llama-cpp/package.nix b/pkgs/by-name/ll/llama-cpp/package.nix
index e84a6eb08d38..043814b728d1 100644
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@@ -80,7 +80,7 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
   pname = "llama-cpp";
-  version = "10273";
+  version = "10408";
 
   outputs = [
     "out"
@@ -91,7 +91,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
     owner = "ggml-org";
     repo = "llama.cpp";
     tag = "b${finalAttrs.version}";
-    hash = "sha256-A4VLmyOr19NaWI/L//BzK30EuaWNI+38em8YABvQ3wE=";
+    hash = "sha256-b01kyCjcrAJ4zFPNRM2GU/9TR5y1mi7WIJDNYrhSJZo=";
     leaveDotGit = true;
     postFetch = ''
       git -C "$out" rev-parse --short HEAD > $out/COMMIT
@@ -124,7 +124,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
     ++ [ openssl ];
 
   npmRoot = "tools/ui";
-  npmDepsHash = "sha256-B7uEynAG70a3xauBKc20RuFa9cnWaWzVBCh+LPLBnIM=";
+  npmDepsHash = "sha256-2Q7XhaLAArmviOLdQsNbYTfdyDE5pW9lR26cRHEVl9k=";
   npmDeps = fetchNpmDeps {
     name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";
     inherit (finalAttrs) src patches;
diff --git a/pkgs/by-name/ll/llama-swap-minimal/package.nix b/pkgs/by-name/ll/llama-swap-minimal/package.nix
index df9303570750..d5141fe77c80 100644
--- a/pkgs/by-name/ll/llama-swap-minimal/package.nix
+++ b/pkgs/by-name/ll/llama-swap-minimal/package.nix
@@ -1,5 +1,7 @@
 { llama-swap }:
 
+# if more "-minimal" options are added
+# you may need to update main llama-swap's passthru.tests.nixos
 llama-swap.override {
   withUI = false;
 }
diff --git a/pkgs/by-name/ll/llama-swap/package.nix b/pkgs/by-name/ll/llama-swap/package.nix
index 066ef2f14b5d..85cae79471c4 100644
--- a/pkgs/by-name/ll/llama-swap/package.nix
+++ b/pkgs/by-name/ll/llama-swap/package.nix
@@ -21,7 +21,7 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "llama-swap";
-  version = "240";
+  version = "249";
 
   outputs = [
     "out"
@@ -32,7 +32,7 @@ buildGoModule (finalAttrs: {
     owner = "mostlygeek";
     repo = "llama-swap";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cvxF4J9Qvi522dBGjaNZvwwY/bV3wXSE0oGFATjzD4U=";
+    hash = "sha256-7wXOL8XtcKV6Abdxar25C85ODQ34RYOAGYCTaCXxPpY=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -45,7 +45,7 @@ buildGoModule (finalAttrs: {
     '';
   };
 
-  vendorHash = "sha256-jQRnFGqQvk6my7ejnesv1pylCmEXLs9GKbQJEZdsaYg=";
+  vendorHash = "sha256-MhR8B2+Yb/xqrTlIxaVHLoQf1eTOO49c65l72IAuZyU=";
 
   # Upstream only embeds the UI when this build tag is set.
   tags = lib.optionals withUI [ "embed_ui" ];
@@ -137,7 +137,7 @@ buildGoModule (finalAttrs: {
   doInstallCheck = true;
   versionCheckProgramArg = "-version";
 
-  passthru.tests.nixos = nixosTests.llama-swap;
+  passthru.tests.nixos = if withUI then nixosTests.llama-swap.full else nixosTests.llama-swap.minimal;
   passthru.updateScript = nix-update-script {
     extraArgs = [
       "--subpackage"
diff --git a/pkgs/by-name/ll/llama-swap/ui.nix b/pkgs/by-name/ll/llama-swap/ui.nix
index 4d0f02b6c85b..a8871af6532a 100644
--- a/pkgs/by-name/ll/llama-swap/ui.nix
+++ b/pkgs/by-name/ll/llama-swap/ui.nix
@@ -7,7 +7,7 @@
 buildNpmPackage (finalAttrs: {
   pname = "${llama-swap.pname}-ui";
   inherit (llama-swap) version src;
-  npmDepsHash = "sha256-cAdFKDhmyaYCoKqSYEuAhu29rBxs7i8uTmU2SHwTLnY=";
+  npmDepsHash = "sha256-6MPXQtmaz97D9PUU2Nn5DH/2HZNP/rnAWVSck/FiCyk=";
 
   postPatch = ''
     substituteInPlace vite.config.ts \
diff --git a/pkgs/by-name/lm/lmstudio/package.nix b/pkgs/by-name/lm/lmstudio/package.nix
index 5338cf21baa6..c0b88f1435ea 100644
--- a/pkgs/by-name/lm/lmstudio/package.nix
+++ b/pkgs/by-name/lm/lmstudio/package.nix
@@ -7,12 +7,12 @@
 let
   pname = "lmstudio";
 
-  version_aarch64-linux = "0.4.19-2";
-  hash_aarch64-linux = "sha256-okb6RxttmvVZdlg+V1P8UwCOhHgXIl+8fCRGy/JmkB4=";
-  version_aarch64-darwin = "0.4.19-2";
-  hash_aarch64-darwin = "sha256-rWZpkdhEGsPYv7gFA5PVWtI+RU5d5DGiLh91O1W+vj4=";
-  version_x86_64-linux = "0.4.19-2";
-  hash_x86_64-linux = "sha256-kR84VRYbKOYi8Y494/KFrIwzbK6nwSiorIkaIJJDeHI=";
+  version_aarch64-linux = "0.4.21-2";
+  hash_aarch64-linux = "sha256-ft/ud1MOP3eOEZgiB+IdL6qhpTiWfEqGz8iKoWnCKn8=";
+  version_aarch64-darwin = "0.4.21-2";
+  hash_aarch64-darwin = "sha256-A0PQ348VQovNbBqnl5z0krZKec0tPZQZ0aZ1QdNuzzE=";
+  version_x86_64-linux = "0.4.21-2";
+  hash_x86_64-linux = "sha256-EBQ3bYnWaMOBTNIOKxRqB2FGdg3tHvB7lo+2HFje01U=";
 
   meta = {
     description = "LM Studio is an easy to use desktop app for experimenting with local and open-source Large Language Models (LLMs)";
diff --git a/pkgs/by-name/lo/loupe/package.nix b/pkgs/by-name/lo/loupe/package.nix
index 797d8b872811..c5befdebb201 100644
--- a/pkgs/by-name/lo/loupe/package.nix
+++ b/pkgs/by-name/lo/loupe/package.nix
@@ -33,8 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
-    name = "loupe-deps-${finalAttrs.version}";
+    inherit (finalAttrs) pname version src;
     hash = "sha256-I4z5qjX10AUuwk+JdX/1ZU0uCAVPQj8HkEc+n9aMczE=";
   };
 
diff --git a/pkgs/by-name/ls/lstk/package.nix b/pkgs/by-name/ls/lstk/package.nix
index 0be3aa2ea982..3498f6770e2b 100644
--- a/pkgs/by-name/ls/lstk/package.nix
+++ b/pkgs/by-name/ls/lstk/package.nix
@@ -7,7 +7,7 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "lstk";
-  version = "0.20.1";
+  version = "0.21.0";
 
   __structuredAttrs = true;
 
@@ -15,7 +15,7 @@ buildGoModule (finalAttrs: {
     owner = "localstack";
     repo = "lstk";
     tag = "v${finalAttrs.version}";
-    sha256 = "sha256-PL6Xqq1S4RDm0Uj5Am9UiJJJ8Q/nWszuyRXkW+Y9cCE=";
+    sha256 = "sha256-8OV+VaoVm9hW2kzPggmXHsoYTL9yzFKfVM9DdnAxOCE=";
   };
 
   vendorHash = "sha256-WiWMOudPoS3qOMs+m/pz9VYZ9OPRn3IWHxAMC6eBjtg=";
diff --git a/pkgs/by-name/lu/luwen/package.nix b/pkgs/by-name/lu/luwen/package.nix
index f9a80ad2fa3c..706f584d8d59 100644
--- a/pkgs/by-name/lu/luwen/package.nix
+++ b/pkgs/by-name/lu/luwen/package.nix
@@ -6,21 +6,21 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "luwen";
-  version = "0.8.5";
+  version = "0.9.0";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "tenstorrent";
     repo = "luwen";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lY7cZ+8C0UEGGYxufl4Vi8g0L4AJFXaGqn7XE2ivTcQ=";
+    hash = "sha256-pc/7G9YxBTg2uYn47ONxI7zsfdK3Ex4zndLASRtDQyk=";
   };
 
   nativeBuildInputs = [
     protobuf
   ];
 
-  cargoHash = "sha256-QBGXbRiBk4WIQFopq1OccmUHgx5GzR/PKhMH4Ie+fyg=";
+  cargoHash = "sha256-2ibAZnfv++eyCB57F0uD7XFJ3MP9SnAApOn6uelo3Po=";
 
   meta = {
     description = "Tenstorrent system interface tools";
diff --git a/pkgs/by-name/lx/lxpanel/package.nix b/pkgs/by-name/lx/lxpanel/package.nix
index 7952ee45f5d6..9d4be53e3fae 100644
--- a/pkgs/by-name/lx/lxpanel/package.nix
+++ b/pkgs/by-name/lx/lxpanel/package.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
-    (libfm.override { withGtk3 = true; })
+    libfm
     keybinder3
     gtk3
     libx11
diff --git a/pkgs/by-name/ma/maigret/package.nix b/pkgs/by-name/ma/maigret/package.nix
index 2322b0d6fd76..e35afc226f5b 100644
--- a/pkgs/by-name/ma/maigret/package.nix
+++ b/pkgs/by-name/ma/maigret/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "maigret";
-  version = "0.6.3";
+  version = "0.6.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "soxoj";
     repo = "maigret";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-iKWPIDxuwoNzyWZAiziWU2Q7VDFgGqAcxYjcw6L/5Ho=";
+    hash = "sha256-yJqJA+GWT6nZFoErpr44gWJbxZi/woAe2xF7dbrV+e0=";
   };
 
   pythonRelaxDeps = true;
diff --git a/pkgs/by-name/ma/mailspring/mailsync.nix b/pkgs/by-name/ma/mailspring/mailsync.nix
index 6f77d031ec29..49197fc78ed2 100644
--- a/pkgs/by-name/ma/mailspring/mailsync.nix
+++ b/pkgs/by-name/ma/mailspring/mailsync.nix
@@ -42,7 +42,7 @@ stdenv.mkDerivation {
     cmake
     pkg-config
   ]
-  ++ lib.optionals stdenv.isLinux [
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
     autoPatchelfHook
   ];
 
@@ -64,7 +64,7 @@ stdenv.mkDerivation {
     xz
     zlib
   ]
-  ++ lib.optionals stdenv.isDarwin [
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
     libiconv
   ];
 
@@ -99,7 +99,7 @@ stdenv.mkDerivation {
     # Transforms 'NAMES libfoo.a libfoo' into 'NAMES foo'
     sed -i -E 's/NAMES lib([a-zA-Z0-9]+)\.a lib\1/NAMES \1/g' CMakeLists.txt
   ''
-  + lib.optionalString stdenv.isDarwin ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
     # UUID_LIB is provided by system frameworks
     substituteInPlace CMakeLists.txt \
       --replace-fail "find_library(UUID_LIB NAMES uuid)" "set(UUID_LIB \"\")"
diff --git a/pkgs/by-name/ma/materia-everforest-kvantum/package.nix b/pkgs/by-name/ma/materia-everforest-kvantum/package.nix
new file mode 100644
index 000000000000..c3fe4d977271
--- /dev/null
+++ b/pkgs/by-name/ma/materia-everforest-kvantum/package.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  unstableGitUpdater,
+}:
+stdenvNoCC.mkDerivation {
+  pname = "materia-everforest-kvantum";
+  version = "0-unstable-2024-01-22";
+
+  src = fetchFromGitHub {
+    owner = "binEpilo";
+    repo = "materia-everforest-kvantum";
+    rev = "391eb1d917dab900dc1ef16ffdff1a4546308ee4";
+    hash = "sha256-5ihKScPJMDU0pbeYtUx/UjC4J08/r40mAK7D+1TK6wA=";
+  };
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/Kvantum
+    cp -a MateriaEverforestDark $out/share/Kvantum
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = unstableGitUpdater { };
+
+  meta = {
+    description = "Everforest theme for Kvantum";
+    homepage = "https://github.com/binEpilo/materia-everforest-kvantum";
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.linux;
+    maintainers = [ lib.maintainers.poz ];
+  };
+}
diff --git a/pkgs/by-name/ma/mattermost-desktop/package.nix b/pkgs/by-name/ma/mattermost-desktop/package.nix
index df0057ea8468..054c708a449e 100644
--- a/pkgs/by-name/ma/mattermost-desktop/package.nix
+++ b/pkgs/by-name/ma/mattermost-desktop/package.nix
@@ -1,8 +1,9 @@
 {
   lib,
+  stdenv,
   fetchFromGitHub,
   buildNpmPackage,
-  electron_41,
+  electron_43,
   makeWrapper,
   testers,
   mattermost-desktop,
@@ -10,21 +11,21 @@
 }:
 
 let
-  electron = electron_41;
+  electron = electron_43;
 in
 
 buildNpmPackage rec {
   pname = "mattermost-desktop";
-  version = "6.2.2";
+  version = "6.3.0";
 
   src = fetchFromGitHub {
     owner = "mattermost";
     repo = "desktop";
     tag = "v${version}";
-    hash = "sha256-KSyFJrYy+pueSrX20SPBoudWfiHmy5L2O8TdzLJRiYk=";
+    hash = "sha256-aDYmnFb0CJDF/M1ca/6YkKTBcTC56+zpe9iqtRR0cpU=";
   };
 
-  npmDepsHash = "sha256-70TBP4iDKuF4X9Tf0tsbUQ3N7bluoPn65OdfdcWin4Y=";
+  npmDepsHash = "sha256-nNKfzPKA0kjki169u/qe5r6rrVbVi3+0nkVj6niS+/c=";
   npmBuildScript = "build-prod";
   makeCacheWritable = true;
 
@@ -100,6 +101,8 @@ buildNpmPackage rec {
     changelog = "https://github.com/mattermost/desktop/releases/tag/${src.tag}";
     license = lib.licenses.asl20;
     platforms = electron.meta.platforms;
+    # https://github.com/NixOS/nixpkgs/issues/430763
+    broken = stdenv.hostPlatform.isDarwin;
     maintainers = with lib.maintainers; [
       joko
       liff
diff --git a/pkgs/by-name/me/me3/package.nix b/pkgs/by-name/me/me3/package.nix
index ce8a10bd3a91..85df9b19ab8d 100644
--- a/pkgs/by-name/me/me3/package.nix
+++ b/pkgs/by-name/me/me3/package.nix
@@ -10,7 +10,7 @@
 }:
 
 let
-  version = "0.12.1";
+  version = "0.13.0";
 
   # me3 creates a pipe under /tmp needed by the compat tool subprocess
   steam-run =
@@ -22,10 +22,10 @@ let
     owner = "garyttierney";
     repo = "me3";
     tag = "v${version}";
-    sha256 = "sha256-pGK6A85Xp6NbpYRKJTgi47acv4c8dZgb+Jdmeu8F/uU=";
+    sha256 = "sha256-OgAJGzjt+VDjbyY3uOjX3M5HajXbdoF1YJFAgwiZ03o=";
   };
 
-  cargoHash = "sha256-ss2NkDHfd5NBLGpnZ80UdvO0nn2mGueO0mnlWkog1jc=";
+  cargoHash = "sha256-e6tytA15kY58efmG3mIgZpTTa11Ijwl8u+NIBdYmha8=";
 
   me3-cli = rustPlatform.buildRustPackage (final: {
     inherit cargoHash version src;
diff --git a/pkgs/by-name/me/mediagoblin/package.nix b/pkgs/by-name/me/mediagoblin/package.nix
index 891df2daecd3..eb956ae26a84 100644
--- a/pkgs/by-name/me/mediagoblin/package.nix
+++ b/pkgs/by-name/me/mediagoblin/package.nix
@@ -5,12 +5,18 @@
   gobject-introspection,
   gst_all_1,
   poppler-utils,
-  python3,
+  python3Packages,
   lndir,
 }:
 
 let
-  python = python3;
+  pythonPackages = python3Packages.overrideScope (
+    final: prev: {
+      paste = prev.paste.override { setuptools = prev.setuptools_80; };
+    }
+  );
+
+  inherit (pythonPackages.python) sitePackages;
 
   version = "0.15.0";
   src = fetchFromSourcehut {
@@ -35,7 +41,7 @@ let
     '';
   };
 in
-python.pkgs.buildPythonApplication rec {
+pythonPackages.buildPythonApplication rec {
   format = "setuptools";
   pname = "mediagoblin";
   inherit version src;
@@ -53,15 +59,15 @@ python.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = [
     gobject-introspection
-    python3.pkgs.babel
+    pythonPackages.babel
     lndir
   ];
 
-  build-system = with python.pkgs; [
+  build-system = with pythonPackages; [
     setuptools
   ];
 
-  dependencies = with python.pkgs; [
+  dependencies = with pythonPackages; [
     alembic
     babel
     bcrypt
@@ -96,7 +102,7 @@ python.pkgs.buildPythonApplication rec {
   ];
 
   optional-dependencies =
-    with python.pkgs;
+    with pythonPackages;
     let
       # not really documented in python build system
       gst = with gst_all_1; [
@@ -123,16 +129,16 @@ python.pkgs.buildPythonApplication rec {
   '';
 
   postInstall = ''
-    lndir -silent ${extlib}/node_modules $out/${python.sitePackages}/mediagoblin/static/extlib/
+    lndir -silent ${extlib}/node_modules $out/${sitePackages}/mediagoblin/static/extlib/
 
-    ln -rs $out/${python.sitePackages}/mediagoblin/static/extlib/jquery/dist/jquery.js $out/${python.sitePackages}/mediagoblin/static/js/extlib/jquery.js
-    ln -rs $out/${python.sitePackages}/mediagoblin/static/extlib/leaflet/dist/leaflet.css $out/${python.sitePackages}/mediagoblin/static/extlib/leaflet/leaflet.css
-    ln -rs $out/${python.sitePackages}/mediagoblin/static/extlib/leaflet/dist/leaflet.js $out/${python.sitePackages}/mediagoblin/static/extlib/leaflet/leaflet.js
-    ln -rs $out/${python.sitePackages}/mediagoblin/static/extlib/leaflet/dist/images/ $out/${python.sitePackages}/mediagoblin/static/extlib/leaflet/
+    ln -rs $out/${sitePackages}/mediagoblin/static/extlib/jquery/dist/jquery.js $out/${sitePackages}/mediagoblin/static/js/extlib/jquery.js
+    ln -rs $out/${sitePackages}/mediagoblin/static/extlib/leaflet/dist/leaflet.css $out/${sitePackages}/mediagoblin/static/extlib/leaflet/leaflet.css
+    ln -rs $out/${sitePackages}/mediagoblin/static/extlib/leaflet/dist/leaflet.js $out/${sitePackages}/mediagoblin/static/extlib/leaflet/leaflet.js
+    ln -rs $out/${sitePackages}/mediagoblin/static/extlib/leaflet/dist/images/ $out/${sitePackages}/mediagoblin/static/extlib/leaflet/
   '';
 
   nativeCheckInputs =
-    with python.pkgs;
+    with pythonPackages;
     [
       pytest-forked
       pytest-xdist
@@ -146,7 +152,7 @@ python.pkgs.buildPythonApplication rec {
   pythonImportsCheck = [ "mediagoblin" ];
 
   passthru = {
-    inherit extlib python;
+    inherit extlib pythonPackages;
   };
 
   meta = {
diff --git a/pkgs/by-name/me/megabasterd/package.nix b/pkgs/by-name/me/megabasterd/package.nix
index 7c1e2b8d6ce4..41dd23b5e871 100644
--- a/pkgs/by-name/me/megabasterd/package.nix
+++ b/pkgs/by-name/me/megabasterd/package.nix
@@ -6,7 +6,7 @@
   maven,
 }:
 let
-  version = "8.57";
+  version = "8.58";
 in
 maven.buildMavenPackage {
   pname = "megabasterd";
@@ -16,7 +16,7 @@ maven.buildMavenPackage {
     owner = "tonikelope";
     repo = "megabasterd";
     tag = "v${version}";
-    hash = "sha256-6PKBzQA3lBa9/7J8bymGmnW3OPsRV4GgZ7dc7H6fOuE=";
+    hash = "sha256-cF0OU/b4BthRmWYUB0ZjE/gRO//T73njgp3iZt+USgA=";
   };
 
   mvnHash = "sha256-JZ8INISDHPVhxylKwQc2DybPqxfwcGpkWxDhq8Fpqt8=";
diff --git a/pkgs/by-name/me/metapac/package.nix b/pkgs/by-name/me/metapac/package.nix
index 3d59bf23ceca..69fe834a5b50 100644
--- a/pkgs/by-name/me/metapac/package.nix
+++ b/pkgs/by-name/me/metapac/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "metapac";
-  version = "0.10.0";
+  version = "0.10.1";
 
   src = fetchFromGitHub {
     owner = "ripytide";
     repo = "metapac";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zp45oaLRHv6NdBQEpTEtG93gF04V8YayluXO2IV8LkI=";
+    hash = "sha256-6Nw4CUTx0/KcHHguRrUH6Sa+DZhPJqdsTEeVBb0eEqw=";
   };
 
-  cargoHash = "sha256-sw9MPnhbQPifkDJoO33RbMBtTsSyRmuiNVyjlteAAcM=";
+  cargoHash = "sha256-hUd9qWXXErOyJV0mjmkMUb8KPuUhp1XI3GNYwpt1Xow=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
diff --git a/pkgs/by-name/me/metronome/package.nix b/pkgs/by-name/me/metronome/package.nix
index 08e7ae0b65c1..13edfb87a7d5 100644
--- a/pkgs/by-name/me/metronome/package.nix
+++ b/pkgs/by-name/me/metronome/package.nix
@@ -27,8 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
-    name = "metronome-${finalAttrs.version}";
+    inherit (finalAttrs) pname version src;
     hash = "sha256-T/x5LpODpKWGA40W1je6jw1DS9attVUK4ZjAnRAyf6k=";
   };
 
diff --git a/pkgs/by-name/mi/microbin/package.nix b/pkgs/by-name/mi/microbin/package.nix
index 420b2973f629..c43fdfca8a19 100644
--- a/pkgs/by-name/mi/microbin/package.nix
+++ b/pkgs/by-name/mi/microbin/package.nix
@@ -1,67 +1,27 @@
 {
   fetchFromGitHub,
-  fetchpatch,
   lib,
   oniguruma,
   openssl,
   pkg-config,
   rustPlatform,
+  nix-update-script,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "microbin";
-  version = "2.0.4";
+  version = "2.1.4";
 
   src = fetchFromGitHub {
     owner = "szabodanika";
     repo = "microbin";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-fsRpqSYDsuV0M6Xar2GVoyTgCPT39dcKJ6eW4YXCkQ0=";
+    hash = "sha256-ipSMiUJgbZ0kijGs7Ok8bRTGdFzygIPEY6ZuJ/eRb9s=";
   };
 
-  cargoHash = "sha256-cQyb9KpmdJ2DB395Ce24JX8YcMLQn3fmeYZUo72L38s=";
+  cargoHash = "sha256-vvSQfXu67RNBXzfDIE2rcfUOcAfTACaVRvSBBITJ9gY=";
 
-  patches = [
-    # Prefix some URLs with args.public_path_as_str() by PeterUpfold
-    # https://github.com/szabodanika/microbin/pull/194
-    # MicroBin returns wrong URLs on deployments with non-root URLs.
-    (fetchpatch {
-      name = "0001-fixup-explicit-urls.patch";
-      url = "https://github.com/szabodanika/microbin/compare/b8a0c5490d681550d982ad02d67a1aaa0897f503..df062134cbaf3fd0ebcb67af8453a4c66844cd13.patch";
-      hash = "sha256-h13FBuzu2O4AwdhRHF5EX5LaKyPeWJAcaV6SGTaYzTg=";
-    })
-
-    # Minor fixups by LuK1337
-    # https://github.com/szabodanika/microbin/pull/211
-    # Fixup styling, password protected and private pastas.
-    (fetchpatch {
-      name = "0002-minor-fixups.patch";
-      url = "https://github.com/szabodanika/microbin/compare/b8a0c5490d681550d982ad02d67a1aaa0897f503..3b0c025e9b6dc1ca69269541940bdb53032a048a.patch";
-      hash = "sha256-cZB/jx5d6F+C4xOn49TQ1at/Z4ov26efo9PTtWEdCHw=";
-    })
-
-    # Fix MICROBIN_ETERNAL_PASTA by SouthFox-D
-    # https://github.com/szabodanika/microbin/pull/215
-    # MICROBIN_ETERNAL_PASTA config doesn't work without this.
-    (fetchpatch {
-      name = "0003-fix-microbin-eternal-pasta.patch";
-      url = "https://github.com/szabodanika/microbin/compare/b8a0c5490d681550d982ad02d67a1aaa0897f503..c7c846c64344b8d51500aa9a4b2e9a92de8d09d8.patch";
-      hash = "sha256-gCio73Jt0F7YCFtQxtf6pPBDLNcyOAcfSsiyjLFzEzY=";
-    })
-
-    # Fix raw pastes returning 404 by GizmoTjaz
-    # https://github.com/szabodanika/microbin/pull/218
-    # Existing pastas return code 404 even when they exist.
-    (fetchpatch {
-      name = "0004-fix-raw-pastas-returning-404.patch";
-      url = "https://github.com/szabodanika/microbin/compare/b8a0c5490d681550d982ad02d67a1aaa0897f503..e789901520824d4bf610d28923097affe85ead7d.patch";
-      hash = "sha256-R47ozwu/FD1kCu5nx4Gf1cOFeLVFdS67K8RNDygwoZM=";
-    })
-  ];
-
-  nativeBuildInputs = [
-    pkg-config
-  ];
+  nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [
     oniguruma
@@ -73,6 +33,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
     RUSTONIG_SYSTEM_LIBONIG = true;
   };
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Tiny, self-contained, configurable paste bin and URL shortener written in Rust";
     homepage = "https://github.com/szabodanika/microbin";
diff --git a/pkgs/by-name/mi/microcode-intel/package.nix b/pkgs/by-name/mi/microcode-intel/package.nix
index f5d102f666b5..1adb9b442f38 100644
--- a/pkgs/by-name/mi/microcode-intel/package.nix
+++ b/pkgs/by-name/mi/microcode-intel/package.nix
@@ -9,7 +9,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "microcode-intel";
-  version = "20260811";
+  version = "20260812";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -18,7 +18,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     owner = "intel";
     repo = "Intel-Linux-Processor-Microcode-Data-Files";
     tag = "microcode-${finalAttrs.version}";
-    hash = "sha256-8BvyFsBeL9tRutY6J2DotvVbKrKb3LUBro5MLO+egrg=";
+    hash = "sha256-Rw40SNaVSnGenRIkuspVzsFXt17GxPUTsRP86aMI4RM=";
   };
 
   nativeBuildInputs = [ libarchive ];
diff --git a/pkgs/by-name/mi/miller/package.nix b/pkgs/by-name/mi/miller/package.nix
index 147d8cbca1f5..59fa2d1cf536 100644
--- a/pkgs/by-name/mi/miller/package.nix
+++ b/pkgs/by-name/mi/miller/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "miller";
-  version = "6.20.2";
+  version = "6.21.0";
 
   src = fetchFromGitHub {
     owner = "johnkerl";
     repo = "miller";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-unzjbPuOmppEY56JnV+A3TZuaHMLNeZS3n7tKpudCXk=";
+    sha256 = "sha256-E/O+uzYaiHBxCOZ0VCmpNlJZDaEBKlCtKAXgm5iY/ps=";
   };
 
   outputs = [
@@ -20,7 +20,7 @@ buildGoModule (finalAttrs: {
     "man"
   ];
 
-  vendorHash = "sha256-ZA9ueehDXsRI3eEE44hJziWKAAsZXkF77hBkYvX2k+U=";
+  vendorHash = "sha256-22RaVj9z7hrXKoKtEDjjUL1gYObhFRvstTIRtDtyD5U=";
 
   postInstall = ''
     mkdir -p $man/share/man/man1
diff --git a/pkgs/by-name/mi/minify/package.nix b/pkgs/by-name/mi/minify/package.nix
index 9d4cbefc12c2..9d4495fb1eb7 100644
--- a/pkgs/by-name/mi/minify/package.nix
+++ b/pkgs/by-name/mi/minify/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "minify";
-  version = "2.24.14";
+  version = "2.24.17";
 
   src = fetchFromGitHub {
     owner = "tdewolff";
     repo = "minify";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Gur0IFYTJWqazAADuFdOXuFiA04k1vCIdRT+6208cso=";
+    hash = "sha256-syEMMEQYUQEEdch7yFrVUUPXe1cIebXkvm52e9LmP+c=";
   };
 
-  vendorHash = "sha256-Ja3Ew3VtFXgWjasnjZd+gJ7duJvsJqo5sVsp8FbxdBc=";
+  vendorHash = "sha256-s4QSt1kxPxgbQLZStsMN/st3g4GjQtK7+wAI5IKaHo4=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/mi/minijinja/package.nix b/pkgs/by-name/mi/minijinja/package.nix
index 1d3a6446f714..82025ae9d2d9 100644
--- a/pkgs/by-name/mi/minijinja/package.nix
+++ b/pkgs/by-name/mi/minijinja/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "minijinja";
-  version = "2.22.0";
+  version = "2.24.0";
 
   src = fetchFromGitHub {
     owner = "mitsuhiko";
     repo = "minijinja";
     rev = finalAttrs.version;
-    hash = "sha256-IFlfhQwyJtjgZJixdm4hxuDW1V6TJTFSiqX1s0NuvE8=";
+    hash = "sha256-Ebn/YiJK9pfYE+DwWR8nMpAckYCbN2C359wN/icJoAM=";
   };
 
-  cargoHash = "sha256-hnWD89auEdZUtBLaScUrj/3k46As6mNhNfo3rXVwY0E=";
+  cargoHash = "sha256-PX3sk4veHYz9m0yQmIKmm6AtZpjzQ/a9HeL3i8oCaSo=";
 
   # The tests relies on the presence of network connection
   doCheck = false;
diff --git a/pkgs/by-name/mi/minizign/package.nix b/pkgs/by-name/mi/minizign/package.nix
index 3bab3ac74526..18bb20faa1e3 100644
--- a/pkgs/by-name/mi/minizign/package.nix
+++ b/pkgs/by-name/mi/minizign/package.nix
@@ -2,23 +2,33 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  zig_0_15,
+  zig_0_16,
 }:
 
 let
-  zig = zig_0_15;
+  zig = zig_0_16;
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "minizign";
-  version = "0.1.7";
+  version = "0.1.13";
 
   src = fetchFromGitHub {
     owner = "jedisct1";
     repo = "zig-minisign";
     tag = finalAttrs.version;
-    hash = "sha256-W1rfIZqEGaBkLE2Goug4ANBWj6mc4hurVhsJ0NWH4nY=";
+    hash = "sha256-qGOGcpmmPPMN9Tm7k31aBXnbouPWXg69KjZLFLNPldo=";
   };
 
+  zigDeps = zig.fetchDeps {
+    inherit (finalAttrs) src pname version;
+    fetchAll = true;
+    hash = "sha256-/ylcSBv+oPW+mcWO7ArPAR2rp1GGpmW0ajIlsQWcTJw=";
+  };
+
+  postConfigure = ''
+    ln -s ${finalAttrs.zigDeps} "$ZIG_GLOBAL_CACHE_DIR/p"
+  '';
+
   nativeBuildInputs = [
     zig
   ];
diff --git a/pkgs/by-name/mo/mochi/package.nix b/pkgs/by-name/mo/mochi/package.nix
index ad637755bee2..afdc636fbac8 100644
--- a/pkgs/by-name/mo/mochi/package.nix
+++ b/pkgs/by-name/mo/mochi/package.nix
@@ -72,7 +72,7 @@ let
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     maintainers = with lib.maintainers; [
       piotrkwiecinski
-      poopsicles
+      dibenzepin
     ];
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
   };
diff --git a/pkgs/by-name/mo/models-dev/package.nix b/pkgs/by-name/mo/models-dev/package.nix
index 9871208dbaa8..c0dd3a2adef2 100644
--- a/pkgs/by-name/mo/models-dev/package.nix
+++ b/pkgs/by-name/mo/models-dev/package.nix
@@ -7,75 +7,77 @@
   writableTmpDirAsHomeHook,
 }:
 let
+  node_modules =
+    finalAttrs:
+    stdenvNoCC.mkDerivation {
+      pname = "${finalAttrs.pname}-node_modules";
+      inherit (finalAttrs) version src;
+
+      __structuredAttrs = true;
+      strictDeps = true;
+
+      impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [
+        "GIT_PROXY_COMMAND"
+        "SOCKS_SERVER"
+      ];
+
+      nativeBuildInputs = [
+        bun
+        writableTmpDirAsHomeHook
+      ];
+
+      dontConfigure = true;
+
+      buildPhase = ''
+        runHook preBuild
+
+        bun install \
+          --cpu="*" \
+          --frozen-lockfile \
+          --ignore-scripts \
+          --no-progress \
+          --os="*"
+
+        runHook postBuild
+      '';
+
+      installPhase = ''
+        runHook preInstall
+
+        mkdir -p $out
+        find . -type d -name node_modules -exec cp -R --parents {} $out \;
+
+        runHook postInstall
+      '';
+
+      # NOTE: Required else we get errors that our fixed-output derivation references store paths
+      dontFixup = true;
+
+      outputHash = "sha256-aL2kNCYF6Y4QnEvlpQ9U5Qe+K8a1J2X7BvJqE+BnRcY=";
+      outputHashAlgo = "sha256";
+      outputHashMode = "recursive";
+    };
+in
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "models-dev";
-  version = "sdk-v0.0.5-unstable-2026-08-04";
+  version = "sdk-v0.0.5-unstable-2026-08-13";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
   src = fetchFromGitHub {
     owner = "anomalyco";
     repo = "models.dev";
-    rev = "183bea88e4c0e9922c81eddb3987d9edb3a640ed";
-    hash = "sha256-h7GsDMuZFOzFVR0Yp3C0fEJAqQi0XLrC/hohMUKE6/8=";
+    rev = "7ac862dc68caf19a58214dc9b0e6463ed641aeb0";
+    hash = "sha256-bPsBe/qIBRsKijdxqpYMSMG4sjXCkCOCe0IzIvSDo+g=";
   };
 
-  node_modules = stdenvNoCC.mkDerivation {
-    pname = "${pname}-node_modules";
-    inherit version src;
-
-    impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [
-      "GIT_PROXY_COMMAND"
-      "SOCKS_SERVER"
-    ];
-
-    nativeBuildInputs = [
-      bun
-      writableTmpDirAsHomeHook
-    ];
-
-    dontConfigure = true;
-
-    buildPhase = ''
-      runHook preBuild
-
-      bun install \
-        --cpu="*" \
-        --frozen-lockfile \
-        --ignore-scripts \
-        --no-progress \
-        --os="*"
-
-      runHook postBuild
-    '';
-
-    installPhase = ''
-      runHook preInstall
-
-      mkdir -p $out
-      find . -type d -name node_modules -exec cp -R --parents {} $out \;
-
-      runHook postInstall
-    '';
-
-    # NOTE: Required else we get errors that our fixed-output derivation references store paths
-    dontFixup = true;
-
-    outputHash = "sha256-aL2kNCYF6Y4QnEvlpQ9U5Qe+K8a1J2X7BvJqE+BnRcY=";
-    outputHashAlgo = "sha256";
-    outputHashMode = "recursive";
-  };
-in
-stdenvNoCC.mkDerivation (finalAttrs: {
-  inherit
-    pname
-    version
-    src
-    node_modules
-    ;
-
   nativeBuildInputs = [ bun ];
 
   configurePhase = ''
     runHook preConfigure
 
-    cp -R ${node_modules}/. .
+    cp -R ${finalAttrs.passthru.node_modules}/. .
 
     runHook postConfigure
   '';
@@ -100,6 +102,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   '';
 
   passthru = {
+    jsonschema = "${finalAttrs.finalPackage}/dist/model-schema.json";
+    node_modules = node_modules finalAttrs;
     updateScript = nix-update-script {
       extraArgs = [
         "--version=branch"
@@ -107,7 +111,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
         "node_modules"
       ];
     };
-    jsonschema = "${finalAttrs.finalPackage}/dist/model-schema.json";
   };
 
   meta = {
diff --git a/pkgs/by-name/mo/mold-unwrapped/package.nix b/pkgs/by-name/mo/mold-unwrapped/package.nix
index b2e0e1731961..c437ba87c84e 100644
--- a/pkgs/by-name/mo/mold-unwrapped/package.nix
+++ b/pkgs/by-name/mo/mold-unwrapped/package.nix
@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mold-unwrapped";
-  version = "2.41.0";
+  version = "2.42.0";
 
   src = fetchFromGitHub {
     owner = "rui314";
     repo = "mold";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-N+dFJk4KJY8E0UBrAlKXpMSuiseF4KAtpFMUA/nbleQ=";
+    hash = "sha256-PPKYjdU4aLxhGLSZTTZFt06/yVi1cTjJalovr/ohDew=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/mo/mongodb-atlas-cli/package.nix b/pkgs/by-name/mo/mongodb-atlas-cli/package.nix
index bbb9bd22ed1c..c428d1f79a15 100644
--- a/pkgs/by-name/mo/mongodb-atlas-cli/package.nix
+++ b/pkgs/by-name/mo/mongodb-atlas-cli/package.nix
@@ -11,16 +11,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "mongodb-atlas-cli";
-  version = "1.57.0";
+  version = "1.58.0";
 
   src = fetchFromGitHub {
     owner = "mongodb";
     repo = "mongodb-atlas-cli";
     tag = "atlascli/v${finalAttrs.version}";
-    hash = "sha256-4UsQCflxYB2jy7y6FejBNJfE1a66JwS44aqelrQBdsU=";
+    hash = "sha256-kpgHmKm9gmAll+zuzXeUGv4oYRE4XL4LbSsFAB6Sj1M=";
   };
 
-  vendorHash = "sha256-FgAnXdYUFRJNKT5c8yS3B9tY8XQmUO+pRAlfw//d6tE=";
+  vendorHash = "sha256-PuwDBGVM7I0s2m8WppG6YdEM5sORTg0OfFFNpo0F31c=";
 
   nativeBuildInputs = [ installShellFiles ];
 
@@ -56,7 +56,6 @@ buildGoModule (finalAttrs: {
     changelog = "https://www.mongodb.com/docs/atlas/cli/current/atlas-cli-changelog/#atlas-cli-${finalAttrs.version}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
-      aduh95
       iamanaws
     ];
     mainProgram = "atlas";
diff --git a/pkgs/by-name/mo/moonlight-qt/package.nix b/pkgs/by-name/mo/moonlight-qt/package.nix
index 0ff24a291319..1eef83cedaf7 100644
--- a/pkgs/by-name/mo/moonlight-qt/package.nix
+++ b/pkgs/by-name/mo/moonlight-qt/package.nix
@@ -8,7 +8,7 @@
   vulkan-headers,
   SDL2,
   SDL2_ttf,
-  ffmpeg,
+  ffmpeg_8,
   libopus,
   libplacebo,
   openssl,
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     SDL2
     SDL2_ttf
-    ffmpeg
+    ffmpeg_8
     libopus
     libplacebo
     qt6.qtdeclarative
diff --git a/pkgs/by-name/mp/mpls/package.nix b/pkgs/by-name/mp/mpls/package.nix
index 92fe72f905f7..63552a5f4707 100644
--- a/pkgs/by-name/mp/mpls/package.nix
+++ b/pkgs/by-name/mp/mpls/package.nix
@@ -7,16 +7,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "mpls";
-  version = "0.21.3";
+  version = "0.22.0";
 
   src = fetchFromGitHub {
     owner = "mhersson";
     repo = "mpls";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DG3op0bKCePp0LLM5faVlnPGiq2bghB+0EItr3yrjqQ=";
+    hash = "sha256-26WRMprKyuxyyW8rBwjTPbsU9XCqUle6NBIoubXuzCM=";
   };
 
-  vendorHash = "sha256-fE6GFfrDS3k9BmsL2+UbefG/EQngI/WGRZA3U10VBP4=";
+  vendorHash = "sha256-Yo6uD0hRwBEPtYDqYs4ZB5NhICwZpkO3VdCl8B/+7qQ=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/mp/mpv/scripts/modernx-zydezu.nix b/pkgs/by-name/mp/mpv/scripts/modernx-zydezu.nix
index 362031f19db3..64f7951287a8 100644
--- a/pkgs/by-name/mp/mpv/scripts/modernx-zydezu.nix
+++ b/pkgs/by-name/mp/mpv/scripts/modernx-zydezu.nix
@@ -9,14 +9,14 @@
 }:
 buildLua (finalAttrs: {
   pname = "modernx-zydezu";
-  version = "0.4.6";
+  version = "0.4.7";
 
   scriptPath = "modernx.lua";
   src = fetchFromGitHub {
     owner = "zydezu";
     repo = "ModernX";
     rev = finalAttrs.version;
-    hash = "sha256-jK35LmihSCF789AJhKlySg6fXurAe5uuHNsgFjt0+iY=";
+    hash = "sha256-EekTzSC2Komh3H18IK1xr5bpQuAlulsc6CnmGb4aZ+A=";
   };
 
   nativeBuildInputs = [ installFonts ];
diff --git a/pkgs/by-name/mu/music-assistant/package.nix b/pkgs/by-name/mu/music-assistant/package.nix
index 16260e110379..e64a3e90098b 100644
--- a/pkgs/by-name/mu/music-assistant/package.nix
+++ b/pkgs/by-name/mu/music-assistant/package.nix
@@ -40,7 +40,7 @@ assert
 
 pythonPackages.buildPythonApplication (finalAttrs: {
   pname = "music-assistant";
-  version = "2.9.10";
+  version = "2.9.13";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -48,7 +48,7 @@ pythonPackages.buildPythonApplication (finalAttrs: {
     owner = "music-assistant";
     repo = "server";
     tag = finalAttrs.version;
-    hash = "sha256-v9xFW83/v8CjKa04oql1yGQKB58VQtFmXZTN/KMN/gM=";
+    hash = "sha256-HCqd8++PKdbuzyeztkcLUXhTivTLJEl749VD2oCsHZA=";
   };
 
   patches = [
@@ -204,6 +204,7 @@ pythonPackages.buildPythonApplication (finalAttrs: {
       "snapcast"
       "sonic_analysis"
       "sonic_similarity"
+      "sonos"
       "sonos_s1"
       "tidal"
       "wiim"
diff --git a/pkgs/by-name/mu/music-assistant/providers.nix b/pkgs/by-name/mu/music-assistant/providers.nix
index e21bc88f9efc..fb0d34731dfc 100644
--- a/pkgs/by-name/mu/music-assistant/providers.nix
+++ b/pkgs/by-name/mu/music-assistant/providers.nix
@@ -1,7 +1,7 @@
 # Do not edit manually, run ./update-providers.py
 
 {
-  version = "2.9.10";
+  version = "2.9.13";
   builtins = [
     "builtin"
     "coverartarchive"
diff --git a/pkgs/by-name/mu/music-assistant/update-providers.py b/pkgs/by-name/mu/music-assistant/update-providers.py
index b9273f4280b7..1befe967b5ba 100755
--- a/pkgs/by-name/mu/music-assistant/update-providers.py
+++ b/pkgs/by-name/mu/music-assistant/update-providers.py
@@ -12,7 +12,7 @@ from functools import cache
 from io import BytesIO
 from pathlib import Path
 from subprocess import check_output, run
-from typing import Dict, Final, List, Optional, Set, Union, cast
+from typing import Final, cast
 from urllib.request import urlopen
 
 from jinja2 import Environment
@@ -82,15 +82,12 @@ EXTRA_LIST_DEPS = {
 }
 
 
-def run_sync(cmd: List[str]) -> None:
+def run_sync(cmd: list[str]) -> None:
     print(f"$ {' '.join(cmd)}")
-    process = run(cmd)
-
-    if process.returncode != 0:
-        sys.exit(1)
+    run(cmd, check=True)
 
 
-async def check_async(cmd: List[str]) -> str:
+async def check_async(cmd: list[str]) -> str:
     print(f"$ {' '.join(cmd)}")
     process = await asyncio.create_subprocess_exec(
         *cmd, stdout=asyncio.subprocess.PIPE, stderr=asyncio.subprocess.PIPE
@@ -113,11 +110,11 @@ class Nix:
     ]
 
     @classmethod
-    async def _run(cls, args: List[str]) -> Optional[str]:
+    async def _run(cls, args: list[str]) -> str | None:
         return await check_async(cls.base_cmd + args)
 
     @classmethod
-    async def eval(cls, expr: str) -> Union[List, Dict, int, float, str, bool]:
+    async def eval(cls, expr: str) -> list | dict | int | float | str | bool:
         response = await cls._run(["eval", "-f", f"{ROOT}/default.nix", "--json", expr])
         if response is None:
             raise RuntimeError("Nix eval expression returned no response")
@@ -127,15 +124,16 @@ class Nix:
             raise RuntimeError("Nix eval response could not be parsed from JSON")
 
 
-async def get_provider_manifests(version: str = "master") -> List:
+async def get_provider_manifests(version: str = "master") -> list:
     manifests = []
     with tempfile.TemporaryDirectory() as tmp:
-        with urlopen(
-            f"https://github.com/music-assistant/music-assistant/archive/refs/tags/{version}.tar.gz"
-        ) as response:
-            tarfile.open(fileobj=BytesIO(response.read())).extractall(
-                tmp, filter="data"
-            )
+        with (
+            urlopen(  # noqa: ASYNC210
+                f"https://github.com/music-assistant/music-assistant/archive/refs/tags/{version}.tar.gz"
+            ) as response,
+            tarfile.open(fileobj=BytesIO(response.read())) as tar,
+        ):
+            tar.extractall(tmp, filter="data")
 
         basedir = Path(os.path.join(tmp, f"server-{version}"))
         sys.path.append(str(basedir))
@@ -179,10 +177,12 @@ class NoMatch(Exception):
 
 
 def resolve_package_attribute(package: str) -> str:
-    pattern = re.compile(rf"^music-assistant\.pythonPackages\.{package}$", re.I)
+    pattern = re.compile(
+        rf"^music-assistant\.pythonPackages\.{package}$", re.IGNORECASE
+    )
     packages = packageset_attributes()
     matches = []
-    for attr in packages.keys():
+    for attr in packages:
         if pattern.match(attr):
             matches.append(attr.split(".")[-1])
 
@@ -215,7 +215,7 @@ class Provider:
         return hash(self.domain)
 
 
-async def resolve_providers(manifests) -> tuple[Set, Set]:
+async def resolve_providers(manifests) -> tuple[set, set]:
     errors = []
     providers = set()
     for manifest in manifests:
@@ -257,7 +257,7 @@ async def resolve_providers(manifests) -> tuple[Set, Set]:
     return providers, builtins
 
 
-def render(outpath: str, version: str, providers: Set, builtins: Set):
+def render(outpath: str, version: str, providers: set, builtins: set):
     env = Environment()
     template = env.from_string(TEMPLATE)
     template.stream(version=version, providers=providers, builtins=builtins).dump(
@@ -278,7 +278,7 @@ async def main():
 
 if __name__ == "__main__":
     run_sync(["pyright", __file__])
-    run_sync(["ruff", "check", "--ignore=E501", __file__])
+    run_sync(["ruff", "check", "--ignore=EXE005", __file__])
     run_sync(["isort", __file__])
     run_sync(["ruff", "format", __file__])
     asyncio.run(main())
diff --git a/pkgs/by-name/mu/musl/package.nix b/pkgs/by-name/mu/musl/package.nix
index 3df1b2289934..3cfdae35710a 100644
--- a/pkgs/by-name/mu/musl/package.nix
+++ b/pkgs/by-name/mu/musl/package.nix
@@ -174,7 +174,14 @@ stdenv.mkDerivation (finalAttrs: {
     install -D ${tree_h} $dev/include/sys/tree.h
   '';
 
-  passthru.linuxHeaders = linuxHeaders;
+  passthru = {
+    linuxHeaders = linuxHeaders;
+
+    # musl's threads are POSIX threads. `libgcc` and `libstdc++` have to be
+    # configured for the same threading model as each other, so rather than
+    # have each guess, they take it from the libc they are built against.
+    threadModel = "posix";
+  };
 
   meta = {
     description = "Efficient, small, quality libc implementation";
diff --git a/pkgs/by-name/mv/mvfst/glog-0.7.patch b/pkgs/by-name/mv/mvfst/glog-0.7.patch
deleted file mode 100644
index 0f72a615b98e..000000000000
--- a/pkgs/by-name/mv/mvfst/glog-0.7.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index a878c7c473..c76c989f91 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -52,7 +52,7 @@
- find_package(fmt REQUIRED)
- find_package(folly REQUIRED)
- find_package(Fizz REQUIRED)
--find_package(Glog REQUIRED)
-+find_package(Glog CONFIG REQUIRED)
- find_package(Threads)
- 
- SET(GFLAG_DEPENDENCIES "")
-diff --git a/cmake/QuicTest.cmake b/cmake/QuicTest.cmake
-index e7d9f0c0c3..5f4525189c 100644
---- a/cmake/QuicTest.cmake
-+++ b/cmake/QuicTest.cmake
-@@ -50,7 +50,7 @@
-   target_link_libraries(${QUIC_TEST_TARGET} PUBLIC
-     "${QUIC_TEST_DEPENDS}"
-     ${LIBGMOCK_LIBRARIES}
--    ${GLOG_LIBRARY}
-+    glog::glog
-   )
- 
-   # Per https://github.com/facebook/mvfst/pull/9, disable some warnings
diff --git a/pkgs/by-name/mv/mvfst/package.nix b/pkgs/by-name/mv/mvfst/package.nix
index faf37a234d90..ceea48d8cbba 100644
--- a/pkgs/by-name/mv/mvfst/package.nix
+++ b/pkgs/by-name/mv/mvfst/package.nix
@@ -10,6 +10,7 @@
   folly,
   gflags,
   glog,
+  openssl,
 
   fizz,
 
@@ -22,10 +23,9 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mvfst";
-  version = "2026.01.19.00";
+  version = "2026.07.27.00";
 
   outputs = [
-    "bin"
     "out"
     "dev"
   ];
@@ -34,13 +34,9 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "facebook";
     repo = "mvfst";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-K4rskeF66EHchsBj8wIP3BYBa7SvQ1ohnOV0HPu+y80=";
+    hash = "sha256-H5T039YtYWP01UFtg7Y/7uGt9jhYEa7Q7j/9JhhSDfw=";
   };
 
-  patches = [
-    ./glog-0.7.patch
-  ];
-
   nativeBuildInputs = [
     cmake
     ninja
@@ -50,6 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
     folly
     gflags
     glog
+    openssl
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/by-name/n8/n8n/package.nix b/pkgs/by-name/n8/n8n/package.nix
index 299785cffdf5..d6c170f661c4 100644
--- a/pkgs/by-name/n8/n8n/package.nix
+++ b/pkgs/by-name/n8/n8n/package.nix
@@ -27,20 +27,20 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "n8n";
-  version = "2.32.6";
+  version = "2.33.7";
 
   src = fetchFromGitHub {
     owner = "n8n-io";
     repo = "n8n";
     tag = "n8n@${finalAttrs.version}";
-    hash = "sha256-wWm6vGyJ2I2SBU38gRGaZG2FR5FBxH6V/sWQwn5B4Ac=";
+    hash = "sha256-6QysdmXgSxfJpNaL10HogrnNYEyrxZLdkfgBnRiXWX4=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_10;
     fetcherVersion = 4;
-    hash = "sha256-D8CKJxU2RoMjNrqIgGDE3mFBjc0kqFLQzT/DdUpiNmY=";
+    hash = "sha256-Ei/8j+KvhZVgqteA+bqNsL11IMGzWn3OHngDpsEH6jk=";
   };
 
   nativeBuildInputs = [
@@ -104,8 +104,12 @@ stdenv.mkDerivation (finalAttrs: {
     mkdir -p $out/{bin,lib/n8n}
     cp -r {packages,node_modules} $out/lib/n8n
 
+    # node must be on PATH: in internal runner mode the CLI spawns the
+    # JS task runner via `spawn('node', ...)`, and since 2.33 a failed
+    # spawn crashes n8n instead of being silently ignored
     makeWrapper $out/lib/n8n/packages/cli/bin/n8n $out/bin/n8n \
-      --set N8N_RELEASE_TYPE "stable"
+      --set N8N_RELEASE_TYPE "stable" \
+      --prefix PATH : ${lib.makeBinPath [ nodejs ]}
 
     # JavaScript runner
     makeWrapper ${nodejs}/bin/node $out/bin/n8n-task-runner \
diff --git a/pkgs/by-name/na/namespace-cli/package.nix b/pkgs/by-name/na/namespace-cli/package.nix
index 0829e6516e15..87c2d6288c16 100644
--- a/pkgs/by-name/na/namespace-cli/package.nix
+++ b/pkgs/by-name/na/namespace-cli/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "namespace-cli";
-  version = "0.0.551";
+  version = "0.0.556";
 
   src = fetchFromGitHub {
     owner = "namespacelabs";
     repo = "foundation";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-utBatGjHNLTT+hdYde5NIZmD7c+oS9zFl9dCyrtMx2s=";
+    hash = "sha256-Vq9aOhQKz2nyjy+zXnaUxGbTrPBmyWeR0n26kReRd3I=";
   };
 
-  vendorHash = "sha256-1MjkgJvn2u2zcO6lMAHdEbiGVp24D3Gv98GQZxGk27Y=";
+  vendorHash = "sha256-x4GWkINfOzcLFg7mCHG80Dpz7tkdcEDMj1oPAXM2n8w=";
 
   subPackages = [
     "cmd/nsc"
diff --git a/pkgs/by-name/na/nats-server/package.nix b/pkgs/by-name/na/nats-server/package.nix
index 31a5d4c09ad4..b008ceae3f7b 100644
--- a/pkgs/by-name/na/nats-server/package.nix
+++ b/pkgs/by-name/na/nats-server/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "nats-server";
-  version = "2.14.4";
+  version = "2.14.5";
 
   src = fetchFromGitHub {
     owner = "nats-io";
     repo = "nats-server";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Jbw+R1na8tjTLyKJC/KDPhA1G1jgNxMhC+xD38IWH2k=";
+    hash = "sha256-rsbvFUJcprWEZx0SPfIr+M0IyyCYbDncBLenOBniumM=";
   };
 
-  vendorHash = "sha256-Lmbacb85+hTe4QoeO72aPOytZQiMQCymOelmGwh0/2E=";
+  vendorHash = "sha256-VB4x100hSSsY6fqODuIefanzchOHlfyfJrNSJUea42U=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/nc/ncdu/package.nix b/pkgs/by-name/nc/ncdu/package.nix
index a6851492c9d5..a5e05e5ee732 100644
--- a/pkgs/by-name/nc/ncdu/package.nix
+++ b/pkgs/by-name/nc/ncdu/package.nix
@@ -69,7 +69,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     homepage = "https://github.com/BratishkaErik/ncdu";
     description = "Disk usage analyzer with an ncurses interface";
-    changelog = "https://github.com/BratishkaErik/ncdu/releases";
+    changelog = "https://github.com/BratishkaErik/ncdu/releases/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       pSub
diff --git a/pkgs/by-name/ne/nerva/package.nix b/pkgs/by-name/ne/nerva/package.nix
index 6062dd703e7e..25fd5eac38b4 100644
--- a/pkgs/by-name/ne/nerva/package.nix
+++ b/pkgs/by-name/ne/nerva/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "nerva";
-  version = "1.64.2";
+  version = "1.64.3";
 
   src = fetchFromGitHub {
     owner = "praetorian-inc";
     repo = "nerva";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vZ03tcYvo+0s/ix+TCLUm9xAyi22mYXYm/15IYMomtE=";
+    hash = "sha256-LqJrrZg/UyMqDYuESHqHR0jOAe7gmGKJToNUg/ABOcc=";
   };
 
   vendorHash = "sha256-Z0MSD+1/1VzrJ+pz5x0JvxrCxtJe59ckaTqHK/+TVN8=";
diff --git a/pkgs/by-name/ne/neural-amp-modeler-lv2/package.nix b/pkgs/by-name/ne/neural-amp-modeler-lv2/package.nix
index ee4e267442a0..3d9ad185c065 100644
--- a/pkgs/by-name/ne/neural-amp-modeler-lv2/package.nix
+++ b/pkgs/by-name/ne/neural-amp-modeler-lv2/package.nix
@@ -4,17 +4,16 @@
   fetchFromGitHub,
   cmake,
 }:
-
 stdenv.mkDerivation (finalAttrs: {
   pname = "neural-amp-modeler-lv2";
-  version = "0.1.4";
+  version = "0.2.3";
 
   src = fetchFromGitHub {
     owner = "mikeoliphant";
     repo = "neural-amp-modeler-lv2";
-    tag = finalAttrs.version;
+    tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-5BOZOocZWWSWawXJFMAgM0NR0s0CbkzDVr6fnvZMvd0=";
+    hash = "sha256-TkynGmhwnkTqieJNuC+H2rDgxYZ9IFvqukfmtbSj790=";
   };
 
   nativeBuildInputs = [
@@ -22,7 +21,10 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   meta = {
-    maintainers = [ lib.maintainers.viraptor ];
+    maintainers = [
+      lib.maintainers.viraptor
+      lib.maintainers.gabyx
+    ];
     description = "Neural Amp Modeler LV2 plugin implementation";
     homepage = finalAttrs.src.meta.homepage;
     license = lib.licenses.gpl3;
diff --git a/pkgs/by-name/ni/nitter/package.nix b/pkgs/by-name/ni/nitter/package.nix
index 07f8a4888d06..2da1b0e2222c 100644
--- a/pkgs/by-name/ni/nitter/package.nix
+++ b/pkgs/by-name/ni/nitter/package.nix
@@ -10,13 +10,13 @@
 buildNimPackage (
   finalAttrs: prevAttrs: {
     pname = "nitter";
-    version = "0-unstable-2026-06-16";
+    version = "0-unstable-2026-07-11";
 
     src = fetchFromGitHub {
       owner = "zedeus";
       repo = "nitter";
-      rev = "35882ed88d422b1355b66a1ff8c1144bffdc7bdf";
-      hash = "sha256-U3FDhTZIcTDNKbSjrb0F9+Y5Q6GHLmGnmwXoZ5XfATc=";
+      rev = "3bc78801b39f0a98f1a424da3f60c4aa60c7025a";
+      hash = "sha256-v+1IkabSbSOf05eAAcw0bPqaujbLtsnDhQZOR1lHAyg=";
     };
 
     lockFile = ./lock.json;
diff --git a/pkgs/by-name/ni/nix-direnv/package.nix b/pkgs/by-name/ni/nix-direnv/package.nix
index 98861db15dda..a52ca907e8f4 100644
--- a/pkgs/by-name/ni/nix-direnv/package.nix
+++ b/pkgs/by-name/ni/nix-direnv/package.nix
@@ -14,7 +14,7 @@ resholve.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "nix-direnv";
-    rev = finalAttrs.version;
+    tag = finalAttrs.version;
     hash = "sha256-dNJeSRuuqA2avtLpTse7mTTmnYdVnC5BxRsofuLXiqE=";
   };
 
@@ -68,6 +68,7 @@ resholve.mkDerivation (finalAttrs: {
   meta = {
     description = "Fast, persistent use_nix implementation for direnv";
     homepage = "https://github.com/nix-community/nix-direnv";
+    changelog = "https://github.com/nix-community/nix-direnv/releases/${finalAttrs.version}";
     license = lib.licenses.mit;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [
diff --git a/pkgs/by-name/no/notepad-next/package.nix b/pkgs/by-name/no/notepad-next/package.nix
index a2892e3bec4e..7dff6f6b78ac 100644
--- a/pkgs/by-name/no/notepad-next/package.nix
+++ b/pkgs/by-name/no/notepad-next/package.nix
@@ -115,7 +115,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = licenses.gpl3Plus;
     platforms = platforms.unix;
     maintainers = with lib.maintainers; [ Holiu618 ];
-    broken = stdenv.hostPlatform.isAarch64;
     mainProgram = "NotepadNext";
   };
 })
diff --git a/pkgs/by-name/nu/nullmailer/package.nix b/pkgs/by-name/nu/nullmailer/package.nix
index 08a6333df655..563366d72112 100644
--- a/pkgs/by-name/nu/nullmailer/package.nix
+++ b/pkgs/by-name/nu/nullmailer/package.nix
@@ -4,6 +4,7 @@
   lib,
   tls ? true,
   gnutls,
+  nixosTests,
 }:
 
 gccStdenv.mkDerivation (finalAttrs: {
@@ -42,6 +43,8 @@ gccStdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
+  passthru.tests.nixos = nixosTests.nullmailer;
+
   meta = {
     homepage = "http://untroubled.org/nullmailer/";
     description = ''
diff --git a/pkgs/by-name/nu/nusmv/package.nix b/pkgs/by-name/nu/nusmv/package.nix
index f56d1d41aed7..b892a44c51f0 100644
--- a/pkgs/by-name/nu/nusmv/package.nix
+++ b/pkgs/by-name/nu/nusmv/package.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation (finalAttrs: {
   version = "2.7.0";
 
   src =
-    with stdenv;
+    with stdenv.hostPlatform;
     fetchurl (
       if isx86_64 && isLinux then
         {
diff --git a/pkgs/by-name/nv/nvidia-mig-parted/package.nix b/pkgs/by-name/nv/nvidia-mig-parted/package.nix
index 7be5061d3cac..6502e7ca6eb3 100644
--- a/pkgs/by-name/nv/nvidia-mig-parted/package.nix
+++ b/pkgs/by-name/nv/nvidia-mig-parted/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "nvidia-mig-parted";
-  version = "0.14.4";
+  version = "0.14.5";
 
   src = fetchFromGitHub {
     owner = "NVIDIA";
     repo = "mig-parted";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-iizYj7JEfBiGfSuuysAIWA2EujxoKclsHho8EHUmuFc=";
+    hash = "sha256-2e5bUQKQmZKVTePu8uoFl91rMgrAc2ikYH112OOnUrE=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/on/onnxruntime/package.nix b/pkgs/by-name/on/onnxruntime/package.nix
index ef4d70237ce0..fd4edb828952 100644
--- a/pkgs/by-name/on/onnxruntime/package.nix
+++ b/pkgs/by-name/on/onnxruntime/package.nix
@@ -25,7 +25,7 @@
   pythonSupport ? (stdenv.buildPlatform.canExecute stdenv.hostPlatform),
   cudaSupport ? config.cudaSupport,
   ncclSupport ? cudaSupport && cudaPackages.nccl.meta.available,
-  openvinoSupport ? stdenv.isLinux,
+  openvinoSupport ? stdenv.hostPlatform.isLinux,
   rocmSupport ? config.rocmSupport,
   coremlSupport ? stdenv.hostPlatform.isDarwin,
   withFullProtobuf ? false,
diff --git a/pkgs/by-name/op/open-policy-agent/package.nix b/pkgs/by-name/op/open-policy-agent/package.nix
index 13e3b8758f3b..2c01ed3a1b14 100644
--- a/pkgs/by-name/op/open-policy-agent/package.nix
+++ b/pkgs/by-name/op/open-policy-agent/package.nix
@@ -16,6 +16,9 @@ buildGoModule (finalAttrs: {
   pname = "open-policy-agent";
   version = "1.16.2";
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   src = fetchFromGitHub {
     owner = "open-policy-agent";
     repo = "opa";
@@ -68,6 +71,19 @@ buildGoModule (finalAttrs: {
         "TestClientTLSWithCustomCACert"
         "TestECR"
         "TestManagerWithOPATelemetryUpdateLoop"
+
+        # tests observed to have `no space left on device` failures on darwin on hydra
+        # storage_internal_error:
+        #   cannot create memtable error:
+        #     newMemTable error:
+        #       While opening memtable: /private/tmp/nix-build-open-policy-agent-X.Y.Z.drv-0/opa_test0000000000/data/00001.mem error:
+        #         while opening file: /private/tmp/nix-build-open-policy-agent-X.Y.Z.drv-0/opa_test0000000000/data/00001.mem error:
+        #           truncate /private/tmp/nix-build-open-policy-agent-X.Y.Z.drv-0/opa_test0000000000/data/00001.mem: no space left on device
+        "TestBundleScope"
+        "TestDataV1"
+        "TestDataV1Metrics"
+        "TestDataMetricsEval"
+        "TestQueryV1"
       ]
       ++ lib.optionals (!enableWasmEval) [
         "TestRegoTargetWasmAndTargetPluginDisablesIndexingTopdownStages"
@@ -84,11 +100,6 @@ buildGoModule (finalAttrs: {
       getGoDirs() {
         go list ./... | grep -v -e e2e ${lib.optionalString stdenv.hostPlatform.isDarwin "-e wasm"}
       }
-    ''
-    # remove tests that have "too many open files"/"no space left on device" issues on darwin in hydra
-    + lib.optionalString stdenv.hostPlatform.isDarwin ''
-      rm v1/server/server_test.go
-      rm v1/server/server_bench_test.go
     '';
 
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
diff --git a/pkgs/by-name/op/opencloud/idp-web.nix b/pkgs/by-name/op/opencloud/idp-web.nix
index 46e322e7424f..d2dd3553de39 100644
--- a/pkgs/by-name/op/opencloud/idp-web.nix
+++ b/pkgs/by-name/op/opencloud/idp-web.nix
@@ -20,7 +20,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     pnpm = pnpm_11;
     sourceRoot = "${finalAttrs.src.name}/${finalAttrs.pnpmRoot}";
     fetcherVersion = 4;
-    hash = "sha256-buDYvRw4NTLxFSdDRZHiuXMVe9fJbe2iu5hr+zh6KLs=";
+    hash = "sha256-rj6KFrzuINVpxrrel2p2iWtJVH8Zg1jrZEIAs8S+8Qs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/op/opencloud/package.nix b/pkgs/by-name/op/opencloud/package.nix
index 6f9b665171fd..6d60fad24ad3 100644
--- a/pkgs/by-name/op/opencloud/package.nix
+++ b/pkgs/by-name/op/opencloud/package.nix
@@ -28,13 +28,13 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "opencloud";
-  version = "7.3.0";
+  version = "7.4.0";
 
   src = fetchFromGitHub {
     owner = "opencloud-eu";
     repo = "opencloud";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2YwDH4qD4PCbfi/nNGPqwtJIpf8MPMGrVRslNWOoDPM=";
+    hash = "sha256-/j3aXAzsIWPHNIRcHLlbi6Y53be5d5GBqrVIZCk0bEw=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/op/opencloud/web.nix b/pkgs/by-name/op/opencloud/web.nix
index 13e0d4a25879..5ad4db8f03a5 100644
--- a/pkgs/by-name/op/opencloud/web.nix
+++ b/pkgs/by-name/op/opencloud/web.nix
@@ -10,20 +10,20 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "opencloud-web";
-  version = "7.2.0";
+  version = "7.3.0";
 
   src = fetchFromGitHub {
     owner = "opencloud-eu";
     repo = "web";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BiOue8+zQ3+6RLiDbLMnxKEen2aav3bljji4d+0Hr5c=";
+    hash = "sha256-v1VmX3q2YQUd3PvRVVEvDvpsgVcNklflXRXRvtHOuCU=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_11;
     fetcherVersion = 4;
-    hash = "sha256-gCsgnOEi9rvtwTZy8J/i63D92Gl2V9ZihxCJ+Y5hLUE=";
+    hash = "sha256-Y/Xz62ZS7pU6WB3dxewfhNI4POW/r/DGodpEy+xw/ww=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/op/opencode-desktop/package.nix b/pkgs/by-name/op/opencode-desktop/package.nix
index 163b423fd8f8..3957ef7939fa 100644
--- a/pkgs/by-name/op/opencode-desktop/package.nix
+++ b/pkgs/by-name/op/opencode-desktop/package.nix
@@ -28,6 +28,28 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     patches
     ;
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  # The musl prebuilts ship libc.musl-*.so.1 SONAMEs that autoPatchelfHook can't
+  # resolve on glibc systems. They aren't loaded at runtime on the host libc anyway.
+  autoPatchelfIgnoreMissingDeps = [ "libc.musl-*.so.*" ];
+
+  postPatch =
+    # The auto-updater would try to download and run an upstream binary that
+    # isn't patched for Nix. Disable it at source.
+    ''
+      substituteInPlace packages/desktop/src/main/constants.ts \
+        --replace-fail 'app.isPackaged && CHANNEL !== "dev"' 'false'
+    ''
+    +
+    # Relax Bun version check to be a warning instead of an error
+    ''
+      substituteInPlace packages/script/src/index.ts \
+        --replace-fail 'throw new Error(`This script requires bun@''${expectedBunVersionRange}' \
+                       'console.warn(`Warning: This script requires bun@''${expectedBunVersionRange}'
+    '';
+
   nativeBuildInputs = [
     bun
     nodejs # for patchShebangs node_modules
@@ -43,13 +65,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     (lib.getLib stdenv.cc.cc)
   ];
 
-  # The musl prebuilts ship libc.musl-*.so.1 SONAMEs that autoPatchelfHook can't
-  # resolve on glibc systems. They aren't loaded at runtime on the host libc anyway.
-  autoPatchelfIgnoreMissingDeps = [ "libc.musl-*.so.*" ];
-
-  __structuredAttrs = true;
-  strictDeps = true;
-
   env = {
     ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
     NODE_OPTIONS = "--max-old-space-size=4096";
@@ -58,18 +73,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     OPENCODE_DISABLE_MODELS_FETCH = true;
   };
 
-  postPatch = ''
-    # The auto-updater would try to download and run an upstream binary that
-    # isn't patched for Nix. Disable it at source.
-    substituteInPlace packages/desktop/src/main/constants.ts \
-      --replace-fail 'app.isPackaged && CHANNEL !== "dev"' 'false'
-
-    # Relax Bun version check to be a warning instead of an error
-    substituteInPlace packages/script/src/index.ts \
-      --replace-fail 'throw new Error(`This script requires bun@''${expectedBunVersionRange}' \
-                     'console.warn(`Warning: This script requires bun@''${expectedBunVersionRange}'
-  '';
-
   configurePhase = ''
     runHook preConfigure
 
diff --git a/pkgs/by-name/op/opencode/package.nix b/pkgs/by-name/op/opencode/package.nix
index 55967add1ab0..cf2499df56b4 100644
--- a/pkgs/by-name/op/opencode/package.nix
+++ b/pkgs/by-name/op/opencode/package.nix
@@ -21,6 +21,9 @@ let
       pname = "${finalAttrs.pname}-node_modules";
       inherit (finalAttrs) version src;
 
+      __structuredAttrs = true;
+      strictDeps = true;
+
       impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [
         "GIT_PROXY_COMMAND"
         "SOCKS_SERVER"
@@ -74,14 +77,14 @@ let
       # NOTE: Required else we get errors that our fixed-output derivation references store paths
       dontFixup = true;
 
-      outputHash = "sha256-GBLs3nXtfSeXb4jXxSNM8ElMa/e/EB4sZn3c2inHnco=";
+      outputHash = "sha256-oU7qWOsY2TtVE+Gp2DhSXffm9OghTHcNhzDwwAovwZI=";
       outputHashAlgo = "sha256";
       outputHashMode = "recursive";
     };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "opencode";
-  version = "1.18.16";
+  version = "1.18.18";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -90,7 +93,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "anomalyco";
     repo = "opencode";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-AP2W443Zk/X8j6BWfMgAEbR4BQiJgnPpr1OG6JWIprE=";
+    hash = "sha256-rDVcv8j9KghTDwooPYriTloOMgTyVutud7xKLG2mTmk=";
   };
 
   postPatch =
diff --git a/pkgs/by-name/op/openfga/package.nix b/pkgs/by-name/op/openfga/package.nix
index e1db8c7a871f..63b961c4f85a 100644
--- a/pkgs/by-name/op/openfga/package.nix
+++ b/pkgs/by-name/op/openfga/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "openfga";
-  version = "1.18.2";
+  version = "1.18.3";
 
   src = fetchFromGitHub {
     owner = "openfga";
     repo = "openfga";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-lmTrAED94yXrdlhQu6BUdsEicMhkgBzReBx5/X36k+M=";
+    hash = "sha256-iqxoUU5mMh4HntDeOvS5F45C7TB9pNHRB9W6Ki5zbEs=";
   };
 
   vendorHash = "sha256-lB6DoULR0zTOcdVAQUNIH0Rwa6mPWh7y7erClmk0mws=";
diff --git a/pkgs/by-name/op/opengist/package.nix b/pkgs/by-name/op/opengist/package.nix
index b7a90e7cccdd..733ba7609610 100644
--- a/pkgs/by-name/op/opengist/package.nix
+++ b/pkgs/by-name/op/opengist/package.nix
@@ -13,13 +13,13 @@
 buildGoModule (finalAttrs: {
   pname = "opengist";
 
-  version = "1.15.0";
+  version = "1.15.1";
 
   src = fetchFromGitHub {
     owner = "thomiceli";
     repo = "opengist";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yE9HvRFEQzv3Fhhbs9hXeLc4vudCMi+NMA2T8YUlREw=";
+    hash = "sha256-BOqAmQsT8MtohE/1k2YaNZv8cmruWzLur+yyNs3ARcQ=";
   };
 
   frontend = buildNpmPackage {
diff --git a/pkgs/by-name/op/openlinkhub/package.nix b/pkgs/by-name/op/openlinkhub/package.nix
index d056564f6c43..7330c386cb13 100644
--- a/pkgs/by-name/op/openlinkhub/package.nix
+++ b/pkgs/by-name/op/openlinkhub/package.nix
@@ -11,17 +11,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "openlinkhub";
-  version = "0.8.9";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "jurkovic-nikola";
     repo = "OpenLinkHub";
     tag = finalAttrs.version;
-    hash = "sha256-g8ZdiBaEelS+LhnOA23mMR+irN1wKD6Rp66sCnSD2tU=";
+    hash = "sha256-VGrLQmg+ze60LRVmzeN8y8W8ZQt1Zxk8iENOsxNaOZ4=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-/itomxsbTDT7ML52bpUfDZIBZ/Rh/zx4Blg+PP7m7gE=";
+  vendorHash = "sha256-d0tA2XVDF/PzmBKqBSjfKJ3C3Lt0gMi3i2bx5LKRgj8=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/op/openmolcas/package.nix b/pkgs/by-name/op/openmolcas/package.nix
index 8c40ec27fe9d..b1a12bd32d0c 100644
--- a/pkgs/by-name/op/openmolcas/package.nix
+++ b/pkgs/by-name/op/openmolcas/package.nix
@@ -16,6 +16,7 @@
   makeWrapper,
   gsl,
   boost188,
+  libwignernj,
   autoPatchelfHook,
   enableQcmaquis ? true,
   # Note that the CASPT2 module is broken with MPI
@@ -65,13 +66,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "openmolcas";
-  version = "26.02";
+  version = "26.06";
 
   src = fetchFromGitLab {
     owner = "Molcas";
     repo = "OpenMolcas";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-FzO1fvMw+/r6SKiaODlhkmKlbzQ9TXLYXk+xpz/fs2I=";
+    hash = "sha256-y4eUfp8PIeWSuF4j9wT6C8z8rYFySUrNMa4ezI3/kXg=";
   };
 
   patches = [
@@ -110,6 +111,7 @@ stdenv.mkDerivation (finalAttrs: {
     boost
     blas-ilp64
     lapack-ilp64
+    libwignernj
   ]
   ++ lib.optionals enableMpi [
     mpi
diff --git a/pkgs/by-name/op/openttd-jgrpp/package.nix b/pkgs/by-name/op/openttd-jgrpp/package.nix
index 61783b73c081..e853251532dc 100644
--- a/pkgs/by-name/op/openttd-jgrpp/package.nix
+++ b/pkgs/by-name/op/openttd-jgrpp/package.nix
@@ -7,13 +7,13 @@
 
 openttd.overrideAttrs (oldAttrs: rec {
   pname = "openttd-jgrpp";
-  version = "0.73.0";
+  version = "0.73.1";
 
   src = fetchFromGitHub {
     owner = "JGRennison";
     repo = "OpenTTD-patches";
     rev = "jgrpp-${version}";
-    hash = "sha256-eFUKJSpHLhyGXvKo/uSB01+5nGv5Y7yUTIU3U81Qx5U=";
+    hash = "sha256-L99u4J/yiaQB2TTP63gIX6N4OrVOuM4/1bpLkCzVvXU=";
   };
   patches = [ ];
 
diff --git a/pkgs/by-name/op/openvox/package.nix b/pkgs/by-name/op/openvox/package.nix
index df8f579f1574..503a54d8da7f 100644
--- a/pkgs/by-name/op/openvox/package.nix
+++ b/pkgs/by-name/op/openvox/package.nix
@@ -6,7 +6,8 @@
   ruby_3_4,
   testers,
 }:
-((bundlerApp.override { ruby = ruby_3_4; }) {
+
+(bundlerApp.override { ruby = ruby_3_4; }) {
   pname = "openvox";
   gemdir = ./.;
   exes = [ "puppet" ];
@@ -28,11 +29,4 @@
     mainProgram = "puppet";
     maintainers = with lib.maintainers; [ skyethepinkcat ];
   };
-}).overrideAttrs
-  # Workaround `bundlerApp` not specifying `__structuredAttrs = true` and `strictDeps = true` for its result package.
-  {
-    # TODO(@ShamrockLee, @skyethepinkcat): Revert/remove after PR #539303 lands on the master branch.
-    __structuredAttrs = true;
-    # TODO(@ShamrockLee, @skyethepinkcat): Revert/remove after PR #540069 lands on the master branch.
-    strictDeps = true;
-  }
+}
diff --git a/pkgs/by-name/op/openwith/package.nix b/pkgs/by-name/op/openwith/package.nix
deleted file mode 100644
index 7ff5bc4c8d82..000000000000
--- a/pkgs/by-name/op/openwith/package.nix
+++ /dev/null
@@ -1,41 +0,0 @@
-{
-  lib,
-  swiftPackages,
-  fetchFromGitHub,
-}:
-
-let
-  inherit (swiftPackages) stdenv swift;
-  inherit (stdenv.hostPlatform) darwinArch;
-in
-stdenv.mkDerivation {
-  pname = "openwith";
-  version = "unstable-2022-10-28";
-
-  src = fetchFromGitHub {
-    owner = "jdek";
-    repo = "openwith";
-    rev = "a8a99ba0d1cabee7cb470994a1e2507385c30b6e";
-    hash = "sha256-lysleg3qM2MndXeKjNk+Y9Tkk40urXA2ZdxY5KZNANo=";
-  };
-
-  nativeBuildInputs = [ swift ];
-
-  makeFlags = [ "openwith_${darwinArch}" ];
-
-  installPhase = ''
-    runHook preInstall
-    install openwith_${darwinArch} -D $out/bin/openwith
-    runHook postInstall
-  '';
-
-  meta = {
-    description = "Utility to specify which application bundle should open specific file extensions";
-    homepage = "https://github.com/jdek/openwith";
-    license = lib.licenses.unlicense;
-    maintainers = with lib.maintainers; [ zowoq ];
-    platforms = [
-      "aarch64-darwin"
-    ];
-  };
-}
diff --git a/pkgs/by-name/or/orca/fix-mock-typing.patch b/pkgs/by-name/or/orca/fix-mock-typing.patch
new file mode 100644
index 000000000000..87a63ece07af
--- /dev/null
+++ b/pkgs/by-name/or/orca/fix-mock-typing.patch
@@ -0,0 +1,64 @@
+diff --git a/tests/unit_tests/test_dbus_service.py b/tests/unit_tests/test_dbus_service.py
+index bf8cab8a7..0db3afd60 100644
+--- a/tests/unit_tests/test_dbus_service.py
++++ b/tests/unit_tests/test_dbus_service.py
+@@ -59,6 +59,7 @@ class TestDBusService:
+         external_modules = [
+             "gi",
+             "gi.repository",
++            "gi.repository.Atspi",
+             "dasbus",
+             "dasbus.connection",
+             "dasbus.error",
+@@ -96,8 +97,16 @@ class TestDBusService:
+                 """Unpack the variant value."""
+                 return self._value
+ 
+-        essential_modules["gi.repository"].GLib = test_context.Mock()
+-        essential_modules["gi.repository"].GLib.Variant = MockGLibVariant
++        gi_repository_mock = essential_modules["gi.repository"]
++        gi_repository_mock.GLib = test_context.Mock()
++        gi_repository_mock.GLib.Variant = MockGLibVariant
++
++        class Fake():
++            pass
++
++        atspi_mock = essential_modules["gi.repository.Atspi"]
++        atspi_mock.Accessible = Fake
++        gi_repository_mock.Atspi = atspi_mock
+ 
+         class MockPublishable:
+             """Mock Publishable base class for inheritance."""
+
+
+Taken from https://gitlab.gnome.org/GNOME/orca/-/commit/20340d2075a34721aa6af46507d02525f3eac5f5
+
+diff --git a/src/orca/ax_utilities_application.py b/src/orca/ax_utilities_application.py
+index 2edcabf11..d59b8ae9e 100644
+--- a/src/orca/ax_utilities_application.py
++++ b/src/orca/ax_utilities_application.py
+@@ -21,6 +21,7 @@
+ 
+ """Utilities for accessible applications."""
+ 
++from __future__ import annotations
+ import gi
+ 
+ gi.require_version("Atspi", "2.0")
+
+
+Taken from https://gitlab.gnome.org/GNOME/orca/-/commit/6c18ba002c6fac3fb80a10791b0daab6ea85f072
+
+diff --git a/src/orca/ax_event_synthesizer.py b/src/orca/ax_event_synthesizer.py
+index 4b999ef75..cb0f0e31a 100644
+--- a/src/orca/ax_event_synthesizer.py
++++ b/src/orca/ax_event_synthesizer.py
+@@ -22,6 +22,8 @@
+ 
+ """Provides support for synthesizing accessible input events."""
+ 
++from __future__ import annotations
++
+ import gi
+ 
+ gi.require_version("Atspi", "2.0")
diff --git a/pkgs/by-name/or/orca/fix-paths.patch b/pkgs/by-name/or/orca/fix-paths.patch
index 1268f032d576..1e7fc2a4a00a 100644
--- a/pkgs/by-name/or/orca/fix-paths.patch
+++ b/pkgs/by-name/or/orca/fix-paths.patch
@@ -1,70 +1,75 @@
-diff --git a/src/orca/ax_utilities_application.py b/src/orca/ax_utilities_application.py
-index 218c7bf22..4474f26cd 100644
---- a/src/orca/ax_utilities_application.py
-+++ b/src/orca/ax_utilities_application.py
-@@ -180,7 +180,7 @@ class AXUtilitiesApplication:
- 
-         pid = AXUtilitiesApplication.get_process_id(app)
-         try:
--            state = subprocess.getoutput(f"cat /proc/{pid}/status | grep State")
-+            state = subprocess.getoutput(f"@cat@ /proc/{pid}/status | @grep@ State")
-             state = state.split()[1]
-         except (GLib.GError, IndexError) as error:
-             tokens = [f"AXUtilitiesApplication: Exception checking state of pid {pid}: {error}"]
-diff --git a/src/orca/debugging_tools_manager.py b/src/orca/debugging_tools_manager.py
-index 5c607f3cd..18ddcd920 100644
---- a/src/orca/debugging_tools_manager.py
-+++ b/src/orca/debugging_tools_manager.py
-@@ -169,7 +169,7 @@ class DebuggingToolsManager:
-             else:
-                 name = AXObject.get_name(app) or "[DEAD]"
-             try:
--                cmdline = subprocess.getoutput(f"cat /proc/{pid}/cmdline")
-+                cmdline = subprocess.getoutput(f"@cat@ /proc/{pid}/cmdline")
-             except subprocess.SubprocessError as error:
-                 cmdline = f"EXCEPTION: {error}"
-             else:
 diff --git a/src/orca/orca_bin.py.in b/src/orca/orca_bin.py.in
-index 86a1413ca..f272c431d 100755
+index be3d4ebdd..1f83d6d6c 100755
 --- a/src/orca/orca_bin.py.in
 +++ b/src/orca/orca_bin.py.in
-@@ -211,7 +211,7 @@ def in_graphical_desktop() -> bool:
- def other_orcas() -> list[int]:
+@@ -209,7 +209,7 @@ def other_orcas() -> list[int]:
      """Returns the pid of any other instances of Orca owned by this user."""
  
--    with subprocess.Popen(f"pgrep -u {os.getuid()} -x orca",
-+    with subprocess.Popen(f"@pgrep@ -u {os.getuid()} -x orca",
-                           shell=True,
-                           stdout=subprocess.PIPE) as proc:
+     with subprocess.Popen(
+-        ["pgrep", "-u", str(os.getuid()), "-x", "orca"],
++        ["@pgrep@", "-u", str(os.getuid()), "-x", "orca"],
+         stdout=subprocess.PIPE,
+     ) as proc:
          pids = proc.stdout.read() if proc.stdout else b""
 diff --git a/src/orca/orca_modifier_manager.py b/src/orca/orca_modifier_manager.py
-index d1d95f5b9..e57993521 100644
+index eec1edc5f..e4ceee004 100644
 --- a/src/orca/orca_modifier_manager.py
 +++ b/src/orca/orca_modifier_manager.py
 @@ -289,7 +289,7 @@ class OrcaModifierManager:
  
          self._restore_original_xkbcomp()
-         with subprocess.Popen(
--            ["xkbcomp", display, "-"],
-+            ["@xkbcomp@", display, "-"],
+         with subprocess.Popen(  # noqa: S603 - xkbcomp is a system dependency, not untrusted input
+-            ["xkbcomp", display, "-"],  # noqa: S607 - full path would break across distros
++            ["@xkbcomp@", display, "-"],  # noqa: S607 - full path would break across distros
              stdout=subprocess.PIPE,
              stderr=subprocess.DEVNULL,
          ) as p:
 @@ -338,7 +338,7 @@ class OrcaModifierManager:
  
          self._caps_lock_cleared = False
-         with subprocess.Popen(
--            ["xkbcomp", "-w0", "-", display],
-+            ["@xkbcomp@", "-w0", "-", display],
+         with subprocess.Popen(  # noqa: S603 - xkbcomp is a system dependency, not untrusted input
+-            ["xkbcomp", "-w0", "-", display],  # noqa: S607 - full path would break across distros
++            ["@xkbcomp@", "-w0", "-", display],  # noqa: S607 - full path would break across distros
              stdin=subprocess.PIPE,
              stdout=None,
              stderr=None,
 @@ -449,7 +449,7 @@ class OrcaModifierManager:
          debug.print_message(debug.LEVEL_INFO, msg, True)
  
-         with subprocess.Popen(
--            ["xkbcomp", "-w0", "-", display],
-+            ["@xkbcomp@", "-w0", "-", display],
+         with subprocess.Popen(  # noqa: S603 - xkbcomp is a system dependency, not untrusted input
+-            ["xkbcomp", "-w0", "-", display],  # noqa: S607 - full path would break across distros
++            ["@xkbcomp@", "-w0", "-", display],  # noqa: S607 - full path would break across distros
              stdin=subprocess.PIPE,
              stdout=None,
              stderr=None,
+diff --git a/tests/unit_tests/test_orca_modifier_manager.py b/tests/unit_tests/test_orca_modifier_manager.py
+index 3c6c917cb..5d714f2a5 100644
+--- a/tests/unit_tests/test_orca_modifier_manager.py
++++ b/tests/unit_tests/test_orca_modifier_manager.py
+@@ -700,7 +700,7 @@ class TestOrcaModifierManager:
+         manager.refresh_orca_modifiers("test reason")
+         mock_restore.assert_called_once()
+         mock_popen.assert_called_once_with(
+-            ["xkbcomp", ":0", "-"],
++            ["@xkbcomp@", ":0", "-"],
+             stdout=subprocess.PIPE,
+             stderr=subprocess.DEVNULL,
+         )
+@@ -808,7 +808,7 @@ class TestOrcaModifierManager:
+         mock_unmap.assert_called_once()
+         if expects_popen_call:
+             mock_popen.assert_called_once_with(
+-                ["xkbcomp", "-w0", "-", ":0"],
++                ["@xkbcomp@", "-w0", "-", ":0"],
+                 stdin=subprocess.PIPE,
+                 stdout=None,
+                 stderr=None,
+@@ -880,7 +880,7 @@ class TestOrcaModifierManager:
+ 
+         if expects_popen_call:
+             mock_popen.assert_called_once_with(
+-                ["xkbcomp", "-w0", "-", ":0"],
++                ["@xkbcomp@", "-w0", "-", ":0"],
+                 stdin=subprocess.PIPE,
+                 stdout=None,
+                 stderr=None,
diff --git a/pkgs/by-name/or/orca/package.nix b/pkgs/by-name/or/orca/package.nix
index 18619dbcbd97..4b738cb46d0d 100644
--- a/pkgs/by-name/or/orca/package.nix
+++ b/pkgs/by-name/or/orca/package.nix
@@ -4,6 +4,7 @@
   buildPackages,
   pkg-config,
   fetchurl,
+  fetchpatch,
   meson,
   ninja,
   wrapGAppsHook3,
@@ -20,8 +21,6 @@
   dbus,
   xkbcomp,
   procps,
-  gnugrep,
-  coreutils,
   gsettings-desktop-schemas,
   speechd-minimal,
   brltty,
@@ -41,9 +40,46 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
   };
 
   patches = [
+    # Avoid running `cat` and `grep` subshells.
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/orca/-/commit/8f47283da2da7a7d34e769d9c129152decf632cb.patch";
+      hash = "sha256-ts/ZCgEaTrnmMM1cUFJB2rDW9icMoi4jV34psD0IDCc=";
+    })
+
+    # Required for fix-paths.patch to apply.
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/orca/-/commit/a7b10302b9ff9145a98cb3626f2488d15c558d3e.patch";
+      hash = "sha256-lacy9vIyM3n84s+tbYvAUBKWCT+4nlI9uPVl7UPVS74=";
+      includes = [
+        "src/orca/orca_modifier_manager.py"
+      ];
+    })
+
+    # Fix tests on Python < 3.15
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/orca/-/commit/6c18ba002c6fac3fb80a10791b0daab6ea85f072.patch";
+      hash = "sha256-jTwVN0hPkead7PiVo/KEUrP04XU/05LXnXutvVmyecc=";
+      excludes = [
+        # These do not apply, fixed in fix-mock-typing.patch
+        "src/orca/ax_event_synthesizer.py"
+        "tests/unit_tests/test_flat_review_presenter.py"
+      ];
+    })
+
+    # Fix more tests on Python < 3.15
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/orca/-/commit/0a1271f0d6ed6f6d73d41b227a9f6d84d994c154.patch";
+      hash = "sha256-ry8fmzUjtHR8/0UpB/zXuv6RYDS8z6fWRdb9eci6nLY=";
+      includes = [
+        "src/orca/sound.py"
+      ];
+    })
+
+    # Fix more tests on Python < 3.15
+    # https://gitlab.gnome.org/GNOME/orca/-/work_items/729
+    ./fix-mock-typing.patch
+
     (replaceVars ./fix-paths.patch {
-      cat = "${coreutils}/bin/cat";
-      grep = "${gnugrep}/bin/grep";
       pgrep = "${procps}/bin/pgrep";
       xkbcomp = "${xkbcomp}/bin/xkbcomp";
     })
@@ -71,7 +107,6 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
   pythonPath = with python3.pkgs; [
     dasbus
     pygobject3
-    dbus-python
     pyxdg
     brltty
     liblouis
@@ -79,6 +114,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     speechd-minimal
     gst-python
     setproctitle
+    at-spi2-core
   ];
 
   strictDeps = false;
@@ -95,11 +131,32 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     gst_all_1.gst-plugins-good
   ];
 
+  nativeCheckInputs = with python3.pkgs; [
+    pytest
+  ];
+
+  checkInputs = with python3.pkgs; [
+    pytest-mock
+  ];
+
+  postPatch = ''
+    # Disable broken tests
+    substituteInPlace tests/meson.build \
+      --replace-fail "  'unit_tests/test_preferences_grid_base.py'," "" \
+      --replace-fail "  'unit_tests/test_braille_presenter.py'," "" \
+      --replace-fail "  'unit_tests/test_profile_manager.py'," ""
+  '';
+
   # Help GI find typelibs during Meson's configure step in cross builds
   preConfigure = lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
     export GI_TYPELIB_PATH=${buildPackages.gtk3}/lib/girepository-1.0''${GI_TYPELIB_PATH:+:$GI_TYPELIB_PATH}
   '';
 
+  # `buildPythonPackage` uses `installCheckPhase` and leaves `checkPhase`
+  # empty. It renames `doCheck` from its arguments, but not `checkPhase`.
+  # See: https://github.com/NixOS/nixpkgs/issues/47390
+  installCheckPhase = "mesonCheckPhase";
+
   dontWrapGApps = true; # Prevent double wrapping
 
   preFixup = ''
diff --git a/pkgs/by-name/os/oscavmgr/package.nix b/pkgs/by-name/os/oscavmgr/package.nix
index c09dad7fd7a5..e1eac94f45a2 100644
--- a/pkgs/by-name/os/oscavmgr/package.nix
+++ b/pkgs/by-name/os/oscavmgr/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "oscavmgr";
-  version = "25.2";
+  version = "26.8.0";
 
   src = fetchFromGitHub {
     owner = "galister";
     repo = "oscavmgr";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-592qj0dHn0fbIFt4Y+1TESIOUpwXcJ2tnlKNcYuxriQ=";
+    hash = "sha256-BYS/1rsXlP67MlkStm45Dm8aZllaVVOmdq8Yf0jB0iM=";
   };
 
-  cargoHash = "sha256-1/jjZ1jkLvE/L1lHFL3RCx3ox2w15WWDp6aQJOtFkcU=";
+  cargoHash = "sha256-R8UzXy44fli54zHEIZ+MdpHEggvoD06YXm5gpfMNfK0=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/pa/par2cmdline/package.nix b/pkgs/by-name/pa/par2cmdline/package.nix
index dcc61de8a37e..a2338a57eddd 100644
--- a/pkgs/by-name/pa/par2cmdline/package.nix
+++ b/pkgs/by-name/pa/par2cmdline/package.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
       any kind of file.
     '';
     license = lib.licenses.gpl2Plus;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ tallesCoelho ];
     platforms = lib.platforms.all;
   };
 })
diff --git a/pkgs/by-name/pa/patroni/package.nix b/pkgs/by-name/pa/patroni/package.nix
index 7b8326b4741e..d8c904112fb5 100644
--- a/pkgs/by-name/pa/patroni/package.nix
+++ b/pkgs/by-name/pa/patroni/package.nix
@@ -23,14 +23,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "patroni";
-  version = "4.1.4";
+  version = "4.1.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "patroni";
     repo = "patroni";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KCixqBMXJTl+Ins8B+VQ3qRxNSgEGlZz3XRYp4qDUHs=";
+    hash = "sha256-tb5FkGfZJdNZKybWJjpZ327sFcnXiqF3UdbUj0i1oc8=";
   };
 
   build-system = with python3Packages; [ setuptools ];
diff --git a/pkgs/by-name/pc/pcb2gcode/package.nix b/pkgs/by-name/pc/pcb2gcode/package.nix
index 2fb79f1b4be9..784d1da3ef47 100644
--- a/pkgs/by-name/pc/pcb2gcode/package.nix
+++ b/pkgs/by-name/pc/pcb2gcode/package.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "PCB2GCODE_COMPILE_WARNING_AS_ERROR" false)
   ];
 
-  preConfigure = lib.optionalString stdenv.isDarwin ''
+  preConfigure = lib.optionalString stdenv.hostPlatform.isDarwin ''
     export CXXFLAGS="$CXXFLAGS -fpermissive -Wno-error=c++20-extensions -Wno-error=invalid-constexpr"
   '';
 
diff --git a/pkgs/by-name/pc/pcmanfm/package.nix b/pkgs/by-name/pc/pcmanfm/package.nix
index 6eaa493ed6ba..57f59547b037 100644
--- a/pkgs/by-name/pc/pcmanfm/package.nix
+++ b/pkgs/by-name/pc/pcmanfm/package.nix
@@ -16,9 +16,6 @@
   nix-update-script,
 }:
 
-let
-  libfm' = libfm.override { withGtk3 = true; };
-in
 stdenv.mkDerivation (finalAttrs: {
   pname = "pcmanfm";
   version = "1.4.0";
@@ -40,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     glib
     gtk3
-    libfm'
+    libfm
     libx11
     pango
     adwaita-icon-theme
diff --git a/pkgs/by-name/pc/pcsx2/package.nix b/pkgs/by-name/pc/pcsx2/package.nix
index df8f52c95f5d..cfd2169eb4c2 100644
--- a/pkgs/by-name/pc/pcsx2/package.nix
+++ b/pkgs/by-name/pc/pcsx2/package.nix
@@ -6,7 +6,7 @@
   cubeb,
   curl,
   kdePackages,
-  ffmpeg,
+  ffmpeg_8,
   gtk3,
   libxrandr,
   libaio,
@@ -86,7 +86,7 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     kdePackages.extra-cmake-modules
     curl
-    ffmpeg
+    ffmpeg_8
     gtk3
     libaio
     libbacktrace
diff --git a/pkgs/by-name/pd/pdns-recursor/package.nix b/pkgs/by-name/pd/pdns-recursor/package.nix
index a9d9791723c1..96c99f05545d 100644
--- a/pkgs/by-name/pd/pdns-recursor/package.nix
+++ b/pkgs/by-name/pd/pdns-recursor/package.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
+    inherit (finalAttrs) pname version src;
     sourceRoot = "pdns-recursor-${finalAttrs.version}/rec-rust-lib/rust";
     hash = "sha256-0/HLB9wMVQALga7ZJcPSDczjcBinMwQz2vTPep+x8p8=";
   };
diff --git a/pkgs/by-name/pg/pgdog/package.nix b/pkgs/by-name/pg/pgdog/package.nix
index f6c5f1fa21cf..860cd0ddf8b5 100644
--- a/pkgs/by-name/pg/pgdog/package.nix
+++ b/pkgs/by-name/pg/pgdog/package.nix
@@ -7,29 +7,30 @@
   rustPlatform,
   useMoldLinker,
   versionCheckHook,
-  withMold ? with clangStdenv.hostPlatform; isUnix && !isDarwin,
+  withMold ? with clangStdenv.hostPlatform; isLinux,
 }:
 let
   stdenv = if withMold then useMoldLinker clangStdenv else clangStdenv;
 in
 rustPlatform.buildRustPackage.override { inherit stdenv; } (finalAttrs: {
   pname = "pgdog";
-  version = "0.1.49";
+  version = "0.1.52";
 
   src = fetchFromGitHub {
     owner = "pgdogdev";
     repo = "pgdog";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zfVNF/y1wzkvPjJ64HSzez0pOR/AEZHWc/S+cUYgat0=";
+    hash = "sha256-k2M5D4/g/NqCC34lnzNmTO0v5rTNClBA94rUlHdYEno=";
   };
 
-  cargoHash = "sha256-B4jigKyK19IhCygF9ZMvO6rHDrEquLLpTVeptaFBuX0=";
+  cargoHash = "sha256-lKDaBpbfNmOox96KVwh2MGj5u6V2Ak3g2vSrombUChI=";
 
   # Hardcoded paths for C compiler and linker
   postPatch = ''
     rm .cargo/config.toml
   '';
 
+  env.RUSTFLAGS = "--cfg tokio_unstable";
   cargoBuildFlags = [
     "--package"
     "pgdog"
diff --git a/pkgs/by-name/ph/phraze/package.nix b/pkgs/by-name/ph/phraze/package.nix
index 46eb77064aef..3826a9bddf7d 100644
--- a/pkgs/by-name/ph/phraze/package.nix
+++ b/pkgs/by-name/ph/phraze/package.nix
@@ -10,18 +10,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "phraze";
-  version = "0.3.25";
+  version = "0.3.28";
 
   src = fetchFromGitHub {
     owner = "sts10";
     repo = "phraze";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Eeyf3+zJYMRbfeTj+LdxMGEeouvvky6cAmADFqIoRNo=";
+    hash = "sha256-Lj3zKgGWJzIqTG9Kw+p3PNnVmEmZ8f8GPh4HvorlPsI=";
   };
 
   doCheck = true;
 
-  cargoHash = "sha256-NJOVWIUObmjjamRDZsj7V6xKsfRfUeUqCiKBv/vNiEY=";
+  cargoHash = "sha256-xKqEZdZqu76rE1/rdMW3nTzZEXdCr2qMTp7SY1dbQTQ=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/pi/pianotrans/package.nix b/pkgs/by-name/pi/pianotrans/package.nix
deleted file mode 100644
index a52b8ca5cebb..000000000000
--- a/pkgs/by-name/pi/pianotrans/package.nix
+++ /dev/null
@@ -1,43 +0,0 @@
-{
-  lib,
-  fetchFromGitHub,
-  python3,
-  ffmpeg,
-}:
-
-python3.pkgs.buildPythonApplication (finalAttrs: {
-  pname = "pianotrans";
-  version = "1.0.1";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "azuwis";
-    repo = "pianotrans";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-gRbyUQmPtGvx5QKAyrmeJl0stp7hwLBWwjSbJajihdE=";
-  };
-
-  build-system = with python3.pkgs; [ setuptools ];
-
-  dependencies = with python3.pkgs; [
-    piano-transcription-inference
-    resampy
-    tkinter
-    torch
-  ];
-
-  # Project has no tests
-  doCheck = false;
-
-  makeWrapperArgs = [
-    ''--prefix PATH : "${lib.makeBinPath [ ffmpeg ]}"''
-  ];
-
-  meta = {
-    description = "Simple GUI for ByteDance's Piano Transcription with Pedals";
-    mainProgram = "pianotrans";
-    homepage = "https://github.com/azuwis/pianotrans";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ azuwis ];
-  };
-})
diff --git a/pkgs/by-name/pi/piped/package.nix b/pkgs/by-name/pi/piped/package.nix
index e09939daa812..a14333f7e5bf 100644
--- a/pkgs/by-name/pi/piped/package.nix
+++ b/pkgs/by-name/pi/piped/package.nix
@@ -12,13 +12,13 @@ let
 in
 buildNpmPackage rec {
   pname = "piped";
-  version = "0-unstable-2026-07-06";
+  version = "0-unstable-2026-08-09";
 
   src = fetchFromGitHub {
     owner = "TeamPiped";
     repo = "piped";
-    rev = "335b10d0c02e407b4ba9113e32912b0d783ad455";
-    hash = "sha256-vcXmsgDZJ3v/1XNXtU3v9GWlDJBatXK9peTPVQe5De0=";
+    rev = "5ef4a0d0072753521cb7584075346623b8282402";
+    hash = "sha256-8vuanaSjspGkminCO2fTrGhecpoGgTcpEtl7YT2ZDYA=";
   };
 
   nativeBuildInputs = [ pnpm ];
@@ -39,7 +39,7 @@ buildNpmPackage rec {
       pnpm
       ;
     fetcherVersion = 4;
-    hash = "sha256-55nG7tfXtxnyfZop+8Wg8rSFOHQi0TjRc0QT16erX1E=";
+    hash = "sha256-mBEzm+GzF/V3W/6JPOn81YawAMaSTw8THtOUb3qtmvc=";
   };
 
   passthru.updateScript = nix-update-script {
diff --git a/pkgs/by-name/pi/pipewire-control-center/package.nix b/pkgs/by-name/pi/pipewire-control-center/package.nix
new file mode 100644
index 000000000000..cc1ba1fe91ce
--- /dev/null
+++ b/pkgs/by-name/pi/pipewire-control-center/package.nix
@@ -0,0 +1,94 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  nix-update-script,
+  wrapGAppsHook4,
+  gobject-introspection,
+  gtk4,
+  libadwaita,
+  copyDesktopItems,
+  makeDesktopItem,
+}:
+
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "pipewire-control-center";
+  version = "0.5.0";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "knightinfected";
+    repo = "PipeWireController";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-18Tbwv4uv75U+l7TQY+6spppB5OkSfHmDn2pSy5EUGM=";
+  };
+
+  build-system = [
+    python3Packages.hatchling
+  ];
+
+  nativeBuildInputs = [
+    copyDesktopItems
+    gobject-introspection
+    wrapGAppsHook4
+  ];
+
+  buildInputs = [
+    gtk4
+    libadwaita
+  ];
+
+  dependencies = with python3Packages; [
+    numpy
+    pycairo
+    pygobject3
+    soundfile
+  ];
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "io.github.knightinfected.PipeWireControlCenter";
+      desktopName = "PipeWire Controller";
+      comment = "Configure PipeWire, filter chains and HRIR virtual surround without editing files";
+      exec = "pipewire-control-center";
+      icon = "audio-card";
+      categories = [
+        "AudioVideo"
+        "Audio"
+        "Settings"
+      ];
+      keywords = [
+        "pipewire"
+        "audio"
+        "surround"
+        "hrir"
+        "equalizer"
+        "filter"
+        "pwcc"
+      ];
+      startupWMClass = "io.github.knightinfected.PipeWireControlCenter";
+    })
+  ];
+
+  pythonImportsCheck = [
+    "pwctl"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "GTK4/libadwaita audio control center for PipeWire";
+    longDescription = ''
+      A GUI control center for PipeWire providing audio management, signal paths,
+      virtual devices, a live patchbay, parametric equalizer, performance monitoring,
+      filter chains, microphone cleanup (echo/noise reduction), HRIR virtual surround,
+      routing snapshots, per-app policies, and LADSPA/LV2 effect inserts.
+    '';
+    homepage = "https://github.com/knightinfected/PipeWireController";
+    changelog = "https://github.com/knightinfected/PipeWireController/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ arison ];
+    mainProgram = "pipewire-control-center";
+  };
+})
diff --git a/pkgs/by-name/pk/pkgsite/package.nix b/pkgs/by-name/pk/pkgsite/package.nix
index 026caad1bf82..aa294b164950 100644
--- a/pkgs/by-name/pk/pkgsite/package.nix
+++ b/pkgs/by-name/pk/pkgsite/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule {
   pname = "pkgsite";
-  version = "0.3.0-unstable-2026-08-04";
+  version = "0.3.0-unstable-2026-08-12";
 
   src = fetchFromGitHub {
     owner = "golang";
     repo = "pkgsite";
-    rev = "9175adf713dbdc79186cb3531996bc6ba3ca355f";
-    hash = "sha256-qDTNb3HPoPtrYI4BoNA+JWwfRtrUacBpeeHeTCCfUl4=";
+    rev = "87ad201175e81c89d34ae301a43baa4f2768b732";
+    hash = "sha256-jmbCalYhZaymxBBdO9uALl4SEbc48TC0GuJRwq35e4Y=";
   };
 
   vendorHash = "sha256-NZzA9QxVSYuSjeZOiwUAXAPBrN00JLHQNPp1lXqtmCw=";
diff --git a/pkgs/by-name/pl/plasma-panel-colorizer/package.nix b/pkgs/by-name/pl/plasma-panel-colorizer/package.nix
index b0eae629e00a..ec21cce2eb2e 100644
--- a/pkgs/by-name/pl/plasma-panel-colorizer/package.nix
+++ b/pkgs/by-name/pl/plasma-panel-colorizer/package.nix
@@ -18,13 +18,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "plasma-panel-colorizer";
-  version = "7.2.0";
+  version = "8.0.0";
 
   src = fetchFromGitHub {
     owner = "luisbocanegra";
     repo = "plasma-panel-colorizer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CRuiHVRCstpD3LtT52Xiu4f2+d0Y4RKKLLt056kqNwg=";
+    hash = "sha256-SDmwfaP4Qc6OUrPWvzcu9VHNqPrqh9a2qqYk7Yejbkg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pl/plasma-plugin-blurredwallpaper/package.nix b/pkgs/by-name/pl/plasma-plugin-blurredwallpaper/package.nix
index ab29bb988432..cdf852b2d373 100644
--- a/pkgs/by-name/pl/plasma-plugin-blurredwallpaper/package.nix
+++ b/pkgs/by-name/pl/plasma-plugin-blurredwallpaper/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "plasma-plugin-blurredwallpaper";
-  version = "3.5.2";
+  version = "3.6.0";
 
   src = fetchFromGitHub {
     owner = "bouteillerAlan";
     repo = "blurredwallpaper";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-uz5IND6e1lEEyMXZrW7R3zuaWEmD4/EkNCP0lAs99d0=";
+    hash = "sha256-/Iit74EAHnB8LBF8/Pcg5RZ/Bb4QZkiWvVGkg9Z+GOo=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/pl/plemoljp-hs/package.nix b/pkgs/by-name/pl/plemoljp-hs/package.nix
index d7be0af69b5b..60280d178439 100644
--- a/pkgs/by-name/pl/plemoljp-hs/package.nix
+++ b/pkgs/by-name/pl/plemoljp-hs/package.nix
@@ -13,7 +13,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   src = fetchzip {
     url = "https://github.com/yuru7/PlemolJP/releases/download/v${finalAttrs.version}/PlemolJP_HS_v${finalAttrs.version}.zip";
-    hash = "sha256-V21T8ktNZE4nq3SH6aN9iIJHmGTkZuMsvT84yHbwSqI=";
+    hash = "sha256-ebBPun8CVHBOxs3c9SNHvT8lP1YqUH4DhBLAZk6NOrE=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/pl/plemoljp-nf/package.nix b/pkgs/by-name/pl/plemoljp-nf/package.nix
index c37d584f9292..9cfe19429cde 100644
--- a/pkgs/by-name/pl/plemoljp-nf/package.nix
+++ b/pkgs/by-name/pl/plemoljp-nf/package.nix
@@ -13,7 +13,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   src = fetchzip {
     url = "https://github.com/yuru7/PlemolJP/releases/download/v${finalAttrs.version}/PlemolJP_NF_v${finalAttrs.version}.zip";
-    hash = "sha256-m8zR9ySl88DnVzG4fKJtc9WjSLDMLU4YDX+KXhcP2WU=";
+    hash = "sha256-7DVWDxciW5pEuaIdIinibwPi7QjNsQBPFq/wtP+fTeg=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/pl/plemoljp/package.nix b/pkgs/by-name/pl/plemoljp/package.nix
index 3899f7448193..a6ac509dbe1b 100644
--- a/pkgs/by-name/pl/plemoljp/package.nix
+++ b/pkgs/by-name/pl/plemoljp/package.nix
@@ -3,15 +3,17 @@
   stdenvNoCC,
   fetchzip,
   nix-update-script,
+  plemoljp-hs,
+  plemoljp-nf,
 }:
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "plemoljp";
-  version = "3.0.0";
+  version = "3.1.0";
 
   src = fetchzip {
     url = "https://github.com/yuru7/PlemolJP/releases/download/v${finalAttrs.version}/PlemolJP_v${finalAttrs.version}.zip";
-    hash = "sha256-R4zC1pnM72FVqBQ5d03z8vyVccsM163BE15m2hdEnSA=";
+    hash = "sha256-X4DUAU7uicWtm8o3L9HmfU9By1YMnnjVrVU0iyw273A=";
   };
 
   installPhase = ''
@@ -26,8 +28,16 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   '';
 
   passthru = {
+    inherit plemoljp-hs plemoljp-nf;
+
     updateScript = nix-update-script {
-      extraArgs = [ "--version-regex=^v([0-9.]+)$" ];
+      extraArgs = [
+        "--version-regex=^v([0-9.]+)$"
+        "--subpackage"
+        "plemoljp-hs"
+        "--subpackage"
+        "plemoljp-nf"
+      ];
     };
   };
 
diff --git a/pkgs/by-name/po/polychromatic/package.nix b/pkgs/by-name/po/polychromatic/package.nix
index 5e5f7c11dacf..a276ef3f09c1 100644
--- a/pkgs/by-name/po/polychromatic/package.nix
+++ b/pkgs/by-name/po/polychromatic/package.nix
@@ -17,14 +17,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "polychromatic";
-  version = "0.9.7";
+  version = "0.9.8";
   pyproject = false;
 
   src = fetchFromGitHub {
     owner = "polychromatic";
     repo = "polychromatic";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2Uo6/74o+cSQQsYsE+7nVDsetnaYjQzL8xkJhUN3E2o=";
+    hash = "sha256-5+7u99+fwDXg3s32QyjLO7X0irw5wY7pUDvT6sSv5nA=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/pr/prettier-plugin-tailwindcss/package.nix b/pkgs/by-name/pr/prettier-plugin-tailwindcss/package.nix
new file mode 100644
index 000000000000..315cb6ba3612
--- /dev/null
+++ b/pkgs/by-name/pr/prettier-plugin-tailwindcss/package.nix
@@ -0,0 +1,76 @@
+{
+  fetchFromGitHub,
+  fetchPnpmDeps,
+  lib,
+  nix-update-script,
+  nodejs,
+  pnpmConfigHook,
+  pnpm_11,
+  stdenv,
+}:
+
+let
+  pnpm = pnpm_11;
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "prettier-plugin-tailwindcss";
+  version = "0.8.1";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "tailwindlabs";
+    repo = "prettier-plugin-tailwindcss";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-mqK3R1+VJ8PqKhkltZnQpTAn8mbQC4VfptoaqmxqobM=";
+  };
+
+  nativeBuildInputs = [
+    nodejs
+    pnpm
+    pnpmConfigHook
+  ];
+
+  pnpmDeps = fetchPnpmDeps {
+    inherit (finalAttrs) pname version src;
+    inherit pnpm;
+    fetcherVersion = 4;
+    hash = "sha256-ZhtyQsEnIoA9SpyD+oaXFzGSDAfufWnwiL7C8ImLZ7E=";
+  };
+
+  buildPhase = ''
+    runHook preBuild
+
+    NODE_ENV=production pnpm run build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib/node_modules/prettier-plugin-tailwindcss
+
+    # Required for `pnpm deploy` to work without the `--legacy` flag
+    pnpm config set --location=project inject-workspace-packages true
+
+    pnpm --filter=prettier-plugin-tailwindcss --prod \
+      deploy $out/lib/node_modules/prettier-plugin-tailwindcss/
+
+    # Workaround for "Cannot find package 'prettier' imported from ..."
+    cp -rL node_modules/prettier $out/lib/node_modules/prettier-plugin-tailwindcss/node_modules/
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Formatter plugin for Tailwind CSS";
+    homepage = "https://github.com/tailwindlabs/prettier-plugin-tailwindcss";
+    changelog = "https://github.com/tailwindlabs/prettier-plugin-tailwindcss/blob/v${finalAttrs.version}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ starryreverie ];
+  };
+})
diff --git a/pkgs/by-name/pr/prime-server/package.nix b/pkgs/by-name/pr/prime-server/package.nix
index 0ec46b18d873..fecc0f89387d 100644
--- a/pkgs/by-name/pr/prime-server/package.nix
+++ b/pkgs/by-name/pr/prime-server/package.nix
@@ -33,8 +33,17 @@ stdenv.mkDerivation (finalAttrs: {
     libsodium
   ];
 
-  # https://github.com/kevinkreiser/prime_server/issues/95
-  env.NIX_CFLAGS_COMPILE = toString [ "-Wno-error=unused-variable" ];
+  env.NIX_CFLAGS_COMPILE = toString (
+    [
+      # https://github.com/kevinkreiser/prime_server/issues/95
+      "-Wno-error=unused-variable"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      # logging.hpp calls sprintf, which the macOS SDK marks deprecated. The
+      # build uses -Werror, so the deprecation stops it.
+      "-Wno-error=deprecated-declarations"
+    ]
+  );
 
   meta = {
     description = "Non-blocking (web)server API for distributed computing and SOA based on zeromq";
diff --git a/pkgs/by-name/pr/prometheus-json-exporter/package.nix b/pkgs/by-name/pr/prometheus-json-exporter/package.nix
index 49fe34d98622..ea64ca3f20cc 100644
--- a/pkgs/by-name/pr/prometheus-json-exporter/package.nix
+++ b/pkgs/by-name/pr/prometheus-json-exporter/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "prometheus-json-exporter";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "prometheus-community";
     repo = "json_exporter";
     rev = "v${version}";
-    sha256 = "sha256-Zeq4gbwGd16MkGQRL8+bq0Ns06Yg+H9GAEo3qaMGDbc=";
+    sha256 = "sha256-nmpErJCp31hxjVmVGaUiuKF/ya92vs+Cqw95EOFJ0BQ=";
   };
 
-  vendorHash = "sha256-41JsxA3CfQjiwZw/2KP4Re4g3gmexadHuN0lUP5rjdo=";
+  vendorHash = "sha256-xyRr78fkiKI9udQHqr/CBwhBts9zNTA3mhRDjGVsyZA=";
 
   passthru.tests = { inherit (nixosTests.prometheus-exporters) json; };
 
diff --git a/pkgs/by-name/pr/prometheus-snowflake-exporter/package.nix b/pkgs/by-name/pr/prometheus-snowflake-exporter/package.nix
new file mode 100644
index 000000000000..85f2e0152755
--- /dev/null
+++ b/pkgs/by-name/pr/prometheus-snowflake-exporter/package.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "prometheus-snowflake-exporter";
+  # No tagged release upstream (only a moving `latest` tag), so pin the commit and
+  # use nixpkgs' unstable versioning. Bump the date + rev on update.
+  version = "0-unstable-2026-07-02";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "grafana";
+    repo = "snowflake-prometheus-exporter";
+    rev = "d9447d3401aa81b26c091775606c502bf8e2d7cd";
+    hash = "sha256-3yaZ2kk2k5ivUNgRNazYjA38zY4dvsTOrkvftQpCW5A=";
+  };
+
+  vendorHash = "sha256-HvlZ5g1LqAoXuFuidmHCMTeFfivqUR2ryAh0hQayxnc=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/prometheus/common/version.Version=${finalAttrs.version}"
+    "-X github.com/prometheus/common/version.Branch=master"
+    "-X github.com/prometheus/common/version.BuildUser=nixbld@nixpkgs"
+  ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };
+
+  meta = {
+    description = "Prometheus exporter for Snowflake metrics";
+    homepage = "https://github.com/grafana/snowflake-prometheus-exporter";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ rhousand ];
+    mainProgram = "snowflake-exporter";
+  };
+})
diff --git a/pkgs/by-name/pr/proton-pass-cli/package.nix b/pkgs/by-name/pr/proton-pass-cli/package.nix
index 5dd3049f0adb..79af51ab32f2 100644
--- a/pkgs/by-name/pr/proton-pass-cli/package.nix
+++ b/pkgs/by-name/pr/proton-pass-cli/package.nix
@@ -15,7 +15,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "proton-pass-cli";
-  version = "2.3.0";
+  version = "2.3.1";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -57,15 +57,15 @@ stdenv.mkDerivation (finalAttrs: {
     sources = {
       "aarch64-darwin" = fetchurl {
         url = "https://proton.me/download/pass-cli/${finalAttrs.version}/pass-cli-macos-aarch64";
-        hash = "sha256-5BtLV41YpvnpB3vqBdnuNhBQPf+M2bAe5LsZNvnBwmg=";
+        hash = "sha256-NORQQIMCkJVqNEkKIwJPto68cWkcMxaxUX2FIJfJoIw=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://proton.me/download/pass-cli/${finalAttrs.version}/pass-cli-linux-aarch64";
-        hash = "sha256-rg8HzFxJwipIHcn8cFAEt31oWf0kI0YXJVx/TJDqfPA=";
+        hash = "sha256-8Er3ZrPLRYP+e5bofQbVFK9i5wEBxPS4NM6IapuhTAU=";
       };
       "x86_64-linux" = fetchurl {
         url = "https://proton.me/download/pass-cli/${finalAttrs.version}/pass-cli-linux-x86_64";
-        hash = "sha256-tuKIbrIfiTWMH7UPBHpH0TKdUOKc3C6tSHAcYUYruBo=";
+        hash = "sha256-0WMzZBIZ1sDgpWeZ8ovWbS2McKJbIdUSPz7HqJ8y9Ms=";
       };
     };
     updateScript = writeShellScript "update-proton-pass-cli" ''
diff --git a/pkgs/by-name/pu/punes/package.nix b/pkgs/by-name/pu/punes/package.nix
index decc5d20c9d8..e599edc5ffab 100644
--- a/pkgs/by-name/pu/punes/package.nix
+++ b/pkgs/by-name/pu/punes/package.nix
@@ -6,7 +6,7 @@
   gitUpdater,
   cmake,
   pkg-config,
-  ffmpeg,
+  ffmpeg_8,
   libGLU,
   alsa-lib,
   libx11,
@@ -74,7 +74,7 @@ stdenv.mkDerivation (finalAttrs: {
   ]);
 
   buildInputs = [
-    ffmpeg
+    ffmpeg_8
     libGLU
   ]
   ++ (with qtPackages; [
diff --git a/pkgs/by-name/pv/pvz-portable-unwrapped/package.nix b/pkgs/by-name/pv/pvz-portable-unwrapped/package.nix
index 294bb5af8dcb..c74fee747288 100644
--- a/pkgs/by-name/pv/pvz-portable-unwrapped/package.nix
+++ b/pkgs/by-name/pv/pvz-portable-unwrapped/package.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pvz-portable-unwrapped";
-  version = "0.2.0";
+  version = "0.2.1";
 
   src = fetchFromGitHub {
     owner = "wszqkzqk";
     repo = "PvZ-Portable";
     tag = finalAttrs.version;
-    hash = "sha256-z0l5zMkTcZ1T711s2CoFktPJcDDEMfAQl0xTA9Yneio=";
+    hash = "sha256-9a57X0JikJd6iEcvdkDGzr6o4jych4Mpuo6z/xPv3+Q=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/py/pytr/package.nix b/pkgs/by-name/py/pytr/package.nix
index 49c905775d6a..2635dad2bf50 100644
--- a/pkgs/by-name/py/pytr/package.nix
+++ b/pkgs/by-name/py/pytr/package.nix
@@ -9,14 +9,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "pytr";
-  version = "0.4.9";
+  version = "0.4.10";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pytr-org";
     repo = "pytr";
     tag = "v${version}";
-    hash = "sha256-W6OtXK9c8NV8wIhvaym2tAg6UNJtCEPk1mt5VB0+Rkg=";
+    hash = "sha256-xo/J0POH21mLm//+gpfhuxIGdKGHJpFbpL82TIDufrM=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/qc/qcsuper/package.nix b/pkgs/by-name/qc/qcsuper/package.nix
new file mode 100644
index 000000000000..ae973fd01d6f
--- /dev/null
+++ b/pkgs/by-name/qc/qcsuper/package.nix
@@ -0,0 +1,55 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+}:
+let
+  inherit (python3Packages)
+    poetry-core
+    crcmod
+    pycrate
+    pyserial
+    pyusb
+    unittestCheckHook
+    ;
+in
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "qcsuper";
+  version = "2.1.3";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "P1sec";
+    repo = "QCSuper";
+    tag = finalAttrs.version;
+    hash = "sha256-fsIbtfbFRrUomgUWeFIZnMIJ7XTAa3JLvyuZabfEtb4=";
+  };
+
+  build-system = [ poetry-core ];
+
+  dependencies = [
+    crcmod
+    pycrate
+    pyserial
+    pyusb
+  ];
+
+  nativeCheckInputs = [ unittestCheckHook ];
+
+  unittestFlags = [
+    "-s"
+    "src/qcsuper/tests"
+    "-v"
+  ];
+
+  pythonImportsCheck = [ "qcsuper" ];
+
+  meta = {
+    description = "Tool to communicate with Qualcomm-based phones and modems, allowing to capture raw 2G/3G/4G radio frames";
+    homepage = "https://github.com/P1sec/QCSuper";
+    changelog = "https://github.com/P1sec/QCSuper/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ felbinger ];
+  };
+})
diff --git a/pkgs/by-name/qo/qownnotes/package.nix b/pkgs/by-name/qo/qownnotes/package.nix
index 1225e2eb08ac..e6bc0c9b3790 100644
--- a/pkgs/by-name/qo/qownnotes/package.nix
+++ b/pkgs/by-name/qo/qownnotes/package.nix
@@ -19,11 +19,11 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "qownnotes";
   appname = "QOwnNotes";
-  version = "26.8.0";
+  version = "26.8.2";
 
   src = fetchurl {
     url = "https://github.com/pbek/QOwnNotes/releases/download/v${finalAttrs.version}/qownnotes-${finalAttrs.version}.tar.xz";
-    hash = "sha256-DjXVgITLBWkKLRJ7iWyR2GsHu80vuFCz3D5qnGVQHMU=";
+    hash = "sha256-8HENXG4CGvuBV8ZVOOgGEj4CRlz6f0prQjT9K+Pf+TY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/qu/quarto/package.nix b/pkgs/by-name/qu/quarto/package.nix
index 155f9eddf12a..30ecca6d5ea9 100644
--- a/pkgs/by-name/qu/quarto/package.nix
+++ b/pkgs/by-name/qu/quarto/package.nix
@@ -7,16 +7,24 @@
   deno,
   fetchurl,
   dart-sass,
+  installShellFiles,
   rWrapper,
   rPackages,
   extraRPackages ? [ ],
   makeWrapper,
   runCommand,
   python3,
-  quarto,
   extraPythonPackages ? ps: [ ],
   sysctl,
   which,
+  autoPatchelfHook,
+  bashNonInteractive,
+  coreutils,
+  versionCheckHook,
+  writeShellScript,
+  curl,
+  jq,
+  common-updater-scripts,
 }:
 
 let
@@ -36,20 +44,39 @@ let
     ]
     ++ (extraPythonPackages ps)
   );
+
+  # bin/quarto resolves every bundled tool through bin/tools/$ARCH_DIR, which it
+  # derives from uname and can only ever be x86_64 or aarch64
+  archDir = stdenv.hostPlatform.parsed.cpu.name;
+  denoDomExt = if stdenv.hostPlatform.isDarwin then "dylib" else "so";
+  denoDomPlugin = "libplugin.${denoDomExt}";
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "quarto";
-  version = "1.9.37";
+  version = "1.10.18";
 
-  src = fetchurl {
-    url = "https://github.com/quarto-dev/quarto-cli/releases/download/v${finalAttrs.version}/quarto-${finalAttrs.version}-linux-amd64.tar.gz";
-    hash = "sha256-ePzZDpg+Pn2+Pw0ZIcwQJTweynuSwg3UvCo8G8oKmvU=";
-  };
+  src =
+    finalAttrs.passthru.sources.${stdenv.hostPlatform.system}
+      or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+
+  # the macOS tarball unpacks flat instead of into a versioned directory
+  sourceRoot = if stdenv.hostPlatform.isDarwin then "." else "quarto-${finalAttrs.version}";
+
+  strictDeps = true;
 
   nativeBuildInputs = [
+    installShellFiles
     makeWrapper
-    which
-  ];
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ];
+
+  buildInputs = [
+    # bin/quarto is a bash script; under strictDeps patchShebangs only resolves
+    # its interpreter from the host dependencies
+    bashNonInteractive
+  ]
+  # libgcc_s.so.1 for the retained typst-gather and deno_dom binaries
+  ++ lib.optionals stdenv.hostPlatform.isLinux [ (stdenv.cc.cc.libgcc or null) ];
 
   dontStrip = true;
 
@@ -60,6 +87,13 @@ stdenv.mkDerivation (finalAttrs: {
       --set-default QUARTO_ESBUILD ${lib.getExe esbuild} \
       --set-default QUARTO_DART_SASS ${lib.getExe dart-sass} \
       --set-default QUARTO_TYPST ${lib.getExe typst} \
+      --set-default QUARTO_DENO_DOM $out/bin/tools/${archDir}/deno_dom/${denoDomPlugin} \
+      --suffix PATH : ${
+        lib.makeBinPath [
+          coreutils
+          which
+        ]
+      } \
       ${lib.optionalString (rWrapper != null) "--set-default QUARTO_R ${rWithPackages}/bin/R"} \
       ${
         lib.optionalString (python3 != null) "--set-default QUARTO_PYTHON ${pythonWithPackages}/bin/python3"
@@ -73,8 +107,46 @@ stdenv.mkDerivation (finalAttrs: {
     runHook preInstall
 
     mkdir -p $out/bin $out/share
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    # the macOS asset bundles a complete tool tree for every architecture,
+    # alongside AppleDouble metadata files
+    find bin/tools -mindepth 1 -maxdepth 1 -type d ! -name ${archDir} -exec rm -r {} +
+    find . -name '._*' -delete
+  ''
+  + ''
+    tools=bin/tools/${archDir}
+    if [ ! -d "$tools" ]; then
+      echo "upstream no longer ships $tools, which is where quarto looks up its tools" >&2
+      exit 1
+    fi
 
-    rm -r bin/tools
+    # swap the vendored tools for the nixpkgs builds. typst-gather and deno_dom
+    # have no nixpkgs equivalent and are kept: dropping the whole directory
+    # broke `quarto call typst-gather` and the DENO_DOM_PLUGIN export.
+    rm -r "$tools"/deno "$tools"/pandoc "$tools"/typst "$tools"/esbuild "$tools"/dart-sass
+
+    ln -s ${lib.getExe deno} "$tools"/deno
+    ln -s ${lib.getExe pandoc} "$tools"/pandoc
+    ln -s ${lib.getExe typst} "$tools"/typst
+    ln -s ${lib.getExe esbuild} "$tools"/esbuild
+    mkdir "$tools"/dart-sass
+    ln -s ${lib.getExe dart-sass} "$tools"/dart-sass/sass
+
+    # the linux-arm64 asset names the plugin libplugin-linux-aarch64.so, while
+    # bin/quarto and QUARTO_DENO_DOM only ever point at the unsuffixed name; a
+    # dlopen miss is swallowed and silently downgrades quarto to the wasm parser
+    if [ ! -e "$tools"/deno_dom/${denoDomPlugin} ]; then
+      mv "$tools"/deno_dom/libplugin*.${denoDomExt} "$tools"/deno_dom/${denoDomPlugin}
+    fi
+
+    # pre-1.4 location, still probed by the VS Code extension
+    ln -s ${archDir}/pandoc bin/tools/pandoc
+
+    # share/man also holds the qmd the page is generated from, which
+    # compressManPages would gzip in place for mandb to trip over
+    installManPage --name quarto.1 share/man/quarto-man.man
+    rm -r share/man
 
     mv bin/* $out/bin
     mv share/* $out/share
@@ -82,17 +154,63 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
-  passthru.tests = {
-    quarto-check =
-      runCommand "quarto-check"
-        {
-          nativeBuildInputs = [ which ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ sysctl ];
-        }
-        ''
-          export HOME="$(mktemp -d)"
-          ${quarto}/bin/quarto check
-          touch $out
-        '';
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru = {
+    sources = {
+      x86_64-linux = fetchurl {
+        url = "https://github.com/quarto-dev/quarto-cli/releases/download/v${finalAttrs.version}/quarto-${finalAttrs.version}-linux-amd64.tar.gz";
+        hash = "sha256-r60HG1vSLALy0wBpV0MYnTZQ4FN6Uwc+ZUtjDP8rDHM=";
+      };
+      aarch64-linux = fetchurl {
+        url = "https://github.com/quarto-dev/quarto-cli/releases/download/v${finalAttrs.version}/quarto-${finalAttrs.version}-linux-arm64.tar.gz";
+        hash = "sha256-9qB99o4lMwtd809l099mvKYFrM47gwxZOljpGITUz2w=";
+      };
+      # the macOS asset is a universal binary carrying both architectures
+      aarch64-darwin = fetchurl {
+        url = "https://github.com/quarto-dev/quarto-cli/releases/download/v${finalAttrs.version}/quarto-${finalAttrs.version}-macos.tar.gz";
+        hash = "sha256-3danGp4ESKsV+2VbxYnhHLZYmiSOw1zNf39EE3UxaI4=";
+      };
+    };
+
+    tests = {
+      quarto-check =
+        runCommand "quarto-check"
+          {
+            nativeBuildInputs = [ which ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ sysctl ];
+          }
+          ''
+            export HOME="$(mktemp -d)"
+            ${lib.getExe finalAttrs.finalPackage} check
+            touch $out
+          '';
+    };
+
+    updateScript = writeShellScript "update-quarto" ''
+      set -o errexit -o pipefail
+      export PATH="${
+        lib.makeBinPath [
+          curl
+          jq
+          common-updater-scripts
+        ]
+      }"
+      NEW_VERSION=$(curl --fail --silent --show-error --location https://api.github.com/repos/quarto-dev/quarto-cli/releases/latest | jq '.tag_name | ltrimstr("v")' --raw-output)
+      # a truncated response still leaves jq at exit 0, and an empty version
+      # would reach update-source-version
+      if [[ -z "$NEW_VERSION" || "$NEW_VERSION" = "null" ]]; then
+          echo "Could not read the latest release tag from the GitHub API." >&2
+          exit 1
+      fi
+      if [[ "${finalAttrs.version}" = "$NEW_VERSION" ]]; then
+          echo "The new version same as the old version."
+          exit 0
+      fi
+      for platform in ${lib.escapeShellArgs finalAttrs.meta.platforms}; do
+        update-source-version "''${UPDATE_NIX_ATTR_PATH:-quarto}" "$NEW_VERSION" --ignore-same-version --source-key="sources.$platform"
+      done
+    '';
   };
 
   meta = {
@@ -104,11 +222,11 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     homepage = "https://quarto.org/";
     changelog = "https://github.com/quarto-dev/quarto-cli/releases/tag/v${finalAttrs.version}";
-    license = lib.licenses.gpl2Plus;
+    license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       mrtarantoga
     ];
-    platforms = lib.platforms.all;
+    platforms = builtins.attrNames finalAttrs.passthru.sources;
     sourceProvenance = with lib.sourceTypes; [
       binaryNativeCode
       binaryBytecode
diff --git a/pkgs/by-name/qu/quartus-prime-lite/package.nix b/pkgs/by-name/qu/quartus-prime-lite/package.nix
index 074a3652d9a2..3c1511dbc035 100644
--- a/pkgs/by-name/qu/quartus-prime-lite/package.nix
+++ b/pkgs/by-name/qu/quartus-prime-lite/package.nix
@@ -5,8 +5,9 @@
   makeDesktopItem,
   runtimeShell,
   runCommand,
+  writeShellScriptBin,
+  xdg-utils,
   unstick,
-  quartus-prime-lite,
   libfaketime,
   pkgsi686Linux,
   withQuesta ? true,
@@ -31,9 +32,23 @@ let
     genericName = "Quartus Prime";
     categories = [ "Development" ];
   };
+  # Quartus's own launcher (quartus/adm/qenv.sh) prepends quartus/linux64
+  # (which bundles an older libstdc++.so.6) to LD_LIBRARY_PATH for its whole
+  # session. When a user clicks a web link, Quartus execs `xdg-open` (found
+  # via $PATH) to open it, and that process inherits the polluted
+  # LD_LIBRARY_PATH, causing the browser it eventually launches to pick up
+  # Quartus's outdated libstdc++ instead of its own and fail to start. Shadow
+  # `xdg-open` on $PATH with a wrapper that restores the environment's
+  # original LD_LIBRARY_PATH (conveniently saved by qenv.sh as
+  # $QUARTUS_ORIG_LIBPATH) before delegating to nixpkgs' own xdg-utils
+  # xdg-open.
+  xdgOpenWrapper = writeShellScriptBin "xdg-open" ''
+    export LD_LIBRARY_PATH=$QUARTUS_ORIG_LIBPATH
+    exec ${lib.getExe' xdg-utils "xdg-open"} "$@"
+  '';
 in
 # I think questa_fse/linux/vlm checksums itself, so use FHSUserEnv instead of `patchelf`
-buildFHSEnv rec {
+buildFHSEnv (finalAttrs: {
   pname = "quartus-prime-lite"; # wrapped
   inherit (unwrapped) version;
 
@@ -75,7 +90,14 @@ buildFHSEnv rec {
     pkgs:
     with pkgs;
     let
-      # This seems ugly - can we override `libpng = libpng12` for all `pkgs`?
+      # NOTE: Not using `pkgs.extend` here on purpose: `pkgs` here is
+      # `pkgsi686Linux`, a spliced package set (see the "splicing code does not
+      # handle `pkgsi686Linux` well" comment in buildFHSEnv.nix), and `.extend`
+      # rebuilds the whole fixed point instead of overriding a single
+      # derivation. That drops the splice, so every package pulled from this
+      # set below (not just the ones touching `libpng`) ends up rebuilt from an
+      # independent, non-spliced i686 bootstrap instead of sharing store paths
+      # with the rest of the closure.
       freetype = pkgs.freetype.override { libpng = libpng12; };
       fontconfig = pkgs.fontconfig.override { inherit freetype; };
       libxft = pkgs.libxft.override { inherit freetype fontconfig; };
@@ -95,6 +117,11 @@ buildFHSEnv rec {
       libxcrypt-legacy
     ];
 
+  # See above NOTE regarding libpng
+  disallowedReferences = [
+    pkgsi686Linux.libpng
+  ];
+
   extraInstallCommands = ''
     mkdir -p $out/share/applications $out/share/icons/hicolor/64x64/apps
     ln -s ${desktopItem}/share/applications/* $out/share/applications
@@ -102,12 +129,13 @@ buildFHSEnv rec {
 
     progs_to_wrap=(
       "${unwrapped}"/quartus/bin/*
+      "${unwrapped}"/niosv/bin/*
       "${unwrapped}"/quartus/sopc_builder/bin/qsys-{generate,edit,script}
       "${unwrapped}"/questa_fse/bin/*
       "${unwrapped}"/questa_fse/linux_x86_64/lmutil
     )
 
-    wrapper=$out/bin/${pname}
+    wrapper=$out/bin/quartus-prime-lite
     progs_wrapped=()
     for prog in ''${progs_to_wrap[@]}; do
         relname="''${prog#"${unwrapped}/"}"
@@ -124,6 +152,12 @@ buildFHSEnv rec {
                 # SOURCE_DATE_EPOCH code path.
                 NIXPKGS_QUARTUS_THIS_PROG_SUPPORTS_FIXED_CLOCK=0
                 ;;
+            niosv/*)
+                # Both are needed for a functional niosv-bsp and possibly other
+                # executables.
+                echo "export QUARTUS_ROOTDIR=${unwrapped}/quartus" >> "$wrapped"
+                echo "export SOPC_KIT_NIOS2=${unwrapped}/niosv" >> "$wrapped"
+                ;;
         esac
         # SOURCE_DATE_EPOCH blocklist for programs that are known to hang/break
         # with fixed/static clock.
@@ -133,6 +167,11 @@ buildFHSEnv rec {
                 ;;
         esac
         echo "export NIXPKGS_QUARTUS_THIS_PROG_SUPPORTS_FIXED_CLOCK=$NIXPKGS_QUARTUS_THIS_PROG_SUPPORTS_FIXED_CLOCK" >> "$wrapped"
+        # If a Wayland user has QT_QPA_PLATFORM=wayland, Quartus executables
+        # that use Qt won't work, so let's be explicit.
+        echo "export QT_QPA_PLATFORM=xcb" >> "$wrapped"
+        # See above NOTE regarding `xdgOpenWrapper`
+        echo "export PATH=${xdgOpenWrapper}/bin:\$PATH" >> "$wrapped"
         echo "exec $wrapper $prog \"\$@\"" >> "$wrapped"
     done
 
@@ -183,7 +222,7 @@ buildFHSEnv rec {
       buildSof =
         runCommand "quartus-prime-lite-test-build-sof"
           {
-            nativeBuildInputs = [ quartus-prime-lite ];
+            nativeBuildInputs = [ finalAttrs.finalPackage ];
             env.NIXPKGS_QUARTUS_REPRODUCIBLE_BUILD = "1";
           }
           ''
@@ -220,11 +259,11 @@ buildFHSEnv rec {
             env.NIXPKGS_QUARTUS_REPRODUCIBLE_BUILD = "1";
           }
           ''
-            "${quartus-prime-lite}/bin/vlog" "${quartus-prime-lite.unwrapped}/questa_fse/intel/verilog/src/arriav_atoms_ncrypt.v"
+            "${finalAttrs.finalPackage}/bin/vlog" "${finalAttrs.passthru.unwrapped}/questa_fse/intel/verilog/src/arriav_atoms_ncrypt.v"
             touch "$out"
           '';
     };
   };
 
   inherit (unwrapped) meta;
-}
+})
diff --git a/pkgs/by-name/qu/quartus-prime-lite/quartus.nix b/pkgs/by-name/qu/quartus-prime-lite/quartus.nix
index 6cc137a2087d..c87343591a8c 100644
--- a/pkgs/by-name/qu/quartus-prime-lite/quartus.nix
+++ b/pkgs/by-name/qu/quartus-prime-lite/quartus.nix
@@ -2,6 +2,7 @@
   stdenv,
   lib,
   unstick,
+  unzip,
   fetchurl,
   withQuesta ? true,
   supportedDevices ? [
@@ -12,119 +13,142 @@
     "MAX II/V"
     "MAX 10 FPGA"
   ],
+  # leaves enabled: quartus, devinfo
+  disabledComponents ? [
+    "quartus_help"
+    "quartus_update"
+    "questa_fe"
+  ],
 }:
 
-let
-  deviceIds = {
-    "Arria II" = "arria_lite";
-    "Cyclone V" = "cyclonev";
-    "Cyclone IV" = "cyclone";
-    "Cyclone 10 LP" = "cyclone10lp";
-    "MAX II/V" = "max";
-    "MAX 10 FPGA" = "max10";
-  };
-
-  supportedDeviceIds =
-    assert lib.assertMsg (lib.all (
-      name: lib.hasAttr name deviceIds
-    ) supportedDevices) "Supported devices are: ${lib.concatStringsSep ", " (lib.attrNames deviceIds)}";
-    lib.listToAttrs (
-      map (name: {
-        inherit name;
-        value = deviceIds.${name};
-      }) supportedDevices
-    );
-
-  unsupportedDeviceIds = lib.removeAttrs deviceIds (lib.attrNames supportedDeviceIds);
-
-  componentHashes = {
-    "arria_lite" = "sha256-Epxvu1z7Z4vQWASIYEJAy5P7Meee114ZNVIAZnmTEH8=";
-    "cyclone" = "sha256-lKOYy61BHxY4OyonxADg6d7IGwckGX8zu0x6dpGB5Lo=";
-    "cyclone10lp" = "sha256-lurSlhCuE6i2ULKNFvlWNtk6rqdvVwREC607HbMSH2I=";
-    "cyclonev" = "sha256-1uSE/RsKR3hbyLzTGOQn1Ml5j5J26e+SmFI1hl9ry28=";
-    "max" = "sha256-jY/b906fJKgJOL3h5nWR5RQdvAJ3U9of6y4VopGo2z0=";
-    "max10" = "sha256-gFeESwuRwrp+8rN7GYbRmOxPGDHMm+ClLRjl/rTBnOk=";
-  };
-
+stdenv.mkDerivation (finalAttrs: {
+  pname = "quartus-prime-lite-unwrapped";
   version = "25.1std.0.1129";
 
-  download =
-    { name, sha256 }:
-    fetchurl {
-      inherit name sha256;
-      # e.g. "23.1std.1.993" -> "23.1std/993"
-      url = "https://downloads.intel.com/akdlm/software/acdsinst/${lib.versions.majorMinor version}std/${lib.elemAt (lib.splitVersion version) 4}/ib_installers/${name}";
-    };
+  nativeBuildInputs = [
+    unstick
+    # The devices' .qdz files are actually zip files, and without `unzip` here
+    # they are failed to be extracted because the installer tries to run its
+    # own `unzip` utility.
+    unzip
+  ];
 
-  installers = map download (
-    [
-      {
-        name = "QuartusLiteSetup-${version}-linux.run";
-        sha256 = "sha256-UYQz7H3NYXJVYK9lM1P3pcMgzOnlKLInR7io3zZ0xOs=";
-      }
-    ]
-    ++ lib.optional withQuesta {
-      name = "QuestaSetup-${version}-linux.run";
-      sha256 = "sha256-0F7psE+jTimCoy+UVJRgxNC6GEVdY/PJu49hf+D7T3U=";
-    }
-  );
-  components = map (
-    id:
-    download {
-      name = "${id}-${version}.qdz";
-      sha256 = lib.getAttr id componentHashes;
-    }
-  ) (lib.attrValues supportedDeviceIds);
-
-in
-stdenv.mkDerivation {
-  inherit version;
-  pname = "quartus-prime-lite-unwrapped";
-
-  nativeBuildInputs = [ unstick ];
-
-  buildCommand =
+  buildCommand = ''
+    echo "setting up installer..."
+  ''
+  + lib.pipe finalAttrs.finalPackage.passthru.installers [
+    (lib.mapAttrsToList finalAttrs.finalPackage.passthru.download)
+    # NOTE that we don't have a choice but to `cp` the installers and not
+    # symlink them, because the installers lookup for `.qdz` files by looking
+    # at the directory of their real, symlink-resolved location. We can however
+    # symlink the `.qdz` files to `$TEMP`.
+    (map (installer: ''
+      # `$(cat $NIX_CC/nix-support/dynamic-linker) $src[0]` often segfaults, so cp + patchelf
+      cp ${installer} $TEMP/${installer.name}
+      chmod u+w,+x $TEMP/${installer.name}
+      patchelf --interpreter $(cat $NIX_CC/nix-support/dynamic-linker) $TEMP/${installer.name}
+    ''))
+    (lib.concatStringsSep "\n")
+  ]
+  + (
     let
-      copyInstaller = installer: ''
-        # `$(cat $NIX_CC/nix-support/dynamic-linker) $src[0]` often segfaults, so cp + patchelf
-        cp ${installer} $TEMP/${installer.name}
-        chmod u+w,+x $TEMP/${installer.name}
-        patchelf --interpreter $(cat $NIX_CC/nix-support/dynamic-linker) $TEMP/${installer.name}
-      '';
-      copyComponent = component: "cp ${component} $TEMP/${component.name}";
-      # leaves enabled: quartus, devinfo
-      disabledComponents = [
-        "quartus_help"
-        "quartus_update"
-        "questa_fe"
-      ]
-      ++ (lib.optional (!withQuesta) "questa_fse")
-      ++ (lib.attrValues unsupportedDeviceIds);
+      availableDevices = lib.pipe finalAttrs.finalPackage.passthru.deviceIds [
+        lib.attrNames
+        lib.naturalSort
+      ];
+      unsupportedRequestedDevices = lib.pipe supportedDevices [
+        (lib.subtractLists availableDevices)
+        lib.naturalSort
+      ];
     in
-    ''
-      echo "setting up installer..."
-      ${lib.concatMapStringsSep "\n" copyInstaller installers}
-      ${lib.concatMapStringsSep "\n" copyComponent components}
-
-      echo "executing installer..."
-      # "Could not load seccomp program: Invalid argument" might occur if unstick
-      # itself is compiled for x86_64 instead of the non-x86 host. In that case,
-      # override the input.
-      unstick $TEMP/${(builtins.head installers).name} \
-        --disable-components ${lib.concatStringsSep "," disabledComponents} \
-        --mode unattended --installdir $out --accept_eula 1
-
-      echo "cleaning up..."
-      rm -r $out/uninstall $out/logs
-
-      # replace /proc pentium check with a true statement. this allows usage under emulation.
-      substituteInPlace $out/quartus/adm/qenv.sh \
-        --replace-fail 'grep sse /proc/cpuinfo > /dev/null 2>&1' ':'
+    assert lib.assertMsg (unsupportedRequestedDevices == [ ]) ''
+      Unsupported devices requested:
+      ${lib.concatMapStringsSep "\n" (d: " - ${d}") unsupportedRequestedDevices}
+      Supported devices are:
+      ${lib.concatMapStringsSep "\n" (d: " - ${d}") availableDevices}
     '';
+    lib.pipe supportedDevices [
+      (map (name: finalAttrs.finalPackage.passthru.deviceIds.${name}))
+      (ids: lib.getAttrs ids finalAttrs.finalPackage.passthru.components)
+      (lib.mapAttrsToList (
+        id: hash: finalAttrs.finalPackage.passthru.download "${id}-${finalAttrs.version}.qdz" hash
+      ))
+      # See NOTE above `map` that iterates the installers.
+      (map (component: "ln -s ${component} $TEMP/${component.name}"))
+      (lib.concatStringsSep "\n")
+    ]
+  )
+  # New line preceding the below bash commands is required for the `echo` below
+  # to be in its own line.
+  + ''
+
+    echo "executing installer..."
+    # "Could not load seccomp program: Invalid argument" might occur if unstick
+    # itself is compiled for x86_64 instead of the non-x86 host. In that case,
+    # override the input.
+    unstick $TEMP/${finalAttrs.finalPackage.passthru.mainInstaller} \
+      --disable-components ${
+        lib.concatStringsSep "," (
+          disabledComponents
+          ++ lib.optional (!withQuesta) "questa_fse"
+          ++ lib.attrValues (lib.removeAttrs finalAttrs.finalPackage.passthru.deviceIds supportedDevices)
+        )
+      } \
+      --mode unattended --installdir $out --accept_eula 1
+
+    echo "installer log:"
+    cat "$out/logs/quartus-${finalAttrs.version}-linux-install.log"
+
+    echo "cleaning up..."
+    rm -r $out/uninstall $out/logs
+
+    # replace /proc pentium check with a true statement. this allows usage under emulation.
+    substituteInPlace $out/quartus/adm/qenv.sh \
+      --replace-fail 'grep sse /proc/cpuinfo > /dev/null 2>&1' ':'
+  '';
+
+  passthru = {
+    deviceIds = {
+      "Arria II" = "arria_lite";
+      "Cyclone V" = "cyclonev";
+      "Cyclone IV" = "cyclone";
+      "Cyclone 10 LP" = "cyclone10lp";
+      "MAX II/V" = "max";
+      "MAX 10 FPGA" = "max10";
+    };
+    components = {
+      "arria_lite" = "sha256-Epxvu1z7Z4vQWASIYEJAy5P7Meee114ZNVIAZnmTEH8=";
+      "cyclone" = "sha256-lKOYy61BHxY4OyonxADg6d7IGwckGX8zu0x6dpGB5Lo=";
+      "cyclone10lp" = "sha256-lurSlhCuE6i2ULKNFvlWNtk6rqdvVwREC607HbMSH2I=";
+      "cyclonev" = "sha256-1uSE/RsKR3hbyLzTGOQn1Ml5j5J26e+SmFI1hl9ry28=";
+      "max" = "sha256-jY/b906fJKgJOL3h5nWR5RQdvAJ3U9of6y4VopGo2z0=";
+      "max10" = "sha256-gFeESwuRwrp+8rN7GYbRmOxPGDHMm+ClLRjl/rTBnOk=";
+    };
+    installers = {
+      "QuartusLiteSetup-${finalAttrs.version}-linux.run" =
+        "sha256-UYQz7H3NYXJVYK9lM1P3pcMgzOnlKLInR7io3zZ0xOs=";
+    }
+    // lib.optionalAttrs withQuesta {
+      "QuestaSetup-${finalAttrs.version}-linux.run" =
+        "sha256-0F7psE+jTimCoy+UVJRgxNC6GEVdY/PJu49hf+D7T3U=";
+    };
+    mainInstaller = "QuartusLiteSetup-${finalAttrs.version}-linux.run";
+    # Make it a bit easier to override the download URL schema.
+    baseURL = "https://downloads.intel.com/akdlm/software/acdsinst";
+    # e.g. "23.1std.1.993" -> "23.1std/993"
+    URLdir = "${lib.versions.majorMinor finalAttrs.version}std/${lib.elemAt (lib.splitVersion finalAttrs.version) 4}/ib_installers";
+    download =
+      name: hash:
+      fetchurl {
+        inherit name hash;
+        url = "${finalAttrs.finalPackage.baseURL}/${finalAttrs.finalPackage.URLdir}/${name}";
+      };
+  };
 
   meta = {
     homepage = "https://fpgasoftware.intel.com";
     description = "FPGA design and simulation software";
+    mainProgram = "quartus";
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree;
     platforms = [ "x86_64-linux" ];
@@ -132,6 +156,7 @@ stdenv.mkDerivation {
       bjornfor
       kwohlfahrt
       zainkergaye
+      doronbehar
     ];
   };
-}
+})
diff --git a/pkgs/by-name/ra/radicle-ci-broker/package.nix b/pkgs/by-name/ra/radicle-ci-broker/package.nix
index d74f46f73b55..f9989d01d7f4 100644
--- a/pkgs/by-name/ra/radicle-ci-broker/package.nix
+++ b/pkgs/by-name/ra/radicle-ci-broker/package.nix
@@ -14,14 +14,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "radicle-ci-broker";
-  version = "0.30.0";
+  version = "0.31.0";
 
   src = fetchFromRadicle {
     seed = "seed.radicle.dev";
     repo = "zwTxygwuz5LDGBq255RA2CbNGrz8";
     node = "z6MkgEMYod7Hxfy9qCvDv5hYHkZ4ciWmLFgfvm3Wn1b2w2FV";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-30+s//C9uMpGgA976RRduHmnmF6YEYmmG+V5P/1TYhA=";
+    hash = "sha256-yY2ke4JBAn0ZTaZ7HV8GCPF5Yqj1j+7GvjFXQQVM3ME=";
     leaveDotGit = true;
     postFetch = ''
       git -C $out rev-parse --short HEAD > $out/.git_head
@@ -29,7 +29,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     '';
   };
 
-  cargoHash = "sha256-9DzdeJcjl8IpmDR+kXdbEHrGi/5e9P26HsZJ9OPZRSA=";
+  cargoHash = "sha256-+XB2+k18gWEO7tpsQK+ua133PcZ0mxV+txle7VutXIk=";
 
   postPatch = ''
     substituteInPlace build.rs \
diff --git a/pkgs/by-name/ra/radicle-node/package.nix b/pkgs/by-name/ra/radicle-node/package.nix
index d42e6c7ba95d..a1b450ae3617 100644
--- a/pkgs/by-name/ra/radicle-node/package.nix
+++ b/pkgs/by-name/ra/radicle-node/package.nix
@@ -15,9 +15,9 @@
   xdg-utils,
   versionCheckHook,
 
-  version ? "1.10.0",
-  srcHash ? "sha256-msKnRL6T9Z+bSxknRvhKSE6rDlGA0e8aWwM1/PhUzZw=",
-  cargoHash ? "sha256-g23LqCXZt+/JX+1Nb9JCORxI0P/LJL2MZHg3lATKLd8=",
+  version ? "1.10.1",
+  srcHash ? "sha256-F+64o9z/al0iaLFyQHAYk/3jjf5T0FdgqaU3nEWIheg=",
+  cargoHash ? "sha256-TLffetbkVwIbUDoI+96T99+lfYu2SIpGtwC0DbuJXnU=",
   updateScript ? ./update.sh,
 }:
 
diff --git a/pkgs/by-name/ra/radicle-node/unstable.nix b/pkgs/by-name/ra/radicle-node/unstable.nix
index 6461906e6651..e4b98a70f3be 100644
--- a/pkgs/by-name/ra/radicle-node/unstable.nix
+++ b/pkgs/by-name/ra/radicle-node/unstable.nix
@@ -1,8 +1,8 @@
 { radicle-node }:
 
 radicle-node.override {
-  version = "1.10.0";
-  srcHash = "sha256-msKnRL6T9Z+bSxknRvhKSE6rDlGA0e8aWwM1/PhUzZw=";
-  cargoHash = "sha256-g23LqCXZt+/JX+1Nb9JCORxI0P/LJL2MZHg3lATKLd8=";
+  version = "1.10.1";
+  srcHash = "sha256-F+64o9z/al0iaLFyQHAYk/3jjf5T0FdgqaU3nEWIheg=";
+  cargoHash = "sha256-TLffetbkVwIbUDoI+96T99+lfYu2SIpGtwC0DbuJXnU=";
   updateScript = ./update-unstable.sh;
 }
diff --git a/pkgs/by-name/re/recyclarr/deps.json b/pkgs/by-name/re/recyclarr/deps.json
index ea9da7b3bb89..37fe2eeadad9 100644
--- a/pkgs/by-name/re/recyclarr/deps.json
+++ b/pkgs/by-name/re/recyclarr/deps.json
@@ -1,14 +1,4 @@
 [
-  {
-    "pname": "AgileObjects.NetStandardPolyfills",
-    "version": "1.6.0",
-    "hash": "sha256-hC5WLhpWNZrIxdPnK8yQUNfJHSne5JROopCs7JhA2uk="
-  },
-  {
-    "pname": "AgileObjects.ReadableExpressions",
-    "version": "4.1.3",
-    "hash": "sha256-Ms116jLkYhnYIFPRUJ4S2Dide+KUWDzS7eYJ48sdqDw="
-  },
   {
     "pname": "Autofac",
     "version": "9.3.1",
@@ -24,95 +14,10 @@
     "version": "4.0.0",
     "hash": "sha256-vMw1sKUK4rUW7Csno0h5XVnS7lUkGO1/hLmGqVwSIKM="
   },
-  {
-    "pname": "AutofacContrib.NSubstitute",
-    "version": "7.0.0",
-    "hash": "sha256-T65WDUM7QkU+658wWZ1kh/3hilwyzR05K1cpYgx7BGc="
-  },
-  {
-    "pname": "AutoFixture",
-    "version": "5.0.0-preview0012",
-    "hash": "sha256-wVx6zoK5jOL5e2MZftBKuYY2Da1or5Uy1k/PANgCUsk="
-  },
-  {
-    "pname": "AutoFixture.AutoNSubstitute",
-    "version": "5.0.0-preview0012",
-    "hash": "sha256-vuCtQanhc/VAWLNczlIBzIY/dUY6UVI3QumO+BMUUs4="
-  },
-  {
-    "pname": "AutoFixture.NUnit4",
-    "version": "5.0.0-preview0012",
-    "hash": "sha256-iwEVJWdFXqp55Fgm8PIypNfdJ647VZdYEjvnbDiZ2r8="
-  },
-  {
-    "pname": "AwesomeAssertions",
-    "version": "9.4.0",
-    "hash": "sha256-gLWp+EsvjnjOckSklok9c/kQhIViBG/VfUEJTUGWYNI="
-  },
-  {
-    "pname": "AwesomeAssertions.Analyzers",
-    "version": "9.0.8",
-    "hash": "sha256-qdYueHz9vSj0GiS4OgaSVPyjdPFcBa4qzd2NDlY98DE="
-  },
-  {
-    "pname": "BouncyCastle.Cryptography",
-    "version": "2.6.2",
-    "hash": "sha256-Yjk2+x/RcVeccGOQOQcRKCiYzyx1mlFnhS5auCII+Ms="
-  },
-  {
-    "pname": "Castle.Core",
-    "version": "5.1.1",
-    "hash": "sha256-oVkQB+ON7S6Q27OhXrTLaxTL0kWB58HZaFFuiw4iTrE="
-  },
   {
     "pname": "CliWrap",
-    "version": "3.10.2",
-    "hash": "sha256-PtRWN6tfZ/uT6o1JrLDj624feJgD5iDS4ywsYwEhQ6c="
-  },
-  {
-    "pname": "coverlet.collector",
-    "version": "10.0.1",
-    "hash": "sha256-6nZ5qWvy1SPYM9SfYbZEdGGrErdnOPluZXgJJ/hiarw="
-  },
-  {
-    "pname": "Docker.DotNet.Enhanced",
-    "version": "4.2.0",
-    "hash": "sha256-e+poxFu+FJwPWuZ1JiiDJjZK+3inIDlIl7obZNGYcB8="
-  },
-  {
-    "pname": "Docker.DotNet.Enhanced.Handler.Abstractions",
-    "version": "4.2.0",
-    "hash": "sha256-EsFRWrwvnv8JOK9N3W/kDjzrO1Jh8St8wn2W9UDvh0Y="
-  },
-  {
-    "pname": "Docker.DotNet.Enhanced.LegacyHttp",
-    "version": "4.2.0",
-    "hash": "sha256-MptmUR15Soy74NWJC+ZCWTqJxZP/BEHjfZPYTUq5IeE="
-  },
-  {
-    "pname": "Docker.DotNet.Enhanced.NativeHttp",
-    "version": "4.2.0",
-    "hash": "sha256-9wMMHwBcSI+pJuB9R1QrtQ1VZOGbASeC1Ouu6nxXum8="
-  },
-  {
-    "pname": "Docker.DotNet.Enhanced.NPipe",
-    "version": "4.2.0",
-    "hash": "sha256-MOzo8ySnMneRV+KaeqUC2Hq8NuY2oDqginK6DeI7Zf4="
-  },
-  {
-    "pname": "Docker.DotNet.Enhanced.Unix",
-    "version": "4.2.0",
-    "hash": "sha256-zT4wLE8ZtandcwDZcq/VHhwxKAIPKF02EnigW+h/80U="
-  },
-  {
-    "pname": "Docker.DotNet.Enhanced.X509",
-    "version": "4.2.0",
-    "hash": "sha256-zqimuvpFBmLh1TUUyVvZmjgCHIQbyb6T1suYArQMaFE="
-  },
-  {
-    "pname": "Fare",
-    "version": "2.2.1",
-    "hash": "sha256-k+RPTDQYgDQHu98V5GPqWhttrk8gjqCnG6SxjocAHfY="
+    "version": "3.10.4",
+    "hash": "sha256-Imb2SFLSr0QZgM0A1jhtAhqdXU1tAEUd0xkdCMR/gYw="
   },
   {
     "pname": "FluentValidation",
@@ -121,203 +26,108 @@
   },
   {
     "pname": "GitVersion.MsBuild",
-    "version": "6.7.0",
-    "hash": "sha256-yUiPTONPgRdES6Bt6VYdGSj9exT6744Za7QeF4v0jW8="
+    "version": "6.8.2",
+    "hash": "sha256-sNIM4WyG6dShpE26+AgRoxTc8GpTHqbsKJJEe2UYYi4="
   },
   {
     "pname": "JetBrains.Annotations",
     "version": "2026.2.0",
     "hash": "sha256-409CskrdaICXUplGs9sNplfTJfYElllVwIQwoDWfdmk="
   },
-  {
-    "pname": "Microsoft.ApplicationInsights",
-    "version": "2.23.0",
-    "hash": "sha256-5sf3bg7CZZjHseK+F3foOchEhmVeioePxMZVvS6Rjb0="
-  },
-  {
-    "pname": "Microsoft.CodeCoverage",
-    "version": "18.7.0",
-    "hash": "sha256-QonDzKnOwcYkkVP0T3PT9/QySgUILc/L/bcp6+l+tA8="
-  },
   {
     "pname": "Microsoft.Extensions.Configuration",
-    "version": "10.0.9",
-    "hash": "sha256-4d8r6Vyune1Qb0kwqzfGPA7BK2nvaiOenTiJedzq6sU="
+    "version": "10.0.10",
+    "hash": "sha256-tFaExufNGPFdUTswqkiRVyRS95Q5XG5WLCEoR6oaKfE="
   },
   {
     "pname": "Microsoft.Extensions.Configuration.Abstractions",
-    "version": "10.0.9",
-    "hash": "sha256-pliaksEAQdxyPURUVSlXpfF3LzJB93zHaeEDsaF5QJE="
+    "version": "10.0.10",
+    "hash": "sha256-Yy3rpOIm1VEPdYTyGeG7S8bNT+ABaSJiYgsVWVeZGtU="
   },
   {
     "pname": "Microsoft.Extensions.Configuration.Binder",
-    "version": "10.0.9",
-    "hash": "sha256-ouJa+84H/bfMi67v25hjEWhTIyBHaWTJAoEvArwbrGA="
+    "version": "10.0.10",
+    "hash": "sha256-YR977qfNxzna45WOWljFEhezAN8lPr/Eewc3WBUx2ks="
   },
   {
     "pname": "Microsoft.Extensions.DependencyInjection",
-    "version": "10.0.9",
-    "hash": "sha256-YIqgDknwTq48X88Imdrfav3tmQ6tZwIOYsLt6dT40M8="
+    "version": "10.0.10",
+    "hash": "sha256-SZDbEORdMQa+Zg9F29lP5By7jaT5b9XLj8LAx7j1EZA="
+  },
+  {
+    "pname": "Microsoft.Extensions.DependencyInjection.Abstractions",
+    "version": "10.0.10",
+    "hash": "sha256-2r+Qvd0u3zODfQ1NAL+qu+W5XGaqJjm31bG6SGJKZn0="
   },
   {
     "pname": "Microsoft.Extensions.DependencyInjection.Abstractions",
     "version": "10.0.9",
     "hash": "sha256-YzQpGAsrjLU18s016LmM7DMJKml0MzKl1bPPYJ/erEk="
   },
-  {
-    "pname": "Microsoft.Extensions.DependencyInjection.Abstractions",
-    "version": "8.0.2",
-    "hash": "sha256-UfLfEQAkXxDaVPC7foE/J3FVEXd31Pu6uQIhTic3JgY="
-  },
-  {
-    "pname": "Microsoft.Extensions.DependencyModel",
-    "version": "8.0.2",
-    "hash": "sha256-PyuO/MyCR9JtYqpA1l/nXGh+WLKCq34QuAXN9qNza9Q="
-  },
   {
     "pname": "Microsoft.Extensions.Diagnostics",
-    "version": "10.0.9",
-    "hash": "sha256-nnhs4+Z8gNL89Dttjqt0FR6uWY5U6bQ1dIa0wwMiUno="
+    "version": "10.0.10",
+    "hash": "sha256-S//g46+Z9CvyhZuBv0jZwNYRHX1hMPOOhhhimP/RbSo="
   },
   {
     "pname": "Microsoft.Extensions.Diagnostics.Abstractions",
-    "version": "10.0.9",
-    "hash": "sha256-OoBCatkSA+QWbMfyFxeuEOIHb04ukPH32gNfCUsar2M="
+    "version": "10.0.10",
+    "hash": "sha256-vhV6KFhBBYbgapGanySiHhycnHSVqPqIyng8OxAXiQ8="
   },
   {
     "pname": "Microsoft.Extensions.Http",
-    "version": "10.0.9",
-    "hash": "sha256-caid7Mp5UjoLLjpwfKuJq24mVWp+lLm7/l8DezPyNKw="
+    "version": "10.0.10",
+    "hash": "sha256-lMiOKGJKlzJ+LNzhafcSkcg8LkCI8ZPnghD9oZW9jgE="
   },
   {
     "pname": "Microsoft.Extensions.Logging",
-    "version": "10.0.9",
-    "hash": "sha256-644xYxPB+PtwGUTAKJV9wByXHWFkR5Ol0p08wFQwMm4="
+    "version": "10.0.10",
+    "hash": "sha256-Cw8ASciR8mlMNLWJ5Mmn/k6SqLS12lN+G8tyPOq/PtQ="
   },
   {
     "pname": "Microsoft.Extensions.Logging.Abstractions",
-    "version": "10.0.9",
-    "hash": "sha256-su2q/OZuG7nB3wnUTVcimy3oHSdetFh4hhmjI3f/ym8="
-  },
-  {
-    "pname": "Microsoft.Extensions.Logging.Abstractions",
-    "version": "8.0.3",
-    "hash": "sha256-5MSY1aEwUbRXehSPHYw0cBZyFcUH4jkgabddxhMiu3Q="
+    "version": "10.0.10",
+    "hash": "sha256-mcqRSYG3QtBlCAUbx7MmaSvG6KKtAFx+E1Z4dAWoTWY="
   },
   {
     "pname": "Microsoft.Extensions.Options",
-    "version": "10.0.9",
-    "hash": "sha256-/fc1g1SDJI81nOZRS7W4LZIAC0ssmasqaWhgJK+9rRs="
+    "version": "10.0.10",
+    "hash": "sha256-S4kPHsyGWpCtmdj+S/IUnZOqYAA3RhhZw76WWq6Qswg="
   },
   {
     "pname": "Microsoft.Extensions.Options.ConfigurationExtensions",
-    "version": "10.0.9",
-    "hash": "sha256-XVKJrNjPo0hojY5V4xoLxedpvkqtr4GJqkCUhLKSTcQ="
+    "version": "10.0.10",
+    "hash": "sha256-0d3y0XN1P8DcWHaGw0Q+lfMYtbgJmk3cW/V4HZgyAio="
   },
   {
     "pname": "Microsoft.Extensions.Primitives",
-    "version": "10.0.9",
-    "hash": "sha256-WEPtmlEexm6QSFR4ITlBHuUD5/bqMfecOxFe5hkbAPU="
-  },
-  {
-    "pname": "Microsoft.NET.Test.Sdk",
-    "version": "18.7.0",
-    "hash": "sha256-m2cPE5Y7lQz1nmyjlaf4bf9LpABQa24wiga7HPN4LgQ="
+    "version": "10.0.10",
+    "hash": "sha256-qOKbxamHl3b+fbpLQs3Ajnga4cz1e50SzQQCrXyo8cc="
   },
   {
     "pname": "Microsoft.NETCore.Platforms",
     "version": "1.1.0",
     "hash": "sha256-FeM40ktcObQJk4nMYShB61H/E8B7tIKfl9ObJ0IOcCM="
   },
-  {
-    "pname": "Microsoft.Testing.Extensions.Telemetry",
-    "version": "2.1.0",
-    "hash": "sha256-SawLiz1fB3QbkkyEVloEj8UpQTAIZR7U9FZfqwCkGr0="
-  },
-  {
-    "pname": "Microsoft.Testing.Extensions.TrxReport.Abstractions",
-    "version": "2.1.0",
-    "hash": "sha256-X54qc4Ey+3hm0e5eCY1R2me8b4zGrWzjesm9fGJWXys="
-  },
-  {
-    "pname": "Microsoft.Testing.Extensions.VSTestBridge",
-    "version": "2.1.0",
-    "hash": "sha256-2m14uEmuEELn4Ci/CZNpKjhlnzq9vYvhgeiM03DZj7A="
-  },
-  {
-    "pname": "Microsoft.Testing.Platform",
-    "version": "2.1.0",
-    "hash": "sha256-CbR0j0Dh65cMccO7L6ppx4b5iiXjqxjjfC9A85HeLuM="
-  },
-  {
-    "pname": "Microsoft.Testing.Platform.MSBuild",
-    "version": "2.1.0",
-    "hash": "sha256-6T2tBSokr5/oiwqKASk18BieKqkIzDbYX32j1Hl1z1g="
-  },
-  {
-    "pname": "Microsoft.TestPlatform.ObjectModel",
-    "version": "18.0.1",
-    "hash": "sha256-oJbS7SZ46RzyOQ+gCysW7qJRy7V8RlQVa5d8uajb91M="
-  },
-  {
-    "pname": "Microsoft.TestPlatform.ObjectModel",
-    "version": "18.7.0",
-    "hash": "sha256-OJYJt3EhJ60HobDzET31dESe29BtqDd35Xjt8/2BQCQ="
-  },
-  {
-    "pname": "Microsoft.TestPlatform.TestHost",
-    "version": "18.7.0",
-    "hash": "sha256-i5XpKR5rgazQ5ZLPGE/F71h0Sp6Ko/ff1NzLo+lsE5M="
-  },
   {
     "pname": "NETStandard.Library",
     "version": "1.6.1",
     "hash": "sha256-iNan1ix7RtncGWC9AjAZ2sk70DoxOsmEOgQ10fXm4Pw="
   },
-  {
-    "pname": "Newtonsoft.Json",
-    "version": "13.0.3",
-    "hash": "sha256-hy/BieY4qxBWVVsDqqOPaLy1QobiIapkbrESm6v2PHc="
-  },
-  {
-    "pname": "NSubstitute",
-    "version": "5.3.0",
-    "hash": "sha256-fa6Hn9Qmpia2labWOs1Xp2LnJBOHfrWIwxvqKRRccs0="
-  },
-  {
-    "pname": "NSubstitute.Analyzers.CSharp",
-    "version": "1.0.17",
-    "hash": "sha256-HyMhNJMze3ALJbl71pprjuLCqS+KLA/bOeX4Sng/eb4="
-  },
-  {
-    "pname": "NUnit",
-    "version": "4.6.1",
-    "hash": "sha256-MLciW0cj9OO3gJ6FjqD/Kpp0S5yPYsTpSWtRTYG0Pvo="
-  },
-  {
-    "pname": "NUnit.Analyzers",
-    "version": "4.14.0",
-    "hash": "sha256-WULxpvd/t9VKLwhe4+rRJdS5B3j5xqK1AUxmhkg4SLY="
-  },
-  {
-    "pname": "NUnit3TestAdapter",
-    "version": "6.2.0",
-    "hash": "sha256-sKQjvF/qlEgfrCKHt1OzT+QZdtPt4RBBZd2f0oD1ldg="
-  },
   {
     "pname": "ReactiveUI.Disposables",
-    "version": "6.0.0",
-    "hash": "sha256-WK2rt1PZFW2MAnQpnwjJgt0sC9lGp8UazxGbJLSBSfs="
+    "version": "7.0.0",
+    "hash": "sha256-133L7v/HbSx11YGQ2IWxLXdpAr8qXLHJS1L2IgaLh+c="
   },
   {
     "pname": "ReactiveUI.Primitives",
-    "version": "6.0.0",
-    "hash": "sha256-b6ByzvvvWhV+BIGRDb9u5t9b9mvRz3memmumQbqtH/A="
+    "version": "7.0.0",
+    "hash": "sha256-b/IoCw7UZs9WyZOMHZVvdec3j/za/maytofPfcEeef8="
   },
   {
     "pname": "ReactiveUI.Primitives.Core",
-    "version": "6.0.0",
-    "hash": "sha256-bWM5Cp/rIuF9CglPo0dse+9a76lPHhjElO4W/3U4MJI="
+    "version": "7.0.0",
+    "hash": "sha256-oRjAbg+IPGJwLkuhO2KZkfAxPW1UhpwHHq5LWtZuvts="
   },
   {
     "pname": "ReferenceTrimmer",
@@ -326,18 +136,18 @@
   },
   {
     "pname": "Refit",
-    "version": "13.1.0",
-    "hash": "sha256-usU/SXfobVSWqku+J2KnRv3Zl662j+7BeBPFkIs/Mm0="
+    "version": "14.0.1",
+    "hash": "sha256-hp4rh+tRTaLd7XW9IwkkJ0y1oSJc6YkiHSsw2JHH6BQ="
   },
   {
     "pname": "Refit.HttpClientFactory",
-    "version": "13.1.0",
-    "hash": "sha256-n07aKFVFSa/dHm/WQuuEsRsBtkCes8APP7aw9MUgQ1k="
+    "version": "14.0.1",
+    "hash": "sha256-Wn0b6B8vc/7+042lod5bB59wSHaPOjxn4hs0Yoy6juo="
   },
   {
     "pname": "Refitter.MSBuild",
-    "version": "2.0.0",
-    "hash": "sha256-4ysnoFGZh1Hlsst/yfCrVx7MbD0O0cHOaY3fiYNHWTw="
+    "version": "2.1.2",
+    "hash": "sha256-5DZVMydPhTQLgcBFtefNdBDZwIqUpUTuB0UQn6wazFM="
   },
   {
     "pname": "Riok.Mapperly",
@@ -346,8 +156,8 @@
   },
   {
     "pname": "Serilog",
-    "version": "4.3.1",
-    "hash": "sha256-TY+GaQYnyDfOGl0gi67xDyUMOuV/mjz8BU66/UsmStI="
+    "version": "4.4.0",
+    "hash": "sha256-tP4X06ThcDVL6XXtYIhdJyxn4uL9jLL0s3DRO6HNQk8="
   },
   {
     "pname": "Serilog.Expressions",
@@ -364,16 +174,6 @@
     "version": "7.0.0",
     "hash": "sha256-LxZYUoUPkCjIIVarJilnXnqQiMrFNJtoRilmzTNtUjo="
   },
-  {
-    "pname": "Serilog.Sinks.TextWriter",
-    "version": "3.0.0",
-    "hash": "sha256-25YPNwn29hTaDr2TsXtzxNFg5xijfV/Ggpopua4VyOk="
-  },
-  {
-    "pname": "SharpZipLib",
-    "version": "1.4.2",
-    "hash": "sha256-/giVqikworG2XKqfN9uLyjUSXr35zBuZ2FX2r8X/WUY="
-  },
   {
     "pname": "Spectre.Console",
     "version": "0.55.0",
@@ -394,26 +194,11 @@
     "version": "0.55.0",
     "hash": "sha256-VJvGl38caKtrLqc1P8HMG8T2Ny2OgEumZzqk2rUcJNw="
   },
-  {
-    "pname": "Spectre.Console.Testing",
-    "version": "0.55.0",
-    "hash": "sha256-Rgro4QZBqQiKHB6LP3H2nII2Tp2Lpp+wNMFoQwQCv+E="
-  },
-  {
-    "pname": "SSH.NET",
-    "version": "2025.1.0",
-    "hash": "sha256-vtpvE5B+IxoMkq9CQMehoR5ZRtihaHQ4VyhmkkIjL98="
-  },
   {
     "pname": "SuperLinq",
     "version": "6.4.1",
     "hash": "sha256-YoWyNzcJkfCI3rfpXDzrhab1HThPJweYKbRmuuDVIYY="
   },
-  {
-    "pname": "System.ComponentModel.Annotations",
-    "version": "4.4.0",
-    "hash": "sha256-jiIzWKF1uEjXUTHbiInJXvC6h8ELJK3BJk7yjeS7IbE="
-  },
   {
     "pname": "System.Data.HashFunction.Core",
     "version": "2.0.0",
@@ -429,11 +214,6 @@
     "version": "2.0.0",
     "hash": "sha256-Zr9Nu3DNW4SXevkoXsP3/K7cTWuKlEj70WzAX8BFAsY="
   },
-  {
-    "pname": "System.Diagnostics.EventLog",
-    "version": "6.0.0",
-    "hash": "sha256-zUXIQtAFKbiUMKCrXzO4mOTD5EUphZzghBYKXprowSM="
-  },
   {
     "pname": "System.Reactive",
     "version": "6.1.0",
@@ -451,33 +231,23 @@
   },
   {
     "pname": "TestableIO.System.IO.Abstractions",
-    "version": "22.1.1",
-    "hash": "sha256-nBLPa/4R7gHmKltK260ZX6e+aOLlVkw5+2kuhraF2ec="
+    "version": "22.2.0",
+    "hash": "sha256-kyoEyF+j/vws2STfSMzHKrqzZJu284lszy0PufOdFBY="
   },
   {
     "pname": "TestableIO.System.IO.Abstractions.Extensions",
     "version": "22.0.4",
     "hash": "sha256-TD+kvVnbaM2CRBURJd23YQZ3bgVaSxsSIS74RNXFcJA="
   },
-  {
-    "pname": "TestableIO.System.IO.Abstractions.TestingHelpers",
-    "version": "22.1.1",
-    "hash": "sha256-tCAMji9DqF+kbA+ArJn6Lsux2bpvQwBI+d2MvzNVQn4="
-  },
   {
     "pname": "TestableIO.System.IO.Abstractions.Wrappers",
-    "version": "22.1.1",
-    "hash": "sha256-1dLAGZ6XaKlxWsYljNgEsQXG8ET4mubrYxLBNpdee6I="
+    "version": "22.2.0",
+    "hash": "sha256-YUzACGTLDZ8R5S8JoXFYXRtmytFxXE2jFuDHJw5feXw="
   },
   {
     "pname": "Testably.Abstractions.FileSystem.Interface",
-    "version": "10.1.0",
-    "hash": "sha256-zS5HAJ+iZbjsiiqPE0+M+0PMGxOH1Bsmm3vdNSKoYPU="
-  },
-  {
-    "pname": "Testcontainers",
-    "version": "4.12.0",
-    "hash": "sha256-NM+zFlgQIo0BP5V/WW8gLJ/tcSTZelbbklOZ3llzZ4g="
+    "version": "10.3.0",
+    "hash": "sha256-uSzMsiXAKZK6NbwXa59zIbCkfI9qwuWsrm5yoLrheKU="
   },
   {
     "pname": "YamlDotNet",
diff --git a/pkgs/by-name/re/recyclarr/package.nix b/pkgs/by-name/re/recyclarr/package.nix
index 6da883eb45bb..b56784d05381 100644
--- a/pkgs/by-name/re/recyclarr/package.nix
+++ b/pkgs/by-name/re/recyclarr/package.nix
@@ -9,13 +9,13 @@
 }:
 buildDotnetModule (finalAttrs: {
   pname = "recyclarr";
-  version = "8.7.0";
+  version = "8.7.1";
 
   src = fetchFromGitHub {
     owner = "recyclarr";
     repo = "recyclarr";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tH76rFsQNPMq5aVJJOrjGAOueTc/jhIE8taUe4aBhg8=";
+    hash = "sha256-BPU+Kzx7AJRy1aL4QjcUQeLxGpy2lzUF7YoZY/FQEA4=";
   };
 
   projectFile = "src/Recyclarr.Cli/Recyclarr.Cli.csproj";
diff --git a/pkgs/by-name/re/reprepro/package.nix b/pkgs/by-name/re/reprepro/package.nix
index 9994497a538a..130181b51627 100644
--- a/pkgs/by-name/re/reprepro/package.nix
+++ b/pkgs/by-name/re/reprepro/package.nix
@@ -15,7 +15,7 @@
 }:
 
 let
-  theStdenv = if stdenv.isDarwin then gcc14Stdenv else stdenv;
+  theStdenv = if stdenv.hostPlatform.isDarwin then gcc14Stdenv else stdenv;
 in
 theStdenv.mkDerivation (finalAttrs: {
   pname = "reprepro";
diff --git a/pkgs/by-name/re/rerun/package.nix b/pkgs/by-name/re/rerun/package.nix
index 76f68ffc0857..1a07bae47aa6 100644
--- a/pkgs/by-name/re/rerun/package.nix
+++ b/pkgs/by-name/re/rerun/package.nix
@@ -40,7 +40,7 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rerun";
-  version = "0.35.0";
+  version = "0.36.0";
 
   __structuredAttrs = true;
 
@@ -53,7 +53,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "rerun-io";
     repo = "rerun";
     tag = finalAttrs.version;
-    hash = "sha256-PPur5of8zoStXl+3Eq/sgDZ0E9ADUnks6nJ55mzJTuI=";
+    hash = "sha256-t/OvWxMFfkTKrTYvaw7xcmL6oDyNaKoyW0sa/n5yVMs=";
   };
 
   # The path in `build.rs` is wrong for some reason, so we patch it to make the passthru tests work
@@ -62,7 +62,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail '"rerun_sdk/rerun_cli/rerun"' '"rerun_sdk/rerun"'
   '';
 
-  cargoHash = "sha256-yapmDUOCCqvxmFFe/nQjeBWytTEnMw2opd/U7aXI4jQ=";
+  cargoHash = "sha256-VXKMEilmgHLHAq6Y7gDvKNJywRIV4fv/XHmNFCMjJws=";
 
   cargoBuildFlags = [
     "--package"
diff --git a/pkgs/by-name/rh/rhash/package.nix b/pkgs/by-name/rh/rhash/package.nix
index e8ef05814fee..54c326c95677 100644
--- a/pkgs/by-name/rh/rhash/package.nix
+++ b/pkgs/by-name/rh/rhash/package.nix
@@ -51,6 +51,6 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Console utility and library for computing and verifying hash sums of files";
     license = lib.licenses.bsd0;
     platforms = lib.platforms.all;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ graysontinker ];
   };
 })
diff --git a/pkgs/by-name/ri/rime-moegirl/package.nix b/pkgs/by-name/ri/rime-moegirl/package.nix
index 7ba321506998..3a88e169e2e9 100644
--- a/pkgs/by-name/ri/rime-moegirl/package.nix
+++ b/pkgs/by-name/ri/rime-moegirl/package.nix
@@ -5,10 +5,10 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "rime-moegirl";
-  version = "20260713";
+  version = "20260812";
   src = fetchurl {
     url = "https://github.com/outloudvi/mw2fcitx/releases/download/${finalAttrs.version}/moegirl.dict.yaml";
-    hash = "sha256-Fca5vWdmqaRnP6id4TqVGFsTxnynAoQTMgAWntF5eY0=";
+    hash = "sha256-WDbIdQdBX03NsPxFrs9N166CGDplDN15MOHmY+MuOiQ=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/ri/rio/package.nix b/pkgs/by-name/ri/rio/package.nix
index 521a05ad6297..d9c1e7775e69 100644
--- a/pkgs/by-name/ri/rio/package.nix
+++ b/pkgs/by-name/ri/rio/package.nix
@@ -51,16 +51,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rio";
-  version = "0.5.10";
+  version = "0.5.24";
 
   src = fetchFromGitHub {
     owner = "raphamorim";
     repo = "rio";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NMbONH9ra+QW8NcdlMhxKtTJv9FCRmJTaJLNdBDxJAI=";
+    hash = "sha256-71LP6Jy9C+XI0wIiUIuMqcVj3QrPHz1w5oc5JuesNwE=";
   };
 
-  cargoHash = "sha256-7Yxy6jBUCHnT6ZU6Zkse4WorOuO4Ex0nb+yXu5mhP1g=";
+  cargoHash = "sha256-7j7h7UEj6lJDct9Q/L7JXQ5xPgSrVpwaN8xOwchCDIo=";
 
   nativeBuildInputs = [
     rustPlatform.bindgenHook
diff --git a/pkgs/by-name/ri/rizin/sigdb.nix b/pkgs/by-name/ri/rizin/sigdb.nix
index 5bbe6685ca8b..197577bf4d6b 100644
--- a/pkgs/by-name/ri/rizin/sigdb.nix
+++ b/pkgs/by-name/ri/rizin/sigdb.nix
@@ -6,7 +6,7 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "rizin-sigdb";
-  version = "unstable-2023-08-23";
+  version = "0-unstable-2023-08-23";
 
   src = fetchFromGitHub {
     owner = "rizinorg";
diff --git a/pkgs/by-name/rm/rmatrix/package.nix b/pkgs/by-name/rm/rmatrix/package.nix
new file mode 100644
index 000000000000..d5602e9c3cbc
--- /dev/null
+++ b/pkgs/by-name/rm/rmatrix/package.nix
@@ -0,0 +1,33 @@
+{
+  rustPlatform,
+  fetchFromGitHub,
+  lib,
+  versionCheckHook,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "rmatrix";
+  version = "0.3.3";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "Tripstack-Corp";
+    repo = "rmatrix";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-sViNj7paMY/3x9u6dKHKf+XQRgv+EYsYsooZSTAwrA4=";
+  };
+
+  cargoHash = "sha256-em16fNb4BZeTsZuaT5Bu/u2cc75iSjOcSDYU0qazefM=";
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  meta = {
+    description = "Digital rain for modern terminals";
+    maintainers = with lib.maintainers; [ yarn ];
+    platforms = lib.platforms.all;
+    license = lib.licenses.mit;
+    homepage = "https://github.com/Tripstack-Corp/rmatrix";
+    mainProgram = "rmatrix";
+  };
+})
diff --git a/pkgs/by-name/rp/rpcs3/ffmpeg-9-pix-fmts.patch b/pkgs/by-name/rp/rpcs3/ffmpeg-9-pix-fmts.patch
new file mode 100644
index 000000000000..31fe8b265a45
--- /dev/null
+++ b/pkgs/by-name/rp/rpcs3/ffmpeg-9-pix-fmts.patch
@@ -0,0 +1,13 @@
+diff --git a/rpcs3/rpcs3qt/recording_settings_dialog.cpp b/rpcs3/rpcs3qt/recording_settings_dialog.cpp
+--- a/rpcs3/rpcs3qt/recording_settings_dialog.cpp
++++ b/rpcs3/rpcs3qt/recording_settings_dialog.cpp
+@@ -31,9 +31,6 @@ static std::vector<const AVCodec*> get_video_codecs(const AVOutputFormat* fmt)
+ 	void* opaque = nullptr;
+ 	while (const AVCodec* codec = av_codec_iterate(&opaque))
+ 	{
+-		if (!codec->pix_fmts)
+-			continue;
+-
+ 		if (codec->capabilities & AV_CODEC_CAP_EXPERIMENTAL)
+ 			continue;
+ 
diff --git a/pkgs/by-name/rp/rpcs3/package.nix b/pkgs/by-name/rp/rpcs3/package.nix
index b4518e0a27b6..7512f439e6c4 100644
--- a/pkgs/by-name/rp/rpcs3/package.nix
+++ b/pkgs/by-name/rp/rpcs3/package.nix
@@ -66,6 +66,11 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
 
+  patches = [
+    # FFmpeg 9 removed AVCodec.pix_fmts; drop the check (RPCS3/rpcs3@a8dd0535935a).
+    ./ffmpeg-9-pix-fmts.patch
+  ];
+
   preConfigure = ''
     cat > ./rpcs3/git-version.h <<EOF
     #define RPCS3_GIT_VERSION "nixpkgs-${lib.sources.shortRev finalAttrs.src.rev}"
diff --git a/pkgs/by-name/rs/rspamd/package.nix b/pkgs/by-name/rs/rspamd/package.nix
index ac416fb819d7..b40b13ba26c6 100644
--- a/pkgs/by-name/rs/rspamd/package.nix
+++ b/pkgs/by-name/rs/rspamd/package.nix
@@ -46,13 +46,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rspamd";
-  version = "4.1.2";
+  version = "4.1.4";
 
   src = fetchFromGitHub {
     owner = "rspamd";
     repo = "rspamd";
     tag = finalAttrs.version;
-    hash = "sha256-LqFLzOcLyZeDT5kRlENmyTzUhyVC0HBhoSKInMFpqZA=";
+    hash = "sha256-roDYMA8uPytPu50wAJ17zZVWl4KxJWaXO1kVVC3+t8g=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/rs/rsyslog-light/package.nix b/pkgs/by-name/rs/rsyslog-light/package.nix
index 1a0aab3a1036..5f259f18f168 100644
--- a/pkgs/by-name/rs/rsyslog-light/package.nix
+++ b/pkgs/by-name/rs/rsyslog-light/package.nix
@@ -3,6 +3,7 @@
 }:
 
 rsyslog.override {
+  withLibyaml = false;
   withKrb5 = false;
   withSystemd = false;
   withJemalloc = false;
diff --git a/pkgs/by-name/rs/rsyslog/package.nix b/pkgs/by-name/rs/rsyslog/package.nix
index e9f4f2d36c15..696144047676 100644
--- a/pkgs/by-name/rs/rsyslog/package.nix
+++ b/pkgs/by-name/rs/rsyslog/package.nix
@@ -2,13 +2,17 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
   pkg-config,
   autoreconfHook,
+  autoconf-archive,
   libestr,
   json_c,
   zlib,
   docutils,
   libfastjson,
+  withLibyaml ? true,
+  libyaml,
   withKrb5 ? true,
   libkrb5,
   withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
@@ -62,16 +66,26 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rsyslog";
-  version = "8.2512.0";
+  version = "8.2606.0";
 
   src = fetchurl {
     url = "https://www.rsyslog.com/files/download/rsyslog/rsyslog-${finalAttrs.version}.tar.gz";
-    hash = "sha256-k8UAJdkLbHlfo1DVaj2DK/zkUEPqm9aCQNnCqTlLxik=";
+    hash = "sha256-JXSz8waOaVXrlO9WQ+K2pbhYXMjqp3IJ/1y8Hi5fceU=";
   };
 
+  patches = [
+    # Remove with rsyslog 8.2608.0 or newer.
+    (fetchpatch {
+      name = "CVE-2026-19654.patch";
+      url = "https://github.com/rsyslog/rsyslog/commit/f7f774228273730ba1075f4cd457ae78303a8f08.patch";
+      hash = "sha256-ww8Ade2eKrQygJduLMPFjxd/fmBnpQ4ePLEzHffPy90=";
+    })
+  ];
+
   nativeBuildInputs = [
     pkg-config
     autoreconfHook
+    autoconf-archive
     docutils
   ];
 
@@ -81,6 +95,7 @@ stdenv.mkDerivation (finalAttrs: {
     json_c
     zlib
   ]
+  ++ lib.optional withLibyaml libyaml
   ++ lib.optional withKrb5 libkrb5
   ++ lib.optional withJemalloc jemalloc
   ++ lib.optional withPostgres libpq
@@ -112,6 +127,7 @@ stdenv.mkDerivation (finalAttrs: {
     "--with-systemdsystemunitdir=\${out}/etc/systemd/system"
     (lib.enableFeature true "largefile")
     (lib.enableFeature true "regexp")
+    (lib.enableFeature withLibyaml "libyaml")
     (lib.enableFeature withKrb5 "gssapi-krb5")
     (lib.enableFeature true "klog")
     (lib.enableFeature true "kmsg")
@@ -157,6 +173,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.enableFeature false "imsolaris")
     (lib.enableFeature true "imptcp")
     (lib.enableFeature true "impstats")
+    (lib.enableFeature false "impstats-push")
     (lib.enableFeature true "omprog")
     (lib.enableFeature withNet "omudpspoof")
     (lib.enableFeature true "omstdout")
diff --git a/pkgs/by-name/rt/rtk/package.nix b/pkgs/by-name/rt/rtk/package.nix
index 9a167dfac4cb..a407e934cc6a 100644
--- a/pkgs/by-name/rt/rtk/package.nix
+++ b/pkgs/by-name/rt/rtk/package.nix
@@ -12,17 +12,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rtk";
-  version = "0.44.2";
+  version = "0.45.0";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "rtk-ai";
     repo = "rtk";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qOWWHov0m3A8V48r/UGN2Hxz+/XraPRYhNPnZ+B+ZBY=";
+    hash = "sha256-weAyHM0nWLrM8JRbbXIfjUsHtAep3DOFyTO+M3BZ/iU=";
   };
 
-  cargoHash = "sha256-1nuCXZZjGDyA8kN6pFPclx8sIdD6QbGZDlTtyl+6Gow=";
+  cargoHash = "sha256-tgW6il/xLxt/xwhUBJ4MNVnk0JSZ7iFjJaEobj5+H4o=";
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/by-name/rt/rtorrent/package.nix b/pkgs/by-name/rt/rtorrent/package.nix
index fddee3463204..b8673174374a 100644
--- a/pkgs/by-name/rt/rtorrent/package.nix
+++ b/pkgs/by-name/rt/rtorrent/package.nix
@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rtorrent";
-  version = "0.16.19";
+  version = "0.16.20";
 
   __structuredAttrs = true;
 
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "rakshasa";
     repo = "rtorrent";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-oMErraDUyCiuRxFZ5CoBvoW9vXHG+eLHnAKzm6kWt2Y=";
+    hash = "sha256-fwMyzRBMO45djYXGAE8RcadM/lMJ5m9yi9DEomzO1Es=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/ru/rura/package.nix b/pkgs/by-name/ru/rura/package.nix
index 2d8d2de57579..4085d7b03a43 100644
--- a/pkgs/by-name/ru/rura/package.nix
+++ b/pkgs/by-name/ru/rura/package.nix
@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rura";
-  version = "1.10.0";
+  version = "1.11.0";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "tlipinski";
     repo = "rura";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yxYTBXGFX2PdtzgYexnXyjNMcDTnfwsy2s8S0y4hp+M=";
+    hash = "sha256-oPvO6oCefkyCkhpidfyQzW4ckN2cxSKijdWlKjWc6PU=";
   };
 
-  cargoHash = "sha256-FnLeyUUwQFWLNLLQX538LHIlzwNRg+JfAW9r3IiBnWg=";
+  cargoHash = "sha256-V69RoAhk3Q7RmlgOEhLsoVHofGxY8aT/iZHoWEv47qw=";
 
   passthru = {
     updateScript = nix-update-script { };
diff --git a/pkgs/by-name/se/searxng/package.nix b/pkgs/by-name/se/searxng/package.nix
index f9718b9d2f08..555bee522ea1 100644
--- a/pkgs/by-name/se/searxng/package.nix
+++ b/pkgs/by-name/se/searxng/package.nix
@@ -13,14 +13,14 @@ in
 python.pkgs.toPythonModule (
   python.pkgs.buildPythonApplication rec {
     pname = "searxng";
-    version = "0-unstable-2026-08-04";
+    version = "0-unstable-2026-08-13";
     pyproject = true;
 
     src = fetchFromGitHub {
       owner = "searxng";
       repo = "searxng";
-      rev = "c63835bd2a5133b30b3752a20eac6b443a918f41";
-      hash = "sha256-zWA7nBzrJh2U8nw6Zdx/fCcYaYHuDW8lGxEllzPPEwI=";
+      rev = "ef9a188cc8d13acb85923ab9b1eee5a4a484ea64";
+      hash = "sha256-ir7mqLRrvDjxysUALzODJFFfOXjsXO6cnB4NSrrNdEc=";
     };
 
     nativeBuildInputs = with python.pkgs; [ pythonRelaxDepsHook ];
diff --git a/pkgs/by-name/se/secretspec-ffi/package.nix b/pkgs/by-name/se/secretspec-ffi/package.nix
new file mode 100644
index 000000000000..0957ecafb696
--- /dev/null
+++ b/pkgs/by-name/se/secretspec-ffi/package.nix
@@ -0,0 +1,87 @@
+{
+  lib,
+  stdenv,
+  buildPackages,
+  rustPlatform,
+  fetchFromGitHub,
+  cargo-c,
+  nix-update-script,
+  pkg-config,
+  runCommandCC,
+  testers,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "secretspec-ffi";
+  version = "0.19.0";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "cachix";
+    repo = "secretspec";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-u6zfPsyLoktLQTE8OEDhK0GtiogOw/3ML4zpDVhSrX0=";
+  };
+
+  cargoHash = "sha256-ogeNTp94FJv7p+eZgrLUK1i63VCHiqHd7BsP+jDMHVc=";
+
+  nativeBuildInputs = [ cargo-c ];
+
+  buildPhase = ''
+    runHook preBuild
+    ${buildPackages.rust.envVars.setEnv} cargo cbuild -p secretspec-ffi -j $NIX_BUILD_CORES \
+      --release --frozen --prefix=${placeholder "out"} \
+      --target ${stdenv.hostPlatform.rust.rustcTarget}
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    ${buildPackages.rust.envVars.setEnv} cargo cinstall -p secretspec-ffi -j $NIX_BUILD_CORES \
+      --release --frozen --prefix=${placeholder "out"} \
+      --target ${stdenv.hostPlatform.rust.rustcTarget}
+    runHook postInstall
+  '';
+
+  checkPhase = ''
+    runHook preCheck
+    ${buildPackages.rust.envVars.setEnv} cargo ctest -p secretspec-ffi -j $NIX_BUILD_CORES \
+      --release --frozen --prefix=${placeholder "out"} \
+      --target ${stdenv.hostPlatform.rust.rustcTarget}
+    runHook postCheck
+  '';
+
+  passthru = {
+    tests = {
+      pkg-config = testers.hasPkgConfigModules {
+        package = finalAttrs.finalPackage;
+        versionCheck = true;
+      };
+      smoke =
+        runCommandCC "${finalAttrs.pname}-smoke-test"
+          {
+            nativeBuildInputs = [ pkg-config ];
+            buildInputs = [ finalAttrs.finalPackage ];
+          }
+          ''
+            $CC ${finalAttrs.src}/secretspec-ffi/tests/smoke.c \
+              $(pkg-config --cflags --libs secretspec_ffi) \
+              -o smoke
+            ./smoke
+            touch $out
+          '';
+    };
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "C ABI for resolving secrets through SecretSpec";
+    homepage = "https://secretspec.dev";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
+      domenkozar
+      sandydoo
+    ];
+    pkgConfigModules = [ "secretspec_ffi" ];
+  };
+})
diff --git a/pkgs/by-name/se/secretspec/package.nix b/pkgs/by-name/se/secretspec/package.nix
index 1ef2a428b36f..fcea19e16fc0 100644
--- a/pkgs/by-name/se/secretspec/package.nix
+++ b/pkgs/by-name/se/secretspec/package.nix
@@ -11,14 +11,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "secretspec";
-  version = "0.18.0";
+  version = "0.19.0";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-4N567/oDMgV81zlusn7TFQcDyWATvpoq879ZL/pzbuU=";
+    hash = "sha256-tpzmzChyyYogebNZZi3LT61MO1HKZW8ln+21CwlqW8M=";
   };
 
-  cargoHash = "sha256-oMoRoKXjaCOER2KvKnLmSh9nKeYErh54IlQPFLHW8sE=";
+  cargoHash = "sha256-VO05AAjBqNVowY2AsyF2W1k4sXWJxOw1U0krs13JS28=";
 
   postPatch = ''
     mkdir -p ../tests/fixtures
diff --git a/pkgs/by-name/sf/sfml_2/package.nix b/pkgs/by-name/sf/sfml_2/package.nix
index d03771f27d6a..fa60a4821ac4 100644
--- a/pkgs/by-name/sf/sfml_2/package.nix
+++ b/pkgs/by-name/sf/sfml_2/package.nix
@@ -67,9 +67,5 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     license = lib.licenses.zlib;
     platforms = lib.platforms.unix;
-    badPlatforms = [
-      # error: implicit instantiation of undefined template 'std::char_traits<unsigned int>'
-      lib.systems.inspect.patterns.isDarwin
-    ];
   };
 })
diff --git a/pkgs/by-name/sh/shadps4-qtlauncher/package.nix b/pkgs/by-name/sh/shadps4-qtlauncher/package.nix
index 943d5c60e7ea..ffce5fba7fb1 100644
--- a/pkgs/by-name/sh/shadps4-qtlauncher/package.nix
+++ b/pkgs/by-name/sh/shadps4-qtlauncher/package.nix
@@ -10,26 +10,26 @@
   fmt,
   sdl3,
   toml11,
+  zarchive,
+  zstd,
 
   shadps4,
 }:
 clangStdenv.mkDerivation (finalAttrs: {
   pname = "shadps4-qtlauncher";
-  version = "0-unstable-2026-06-07";
+  version = "0-unstable-2026-08-08";
 
   src = fetchFromGitHub {
     owner = "shadps4-emu";
     repo = "shadps4-qtlauncher";
-    rev = "eadffe744d6f2bb7b21aedeef2cc0f66cdffd6ed";
-    hash = "sha256-tlCP8Cu3UVoclaQ0cIVr89q7wwgkzFVwhMSqpVB6FnM=";
+    rev = "a12b988ef35d98f2222a614c05498b27fef87121";
+    hash = "sha256-ux9iXNV5QiBCyLCyDYTN1WtO+DyMlXrr+8xWX/4TmD4=";
 
     postCheckout = ''
-      cd "$out"
+      git -C "$out" rev-parse --short=8 HEAD > $out/COMMIT
+      date -u -d "@$(git -C "$out" log -1 --pretty=%ct)" "+%Y-%m-%dT%H:%M:%SZ" > $out/SOURCE_DATE_EPOCH
 
-      git rev-parse --short=8 HEAD > $out/COMMIT
-      date -u -d "@$(git log -1 --pretty=%ct)" "+%Y-%m-%dT%H:%M:%SZ" > $out/SOURCE_DATE_EPOCH
-
-      git -C externals submodule update --init --recursive \
+      git -C "$out/externals" submodule update --init --recursive \
         volk \
         json \
         openal-soft \
@@ -64,6 +64,9 @@ clangStdenv.mkDerivation (finalAttrs: {
       --replace-fail "@shadps4-qt@" "$out"
   '';
 
+  # System Zstd is not linked by default
+  env.NIX_LDFLAGS = "-lzstd";
+
   nativeBuildInputs = [
     cmake
     pkg-config
@@ -74,6 +77,8 @@ clangStdenv.mkDerivation (finalAttrs: {
     fmt
     sdl3
     toml11
+    zarchive
+    zstd
     qt6.qtbase
     qt6.qttools
     qt6.qtmultimedia
@@ -94,13 +99,15 @@ clangStdenv.mkDerivation (finalAttrs: {
 
   meta = {
     inherit (shadps4.meta)
+      homepage
+      downloadPage
+      donationPage
       platforms
       license
       maintainers
       ;
 
     description = shadps4.meta.description + " (Qt UI)";
-    homepage = "https://github.com/shadps4-emu/shadps4-qtlauncher";
     mainProgram = "shadPS4QtLauncher";
   };
 })
diff --git a/pkgs/by-name/sh/shadps4/package.nix b/pkgs/by-name/sh/shadps4/package.nix
index 250bcf430d9a..4111f4b3ca71 100644
--- a/pkgs/by-name/sh/shadps4/package.nix
+++ b/pkgs/by-name/sh/shadps4/package.nix
@@ -2,6 +2,7 @@
   lib,
   clangStdenv,
   fetchFromGitHub,
+  fetchpatch2,
   makeWrapper,
 
   nixosTests,
@@ -12,7 +13,9 @@
   cryptopp,
   ffmpeg,
   fmt,
+  freetype,
   half,
+  httplib,
   jack2,
   libdecor,
   libpng,
@@ -21,6 +24,7 @@
   libusb1,
   magic-enum,
   minimp3,
+  miniupnpc,
   miniz,
   nlohmann_json,
   libgbm,
@@ -49,27 +53,37 @@
   vulkan-memory-allocator,
   xbyak,
   xxhash,
+  zarchive,
+  zstd,
   zlib,
   nix-update-script,
+
+  withRpc ? true,
 }:
 
+let
+  abseilCppSrc = fetchFromGitHub {
+    owner = "abseil";
+    repo = "abseil-cpp";
+    tag = "20250512.1";
+    hash = "sha256-eB7OqTO9Vwts9nYQ/Mdq0Ds4T1KgmmpYdzU09VPWOhk=";
+  };
+in
 clangStdenv.mkDerivation (finalAttrs: {
   pname = "shadps4";
-  version = "0.16.0";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     owner = "shadps4-emu";
     repo = "shadPS4";
     tag = "v.${finalAttrs.version}";
-    hash = "sha256-SavSUHtnJeRi2mzIyUhLfLk37Y/PSuI3bbbqWA7qVbg=";
+    hash = "sha256-Z3UwxK+0D3RXKTM0ybYG4U42bInjF05KlMXzxN4UcNg=";
 
     postCheckout = ''
-      cd "$out"
+      git -C "$out" rev-parse --short=8 HEAD > $out/COMMIT
+      date -u -d "@$(git -C "$out" log -1 --pretty=%ct)" "+%Y-%m-%dT%H:%M:%SZ" > $out/SOURCE_DATE_EPOCH
 
-      git rev-parse --short=8 HEAD > $out/COMMIT
-      date -u -d "@$(git log -1 --pretty=%ct)" "+%Y-%m-%dT%H:%M:%SZ" > $out/SOURCE_DATE_EPOCH
-
-      git -C externals submodule update --init --recursive \
+      git -C "$out/externals" submodule update --init --recursive \
         glslang \
         zydis \
         sirit \
@@ -83,10 +97,23 @@ clangStdenv.mkDerivation (finalAttrs: {
         aacdec/fdk-aac \
         spdlog \
         libressl \
-        ImGuiFileDialog
+        ImGuiFileDialog \
+        protobuf
     '';
   };
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  patches = [
+    # https://github.com/shadps4-emu/shadPS4/pull/4786
+    (fetchpatch2 {
+      name = "use-system-zarchive.patch";
+      url = "https://github.com/shadps4-emu/shadPS4/commit/71c48b43570ac8df545d3d96261b0ec7fa37c808.patch?full_index=1";
+      hash = "sha256-MQiw+DGi/85nTSAVrNw2GmwhbBD7/Xy3lCIDMg1HxxU=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace src/common/scm_rev.cpp.in \
       --replace-fail @APP_VERSION@ ${finalAttrs.version} \
@@ -96,6 +123,15 @@ clangStdenv.mkDerivation (finalAttrs: {
       --replace-fail @BUILD_DATE@ $(cat SOURCE_DATE_EPOCH)
   '';
 
+  # System Zstd is not linked by default
+  env.NIX_LDFLAGS = "-lzstd";
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    makeWrapper
+  ];
+
   buildInputs = [
     alsa-lib
     boost
@@ -103,7 +139,9 @@ clangStdenv.mkDerivation (finalAttrs: {
     cryptopp
     ffmpeg
     fmt
+    freetype
     half
+    httplib
     jack2
     libdecor
     libpng
@@ -120,6 +158,7 @@ clangStdenv.mkDerivation (finalAttrs: {
     libxtst
     magic-enum
     minimp3
+    miniupnpc
     miniz
     libgbm
     nlohmann_json
@@ -139,17 +178,17 @@ clangStdenv.mkDerivation (finalAttrs: {
     vulkan-memory-allocator
     xbyak
     xxhash
+    zarchive
+    zstd
     zlib
   ];
 
-  nativeBuildInputs = [
-    cmake
-    pkg-config
-    makeWrapper
-  ];
-
   cmakeFlags = [
+    (lib.cmakeBool "ENABLE_DISCORD_RPC" withRpc)
+    (lib.cmakeBool "ENABLE_TESTS" false)
     (lib.cmakeBool "ENABLE_UPDATER" false)
+    (lib.cmakeBool "ENABLE_SYSTEM_LIBRARIES" true)
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_ABSL" "${abseilCppSrc}")
   ];
 
   # Still in development, help with debugging
@@ -183,7 +222,9 @@ clangStdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Early in development PS4 emulator";
-    homepage = "https://github.com/shadps4-emu/shadPS4";
+    homepage = "https://shadps4.net";
+    downloadPage = "https://shadps4.net/downloads";
+    donationPage = "https://ko-fi.com/shadps4";
     license = lib.licenses.gpl2Plus;
     maintainers = with lib.maintainers; [
       ryand56
diff --git a/pkgs/by-name/sh/share-preview/package.nix b/pkgs/by-name/sh/share-preview/package.nix
index 29be893c1993..79a67050a12f 100644
--- a/pkgs/by-name/sh/share-preview/package.nix
+++ b/pkgs/by-name/sh/share-preview/package.nix
@@ -27,8 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
-    name = "share-preview-${finalAttrs.version}";
+    inherit (finalAttrs) pname version src;
     hash = "sha256-MC5MsoFdeCvF9nIFoYCKoBBpgGysBH36OdmTqbIJt8s=";
   };
 
diff --git a/pkgs/by-name/sh/shopify-cli/package.nix b/pkgs/by-name/sh/shopify-cli/package.nix
index 830fe89f013b..d1553031cd71 100644
--- a/pkgs/by-name/sh/shopify-cli/package.nix
+++ b/pkgs/by-name/sh/shopify-cli/package.nix
@@ -19,13 +19,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "shopify";
-  version = "4.6.0";
+  version = "4.6.1";
 
   src = fetchFromGitHub {
     owner = "shopify";
     repo = "cli";
     tag = finalAttrs.version;
-    hash = "sha256-iSXONoEcnLvaEGRzsXhyogjOw3jiQ5+JqDyKgplL9zg=";
+    hash = "sha256-c+fp/ml5x4CLmpkTxAZrB/zqaDWuG3cgrjNdmuvHdKY=";
   };
 
   pnpmDeps = fetchPnpmDeps {
diff --git a/pkgs/by-name/sn/snooze/package.nix b/pkgs/by-name/sn/snooze/package.nix
index 1c3432259a8b..179c146f6712 100644
--- a/pkgs/by-name/sn/snooze/package.nix
+++ b/pkgs/by-name/sn/snooze/package.nix
@@ -5,12 +5,12 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "snooze";
-  version = "0.5.1";
+  version = "0.6";
   src = fetchFromGitHub {
     owner = "leahneukirchen";
     repo = "snooze";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-ghWQ/bslWJCcsQ8OqS3MHZiiuGzbgzat6mkG2avSbEk=";
+    sha256 = "sha256-nPJ1W/37duJoyKopkQl/UHDv+MaRFHGuiQI16VIU6HA=";
   };
   makeFlags = [
     "DESTDIR=$(out)"
diff --git a/pkgs/by-name/so/solanum/package.nix b/pkgs/by-name/so/solanum/package.nix
index 4d61443b4844..accb21344c9f 100644
--- a/pkgs/by-name/so/solanum/package.nix
+++ b/pkgs/by-name/so/solanum/package.nix
@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "solanum";
-  version = "0-unstable-2026-06-23";
+  version = "0-unstable-2026-07-26";
 
   src = fetchFromGitHub {
     owner = "solanum-ircd";
     repo = "solanum";
-    rev = "a17cc145a7de564e49b84807d335289f30b12d00";
-    hash = "sha256-tlocAC1U5WM3AKPxmBqqGGN05t+rwgA3p2im0NKKBuQ=";
+    rev = "115b1e2e8c3d94a490cdcb0fc1f7a4448cefc6bf";
+    hash = "sha256-xy3nRooKpTmEr8WRdU8Xs4bmNwLv9oTk2y5KvpZjfDc=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/so/source-meta-json-schema/package.nix b/pkgs/by-name/so/source-meta-json-schema/package.nix
index e855e09bffbd..f37578f0a5fc 100644
--- a/pkgs/by-name/so/source-meta-json-schema/package.nix
+++ b/pkgs/by-name/so/source-meta-json-schema/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "source-meta-json-schema";
-  version = "16.5.0";
+  version = "16.7.0";
 
   src = fetchFromGitHub {
     owner = "sourcemeta";
     repo = "jsonschema";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5oVWIvI4GRhyR7osJww5WMGFXcoAQwXH3QDWPZHn4lY=";
+    hash = "sha256-mW3tVzXy/CY6xTdG3/xkVMB2Z8iT88ZOrG390mdUwbQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sp/sparrow/package.nix b/pkgs/by-name/sp/sparrow/package.nix
index 08fce8ce298d..3df9fa821aa4 100644
--- a/pkgs/by-name/sp/sparrow/package.nix
+++ b/pkgs/by-name/sp/sparrow/package.nix
@@ -24,8 +24,7 @@
 }:
 
 let
-  pname = "sparrow";
-  version = "2.4.2";
+  version = "2.5.3";
 
   openjdk = zulu25.override { enableJavaFX = true; };
 
@@ -36,12 +35,26 @@ let
     }
     ."${stdenvNoCC.hostPlatform.system}";
 
+  javaArch =
+    {
+      x86_64-linux = "x64";
+      aarch64-linux = "aarch64";
+    }
+    ."${stdenvNoCC.hostPlatform.system}";
+
+  jnaArch =
+    {
+      x86_64-linux = "x86-64";
+      aarch64-linux = "aarch64";
+    }
+    ."${stdenvNoCC.hostPlatform.system}";
+
   src = fetchurl {
-    url = "https://github.com/sparrowwallet/${pname}/releases/download/${version}/sparrowwallet-${version}-${sparrowArch}.tar.gz";
+    url = "https://github.com/sparrowwallet/sparrow/releases/download/${version}/sparrowwallet-${version}-${sparrowArch}.tar.gz";
     hash =
       {
-        x86_64-linux = "sha256-BvtQZ+b+Hj+9eBdLg/KfYUeRQth0LWwwbZUQMfyTayE=";
-        aarch64-linux = "sha256-SMVO07kuTo1Yfj+8QfPOvkLR4551tQadJPoIMdT9GFE=";
+        x86_64-linux = "sha256-xRtMh8nYHzjMyb8zSPQZNIbcfQIuKk4izfPW/PLK2zg=";
+        aarch64-linux = "sha256-Kl4SV5MSIfCszUI2uN9/eLK+25gkSWkRHoSf8X837VM=";
       }
       ."${stdenvNoCC.hostPlatform.system}";
 
@@ -71,13 +84,13 @@ let
   };
 
   manifest = fetchurl {
-    url = "https://github.com/sparrowwallet/${pname}/releases/download/${version}/${pname}-${version}-manifest.txt";
-    hash = "sha256-cv/bkUZArASgWjgEphdWc6p8R9uOOkT+Idc53sjEOQ0=";
+    url = "https://github.com/sparrowwallet/sparrow/releases/download/${version}/sparrow-${version}-manifest.txt";
+    hash = "sha256-oVR5lJOWHTyEe+fBbxa+ZPh9GERHlZbZMPmaGImmdhg=";
   };
 
   manifestSignature = fetchurl {
-    url = "https://github.com/sparrowwallet/${pname}/releases/download/${version}/${pname}-${version}-manifest.txt.asc";
-    hash = "sha256-lIamtUX45HVTrUJKbiGsFkRanM17KaZS0NwlTAoptEE=";
+    url = "https://github.com/sparrowwallet/sparrow/releases/download/${version}/sparrow-${version}-manifest.txt.asc";
+    hash = "sha256-9ohRv/3rcOr78Mr0Bfny9zn+SqpLFaf0hn9G2LMAc8Q=";
   };
 
   publicKey = ./publickey.asc;
@@ -96,11 +109,11 @@ let
       --add-opens=javafx.controls/javafx.scene.control.cell=com.sparrowwallet.sparrow
       --add-opens=org.controlsfx.controls/impl.org.controlsfx.skin=com.sparrowwallet.sparrow
       --add-opens=org.controlsfx.controls/impl.org.controlsfx.skin=javafx.fxml
-      --add-opens=javafx.graphics/com.sun.javafx.tk=centerdevice.nsmenufx
-      --add-opens=javafx.graphics/com.sun.javafx.tk.quantum=centerdevice.nsmenufx
-      --add-opens=javafx.graphics/com.sun.glass.ui=centerdevice.nsmenufx
-      --add-opens=javafx.controls/com.sun.javafx.scene.control=centerdevice.nsmenufx
-      --add-opens=javafx.graphics/com.sun.javafx.menu=centerdevice.nsmenufx
+      --add-opens=javafx.graphics/com.sun.javafx.tk=nsmenufx
+      --add-opens=javafx.graphics/com.sun.javafx.tk.quantum=nsmenufx
+      --add-opens=javafx.graphics/com.sun.glass.ui=nsmenufx
+      --add-opens=javafx.controls/com.sun.javafx.scene.control=nsmenufx
+      --add-opens=javafx.graphics/com.sun.javafx.menu=nsmenufx
       --add-opens=javafx.graphics/com.sun.glass.ui=com.sparrowwallet.sparrow
       --add-opens=javafx.graphics/javafx.scene.input=com.sparrowwallet.sparrow
       --add-opens=javafx.graphics/com.sun.javafx.application=com.sparrowwallet.sparrow
@@ -117,10 +130,17 @@ let
       --add-reads=com.sparrowwallet.merged.module=com.fasterxml.jackson.core
       --add-reads=com.sparrowwallet.merged.module=co.nstant.in.cbor
       --add-reads=kotlin.stdlib=kotlinx.coroutines.core
+      --enable-native-access=com.sparrowwallet.drongo
+      --enable-native-access=com.sparrowwallet.merged.module
+      --enable-native-access=javafx.graphics
+      --enable-native-access=com.fazecast.jSerialComm
+      --enable-native-access=org.usb4java
       -m com.sparrowwallet.sparrow
     )
 
-    XDG_DATA_DIRS=${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}:${gtk3}/share/gsettings-schemas/${gtk3.name}:$XDG_DATA_DIRS ${openjdk}/bin/java ''${params[@]} $@
+    XDG_DATA_DIRS=${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}:${gtk3}/share/gsettings-schemas/${gtk3.name}:$XDG_DATA_DIRS \
+    LD_LIBRARY_PATH=@nativeLibs@''${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH} \
+    ${openjdk}/bin/java "''${params[@]}" "$@"
   '';
 
   torWrapper = writeScript "tor-wrapper" ''
@@ -159,6 +179,9 @@ let
       gnugrep
       openjdk
       autoPatchelfHook
+    ];
+
+    buildInputs = [
       (lib.getLib stdenv.cc.cc)
       zlib
       libusb1
@@ -175,46 +198,62 @@ let
 
       # Delete unneeded native libs.
 
-      rm -fR com.sparrowwallet.merged.module/com/sun/jna/freebsd-x86-64
-      rm -fR com.sparrowwallet.merged.module/com/sun/jna/dragonflybsd-x86-64
-      rm -fR com.sparrowwallet.merged.module/com/sun/jna/freebsd-aarch64
-      rm -fR com.sparrowwallet.merged.module/com/sun/jna/freebsd-x86
-      rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-arm
-      rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-armel
-      rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-mips64el
-      rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-ppc
-      rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-ppc64le
-      rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-s390x
-      rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-x86
-      rm -fR com.sparrowwallet.merged.module/com/sun/jna/openbsd-x86-64
-      rm -fR com.sparrowwallet.merged.module/com/sun/jna/openbsd-x86
-      rm -fR com.sparrowwallet.merged.module/com/sun/jna/sunos-sparc
-      rm -fR com.sparrowwallet.merged.module/com/sun/jna/sunos-sparcv9
-      rm -fR com.sparrowwallet.merged.module/com/sun/jna/sunos-x86-64
-      rm -fR com.sparrowwallet.merged.module/com/sun/jna/sunos-x86
-      rm -fR com.github.sarxos.webcam.capture/com/github/sarxos/webcam/ds/buildin/lib/linux_armel
-      rm -fR com.github.sarxos.webcam.capture/com/github/sarxos/webcam/ds/buildin/lib/linux_armhf
-      rm -fR com.github.sarxos.webcam.capture/com/github/sarxos/webcam/ds/buildin/lib/linux_x86
-      rm -fR openpnp.capture.java/darwin-aarch64
-      rm -fR openpnp.capture.java/darwin-x86-64
-      rm -fR openpnp.capture.java/win32-x86-64
-      rm -fR com.nativelibs4java.bridj/org/bridj/lib/linux_arm32_armel
-      rm -fR com.nativelibs4java.bridj/org/bridj/lib/linux_armel
-      rm -fR com.nativelibs4java.bridj/org/bridj/lib/linux_armhf
-      rm -fR com.nativelibs4java.bridj/org/bridj/lib/linux_x86
-      rm -fR com.nativelibs4java.bridj/org/bridj/lib/sunos_x64
-      rm -fR com.nativelibs4java.bridj/org/bridj/lib/sunos_x86
-      rm -fR com.sparrowwallet.merged.module/linux-arm
-      rm -fR com.sparrowwallet.merged.module/linux-x86
-      rm -fR com.fazecast.jSerialComm/FreeBSD
-      rm -fR com.fazecast.jSerialComm/OpenBSD
-      rm -fR com.fazecast.jSerialComm/Android
-      rm -fR com.fazecast.jSerialComm/Solaris
+      rm -R com.sparrowwallet.merged.module/com/sun/jna/win32
+      rm -R com.fazecast.jSerialComm/FreeBSD
+      rm -R com.fazecast.jSerialComm/OpenBSD
+      rm -R com.fazecast.jSerialComm/Android
+      rm -R com.fazecast.jSerialComm/Solaris
+      rm -R com.fazecast.jSerialComm/OSX
+      rm -R com.fazecast.jSerialComm/Windows
+      rm -R com.fazecast.jSerialComm/Linux/armv5
+      rm -R com.fazecast.jSerialComm/Linux/armv6hf
+      rm -R com.fazecast.jSerialComm/Linux/armv7hf
+      rm -R com.fazecast.jSerialComm/Linux/armv8_32
+      rm -R com.fazecast.jSerialComm/Linux/ppc64le
+      rm -R com.fazecast.jSerialComm/Linux/x86
+
+      echo "--- Remaining native libraries in modules ---"
+      find . -name "*.so" -o -name "*.dll" -o -name "*.dylib" -o -name "*.jnilib" -o -name "*.a"
+      echo "--------------------------------------------"
 
       ls | xargs -d " " -- echo > ../manifest.txt
       find . | grep "\.so$" | xargs -- chmod ugo+x
       popd
 
+      # Provide native libs for LD_LIBRARY_PATH
+      mkdir native-libs
+      cp lib/runtime/lib/libargon2.so \
+         lib/runtime/lib/libbwt_jni.so \
+         lib/runtime/lib/libopenpnp-capture.so \
+         lib/runtime/lib/libzbar.so \
+         native-libs/
+      chmod ugo+x native-libs/*.so
+
+      # secp256k1 explicitly looks in java.home/lib or inside the module jar
+      mkdir -p modules/com.sparrowwallet.drongo/native/linux/${javaArch}
+      cp lib/runtime/lib/libsecp256k1.so modules/com.sparrowwallet.drongo/native/linux/${javaArch}/
+
+      # JNA extracts from resource path
+      mkdir -p modules/com.sparrowwallet.merged.module/com/sun/jna/linux-${jnaArch}
+      cp lib/runtime/lib/libjnidispatch.so modules/com.sparrowwallet.merged.module/com/sun/jna/linux-${jnaArch}/
+
+      # hidapi extracts from resource path via JNA
+      mkdir -p modules/com.sparrowwallet.merged.module/linux-${jnaArch}
+      cp lib/runtime/lib/libhidapi.so modules/com.sparrowwallet.merged.module/linux-${jnaArch}/
+      cp lib/runtime/lib/libhidapi-libusb.so modules/com.sparrowwallet.merged.module/linux-${jnaArch}/
+
+      # usb4java extracts from resource path
+      mkdir -p modules/org.usb4java/org/usb4java/linux-${jnaArch}
+      cp lib/runtime/lib/libusb4java.so modules/org.usb4java/org/usb4java/linux-${jnaArch}/
+
+      # jzbar extracts from resource path
+      mkdir -p modules/io.github.doblon8.jzbar/native/linux/${javaArch}
+      cp lib/runtime/lib/libzbar.so modules/io.github.doblon8.jzbar/native/linux/${javaArch}/
+
+      # openpnp extracts from resource path
+      mkdir -p modules/io.github.doblon8.openpnp.capture/native/linux/${javaArch}
+      cp lib/runtime/lib/libopenpnp-capture.so modules/io.github.doblon8.openpnp.capture/native/linux/${javaArch}/
+
       # Replace the embedded Tor binary (which is in a Tar archive)
       # with one from Nixpkgs.
       gzip -c ${torWrapper}  > tor.gz
@@ -225,6 +264,7 @@ let
       mkdir -p $out
       cp manifest.txt $out/
       cp -r modules/ $out/
+      cp -r native-libs/ $out/
     '';
   };
 in
@@ -278,9 +318,11 @@ stdenvNoCC.mkDerivation rec {
 
     mkdir -p $out/bin $out
     ln -s ${sparrow-modules}/modules $out/lib
-    install -D -m 777 ${launcher} $out/bin/sparrow-desktop
+    install -D -m 555 ${launcher} $out/bin/sparrow-desktop
     substituteAllInPlace $out/bin/sparrow-desktop
-    substituteInPlace $out/bin/sparrow-desktop --subst-var-by jdkModules ${jdk-modules}
+    substituteInPlace $out/bin/sparrow-desktop \
+      --subst-var-by jdkModules ${jdk-modules} \
+      --subst-var-by nativeLibs ${sparrow-modules}/native-libs
 
     mkdir -p $out/share/icons
     ln -s ${sparrow-icons}/hicolor $out/share/icons
@@ -313,6 +355,7 @@ stdenvNoCC.mkDerivation rec {
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
       msgilligan
+      eymeric
     ];
     platforms = [
       "x86_64-linux"
diff --git a/pkgs/by-name/sp/spec-kit/package.nix b/pkgs/by-name/sp/spec-kit/package.nix
index 1c3d33667716..3005c3a5429a 100644
--- a/pkgs/by-name/sp/spec-kit/package.nix
+++ b/pkgs/by-name/sp/spec-kit/package.nix
@@ -7,13 +7,13 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "spec-kit";
-  version = "0.0.90";
+  version = "0.16.1";
 
   src = fetchFromGitHub {
     owner = "github";
     repo = "spec-kit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ulAii6//DT9uqLxYk6qmX6dwWWjhuARbBmjH5u1YGGM=";
+    hash = "sha256-Js/yEO63OG4rZ32Vm5qGDOFlVnitxqr/NIIQS6kwdRs=";
   };
 
   pyproject = true;
@@ -22,17 +22,17 @@ python3Packages.buildPythonApplication (finalAttrs: {
     hatchling
   ];
 
-  dependencies =
-    with python3Packages;
-    [
-      typer
-      rich
-      httpx
-      platformdirs
-      readchar
-      truststore
-    ]
-    ++ httpx.optional-dependencies.socks;
+  dependencies = with python3Packages; [
+    click
+    json5
+    packaging
+    pathspec
+    platformdirs
+    pyyaml
+    readchar
+    rich
+    typer
+  ];
 
   pythonImportsCheck = [
     "specify_cli"
@@ -45,7 +45,10 @@ python3Packages.buildPythonApplication (finalAttrs: {
     homepage = "https://github.com/github/spec-kit";
     changelog = "https://github.com/github/spec-kit/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ luochen1990 ];
+    maintainers = [
+      lib.maintainers.luochen1990
+      lib.maintainers."3mp3ri0r"
+    ];
     mainProgram = "specify";
   };
 })
diff --git a/pkgs/by-name/sq/sqlit-tui/package.nix b/pkgs/by-name/sq/sqlit-tui/package.nix
index 4e44a1ecb7e4..92d21228813a 100644
--- a/pkgs/by-name/sq/sqlit-tui/package.nix
+++ b/pkgs/by-name/sq/sqlit-tui/package.nix
@@ -35,6 +35,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     psycopg2
     pyodbc
     pyperclip
+    pytz
     sqlparse
     sshtunnel
     textual
@@ -52,8 +53,11 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   pythonImportsCheck = [ "sqlit" ];
 
-  disabledTests = [
+  disabledTestPaths = [
     "tests/ui/" # UI tests fail in the sandbox
+  ];
+
+  disabledTests = [
     "test_installer_cancel_terminates_process" # timeout error
     "test_detect_strategy_pip_user_fallback" # AssertionError: assert 'externally-managed' == 'pip-user'
   ];
diff --git a/pkgs/by-name/sq/squawk/package.nix b/pkgs/by-name/sq/squawk/package.nix
index c07e786f30a4..01caac06e766 100644
--- a/pkgs/by-name/sq/squawk/package.nix
+++ b/pkgs/by-name/sq/squawk/package.nix
@@ -51,6 +51,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     homepage = "https://squawkhq.com";
     changelog = "https://github.com/sbdchd/squawk/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.gpl3Only;
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.dibenzepin ];
   };
 })
diff --git a/pkgs/by-name/ss/ssh-vault/package.nix b/pkgs/by-name/ss/ssh-vault/package.nix
index c7173c219a6e..9bff6af5a913 100644
--- a/pkgs/by-name/ss/ssh-vault/package.nix
+++ b/pkgs/by-name/ss/ssh-vault/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ssh-vault";
-  version = "1.2.14";
+  version = "1.3.2";
 
   src = fetchFromGitHub {
     owner = "ssh-vault";
     repo = "ssh-vault";
     tag = finalAttrs.version;
-    hash = "sha256-wxiADf5KjAD/lZBOYb7vbWYcfw9Xmk+gHmN9cPQ0vvI=";
+    hash = "sha256-JwCW4IcA1B6A+ax+mITVfbrT/Od+y9NtDezE+KjbHlE=";
   };
 
-  cargoHash = "sha256-Ab6XXCdT97reDJYqZBLELH2XgBYHZ4pLF/byELWy4j8=";
+  cargoHash = "sha256-aXnFmpxAjX6dLzzNXTJP7iBnuVjGNGcmwia7PNOkeTg=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/st/stackit-cli/package.nix b/pkgs/by-name/st/stackit-cli/package.nix
index 114bafb0b103..404724e61f69 100644
--- a/pkgs/by-name/st/stackit-cli/package.nix
+++ b/pkgs/by-name/st/stackit-cli/package.nix
@@ -12,16 +12,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "stackit-cli";
-  version = "0.68.0";
+  version = "0.70.0";
 
   src = fetchFromGitHub {
     owner = "stackitcloud";
     repo = "stackit-cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ifi+lUXZ0pn5GdjdeyjRD1Xixe/wZGlUp7gKvH6udng=";
+    hash = "sha256-jKOJPpmELJBkljVetIJkd5cZ2FMz687FEUCwV2ZVFjA=";
   };
 
-  vendorHash = "sha256-hAgtOsfHh5QtbWbItHAckuw7wP+aeAAL5JDYZXokgJ0=";
+  vendorHash = "sha256-ptS1n1Z74q6NnFiOqDrBZLjjfNdpaZuZiggXKg5hRO4=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/st/stakk/package.nix b/pkgs/by-name/st/stakk/package.nix
index def14f812ca2..01edc4105249 100644
--- a/pkgs/by-name/st/stakk/package.nix
+++ b/pkgs/by-name/st/stakk/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "stakk";
-  version = "1.17.2";
+  version = "1.19.0";
 
   src = fetchFromGitHub {
     owner = "glennib";
     repo = "stakk";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+q94xzOV9rA7B1pBBt9ZjESzcV8mhraiMGgDQekZM7Y=";
+    hash = "sha256-tbzy8+dt5nxGODhng1Mb07PiEesIMZ0DROPLZBDWusI=";
   };
 
-  cargoHash = "sha256-/Wx1n5zt+rBGtM04bi2PTiO8zqCJvgKz5aoTo7f08NI=";
+  cargoHash = "sha256-t/O+EXeuGZXQn1fwVnjF2rAleDUWFTwIaSF+NSGrX4w=";
 
   useNextest = true;
 
diff --git a/pkgs/by-name/st/stellar-core/package.nix b/pkgs/by-name/st/stellar-core/package.nix
index db357501e549..8131d0674dc7 100644
--- a/pkgs/by-name/st/stellar-core/package.nix
+++ b/pkgs/by-name/st/stellar-core/package.nix
@@ -2,7 +2,9 @@
   autoconf,
   automake,
   bison,
+  cargo,
   fetchFromGitHub,
+  fetchpatch2,
   flex,
   gitMinimal,
   lib,
@@ -16,7 +18,6 @@
   rustPlatform,
   stdenv,
   symlinkJoin,
-  cargo,
 }:
 
 let
@@ -104,6 +105,23 @@ stdenv.mkDerivation (finalAttrs: {
       '';
     };
 
+  # ethnum <= 1.5.2 fails on rustc 1.97+ (TryFromIntError is no longer ZST).
+  # Protocols p21-p26 pin ethnum 1.5.0 in Cargo.lock / dep-tree expects, so keep
+  # that version and apply the upstream 1.5.3 source fix in the vendored crate.
+  # https://github.com/nlordell/ethnum-rs/pull/58
+  postPatch = ''
+    shopt -s nullglob
+    for crate in "$cargoDepsCopy"/source-registry-*/ethnum-1.5.0; do
+      patch -p1 -d "$crate" < ${
+        fetchpatch2 {
+          name = "ethnum-1.5.0-rustc-1.97.patch";
+          url = "https://github.com/nlordell/ethnum-rs/commit/87e3457c095c98fcac554548ee80f56e0cfb80ae.patch?full_index=1";
+          hash = "sha256-xG3RQg2vF+XW9IiYWaNyOF39WipSeoZGrygsOJ3XgIs=";
+        }
+      }
+    done
+  '';
+
   strictDeps = true;
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/st/stratisd/package.nix b/pkgs/by-name/st/stratisd/package.nix
index 4f480165801b..47730158964f 100644
--- a/pkgs/by-name/st/stratisd/package.nix
+++ b/pkgs/by-name/st/stratisd/package.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
+    inherit (finalAttrs) pname version src;
     hash = "sha256-zA+GEKmg5iV1PaGh0yjNb4h52PH7PwpN53xLV8P9Gac=";
   };
 
diff --git a/pkgs/by-name/st/strictdoc/package.nix b/pkgs/by-name/st/strictdoc/package.nix
index 42d2e3cc0945..2efe8fe46677 100644
--- a/pkgs/by-name/st/strictdoc/package.nix
+++ b/pkgs/by-name/st/strictdoc/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "strictdoc";
-  version = "0.22.0";
+  version = "0.27.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "strictdoc-project";
     repo = "strictdoc";
     tag = finalAttrs.version;
-    hash = "sha256-mDsI/pGMIcyfFqX9uWWlg09As+4Mth9WK5xylQvSVGM=";
+    hash = "sha256-z9e/ZkKeiuNgkn0FoAYX2fxo60TH5hqsLRzpaVvS2u4=";
   };
 
   build-system = [
@@ -48,10 +48,12 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     textx
     toml
     tree-sitter
+    tree-sitter-grammars.tree-sitter-c
     tree-sitter-grammars.tree-sitter-cpp
     tree-sitter-grammars.tree-sitter-python
     tree-sitter-grammars.tree-sitter-rust
     uvicorn
+    watchdog
     webdriver-manager
     websockets
     xlrd
diff --git a/pkgs/by-name/su/sundtek/package.nix b/pkgs/by-name/su/sundtek/package.nix
index 733b36702a35..61845738a6b9 100644
--- a/pkgs/by-name/su/sundtek/package.nix
+++ b/pkgs/by-name/su/sundtek/package.nix
@@ -10,7 +10,7 @@ let
     "$out/bin"
   ];
   platform =
-    with stdenv;
+    with stdenv.hostPlatform;
     if isx86_64 then
       "64bit"
     else if isi686 then
@@ -18,7 +18,7 @@ let
     else
       throw "${system} not considered in build derivation. Might still be supported.";
   sha256 =
-    with stdenv;
+    with stdenv.hostPlatform;
     if isx86_64 then
       "1jfsng5n3phw5rqpkid9m5j7m7zgj5bifh7swvba7f97y6imdaax"
     else
diff --git a/pkgs/by-name/sw/swiftformat/package.nix b/pkgs/by-name/sw/swiftformat/package.nix
index 2d44cd06482a..07e5d56fa509 100644
--- a/pkgs/by-name/sw/swiftformat/package.nix
+++ b/pkgs/by-name/sw/swiftformat/package.nix
@@ -10,13 +10,13 @@
 
 swift.stdenv.mkDerivation (finalAttrs: {
   pname = "swiftformat";
-  version = "0.61.1";
+  version = "0.62.1";
 
   src = fetchFromGitHub {
     owner = "nicklockwood";
     repo = "SwiftFormat";
     rev = finalAttrs.version;
-    sha256 = "sha256-h0d/vdoKZuYJkMO+TmFFgomaSVA94P+MKclSlBlIleE=";
+    sha256 = "sha256-LW/ihr0PaQyd8/SbOD1p8MOETbALO1RQMaEspt3y0Hs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ta/taskwarrior3/package.nix b/pkgs/by-name/ta/taskwarrior3/package.nix
index 895488f43683..78473a434bfb 100644
--- a/pkgs/by-name/ta/taskwarrior3/package.nix
+++ b/pkgs/by-name/ta/taskwarrior3/package.nix
@@ -34,8 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
     fetchSubmodules = true;
   };
   cargoDeps = rustPlatform.fetchCargoVendor {
-    name = "${finalAttrs.pname}-${finalAttrs.version}-cargo-deps";
-    inherit (finalAttrs) src;
+    inherit (finalAttrs) pname version src;
     hash = "sha256-03HG8AGe6PJ516zL23iNjGUYmGOZa8NuFljb1ll2pjs=";
   };
 
diff --git a/pkgs/by-name/ta/taze/package.nix b/pkgs/by-name/ta/taze/package.nix
index e3fb14d8c429..a884d6969ef7 100644
--- a/pkgs/by-name/ta/taze/package.nix
+++ b/pkgs/by-name/ta/taze/package.nix
@@ -12,20 +12,20 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "taze";
-  version = "19.16.0";
+  version = "20.0.1";
 
   src = fetchFromGitHub {
     owner = "antfu-collective";
     repo = "taze";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VVWceyF/jgsdJt33FbHJUNCey5peIB3BxhmOwxhVaHI=";
+    hash = "sha256-0BvMBb7QFxZgR+6V1xP3CZWmmW3VU3r2/rtMytm/Eiw=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_11;
     fetcherVersion = 4;
-    hash = "sha256-p0rkOHqieg1K+QWAMr2JtXL5Cq6iEa+Skt0B0Iq/OpI=";
+    hash = "sha256-mylj8NazfOAs9wHoCawcU0/5xy2pYGkKb/B9g5BhUuY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/te/temporal_capi/package.nix b/pkgs/by-name/te/temporal_capi/package.nix
index a5a7fc7a7d2d..310c3e75a465 100644
--- a/pkgs/by-name/te/temporal_capi/package.nix
+++ b/pkgs/by-name/te/temporal_capi/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "temporal_capi";
-  version = "0.2.5";
+  version = "0.2.6";
 
   src = fetchFromGitHub {
     owner = "boa-dev";
     repo = "temporal";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-A4bxwyIBMvMH0YvZJSr5K2J390RulZZny7Ghh7pIG78=";
+    hash = "sha256-nKE5n/ingB/+sEPJvpUQVsjCn+4/EPpcfZAM91CCZDE=";
   };
 
-  cargoHash = "sha256-u/ZpbSpwJBC0Z+yxlUwWOq23GaUSEr0Tqk30nSimGuY=";
+  cargoHash = "sha256-sE4I1TW6XEgdqcPL0kRHQ+usb1UYIvbf8ujpJHu4LXo=";
 
   postPatch = ''
     # Force crate-type to include staticlib
diff --git a/pkgs/by-name/te/tensorflow-lite/package.nix b/pkgs/by-name/te/tensorflow-lite/package.nix
index 3ed4c29c06e3..5de65d593658 100644
--- a/pkgs/by-name/te/tensorflow-lite/package.nix
+++ b/pkgs/by-name/te/tensorflow-lite/package.nix
@@ -32,7 +32,7 @@ let
       or (throw "unsupported host system ${hostPlatform.system} with build system ${buildPlatform.system}");
 in
 buildBazelPackage rec {
-  name = "tensorflow-lite";
+  pname = "tensorflow-lite";
   version = "2.13.0";
 
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/te/termsonic/package.nix b/pkgs/by-name/te/termsonic/package.nix
index 4ebf198eb4cc..6f402ed9a573 100644
--- a/pkgs/by-name/te/termsonic/package.nix
+++ b/pkgs/by-name/te/termsonic/package.nix
@@ -7,14 +7,14 @@
 }:
 buildGoModule {
   pname = "termsonic";
-  version = "0-unstable-2025-01-07";
+  version = "0-unstable-2026-08-07";
 
   src = fetchzip {
-    url = "https://git.sixfoisneuf.fr/termsonic/snapshot/termsonic-1dd63d453b109c79967726106035cda9744bbe11.zip";
-    hash = "sha256-HPI4G+bGHejTwVsb8YIU6b7KnIrkqzDf8zZQAWmcfks=";
+    url = "https://git.sixfoisneuf.fr/termsonic/snapshot/termsonic-dd778fcc6bee41cd7ae9f6e173e7dd6f16e1f53d.zip";
+    hash = "sha256-m48lJvJ83NoFuN05UH5BFTNoSftKa4giGJr3CWdaqnA=";
   };
 
-  vendorHash = "sha256-+v7i69b4d11IGnraE6ROscFmqCVLHnkyI2pW+NS1v8k=";
+  vendorHash = "sha256-Dptiuu1KPZrmIYwQG1gIVb9jaJXlQ+Nv6e33wZbgiqA=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/to/toppler/gcc14.patch b/pkgs/by-name/to/toppler/gcc14.patch
deleted file mode 100644
index 9582fe694bb0..000000000000
--- a/pkgs/by-name/to/toppler/gcc14.patch
+++ /dev/null
@@ -1,85 +0,0 @@
-diff --git a/Makefile b/Makefile
-index a6a140f..fb9a8b9 100644
---- a/Makefile
-+++ b/Makefile
-@@ -518,7 +518,7 @@ src/po/%.po: _build/toppler.pot
- # TODO dist and windist..
- 
- .PHONY: install
--install: toppler.dat toppler $(TRANSLATIONFILES_INST)
-+install: toppler $(TRANSLATIONFILES_INST)
- 	$(INSTALL) -m755 -d $(DESTDIR)$(PKGDATADIR)
- 	$(INSTALL) -m755 -d $(DESTDIR)$(BINDIR)
- 	$(INSTALL) -m755 -d $(DESTDIR)$(MANDIR)/man6
-diff --git a/src/decl.cc b/src/decl.cc
-index f80f83e..8a7bbd9 100644
---- a/src/decl.cc
-+++ b/src/decl.cc
-@@ -22,6 +22,7 @@
- #include <SDL.h>
- 
- #include <cstdlib>
-+#include <algorithm>
- #include <cstring>
- #include <sys/stat.h>
- #include <unistd.h>
-diff --git a/src/keyb.cc b/src/keyb.cc
-index c3c13df..7d37847 100644
---- a/src/keyb.cc
-+++ b/src/keyb.cc
-@@ -156,7 +156,7 @@ static void handleEvents(void) {
-       mouse_button = e.button.button;
-       break;
-     case SDL_QUIT:
--      fprintf(stderr, _("Wheee!!\n").c_str());
-+      fprintf(stderr, "%s", _("Wheee!!\n").c_str());
-       exit(0);
-       break;
- 
-diff --git a/src/level.cc b/src/level.cc
-index e1e2bb8..ac2faf3 100644
---- a/src/level.cc
-+++ b/src/level.cc
-@@ -27,6 +27,7 @@
- #endif
- 
- #include "decl.h"
-+#include <algorithm>
- 
- #ifdef _WIN32
- #include <direct.h>
-diff --git a/src/main.cc b/src/main.cc
-index 522d041..ffc8e40 100644
---- a/src/main.cc
-+++ b/src/main.cc
-@@ -46,7 +46,7 @@ static bool parse_arguments(int argc, char *argv[]) {
-       if (parm >= '0' && parm <= '9') {
-         printf(_("Debug level is now %c.\n").c_str(), parm);
-         config.debug_level(parm - '0');
--      } else printf(_("Illegal debug level value, using default.\n").c_str());
-+      } else printf("%s", _("Illegal debug level value, using default.\n").c_str());
-     } else {
-       printhelp();
-       return false;
-@@ -110,7 +110,7 @@ int main(int argc, char *argv[]) {
-     atexit(QuitFunction);
-     srand(time(0));
-     startgame();
--    printf(_("Thanks for playing!\n").c_str());
-+    printf("%s", _("Thanks for playing!\n").c_str());
-     SDL_ShowCursor(mouse);
-     SDL_Quit();
-   }
-diff --git a/src/screen.cc b/src/screen.cc
-index eb18543..ce23571 100644
---- a/src/screen.cc
-+++ b/src/screen.cc
-@@ -30,6 +30,8 @@
- #include "keyb.h"
- #include "configuration.h"
- 
-+#include <algorithm>
-+
- static SDL_Surface *display = nullptr;
- static SDL_Window *sdlWindow = nullptr;
- static SDL_Renderer *sdlRenderer = nullptr;
diff --git a/pkgs/by-name/to/toppler/package.nix b/pkgs/by-name/to/toppler/package.nix
deleted file mode 100644
index c8db49d899f8..000000000000
--- a/pkgs/by-name/to/toppler/package.nix
+++ /dev/null
@@ -1,91 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitLab,
-  nix-update-script,
-  writableTmpDirAsHomeHook,
-
-  buildPackages,
-  pkg-config,
-  gettext,
-  povray,
-  imagemagick,
-  gimp2,
-
-  sdl2-compat,
-  SDL2_mixer,
-  SDL2_image,
-  libpng,
-  zlib,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "toppler";
-  version = "1.3";
-
-  src = fetchFromGitLab {
-    owner = "roever";
-    repo = "toppler";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-ecEaELu52Nmov/BD9VzcUw6wyWeHJcsKQkEzTnaW330=";
-  };
-
-  strictDeps = true;
-  enableParallelBuilding = true;
-
-  depsBuildBuild = [
-    buildPackages.stdenv.cc
-    pkg-config
-    sdl2-compat
-    SDL2_image
-    libpng
-    zlib
-  ];
-
-  nativeBuildInputs = [
-    pkg-config
-    gettext
-    povray
-    imagemagick
-    gimp2
-    # GIMP needs a writable home
-    writableTmpDirAsHomeHook
-  ];
-
-  buildInputs = [
-    sdl2-compat
-    SDL2_mixer
-    zlib
-  ];
-
-  patches = [
-    # Based on https://gitlab.com/roever/toppler/-/merge_requests/3
-    ./gcc14.patch
-  ];
-
-  makeFlags = [
-    "CXX_NATIVE=$(CXX_FOR_BUILD)"
-    "PKG_CONFIG_NATIVE=$(PKG_CONFIG_FOR_BUILD)"
-    "PREFIX=${placeholder "out"}"
-  ];
-
-  preBuild = ''
-    # The `$` is escaped in `makeFlags` so using it for these parameters results in infinite recursion
-    makeFlagsArray+=(CXX=$CXX PKG_CONFIG=$PKG_CONFIG);
-  '';
-
-  passthru.updateScript = nix-update-script { };
-
-  meta = {
-    description = "Jump and run game, reimplementation of Tower Toppler/Nebulus";
-    homepage = "https://gitlab.com/roever/toppler";
-    license = with lib.licenses; [
-      gpl2Plus
-      # Makefile
-      gpl3Plus
-    ];
-    maintainers = with lib.maintainers; [ fgaz ];
-    platforms = lib.platforms.all;
-    mainProgram = "toppler";
-  };
-})
diff --git a/pkgs/by-name/tr/tree-sitter/grammars/README.md b/pkgs/by-name/tr/tree-sitter/grammars/README.md
index 7357fd18fcad..623c581c63ec 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/README.md
+++ b/pkgs/by-name/tr/tree-sitter/grammars/README.md
@@ -149,6 +149,9 @@ grammars.withPlugins (p: [
 
 The scoped `withPlugins` helper receives derivations from the same overridden scope, so added or replaced grammars are visible.
 
+Deprecated or renamed grammar aliases live in [aliases.nix](aliases.nix) and are exposed only when `config.allowAliases = true`.
+An alias resolves to the same derivation as its canonical name, so `derivations`, `allGrammars`, and `withPlugins` all see it once enabled.
+
 The set also carries package-set helpers (`callPackage`, `newScope`, `overrideScope`, …) alongside the grammars, so do not iterate it directly.
 Use one of its grammar-only views instead; each reflects any `overrideScope`:
 
diff --git a/pkgs/by-name/tr/tree-sitter/grammars/aliases.nix b/pkgs/by-name/tr/tree-sitter/grammars/aliases.nix
new file mode 100644
index 000000000000..d0719f3a63f1
--- /dev/null
+++ b/pkgs/by-name/tr/tree-sitter/grammars/aliases.nix
@@ -0,0 +1,16 @@
+{ lib }:
+_final: prev:
+let
+  checkInGrammars =
+    name: alias:
+    if builtins.hasAttr name prev then
+      throw "Alias ${name} is still in tree-sitter-grammars"
+    else
+      alias;
+
+  mapAliases = lib.mapAttrs checkInGrammars;
+in
+mapAliases {
+  # keep-sorted start block=yes
+  # keep-sorted end
+}
diff --git a/pkgs/by-name/tr/tree-sitter/package.nix b/pkgs/by-name/tr/tree-sitter/package.nix
index 93bdd88927ae..1968cf15d603 100644
--- a/pkgs/by-name/tr/tree-sitter/package.nix
+++ b/pkgs/by-name/tr/tree-sitter/package.nix
@@ -1,6 +1,7 @@
 {
   lib,
   stdenv,
+  config,
   newScope,
   fetchFromGitHub,
   fetchFromGitLab,
@@ -76,6 +77,8 @@ let
   builtGrammars = lib.mapAttrs (_: lib.makeOverridable buildGrammar) grammars;
 
   hasTreeSitterPrefix = lib.hasPrefix "tree-sitter-";
+  grammarAliases = import ./grammars/aliases.nix { inherit lib; };
+
   grammarDerivationsFrom = lib.filterAttrs (
     name: value: hasTreeSitterPrefix name && lib.isDerivation value
   );
@@ -117,6 +120,7 @@ let
   grammarsScope = lib.makeScope newScope (
     self:
     builtGrammars
+    // lib.optionalAttrs config.allowAliases (grammarAliases self builtGrammars)
     // {
       derivations = grammarDerivationsFrom self;
       allGrammars = lib.filter (p: !(p.meta.broken or false)) (
diff --git a/pkgs/by-name/ts/tsukimi/package.nix b/pkgs/by-name/ts/tsukimi/package.nix
index a23345244376..b550e1f6e483 100644
--- a/pkgs/by-name/ts/tsukimi/package.nix
+++ b/pkgs/by-name/ts/tsukimi/package.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
+    inherit (finalAttrs) pname version src;
     hash = "sha256-lfDPrmCl+Fuf/AG8xiFv00HD76Wy63cBc9Iji7Cw2sw=";
   };
 
diff --git a/pkgs/by-name/ts/tsx/package.nix b/pkgs/by-name/ts/tsx/package.nix
index 542ddc058ac4..94b18bd2768f 100644
--- a/pkgs/by-name/ts/tsx/package.nix
+++ b/pkgs/by-name/ts/tsx/package.nix
@@ -15,13 +15,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "tsx";
-  version = "4.23.1";
+  version = "4.23.12";
 
   src = fetchFromGitHub {
     owner = "privatenumber";
     repo = "tsx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zR3a3AZLPYmnIeiT0SNwN6gVcnR4ObzJsfj7aQ8LOkQ=";
+    hash = "sha256-hHiJaLyCJwxSV1fc9Zpn/JHmvRS2fhT1XmL+B94+axw=";
   };
 
   pnpmDeps = fetchPnpmDeps {
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
       ;
     pnpm = pnpm';
     fetcherVersion = 3;
-    hash = "sha256-jnCz9u+UMGV20t6fhzk/rVq68K+e5eBvUth6O7jOpQg=";
+    hash = "sha256-KysktlAKCChQW0CwI8qsVJu2rEmMwF+eVNvxuzAYLis=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/tt/tt-smi/package.nix b/pkgs/by-name/tt/tt-smi/package.nix
index 2d62067a54ad..395cfe3787c4 100644
--- a/pkgs/by-name/tt/tt-smi/package.nix
+++ b/pkgs/by-name/tt/tt-smi/package.nix
@@ -8,7 +8,7 @@
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "tt-smi";
-  version = "6.1.0";
+  version = "6.2.0";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -16,7 +16,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "tenstorrent";
     repo = "tt-smi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6dh0f2Unlmmk5IOWlf7hKIrENRvubqfVTLmBIwPfI28=";
+    hash = "sha256-czlZ2C9GBgpNPsspUSe4lA4AU+8zNmTc5UHzqY/OUV8=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/tu/tuicr/package.nix b/pkgs/by-name/tu/tuicr/package.nix
index 2693e407b276..2e9ee769f99b 100644
--- a/pkgs/by-name/tu/tuicr/package.nix
+++ b/pkgs/by-name/tu/tuicr/package.nix
@@ -9,7 +9,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tuicr";
-  version = "0.21.0";
+  version = "0.22.0";
 
   __structuredAttrs = true;
 
@@ -17,10 +17,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "agavra";
     repo = "tuicr";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9QEDfDwb9Elm4R40/0pBz0EgTOoJJWWNraz2D0H6bAo=";
+    hash = "sha256-MotMXx3YEdR7s3Bz3ZW5Lk733S65zLzl9Pu6jReO9Bw=";
   };
 
-  cargoHash = "sha256-efBYiq0FA9kpMwzHM2GiUC2rWyWC9QcgfCCVIu5bbPk=";
+  cargoHash = "sha256-7qrRsZ7SFi1LB9wI7oiwmE58cI+240IgmU7Zyhi6MAg=";
 
   strictDeps = true;
 
diff --git a/pkgs/by-name/tu/tuigreet/package.nix b/pkgs/by-name/tu/tuigreet/package.nix
index b1a16c8f2f5d..23345ce3b1b2 100644
--- a/pkgs/by-name/tu/tuigreet/package.nix
+++ b/pkgs/by-name/tu/tuigreet/package.nix
@@ -8,16 +8,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tuigreet";
-  version = "0.9.1";
+  version = "0.11.0";
+
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
-    owner = "apognu";
+    owner = "tuigreet";
     repo = "tuigreet";
     tag = finalAttrs.version;
-    hash = "sha256-e0YtpakEaaWdgu+bMr2VFoUc6+SUMFk4hYtSyk5aApY=";
+    hash = "sha256-4DB4Pl2UwIeab/MJaX3VfVNMsPWE6Q513z1NDdxvG3o=";
   };
 
-  cargoHash = "sha256-w6ZOqpwogKoN4oqqI1gFqY8xAnfvhEBVaL8/6JXpKXs=";
+  cargoHash = "sha256-5Q4E8nnmQ109gcfxxctn/rne5N4Qvz2Pft6o7as2fSc=";
 
   nativeBuildInputs = [
     installShellFiles
@@ -33,10 +35,13 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   meta = {
     description = "Graphical console greeter for greetd";
-    homepage = "https://github.com/apognu/tuigreet";
-    changelog = "https://github.com/apognu/tuigreet/releases/tag/${finalAttrs.version}";
+    homepage = "https://github.com/tuigreet/tuigreet";
+    changelog = "https://github.com/tuigreet/tuigreet/releases/tag/${finalAttrs.version}";
     license = lib.licenses.gpl3Plus;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [
+      NotAShelf
+      antoineco
+    ];
     platforms = lib.platforms.linux;
     mainProgram = "tuigreet";
   };
diff --git a/pkgs/by-name/tu/turingdb/package.nix b/pkgs/by-name/tu/turingdb/package.nix
index 49fd998bb6c5..bc13009de94d 100644
--- a/pkgs/by-name/tu/turingdb/package.nix
+++ b/pkgs/by-name/tu/turingdb/package.nix
@@ -105,7 +105,7 @@ turingstdenv.mkDerivation (finalAttrs: {
     pugixml
     zlib
   ]
-  ++ lib.optionals turingstdenv.isDarwin [ llvmPackages_20.openmp ]
+  ++ lib.optionals turingstdenv.hostPlatform.isDarwin [ llvmPackages_20.openmp ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [ stdenv.cc.cc.lib ]
   ++ lib.optionals cudaSupport [
     cudaPackages.cuda_cudart
diff --git a/pkgs/by-name/tu/turnon/package.nix b/pkgs/by-name/tu/turnon/package.nix
index 117d223342b9..e22cb0e6738c 100644
--- a/pkgs/by-name/tu/turnon/package.nix
+++ b/pkgs/by-name/tu/turnon/package.nix
@@ -14,7 +14,7 @@
 }:
 
 let
-  version = "2.9.3";
+  version = "3.2.2";
 in
 rustPlatform.buildRustPackage {
   pname = "turnon";
@@ -24,10 +24,10 @@ rustPlatform.buildRustPackage {
     owner = "swsnr";
     repo = "turnon";
     rev = "v${version}";
-    hash = "sha256-2dPvIuD7gVfhr/E5szJ5rqWL5yRJKZoj2lV+W9CyCjI=";
+    hash = "sha256-GccO6zwIR/JFdKE3uUQZ3RaBMm9tHumP7jpZRb6n5uU=";
   };
 
-  cargoHash = "sha256-e0Hds/y3qh7Th+ZTqHIfVleh3vmDlKKJ5Bwt64g5c60=";
+  cargoHash = "sha256-5FBVDNzmen/GnfN6JBmxU4et9gkxZt8RjSD12t/2THI=";
 
   doCheck = true;
 
@@ -56,7 +56,7 @@ rustPlatform.buildRustPackage {
 
   postPatch = ''
     substituteInPlace justfile \
-        --replace-fail "version := \`git describe\`" "version := \"${version}\"" \
+        --replace-fail "version := \`git describe --always\`" "version := \"${version}\"" \
         --replace-fail "DESTPREFIX := '/app'" "DESTPREFIX := '$out'" \
         --replace-fail "APPID := 'de.swsnr.turnon.Devel'" "APPID := 'de.swsnr.turnon'" \
         --replace-fail "just --list" "just compile" # Replacing the default recipe with the compile command as just-hook-buildPhase runs the default recipe to compile the package.
diff --git a/pkgs/by-name/ty/typos-lsp/package.nix b/pkgs/by-name/ty/typos-lsp/package.nix
index 1d548fba4ce8..c00a352c115d 100644
--- a/pkgs/by-name/ty/typos-lsp/package.nix
+++ b/pkgs/by-name/ty/typos-lsp/package.nix
@@ -7,16 +7,16 @@ rustPlatform.buildRustPackage (finalAttrs: {
   pname = "typos-lsp";
   # Please update the corresponding VSCode extension too.
   # See pkgs/applications/editors/vscode/extensions/tekumara.typos-vscode/default.nix
-  version = "0.1.54";
+  version = "0.1.55";
 
   src = fetchFromGitHub {
     owner = "tekumara";
     repo = "typos-lsp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-UP8kh67z++ILNFjBKYmfadmXKOrVKybXg5K0c9ELct8=";
+    hash = "sha256-VcYBzaldmnFb5Y3O+wWapEs7pkBI/n4N6FEM8fBhYZs=";
   };
 
-  cargoHash = "sha256-EbC1ij/58LDEpJIqmDH1J45sEpLrs742BVW1gL5Op+4=";
+  cargoHash = "sha256-JV0LDkJvdM1zZbYDXGcEZPbwbm7vV9+K5WjQxZX0au4=";
 
   # fix for compilation on aarch64
   # see https://github.com/NixOS/nixpkgs/issues/145726
diff --git a/pkgs/by-name/ua/uavs3d/package.nix b/pkgs/by-name/ua/uavs3d/package.nix
index 39a0d4c7d612..ee0e70573dc5 100644
--- a/pkgs/by-name/ua/uavs3d/package.nix
+++ b/pkgs/by-name/ua/uavs3d/package.nix
@@ -4,17 +4,17 @@
   cmake,
   stdenv,
   testers,
-  unstableGitUpdater,
+  gitUpdater,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "uavs3d";
-  version = "1.1-unstable-2025-12-13";
+  version = "1.2";
 
   src = fetchFromGitHub {
     owner = "uavs3";
     repo = "uavs3d";
-    rev = "0e20d2c291853f196c68922a264bcd8471d75b68";
+    tag = finalAttrs.version;
     hash = "sha256-SlCGLglBsU3ua406Bnf89c4X80F5B93piF2sAXqtRus=";
   };
 
@@ -41,9 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   passthru = {
-    updateScript = unstableGitUpdater {
-      tagPrefix = "v";
-    };
+    updateScript = gitUpdater { };
     tests.pkg-config = testers.hasPkgConfigModules { package = finalAttrs.finalPackage; };
   };
 
diff --git a/pkgs/by-name/uc/uclibc-ng/package.nix b/pkgs/by-name/uc/uclibc-ng/package.nix
index c84823fd84ef..d6ab5867b81d 100644
--- a/pkgs/by-name/uc/uclibc-ng/package.nix
+++ b/pkgs/by-name/uc/uclibc-ng/package.nix
@@ -69,11 +69,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "uclibc-ng";
-  version = "1.0.58";
+  version = "1.0.59";
 
   src = fetchurl {
     url = "https://downloads.uclibc-ng.org/releases/${finalAttrs.version}/uClibc-ng-${finalAttrs.version}.tar.xz";
-    hash = "sha256-noEApEL3B5uXKMoobjA19n3wV4YGFm6i0e+GWkoS3bk=";
+    hash = "sha256-hsbxWXG/sUFWhQ8uNpBtrFpp33s+aIIW0a6gnS21QXQ=";
   };
 
   configurePhase = ''
diff --git a/pkgs/by-name/ul/ultrastardx/package.nix b/pkgs/by-name/ul/ultrastardx/package.nix
index 54caf412332a..62faa1801652 100644
--- a/pkgs/by-name/ul/ultrastardx/package.nix
+++ b/pkgs/by-name/ul/ultrastardx/package.nix
@@ -15,7 +15,7 @@
   SDL2_mixer,
   SDL2_net,
   SDL2_ttf,
-  ffmpeg_8,
+  ffmpeg,
   sqlite,
   zlib,
   libx11,
@@ -39,19 +39,19 @@ let
     libx11
     libGLU
     libGL
-    ffmpeg_8
+    ffmpeg
   ];
 
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ultrastardx";
-  version = "2026.6.0";
+  version = "2026.8.0";
 
   src = fetchFromGitHub {
     owner = "UltraStar-Deluxe";
     repo = "USDX";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-xqP50OFUT+wreG/EZhmh5zPOwpNvG1TQkLzovgVDquI=";
+    hash = "sha256-dtZrVsXXpy70aJvMqs/IUPsvRd52FKpm9I5XuZSLwCY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/un/unblob/package.nix b/pkgs/by-name/un/unblob/package.nix
index 552040ab866e..baab150401e8 100644
--- a/pkgs/by-name/un/unblob/package.nix
+++ b/pkgs/by-name/un/unblob/package.nix
@@ -42,7 +42,7 @@ let
     zstd
     lz4
   ]
-  ++ lib.optional stdenvNoCC.isLinux partclone;
+  ++ lib.optional stdenvNoCC.hostPlatform.isLinux partclone;
 in
 python3.pkgs.buildPythonApplication rec {
   pname = "unblob";
diff --git a/pkgs/by-name/up/updatecli/package.nix b/pkgs/by-name/up/updatecli/package.nix
index 5853dec5a7c0..e0bb8b5486f6 100644
--- a/pkgs/by-name/up/updatecli/package.nix
+++ b/pkgs/by-name/up/updatecli/package.nix
@@ -12,17 +12,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "updatecli";
-  version = "0.119.0";
+  version = "0.120.0";
 
   src = fetchFromGitHub {
     owner = "updatecli";
     repo = "updatecli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-iXlaKJcxL2dwu0NTVtuLyinOY/fLWOGQU8jn1ZASrzw=";
+    hash = "sha256-KVGvOCdxgTK9chZU8TwemrQUlkvOdvWIzBG0dSY/VpU=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-xiE9aRZCDF9x7e4z5WMCNMPoMOQJldp7iuz2HU1KnSo=";
+  vendorHash = "sha256-iZf6nB6arDEWDANq3Gp72kfFQi5QKGymHLKFJcnT+98=";
 
   # tests require network access
   doCheck = false;
diff --git a/pkgs/by-name/va/vapoursynth/editor.nix b/pkgs/by-name/va/vapoursynth/editor.nix
index 3291bb7d625c..52b1a8b13154 100644
--- a/pkgs/by-name/va/vapoursynth/editor.nix
+++ b/pkgs/by-name/va/vapoursynth/editor.nix
@@ -83,6 +83,7 @@ let
     in
     runCommand "${unwrapped.name}-with-plugins"
       {
+        inherit (unwrapped) pname version;
         nativeBuildInputs = [ makeWrapper ];
         passthru = {
           withPlugins = plugins': withPlugins (plugins ++ plugins');
diff --git a/pkgs/by-name/ve/velocity/deps.json b/pkgs/by-name/ve/velocity/deps.json
index 44f6ca0c7599..48531507a423 100644
--- a/pkgs/by-name/ve/velocity/deps.json
+++ b/pkgs/by-name/ve/velocity/deps.json
@@ -37,12 +37,19 @@
    "module": "sha256-NMCTxQIrGzueJvGDW6JYNKMV7a41/2bv+iE5528MEiw=",
    "pom": "sha256-yZIwMm954KZ4M0gs0HWGn8qyIrf17xuZpnOH5RjyAio="
   },
-  "com/google/code/gson#gson-parent/2.8.9": {
-   "pom": "sha256-sW4CbmNCfBlyrQ/GhwPsN5sVduQRuknDL6mjGrC7z/s="
+  "com/google/code/gson#gson-parent/2.11.0": {
+   "pom": "sha256-issfO3Km8CaRasBzW62aqwKT1Sftt7NlMn3vE6k2e3o="
   },
-  "com/google/code/gson#gson/2.8.9": {
-   "jar": "sha256-05mSkYVd5JXJTHQ3YbirUXbP6r4oGlqw2OjUUyb9cD4=",
-   "pom": "sha256-r97W5qaQ+/OtSuZa2jl/CpCl9jCzA9G3QbnJeSb91N4="
+  "com/google/code/gson#gson/2.11.0": {
+   "jar": "sha256-V5KNblpu3rKr03cKj5W6RNzkXzsjt6ncKzCcWBVSp4s=",
+   "pom": "sha256-wOVHvqmYiI5uJcWIapDnYicryItSdTQ90sBd7Wyi42A="
+  },
+  "com/google/errorprone#error_prone_annotations/2.27.0": {
+   "jar": "sha256-JMkjNyxY410LnxagKJKbua7cd1IYZ8J08r0HNd9bofU=",
+   "pom": "sha256-TKWjXWEjXhZUmsNG0eNFUc3w/ifoSqV+A8vrJV6k5do="
+  },
+  "com/google/errorprone#error_prone_parent/2.27.0": {
+   "pom": "sha256-+oGCnQSVWd9pJ/nJpv1rvQn4tQ5tRzaucsgwC2w9dlQ="
   },
   "com/googlecode/concurrent-trees#concurrent-trees/2.6.1": {
    "jar": "sha256-BONySYTipcv1VgbPo3KlvT08XSohUzpwBOPN5Tl2H6U=",
@@ -75,13 +82,13 @@
    "module": "sha256-pnYDnqavCPJXtG4Hwr8VcaRqTUtbnMuGw/yY0H+v6hs=",
    "pom": "sha256-arSo7K4qu9NrkZ0Lm5+yTBdxSPE+U2TJegxu4Ro/xCY="
   },
-  "io/papermc#fill-gradle/1.0.10": {
-   "jar": "sha256-bus0jbvo7Q5DIHtK4tZ3Mej1iT9UTyOogKbaHjFp8G0=",
-   "module": "sha256-3XcMaCi73jdXaT9jRCDsQfLC7HUj812wHEyl/b5ulUc=",
-   "pom": "sha256-fzyVO0ASsxooOLuG8wj9zZyFY28PXwRNowZOTi25m4o="
+  "io/papermc#fill-gradle/1.0.12": {
+   "jar": "sha256-6V0UIlMg/pW6cwDp9J5h2E+lYaP8BT+Bv0DR7ZwGczk=",
+   "module": "sha256-UHDlz/3z1BjsmaUCzglE7niQPBSjSTtNIpmEJIQtIIA=",
+   "pom": "sha256-hpEZH3pmqKAdxYpUKzEXybZtsoZ1jKa28yF8R5gSNNk="
   },
-  "io/papermc/fill/gradle#io.papermc.fill.gradle.gradle.plugin/1.0.10": {
-   "pom": "sha256-btM/SagAKm6tp/rMWgrl+jtEzgf0CEUEu5XbTMLWUsc="
+  "io/papermc/fill/gradle#io.papermc.fill.gradle.gradle.plugin/1.0.12": {
+   "pom": "sha256-6QgmgblRWPmLcnuNXlQ1NJmEogCMk22xVHEe4pPpIX0="
   },
   "org/apache#apache/35": {
    "pom": "sha256-6il9zRFBNui46LYwIw1Sp2wvxp9sXbJdZysYVwAHKLg="
@@ -100,13 +107,13 @@
    "jar": "sha256-eJRUAUwVDyrfaBzYD47PSYF9k+15DzZZs2LcoHreh7g=",
    "pom": "sha256-ok2dkGpHjhJrIZqdJFGLgztm2ksQP5Y+ILkFC+virhU="
   },
-  "org/gradle/kotlin#gradle-kotlin-dsl-plugins/5.2.0": {
-   "jar": "sha256-SKlcMPRlehDfloYC01LJ2GTZemYholfoFQjINWDE/q4=",
-   "module": "sha256-fxo3x8yLU7tmBAqrbAacidiqWOJ/+nH3s2HGROtaD7A=",
-   "pom": "sha256-uB9ZcQ4lOEW0+Pbe27BWPWfD5/UPg7AiQZXjo2GAtH8="
+  "org/gradle/kotlin#gradle-kotlin-dsl-plugins/6.5.7": {
+   "jar": "sha256-zIyqQQGjXQzwQzpj6K04kRpMhIBz/MlPQ64CUfM+Ta8=",
+   "module": "sha256-ENa9ZquwiOylvjYP9yVQyWFU0mdu/t10rzHEUAF8OQk=",
+   "pom": "sha256-q+nzlg+nNZciqHUuYb/ElnYeFdFHNeTGQiB5cHYGq74="
   },
-  "org/gradle/kotlin/kotlin-dsl#org.gradle.kotlin.kotlin-dsl.gradle.plugin/5.2.0": {
-   "pom": "sha256-pXu0ObpCYKJW8tYIRx1wgRiQd6Ck3fsCjdGBe+W8Ejc="
+  "org/gradle/kotlin/kotlin-dsl#org.gradle.kotlin.kotlin-dsl.gradle.plugin/6.5.7": {
+   "pom": "sha256-Ldg2zAlxLNrd/u/GgNLqZutD2NxjOGvVlSZYE0l/Ry0="
   },
   "org/gradle/toolchains#foojay-resolver/1.0.0": {
    "jar": "sha256-eLhqR9/fdpfJvRXaeJg/2A2nJH1uAvwQa98H4DiLYKg=",
@@ -120,96 +127,89 @@
    "jar": "sha256-rOKhDcji1f00kl7KwD5JiLLA+FFlDJS4zvSbob0RFHg=",
    "pom": "sha256-llrrK+3/NpgZvd4b96CzuJuCR91pyIuGN112Fju4w5c="
   },
-  "org/jetbrains/intellij/deps#trove4j/1.0.20200330": {
-   "jar": "sha256-xf1yW/+rUYRr88d9sTg8YKquv+G3/i8A0j/ht98KQ50=",
-   "pom": "sha256-h3IcuqZaPJfYsbqdIHhA8WTJ/jh1n8nqEP/iZWX40+k="
+  "org/jetbrains/kotlin#abi-tools-api/2.3.20": {
+   "jar": "sha256-U2hfV4OwSQaDiY11Wrrk1Bi26DugYTSFiv3ctZRYmek=",
+   "pom": "sha256-qIbJ/X8rlmlFf+wCHxnc8V8EY+DbS9rVOuGBJTZsxvk="
   },
-  "org/jetbrains/kotlin#kotlin-assignment/2.0.21": {
-   "module": "sha256-8638yrZURNtqqzwNfSVoZG7AyS8kWCh/KLKu5POXNtw=",
-   "pom": "sha256-QBfCQqfb3Oca6ApXB7S/OyOoIr8jpodahFp7UTYhzQ8="
+  "org/jetbrains/kotlin#fus-statistics-gradle-plugin/2.3.20": {
+   "module": "sha256-bNjWSw5lN3kE8wb2qFja/ZMcQTUkD4RMk9UpTumP6Dk=",
+   "pom": "sha256-SgpFTor25QOv5ngwoYVjubaA3u67GhcGoNe0S8UHQKE="
   },
-  "org/jetbrains/kotlin#kotlin-assignment/2.0.21/gradle85": {
-   "jar": "sha256-USUeNCELiNTJCAXKZS6Xe93IR4OkVAY5ydIQkJhbrOY="
+  "org/jetbrains/kotlin#fus-statistics-gradle-plugin/2.3.20/gradle813": {
+   "jar": "sha256-pPEKPw6l3dH1VaT3BuCep/VSs8hSK7EAY2HdMG4152o="
   },
-  "org/jetbrains/kotlin#kotlin-build-statistics/2.0.21": {
-   "jar": "sha256-gBILdN8DYz1veeCIZBMe7jt6dIb2wF0vLtyGg3U8VNo=",
-   "pom": "sha256-/iTcYG/sg+yY3Qi8i7HPmeVAXejpF8URnVoMt++sVZ0="
+  "org/jetbrains/kotlin#kotlin-assignment/2.3.20": {
+   "module": "sha256-GCp0ZM5mvM/ejjG+aPoO7DE8HZDD2POWeclyJyliFjg=",
+   "pom": "sha256-f3R8uTA9Hfqh1hJfZsFUG+o4PsuZh2ta28riSAVZZ48="
   },
-  "org/jetbrains/kotlin#kotlin-build-tools-api/2.0.21": {
-   "jar": "sha256-j8orSvbEzyRWXZp/ZMMXhIlRjQSeEGmB22cY7yLK4Y4=",
-   "pom": "sha256-zL2XaTA2Y0gWKVGY5JRFNPr7c9d4+M1NQ588h7CQ9JQ="
+  "org/jetbrains/kotlin#kotlin-assignment/2.3.20/gradle813": {
+   "jar": "sha256-tYin5gfij7WAIo4SDdX/+L6nO9J3JnM6F35kRYLooB0="
   },
-  "org/jetbrains/kotlin#kotlin-compiler-embeddable/2.0.21": {
-   "jar": "sha256-n6jN0d4NzP/hVMmX1CPsa19TzW2Rd+OnepsN4D+xvIE=",
-   "pom": "sha256-vUZWpG7EGCUuW8Xhwg6yAp+yqODjzJTu3frH6HyM1bY="
+  "org/jetbrains/kotlin#kotlin-build-statistics/2.3.20": {
+   "jar": "sha256-ptJ7PINhdlLdBlYG+Yz1nPviY/jCDr5OvVpvJonrDU8=",
+   "pom": "sha256-nQqNf/FyPV1y00ldVVc9jTxrd3TWHYBXlxT3nCQmX48="
   },
-  "org/jetbrains/kotlin#kotlin-compiler-runner/2.0.21": {
-   "jar": "sha256-COYFvoEGD/YS0K65QFihm8SsmWJcNcRhxsCzAlYOkQQ=",
-   "pom": "sha256-+Wdq1JVBFLgc39CR6bW0J7xkkc+pRIRmjWU9TRkCPm0="
+  "org/jetbrains/kotlin#kotlin-build-tools-api/2.3.20": {
+   "jar": "sha256-IvGrIjhUuUkJn2slnO9UHVtYo2Q9+aScRXfGPEFuhDs=",
+   "pom": "sha256-G14LLDaQXcL1XgpLeBKuY+MSXe/PaG0sD0kPg7c9nV4="
   },
-  "org/jetbrains/kotlin#kotlin-daemon-client/2.0.21": {
-   "jar": "sha256-Nx6gjk8DaILMjgZP/PZEWZDfREKVuh7GiSjnzCtbwBU=",
-   "pom": "sha256-8oY4JGtQVSC/6TXxXz7POeS6VSb6RcjzKsfeejEjdAA="
+  "org/jetbrains/kotlin#kotlin-compiler-runner/2.3.20": {
+   "jar": "sha256-wGnzCkA75wyBUviqnyXsy6GI7q1UJjrgKvFEIUN6Igg=",
+   "pom": "sha256-jYTqDt1gs4vOpWLeUXgVKiZxqaAFPWcPkxRSs9sBMig="
   },
-  "org/jetbrains/kotlin#kotlin-daemon-embeddable/2.0.21": {
-   "jar": "sha256-saCnPFAi+N0FpjjGt2sr1zYYGKHzhg/yZEEzsd0r2wM=",
-   "pom": "sha256-jbZ7QN1gJaLtBpKU8sm8+2uW2zFZz+927deEHCZq+/A="
+  "org/jetbrains/kotlin#kotlin-daemon-client/2.3.20": {
+   "jar": "sha256-xxp8G+j7/wTgr0XJ7oy3ph2JU7ymuL8iWlcZxyWpC0Q=",
+   "pom": "sha256-nnyLgHJBF/cqrOZfa+SNg224/Dl1OtlR8ruQhi1+cIA="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-annotations/2.0.21": {
-   "jar": "sha256-W0cHoy5GfvvhIsMY/2q9yhei/H2Mg/ZgN8mhILbcvC8=",
-   "pom": "sha256-P+CLlUN7C074sWt39hqImzn1xGt+lx1N+63mbUQOodg="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-annotations/2.3.20": {
+   "jar": "sha256-4WYu10cyK2P2HU+t2Zq3gQTEXq8JwRp4mGJBXoHBjcQ=",
+   "pom": "sha256-aP+Cf8E1DZPw1nM2jAZHm2K31eXDBlipWM+TBmgx6Nk="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-api/2.0.21": {
-   "jar": "sha256-Uur1LOMDtSneZ6vDusE+TxNZY1dUPfqDHE1y0tYxDlA=",
-   "module": "sha256-z29dNExVVVS/rGQFHq0AhcvUM4Z2uqP8h7UD6eSrvjQ=",
-   "pom": "sha256-gV5yqZ4ZFD1mLSTkYlKlnOdWMC18W9/FlIF9fMexI3g="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-api/2.3.20": {
+   "module": "sha256-04UBEP9ajrcP7S1Xi0X7B+vESvaika5M88eUMMZRKLo=",
+   "pom": "sha256-AdVSITSRyFPVb4frdIEwON+e4dhekIaqN70GY7JJb4g="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-api/2.0.21/gradle85": {
-   "jar": "sha256-Uur1LOMDtSneZ6vDusE+TxNZY1dUPfqDHE1y0tYxDlA="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-api/2.3.20/gradle813": {
+   "jar": "sha256-ybwX32m/OZB8WXweGb7EtHnHWqx1+/1jIeNEW0lxLog="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-idea-proto/2.0.21": {
-   "jar": "sha256-UzVXQrV7qOFvvfCiBDn4s0UnYHHtsUTns9puYL42MYg=",
-   "pom": "sha256-OMyaLLf55K/UOcMQdvgzFThIsfftITMgCDXRtCDfbqs="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-idea-proto/2.3.20": {
+   "jar": "sha256-5Cicv5/0lAfwQd3GM24bV3pspM8r4dKjEzgnHBPu0+0=",
+   "pom": "sha256-9veHObqf4nEunwyeW8T16TcZzP6pW0fC9JslC+F2NX4="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-idea/2.0.21": {
-   "jar": "sha256-wfTqDBkmfx7tR0tUGwdxXEkWes+/AnqKL9B8u8gbjnI=",
-   "module": "sha256-YqcNAg27B4BkexFVGIBHE+Z2BkBa6XoQ2P2jgpOI0Uk=",
-   "pom": "sha256-1GjmNf3dsw9EQEuFixCyfcVm6Z1bVIusEMIjOp7OF74="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-idea/2.3.20": {
+   "jar": "sha256-lS5zlI4qINOYwmuHprtwzPZkGPuvFSfDUVsYjqnUvWA=",
+   "module": "sha256-b7XZcwCl5Vmv1Nn/msA1bE2Wb31pS2Yvrhaf2HQhUx4=",
+   "pom": "sha256-WROHIVGNgqND99wvCRK3BJjT7vM2PJ66wiCssPyTjsw="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-model/2.0.21": {
-   "jar": "sha256-lR13mJs1cAljH/HvsSsBYczzKcUpxUalKfih0x+bwDw=",
-   "module": "sha256-6qn9n4b71E/2BwoZfce90ZgPDUHo20myUoA9A6pMVaw=",
-   "pom": "sha256-5RVeYOyr2v1kUmVKaYALyyp37n0fxucH+tOo5p8HTCw="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin/2.3.20": {
+   "module": "sha256-lVUmc7gbNXitmy86/xRUtjzoBsb9SrfGBJIx6GQKtHE=",
+   "pom": "sha256-EcMjwt2KgE6fWOBHwsAYZLKgHcDYEys2PApDEiFbwJs="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin/2.0.21": {
-   "module": "sha256-D5iXoGwHo+h9ZHExzDSQofctGuVMEH8T9yJp1TRLCHo=",
-   "pom": "sha256-RenM7OM+TY36mUHMkS81RYIBqdPwQ3IMMket3lf0f/Y="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin/2.3.20/gradle813": {
+   "jar": "sha256-RuFu4mWU9ID+y5LJbarjdTDoNQJreON+8yUelX8D9vs="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin/2.0.21/gradle85": {
-   "jar": "sha256-nfXH/xOx/GislFDKY8UxEYkdb2R73ewPQ5iz5yJb9tk="
+  "org/jetbrains/kotlin#kotlin-gradle-plugins-bom/2.3.20": {
+   "module": "sha256-+CvXZF0MPv609PZVIKPGWz6MMCsIMyIDegABuHsC6ZA=",
+   "pom": "sha256-3WuRkZfhMv5x3axw9vxdj65/Und6/YN7FN6HG4wKVAA="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugins-bom/2.0.21": {
-   "module": "sha256-8JRUh/5RlZ/fi2oUQXB6Ke1fGsMaIxx/3r4sPd0i/fE=",
-   "pom": "sha256-Z1AT1Mvu4JyIkgriuiRvmfKKeJuHT2NASeAS+j7r9Mg="
+  "org/jetbrains/kotlin#kotlin-klib-commonizer-api/2.3.20": {
+   "jar": "sha256-vpN3SFQS0A8B54KZyzC+SAJZHCcwNCtuva/AiU91J0M=",
+   "pom": "sha256-IbFbpb1i0h1Ta7egyMtnQ1cfwPQwklSKQjWybyodIgs="
   },
-  "org/jetbrains/kotlin#kotlin-klib-commonizer-api/2.0.21": {
-   "jar": "sha256-R1eJEWW2mPvazo9NpvK8DpiOrvnvNnE1SIZajycGmv0=",
-   "pom": "sha256-Y/6HvSI1sSlAnHIqCbYsIKe3eueQGeIgMSSK9zawPFQ="
+  "org/jetbrains/kotlin#kotlin-native-utils/2.3.20": {
+   "jar": "sha256-QxnCdkeV773/K3julUVRV9evC5FVaYuqG6Uqar46vy0=",
+   "pom": "sha256-LAp+ADViCIXUN+fxJidEdbpYqiJC+1279D+R8gyvpwg="
   },
-  "org/jetbrains/kotlin#kotlin-native-utils/2.0.21": {
-   "jar": "sha256-ResIo5Kfl8SKkpEsliV3nRVAvG8/IS+56UYg0DJrzAA=",
-   "pom": "sha256-ZpB3PnZJ0dD61V0GCaTiHh68mF3Q+iYenG/9OJhnBh0="
+  "org/jetbrains/kotlin#kotlin-sam-with-receiver/2.3.20": {
+   "module": "sha256-nhEhx/ZQMDvdx/BH/tMCf4FjuzZ1Gy3w+vNjfumFsh8=",
+   "pom": "sha256-Y/Gk4+TT3jrPghTwWgtW/5IM4L9ZYVSnkE8gVuP41RE="
   },
-  "org/jetbrains/kotlin#kotlin-sam-with-receiver/2.0.21": {
-   "module": "sha256-kJCVCx7oa4b+KWmV2AKG6opPN5+yshjoVvzt0ErS1Hk=",
-   "pom": "sha256-7lYZBmzLB5zDMy4kcnQ1n9dQXeLVQPuRtyd5ICW2Siw="
+  "org/jetbrains/kotlin#kotlin-sam-with-receiver/2.3.20/gradle813": {
+   "jar": "sha256-oHxdPMvaP8dWTkB0RybhNz5UvSXwVGPT9D1DnXeOy90="
   },
-  "org/jetbrains/kotlin#kotlin-sam-with-receiver/2.0.21/gradle85": {
-   "jar": "sha256-HSNuNiIzuaJx5QsiOlDI2+rdA1C2OiRkYIJWhS2jaKM="
-  },
-  "org/jetbrains/kotlin#kotlin-stdlib-common/2.0.21": {
-   "module": "sha256-b134r2M2AKa5z7D8x2SvPVEZ83Zndne5G2rugWsdMKs=",
-   "pom": "sha256-X0As+413MZW5ZwUBJMnom1+EsXJGThiUkpeJv1xMLyk="
+  "org/jetbrains/kotlin#kotlin-stdlib-common/2.3.20": {
+   "module": "sha256-fV4z3nFM3ddQeGQgmMvL7pfBg5jQNLd9MrSwdLlQOTk=",
+   "pom": "sha256-/Xtj7fb31urrwWoYVgu7koszQlYepcnR92kZiw/puYg="
   },
   "org/jetbrains/kotlin#kotlin-stdlib-jdk7/1.8.0": {
    "pom": "sha256-36lkSmrluJjuR1ux9X6DC6H3cK7mycFfgRKqOBGAGEo="
@@ -228,30 +228,34 @@
    "jar": "sha256-pMdNlNZM4avlN2D+A4ndlB9vxVjQ2rNeR8CFoR7IDyg=",
    "pom": "sha256-X0uU3TBlp3ZMN/oV3irW2B9A1Z+Msz8X0YHGOE+3py4="
   },
-  "org/jetbrains/kotlin#kotlin-stdlib/2.0.21": {
-   "jar": "sha256-8xzFPxBafkjAk2g7vVQ3Vh0SM5IFE3dLRwgFZBvtvAk=",
-   "module": "sha256-gf1tGBASSH7jJG7/TiustktYxG5bWqcpcaTd8b0VQe0=",
-   "pom": "sha256-/LraTNLp85ZYKTVw72E3UjMdtp/R2tHKuqYFSEA+F9o="
+  "org/jetbrains/kotlin#kotlin-stdlib/2.3.20": {
+   "jar": "sha256-CuElBKUEDrrzdwOQhINCDRpWJN0dk/NXZl+Md8hIoB4=",
+   "module": "sha256-9Os0T8TR46KK4WwIbsPkL1I3O0ZtQwgYL7OG45LA76M=",
+   "pom": "sha256-yDwC2afi6VRzBJHDPC8dwDwnZi4ntWbsK0TS0Bhjm5g="
   },
-  "org/jetbrains/kotlin#kotlin-tooling-core/2.0.21": {
-   "jar": "sha256-W28UhUj+ngdN9R9CJTREM78DdaxbOf/NPXvX1/YC1ik=",
-   "pom": "sha256-MiVe/o/PESl703OozHf4sYXXOYTpGxieeRZlKb36XVo="
+  "org/jetbrains/kotlin#kotlin-tooling-core/2.3.20": {
+   "jar": "sha256-NnFCeBKZvA+RIMHe7A5ik0oa+ep/AaqpxaU1TcXY19k=",
+   "pom": "sha256-R+Ou/SS1vmLYB7bLzXnFW4P5S1XP4Y79xuM84RvxkOQ="
   },
-  "org/jetbrains/kotlin#kotlin-util-io/2.0.21": {
-   "jar": "sha256-Dv7kwg8+f5ErMceWxOR/nRTqaIA+x+1OXU8kJY46ph4=",
-   "pom": "sha256-4gD5F2fbCFJsjZSt3OB7kPNCVBSwTs/XzPjkHJ8QmKA="
+  "org/jetbrains/kotlin#kotlin-util-io/2.3.20": {
+   "jar": "sha256-DnbnRx6RxT6mjS0k7x8p+1kqxfuw0dEPqpFkMO/z2so=",
+   "pom": "sha256-lcKKgo/B8eWeZWOCR6ZPdm2B2LWfbY3r7y0YoMwyH4k="
   },
-  "org/jetbrains/kotlin#kotlin-util-klib/2.0.21": {
-   "jar": "sha256-oTtziWVUtI5L702KRjDqfpQBSaxMrcysBpFGORRlSeo=",
-   "pom": "sha256-724nWZiUO5b1imSWQIUyDxAxdNYJ7GakqUnmASPHmPU="
+  "org/jetbrains/kotlin#kotlin-util-klib-metadata/2.3.20": {
+   "jar": "sha256-qJlOC8poRt+xn0WMTMFdexN3nKGw2fNIgLX/LCorc7M=",
+   "pom": "sha256-jxApEHGu+rvY5m/5r3dDojiB1pxqryjhNhbMDpW9F7c="
   },
-  "org/jetbrains/kotlinx#kotlinx-coroutines-bom/1.6.4": {
-   "pom": "sha256-qyYUhV+6ZqqKQlFNvj1aiEMV/+HtY/WTLnEKgAYkXOE="
+  "org/jetbrains/kotlin#kotlin-util-klib/2.3.20": {
+   "jar": "sha256-lWK407egS+uisUwFZx5xOFnqVLvAohB+ZbK88nP6hEg=",
+   "pom": "sha256-WlhMPMK6O0HR5c1+eiCDV2wbjDl6ebuBY2dtjvew6hc="
   },
-  "org/jetbrains/kotlinx#kotlinx-coroutines-core-jvm/1.6.4": {
-   "jar": "sha256-wkyLsnuzIMSpOHFQGn5eDGFgdjiQexl672dVE9TIIL4=",
-   "module": "sha256-DZTIpBSD58Jwfr1pPhsTV6hBUpmM6FVQ67xUykMho6c=",
-   "pom": "sha256-Cdlg+FkikDwuUuEmsX6fpQILQlxGnsYZRLPAGDVUciQ="
+  "org/jetbrains/kotlinx#kotlinx-coroutines-bom/1.8.0": {
+   "pom": "sha256-Ejnp2+E5fNWXE0KVayURvDrOe2QYQuQ3KgiNz6i5rVU="
+  },
+  "org/jetbrains/kotlinx#kotlinx-coroutines-core-jvm/1.8.0": {
+   "jar": "sha256-mGCQahk3SQv187BtLw4Q70UeZblbJp8i2vaKPR9QZcU=",
+   "module": "sha256-/2oi2kAECTh1HbCuIRd+dlF9vxJqdnlvVCZye/dsEig=",
+   "pom": "sha256-pWM6vVNGfOuRYi2B8umCCAh3FF4LduG3V4hxVDSIXQs="
   },
   "org/junit#junit-bom/5.13.4": {
    "module": "sha256-6Vkoj94bGwUNm8CC/HhniRKNpdKFMJFGj8pQQQS99AA=",
@@ -332,56 +336,56 @@
   "com/fasterxml#oss-parent/55": {
    "pom": "sha256-D14Y8rNev22Dn3/VSZcog/aWwhD5rjIwr9LCC6iGwE0="
   },
-  "com/fasterxml#oss-parent/61": {
-   "pom": "sha256-NklRPPWX6RhtoIVZhqjFQ+Er29gF7e75wSTbVt0DZUQ="
-  },
   "com/fasterxml#oss-parent/68": {
    "pom": "sha256-Jer9ltriQra1pxCPVbLBQBW4KNqlq+I0KJ/W53Shzlc="
   },
-  "com/fasterxml#oss-parent/70": {
-   "pom": "sha256-JsqO1vgsnS7XzTIpgQW7ZcD52JnbYXV6CXQVhvqTpjk="
+  "com/fasterxml#oss-parent/69": {
+   "pom": "sha256-OFbVhKqhyOM86UxnJE9x9vcFOKJZ/+jngXYbn6qth18="
   },
-  "com/fasterxml/jackson#jackson-base/2.20.1": {
-   "pom": "sha256-C3SKsMx/KH21tgGMYUz+Z+fh9NgJQc4vQdMXzMO1tcU="
+  "com/fasterxml#oss-parent/79": {
+   "pom": "sha256-kga33Wf7E4A2V2w9/KlHoqjz4sTS2cHy0d6lGbOk2uE="
   },
-  "com/fasterxml/jackson#jackson-bom/2.19.1": {
-   "pom": "sha256-um1o7qs6HME6d6it4hl/+aMqoc/+rHKEfUm63YLhuc4="
+  "com/fasterxml/jackson#jackson-base/2.22.0": {
+   "pom": "sha256-JSCeuNzVprRyMLP8EZzxwDgB9pg7lSliS37/aBPwFyY="
   },
-  "com/fasterxml/jackson#jackson-bom/2.20.1": {
-   "pom": "sha256-DGRn7UyMc5JSTOcDymzj7YhZbuw5DxOwwmTy+WEwilQ="
+  "com/fasterxml/jackson#jackson-bom/2.19.2": {
+   "pom": "sha256-IgBr5w/QGAmemcbCesCYIyDzoPPCzgU8VXA1eaXuowM="
   },
-  "com/fasterxml/jackson#jackson-parent/2.19.2": {
-   "pom": "sha256-Y5orY90F2k44EIEwOYXKrfu3rZ+FsdIyBjj2sR8gg2U="
+  "com/fasterxml/jackson#jackson-bom/2.22.0": {
+   "pom": "sha256-Yx1zbVKdGb+iUFTYuaRCZFh72NJEmuisGMcfDvLS8kQ="
   },
-  "com/fasterxml/jackson#jackson-parent/2.20": {
-   "pom": "sha256-tDt/XGLoaxZPrnCuF9aRHF22B5mvAQVzYK/aguSEW+U="
+  "com/fasterxml/jackson#jackson-parent/2.19.3": {
+   "pom": "sha256-I9GGyNjNBgFdAixxDHFUI9Zg1J4pc7FYcLApzCYBhoI="
   },
-  "com/fasterxml/jackson/core#jackson-annotations/2.20": {
-   "jar": "sha256-lZov+y1ZFDb1Hxg8alIfyJNHkS9xG/DK4AjN8EXZUxk=",
-   "module": "sha256-wHDxTsg1jQlcAurootZcsAzLoOXFqnOwASlDM/5GiXE=",
-   "pom": "sha256-TXQMRHjdCNCJ7NxtBjIopVoRp+jkl9pDOPhy+BFXlKQ="
+  "com/fasterxml/jackson#jackson-parent/2.22": {
+   "pom": "sha256-fUWn77ad8ge+18xUuHoLsBLxCVLAlVcKJztJSF2g0Sk="
   },
-  "com/fasterxml/jackson/core#jackson-core/2.20.1": {
-   "jar": "sha256-/6tNlX2qJ5bPJMtm0LeKcJDxvL4Xw6RXjwmv+q8TcIk=",
-   "module": "sha256-GalAQ0Ic2ahuFUkSnDjBjgs1exQUWuT3Ns2gL4Bch8k=",
-   "pom": "sha256-FuBJqySPgqpssEjwTVLvPuH1TIDaHSY68k++UM9ueX4="
+  "com/fasterxml/jackson/core#jackson-annotations/2.22": {
+   "jar": "sha256-Id21mIB9OlGodnBOuXnZKW4cam9Hqxgm/4jG1qEnotA=",
+   "module": "sha256-PSJwREjpjf1XjF31ZG3QqYrsBAgLCKMkXPi+uKJdy10=",
+   "pom": "sha256-OMO6UqDq3j4+rMWxNJnVbhA4zLrY7Eu3lCbcIUMrRtA="
   },
-  "com/fasterxml/jackson/core#jackson-databind/2.20.1": {
-   "jar": "sha256-NLvrRSb/9PhWWxIQa/haavy66FiWbUibVCFKxGsuJug=",
-   "module": "sha256-S1M7Mu5wZfVaSnsNbuTYn9WDdxSr83YUyJkRT7EhWHo=",
-   "pom": "sha256-vP3yeCUyMraDq1HeLcvI+Y8g9Hc4wRHs/SyFxBsTHOw="
+  "com/fasterxml/jackson/core#jackson-core/2.22.0": {
+   "jar": "sha256-0ujdTfHg9ht4bqBnkvW/QjXYJ48Vjzvm6ZfpVZMcDJg=",
+   "module": "sha256-YIIVtvFyn7S4gI73UdJki62kTgivii0JzOI5UFeV7l8=",
+   "pom": "sha256-WqFPSdI2n4hbfD3D6oLoqtscCTZ26GCIPmiHFQ5z0/Q="
   },
-  "com/fasterxml/jackson/datatype#jackson-datatype-jsr310/2.20.1": {
-   "jar": "sha256-aSvoPH4u67U7mVwR2BPGA6fXFtYMnS1PuUhuyxBfkpE=",
-   "module": "sha256-Ym4ePGc34Ie1v0UXrorr1pQ1ChBIdvtHSmJ3h+HEq0Y=",
-   "pom": "sha256-8V/WLrJEdrAKsf93IPALFmtpc+YobRRwi7hmEuv5I9Q="
+  "com/fasterxml/jackson/core#jackson-databind/2.22.0": {
+   "jar": "sha256-NSCgNR8pRpnj4bejfHpyav2B4aia5wKsfUf/NH/S7L8=",
+   "module": "sha256-McdjazHtpftn3FUh4gHzyV2WiWX+YMECdW4xmy0YD28=",
+   "pom": "sha256-dryzSDZ2c9C158+siWGxi9AIGrPBUaFui+UiEL7CMTY="
   },
-  "com/fasterxml/jackson/module#jackson-modules-java8/2.20.1": {
-   "pom": "sha256-ARd18sV1jwGRus7bTlFDj6/crz2rJUi/xLfXlaRUNg0="
+  "com/fasterxml/jackson/datatype#jackson-datatype-jsr310/2.22.0": {
+   "jar": "sha256-yLP1aFVSPtfq5oXKKS0tvpf/IgWt8v6RoHWePuB1TUw=",
+   "module": "sha256-23MyjrwA9Z0hzyKzS2O0i0CMtoX8Iih0lszyewul+z0=",
+   "pom": "sha256-DekC1FGLtdtaO+KWeRHkmbPKRiyweE/h9HcXa2uCB3I="
   },
-  "com/fasterxml/woodstox#woodstox-core/7.1.0": {
-   "jar": "sha256-gSZpIKHNxHMGqKK0cmyZ7Imz+/McJHDk9eR32dhXyp8=",
-   "pom": "sha256-+ZXFCx0gl18KjW8OUyK8jRPHiuPcGCcXdoQUlypmzIU="
+  "com/fasterxml/jackson/module#jackson-modules-java8/2.22.0": {
+   "pom": "sha256-inDeHu8ntNOzDZ5gLQQF8lBJ94o26BtHbF6gjk+YSGo="
+  },
+  "com/fasterxml/woodstox#woodstox-core/7.1.1": {
+   "jar": "sha256-ArnQIunUdwT/inqFmg2/07KIKoMR63/x4YD3YMzaJxI=",
+   "pom": "sha256-r7XLRdQcH542dZCd5P7yQr3BzqRHagY0riD016VEM/8="
   },
   "com/github/ben-manes/caffeine#caffeine/3.2.3": {
    "jar": "sha256-ynDJCl0c4VEYgM6ck9StIhCPYREdPa+R61J2K1cb0Xk=",
@@ -415,15 +419,15 @@
    "jar": "sha256-dmrSoHg/JoeWLIrXTO7MOKKLn3Ki0IXuQ4t4E+ko0Mc=",
    "pom": "sha256-GYidvfGyVLJgGl7mRbgUepdGRIgil2hMeYr+XWPXjf4="
   },
-  "com/google/code/gson#gson-parent/2.13.2": {
-   "pom": "sha256-g6tSip1Q/XauuK1vcns+6ct2ZYYlV3TtFsqMTHbZ2s0="
+  "com/google/code/gson#gson-parent/2.14.0": {
+   "pom": "sha256-grD2aUxXWKuLsH4FYwII1Q9YnUteBP0KBG1Zzfe6PR0="
   },
   "com/google/code/gson#gson-parent/2.8.0": {
    "pom": "sha256-Dx2DabHp8bxLRnyNz92LWXM6rVtchBnDpZsvmrrwTNI="
   },
-  "com/google/code/gson#gson/2.13.2": {
-   "jar": "sha256-3QzhtVo+0ggMtw+cZVhQzahsIGhiMQAJ3LXlyVJlpeA=",
-   "pom": "sha256-OqBqp8D5rwkpYaQtCVeOQyS+FGNIoO5u1HhX98Jne3Y="
+  "com/google/code/gson#gson/2.14.0": {
+   "jar": "sha256-LL0Rm/GWHCh4gxCWPcgLpl9Yze7B3ROci9sSQPqiw28=",
+   "pom": "sha256-H6ASLA43MxkmQoYcNr5Mb3maeVMnojvdKSJpG26bpIA="
   },
   "com/google/code/gson#gson/2.8.0": {
    "jar": "sha256-xiIXY715xPHD3H91C18poLs4s2e4ExTE9xiW40DECCU=",
@@ -444,13 +448,13 @@
   "com/google/errorprone#error_prone_annotations/2.38.0": {
    "pom": "sha256-MAe++K/zro6hLYHD/qy08Vl5ss9cPjj8kYmpjeoUEWc="
   },
-  "com/google/errorprone#error_prone_annotations/2.41.0": {
-   "jar": "sha256-pW54K1tQgRrCBAc6NVoh2RWiEH/OE+xxEzGtA29mD8w=",
-   "pom": "sha256-oVHfHi4LSGGNiwahgHSKKbOrs5sbI5b2och5pydIjG4="
+  "com/google/errorprone#error_prone_annotations/2.47.0": {
+   "jar": "sha256-U2S8byLnLpgZXkBqWNO6HAn/oR3qBylZLLhw3C3kBW0=",
+   "pom": "sha256-2AyImkpvcR9pRfvueeBewkexeKVn6dWr9Y6ybr8KB1I="
   },
-  "com/google/errorprone#error_prone_annotations/2.43.0": {
-   "jar": "sha256-SCcudcFuH3vce9GVKcys1e4XBARwHX9aI0QbtYR5V/U=",
-   "pom": "sha256-T2uIia+o3r2+Hj/ipfjmbiIWygtWPya05UE4cw7s3IA="
+  "com/google/errorprone#error_prone_annotations/2.48.0": {
+   "jar": "sha256-tJxclYMW7WegnGmd2pqnScr0NNUdhj3qWZ7zakm5yFU=",
+   "pom": "sha256-GJ4JrQSJwyXpDaqp1cj0BjMGAvo2Zgm8oHy82tA6udo="
   },
   "com/google/errorprone#error_prone_parent/2.11.0": {
    "pom": "sha256-goPwy0TGJKedMwtv2AuLinFaaLNoXJqVHD3oN9RUBVE="
@@ -464,11 +468,11 @@
   "com/google/errorprone#error_prone_parent/2.38.0": {
    "pom": "sha256-5iRYpqPmMIG8fFezwPrJ8E92zjL2BlMttp/is9R7k0w="
   },
-  "com/google/errorprone#error_prone_parent/2.41.0": {
-   "pom": "sha256-xTg4jXYKXByY3PBvbtPP5fEaZRgn21y9LtgojHlcrUI="
+  "com/google/errorprone#error_prone_parent/2.47.0": {
+   "pom": "sha256-I2ipkMemMJXh0NREWdWkCS8Osx+FYr0SzfDhyHe2poU="
   },
-  "com/google/errorprone#error_prone_parent/2.43.0": {
-   "pom": "sha256-u5LEWE0CEb1ZvspPsnYXD13FD+NGFG6TV40tqyYDPhA="
+  "com/google/errorprone#error_prone_parent/2.48.0": {
+   "pom": "sha256-sz+opFyfF5SlAIwLLYOoTrKLXQEXptFW8AP58JvnQQ8="
   },
   "com/google/guava#failureaccess/1.0.1": {
    "jar": "sha256-oXHuTHNN0tqDfksWvp30Zhr6typBra8x64Tf2vk2yiY=",
@@ -496,8 +500,8 @@
   "com/google/guava#guava-parent/33.4.0-android": {
    "pom": "sha256-ciDt5hAmWW+8cg7kuTJG+i0U8ygFhTK1nvBT3jl8fYM="
   },
-  "com/google/guava#guava-parent/33.5.0-jre": {
-   "pom": "sha256-aHGeaHxuTJ/z4P7L73vSCJbw9PezFHQ+0zxy+WJWghU="
+  "com/google/guava#guava-parent/33.6.0-jre": {
+   "pom": "sha256-N0vTH2Gxz2Er7pqy5NcLvfd92FpJtDH4CdT73JAfLdQ="
   },
   "com/google/guava#guava/21.0": {
    "jar": "sha256-lyE5cYq8ikiT+njLqM97LJA/Ncl6r0T6MDGwZplItIA=",
@@ -515,10 +519,10 @@
    "jar": "sha256-vX+iJ1kfuFCWd9DREiz5UVjzuKn0VlP1goHYefbcSMU=",
    "pom": "sha256-QsJX9/c203ezGv7u6XirJtcwzXCvYN3nZi4YI1LiSCo="
   },
-  "com/google/guava#guava/33.5.0-jre": {
-   "jar": "sha256-HjAfDFKsJIsLFP3D0SKDx3JS1Nb0hSHVcufYxMLMSsc=",
-   "module": "sha256-d+1CyMiyzru5OsngdUP/ZBiqJL24UXWAz1Mk6aZRCVY=",
-   "pom": "sha256-BHj6eKkIs8Mf5td76ZeKqmIeKhgduEAH49OzdCSirGE="
+  "com/google/guava#guava/33.6.0-jre": {
+   "jar": "sha256-3Fc+H8pP1UVPSl/T19ot8DACh2pBdbr8FKlZgN13E7M=",
+   "module": "sha256-K69zzoOa5I5LngCD4law5Y/Dv4/Hj8P755e7yJARIW4=",
+   "pom": "sha256-tFt4lEKABUMRxT2pJwgJ+0Dcq8QIzmbOVXMAmbT1fTI="
   },
   "com/google/guava#listenablefuture/9999.0-empty-to-avoid-conflict-with-guava": {
    "jar": "sha256-s3KgN9QjCqV/vv/e8w/WEj+cDC24XQrO0AyRuXTzP5k=",
@@ -562,13 +566,13 @@
    "jar": "sha256-1lImlJcTxMYaeE9BxRFn57Axb5N2Q5jrup5DNrPZVMI=",
    "pom": "sha256-5O1sZpYgNm+ZOSBln+CsfLyD11PbwNwOseUplzr5byM="
   },
-  "com/gradleup/shadow#com.gradleup.shadow.gradle.plugin/9.3.1": {
-   "pom": "sha256-UTTWOg2SWbKU+BUhoZoEAhUkhUVGiq7E9MBGfIKVx1o="
+  "com/gradleup/shadow#com.gradleup.shadow.gradle.plugin/9.5.1": {
+   "pom": "sha256-Mi1vdR/j/QgX4xsZnQzx3MbwOZvJ1IfE7ad+/4kGqac="
   },
-  "com/gradleup/shadow#shadow-gradle-plugin/9.3.1": {
-   "jar": "sha256-lGB42YbsVs6P+NAWN9kPcJ8zPVg6tSCq3Y5EnTcE2Gc=",
-   "module": "sha256-IuNwRjPPGSGbTVGUqNKJDPfPTbctRA5g6BIlcS+na2w=",
-   "pom": "sha256-nLrNpEyjh3wt54LMo5iIGUYCimh4H/kOypnamAgO/JE="
+  "com/gradleup/shadow#shadow-gradle-plugin/9.5.1": {
+   "jar": "sha256-6Qv/4KUXI4nhG/Js1Zy1AFyBGJIo9QA5UL/jQ0VPMmE=",
+   "module": "sha256-64DurOvM0TfqSwoYSZB/rmDtt6rkAuZ2pN0zynsIbJk=",
+   "pom": "sha256-/t6danx5fZsl5xwVwj0DkDVrUwlqMM1CclE0MHs6LWM="
   },
   "com/lmax#disruptor/4.0.0": {
    "jar": "sha256-wrqAhBVBJyvIFbytq5ENLXFqpWPsoVdiRQq0yIlEBQU=",
@@ -620,13 +624,17 @@
    "jar": "sha256-avZllfn2p7tYzmZRjWiI1AtUfDZtImLwZnbu4ZUo/2Y=",
    "pom": "sha256-r/ZFxYzUGsUYTZds6O443laU2Zq4dk1u5/FPcOrV+Ys="
   },
+  "commons-codec#commons-codec/1.22.0": {
+   "jar": "sha256-0WT+efJiwy2bGKC1stMX0cJ2U9Xpj9K5mMJL+QHHLOQ=",
+   "pom": "sha256-2aVl2Xj6pp0rEZX7HsJ+YPKef+sJr7ha2sePKABo+P4="
+  },
   "commons-collections#commons-collections/3.2.2": {
    "jar": "sha256-7urpF5FxRKaKdB1MDf9mqlxcX9hVk/8he87T/Iyng7g=",
    "pom": "sha256-1dgfzCiMDYxxHDAgB8raSqmiJu0aES1LqmTLHWMiFws="
   },
-  "commons-io#commons-io/2.21.0": {
-   "jar": "sha256-fWQ6Kv6osFi3YqpvuQ5bJW9scpc5+LN4TDNw3cYJ6I0=",
-   "pom": "sha256-rkd5XnIYA+yP8d7tdL4oqBGgJxO9WjqwrGfCtYy2Nas="
+  "commons-io#commons-io/2.22.0": {
+   "jar": "sha256-K5p7H3JvuGIW29LIMh6r4CIdvVsb6BwY4ctTgRsQR1g=",
+   "pom": "sha256-ZCXOwOp2ADXvp3J33oX4n6bb7RR6s92VuNLLxVNArM8="
   },
   "dev/equo/ide#solstice/1.8.1": {
    "jar": "sha256-bluizOgTvh1xzNwuzz5JJxsU5pG/u7GhFM86MOdzsQ0=",
@@ -637,110 +645,117 @@
    "jar": "sha256-DnGR++Mk+5340tIHwHtma43CW7vib1OkxS4v7OYkqXY=",
    "pom": "sha256-+pvmlFd2A+LUy1X0UjctP2wPk+XzjuXNf7Yos3k8qbw="
   },
+  "io/github/java-diff-utils#java-diff-utils-parent/4.12": {
+   "pom": "sha256-2BHPnxGMwsrRMMlCetVcF01MCm8aAKwa4cm8vsXESxk="
+  },
+  "io/github/java-diff-utils#java-diff-utils/4.12": {
+   "jar": "sha256-mZCiA5d49rTMlHkBQcKGiGTqzuBiDGxFlFESGpAc1bU=",
+   "pom": "sha256-wm4JftyOxoBdExmBfSPU5JbMEBXMVdxSAhEtj2qRZfw="
+  },
   "io/leangen/geantyref#geantyref/1.3.16": {
    "jar": "sha256-fx1ZEJLVFCtqqnz1n5TEx01X2+7wOy+CYpSfjza6xuM=",
    "pom": "sha256-JCgbY4MutO8QZOfd/b57eWquGr+IeYrb9NC5ZpurpKQ="
   },
-  "io/netty#netty-buffer/4.2.15.Final": {
-   "jar": "sha256-E2H9nJuoW5gxz1ShsuRd3DzjSnaJMXJsCZ0/XvDv5KM=",
-   "pom": "sha256-65fBAZy/5xAdObyuO9p4EgYJLijqCaZ9hDk1RHMry98="
+  "io/netty#netty-buffer/4.2.16.Final": {
+   "jar": "sha256-zDaun70LA/51XrTrRCTKU7Wc/Sl9f9R9SeWxBZvt7Ww=",
+   "pom": "sha256-vlW9UE+MhdG1OfKuDpRwniKk9K7Ts5LdUZnz1EoOQBo="
   },
-  "io/netty#netty-codec-base/4.2.15.Final": {
-   "jar": "sha256-LG051ycGKLjPwxZvvXqT1ZWVjlnEYbwy3bODyMkb+BE=",
-   "pom": "sha256-Yo9jcdvZkUKSeNM/py8joObWy4+0mp9gi96pLeox8r8="
+  "io/netty#netty-codec-base/4.2.16.Final": {
+   "jar": "sha256-/rQQIlk42ZcN5rYkoMAx0HmAT6XMXh7G6SmPFttZmKc=",
+   "pom": "sha256-ZkVXYbAnBBnSS0CbBylN7eVw7u17Lq5bPi+Vk1sRWdc="
   },
-  "io/netty#netty-codec-compression/4.2.15.Final": {
-   "jar": "sha256-StqlzdTS6bULI+TD7/Quc95utAhIcYs6qEzVtFTabOg=",
-   "pom": "sha256-Wmcscj2X0KkT+k+S+5LzPVa3/k4/+fAT38vV+mnOcC4="
+  "io/netty#netty-codec-compression/4.2.16.Final": {
+   "jar": "sha256-E8hWVBTdIRUoEwPvStH3zGm9d3HY0Sx9L7MTB9/ybRE=",
+   "pom": "sha256-KwI/X/Ssk3HYJ1WnuZcR7mc4nrQpGpnMNZPzcNI9S0s="
   },
-  "io/netty#netty-codec-haproxy/4.2.15.Final": {
-   "jar": "sha256-/rBrqlm9QTnWrWFojQatjpBmq6ZIDKnvqdHqaHWy98U=",
-   "pom": "sha256-nL6AzyIRXZwZ52TOMenN4ci0gYsOfGa163TbQIFNglQ="
+  "io/netty#netty-codec-haproxy/4.2.16.Final": {
+   "jar": "sha256-utoBbTDrCtywcDvF80ORSC7QRGddER+DAmPW8+MAZ10=",
+   "pom": "sha256-c2aec//A9ebb7XFOIZyj7YNyFLlrgxQHYAeQGGgkx40="
   },
-  "io/netty#netty-codec-http/4.2.15.Final": {
-   "jar": "sha256-dq5X6HrzezxBBxQPULkkSxRWFjpqIlUQg498WkRY7CI=",
-   "pom": "sha256-L2DNcK6TJT2XPGLgJ1FFD2dMJpDgBSvTo6SBnhApDe8="
+  "io/netty#netty-codec-http/4.2.16.Final": {
+   "jar": "sha256-DRb5gd6NDTBKKrGoHwpnSJIIn7qopYMQCuu0pbAEVuw=",
+   "pom": "sha256-8AXeoD9FJF3QsnAUqh8c73sSu+1aUr488RTY50ERIqQ="
   },
-  "io/netty#netty-codec-marshalling/4.2.15.Final": {
-   "jar": "sha256-u8ZVtSUzh/Vmsl1BhRUpUfASH7Ov7yw1LnqlK5+5ZdM=",
-   "pom": "sha256-adEoNDr92lR7EVWv2nDxq+G/YKVqjrvLOpFiqKnZuUo="
+  "io/netty#netty-codec-marshalling/4.2.16.Final": {
+   "jar": "sha256-lpGBjG5ZqX5FT4OByG3+hAMCFo2YUJiieNygd4Hvx14=",
+   "pom": "sha256-1axV/Hv2JI89GCljAGR6Wm96Q4zhlMWFCvw0dHGf8Ec="
   },
-  "io/netty#netty-codec-protobuf/4.2.15.Final": {
-   "jar": "sha256-7POiRpU3SzVEcA2U21aHXakMHfvh5Dx0TcwV4eiZigE=",
-   "pom": "sha256-jgC64Kk0jBh7Ei9/Ap4aDrulRD+H9irXJykFTydtjjk="
+  "io/netty#netty-codec-protobuf/4.2.16.Final": {
+   "jar": "sha256-u2byPMtUPdhC3dqRtsjpfiIiINLvpUWfakaiKt47IXA=",
+   "pom": "sha256-TiexREeB19B1v56pdi3boTz6QvwxW9TJjvrnM9DhiBw="
   },
-  "io/netty#netty-codec/4.2.15.Final": {
-   "jar": "sha256-FTsRoWZFlzOvefsNRmfzC/o5eSiW9omyHJOkpAkTh+o=",
-   "pom": "sha256-sLXSrAj8Ig2Mb1FncT9DRkPiLEXBjsAT7EYSzQ2cTh0="
+  "io/netty#netty-codec/4.2.16.Final": {
+   "jar": "sha256-QYaLzEKJVOcH45owaGzt3AvSODkdOYnQTfty1fBzWSY=",
+   "pom": "sha256-42iq3f6M+/Tl+dzdBTTN5zDe1pP5Dboq6WspfcFXchg="
   },
-  "io/netty#netty-common/4.2.15.Final": {
-   "jar": "sha256-eCBqp/bRl8qpJikUCMAYiba5EMoPdAF9P8vazPlWKVk=",
-   "pom": "sha256-5tiUFFbAqD6Bq1eWqdEXrE62BVYbi6OeTbEY55k/Ro0="
+  "io/netty#netty-common/4.2.16.Final": {
+   "jar": "sha256-mCXuaKDcTNK1Pi9TJQJAGyIRutm3fosEiC2eZEhyg/8=",
+   "pom": "sha256-TWJqGdVkbPRBGRaz/pS5hwgetg2OW3/gawO4P09avCU="
   },
-  "io/netty#netty-handler/4.2.15.Final": {
-   "jar": "sha256-mbWeS+pyIg0q7VLfi6832XQxsGreCxNSJs33MWiXXqs=",
-   "pom": "sha256-omoi2DUluf+cHSF+YhGjWFvWiDVLpbW8dmY8n7BasZU="
+  "io/netty#netty-handler/4.2.16.Final": {
+   "jar": "sha256-olnKSW2gWsGYH5XNhWIR+JSjKAVqYSnpzXDbvV30Afc=",
+   "pom": "sha256-K3TxgB2lbN/5DgZBkWKU+78g0BwR+NXO6EAQdKhxwoU="
   },
-  "io/netty#netty-parent/4.2.15.Final": {
-   "pom": "sha256-4GUVjGqeWiONLlBYvbQeSqO4PJsLV9pPW8kCntRa568="
+  "io/netty#netty-parent/4.2.16.Final": {
+   "pom": "sha256-WRgTKjEV1EispZT6haJhTZuGqWk8Ti9CSpSupdkpQXI="
   },
-  "io/netty#netty-resolver/4.2.15.Final": {
-   "jar": "sha256-JDGEl/KjpkWWT+1Bj0iHm6ETZcq44fjWbEf6faFe8Zo=",
-   "pom": "sha256-rcbfcXVa/IHdpi0ourEVeXVxbXcGrZZx94Y034FzOHo="
+  "io/netty#netty-resolver/4.2.16.Final": {
+   "jar": "sha256-yeymqZA2SFzx0Ya0pqWVsKVMU4CDGe4DkkJw6uBMMrs=",
+   "pom": "sha256-YuLxeXHiRXTb/RQxaaegsdtXdHYZQbVawwb5fjLYnCU="
   },
-  "io/netty#netty-transport-classes-epoll/4.2.15.Final": {
-   "jar": "sha256-vlCUB/1xpLgzeFZ8YTQg21RNZZu1It97JTodvoyil/4=",
-   "pom": "sha256-w2AsL/4gFAb1LjkIYcjNwpCglQsjU82uppNqnFZWVo4="
+  "io/netty#netty-transport-classes-epoll/4.2.16.Final": {
+   "jar": "sha256-nytTIQ25yNJOeH7UPziWqvMNaG7ScMevuymrYzDGqiM=",
+   "pom": "sha256-vb/ZFXklc5aAVemBp4NeW2sZYu8+AFQ7W6FGL1ztVeY="
   },
-  "io/netty#netty-transport-classes-io_uring/4.2.15.Final": {
-   "jar": "sha256-3PucV45HrtXQUEW0uApdBce00M++Y+tDEKCVHL336Js=",
-   "pom": "sha256-bJ4vm0AqUUDgQvenry7sCucwrm42Jc0T1Hf1BykonLg="
+  "io/netty#netty-transport-classes-io_uring/4.2.16.Final": {
+   "jar": "sha256-LwsYmDSqLJRbLvll/tMByYg7RajFRAjiVlck9GUQpZ4=",
+   "pom": "sha256-KhvKEYchZGzw+glMgjDOMZlJC3emX/4wdrGWZ/5ewAc="
   },
-  "io/netty#netty-transport-classes-kqueue/4.2.15.Final": {
-   "jar": "sha256-KhXiITof5J5ztLs5vHRucZbbqMGxgrwNIacZpNG+LAA=",
-   "pom": "sha256-xvcz3fb1A0K7FhEAPSl6JYmFwwxhkpaBy1TvDhuJsKQ="
+  "io/netty#netty-transport-classes-kqueue/4.2.16.Final": {
+   "jar": "sha256-ZZm0lfaUIMskCrChqmChmi3zvHJ5FykXDgmTcnY3pok=",
+   "pom": "sha256-BJZ8VzolqZK1UmaFI1J0tTxUF3TBTkhgSjzAuo+7xZo="
   },
-  "io/netty#netty-transport-native-epoll/4.2.15.Final": {
-   "jar": "sha256-mIBLKVRKIPVvJCJAu+wiBoTz4fzHgItxGKfV5+mZxBA=",
-   "pom": "sha256-nkXMVKRyv81Jtb0wbBBh9iUg9b3E5K/It+E/46y3iIA="
+  "io/netty#netty-transport-native-epoll/4.2.16.Final": {
+   "jar": "sha256-TmFq5d867+4rusNMznKQ/K7edFk/jPCnJB0DiP7yDp8=",
+   "pom": "sha256-QRVO4MBLhXd72/rfepRzUgHoyyTXYZQJxZl9OUzYd2Q="
   },
-  "io/netty#netty-transport-native-epoll/4.2.15.Final/linux-aarch_64": {
-   "jar": "sha256-WkAenftPk343oiIfa5HaJaAI6sHwjd1LsNntIODjJmg="
+  "io/netty#netty-transport-native-epoll/4.2.16.Final/linux-aarch_64": {
+   "jar": "sha256-ISzH2BOQ4xtYCh+5G2yNljtD52LtByxVXisJrUR26Sg="
   },
-  "io/netty#netty-transport-native-epoll/4.2.15.Final/linux-x86_64": {
-   "jar": "sha256-VEDjj1yihY/ujXiY5lKR4FtmVzbJ6KFMgy5wdRH126Y="
+  "io/netty#netty-transport-native-epoll/4.2.16.Final/linux-x86_64": {
+   "jar": "sha256-LgBUjnMZSIgdDHPuedLq11klTnUJKUBqHVlUhHWPAmc="
   },
-  "io/netty#netty-transport-native-io_uring/4.2.15.Final": {
-   "jar": "sha256-vuDQYNcWxXGFAGX3C5v4Plyb3ma0friZC4V3RE86e5g=",
-   "pom": "sha256-0np3cX5rpNzjAMDNREgJSudXIlLTvhajJrpgNLjYty4="
+  "io/netty#netty-transport-native-io_uring/4.2.16.Final": {
+   "jar": "sha256-0Iz035DxeoA0dbOIYbkVyxwmbH6LtFY6tRFk+FN5/tI=",
+   "pom": "sha256-5pMebTJsgi549gvRlXw1kkNdRQlwV4cViC/tgD2pUiI="
   },
-  "io/netty#netty-transport-native-io_uring/4.2.15.Final/linux-aarch_64": {
-   "jar": "sha256-uYiMSZ/40F33tfNfJ8N9042x8Uh14rSeWAXX1rwxG08="
+  "io/netty#netty-transport-native-io_uring/4.2.16.Final/linux-aarch_64": {
+   "jar": "sha256-Tsoxe+Z6N5ni4S4XqLtBRBKDhCF9p7cu0bdf2Gh5FOk="
   },
-  "io/netty#netty-transport-native-io_uring/4.2.15.Final/linux-x86_64": {
-   "jar": "sha256-FDjPsr9kJuJS2kjBHvgDzyg+m/2Djdr1Fwu0DFsjiRc="
+  "io/netty#netty-transport-native-io_uring/4.2.16.Final/linux-x86_64": {
+   "jar": "sha256-m2xqbFD0lAQBkZttB0412lqMcjnyS9b8UwtsrJyHrEk="
   },
-  "io/netty#netty-transport-native-kqueue/4.2.15.Final": {
-   "jar": "sha256-PksUkkGKsOqduvbKFWDDn/auyERrW2I/fwvfGoCNVQY=",
-   "pom": "sha256-9emre+S1ndRDWHQg5yTkLuoqym4XvdI7MULFPc5MCKo="
+  "io/netty#netty-transport-native-kqueue/4.2.16.Final": {
+   "jar": "sha256-WPsZTq1tUUTGPXH8XFsAuYV+ozOadAO3HHlU1oCaUTw=",
+   "pom": "sha256-6WV9u1HizKEFYV5hou8q+IC25LLkuk5el0S0bVqDAAg="
   },
-  "io/netty#netty-transport-native-kqueue/4.2.15.Final/osx-aarch_64": {
-   "jar": "sha256-yWlqQeVJ60JDLx4sw/OHyFQ1A0tzo7+HSP//QNAPkho="
+  "io/netty#netty-transport-native-kqueue/4.2.16.Final/osx-aarch_64": {
+   "jar": "sha256-eWxQP3qAIXF3vTFfZEgmMTTuD5BCYn1f1pjHYLz5nIw="
   },
-  "io/netty#netty-transport-native-kqueue/4.2.15.Final/osx-x86_64": {
-   "jar": "sha256-YJXClmGr4fL7wsecVKlN5P2t3W6ZxwKSf9PADmaHJXQ="
+  "io/netty#netty-transport-native-kqueue/4.2.16.Final/osx-x86_64": {
+   "jar": "sha256-BaCaSrUfSI8MIvQszObAaTWvv6xRFz+uRBcEZaoHKCg="
   },
-  "io/netty#netty-transport-native-unix-common/4.2.15.Final": {
-   "jar": "sha256-ueqfxa1eugTpmv3/dbLrl7Xd+yrXcuLy712PJ388vXY=",
-   "pom": "sha256-PHTmq7oFksjigPJiOU192YMbOsxHf5gXpYbWxCCpryU="
+  "io/netty#netty-transport-native-unix-common/4.2.16.Final": {
+   "jar": "sha256-QcqP4ZIIPReRe+fdzs3tTaT8HbHRZW0D0LyxTi9DEVU=",
+   "pom": "sha256-iLtMG6+R4rBUJGu5g7mqAvtmwj+w6G5aKCOHarJGbW4="
   },
-  "io/netty#netty-transport/4.2.15.Final": {
-   "jar": "sha256-n7Zx6WZRBmzxoo2tPxOCx8md9bgybUohTZo3WzEfjcE=",
-   "pom": "sha256-Ta4gEvr/cYZwdwOzlST6fCAu9Br65bk4Sgk3zDwEFLo="
+  "io/netty#netty-transport/4.2.16.Final": {
+   "jar": "sha256-z6P2VMr/kGZTOF9LfdqlOdeVt49XEaYiSCsX0rc0hMA=",
+   "pom": "sha256-wUroBRmAFPeewCE4EL/oxFxaPWmUoYHyM+t2wZ6UIwo="
   },
-  "it/unimi/dsi#fastutil/8.5.15": {
-   "jar": "sha256-z/62ZzvfHm5Dd9aE3y9VrDWc9c9t9hPgXmLe7qUAk2o=",
-   "pom": "sha256-f2baEne0E7MncoaNO1C1XF/lTiZD8bVORZbk9Sofvtg="
+  "it/unimi/dsi#fastutil/8.5.18": {
+   "jar": "sha256-kJSuZ9AdCtJG+IbxGtVX/C55xyy/P+7YPhUSqK6Qp0o=",
+   "pom": "sha256-GE28pJp9A+Oh358Pl7RiCW6En1rQXFz3s4YibsFZ73k="
   },
   "jakarta/inject#jakarta.inject-api/2.0.1": {
    "jar": "sha256-99yYBi/M8UEmq7dRtk+rEsMSVm6MvchINZi//OqTr3w=",
@@ -786,16 +801,6 @@
    "module": "sha256-14HUFbA5BUa6FkvPf74dwreas6rTtN6jpIrEvpQzI54=",
    "pom": "sha256-QzBXYlX/5/CT5fjU2AQ0t3P5VCqovZs7L+36+BCCSGQ="
   },
-  "net/kyori#adventure-platform-api/4.4.1": {
-   "jar": "sha256-7GBGKMK3wWXqdMH8s6LQ8DNZwsd6FJYOOgvC43lnCsI=",
-   "module": "sha256-eQK22+/3zL7KP5EHK10TlnoPi4aDYL1pOh/GIuIAN0s=",
-   "pom": "sha256-116fYiU8axNS3XTNyLmuRqoFyz3fTnV98xetsWXY75w="
-  },
-  "net/kyori#adventure-platform-facet/4.4.1": {
-   "jar": "sha256-IPjm2zTXIqSszL7cybbALo7ms8q5NQsGqz0cCwuLRU8=",
-   "module": "sha256-5bh8za6MLPoH27A4UsnTVFaMXk5XbCKgIpHzoYOFZaE=",
-   "pom": "sha256-SLtXCyvxeN2kDMBb6aJtOpY5QLcYpl8X2YvDhcgGaXQ="
-  },
   "net/kyori#adventure-text-logger-slf4j/5.2.0": {
    "jar": "sha256-rnm384RsXZc7N8fuwDGQvUThgpGNE0bncFxZkaG137M=",
    "module": "sha256-0BEmhpPSXU/YmXCP+s90I40Cyi/eBDgnbUxgaRM3SMk=",
@@ -888,16 +893,19 @@
   "org/apache#apache/35": {
    "pom": "sha256-6il9zRFBNui46LYwIw1Sp2wvxp9sXbJdZysYVwAHKLg="
   },
-  "org/apache/ant#ant-launcher/1.10.15": {
-   "jar": "sha256-XIVRmQMHoDIzbZjdrtVJo5ponwfU1Ma5UGAb8is9ahs=",
-   "pom": "sha256-ea+EKil53F/gAivAc8SYgQ7q2DvGKD7t803E3+MNrJU="
+  "org/apache#apache/37": {
+   "pom": "sha256-Uk7EeHr/c69rOp+voVTH8YgbZIKZtmP9v8rdoShvI1M="
   },
-  "org/apache/ant#ant-parent/1.10.15": {
-   "pom": "sha256-SYhPGHPFEHzCN/QoXER3R5uwgEvwc3OUgBsI114rvrA="
+  "org/apache/ant#ant-launcher/1.10.17": {
+   "jar": "sha256-9uPeBtwOo5ZjgATxoAP1X9vSDD58z7m3pST0n9CuhWg=",
+   "pom": "sha256-9AC2o10TvZ5x6sSDWfHZH799QMhtnHduwxZ/cQh5Xs0="
   },
-  "org/apache/ant#ant/1.10.15": {
-   "jar": "sha256-djrNpKaViMnqiBepUoUf8ML8S/+h0IHCVl3EB/KdV5Q=",
-   "pom": "sha256-R4DmHoeBbu4fIdGE7Jl7Zfk9tfS5BCwXitsp4j50JdY="
+  "org/apache/ant#ant-parent/1.10.17": {
+   "pom": "sha256-mp73BzK+4Ro0oIZDqmlGPRwlhlhAHXJ5pU9zrQoVqeQ="
+  },
+  "org/apache/ant#ant/1.10.17": {
+   "jar": "sha256-i+aS4Cg39BpHo9Ic3mZVeSFC/fQv4jvLFtcSnK2bIoQ=",
+   "pom": "sha256-Y6briOLg/NdpZ6rn5vWBGwLz+cUtltt2a2tJBXaPxis="
   },
   "org/apache/commons#commons-parent/39": {
    "pom": "sha256-h80n4aAqXD622FBZzphpa7G0TCuLZQ8FZ8ht9g+mHac="
@@ -911,6 +919,9 @@
   "org/apache/commons#commons-parent/91": {
    "pom": "sha256-0vi2/UgAtqrxIPWjgibV+dX8bbg3r5ni+bMwZ4aLmHI="
   },
+  "org/apache/commons#commons-parent/98": {
+   "pom": "sha256-1AMYUn9WAz4P8HiZccw4yFaqmaaF7qEScIFOfx7an7o="
+  },
   "org/apache/groovy#groovy-bom/4.0.27": {
    "module": "sha256-1sIlTINHuEzahMr3SRShh8Lzd+QoTo2Ls/kBUhgQqos=",
    "pom": "sha256-qkTrUr/f5h0ns+RQ0rNI2I3qo0N6tNnUmoQJU0j59vs="
@@ -936,48 +947,76 @@
    "jar": "sha256-8r8vLHdyFpyeMGmXGWZ60w+bRsTp14QZB96y0S2ZI/4=",
    "pom": "sha256-f8K4BFgJ8/J6ydTZ6ZudNGIbY3HPk8cxPs2Epa8Om64="
   },
-  "org/apache/logging/log4j#log4j-api/2.25.3": {
-   "jar": "sha256-6IZoKSD6D7nW62OV3LTeCIRD+GRsicXlhG4WjjJ/QG8=",
-   "module": "sha256-W+T3N0jWz53pXLci63n8rVvCQnk6l4p+cmbyNZGBHAw=",
-   "pom": "sha256-MoS+ZXOuuDNGz/a3RvoyXSPq3Z0JyOKG7R11kEoS3W4="
+  "org/apache/logging/log4j#log4j-api/2.26.0": {
+   "jar": "sha256-gg3nu69DDq8uPlzLkvI+IIV5fFrE1Pf8bItmD776Hbw=",
+   "module": "sha256-oSTwJk9jCkX7b0GfRhR0KXi1tRco8J5kAwNfHWPcTCE=",
+   "pom": "sha256-pLhyPB5gXu3Cs5bdtTL6BhryQufi4mmOytUCsMNcV7I="
   },
-  "org/apache/logging/log4j#log4j-bom/2.25.3": {
-   "pom": "sha256-ZleICHEo/mw6+dAlJEhTKvl4cRdmSB20k5a/AyWibK0="
+  "org/apache/logging/log4j#log4j-api/2.26.1": {
+   "jar": "sha256-8YEKRwTMzgGdArugKdwCpPKsDJl/ZHtGXn1AnBkn+CI=",
+   "module": "sha256-Xtk/b7UzS/fuUpQ9GmVLw6Hz8Qdlri/Uu9OHMzvmZ4o=",
+   "pom": "sha256-yKuGj5xTIjO9EvMRzqkKP23mXqB6eqRww+K7+Dtcefs="
   },
-  "org/apache/logging/log4j#log4j-core/2.25.3": {
-   "jar": "sha256-Nit/y2W3OqRsxLxTq/TrIW9ESoO10aA3y2/f/wrp8Pk=",
-   "module": "sha256-ChRnoKtPxLJSc7VVHGCL15UguZ/SgRGgM9M4jwJVYwA=",
-   "pom": "sha256-ysGDRqDJErAmrVF/SE78POgyZ/LPambKhGmRL/GYaw0="
+  "org/apache/logging/log4j#log4j-bom/2.26.0": {
+   "pom": "sha256-1K8Y0C3O/GV/Wkl/M5wUuf3lVGhsfIHF+Acr4WXbdXg="
   },
-  "org/apache/logging/log4j#log4j-iostreams/2.25.3": {
-   "jar": "sha256-/bYDbzyivDDtcC92iVBzx6K0D7Z8abhI28hfhrzbT18=",
-   "module": "sha256-w16fRwVrq6CHkPU1NbwMZzcA3AtDYdashOfZuLostKc=",
-   "pom": "sha256-B6fd6EEZoZgc5jJXCgumiZfDhM14BF/1fWG5aa2ISo8="
+  "org/apache/logging/log4j#log4j-bom/2.26.1": {
+   "pom": "sha256-RBWtGJ3QTbVJWKQ+I7N8w5eh7e6eiIIUuL1H++gZBy4="
   },
-  "org/apache/logging/log4j#log4j-jul/2.25.3": {
-   "jar": "sha256-JvGAp0Z1gERrC2oYwl2Lx3Ny0QRnYj0epv+gi/ZubT8=",
-   "module": "sha256-z7mvFAXDC9A6Rd2vkNR20h2Q+XJOU9W9x1yYIpjKWYs=",
-   "pom": "sha256-az9qo3TRyvI39ikwuNGy+jjtRxXfs5h+oNDmSrDIXKA="
+  "org/apache/logging/log4j#log4j-core/2.26.0": {
+   "jar": "sha256-QGuzEyxHpdMi5cVx/rB4fKhElkafNG61Hx7y7kVJmQI=",
+   "module": "sha256-l9KA4YMBLdiYgQpxdqI4EntnyCUX7CvUXCPEHOB5kLs=",
+   "pom": "sha256-pAJ6Ewgiftxul2LUHNIAqueglUL917rrR6l0EJ5WduM="
   },
-  "org/apache/logging/log4j#log4j-slf4j2-impl/2.25.3": {
-   "jar": "sha256-vtxWAWj0AF0JRS5raVmyUvnvouuMvRfGZgw27s7HI4s=",
-   "module": "sha256-EPKDWuK5Gf9a6uJmWX892PAbncsOtDju6BsPF/J06HQ=",
-   "pom": "sha256-4VDwlijvLRf+UUyi2y1S0y7M3VPnSrOtTuKPM01pWgE="
+  "org/apache/logging/log4j#log4j-core/2.26.1": {
+   "jar": "sha256-LsjDv1ptfIm+hiARai/Jc/fdoa0CYa05PE1HJu39Pcs=",
+   "module": "sha256-A7/Yrb4wasRgAeyd5mj45dJPZlnyEvxk5iobZypaL2o=",
+   "pom": "sha256-Gj/ZpEZ8OrmxJ+cUG+8Sm2JCj+Ey9/klw69/Uk3XqLU="
   },
-  "org/apache/logging/log4j#log4j/2.25.3": {
-   "pom": "sha256-pbdIJFris5b1vKlHpJbtwI29vfeWmuLMsattS0lznn8="
+  "org/apache/logging/log4j#log4j-iostreams/2.26.0": {
+   "jar": "sha256-HE4U6+z9ag4QCgj57M+2OXhKRB51keiHdSRAu0yUH+g=",
+   "module": "sha256-fgesENfiXLzx62YnB3qzvTjeZJ+PmUbcaAHJ2TI+KGs=",
+   "pom": "sha256-w1ZZ/qd8q01GPl0izY60qAL4m1e7941HHC14nqIFwfg="
   },
-  "org/apache/maven#maven-api-annotations/4.0.0-rc-3": {
-   "jar": "sha256-XTSQ9yrTp+gr6IsnYp83xZ/SUxuuURw7E4ZkINXYYr0=",
-   "pom": "sha256-83HUqkRgxMwP4x0W20WC2+eGHvzS5nqvGEPimR8Xx0I="
+  "org/apache/logging/log4j#log4j-jul/2.26.0": {
+   "jar": "sha256-bdJsxNf5URhI0PgwJsb/CeiCVvlGZL8plvebYgaoPk8=",
+   "module": "sha256-6sOaiZ2yNHRDi9u6b5kzxyNpAJ+vkYlNbmV2Dfau+Fc=",
+   "pom": "sha256-Rf6AcmVLH4jvd88P7PUvQq+HepB/OlSTMMrr9DJ21TQ="
   },
-  "org/apache/maven#maven-api-xml/4.0.0-rc-3": {
-   "jar": "sha256-8+OzZCNzxp1MdEHUDroHZeHXROmStiGURS9epUUd/bo=",
-   "pom": "sha256-XxSOOelo08K3a4426hN3mJ8KeetDpqWa5yPZElzLXGE="
+  "org/apache/logging/log4j#log4j-slf4j2-impl/2.26.0": {
+   "jar": "sha256-z8G929OeaEtpiuloKR2KOzpV7g7C7z0+pcIzap4VFZg=",
+   "module": "sha256-KT7CmLbfDlHBOibm/r/IjoDZvj1WJsPXCRuy7x34O2M=",
+   "pom": "sha256-kGxQhfOYyeT5psxrpWxeVbjgpxXx5ytXT8qkkkO67Gw="
   },
-  "org/apache/maven#maven-xml/4.0.0-rc-3": {
-   "jar": "sha256-BjxCTLR/dRZBJdXuolFnuTHdaU40Jo1QJHN050IR3Rk=",
-   "pom": "sha256-nZZekiyqwDYkl9J7v6UaRI+UydcTYjZnnGhSNwb3KYI="
+  "org/apache/logging/log4j#log4j/2.26.0": {
+   "pom": "sha256-5fqx/dFG24mAzuDdE4P1+vinkmYG+si9qpv+8XyY1cQ="
+  },
+  "org/apache/logging/log4j#log4j/2.26.1": {
+   "pom": "sha256-6kcFcl/ZS/XevikR1Op68giYYD9oNU5kskYaDySeRF0="
+  },
+  "org/apache/maven#maven-api-annotations/4.0.0-rc-5": {
+   "jar": "sha256-H3MlwBoKxaUgbK/wn6OIUgxlBdq4UBePRS0saq09PIM=",
+   "pom": "sha256-KUsXWzHbZT0YahLB+cEqvDDOJNhP0I7Y7nrNP/z/c1I="
+  },
+  "org/apache/maven#maven-api-xml/4.0.0-rc-5": {
+   "jar": "sha256-NYhRqH7dDd1WakN0cOoCG6hRoEh+xNFIJf8E2wP/WHc=",
+   "pom": "sha256-ipJVq+4mRj+acwxara70LVkUk1mAUJvRZ3f4hfJzLRs="
+  },
+  "org/apache/maven#maven-api/4.0.0-rc-5": {
+   "pom": "sha256-YQwETwFZpuFcV57QV5QDJw+/ngDoPtsnaSaxz3f1rKk="
+  },
+  "org/apache/maven#maven-impl-modules/4.0.0-rc-5": {
+   "pom": "sha256-lzSkwzOHhsbmqv59tDdsrQufTt6mPZ78yOnybyBiXzU="
+  },
+  "org/apache/maven#maven-parent/45": {
+   "pom": "sha256-lP6Gnrm0zp/OOZXQXqhrFoyF2Sf50XvrgUoZYMdtfm8="
+  },
+  "org/apache/maven#maven-xml/4.0.0-rc-5": {
+   "jar": "sha256-pLetPjQQ4P62Q467YjHI4CRJzQL89kUbrtggAIoQNWQ=",
+   "pom": "sha256-pQMKSVjqpDsGfONgwpcxkL14uknuzOXq828ZaFPvyS8="
+  },
+  "org/apache/maven#maven/4.0.0-rc-5": {
+   "pom": "sha256-hRSh6zmY8SItJFgJCcRXbVzw31PUBp27tMptNDE4AvU="
   },
   "org/apiguardian#apiguardian-api/1.1.2": {
    "jar": "sha256-tQlEisUG1gcxnxglN/CzXXEAdYLsdBgyofER5bW3Czg=",
@@ -1026,16 +1065,16 @@
   "org/codehaus/mojo#mojo-parent/40": {
    "pom": "sha256-/GSNzcQE+L9m4Fg5FOz5gBdmGCASJ76hFProUEPLdV4="
   },
-  "org/codehaus/plexus#plexus-utils/4.0.2": {
-   "jar": "sha256-iVcnTnX+LCeLFCjdFqDa7uHdOBUstu/4Fhd6wo/Mtpc=",
-   "pom": "sha256-UVHBO918w6VWlYOn9CZzkvAT/9MRXquNtfht5CCjZq8="
+  "org/codehaus/plexus#plexus-utils/4.0.3": {
+   "jar": "sha256-Qh/27RRsU6nU6q3o9im1KxKvcYcQHxvQbCxk6QQBnzw=",
+   "pom": "sha256-NXNmWPP+Hvo5UIbJHfJZJmT6+iTD8mCP2roRNtF/02A="
   },
-  "org/codehaus/plexus#plexus-xml/4.1.0": {
-   "jar": "sha256-huan8HSE6LH3r2bZfTujyz1pKlRhtLHQordnDPV0jok=",
-   "pom": "sha256-uKO6h7WsMXVJUEngIXiIDKJczJ6rGkR9OKGbU3xXgk4="
+  "org/codehaus/plexus#plexus-xml/4.1.1": {
+   "jar": "sha256-4JsfzEbadEoOTavnA/KHzhM7Yx6pXG4aioLrrSsaKBU=",
+   "pom": "sha256-z4hxHMW/kIkzRxDnJ2FglUB88EuWg3Vnfg3aqYqlfg0="
   },
-  "org/codehaus/plexus#plexus/20": {
-   "pom": "sha256-p7WUsAL8eRczyOlEcNCQRfT9aak61cN1dS8gV/hGM7Q="
+  "org/codehaus/plexus#plexus/25": {
+   "pom": "sha256-+qeUfCAglnrQySslnun6Nh0F6QzQNtF8NwmLse2uo6M="
   },
   "org/codehaus/woodstox#stax2-api/4.2.2": {
    "jar": "sha256-phxI1VPvrXi8Af/8SsUovruuZMuuwXCypeOc9h61Gr4=",
@@ -1047,31 +1086,24 @@
   "org/eclipse/ee4j#project/1.0.7": {
    "pom": "sha256-IFwDmkLLrjVW776wSkg+s6PPlVC9db+EJg3I8oIY8QU="
   },
-  "org/eclipse/jgit#org.eclipse.jgit-parent/7.4.0.202509020913-r": {
-   "pom": "sha256-1TcU7SZJuBcyiPZUBeVPvvdRZWuRSAxUWfTcAZIAJHI="
-  },
   "org/eclipse/jgit#org.eclipse.jgit-parent/7.5.0.202512021534-r": {
    "pom": "sha256-fjiAaoU2kaSdsW6sg2/mtiYnaUOxCLZ3VKPVx0D7vA4="
   },
-  "org/eclipse/jgit#org.eclipse.jgit/7.4.0.202509020913-r": {
-   "jar": "sha256-m8fPLQQAoTDjQF5K6ceHddm9sQNwmNALLY6nlDbzp/M=",
-   "pom": "sha256-XwwOLNvW14gwL6hLKNDFOKBjNLoIEvxkJSBQkHIi0ws="
+  "org/eclipse/jgit#org.eclipse.jgit-parent/7.7.0.202606012155-r": {
+   "pom": "sha256-S4qHPLaFhEH/MSUDTbVU0leSL7cIIEeVtyAZDW+05iE="
   },
   "org/eclipse/jgit#org.eclipse.jgit/7.5.0.202512021534-r": {
    "jar": "sha256-FZe8eKjYwBFpdtRqlIcqLMKGVnDrpNsLn1GBGzSTbXI=",
    "pom": "sha256-bJVN/BDxwwG9uiXT1jCfd0eYBDY891VuUei7NxRVXGQ="
   },
+  "org/eclipse/jgit#org.eclipse.jgit/7.7.0.202606012155-r": {
+   "jar": "sha256-onxHjV94vD2VRh8VOmDv3xYjknUCxopFetmplaNcWnw=",
+   "pom": "sha256-owH00aR2nxrSVstU54V6Uq8n59A+UMo8UPTLZDw98SY="
+  },
   "org/eclipse/platform#org.eclipse.osgi/3.24.0": {
    "jar": "sha256-eJRUAUwVDyrfaBzYD47PSYF9k+15DzZZs2LcoHreh7g=",
    "pom": "sha256-ok2dkGpHjhJrIZqdJFGLgztm2ksQP5Y+ILkFC+virhU="
   },
-  "org/fusesource#fusesource-pom/1.12": {
-   "pom": "sha256-xA2WDarc73sBwbHGZXr7rE//teUxaPj8sLKLhOb9zKE="
-  },
-  "org/fusesource/jansi#jansi/2.4.2": {
-   "jar": "sha256-C3uLADqQ6kkVebYvURiCjkURKRTGVYmwD6pJ1ux4WDk=",
-   "pom": "sha256-Lory+B0MmVUIvWfJid4ewhbrakdgk/WY9CFOz2ESjfA="
-  },
   "org/javassist#javassist/3.28.0-GA": {
    "jar": "sha256-V9Cp6ShvgvTqqFESUYaZf4Eb784OIGD/ChWnf1qd2ac=",
    "pom": "sha256-w2p8E9o6SFKqiBvfnbYLnk0a8UbsKvtTmPltWYP21d0="
@@ -1093,85 +1125,108 @@
    "module": "sha256-W07rjbph51OBYVPgxz9WKyDgF+OTk5UtTeTdMbdyYLs=",
    "pom": "sha256-+NxQzzqsS87HQKkJVfKADkElHpxANjC3W3UtO271vuI="
   },
-  "org/jetbrains/intellij/deps#trove4j/1.0.20200330": {
-   "jar": "sha256-xf1yW/+rUYRr88d9sTg8YKquv+G3/i8A0j/ht98KQ50=",
-   "pom": "sha256-h3IcuqZaPJfYsbqdIHhA8WTJ/jh1n8nqEP/iZWX40+k="
+  "org/jetbrains/kotlin#abi-tools-api/2.3.20": {
+   "jar": "sha256-U2hfV4OwSQaDiY11Wrrk1Bi26DugYTSFiv3ctZRYmek=",
+   "pom": "sha256-qIbJ/X8rlmlFf+wCHxnc8V8EY+DbS9rVOuGBJTZsxvk="
   },
-  "org/jetbrains/kotlin#kotlin-assignment-compiler-plugin-embeddable/2.0.21": {
-   "jar": "sha256-VNSBSyF3IXiP2GU5gSMImi/P91FQ17NdjnMKI34my9E=",
-   "pom": "sha256-rIU9chaJ+vEV8RiBCjU2/CcvE1to0CdFOqpW6eY79wc="
+  "org/jetbrains/kotlin#abi-tools/2.3.20": {
+   "jar": "sha256-R9fBgRPZhYUGWrUky6HEcLTDaTB2l8qdHIEOULk9C9E=",
+   "pom": "sha256-Pi8inRHuIgaFPTAL/l0R3dzpYFqJ5cmvrwa3Ij0Zh1c="
   },
-  "org/jetbrains/kotlin#kotlin-build-common/2.0.21": {
-   "jar": "sha256-cLmHScMJc9O3YhCL37mROSB4swhzCKzTwa0zqg9GIV0=",
-   "pom": "sha256-qNP7huk2cgYkCh2+6LMBCteRP+oY+9Rtv2EB+Yvj4V0="
+  "org/jetbrains/kotlin#kotlin-assignment-compiler-plugin-embeddable/2.3.20": {
+   "jar": "sha256-EjVTkgnMVtLi7G+XeYaHiHK3Cgh4H2Sv/0Ubwfe9VrE=",
+   "pom": "sha256-m9zHQ84iL4oxnuYJe2Cq7unmvqe1vzKXYVp1tLpsFDM="
   },
-  "org/jetbrains/kotlin#kotlin-build-tools-api/2.0.21": {
-   "jar": "sha256-j8orSvbEzyRWXZp/ZMMXhIlRjQSeEGmB22cY7yLK4Y4=",
-   "pom": "sha256-zL2XaTA2Y0gWKVGY5JRFNPr7c9d4+M1NQ588h7CQ9JQ="
+  "org/jetbrains/kotlin#kotlin-build-tools-api/2.3.20": {
+   "jar": "sha256-IvGrIjhUuUkJn2slnO9UHVtYo2Q9+aScRXfGPEFuhDs=",
+   "pom": "sha256-G14LLDaQXcL1XgpLeBKuY+MSXe/PaG0sD0kPg7c9nV4="
   },
-  "org/jetbrains/kotlin#kotlin-build-tools-impl/2.0.21": {
-   "jar": "sha256-um6iTa7URxf1AwcqkcWbDafpyvAAK9DsG+dzKUwSfcs=",
-   "pom": "sha256-epPI22tqqFtPyvD0jKcBa5qEzSOWoGUreumt52eaTkE="
+  "org/jetbrains/kotlin#kotlin-build-tools-compat/2.3.20": {
+   "jar": "sha256-RMMHtO3UysUflgqBNBEtZkyTB2cAzaXoZulNmkKWNA4=",
+   "pom": "sha256-rpC+JesEdhCNlo6+Mqjd9SXhQIhYj6BUc9sSgVoPG3Q="
   },
-  "org/jetbrains/kotlin#kotlin-compiler-embeddable/2.0.21": {
-   "jar": "sha256-n6jN0d4NzP/hVMmX1CPsa19TzW2Rd+OnepsN4D+xvIE=",
-   "pom": "sha256-vUZWpG7EGCUuW8Xhwg6yAp+yqODjzJTu3frH6HyM1bY="
+  "org/jetbrains/kotlin#kotlin-build-tools-cri-impl/2.3.20": {
+   "jar": "sha256-VOztYw8oEkzP4uRk5srMKB5SiopQqJclchVUyWk1SP4=",
+   "pom": "sha256-5zeMZYHvXw4stA46TOxR0rlj5iVkWpK2fqCVJa+XxMM="
   },
-  "org/jetbrains/kotlin#kotlin-compiler-runner/2.0.21": {
-   "jar": "sha256-COYFvoEGD/YS0K65QFihm8SsmWJcNcRhxsCzAlYOkQQ=",
-   "pom": "sha256-+Wdq1JVBFLgc39CR6bW0J7xkkc+pRIRmjWU9TRkCPm0="
+  "org/jetbrains/kotlin#kotlin-build-tools-impl/2.3.20": {
+   "jar": "sha256-loG8IWSovZ9t30wIXPSoNrktJ1BmZ9c7q59thVM2yRA=",
+   "pom": "sha256-gswavl5j0/5nV+eXKE8F25r9fq3D6D0ROcOlW2TUstU="
   },
-  "org/jetbrains/kotlin#kotlin-daemon-client/2.0.21": {
-   "jar": "sha256-Nx6gjk8DaILMjgZP/PZEWZDfREKVuh7GiSjnzCtbwBU=",
-   "pom": "sha256-8oY4JGtQVSC/6TXxXz7POeS6VSb6RcjzKsfeejEjdAA="
+  "org/jetbrains/kotlin#kotlin-compiler-embeddable/2.3.20": {
+   "jar": "sha256-l2+YnQtfXYDo6KitS3PaC/wn/dllufo4Nisr557MEzc=",
+   "pom": "sha256-DDWu7jcvB1FOvtN7lAe44RgdFCd1UTnlzudxnKBf5+g="
   },
-  "org/jetbrains/kotlin#kotlin-daemon-embeddable/2.0.21": {
-   "jar": "sha256-saCnPFAi+N0FpjjGt2sr1zYYGKHzhg/yZEEzsd0r2wM=",
-   "pom": "sha256-jbZ7QN1gJaLtBpKU8sm8+2uW2zFZz+927deEHCZq+/A="
+  "org/jetbrains/kotlin#kotlin-compiler-runner/2.3.20": {
+   "jar": "sha256-wGnzCkA75wyBUviqnyXsy6GI7q1UJjrgKvFEIUN6Igg=",
+   "pom": "sha256-jYTqDt1gs4vOpWLeUXgVKiZxqaAFPWcPkxRSs9sBMig="
   },
-  "org/jetbrains/kotlin#kotlin-metadata-jvm/2.3.0": {
-   "jar": "sha256-DGQgOZHQIy2YnNXjZtYCjSexsIckCBgXi9UMJo7qtW8=",
-   "pom": "sha256-N51JdplIjLxv11nTN2QrRWLD2lI4g8NMH201PgZZvJc="
+  "org/jetbrains/kotlin#kotlin-daemon-client/2.3.20": {
+   "jar": "sha256-xxp8G+j7/wTgr0XJ7oy3ph2JU7ymuL8iWlcZxyWpC0Q=",
+   "pom": "sha256-nnyLgHJBF/cqrOZfa+SNg224/Dl1OtlR8ruQhi1+cIA="
+  },
+  "org/jetbrains/kotlin#kotlin-daemon-embeddable/2.3.20": {
+   "jar": "sha256-iHC6uEC4CHyWxN3AYIi0rt9RMcQIrzZ0MGME8flq8/Q=",
+   "pom": "sha256-YVQOWzoywLEZYkSWZZJMbNdVTqmu4IVb2OT1t/YQoKs="
+  },
+  "org/jetbrains/kotlin#kotlin-klib-abi-reader/2.3.20": {
+   "jar": "sha256-XAo6pyBAjdL2PnYIdd0/Z9t+0Ws/AAKA4IgcYHDOT2M=",
+   "pom": "sha256-ui+7W5OjnlGraeWCJPGNdxYqDrYDkIbl9lVne8O3xno="
+  },
+  "org/jetbrains/kotlin#kotlin-klib-commonizer-embeddable/2.3.20": {
+   "jar": "sha256-4FeWYwUcbaKyPZX8LDpBKnYnnbg6eQHuhqfjrPbnHjQ=",
+   "pom": "sha256-shhlfghlbEa018djdux6BOoGAJpGLTpkcBFvr92OPss="
+  },
+  "org/jetbrains/kotlin#kotlin-metadata-jvm/2.3.20": {
+   "jar": "sha256-FyZLlpD+7TSqi459VW+y55UfaABGLxFyQ/upYgEBT30=",
+   "pom": "sha256-DF/7/5dG1Ca56GasBWviiSizGKJc3FaDkIHsRJspzZc="
+  },
+  "org/jetbrains/kotlin#kotlin-metadata-jvm/2.4.0": {
+   "jar": "sha256-mq3FHFiOdsjPPYPUCQ5GpLaH8u2qH99lqp/kQiMpSSc=",
+   "pom": "sha256-chmTkfj8cneq1l3owN3xiekzupPXw21DBBuEVqPITCk="
   },
   "org/jetbrains/kotlin#kotlin-reflect/1.6.10": {
    "jar": "sha256-MnesECrheq0QpVq+x1/1aWyNEJeQOWQ0tJbnUIeFQgM=",
    "pom": "sha256-V5BVJCdKAK4CiqzMJyg/a8WSWpNKBGwcxdBsjuTW1ak="
   },
-  "org/jetbrains/kotlin#kotlin-reflect/2.0.21": {
-   "jar": "sha256-OtL8rQwJ3cCSLeurRETWEhRLe0Zbdai7dYfiDd+v15k=",
-   "pom": "sha256-Aqt66rA8aPQBAwJuXpwnc2DLw2CBilsuNrmjqdjosEk="
+  "org/jetbrains/kotlin#kotlin-reflect/2.3.20": {
+   "jar": "sha256-40b6PD/0RR9fcHoxKIf9TIVV2kjMFfqdsrqTwz+J+BM=",
+   "pom": "sha256-iwC9L+srtVON85aVQXTZ3cDsVA00ElhjA1ObHpZVwzM="
   },
-  "org/jetbrains/kotlin#kotlin-sam-with-receiver-compiler-plugin-embeddable/2.0.21": {
-   "jar": "sha256-x88d6VXfIqFihyImvQZ3yaDItmMKLi1z0R0UfNDFO3M=",
-   "pom": "sha256-cWKsEOFFTpJ2c7FcrQMp2jgvt1jmVPWfy0AHRZ2eyEE="
+  "org/jetbrains/kotlin#kotlin-sam-with-receiver-compiler-plugin-embeddable/2.3.20": {
+   "jar": "sha256-hvch6zOswK/QbdZoDnenZLY0qb2LEbc77yv8CQnxiUA=",
+   "pom": "sha256-Vg23nSOjmud5dqVmkZRw3sQazHeqUa6qVlzAKbkXGqw="
   },
-  "org/jetbrains/kotlin#kotlin-script-runtime/2.0.21": {
-   "jar": "sha256-nBEfjQit5FVWYnLVYZIa3CsstrekzO442YKcXjocpqM=",
-   "pom": "sha256-lbLpKa+hBxvZUv0Tey5+gdBP4bu4G3V+vtBrIW5aRSQ="
+  "org/jetbrains/kotlin#kotlin-script-runtime/2.3.20": {
+   "jar": "sha256-b8232m5lz4zEPlqrq5S9zEiCXnkzaG+KG/aU64j44A4=",
+   "pom": "sha256-ZgmWdnA6CB/ZrEMTlmWIPlwUUCC2QHWd4FOdiRb/JH8="
   },
-  "org/jetbrains/kotlin#kotlin-scripting-common/2.0.21": {
-   "jar": "sha256-+H3rKxTQaPmcuhghfYCvhUgcApxzGthwRFjprdnKIPg=",
-   "pom": "sha256-hP6ezqjlV+/6iFbJAhMlrWPCHZ0TEh6q6xGZ9qZYZXU="
+  "org/jetbrains/kotlin#kotlin-scripting-common/2.3.20": {
+   "jar": "sha256-tMI52HsjvhgvBb9Xz16B+V1wv370qYnrmLczicbryJ8=",
+   "pom": "sha256-h+/vFa4RjxNDUmPrEJcAZGD7qDlph340uKcvDjPIOsk="
   },
-  "org/jetbrains/kotlin#kotlin-scripting-compiler-embeddable/2.0.21": {
-   "jar": "sha256-JBPCMP3YzUfrvronPk35TPO0TLPsldLLNUcsk3aMnxw=",
-   "pom": "sha256-1Ch6fUD4+Birv3zJhH5/OSeC0Ufb7WqEQORzvE9r8ug="
+  "org/jetbrains/kotlin#kotlin-scripting-compiler-embeddable/2.3.20": {
+   "jar": "sha256-vVX49hvUHOxSllbC1HeEvLpawmDpT0FWwnLDFJZu71k=",
+   "pom": "sha256-1l8YaBd9zkuKkv+93bVrFzH5+66IyOcw7XvLcAy7soo="
   },
-  "org/jetbrains/kotlin#kotlin-scripting-compiler-impl-embeddable/2.0.21": {
-   "jar": "sha256-btD6W+slRmiDmJtWQfNoCUeSYLcBRTVQL9OHzmx7qDM=",
-   "pom": "sha256-0ysb8kupKaL6MqbjRDIPp7nnvgbON/z3bvOm3ITiNrE="
+  "org/jetbrains/kotlin#kotlin-scripting-compiler-impl-embeddable/2.3.20": {
+   "jar": "sha256-gG/WOzvOxea17rGghD1qsJTVV4aoRl5HSiQ5KVocCiU=",
+   "pom": "sha256-xKkTo4XzTjKlbyBd8XoI3U4RfDBsV+XkfcXUlSPw6+E="
   },
-  "org/jetbrains/kotlin#kotlin-scripting-jvm/2.0.21": {
-   "jar": "sha256-iEJ/D3pMR4RfoiIdKfbg4NfL5zw+34vKMLTYs6M2p3w=",
-   "pom": "sha256-opCFi++0KZc09RtT7ZqUFaKU55um/CE8BMQnzch5nA0="
+  "org/jetbrains/kotlin#kotlin-scripting-jvm/2.3.20": {
+   "jar": "sha256-cEfOA1P0kSXDx0Z5LU92wyZde3L+YmlLfuwHW7oCUow=",
+   "pom": "sha256-B8Ba4tHs4K4e1mAQ7TGNnN3LNYcEbGM8GGvRTM8EYdU="
   },
   "org/jetbrains/kotlin#kotlin-stdlib-common/1.9.10": {
    "jar": "sha256-zeM0G6GKK6JisLfPbFWyDJDo1DTkLJoT5qP3cNuWWog=",
    "pom": "sha256-fUtwVHkQZ2s738iSWojztr+yRYLJeEVCgFVEzu9JCpI="
   },
-  "org/jetbrains/kotlin#kotlin-stdlib-common/2.0.21": {
-   "module": "sha256-b134r2M2AKa5z7D8x2SvPVEZ83Zndne5G2rugWsdMKs=",
-   "pom": "sha256-X0As+413MZW5ZwUBJMnom1+EsXJGThiUkpeJv1xMLyk="
+  "org/jetbrains/kotlin#kotlin-stdlib-common/2.3.20": {
+   "module": "sha256-fV4z3nFM3ddQeGQgmMvL7pfBg5jQNLd9MrSwdLlQOTk=",
+   "pom": "sha256-/Xtj7fb31urrwWoYVgu7koszQlYepcnR92kZiw/puYg="
+  },
+  "org/jetbrains/kotlin#kotlin-stdlib-jdk7/1.8.0": {
+   "pom": "sha256-36lkSmrluJjuR1ux9X6DC6H3cK7mycFfgRKqOBGAGEo="
   },
   "org/jetbrains/kotlin#kotlin-stdlib-jdk7/1.8.21": {
    "pom": "sha256-m7EH1dXjkwvFl38AekPNILfSTZGxweUo6m7g8kjxTTY="
@@ -1194,54 +1249,57 @@
    "jar": "sha256-VemJxRK4CQd5n4VDCfO8d4LFs9E5MkQtA3nVxHJxFQQ=",
    "pom": "sha256-fin79z/fceBnnT3ufmgP1XNGT6AWRKT1irgZ0sCI09I="
   },
-  "org/jetbrains/kotlin#kotlin-stdlib/2.0.21": {
-   "jar": "sha256-8xzFPxBafkjAk2g7vVQ3Vh0SM5IFE3dLRwgFZBvtvAk=",
-   "module": "sha256-gf1tGBASSH7jJG7/TiustktYxG5bWqcpcaTd8b0VQe0=",
-   "pom": "sha256-/LraTNLp85ZYKTVw72E3UjMdtp/R2tHKuqYFSEA+F9o="
+  "org/jetbrains/kotlin#kotlin-stdlib/2.3.20": {
+   "jar": "sha256-CuElBKUEDrrzdwOQhINCDRpWJN0dk/NXZl+Md8hIoB4=",
+   "module": "sha256-9Os0T8TR46KK4WwIbsPkL1I3O0ZtQwgYL7OG45LA76M=",
+   "pom": "sha256-yDwC2afi6VRzBJHDPC8dwDwnZi4ntWbsK0TS0Bhjm5g="
   },
-  "org/jetbrains/kotlinx#kotlinx-coroutines-bom/1.6.4": {
-   "pom": "sha256-qyYUhV+6ZqqKQlFNvj1aiEMV/+HtY/WTLnEKgAYkXOE="
+  "org/jetbrains/kotlin#kotlin-tooling-core/2.3.20": {
+   "jar": "sha256-NnFCeBKZvA+RIMHe7A5ik0oa+ep/AaqpxaU1TcXY19k=",
+   "pom": "sha256-R+Ou/SS1vmLYB7bLzXnFW4P5S1XP4Y79xuM84RvxkOQ="
   },
-  "org/jetbrains/kotlinx#kotlinx-coroutines-core-jvm/1.6.4": {
-   "jar": "sha256-wkyLsnuzIMSpOHFQGn5eDGFgdjiQexl672dVE9TIIL4=",
-   "module": "sha256-DZTIpBSD58Jwfr1pPhsTV6hBUpmM6FVQ67xUykMho6c=",
-   "pom": "sha256-Cdlg+FkikDwuUuEmsX6fpQILQlxGnsYZRLPAGDVUciQ="
+  "org/jetbrains/kotlinx#kotlinx-coroutines-bom/1.8.0": {
+   "pom": "sha256-Ejnp2+E5fNWXE0KVayURvDrOe2QYQuQ3KgiNz6i5rVU="
   },
-  "org/jline#jline-native/3.30.6": {
-   "jar": "sha256-Q8NvCTRUWpVJ+zyP86+jYcMg7+HJR1ns0Js0Bkg5fIA=",
-   "pom": "sha256-yHC+cymTnXtPEBOlSMgyV6bCXGLYuQBlKyAJmvip9Q4="
+  "org/jetbrains/kotlinx#kotlinx-coroutines-core-jvm/1.8.0": {
+   "jar": "sha256-mGCQahk3SQv187BtLw4Q70UeZblbJp8i2vaKPR9QZcU=",
+   "module": "sha256-/2oi2kAECTh1HbCuIRd+dlF9vxJqdnlvVCZye/dsEig=",
+   "pom": "sha256-pWM6vVNGfOuRYi2B8umCCAh3FF4LduG3V4hxVDSIXQs="
+  },
+  "org/jline#jline-native/4.3.1": {
+   "jar": "sha256-/5SrS8zDwVSURAgs4HonYMvxrU2uBOQ1CFl72AK8sjE=",
+   "pom": "sha256-GtgjRIisZV0MN6GKQgZQz5vu6ZlIrWQLxG0ERX61qR8="
   },
   "org/jline#jline-parent/3.20.0": {
    "pom": "sha256-cXjGACAsS8Jux6S2IlXu829wVsrSpeYjnFdL7qXCEMo="
   },
+  "org/jline#jline-parent/4.3.1": {
+   "pom": "sha256-KE7hO/HegCVCPmekmMQ8nGkBU3zcY0jkyZx8sMd34Xw="
+  },
   "org/jline#jline-reader/3.20.0": {
    "jar": "sha256-rNHJTR4iiqe3li9psh7Tqf2CjrOmPkuvkIaVTmJq8fA=",
    "pom": "sha256-2fF+3XIcAqExcgN21sB4eHgutrb6/rX/QkBKtXFD4TY="
   },
-  "org/jline#jline-terminal-jansi/3.30.6": {
-   "jar": "sha256-6cGTeJwc3JxwQe+EDH9F0yo1vMy4Tn3sbErV5aNEeQI=",
-   "pom": "sha256-RtfReyoFCTCZFoCUA7uJuCJMcJ7fEMppQwXJZZHo2D0="
+  "org/jline#jline-terminal-ffm/4.3.1": {
+   "jar": "sha256-KRPOpI5erD4HY/WDgFlwGwXBnW3EHoKa7hagY2SjQNY=",
+   "pom": "sha256-xYsPdcM+DCcCXuYmdGoSEKl2U9BTfdsZUhevc+NxTX4="
   },
   "org/jline#jline-terminal/3.20.0": {
    "jar": "sha256-EhJRcOeVUZum3IAQwHC1PHaq6StIXB43Uw5Uq13QjUM=",
    "pom": "sha256-EMo7z1F48YUH8hCmOtljeJaFM0OtHBKRoBmhFvIWpUg="
   },
-  "org/jline#jline-terminal/3.30.6": {
-   "jar": "sha256-mo396KJbCpaHzxHg3UoShmXoMfFPnO2F/8KE062603Q=",
-   "pom": "sha256-Yv7vISV+WE0/bEvZIqStBnVudSYwwK8IKJzgEEKWoCo="
+  "org/jline#jline-terminal/4.3.1": {
+   "jar": "sha256-JyknNjRx/b8vOHEL77/oZqzB7TRyBiqM7QKxZobye8w=",
+   "pom": "sha256-vwkp2Y0b/BrKJZIKT2zOOy9HSzrdl5KAyOM33dc2FRw="
   },
   "org/jspecify#jspecify/1.0.0": {
    "jar": "sha256-H61ua+dVd4Hk0zcp1Jrhzcj92m/kd7sMxozjUer9+6s=",
    "module": "sha256-0wfKd6VOGKwe8artTlu+AUvS9J8p4dL4E+R8J4KDGVs=",
    "pom": "sha256-zauSmjuVIR9D0gkMXi0N/oRllg43i8MrNYQdqzJEM6Y="
   },
-  "org/junit#junit-bom/5.11.4": {
-   "module": "sha256-qaTye+lOmbnVcBYtJGqA9obSd9XTGutUgQR89R2vRuQ=",
-   "pom": "sha256-GdS3R7IEgFMltjNFUylvmGViJ3pKwcteWTpeTE9eQRU="
-  },
-  "org/junit#junit-bom/5.13.2": {
-   "module": "sha256-7WfhUiFASsQrXlmBAu33Yt1qlS3JUAHpwMTudKBOgoM=",
-   "pom": "sha256-Q7EQT7P9TvS3KpdR1B4Jwp8AHIvgD/OXIjjcFppzS0k="
+  "org/junit#junit-bom/5.13.1": {
+   "module": "sha256-M8B6uXJHkKblhZugfWkResUwQ5ckVFqBxBeeMnLHXeg=",
+   "pom": "sha256-+mhFHqgwVy7UP/5R11tqBfel5mWmAqUfSda+AgY6ZfM="
   },
   "org/junit#junit-bom/5.13.4": {
    "module": "sha256-6Vkoj94bGwUNm8CC/HhniRKNpdKFMJFGj8pQQQS99AA=",
@@ -1251,44 +1309,56 @@
    "module": "sha256-etPdstdOanfWWuiaykXUaMl7+ZFba8UvRJ1nXk5vmzU=",
    "pom": "sha256-9apHs2ZIPo0fm+8Q5noMZvZq/A8zHJ+WaxMQutYND28="
   },
+  "org/junit#junit-bom/5.14.1": {
+   "module": "sha256-J4rLEczJmYaUIkOG+W+0lBoi7bQstEbJLg8fMwFLa0g=",
+   "pom": "sha256-AbAd+jZlULQKxXYFSKfXKLYQnRfEUeg4ZNHl4M6GLJQ="
+  },
   "org/junit#junit-bom/5.14.2": {
    "module": "sha256-XSb0RAOSMm3SSDz0kBQ+6hSV1QlUWaC5ZRp7GzjiTr8=",
    "pom": "sha256-7S3MeFW9RgvMyTob8Mli5jtWb/fY8d7Q8fJZO6gYOq8="
   },
-  "org/junit/jupiter#junit-jupiter-api/5.14.2": {
-   "jar": "sha256-cEzaGFcxa7eRGZsaG/gXOwd4uTioRFyFvhFUxfiBOgo=",
-   "module": "sha256-Cw9Y0AG0zPQduv9mL/CPBGQLn1FWshXS3FfO6TaS6CY=",
-   "pom": "sha256-NXvqCt8V4DrCyOrfIEW5NCUPr4SAlAmWNZm89HXeszg="
+  "org/junit#junit-bom/5.14.3": {
+   "module": "sha256-8lxAv6Usi3tCXVdqiPMQ9kMmFtYrpYkyA/on37yfAl4=",
+   "pom": "sha256-CKAoVuSHyTV/mynjh0X4roBYSBEectFarQNSM48WMuE="
   },
-  "org/junit/jupiter#junit-jupiter-engine/5.14.2": {
-   "jar": "sha256-Ak2bBtMbkPucWnwLxiz6LUnGc6aKenW+m1JUi6YoNQk=",
-   "module": "sha256-VB9i/FQLJZxofAveUbVBhLcvlGJIpA6C5J9kVXYSsGU=",
-   "pom": "sha256-2j/YDMHhYiWQKIDDwXB/O4laEdqcYjMISgSzlcDh/QE="
+  "org/junit#junit-bom/6.0.3": {
+   "module": "sha256-KA48NIVfKhPeJBIZN+TPl+S565IG5g+JHk8KHPDnq6E=",
+   "pom": "sha256-plW2pdwA0b68kfsrFcDH6K6snWvc+HlZVQU3DidTAoc="
   },
-  "org/junit/jupiter#junit-jupiter-params/5.14.2": {
-   "jar": "sha256-BthnOrFhdBF+uup8ydwIgJ23o5T12T79JANi2IPQHfA=",
-   "module": "sha256-9VHVeJrqNQzfsYFkyp2a/1bgyYIsfG32HTF3ZL6LQA0=",
-   "pom": "sha256-CuKLm95MW9YCVeCb7vGRXAfvL5gdO49HyLSIeVGJFuY="
+  "org/junit/jupiter#junit-jupiter-api/6.0.3": {
+   "jar": "sha256-1lXX5vDHrgfxCi87uq67bTDpsmIEoGitnps5UKooeSw=",
+   "module": "sha256-6k1/evmsFrsuF34miQeJb6PG+a5QcmBNRoLXrv/inKg=",
+   "pom": "sha256-dmyA+zGOFgDr9smpId6AGIexVIqigtataRiLdgjVbUc="
   },
-  "org/junit/jupiter#junit-jupiter/5.14.2": {
-   "jar": "sha256-7gTJsMUyE2pLxKhTH+VKIsY3uTppC8BkcYNXWE0eca4=",
-   "module": "sha256-yjO7T4OBTaS6iffR9w0zNieo/Pab5G2cf9973XACpr8=",
-   "pom": "sha256-6IK8iSW+9JsonGrn/GcKd0zmT3eer9dHuKo9ioqGfjo="
+  "org/junit/jupiter#junit-jupiter-engine/6.0.3": {
+   "jar": "sha256-Hi+rYa0n6gj8fHDdlnfPjG0a5UNNQtz91jOxLH58BNA=",
+   "module": "sha256-03TlhvHApdyh+00ZNJ4KgEqRc7lh+EHijPxYgeLmUV0=",
+   "pom": "sha256-uvvAmTJsGIPw7hywVtMbQiLiYWX5+aqbiW89P3ijFTg="
   },
-  "org/junit/platform#junit-platform-commons/1.14.2": {
-   "jar": "sha256-kRf5qtxmOsVQrl6B2NOrnx4Juy40wW5goesWM6F7zAY=",
-   "module": "sha256-LIpzAEQQ2y0nkUEBq+hnLcackhHD0ziuNHHZSisratI=",
-   "pom": "sha256-b6pnFLuLb4V7Gz7Tthz5EOv9rZPyWDJ506T9RWVa+cU="
+  "org/junit/jupiter#junit-jupiter-params/6.0.3": {
+   "jar": "sha256-zylH4jArn4yKBZJZoneIHBytro+8JRTBapJc/re+suU=",
+   "module": "sha256-1LBksP8UD1Vd0GdEscxr//wQ9SSbLdWqRprl9NTv7Cg=",
+   "pom": "sha256-mVtk7KoiJ8S1Xz6453c19URDSi7Cz+7QYF6LrxCCY94="
   },
-  "org/junit/platform#junit-platform-engine/1.14.2": {
-   "jar": "sha256-WkXEMHY6JsbFVHHhktivu2RDlWvBFrfmeWuNeJpaFG0=",
-   "module": "sha256-rJRHEJU5b12sFYUmoSVj/dUEkq57Km9JH62ixRsHS+s=",
-   "pom": "sha256-k2qlp7HfWDlzoyJ/y9uV6nTjHhvrGOqGmS7JBlPwqGo="
+  "org/junit/jupiter#junit-jupiter/6.0.3": {
+   "jar": "sha256-eEtlgV9HmgyZqdOlc7FC4qUl77YCXZf3UbGecvkK7aM=",
+   "module": "sha256-gaZM8ir7jnaHVSE+nIDr06sDMc5ACm/WOeQ6VJWtj+A=",
+   "pom": "sha256-vO0g6RqqVnfxupb6b3GBAKuD6JSlLplhtgBMBWoYRew="
   },
-  "org/junit/platform#junit-platform-launcher/1.14.2": {
-   "jar": "sha256-HfxXdiDdEx6Ddl9mKsqhCaLfV1KgOZ8DTIaKyHMyOvI=",
-   "module": "sha256-TlbYQ96bbUO3CC/Ux0IHDSp9+rUZL7oaKQCYDwa+MTk=",
-   "pom": "sha256-BFn8NaM0Pr/qeOt5MvpB7OdtgyQ3A1MAsEjnpC6A5wk="
+  "org/junit/platform#junit-platform-commons/6.0.3": {
+   "jar": "sha256-OfJi0Jw9UnGf4Ld/CA6Qo2leKF13mkGyMuF5Y65dogA=",
+   "module": "sha256-nfLma22VBAClGKmt00M9CjBxzhwzpvgPnPIlYtUpRbc=",
+   "pom": "sha256-vbjiS+l+Dll2nyFktTYfVSJ5WN9BA9aGgvh3mtLKjX0="
+  },
+  "org/junit/platform#junit-platform-engine/6.0.3": {
+   "jar": "sha256-SR6eT3RfFhuKjkGGoafGpFDqEscJMMmu2uQnIVMB2Uc=",
+   "module": "sha256-U1qGeP2rxB2/DEHMW3Vh7xINdWUMPcOTAqfWCTdmE5M=",
+   "pom": "sha256-eofYxqCn2wJgsAzjAxgPb0HQQFYoldaARhnV227iMr4="
+  },
+  "org/junit/platform#junit-platform-launcher/6.0.3": {
+   "jar": "sha256-MVYINy5NxEvKDMs66KB+zCBrM2cDP6BXSKA8zVY/EwE=",
+   "module": "sha256-glZnrWqEsMW6dTdSvpqZ4wFL/lKRQ7xmtGdNkbA/pbg=",
+   "pom": "sha256-TTngPyCTd29BkwccjN8ZgTa5YWbHtDteN+fWFWudmO0="
   },
   "org/lanternpowered#lmbda/2.0.0": {
    "jar": "sha256-v7mL90YQgkvVbhDYJSM6Zg66M7qRXPlHJGJX9QPadfM=",
@@ -1297,9 +1367,12 @@
   "org/mockito#mockito-bom/4.11.0": {
    "pom": "sha256-2FMadGyYj39o7V8YjN6pRQBq6pk+xd+eUk4NJ9YUkdo="
   },
-  "org/mockito#mockito-core/5.21.0": {
-   "jar": "sha256-A9sj3nQsvKQqo9YSf9rOVg+sN7A22TGHCAH4TCiL0oY=",
-   "pom": "sha256-AiGzH5bfAaFYxkU3Gq2BstP1vuD1icoNDC6qbo2gkvM="
+  "org/mockito#mockito-bom/5.20.0": {
+   "pom": "sha256-YmvA9584nSxBVD0W2NnbC1OtCEjMN6bgtM53Gk/gvEk="
+  },
+  "org/mockito#mockito-core/5.22.0": {
+   "jar": "sha256-GKIGNowsj9aT52LzdD42WswgjDKxp18m7qqa87CSYcc=",
+   "pom": "sha256-gnO7dguz2m8eaEqnCDGOnJxdJDNUFRMeY5JOVB8+jTA="
   },
   "org/objenesis#objenesis-parent/3.3": {
    "pom": "sha256-MFw4SqLx4cf+U6ltpBw+w1JDuX1CjSSo93mBjMEL5P8="
@@ -1340,23 +1413,26 @@
    "jar": "sha256-k4otCP5UBQ12ELlE2N3DoJNVcQ2ea+CqyDjbwE6aKCU=",
    "pom": "sha256-tsqj6301vXVu1usKKoGGi408D29CJE/q5BdgrGYwbYc="
   },
-  "org/slf4j#slf4j-api/1.7.36": {
-   "jar": "sha256-0+9XXj5JeWeNwBvx3M5RAhSTtNEft/G+itmCh3wWocA=",
-   "pom": "sha256-+wRqnCKUN5KLsRwtJ8i113PriiXmDL0lPZhSEN7cJoQ="
-  },
   "org/slf4j#slf4j-api/2.0.17": {
    "jar": "sha256-e3UdlSBhlU1av+1xgcH2RdM2CRtnmJFZHWMynGIuuDI=",
    "pom": "sha256-FQxAKH987NwhuTgMqsmOkoxPM8Aj22s0jfHFrJdwJr8="
   },
+  "org/slf4j#slf4j-api/2.0.18": {
+   "jar": "sha256-RFCP0VdlAGiMeQsZCs3Rb+xPjHmj4LkAr9cFA88FX1U=",
+   "pom": "sha256-bCx/LAJ3TMK3thn70t94c82tKXGJJuRHVLh/cNHrQ8s="
+  },
   "org/slf4j#slf4j-bom/2.0.17": {
    "pom": "sha256-940ntkK0uIbrg5/BArXNn+fzDzdZn/5oGFvk4WCQMek="
   },
-  "org/slf4j#slf4j-parent/1.7.36": {
-   "pom": "sha256-uziNN/vN083mTDzt4hg4aTIY3EUfBAQMXfNgp47X6BI="
+  "org/slf4j#slf4j-bom/2.0.18": {
+   "pom": "sha256-khmqtgFXUSbE5m4TMesrDGwXozCsTVoH480R1YCgwS0="
   },
   "org/slf4j#slf4j-parent/2.0.17": {
    "pom": "sha256-lc1x6FLf2ykSbli3uTnVfsKy5gJDkYUuC1Rd7ggrvzs="
   },
+  "org/slf4j#slf4j-parent/2.0.18": {
+   "pom": "sha256-CziWvtrSye2Wl+3L6h2gxUzSOKcjWDqBNYqDv7eC6fo="
+  },
   "org/sonatype/oss#oss-parent/5": {
    "pom": "sha256-FnjUEgpYXYpjATGu7ExSTZKDmFg7fqthbufVqH9SDT0="
   },
@@ -1414,9 +1490,9 @@
    "jar": "sha256-IRswbPxE+Plt86Cj3a91uoxSie7XfWDXL4ibuFX1NeU=",
    "pom": "sha256-CTvhsDMxvOKTLWglw36YJy12Ieap6fuTKJoAJRi43Vo="
   },
-  "org/vafer#jdependency/2.14": {
-   "jar": "sha256-HT3hIYOiqJada8b/Wtdx3l1W0ISXxdk+FopctxDiy/E=",
-   "pom": "sha256-yGRf/88P5qu8IVS8i/0Jysbgd2M4Kz6cGLXbmR7IFjk="
+  "org/vafer#jdependency/2.16": {
+   "jar": "sha256-hpgdL1CrFe6+GpD4Q6GV8o8L0e5SJV12pz7AtLfsec0=",
+   "pom": "sha256-+jUpmw0MRzE9cDZKddILmsOoh0Q8Yyx+z1C6ffiHG+U="
   },
   "org/xmlresolver#xmlresolver/5.1.1": {
    "jar": "sha256-MSL4rkDERq27MDzVUldoA/2/bq77hL985D0TNlsnymg=",
diff --git a/pkgs/by-name/ve/velocity/package.nix b/pkgs/by-name/ve/velocity/package.nix
index eeb87546ce27..60aa3a037998 100644
--- a/pkgs/by-name/ve/velocity/package.nix
+++ b/pkgs/by-name/ve/velocity/package.nix
@@ -2,13 +2,12 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  gradle,
-  jdk17,
-  jdk21,
+  gradle_9,
+  jdk25,
   makeBinaryWrapper,
   openssl,
   libdeflate,
-  jre_headless,
+  jdk25_headless,
   writeScript,
   nixosTests,
 
@@ -19,7 +18,6 @@
   ],
 }:
 let
-  gradle_jdk17 = gradle.override { javaToolchains = [ jdk17 ]; };
   velocityNativePlatform =
     {
       x86_64-linux = "linux_x86_64";
@@ -34,17 +32,17 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "velocity";
-  version = "3.5.0-unstable-2026-07-10";
+  version = "4.1.0-unstable-2026-08-03";
 
   src = fetchFromGitHub {
     owner = "PaperMC";
     repo = "Velocity";
-    rev = "97b386d86ff99f787117cb30e8a4b50c83dba6c2";
-    hash = "sha256-EzoR12YsXP0F7n1ifk/Eg16S//pmYnRpSiO7qkerBes=";
+    rev = "00759e52790e85e148efc08adb7e7dd29e6c5110";
+    hash = "sha256-D9r4OyVfeLNzbEklUdWJ7vEqRsZ9ja5AanqeerdFJck=";
   };
 
   nativeBuildInputs = [
-    gradle_jdk17
+    gradle_9
     makeBinaryWrapper
   ];
 
@@ -54,16 +52,22 @@ stdenv.mkDerivation (finalAttrs: {
     libdeflate
 
     # needed for building velocity-native jni
-    jdk21
+    jdk25
   ];
 
   strictDeps = true;
 
-  mitmCache = gradle_jdk17.fetchDeps {
+  mitmCache = gradle_9.fetchDeps {
     inherit (finalAttrs) pname;
     data = ./deps.json;
   };
 
+  gradleUpdateScript = ''
+    runHook preBuild
+
+    gradle --write-verification-metadata sha256
+  '';
+
   patches = [
     ./fix-version.patch # remove build-time dependency on git and use version string from a env var instead
     ./disable-javadocs.patch # disable building java docs because they cause build failures
@@ -97,7 +101,7 @@ stdenv.mkDerivation (finalAttrs: {
     mkdir -p $out/bin $out/share/velocity
     cp proxy/build/libs/velocity-proxy-${builtins.head (builtins.split "-" finalAttrs.version)}-SNAPSHOT-all.jar $out/share/velocity/velocity.jar
 
-    makeWrapper ${lib.getExe jre_headless} "$out/bin/velocity" \
+    makeWrapper ${lib.getExe jdk25_headless} "$out/bin/velocity" \
       --append-flags "-jar $out/share/velocity/velocity.jar"
 
     ${lib.optionalString withVelocityNative ''
diff --git a/pkgs/by-name/ve/ventoy/000-nixos-sanitization.patch b/pkgs/by-name/ve/ventoy/000-nixos-sanitization.patch
index a7a9f99fa871..e547e36f1d4d 100644
--- a/pkgs/by-name/ve/ventoy/000-nixos-sanitization.patch
+++ b/pkgs/by-name/ve/ventoy/000-nixos-sanitization.patch
@@ -161,10 +161,10 @@ diff --color -Naur ventoy-1.1.12-old/tool/VentoyWorker.sh ventoy-1.1.12-new/tool
  
      check_umount_disk "$DISK"
      
-diff --color -Naur ventoy-1.1.12-old/Ventoy2Disk.sh ventoy-1.1.12-new/Ventoy2Disk.sh
---- ventoy-1.1.12-old/Ventoy2Disk.sh	2026-04-24 18:49:51.366082120 +0100
-+++ ventoy-1.1.12-new/Ventoy2Disk.sh	2026-04-24 20:19:55.219025537 +0100
-@@ -32,66 +32,4 @@
+diff --color -Naur ventoy-1.1.17-old/Ventoy2Disk.sh ventoy-1.1.17-new/Ventoy2Disk.sh
+--- ventoy-1.1.17-old/Ventoy2Disk.sh	2026-08-13 01:33:02.176591073 +0300
++++ ventoy-1.1.17-new/Ventoy2Disk.sh	2026-08-13 01:33:02.179127365 +0300
+@@ -30,59 +30,4 @@
  echo '**********************************************'
  echo ''
  
@@ -224,13 +224,6 @@ diff --color -Naur ventoy-1.1.12-old/Ventoy2Disk.sh ventoy-1.1.12-new/Ventoy2Dis
 -else
 -    ash ./tool/VentoyWorker.sh $*
 -fi
--
--if [ -n "$OLDDIR" ]; then 
--    CURDIR=$(pwd)
--    if [ "$CURDIR" != "$OLDDIR" ]; then
--        cd "$OLDDIR"
--    fi
--fi
 +./tool/VentoyWorker.sh $*
 diff --color -Naur ventoy-1.1.12-old/VentoyPlugson.sh ventoy-1.1.12-new/VentoyPlugson.sh
 --- ventoy-1.1.12-old/VentoyPlugson.sh	2026-04-24 18:49:51.367031295 +0100
diff --git a/pkgs/by-name/ve/ventoy/package.nix b/pkgs/by-name/ve/ventoy/package.nix
index 902530ecadc5..1858b232bf70 100644
--- a/pkgs/by-name/ve/ventoy/package.nix
+++ b/pkgs/by-name/ve/ventoy/package.nix
@@ -59,11 +59,11 @@ stdenv.mkDerivation (finalAttrs: {
     "ventoy"
     + optionalString (defaultGuiType == "gtk3") "-gtk3"
     + optionalString (defaultGuiType == "qt5") "-qt5";
-  version = "1.1.12";
+  version = "1.1.17";
 
   src = fetchurl {
     url = "https://github.com/ventoy/Ventoy/releases/download/v${finalAttrs.version}/ventoy-${finalAttrs.version}-linux.tar.gz";
-    hash = "sha256-BGILVGvMXu61lxdnWVs3E+495xWAqCRJBTxTp8sy/Nk=";
+    hash = "sha256-f7TtCM72prTTndGSYNjIApGnjf35r31GFXHiPLvEOAU=";
   };
 
   patches = [
diff --git a/pkgs/by-name/vi/virter/package.nix b/pkgs/by-name/vi/virter/package.nix
index 84e25a1cf210..c076d0967271 100644
--- a/pkgs/by-name/vi/virter/package.nix
+++ b/pkgs/by-name/vi/virter/package.nix
@@ -11,16 +11,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "virter";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "LINBIT";
     repo = "virter";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Kjk/kLDWwFDgr+PnwBNgsZEP/C4YS8/i1l1lTndpS8Q=";
+    hash = "sha256-N8IJGhjnCbUqtZvQ5Et9a3JvG3RctXM9mVM6hBZroE0=";
   };
 
-  vendorHash = "sha256-h/4yQmSPoeAm0p7bYv7xQVk316zl7PB1IcRQlOEDHVQ=";
+  vendorHash = "sha256-XOMxe+pG4OB15l+TKuYR2tJPPcPbsnipxHlnDH0XukA=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/vi/virtnbdbackup/package.nix b/pkgs/by-name/vi/virtnbdbackup/package.nix
index 29a0180f68fe..12c0812f918e 100644
--- a/pkgs/by-name/vi/virtnbdbackup/package.nix
+++ b/pkgs/by-name/vi/virtnbdbackup/package.nix
@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "virtnbdbackup";
-  version = "2.48";
+  version = "2.49";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "abbbi";
     repo = "virtnbdbackup";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qbuTyu3j9775s0VmL+RJLEVYAd2vNqjhETJc2idZ45M=";
+    hash = "sha256-Z6lHU28pqO3Xf9470mVInJdv0hh/sgNPnMIt57WFbFk=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/wa/walls/package.nix b/pkgs/by-name/wa/walls/package.nix
new file mode 100644
index 000000000000..7f04c515a09b
--- /dev/null
+++ b/pkgs/by-name/wa/walls/package.nix
@@ -0,0 +1,87 @@
+{
+  lib,
+  stdenv,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  xdg-terminal-exec,
+  gtk3,
+  gdk-pixbuf,
+  cairo,
+  pango,
+  glib,
+  atk,
+  libappindicator,
+  libdbusmenu-gtk3,
+  nix-update-script,
+  writableTmpDirAsHomeHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "walls";
+  version = "0.13.4";
+
+  src = fetchFromGitHub {
+    owner = "willfish";
+    repo = "walls";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-6c4NdXGPsDFqlLLMH2BL0MpoQpZiLxJnWMzWKN1bO84=";
+  };
+
+  __structuredAttrs = true;
+
+  cargoHash = "sha256-WZK3QkeBqDkH/5m9mqhyJQDKZoA6LfEuFbMRImJN4oQ=";
+
+  cargoBuildFlags = [
+    "-p"
+    "walls"
+    "-p"
+    "walls-tray"
+  ];
+
+  nativeBuildInputs = [ pkg-config ];
+
+  nativeCheckInputs = [ writableTmpDirAsHomeHook ];
+
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    gtk3
+    gdk-pixbuf
+    cairo
+    pango
+    glib
+    atk
+    libappindicator
+    libdbusmenu-gtk3
+  ];
+
+  # PTY integration test is unreliable in the Nix build sandbox.
+  cargoTestFlags = [
+    "--workspace"
+    "--"
+    "--skip"
+    "tui_with_pty_exits_cleanly_on_quit"
+  ];
+
+  postInstall = lib.optionalString stdenv.hostPlatform.isLinux ''
+    mkdir -p $out/share/icons/hicolor/scalable/apps $out/share/applications
+    cp assets/icons/walls-tray.svg $out/share/icons/hicolor/scalable/apps/walls.svg
+    substitute assets/applications/walls.desktop.in $out/share/applications/walls.desktop \
+      --replace-fail '@walls@' "$out/bin/walls" \
+      --replace-fail '@xdg-terminal-exec@' "${lib.getExe xdg-terminal-exec}"
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Wallpaper manager with Wallhaven sources, CLI/TUI, and tray";
+    homepage = "https://github.com/willfish/walls";
+    changelog = "https://github.com/willfish/walls/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ willfish ];
+    mainProgram = "walls";
+    # Upstream CI builds the flake package on x86_64/aarch64 Linux and Darwin
+    # (tray GTK deps are Linux-only; Darwin still produces walls + walls-tray).
+    # x86_64-darwin is dropped in nixpkgs 26.11; platforms.darwin is aarch64-only there.
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+  };
+})
diff --git a/pkgs/by-name/wa/wangle/glog-0.7.patch b/pkgs/by-name/wa/wangle/glog-0.7.patch
deleted file mode 100644
index c80c13d8f78f..000000000000
--- a/pkgs/by-name/wa/wangle/glog-0.7.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-diff --git a/wangle/CMakeLists.txt b/wangle/CMakeLists.txt
-index 041e73c2b1..2804ad72cf 100644
---- a/wangle/CMakeLists.txt
-+++ b/wangle/CMakeLists.txt
-@@ -66,7 +66,7 @@
- find_package(fizz CONFIG REQUIRED)
- find_package(fmt CONFIG REQUIRED)
- find_package(OpenSSL REQUIRED)
--find_package(Glog REQUIRED)
-+find_package(Glog CONFIG REQUIRED)
- find_package(gflags CONFIG QUIET)
- if (gflags_FOUND)
-   message(STATUS "Found gflags from package config")
-@@ -162,7 +162,6 @@
-     ${FOLLY_INCLUDE_DIR}
-     ${Boost_INCLUDE_DIRS}
-     ${OPENSSL_INCLUDE_DIR}
--    ${GLOG_INCLUDE_DIRS}
-     ${GFLAGS_INCLUDE_DIRS}
-     ${LIBEVENT_INCLUDE_DIR}
-     ${DOUBLE_CONVERSION_INCLUDE_DIR}
-@@ -172,7 +171,7 @@
-   ${FIZZ_LIBRARIES}
-   ${Boost_LIBRARIES}
-   ${OPENSSL_LIBRARIES}
--  ${GLOG_LIBRARIES}
-+  glog::glog
-   ${GFLAGS_LIBRARIES}
-   ${LIBEVENT_LIB}
-   ${DOUBLE_CONVERSION_LIBRARY}
diff --git a/pkgs/by-name/wa/wangle/package.nix b/pkgs/by-name/wa/wangle/package.nix
index 1e24c31536b7..0312fbb9a0c1 100644
--- a/pkgs/by-name/wa/wangle/package.nix
+++ b/pkgs/by-name/wa/wangle/package.nix
@@ -24,7 +24,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wangle";
-  version = "2026.01.19.00";
+  version = "2026.07.27.00";
 
   outputs = [
     "out"
@@ -35,13 +35,9 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "facebook";
     repo = "wangle";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tGq6jbBPotuBK1PuRRGvdNb208glzlt7dehjIY+4nvk=";
+    hash = "sha256-BGl1LGaYRmYdG4h98HhAT7X4tXEMjlzh27nGLCY/B1c=";
   };
 
-  patches = [
-    ./glog-0.7.patch
-  ];
-
   nativeBuildInputs = [
     cmake
     ninja
diff --git a/pkgs/by-name/wa/waon/package.nix b/pkgs/by-name/wa/waon/package.nix
deleted file mode 100644
index cc637ee384c0..000000000000
--- a/pkgs/by-name/wa/waon/package.nix
+++ /dev/null
@@ -1,46 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fftw,
-  gtk2,
-  libao,
-  libsamplerate,
-  libsndfile,
-  ncurses,
-  pkg-config,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "waon";
-  version = "0.11";
-
-  src = fetchFromGitHub {
-    owner = "kichiki";
-    repo = "waon";
-    rev = "v${finalAttrs.version}";
-    sha256 = "1xmq8d2rj58xbp4rnyav95y1vnz3r9s9db7xxfa2rd0ilq0ps4y7";
-  };
-
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [
-    fftw
-    gtk2
-    libao
-    libsamplerate
-    libsndfile
-    ncurses
-  ];
-
-  installPhase = ''
-    install -Dt $out/bin waon pv gwaon
-  '';
-
-  meta = {
-    description = "Wave-to-Notes transcriber";
-    homepage = "https://kichiki.github.io/WaoN/";
-    license = lib.licenses.gpl2;
-    maintainers = [ lib.maintainers.puckipedia ];
-    platforms = lib.platforms.all;
-  };
-})
diff --git a/pkgs/by-name/wa/wasm-tools/package.nix b/pkgs/by-name/wa/wasm-tools/package.nix
index 481342d49c05..e237032abfc5 100644
--- a/pkgs/by-name/wa/wasm-tools/package.nix
+++ b/pkgs/by-name/wa/wasm-tools/package.nix
@@ -8,20 +8,20 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wasm-tools";
-  version = "1.254.0";
+  version = "1.255.0";
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = "wasm-tools";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Zy+cJdbsRmwRyy9y/nfpi3kWmklKOrgrw78DwQ/s+fs=";
+    hash = "sha256-QQ9lSQLPaLSNumGtr64W9n56vBXh5m9Z/dge/tbl3gU=";
     fetchSubmodules = true;
   };
 
   # Disable cargo-auditable until https://github.com/rust-secure-code/cargo-auditable/issues/124 is solved.
   auditable = false;
 
-  cargoHash = "sha256-RgAew00flGTwt1FvfWsmPgg/MK4CMFVG2h5dmDgCZMo=";
+  cargoHash = "sha256-ozxSdq5CpSLwEWsombAvZCrv4wDL0PLqoVIoTBqyUL4=";
   cargoBuildFlags = [
     "--package"
     "wasm-tools"
diff --git a/pkgs/by-name/wa/watchman/Cargo.lock b/pkgs/by-name/wa/watchman/Cargo.lock
index 4bd8d68bd690..9b8890ee5b10 100644
--- a/pkgs/by-name/wa/watchman/Cargo.lock
+++ b/pkgs/by-name/wa/watchman/Cargo.lock
@@ -16,48 +16,72 @@ dependencies = [
 ]
 
 [[package]]
-name = "ansi_term"
-version = "0.12.1"
+name = "anstream"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d52a9bb7ec0cf484c551830a7ce27bd20d67eac647e1befb56b0be4ee39a55d2"
+checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
 dependencies = [
- "winapi",
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
+
+[[package]]
+name = "anstyle-parse"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
+dependencies = [
+ "anstyle",
+ "once_cell_polyfill",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "anyhow"
-version = "1.0.100"
+version = "1.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a23eb6b1614318a8071c9b2521f36b424b2c83db5eb3a0fead4a6c0809af6e61"
-
-[[package]]
-name = "atty"
-version = "0.2.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
-dependencies = [
- "hermit-abi",
- "libc",
- "winapi",
-]
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
 
 [[package]]
 name = "autocfg"
-version = "1.5.0"
+version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 
 [[package]]
 name = "bitflags"
-version = "1.3.2"
+version = "2.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
-
-[[package]]
-name = "bitflags"
-version = "2.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "812e12b5285cc515a9c72a5c1d3b6d46a19dac5acfef5265968c166106e31dd3"
+checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
 
 [[package]]
 name = "byteorder"
@@ -67,9 +91,9 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "bytes"
-version = "1.11.0"
+version = "1.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b35204fbdc0b3f4446b89fc1ac2cf84a8a68971995d0bf2e925ec7cd960f9cb3"
+checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
 dependencies = [
  "serde",
 ]
@@ -82,25 +106,59 @@ checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
 [[package]]
 name = "cfg_aliases"
-version = "0.2.1"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
+checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
 
 [[package]]
 name = "clap"
-version = "2.34.0"
+version = "4.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a0610544180c38b88101fecf2dd634b174a62eef6946f84dfc6a7127512b381c"
+checksum = "d91e0c145792ef73a6ad36d27c75ac09f1832222a3c209689d90f534685ee5b7"
 dependencies = [
- "ansi_term",
- "atty",
- "bitflags 1.3.2",
- "strsim",
- "textwrap",
- "unicode-width",
- "vec_map",
+ "clap_builder",
+ "clap_derive",
 ]
 
+[[package]]
+name = "clap_builder"
+version = "4.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f09628afdcc538b57f3c6341e9c8e9970f18e4a481690a64974d7023bd33548b"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "clap_lex",
+ "strsim",
+ "terminal_size",
+ "unicase",
+ "unicode-width 0.2.2",
+]
+
+[[package]]
+name = "clap_derive"
+version = "4.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d012d2b9d65aca7f18f4d9878a045bc17899bba951561ba5ec3c2ba1eed9a061"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "clap_lex"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
+
+[[package]]
+name = "colorchoice"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
+
 [[package]]
 name = "crossbeam"
 version = "0.8.4"
@@ -116,18 +174,18 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-channel"
-version = "0.5.15"
+version = "0.5.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82b8f8f868b36967f9606790d1903570de9ceaf870a7bf9fbbd3016d636a2cb2"
+checksum = "d85363c37faeca707aef026efa9f3b34d077bce547e48f770770625c6013679e"
 dependencies = [
  "crossbeam-utils",
 ]
 
 [[package]]
 name = "crossbeam-deque"
-version = "0.8.6"
+version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9dd111b7b7f7d55b72c0a6ae361660ee5853c9af73f70c3c2ef6858b950e2e51"
+checksum = "5181e0de7b61eb03a81e347d6dd8797bae9da5146707b51077e2d71a54ec0ceb"
 dependencies = [
  "crossbeam-epoch",
  "crossbeam-utils",
@@ -135,27 +193,27 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.18"
+version = "0.9.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
 dependencies = [
  "crossbeam-utils",
 ]
 
 [[package]]
 name = "crossbeam-queue"
-version = "0.3.12"
+version = "0.3.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f58bbc28f91df819d0aa2a2c00cd19754769c2fad90579b3592b1c9ba7a3115"
+checksum = "803d13fb3b09d88be9f4dbc29062c66b19bf7170867ceb746d2a8689bf6c7a26"
 dependencies = [
  "crossbeam-utils",
 ]
 
 [[package]]
 name = "crossbeam-utils"
-version = "0.8.21"
+version = "0.8.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
+checksum = "61803da095bee82a81bb1a452ecc25d3b2f1416d1897eb86430c6159ef717c17"
 
 [[package]]
 name = "duct"
@@ -171,9 +229,9 @@ dependencies = [
 
 [[package]]
 name = "either"
-version = "1.15.0"
+version = "1.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
+checksum = "9e5e8f6c15a24b9a3ee5efec809ccd006d3b30e8b3bb63c39af737c7f87daa1d"
 
 [[package]]
 name = "errno"
@@ -193,9 +251,9 @@ checksum = "3a471a38ef8ed83cd6e40aa59c1ffe17db6855c18e3604d9c4ed8c08ebc28678"
 
 [[package]]
 name = "futures"
-version = "0.3.31"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65bc07b1a8bc7c85c5f2e110c476c7389b4554ba72af57d8445ea63a576b0876"
+checksum = "a88cf1f829d945f548cf8fec32c61b1f202b6d93b45848602fc02af4b12ad218"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -208,9 +266,9 @@ dependencies = [
 
 [[package]]
 name = "futures-channel"
-version = "0.3.31"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dff15bf788c671c1934e366d07e30c1814a8ef514e1af724a602e8a2fbe1b10"
+checksum = "262590f4fe6afeb0bc83be1daa64e52657fe185690a958af7f3ad0e92085c5ae"
 dependencies = [
  "futures-core",
  "futures-sink",
@@ -218,15 +276,15 @@ dependencies = [
 
 [[package]]
 name = "futures-core"
-version = "0.3.31"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05f29059c0c2090612e8d742178b0580d2dc940c837851ad723096f87af6663e"
+checksum = "2cd50c473c80f6d7c3670a752354b8e569b1a7cbfdc0419ec88e5edad85e0dc7"
 
 [[package]]
 name = "futures-executor"
-version = "0.3.31"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e28d1d997f585e54aebc3f97d39e72338912123a67330d723fdbb564d646c9f"
+checksum = "6754879cc9f2c66f88c6e5c35344bb0bdb0708b0352b1201815667c7eabc7458"
 dependencies = [
  "futures-core",
  "futures-task",
@@ -235,38 +293,38 @@ dependencies = [
 
 [[package]]
 name = "futures-io"
-version = "0.3.31"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e5c1b78ca4aae1ac06c48a526a655760685149f0d465d21f37abfe57ce075c6"
+checksum = "4577ecaa3c4f96589d473f679a71b596316f6641bc350038b962a5daf0085d7a"
 
 [[package]]
 name = "futures-macro"
-version = "0.3.31"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "162ee34ebcb7c64a8abebc059ce0fee27c2262618d7b60ed8faf72fef13c3650"
+checksum = "2d6d3cde68c518367be28956066ddfef33813991b77a55005a69dae04bf3b10b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn 2.0.119",
 ]
 
 [[package]]
 name = "futures-sink"
-version = "0.3.31"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e575fab7d1e0dcb8d0c7bcf9a63ee213816ab51902e6d244a95819acacf1d4f7"
+checksum = "e34418ac499d6305c2fb5ad0ed2f6ac998c5f8ca209b4510f7f94242c647e307"
 
 [[package]]
 name = "futures-task"
-version = "0.3.31"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f90f7dce0722e95104fcb095585910c0977252f286e354b5e3bd38902cd99988"
+checksum = "b231ed28831efb4a61a08580c4bc233ec56bc009f4cd8f52da2c3cb97df0c109"
 
 [[package]]
 name = "futures-util"
-version = "0.3.31"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fa08315bb612088cc391249efdc3bc77536f16c91f6cf495e6fbe85b20a4a81"
+checksum = "a77a90a256fce34da66415271e30f94ee91c57b04b8a2c042d9cf3220179deaa"
 dependencies = [
  "futures 0.1.31",
  "futures-channel",
@@ -275,9 +333,9 @@ dependencies = [
  "futures-macro",
  "futures-sink",
  "futures-task",
+ "libc",
  "memchr",
  "pin-project-lite",
- "pin-utils",
  "slab",
 ]
 
@@ -301,27 +359,21 @@ checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
 
 [[package]]
 name = "heck"
-version = "0.3.3"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d621efb26863f0e9924c6ac577e8275e5e6b77455db64ffa6c65c904e9e132c"
-dependencies = [
- "unicode-segmentation",
-]
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 
 [[package]]
-name = "hermit-abi"
-version = "0.1.19"
+name = "is_terminal_polyfill"
+version = "1.70.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
-dependencies = [
- "libc",
-]
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
 
 [[package]]
 name = "itoa"
-version = "1.0.17"
+version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92ecc6618181def0457392ccd0ee51198e065e016d1d527a7ac1b6dc7c1f09d2"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
 [[package]]
 name = "jwalk"
@@ -334,16 +386,16 @@ dependencies = [
 ]
 
 [[package]]
-name = "lazy_static"
-version = "1.5.0"
+name = "libc"
+version = "0.2.189"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
 
 [[package]]
-name = "libc"
-version = "0.2.180"
+name = "linux-raw-sys"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bcc35a38544a891a5f7c865aca548a982ccb3b8650a5b06d0fd33a10283c56fc"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
 
 [[package]]
 name = "lock_api"
@@ -362,9 +414,9 @@ checksum = "3e2e65a1a2e43cfcb47a895c4c8b10d1f4a61097f9f254f183aee60cad9c651d"
 
 [[package]]
 name = "memchr"
-version = "2.7.6"
+version = "2.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f52b00d39961fc5b2736ea853c9cc86238e165017a493d1d5c8eac6bdc4cc273"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
 
 [[package]]
 name = "memoffset"
@@ -377,9 +429,9 @@ dependencies = [
 
 [[package]]
 name = "mio"
-version = "1.1.1"
+version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a69bcab0ad47271a0234d9422b131806bf3968021e5dc9328caf2d4cd58557fc"
+checksum = "30d65c71f1ce40ab09135ce117d742b9f8a19ff91a41a8b57ed50bc2de59c427"
 dependencies = [
  "libc",
  "wasi",
@@ -392,7 +444,7 @@ version = "0.30.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "74523f3a35e05aba87a1d978330aef40f67b0304ac79c1c00b294c9830543db6"
 dependencies = [
- "bitflags 2.10.0",
+ "bitflags",
  "cfg-if",
  "cfg_aliases",
  "libc",
@@ -401,9 +453,9 @@ dependencies = [
 
 [[package]]
 name = "ntapi"
-version = "0.4.2"
+version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c70f219e21142367c70c0b30c6a9e3a14d55b4d12a204d897fbec83a0363f081"
+checksum = "c3b335231dfd352ffb0f8017f3b6027a4917f7df785ea2143d8af2adc66980ae"
 dependencies = [
  "winapi",
 ]
@@ -414,7 +466,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2a180dd8642fa45cdb7dd721cd4c11b1cadd4929ce112ebd8b9f5803cc79d536"
 dependencies = [
- "bitflags 2.10.0",
+ "bitflags",
 ]
 
 [[package]]
@@ -429,9 +481,15 @@ dependencies = [
 
 [[package]]
 name = "once_cell"
-version = "1.21.3"
+version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "once_cell_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
 
 [[package]]
 name = "os_pipe"
@@ -468,54 +526,24 @@ dependencies = [
 
 [[package]]
 name = "pin-project-lite"
-version = "0.2.16"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b"
-
-[[package]]
-name = "pin-utils"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
-
-[[package]]
-name = "proc-macro-error"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da25490ff9892aab3fcf7c36f08cfb902dd3e71ca0f9f9517bea02a73a5ce38c"
-dependencies = [
- "proc-macro-error-attr",
- "proc-macro2",
- "quote",
- "syn 1.0.109",
- "version_check",
-]
-
-[[package]]
-name = "proc-macro-error-attr"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1be40180e52ecc98ad80b184934baf3d0d29f979574e439af5a55274b35f869"
-dependencies = [
- "proc-macro2",
- "quote",
- "version_check",
-]
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.105"
+version = "1.0.107"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "535d180e0ecab6268a3e718bb9fd44db66bbbc256257165fc699dadf70d16fe7"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "quote"
-version = "1.0.43"
+version = "1.0.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc74d9a594b72ae6656596548f56f667211f8a97b3d4c3d467150794690dc40a"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
 dependencies = [
  "proc-macro2",
 ]
@@ -528,9 +556,9 @@ checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
 
 [[package]]
 name = "rayon"
-version = "1.11.0"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "368f01d005bf8fd9b1206fb6fa653e6c4a81ceb1466406b81792d87c5677a58f"
+checksum = "fb39b166781f92d482534ef4b4b1b2568f42613b53e5b6c160e24cfbfa30926d"
 dependencies = [
  "either",
  "rayon-core",
@@ -552,7 +580,20 @@ version = "0.5.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
 dependencies = [
- "bitflags 2.10.0",
+ "bitflags",
+]
+
+[[package]]
+name = "rustix"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+dependencies = [
+ "bitflags",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -563,9 +604,9 @@ checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
 name = "serde"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
 dependencies = [
  "serde_core",
  "serde_derive",
@@ -595,29 +636,29 @@ dependencies = [
 
 [[package]]
 name = "serde_core"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn 3.0.3",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.149"
+version = "1.0.151"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86"
+checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
 dependencies = [
  "itoa",
  "memchr",
@@ -670,61 +711,37 @@ dependencies = [
 
 [[package]]
 name = "slab"
-version = "0.4.11"
+version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a2ae44ef20feb57a68b23d846850f861394c2e02dc425a50098ae8c90267589"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
 
 [[package]]
 name = "smallvec"
-version = "1.15.1"
+version = "1.15.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
+checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
 
 [[package]]
 name = "socket2"
-version = "0.6.1"
+version = "0.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17129e116933cf371d018bb80ae557e889637989d8638274fb25622827b03881"
+checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
 dependencies = [
  "libc",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "strsim"
-version = "0.8.0"
+version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ea5119cdb4c55b55d432abb513a0429384878c15dde60cc77b1c99de1a95a6a"
-
-[[package]]
-name = "structopt"
-version = "0.3.26"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c6b5c64445ba8094a6ab0c3cd2ad323e07171012d9c98b0b15651daf1787a10"
-dependencies = [
- "clap",
- "lazy_static",
- "structopt-derive",
-]
-
-[[package]]
-name = "structopt-derive"
-version = "0.4.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dcb5ae327f9cc13b68763b5749770cb9e048a99bd9dfdfa58d0cf05d5f64afe0"
-dependencies = [
- "heck",
- "proc-macro-error",
- "proc-macro2",
- "quote",
- "syn 1.0.109",
-]
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
 
 [[package]]
 name = "syn"
-version = "1.0.109"
+version = "2.0.119"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -733,9 +750,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.114"
+version = "3.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4d107df263a3013ef9b1879b0df87d706ff80f65a86ea879bd9c31f9b307c2a"
+checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -762,43 +779,44 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d9a2882c514780a1973df90de9d68adcd8871bacc9a6331c3f28e6d2ff91a3d1"
 dependencies = [
- "unicode-width",
+ "unicode-width 0.1.14",
 ]
 
 [[package]]
-name = "textwrap"
-version = "0.11.0"
+name = "terminal_size"
+version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d326610f408c7a4eb6f51c37c330e496b08506c9457c9d34287ecc38809fb060"
+checksum = "230a1b821ccbd75b185820a1f1ff7b14d21da1e442e22c0863ea5f08771a8874"
 dependencies = [
- "unicode-width",
+ "rustix",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "thiserror"
-version = "2.0.18"
+version = "2.0.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
+checksum = "09a43598840e33d5b0331f38c5e30d13bb11c11210a4b58f0d9b18a5a5eefcd9"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "2.0.18"
+version = "2.0.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
+checksum = "43cbfe0cf76104d42a574802844187e84a305e531ed54455f11fbde0f10541cd"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn 3.0.3",
 ]
 
 [[package]]
 name = "tokio"
-version = "1.49.0"
+version = "1.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72a2903cd7736441aac9df9d7688bd0ce48edccaadf181c3b90be801e81d3d86"
+checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
 dependencies = [
  "bytes",
  "libc",
@@ -814,20 +832,20 @@ dependencies = [
 
 [[package]]
 name = "tokio-macros"
-version = "2.6.0"
+version = "2.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af407857209536a95c8e56f8231ef2c2e2aff839b22e07a1ffcbc617e9db9fa5"
+checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn 3.0.3",
 ]
 
 [[package]]
 name = "tokio-util"
-version = "0.7.18"
+version = "0.7.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ae9cec805b01e8fc3fd2fe289f89149a9b66dd16786abd8b19cfa7b48cb0098"
+checksum = "494815d09bf52b5548659851081238f0ca39ff638363907596da739561c62c52"
 dependencies = [
  "bytes",
  "futures-core",
@@ -835,6 +853,7 @@ dependencies = [
  "futures-sink",
  "futures-util",
  "hashbrown",
+ "libc",
  "pin-project-lite",
  "slab",
  "tokio",
@@ -860,16 +879,16 @@ dependencies = [
 ]
 
 [[package]]
-name = "unicode-ident"
-version = "1.0.22"
+name = "unicase"
+version = "2.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9312f7c4f6ff9069b165498234ce8be658059c6728633667c526e27dc2cf1df5"
+checksum = "dbc4bc3a9f746d862c45cb89d705aa10f187bb96c76001afab07a0d35ce60142"
 
 [[package]]
-name = "unicode-segmentation"
-version = "1.12.0"
+name = "unicode-ident"
+version = "1.0.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6ccf251212114b54433ec949fd6a7841275f9ada20dddd2f29e9ceea4501493"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
 
 [[package]]
 name = "unicode-width"
@@ -878,10 +897,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7dd6e30e90baa6f72411720665d41d89b9a3d039dc45b8faea1ddd07f617f6af"
 
 [[package]]
-name = "vec_map"
-version = "0.8.2"
+name = "unicode-width"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1bddf1187be692e79c5ffeab891132dfb0f236ed36a43c7ed39f1165ee20191"
+checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
+
+[[package]]
+name = "utf8parse"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "version_check"
@@ -897,9 +922,9 @@ checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
 [[package]]
 name = "wasip2"
-version = "1.0.2+wasi-0.2.9"
+version = "1.0.4+wasi-0.2.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9517f9239f02c069db75e65f174b3da828fe5f5b945c4dd26bd25d89c03ebcf5"
+checksum = "b67efb37e106e55ce722a510d6b5f9c17f083e5fc79afc2badeb12cc313d9487"
 dependencies = [
  "wit-bindgen",
 ]
@@ -910,7 +935,7 @@ version = "0.9.0"
 dependencies = [
  "anyhow",
  "bytes",
- "futures 0.3.31",
+ "futures 0.3.33",
  "maplit",
  "serde",
  "serde_bser",
@@ -926,12 +951,12 @@ version = "0.1.0"
 dependencies = [
  "ahash",
  "anyhow",
+ "clap",
  "duct",
  "jwalk",
  "nix",
  "serde",
  "serde_json",
- "structopt",
  "sysinfo",
  "tabular",
  "tokio",
@@ -1014,7 +1039,7 @@ checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -1025,7 +1050,7 @@ checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -1162,32 +1187,32 @@ checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
 
 [[package]]
 name = "wit-bindgen"
-version = "0.51.0"
+version = "0.57.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
 
 [[package]]
 name = "zerocopy"
-version = "0.8.33"
+version = "0.8.55"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "668f5168d10b9ee831de31933dc111a459c97ec93225beb307aed970d1372dfd"
+checksum = "b5a105cd7b140f6eeec8acff2ea38135d3cab283ada58540f629fe51e46696eb"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.33"
+version = "0.8.55"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c7962b26b0a8685668b671ee4b54d007a67d4eaf05fda79ac0ecf41e32270f1"
+checksum = "0fe976fb70c78cd64cccfe3a6fc142244e8a77b70959b30faf9d0ac37ee228eb"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn 2.0.119",
 ]
 
 [[package]]
 name = "zmij"
-version = "1.0.15"
+version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94f63c051f4fe3c1509da62131a678643c5b6fbdc9273b2b79d4378ebda003d2"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
diff --git a/pkgs/by-name/wa/watchman/fmt-12.2.0-format-header.patch b/pkgs/by-name/wa/watchman/fmt-12.2.0-format-header.patch
new file mode 100644
index 000000000000..1f7e6dda7220
--- /dev/null
+++ b/pkgs/by-name/wa/watchman/fmt-12.2.0-format-header.patch
@@ -0,0 +1,611 @@
+From 2235635249f63e127963b0c8d66b8da20d57363a Mon Sep 17 00:00:00 2001
+From: Daeho Ro <40587651+daeho-ro@users.noreply.github.com>
+Date: Wed, 5 Aug 2026 23:25:44 +0900
+Subject: [PATCH] Include <fmt/format.h> for fmt::format instead of
+ <fmt/core.h>
+
+---
+ watchman/ChildProcess.cpp                 | 2 +-
+ watchman/Client.h                         | 2 +-
+ watchman/ContentHash.cpp                  | 2 +-
+ watchman/CookieSync.cpp                   | 2 +-
+ watchman/Errors.h                         | 2 +-
+ watchman/InMemoryView.cpp                 | 2 +-
+ watchman/LRUCache.h                       | 2 +-
+ watchman/Logging.cpp                      | 2 +-
+ watchman/Options.cpp                      | 2 +-
+ watchman/PathUtils.cpp                    | 2 +-
+ watchman/Poison.cpp                       | 2 +-
+ watchman/ProcessLock.cpp                  | 2 +-
+ watchman/SanityCheck.cpp                  | 2 +-
+ watchman/SignalHandler.cpp                | 2 +-
+ watchman/UserDir.cpp                      | 2 +-
+ watchman/benchmarks/bser.cpp              | 2 +-
+ watchman/bser.h                           | 2 +-
+ watchman/cmds/heapprof.cpp                | 2 +-
+ watchman/cppclient/WatchmanClient.cpp     | 2 +-
+ watchman/cppclient/WatchmanConnection.cpp | 2 +-
+ watchman/fs/FileSystem.cpp                | 2 +-
+ watchman/fs/ParallelWalk.cpp              | 2 +-
+ watchman/fs/UnixDirHandle.cpp             | 2 +-
+ watchman/main.cpp                         | 2 +-
+ watchman/query/GlobTree.cpp               | 2 +-
+ watchman/query/TermRegistry.cpp           | 2 +-
+ watchman/query/intcompare.cpp             | 2 +-
+ watchman/query/parse.cpp                  | 2 +-
+ watchman/query/pcre.cpp                   | 2 +-
+ watchman/query/type.cpp                   | 2 +-
+ watchman/root/init.cpp                    | 2 +-
+ watchman/root/resolve.cpp                 | 2 +-
+ watchman/root/watchlist.cpp               | 2 +-
+ watchman/scm/Git.cpp                      | 2 +-
+ watchman/scm/Mercurial.cpp                | 2 +-
+ watchman/test/ArtTest.cpp                 | 2 +-
+ watchman/test/BserTest.cpp                | 2 +-
+ watchman/thirdparty/jansson/load.cpp      | 2 +-
+ watchman/thirdparty/jansson/value.cpp     | 2 +-
+ watchman/watcher/WatcherRegistry.cpp      | 2 +-
+ watchman/watcher/eden.cpp                 | 2 +-
+ watchman/watchman_string.h                | 2 +-
+ watchman/winbuild/susres.cpp              | 2 +-
+ 43 files changed, 43 insertions(+), 43 deletions(-)
+
+diff --git a/watchman/ChildProcess.cpp b/watchman/ChildProcess.cpp
+index abfb15993529..8ace18c98703 100644
+--- a/watchman/ChildProcess.cpp
++++ b/watchman/ChildProcess.cpp
+@@ -6,7 +6,7 @@
+  */
+ 
+ #include "watchman/ChildProcess.h"
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <folly/ScopeGuard.h>
+ #include <folly/String.h>
+ #include <memory>
+diff --git a/watchman/Client.h b/watchman/Client.h
+index c3f3b9273d64..e5e3f16a3626 100644
+--- a/watchman/Client.h
++++ b/watchman/Client.h
+@@ -7,7 +7,7 @@
+ 
+ #pragma once
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ 
+ #include <chrono>
+ #include <deque>
+diff --git a/watchman/ContentHash.cpp b/watchman/ContentHash.cpp
+index cdecf02ff67b..3fa84487ac96 100644
+--- a/watchman/ContentHash.cpp
++++ b/watchman/ContentHash.cpp
+@@ -6,7 +6,7 @@
+  */
+ 
+ #include "watchman/ContentHash.h"
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <folly/ScopeGuard.h>
+ #include <string>
+ #include "watchman/Hash.h"
+diff --git a/watchman/CookieSync.cpp b/watchman/CookieSync.cpp
+index 99dcc2692c5b..3e619db9ff5f 100644
+--- a/watchman/CookieSync.cpp
++++ b/watchman/CookieSync.cpp
+@@ -6,7 +6,7 @@
+  */
+ 
+ #include "watchman/CookieSync.h"
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <folly/String.h>
+ #include <exception>
+ #include <optional>
+diff --git a/watchman/Errors.h b/watchman/Errors.h
+index 072628fed1c2..aef90104b84c 100644
+--- a/watchman/Errors.h
++++ b/watchman/Errors.h
+@@ -7,7 +7,7 @@
+ 
+ #pragma once
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <cstdint>
+ #include <string>
+ #include <system_error>
+diff --git a/watchman/InMemoryView.cpp b/watchman/InMemoryView.cpp
+index 38ea8baa828f..ee2fc79c1a27 100644
+--- a/watchman/InMemoryView.cpp
++++ b/watchman/InMemoryView.cpp
+@@ -6,7 +6,7 @@
+  */
+ 
+ #include "watchman/InMemoryView.h"
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <folly/ScopeGuard.h>
+ #include <algorithm>
+ #include <chrono>
+diff --git a/watchman/LRUCache.h b/watchman/LRUCache.h
+index 89aa9beb8298..e6dcba1cc293 100644
+--- a/watchman/LRUCache.h
++++ b/watchman/LRUCache.h
+@@ -6,7 +6,7 @@
+  */
+ 
+ #pragma once
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <folly/Synchronized.h>
+ #include <folly/futures/Future.h>
+ #include <chrono>
+diff --git a/watchman/Logging.cpp b/watchman/Logging.cpp
+index 7ad66d3723f5..11c56affa73a 100644
+--- a/watchman/Logging.cpp
++++ b/watchman/Logging.cpp
+@@ -15,7 +15,7 @@
+ 
+ #include "watchman/portability/Backtrace.h"
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <array>
+ #include <limits>
+ #include <optional>
+diff --git a/watchman/Options.cpp b/watchman/Options.cpp
+index 4cae973f92e9..0b8cf659c47a 100644
+--- a/watchman/Options.cpp
++++ b/watchman/Options.cpp
+@@ -6,7 +6,7 @@
+  */
+ 
+ #include "watchman/Options.h"
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <string.h>
+ #include "watchman/CommandRegistry.h"
+ #include "watchman/LogConfig.h"
+diff --git a/watchman/PathUtils.cpp b/watchman/PathUtils.cpp
+index 9712e2e13ba4..fb03b5f6084e 100644
+--- a/watchman/PathUtils.cpp
++++ b/watchman/PathUtils.cpp
+@@ -7,7 +7,7 @@
+ 
+ #include "watchman/PathUtils.h"
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <folly/Exception.h>
+ #include <folly/String.h>
+ #include <folly/portability/Fcntl.h>
+diff --git a/watchman/Poison.cpp b/watchman/Poison.cpp
+index 65741d5ea321..ee307d7ac2ae 100644
+--- a/watchman/Poison.cpp
++++ b/watchman/Poison.cpp
+@@ -5,7 +5,7 @@
+  * LICENSE file in the root directory of this source tree.
+  */
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include "watchman/Logging.h"
+ #include "watchman/WatchmanConfig.h"
+ 
+diff --git a/watchman/ProcessLock.cpp b/watchman/ProcessLock.cpp
+index 5cb3ef0ffbc8..960be71530db 100644
+--- a/watchman/ProcessLock.cpp
++++ b/watchman/ProcessLock.cpp
+@@ -7,7 +7,7 @@
+ 
+ #include "ProcessLock.h"
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <folly/String.h>
+ 
+ #include "watchman/Logging.h"
+diff --git a/watchman/SanityCheck.cpp b/watchman/SanityCheck.cpp
+index f0e430afd3ae..a4ee1eef57dc 100644
+--- a/watchman/SanityCheck.cpp
++++ b/watchman/SanityCheck.cpp
+@@ -5,7 +5,7 @@
+  * LICENSE file in the root directory of this source tree.
+  */
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <folly/String.h>
+ 
+ #include "watchman/Connect.h"
+diff --git a/watchman/SignalHandler.cpp b/watchman/SignalHandler.cpp
+index 8606b9c4dd85..c2bd56d50a72 100644
+--- a/watchman/SignalHandler.cpp
++++ b/watchman/SignalHandler.cpp
+@@ -5,7 +5,7 @@
+  * LICENSE file in the root directory of this source tree.
+  */
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include "watchman/Logging.h"
+ #include "watchman/Shutdown.h"
+ 
+diff --git a/watchman/UserDir.cpp b/watchman/UserDir.cpp
+index 50e1c481914b..1e374cf84ab4 100644
+--- a/watchman/UserDir.cpp
++++ b/watchman/UserDir.cpp
+@@ -7,7 +7,7 @@
+ 
+ #include "watchman/UserDir.h"
+ #include <eden/common/utils/StringConv.h>
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <folly/String.h>
+ #include <folly/portability/Unistd.h>
+ #include "watchman/Logging.h"
+diff --git a/watchman/benchmarks/bser.cpp b/watchman/benchmarks/bser.cpp
+index 8c48e6b62a00..2133f3da134c 100644
+--- a/watchman/benchmarks/bser.cpp
++++ b/watchman/benchmarks/bser.cpp
+@@ -7,7 +7,7 @@
+ 
+ #include "watchman/bser.h"
+ #include <benchmark/benchmark.h>
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <random>
+ #include <vector>
+ 
+diff --git a/watchman/bser.h b/watchman/bser.h
+index 92a3a3328b84..49e719fb31a2 100644
+--- a/watchman/bser.h
++++ b/watchman/bser.h
+@@ -7,7 +7,7 @@
+ 
+ #pragma once
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include "watchman/thirdparty/jansson/jansson.h"
+ 
+ typedef struct bser_ctx {
+diff --git a/watchman/cmds/heapprof.cpp b/watchman/cmds/heapprof.cpp
+index d30c9dcfc4fb..fa0334f939c1 100644
+--- a/watchman/cmds/heapprof.cpp
++++ b/watchman/cmds/heapprof.cpp
+@@ -5,7 +5,7 @@
+  * LICENSE file in the root directory of this source tree.
+  */
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <folly/String.h>
+ #include <folly/memory/Malloc.h>
+ #include "watchman/Client.h"
+diff --git a/watchman/cppclient/WatchmanClient.cpp b/watchman/cppclient/WatchmanClient.cpp
+index 5331149c42ac..d4fc4536a5db 100644
+--- a/watchman/cppclient/WatchmanClient.cpp
++++ b/watchman/cppclient/WatchmanClient.cpp
+@@ -7,7 +7,7 @@
+ 
+ #include "WatchmanClient.h"
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <glog/logging.h>
+ 
+ #include <utility>
+diff --git a/watchman/cppclient/WatchmanConnection.cpp b/watchman/cppclient/WatchmanConnection.cpp
+index c041baa41d53..fa6aba15d627 100644
+--- a/watchman/cppclient/WatchmanConnection.cpp
++++ b/watchman/cppclient/WatchmanConnection.cpp
+@@ -9,7 +9,7 @@
+ 
+ #include <cstdlib>
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ 
+ #include <folly/ExceptionWrapper.h>
+ #include <folly/SocketAddress.h>
+diff --git a/watchman/fs/FileSystem.cpp b/watchman/fs/FileSystem.cpp
+index 7cc159a6bd1c..85fc2c0f6fa1 100644
+--- a/watchman/fs/FileSystem.cpp
++++ b/watchman/fs/FileSystem.cpp
+@@ -6,7 +6,7 @@
+  */
+ 
+ #include "watchman/fs/FileSystem.h"
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <folly/String.h>
+ #include <system_error>
+ #include "watchman/fs/FSDetect.h"
+diff --git a/watchman/fs/ParallelWalk.cpp b/watchman/fs/ParallelWalk.cpp
+index 5a063dbca390..36ecea6826af 100644
+--- a/watchman/fs/ParallelWalk.cpp
++++ b/watchman/fs/ParallelWalk.cpp
+@@ -6,7 +6,7 @@
+  */
+ 
+ #include "watchman/fs/ParallelWalk.h"
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <folly/concurrency/UnboundedQueue.h>
+ #include <folly/executors/CPUThreadPoolExecutor.h>
+ #include <folly/system/HardwareConcurrency.h>
+diff --git a/watchman/fs/UnixDirHandle.cpp b/watchman/fs/UnixDirHandle.cpp
+index 6b644e5fb241..1198182112db 100644
+--- a/watchman/fs/UnixDirHandle.cpp
++++ b/watchman/fs/UnixDirHandle.cpp
+@@ -7,7 +7,7 @@
+ 
+ #include "watchman/fs/DirHandle.h"
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <folly/String.h>
+ #include <system_error>
+ #include "watchman/Logging.h"
+diff --git a/watchman/main.cpp b/watchman/main.cpp
+index 9511b916b024..4382297b1b21 100644
+--- a/watchman/main.cpp
++++ b/watchman/main.cpp
+@@ -5,7 +5,7 @@
+  * LICENSE file in the root directory of this source tree.
+  */
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <folly/Exception.h>
+ #include <folly/ScopeGuard.h>
+ #include <folly/Singleton.h>
+diff --git a/watchman/query/GlobTree.cpp b/watchman/query/GlobTree.cpp
+index c771db5225fd..568ee7cec5ef 100644
+--- a/watchman/query/GlobTree.cpp
++++ b/watchman/query/GlobTree.cpp
+@@ -7,7 +7,7 @@
+ 
+ #include "watchman/query/GlobTree.h"
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <folly/Range.h>
+ 
+ namespace watchman {
+diff --git a/watchman/query/TermRegistry.cpp b/watchman/query/TermRegistry.cpp
+index 4efe2c5b46a0..f2cc1abd9eb4 100644
+--- a/watchman/query/TermRegistry.cpp
++++ b/watchman/query/TermRegistry.cpp
+@@ -6,7 +6,7 @@
+  */
+ 
+ #include "watchman/query/TermRegistry.h"
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include "watchman/CommandRegistry.h"
+ #include "watchman/Errors.h"
+ #include "watchman/query/QueryExpr.h"
+diff --git a/watchman/query/intcompare.cpp b/watchman/query/intcompare.cpp
+index 4b13bb9d3c16..3f308456b718 100644
+--- a/watchman/query/intcompare.cpp
++++ b/watchman/query/intcompare.cpp
+@@ -6,7 +6,7 @@
+  */
+ 
+ #include "watchman/query/intcompare.h"
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include "watchman/Errors.h"
+ #include "watchman/query/FileResult.h"
+ #include "watchman/query/QueryExpr.h"
+diff --git a/watchman/query/parse.cpp b/watchman/query/parse.cpp
+index 90fe43245364..772c1c85e7be 100644
+--- a/watchman/query/parse.cpp
++++ b/watchman/query/parse.cpp
+@@ -5,7 +5,7 @@
+  * LICENSE file in the root directory of this source tree.
+  */
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ 
+ #include "watchman/CommandRegistry.h"
+ #include "watchman/Errors.h"
+diff --git a/watchman/query/pcre.cpp b/watchman/query/pcre.cpp
+index 0b7abebf397f..34b68700aab3 100644
+--- a/watchman/query/pcre.cpp
++++ b/watchman/query/pcre.cpp
+@@ -5,7 +5,7 @@
+  * LICENSE file in the root directory of this source tree.
+  */
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <memory>
+ #include "watchman/Errors.h"
+ #include "watchman/fs/FileSystem.h"
+diff --git a/watchman/query/type.cpp b/watchman/query/type.cpp
+index cf87e9f7d601..6a303a684d3b 100644
+--- a/watchman/query/type.cpp
++++ b/watchman/query/type.cpp
+@@ -5,7 +5,7 @@
+  * LICENSE file in the root directory of this source tree.
+  */
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include "watchman/Errors.h"
+ #include "watchman/fs/FileInformation.h"
+ #include "watchman/query/FileResult.h"
+diff --git a/watchman/root/init.cpp b/watchman/root/init.cpp
+index d8d8f14660b0..979c2f13b9b6 100644
+--- a/watchman/root/init.cpp
++++ b/watchman/root/init.cpp
+@@ -5,7 +5,7 @@
+  * LICENSE file in the root directory of this source tree.
+  */
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <folly/String.h>
+ #include "watchman/Logging.h"
+ #include "watchman/QueryableView.h"
+diff --git a/watchman/root/resolve.cpp b/watchman/root/resolve.cpp
+index 667de1303b73..3fe5ddc69df3 100644
+--- a/watchman/root/resolve.cpp
++++ b/watchman/root/resolve.cpp
+@@ -5,7 +5,7 @@
+  * LICENSE file in the root directory of this source tree.
+  */
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <folly/String.h>
+ #include <system_error>
+ #include "watchman/Errors.h"
+diff --git a/watchman/root/watchlist.cpp b/watchman/root/watchlist.cpp
+index ec36b16c64bb..67b3e41e6456 100644
+--- a/watchman/root/watchlist.cpp
++++ b/watchman/root/watchlist.cpp
+@@ -6,7 +6,7 @@
+  */
+ 
+ #include "watchman/root/watchlist.h"
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <folly/Synchronized.h>
+ #include <vector>
+ #include "watchman/QueryableView.h"
+diff --git a/watchman/scm/Git.cpp b/watchman/scm/Git.cpp
+index c92a5a42cd09..39b45c728bee 100644
+--- a/watchman/scm/Git.cpp
++++ b/watchman/scm/Git.cpp
+@@ -6,7 +6,7 @@
+  */
+ 
+ #include "watchman/scm/Git.h"
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <folly/String.h>
+ #include <folly/portability/SysTime.h>
+ #include "watchman/ChildProcess.h"
+diff --git a/watchman/scm/Mercurial.cpp b/watchman/scm/Mercurial.cpp
+index bdb586e73f9b..0952506c4160 100644
+--- a/watchman/scm/Mercurial.cpp
++++ b/watchman/scm/Mercurial.cpp
+@@ -6,7 +6,7 @@
+  */
+ 
+ #include "Mercurial.h"
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <folly/String.h>
+ #include <folly/portability/SysTime.h>
+ #include <chrono>
+diff --git a/watchman/test/ArtTest.cpp b/watchman/test/ArtTest.cpp
+index a1f86034e9c4..05c4d249e6a0 100644
+--- a/watchman/test/ArtTest.cpp
++++ b/watchman/test/ArtTest.cpp
+@@ -5,7 +5,7 @@
+  * LICENSE file in the root directory of this source tree.
+  */
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <folly/logging/xlog.h>
+ #include <folly/portability/GTest.h>
+ #include <stdio.h>
+diff --git a/watchman/test/BserTest.cpp b/watchman/test/BserTest.cpp
+index 119b4849b5dc..9fb5b2f66883 100644
+--- a/watchman/test/BserTest.cpp
++++ b/watchman/test/BserTest.cpp
+@@ -6,7 +6,7 @@
+  */
+ 
+ #include "watchman/bser.h"
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <folly/ScopeGuard.h>
+ #include <folly/logging/xlog.h>
+ #include <folly/portability/GTest.h>
+diff --git a/watchman/thirdparty/jansson/load.cpp b/watchman/thirdparty/jansson/load.cpp
+index 888588cab88d..c2f29b309b19 100644
+--- a/watchman/thirdparty/jansson/load.cpp
++++ b/watchman/thirdparty/jansson/load.cpp
+@@ -20,7 +20,7 @@
+ 
+ #include <system_error>
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <folly/String.h>
+ 
+ 
+diff --git a/watchman/thirdparty/jansson/value.cpp b/watchman/thirdparty/jansson/value.cpp
+index 5c241421f650..1ac20171210b 100644
+--- a/watchman/thirdparty/jansson/value.cpp
++++ b/watchman/thirdparty/jansson/value.cpp
+@@ -13,7 +13,7 @@
+ 
+ #include <algorithm>
+ #include <cmath>
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <string>
+ #include <sstream>
+ 
+diff --git a/watchman/watcher/WatcherRegistry.cpp b/watchman/watcher/WatcherRegistry.cpp
+index bf7fcaf8e06a..2384842f50ce 100644
+--- a/watchman/watcher/WatcherRegistry.cpp
++++ b/watchman/watcher/WatcherRegistry.cpp
+@@ -5,7 +5,7 @@
+  * LICENSE file in the root directory of this source tree.
+  */
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ 
+ #include "watchman/watcher/WatcherRegistry.h"
+ 
+diff --git a/watchman/watcher/eden.cpp b/watchman/watcher/eden.cpp
+index 66bd8f98cf2f..836c88d9f240 100644
+--- a/watchman/watcher/eden.cpp
++++ b/watchman/watcher/eden.cpp
+@@ -6,7 +6,7 @@
+  */
+ 
+ #include <cpptoml.h>
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <folly/ScopeGuard.h>
+ #include <folly/String.h>
+ #include <folly/futures/Future.h>
+diff --git a/watchman/watchman_string.h b/watchman/watchman_string.h
+index 0a653f39eed5..5f03973a90d5 100644
+--- a/watchman/watchman_string.h
++++ b/watchman/watchman_string.h
+@@ -9,7 +9,7 @@
+ 
+ #include "watchman/watchman_system.h"
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <folly/FBString.h>
+ 
+ #include <stdint.h>
+diff --git a/watchman/winbuild/susres.cpp b/watchman/winbuild/susres.cpp
+index cc686912c10a..fd9306a24976 100644
+--- a/watchman/winbuild/susres.cpp
++++ b/watchman/winbuild/susres.cpp
+@@ -6,7 +6,7 @@
+  */
+ 
+ #include <errno.h>
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <windows.h>
diff --git a/pkgs/by-name/wa/watchman/glog-0.7.patch b/pkgs/by-name/wa/watchman/glog-0.7.patch
deleted file mode 100644
index 30eaa67b424e..000000000000
--- a/pkgs/by-name/wa/watchman/glog-0.7.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index dd6eec3320..ee74ab0008 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -333,7 +333,7 @@
- find_package(Gflags REQUIRED)
- include_directories(SYSTEM ${GFLAGS_INCLUDE_DIR})
- 
--find_package(Glog REQUIRED)
-+find_package(Glog CONFIG REQUIRED)
- add_compile_definitions(GLOG_NO_ABBREVIATED_SEVERITIES)
- 
- # We indirectly depend on boost.  This logic needs to match
-@@ -479,7 +479,6 @@
- )
- target_include_directories(third_party_deps INTERFACE
-   ${FOLLY_INCLUDE_DIR}
--  ${GLOG_INCLUDE_DIR}
-   ${GFLAGS_INCLUDE_DIR}
-   ${Boost_INCLUDE_DIRS}
- )
diff --git a/pkgs/by-name/wa/watchman/package.nix b/pkgs/by-name/wa/watchman/package.nix
index af8badd634dd..33670c689823 100644
--- a/pkgs/by-name/wa/watchman/package.nix
+++ b/pkgs/by-name/wa/watchman/package.nix
@@ -30,19 +30,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "watchman";
-  version = "2026.01.19.00";
+  version = "2026.07.27.00";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "watchman";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Eh7IHYEavgVd2p+r1PzQrAdqPD5FlYiTp4TCon55byE=";
+    hash = "sha256-cfx0hRsWDq6NTr8QvnLt/LsZ4Ja8d3lejUSgzsockp4=";
   };
 
-  patches = [
-    ./glog-0.7.patch
-  ];
-
   nativeBuildInputs = [
     cmake
     ninja
@@ -90,6 +86,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   doCheck = true;
 
+  # fmt v12.2.0 changed the definition of its fmt/core.h header to no longer
+  # include fmt/format.h, so we must pull that one in instead. vendored from
+  # https://github.com/facebook/watchman/pull/1348 with a small modification to
+  # the surrounding context in watchman/watcher/eden.cpp to avoid the changes
+  # in 542ccb794647fe7bdeb59db8f54cd434db42bd30.
+  patches = [ ./fmt-12.2.0-format-header.patch ];
+
   postPatch = ''
     patchShebangs .
 
diff --git a/pkgs/by-name/wa/waypipe/package.nix b/pkgs/by-name/wa/waypipe/package.nix
index eacc5b6cbdc4..708042321bf3 100644
--- a/pkgs/by-name/wa/waypipe/package.nix
+++ b/pkgs/by-name/wa/waypipe/package.nix
@@ -9,7 +9,7 @@
   libgbm,
   lz4,
   zstd,
-  ffmpeg,
+  ffmpeg_8,
   cargo,
   rustc,
   vulkan-headers,
@@ -59,14 +59,15 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
     libgbm
     lz4
     zstd
-    ffmpeg
+    # FFmpeg 9 dropped AVVulkanDeviceContext fixed-queue fields that waypipe 0.11.0 still uses.
+    ffmpeg_8
     vulkan-headers
     vulkan-loader
   ];
 
   runtimeDependencies = [
     libgbm
-    ffmpeg.lib
+    ffmpeg_8.lib
     vulkan-loader
   ];
 
diff --git a/pkgs/by-name/wd/wdiff/package.nix b/pkgs/by-name/wd/wdiff/package.nix
index 42780f91dc81..edbe0208e31c 100644
--- a/pkgs/by-name/wd/wdiff/package.nix
+++ b/pkgs/by-name/wd/wdiff/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wdiff";
-  version = "1.2.2";
+  version = "1.2.3";
 
   src = fetchurl {
     url = "mirror://gnu/wdiff/wdiff-${finalAttrs.version}.tar.gz";
-    sha256 = "0sxgg0ms5lhi4aqqvz1rj4s77yi9wymfm3l3gbjfd1qchy66kzrl";
+    sha256 = "sha256-KaRFfrDtNckC5nMtcfJeHWx/5/oO2g+2w3HtZ3m0n9Y=";
   };
 
   # for makeinfo
diff --git a/pkgs/by-name/wd/wdt/package.nix b/pkgs/by-name/wd/wdt/package.nix
index 1b09cd9fbf12..06221d6d2f0b 100644
--- a/pkgs/by-name/wd/wdt/package.nix
+++ b/pkgs/by-name/wd/wdt/package.nix
@@ -51,11 +51,14 @@ stdenv.mkDerivation {
     };
   };
 
+  # We must increase the pinned C++ standard since headers from Folly
+  # v2026.07.27.00 require at least C++20
   postPatch = ''
     substituteInPlace CMakeLists.txt \
       --replace-fail "cmake_minimum_required(VERSION 3.2)" "cmake_minimum_required(VERSION 3.10)" \
       --replace-fail "find_package(Boost COMPONENTS system filesystem REQUIRED)" \
-        "find_package(Boost COMPONENTS filesystem REQUIRED)"
+        "find_package(Boost COMPONENTS filesystem REQUIRED)" \
+      --replace-fail "set(CMAKE_CXX_STANDARD 17)" "set(CMAKE_CXX_STANDARD 20)"
   '';
 
   meta = {
diff --git a/pkgs/by-name/wf/wf-recorder/package.nix b/pkgs/by-name/wf/wf-recorder/package.nix
index 2f5ee21236a8..ce5c4a7ec738 100644
--- a/pkgs/by-name/wf/wf-recorder/package.nix
+++ b/pkgs/by-name/wf/wf-recorder/package.nix
@@ -9,7 +9,7 @@
   wayland-scanner,
   wayland,
   wayland-protocols,
-  ffmpeg,
+  ffmpeg_8,
   x264,
   libpulseaudio,
   pipewire,
@@ -37,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     wayland
     wayland-protocols
-    ffmpeg
+    ffmpeg_8
     x264
     libpulseaudio
     pipewire
diff --git a/pkgs/by-name/wh/whale/package.nix b/pkgs/by-name/wh/whale/package.nix
index 0f27c8a51bc7..9c3c6b967282 100644
--- a/pkgs/by-name/wh/whale/package.nix
+++ b/pkgs/by-name/wh/whale/package.nix
@@ -10,7 +10,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "whale";
-  version = "0.1.63";
+  version = "0.1.66";
 
   __structuredAttrs = true;
 
@@ -18,7 +18,7 @@ buildGoModule (finalAttrs: {
     owner = "usewhale";
     repo = "Whale";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hrPMYaXMLM1+nrv80b3/Ue1JkJ56QvdndhSAsXt5fi8=";
+    hash = "sha256-sFpTIOmWrwdQAti75+rx9JOY2pgARGJw3L0SdY/nf7g=";
   };
 
   vendorHash = "sha256-YBY5b2SLcWeiCQDZELJdsi+mJ+YEuo+yTbotUlLgqEA=";
diff --git a/pkgs/by-name/wi/wildcard/package.nix b/pkgs/by-name/wi/wildcard/package.nix
index a0090667ce72..01a2b9df974a 100644
--- a/pkgs/by-name/wi/wildcard/package.nix
+++ b/pkgs/by-name/wi/wildcard/package.nix
@@ -29,9 +29,8 @@ stdenv.mkDerivation (finalAttrs: {
   strictDeps = true;
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
+    inherit (finalAttrs) pname version src;
     hash = "sha256-hoJsXoPmp0A6oIV1Rm7eXI2U2OIGrStmKzDdPQtI41A=";
-    name = "wildcard-${finalAttrs.version}";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/wi/wireshark/package.nix b/pkgs/by-name/wi/wireshark/package.nix
index 7c7135907646..cd3f6b765956 100644
--- a/pkgs/by-name/wi/wireshark/package.nix
+++ b/pkgs/by-name/wi/wireshark/package.nix
@@ -60,7 +60,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wireshark-${if withQt then "qt" else "cli"}";
-  version = "4.6.7";
+  version = "4.6.8";
 
   outputs = [
     "out"
@@ -71,7 +71,7 @@ stdenv.mkDerivation (finalAttrs: {
     repo = "wireshark";
     owner = "wireshark";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+y2OyCXHnUYNKVbUNeqcATKcTPZz+ikOHPAEs1C2hww=";
+    hash = "sha256-qUC2k8LZQxmSu19jj1LHM+oQiF/ao+rV6wwRQhISuzk=";
   };
 
   patches = [
diff --git a/pkgs/by-name/wl/wl-freeze/package.nix b/pkgs/by-name/wl/wl-freeze/package.nix
index e9dfdae1bb96..74466397909d 100644
--- a/pkgs/by-name/wl/wl-freeze/package.nix
+++ b/pkgs/by-name/wl/wl-freeze/package.nix
@@ -8,11 +8,14 @@
   procps,
   psmisc,
   libnotify,
+  xdotool,
+  kdotool,
+  kdePackages,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wl-freeze";
-  version = "2.0.2";
+  version = "2.1.0";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -21,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "Zerodya";
     repo = "wl-freeze";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-miyDiUN86Zy9RfVm1MefKrYihX4+bFv6Jr4Cl4GzGz8=";
+    hash = "sha256-WY1XB17ARU34dAlU7CqMg3AXVlE0qilXwfGMpYeeiwk=";
   };
 
   dontConfigure = true;
@@ -55,6 +58,9 @@ stdenv.mkDerivation (finalAttrs: {
           procps
           psmisc
           libnotify
+          xdotool
+          kdotool
+          kdePackages.qttools
         ]
       }
   '';
diff --git a/pkgs/by-name/wo/woxi/package.nix b/pkgs/by-name/wo/woxi/package.nix
new file mode 100644
index 000000000000..85d36d24a89f
--- /dev/null
+++ b/pkgs/by-name/wo/woxi/package.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  rustPlatform,
+  fetchCrate,
+  nix-update-script,
+  versionCheckHook,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "woxi";
+  version = "0.3.0";
+
+  __structuredAttrs = true;
+
+  src = fetchCrate {
+    inherit (finalAttrs) pname version;
+    hash = "sha256-gw2pudFKAFJ6MXzpqg7p5pHPhmQMTPH6hjlEPK6wr60=";
+  };
+
+  cargoHash = "sha256-mNA54ukwF6vsbm3sZnlfTENU/Hl2JAXfcZyDfj7LjY4=";
+
+  # The test suite compares Woxi's output against the proprietary
+  # `wolframscript` engine, which is unavailable in the sandbox.
+  doCheck = false;
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Interpreter for a subset of the Wolfram Language";
+    homepage = "https://github.com/ad-si/Woxi";
+    changelog = "https://github.com/ad-si/Woxi/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.agpl3Plus;
+    mainProgram = "woxi";
+    maintainers = with lib.maintainers; [
+      ad-si
+      Dietr1ch
+    ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/wp/wpsoffice-cn/sources.nix b/pkgs/by-name/wp/wpsoffice-cn/sources.nix
index b3ee081764fd..b10b795b3bf4 100644
--- a/pkgs/by-name/wp/wpsoffice-cn/sources.nix
+++ b/pkgs/by-name/wp/wpsoffice-cn/sources.nix
@@ -1,14 +1,14 @@
 # Generated by ./update.sh - do not update manually!
-# Last updated: 2026-06-21
+# Last updated: 2026-08-13
 {
-  linux-version = "12.1.2.26885";
-  darwin-version = "12.1.26016";
+  linux-version = "12.1.2.28080";
+  darwin-version = "12.1.26055";
   x86_64-linux = {
-    url = "https://wps-linux-personal.wpscdn.cn/wps/download/ep/Linux2023/26885/wps-office_12.1.2.26885.AK.preread.sw.Personal_715971_amd64.deb";
-    hash = "sha256-VdpRSUZ6FYS0ttEoDLWrBMBhRTl0gQ+slnmzO9hmTlE=";
+    url = "https://wps-linux-personal.wpscdn.cn/wps/download/ep/Linux2023/28080/wps-office_12.1.2.28080.AK.preread.sw.Personal_765474_amd64.deb";
+    hash = "sha256-L6mZ9gpx4hCTq0nvbX9h12aMhEv+vzCQfSwpDkYPm+A=";
   };
   aarch64-darwin = {
-    url = "https://package.mac.wpscdn.cn/mac_wps_pkg/12.1.26016/WPS_Office_12.1.26016(26016)_arm64.dmg";
-    hash = "sha256-vlT96ROqB/6Jt/x60Zeh6B4MtN2NGyn5PWv9pNafF/8=";
+    url = "https://package.mac.wpscdn.cn/mac_wps_pkg/12.1.26055/WPS_Office_12.1.26055(26055)_arm64.dmg";
+    hash = "sha256-uEcjS6RXGcIPeBUnGw+J1A6Yy+TuxHwrRIKJUxBZYUI=";
   };
 }
diff --git a/pkgs/by-name/xb/xbyak/package.nix b/pkgs/by-name/xb/xbyak/package.nix
index a8414f561d85..faa83b7bd72b 100644
--- a/pkgs/by-name/xb/xbyak/package.nix
+++ b/pkgs/by-name/xb/xbyak/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "xbyak";
-  version = "7.37.6";
+  version = "7.38";
 
   src = fetchFromGitHub {
     owner = "herumi";
     repo = "xbyak";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NA4h4BEzYh7gSVOqznixoU2VjKZYx8dde+Es7dOQiOM=";
+    hash = "sha256-EHQSUZt0fvR1GZBpMqBuXxlPt3j3cLKTtc9JNkCNlt4=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/xf/xfsdump/package.nix b/pkgs/by-name/xf/xfsdump/package.nix
index 2d7886e597a8..502777c19f57 100644
--- a/pkgs/by-name/xf/xfsdump/package.nix
+++ b/pkgs/by-name/xf/xfsdump/package.nix
@@ -10,6 +10,7 @@
   libtool,
   libuuid,
   libxfs,
+  fetchpatch,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -33,6 +34,17 @@ stdenv.mkDerivation (finalAttrs: {
     libxfs
     ncurses
   ];
+  # xfsdump doesn't use flexible array. The old dh_name[6] causes buffer
+  # overflow crash while strcpy() in various places.
+  # See:
+  # https://github.com/NixOS/nixpkgs/pull/533325
+  # https://lore.kernel.org/linux-xfs/20260625222337.54449-1-celeste@collar.sh/T/#u
+  patches = [
+    (fetchpatch {
+      url = "https://lore.kernel.org/linux-xfs/20260625222337.54449-1-celeste@collar.sh/raw";
+      sha256 = "sha256-iOxnd9lgdeNQThinzEjMRKN90YLRcGdTuczUFU61Cm8=";
+    })
+  ];
 
   postPatch = ''
     substituteInPlace Makefile \
diff --git a/pkgs/by-name/xm/xmpp-dns/package.nix b/pkgs/by-name/xm/xmpp-dns/package.nix
new file mode 100644
index 000000000000..683c1aa4458a
--- /dev/null
+++ b/pkgs/by-name/xm/xmpp-dns/package.nix
@@ -0,0 +1,35 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitLab,
+  installShellFiles,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "xmpp-dns";
+  version = "0.6.3";
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitLab {
+    domain = "salsa.debian.org";
+    owner = "mdosch";
+    repo = "xmpp-dns";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-GLTAV8LtOtgYwb261m3gq+AwFQspFUjVl4Si/A5ZmzI=";
+  };
+  vendorHash = "sha256-KFDnFD6g88zIRt08aL/0Obik70oELCDb7piKZaSXGY4=";
+
+  nativeBuildInputs = [ installShellFiles ];
+  postInstall = "installManPage man/xmpp-dns.1";
+
+  meta = {
+    description = "CLI tool to check XMPP SRV records";
+    homepage = "https://salsa.debian.org/mdosch/xmpp-dns";
+    changelog = "https://salsa.debian.org/mdosch/xmpp-dns/-/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ haansn08 ];
+    platforms = lib.platforms.all;
+    mainProgram = "xmpp-dns";
+  };
+})
diff --git a/pkgs/by-name/xo/xournalpp/package.nix b/pkgs/by-name/xo/xournalpp/package.nix
index fc8eb756bec8..2926b003bd14 100644
--- a/pkgs/by-name/xo/xournalpp/package.nix
+++ b/pkgs/by-name/xo/xournalpp/package.nix
@@ -31,13 +31,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xournalpp";
-  version = "1.3.6";
+  version = "1.3.7";
 
   src = fetchFromGitHub {
     owner = "xournalpp";
     repo = "xournalpp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-eSKGu0l3Hif+MlT+5jjLkUYUuglnONasyA6AQiHb32s=";
+    hash = "sha256-CvuHgZ824jLF/L0/PAnbT4RXFLV+Uh2RJ30DA4PEEbE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/xq/xq-xml/package.nix b/pkgs/by-name/xq/xq-xml/package.nix
index 5b806abd8649..fcb2c2c6a8c7 100644
--- a/pkgs/by-name/xq/xq-xml/package.nix
+++ b/pkgs/by-name/xq/xq-xml/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "xq";
-  version = "1.4.0";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "sibprogrammer";
     repo = "xq";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6iC5YhCppzlyp6o+Phq98gQj4LjQx/5pt2+ejOvGvTE=";
+    hash = "sha256-LjY+BQUrqjBZD3//4CULMiIbOfJXVB394ac1yT5DPaU=";
   };
 
-  vendorHash = "sha256-EYAFp9+tiE0hgTWewmai6LcCJiuR+lOU74IlYBeUEf0=";
+  vendorHash = "sha256-ILlqmZwC0azNfvC3f5wSV96X7GPy969YUiIYOrFxJmU=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/yb/yb/package.nix b/pkgs/by-name/yb/yb/package.nix
index 198e7cc97dc9..5b5b174c3243 100644
--- a/pkgs/by-name/yb/yb/package.nix
+++ b/pkgs/by-name/yb/yb/package.nix
@@ -49,7 +49,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     installShellFiles
   ];
 
-  buildInputs = lib.optionals stdenv.isLinux [ pcsclite ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ pcsclite ];
 
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     # Bash completion: patch two clap_complete quirks:
@@ -107,7 +107,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
           pkg-config
           llvmPackages.libclang
         ];
-        buildInputs = lib.optionals stdenv.isLinux [ pcsclite ];
+        buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ pcsclite ];
 
         LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
         BINDGEN_EXTRA_CLANG_ARGS = "-I${llvmPackages.libclang.lib}/lib/clang/${lib.versions.major llvmPackages.release_version}/include";
diff --git a/pkgs/by-name/yo/yosys/package.nix b/pkgs/by-name/yo/yosys/package.nix
index ba16eb81928d..81fe33e81d20 100644
--- a/pkgs/by-name/yo/yosys/package.nix
+++ b/pkgs/by-name/yo/yosys/package.nix
@@ -79,13 +79,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "yosys";
-  version = "0.67";
+  version = "0.68";
 
   src = fetchFromGitHub {
     owner = "YosysHQ";
     repo = "yosys";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-sJaekoBnLEn7j56duQOFMkT4fELHNgkYCbcY6E8hgyA=";
+    hash = "sha256-cf3L3Il717ReAcPTPNHZLwldDeCwuPqHYoxeQusBOOg=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index 090de7255fa3..e01a2262901e 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -98,7 +98,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "1.14.2";
+  version = "1.15.0";
 
   outputs = [
     "out"
@@ -111,7 +111,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-k6wZ8hgrBhvJjxUYCpR01Vuj7ecr5eZnGBUoMzsckko=";
+    hash = "sha256-oHFcYIWshXQdZP2J936a+bBe4MY55aj50YfMh9E2qz4=";
   };
 
   postPatch = ''
@@ -134,7 +134,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail 'builder.include(&glib_path_config);' 'builder.include("${lib.getLib glib}/lib/glib-2.0/include");'
   '';
 
-  cargoHash = "sha256-9kjNF4TpR6t7L3fV8CgWiIU5qVzX1iPIMauB5ie20lo=";
+  cargoHash = "sha256-yk+scR1GUD2f/IPSu/zorqyHuktjCnP7rFzap90xjN8=";
 
   __structuredAttrs = true;
 
diff --git a/pkgs/by-name/ze/zennotes-desktop/package.nix b/pkgs/by-name/ze/zennotes-desktop/package.nix
index 87663ddd2ec5..74211729c544 100644
--- a/pkgs/by-name/ze/zennotes-desktop/package.nix
+++ b/pkgs/by-name/ze/zennotes-desktop/package.nix
@@ -13,14 +13,14 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "zennotes-desktop";
-  version = "2.25.0";
-  npmDepsHash = "sha256-qW7G+zZCmFMR9pKdLelI+jfHyuU1/cTx1hTmzM9HRc4=";
+  version = "2.27.0";
+  npmDepsHash = "sha256-cSotsEeJp2/5t7me8ETs+1URHfUoM1boY5lsjUEi8WI=";
 
   src = fetchFromGitHub {
     owner = "ZenNotes";
     repo = "zennotes";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Sdyl5b8IeshmstXQqUX1YbWehCaUrKELU2FiTW4xm7g=";
+    hash = "sha256-ViZHSH9m02NzexYNbeOuZJ623Nz8dvd2jGqAIj+lKRI=";
   };
 
   npmWorkspace = "apps/desktop";
diff --git a/pkgs/by-name/ze/zerofs/package.nix b/pkgs/by-name/ze/zerofs/package.nix
index 23a232f9411c..24fd1d628014 100644
--- a/pkgs/by-name/ze/zerofs/package.nix
+++ b/pkgs/by-name/ze/zerofs/package.nix
@@ -10,18 +10,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zerofs";
-  version = "2.2.1";
+  version = "2.2.3";
 
   src = fetchFromGitHub {
     owner = "Barre";
     repo = "ZeroFS";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8pODKvQWTbqBIG6vwoSbQ+CuliGspFQJZWM9lA8c2wQ=";
+    hash = "sha256-2QVMpd838AX2yvmPRwuAkCiLueUKdZrXACV7OWfvwLo=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/zerofs";
 
-  cargoHash = "sha256-eyVbpbo2XYp6jrocHD9VujqyBhnwy5w4r8EI6XOTRI0=";
+  cargoHash = "sha256-FlFC/jLtTYysBOoMOebapTaZ+6+wZJwPu1PLe5hjLXk=";
 
   nativeBuildInputs = [ cmake ];
 
diff --git a/pkgs/development/compilers/chicken/4/chicken.nix b/pkgs/development/compilers/chicken/4/chicken.nix
index 21999870e3b2..fa96639f85db 100644
--- a/pkgs/development/compilers/chicken/4/chicken.nix
+++ b/pkgs/development/compilers/chicken/4/chicken.nix
@@ -10,7 +10,7 @@
 let
   version = "4.13.0";
   platform =
-    with stdenv;
+    with stdenv.hostPlatform;
     if isDarwin then
       "macosx"
     else if isCygwin then
diff --git a/pkgs/development/compilers/chicken/5/chicken.nix b/pkgs/development/compilers/chicken/5/chicken.nix
index 06b9dd6c1485..7df46bcebe8b 100644
--- a/pkgs/development/compilers/chicken/5/chicken.nix
+++ b/pkgs/development/compilers/chicken/5/chicken.nix
@@ -10,7 +10,7 @@
 
 let
   platform =
-    with stdenv;
+    with stdenv.hostPlatform;
     if isDarwin then
       "macosx"
     else if isCygwin then
diff --git a/pkgs/development/compilers/dotnet/source/vmr.nix b/pkgs/development/compilers/dotnet/source/vmr.nix
index 56e8cfa311c3..fec51026975d 100644
--- a/pkgs/development/compilers/dotnet/source/vmr.nix
+++ b/pkgs/development/compilers/dotnet/source/vmr.nix
@@ -43,11 +43,10 @@ let
   stdenv = llvmPackages.stdenv;
 
   inherit (stdenv)
-    isLinux
-    isDarwin
     buildPlatform
     targetPlatform
     ;
+  inherit (stdenv.hostPlatform) isLinux isDarwin;
   inherit (swiftPackages) swift;
 
   releaseManifest = lib.importJSON releaseManifestFile;
diff --git a/pkgs/development/compilers/fpc/lazarus.nix b/pkgs/development/compilers/fpc/lazarus.nix
index 96e8b93a0951..b93013b15e1c 100644
--- a/pkgs/development/compilers/fpc/lazarus.nix
+++ b/pkgs/development/compilers/fpc/lazarus.nix
@@ -5,11 +5,12 @@
   makeWrapper,
   writeText,
   fpc,
-  gtk2,
+  gtk3,
   glib,
   pango,
   atk,
   gdk-pixbuf,
+  harfbuzz,
   libxi,
   xorgproto,
   libx11,
@@ -27,7 +28,7 @@
 #  1. the build date is embedded in the binary through `$I %DATE%` - we should dump that
 
 let
-  version = "4.4-0";
+  version = "4.8-0";
 
   # as of 2.0.10 a suffix is being added. That may or may not disappear and then
   # come back, so just leave this here.
@@ -43,7 +44,7 @@ let
     )
   );
 
-  LCL_PLATFORM = if withQt then "qt${qtVersion}" else "gtk2";
+  LCL_PLATFORM = if withQt then "qt${qtVersion}" else "gtk3";
 
   qtVersion = lib.versions.major qtbase.version;
 in
@@ -53,7 +54,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://sourceforge/lazarus/Lazarus%20Zip%20_%20GZip/Lazarus%20${majorMinorPatch version}/lazarus-${version}.tar.gz";
-    hash = "sha256-GQ7ce3p7GEMFAslkpF399UGP8Wu8rVwEQjszoJ0izAY=";
+    hash = "sha256-a0yeyU/nn+TlgCfde/ENm2w1ycsvkdtZMLdYC0ogGpk=";
   };
 
   postPatch = ''
@@ -61,9 +62,9 @@ stdenv.mkDerivation rec {
   '';
 
   buildInputs = [
-    # we need gtk2 unconditionally as that is the default target when building applications with lazarus
+    # we need gtk unconditionally as that is the default target when building applications with lazarus
     fpc
-    gtk2
+    gtk3
     glib
     libxi
     xorgproto
@@ -73,6 +74,7 @@ stdenv.mkDerivation rec {
     atk
     stdenv.cc
     gdk-pixbuf
+    harfbuzz
   ]
   ++ lib.optionals withQt [
     libqtpas
@@ -109,11 +111,13 @@ stdenv.mkDerivation rec {
         "-lc"
         "-lcairo"
         "-lgcc_s"
-        "-lgdk-x11-2.0"
+        "-lgdk-3"
         "-lgdk_pixbuf-2.0"
         "-lglib-2.0"
-        "-lgtk-x11-2.0"
+        "-lgtk-3"
         "-lpango-1.0"
+        "-lharfbuzz"
+        "-lharfbuzz-gobject"
       ]
       ++ lib.optionals withQt [
         "-L${lib.getLib libqtpas}/lib"
diff --git a/pkgs/development/compilers/gcc/ng/15/libstdcxx/force-regular-dirs.patch b/pkgs/development/compilers/gcc/ng/15/libstdcxx/force-regular-dirs.patch
index e80cffdce1e7..2812ba748e80 100644
--- a/pkgs/development/compilers/gcc/ng/15/libstdcxx/force-regular-dirs.patch
+++ b/pkgs/development/compilers/gcc/ng/15/libstdcxx/force-regular-dirs.patch
@@ -1,9 +1,21 @@
 From db427c55334dd2edc11397d3a92d55dc9c06d1c3 Mon Sep 17 00:00:00 2001
 From: John Ericson <git@JohnEricson.me>
 Date: Sun, 20 Jul 2025 14:20:00 -0400
-Subject: [PATCH] libstdc++: Force regular include/lib dir
+Subject: [PATCH] libstdc++: Force regular lib dir, headers in include-cxx
 
 Delete a bunch of unneeded logic to do this.
+
+The library goes straight in $(libdir), with no version-specific or
+target-specific subdirectory.
+
+The headers go in $(includedir)-cxx rather than $(includedir). libstdc++
+intentionally ships headers named after C headers -- `math.h`, `stdlib.h`,
+`complex.h`, `stdckdint.h` and friends -- whose whole purpose is to shadow
+the C ones when compiling C++. Installed into the ordinary include dir they
+shadow them when compiling *C* too, because the generic setup hook puts that
+directory on the C include path. A sibling directory keeps them out of C's
+way while staying findable for C++; no version or target subdirectory is
+needed, since the store path already separates one libstdc++ from another.
 ---
  libstdc++-v3/acinclude.m4        | 80 ++------------------------------
  libstdc++-v3/include/Makefile.am |  2 +-
@@ -21,7 +33,7 @@ index a0094c2dd95..a0718dff394 100644
 -  glibcxx_toolexeclibdir=no
 +  glibcxx_toolexecdir='$(libdir)'
 +  glibcxx_toolexeclibdir='$(libdir)'
-+  gxx_include_dir='$(includedir)'
++  gxx_include_dir='$(includedir)-cxx'
    glibcxx_prefixdir=$prefix
  
 -  AC_MSG_CHECKING([for gxx-include-dir])
diff --git a/pkgs/development/compilers/gcc/ng/README.md b/pkgs/development/compilers/gcc/ng/README.md
index b40070caebc6..0bbde4ef5cbf 100644
--- a/pkgs/development/compilers/gcc/ng/README.md
+++ b/pkgs/development/compilers/gcc/ng/README.md
@@ -1,3 +1,58 @@
 # GCC Next-Generation
 
-Experimental split GCC package set based on the LLVM package set design.
+Experimental split GCC package set, based on the LLVM package set design.
+
+The monolithic `gcc` derivation builds the compiler and every runtime library in one go, so a change to the target libc rebuilds the compiler too.
+This set separates them — `gcc`, `libgcc`, `libstdcxx` and the rest are individual packages — so the compiler stops depending on the libc, and each piece can be rebuilt on its own.
+Because GCC is not a multi-target compiler — a single target is baked into the binary with CPP — we still need to rebuild it more than we do LLVM, but someday that should change.
+
+A platform opts in with `useGccNG`, in the same way it would opt into `useLLVM`.
+
+## The bootstrap chain
+
+The libc and libgcc depend on each other: a libc's own sources call into libgcc for integer and floating-point helpers and for stack unwinding, and a libgcc that can use the libc's threads needs the libc.
+
+The way out we currently use is the same one the LLVM set takes with `compiler-rt-no-libc` and `compiler-rt-libc` — build the runtime twice, either side of the libc.
+It is unclear whether this works in general to resolve the circularity, but we shall see.
+
+That gives four compilers, each one step further along:
+
+| compiler | libc | libgcc | used to build |
+|---|---|---|---|
+| `gccNoLibgcc` | headers, or nothing | — | `libgcc-no-libc` |
+| `gccWithLibgcc` | headers, or nothing | `libgcc-no-libc` | the libc |
+| `gccWithLibcAndBasicLibgcc` | real | `libgcc-no-libc` | `libgcc-libc` |
+| `gccWithLibc` / `gcc` | real | `libgcc-libc` | everything else |
+
+`libgcc` resolves to `libgcc-libc` wherever a libc exists; only those first three stages ever see `libgcc-no-libc`.
+The bootstrap one is single-threaded and compiled against the libc's headers at best, so it is not intended for use beyond building the libc.
+
+Nothing is passed down to say which stage is which.
+It follows from the compiler: each package reads `stdenv.cc.libc` and needs no flag of its own.
+That is also how the two `libgcc`s differ — same expression, different `stdenv`.
+
+## Where the pre-libc stage is written down
+
+`binutilsNoLibc` carries `preLibcHeaders` as its `libc`: the header-only stand-in for platforms that have one, and nothing at all for platforms that do not.
+`wrapCCWith` defaults `libc` to `bintools.libc`, so the bootstrap compilers inherit it, and everything built with them reads `stdenv.cc.libc`.
+
+Setting a sysroot as well is unusual for nixpkgs, since headers normally reach a compiler through the wrapper, as they do here.
+It is needed because `gcc/configure` takes `target_header_dir` from `--with-sysroot`, and `target_header_dir` is what decides `inhibit_libc`.
+A libgcc built with `inhibit_libc` still compiles, links and installs, just with pieces silently missing.
+
+Given that, the sysroot is derived from `stdenv.cc.libc` too, so it cannot disagree with the headers.
+
+## Threading
+
+Which threading model is available is a property of the libc, so the libc declares it as `passthru.threadModel`; `libgcc` reads it from there, and `libstdcxx` takes both the model and the generated `gthr-default.h` from `libgcc`.
+
+Reading it from the compiler instead, with `$CC -v | sed -n 's/^Thread model: //p'`, reports the wrong component: in this set the compiler is configured separately from libgcc, so the two can disagree.
+A platform whose libc declares nothing gets `single`.
+
+## Relationship to the monolithic set
+
+Both are packaged from the same sources and, for now, the same version: `gccNGPackages` tracks `default-gcc-version` with no fallback, so bumping the monolithic default past what is packaged here is an evaluation error rather than a silent version skew.
+
+Nothing selects GGN NG yet by default.
+The plan is for very exotic package sets to switch to this first.
+The main tier-1 native Linux package sets cached on `cache.nixos.org` will come later.
diff --git a/pkgs/development/compilers/gcc/ng/common/default.nix b/pkgs/development/compilers/gcc/ng/common/default.nix
index 0e040fdb1320..9929fee1e655 100644
--- a/pkgs/development/compilers/gcc/ng/common/default.nix
+++ b/pkgs/development/compilers/gcc/ng/common/default.nix
@@ -131,6 +131,7 @@ makeScopeWithSplicing' {
           "-B${targetGccPackages.libssp}/lib"
           "-B${targetGccPackages.libatomic}/lib"
           "-B${targetGccPackages.libgomp}/lib"
+          "-B${targetGccPackages.libstdcxx}/lib"
           "-B${targetGccPackages.libgfortran}/lib/"
         ];
       };
@@ -163,10 +164,20 @@ makeScopeWithSplicing' {
           "-B${targetGccPackages.libssp}/lib"
           "-B${targetGccPackages.libatomic}/lib"
           "-B${targetGccPackages.libgomp}/lib"
+          # `libcxx` above tells cc-wrapper where the C++ *headers* are; it does
+          # not put the library itself on the link path for a GNU compiler. So
+          # every C++ link failed with `cannot find -lstdc++` until this was
+          # added, in the same style as the other runtime libraries.
+          "-B${targetGccPackages.libstdcxx}/lib"
           "-I${targetGccPackages.libgomp}/lib/gcc/${metadata.release_version}/include"
         ];
       };
 
+      # Stage 1 of the bootstrap chain; see ../README.md.
+      #
+      # No `libc` is passed: `wrapCCWith` defaults it to `bintools.libc`, and
+      # `binutilsNoLibc` carries `preLibcHeaders`. That is the only place the
+      # pre-libc stage is written down.
       gccNoLibgcc = wrapCCWith {
         cc = gccPackages.gcc-unwrapped;
         libcxx = null;
@@ -177,10 +188,51 @@ makeScopeWithSplicing' {
         ];
       };
 
-      libgcc = callPackage ./libgcc {
+      # Built before there is a libc, and not intended for use beyond getting
+      # one built. Note the two differ only by `stdenv`: which stage this is
+      # follows from the compiler, never from an argument.
+      libgcc-no-libc = callPackage ./libgcc {
         stdenv = overrideCC stdenv buildGccPackages.gccNoLibgcc;
       };
 
+      # The real one, built against the finished libc, so it can use that
+      # libc's threads. This is what everything above the libc gets.
+      libgcc-libc = callPackage ./libgcc {
+        stdenv = overrideCC stdenv buildGccPackages.gccWithLibcAndBasicLibgcc;
+      };
+
+      libgcc =
+        if stdenv.hostPlatform.libc == null then gccPackages.libgcc-no-libc else gccPackages.libgcc-libc;
+
+      # Stage 2: libgcc available, libc not yet — what compiling a libc needs.
+      # `binutilsNoLibc` is what keeps the libc out, so nothing here refers to
+      # a libc derivation and the cycle stays broken.
+      gccWithLibgcc = wrapCCWith {
+        cc = gccPackages.gcc-unwrapped;
+        libcxx = null;
+        bintools = binutilsNoLibc;
+        extraPackages = [
+          targetGccPackages.libgcc-no-libc
+        ];
+        nixSupport.cc-cflags = [
+          "-B${targetGccPackages.libgcc-no-libc}/lib"
+        ];
+      };
+
+      # Stage 3: real libc, bootstrap libgcc still. The finished libgcc is what
+      # this is about to build.
+      gccWithLibcAndBasicLibgcc = wrapCCWith {
+        cc = gccPackages.gcc-unwrapped;
+        libcxx = null;
+        bintools = binutils;
+        extraPackages = [
+          targetGccPackages.libgcc-no-libc
+        ];
+        nixSupport.cc-cflags = [
+          "-B${targetGccPackages.libgcc-no-libc}/lib"
+        ];
+      };
+
       gccWithLibc = wrapCCWith {
         cc = gccPackages.gcc-unwrapped;
         libcxx = null;
diff --git a/pkgs/development/compilers/gcc/ng/common/gcc/default.nix b/pkgs/development/compilers/gcc/ng/common/gcc/default.nix
index 1c7a57d9a6cc..fd282acfda67 100644
--- a/pkgs/development/compilers/gcc/ng/common/gcc/default.nix
+++ b/pkgs/development/compilers/gcc/ng/common/gcc/default.nix
@@ -27,11 +27,18 @@
   texinfo,
   which,
   gettext,
+  flex,
+  bison,
+  # Whether `monorepoSrc` is a VCS checkout rather than a release tarball. A
+  # checkout lacks the generated sources (gengtype-lex.cc and friends) that a
+  # tarball ships pre-built, so they have to be regenerated with flex and bison.
+  fromVCS ? false,
   getVersionFile,
   buildGccPackages,
-  targetPackages,
-  libc,
   bintools,
+  # Build the shared runtime libraries, and so have the driver's specs emit
+  # `-lgcc_s`. Derived the way the monolithic build derives it.
+  enableTargetShared ? stdenv.targetPlatform.hasSharedLibraries,
 }:
 let
   inherit (stdenv) targetPlatform hostPlatform;
@@ -81,6 +88,36 @@ stdenv.mkDerivation (finalAttrs: {
       hash = "sha256-54/HzM+aeWq8CTkQu8Pualqc/LgRLS0+8EY8uPUsD+s=";
     })
 
+    # Not upstream yet; a follow-up to the series above (drop the `/raw` to
+    # read them). They extend that series' `<target>-as` preference to `PATH`,
+    # where we put the cross toolchain, so a cross compiler finds its tools
+    # the way a native one does. See below for the problems `--with-as` and
+    # `--with-ld` cause, and thus why we want to avoid them.
+    (fetchpatch {
+      name = "driver-factor-out-env-path-parsing.patch";
+      url = "https://inbox.sourceware.org/gcc-patches/20260810065714.2215299-1-git@JohnEricson.me/raw";
+      hash = "sha256-2qUUMWuyxX4mVaBPeNnHIiMl/aN7ejWM5stTSFWxD7g=";
+    })
+    (fetchpatch {
+      name = "driver-search-PATH-ourselves.patch";
+      url = "https://inbox.sourceware.org/gcc-patches/20260810065714.2215299-2-git@JohnEricson.me/raw";
+      # The posted patch is against trunk, which spells this cast with the C++
+      # operator.  GCC 15 still uses the CONST_CAST macro, and the line is
+      # context rather than a change, so it cannot fuzz-match.  Rewrite it
+      # here rather than keeping a forked copy of the whole patch.
+      postFetch = ''
+        substituteInPlace "$out" \
+          --replace-fail 'string, const_cast<char **> (commands[i].argv),' \
+                         'string, CONST_CAST (char **, commands[i].argv),'
+      '';
+      hash = "sha256-uD8xJxQus2qyNgNDN/63WnURNuUJFDkhaXPph7g/DIk=";
+    })
+    (fetchpatch {
+      name = "driver-search-PATH-machine-prefix.patch";
+      url = "https://inbox.sourceware.org/gcc-patches/20260810065714.2215299-3-git@JohnEricson.me/raw";
+      hash = "sha256-Q5CJpJKD11kadIKselQdHgNe26GqojpyAAmlAyHnsB0=";
+    })
+
     (getVersionFile "gcc/fix-collect2-paths.diff")
   ];
 
@@ -93,12 +130,39 @@ stdenv.mkDerivation (finalAttrs: {
   strictDeps = true;
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
+
+  # The target assembler and linker have to be *runnable here*, during
+  # configure. GCC probes them for capabilities, and a probe it cannot run is
+  # not an error -- it silently records "no". Without the target `ld` on
+  # `PATH`, every `gcc_cv_ld_*` probe fails that way, and the two that matter
+  # most are `HAVE_GAS_HIDDEN` (which needs `gcc_cv_as_hidden` *and*
+  # `gcc_cv_ld_hidden`) and `HAVE_LD_EH_FRAME_HDR`.
+  #
+  # Losing `HAVE_GAS_HIDDEN` is the nasty one: `-fvisibility=hidden` degrades
+  # into a no-op that merely warns, so every symbol stays preemptible and GCC's
+  # own same-translation-unit `R_X86_64_PC32` references become invalid when
+  # linking a shared library.
+  #
+  # The *unwrapped* bintools: `as` and `ld` proper carry no target-libc
+  # reference, so the decoupling this package set exists for still holds.
+  #
+  # Note this is `PATH` rather than `--with-as`/`--with-ld` on purpose. We want
+  # configure to *ask* the real tools what they support, and we want it to bake
+  # nothing else: those flags record `DEFAULT_ASSEMBLER`/`DEFAULT_LINKER` as
+  # absolute store paths, and the driver then runs exactly those binaries
+  # instead of the wrapped ones it is meant to defer to.
+  depsBuildTarget = [ (bintools.bintools or bintools) ];
+
   nativeBuildInputs = [
     texinfo
     which
     gettext
   ]
-  ++ lib.optional (perl != null) perl;
+  ++ lib.optional (perl != null) perl
+  ++ lib.optionals fromVCS [
+    flex
+    bison
+  ];
 
   buildInputs = [
     gmp
@@ -197,7 +261,11 @@ stdenv.mkDerivation (finalAttrs: {
     "--disable-install-libiberty"
     "--disable-multilib"
     "--disable-nls"
-    "--disable-shared"
+    # Derived rather than forced off: the driver's specs only emit `-lgcc_s`
+    # for a target that has shared libraries, so hardcoding this leaves every
+    # throwing C++ program unlinkable even though `libgcc_s.so` is built and
+    # findable. Same predicate the monolithic build uses.
+    (lib.enableFeature enableTargetShared "shared")
     "--enable-default-pie"
     "--enable-languages=${
       lib.concatStrings (
@@ -218,12 +286,26 @@ stdenv.mkDerivation (finalAttrs: {
     "--without-headers"
     "--with-gnu-as"
     "--with-gnu-ld"
-    "--with-as=${lib.getExe' bintools "${bintools.targetPrefix}as"}"
+    # Deliberately no `--with-as` / `--with-ld`. Those bake
+    # `DEFAULT_ASSEMBLER` and `DEFAULT_LINKER` -- absolute store paths -- into
+    # the compiler, so the driver runs exactly those binaries and stops
+    # deferring to the wrapped tools it is meant to use.
+    #
+    # Nothing has to be baked. At configure time the tools are on `PATH` via
+    # `depsBuildTarget`, which is what the capability probes need; at use time
+    # the driver finds them on `PATH` under their target-prefixed names, via
+    # the `find_a_program` patches above.
     "--with-system-zlib"
     "--without-included-gettext"
     "--enable-linker-build-id"
-    "--with-sysroot=${lib.getDev (targetPackages.libc or libc)}"
-    "--with-native-system-header-dir=/include"
+    # Deliberately *no* `--with-sysroot` / `--with-native-system-header-dir`
+    # pointing at the target libc. Baking a libc store path into the compiler
+    # makes every libc change rebuild the compiler, which is precisely the
+    # coupling this split package set exists to remove. cc-wrapper already
+    # supplies the target libc (`-idirafter <libc.dev>/include` and the
+    # corresponding `-B`/`-L` flags), so the compiler proper does not need to
+    # know about it -- exactly as in the LLVM package set, where `clang`
+    # likewise carries no libc reference (`--without-headers` above).
   ]
   ++ lib.optionals enablePlugin [
     "--enable-plugin"
@@ -236,6 +318,20 @@ stdenv.mkDerivation (finalAttrs: {
       "--with-multilib-list="
     ];
 
+  # `LIMITS_H_TEST` decides whether gcc's generated `syslimits.h` chains to the
+  # target libc's `limits.h` (`#include_next`) or is emitted self-contained. It
+  # defaults to a `[ -f $(BUILD_SYSTEM_HEADER_DIR)/limits.h ]` probe, which
+  # necessarily fails here: we deliberately do not point the compiler at a
+  # sysroot (see `configureFlags`), so there is no libc for it to find at build
+  # time.
+  #
+  # Self-contained is the wrong answer regardless. Every target in this package
+  # set is hosted, and cc-wrapper always supplies a libc, so the chained header
+  # is what resolves correctly at *use* time. Without it, anything the libc's
+  # `limits.h` defines and gcc's does not -- `PATH_MAX` being the common one --
+  # goes missing from every libgcc source that needs it.
+  makeFlags = [ "LIMITS_H_TEST=true" ];
+
   doCheck = false;
 
   postInstall = ''
diff --git a/pkgs/development/compilers/gcc/ng/common/libatomic/default.nix b/pkgs/development/compilers/gcc/ng/common/libatomic/default.nix
index db4261a186cc..ce51cf4dd520 100644
--- a/pkgs/development/compilers/gcc/ng/common/libatomic/default.nix
+++ b/pkgs/development/compilers/gcc/ng/common/libatomic/default.nix
@@ -14,29 +14,34 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "libatomic";
   inherit version;
 
-  src = runCommand "libatomic-src-${version}" { src = monorepoSrc; } ''
-    runPhase unpackPhase
+  src = runCommand "libatomic-src-${version}" { src = monorepoSrc; } (
+    ''
+      runPhase unpackPhase
 
-    mkdir -p "$out/gcc"
-    cp gcc/BASE-VER "$out/gcc"
-    cp gcc/DATESTAMP "$out/gcc"
+      mkdir -p "$out/gcc"
+      cp gcc/BASE-VER "$out/gcc"
+      cp gcc/DATESTAMP "$out/gcc"
 
-    cp -r libatomic "$out"
+      cp -r libatomic "$out"
 
-    cp -r config "$out"
-    cp -r multilib.am "$out"
-    cp -r libtool.m4 "$out"
+      cp -r config "$out"
+      cp -r multilib.am "$out"
+      cp -r libtool.m4 "$out"
 
-    cp config.guess "$out"
-    cp config.rpath "$out"
-    cp config.sub "$out"
-    cp config-ml.in "$out"
-    cp ltmain.sh "$out"
-    cp install-sh "$out"
-    cp mkinstalldirs "$out"
+      cp config.guess "$out"
+      cp config.rpath "$out"
+      cp config.sub "$out"
+      cp config-ml.in "$out"
+      cp ltmain.sh "$out"
+      cp install-sh "$out"
+      cp mkinstalldirs "$out"
 
-    [[ -f MD5SUMS ]]; cp MD5SUMS "$out"
-  '';
+    ''
+    # `MD5SUMS` exists only in release tarballs, not in a VCS checkout.
+    + ''
+      if [[ -f MD5SUMS ]]; then cp MD5SUMS "$out"; fi
+    ''
+  );
 
   patches = [
     (fetchpatch {
diff --git a/pkgs/development/compilers/gcc/ng/common/libbacktrace/default.nix b/pkgs/development/compilers/gcc/ng/common/libbacktrace/default.nix
index 307a7061bc57..75cf777746a7 100644
--- a/pkgs/development/compilers/gcc/ng/common/libbacktrace/default.nix
+++ b/pkgs/development/compilers/gcc/ng/common/libbacktrace/default.nix
@@ -11,28 +11,33 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "libbacktrace";
   inherit version;
 
-  src = runCommand "libbacktrace-src-${version}" { src = monorepoSrc; } ''
-    runPhase unpackPhase
+  src = runCommand "libbacktrace-src-${version}" { src = monorepoSrc; } (
+    ''
+      runPhase unpackPhase
 
-    mkdir -p "$out/gcc"
-    cp gcc/BASE-VER "$out/gcc"
-    cp gcc/DATESTAMP "$out/gcc"
+      mkdir -p "$out/gcc"
+      cp gcc/BASE-VER "$out/gcc"
+      cp gcc/DATESTAMP "$out/gcc"
 
-    cp -r include "$out"
-    cp -r libbacktrace "$out"
+      cp -r include "$out"
+      cp -r libbacktrace "$out"
 
-    cp config.guess "$out"
-    cp config.rpath "$out"
-    cp config.sub "$out"
-    cp config-ml.in "$out"
-    cp ltmain.sh "$out"
-    cp install-sh "$out"
-    cp move-if-change "$out"
-    cp mkinstalldirs "$out"
-    cp test-driver "$out"
+      cp config.guess "$out"
+      cp config.rpath "$out"
+      cp config.sub "$out"
+      cp config-ml.in "$out"
+      cp ltmain.sh "$out"
+      cp install-sh "$out"
+      cp move-if-change "$out"
+      cp mkinstalldirs "$out"
+      cp test-driver "$out"
 
-    [[ -f MD5SUMS ]]; cp MD5SUMS "$out"
-  '';
+    ''
+    # `MD5SUMS` exists only in release tarballs, not in a VCS checkout.
+    + ''
+      if [[ -f MD5SUMS ]]; then cp MD5SUMS "$out"; fi
+    ''
+  );
 
   outputs = [
     "out"
diff --git a/pkgs/development/compilers/gcc/ng/common/libgcc/default.nix b/pkgs/development/compilers/gcc/ng/common/libgcc/default.nix
index d88c2e6c0ae5..27bd39f16be0 100644
--- a/pkgs/development/compilers/gcc/ng/common/libgcc/default.nix
+++ b/pkgs/development/compilers/gcc/ng/common/libgcc/default.nix
@@ -12,9 +12,62 @@
   buildPackages,
   which,
   python3,
+
+  # Build `libgcc_s` as well as `libgcc.a`. Only ever worth turning *off*: the
+  # assertion below refuses to force it on where the default says it cannot
+  # work, since what follows from that is a link failure much further away.
+  enableShared ? __defaultEnableShared,
+
+  # The following are arguments rather than a `let` bindings only so
+  # that it is in scope for the default definition above.
+
+  # Whether a shared libgcc can be built at all here, derived the way the
+  # monolithic build derives it rather than forced off.
+  #
+  # Shared needs something to link against. Normally that is the libc, on any
+  # format -- PE/COFF included -- which is why every stage after the bootstrap
+  # builds it. ELF additionally allows it *before* the libc exists, because a
+  # shared object may keep undefined symbols; `libgcc_s.so` comes out with an
+  # empty `DT_NEEDED`, which is why the monolithic build ships one even from
+  # its nolibc stage. A PE/COFF DLL must resolve everything at link time, so
+  # there the bootstrap yields only `libgcc.a` -- all it is used for anyway.
+  __defaultEnableShared ?
+    stdenv.hostPlatform.hasSharedLibraries && (__haveLinkableLibc || stdenv.hostPlatform.isElf),
+
+  # Whether the compiler has a libc that can actually be linked against, as
+  # opposed to nothing at all or a headers-only stand-in.
+  __haveLinkableLibc ? (stdenv.cc.libc or null) != null && !(stdenv.cc.libc.headersOnly or false),
 }:
+let
+  # A libc needs libgcc to build, and a libgcc that can use the libc's threads
+  # needs the libc, so this package is instantiated twice — see
+  # `libgcc-no-libc` and `libgcc-libc` in the package set, the same split the
+  # LLVM package set makes with `compiler-rt-no-libc` and `compiler-rt-libc`.
+  #
+  # Nothing here says which of the two it is. The difference is entirely in the
+  # compiler it is handed: the bootstrap wrapper's `libc` is `preLibcHeaders`
+  # (or nothing at all, on platforms without one), the later wrapper's is the
+  # finished libc. Everything below reads that one value.
+  libc = stdenv.cc.libc or null;
+
+  # Which threading model may be used is decided by the libc, so take it from
+  # there rather than guess — and pass it on in `passthru` so that `libstdcxx`,
+  # which has to agree, reads the same answer instead of probing for its own.
+  #
+  # This is what makes the bootstrap build single-threaded without being told
+  # to be: a headers-only package declares no `threadModel`, and a real libc
+  # does. That build exists only to get the libc built and is thrown away
+  # afterwards, so there is nothing to be gained from threading it, and plenty
+  # to go wrong: `gthr-posix.h` includes `<pthread.h>` unconditionally, which
+  # at that point is either absent or a stand-in for a libc that does not exist
+  # yet.
+  threadModel = if libc == null then "single" else libc.threadModel or "single";
+in
+
+assert enableShared -> __defaultEnableShared;
+
 stdenv.mkDerivation (finalAttrs: {
-  pname = "libgcc";
+  pname = "libgcc" + lib.optionalString (libc == null) "-no-libc";
   inherit version;
 
   src = monorepoSrc;
@@ -83,9 +136,93 @@ stdenv.mkDerivation (finalAttrs: {
     buildRoot=$(readlink -e "./build")
   '';
 
-  postPatch = ''
-    sourceRoot=$(readlink -e "./libgcc")
-  '';
+  postPatch =
+    # Both halves of this are ELF-specific, so it is applied only there.
+    # `crti.o`/`crtn.o` are an ELF convention; forcing the rule on a PE/COFF
+    # target makes the build assemble the generic ELF `crti.S` with a PE
+    # assembler, which fails outright. And on those targets `SHLIB_LC` is not
+    # `-lc` but the list of system import libraries the DLL needs, so blanking
+    # it would leave the shared libgcc missing its real dependencies.
+    #
+    # Trick to build a gcc that is capable of emitting shared libraries *without* having the
+    # hostPlatform libc available beforehand.  Taken from:
+    #   https://web.archive.org/web/20170222224855/http://frank.harvard.edu/~coldwell/toolchain/
+    #   https://web.archive.org/web/20170224235700/http://frank.harvard.edu/~coldwell/toolchain/t-linux.diff
+    lib.optionalString (enableShared && stdenv.hostPlatform.isElf) (
+      let
+
+        # crt{i,n}.o are the first and last (respectively) object file
+        # linked when producing an executable.  Traditionally these
+        # files are delivered as part of the C library, but on GNU
+        # systems they are in fact built by GCC.  Since libgcc needs to
+        # build before glibc, we can't wait for them to be copied by
+        # glibc.  At this early pre-glibc stage these files sometimes
+        # have different names.
+        crtstuff-ofiles =
+          if stdenv.hostPlatform.isPower64 then "ecrti.o ecrtn.o ncrti.o ncrtn.o" else "crti.o crtn.o";
+
+        # Normally, `SHLIB_LC` is set to `-lc`, which means that
+        # `libgcc_s.so` cannot be built until `libc.so` is available.
+        # The assignment below clobbers this variable, removing the
+        # `-lc`.
+        #
+        # On PowerPC we add `-mnewlib`, which means "libc has not been
+        # built yet".  This causes libgcc's Makefile to use the
+        # gcc-built `{e,n}crt{n,i}.o` instead of failing to find the
+        # versions which have been repackaged in libc as `crt{n,i}.o`
+        #
+        SHLIB_LC = lib.optionalString stdenv.hostPlatform.isPower64 "-mnewlib";
+
+      in
+      ''
+        echo 'libgcc.a: ${crtstuff-ofiles}' >> libgcc/Makefile.in
+        echo 'SHLIB_LC=${SHLIB_LC}' >> libgcc/Makefile.in
+      ''
+
+      # Meanwhile, crt{i,n}.S are not present on certain platforms
+      # (e.g. LoongArch64), resulting in the following error:
+      #
+      # No rule to make target '../../../gcc-xx.x.x/libgcc/config/loongarch/crti.S', needed by 'crti.o'.  Stop.
+      #
+      # For LoongArch64 and S390, a hacky workaround is to simply touch them,
+      # as the platform forces .init_array support.
+      #
+      # https://www.openwall.com/lists/musl/2022/11/09/3
+      #
+      # 'parsed.cpu.family' won't be correct for every platform.
+      + (lib.optionalString
+        (stdenv.hostPlatform.isLoongArch64 || stdenv.hostPlatform.isS390 || stdenv.hostPlatform.isAlpha)
+        ''
+          touch libgcc/config/${stdenv.hostPlatform.parsed.cpu.family}/crt{i,n}.S
+        ''
+      )
+      + lib.optionalString (stdenv.hostPlatform.isPower && !stdenv.hostPlatform.isPower64) ''
+        touch libgcc/config/rs6000/crt{i,n}.S
+      ''
+    )
+
+    # gcc's installed `limits.h` chains to the target libc's with
+    # `#include_next`. Where the compiler has a libc — headers-only or real —
+    # that resolves, and it has to: some targets build libgcc sources that need
+    # what only the libc header defines. Where it does not, the chain has
+    # nowhere to land, and
+    # even configure's `AC_PROG_CPP` probe fails -- it includes `<limits.h>`
+    # precisely because that "exists even on freestanding compilers" -- after
+    # which configure falls back to `/lib/cpp` and reports that as the error.
+    #
+    # Only in that case, put gcc's own `glimits.h` earlier on the include path
+    # for this build. That is the self-contained variant, the same file gcc
+    # installs when configured against no libc, so nothing is invented here.
+    # The compiler keeps shipping the chained header either way, which is what
+    # has to stay correct for everything compiled against a real libc later.
+    + lib.optionalString (libc == null) ''
+      mkdir -p "$NIX_BUILD_TOP/freestanding-include"
+      cp gcc/glimits.h "$NIX_BUILD_TOP/freestanding-include/limits.h"
+      export NIX_CFLAGS_COMPILE="-isystem $NIX_BUILD_TOP/freestanding-include ''${NIX_CFLAGS_COMPILE-}"
+    ''
+    + ''
+      sourceRoot=$(readlink -e "./libgcc")
+    '';
 
   enableParallelBuilding = true;
 
@@ -100,6 +237,35 @@ stdenv.mkDerivation (finalAttrs: {
     cd "$buildRoot/gcc"
 
     (
+  ''
+  # `AS`, `CC`, `CPP` and `LD` still name the *target* tools at this point,
+  # under their machine-prefixed names. Snapshot them before the
+  # `*_FOR_BUILD` assignments below overwrite them.
+  #
+  # Deriving `AS_FOR_TARGET` from `$AS` *after* `AS=$AS_FOR_BUILD` asked for
+  # the basename of the build assembler -- plain `as` -- inside the target
+  # compiler's `bin`, and a cross wrapper installs only prefixed names, so
+  # the path did not exist. Likewise `ld`.
+  #
+  # That is not an error `gcc/configure` reports. It probes the target
+  # assembler and linker for capabilities, and a probe it cannot run simply
+  # records "no"; with neither tool found, *every* `gcc_cv_as_*`/`gcc_cv_ld_*`
+  # answer came back "no". The one that matters here is
+  # `HAVE_LD_EH_FRAME_HDR`: `unwind-dw2-fde-dip.c` gates `USE_PT_GNU_EH_FRAME`
+  # on it, so without it the unwinder is compiled with no `dl_iterate_phdr`
+  # lookup at all -- only the `__register_frame` registry, which nothing
+  # populates for normally linked objects. libgcc and libstdc++ then build,
+  # link and install perfectly cleanly, and every C++ `throw` finds no FDE
+  # and calls `std::terminate`.
+  #
+  # `CPP` in particular is not always exported, so fall back to the
+  # machine-prefixed name the wrappers install.
+  + ''
+    targetAs=$(basename "''${AS:-${stdenv.hostPlatform.config}-as}")
+    targetCc=$(basename "''${CC:-${stdenv.hostPlatform.config}-cc}")
+    targetCpp=$(basename "''${CPP:-${stdenv.hostPlatform.config}-cpp}")
+    targetLd=$(basename "''${LD:-${stdenv.hostPlatform.config}-ld}")
+
     export AS_FOR_BUILD=${lib.getExe' buildPackages.stdenv.cc "$(basename $AS_FOR_BUILD)"}
     export CC_FOR_BUILD=${lib.getExe' buildPackages.stdenv.cc "$(basename $CC_FOR_BUILD)"}
     export CPP_FOR_BUILD=${lib.getExe' buildPackages.stdenv.cc "$(basename $CPP_FOR_BUILD)"}
@@ -112,10 +278,10 @@ stdenv.mkDerivation (finalAttrs: {
     export CXX=$CXX_FOR_BUILD
     export LD=$LD_FOR_BUILD
 
-    export AS_FOR_TARGET=${lib.getExe' stdenv.cc "$(basename $AS)"}
-    export CC_FOR_TARGET=${lib.getExe' stdenv.cc "$(basename $CC)"}
-    export CPP_FOR_TARGET=${lib.getExe' stdenv.cc "$(basename $CPP)"}
-    export LD_FOR_TARGET=${lib.getExe' stdenv.cc.bintools "$(basename $LD)"}
+    export AS_FOR_TARGET=${lib.getExe' stdenv.cc "$targetAs"}
+    export CC_FOR_TARGET=${lib.getExe' stdenv.cc "$targetCc"}
+    export CPP_FOR_TARGET=${lib.getExe' stdenv.cc "$targetCpp"}
+    export LD_FOR_TARGET=${lib.getExe' stdenv.cc.bintools "$targetLd"}
 
     export NIX_CFLAGS_COMPILE_FOR_BUILD+=' -DGENERATOR_FILE=1'
 
@@ -184,6 +350,21 @@ stdenv.mkDerivation (finalAttrs: {
 
     "--with-system-zlib"
   ]
+  # `gcc/configure` sets `inhibit_libc=true` when host != target and
+  # `$target_header_dir/stdio.h` does not exist. `inhibit_libc` makes
+  # `tsystem.h` skip <unistd.h> and friends, which is fine for the generic
+  # sources but breaks the target-specific ones that genuinely need libc
+  # declarations -- the profiling support files are the usual casualty.
+  #
+  # `target_header_dir` is derived from `--with-sysroot`, *not* from
+  # `--with-headers`, so the sysroot pair is what has to be set. Point it at
+  # whichever libc the compiler carries, which in the bootstrap build is the
+  # headers-only one. This affects only the `gcc/configure` run that generates
+  # libgcc's makefile fragments, not the compiler that gets shipped.
+  ++ lib.optionals (libc != null) [
+    "--with-sysroot=${lib.getDev libc}"
+    "--with-native-system-header-dir=/include"
+  ]
   ++
     lib.optional (!stdenv.hostPlatform.isRiscV)
       # RISC-V does not like it being empty
@@ -202,12 +383,12 @@ stdenv.mkDerivation (finalAttrs: {
 
   configureFlags = [
     "--disable-dependency-tracking"
-    "gcc_cv_target_thread_file=single"
+    "gcc_cv_target_thread_file=${threadModel}"
     # $CC cannot link binaries, let alone run then
     "cross_compiling=true"
-    # Do not have dynamic linker without libc
     "--enable-static"
-    "--disable-shared"
+
+    (lib.enableFeature enableShared "shared")
   ];
 
   # Set the variable back the way it was, see corresponding code in
@@ -226,6 +407,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru = {
     isGNU = true;
+    inherit threadModel;
   };
 
   meta = gcc_meta // {
diff --git a/pkgs/development/compilers/gcc/ng/common/libgomp/default.nix b/pkgs/development/compilers/gcc/ng/common/libgomp/default.nix
index 9053e88a80f9..19b74a3da0d9 100644
--- a/pkgs/development/compilers/gcc/ng/common/libgomp/default.nix
+++ b/pkgs/development/compilers/gcc/ng/common/libgomp/default.nix
@@ -13,30 +13,35 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "libgomp";
   inherit version;
 
-  src = runCommand "libgomp-src-${version}" { src = monorepoSrc; } ''
-    runPhase unpackPhase
+  src = runCommand "libgomp-src-${version}" { src = monorepoSrc; } (
+    ''
+      runPhase unpackPhase
 
-    mkdir -p "$out/gcc"
-    cp gcc/BASE-VER "$out/gcc"
-    cp gcc/DATESTAMP "$out/gcc"
+      mkdir -p "$out/gcc"
+      cp gcc/BASE-VER "$out/gcc"
+      cp gcc/DATESTAMP "$out/gcc"
 
-    cp -r libgomp "$out"
-    cp -r include "$out"
+      cp -r libgomp "$out"
+      cp -r include "$out"
 
-    cp -r config "$out"
-    cp -r multilib.am "$out"
-    cp -r libtool.m4 "$out"
+      cp -r config "$out"
+      cp -r multilib.am "$out"
+      cp -r libtool.m4 "$out"
 
-    cp config.guess "$out"
-    cp config.rpath "$out"
-    cp config.sub "$out"
-    cp config-ml.in "$out"
-    cp ltmain.sh "$out"
-    cp install-sh "$out"
-    cp mkinstalldirs "$out"
+      cp config.guess "$out"
+      cp config.rpath "$out"
+      cp config.sub "$out"
+      cp config-ml.in "$out"
+      cp ltmain.sh "$out"
+      cp install-sh "$out"
+      cp mkinstalldirs "$out"
 
-    [[ -f MD5SUMS ]]; cp MD5SUMS "$out"
-  '';
+    ''
+    # `MD5SUMS` exists only in release tarballs, not in a VCS checkout.
+    + ''
+      if [[ -f MD5SUMS ]]; then cp MD5SUMS "$out"; fi
+    ''
+  );
 
   outputs = [
     "out"
diff --git a/pkgs/development/compilers/gcc/ng/common/libiberty/default.nix b/pkgs/development/compilers/gcc/ng/common/libiberty/default.nix
index a83d9580dabc..28a099b9f9fb 100644
--- a/pkgs/development/compilers/gcc/ng/common/libiberty/default.nix
+++ b/pkgs/development/compilers/gcc/ng/common/libiberty/default.nix
@@ -11,26 +11,31 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "libiberty";
   inherit version;
 
-  src = runCommand "libiberty-src-${version}" { src = monorepoSrc; } ''
-    runPhase unpackPhase
+  src = runCommand "libiberty-src-${version}" { src = monorepoSrc; } (
+    ''
+      runPhase unpackPhase
 
-    mkdir -p "$out/gcc"
-    cp gcc/BASE-VER "$out/gcc"
-    cp gcc/DATESTAMP "$out/gcc"
+      mkdir -p "$out/gcc"
+      cp gcc/BASE-VER "$out/gcc"
+      cp gcc/DATESTAMP "$out/gcc"
 
-    cp -r include "$out"
-    cp -r libiberty "$out"
+      cp -r include "$out"
+      cp -r libiberty "$out"
 
-    cp config.guess "$out"
-    cp config.rpath "$out"
-    cp config.sub "$out"
-    cp config-ml.in "$out"
-    cp ltmain.sh "$out"
-    cp install-sh "$out"
-    cp mkinstalldirs "$out"
+      cp config.guess "$out"
+      cp config.rpath "$out"
+      cp config.sub "$out"
+      cp config-ml.in "$out"
+      cp ltmain.sh "$out"
+      cp install-sh "$out"
+      cp mkinstalldirs "$out"
 
-    [[ -f MD5SUMS ]]; cp MD5SUMS "$out"
-  '';
+    ''
+    # `MD5SUMS` exists only in release tarballs, not in a VCS checkout.
+    + ''
+      if [[ -f MD5SUMS ]]; then cp MD5SUMS "$out"; fi
+    ''
+  );
 
   outputs = [
     "out"
diff --git a/pkgs/development/compilers/gcc/ng/common/libquadmath/default.nix b/pkgs/development/compilers/gcc/ng/common/libquadmath/default.nix
index 982b4177b749..41e309459027 100644
--- a/pkgs/development/compilers/gcc/ng/common/libquadmath/default.nix
+++ b/pkgs/development/compilers/gcc/ng/common/libquadmath/default.nix
@@ -11,25 +11,30 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "libquadmath";
   inherit version;
 
-  src = runCommand "libquadmath-src-${version}" { src = monorepoSrc; } ''
-    runPhase unpackPhase
+  src = runCommand "libquadmath-src-${version}" { src = monorepoSrc; } (
+    ''
+      runPhase unpackPhase
 
-    mkdir -p "$out/gcc"
-    cp gcc/BASE-VER "$out/gcc"
-    cp gcc/DATESTAMP "$out/gcc"
+      mkdir -p "$out/gcc"
+      cp gcc/BASE-VER "$out/gcc"
+      cp gcc/DATESTAMP "$out/gcc"
 
-    cp -r libquadmath "$out"
+      cp -r libquadmath "$out"
 
-    cp config.guess "$out"
-    cp config.rpath "$out"
-    cp config.sub "$out"
-    cp config-ml.in "$out"
-    cp ltmain.sh "$out"
-    cp install-sh "$out"
-    cp mkinstalldirs "$out"
+      cp config.guess "$out"
+      cp config.rpath "$out"
+      cp config.sub "$out"
+      cp config-ml.in "$out"
+      cp ltmain.sh "$out"
+      cp install-sh "$out"
+      cp mkinstalldirs "$out"
 
-    [[ -f MD5SUMS ]]; cp MD5SUMS "$out"
-  '';
+    ''
+    # `MD5SUMS` exists only in release tarballs, not in a VCS checkout.
+    + ''
+      if [[ -f MD5SUMS ]]; then cp MD5SUMS "$out"; fi
+    ''
+  );
 
   sourceRoot = "${finalAttrs.src.name}/libquadmath";
 
diff --git a/pkgs/development/compilers/gcc/ng/common/libsanitizer/default.nix b/pkgs/development/compilers/gcc/ng/common/libsanitizer/default.nix
index b42736d122bd..c90ed42e5848 100644
--- a/pkgs/development/compilers/gcc/ng/common/libsanitizer/default.nix
+++ b/pkgs/development/compilers/gcc/ng/common/libsanitizer/default.nix
@@ -12,25 +12,30 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "libsanitizer";
   inherit version;
 
-  src = runCommand "libsanitizer-src-${version}" { src = monorepoSrc; } ''
-    runPhase unpackPhase
+  src = runCommand "libsanitizer-src-${version}" { src = monorepoSrc; } (
+    ''
+      runPhase unpackPhase
 
-    mkdir -p "$out/gcc"
-    cp gcc/BASE-VER "$out/gcc"
-    cp gcc/DATESTAMP "$out/gcc"
+      mkdir -p "$out/gcc"
+      cp gcc/BASE-VER "$out/gcc"
+      cp gcc/DATESTAMP "$out/gcc"
 
-    cp -r libsanitizer "$out"
+      cp -r libsanitizer "$out"
 
-    cp config.guess "$out"
-    cp config.rpath "$out"
-    cp config.sub "$out"
-    cp config-ml.in "$out"
-    cp ltmain.sh "$out"
-    cp install-sh "$out"
-    cp mkinstalldirs "$out"
+      cp config.guess "$out"
+      cp config.rpath "$out"
+      cp config.sub "$out"
+      cp config-ml.in "$out"
+      cp ltmain.sh "$out"
+      cp install-sh "$out"
+      cp mkinstalldirs "$out"
 
-    [[ -f MD5SUMS ]]; cp MD5SUMS "$out"
-  '';
+    ''
+    # `MD5SUMS` exists only in release tarballs, not in a VCS checkout.
+    + ''
+      if [[ -f MD5SUMS ]]; then cp MD5SUMS "$out"; fi
+    ''
+  );
 
   sourceRoot = "${finalAttrs.src.name}/libsanitizer";
 
diff --git a/pkgs/development/compilers/gcc/ng/common/libssp/default.nix b/pkgs/development/compilers/gcc/ng/common/libssp/default.nix
index bcc5d4b9c2e3..45840d75f3bb 100644
--- a/pkgs/development/compilers/gcc/ng/common/libssp/default.nix
+++ b/pkgs/development/compilers/gcc/ng/common/libssp/default.nix
@@ -14,28 +14,33 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "libssp";
   inherit version;
 
-  src = runCommand "libssp-src-${version}" { src = monorepoSrc; } ''
-    runPhase unpackPhase
+  src = runCommand "libssp-src-${version}" { src = monorepoSrc; } (
+    ''
+      runPhase unpackPhase
 
-    mkdir -p "$out/gcc"
-    cp gcc/BASE-VER "$out/gcc"
-    cp gcc/DATESTAMP "$out/gcc"
+      mkdir -p "$out/gcc"
+      cp gcc/BASE-VER "$out/gcc"
+      cp gcc/DATESTAMP "$out/gcc"
 
-    cp -r libssp "$out"
+      cp -r libssp "$out"
 
-    cp -r config "$out"
-    cp -r multilib.am "$out"
+      cp -r config "$out"
+      cp -r multilib.am "$out"
 
-    cp config.guess "$out"
-    cp config.rpath "$out"
-    cp config.sub "$out"
-    cp config-ml.in "$out"
-    cp ltmain.sh "$out"
-    cp install-sh "$out"
-    cp mkinstalldirs "$out"
+      cp config.guess "$out"
+      cp config.rpath "$out"
+      cp config.sub "$out"
+      cp config-ml.in "$out"
+      cp ltmain.sh "$out"
+      cp install-sh "$out"
+      cp mkinstalldirs "$out"
 
-    [[ -f MD5SUMS ]]; cp MD5SUMS "$out"
-  '';
+    ''
+    # `MD5SUMS` exists only in release tarballs, not in a VCS checkout.
+    + ''
+      if [[ -f MD5SUMS ]]; then cp MD5SUMS "$out"; fi
+    ''
+  );
 
   outputs = [
     "out"
diff --git a/pkgs/development/compilers/gcc/ng/common/libstdcxx/default.nix b/pkgs/development/compilers/gcc/ng/common/libstdcxx/default.nix
index 8e43df2ab635..08865b5ff519 100644
--- a/pkgs/development/compilers/gcc/ng/common/libstdcxx/default.nix
+++ b/pkgs/development/compilers/gcc/ng/common/libstdcxx/default.nix
@@ -10,41 +10,55 @@
   autoreconfHook269,
   runCommand,
   gettext,
+  libgcc,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "libstdcxx";
   inherit version;
 
-  src = runCommand "libstdcxx-src-${version}" { src = monorepoSrc; } ''
-    runPhase unpackPhase
+  src = runCommand "libstdcxx-src-${version}" { src = monorepoSrc; } (
+    ''
+      runPhase unpackPhase
 
-    mkdir -p "$out/gcc"
-    cp gcc/BASE-VER "$out/gcc"
-    cp gcc/DATESTAMP "$out/gcc"
+      mkdir -p "$out/gcc"
+      cp gcc/BASE-VER "$out/gcc"
+      cp gcc/DATESTAMP "$out/gcc"
 
-    mkdir -p "$out/libgcc"
-    cp libgcc/gthr*.h "$out/libgcc"
-    cp libgcc/unwind-pe.h "$out/libgcc"
+      mkdir -p "$out/libgcc"
+      cp libgcc/gthr*.h "$out/libgcc"
+      cp libgcc/unwind-pe.h "$out/libgcc"
 
-    cp -r libstdc++-v3 "$out"
+      cp -r libstdc++-v3 "$out"
 
-    cp -r libiberty "$out"
-    cp -r include "$out"
-    cp -r contrib "$out"
+      cp -r libiberty "$out"
+      cp -r include "$out"
+      cp -r contrib "$out"
 
-    cp -r config "$out"
-    cp -r multilib.am "$out"
+      cp -r config "$out"
+      cp -r multilib.am "$out"
 
-    cp config.guess "$out"
-    cp config.rpath "$out"
-    cp config.sub "$out"
-    cp config-ml.in "$out"
-    cp ltmain.sh "$out"
-    cp install-sh "$out"
-    cp mkinstalldirs "$out"
+      cp config.guess "$out"
+      cp config.rpath "$out"
+      cp config.sub "$out"
+      cp config-ml.in "$out"
+      cp ltmain.sh "$out"
+      cp install-sh "$out"
+      cp mkinstalldirs "$out"
 
-    [[ -f MD5SUMS ]]; cp MD5SUMS "$out"
-  '';
+    ''
+    # `src/Makefile` runs this to compute `LTLDFLAGS`, reaching out of the
+    # subdirectory for it as `$(top_srcdir)/../libtool-ldflags`. Missing, the
+    # shell says "No such file or directory" and `LTLDFLAGS` silently comes out
+    # empty, dropping our `LDFLAGS` from every library link.
+    + ''
+      cp libtool-ldflags "$out"
+
+    ''
+    # `MD5SUMS` exists only in release tarballs, not in a VCS checkout.
+    + ''
+      if [[ -f MD5SUMS ]]; then cp MD5SUMS "$out"; fi
+    ''
+  );
 
   outputs = [
     "out"
@@ -85,6 +99,59 @@ stdenv.mkDerivation (finalAttrs: {
     cd "$buildRoot"
     configureScript=$sourceRoot/configure
     chmod +x "$configureScript"
+
+  ''
+  # Build libstdc++ with the *C* driver, not `g++`. `g++` implies `-lstdc++`,
+  # which cannot be satisfied while building the very library that provides
+  # it, and the link fails with `cannot find -lstdc++`.
+  #
+  # This is not our invention; it is what a monolithic build does, and
+  # `libstdc++-v3/src/Makefile.am` says so where it defines `CXXLINK`:
+  #
+  #     We cannot allow g++ to be used since this would add -lstdc++ to the
+  #     link line which of course is problematic at this point.  So, we get
+  #     the top-level directory to configure libstdc++-v3 to use gcc as the
+  #     C++ compilation driver.
+  #
+  # The top level does that through `RAW_CXX_FOR_TARGET`, which is `xgcc`
+  # -- not `xg++` -- plus `-shared-libgcc` and `-nostdinc++`. Building
+  # standalone there is no top level to arrange it, so arrange it here. The
+  # C driver still compiles `.cc` as C++ by extension; what it drops is the
+  # implicit `-lstdc++`. `-shared-libgcc` puts back the linkage `g++` would
+  # have chosen, which the C driver does not default to, and `-nostdinc++`
+  # keeps any already-installed C++ headers out of a build whose whole
+  # purpose is to produce them.
+  + ''
+    cxxForLibstdcxx="$CC -shared-libgcc -nostdinc++"
+
+  ''
+  # Put libgcc's `gthr-default.h` where libstdc++ expects to find it.
+  #
+  # It is not a source file. In a monolithic build libgcc's Makefile creates
+  # it by copying whichever `gthr-<model>.h` matches the target's thread
+  # model, and libstdc++ -- configured inside that same build tree -- picks
+  # it up. Standalone there is no such tree, so take the one `libgcc`
+  # installed. The two implement a single threading model between them, and
+  # copying libgcc's own answer is what makes them agree by construction
+  # rather than by two independent guesses that can drift apart. `libgcc`
+  # decided it from the libc; `gcc_cv_target_thread_file` below repeats the
+  # same value.
+  #
+  # The consequence of getting this wrong is worth spelling out, because the
+  # installed headers do not show it. `GLIBCXX_CHECK_GTHREADS` compiles
+  # `#include "gthr.h"` and requires `__GTHREADS_CXX0X`, which
+  # `gthr-posix.h` defines unconditionally. With no posix `gthr-default.h`
+  # on the include path that test fails, configure concludes there are no
+  # gthreads, and `_GLIBCXX_HAS_GTHREADS` is left undefined in
+  # `c++config.h` -- so `<mutex>` compiles away and `std::mutex` does not
+  # exist. Stating the intent with `--enable-threads=posix` does not help:
+  # the probe overrides intent with an empirical answer, so the header has
+  # to actually be there.
+  + ''
+    cp ${lib.getDev libgcc}/include/gthr-default.h "$sourceRoot/../libgcc/gthr-default.h"
+
+    export CXX="$cxxForLibstdcxx"
+    echo "libstdcxx: building with CXX=$CXX"
   '';
 
   configurePlatforms = [
@@ -94,11 +161,19 @@ stdenv.mkDerivation (finalAttrs: {
 
   configureFlags = [
     "--disable-dependency-tracking"
-    "gcc_cv_target_thread_file=posix"
+    # The same answer `libgcc` used, and the model of the `gthr-default.h`
+    # copied in above. A mismatch here is silent: the unwinder's locks vanish
+    # while `libstdc++` still hands out `std::thread`.
+    "gcc_cv_target_thread_file=${libgcc.threadModel}"
     "cross_compiling=true"
     "--disable-multilib"
 
-    "--enable-clocale=gnu"
+    # `gnu` is the glibc locale model: `config/locale/gnu/ctype_members.cc`
+    # reads `__ctype_b`, which only glibc has. Forcing it everywhere breaks any
+    # other libc -- on musl the build fails converting `const unsigned short *`
+    # to `const ctype_base::mask *`. Configure picks the right model from the
+    # host triple on its own, as it does for the monolithic build, which passes
+    # no `--enable-clocale` at all.
     "--disable-libstdcxx-pch"
     "--disable-vtable-verify"
     "--enable-libstdcxx-visibility"
diff --git a/pkgs/development/compilers/llvm/common/flang-rt/default.nix b/pkgs/development/compilers/llvm/common/flang-rt/default.nix
index 01a1d6ca8584..40944ccf2adc 100644
--- a/pkgs/development/compilers/llvm/common/flang-rt/default.nix
+++ b/pkgs/development/compilers/llvm/common/flang-rt/default.nix
@@ -15,7 +15,10 @@ let
 
   minDarwinVersion = "10.12";
   effectiveDarwinVersion =
-    if stdenv.isDarwin && lib.versionOlder stdenv.hostPlatform.darwinMinVersion minDarwinVersion then
+    if
+      stdenv.hostPlatform.isDarwin
+      && lib.versionOlder stdenv.hostPlatform.darwinMinVersion minDarwinVersion
+    then
       minDarwinVersion
     else
       stdenv.hostPlatform.darwinMinVersion;
@@ -57,7 +60,7 @@ stdenv.mkDerivation (finalAttrs: {
     libllvm
   ];
 
-  env = lib.optionalAttrs stdenv.isDarwin {
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
     MACOSX_DEPLOYMENT_TARGET = effectiveDarwinVersion;
     NIX_CFLAGS_COMPILE = "-mmacosx-version-min=${effectiveDarwinVersion}";
   };
@@ -70,7 +73,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeFeature "LLVM_DIR" "${libllvm.dev}/lib/cmake/llvm")
     (lib.cmakeFeature "LLVM_ENABLE_RUNTIMES" "flang-rt")
   ]
-  ++ lib.optionals stdenv.isDarwin [
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
     (lib.cmakeFeature "CMAKE_OSX_DEPLOYMENT_TARGET" effectiveDarwinVersion)
   ];
 
diff --git a/pkgs/development/compilers/smlnj/bootstrap.nix b/pkgs/development/compilers/smlnj/bootstrap.nix
deleted file mode 100644
index ec9db0755fdc..000000000000
--- a/pkgs/development/compilers/smlnj/bootstrap.nix
+++ /dev/null
@@ -1,60 +0,0 @@
-# This derivation should be redundant, now that regular smlnj works on Darwin,
-# and is preserved only for pre-existing direct usage. New use cases should
-# just use the regular smlnj derivation.
-
-{
-  lib,
-  stdenv,
-  fetchurl,
-  cpio,
-  rsync,
-  xar,
-  makeWrapper,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "smlnj-bootstrap";
-
-  version = "110.91";
-
-  src = fetchurl {
-    url = "http://smlnj.cs.uchicago.edu/dist/working/${version}/smlnj-x86-${version}.pkg";
-    sha256 = "12jn50h5jz0ac1vzld2mb94p1dyc8h0mk0hip2wj5xqk1dbzwxl4";
-  };
-
-  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [
-    cpio
-    rsync
-  ];
-
-  unpackPhase = ''
-    ${xar}/bin/xar -xf $src
-    cd smlnj.pkg
-  '';
-
-  buildPhase = ''
-    cat Payload | gunzip -dc | cpio -i
-  '';
-
-  installPhase = ''
-    mkdir -p $out/bin
-    rsync -av bin/ $out/bin/
-
-    mkdir -p $out/lib
-    rsync -av lib/ $out/lib/
-  '';
-
-  postInstall = ''
-    wrapProgram "$out/bin/sml" --set "SMLNJ_HOME" "$out"
-  '';
-
-  meta = {
-    description = "Compiler for the Standard ML '97 programming language";
-    homepage = "http://www.smlnj.org";
-    license = lib.licenses.free;
-    platforms = lib.platforms.darwin;
-    maintainers = [ lib.maintainers.jwiegley ];
-    mainProgram = "sml";
-  };
-}
diff --git a/pkgs/development/compilers/swift/wrapper/default.nix b/pkgs/development/compilers/swift/wrapper/default.nix
index e446bec66868..b3c42685a4cf 100644
--- a/pkgs/development/compilers/swift/wrapper/default.nix
+++ b/pkgs/development/compilers/swift/wrapper/default.nix
@@ -53,7 +53,6 @@ stdenv.mkDerivation (
       stdenv.targetPlatform.darwinMinVersion
     );
 
-    passAsFile = [ "buildCommand" ];
     buildCommand = ''
       mkdir -p $out/bin $out/nix-support
 
diff --git a/pkgs/development/coq-modules/CertiRocq/default.nix b/pkgs/development/coq-modules/CertiRocq/default.nix
index cf012f592dfb..358b7ff3f29a 100644
--- a/pkgs/development/coq-modules/CertiRocq/default.nix
+++ b/pkgs/development/coq-modules/CertiRocq/default.nix
@@ -1,7 +1,5 @@
 {
   lib,
-  pkgs,
-  pkg-config,
   mkCoqDerivation,
   coq,
   wasmcert,
@@ -45,10 +43,6 @@ mkCoqDerivation {
   };
   releaseRev = v: "v${v}";
 
-  buildInputs = [
-    pkgs.clang
-  ];
-
   propagatedBuildInputs = [
     wasmcert
     compcert
@@ -57,10 +51,17 @@ mkCoqDerivation {
     metarocq-safechecker-plugin
   ];
 
-  patchPhase = ''
+  postPatch = ''
     patchShebangs ./configure.sh
     patchShebangs ./clean_extraction.sh
     patchShebangs ./make_plugin.sh
+
+    # drop after  https://github.com/CertiRocq/certirocq/pull/162
+    substituteInPlace runtime/Makefile \
+      --replace-fail "gcc -I /opt/homebrew/include" '$(CC)'
+    substituteInPlace clean_extraction.sh \
+      --replace-fail "mv aST.ml AST.ml" "mv aST.ml AST.ml.tmp && mv AST.ml.tmp AST.ml" \
+      --replace-fail "mv aST.mli AST.mli" "mv aST.mli AST.mli.tmp && mv AST.mli.tmp AST.mli"
   '';
 
   configurePhase = ''
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index fc4cd0db1219..13272e207d5e 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -35,10 +35,10 @@
       sourceVersion = {
         major = "3";
         minor = "11";
-        patch = "15";
+        patch = "16";
         suffix = "";
       };
-      hash = "sha256-JyF53dmi5BoPyOQuM9+9ygs3EapavzctPy1RVD0JtiU=";
+      hash = "sha256-kbzev93iOaADrpNzin/OD5Iw/uXEvCuG9uboxvmKq+g=";
       inherit passthruFun;
     };
 
@@ -47,10 +47,10 @@
       sourceVersion = {
         major = "3";
         minor = "12";
-        patch = "13";
+        patch = "14";
         suffix = "";
       };
-      hash = "sha256-wIvGWoGXHB3VeDGCgmUDNpRmx+ZzdNFkZRmt8FIHtoQ=";
+      hash = "sha256-XIRir1eQuvQ6MhoVWdvg2wbRvkMA+4X7U8QAYGaOVIo=";
       inherit passthruFun;
     };
 
diff --git a/pkgs/development/lean-modules/mathlib/default.nix b/pkgs/development/lean-modules/mathlib/default.nix
index 8b76f66964c4..eda7d235adba 100644
--- a/pkgs/development/lean-modules/mathlib/default.nix
+++ b/pkgs/development/lean-modules/mathlib/default.nix
@@ -72,11 +72,11 @@ in
 runCommand mathlib__archive.name
   {
     nativeBuildInputs = [ leangz-raw ];
+    inherit (mathlib__archive) pname version;
     passthru = {
       inherit mathlib__archive;
       inherit (mathlib__archive)
         src
-        version
         lakePackageName
         lean4
         allLeanDeps
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index 2181d2e4a26d..0188703a78fc 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -70,20 +70,20 @@
   withDav1d ? withHeadlessDeps, # AV1 decoder (focused on speed and correctness)
   withDavs2 ? withFullDeps && withGPL, # AVS2 decoder
   withDc1394 ? withFullDeps && !stdenv.hostPlatform.isDarwin, # IIDC-1394 grabbing (ieee 1394)
-  withDrm ? withHeadlessDeps && (with stdenv; isLinux || isFreeBSD), # libdrm support
+  withDrm ? withHeadlessDeps && (with stdenv.hostPlatform; isLinux || isFreeBSD), # libdrm support
   withDvdnav ? withFullDeps && withGPL && lib.versionAtLeast version "7", # needed for DVD demuxing
   withDvdread ? withFullDeps && withGPL && lib.versionAtLeast version "7", # needed for DVD demuxing
   withFdkAac ? withFullDeps && (!withGPL || withUnfree), # Fraunhofer FDK AAC de/encoder
   withNvcodec ?
     withHeadlessDeps
     && (
-      with stdenv;
+      with stdenv.hostPlatform;
       !isDarwin
       && !isAarch32
-      && !hostPlatform.isLoongArch64
-      && !hostPlatform.isRiscV
-      && !(hostPlatform.isPower && hostPlatform.isBigEndian)
-      && hostPlatform == buildPlatform
+      && !isLoongArch64
+      && !isRiscV
+      && !(isPower && isBigEndian)
+      && stdenv.hostPlatform == stdenv.buildPlatform
     ), # dynamically linked Nvidia code
   withFlite ? withFullDeps, # Voice Synthesis
   withFontconfig ? withHeadlessDeps, # Needed for drawtext filter
@@ -152,8 +152,8 @@
   withUavs3d ? withFullDeps, # AVS3 decoder
   withV4l2 ? withHeadlessDeps && stdenv.hostPlatform.isLinux, # Video 4 Linux support
   withV4l2M2m ? withV4l2,
-  withVaapi ? withHeadlessDeps && (with stdenv; isLinux || isFreeBSD), # Vaapi hardware acceleration
-  withVdpau ? withSmallDeps && (with stdenv; isLinux || isFreeBSD), # Vdpau hardware acceleration
+  withVaapi ? withHeadlessDeps && (with stdenv.hostPlatform; isLinux || isFreeBSD), # Vaapi hardware acceleration
+  withVdpau ? withSmallDeps && (with stdenv.hostPlatform; isLinux || isFreeBSD), # Vdpau hardware acceleration
   withVidStab ? withHeadlessDeps && withGPL, # Video stabilization
   withVmaf ? withFullDeps && lib.versionAtLeast version "5", # Netflix's VMAF (Video Multi-Method Assessment Fusion)
   withVoAmrwbenc ? withFullDeps && withVersion3, # AMR-WB encoder
diff --git a/pkgs/development/libraries/fmt/default.nix b/pkgs/development/libraries/fmt/default.nix
index 641a91d75629..6c63ba589886 100644
--- a/pkgs/development/libraries/fmt/default.nix
+++ b/pkgs/development/libraries/fmt/default.nix
@@ -106,7 +106,7 @@ in
     version = "12.2.0";
     hash = "sha256-Tc7PmNxUv7ajw6GaHPGEEtrD/fl6is7RB8TPestJa1o=";
 
-    patches = lib.optionals stdenv.is32bit [
+    patches = lib.optionals stdenv.hostPlatform.is32bit [
       # fix build on 32-bit targets
       # FIXME: remove in next update
       (fetchpatch {
diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 5e391970a271..6ce41321494e 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -278,6 +278,11 @@ stdenv.mkDerivation (
     passthru = {
       inherit version;
       minorRelease = version;
+
+      # glibc's threads are POSIX threads. `libgcc` and `libstdc++` have to be
+      # configured for the same threading model as each other, so rather than
+      # have each guess, they take it from the libc they are built against.
+      threadModel = "posix";
     };
   }
 
diff --git a/pkgs/development/libraries/gstreamer/devtools/default.nix b/pkgs/development/libraries/gstreamer/devtools/default.nix
index e1e8cf9e4637..55421dc2010e 100644
--- a/pkgs/development/libraries/gstreamer/devtools/default.nix
+++ b/pkgs/development/libraries/gstreamer/devtools/default.nix
@@ -88,6 +88,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   mesonFlags = [
     (lib.mesonEnable "doc" enableDocumentation)
+    # dots-viewer requires nix 0.23.2, which is too old to build on loongarch64
+    (lib.mesonEnable "dots_viewer" (!stdenv.hostPlatform.isLoongArch64))
   ];
 
   cargoRoot = "dots-viewer";
diff --git a/pkgs/development/libraries/scenefx/default.nix b/pkgs/development/libraries/scenefx/default.nix
index b6ecb7a9c080..de3618403a86 100644
--- a/pkgs/development/libraries/scenefx/default.nix
+++ b/pkgs/development/libraries/scenefx/default.nix
@@ -88,7 +88,7 @@ let
     });
 
 in
-{
+rec {
   scenefx_0_4 = generic {
     version = "0.4.1";
     hash = "sha256-XD5EcquaHBg5spsN06fPHAjVCb1vOMM7oxmjZZ/PxIE=";
@@ -101,4 +101,6 @@ in
     wlroots = wlroots_0_20;
     extraBuildInputs = [ lcms2 ];
   };
+
+  scenefx = scenefx_0_5;
 }
diff --git a/pkgs/development/libraries/valhalla/default.nix b/pkgs/development/libraries/valhalla/default.nix
index 565477d03b26..d04e95489d14 100644
--- a/pkgs/development/libraries/valhalla/default.nix
+++ b/pkgs/development/libraries/valhalla/default.nix
@@ -49,6 +49,11 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "ENABLE_TESTS" false)
     (lib.cmakeBool "ENABLE_SINGLE_FILES_WERROR" false)
     (lib.cmakeBool "PREFER_EXTERNAL_DEPS" true)
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    # On darwin Valhalla only looks at the Homebrew paths
+    (lib.cmakeFeature "SQLITE3_INCLUDE_DIR" "${lib.getDev sqlite}/include")
+    (lib.cmakeFeature "SQLITE3_LIBRARY" "${lib.getLib sqlite}/lib/libsqlite3.dylib")
   ];
 
   buildInputs = [
@@ -83,6 +88,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.Thra11 ];
     pkgConfigModules = [ "libvalhalla" ];
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.unix;
   };
 })
diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index e3f874b6a4ca..eac1b5633676 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -917,6 +917,41 @@ final: prev: {
     }
   ) { };
 
+  fallo = callPackage (
+    {
+      buildLuarocksPackage,
+      fetchFromGitHub,
+      fetchurl,
+      lua-cjson,
+      luaOlder,
+    }:
+    buildLuarocksPackage {
+      pname = "fallo";
+      version = "2.3.0-1";
+      knownRockspec =
+        (fetchurl {
+          url = "mirror://luarocks/fallo-2.3.0-1.rockspec";
+          sha256 = "14mxxd6nfbx5bchp3i5c0nf93higak6l7506r8jnh30yafyr01cq";
+        }).outPath;
+      src = fetchFromGitHub {
+        owner = "NTBBloodbath";
+        repo = "fallo";
+        rev = "8bbbcd6b3db8c10ed68f51c2c6d79af99e5feed7";
+        hash = "sha256-KW3vzjAd68Q13v2OZoQIzNUj9/qhYh1Ve5dBIG+yuV0=";
+      };
+
+      disabled = luaOlder "5.1";
+      propagatedBuildInputs = [ lua-cjson ];
+
+      meta = {
+        homepage = "https://github.com/NTBBloodbath/fallo";
+        maintainers = with lib.maintainers; [ mrcjkb ];
+        license.fullName = "LGPL-2.0-only";
+        description = "Modern and ergonomic error handling for Lua, inspired by Rust's Result.";
+      };
+    }
+  ) { };
+
   fennel = callPackage (
     {
       buildLuarocksPackage,
diff --git a/pkgs/development/php-packages/relay/default.nix b/pkgs/development/php-packages/relay/default.nix
index 6e4627a67e43..52c9e145f39e 100644
--- a/pkgs/development/php-packages/relay/default.nix
+++ b/pkgs/development/php-packages/relay/default.nix
@@ -16,36 +16,36 @@
 }:
 
 let
-  version = "0.30.0";
+  version = "0.40.0";
   hashes = {
     "aarch64-darwin" = {
       platform = "darwin-arm64";
       hash = {
-        "8.1" = "sha256-71TLrF9HvuocMLei89bGIibJIC1sD59RB9Vb6FBS49U=";
-        "8.2" = "sha256-WFrJ0+gun1qs77s3URFTha/tZA8gSeqlGLT26twnjko=";
-        "8.3" = "fiduW1NKScDDY3k3lvw98r8KqaD0jPR4En8dNvdglFA=";
-        "8.4" = "sha256-SQ9+/zD6n49e2/9nH6hotyIJ/xsQMX5A78hFTPK4/hg=";
-        "8.5" = "+n+fE5soEbruH+L35B+bapU/Z7rSjjOD/4BgRmr3MVc=";
+        "8.1" = "sha256-pwqus2P17DirEGqwbe5CqlIZ+InPrIHbUUbcgLli8rc=";
+        "8.2" = "sha256-IeoOYVnp0sWD+Ww/d8DwDemqXv/6neEWE3g2txHEuEg=";
+        "8.3" = "OQAErtNtCIpNmz2YbfhLJ9ueH7mhZa6j1YtcuH00Ob8=";
+        "8.4" = "sha256-WP283JJfXQTnfbnyLfs0j8IIcdDGflCFtV0WxBV/JLU=";
+        "8.5" = "0zH1RD2Uq5uG4TnUsYzsYgUdUshsKNU0kzbdNG77sd8=";
       };
     };
     "aarch64-linux" = {
       platform = "debian-aarch64+libssl3";
       hash = {
-        "8.1" = "sha256-hetG8fEmMJccYWMQwPb3hml5thNeY2L6Y4gCDQmbDlo=";
-        "8.2" = "sha256-HufvcT4QSkuoxDcaCWD+hmG1fORyTUBh1Vsfnv7krng=";
-        "8.3" = "sha256-LV4coud7YNqB+s1sHoKXNVLAUrLjDMDpulS9fGVXDsg=";
-        "8.4" = "em1nZgGD1fAtvMxVeJBU4RZaA71/qMVLi0KCRAbilpM=";
-        "8.5" = "d0f3PzvZZn1KmXy1Gm0gm5f3f58kt+/LTc3yWZqto2I=";
+        "8.1" = "sha256-r6rV05ZLsi2SvFqONtYk2IIrkdbTZqsClruTMpcOOas=";
+        "8.2" = "sha256-SsHqRS3Bq4N10c06zEoVZXTv5+bfkcDgCRdntcoyD/k=";
+        "8.3" = "sha256-yQunez9xOyhGYqFKHKWtdK8BiGPz3JIyDnsfqGthIYs=";
+        "8.4" = "bC/67qQxe/Zy027r8c7tWr6S6Seeh+lbjYEl+cE7HNw=";
+        "8.5" = "3KWlZxbO8u5hpN/PsKzgCbNUhWHb56SqgNwTL8iHtSs=";
       };
     };
     "x86_64-linux" = {
       platform = "debian-x86-64+libssl3";
       hash = {
-        "8.1" = "sha256-La/TQDnQ0hqNhPMtLlwfw5cKtXCpjxBMTd6yvZM2O2M=";
-        "8.2" = "sha256-+FavbnliF071lWFU55rhFNq6X2wpW9mHSstwQQTbnwQ=";
-        "8.3" = "sha256-G6nfKMObVMtY45J7DaKg0LdHwV+lfCUa1Pkfp66+apY=";
-        "8.4" = "x9YXGxtqN3EL1lWCqAkIKKrO0b40BFalO6GExhF3p4c=";
-        "8.5" = "8hU5Ft9i3L6pf2XY7rRLmSbQmZ3z1wjI+7sjiq/GHUU=";
+        "8.1" = "sha256-KgyAPCLLtmeMa5X3Akuf0nR51aSQS6+RpNYO3U4Zdp0=";
+        "8.2" = "sha256-zSl141iQ3Vfb5JmeRacFZhBcfEKQuW9rld9O2c8HRvU=";
+        "8.3" = "sha256-kdd4k6xdbbNuIk/DBTufxqH8j+4Z2xgzG4Z/c7PfKFs=";
+        "8.4" = "jteJPpdxFSBljS81Jn9x6cLLn3iLVpqeGb3qecWFw4c=";
+        "8.5" = "uFZj/cDsd6LhIeaj3IdB3Kl9btnkS/eEVfLdYhh4Mus=";
       };
     };
   };
diff --git a/pkgs/development/python-modules/aio-geojson-usgs-earthquakes/default.nix b/pkgs/development/python-modules/aio-geojson-usgs-earthquakes/default.nix
index 3bf8f81dc341..142282ff0dd3 100644
--- a/pkgs/development/python-modules/aio-geojson-usgs-earthquakes/default.nix
+++ b/pkgs/development/python-modules/aio-geojson-usgs-earthquakes/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "aio-geojson-usgs-earthquakes";
-  version = "2026.6.0";
+  version = "2026.8.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "exxamalte";
     repo = "python-aio-geojson-usgs-earthquakes";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Faz4411UuPE1L/FWcn41l2ZiFVn0s4Pp2YgYhznEzqg=";
+    hash = "sha256-ymmO43USHiu11SRmirkJfjKZayD7eRv057uPhtZLWx0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/aioghost/default.nix b/pkgs/development/python-modules/aioghost/default.nix
index db86aafd313b..35fdc9bd8020 100644
--- a/pkgs/development/python-modules/aioghost/default.nix
+++ b/pkgs/development/python-modules/aioghost/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "aioghost";
-  version = "0.4.22";
+  version = "0.4.23";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TryGhost";
     repo = "aioghost";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-UGRi+MoKkh/muxwubMG4DySTpK/lqmGCloWznFvN2pc=";
+    hash = "sha256-bgWBZvkHkUE1o2a6L6vC1YK41Da0SayPhTLJeTbnYxk=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/aiopnsense/default.nix b/pkgs/development/python-modules/aiopnsense/default.nix
index 20814cab7208..310cb1a54d7f 100644
--- a/pkgs/development/python-modules/aiopnsense/default.nix
+++ b/pkgs/development/python-modules/aiopnsense/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "aiopnsense";
-  version = "1.1.5";
+  version = "1.1.7";
   pyproject = true;
 
   disabled = pythonOlder "3.14";
@@ -24,7 +24,7 @@ buildPythonPackage (finalAttrs: {
     owner = "Snuffy2";
     repo = "aiopnsense";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-amXqUp77L72fv6xxz4Nm7fMj4xxWaYrsy1EPxccKm+Q=";
+    hash = "sha256-xVbbbhxQMNeK56d4k274Z8+X8ggScJjYKH9V4CfwrRk=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/ansi2image/default.nix b/pkgs/development/python-modules/ansi2image/default.nix
index 017f2434d91f..b30e172cbbb3 100644
--- a/pkgs/development/python-modules/ansi2image/default.nix
+++ b/pkgs/development/python-modules/ansi2image/default.nix
@@ -20,6 +20,12 @@ buildPythonPackage (finalAttrs: {
     hash = "sha256-3nTCWyWfFs1NqUGIvYO3ao9MnOMtrq1fmTihLwSky60=";
   };
 
+  postPatch = ''
+    substituteInPlace ansi2image/__meta__.py \
+      --replace-fail "__version__ = '0.1.4'" "__version__ = '${finalAttrs.version}'" \
+      --replace-fail "__version_tuple__ = version_tuple = (0, 1, 4)" "__version_tuple__ = version_tuple = (${lib.concatStringsSep ", " (lib.splitString "." finalAttrs.version)})"
+  '';
+
   build-system = [ setuptools ];
 
   dependencies = [
@@ -35,10 +41,10 @@ buildPythonPackage (finalAttrs: {
 
   meta = {
     description = "Module to convert ANSI text to an image";
-    mainProgram = "ansi2image";
     homepage = "https://github.com/helviojunior/ansi2image";
     changelog = "https://github.com/helviojunior/ansi2image/blob/${finalAttrs.version}/CHANGELOG";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "ansi2image";
   };
 })
diff --git a/pkgs/development/python-modules/bambi/default.nix b/pkgs/development/python-modules/bambi/default.nix
index d46086b896c6..4111bab8b64e 100644
--- a/pkgs/development/python-modules/bambi/default.nix
+++ b/pkgs/development/python-modules/bambi/default.nix
@@ -28,7 +28,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "bambi";
-  version = "0.19.0";
+  version = "0.20.0";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -36,7 +36,7 @@ buildPythonPackage (finalAttrs: {
     owner = "bambinos";
     repo = "bambi";
     tag = finalAttrs.version;
-    hash = "sha256-2BLbvdVN+wkmP2NCGaBoJO10hbBXUJ1/Q7bjRN4idWM=";
+    hash = "sha256-eTqqcVP+ucQ2Sv9mTyMOUdmYYX0pkrsH76DGQKPGO0k=";
   };
 
   build-system = [
@@ -93,27 +93,32 @@ buildPythonPackage (finalAttrs: {
 
     # Tests require network access
     "test_alias_equal_to_name"
-    "test_exclusion"
-    "test_inplace_false"
     "test_average_by"
     "test_ax"
     "test_basic"
+    "test_categorical_and_interactions"
     "test_censored_response"
     "test_custom_prior"
     "test_data_is_copied"
     "test_distributional_model"
     "test_elasticity"
+    "test_exclusion"
     "test_extra_namespace"
     "test_fig_kwargs"
     "test_gamma_with_splines"
     "test_group_effects"
     "test_hdi_prob"
+    "test_inplace_false"
     "test_legend"
     "test_model_with_group_specific_effects"
     "test_model_with_intercept"
     "test_model_without_intercept"
+    "test_no_offsets_when_centered_parametrization"
     "test_non_distributional_model"
     "test_normal_with_splines"
+    "test_offsets_match_sampled_offsets"
+    "test_offsets_reconstructed_with_sigma_alias"
+    "test_offsets_reconstructed_without_centering"
     "test_predict_new_groups"
     "test_predict_new_groups_fail"
     "test_predict_offset"
diff --git a/pkgs/development/python-modules/bc-detect-secrets/default.nix b/pkgs/development/python-modules/bc-detect-secrets/default.nix
index 96bc071e25cc..1715d6904a15 100644
--- a/pkgs/development/python-modules/bc-detect-secrets/default.nix
+++ b/pkgs/development/python-modules/bc-detect-secrets/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "bc-detect-secrets";
-  version = "1.5.47";
+  version = "1.5.48";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "detect-secrets";
     tag = finalAttrs.version;
-    hash = "sha256-ykmOa29/ASEr+AG2SjhSUN8gLMeKpscDKsPtTTZ+cU8=";
+    hash = "sha256-p8j5oqDXxo6EXmtksI1yxNuY8VkCTF2qoI/oU+YfRpY=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/bittensor-core/default.nix b/pkgs/development/python-modules/bittensor-core/default.nix
index 524fa9e0c788..2c2eb82ea129 100644
--- a/pkgs/development/python-modules/bittensor-core/default.nix
+++ b/pkgs/development/python-modules/bittensor-core/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "bittensor-core";
-  version = "0.1.1";
+  version = "0.1.2";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -18,7 +18,7 @@ buildPythonPackage (finalAttrs: {
   src = fetchPypi {
     pname = "bittensor_core";
     inherit (finalAttrs) version;
-    hash = "sha256-xAw0uZhjc0uoh/6bzFFp4IvqyV7vc6cPnrjkMLIvjLU=";
+    hash = "sha256-PsnNAB69iou4LgmPtsLwdrCI0mjygc4GH8qysm1I7DQ=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
diff --git a/pkgs/development/python-modules/blackjax/default.nix b/pkgs/development/python-modules/blackjax/default.nix
index 5b52a178d97e..424b0a073b4c 100644
--- a/pkgs/development/python-modules/blackjax/default.nix
+++ b/pkgs/development/python-modules/blackjax/default.nix
@@ -100,7 +100,9 @@ buildPythonPackage (finalAttrs: {
   ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
     # AssertionError: Not equal to tolerance rtol=1e-07, atol=1e-05
     "test_equal_matrices"
+    "test_pop_oldest_exactness_k5_d5_n10_nwraps2"
     "test_restart_after_reset_matches_fresh_accumulation"
+    "test_skips_first_offset_steps"
     "test_split_pop_k1_degenerate"
   ];
 
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index 4619c48f8086..5f21555752e6 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -358,13 +358,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "boto3-stubs";
-  version = "1.43.67";
+  version = "1.43.69";
   pyproject = true;
 
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit (finalAttrs) version;
-    hash = "sha256-8VaW9WcQLQV+TQ0xOjcdxkTKY4570HxJDzYsLGT3pLw=";
+    hash = "sha256-5JRLpmigWS8JhFJC5rToXEdqOcqu6NQ7TnzpYdb4hfg=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/botocore-stubs/default.nix b/pkgs/development/python-modules/botocore-stubs/default.nix
index ae626cc6b894..684bb244579b 100644
--- a/pkgs/development/python-modules/botocore-stubs/default.nix
+++ b/pkgs/development/python-modules/botocore-stubs/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "botocore-stubs";
-  version = "1.43.14";
+  version = "1.43.67";
   pyproject = true;
 
   src = fetchPypi {
     pname = "botocore_stubs";
     inherit (finalAttrs) version;
-    hash = "sha256-njvB/dUdp0c/DfcmyCdHobCukTRJ1illl2XCR/7MIDk=";
+    hash = "sha256-hT50AUofVXBVxP+uX7ONfGXHwFIOGqs2bKxB1UKPQZ0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/cardimpose/default.nix b/pkgs/development/python-modules/cardimpose/default.nix
index 412e7d28ac0e..ce16b137cea7 100644
--- a/pkgs/development/python-modules/cardimpose/default.nix
+++ b/pkgs/development/python-modules/cardimpose/default.nix
@@ -1,20 +1,23 @@
 {
   lib,
   buildPythonPackage,
-  fetchFromGitHub,
+  fetchPypi,
   setuptools,
   pymupdf,
 }:
-buildPythonPackage {
+buildPythonPackage (finalAttrs: {
   pname = "cardimpose";
-  version = "0.2.1-unstable-2024-12-28";
+  version = "0.2.2";
   pyproject = true;
 
-  src = fetchFromGitHub {
-    owner = "frsche";
-    repo = "cardimpose";
-    rev = "eb26a9795e20db3e3dd5b62dbcbbad547cb05a55";
-    hash = "sha256-Fel0YOe2D76h+QAon/wxI6EsZhfLca+0ncNi9i888+E=";
+  __structuredAttrs = true;
+
+  # Get source from Pypi as the GitHub repository doesn't have any version
+  # indicators, so there's no way to tell when a new version is available or
+  # what the version should be.
+  src = fetchPypi {
+    inherit (finalAttrs) pname version;
+    hash = "sha256-fMI2bvsHGYU7nZ9CdaUtWQkNj2MihMEcBCVy8VbE6F0=";
   };
 
   build-system = [ setuptools ];
@@ -38,4 +41,4 @@ buildPythonPackage {
     badPlatforms = pymupdf.meta.badPlatforms or [ ];
     maintainers = [ lib.maintainers.me-and ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/charset-normalizer/default.nix b/pkgs/development/python-modules/charset-normalizer/default.nix
index 54cc26122485..1db84cffa0dd 100644
--- a/pkgs/development/python-modules/charset-normalizer/default.nix
+++ b/pkgs/development/python-modules/charset-normalizer/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   aiohttp,
   buildPythonPackage,
   fetchFromGitHub,
@@ -9,7 +10,7 @@
   pytestCheckHook,
   requests,
   setuptools,
-  withMypyc ? !isPyPy,
+  withMypyc ? !isPyPy && !stdenv.hostPlatform.isStatic,
 }:
 
 buildPythonPackage rec {
diff --git a/pkgs/development/python-modules/comfy-kitchen/default.nix b/pkgs/development/python-modules/comfy-kitchen/default.nix
index 8a817ee5ae28..4c90d1f39877 100644
--- a/pkgs/development/python-modules/comfy-kitchen/default.nix
+++ b/pkgs/development/python-modules/comfy-kitchen/default.nix
@@ -17,14 +17,14 @@ let
 in
 buildPythonPackage (finalAttrs: {
   pname = "comfy-kitchen";
-  version = "0.2.28";
+  version = "0.2.30";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Comfy-Org";
     repo = "comfy-kitchen";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jtCW0mO78CuOWpM2TnlnEfDuti3BRXvT1VVDiDKSpeU=";
+    hash = "sha256-n4U7AQQgDtEM5QBTia9V2WSP+CEnpG/Z+tp7I+YyCYA=";
   };
 
   buildInputs = lib.optionals cudaSupport (
diff --git a/pkgs/development/python-modules/comfyui-workflow-templates-core/default.nix b/pkgs/development/python-modules/comfyui-workflow-templates-core/default.nix
index c9b630a293d0..4200b4d2233f 100644
--- a/pkgs/development/python-modules/comfyui-workflow-templates-core/default.nix
+++ b/pkgs/development/python-modules/comfyui-workflow-templates-core/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "comfyui-workflow-templates-core";
-  version = "0.3.302";
+  version = "0.3.307";
   pyproject = true;
 
   src = fetchPypi {
     pname = "comfyui_workflow_templates_core";
     inherit (finalAttrs) version;
-    hash = "sha256-nZVZto1DBFT1S6t/21IJMxbZsIMcRoxmrhD0mBqQbu4=";
+    hash = "sha256-GIvshis5CvvmuY4IvEziIWSWo5DRg4s6RYpd2MnBGuE=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/comfyui-workflow-templates-json/default.nix b/pkgs/development/python-modules/comfyui-workflow-templates-json/default.nix
index e3e3da9f265b..aad214946a3a 100644
--- a/pkgs/development/python-modules/comfyui-workflow-templates-json/default.nix
+++ b/pkgs/development/python-modules/comfyui-workflow-templates-json/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "comfyui-workflow-templates-json";
-  version = "0.1.37";
+  version = "0.1.42";
   pyproject = true;
 
   src = fetchPypi {
     pname = "comfyui_workflow_templates_json";
     inherit (finalAttrs) version;
-    hash = "sha256-Iod2Kh8he/cSBt7l/xf+rxPpbabARESFn1Zxmgjr5Ps=";
+    hash = "sha256-Plyqq6rXdSWJc+NHs7rDRdFrYlaSWSWm/+DXMd7/q3I=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/comfyui-workflow-templates-media-assets-01/default.nix b/pkgs/development/python-modules/comfyui-workflow-templates-media-assets-01/default.nix
index 7d637886c3d8..b420467457ce 100644
--- a/pkgs/development/python-modules/comfyui-workflow-templates-media-assets-01/default.nix
+++ b/pkgs/development/python-modules/comfyui-workflow-templates-media-assets-01/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "comfyui-workflow-templates-media-assets-01";
-  version = "0.1.24";
+  version = "0.1.26";
   pyproject = true;
 
   src = fetchPypi {
     pname = "comfyui_workflow_templates_media_assets_01";
     inherit (finalAttrs) version;
-    hash = "sha256-IXMRhxUuY3ISb55TC02J65I6pk+IcpuDf2hLO1E+lso=";
+    hash = "sha256-mjjf45ybwP8ymOxhoHRqEsgNewtF4BhKLpFeDje946M=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/comfyui-workflow-templates/default.nix b/pkgs/development/python-modules/comfyui-workflow-templates/default.nix
index 5d9ed5417ceb..2859d44b3b48 100644
--- a/pkgs/development/python-modules/comfyui-workflow-templates/default.nix
+++ b/pkgs/development/python-modules/comfyui-workflow-templates/default.nix
@@ -15,13 +15,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "comfyui-workflow-templates";
-  version = "0.11.37";
+  version = "0.11.39";
   pyproject = true;
 
   src = fetchPypi {
     pname = "comfyui_workflow_templates";
     inherit (finalAttrs) version;
-    hash = "sha256-si/bxl5NXk0kSs91EhIwmLhlnWxW+3l4ZvisDI0YSbo=";
+    hash = "sha256-1RGGThxYFKlheesrlsLQV5+ynX6LnqFBU+qcGsCW0EI=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/copykitten/default.nix b/pkgs/development/python-modules/copykitten/default.nix
index 71696ca005b4..16d598120c34 100644
--- a/pkgs/development/python-modules/copykitten/default.nix
+++ b/pkgs/development/python-modules/copykitten/default.nix
@@ -19,7 +19,7 @@ buildPythonPackage (finalAttrs: {
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
+    inherit (finalAttrs) pname version src;
     hash = "sha256-Ujed/3vckHMkYaQ1Euj+KaPG4yeERS7HBbl5SzvbOWE=";
   };
 
diff --git a/pkgs/development/python-modules/credsweeper/default.nix b/pkgs/development/python-modules/credsweeper/default.nix
index df3793d3da01..801ab22a0187 100644
--- a/pkgs/development/python-modules/credsweeper/default.nix
+++ b/pkgs/development/python-modules/credsweeper/default.nix
@@ -1,18 +1,23 @@
 {
   lib,
+  stdenv,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pythonOlder,
+
+  # build-system
+  hatchling,
+
+  # dependencies
   base58,
   beautifulsoup4,
-  buildPythonPackage,
+  bech32,
+  brotli,
   colorama,
   cryptography,
-  deepdiff,
-  fetchFromGitHub,
   gitpython,
-  hatchling,
   humanfriendly,
-  hypothesis,
   lxml,
-  nix-update-script,
   numpy,
   odfpy,
   onnxruntime,
@@ -21,7 +26,7 @@
   pdfminer-six,
   pybase62,
   pyjks,
-  pytestCheckHook,
+  pysquashfsimage,
   python-dateutil,
   python-docx,
   python-pptx,
@@ -31,11 +36,20 @@
   striprtf,
   whatthepatch,
   xlrd,
+  # < python 3.14 only:
+  zstandard,
+
+  # tests
+  deepdiff,
+  hypothesis,
+  psutil,
+  pytestCheckHook,
+  versionCheckHook,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "credsweeper";
-  version = "1.16.0";
+  version = "1.17.4";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -44,7 +58,7 @@ buildPythonPackage (finalAttrs: {
     owner = "Samsung";
     repo = "CredSweeper";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DiIT7DzH6ut/Ax2qgga5vKjeXocROGbHdARLWJijejY=";
+    hash = "sha256-JsKwmzC9kMF3dkYVFrLDxYsxOc5X13pFN9aealZEgqY=";
   };
 
   build-system = [ hatchling ];
@@ -52,6 +66,8 @@ buildPythonPackage (finalAttrs: {
   dependencies = [
     base58
     beautifulsoup4
+    bech32
+    brotli
     colorama
     cryptography
     gitpython
@@ -65,6 +81,7 @@ buildPythonPackage (finalAttrs: {
     pdfminer-six
     pybase62
     pyjks
+    pysquashfsimage
     python-dateutil
     python-docx
     python-pptx
@@ -74,12 +91,17 @@ buildPythonPackage (finalAttrs: {
     striprtf
     whatthepatch
     xlrd
+  ]
+  ++ lib.optionals (pythonOlder "3.14") [
+    zstandard
   ];
 
   nativeCheckInputs = [
     deepdiff
     hypothesis
+    psutil
     pytestCheckHook
+    versionCheckHook
   ];
 
   pythonImportsCheck = [ "credsweeper" ];
@@ -92,10 +114,19 @@ buildPythonPackage (finalAttrs: {
     "test_match_n"
     "test_multi_jobs_p"
     "test_rules_ml_p"
+  ]
+  ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
+    # aarch64-linux fails cpuinfo test, because /sys/devices/system/cpu/ does not exist in the sandbox:
+    # RuntimeError: Failed to initialize cpuinfo!
+    "test_external_ml_n"
+    "test_external_ml_p"
+    "test_import_config_n"
+    "test_import_config_p"
+    "test_it_works_n"
+    "test_log_n"
+    "test_log_p"
   ];
 
-  passthru.updateScript = nix-update-script { };
-
   meta = {
     description = "Tool to detect credentials in any directories or files";
     homepage = "https://github.com/Samsung/CredSweeper";
diff --git a/pkgs/development/python-modules/crewai-cli/default.nix b/pkgs/development/python-modules/crewai-cli/default.nix
index d1c19f09636e..2ef355496381 100644
--- a/pkgs/development/python-modules/crewai-cli/default.nix
+++ b/pkgs/development/python-modules/crewai-cli/default.nix
@@ -41,7 +41,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "crewai-cli";
-  version = "1.15.14";
+  version = "1.15.15";
   pyproject = true;
   __structuredAttrs = true;
 
diff --git a/pkgs/development/python-modules/crewai-core/default.nix b/pkgs/development/python-modules/crewai-core/default.nix
index 6b9a2d4d717b..5e1196766d07 100644
--- a/pkgs/development/python-modules/crewai-core/default.nix
+++ b/pkgs/development/python-modules/crewai-core/default.nix
@@ -26,7 +26,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "crewai-core";
-  version = "1.15.14";
+  version = "1.15.15";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -34,7 +34,7 @@ buildPythonPackage (finalAttrs: {
     owner = "crewAIInc";
     repo = "crewAI";
     tag = finalAttrs.version;
-    hash = "sha256-xhNj6Flo9c/Bh/n/TwEJ2naS5SEf59RBCYZfcLxq8ds=";
+    hash = "sha256-5c1kRoBOSFDqN04TaWgrQu3d0krQRh7Jx37k7nSq+ck=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/lib/crewai-core";
diff --git a/pkgs/development/python-modules/crewai/default.nix b/pkgs/development/python-modules/crewai/default.nix
index bc1f12e3d744..7dca7f23ab34 100644
--- a/pkgs/development/python-modules/crewai/default.nix
+++ b/pkgs/development/python-modules/crewai/default.nix
@@ -59,7 +59,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "crewai";
-  version = "1.15.14";
+  version = "1.15.15";
   pyproject = true;
   __structuredAttrs = true;
 
diff --git a/pkgs/development/python-modules/cryptomobile/default.nix b/pkgs/development/python-modules/cryptomobile/default.nix
new file mode 100644
index 000000000000..576b88aa0aae
--- /dev/null
+++ b/pkgs/development/python-modules/cryptomobile/default.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  python,
+  unittestCheckHook,
+  cryptography,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "cryptomobile";
+  version = "0-unstable-2025-08-30";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "mitshell";
+    repo = "cryptomobile";
+    rev = "0857cbbf140c05c54688bdb2076c25eb8f3ddb89";
+    hash = "sha256-GxRf+0QBmWHBEYMuBeFX9S63Nbbq8jyXF+L2Uj8VCXk=";
+  };
+
+  build-system = [ setuptools ];
+
+  pythonImportsCheck = [ "CryptoMobile" ];
+
+  nativeCheckInputs = [
+    unittestCheckHook # for test/test_CryptoMobile.py
+    cryptography
+  ];
+
+  checkPhase = ''
+    runHook preCheck
+
+    ${python.interpreter} ./test/test_CM.py
+    ${python.interpreter} ./test/test_ECIES.py
+    ${python.interpreter} ./test/test_Milenage.py
+    ${python.interpreter} ./test/test_TUAK.py
+
+    runHook postCheck
+  '';
+
+  meta = {
+    description = "Cryptography for mobile network";
+    homepage = "https://github.com/mitshell/CryptoMobile";
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ felbinger ];
+  };
+})
diff --git a/pkgs/development/python-modules/cyclonedx-python-lib/default.nix b/pkgs/development/python-modules/cyclonedx-python-lib/default.nix
index 7d8b3a7c96c8..4b73854c0d7b 100644
--- a/pkgs/development/python-modules/cyclonedx-python-lib/default.nix
+++ b/pkgs/development/python-modules/cyclonedx-python-lib/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "cyclonedx-python-lib";
-  version = "11.11.1";
+  version = "11.11.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "CycloneDX";
     repo = "cyclonedx-python-lib";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-y9sAbo0O1JIna6PODpvS3Js6UF1nKUFc4s8jx8UqLwY=";
+    hash = "sha256-VszqYukH8MGt3BUSc0ohhuQAc2t3NXGkvEm8rcuTJac=";
   };
 
   pythonRelaxDeps = [ "py-serializable" ];
diff --git a/pkgs/development/python-modules/cython/0.nix b/pkgs/development/python-modules/cython/0.nix
index 53d0847d1d90..547043168b75 100644
--- a/pkgs/development/python-modules/cython/0.nix
+++ b/pkgs/development/python-modules/cython/0.nix
@@ -32,9 +32,9 @@ let
     "overflow_check_longlong"
   ];
 in
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "cython";
-  version = "0.29.37.1";
+  version = "0.29.37";
   pyproject = true;
 
   # error: too few arguments to function '_PyLong_AsByteArray'
@@ -43,8 +43,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "cython";
     repo = "cython";
-    tag = version;
-    hash = "sha256-XsEy2NrG7hq+VXRCRbD4BRaBieU6mVoE0GT52L3mMhs=";
+    tag = finalAttrs.version;
+    hash = "sha256-8LQsfN0LjWvBcRyFNR66jilijGGswgbjrZ9xnOQTjjk=";
   };
 
   nativeBuildInputs = [
@@ -98,9 +98,9 @@ buildPythonPackage rec {
   setupHook = ./setup-hook.sh;
 
   meta = {
-    changelog = "https://github.com/cython/cython/blob/${version}/CHANGES.rst";
+    changelog = "https://github.com/cython/cython/blob/${finalAttrs.version}/CHANGES.rst";
     description = "Optimising static compiler for both the Python programming language and the extended Cython programming language";
     homepage = "https://cython.org";
     license = lib.licenses.asl20;
   };
-}
+})
diff --git a/pkgs/development/python-modules/dashscope/default.nix b/pkgs/development/python-modules/dashscope/default.nix
index 685106b24dd3..013d53902bf7 100644
--- a/pkgs/development/python-modules/dashscope/default.nix
+++ b/pkgs/development/python-modules/dashscope/default.nix
@@ -11,21 +11,32 @@
   websocket-client,
   cryptography,
   certifi,
+  typer,
+  rich,
+  httpx,
+  httpx-sse,
+  pyyaml,
+  # Optional dependencies
+  tiktoken,
   # Test
   pytestCheckHook,
-  tiktoken,
+  pytest-asyncio,
+  pydantic,
+  tenacity,
 }:
 
 buildPythonPackage rec {
   pname = "dashscope";
-  version = "1.25.9";
+  version = "1.26.6";
   pyproject = true;
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "dashscope";
     repo = "dashscope-sdk-python";
     tag = "v${version}";
-    hash = "sha256-VR7Auso+0al9qAE3IDFAPl5zIX0Yp9OfJchR+Q9DB1o=";
+    hash = "sha256-4plniNvpRNIUquTRDJZonQsa4inktGS7AluxKsX+Mpg=";
   };
 
   build-system = [ setuptools ];
@@ -36,8 +47,18 @@ buildPythonPackage rec {
     websocket-client
     cryptography
     certifi
+    typer
+    rich
+    httpx
+    httpx-sse
+    # Not listed in requirements.txt
+    pyyaml
   ];
 
+  optional-dependencies = {
+    tokenizer = [ tiktoken ];
+  };
+
   # Specify the version explicitly
   postPatch = ''
     substituteInPlace setup.py \
@@ -46,8 +67,11 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytestCheckHook
-    tiktoken
-  ];
+    pytest-asyncio
+    pydantic
+    tenacity
+  ]
+  ++ optional-dependencies.tokenizer;
 
   pythonImportsCheck = [ "dashscope" ];
 
@@ -55,6 +79,9 @@ buildPythonPackage rec {
     # Needs network access and/or API key
     "TestAsyncImageSynthesisRequest"
     "TestAsyncRequest"
+    "TestAsyncSessionLifecycle"
+    "TestAsyncSessionUsage"
+    "TestAsyncSessionWithDifferentMethods"
     "TestAsyncVideoSynthesisRequest"
     "TestEncryption"
     "TestSpeechRecognition"
diff --git a/pkgs/development/python-modules/databricks-sdk/default.nix b/pkgs/development/python-modules/databricks-sdk/default.nix
index 2addea4ec542..692e7cad4d1d 100644
--- a/pkgs/development/python-modules/databricks-sdk/default.nix
+++ b/pkgs/development/python-modules/databricks-sdk/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "databricks-sdk";
-  version = "0.123.0";
+  version = "0.127.0";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -30,7 +30,7 @@ buildPythonPackage (finalAttrs: {
     owner = "databricks";
     repo = "databricks-sdk-py";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mSxTk8wq9Hq9xL20Jt8kWpry5F5SljMIcFsv8UohY1c=";
+    hash = "sha256-ZifBh5cCxrfbn3a3EUre7EavRoxBwJR3b6TdUDD3H7o=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/datafusion/default.nix b/pkgs/development/python-modules/datafusion/default.nix
index e45818b9c6fa..1fc347993392 100644
--- a/pkgs/development/python-modules/datafusion/default.nix
+++ b/pkgs/development/python-modules/datafusion/default.nix
@@ -4,6 +4,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   rustPlatform,
+  pythonOlder,
 
   # nativeBuildInputs
   protoc,
@@ -12,6 +13,7 @@
   protobuf,
 
   # dependencies
+  cloudpickle,
   pyarrow,
   typing-extensions,
 
@@ -26,7 +28,7 @@
 buildPythonPackage (finalAttrs: {
   pname = "datafusion";
   # WARNING: Ensure rerun-sdk is compatible with this version of datafusion
-  version = "53.0.0";
+  version = "54.0.0";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -37,12 +39,12 @@ buildPythonPackage (finalAttrs: {
     tag = finalAttrs.version;
     # Fetch arrow-testing and parquet-testing (tests assets)
     fetchSubmodules = true;
-    hash = "sha256-3plgAJuh2rrnvzkQVy3gUgEoHHT4FSjDp5DZx1keD+g=";
+    hash = "sha256-Kh8w8L3AJCs9a3KA9RHaA0btbJEBdYZge1VK7AX0lX0=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname src version;
-    hash = "sha256-kHGlUaPNSs1Nh3HCU+yUVQq/IXp9PUwpDmfAon8eRBk=";
+    hash = "sha256-s4+Y2axZKL7wKiw8Z6c12eWAnf1zGPAFFvWS45vFrlo=";
   };
 
   nativeBuildInputs = with rustPlatform; [
@@ -56,7 +58,10 @@ buildPythonPackage (finalAttrs: {
   ];
 
   dependencies = [
+    cloudpickle
     pyarrow
+  ]
+  ++ lib.optionals (pythonOlder "3.13") [
     typing-extensions
   ];
 
diff --git a/pkgs/development/python-modules/deepface/default.nix b/pkgs/development/python-modules/deepface/default.nix
index f3ff6352152d..0a008348a5c5 100644
--- a/pkgs/development/python-modules/deepface/default.nix
+++ b/pkgs/development/python-modules/deepface/default.nix
@@ -13,7 +13,7 @@
   pandas,
   pillow,
   requests,
-  retinaface,
+  retina-face,
   setuptools,
   tensorflow,
   tqdm,
@@ -55,7 +55,7 @@ buildPythonPackage rec {
     pandas
     pillow
     requests
-    retinaface
+    retina-face
     tensorflow
     tqdm
   ];
diff --git a/pkgs/development/python-modules/devpi-web/default.nix b/pkgs/development/python-modules/devpi-web/default.nix
index d05780e39178..a1b5d1f08b8c 100644
--- a/pkgs/development/python-modules/devpi-web/default.nix
+++ b/pkgs/development/python-modules/devpi-web/default.nix
@@ -29,14 +29,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "devpi-web";
-  version = "5.1.0";
+  version = "5.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "devpi";
     repo = "devpi";
     tag = "web-${finalAttrs.version}";
-    hash = "sha256-7uYHkrACVRaSqhCflbN3TrGtAnw7ifdkiiLnuGd8bnw=";
+    hash = "sha256-PEQZlQIM8WVmF8d3LBKoVrFoIwdf0FY85p4jpoPQyyg=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/web";
diff --git a/pkgs/development/python-modules/diffimg/default.nix b/pkgs/development/python-modules/diffimg/default.nix
index 183af28cf4fb..2910e6ecf7c5 100644
--- a/pkgs/development/python-modules/diffimg/default.nix
+++ b/pkgs/development/python-modules/diffimg/default.nix
@@ -3,14 +3,17 @@
   buildPythonPackage,
   fetchFromGitHub,
   pillow,
-  unittestCheckHook,
+  pytestCheckHook,
   pythonAtLeast,
+  setuptools,
 }:
 
 buildPythonPackage {
   pname = "diffimg";
   version = "0.3.0"; # github recognized 0.1.3, there's a v0.1.5 tag and setup.py says 0.3.0
-  format = "setuptools";
+
+  __structureAttrs = true;
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "nicolashahn";
@@ -30,11 +33,15 @@ buildPythonPackage {
       --replace-warn "3503192421617232" "3503192421617233"
   '';
 
-  propagatedBuildInputs = [ pillow ];
+  build-system = [ setuptools ];
+
+  dependencies = [ pillow ];
 
   pythonImportsCheck = [ "diffimg" ];
 
-  nativeCheckInputs = [ unittestCheckHook ];
+  enabledTestPaths = [ "diffimg/test.py" ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
 
   meta = {
     description = "Differentiate images in python - get a ratio or percentage difference, and generate a diff image";
diff --git a/pkgs/development/python-modules/dj-email-url/default.nix b/pkgs/development/python-modules/dj-email-url/default.nix
index 1fad76637606..6d2e31bfdd9d 100644
--- a/pkgs/development/python-modules/dj-email-url/default.nix
+++ b/pkgs/development/python-modules/dj-email-url/default.nix
@@ -1,31 +1,40 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
-  python,
+  fetchFromGitHub,
+  setuptools,
+  unittestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "dj-email-url";
   version = "1.0.6";
-  format = "setuptools";
+  pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-Vf/jMp5I9U+Kdao27OCPNl4J1h+KIJdz7wmh1HYOaZo=";
+  src = fetchFromGitHub {
+    owner = "migonzalvar";
+    repo = "dj-email-url";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-xjJZyQE/7zgFzFM3JnlkiT0juOv94o4X5398AqCn5Qg=";
   };
 
-  checkPhase = ''
-    ${python.interpreter} test_dj_email_url.py
-  '';
+  build-system = [ setuptools ];
 
-  # tests not included with pypi release
-  doCheck = false;
+  nativeCheckInputs = [ unittestCheckHook ];
+
+  unittestFlags = [ "." ];
 
   meta = {
     description = "Use an URL to configure email backend settings in your Django Application";
     homepage = "https://github.com/migonzalvar/dj-email-url";
-    license = lib.licenses.bsd0;
+    # https://github.com/migonzalvar/dj-email-url/blob/master/LICENSE
+    license =
+      with lib.licenses;
+      AND [
+        bsd2
+        cc-by-40
+        cc0
+      ];
     maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/django-hcaptcha/default.nix b/pkgs/development/python-modules/django-hcaptcha/default.nix
index 9f51677dbdaa..cb0017420cb5 100644
--- a/pkgs/development/python-modules/django-hcaptcha/default.nix
+++ b/pkgs/development/python-modules/django-hcaptcha/default.nix
@@ -2,13 +2,14 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  setuptools,
   django,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "django-hcaptcha";
   version = "0.2.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) version;
@@ -16,7 +17,9 @@ buildPythonPackage (finalAttrs: {
     hash = "sha256-slGerwzJeGWscvglMBEixc9h4eSFLWiVmUFgIirLbBo=";
   };
 
-  propagatedBuildInputs = [ django ];
+  build-system = [ setuptools ];
+
+  dependencies = [ django ];
 
   # No tests
   doCheck = false;
diff --git a/pkgs/development/python-modules/django-health-check/default.nix b/pkgs/development/python-modules/django-health-check/default.nix
index ba4f3d30eff9..25c83dd8fe5f 100644
--- a/pkgs/development/python-modules/django-health-check/default.nix
+++ b/pkgs/development/python-modules/django-health-check/default.nix
@@ -69,7 +69,7 @@ buildPythonPackage (finalAttrs: {
     "test_check_status__nonexistent_hostname"
     "test_check_status__no_answer"
   ]
-  ++ lib.optionals stdenv.isDarwin [
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
     # sensors_temperatures is not available on darwin: https://psutil.readthedocs.io/stable/index.html#psutil.sensors_temperatures
     "TestTemperature"
     # some metrics aren't available on darwin: https://psutil.readthedocs.io/stable/index.html#psutil.virtual_memory
diff --git a/pkgs/development/python-modules/django-ipware/default.nix b/pkgs/development/python-modules/django-ipware/default.nix
index 01c66883d04b..95cf8140e306 100644
--- a/pkgs/development/python-modules/django-ipware/default.nix
+++ b/pkgs/development/python-modules/django-ipware/default.nix
@@ -1,28 +1,41 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   django,
   python-ipware,
+  setuptools,
+  pytestCheckHook,
+  pytest-django,
 }:
 
 buildPythonPackage rec {
   pname = "django-ipware";
   version = "7.0.1";
-  format = "setuptools";
+  pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-2exD0r983yFv7Y1JSghN61dhpUhgpTsudDRqTzhM/0c=";
+  src = fetchFromGitHub {
+    owner = "un33k";
+    repo = "django-ipware";
+    tag = "v${version}";
+    hash = "sha256-jLEHhJ6oNT1tsSqMbfPw1tb2Z/iQa8V6LpbT4ChLKI4=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     django
     python-ipware
   ];
 
-  # django.core.exceptions.ImproperlyConfigured: Requested setting IPWARE_TRUSTED_PROXY_LIST, but settings are not configured. You must either define the environment variable DJANGO_SETTINGS_MODULE or call settings.configure() before accessing settings.
-  doCheck = false;
+  env.DJANGO_SETTINGS_MODULE = "ipware.tests.testsettings";
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-django
+  ];
+
+  enabledTestPaths = [ "ipware/tests/tests*.py" ];
 
   # pythonImportsCheck fails with:
   # django.core.exceptions.ImproperlyConfigured: Requested setting IPWARE_META_PRECEDENCE_ORDER, but settings are not configured. You must either define the environment variable DJANGO_SETTINGS_MODULE or call settings.configure() before accessing settings.
diff --git a/pkgs/development/python-modules/django-silk/default.nix b/pkgs/development/python-modules/django-silk/default.nix
index ee33261ed5f1..5f30356c1724 100644
--- a/pkgs/development/python-modules/django-silk/default.nix
+++ b/pkgs/development/python-modules/django-silk/default.nix
@@ -27,14 +27,14 @@
 
 buildPythonPackage rec {
   pname = "django-silk";
-  version = "5.5.0";
+  version = "5.5.1";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "jazzband";
     repo = "django-silk";
     tag = version;
-    hash = "sha256-F9IHxp2dx0hzu9iOaborJjLyzZjs86rccczhc5GPbtY=";
+    hash = "sha256-Ee0U8PVdyXppqLAbQF3V01VIxn6q94eDp+6GvqbeD5g=";
   };
 
   # "test_time_taken" tests aren't suitable for reproducible execution, but Django's
diff --git a/pkgs/development/python-modules/django-tenants/default.nix b/pkgs/development/python-modules/django-tenants/default.nix
index 345e01ead7cd..ee702b8bbdb4 100644
--- a/pkgs/development/python-modules/django-tenants/default.nix
+++ b/pkgs/development/python-modules/django-tenants/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "django-tenants";
-  version = "3.12.0";
+  version = "3.14.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "django-tenants";
     repo = "django-tenants";
     tag = "v${version}";
-    hash = "sha256-0HFkLG2GDECiaG9OKYR4V1q5oy0vzmthlKoiSM5IIFc=";
+    hash = "sha256-3A4ClGinyN1t5bt441BVZncpw9Ie7b81M/5Tfsbz4kw=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/django-vcache/default.nix b/pkgs/development/python-modules/django-vcache/default.nix
index 8a37756f3cdc..870e85e84fbc 100644
--- a/pkgs/development/python-modules/django-vcache/default.nix
+++ b/pkgs/development/python-modules/django-vcache/default.nix
@@ -23,7 +23,7 @@ buildPythonPackage (finalAttrs: {
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
+    inherit (finalAttrs) pname version src;
     hash = "sha256-tpf0r32wNJ/XCmNutoirTobqKgsEX96s4MsI6+p7KlQ=";
   };
 
diff --git a/pkgs/development/python-modules/dnachisel/default.nix b/pkgs/development/python-modules/dnachisel/default.nix
index c7eabbb2365b..623d520d9ad2 100644
--- a/pkgs/development/python-modules/dnachisel/default.nix
+++ b/pkgs/development/python-modules/dnachisel/default.nix
@@ -8,7 +8,7 @@
   genome-collector,
   matplotlib,
   numpy,
-  primer3,
+  primer3-py,
   proglog,
   pytestCheckHook,
   python-codon-tables,
@@ -39,7 +39,7 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    primer3
+    primer3-py
     genome-collector
     matplotlib
     pytestCheckHook
diff --git a/pkgs/development/python-modules/docling-slim/default.nix b/pkgs/development/python-modules/docling-slim/default.nix
index 368a0e9cf5a5..8ab9c98d5f45 100644
--- a/pkgs/development/python-modules/docling-slim/default.nix
+++ b/pkgs/development/python-modules/docling-slim/default.nix
@@ -87,6 +87,7 @@
   # tests
   ffmpeg-headless,
   gitMinimal,
+  pytest-xdist,
   pytestCheckHook,
   writableTmpDirAsHomeHook,
 }:
@@ -283,6 +284,7 @@ buildPythonPackage (finalAttrs: {
     openpyxl
     pylatexenc
     pypdfium2
+    pytest-xdist
     pytestCheckHook
     python-docx
     python-pptx
diff --git a/pkgs/development/python-modules/elevenlabs/default.nix b/pkgs/development/python-modules/elevenlabs/default.nix
index 2734615eab7b..4b87bd6759b7 100644
--- a/pkgs/development/python-modules/elevenlabs/default.nix
+++ b/pkgs/development/python-modules/elevenlabs/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "elevenlabs";
-  version = "2.60.0";
+  version = "2.63.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "elevenlabs";
     repo = "elevenlabs-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Foe5icwDNVD/g/tss1UG9wzrzXmECzXr/3Ql6yA4YHY=";
+    hash = "sha256-Fm7gB892mm0K8HgYAC2pGEMQaB90cX7jwiMZqF27lgk=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/fastmcp/default.nix b/pkgs/development/python-modules/fastmcp/default.nix
index f30dcd915091..1154fc8668d6 100644
--- a/pkgs/development/python-modules/fastmcp/default.nix
+++ b/pkgs/development/python-modules/fastmcp/default.nix
@@ -3,6 +3,7 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch,
   writableTmpDirAsHomeHook,
 
   # build-system
@@ -29,7 +30,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "fastmcp";
-  version = "3.3.1";
+  version = "3.4.7";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -37,9 +38,19 @@ buildPythonPackage (finalAttrs: {
     owner = "PrefectHQ";
     repo = "fastmcp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1W5NbWIULxFXGSozZEeITcPt1EbY6IsJLQdyevcn9BI=";
+    hash = "sha256-EysVbtFbop5ENupc9T5EmtUSZ8osVtQSzpwa6rea/OQ=";
   };
 
+  patches = [
+    # Fix python 3.14 compatibility (https://github.com/PrefectHQ/fastmcp/pull/4796)
+    # TODO: remove when updating to the next release
+    (fetchpatch {
+      url = "https://github.com/PrefectHQ/fastmcp/commit/6be0ac8e15d35ff8f5121266855bc34c1158c9a1.patch";
+      includes = [ "fastmcp_slim/fastmcp/tools/function_tool.py" ];
+      hash = "sha256-7N86b5sslWLgoB2dS2Xh3JfZX3oTHeXfeSJOaWKI5b0=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace-fail "timeout = 5" "timeout = 50"
@@ -108,8 +119,11 @@ buildPythonPackage (finalAttrs: {
     "test_nested_streamable_http_server_resolves_correctly"
 
     # Requires prefab-ui (optional dependency)
+    # https://github.com/NixOS/nixpkgs/pull/510123 adds the prefab-ui package.
     "TestPrefabAppConfig"
     "test_doc_examples_quality"
+    "test_run_dev_apps_with_host"
+    "test_run_dev_apps_log_panel_propagation"
 
     # AssertionError: assert 'INFO' == 'DEBUG'
     "test_temporary_settings"
@@ -120,6 +134,14 @@ buildPythonPackage (finalAttrs: {
     "test_server_starts_without_auth"
     "test_canonical_multi_client_with_transforms"
 
+    # Server startup is flaky when the suite runs with pytest-xdist
+    "test_unauthorized_access"
+
+    # Timing-sensitive and flaky
+    "test_rate_limiting_recovery_over_time"
+    "test_rate_limiting_with_different_operations"
+    "test_timeout"
+
     # RuntimeError: Attempted to exit a cancel scope that isn't the current tasks's current cancel scope
     "test_stateful_proxy"
     "test_concurrent_log_requests_no_mixing"
diff --git a/pkgs/development/python-modules/fireworks-ai/default.nix b/pkgs/development/python-modules/fireworks-ai/default.nix
index bfcda1178fc3..7242c76cabf7 100644
--- a/pkgs/development/python-modules/fireworks-ai/default.nix
+++ b/pkgs/development/python-modules/fireworks-ai/default.nix
@@ -37,7 +37,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "fireworks-ai";
-  version = "1.2.0";
+  version = "1.2.8";
   pyproject = true;
   __structuredAttrs = true;
   strictDeps = true;
@@ -46,7 +46,7 @@ buildPythonPackage (finalAttrs: {
     owner = "fw-ai-external";
     repo = "python-sdk";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hcJ32r4MnZFBPYf3aT2PhrtXDIYY3EBaE8Y5wH2Sxuw=";
+    hash = "sha256-V3xU/6pmiNVUvMaTWPduoyum9R1IN+Vq36JkIDkAoY4=";
   };
 
   postPatch = ''
@@ -97,6 +97,16 @@ buildPythonPackage (finalAttrs: {
   ]
   ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies;
 
+  pytestFlags = [
+    # ResourceWarning: Unclosed client session <aiohttp.client.ClientSession object at 0x7ffff1d48ec0>
+    "-Wignore::ResourceWarning"
+  ];
+
+  disabledTests = [
+    # httpx.TimeoutException: Test timeout error
+    "test_retrying_timeout_errors_doesnt_leak"
+  ];
+
   pythonImportsCheck = [
     "fireworks"
   ];
diff --git a/pkgs/development/python-modules/flashinfer/default.nix b/pkgs/development/python-modules/flashinfer-python/default.nix
similarity index 98%
rename from pkgs/development/python-modules/flashinfer/default.nix
rename to pkgs/development/python-modules/flashinfer-python/default.nix
index 795db6d46c0b..202520941fd1 100644
--- a/pkgs/development/python-modules/flashinfer/default.nix
+++ b/pkgs/development/python-modules/flashinfer-python/default.nix
@@ -31,7 +31,7 @@
 }:
 
 buildPythonPackage (finalAttrs: {
-  pname = "flashinfer";
+  pname = "flashinfer-python";
   version = "0.6.4";
   pyproject = true;
 
diff --git a/pkgs/development/python-modules/genome-collector/default.nix b/pkgs/development/python-modules/genome-collector/default.nix
index 4af18d63fded..c36f1fa31bdb 100644
--- a/pkgs/development/python-modules/genome-collector/default.nix
+++ b/pkgs/development/python-modules/genome-collector/default.nix
@@ -5,19 +5,29 @@
   biopython,
   fetchPypi,
   proglog,
+  setuptools,
 }:
 
 buildPythonPackage rec {
-  pname = "genome_collector";
+  pname = "genome-collector";
   version = "0.1.6";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "genome_collector";
+    inherit version;
     sha256 = "0023ihrz0waxbhq28xh1ymvk51ih882y9psg4glm6s9d1zmqvdph";
   };
 
-  propagatedBuildInputs = [
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace-fail "import ez_setup" "" \
+      --replace-fail "ez_setup.use_setuptools()" ""
+  '';
+
+  build-system = [ setuptools ];
+
+  dependencies = [
     appdirs
     biopython
     proglog
diff --git a/pkgs/development/python-modules/git-dummy/default.nix b/pkgs/development/python-modules/git-dummy/default.nix
index 156ab57fe99b..4a5c6e4c3325 100644
--- a/pkgs/development/python-modules/git-dummy/default.nix
+++ b/pkgs/development/python-modules/git-dummy/default.nix
@@ -20,6 +20,7 @@ buildPythonPackage (finalAttrs: {
   pname = "git-dummy";
   version = "0.1.2";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "initialcommit-com";
@@ -40,12 +41,20 @@ buildPythonPackage (finalAttrs: {
 
   postInstall =
     # https://github.com/NixOS/nixpkgs/issues/308283
-    lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-      installShellCompletion --cmd git-dummy \
-        --bash <($out/bin/git-dummy --show-completion bash) \
-        --fish <($out/bin/git-dummy --show-completion fish) \
-        --zsh <($out/bin/git-dummy --show-completion zsh)
-    '';
+    lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform)
+      # Otherwise, typer ignores the requested shell and instead detects it by walking the
+      # process tree, which yields bash on linux and fails outright on darwin:
+      # https://github.com/fastapi/typer/blob/0.25.1/typer/completion.py#L42-L59
+      ''
+        export _TYPER_COMPLETE_TEST_DISABLE_SHELL_DETECTION=1
+        installShellCompletion --cmd git-dummy \
+          --bash <($out/bin/git-dummy --show-completion bash) \
+          --fish <($out/bin/git-dummy --show-completion fish) \
+          --zsh <($out/bin/git-dummy --show-completion zsh)
+      '';
+
+  # No python tests nor --version flag
+  doCheck = false;
 
   meta = {
     description = "Generate dummy Git repositories populated with the desired number of commits, branches, and structure";
diff --git a/pkgs/development/python-modules/graph-tool/default.nix b/pkgs/development/python-modules/graph-tool/default.nix
index f455258ea14b..e58456161e71 100644
--- a/pkgs/development/python-modules/graph-tool/default.nix
+++ b/pkgs/development/python-modules/graph-tool/default.nix
@@ -2,10 +2,9 @@
   buildPythonPackage,
   lib,
   fetchurl,
-  fetchpatch,
   stdenv,
 
-  boost189,
+  boost191,
   cairomm,
   cgal,
   expat,
@@ -22,35 +21,31 @@
   pygobject3,
   python,
   scipy,
-  sparsehash,
   zstandard,
+
+  writableTmpDirAsHomeHook,
+
   gitUpdater,
 }:
 
 let
-  boost' = boost189.override {
-    patches = [
-      # required to build against Clang >= 21 (https://github.com/boostorg/lexical_cast/pull/87)
-      # TODO: drop when upgrading to Boost >= 1.90
-      (fetchpatch {
-        name = "Reduce-dependency-on-Boost.TypeTraits-now-that-C-11-.patch";
-        url = "https://github.com/boostorg/lexical_cast/commit/8fc8a19931c8cb452400af907959fdacbbdd8ec1.patch";
-        relative = "include";
-        hash = "sha256-OO39ejR+I5ufjqinrMJ6HgjTE7Ph+XBu50PqcIKaIQo=";
-      })
-    ];
+  boost' = boost191.override {
     enablePython = true;
     inherit python;
   };
 in
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "graph-tool";
-  version = "2.98";
+  version = "3.6";
   pyproject = false;
 
+  strictDeps = true;
+
+  __structuredAttrs = true;
+
   src = fetchurl {
-    url = "https://downloads.skewed.de/graph-tool/graph-tool-${version}.tar.bz2";
-    hash = "sha256-7vGUi5N/XwQ3Se7nX+DG1+jwNlUdlF6dVeN4cLBsxSc=";
+    url = "https://downloads.skewed.de/graph-tool/graph-tool-${finalAttrs.version}.tar.bz2";
+    hash = "sha256-KFKitvz3zFEQAi8hkvIBC0c5QTRmOJRamdV0cyMbejU=";
   };
 
   postPatch =
@@ -75,6 +70,16 @@ buildPythonPackage rec {
       cgal = lib.getDev cgal;
       python-module-path = "$(out)/${python.sitePackages}";
     }
+    ++ [
+      # CXXFLAGS defaults to "-g -O2", if unset.
+      # "-g" produces debugging information, which significantly increases
+      # resource requirements during compilation, but is not necessary as we
+      # subsequently strip the binaries.
+      # "-ftemplate-backtrace-limit=1" reduces the number of template
+      # instantiation notes per warning in order to reduce the log file size.
+      # "-O3" is also used by upstream.
+      "CXXFLAGS=-ftemplate-backtrace-limit=1 -O3"
+    ]
     ++
       lib.optionals stdenv.cc.isGNU
         # enable GCC's link-time optimizer in order to reduce compilation time and memory usage during compilation
@@ -93,7 +98,6 @@ buildPythonPackage rec {
     cgal
     expat
     mpfr
-    sparsehash
   ]
   ++ lib.optionals stdenv.cc.isClang [ llvmPackages.openmp ];
 
@@ -109,10 +113,11 @@ buildPythonPackage rec {
 
   propagatedNativeBuildInputs = [ gobject-introspection ];
 
+  nativeCheckInputs = [ writableTmpDirAsHomeHook ];
+
   preInstallCheck =
     # avoid warnings about Matplotlib and Fontconfig configuration issues
     ''
-      export HOME=$(mktemp -d)
       export FONTCONFIG_FILE=${fontconfig.out}/etc/fonts/fonts.conf
     '';
 
@@ -126,8 +131,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python module for manipulation and statistical analysis of graphs";
     homepage = "https://graph-tool.skewed.de";
-    changelog = "https://git.skewed.de/count0/graph-tool/commits/release-${version}";
+    changelog = "https://git.skewed.de/count0/graph-tool/commits/release-${finalAttrs.version}";
     license = lib.licenses.lgpl3Plus;
     maintainers = [ lib.maintainers.mjoerg ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/hishel/default.nix b/pkgs/development/python-modules/hishel/default.nix
index 32acc70f5075..95c5ae5558e6 100644
--- a/pkgs/development/python-modules/hishel/default.nix
+++ b/pkgs/development/python-modules/hishel/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "hishel";
-  version = "1.3.0";
+  version = "1.3.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "karpetrosyan";
     repo = "hishel";
     tag = version;
-    hash = "sha256-aD6sHMM7dzy6n1EJN/+K+7H5nu5ohGfru224pSAf1Nc=";
+    hash = "sha256-KVfbWhGpbLGzK3fQOuT+KtBi13z5ZZBP8NOsIIfObMc=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/hist/default.nix b/pkgs/development/python-modules/hist/default.nix
index 97284cd81450..ea689543c8b7 100644
--- a/pkgs/development/python-modules/hist/default.nix
+++ b/pkgs/development/python-modules/hist/default.nix
@@ -13,12 +13,12 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "hist";
-  version = "2.10.1";
+  version = "2.11.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-3sjmrHmm1k7Ihzzzaz7wOUx5r/Ow6Kvtcf3Hf9xCGy4=";
+    hash = "sha256-kusfoMo5utYZ9/cEs7qTxEs1U7BEX22ywXxnwBuctTQ=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/hydrus-api/default.nix b/pkgs/development/python-modules/hydrus-api/default.nix
index 472f08d44738..2e65a714b47d 100644
--- a/pkgs/development/python-modules/hydrus-api/default.nix
+++ b/pkgs/development/python-modules/hydrus-api/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "hydrus-api";
-  version = "5.1.1";
+  version = "5.3.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "hydrus_api";
     inherit version;
-    hash = "sha256-oA3DbdX+MRZiInCKXurBdKlUFQ4jeU+jHr9NxMEHQmI=";
+    hash = "sha256-Xq27pMVj2JkcHLvFzVDKL9KNOjTxZ3yH5+RVcVMzKJc=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/jupysql/default.nix b/pkgs/development/python-modules/jupysql/default.nix
index c9e255aba086..c7db947e148d 100644
--- a/pkgs/development/python-modules/jupysql/default.nix
+++ b/pkgs/development/python-modules/jupysql/default.nix
@@ -36,16 +36,16 @@
   writableTmpDirAsHomeHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "jupysql";
   version = "0.11.1";
-
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "ploomber";
     repo = "jupysql";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-7wfKvKqDf8LlUiLoevNRxmq8x5wLheOgIeWz72oFcuw=";
   };
 
@@ -84,9 +84,12 @@ buildPythonPackage rec {
     psutil
     writableTmpDirAsHomeHook
   ]
-  ++ optional-dependencies.dev;
+  ++ finalAttrs.passthru.optional-dependencies.dev;
 
   disabledTests = [
+    # ValueError: max() iterable argument is empty
+    "test_columns_with_missing_values[empty-dictionaries]"
+
     # AttributeError: 'DataFrame' object has no attribute 'frame_equal'
     "test_resultset_polars_dataframe"
 
@@ -135,8 +138,8 @@ buildPythonPackage rec {
   meta = {
     description = "Better SQL in Jupyter";
     homepage = "https://github.com/ploomber/jupysql";
-    changelog = "https://github.com/ploomber/jupysql/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/ploomber/jupysql/blob/${finalAttrs.src.rev}/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ euxane ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/kaggle/default.nix b/pkgs/development/python-modules/kaggle/default.nix
index 4b2f24d2a3e9..5c3b28753937 100644
--- a/pkgs/development/python-modules/kaggle/default.nix
+++ b/pkgs/development/python-modules/kaggle/default.nix
@@ -1,30 +1,37 @@
 {
-  bleach,
+  lib,
+  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
+
+  # build-system
   hatchling,
+
+  # dependencies
+  bleach,
   jupytext,
   kagglesdk,
-  lib,
   packaging,
   protobuf,
   python-dateutil,
   python-dotenv,
   python-slugify,
-  pytestCheckHook,
   requests,
   six,
   tqdm,
   urllib3,
+
+  # tests
+  pytestCheckHook,
+  versionCheckHook,
   writableTmpDirAsHomeHook,
 }:
 
 buildPythonPackage (finalAttrs: {
-  __structuredAttrs = true;
-
   pname = "kaggle";
   version = "2.2.4";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "Kaggle";
@@ -52,9 +59,14 @@ buildPythonPackage (finalAttrs: {
 
   nativeCheckInputs = [
     pytestCheckHook
+    versionCheckHook
     # kaggle creates its config dir at import time; needs a writable HOME.
     writableTmpDirAsHomeHook
   ];
+  versionCheckKeepEnvironment = lib.optionals stdenv.hostPlatform.isDarwin [
+    # PermissionError: [Errno 1] Operation not permitted: '/var/empty/.kaggle'
+    "HOME"
+  ];
 
   # kaggle authenticates at import time; fake creds for the offline checks.
   env = {
@@ -64,11 +76,13 @@ buildPythonPackage (finalAttrs: {
 
   pythonImportsCheck = [ "kaggle" ];
 
+  __darwinAllowLocalNetworking = true;
+
   meta = {
     description = "Official Kaggle CLI";
     mainProgram = "kaggle";
     homepage = "https://github.com/Kaggle/kaggle-cli";
-    changelog = "https://github.com/Kaggle/kaggle-cli/blob/v${finalAttrs.version}/CHANGELOG.md";
+    changelog = "https://github.com/Kaggle/kaggle-cli/blob/${finalAttrs.src.rev}/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ daniel-fahey ];
   };
diff --git a/pkgs/development/python-modules/kagglesdk/default.nix b/pkgs/development/python-modules/kagglesdk/default.nix
index ed903ed7283f..af940a9241f3 100644
--- a/pkgs/development/python-modules/kagglesdk/default.nix
+++ b/pkgs/development/python-modules/kagglesdk/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "kagglesdk";
-  version = "0.1.36";
+  version = "0.1.37";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -21,7 +21,7 @@ buildPythonPackage (finalAttrs: {
     owner = "Kaggle";
     repo = "kagglesdk";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-a7+/bAqRJyETzBFqD5AlrJsMtF227GLdM7EnYTlcfso=";
+    hash = "sha256-R88x9jlvY2UIksiDjgQJHvb+dpkda1GPYwEh9KWkZi4=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/knx-telegram-store/default.nix b/pkgs/development/python-modules/knx-telegram-store/default.nix
index ffb4cd985e59..39140fc6b66c 100644
--- a/pkgs/development/python-modules/knx-telegram-store/default.nix
+++ b/pkgs/development/python-modules/knx-telegram-store/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "knx-telegram-store";
-  version = "0.11.2";
+  version = "0.12.0";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -22,7 +22,7 @@ buildPythonPackage (finalAttrs: {
     owner = "XKNX";
     repo = "knx-telegram-store";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xTJ4mFmew4FbtE94kh+tBTEwH1j0x977qvcmi/ceVYg=";
+    hash = "sha256-otHKGgWjo8j6jlWlD7ojh/3LGlR41hQQGueCxvocCM4=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/langgraph-runtime-inmem/default.nix b/pkgs/development/python-modules/langgraph-runtime-inmem/default.nix
index b71f232b093c..48f64d24b0ca 100644
--- a/pkgs/development/python-modules/langgraph-runtime-inmem/default.nix
+++ b/pkgs/development/python-modules/langgraph-runtime-inmem/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langgraph-runtime-inmem";
-  version = "0.31.2";
+  version = "0.32.3";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -22,7 +22,7 @@ buildPythonPackage (finalAttrs: {
   src = fetchPypi {
     pname = "langgraph_runtime_inmem";
     inherit (finalAttrs) version;
-    hash = "sha256-VE7gXsjV+pXhz85rZnD9mhgwp5QRXvxEjdgF7tjNBAE=";
+    hash = "sha256-k5ATRuxkds7dDZx3lxGJUL+vUgVFHe8/BaAZqoaaxd4=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/llama-cpp-python/default.nix b/pkgs/development/python-modules/llama-cpp-python/default.nix
index 90a35ec2a94a..0f997b0c55c7 100644
--- a/pkgs/development/python-modules/llama-cpp-python/default.nix
+++ b/pkgs/development/python-modules/llama-cpp-python/default.nix
@@ -1,7 +1,6 @@
 {
   lib,
   stdenv,
-  gcc13Stdenv,
   buildPythonPackage,
   fetchFromGitHub,
 
@@ -35,10 +34,7 @@
   cudaPackages ? { },
 
 }:
-let
-  stdenvTarget = if cudaSupport then gcc13Stdenv else stdenv;
-in
-buildPythonPackage.override { stdenv = stdenvTarget; } rec {
+buildPythonPackage rec {
   pname = "llama-cpp-python";
   version = "0.3.23";
   pyproject = true;
@@ -126,7 +122,7 @@ buildPythonPackage.override { stdenv = stdenvTarget; } rec {
       rev-prefix = "v";
       allowedVersions = "^[.0-9]+$";
     };
-    tests = lib.optionalAttrs stdenvTarget.hostPlatform.isLinux {
+    tests = lib.optionalAttrs stdenv.hostPlatform.isLinux {
       withCuda = llama-cpp-python.override {
         cudaSupport = true;
       };
diff --git a/pkgs/development/python-modules/llguidance/default.nix b/pkgs/development/python-modules/llguidance/default.nix
index 6986d617876a..a44d5d543071 100644
--- a/pkgs/development/python-modules/llguidance/default.nix
+++ b/pkgs/development/python-modules/llguidance/default.nix
@@ -23,7 +23,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "llguidance";
-  version = "1.7.6";
+  version = "1.8.0";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -31,12 +31,12 @@ buildPythonPackage (finalAttrs: {
     owner = "guidance-ai";
     repo = "llguidance";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6FaT8hHjmtl878YN9yOjPPVH3QKRpJ8/HPbg0D/Zz2Q=";
+    hash = "sha256-/rHTefKTq5ch38NqbcLYTXBJwkW+WzG5OFvignDIie4=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src pname version;
-    hash = "sha256-tAo6hDWUNm6h/DTOCVU/+o69wQ545THQBBdvN01bhTY=";
+    hash = "sha256-aa9R+6xgFVGAD3snHbkPRF5jMYwC3DFNjXcUtaOzDbU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/manim/default.nix b/pkgs/development/python-modules/manim/default.nix
index c30af66c430e..3759797f8dfc 100644
--- a/pkgs/development/python-modules/manim/default.nix
+++ b/pkgs/development/python-modules/manim/default.nix
@@ -5,7 +5,7 @@
   texliveInfraOnly,
 
   # build-system
-  hatchling,
+  uv-build,
 
   # buildInputs
   cairo,
@@ -42,6 +42,7 @@
   # optional-dependencies
   jupyterlab,
   notebook,
+  typst,
 
   # tests
   ffmpeg,
@@ -187,22 +188,32 @@ let
 in
 buildPythonPackage (finalAttrs: {
   pname = "manim";
+  version = "0.21.0";
   pyproject = true;
-  version = "0.20.1";
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "ManimCommunity";
     repo = "manim";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rfPqKPbxT8UsxSin4DquDjPMAUEYmKixx2fBlr5mz8U=";
+    hash = "sha256-K6+U+ri/bBf760JmyhpkzQsQqp+ofve5zBByZPVdc1w=";
   };
 
-  build-system = [
-    hatchling
-  ];
-
   patches = [ ./pytest-report-header.patch ];
 
+  postPatch =
+    # nixpkgs still ships uv-build < 0.12.1
+    ''
+      substituteInPlace pyproject.toml \
+        --replace-fail \
+          "uv_build>=0.12.1,<0.13.0" \
+          "uv_build"
+    '';
+
+  build-system = [
+    uv-build
+  ];
+
   buildInputs = [ cairo ];
 
   pythonRelaxDeps = [
@@ -246,6 +257,9 @@ buildPythonPackage (finalAttrs: {
     ];
     # TODO package dearpygui
     # gui = [ dearpygui ];
+    typst = [
+      typst
+    ];
   };
 
   makeWrapperArgs = [
@@ -264,10 +278,11 @@ buildPythonPackage (finalAttrs: {
     pytest-cov-stub
     pytest-xdist
     pytestCheckHook
+    typst
     versionCheckHook
   ];
 
-  # about 55 of ~600 tests failing mostly due to demand for display
+  # about 45 of ~1050 tests failing mostly due to demand for display
   disabledTests = import ./failing_tests.nix;
 
   pythonImportsCheck = [ "manim" ];
diff --git a/pkgs/development/python-modules/manim/failing_tests.nix b/pkgs/development/python-modules/manim/failing_tests.nix
index 987b64db26de..51fedd98bfa1 100644
--- a/pkgs/development/python-modules/manim/failing_tests.nix
+++ b/pkgs/development/python-modules/manim/failing_tests.nix
@@ -49,42 +49,6 @@
 
   # reason for failure: tests try to reach network
   "test_logging_to_file"
-  "test_plugin_function_like"
-  "test_plugin_no_all"
-  "test_plugin_with_all"
-
-  # failing with:
-  # E           AssertionError:
-  # E           Not equal to tolerance rtol=1e-07, atol=1.01
-  # E           Frame no -1. You can use --show_diff to visually show the difference.
-  # E           Mismatched elements: 18525 / 1639680 (1.13%)
-  # E           Max absolute difference: 255
-  # E           Max relative difference: 255.
-  "test_Text2Color"
-  "test_PointCloudDot"
-  "test_Torus"
-
-  # test_ImplicitFunction[/test_implicit_graph] failing with:
-  # E           AssertionError:
-  # E           Not equal to tolerance rtol=1e-07, atol=1.01
-  # E           Frame no -1. You can use --show_diff to visually show the difference.
-  # E           Mismatched elements: 1185[/633] / 1639680[/1639680] (0.0723[/0.0386]%)
-  # E           Max absolute difference: 125[/121]
-  # E           Max relative difference: 6.5[/1]
-  #
-  # These started failing after relaxing the “watchdog” and “isosurfaces” dependencies,
-  # likely due to a tolerance difference.  They should, however, start working again when [1] is
-  # included in a Manim release.
-  # [1]: https://github.com/ManimCommunity/manim/pull/3376
-  "test_ImplicitFunction"
-  "test_implicit_graph"
-
-  # failing with:
-  # TypeError: __init__() got an unexpected keyword argument 'msg' - maybe you meant pytest.mark.skipif?
-  "test_force_window_opengl_render_with_movies"
-
-  # mismatching expectation on the new commandline
-  "test_manim_new_command"
 
   # This tests checks if the manim executable is a python script. In our case it is not.
   # It is a wrapper shell script instead.
diff --git a/pkgs/development/python-modules/mat2/default.nix b/pkgs/development/python-modules/mat2/default.nix
index 7ec07a3defbd..f1a165d94cb6 100644
--- a/pkgs/development/python-modules/mat2/default.nix
+++ b/pkgs/development/python-modules/mat2/default.nix
@@ -1,12 +1,11 @@
 {
   lib,
-  stdenv,
   buildPythonPackage,
   pytestCheckHook,
   fetchFromGitHub,
   replaceVars,
   exiftool,
-  ffmpeg,
+  ffmpeg_8,
   setuptools,
   wrapGAppsHook3,
   gdk-pixbuf,
@@ -39,7 +38,7 @@ buildPythonPackage (finalAttrs: {
     # hardcode paths to some binaries
     (replaceVars ./paths.patch {
       exiftool = lib.getExe exiftool;
-      ffmpeg = lib.getExe ffmpeg;
+      ffmpeg = lib.getExe ffmpeg_8;
       kdialog = if dolphinIntegration then lib.getExe kdePackages.kdialog else null;
       # replaced in postPatch
       mat2 = null;
diff --git a/pkgs/development/python-modules/modal/default.nix b/pkgs/development/python-modules/modal/default.nix
index 2e2002f116ef..40ad38e2df6f 100644
--- a/pkgs/development/python-modules/modal/default.nix
+++ b/pkgs/development/python-modules/modal/default.nix
@@ -39,7 +39,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "modal";
-  version = "1.5.3";
+  version = "1.5.4";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -48,7 +48,7 @@ buildPythonPackage (finalAttrs: {
     owner = "modal-labs";
     repo = "modal-client";
     tag = "py/v${finalAttrs.version}";
-    hash = "sha256-XVY+RzedSMVug+mZ6pioO5qYbR6gUaD5QJIENIPWgx8=";
+    hash = "sha256-5pWpw2Jb16Rjq/n74KZsclRrxEGzUEAWbmGHxK4H1e4=";
   };
   sourceRoot = "${finalAttrs.src.name}/py";
 
diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 213bc023e397..a154be071b13 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -207,8 +207,8 @@ in
       "sha256-Ees/nrPLKM8p6FqVewgRkC/1w/8kZrDGgxUb3AwDgeo=";
 
   mypy-boto3-cleanrooms =
-    buildMypyBoto3Package "cleanrooms" "1.43.57"
-      "sha256-yIROx5OPyDTU+oukuqn5JIaZAc+cebDLLYuZza2YNGc=";
+    buildMypyBoto3Package "cleanrooms" "1.43.69"
+      "sha256-UMO+vnUE/SSE4hJBDSdsSjWuX8IwBrFjPdT5tftkXY8=";
 
   mypy-boto3-cloud9 =
     buildMypyBoto3Package "cloud9" "1.43.39"
@@ -219,8 +219,8 @@ in
       "sha256-KwwGrKpyWEtL6cqtQA3TjWuQodCGETNCopw9GCQE4BY=";
 
   mypy-boto3-clouddirectory =
-    buildMypyBoto3Package "clouddirectory" "1.43.0"
-      "sha256-Ula0Hx4jZ6JVlT9v4P88bmtQSYyFtofeZiN9vAILqxw=";
+    buildMypyBoto3Package "clouddirectory" "1.43.69"
+      "sha256-iGWIsG2t7LS4gMbNAVPyarrc8qmhtpleps/OhDInY24=";
 
   mypy-boto3-cloudformation =
     buildMypyBoto3Package "cloudformation" "1.43.62"
@@ -335,8 +335,8 @@ in
       "sha256-3JYcWKFk0dKJg/qn+EBvxeAO5xh5PXCU3dTEWDr1oXI=";
 
   mypy-boto3-connect =
-    buildMypyBoto3Package "connect" "1.43.67"
-      "sha256-b/3fZ8i4ijNE38txRScSfDOplofgLlVo7lxH8ozqURA=";
+    buildMypyBoto3Package "connect" "1.43.69"
+      "sha256-lXq62mDozVi49JkQz8v21NAXkNiOz1D10Op1U/bIuy4=";
 
   mypy-boto3-connect-contact-lens =
     buildMypyBoto3Package "connect-contact-lens" "1.43.0"
@@ -467,8 +467,8 @@ in
       "sha256-11KpPRxGId76g/I4jXwMQ55kwGEQVsasgvMUXsiLbM4=";
 
   mypy-boto3-eks =
-    buildMypyBoto3Package "eks" "1.43.38"
-      "sha256-d8nAhWJTMytBpPwwp0kVjxmeX+l7mFZzd2NfNBNmaIY=";
+    buildMypyBoto3Package "eks" "1.43.69"
+      "sha256-Vn8EzKWaXobr77B3b11dCsH8fu7+ZxLZOC+Eo/IWPmU=";
 
   mypy-boto3-elastic-inference =
     buildMypyBoto3Package "elastic-inference" "1.36.0"
@@ -862,8 +862,8 @@ in
       "sha256-qvQo6w4QfSTVfmJhu7tZFGV6///8pJwEijs3oLT/nTg=";
 
   mypy-boto3-medialive =
-    buildMypyBoto3Package "medialive" "1.43.27"
-      "sha256-0LntM7UfzKU0Pe0peTvZw2Ll59DNNRVajrB8L5ThgCs=";
+    buildMypyBoto3Package "medialive" "1.43.68"
+      "sha256-uzgonFo6T55QjJcaORBcWpwOjdnC+EWFo7TwmmUrdkc=";
 
   mypy-boto3-mediapackage =
     buildMypyBoto3Package "mediapackage" "1.43.0"
@@ -982,8 +982,8 @@ in
       "sha256-JEuEjo0htTuDCZx2nNJK2Zq59oSUqkMf4BrNamerfVk=";
 
   mypy-boto3-organizations =
-    buildMypyBoto3Package "organizations" "1.43.64"
-      "sha256-kyUieR7tYYUGbEOi6ftCEDD07+QfcyJ2cOWqrk2FVAs=";
+    buildMypyBoto3Package "organizations" "1.43.69"
+      "sha256-paBe5gVy3zwFWnrFlMJkSFsTezo8racFPocj7osxIss=";
 
   mypy-boto3-osis =
     buildMypyBoto3Package "osis" "1.43.0"
@@ -1170,8 +1170,8 @@ in
       "sha256-T+JIJpHxD7IzAwq8yxgq6zbVMj/btpbhKnylMyfFvvU=";
 
   mypy-boto3-sagemaker =
-    buildMypyBoto3Package "sagemaker" "1.43.67"
-      "sha256-MV/iTCqk8ESXYLzdilcHY0FQVx+tp7/lqradISrY/oA=";
+    buildMypyBoto3Package "sagemaker" "1.43.68"
+      "sha256-ta4JKDQQcZWhHcWTCFF+TASEH5VbxX7j487ptP8W1X8=";
 
   mypy-boto3-sagemaker-a2i-runtime =
     buildMypyBoto3Package "sagemaker-a2i-runtime" "1.43.0"
@@ -1194,8 +1194,8 @@ in
       "sha256-OxrliFuV8nojK9YroUDbJAUt1eECaLeW/Nnww0+iU5g=";
 
   mypy-boto3-sagemaker-runtime =
-    buildMypyBoto3Package "sagemaker-runtime" "1.43.29"
-      "sha256-Nou8wjJC8QYCAMD/AlsQYIfWt9qO9ysT3RRJKoQGevY=";
+    buildMypyBoto3Package "sagemaker-runtime" "1.43.68"
+      "sha256-aMnsrMCq0pwyRsPAzuvGVCdDFYNooHv334jmMcI5Mz0=";
 
   mypy-boto3-savingsplans =
     buildMypyBoto3Package "savingsplans" "1.43.0"
@@ -1346,8 +1346,8 @@ in
       "sha256-WEz+PMPa1ojI7uyLyMq2s5P6u19uBI/8pra73oWsyKA=";
 
   mypy-boto3-textract =
-    buildMypyBoto3Package "textract" "1.43.0"
-      "sha256-HT/oZkcrMOpYUruaOmwm88XHj9Mp8EGkceYczF4TVlo=";
+    buildMypyBoto3Package "textract" "1.43.69"
+      "sha256-RclJXtzfxHLiV/GLiIuPP553QGUC3BtI5EbiqChUbbs=";
 
   mypy-boto3-timestream-query =
     buildMypyBoto3Package "timestream-query" "1.43.0"
diff --git a/pkgs/development/python-modules/nanoemoji/default.nix b/pkgs/development/python-modules/nanoemoji/default.nix
index 75698fd3396f..88a3229fe411 100644
--- a/pkgs/development/python-modules/nanoemoji/default.nix
+++ b/pkgs/development/python-modules/nanoemoji/default.nix
@@ -23,14 +23,14 @@
 
 buildPythonPackage rec {
   pname = "nanoemoji";
-  version = "0.15.9";
+  version = "0.16.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "googlefonts";
     repo = "nanoemoji";
     tag = "v${version}";
-    hash = "sha256-T/d7gbw8n2I6amp3qAK/uo3Uf1qZ9teVOCIgkiMSkmE=";
+    hash = "sha256-FysyKC01XBnRiur5RR9fcsTxQqE8x0JJHSoe3q6JtKc=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/pynslookup/default.nix b/pkgs/development/python-modules/nslookup/default.nix
similarity index 85%
rename from pkgs/development/python-modules/pynslookup/default.nix
rename to pkgs/development/python-modules/nslookup/default.nix
index 411ded3d31be..ea2262922820 100644
--- a/pkgs/development/python-modules/pynslookup/default.nix
+++ b/pkgs/development/python-modules/nslookup/default.nix
@@ -7,7 +7,7 @@
 }:
 
 buildPythonPackage (finalAttrs: {
-  pname = "pynslookup";
+  pname = "nslookup";
   version = "1.9.0";
   pyproject = true;
 
@@ -30,6 +30,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Module to do DNS lookups";
     homepage = "https://github.com/wesinator/pynslookup";
+    changelog = "https://github.com/wesinator/pynslookup/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mpl20;
     maintainers = with lib.maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/openinference-instrumentation-openai/default.nix b/pkgs/development/python-modules/openinference-instrumentation-openai/default.nix
index 31a804841153..60e327ed4294 100644
--- a/pkgs/development/python-modules/openinference-instrumentation-openai/default.nix
+++ b/pkgs/development/python-modules/openinference-instrumentation-openai/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "openinference-instrumentation-openai";
-  version = "0.1.52";
+  version = "0.1.54";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -31,7 +31,7 @@ buildPythonPackage (finalAttrs: {
     owner = "Arize-ai";
     repo = "openinference";
     tag = "python-openinference-instrumentation-openai-v${finalAttrs.version}";
-    hash = "sha256-wmwqmN/rN521TaXVZfkaRzHPVhANSgKaBVc4rhXgIII=";
+    hash = "sha256-rEF7Ijx3Zo3NHywFJFa5+QpXZjIWOvkQBie+54v/f8A=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/python/instrumentation/${finalAttrs.pname}";
diff --git a/pkgs/development/python-modules/opuslib-next/default.nix b/pkgs/development/python-modules/opuslib-next/default.nix
index 3d4a30b96c0f..4d8fc0d3cdba 100644
--- a/pkgs/development/python-modules/opuslib-next/default.nix
+++ b/pkgs/development/python-modules/opuslib-next/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "opuslib-next";
-  version = "1.3.0";
+  version = "1.3.1";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -19,7 +19,7 @@ buildPythonPackage (finalAttrs: {
     owner = "kalicyh";
     repo = "opuslib-next";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rR1tsijKUBUH3bZZSISsx1JUO35TZevcTcfPtoQow/E=";
+    hash = "sha256-5pfv1wMqFuduoUn3HzVuygJdnpfTY/MdXhYZ5S83B2g=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/orbax-checkpoint/default.nix b/pkgs/development/python-modules/orbax-checkpoint/default.nix
index d09b7f14930d..3e822bd18242 100644
--- a/pkgs/development/python-modules/orbax-checkpoint/default.nix
+++ b/pkgs/development/python-modules/orbax-checkpoint/default.nix
@@ -42,7 +42,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "orbax-checkpoint";
-  version = "0.12.1";
+  version = "0.12.3";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -50,7 +50,7 @@ buildPythonPackage (finalAttrs: {
     owner = "google";
     repo = "orbax";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yE8M8f2c+4lTL56LrS57vU/MMM3NgYCZOuHZWbdODh0=";
+    hash = "sha256-uyObu0UdXRN5KgJhTTdkL2vJEjF9Lh0oOjMZENH4zck=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/checkpoint";
diff --git a/pkgs/development/python-modules/otter-grader/default.nix b/pkgs/development/python-modules/otter-grader/default.nix
index 7821be272a4d..42b5bbd5c31c 100644
--- a/pkgs/development/python-modules/otter-grader/default.nix
+++ b/pkgs/development/python-modules/otter-grader/default.nix
@@ -122,7 +122,7 @@ buildPythonPackage (finalAttrs: {
     # this R Markdown test, causing a partial credit output mismatch
     "test_rmd"
   ]
-  ++ lib.optionals stdenv.isDarwin [
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
     # socket.bind() fails under macOS sandbox
     "test_otter_example"
     "test_jupyterlite"
diff --git a/pkgs/development/python-modules/pdoc-pyo3-sample-library/default.nix b/pkgs/development/python-modules/pdoc-pyo3-sample-library/default.nix
index 50e889cc56bd..5f9550d68566 100644
--- a/pkgs/development/python-modules/pdoc-pyo3-sample-library/default.nix
+++ b/pkgs/development/python-modules/pdoc-pyo3-sample-library/default.nix
@@ -21,7 +21,7 @@ buildPythonPackage (finalAttrs: {
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
+    inherit (finalAttrs) pname version src;
     hash = "sha256-XqXkheK8OEzlLEbq09KMRFxrjJBnFaxvj4rIL2gmydA=";
   };
 
diff --git a/pkgs/development/python-modules/piano-transcription-inference/default.nix b/pkgs/development/python-modules/piano-transcription-inference/default.nix
deleted file mode 100644
index ee27efa042b5..000000000000
--- a/pkgs/development/python-modules/piano-transcription-inference/default.nix
+++ /dev/null
@@ -1,83 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchPypi,
-  fetchpatch,
-  fetchurl,
-  librosa,
-  matplotlib,
-  mido,
-  setuptools,
-  torch,
-  torchlibrosa,
-}:
-
-buildPythonPackage rec {
-  pname = "piano-transcription-inference";
-  version = "0.0.6";
-  pyproject = true;
-
-  src = fetchPypi {
-    pname = "piano_transcription_inference";
-    inherit version;
-    hash = "sha256-tt0A+bS8rLYUByXwO0E5peD0rNNaaeSSpdH3NOz70jE=";
-  };
-
-  checkpoint = fetchurl {
-    name = "piano-transcription-inference.pth";
-    # The download url can be found in
-    # https://github.com/qiuqiangkong/piano_transcription_inference/blob/master/piano_transcription_inference/inference.py
-    url = "https://zenodo.org/record/4034264/files/CRNN_note_F1%3D0.9677_pedal_F1%3D0.9186.pth?download=1";
-    hash = "sha256-w/qXMHJb9Kdi8cFLyAzVmG6s2gGwJvWkolJc1geHYUE=";
-  };
-
-  build-system = [ setuptools ];
-
-  dependencies = [
-    librosa
-    matplotlib
-    mido
-    torch
-    torchlibrosa
-  ];
-
-  patches = [
-    # Fix run against librosa 0.10.0
-    # https://github.com/qiuqiangkong/piano_transcription_inference/pull/14
-    (fetchpatch {
-      url = "https://github.com/qiuqiangkong/piano_transcription_inference/commit/b2d448916be771cd228f709c23c474942008e3e8.patch";
-      hash = "sha256-8O4VtFij//k3fhcbMRz4J8Iz4AdOPLkuk3UTxuCSy8U=";
-    })
-    (fetchpatch {
-      url = "https://github.com/qiuqiangkong/piano_transcription_inference/commit/61443632dc5ea69a072612b6fa3f7da62c96b72c.patch";
-      hash = "sha256-I9+Civ95BnPUX0WQhTU/pGQruF5ctIgkIdxCK+xO3PE=";
-    })
-  ];
-
-  postPatch = ''
-    substituteInPlace piano_transcription_inference/inference.py --replace \
-      "checkpoint_path='{}/piano_transcription_inference_data/note_F1=0.9677_pedal_F1=0.9186.pth'.format(str(Path.home()))" \
-      "checkpoint_path='$out/share/checkpoint.pth'"
-  '';
-
-  postInstall = ''
-    mkdir "$out/share"
-    ln -s "${checkpoint}" "$out/share/checkpoint.pth"
-  '';
-
-  # Project has no tests.
-  # In order to make pythonImportsCheck work, NUMBA_CACHE_DIR env var need to
-  # be set to a writable dir (https://github.com/numba/numba/issues/4032#issuecomment-488102702).
-  # pythonImportsCheck has no pre* hook, use checkPhase to workaround that.
-  checkPhase = ''
-    export NUMBA_CACHE_DIR="$(mktemp -d)"
-  '';
-  pythonImportsCheck = [ "piano_transcription_inference" ];
-
-  meta = {
-    description = "Piano transcription inference package";
-    homepage = "https://github.com/qiuqiangkong/piano_transcription_inference";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ azuwis ];
-  };
-}
diff --git a/pkgs/development/python-modules/pillow-jxl-plugin/default.nix b/pkgs/development/python-modules/pillow-jxl-plugin/default.nix
new file mode 100644
index 000000000000..395cb68d412c
--- /dev/null
+++ b/pkgs/development/python-modules/pillow-jxl-plugin/default.nix
@@ -0,0 +1,68 @@
+{
+  lib,
+  buildPythonPackage,
+  pytestCheckHook,
+  fetchPypi,
+  rustPlatform,
+  maturin,
+  cmake,
+  packaging,
+  pillow,
+  numpy,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "pillow-jxl-plugin";
+  version = "1.3.8";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  # Contains Cargo.lock
+  src = fetchPypi {
+    pname = "pillow_jxl_plugin";
+    inherit (finalAttrs) version;
+    hash = "sha256-RDD9d1eJl0IHnFSKfSU31tY88PHTIxgAlbwPbwPZ1Po=";
+  };
+
+  build-system = [ maturin ];
+
+  nativeBuildInputs = with rustPlatform; [
+    cargoSetupHook
+    maturinBuildHook
+    cmake
+  ];
+
+  dontUseCmakeConfigure = true;
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) src;
+    hash = "sha256-IiVTlKtKkfZnRXme7QFA5MS8PPiL8+riOYOEoNaHHXc=";
+  };
+
+  dependencies = [
+    packaging
+    pillow
+  ];
+
+  doCheck = false;
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    numpy
+  ];
+
+  pythonImportsCheck = [
+    "pillow_jxl"
+  ];
+
+  meta = {
+    changelog = "https://github.com/Isotr0py/pillow-jpegxl-plugin/releases/tag/v${finalAttrs.version}";
+    description = "Pillow plugin that adds support for JPEG XL files";
+    homepage = "https://github.com/Isotr0py/pillow-jpegxl-plugin";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [
+      dandellion
+      KunyaKud
+    ];
+  };
+})
diff --git a/pkgs/development/python-modules/plugwise/default.nix b/pkgs/development/python-modules/plugwise/default.nix
index d8128322a225..1cc831196982 100644
--- a/pkgs/development/python-modules/plugwise/default.nix
+++ b/pkgs/development/python-modules/plugwise/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "plugwise";
-  version = "1.14.4";
+  version = "1.14.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "plugwise";
     repo = "python-plugwise";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2VAvka9q3LxHMzPEuHgsTGZBmzTSrhb8GO8FQdv3Ohs=";
+    hash = "sha256-qWiHlCP7S2JNDGKNDaqH/zvNyY+wldOG+fls2YvBDLY=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/plumbum/default.nix b/pkgs/development/python-modules/plumbum/default.nix
index 4b08a851a397..137a7a66dd59 100644
--- a/pkgs/development/python-modules/plumbum/default.nix
+++ b/pkgs/development/python-modules/plumbum/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "plumbum";
-  version = "2.0.1";
+  version = "2.0.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tomerfiliba";
     repo = "plumbum";
     tag = "v${version}";
-    hash = "sha256-XwsEcAHvVhWQG5trznOvkfP8Al7kfMGSG2wR0sXY+eI=";
+    hash = "sha256-i99HpT/QuF9JwX92IwwOqpEVUc/1k39E7N9v9TZ4Qvg=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pqc-audit/default.nix b/pkgs/development/python-modules/pqc-audit/default.nix
index d6e7ccf7d82a..9a0f7540a2ff 100644
--- a/pkgs/development/python-modules/pqc-audit/default.nix
+++ b/pkgs/development/python-modules/pqc-audit/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pqc-audit";
-  version = "0.2.0";
+  version = "0.4.1";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -21,7 +21,7 @@ buildPythonPackage (finalAttrs: {
     owner = "rauleteee";
     repo = "pqc-scanner";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QzkytPYDVwoiISgsNhEbbWPLGRz9JKwiFbX2H5HtosI=";
+    hash = "sha256-6Nm73BvFNh8gxxWBzuvIBCJLCxO2px+H4c9iRYIMxi8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/primer3/default.nix b/pkgs/development/python-modules/primer3-py/default.nix
similarity index 98%
rename from pkgs/development/python-modules/primer3/default.nix
rename to pkgs/development/python-modules/primer3-py/default.nix
index 6fd5dcf066fb..3a8228698d47 100644
--- a/pkgs/development/python-modules/primer3/default.nix
+++ b/pkgs/development/python-modules/primer3-py/default.nix
@@ -12,7 +12,7 @@
 }:
 
 buildPythonPackage (finalAttrs: {
-  pname = "primer3";
+  pname = "primer3-py";
   version = "2.3.0";
   pyproject = true;
 
diff --git a/pkgs/development/python-modules/py-dactyl/default.nix b/pkgs/development/python-modules/py-dactyl/default.nix
index 8bed0ba855bc..6b5e3b929c43 100644
--- a/pkgs/development/python-modules/py-dactyl/default.nix
+++ b/pkgs/development/python-modules/py-dactyl/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "py-dactyl";
-  version = "2.1.2";
+  version = "2.1.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "iamkubi";
     repo = "pydactyl";
     tag = "v${version}";
-    hash = "sha256-/bmk4RIS8pEi+RbJ+6tOchwFj246hdoTXv6WBNisKuc=";
+    hash = "sha256-WgsykxwcpUasbYJdhM2s/+a7SaORzA7mW+9AhORxcbA=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pycambia/default.nix b/pkgs/development/python-modules/pycambia/default.nix
index 9501585b0931..1851ff11e104 100644
--- a/pkgs/development/python-modules/pycambia/default.nix
+++ b/pkgs/development/python-modules/pycambia/default.nix
@@ -20,7 +20,7 @@ buildPythonPackage (finalAttrs: {
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
+    inherit (finalAttrs) pname version src;
     hash = "sha256-w7n/W7PDC3+DPCb//X462mowhEPw0k3HA1raAeu4t/c=";
   };
 
diff --git a/pkgs/development/python-modules/pycdlib/default.nix b/pkgs/development/python-modules/pycdlib/default.nix
index 494f8075f0fa..deaccd228afe 100644
--- a/pkgs/development/python-modules/pycdlib/default.nix
+++ b/pkgs/development/python-modules/pycdlib/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pycdlib";
-  version = "1.16.0";
+  version = "1.20.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "clalancette";
     repo = "pycdlib";
     tag = "v${version}";
-    hash = "sha256-uJ9rMriRCLXpKekG8vGsIw+s0e6wlfX0soAYs6HGe0Y=";
+    hash = "sha256-4FkB1QkvbZ/GIlBM14jiGbc6m7MA5EIlq1LjeXGVXC0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pycrate/default.nix b/pkgs/development/python-modules/pycrate/default.nix
new file mode 100644
index 000000000000..d929ea9a7d66
--- /dev/null
+++ b/pkgs/development/python-modules/pycrate/default.nix
@@ -0,0 +1,68 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  cryptomobile,
+  pysctp,
+  lxml,
+  python,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "pycrate";
+  version = "0.8.1";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "pycrate-org";
+    repo = "pycrate";
+    tag = finalAttrs.version;
+    hash = "sha256-FUVEkzfDIbPw4e2ADMCnqycZjg9m1fvyLIU9xHwO6jA=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    cryptomobile # for NASLTE / NAS5G / corenet
+    pysctp # for corenet
+    lxml # for diameter_dict
+  ];
+
+  pythonImportsCheck = [
+    "pycrate_core"
+    "pycrate_ether"
+    "pycrate_media"
+    "pycrate_asn1c"
+    "pycrate_asn1dir"
+    "pycrate_asn1rt"
+    "pycrate_csn1"
+    "pycrate_csn1dir"
+    "pycrate_mobile"
+    "pycrate_diameter"
+    "pycrate_corenet"
+    "pycrate_sys"
+    "pycrate_crypto"
+    "pycrate_osmo"
+    "pycrate_gmr1"
+    "pycrate_gmr1_csn1"
+  ];
+
+  checkPhase = ''
+    runHook preCheck
+
+    cd test # working directory must be correct, so that resources can be accessed using relatives paths
+    find . -name '*.py' -exec ${python.interpreter} {} \;
+
+    runHook postCheck
+  '';
+
+  meta = {
+    description = "Software suite to handle various data and protocol formats";
+    homepage = "https://github.com/pycrate-org/pycrate";
+    changelog = "https://github.com/pycrate-org/pycrate/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ felbinger ];
+  };
+})
diff --git a/pkgs/development/python-modules/pygame-ce/default.nix b/pkgs/development/python-modules/pygame-ce/default.nix
index fd6efdd93aee..7ffb8bcdbc29 100644
--- a/pkgs/development/python-modules/pygame-ce/default.nix
+++ b/pkgs/development/python-modules/pygame-ce/default.nix
@@ -42,7 +42,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pygame-ce";
-  version = "2.5.7";
+  version = "2.5.8";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -50,7 +50,7 @@ buildPythonPackage (finalAttrs: {
     owner = "pygame-community";
     repo = "pygame-ce";
     tag = finalAttrs.version;
-    hash = "sha256-Yjs2SLgPVMOy8DCS+Pfk0fs0G//sY20jfGQNJ5rN58Q=";
+    hash = "sha256-1aUrnTllhaMjsCd/vVQ6aPDgcUdjBTPTeLzfrI6YLCI=";
     # Unicode files cause different checksums on HFS+ vs. other filesystems
     postFetch = "rm -rf $out/docs/reST";
   };
@@ -78,10 +78,10 @@ buildPythonPackage (finalAttrs: {
     # cython was pinned to fix windows build hangs (pygame-community/pygame-ce/pull/3015)
     ''
       substituteInPlace pyproject.toml \
-        --replace-fail "meson-python<=0.18.0" "meson-python" \
-        --replace-fail "meson<=1.10.0" "meson" \
+        --replace-fail "meson-python<=0.20.0" "meson-python" \
+        --replace-fail "meson<=1.11.2" "meson" \
         --replace-fail "ninja<=1.13.0" "ninja" \
-        --replace-fail "cython<=3.2.4" "cython" \
+        --replace-fail "cython<=3.2.9" "cython" \
         --replace-fail "sphinx<=8.2.3" "sphinx" \
         --replace-fail "astroid<4.0.0" "astroid" \
         --replace-fail "sphinx-autoapi<=3.6.0" "sphinx-autoapi" \
diff --git a/pkgs/development/python-modules/pygeosphere-warnings/default.nix b/pkgs/development/python-modules/pygeosphere-warnings/default.nix
new file mode 100644
index 000000000000..26a92718cf43
--- /dev/null
+++ b/pkgs/development/python-modules/pygeosphere-warnings/default.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  aiohttp,
+  buildPythonPackage,
+  fetchFromGitHub,
+  hatchling,
+  pytest-asyncio,
+  pytestCheckHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "pygeosphere-warnings";
+  version = "0.1.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "tklecka";
+    repo = "pygeosphere-warnings";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-AQ2TQk5N+S4bW0OmrZj0la2UMIdpmxBUCMhbIkszm3g=";
+  };
+
+  build-system = [ hatchling ];
+
+  dependencies = [ aiohttp ];
+
+  nativeCheckInputs = [
+    pytest-asyncio
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "pygeosphere_warnings" ];
+
+  meta = {
+    description = "Asynchronous Python client for the GeoSphere Austria Warn API";
+    homepage = "https://github.com/tklecka/pygeosphere-warnings";
+    changelog = "https://github.com/tklecka/pygeosphere-warnings/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.jamiemagee ];
+  };
+})
diff --git a/pkgs/development/python-modules/pyimouapi/default.nix b/pkgs/development/python-modules/pyimouapi/default.nix
index 5b3e673949f8..0e31748b5f50 100644
--- a/pkgs/development/python-modules/pyimouapi/default.nix
+++ b/pkgs/development/python-modules/pyimouapi/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pyimouapi";
-  version = "1.3.3";
+  version = "1.3.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Imou-OpenPlatform";
     repo = "Py-Imou-Open-Api";
     tag = finalAttrs.version;
-    hash = "sha256-g70zYBmhQXlk1EUExqWuHWDenx8ZCcnMvh8wo1hLS4g=";
+    hash = "sha256-rX6BQFxUktrlZAhjRySheQRbEu6TFKxZwpjIi1wx85I=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pysctp/default.nix b/pkgs/development/python-modules/pysctp/default.nix
new file mode 100644
index 000000000000..061dfca0202d
--- /dev/null
+++ b/pkgs/development/python-modules/pysctp/default.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  lksctp-tools,
+  python,
+}:
+buildPythonPackage (finalAttrs: {
+  pname = "pysctp";
+  version = "0.7.3";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "P1sec";
+    repo = "pysctp";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-CtWS+tuh2+Q9Hr64W6bsPE2v020BpnUJ5FDHblGCcYs=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ lksctp-tools ];
+
+  pythonImportsCheck = [ "sctp" ];
+
+  # running the tests fails with OSError: [Errno 93] Protocol not supported
+  doCheck = false;
+
+  meta = {
+    description = "SCTP stack for Python";
+    homepage = "https://github.com/P1sec/pysctp";
+    changelog = "https://github.com/pycrate-org/pycrate/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ felbinger ];
+  };
+})
diff --git a/pkgs/development/python-modules/pysquashfsimage/default.nix b/pkgs/development/python-modules/pysquashfsimage/default.nix
new file mode 100644
index 000000000000..4d21ba06a6fb
--- /dev/null
+++ b/pkgs/development/python-modules/pysquashfsimage/default.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "pysquashfsimage";
+  version = "0.9.0";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "matteomattei";
+    repo = "PySquashfsImage";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-yQnXqCe/nMx+HGgNThdlnyvdNI++6n3iC3c0YvFl0Jk=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  pythonImportsCheck = [ "PySquashfsImage" ];
+
+  # No tests
+  doCheck = false;
+
+  meta = {
+    description = "Python library to read Squashfs image files";
+    homepage = "https://github.com/matteomattei/PySquashfsImage";
+    changelog = "https://github.com/matteomattei/PySquashfsImage/releases/tag/${finalAttrs.src.tag}";
+    license = with lib.licenses; [
+      gpl3Only
+      lgpl21Only
+    ];
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+})
diff --git a/pkgs/development/python-modules/pytapo/default.nix b/pkgs/development/python-modules/pytapo/default.nix
index 31585d9db518..145a04d48aaa 100644
--- a/pkgs/development/python-modules/pytapo/default.nix
+++ b/pkgs/development/python-modules/pytapo/default.nix
@@ -12,12 +12,12 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pytapo";
-  version = "3.4.15";
+  version = "3.4.18";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-2hC/MccVar7Xce5TL26qwVMrFQ+bxngiCitNx08Sz3E=";
+    hash = "sha256-N8s4L8quSWlChU4BSKnLDqY6WboJbcuYLNaFwPEeNnI=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/python-kadmin-rs/default.nix b/pkgs/development/python-modules/python-kadmin-rs/default.nix
index 97ec9779d83b..122ce43bf46e 100644
--- a/pkgs/development/python-modules/python-kadmin-rs/default.nix
+++ b/pkgs/development/python-modules/python-kadmin-rs/default.nix
@@ -20,7 +20,7 @@ buildPythonPackage (finalAttrs: {
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
+    inherit (finalAttrs) pname version src;
     hash = "sha256-NXPc8hssmMXcmuK15oF5CIV+cUAmRoml6BXYhIkRdvI=";
   };
 
diff --git a/pkgs/development/python-modules/ray/default.nix b/pkgs/development/python-modules/ray/default.nix
index 9ced1b9c373c..b3e46194b649 100644
--- a/pkgs/development/python-modules/ray/default.nix
+++ b/pkgs/development/python-modules/ray/default.nix
@@ -60,6 +60,8 @@
   scipy,
   # serve
   fastapi,
+  jinja2,
+  mmh3,
   starlette,
   uvicorn,
   watchfiles,
@@ -73,7 +75,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "ray";
-  version = "2.56.1";
+  version = "2.57.0";
   format = "wheel";
   __structuredAttrs = true;
 
@@ -91,22 +93,22 @@ buildPythonPackage (finalAttrs: {
       # Results are in ./ray-hashes.nix
       hashes = {
         x86_64-linux = {
-          cp311 = "sha256-5wA6R6Qu8q0z7As03Ftq+wP2P+WUZeb0yPbQVJLZ5KY=";
-          cp312 = "sha256-5dMXNpaDETTHa9CUUd/pXDLXLCcSU7DWsJ0t+ZlKpmA=";
-          cp313 = "sha256-gfLbICzDG8P1xKz57xVNEPHzns5gLZ0tMQiHXEm/AcM=";
-          cp314 = "sha256-rpH+V4+t6jjBOiCKD+wn4c7SOMzfX/+V7z4wrDBx3sk=";
+          cp311 = "sha256-sMw9Q1vvbn/+hIgW5zadMO4pfojEwavGMjzJOD/zgm8=";
+          cp312 = "sha256-WV0Iix/RrdZGVMbOviA+JZA3h7ZQ01xKPcAI1FHkikE=";
+          cp313 = "sha256-caocUv54AM0he2Ab+f9VfCo//l+tWwD2eS2ppniyyRQ=";
+          cp314 = "sha256-AssrX99BJG9rkwbIUkfucTG/7unTak7a5UZT4C7XiQw=";
         };
         aarch64-linux = {
-          cp311 = "sha256-TfRfM8wXaxHGkZHv3PtKzq7qIv7Pp4T2SFtlBO+MiyY=";
-          cp312 = "sha256-j91rCWIVkGzx+azceJjJ1hQGBvLSckV3i4OFqfGebLA=";
-          cp313 = "sha256-f9xH3k4jDw23xsZoqeFh+GTaxUi9MiMJhuCww244brU=";
-          cp314 = "sha256-6jcsf5WxTx928L3Sq8lgLFboi8MGmdIij3gTPndJsvE=";
+          cp311 = "sha256-epgm4zv69GUhmrMp4F8D4/apGfzl0haS9axWakQnfLM=";
+          cp312 = "sha256-7rHRrbYb0div/cX7VVrwSU/tj+xTuDV21MYPgR4GvpQ=";
+          cp313 = "sha256-Xi2SWPdRZ291gdwK0wfC2RKQglRCNmEoye0MzQ9guEU=";
+          cp314 = "sha256-4kiTkpbwyPRrPnNCFVV3YJSXKx28c9SAJHm5kXfCJp4=";
         };
         aarch64-darwin = {
-          cp311 = "sha256-XuvXds1GHt68WHTS37owBRR7a0VkXYoWplSTEcXv/+o=";
-          cp312 = "sha256-RLwAAMW/rYWy/24O+R6V+QHRotL91y+U8IoEbrSUzWE=";
-          cp313 = "sha256-k97atlgzSvgYd7bthAxOX4Xi4LGzZBsg6q7jfK2DXMY=";
-          cp314 = "sha256-dvYmimacHZkQ8de3OQPePt6YUO2U0+KDGNSVVZvTfQ4=";
+          cp311 = "sha256-oBbWJYtTVxlS8qglFXGy1z2PawmBvmxh4WDMkBtxGHE=";
+          cp312 = "sha256-jvWRV1xTF5P+t/d3RMUsNFCf9YtIsw0KO8tqFmYlawI=";
+          cp313 = "sha256-IbZ+3cdRuoxl3u6GVAdcK0KFEQTJNs5CynlExLbsR5k=";
+          cp314 = "sha256-eYoe4k5O3jnpAPzJNdhttfCA0np0xX4yOKUAS6kXEgA=";
         };
       };
     in
@@ -215,10 +217,16 @@ buildPythonPackage (finalAttrs: {
     serve = lib.unique (
       [
         fastapi
+        # Undeclared upstream: `ray.serve._private.haproxy`, imported by the serve controller since
+        # 2.57.0, needs it
+        jinja2
+        mmh3
         requests
         starlette
         uvicorn
         watchfiles
+        # `ray-haproxy` (upstream, linux-only) is not packaged: it only ships an HAProxy binary, and
+        # ray falls back to `haproxy` from PATH
       ]
       ++ self.default
     );
diff --git a/pkgs/development/python-modules/redisvl/default.nix b/pkgs/development/python-modules/redisvl/default.nix
index b013caa48ec0..b95b33a9b86d 100644
--- a/pkgs/development/python-modules/redisvl/default.nix
+++ b/pkgs/development/python-modules/redisvl/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "redisvl";
-  version = "0.25.0";
+  version = "0.25.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "redis";
     repo = "redis-vl-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+b27+c3S/XNRTIyXyqgjV6Z5MD9GnuqjrpME09qyEog=";
+    hash = "sha256-SDNcGmARLaRdAqqzmJf5lBeGsiPCj5xbsdyzYdaYl0w=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/rerun-notebook/default.nix b/pkgs/development/python-modules/rerun-notebook/default.nix
index 208fa166fa35..90d78ca850c2 100644
--- a/pkgs/development/python-modules/rerun-notebook/default.nix
+++ b/pkgs/development/python-modules/rerun-notebook/default.nix
@@ -22,7 +22,7 @@ buildPythonPackage (finalAttrs: {
     inherit (finalAttrs) version;
     format = "wheel";
     python = "py2.py3";
-    hash = "sha256-PMhHz/rTB3yIOg80g/dt/ktq4pHZ6hNrCYdlp70dcOI=";
+    hash = "sha256-2w2Jvoz/L5VPx4dGcYyQkdcitoPO+NJCzuAxeJR9JHM=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/rerun-sdk/default.nix b/pkgs/development/python-modules/rerun-sdk/default.nix
index ca0f5893deb4..c09a4905d7ea 100644
--- a/pkgs/development/python-modules/rerun-sdk/default.nix
+++ b/pkgs/development/python-modules/rerun-sdk/default.nix
@@ -12,10 +12,9 @@
   # dependencies
   attrs,
   numpy,
-  opencv4,
   pillow,
+  psutil,
   pyarrow,
-  semver,
   typing-extensions,
 
   # tests
@@ -23,9 +22,10 @@
   datafusion,
   inline-snapshot,
   polars,
-  pytest-snapshot,
   pytestCheckHook,
   rerun-notebook,
+  semver,
+  syrupy,
   tomli,
   torch,
   torchvision,
@@ -67,7 +67,7 @@ buildPythonPackage {
     # dependencies), so they are never codegen'd and runtime dispatch falls back to the equivalent
     # AVX2 / scalar kernels.
     + ''
-      lanceDistance="$cargoDepsCopy/source-registry-0/lance-linalg-8.0.0/src/distance"
+      lanceDistance="$cargoDepsCopy/source-registry-0/lance-linalg-9.0.0/src/distance"
 
       substituteInPlace "$lanceDistance/dot_u8.rs" \
         --replace-fail "return |a, b| unsafe { x86::dot_u8_avx512_vnni(a, b) };" ""
@@ -89,10 +89,9 @@ buildPythonPackage {
   dependencies = [
     attrs
     numpy
-    opencv4
     pillow
+    psutil
     pyarrow
-    semver
     typing-extensions
   ];
 
@@ -115,9 +114,10 @@ buildPythonPackage {
     datafusion
     inline-snapshot
     polars
-    pytest-snapshot
     pytestCheckHook
     rerun-notebook
+    semver
+    syrupy
     tomli
     torch
     torchvision
@@ -126,11 +126,15 @@ buildPythonPackage {
   inherit (rerun) addDlopenRunpaths addDlopenRunpathsPhase;
   postPhases = lib.optionals stdenv.hostPlatform.isLinux [ "addDlopenRunpathsPhase" ];
 
+  pytestFlags = [
+    # Some checked-in `.ambr` entries belong to tests skipped below (and to tests upstream has since
+    # removed). syrupy fails the whole session over unused snapshots by default.
+    "--snapshot-warn-unused"
+  ];
+
   disabledTests = [
     # RuntimeError: MP4 error: MP4 demux: MP4 error: file contains a box with a larger size than it
-    "test_allow_b_frames_opts_in_to_b_frame_inputs"
     "test_asset_mode_timeline_type_timestamp_applies_to_index_chunk"
-    "test_b_frames_in_stream_mode_raise"
     "test_custom_entity_path_applies_to_every_chunk"
     "test_default_mode_produces_video_stream_chunks"
     "test_output_codec_same_as_source_stays_on_the_direct_path"
@@ -154,14 +158,6 @@ buildPythonPackage {
     "test_server_with_multiple_datasets"
     "test_viewer_dies_on_client_close"
 
-    # TypeError: 'Snapshot' object is not callable
-    "test_chunk_record_batch"
-    "test_schema_recording"
-
-    # pytest_snapshot mismatch: serialized schema/summary output drifted in 0.32.0
-    "test_schema"
-    "test_summary_format"
-
     # AttributeError: 'datetime.datetime' object has no attribute 'value'
     "test_lenses_time_extraction"
 
@@ -188,6 +184,10 @@ buildPythonPackage {
     # real binaries (rerun.src is fetched without fetchLFS).
     "rerun_py/tests/integration/test_hdf5_reader.py"
 
+    # ModuleNotFoundError: No module named 'mdlint'. It sits next to the test file, which is
+    # not on `sys.path` as `scripts/ci` has no `__init__.py`.
+    "scripts/ci/mdlint_test.py"
+
     # "fixture 'benchmark' not found"
     "tests/python/log_benchmark/test_log_benchmark.py"
     "tests/python/log_benchmark/test_micro_benchmark.py"
@@ -198,7 +198,8 @@ buildPythonPackage {
     # ConnectionError: Connection: connecting to server: transport error
     "rerun_py/tests/api_sandbox/"
 
-    # RuntimeError: Failed to load URDF file: No elements found
+    # RuntimeError: Failed to load URDF file: No elements found. `so100.urdf` is a Git LFS
+    # pointer file, not the real model (rerun.src is fetched without fetchLFS).
     "rerun_py/tests/unit/test_urdf_tree.py"
   ];
 
diff --git a/pkgs/development/python-modules/retinaface/default.nix b/pkgs/development/python-modules/retina-face/default.nix
similarity index 87%
rename from pkgs/development/python-modules/retinaface/default.nix
rename to pkgs/development/python-modules/retina-face/default.nix
index ba90167166d9..005ab1ee7864 100644
--- a/pkgs/development/python-modules/retinaface/default.nix
+++ b/pkgs/development/python-modules/retina-face/default.nix
@@ -19,25 +19,19 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
-  pname = "retinaface";
+buildPythonPackage (finalAttrs: {
+  pname = "retina-face";
   version = "0.0.17";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "serengil";
     repo = "retinaface";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-0s1CSGlK2bF1F2V/IuG2ZqD7CkNfHGvp1M5C3zDnuKs=";
   };
 
-  # requires internet connection
-  disabledTestPaths = [
-    "tests/test_actions.py"
-    "tests/test_align_first.py"
-    "tests/test_expand_face_area.py"
-  ];
-
   build-system = [ setuptools ];
 
   dependencies = [
@@ -52,13 +46,20 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [ pytestCheckHook ];
 
+  # requires internet connection
+  disabledTestPaths = [
+    "tests/test_actions.py"
+    "tests/test_align_first.py"
+    "tests/test_expand_face_area.py"
+  ];
+
   pythonImportsCheck = [ "retinaface" ];
 
   meta = {
     description = "Deep Face Detection Library for Python";
     homepage = "https://github.com/serengil/retinaface";
-    changelog = "https://github.com/serengil/retinaface/releases/tag/v${version}";
+    changelog = "https://github.com/serengil/retinaface/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ derdennisop ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/rtoml/default.nix b/pkgs/development/python-modules/rtoml/default.nix
index 9c69d83d00ba..71081a4a3154 100644
--- a/pkgs/development/python-modules/rtoml/default.nix
+++ b/pkgs/development/python-modules/rtoml/default.nix
@@ -2,37 +2,45 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  libiconv,
+  rustPlatform,
+
+  # tests
   dirty-equals,
   pytest-benchmark,
   pytestCheckHook,
-  rustPlatform,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "rtoml";
-  version = "0.10";
+  version = "0.13";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "samuelcolvin";
     repo = "rtoml";
-    rev = "v${version}";
-    hash = "sha256-1movtKMQkQ6PEpKpSkK0Oy4AV0ee7XrS0P9m6QwZTaM=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-QrGoMxNGKQS0En2txZq+mxxWpzwLbHRxqdsAZ1J/bcc=";
   };
 
+  # The `generate-import-lib` PyO3 feature only matters when building Windows import libraries;
+  # on other platforms it just pulls in the `python3-dll-a` crate, which is not vendored.
+  # Drop it so the offline maturin build resolves.
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail ', "pyo3/generate-import-lib"' ""
+  '';
+
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit pname version src;
-    hash = "sha256-/elui0Rf3XwvD2jX+NGoJgf9S3XSp16qzdwkGZbKaZg=";
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-qHd82jdOyaIqVFFt+ZrHIH0EPwlLJpCFCrx15DN5Rig=";
   };
 
-  build-system = with rustPlatform; [
+  nativeBuildInputs = with rustPlatform; [
     cargoSetupHook
     maturinBuildHook
   ];
 
-  buildInputs = [ libiconv ];
-
   pythonImportsCheck = [ "rtoml" ];
 
   nativeCheckInputs = [
@@ -43,19 +51,11 @@ buildPythonPackage rec {
 
   pytestFlags = [ "--benchmark-disable" ];
 
-  disabledTests = [
-    # TypeError: loads() got an unexpected keyword argument 'name'
-    "test_load_data_toml"
-  ];
-
-  preCheck = ''
-    rm -rf rtoml
-  '';
-
   meta = {
     description = "Rust based TOML library for Python";
     homepage = "https://github.com/samuelcolvin/rtoml";
+    changelog = "https://github.com/samuelcolvin/rtoml/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ GaetanLepage ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index 967f0f49c7a4..a8379ec907e8 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -131,10 +131,6 @@ buildPythonPackage (finalAttrs: {
     "test_hyp0f1_gh5764"
     "test_simple_det_shapes_real_complex"
   ]
-  ++ lib.optionals (python.isPy311) [
-    # https://github.com/scipy/scipy/issues/22789 Observed only with Python 3.11
-    "test_funcs"
-  ]
   ++ lib.optionals (python.isPy312) [
     # failure caused by the inconsistent RNG implementation across python versions
     # https://github.com/NixOS/nixpkgs/issues/547063
diff --git a/pkgs/development/python-modules/showit/default.nix b/pkgs/development/python-modules/showit/default.nix
deleted file mode 100644
index 5d22ce607c53..000000000000
--- a/pkgs/development/python-modules/showit/default.nix
+++ /dev/null
@@ -1,42 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  setuptools,
-  numpy,
-  matplotlib,
-  pytestCheckHook,
-}:
-
-buildPythonPackage {
-  pname = "showit";
-  version = "1.1.4";
-  pyproject = true;
-
-  __structuredAttrs = true;
-
-  src = fetchFromGitHub {
-    owner = "freeman-lab";
-    repo = "showit";
-    rev = "ef76425797c71fbe3795b4302c49ab5be6b0bacb"; # no tags in repo
-    hash = "sha256-JrcqfQtSjbbOhr5quHE+QwlKsA6eUpCifLRzTrOOqHU=";
-  };
-
-  build-system = [ setuptools ];
-
-  dependencies = [
-    numpy
-    matplotlib
-  ];
-
-  nativeCheckInputs = [ pytestCheckHook ];
-
-  pythonImportsCheck = [ "showit" ];
-
-  meta = {
-    description = "Simple and sensible display of images";
-    homepage = "https://github.com/freeman-lab/showit";
-    license = lib.licenses.mit;
-    maintainers = [ ];
-  };
-}
diff --git a/pkgs/development/python-modules/simple-pid/default.nix b/pkgs/development/python-modules/simple-pid/default.nix
index 2871d0521912..a1a8baa5f6c5 100644
--- a/pkgs/development/python-modules/simple-pid/default.nix
+++ b/pkgs/development/python-modules/simple-pid/default.nix
@@ -27,7 +27,7 @@ buildPythonPackage (finalAttrs: {
     "simple_pid"
   ];
 
-  doCheck = !stdenv.isDarwin;
+  doCheck = !stdenv.hostPlatform.isDarwin;
 
   nativeCheckInputs = [
     pytestCheckHook
diff --git a/pkgs/development/python-modules/siphashc/default.nix b/pkgs/development/python-modules/siphashc/default.nix
index 8e274550fb89..55ef3e92672e 100644
--- a/pkgs/development/python-modules/siphashc/default.nix
+++ b/pkgs/development/python-modules/siphashc/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "siphashc";
-  version = "2.7";
+  version = "2.8";
   pyproject = true;
   build-system = [ setuptools ];
 
@@ -16,7 +16,7 @@ buildPythonPackage (finalAttrs: {
     owner = "WeblateOrg";
     repo = "siphashc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Rj+0oIlGs2Xs2TTN0PIwcVUlTgd1AZITC8xBf/Hn31Q=";
+    hash = "sha256-ZlTBDsb8g04PJe7vQ5AJ0Ndp1CJsN+/R8kM6xA+EtFM=";
   };
 
   nativeCheckInputs = [ pytestCheckHook ];
diff --git a/pkgs/development/python-modules/sklearn2pmml/default.nix b/pkgs/development/python-modules/sklearn2pmml/default.nix
index 9d666848865b..fa7c9ccc3377 100644
--- a/pkgs/development/python-modules/sklearn2pmml/default.nix
+++ b/pkgs/development/python-modules/sklearn2pmml/default.nix
@@ -33,14 +33,14 @@ let
 in
 buildPythonPackage (finalAttrs: {
   pname = "sklearn2pmml";
-  version = "0.131.0";
+  version = "0.132.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jpmml";
     repo = "sklearn2pmml";
     tag = finalAttrs.version;
-    hash = "sha256-FHk5vsXksVJs873VJqfX85nkRkojYBhaivbPIv1FReU=";
+    hash = "sha256-86nsTPmHVolQzyqK58QEFJJ77l4OFEhmmGD1AbaJbGg=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/slicedimage/default.nix b/pkgs/development/python-modules/slicedimage/default.nix
deleted file mode 100644
index c770f9cd8e70..000000000000
--- a/pkgs/development/python-modules/slicedimage/default.nix
+++ /dev/null
@@ -1,53 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  boto3,
-  diskcache,
-  packaging,
-  numpy,
-  requests,
-  scikit-image,
-  six,
-  pytestCheckHook,
-  tifffile,
-}:
-
-buildPythonPackage rec {
-  pname = "slicedimage";
-  version = "4.1.1";
-  format = "setuptools";
-
-  src = fetchFromGitHub {
-    owner = "spacetx";
-    repo = "slicedimage";
-    rev = version;
-    sha256 = "1vpg8varvfx0nj6xscdfm7m118hzsfz7qfzn28r9rsfvrhr0dlcw";
-  };
-
-  propagatedBuildInputs = [
-    boto3
-    diskcache
-    packaging
-    numpy
-    requests
-    scikit-image
-    six
-    tifffile
-  ];
-
-  nativeCheckInputs = [ pytestCheckHook ];
-
-  # Ignore tests which require setup, check again if disabledTestFiles can be used
-  disabledTestPaths = [ "tests/io_" ];
-
-  pythonImportsCheck = [ "slicedimage" ];
-
-  meta = {
-    description = "Library to access sliced imaging data";
-    mainProgram = "slicedimage";
-    homepage = "https://github.com/spacetx/slicedimage";
-    license = lib.licenses.mit;
-    maintainers = [ ];
-  };
-}
diff --git a/pkgs/development/python-modules/staticmap/default.nix b/pkgs/development/python-modules/staticmap/default.nix
index 55beaed32d8a..d9bbb37f25c5 100644
--- a/pkgs/development/python-modules/staticmap/default.nix
+++ b/pkgs/development/python-modules/staticmap/default.nix
@@ -2,21 +2,26 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  setuptools,
   pillow,
   requests,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "staticmap";
   version = "0.5.7";
-  format = "setuptools";
+  pyproject = true;
+
+  __structuredAttrs = true;
 
   src = fetchPypi {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-x6lrkCumEpLoGMILCBBhnWuBps21C8wauS1QrE2yCn8=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     requests
     pillow
   ];
@@ -32,4 +37,4 @@ buildPythonPackage rec {
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ traxys ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/stringzilla/default.nix b/pkgs/development/python-modules/stringzilla/default.nix
index 386160b5abda..ca52cba1b35f 100644
--- a/pkgs/development/python-modules/stringzilla/default.nix
+++ b/pkgs/development/python-modules/stringzilla/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "stringzilla";
-  version = "5.0.7";
+  version = "5.1.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ashvardanian";
     repo = "stringzilla";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qVWHbtr3lo2LGX376Ctuo6hzRRXTpEug7a77UZCVd70=";
+    hash = "sha256-RENsISsEfDJaoQK9v9i6vM3OId7FREw5hixpEUETfEw=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/stripe/default.nix b/pkgs/development/python-modules/stripe/default.nix
index b6a50ee469de..8e693fad891c 100644
--- a/pkgs/development/python-modules/stripe/default.nix
+++ b/pkgs/development/python-modules/stripe/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "stripe";
-  version = "15.4.0";
+  version = "15.5.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-+UwngKdyjF+0l4ng+7GOmEJn+T+nJOhACzGuvzbQGx4=";
+    hash = "sha256-a3EEiycKBsE5nJ/2F55pB8eCXsOU9XmpczQNXCuFda4=";
   };
 
   build-system = [ flit-core ];
diff --git a/pkgs/development/python-modules/thriftpy2/default.nix b/pkgs/development/python-modules/thriftpy2/default.nix
index b6e771173698..13de83734440 100644
--- a/pkgs/development/python-modules/thriftpy2/default.nix
+++ b/pkgs/development/python-modules/thriftpy2/default.nix
@@ -41,7 +41,7 @@ buildPythonPackage rec {
   meta = {
     description = "Python module for Apache Thrift";
     homepage = "https://github.com/Thriftpy/thriftpy2";
-    changelog = "https://github.com/Thriftpy/thriftpy2/blob/${src.tag}/CHANGES.rst";
+    changelog = "https://github.com/Thriftpy/thriftpy2/releases/tag/${src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/timy/default.nix b/pkgs/development/python-modules/timy/default.nix
index 04737441bd48..28eefb04070a 100644
--- a/pkgs/development/python-modules/timy/default.nix
+++ b/pkgs/development/python-modules/timy/default.nix
@@ -2,13 +2,16 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  setuptools,
   pytestCheckHook,
 }:
 
 buildPythonPackage {
   pname = "timy";
   version = "0.4.2";
-  format = "setuptools";
+  pyproject = true;
+
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "ramonsaraiva";
@@ -17,10 +20,14 @@ buildPythonPackage {
     hash = "sha256-4Opaph8Q1tQH+C/Epur8AA26RN4vO944DjCg0zDJqxM=";
   };
 
+  build-system = [ setuptools ];
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
 
+  pythonImportsCheck = [ "timy" ];
+
   meta = {
     description = "Minimalist measurement of python code time";
     homepage = "https://github.com/ramonsaraiva/timy";
diff --git a/pkgs/development/python-modules/tlparse/default.nix b/pkgs/development/python-modules/tlparse/default.nix
index ad9dbe6999e4..3093b0f0c32d 100644
--- a/pkgs/development/python-modules/tlparse/default.nix
+++ b/pkgs/development/python-modules/tlparse/default.nix
@@ -22,8 +22,7 @@ buildPythonPackage (finalAttrs: {
 
   cargoHash = "sha256-q5JaOacChdg57dBL5vQjYd1ht2fBBYnw6+RFIWXYfkY=";
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
-    name = "${finalAttrs.pname}-${finalAttrs.version}";
+    inherit (finalAttrs) pname version src;
     hash = finalAttrs.cargoHash;
   };
 
diff --git a/pkgs/development/python-modules/typechecks/default.nix b/pkgs/development/python-modules/typechecks/default.nix
index 5899598cab52..0361156d611a 100644
--- a/pkgs/development/python-modules/typechecks/default.nix
+++ b/pkgs/development/python-modules/typechecks/default.nix
@@ -2,12 +2,13 @@
   buildPythonPackage,
   fetchFromGitHub,
   lib,
+  setuptools,
 }:
 
 buildPythonPackage {
   pname = "typechecks";
   version = "unstable-2023-07-13";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "openvax";
@@ -18,6 +19,8 @@ buildPythonPackage {
     hash = "sha256-GdmBtkyuzLfpk6oneWgJ5M1bnhGJ5/lSbGliwoAQWZs=";
   };
 
+  build-system = [ setuptools ];
+
   pythonImportsCheck = [ "typechecks" ];
 
   meta = {
diff --git a/pkgs/development/python-modules/udsoncan/default.nix b/pkgs/development/python-modules/udsoncan/default.nix
index 0dd4699d080e..575c51ead647 100644
--- a/pkgs/development/python-modules/udsoncan/default.nix
+++ b/pkgs/development/python-modules/udsoncan/default.nix
@@ -23,6 +23,9 @@ buildPythonPackage (finalAttrs: {
     setuptools
   ];
 
+  # test/test_connection.py binds a socket on 127.0.0.1
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/uhashring/default.nix b/pkgs/development/python-modules/uhashring/default.nix
index 513dd2ddab72..06c7534bebf6 100644
--- a/pkgs/development/python-modules/uhashring/default.nix
+++ b/pkgs/development/python-modules/uhashring/default.nix
@@ -8,14 +8,14 @@
 }:
 buildPythonPackage rec {
   pname = "uhashring";
-  version = "2.4";
+  version = "2.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ultrabug";
     repo = "uhashring";
     tag = version;
-    hash = "sha256-6zNPExbcwTUne0lT8V6xp2Gf6J1VgG7Q93qizVOAc+k=";
+    hash = "sha256-rxYAqzyGqS+Pp70jD36bvXJHvMshUWbTvmqB+H+3BAM=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/unearth/default.nix b/pkgs/development/python-modules/unearth/default.nix
index a2f6ab05c389..bfced8e1259f 100644
--- a/pkgs/development/python-modules/unearth/default.nix
+++ b/pkgs/development/python-modules/unearth/default.nix
@@ -32,6 +32,12 @@ buildPythonPackage rec {
       hash = "sha256-t/Ubv9qC1Fvh4JsnfVgOZO/O7ZpCGHugBUt9qAjnH8c=";
       excludes = [ "pdm.lock" ];
     })
+    # Remove when updating to the first release containing this fix.
+    (fetchpatch {
+      name = "CVE-2026-73030.patch";
+      url = "https://github.com/frostming/unearth/commit/6c78164e7bfa28b8b3d6f247b87e560692e3c8ba.patch";
+      hash = "sha256-OEf4YnpNhZcIWaFMSXQP0SA7kRV9FqKIpnkLbUrQj+4=";
+    })
   ];
 
   build-system = [ pdm-backend ];
diff --git a/pkgs/development/python-modules/unstructured-client/default.nix b/pkgs/development/python-modules/unstructured-client/default.nix
index c3f913ce991d..60a62567e972 100644
--- a/pkgs/development/python-modules/unstructured-client/default.nix
+++ b/pkgs/development/python-modules/unstructured-client/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "unstructured-client";
-  version = "0.45.0";
+  version = "0.46.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Unstructured-IO";
     repo = "unstructured-python-client";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-K4+k1wKFvT2JYElt2SdBFKJGpFdC15Bu8Aa+M/c7JSQ=";
+    hash = "sha256-Q1REvlD14WYQS8r51XsjheK8BZMSgSvQZQx5wmNjkXo=";
   };
 
   preBuild = ''
diff --git a/pkgs/development/python-modules/vllm/default.nix b/pkgs/development/python-modules/vllm/default.nix
index 603e4f206d0b..8de59e998e5a 100644
--- a/pkgs/development/python-modules/vllm/default.nix
+++ b/pkgs/development/python-modules/vllm/default.nix
@@ -101,7 +101,7 @@
   py-libnuma,
   # cuda-only
   cupy,
-  flashinfer,
+  flashinfer-python,
   nvidia-ml-py,
   # rocm-only
   bash,
@@ -595,7 +595,7 @@ buildPythonPackage.override { stdenv = torch.stdenv; } (finalAttrs: {
   ]
   ++ lib.optionals cudaSupport [
     cupy
-    flashinfer
+    flashinfer-python
     nvidia-ml-py
     tokenspeed-mla
   ]
diff --git a/pkgs/development/python-modules/wandb/default.nix b/pkgs/development/python-modules/wandb/default.nix
index cc5467662ba6..4a9e2274a95b 100644
--- a/pkgs/development/python-modules/wandb/default.nix
+++ b/pkgs/development/python-modules/wandb/default.nix
@@ -13,6 +13,9 @@
   ## wandb-xpu
   rustPlatform,
 
+  ## parquet-rust-wrapper
+  cacert,
+
   ## wandb
   buildPythonPackage,
 
@@ -21,6 +24,7 @@
 
   # dependencies
   click,
+  opentelemetry-api,
   packaging,
   platformdirs,
   protobuf,
@@ -76,22 +80,22 @@
 }:
 
 let
-  version = "0.28.1";
+  version = "0.28.2";
   src = fetchFromGitHub {
     owner = "wandb";
     repo = "wandb";
     tag = "v${version}";
-    hash = "sha256-yXsSHyPOh3QXRRkTL4Rj8lLuFjp1LIKfPiacy4+obAk=";
+    hash = "sha256-kmgLHb+1NjStqcjMOYPPU2v2js4m8O3b2OpM6BiSbXI=";
   };
 
   wandb-xpu = rustPlatform.buildRustPackage {
     pname = "wandb-xpu";
-    version = "0.7.0";
+    version = "0.7.1";
     inherit src;
 
     sourceRoot = "${src.name}/xpu";
 
-    cargoHash = "sha256-vB0LZjfnf//U1BXCzvaQBjlXLlGx/4g+emSZWcS+oGU=";
+    cargoHash = "sha256-YKuXtttLam4NmJsJPQH8sFbj1Qs5Gc2uoFJEvTYxkew=";
 
     checkFlags = [
       # fails in sandbox
@@ -116,12 +120,19 @@ let
 
   parquet-rust-wrapper = rustPlatform.buildRustPackage {
     pname = "arrow-rs-wrapper";
-    version = "0.1.0";
+    version = "0.1.1";
     inherit src;
 
     sourceRoot = "${src.name}/parquet-rust-wrapper";
 
-    cargoHash = "sha256-BkeSRbZoehYGHj15KcInugRBvOLXJlh1NqTHhRnNOK8=";
+    cargoHash = "sha256-F68Rvfc04eI/y0Z5tGtQn4zEmqLuMZGZiKEh2HMFi/g=";
+
+    nativeCheckInputs = [
+      # The `httpfile` tests serve a local HTTP server, but reqwest's rustls backend refuses to
+      # build a client at all without system CA certificates.
+      # Its setup hook exports `SSL_CERT_FILE`.
+      cacert
+    ];
 
     # The original build script renames the library:
     # https://github.com/wandb/wandb/blob/v0.26.0/parquet-rust-wrapper/build.sh#L37-L68
@@ -139,15 +150,8 @@ let
     sourceRoot = "${src.name}/core";
 
     postPatch =
-      # Relax the Go toolchain requirement; nixpkgs ships 1.26.2.
-      ''
-        substituteInPlace go.mod \
-          --replace-fail \
-            "go 1.26.4" \
-            "go 1.26.2"
-      ''
       # hardcode the `wandb-xpu` binary path.
-      + ''
+      ''
         substituteInPlace internal/monitor/xpuresourcemanager.go \
           --replace-fail \
             'cmdPath, err := getXPUCmdPath()' \
@@ -234,6 +238,7 @@ buildPythonPackage (finalAttrs: {
 
   dependencies = [
     click
+    opentelemetry-api
     packaging
     platformdirs
     protobuf
@@ -322,6 +327,12 @@ buildPythonPackage (finalAttrs: {
   ];
 
   disabledTests = [
+    # The conftest mocks out `read_many_from_queue`, which is the agent loop's only throttle.
+    # It then spins while the child runs, and the `MagicMock` API retains every heartbeat
+    # call (~270MiB/s), OOM-killing the pytest worker.
+    "test_agent_config_whitespace_cli_agent"
+    "test_agent_subprocess_with_import_readline"
+
     # Probably failing because of lack of internet access
     # AttributeError: module 'wandb.sdk.launch.registry' has no attribute 'azure_container_registry'. Did you mean: 'elastic_container_registry'?
     "test_registry_from_uri"
@@ -392,6 +403,7 @@ buildPythonPackage (finalAttrs: {
     "test_log_media_prefixed_with_multiple_slashes"
     "test_log_media_saves_to_run_directory"
     "test_log_media_with_path_traversal"
+    "test_table_logging_mode_incremental_warns_after_100_increments"
 
     # HandleAbandonedError / SystemExit when run in sandbox
     "test_makedirs_raises_oserror__uses_temp_dir"
diff --git a/pkgs/development/python-modules/warp-nn/default.nix b/pkgs/development/python-modules/warp-nn/default.nix
index 39ced41c0bd8..cbf8973ad740 100644
--- a/pkgs/development/python-modules/warp-nn/default.nix
+++ b/pkgs/development/python-modules/warp-nn/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "warp-nn";
-  version = "0.3.0";
+  version = "0.3.1";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -26,7 +26,7 @@ buildPythonPackage (finalAttrs: {
     owner = "NVIDIA";
     repo = "warp-nn";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-dziGJhuuLHy8gEB39tvpLTHjPOwz6YVhsCB6KbIb7vI=";
+    hash = "sha256-bs0YXYXPIwXKlFrsiZ5hdJ/E4uT4x3Ex/dJEWfurVcg=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/whenever/default.nix b/pkgs/development/python-modules/whenever/default.nix
index b76997879701..7767a5601904 100644
--- a/pkgs/development/python-modules/whenever/default.nix
+++ b/pkgs/development/python-modules/whenever/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "whenever";
-  version = "0.10.4";
+  version = "0.10.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ariebovenberg";
     repo = "whenever";
     tag = version;
-    hash = "sha256-yDI5TAnEyVPNYXqsCEitFrQnk+Ed0CyRKcCykxFqeWU=";
+    hash = "sha256-axysocowBamYcNZ9IS58SefSltWC8mdO1Ovf65vMxTk=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
diff --git a/pkgs/development/python-modules/whoisdomain/default.nix b/pkgs/development/python-modules/whoisdomain/default.nix
index f67f132336bc..26c0937d245a 100644
--- a/pkgs/development/python-modules/whoisdomain/default.nix
+++ b/pkgs/development/python-modules/whoisdomain/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "whoisdomain";
-  version = "2.20260709.1";
+  version = "2.20260806.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mboot-github";
     repo = "WhoisDomain";
     tag = finalAttrs.version;
-    hash = "sha256-9oXKqMdZZFC0orrWMgcpL1mmJil3ENRY5fZjlISupF0=";
+    hash = "sha256-qQbwtwyACTPNcrs8QMEIBwDu4guMmOMc+TuF5MXY1cE=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/zhong-hong-hvac/default.nix b/pkgs/development/python-modules/zhong-hong-hvac/default.nix
index 76f19fbd9491..649c468e2312 100644
--- a/pkgs/development/python-modules/zhong-hong-hvac/default.nix
+++ b/pkgs/development/python-modules/zhong-hong-hvac/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "zhong-hong-hvac";
-  version = "1.0.15";
+  version = "1.0.18";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "crhan";
     repo = "ZhongHongHVAC";
     tag = "v${version}";
-    hash = "sha256-ZCbo7U6bevnzybVVplSgdFLiuz9+HXiE0r/8sYJ+euQ=";
+    hash = "sha256-X+zlakXGSmmCBYjdSR6sw1w9p7Mt65IyrgrFK7UkYE8=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/rocm-modules/release-attrPaths.json b/pkgs/development/rocm-modules/release-attrPaths.json
index 5e1c5eb793d2..a11324d54c3d 100644
--- a/pkgs/development/rocm-modules/release-attrPaths.json
+++ b/pkgs/development/rocm-modules/release-attrPaths.json
@@ -181,7 +181,6 @@
     "peek",
     "petsc",
     "pfft",
-    "pianotrans",
     "piper-phonemize",
     "piper-tts",
     "pnetcdf",
@@ -448,7 +447,6 @@
     "python3Packages.petsctools",
     "python3Packages.pettingzoo",
     "python3Packages.pgmpy",
-    "python3Packages.piano-transcription-inference",
     "python3Packages.piper-phonemize",
     "python3Packages.pocket-tts",
     "python3Packages.pomegranate",
@@ -490,7 +488,7 @@
     "python3Packages.rembg",
     "python3Packages.rerun-sdk",
     "python3Packages.resize-right",
-    "python3Packages.retinaface",
+    "python3Packages.retina-face",
     "python3Packages.rlax",
     "python3Packages.rlcard",
     "python3Packages.roma",
diff --git a/pkgs/development/tcl-modules/by-name/ex/expect/fix-build-time-run-tcl.patch b/pkgs/development/tcl-modules/by-name/ex/expect/fix-build-time-run-tcl.patch
index 8edc4bea39d6..213251101530 100644
--- a/pkgs/development/tcl-modules/by-name/ex/expect/fix-build-time-run-tcl.patch
+++ b/pkgs/development/tcl-modules/by-name/ex/expect/fix-build-time-run-tcl.patch
@@ -1,11 +1,13 @@
---- a/Makefile.in	2022-09-07 21:46:37.090519258 +0200
-+++ b/Makefile.in	2022-09-07 21:46:21.462592279 +0200
-@@ -380,7 +380,7 @@
- 	cp $(DIST_ROOT)/$(PKG_DIR).tar.gz $(top_builddir)
- 
- $(SCRIPTS):
--	$(TCLSH) $(srcdir)/fixline1 $(SHORT_BINDIR) < $(srcdir)/example/$@ > $@
-+	@tcl@ $(srcdir)/fixline1 $(SHORT_BINDIR) < $(srcdir)/example/$@ > $@
- 
- ## We cannot use TCL_LIBS below (after TCL_LIB_SPEC) because its
- ## expansion references the contents of LIBS, which contains linker
+diff --git a/Makefile.in b/Makefile.in
+index 36feb62..ac77b25 100644
+--- a/Makefile.in
++++ b/Makefile.in
+@@ -380,7 +380,7 @@ dist: dist-clean doc
+ 	cp $(DIST_ROOT)/$(PKG_DIR).tar.gz $(top_builddir)
+ 
+ $(SCRIPTS):
+-	$(TCLSH) $(srcdir)/fixline1 $(SHORT_BINDIR) < $(srcdir)/example/$@ > $@
++	@tcl@ $(srcdir)/fixline1 $(SHORT_BINDIR) < $(srcdir)/example/$@ > $@
+ 
+ ## We cannot use TCL_LIBS below (after TCL_LIB_SPEC) because its
+ ## expansion references the contents of LIBS, which contains linker
diff --git a/pkgs/development/tcl-modules/by-name/ex/expect/package.nix b/pkgs/development/tcl-modules/by-name/ex/expect/package.nix
index 8e4b2b0caa54..ffedb36c9970 100644
--- a/pkgs/development/tcl-modules/by-name/ex/expect/package.nix
+++ b/pkgs/development/tcl-modules/by-name/ex/expect/package.nix
@@ -2,40 +2,29 @@
   lib,
   stdenv,
   buildPackages,
-  fetchurl,
+  fetchFromGitHub,
   tcl,
   makeWrapper,
   autoreconfHook,
-  fetchpatch,
   replaceVars,
+  dejagnu,
 }:
 
-tcl.mkTclDerivation rec {
+tcl.mkTclDerivation (finalAttrs: {
   pname = "expect";
-  version = "5.45.4";
+  version = "6.0a2";
 
-  src = fetchurl {
-    url = "mirror://sourceforge/expect/Expect/${version}/expect${version}.tar.gz";
-    hash = "sha256-Safag7C92fRtBKBN7sGcd2e7mjI+QMR4H4nK92C5LDQ=";
+  src = fetchFromGitHub {
+    owner = "tcltk-depot";
+    repo = "expect";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-cVs8wU8WlJ0XtEv5Femhb4lwKtyVkPHjosXLbQ8QR4g=";
   };
 
   patches = [
     (replaceVars ./fix-build-time-run-tcl.patch {
       tcl = "${buildPackages.tcl}/bin/tclsh";
     })
-    # The following patches fix compilation with clang 15+
-    (fetchpatch {
-      url = "https://sourceforge.net/p/expect/patches/24/attachment/0001-Add-prototype-to-function-definitions.patch";
-      hash = "sha256-X2Vv6VVM3KjmBHo2ukVWe5YTVXRmqe//Kw2kr73OpZs=";
-    })
-    (fetchpatch {
-      url = "https://sourceforge.net/p/expect/patches/_discuss/thread/b813ca9895/6759/attachment/expect-configure-c99.patch";
-      hash = "sha256-PxQQ9roWgVXUoCMxkXEgu+it26ES/JuzHF6oML/nk54=";
-    })
-    ./0004-enable-cross-compilation.patch
-    # Include `sys/ioctl.h` and `util.h` on Darwin, which are required for `ioctl` and `openpty`.
-    # Include `termios.h` on FreeBSD for `openpty`
-    ./fix-darwin-bsd-clang16.patch
     # Remove some code which causes it to link against a file that does not exist at build time on native FreeBSD
     ./freebsd-unversioned.patch
   ];
@@ -49,24 +38,17 @@ tcl.mkTclDerivation rec {
     makeWrapper
   ];
 
+  __structuredAttrs = true;
+
   strictDeps = true;
 
-  env = {
-    NIX_CFLAGS_COMPILE = toString (
-      # Needed to avoid errors when building with GCC 15.
-      lib.optionals stdenv.cc.isGNU [ "-Wno-error=incompatible-pointer-types" ]
-      # Autoconf 2.73 defaults to C23, but Expect uses K&R style function declarations.
-      ++ [ "-std=gnu17" ]
-    );
-  };
-
-  hardeningDisable = [ "format" ];
-
   postInstall = ''
     tclWrapperArgs+=(--prefix PATH : ${lib.makeBinPath [ tcl ]})
-    ${lib.optionalString stdenv.hostPlatform.isDarwin "tclWrapperArgs+=(--prefix DYLD_LIBRARY_PATH : $out/lib/expect${version})"}
+    ${lib.optionalString stdenv.hostPlatform.isDarwin "tclWrapperArgs+=(--prefix DYLD_LIBRARY_PATH : $out/lib/expect${finalAttrs.version})"}
   '';
 
+  doCheck = true;
+  installCheckTarget = "test";
   tclRequiresCheck = [ "Expect" ];
 
   outputs = [
@@ -74,13 +56,16 @@ tcl.mkTclDerivation rec {
     "dev"
   ];
 
+  passthru.tests = {
+    inherit dejagnu;
+  };
+
   meta = {
     description = "Tool for automating interactive applications";
     homepage = "https://expect.sourceforge.net/";
     license = lib.licenses.publicDomain;
     platforms = lib.platforms.unix;
     mainProgram = "expect";
-    maintainers = with lib.maintainers; [ SuperSandro2000 ];
-    broken = tcl.isTcl9;
+    maintainers = with lib.maintainers; [ fgaz ];
   };
-}
+})
diff --git a/pkgs/development/tcl-modules/by-name/ex/expect/0004-enable-cross-compilation.patch b/pkgs/development/tcl-modules/by-name/ex/expect_5/0004-enable-cross-compilation.patch
similarity index 100%
rename from pkgs/development/tcl-modules/by-name/ex/expect/0004-enable-cross-compilation.patch
rename to pkgs/development/tcl-modules/by-name/ex/expect_5/0004-enable-cross-compilation.patch
diff --git a/pkgs/development/tcl-modules/by-name/ex/expect_5/fix-build-time-run-tcl.patch b/pkgs/development/tcl-modules/by-name/ex/expect_5/fix-build-time-run-tcl.patch
new file mode 100644
index 000000000000..8edc4bea39d6
--- /dev/null
+++ b/pkgs/development/tcl-modules/by-name/ex/expect_5/fix-build-time-run-tcl.patch
@@ -0,0 +1,11 @@
+--- a/Makefile.in	2022-09-07 21:46:37.090519258 +0200
++++ b/Makefile.in	2022-09-07 21:46:21.462592279 +0200
+@@ -380,7 +380,7 @@
+ 	cp $(DIST_ROOT)/$(PKG_DIR).tar.gz $(top_builddir)
+ 
+ $(SCRIPTS):
+-	$(TCLSH) $(srcdir)/fixline1 $(SHORT_BINDIR) < $(srcdir)/example/$@ > $@
++	@tcl@ $(srcdir)/fixline1 $(SHORT_BINDIR) < $(srcdir)/example/$@ > $@
+ 
+ ## We cannot use TCL_LIBS below (after TCL_LIB_SPEC) because its
+ ## expansion references the contents of LIBS, which contains linker
diff --git a/pkgs/development/tcl-modules/by-name/ex/expect/fix-darwin-bsd-clang16.patch b/pkgs/development/tcl-modules/by-name/ex/expect_5/fix-darwin-bsd-clang16.patch
similarity index 100%
rename from pkgs/development/tcl-modules/by-name/ex/expect/fix-darwin-bsd-clang16.patch
rename to pkgs/development/tcl-modules/by-name/ex/expect_5/fix-darwin-bsd-clang16.patch
diff --git a/pkgs/development/tcl-modules/by-name/ex/expect_5/freebsd-unversioned.patch b/pkgs/development/tcl-modules/by-name/ex/expect_5/freebsd-unversioned.patch
new file mode 100644
index 000000000000..345fa4f6277f
--- /dev/null
+++ b/pkgs/development/tcl-modules/by-name/ex/expect_5/freebsd-unversioned.patch
@@ -0,0 +1,14 @@
+--- expect5.45.4/tclconfig/tcl.m4.orig	2024-05-29 11:24:56.150656190 -0700
++++ expect5.45.4/tclconfig/tcl.m4	2024-05-29 11:25:22.850790934 -0700
+@@ -1643,11 +1643,6 @@
+ 		LIBS=`echo $LIBS | sed s/-pthread//`
+ 		CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
+ 		LDFLAGS="$LDFLAGS $PTHREAD_LIBS"])
+-	    # Version numbers are dot-stripped by system policy.
+-	    TCL_TRIM_DOTS=`echo ${VERSION} | tr -d .`
+-	    UNSHARED_LIB_SUFFIX='${TCL_TRIM_DOTS}.a'
+-	    SHARED_LIB_SUFFIX='${TCL_TRIM_DOTS}\$\{DBGX\}.so.1'
+-	    TCL_LIB_VERSIONS_OK=nodots
+ 	    ;;
+ 	Darwin-*)
+ 	    CFLAGS_OPTIMIZE="-Os"
diff --git a/pkgs/development/tcl-modules/by-name/ex/expect_5/package.nix b/pkgs/development/tcl-modules/by-name/ex/expect_5/package.nix
new file mode 100644
index 000000000000..2cda3a33300c
--- /dev/null
+++ b/pkgs/development/tcl-modules/by-name/ex/expect_5/package.nix
@@ -0,0 +1,86 @@
+{
+  lib,
+  stdenv,
+  buildPackages,
+  fetchurl,
+  tcl,
+  makeWrapper,
+  autoreconfHook,
+  fetchpatch,
+  replaceVars,
+}:
+
+tcl.mkTclDerivation rec {
+  pname = "expect";
+  version = "5.45.4";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/expect/Expect/${version}/expect${version}.tar.gz";
+    hash = "sha256-Safag7C92fRtBKBN7sGcd2e7mjI+QMR4H4nK92C5LDQ=";
+  };
+
+  patches = [
+    (replaceVars ./fix-build-time-run-tcl.patch {
+      tcl = "${buildPackages.tcl}/bin/tclsh";
+    })
+    # The following patches fix compilation with clang 15+
+    (fetchpatch {
+      url = "https://sourceforge.net/p/expect/patches/24/attachment/0001-Add-prototype-to-function-definitions.patch";
+      hash = "sha256-X2Vv6VVM3KjmBHo2ukVWe5YTVXRmqe//Kw2kr73OpZs=";
+    })
+    (fetchpatch {
+      url = "https://sourceforge.net/p/expect/patches/_discuss/thread/b813ca9895/6759/attachment/expect-configure-c99.patch";
+      hash = "sha256-PxQQ9roWgVXUoCMxkXEgu+it26ES/JuzHF6oML/nk54=";
+    })
+    ./0004-enable-cross-compilation.patch
+    # Include `sys/ioctl.h` and `util.h` on Darwin, which are required for `ioctl` and `openpty`.
+    # Include `termios.h` on FreeBSD for `openpty`
+    ./fix-darwin-bsd-clang16.patch
+    # Remove some code which causes it to link against a file that does not exist at build time on native FreeBSD
+    ./freebsd-unversioned.patch
+  ];
+
+  postPatch = ''
+    sed -i "s,/bin/stty,$(type -p stty),g" configure.in
+  '';
+
+  nativeBuildInputs = [
+    autoreconfHook
+    makeWrapper
+  ];
+
+  strictDeps = true;
+
+  env = {
+    NIX_CFLAGS_COMPILE = toString (
+      # Needed to avoid errors when building with GCC 15.
+      lib.optionals stdenv.cc.isGNU [ "-Wno-error=incompatible-pointer-types" ]
+      # Autoconf 2.73 defaults to C23, but Expect uses K&R style function declarations.
+      ++ [ "-std=gnu17" ]
+    );
+  };
+
+  hardeningDisable = [ "format" ];
+
+  postInstall = ''
+    tclWrapperArgs+=(--prefix PATH : ${lib.makeBinPath [ tcl ]})
+    ${lib.optionalString stdenv.hostPlatform.isDarwin "tclWrapperArgs+=(--prefix DYLD_LIBRARY_PATH : $out/lib/expect${version})"}
+  '';
+
+  tclRequiresCheck = [ "Expect" ];
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  meta = {
+    description = "Tool for automating interactive applications";
+    homepage = "https://expect.sourceforge.net/";
+    license = lib.licenses.publicDomain;
+    platforms = lib.platforms.unix;
+    mainProgram = "expect";
+    maintainers = with lib.maintainers; [ fgaz ];
+    broken = tcl.isTcl9;
+  };
+}
diff --git a/pkgs/development/tools/analysis/radare2/default.nix b/pkgs/development/tools/analysis/radare2/default.nix
index 7bce5fb9fd62..5888d17bc7a2 100644
--- a/pkgs/development/tools/analysis/radare2/default.nix
+++ b/pkgs/development/tools/analysis/radare2/default.nix
@@ -41,26 +41,26 @@ let
   sdb = fetchFromGitHub {
     owner = "radareorg";
     repo = "sdb";
-    tag = "2.4.6"; # https://github.com/radareorg/radare2/blob/master/subprojects/sdb.wrap
-    hash = "sha256-5DuHC5uL4gXBJPGW2awDq/5Ufdi1RoEJnm+eAU3X8S4=";
+    tag = "2.5.0"; # https://github.com/radareorg/radare2/blob/master/subprojects/sdb.wrap
+    hash = "sha256-TSZGAzryZcVHJPnCx7zrP1+nschsOm1zmkCJyqA4kbk=";
   };
 
   qjs = fetchFromGitHub {
     owner = "quickjs-ng";
     repo = "quickjs";
-    rev = "3087a2ce5bcb66cc1fcd9f34d3e5ce3bd43a67d9"; # https://github.com/radareorg/radare2/blob/master/subprojects/qjs.wrap
-    hash = "sha256-Z6DUe/W1+3SYPRPCiL3oNL5ovXCsW3dsFuGkA9WF3W4=";
+    rev = "9d15fb60b67c45fd0de413bb49e48f8dacebac16"; # https://github.com/radareorg/radare2/blob/master/subprojects/qjs.wrap
+    hash = "sha256-TH139/44X2FPUTqEdqB09QSUE+QJhudnA+dQF8f8BN0=";
   };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "radare2";
-  version = "6.1.8";
+  version = "6.2.0";
 
   src = fetchFromGitHub {
     owner = "radareorg";
     repo = "radare2";
     tag = finalAttrs.version;
-    hash = "sha256-Gh+W0vWsIscbew1u5cuOXWC20azCxYuA7D+qVTkfEN0=";
+    hash = "sha256-7BCNdPWzsjUuVftbxUZ6iChR5KDp2yKVjKi+1oHt9O8=";
   };
 
   mesonFlags = [
diff --git a/pkgs/development/tools/pnpm/default.nix b/pkgs/development/tools/pnpm/default.nix
index 1a63aa91ae6d..8b963dec9768 100644
--- a/pkgs/development/tools/pnpm/default.nix
+++ b/pkgs/development/tools/pnpm/default.nix
@@ -45,8 +45,8 @@ let
       hash = "sha256-zLXEecqxsAYhMlv+fUyaioAx56Ul1ySeJ17L7IGwjbI=";
     };
     "11" = {
-      version = "11.20.0";
-      hash = "sha256-NOGYyx5DI3UX7O39MfmuJqbAo+U2bOWKLQX0sh+18Zo=";
+      version = "11.21.0";
+      hash = "sha256-hyN9N+rbedxiagV26zpS0j1wQiwyOuXgD8BckfQyN4A=";
     };
   };
 
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libc.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libc.nix
index e23ba1a4fd36..a67bc775f92e 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/libc.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libc.nix
@@ -47,5 +47,11 @@ symlinkJoin {
     fixupPhase
   '';
 
+  # NetBSD's threads are POSIX threads — `libpthread` is joined in above.
+  # `libgcc` and `libstdc++` have to be configured for the same threading model
+  # as each other, so rather than have each guess, they take it from the libc
+  # they are built against.
+  passthru.threadModel = "posix";
+
   meta.platforms = lib.platforms.netbsd;
 }
diff --git a/pkgs/os-specific/linux/gtp5g/default.nix b/pkgs/os-specific/linux/gtp5g/default.nix
new file mode 100644
index 000000000000..13648be8d058
--- /dev/null
+++ b/pkgs/os-specific/linux/gtp5g/default.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+
+  kmod,
+  kernel,
+  kernelModuleMakeFlags,
+
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "gtp5g";
+  version = "0.10.2";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "free5gc";
+    repo = "gtp5g";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-GJV7iLCbjHn6YxyWLFqS+EATWdZVbVBoJMZdTVG/8bo=";
+  };
+
+  nativeBuildInputs = [ kmod ] ++ kernel.moduleBuildDependencies;
+
+  makeFlags = kernelModuleMakeFlags ++ [
+    "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "KVER=${kernel.modDirVersion}"
+  ];
+
+  installPhase = ''
+    install -Dm644 gtp5g.ko "$out/lib/modules/${kernel.modDirVersion}/kernel/drivers/net/gtp5g.ko"
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "GTP-U Linux Kernel Module";
+    homepage = "https://free5gc.org/";
+    changelog = "https://github.com/free5gc/gtp5g";
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ felbinger ];
+    broken = lib.versionAtLeast kernel.version "6.18";
+  };
+})
diff --git a/pkgs/pkgs-lib/formats.nix b/pkgs/pkgs-lib/formats.nix
index a38b92f9444f..71b22076e0e5 100644
--- a/pkgs/pkgs-lib/formats.nix
+++ b/pkgs/pkgs-lib/formats.nix
@@ -967,36 +967,44 @@ optionalAttrs allowAliases aliases
               # otherwise removeAttrs will fail.
               value = removeAttrs value [ "_imports" ];
               pythonGen = pkgs.writeText "pythonGen" ''
+                import ast
                 import json
                 import os
 
-                def recursive_repr(value: any) -> str:
+                def gen_ast_node(value: any) -> ast.expr:
                     if type(value) is list:
-                        return '\n'.join([
-                            "[",
-                            *[recursive_repr(x) + "," for x in value],
-                            "]",
-                        ])
-                    elif type(value) is dict and value.get("_type") == "raw":
-                        return value.get("value")
+                        return ast.List(elts=[gen_ast_node(x) for x in value])
                     elif type(value) is dict:
-                        return '\n'.join([
-                            "{",
-                            *[f"'{k.replace('\''', '\\\''')}': {recursive_repr(v)}," for k, v in value.items()],
-                            "}",
-                        ])
+                        if value.get("_type") == "raw":
+                            return ast.parse(value["value"], mode="eval").body
+                        else:
+                            return ast.Dict(
+                                keys=[ast.Constant(k) for k in value],
+                                values=[gen_ast_node(v) for v in value.values()],
+                            )
                     else:
-                        return repr(value)
+                        return ast.Constant(value)
+
+
+                tree = ast.Module(body=[], type_ignores=[])
 
                 with open(os.environ["NIX_ATTRS_JSON_FILE"], "r") as f:
                     attrs = json.load(f)
+
                     if attrs["imports"] is not None:
                         for i in attrs["imports"]:
-                            print(f"import {i}")
-                        print()
+                            tree.body.append(ast.parse(f"import {i}").body[0])
+
+                    for key, val in attrs["value"].items():
+                        tree.body.append(ast.Assign(
+                            targets=[ast.Name(id=key, ctx=ast.Store())],
+                            value=gen_ast_node(val),
+                        ))
+
+                ast.fix_missing_locations(tree)
+
+                print(ast.unparse(tree))
 
-                    for key, value in attrs["value"].items():
-                        print(f"{key} = {recursive_repr(value)}")
               '';
               preferLocalBuild = true;
               __structuredAttrs = true;
diff --git a/pkgs/pkgs-lib/tests/formats.nix b/pkgs/pkgs-lib/tests/formats.nix
index 56ce50ed6953..80f34ab047a4 100644
--- a/pkgs/pkgs-lib/tests/formats.nix
+++ b/pkgs/pkgs-lib/tests/formats.nix
@@ -1148,21 +1148,12 @@ runBuildTests {
         import re
         import a.b.c
 
-        attrs = {
-            "conditional": 1 if True else 2,
-            "foo": None,
-        }
+        attrs = {"conditional": 1 if True else 2, "foo": None}
         bool = True
         float = 3.141
-        func = re.findall(r"\bf[a-z]*", "which foot or hand fell fastest")
+        func = re.findall("\\bf[a-z]*", "which foot or hand fell fastest")
         int = 10
-        list = [
-            None,
-            1,
-            "str",
-            True,
-            1 if True else 2,
-        ]
+        list = [None, 1, "str", True, 1 if True else 2]
         null = None
         str = "foo"
         str_special = "foo\ntesthello''''"
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 631cff15bf0e..277a52933b88 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2324,7 +2324,8 @@
       ];
     "geosphere_austria_warnings" =
       ps: with ps; [
-      ]; # missing inputs: pygeosphere-warnings
+        pygeosphere-warnings
+      ];
     "ghost" =
       ps: with ps; [
         aioghost
@@ -8319,6 +8320,7 @@
     "geofency"
     "geonetnz_quakes"
     "geonetnz_volcano"
+    "geosphere_austria_warnings"
     "ghost"
     "gios"
     "github"
diff --git a/pkgs/servers/home-assistant/custom-components/alarmo/package.nix b/pkgs/servers/home-assistant/custom-components/alarmo/package.nix
index dcf7a722f78c..2222ea428674 100644
--- a/pkgs/servers/home-assistant/custom-components/alarmo/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/alarmo/package.nix
@@ -7,13 +7,13 @@
 buildHomeAssistantComponent rec {
   owner = "nielsfaber";
   domain = "alarmo";
-  version = "1.10.18";
+  version = "1.10.19";
 
   src = fetchFromGitHub {
     owner = "nielsfaber";
     repo = "alarmo";
     tag = "v${version}";
-    hash = "sha256-SBR/NVz7E+gsVLnEO3o30irNeFnnBZb5YVJImWHLk2Y=";
+    hash = "sha256-YhxEhzQ8g38fMU3ntdES1scmBZuhC15nxoHEmbPHmIo=";
   };
 
   postPatch = ''
diff --git a/pkgs/servers/home-assistant/custom-components/local_openai/package.nix b/pkgs/servers/home-assistant/custom-components/local_openai/package.nix
index 359a97058d4e..fd17ae3b064b 100644
--- a/pkgs/servers/home-assistant/custom-components/local_openai/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/local_openai/package.nix
@@ -9,13 +9,13 @@
 buildHomeAssistantComponent (finalAttrs: {
   owner = "skye-harris";
   domain = "local_openai";
-  version = "1.9.0";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     inherit (finalAttrs) owner;
     repo = "hass_local_openai_llm";
     tag = finalAttrs.version;
-    hash = "sha256-z5O+G5OtsC82rRjf3hAbfD5MON62AajBolCKfbo31X0=";
+    hash = "sha256-rDvZtNwfw3GI0qvKRLT8BsQ60au8S0hPw36CdAlBgIw=";
   };
 
   dependencies = [
diff --git a/pkgs/servers/home-assistant/custom-components/plant/package.nix b/pkgs/servers/home-assistant/custom-components/plant/package.nix
index de0e4670cacb..90be32ad81ed 100644
--- a/pkgs/servers/home-assistant/custom-components/plant/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/plant/package.nix
@@ -11,13 +11,13 @@
 buildHomeAssistantComponent rec {
   owner = "olen";
   domain = "plant";
-  version = "2026.8.0";
+  version = "2026.8.1";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "homeassistant-plant";
     tag = "v${version}";
-    hash = "sha256-2u+0Ufpg22Ad+TRT4pUzzEdwSpKASotww/tun38e4AA=";
+    hash = "sha256-GGzALqXi28XJYGJdsMni6oOJxb/RRO479aubtkoJnwY=";
   };
 
   dependencies = [
diff --git a/pkgs/servers/home-assistant/custom-components/tuya_local/package.nix b/pkgs/servers/home-assistant/custom-components/tuya_local/package.nix
index c9b672b8ad95..ab910c1f4621 100644
--- a/pkgs/servers/home-assistant/custom-components/tuya_local/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/tuya_local/package.nix
@@ -11,13 +11,13 @@
 buildHomeAssistantComponent rec {
   owner = "make-all";
   domain = "tuya_local";
-  version = "2026.7.2";
+  version = "2026.8.0";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "tuya-local";
     tag = version;
-    hash = "sha256-kmLcLoEfNJWzzAPhLcw6JdyWHrTv2RHen8aRiTjX8Gc=";
+    hash = "sha256-EehiG62enkvYjFBMqFT+0mOXd5wbZxp5OEZUlDolKzg=";
   };
 
   dependencies = [
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/sonos-card/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/sonos-card/package.nix
index 7501edc5cbcf..6c9a10821790 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/sonos-card/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/sonos-card/package.nix
@@ -6,13 +6,13 @@
 
 buildNpmPackage rec {
   pname = "sonos-card";
-  version = "10.7.1";
+  version = "10.8.2";
 
   src = fetchFromGitHub {
     owner = "punxaphil";
     repo = "custom-sonos-card";
     tag = "v${version}";
-    hash = "sha256-xwSWQqJ3lbkVkorjbQPrDaW/MgCHQFBm9VEV+YKVMxk=";
+    hash = "sha256-Ml5GLYdpa/FkVfUJstu2DCp8c9+Mw7cw+lWFZunN04Y=";
   };
 
   postPatch = ''
@@ -21,7 +21,7 @@ buildNpmPackage rec {
       --replace-fail "&& bash create-dist-maxi-media-player.sh" ""
   '';
 
-  npmDepsHash = "sha256-vrF7i2zaWuGe2OAhhrhPkKZRUqtc+/tLUVoPKgHtEpI=";
+  npmDepsHash = "sha256-tc+m3TJLcF0FNbMZA1lAlzpSYos79HF87IsWdKSmoLQ=";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/servers/http/apache-httpd/2.4.nix b/pkgs/servers/http/apache-httpd/2.4.nix
index e762b8501afc..43f3cd60b7e7 100644
--- a/pkgs/servers/http/apache-httpd/2.4.nix
+++ b/pkgs/servers/http/apache-httpd/2.4.nix
@@ -3,6 +3,8 @@
   stdenv,
   fetchurl,
   fetchpatch2,
+  autoreconfHook,
+  pkg-config,
   perl,
   zlib,
   apr,
@@ -30,6 +32,8 @@
   brotli,
   luaSupport ? false,
   lua5,
+  systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
+  systemdLibs,
 }:
 
 stdenv.mkDerivation rec {
@@ -63,6 +67,8 @@ stdenv.mkDerivation rec {
   depsBuildBuild = [ buildPackages.stdenv.cc ];
 
   nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
     perl
     which
   ];
@@ -76,13 +82,17 @@ stdenv.mkDerivation rec {
   ++ lib.optional sslSupport openssl
   ++ lib.optional ldapSupport openldap
   # there is no --with-ldap flag
+  ++ lib.optional luaSupport lua5
   ++ lib.optional libxml2Support libxml2
   ++ lib.optional http2Support nghttp2
-  ++ lib.optional stdenv.hostPlatform.isDarwin libiconv;
+  ++ lib.optional stdenv.hostPlatform.isDarwin libiconv
+  ++ lib.optional systemdSupport systemdLibs;
 
   postPatch = ''
     sed -i config.layout -e "s|installbuilddir:.*|installbuilddir: $dev/share/build|"
-    sed -i configure -e 's|perlbin=.*|perlbin="/usr/bin/env perl"|'
+    sed -i configure.in \
+      -e 's|AC_PATH_PROG|AC_PATH_TOOL|' \
+      -e 's|perlbin=.*|perlbin="/usr/bin/env perl"|'
     ${lib.optionalString withLynx "sed -i support/apachectl.in -e 's|@LYNX_PATH@|${lynx}/bin/lynx|'"}
   '';
 
@@ -104,19 +114,14 @@ stdenv.mkDerivation rec {
     "--enable-imagemap"
     "--enable-cgi"
     "--includedir=${placeholder "dev"}/include"
+    "--docdir=$(doc)/share/doc"
     (lib.enableFeature proxySupport "proxy")
     (lib.enableFeature sslSupport "ssl")
     (lib.withFeatureAs libxml2Support "libxml2" "${libxml2.dev}/include/libxml2")
-    "--docdir=$(doc)/share/doc"
-
     (lib.enableFeature brotliSupport "brotli")
-    (lib.withFeatureAs brotliSupport "brotli" brotli)
-
     (lib.enableFeature http2Support "http2")
-    (lib.withFeature http2Support "nghttp2")
-
+    (lib.enableFeature systemdSupport "systemd")
     (lib.enableFeature luaSupport "lua")
-    (lib.withFeatureAs luaSupport "lua" lua5)
   ]
   ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
     # skip bad config check when cross compiling
diff --git a/pkgs/servers/http/nginx/modules/vts/package.nix b/pkgs/servers/http/nginx/modules/vts/package.nix
index 10858b0cb7ca..44eaf415eee1 100644
--- a/pkgs/servers/http/nginx/modules/vts/package.nix
+++ b/pkgs/servers/http/nginx/modules/vts/package.nix
@@ -6,13 +6,13 @@
 
 mkNginxPlugin (finalAttrs: {
   pname = "vts";
-  version = "0.2.6";
+  version = "0.2.7";
 
   src = fetchFromGitHub {
     owner = "vozlt";
     repo = "nginx-module-vts";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3u4igVGBVsv+GNi3CSduZL6ZaOmdPoItUPA4+wmRw5Y=";
+    hash = "sha256-5Cwjy3vrhyBohsroSB43qMvxZjIJtP/QHSK5QWnplzw=";
   };
 
   meta = {
diff --git a/pkgs/servers/monitoring/grafana/plugins/grafana-lokiexplore-app/default.nix b/pkgs/servers/monitoring/grafana/plugins/grafana-lokiexplore-app/default.nix
index f10029c330b7..099a1a8e1ea4 100644
--- a/pkgs/servers/monitoring/grafana/plugins/grafana-lokiexplore-app/default.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/grafana-lokiexplore-app/default.nix
@@ -2,8 +2,8 @@
 
 grafanaPlugin {
   pname = "grafana-lokiexplore-app";
-  version = "2.4.0";
-  zipHash = "sha256-x+LxpkDN+iKW9QBDEg6oDURWuLUYNAC3UDWDmfoYcYo=";
+  version = "2.5.0";
+  zipHash = "sha256-n+jIw5mvhXtpJlDPK7stsNhSV5y/sW382+DI7Shx4PI=";
   meta = {
     description = "Browse Loki logs without the need for writing complex queries";
     license = lib.licenses.agpl3Only;
diff --git a/pkgs/servers/monitoring/grafana/plugins/grafana-opensearch-datasource/default.nix b/pkgs/servers/monitoring/grafana/plugins/grafana-opensearch-datasource/default.nix
index 5a414111d888..076c88971f97 100644
--- a/pkgs/servers/monitoring/grafana/plugins/grafana-opensearch-datasource/default.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/grafana-opensearch-datasource/default.nix
@@ -2,11 +2,11 @@
 
 grafanaPlugin {
   pname = "grafana-opensearch-datasource";
-  version = "2.34.0";
+  version = "2.34.3";
   zipHash = {
-    x86_64-linux = "sha256-/NG+38zeIcoiQTm/QJFwwZSpo0zdovh1a4QntndcphE=";
-    aarch64-linux = "sha256-jGRMlbOsOd7fglTMmdOSGxNv4GiV9aiusXz6CnCefaY=";
-    aarch64-darwin = "sha256-WzhbYvgkuIzB8coJMinLiEyW3RIFxftM2ZGPG9rGGxU=";
+    x86_64-linux = "sha256-P5NlM7TZWLVbKbYFy9TzqwRiKQZkXsOxmUJbWx+6TAI=";
+    aarch64-linux = "sha256-MLpS4NHu0F7a1eQOTMYuZi3N/ESn+jXKMhspl2DoqhE=";
+    aarch64-darwin = "sha256-PIqemTwdml2c9y6RKfOrYB6IIqwgmy0zB33CKizCwqY=";
   };
   meta = {
     description = "Empowers you to seamlessly integrate JSON data into Grafana";
diff --git a/pkgs/servers/nextcloud/notify_push.nix b/pkgs/servers/nextcloud/notify_push.nix
index 34d2da330b88..caea9be116dc 100644
--- a/pkgs/servers/nextcloud/notify_push.nix
+++ b/pkgs/servers/nextcloud/notify_push.nix
@@ -13,22 +13,22 @@ rustPlatform.buildRustPackage rec {
   # in nixpkgs!
   # For that, check the `<dependencies>` section of `appinfo/info.xml`
   # in the app (https://github.com/nextcloud/notify_push/blob/main/appinfo/info.xml)
-  version = "1.3.5";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "nextcloud";
     repo = "notify_push";
     tag = "v${version}";
-    hash = "sha256-MLy2W6/D1Gzr4sxYMFjC9yVUdWAkP9h5bEVd6CulIvI=";
+    hash = "sha256-zIYAVNWJ/lXBAWl1MVxZbQH9ep8aNrAJ6l5ypnSQ5ik=";
   };
 
-  cargoHash = "sha256-/1KrN3zDYzxlglhyyyIROwOmNW7STdmMvG8x95UFEZU=";
+  cargoHash = "sha256-0BCM9TT1SRa0Y2EC5bNt2lM8qcgYOvr1sms4yhSzgHU=";
 
   passthru = rec {
     app = fetchNextcloudApp {
       appName = "notify_push";
       appVersion = version;
-      hash = "sha256-jyO9TDVc/xUnpUww3GaOY1I5x+rokAxt5FJtMrq1SAY=";
+      hash = "sha256-nZbIHZSj7KtvCPYVBZXED0+WfmWwuCN4QHa+yfrxzIg=";
       license = "agpl3Plus";
       homepage = "https://github.com/nextcloud/notify_push";
       url = "https://github.com/nextcloud-releases/notify_push/releases/download/v${version}/notify_push-v${version}.tar.gz";
@@ -41,7 +41,7 @@ rustPlatform.buildRustPackage rec {
 
       buildAndTestSubdir = "test_client";
 
-      cargoHash = "sha256-/1KrN3zDYzxlglhyyyIROwOmNW7STdmMvG8x95UFEZU=";
+      cargoHash = "sha256-0BCM9TT1SRa0Y2EC5bNt2lM8qcgYOvr1sms4yhSzgHU=";
 
       meta = meta // {
         mainProgram = "test_client";
diff --git a/pkgs/servers/sql/postgresql/ext/pg_when.nix b/pkgs/servers/sql/postgresql/ext/pg_when.nix
new file mode 100644
index 000000000000..2ddb805b6b66
--- /dev/null
+++ b/pkgs/servers/sql/postgresql/ext/pg_when.nix
@@ -0,0 +1,67 @@
+{
+  buildPgrxExtension,
+  cargo-pgrx_0_18_0,
+  fetchFromGitHub,
+  lib,
+  nix-update-script,
+  postgresql,
+  postgresqlTestExtension,
+  tzdata,
+}:
+buildPgrxExtension (finalAttrs: {
+  inherit postgresql;
+  cargo-pgrx = cargo-pgrx_0_18_0;
+
+  pname = "pg_when";
+  version = "0.1.10";
+
+  src = fetchFromGitHub {
+    owner = "frectonz";
+    repo = "pg-when";
+    tag = finalAttrs.version;
+    hash = "sha256-2+YCxOB3Svl1DY4mNQg4giks8/fagHAXQ0K16PR96hM=";
+  };
+
+  cargoHash = "sha256-pHY71+egTX9AU8nNeDHCymmaFsz+2JYmRGqKq4uT7w4=";
+
+  # pgrx tests try to install the extension into the postgresql nix store
+  doCheck = false;
+
+  passthru.updateScript = nix-update-script { };
+
+  passthru.tests.extension = postgresqlTestExtension {
+    inherit (finalAttrs) finalPackage;
+
+    # timezone lookups need an IANA time zone database
+    env.TZDIR = "${tzdata}/share/zoneinfo";
+
+    sql = ''
+      CREATE EXTENSION pg_when;
+    '';
+    asserts = [
+      {
+        query = "when_is('December 31, 2026 at evening in Asia/Tokyo')";
+        expected = "TIMESTAMPTZ '2026-12-31 18:00:00+09'";
+        description = "exact date with a time keyword and a named timezone resolves correctly";
+      }
+      {
+        query = "seconds_at('January 1, 2000 at midnight in UTC+3')";
+        expected = "946674000";
+        description = "UNIX timestamp accounts for the UTC offset";
+      }
+      {
+        query = "millis_at('1970-01-01 at midnight')";
+        expected = "0";
+        description = "UNIX epoch is zero milliseconds";
+      }
+    ];
+  };
+
+  meta = {
+    description = "PostgreSQL extension for creating time values with natural language";
+    homepage = "https://github.com/frectonz/pg-when";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ frectonz ];
+    platforms = postgresql.meta.platforms;
+  };
+})
diff --git a/pkgs/servers/sql/postgresql/ext/vectorchord/package.nix b/pkgs/servers/sql/postgresql/ext/vectorchord/package.nix
index 7d40097abf6a..4df95e952937 100644
--- a/pkgs/servers/sql/postgresql/ext/vectorchord/package.nix
+++ b/pkgs/servers/sql/postgresql/ext/vectorchord/package.nix
@@ -25,16 +25,18 @@ buildPgrxExtension (finalAttrs: {
 
   cargoHash = "sha256-IXOCzKJArNOcb/2TcJbLz1XdCquUpyF/cLHYU5vmlko=";
 
-  patches = lib.optional (lib.versionOlder rustc.llvm.version "22.0.0" && stdenv.isx86_64) [
-    # Due to a bug in LLVM 21, build fails on x86_64 with:
-    # `rustc-LLVM ERROR: Cannot select: intrinsic %llvm.x86.avx512.vpdpbusd.512`.
-    # This has been fixed in Rust's build of LLVM and LLVM 22 with https://github.com/rust-lang/llvm-project/commit/94e2c19f86a699d7a19ff0f4130b696699189c8d,
-    # but this is not reflected in nixpkgs' packaging of rustc.
-    # For this reason, we temporarily disable avx512vnni support until this is fixed in nixpkgs.
-    # This might cause a performance penalty, but should not affect correctness.
-    # See https://github.com/NixOS/nixpkgs/pull/537113#issuecomment-4846239887
-    ./0001-disable-avx512vnni.patch
-  ];
+  patches =
+    lib.optional (lib.versionOlder rustc.llvm.version "22.0.0" && stdenv.hostPlatform.isx86_64)
+      [
+        # Due to a bug in LLVM 21, build fails on x86_64 with:
+        # `rustc-LLVM ERROR: Cannot select: intrinsic %llvm.x86.avx512.vpdpbusd.512`.
+        # This has been fixed in Rust's build of LLVM and LLVM 22 with https://github.com/rust-lang/llvm-project/commit/94e2c19f86a699d7a19ff0f4130b696699189c8d,
+        # but this is not reflected in nixpkgs' packaging of rustc.
+        # For this reason, we temporarily disable avx512vnni support until this is fixed in nixpkgs.
+        # This might cause a performance penalty, but should not affect correctness.
+        # See https://github.com/NixOS/nixpkgs/pull/537113#issuecomment-4846239887
+        ./0001-disable-avx512vnni.patch
+      ];
 
   # Include upgrade scripts in the final package
   # https://github.com/supervc-stack/VectorChord/blob/0.5.0/crates/make/src/main.rs#L366
diff --git a/pkgs/servers/web-apps/wordpress/default.nix b/pkgs/servers/web-apps/wordpress/default.nix
index 3fce17902ad9..e80c0c8841bc 100644
--- a/pkgs/servers/web-apps/wordpress/default.nix
+++ b/pkgs/servers/web-apps/wordpress/default.nix
@@ -2,15 +2,15 @@
 builtins.mapAttrs (_: callPackage ./generic.nix) rec {
   wordpress = wordpress_7_0;
   wordpress_6_8 = {
-    version = "6.8.7";
-    hash = "sha256-Fu0P83henBEdNbXXVb7cKc69zcLrGyRMx7LcTea+if0=";
+    version = "6.8.8";
+    hash = "sha256-U4jnqPpGLDLkHOXKu3luIijNGHtrgNFdBpqNXm7NPgU=";
   };
   wordpress_6_9 = {
-    version = "6.9.6";
-    hash = "sha256-kyTKCV/z5RtKmrEcAdb8lPtutloBCjOHCSFTNwFCGH8=";
+    version = "6.9.7";
+    hash = "sha256-Ef1l7Mv03V3l7LNyS1X5LFbWweqWdJf+k3S83XpvvaY=";
   };
   wordpress_7_0 = {
-    version = "7.0.3";
-    hash = "sha256-OOTH15WW1Y9g+lSWojVHFAfETcN6b5xNMdRgcJhei8Q=";
+    version = "7.0.4";
+    hash = "sha256-Jrmav8ZUJ/urUrJDFVOblE3O8UZ4maUla2wd4sSufkY=";
   };
 }
diff --git a/pkgs/stdenv/cross/default.nix b/pkgs/stdenv/cross/default.nix
index f2adc91e2bb1..98d93014faf2 100644
--- a/pkgs/stdenv/cross/default.nix
+++ b/pkgs/stdenv/cross/default.nix
@@ -127,6 +127,8 @@ lib.init bootStages
                 buildPackages.zig.cc
               else if crossSystem.useArocc or false then
                 buildPackages.arocc
+              else if crossSystem.useGccNG or false then
+                buildPackages.gccNGPackages.gcc
               else
                 buildPackages.gcc;
 
diff --git a/pkgs/stdenv/generic/default.nix b/pkgs/stdenv/generic/default.nix
index 95d9228d7da2..6d78cc0f0c14 100644
--- a/pkgs/stdenv/generic/default.nix
+++ b/pkgs/stdenv/generic/default.nix
@@ -201,25 +201,35 @@ let
         extraSandboxProfile
         ;
 
-      # Utility flags to test the type of platform.
-      inherit (hostPlatform)
-        isDarwin
-        isLinux
-        isSunOS
-        isCygwin
-        isBSD
-        isFreeBSD
-        isOpenBSD
-        isi686
-        isx86_32
-        isx86_64
-        is32bit
-        is64bit
-        isAarch32
-        isAarch64
-        isMips
-        isBigEndian
-        ;
+    }
+    // lib.optionalAttrs config.allowAliases (
+      lib.mapAttrs
+        (
+          name: value: lib.warn "stdenv.${name} is deprecated, use stdenv.hostPlatform.${name} instead" value
+        )
+        {
+          # Added 2026-05-09
+          inherit (hostPlatform)
+            isDarwin
+            isLinux
+            isSunOS
+            isCygwin
+            isBSD
+            isFreeBSD
+            isOpenBSD
+            isi686
+            isx86_32
+            isx86_64
+            is32bit
+            is64bit
+            isAarch32
+            isAarch64
+            isMips
+            isBigEndian
+            ;
+        }
+    )
+    // {
 
       # Override `system` so that packages can get the system of the host
       # platform through `stdenv.system`. `system` is originally set to the
diff --git a/pkgs/tools/inputmethods/fcitx5/fcitx5-qt.nix b/pkgs/tools/inputmethods/fcitx5/fcitx5-qt.nix
index 8502124a24d0..9b503d054571 100644
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-qt.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-qt.nix
@@ -16,13 +16,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "fcitx5-qt${majorVersion}";
-  version = "5.1.13";
+  version = "5.1.14";
 
   src = fetchFromGitHub {
     owner = "fcitx";
     repo = "fcitx5-qt";
     rev = version;
-    hash = "sha256-CrrQQPtWQwE6eZOJB+uLVUjPJMKW/sz/tij41dyEe0U=";
+    hash = "sha256-fyqejCb6c6VuPb44UPQDLrdZ93mHTxlX29jCN6KcZ5I=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/package-management/lix/common-lix.nix b/pkgs/tools/package-management/lix/common-lix.nix
index fdd550e8c8d1..42c3bc93e405 100644
--- a/pkgs/tools/package-management/lix/common-lix.nix
+++ b/pkgs/tools/package-management/lix/common-lix.nix
@@ -122,10 +122,11 @@ let
           [project options]
           builtin-dep-closure = @deps@
         '';
-        passAsFile = [ "input" ];
+        __structuredAttrs = true;
       }
       ''
-        substitute $inputPath $out --replace-fail @deps@ "$(cat ${deps})"
+        printf "%s" "$input" > $out
+        substituteInPlace $out --replace-fail @deps@ "$(cat ${deps})"
       '';
 
   # curl 8.21.0 /somehow/ breaks Lix unit tests.
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index f4e16059c591..1aadb3212d92 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -189,14 +189,14 @@ lib.makeExtensible (
 
       nixComponents_2_35 =
         (nixDependencies.callPackage ./modular/packages.nix rec {
-          version = "2.35.1";
+          version = "2.35.2";
           inherit teams;
           otherSplices = generateSplicesForNixComponents "nixComponents_2_35";
           src = removeFunctionalTests commonDisabledTests (fetchFromGitHub {
             owner = "NixOS";
             repo = "nix";
             tag = version;
-            hash = "sha256-ldhnx4+Ya3OfRT9Sh7Nzk+H+9D3CjonomPBjGSfXdJk=";
+            hash = "sha256-C/YEm/5IPiAMxQH5aHlkwgQMkLqK7NVsudEWdlzBZAA=";
           });
         }).appendPatches
           [ ];
diff --git a/pkgs/tools/security/ghidra/extensions.nix b/pkgs/tools/security/ghidra/extensions.nix
index 459977a4ba91..56f03063821c 100644
--- a/pkgs/tools/security/ghidra/extensions.nix
+++ b/pkgs/tools/security/ghidra/extensions.nix
@@ -13,6 +13,8 @@ lib.makeScope newScope (self: {
 
   findcrypt = self.callPackage ./extensions/findcrypt { };
 
+  ghidralib = self.callPackage ./extensions/ghidralib { };
+
   ghidra-delinker-extension = self.callPackage ./extensions/ghidra-delinker-extension {
     inherit ghidra;
   };
diff --git a/pkgs/tools/security/ghidra/extensions/ghidralib/default.nix b/pkgs/tools/security/ghidra/extensions/ghidralib/default.nix
new file mode 100644
index 000000000000..0e7f9dad0031
--- /dev/null
+++ b/pkgs/tools/security/ghidra/extensions/ghidralib/default.nix
@@ -0,0 +1,26 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildGhidraScripts,
+}:
+buildGhidraScripts {
+  pname = "GhidraLib";
+  version = "0.2.0-unstable-2025-10-31";
+
+  src = fetchFromGitHub {
+    owner = "msm-code";
+    repo = "ghidralib";
+    rev = "f3e33e444b4a8682c240c87f8754542e2e338731";
+    hash = "sha256-Dz7CWHkszHq5HT/S9cBGOfkoamnf9T1l2IbaAZXEGf0=";
+  };
+
+  meta = {
+    description = "A Pythonic Ghidra standard library";
+    homepage = "https://github.com/msm-code/ghidralib";
+    maintainers = with lib.maintainers; [
+      BonusPlay
+      msm
+    ];
+    license = lib.licenses.asl20;
+  };
+}
diff --git a/pkgs/tools/security/pinentry/default.nix b/pkgs/tools/security/pinentry/default.nix
index bbda793a4448..752805ce7009 100644
--- a/pkgs/tools/security/pinentry/default.nix
+++ b/pkgs/tools/security/pinentry/default.nix
@@ -12,7 +12,6 @@
   libsForQt5,
   qt6,
   ncurses,
-  gtk2,
   gcr,
   withLibsecret ? true,
   libsecret,
@@ -27,10 +26,6 @@ let
       flag = "curses";
       buildInputs = [ ncurses ];
     };
-    gtk2 = {
-      flag = "gtk2";
-      buildInputs = [ gtk2 ];
-    };
     gnome3 = {
       flag = "gnome3";
       buildInputs = [ gcr ];
@@ -93,12 +88,6 @@ let
       patches = [
         ./autoconf-ar.patch
         ./gettext-0.25.patch
-      ]
-      ++ lib.optionals (lib.elem "gtk2" buildFlavors) [
-        (fetchpatch {
-          url = "https://salsa.debian.org/debian/pinentry/raw/debian/1.1.0-1/debian/patches/0007-gtk2-When-X11-input-grabbing-fails-try-again-over-0..patch";
-          sha256 = "15r1axby3fdlzz9wg5zx7miv7gqx2jy4immaw4xmmw5skiifnhfd";
-        })
       ];
 
       configureFlags = [
@@ -159,11 +148,6 @@ in
     "curses"
     "tty"
   ];
-  pinentry-gtk2 = buildPinentry "gtk2" [
-    "gtk2"
-    "curses"
-    "tty"
-  ];
   pinentry-qt5 = buildPinentry "qt5" [
     "qt5"
     "curses"
@@ -178,7 +162,6 @@ in
   pinentry-all = buildPinentry "all" [
     "curses"
     "tty"
-    "gtk2"
     "gnome3"
     "qt"
     "emacs"
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index e34daf590e0e..66eb84d58c52 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -786,6 +786,7 @@ mapAliases {
   evolve-core = throw "'evolve-core' has been removed, as it hindered the removal of flutter329"; # Added 2026-01-25
   eww-wayland = throw "'eww-wayland' has been renamed to/replaced by 'eww'"; # Converted to throw 2025-10-27
   ex_doc = warnAlias "'ex_doc' is deprecated in favor of using the beamPackages sets. Use 'beamPackages.ex_doc' instead." beamPackages.ex_doc; # added 2026-06-15
+  ext4fuse = throw "'ext4fuse' has been removed as it is unmaintained, and depends on the unmaintained fuse2 library"; # added 2026-08-12
   f3d_egl = warnAlias "'f3d' now build with egl support by default, so `f3d_egl` is deprecated, consider using 'f3d' instead." f3d; # Added 2025-07-18
   fabs = throw "'fabs' has been removed due to being broken for more than a year; see RFC 180"; # Added 2026-02-05
   falcon = throw "'falcon' has been removed as it is unmaintained and depends on pcre, which is deprecated"; # Added 2026-06-16
@@ -1101,6 +1102,7 @@ mapAliases {
   hpmyroom = throw "hpmyroom has been removed because it has been marked as broken since May 2024."; # Added 2025-10-11
   hpp-fcl = throw "'hpp-fcl' has been renamed to/replaced by 'coal'"; # Converted to throw 2025-10-27
   hspellDicts = throw "'hspellDicts' has been removed due to being broken for more than a year; see RFC 180"; # Added 2026-02-05
+  hterm = throw "'hterm' has been removed as it depended on the deprecated GTK 2 engine."; # Added 2026-08-13
   http-prompt = throw "'http-prompt' has been removed as it was broken and unmaintained upstream"; # Added 2025-11-26
   httperf = throw "'httperf' has been removed as it was unmaintained and broken"; # Added 2026-05-04
   httpfs2 = throw "'httpfs2' has been removed as it was unmaintained upstream"; # Added 2026-05-31
@@ -1166,6 +1168,7 @@ mapAliases {
   jellyfin-media-player = jellyfin-desktop; # Added 2025-12-14
   jellyseerr = warnAlias "'jellyseerr' has been renamed to 'seerr'" seerr; # Added 2026-03-17
   jesec-rtorrent = throw "'jesec-rtorrent' has been removed due to lack of maintenance upstream."; # Added 2025-11-20
+  jetty_11 = throw "'jetty_11' has been removed as it has reached end of life. Please migrate to 'jetty_12'."; # Added 2026-08-04
   jextract-21 = throw "'jextract-21' has been removed due to lack of maintenance upstream. Please use 'jextract'"; # Added 2026-05-13
   jhentai = throw "'jhentai' has been removed, as it is unmaintained"; # Added 2026-01-25
   jikespg = throw "'jikespg' has been removed due to lack of maintenance upstream."; # Added 2025-06-10
@@ -1870,6 +1873,7 @@ mapAliases {
   opensyclWithRocm = throw "'opensyclWithRocm' has been renamed to/replaced by 'adaptivecppWithRocm'"; # Converted to throw 2025-10-27
   opentofu-ls = warnAlias "'opentofu-ls' has been renamed to 'tofu-ls'" tofu-ls; # Added 2025-06-10
   opentracing-cpp = throw "'opentracingc-cpp' has been removed as it was archived upstream in 2024"; # Added 2025-10-19
+  openwith = throw "'openwith' has been removed, doesn't seem to work correctly on macOS 26 or newer"; # Added 2026-08-12
   openzwave = throw "openzwave was removed because upstream is no longer maintained. Consider using zwave-js-server"; # Added 2026-05-14
   opera = throw "'opera' has been removed due to lack of maintenance in nixpkgs"; # Added 2025-05-19
   opusTools = warnAlias "'opusTools' has been renamed to 'opus-tools'" opus-tools; # Added 2026-02-12
@@ -1940,6 +1944,7 @@ mapAliases {
   php81 = throw "php81 is EOL"; # Added 2025-10-04
   php81Extensions = throw "php81 is EOL"; # Added 2025-10-04
   php81Packages = throw "php81 is EOL"; # Added 2025-10-04
+  pianotrans = throw "'pianotrans' has been removed because its dependency 'piano-transcription-inference' was unmaintained"; # Added 2026-08-13
   picom-next = throw "'picom-next' has been renamed to/replaced by 'picom'"; # Converted to throw 2025-10-27
   pidgin-carbons = throw "'pidgin-carbons' has been renamed to/replaced by 'pidginPackages.pidgin-carbons'"; # Converted to throw 2025-10-27
   pidgin-indicator = throw "'pidgin-indicator' has been renamed to/replaced by 'pidginPackages.pidgin-indicator'"; # Converted to throw 2025-10-27
@@ -1956,6 +1961,7 @@ mapAliases {
   pilipalax = throw "'pilipalax' has been removed from nixpkgs due to it not being maintained"; # Added 2025-07-25
   pinecone = throw "'pinecone' has been removed, as it is unmaintained and obsolete"; # Added 2026-03-31
   pinentry = throw "'pinentry' has been removed. Pick an appropriate variant like 'pinentry-curses' or 'pinentry-gnome3'"; # Converted to throw 2025-10-26
+  pinentry-gtk2 = throw "'pinentry-gtk2' has been removed as it depended on the deprecated GTK2 engine, use pinentry-gnome3 instead."; # Added 2026-08-12
   pingvin-share = throw "'pingvin-share' has been removed as it was broken and archived upstream"; # Added 2025-11-08
   pipecontrol = throw "'pipecontrol' has been removed due to outdated KF5 dependencies."; # Added 2026-05-01
   piper-train = throw "piper-train is now part of the piper package using the `withTrain` override"; # Added 2025-09-03
@@ -2430,6 +2436,7 @@ mapAliases {
   tokyonight-gtk-theme = throw "'tokyonight-gtk-theme' has been removed because it depended on 'gtk-engine-murrine', which was removed because it was unmaintained upstream and depended on GTK 2."; # Added 2026-07-22
   tomcat_connectors = throw "'tomcat_connectors' has been renamed to/replaced by 'apacheHttpdPackages.mod_jk'"; # Converted to throw 2025-10-27
   tooling-language-server = deputy; # Added 2025-06-22
+  toppler = throw "'toppler' has been removed because it was unmaintained upstream and depended on 'gimp2', which is deprecated and relies on GTK 2."; # Added 2026-08-10
   tor-browser-bundle-bin = throw "'tor-browser-bundle-bin' has been renamed to/replaced by 'tor-browser'"; # Converted to throw 2025-10-27
   tora = throw "'tora' has been removed due to outdated KF5 dependencies."; # Added 2026-05-01
   torrent7z = throw "torrent7z is unmaintained and used a p7zip version from 2009. Consider using p7zip with the arguments to remove entropy instead"; # added 2026-05-09
@@ -2537,6 +2544,7 @@ mapAliases {
   w_scan = throw "'w_scan' has been removed due to lack of upstream maintenance"; # Added 2025-08-29
   waitron = throw "'waitron' has been removed because it has been marked as broken since at least November 2024."; # Added 2025-10-01
   wakatime = throw "'wakatime' has been renamed to/replaced by 'wakatime-cli'"; # Converted to throw 2025-10-27
+  waon = throw "'waon' has been removed as it was unmaintained upstream and depended on the deprecated GTK 2 engine"; # Added 2026-08-13
   wapp = throw "'wapp' has been renamed to/replaced by 'tclPackages.wapp'"; # Converted to throw 2025-10-27
   warmux = throw "'warmux' has been removed as it is unmaintained and broken"; # Added 2025-11-03
   warp-plus = throw "'warp-plus' has been removed as it is unmaintained and broken"; # Added 2026-07-05
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 59e955517367..18ab35796202 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -88,6 +88,8 @@ with pkgs;
       (
         if stdenvNoCC.hostPlatform.isDarwin || stdenvNoCC.hostPlatform.useLLVM or false then
           overrideCC stdenvNoCC buildPackages.llvmPackages.clangNoCompilerRt
+        else if stdenvNoCC.hostPlatform.useGccNG or false then
+          overrideCC stdenvNoCC buildPackages.gccNGPackages.gccNoLibgcc
         else
           gccCrossLibcStdenv
       )
@@ -99,6 +101,11 @@ with pkgs;
       (
         if stdenvNoCC.hostPlatform.isDarwin || stdenvNoCC.hostPlatform.useLLVM or false then
           overrideCC stdenvNoCC buildPackages.llvmPackages.clangNoLibc
+        else if stdenvNoCC.hostPlatform.useGccNG or false then
+          # The split package set can express the two rungs separately, the way
+          # the LLVM set does: no libgcc above, libgcc but no libc here. The
+          # monolithic `gccCrossLibcStdenv` has to serve both.
+          overrideCC stdenvNoCC buildPackages.gccNGPackages.gccWithLibgcc
         else
           gccCrossLibcStdenv
       )
@@ -1995,7 +2002,7 @@ with pkgs;
 
   exiftool = perlPackages.ImageExifTool;
 
-  expect = tclPackages.expect;
+  expect = tcl8Packages.expect_5;
 
   Fabric = with python3Packages; toPythonApplication fabric;
 
@@ -2074,7 +2081,7 @@ with pkgs;
   gnupg1 = gnupg1compat; # use config.packageOverrides if you prefer original gnupg1
 
   gnupg24 = callPackage ../tools/security/gnupg/24.nix {
-    pinentry = if stdenv.hostPlatform.isDarwin then pinentry_mac else pinentry-gtk2;
+    pinentry = if stdenv.hostPlatform.isDarwin then pinentry_mac else pinentry-gnome3;
   };
   gnupg = gnupg24;
   gnupgMinimal = gnupg.override {
@@ -2729,7 +2736,6 @@ with pkgs;
   inherit (callPackages ../tools/security/pinentry { })
     pinentry-curses
     pinentry-emacs
-    pinentry-gtk2
     pinentry-gnome3
     pinentry-qt
     pinentry-tty
@@ -3244,9 +3250,11 @@ with pkgs;
       # NOTE: keep this with the "NG" label until we're ready to drop the monolithic GCC
       gccNGPackagesSet = recurseIntoAttrs (callPackages ../development/compilers/gcc/ng { });
       gccNGPackages_15 = gccNGPackagesSet."15";
+      gccNGPackages = gccNGPackagesSet.${toString default-gcc-version};
       mkGCCNGPackages = gccNGPackagesSet.mkPackage;
     })
     gccNGPackages_15
+    gccNGPackages
     mkGCCNGPackages
     ;
 
@@ -3256,7 +3264,7 @@ with pkgs;
       ccWrapper.override (prev: {
         cc = prev.cc.override {
           reproducibleBuild = false;
-          profiledCompiler = with stdenv; (!isDarwin && hostPlatform.isx86);
+          profiledCompiler = with stdenv.hostPlatform; (!isDarwin && isx86);
         };
       })
     else
@@ -4103,8 +4111,6 @@ with pkgs;
     coursier = coursier.override { jre = jdk8; };
   };
 
-  # smlnjBootstrap should be redundant, now that smlnj works on Darwin natively
-  smlnjBootstrap = callPackage ../development/compilers/smlnj/bootstrap.nix { };
   smlnj = callPackage ../development/compilers/smlnj { };
 
   squeak = callPackage ../development/compilers/squeak {
@@ -5622,11 +5628,22 @@ with pkgs;
     if stdenv.hostPlatform != stdenv.buildPlatform then
       {
         stdenv = gccCrossLibcStdenv; # doesn't compile without gcc
-        libgcc = callPackage ../development/libraries/gcc/libgcc {
-          gcc = gccCrossLibcStdenv.cc;
-          glibc = glibc.override { libgcc = null; };
-          stdenvNoLibs = gccCrossLibcStdenv;
-        };
+        # glibc `dlopen`s `libgcc_s.so` without consulting the usual search
+        # path, so it has to name one that already exists. The monolithic
+        # build gets there by building glibc twice: the inner `libgcc = null`
+        # one names no libgcc at all, and is used for nothing but building the
+        # libgcc the real one names. The split package set already has that
+        # rung as a package of its own — `libgcc-no-libc` is what exists
+        # before any libc does — so there is nothing left to open-code here.
+        libgcc =
+          if stdenv.hostPlatform.useGccNG or false then
+            gccNGPackages.libgcc-no-libc
+          else
+            callPackage ../development/libraries/gcc/libgcc {
+              gcc = gccCrossLibcStdenv.cc;
+              glibc = glibc.override { libgcc = null; };
+              stdenvNoLibs = gccCrossLibcStdenv;
+            };
       }
     else
       {
@@ -7300,13 +7317,10 @@ with pkgs;
 
   inspircdMinimal = inspircd.override { extraModules = [ ]; };
 
-  inherit (callPackages ../servers/http/jetty { })
-    jetty_11
+  inherit (callPackages ../by-name/je/jetty { })
     jetty_12
     ;
 
-  jetty = jetty_12;
-
   inherit
     ({
       kanidm_1_8 = callPackage ../servers/kanidm/1_8.nix {
@@ -8784,6 +8798,7 @@ with pkgs;
   inherit (callPackages ../development/libraries/scenefx { })
     scenefx_0_4
     scenefx_0_5
+    scenefx
     ;
 
   sway-contrib = recurseIntoAttrs (callPackages ../applications/misc/sway-contrib { });
diff --git a/pkgs/top-level/darwin-aliases.nix b/pkgs/top-level/darwin-aliases.nix
index 72a7dbc9434a..ae22c028f23b 100644
--- a/pkgs/top-level/darwin-aliases.nix
+++ b/pkgs/top-level/darwin-aliases.nix
@@ -141,7 +141,7 @@ stubs
   ### O ###
 
   opencflite = pkgs.opencflite; # added 2024-05-02
-  openwith = pkgs.openwith; # added 2025-11-28
+  openwith = throw "'openwith' has been removed, doesn't seem to work correctly on macOS 26 or newer"; # Added 2026-08-12
 
   ### P ###
   postLinkSignHook = throw "'darwin.postLinkSignHook' has been removed because it is obsolete"; # added 2025-02-23
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index 5102092fa6bb..352fcdd609fb 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -345,6 +345,8 @@ in
 
         gcadapter-oc-kmod = callPackage ../os-specific/linux/gcadapter-oc-kmod { };
 
+        gtp5g = callPackage ../os-specific/linux/gtp5g { };
+
         hyperv-daemons = callPackage ../os-specific/linux/hyperv-daemons { };
 
         e1000e =
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 917ccee50292..e71d4096740e 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -255,6 +255,7 @@ mapAliases {
   filesplit = throw "filesplit has been removed, since it is unmaintained"; # added 2025-08-20
   fints_4 = throw "fints_4 has been removed, migrate to fints"; # added 2026-06-04
   flake8-future-import = throw "'flake8-future-import' has been removed as it was unmaintained upstream"; # Added 2026-03-22
+  flashinfer = warnAlias "'flashinfer' has been renamed to 'flashinfer-python'" flashinfer-python; # Added 2026-08-13
   flask-security-too = throw "'flask-security-too' has been renamed to/replaced by 'flask-security'"; # Converted to throw 2025-10-29
   flask-silk = throw "flask-silk was removed, as it is unmaintained since 2018."; # added 2025-05-25
   flask-themes2 = throw "'flask-themes2' was removed as the only consumer pyload-ng was removed"; # added 2026-03-21
@@ -457,6 +458,7 @@ mapAliases {
   peakrdl = throw "'peakrdl' has been renamed to/replaced by 'peakrdl-cli'"; # added 2026-07-14
   pep257 = throw "'pep257' has been renamed to/replaced by 'pydocstyle'"; # Converted to throw 2025-10-29
   percol = throw "percol has been removed because it hasn't been updated since 2019"; # added 2025-05-25
+  piano-transcription-inference = throw "'piano-transcription-inference' has been removed, because its upstream repo was archived in 2025."; # added 2026-08-13
   pilight = throw "'pilight' has been removed, because it is unmaintained since 2019 and the integration was removed from Home Assistant."; # added 2026-05-06
   pillow-avif-plugin = throw "'pillow-avif-plugin' has been removed because 'pillow' has native avif support since 11.3"; # added 2025-11-26
   pinecone-client = warnAlias "'pinecone-client' has been renamed to 'pinecone'" pinecone; # added 2026-07-22
@@ -471,6 +473,7 @@ mapAliases {
   postgrest-py = postgrest; # added 2025-08-29
   powerlineMemSegment = throw "'powerlineMemSegment' has been renamed to/replaced by 'powerline-mem-segment'"; # Converted to throw 2025-10-29
   prayer-times-calculator = throw "'prayer-times-calculator' has been renamed to/replaced by 'prayer-times-calculator-offline'"; # Converted to throw 2025-10-29
+  primer3 = primer3-py; # Added 2026-08-13
   prometheus_client = throw "'prometheus_client' has been renamed to/replaced by 'prometheus-client'"; # Converted to throw 2025-10-29
   prompt_toolkit = throw "'prompt_toolkit' has been renamed to/replaced by 'prompt-toolkit'"; # Converted to throw 2025-10-29
   protonup = throw "'protonup' has been renamed to/replaced by 'protonup-ng'"; # Converted to throw 2025-10-29
@@ -519,6 +522,7 @@ mapAliases {
   pymyq = throw "'pymyq' has been renamed to/replaced by 'python-myq'"; # Converted to throw 2025-10-29
   pymystem3 = throw "'pymystem3' has been removed because it is broken and unmaintained"; # Added 2026-04-19
   pynotifier = py-notifier; # Added 2026-07-27
+  pynslookup = throw "'pynslookup' has been renamed to 'nslookup'"; # Added 2026-08-10
   pyobject = throw "'pyobject' has been removed because it was only supporting python 2"; # Added 2026-01-24
   pyosmium = warnAlias "'pyosmium' has been renamed to 'osmium'" osmium; # Added 2026-07-27
   pyownet = throw "pyownet was removed because Home Assistant switched to aio-ownet"; # added 2025-10-31
@@ -627,6 +631,7 @@ mapAliases {
   requests_oauthlib = throw "'requests_oauthlib' has been renamed to/replaced by 'requests-oauthlib'"; # Converted to throw 2025-10-29
   requests_toolbelt = throw "'requests_toolbelt' has been renamed to/replaced by 'requests-toolbelt'"; # Converted to throw 2025-10-29
   restructuredtext_lint = throw "'restructuredtext_lint' has been renamed to/replaced by 'restructuredtext-lint'"; # Converted to throw 2025-10-29
+  retinaface = retina-face; # Added 2026-08-13
   retry_decorator = throw "'retry_decorator' has been renamed to/replaced by 'retry-decorator'"; # Converted to throw 2025-10-29
   retworkx = throw "'retworkx' has been renamed to/replaced by 'rustworkx'"; # Converted to throw 2025-10-29
   rki-covid-parser = throw "rki-covid-parser has been removed because it is unmaintained and broken"; # added 2025-09-20
@@ -653,10 +658,12 @@ mapAliases {
   setuptoolsTrial = throw "'setuptoolsTrial' has been renamed to/replaced by 'setuptools-trial'"; # Converted to throw 2025-10-29
   sharkiqpy = throw "'sharkiqpy' has been renamed to/replaced by 'sharkiq'"; # Converted to throw 2025-10-29
   shippai = throw "shippai has been removed because the upstream repository was archived in 2023"; # added 2025-07-09
+  showit = throw "'showit' has been removed because the upstream is unmaintained"; # Added 2026-08-14
   sip_4 = throw "'sip_4' has been renamed to/replaced by 'sip4'"; # Converted to throw 2025-10-29
   sipsimple = lib.warnOnInstantiate "'sipsimple' has been renamed to 'python3-sipsimple' to fit upstream naming" python3-sipsimple; # added 2026-01-05
   slackclient = throw "'slackclient' has been renamed to/replaced by 'slack-sdk'"; # Converted to throw 2025-10-29
   sleekxmpp = throw "'sleekxmpp' has been removed because it was deprecated in favor of 'slixmpp'"; # added 2026-01-19
+  slicedimage = throw "'slicedimage' has been removed because it was unused"; # Added 2026-08-14
   smart_open = throw "'smart_open' has been renamed to/replaced by 'smart-open'"; # Converted to throw 2025-10-29
   smpp_pdu = throw "'smpp_pdu' has been renamed to/replaced by 'smpp-pdu'"; # Converted to throw 2025-10-29
   sorl_thumbnail = throw "'sorl_thumbnail' has been renamed to/replaced by 'sorl-thumbnail'"; # Converted to throw 2025-10-29
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 393e892b0e73..478243941647 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3779,6 +3779,8 @@ self: super: with self; {
 
   cryptolyzer = callPackage ../development/python-modules/cryptolyzer { };
 
+  cryptomobile = callPackage ../development/python-modules/cryptomobile { };
+
   cryptoparser = callPackage ../development/python-modules/cryptoparser { };
 
   crysp = callPackage ../development/python-modules/crysp { };
@@ -6135,7 +6137,7 @@ self: super: with self; {
 
   flash-mla = callPackage ../development/python-modules/flash-mla { };
 
-  flashinfer = callPackage ../development/python-modules/flashinfer { };
+  flashinfer-python = callPackage ../development/python-modules/flashinfer-python { };
 
   flashtext = callPackage ../development/python-modules/flashtext { };
 
@@ -11952,6 +11954,8 @@ self: super: with self; {
 
   nskeyedunarchiver = callPackage ../development/python-modules/nskeyedunarchiver { };
 
+  nslookup = callPackage ../development/python-modules/nslookup { };
+
   nsw-fuel-api-client = callPackage ../development/python-modules/nsw-fuel-api-client { };
 
   nsz = callPackage ../development/python-modules/nsz { };
@@ -13224,10 +13228,6 @@ self: super: with self; {
 
   pi1wire = callPackage ../development/python-modules/pi1wire { };
 
-  piano-transcription-inference =
-    callPackage ../development/python-modules/piano-transcription-inference
-      { };
-
   piccata = callPackage ../development/python-modules/piccata { };
 
   piccolo = callPackage ../development/python-modules/piccolo { };
@@ -13290,6 +13290,8 @@ self: super: with self; {
 
   pillow-jpls = callPackage ../development/python-modules/pillow-jpls { };
 
+  pillow-jxl-plugin = callPackage ../development/python-modules/pillow-jxl-plugin { };
+
   pillowfight = callPackage ../development/python-modules/pillowfight { };
 
   pims = callPackage ../development/python-modules/pims { };
@@ -13694,7 +13696,7 @@ self: super: with self; {
 
   primepy = callPackage ../development/python-modules/primepy { };
 
-  primer3 = callPackage ../development/python-modules/primer3 { };
+  primer3-py = callPackage ../development/python-modules/primer3-py { };
 
   primp = callPackage ../development/python-modules/primp { };
 
@@ -14383,6 +14385,8 @@ self: super: with self; {
 
   pycrashreport = callPackage ../development/python-modules/pycrashreport { };
 
+  pycrate = callPackage ../development/python-modules/pycrate { };
+
   pycrdt = callPackage ../development/python-modules/pycrdt { };
 
   pycrdt-store = callPackage ../development/python-modules/pycrdt-store { };
@@ -14744,6 +14748,8 @@ self: super: with self; {
 
   pygeocodio = callPackage ../development/python-modules/pygeocodio { };
 
+  pygeosphere-warnings = callPackage ../development/python-modules/pygeosphere-warnings { };
+
   pygerber = callPackage ../development/python-modules/pygerber { };
 
   pygetwindow = callPackage ../development/python-modules/pygetwindow { };
@@ -15315,8 +15321,6 @@ self: super: with self; {
 
   pynrrd = callPackage ../development/python-modules/pynrrd { };
 
-  pynslookup = callPackage ../development/python-modules/pynslookup { };
-
   pynuki = callPackage ../development/python-modules/pynuki { };
 
   pynut2 = callPackage ../development/python-modules/pynut2 { };
@@ -15837,6 +15841,8 @@ self: super: with self; {
 
   pyscss = callPackage ../development/python-modules/pyscss { };
 
+  pysctp = callPackage ../development/python-modules/pysctp { };
+
   pysdcp = callPackage ../development/python-modules/pysdcp { };
 
   pysdl2 = callPackage ../development/python-modules/pysdl2 { };
@@ -16039,6 +16045,8 @@ self: super: with self; {
 
   pysqlitecipher = callPackage ../development/python-modules/pysqlitecipher { };
 
+  pysquashfsimage = callPackage ../development/python-modules/pysquashfsimage { };
+
   pysqueezebox = callPackage ../development/python-modules/pysqueezebox { };
 
   pysrdaligateway = callPackage ../development/python-modules/pysrdaligateway { };
@@ -17798,7 +17806,7 @@ self: super: with self; {
 
   rethinkdb = callPackage ../development/python-modules/rethinkdb { };
 
-  retinaface = callPackage ../development/python-modules/retinaface { };
+  retina-face = callPackage ../development/python-modules/retina-face { };
 
   retry = callPackage ../development/python-modules/retry { };
 
@@ -18644,8 +18652,6 @@ self: super: with self; {
 
   show-in-file-manager = callPackage ../development/python-modules/show-in-file-manager { };
 
-  showit = callPackage ../development/python-modules/showit { };
-
   shtab = callPackage ../development/python-modules/shtab { };
 
   shutilwhich = callPackage ../development/python-modules/shutilwhich { };
@@ -18862,8 +18868,6 @@ self: super: with self; {
 
   slh-dsa = callPackage ../development/python-modules/slh-dsa { };
 
-  slicedimage = callPackage ../development/python-modules/slicedimage { };
-
   slicer = callPackage ../development/python-modules/slicer { };
 
   slicerator = callPackage ../development/python-modules/slicerator { };
diff --git a/pkgs/top-level/release-cuda.nix b/pkgs/top-level/release-cuda.nix
index b7111fedb63e..8e8561b85a57 100644
--- a/pkgs/top-level/release-cuda.nix
+++ b/pkgs/top-level/release-cuda.nix
@@ -132,7 +132,7 @@ let
         cupy = linux;
         faiss = linux;
         faster-whisper = linux;
-        flashinfer = linux;
+        flashinfer-python = linux;
         flax = linux;
         gpt-2-simple = linux;
         grad-cam = linux;