diff --git a/lib/licenses/licenses.nix b/lib/licenses/licenses.nix
index 42eda4e3138b..3a02b94830a1 100644
--- a/lib/licenses/licenses.nix
+++ b/lib/licenses/licenses.nix
@@ -203,6 +203,11 @@ lib.mapAttrs mkLicense (
       fullName = " BitTorrent Open Source License v1.1";
     };
 
+    blessing = {
+      spdxId = "blessing";
+      fullName = "SQLite Blessing";
+    };
+
     boehmGC = {
       spdxId = "Boehm-GC";
       fullName = "Boehm-Demers-Weiser GC License";
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index af3b202f2e55..6544a8f095d2 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -18949,6 +18949,12 @@
     githubId = 54669781;
     keys = [ { fingerprint = "293B 93D8 A471 059F 85D7  16A6 5BA9 2099 D9BE 2DAA"; } ];
   };
+  mishushakov = {
+    email = "mish@e2b.dev";
+    github = "mishushakov";
+    githubId = 10400064;
+    name = "Mish Ushakov";
+  };
   misilelab = {
     name = "misilelab";
     email = "misileminecord@gmail.com";
@@ -21883,6 +21889,12 @@
     githubId = 4908217;
     name = "Paho Lurie-Gregg";
   };
+  paige = {
+    email = "paigely@tuta.io";
+    github = "ssalggnikool";
+    githubId = 235818692;
+    name = "paige";
+  };
   pakhfn = {
     email = "pakhfn@gmail.com";
     github = "pakhfn";
diff --git a/pkgs/applications/emulators/libretro/cores/gambatte.nix b/pkgs/applications/emulators/libretro/cores/gambatte.nix
index b549d8939e3a..67b50f6f8f15 100644
--- a/pkgs/applications/emulators/libretro/cores/gambatte.nix
+++ b/pkgs/applications/emulators/libretro/cores/gambatte.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "gambatte";
-  version = "0-unstable-2026-07-31";
+  version = "0-unstable-2026-08-14";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "gambatte-libretro";
-    rev = "96174369b3c30d9fc57c926fa3379c273dc6a9a5";
-    hash = "sha256-DEXyycFfQMK3RksP+4YxBIPYqmCFH4fM39MKxw6VOBU=";
+    rev = "6a7c009273dba8d0607d60ac90634dea11d45343";
+    hash = "sha256-tkEl+APyBw6mIlyzaOAsHSEg0xABl0cW/1lkgUocKJQ=";
   };
 
   meta = {
diff --git a/pkgs/applications/emulators/libretro/cores/swanstation.nix b/pkgs/applications/emulators/libretro/cores/swanstation.nix
index f4f7f0a91e27..59717cdbd121 100644
--- a/pkgs/applications/emulators/libretro/cores/swanstation.nix
+++ b/pkgs/applications/emulators/libretro/cores/swanstation.nix
@@ -6,13 +6,13 @@
 }:
 mkLibretroCore {
   core = "swanstation";
-  version = "0-unstable-2026-07-20";
+  version = "0-unstable-2026-08-11";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "swanstation";
-    rev = "5430a4a53b89fa5827c97b84ada29d23317245bc";
-    hash = "sha256-sE9jJjdt25nz0+B0oSonRubYWurE20o/FDdUTj//qOI=";
+    rev = "7f69c199ed88d5723f71dd3a6e9c1b7a45b535a6";
+    hash = "sha256-16ZdvG/N31vCC/kI8INH1PkmdfzHhQ2pnrUrzblCayg=";
   };
 
   extraNativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/az/azurehound/package.nix b/pkgs/by-name/az/azurehound/package.nix
index 2d1465d77ac3..8e9399ad2ef7 100644
--- a/pkgs/by-name/az/azurehound/package.nix
+++ b/pkgs/by-name/az/azurehound/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "azurehound";
-  version = "3.0.0";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "SpecterOps";
     repo = "AzureHound";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4uc4XSjvuMUSeCsJl9uHBFIaeG1KZ1xDaACXnXkp7v0=";
+    hash = "sha256-WtT56qFwpAVTyWKH8Bun9irr0DHbzLDcvV3VPXEw8BE=";
   };
 
   vendorHash = "sha256-WF46wXaNU/Em0KpF6hkuuJ+7K1IKLGqpNS/HxpxX5WY=";
diff --git a/pkgs/by-name/ba/badkeys/package.nix b/pkgs/by-name/ba/badkeys/package.nix
index ac44529c7c20..1f8daee3b6e5 100644
--- a/pkgs/by-name/ba/badkeys/package.nix
+++ b/pkgs/by-name/ba/badkeys/package.nix
@@ -4,6 +4,7 @@
   fetchFromGitHub,
   python3Packages,
   testers,
+  fetchpatch2,
 }:
 
 python3Packages.buildPythonApplication (finalAttrs: {
@@ -18,6 +19,20 @@ python3Packages.buildPythonApplication (finalAttrs: {
     hash = "sha256-i6wKe3djZL2tHjq3UrC+edU6Gz8EYSXSUry61BaI0v4=";
   };
 
+  patches = [
+    # TODO: remove on version > 0.0.19
+    (fetchpatch2 {
+      name = "Adapt-tests-for-rsainvalid-check-for-latest-Python-c.patch";
+      url = "https://github.com/badkeys/badkeys/commit/0bdcc68378bf389aebcc714b8c24de1c8a88a4e9.patch?full_index=1";
+      hash = "sha256-K0AsRNxfDQ/qC7abt0rr8tKNP9cfvWJ75DscdyoxF08=";
+    })
+    (fetchpatch2 {
+      name = "Add-test-for-Diffie-Hellman-DH-key.patch";
+      url = "https://github.com/badkeys/badkeys/commit/4e16c47dc79dd98865f4e3ec4b981306630a57a3.patch?full_index=1";
+      hash = "sha256-6F4lfUOmSkCF4XuiPwnJGD2RrxT5/jsillAyW9vzXMw=";
+    })
+  ];
+
   build-system = with python3Packages; [
     setuptools
     setuptools-scm
diff --git a/pkgs/by-name/bo/bomber-go/package.nix b/pkgs/by-name/bo/bomber-go/package.nix
index 9d970d959980..105cd66266e9 100644
--- a/pkgs/by-name/bo/bomber-go/package.nix
+++ b/pkgs/by-name/bo/bomber-go/package.nix
@@ -2,36 +2,39 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  versionCheckHook,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "bomber-go";
-  version = "0.4.7";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = "devops-kung-fu";
     repo = "bomber";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-q3x3duXc2++BvVul2a5fBTcPHWrOHpPOGHBUXL08syg=";
+    hash = "sha256-D3xs8lVhrRKVVQYzHN7CQNw5NTC+AxgsWvJxnV0lwGY=";
   };
 
-  vendorHash = "sha256-jVdrvc48/Vt240EYk5PtZCjNGipX7M1qF8OJdpu/qI4=";
+  vendorHash = "sha256-mhGnuNuvMvX4WsqnS7QkWcrPfWEyaQsSKDUOpg9YrO8=";
 
-  ldflags = [
-    "-w"
-    "-s"
-  ];
+  ldflags = [ "-s" ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
 
   checkFlags = [
-    "-skip=TestEnrich" # Requires network access
+    # Requires network access
+    "-skip=TestEnrich|TestScanner_enrichVulnerabilities"
   ];
 
+  doInstallCheck = true;
+
   meta = {
     description = "Tool to scans Software Bill of Materials (SBOMs) for vulnerabilities";
     homepage = "https://github.com/devops-kung-fu/bomber";
-    changelog = "https://github.com/devops-kung-fu/bomber/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/devops-kung-fu/bomber/releases/tag/v${finalAttrs.src.tag}";
     license = lib.licenses.mpl20;
-    mainProgram = "bomber";
     maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "bomber";
   };
 })
diff --git a/pkgs/by-name/ce/ceph/src.nix b/pkgs/by-name/ce/ceph/src.nix
index acac0d1278be..71baf1bf3667 100644
--- a/pkgs/by-name/ce/ceph/src.nix
+++ b/pkgs/by-name/ce/ceph/src.nix
@@ -6,11 +6,11 @@
 
 applyPatches (final: {
   pname = "ceph-src";
-  version = "20.2.2";
+  version = "20.2.3";
 
   src = fetchurl {
     url = "https://download.ceph.com/tarballs/ceph-${final.version}.tar.gz";
-    hash = "sha256-G76ZcCdadt4KP7Ry0yzqPrbi1ydZlrcZb2IhGd2Fd1M=";
+    hash = "sha256-y3bZm2lkHiebXYNbZA7jN4VXCLaDEElYvpyuglLISi0=";
   };
 
   patches = [
diff --git a/pkgs/by-name/cl/claude-agent-acp/package.nix b/pkgs/by-name/cl/claude-agent-acp/package.nix
index 4a00c635c81c..d6598d89d1b9 100644
--- a/pkgs/by-name/cl/claude-agent-acp/package.nix
+++ b/pkgs/by-name/cl/claude-agent-acp/package.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "claude-agent-acp";
-  version = "0.66.0";
+  version = "0.69.0";
 
   src = fetchFromGitHub {
     owner = "agentclientprotocol";
     repo = "claude-agent-acp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-B6oB0xrDHFm46YfgTc/VlxPjHhCdSNlriq1zGe6XyU4=";
+    hash = "sha256-x0k+5EhGx3y6Xd2rswTWMfYb0ZAYf5D+DaACr14uNMM=";
   };
 
-  npmDepsHash = "sha256-7c9+Q+HkoUeL38EzEbu+KePA/aN+If9tGr7C/lWluhU=";
+  npmDepsHash = "sha256-Zr9aKUoIVheaFBMBmpZovsP0hWt0tqnxk/PMEjgP9HY=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/by-name/do/dokuwiki/package.nix b/pkgs/by-name/do/dokuwiki/package.nix
index 69f0d9b3461c..e6b1e614063f 100644
--- a/pkgs/by-name/do/dokuwiki/package.nix
+++ b/pkgs/by-name/do/dokuwiki/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dokuwiki";
-  version = "2026-07-14a";
+  version = "2026-07-14b";
 
   src = fetchFromGitHub {
     owner = "dokuwiki";
     repo = "dokuwiki";
     rev = "release-${version}";
-    sha256 = "sha256-qj+Ng20aB3qV2afrER309kvlh6gXRFPh3MqnomvvCf4=";
+    sha256 = "sha256-w/uVk60gdr4PhUMOHHYl+X87Hx9pojYqJo5sZXLUX6o=";
   };
 
   preload = writeText "preload.php" ''
diff --git a/pkgs/by-name/fi/fishy/package.nix b/pkgs/by-name/fi/fishy/package.nix
deleted file mode 100644
index 92b581c97d42..000000000000
--- a/pkgs/by-name/fi/fishy/package.nix
+++ /dev/null
@@ -1,41 +0,0 @@
-{
-  fetchFromGitHub,
-  lib,
-  nix-update-script,
-  openssl,
-  pkg-config,
-  rustPlatform,
-  versionCheckHook,
-}:
-
-rustPlatform.buildRustPackage (finalAttrs: {
-  pname = "fishy";
-  version = "0.2.1";
-
-  src = fetchFromGitHub {
-    owner = "p2panda";
-    repo = "fishy";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-nRkP53v9+VzqHKTsHs+cBeLjh3yASFE18sSEY02NR1s=";
-  };
-
-  cargoHash = "sha256-F4zbalop1PEb381DctUIzdm3v71b6M/hnuw9BuIEkBU=";
-
-  env.OPENSSL_NO_VENDOR = 1;
-
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ openssl ];
-
-  nativeInstallCheckInputs = [ versionCheckHook ];
-  doInstallCheck = true;
-  passthru.updateScript = nix-update-script { };
-
-  meta = {
-    description = "Create, manage and deploy p2panda schemas";
-    homepage = "https://github.com/p2panda/fishy";
-    changelog = "https://github.com/p2panda/fishy/blob/${finalAttrs.src.rev}/CHANGELOG.md";
-    license = lib.licenses.agpl3Only;
-    maintainers = with lib.maintainers; [ confusedalex ];
-    mainProgram = "fishy";
-  };
-})
diff --git a/pkgs/by-name/fo/folia-major/package.nix b/pkgs/by-name/fo/folia-major/package.nix
index 716d5e418648..298f83129e88 100644
--- a/pkgs/by-name/fo/folia-major/package.nix
+++ b/pkgs/by-name/fo/folia-major/package.nix
@@ -14,7 +14,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "folia-major";
-  version = "0.6.15";
+  version = "0.6.19";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -23,12 +23,12 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     owner = "chthollyphile";
     repo = "folia-major";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-UGISQdUPQAEn80VeBf+l+HYNJtFW5bDhAw2lA5jQjfk=";
+    hash = "sha256-H515DVSwMEz/2DyST3D55KaoBWJX1UX4on7im849J3k=";
   };
 
   npmDeps = fetchNpmDeps {
     inherit (finalAttrs) src;
-    hash = "sha256-iLem10jROG1SEHCdDO8LeV0qaJHUC5JQeXf2HAk6EgU=";
+    hash = "sha256-7MIjM/US39wW+Xk6soMZuKdmL7KOONXcA6zIGGJ45CA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gi/gitaly/package.nix b/pkgs/by-name/gi/gitaly/package.nix
index ba512ddfb735..498e463161dd 100644
--- a/pkgs/by-name/gi/gitaly/package.nix
+++ b/pkgs/by-name/gi/gitaly/package.nix
@@ -7,7 +7,7 @@
 }:
 
 let
-  version = "19.2.2";
+  version = "19.2.4";
   package_version = "v${lib.versions.major version}";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
 
@@ -21,7 +21,7 @@ let
       owner = "gitlab-org";
       repo = "gitaly";
       rev = "v${version}";
-      hash = "sha256-S48IuJmL7Huo07ECTI953aFtjXdRJktrCWRoPHF0qjE=";
+      hash = "sha256-tUofUDi2cb31qh5PX6fx7BZ8eflvR7fUi7jnK1fH0q8=";
     };
 
     vendorHash = "sha256-4yB63q5a9GaCaasI40uObx6ZV/5FMIvkbkHt8fqD1gA=";
diff --git a/pkgs/by-name/gi/gitlab-pages/package.nix b/pkgs/by-name/gi/gitlab-pages/package.nix
index 049589813def..25d4a01c00fd 100644
--- a/pkgs/by-name/gi/gitlab-pages/package.nix
+++ b/pkgs/by-name/gi/gitlab-pages/package.nix
@@ -6,14 +6,14 @@
 
 buildGoModule (finalAttrs: {
   pname = "gitlab-pages";
-  version = "19.2.2";
+  version = "19.2.4";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-pages";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-lKLwhpHQcSfjLBumK6YcZ4TTj0sEZyJ7pmYeh1lLurY=";
+    hash = "sha256-GXhKAk6PVOK/y5FjRDWkKukqK4j2DTONsDMkbPZ/Iz4=";
   };
 
   vendorHash = "sha256-aTnRSas8PgxPLLcBExNb5GHYXV0eLc1gD4Ky+50/kfw=";
diff --git a/pkgs/by-name/gi/gitlab/data.json b/pkgs/by-name/gi/gitlab/data.json
index a784a5d738a8..9c0068523ebf 100644
--- a/pkgs/by-name/gi/gitlab/data.json
+++ b/pkgs/by-name/gi/gitlab/data.json
@@ -1,17 +1,17 @@
 {
-  "version": "19.2.2",
-  "repo_hash": "sha256-3JyP5xRjYegkjD3y8dVjMQ7zwLi+46GNKVcMb5bZGG4=",
+  "version": "19.2.4",
+  "repo_hash": "sha256-AP2sWC0O5D8zPaIYm5/m8t/Z5aXq74AZsT4hH9B0Quk=",
   "yarn_hash": "sha256-UJS0ZX8d6iIRNa/LQLQTSNZDtjKNm9e35RKqvsXxv3c=",
   "frontend_islands_yarn_hash": "sha256-EvGQin+5DqqIgM36jlVkVI49WcJzVvceYnkSS9ybfcY=",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v19.2.2-ee",
+  "rev": "v19.2.4-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "19.2.2",
-    "GITLAB_KAS_VERSION": "19.2.2",
-    "GITLAB_PAGES_VERSION": "19.2.2",
+    "GITALY_SERVER_VERSION": "19.2.4",
+    "GITLAB_KAS_VERSION": "19.2.4",
+    "GITLAB_PAGES_VERSION": "19.2.4",
     "GITLAB_SHELL_VERSION": "14.56.1",
     "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.14.7",
-    "GITLAB_WORKHORSE_VERSION": "19.2.2"
+    "GITLAB_WORKHORSE_VERSION": "19.2.4"
   }
 }
diff --git a/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix b/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
index 6e0e79428d1c..c092ef5fbce9 100644
--- a/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
@@ -10,7 +10,7 @@ in
 buildGoModule (finalAttrs: {
   pname = "gitlab-workhorse";
 
-  version = "19.2.2";
+  version = "19.2.4";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
diff --git a/pkgs/by-name/go/goperf/package.nix b/pkgs/by-name/go/goperf/package.nix
index 0898a504ae3d..be6561f001ea 100644
--- a/pkgs/by-name/go/goperf/package.nix
+++ b/pkgs/by-name/go/goperf/package.nix
@@ -9,15 +9,15 @@
 
 buildGoModule (finalAttrs: {
   pname = "goperf";
-  version = "0-unstable-2026-07-08";
+  version = "0-unstable-2026-08-13";
 
   src = fetchgit {
     url = "https://go.googlesource.com/perf";
-    rev = "82a0b07e230d76fa1b3036c383d7a98172f87334";
-    hash = "sha256-TOzEoIWofdWlAfKWBS5KWxVpHsn2wx6GZDjACxFZiKI=";
+    rev = "fd4a688df89207abdabe0a0cf5b2cd9ccfd376d2";
+    hash = "sha256-YgMIIF9DAjyAPpZJtVoOKSatNhRPg/nPOYr0P06Fi5s=";
   };
 
-  vendorHash = "sha256-PBvMccuMBBGfJlETw0Xjm5Ojkgg1BS+y9Kc3vwGW5kk=";
+  vendorHash = "sha256-AZx9tPzsPvjc5kpmiBa6eYKtrw0hczYi0sbcd/lkiiA=";
 
   passthru.updateScript = writeShellScript "update-goperf" ''
     export UPDATE_NIX_ATTR_PATH=goperf
diff --git a/pkgs/by-name/le/leviculum/package.nix b/pkgs/by-name/le/leviculum/package.nix
index 024fe26d7ff5..d885c6d73284 100644
--- a/pkgs/by-name/le/leviculum/package.nix
+++ b/pkgs/by-name/le/leviculum/package.nix
@@ -10,7 +10,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "leviculum";
-  version = "0.8.0";
+  version = "0.8.1";
   __structuredAttrs = true;
 
   src = fetchFromGitea {
@@ -19,10 +19,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     repo = "leviculum";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = false;
-    hash = "sha256-Gfx1XxkIEfPxag0JHBU7+rNV63HnOcxBxqNiKtjM9h4=";
+    hash = "sha256-ehAKFOZKgGwQh7V8XC4bphDA1vAQjEZ3Hav1DtW0DfY=";
   };
 
-  cargoHash = "sha256-CfdlcujftaPTGewjO+H7p9sQoXV5MmVF3wlZoRdW9BM=";
+  cargoHash = "sha256-se+2aqR9S+470MZ1Ghny1dmIqY3MGmVHsOTFiYdFEoA=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/li/libtsm/package.nix b/pkgs/by-name/li/libtsm/package.nix
index fd960021e34b..298a238e0bec 100644
--- a/pkgs/by-name/li/libtsm/package.nix
+++ b/pkgs/by-name/li/libtsm/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libtsm";
-  version = "4.6.0";
+  version = "4.7.1";
 
   src = fetchFromGitHub {
     owner = "kmscon";
     repo = "libtsm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CN5ktki8fbvmiGiyDvDf4ayRKakpWRI51SdhRbFqNVM=";
+    hash = "sha256-VT4dOlQT98/AaFRGd4vOoyDe8W1KRvvFRaCkr/Abu9Y=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/li/lisette/package.nix b/pkgs/by-name/li/lisette/package.nix
index 35301cd29df5..ba014538b790 100644
--- a/pkgs/by-name/li/lisette/package.nix
+++ b/pkgs/by-name/li/lisette/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   rustPlatform,
   fetchFromGitHub,
   versionCheckHook,
@@ -9,16 +10,23 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lisette";
-  version = "0.2.1";
+  version = "0.11.1";
 
   src = fetchFromGitHub {
     owner = "ivov";
     repo = "lisette";
     tag = "lisette-v${finalAttrs.version}";
-    hash = "sha256-dp78bOsAe3KkPI3Lz11zCoRdx60lc1OUWUp45JNoz7o=";
+    hash = "sha256-y4daDiPOf5egoAiE1y6vEZoZJfDLB2ywy7hOn75GS/Y=";
   };
 
-  cargoHash = "sha256-ZoGS2DlLeAhTTa0TZi8Jh7bVbWdat2p7oWciRY5KUcE=";
+  cargoHash = "sha256-ARONSRqGiLF9UC5rJIc6754km7tS+9WQUSMuedRB1Fg=";
+
+  # The e2e_learn test expects to find the `lis` binary in `target/debug/lis`
+  postPatch = ''
+    substituteInPlace tests/e2e_learn.rs --replace-fail \
+      'repo.join("target/debug/lis")' \
+      'repo.join("target/${stdenv.hostPlatform.rust.cargoShortTarget}/debug/lis")'
+  '';
 
   preCheck = ''
     export NO_COLOR=true
diff --git a/pkgs/by-name/li/listmonk/package.nix b/pkgs/by-name/li/listmonk/package.nix
index 6525511d748f..b1892a6615a6 100644
--- a/pkgs/by-name/li/listmonk/package.nix
+++ b/pkgs/by-name/li/listmonk/package.nix
@@ -16,7 +16,7 @@ buildGoModule (finalAttrs: {
   src = fetchFromGitHub {
     owner = "knadh";
     repo = "listmonk";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-yLOs1vhTV/0zzq/2Rk5rJ3/1z+kE5xaYODM5NO06F6U=";
   };
 
diff --git a/pkgs/by-name/lx/lxmf-rs/package.nix b/pkgs/by-name/lx/lxmf-rs/package.nix
index e6d637ba38b9..5f4166d144d4 100644
--- a/pkgs/by-name/lx/lxmf-rs/package.nix
+++ b/pkgs/by-name/lx/lxmf-rs/package.nix
@@ -13,17 +13,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lxmf-rs";
-  version = "0.9.7";
+  version = "0.9.8";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "FreeTAKTeam";
     repo = "LXMF-rs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ZK48G8oDms8GepF+g2SxWalBbSP3yD1IHDVyev/Sc7w=";
+    hash = "sha256-yV/SAtpiL5hu5CVcI2dqtIt/gGTCQzaYtG9tV9tM7A0=";
   };
 
-  cargoHash = "sha256-ZqeTA5hbcYO12llZZ9/U1L9vOCxeY3GdT9s2TF7lU0I=";
+  cargoHash = "sha256-RKVHLKjfukNwIXsAz4CnJDy1oOM4McQeE31Ch+WHc5w=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/ly/lycheeslicer/package.nix b/pkgs/by-name/ly/lycheeslicer/package.nix
index 942d2cfeefe4..fcd0a71876a8 100644
--- a/pkgs/by-name/ly/lycheeslicer/package.nix
+++ b/pkgs/by-name/ly/lycheeslicer/package.nix
@@ -56,6 +56,6 @@ appimageTools.wrapType2 {
       ZachDavies
     ];
     platforms = [ "x86_64-linux" ];
-    mainProgram = "LycheeSlicer";
+    mainProgram = "lycheeslicer";
   };
 }
diff --git a/pkgs/by-name/me/mesa-libclc/package.nix b/pkgs/by-name/me/mesa-libclc/package.nix
index 9bc61617264e..691a22e8e3fb 100644
--- a/pkgs/by-name/me/mesa-libclc/package.nix
+++ b/pkgs/by-name/me/mesa-libclc/package.nix
@@ -6,17 +6,18 @@
   cmake,
   llvmPackages_22,
   mesa,
-  spirv-llvm-translator,
+  buildPackages,
 }:
 let
-  spirv-llvm-translator' = spirv-llvm-translator.override {
-    inherit (llvmPackages_22) llvm;
+  llvmPackages_22' = buildPackages.llvmPackages_22;
+  spirv-llvm-translator' = buildPackages.spirv-llvm-translator.override {
+    inherit (llvmPackages_22') llvm;
   };
   tools = buildEnv {
     name = "mesa-libclc-tools";
     paths = [
-      llvmPackages_22.clang-unwrapped
-      llvmPackages_22.llvm
+      llvmPackages_22'.clang-unwrapped
+      llvmPackages_22'.llvm
     ];
     pathsToLink = [ "/bin" ];
   };
diff --git a/pkgs/by-name/mo/monocle/package.nix b/pkgs/by-name/mo/monocle/package.nix
index 9f1e5a697093..35166d64b086 100644
--- a/pkgs/by-name/mo/monocle/package.nix
+++ b/pkgs/by-name/mo/monocle/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "monocle";
-  version = "1.3.0";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "bgpkit";
     repo = "monocle";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-S1oFajXaym787JFwKpZwajRaVyj3cxWT3DZE/fIZCSY=";
+    hash = "sha256-UF4i1Nq0gZIZ2nZy9Lx9yeCVdl3uv5eQo8uVPvKuodE=";
   };
 
-  cargoHash = "sha256-60cFl2+ZdYJ/iAC5IjP/5T9f8a/qxsK/szo7qT+/aU8=";
+  cargoHash = "sha256-D5khIguUPvUT1Sa/m141BSnT0qkaXDreVpsTNSnH7x4=";
 
   # require internet access
   checkFlags = map (t: "--skip=${t}") [
@@ -37,6 +37,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "lens::ip::tests::test_fetch_ip_info"
     "lens::search::tests::test_build_broker_with_filters"
     "lens::search::tests::test_pagination_logic"
+    "rejects_invalid_historical_rpki_selections"
     "server::handlers::country::tests::test_country_lens_lookup"
   ];
 
diff --git a/pkgs/by-name/ni/nix-search-tv/package.nix b/pkgs/by-name/ni/nix-search-tv/package.nix
index e6e647eed359..4748af370128 100644
--- a/pkgs/by-name/ni/nix-search-tv/package.nix
+++ b/pkgs/by-name/ni/nix-search-tv/package.nix
@@ -7,14 +7,14 @@
 
 buildGoModule (finalAttrs: {
   pname = "nix-search-tv";
-  version = "2.2.8";
+  version = "2.2.9";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "3timeslazy";
     repo = "nix-search-tv";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TbNpfJOL0IM+ElXYXherSeUT+qswxH8eY/tvCZyKAZg=";
+    hash = "sha256-FLiUAztKoFScjg4gfnPfo1jSfIn8xQuJNKrgYhUDo0k=";
   };
 
   vendorHash = "sha256-SSKDo4A8Nhvylghrw6d7CdHpZ7jObEr5V3r0Y9cH80Y=";
diff --git a/pkgs/by-name/pi/pigeons/package.nix b/pkgs/by-name/pi/pigeons/package.nix
new file mode 100644
index 000000000000..cf8c08e02291
--- /dev/null
+++ b/pkgs/by-name/pi/pigeons/package.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  nix-update-script,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "pigeons";
+  version = "0.2.1";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "n0-computer";
+    repo = "pigeons";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-dig5bYAxPPOM8YFR0IE9LCQqP/tF7J5FkPlWE9Zx4DA=";
+  };
+
+  cargoHash = "sha256-0fYPpP/pFtlG3Ws+nI1PWOcv1jbVQ1bERL439dCFDgA=";
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = "version";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Connect to any machine behind a NAT or firewall with plain SSH";
+    homepage = "https://pigeons.computer";
+    license = lib.licenses.OR [
+      lib.licenses.asl20
+      lib.licenses.mit
+    ];
+    maintainers = with lib.maintainers; [ hougo ];
+    mainProgram = "pigeons";
+  };
+})
diff --git a/pkgs/by-name/pr/prek/package.nix b/pkgs/by-name/pr/prek/package.nix
index 0e82b7eb79b0..99bde6cb2329 100644
--- a/pkgs/by-name/pr/prek/package.nix
+++ b/pkgs/by-name/pr/prek/package.nix
@@ -4,36 +4,28 @@
   fetchFromGitHub,
   rustPlatform,
   installShellFiles,
-  git,
-  uv,
-  python312,
   versionCheckHook,
   nix-update-script,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "prek";
-  version = "0.4.13";
+  version = "0.4.14";
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "j178";
     repo = "prek";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zxsSQ6omRF94AeiRDGZ9jFt8jSwJpkAW5aWHh2t42Mc=";
+    hash = "sha256-Zu7EGt/4GoUK02NkuCJbUBiluhHGMB/hLr/FL4oEY20=";
   };
 
-  cargoHash = "sha256-cNTmqG1ZbdOX8FIZZalEjxpCqTaHC4NslqOO8+M9kYU=";
+  cargoHash = "sha256-s+l7xMf+TiEi5TgrQqP7c4SczdnFFRFpFOOVdBXAmwM=";
 
   nativeBuildInputs = [
     installShellFiles
   ];
 
-  nativeCheckInputs = [
-    git
-    python312
-    uv
-  ];
-
   # many tests just do not work, as they require network access
   # best to disable all, as the upstream already tests everything
   doCheck = false;
diff --git a/pkgs/by-name/qe/qemu/package.nix b/pkgs/by-name/qe/qemu/package.nix
index fa09731c3b04..7eb7facb578e 100644
--- a/pkgs/by-name/qe/qemu/package.nix
+++ b/pkgs/by-name/qe/qemu/package.nix
@@ -70,9 +70,6 @@
   xen,
   cephSupport ? false,
   ceph,
-  glusterfsSupport ? false,
-  glusterfs,
-  libuuid,
   openGLSupport ? sdlSupport,
   libgbm,
   libepoxy,
@@ -236,10 +233,6 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals xenSupport [ xen ]
   ++ lib.optionals cephSupport [ ceph ]
-  ++ lib.optionals glusterfsSupport [
-    glusterfs
-    libuuid
-  ]
   ++ lib.optionals openGLSupport [
     libgbm
     libepoxy
@@ -342,7 +335,6 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optional gtkSupport "--enable-gtk"
   ++ lib.optional xenSupport "--enable-xen"
   ++ lib.optional cephSupport "--enable-rbd"
-  ++ lib.optional glusterfsSupport "--enable-glusterfs"
   ++ lib.optional openGLSupport "--enable-opengl"
   ++ lib.optional virglSupport "--enable-virglrenderer"
   ++ lib.optional tpmSupport "--enable-tpm"
diff --git a/pkgs/by-name/re/reticulum-go/package.nix b/pkgs/by-name/re/reticulum-go/package.nix
index 3a70dd00225f..3219af90631d 100644
--- a/pkgs/by-name/re/reticulum-go/package.nix
+++ b/pkgs/by-name/re/reticulum-go/package.nix
@@ -3,11 +3,12 @@
   buildGoModule,
   fetchFromGitHub,
   nix-update-script,
+  versionCheckHook,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "reticulum-go";
-  version = "0.9.6";
+  version = "1.0.1";
   strictDeps = true;
   __structuredAttrs = true;
 
@@ -15,15 +16,9 @@ buildGoModule (finalAttrs: {
     owner = "Quad4-Software";
     repo = "Reticulum-Go";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Rji6MJQAN48zKsLHQS8ukbi9pWjHPEbezXJu/700HZs=";
+    hash = "sha256-QPf8MymZUW8DbYYgE1hGqKNQJNunyigJMgh/tYJaW1k=";
   };
 
-  # TODO: Remove this when https://github.com/NixOS/nixpkgs/pull/527289 has landed in `master`
-  postPatch = ''
-    substituteInPlace go.mod \
-      --replace-fail "1.26.4" "1.26.3"
-  '';
-
   vendorHash = null;
 
   subPackages = [ "cmd/reticulum-go" ];
@@ -31,11 +26,15 @@ buildGoModule (finalAttrs: {
   ldflags = [
     "-s"
     "-w"
+    "-X main.defaultVersion=${finalAttrs.version}"
   ];
 
   # Required for some tests on darwin.
   __darwinAllowLocalNetworking = true;
 
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
   passthru.updateScript = nix-update-script { };
 
   meta = {
diff --git a/pkgs/by-name/rp/rpcs3/package.nix b/pkgs/by-name/rp/rpcs3/package.nix
index 7512f439e6c4..8c664c9e3778 100644
--- a/pkgs/by-name/rp/rpcs3/package.nix
+++ b/pkgs/by-name/rp/rpcs3/package.nix
@@ -64,7 +64,12 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-KTF2Oj1p+EplRgWQ/We8mqu60h161/1gniKWjVAvAso=";
   };
 
-  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version=branch"
+      "--use-github-releases"
+    ];
+  };
 
   patches = [
     # FFmpeg 9 removed AVCodec.pix_fmts; drop the check (RPCS3/rpcs3@a8dd0535935a).
diff --git a/pkgs/by-name/sb/sbomit/package.nix b/pkgs/by-name/sb/sbomit/package.nix
new file mode 100644
index 000000000000..f697e29c881e
--- /dev/null
+++ b/pkgs/by-name/sb/sbomit/package.nix
@@ -0,0 +1,35 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "sbomit";
+  version = "0.2.1";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "SBOMit";
+    repo = "sbomit";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-/tst1XGwW8LTuEFbY1KA+C93TNapVJsYstFY9oPH8yA=";
+  };
+
+  vendorHash = "sha256-R3WBmmoh+YJMJlo+OgSXU50YcEfLQWAxkBYHPAT3NZM=";
+
+  ldflags = [ "-s" ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Tool to generate SBOMs";
+    homepage = "https://github.com/SBOMit/sbomit";
+    changelog = "https://github.com/SBOMit/sbomit/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "sbomit";
+  };
+})
diff --git a/pkgs/by-name/sn/snx-rs/package.nix b/pkgs/by-name/sn/snx-rs/package.nix
index 544f184879f0..fb4fd0d3da77 100644
--- a/pkgs/by-name/sn/snx-rs/package.nix
+++ b/pkgs/by-name/sn/snx-rs/package.nix
@@ -15,13 +15,13 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "snx-rs";
-  version = "6.2.3";
+  version = "6.2.4";
 
   src = fetchFromGitHub {
     owner = "ancwrd1";
     repo = "snx-rs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6pAIq9V81HDflRqRHF4Q0OOd/t/rOpfyj9IDRwmU2LE=";
+    hash = "sha256-/csO66hElnqxGSW2doFzMuXUnB71Ss1XpIqxCEDgjio=";
   };
 
   passthru.updateScript = nix-update-script { };
@@ -49,7 +49,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     versionCheckHook
   ];
 
-  cargoHash = "sha256-2OZmPNZNzu/rIIXInvYvwXewlWvXPE49Hj54dhfOWC8=";
+  cargoHash = "sha256-AO64YbfO1DxvCjMrrCmj9Nkgp+6RlC7A/pk0Kse4dvA=";
 
   doInstallCheck = true;
   versionCheckProgram = "${placeholder "out"}/bin/snx-rs";
diff --git a/pkgs/by-name/sp/spirv-llvm-translator/package.nix b/pkgs/by-name/sp/spirv-llvm-translator/package.nix
index b86f3424f750..4fa49a4db564 100644
--- a/pkgs/by-name/sp/spirv-llvm-translator/package.nix
+++ b/pkgs/by-name/sp/spirv-llvm-translator/package.nix
@@ -3,7 +3,6 @@
   stdenv,
   srcOnly,
   fetchFromGitHub,
-  fetchpatch,
   cmake,
   pkg-config,
   lit,
diff --git a/pkgs/by-name/st/stillcolor/package.nix b/pkgs/by-name/st/stillcolor/package.nix
new file mode 100644
index 000000000000..8ab55d0ec2f3
--- /dev/null
+++ b/pkgs/by-name/st/stillcolor/package.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  fetchzip,
+  stdenvNoCC,
+  unzip,
+}:
+stdenvNoCC.mkDerivation (finalAttrs: {
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  pname = "stillcolor";
+  version = "1.1";
+
+  src = fetchzip {
+    url = "https://github.com/aiaf/Stillcolor/releases/download/v${finalAttrs.version}/Stillcolor-v${finalAttrs.version}.zip";
+    hash = "sha256-ojs5EvrH4FVWHV6VXOhQmpfH69Zmy0PGMZnEO751pi8=";
+  };
+
+  nativeBuildInputs = [ unzip ];
+
+  dontPatch = true;
+  dontConfigure = true;
+  dontBuild = true;
+  dontFixup = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/Applications/Stillcolor.app
+    cp -R . $out/Applications/Stillcolor.app/
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Disable temporal dithering on your Mac with this lightweight menu bar app. Designed for Apple silicon Macs.";
+    downloadPage = "https://github.com/aiaf/Stillcolor/releases";
+    homepage = "https://github.com/aiaf/Stillcolor";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.darwin;
+    mainProgram = "stillcolor";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    maintainers = with lib.maintainers; [ paige ];
+  };
+})
diff --git a/pkgs/by-name/ul/ultrastardx/package.nix b/pkgs/by-name/ul/ultrastardx/package.nix
index 62faa1801652..fbd5f1777a9c 100644
--- a/pkgs/by-name/ul/ultrastardx/package.nix
+++ b/pkgs/by-name/ul/ultrastardx/package.nix
@@ -36,12 +36,13 @@ let
     sqlite
     lua
     zlib
+    ffmpeg
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
     libx11
     libGLU
     libGL
-    ffmpeg
   ];
-
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ultrastardx";
@@ -58,19 +59,44 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     autoreconfHook
   ];
+
   buildInputs = [
     fpc
     libpng
   ]
   ++ sharedLibs;
 
-  preBuild =
-    let
-      items = lib.concatMapStringsSep " " (x: "-rpath ${lib.getLib x}/lib") sharedLibs;
-    in
-    ''
-      export NIX_LDFLAGS="$NIX_LDFLAGS ${items}"
-    '';
+  env = {
+    NIX_LDFLAGS = lib.concatMapStringsSep " " (x: "-rpath ${lib.getLib x}/lib") sharedLibs;
+  }
+  // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    MACOSX_DEPLOYMENT_TARGET = "10.13";
+  };
+
+  # fpc's fpc.cfg hardcodes -FD/Applications/Xcode.app/.../usr/bin to find `as`/`ld`,
+  # which is unreachable in the build sandbox and has no sysroot.
+  preBuild = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    export PFLAGS_EXTRA="-FD${lib.getBin stdenv.cc.bintools}/bin -XR$SDKROOT $PFLAGS_EXTRA"
+  '';
+
+  installPhase = ''
+    runHook preInstall
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    make macos-app
+    mkdir -p "$out/Applications" "$out/bin"
+    cp -R UltraStarDeluxe.app "$out/Applications/"
+    ln -s "$out/Applications/UltraStarDeluxe.app/Contents/MacOS/ultrastardx" \
+          "$out/bin/ultrastardx"
+  ''
+  + lib.optionalString stdenv.hostPlatform.isLinux ''
+    make install
+    install -Dm644 dists/ultrastardx.desktop \
+      "$out/share/applications/ultrastardx.desktop"
+  ''
+  + ''
+    runHook postInstall
+  '';
 
   # dlopened libgcc requires the rpath not to be shrunk
   dontPatchELF = true;
@@ -82,7 +108,8 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.gpl2Plus;
     maintainers = with lib.maintainers; [
       diogotcorreia
+      philocalyst
     ];
-    platforms = lib.platforms.linux;
+    platforms = with lib.platforms; linux ++ darwin ++ windows;
   };
 })
diff --git a/pkgs/by-name/vi/victoriametrics/package.nix b/pkgs/by-name/vi/victoriametrics/package.nix
index bf8a5880b4f1..f0361b1f915c 100644
--- a/pkgs/by-name/vi/victoriametrics/package.nix
+++ b/pkgs/by-name/vi/victoriametrics/package.nix
@@ -14,13 +14,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "VictoriaMetrics";
-  version = "1.149.0";
+  version = "1.150.0";
 
   src = fetchFromGitHub {
     owner = "VictoriaMetrics";
     repo = "VictoriaMetrics";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-RRXrs6OfndYBcVLxfUfZZUuNoBuyC+1lpf1e3qISdQA=";
+    hash = "sha256-fY8rfWuMk46sNiS+IhQYINxoasmHhUJzBKI2ocROZR8=";
   };
 
   vendorHash = null;
diff --git a/pkgs/development/compilers/julia/default.nix b/pkgs/development/compilers/julia/default.nix
index 0d3654f74bd9..c9a9f09f46d9 100644
--- a/pkgs/development/compilers/julia/default.nix
+++ b/pkgs/development/compilers/julia/default.nix
@@ -23,11 +23,11 @@ in
 {
   julia_110-bin = wrapJulia (
     callPackage (import ./generic-bin.nix {
-      version = "1.10.11";
+      version = "1.10.12";
       sha256 = {
-        x86_64-linux = "1grpvdzkh4b6mfdn1khbs1nz1b7q61rkzfip3q2x4330fjqwcjgv";
-        aarch64-linux = "1cn62bmrgz344zsml80rqpmryp8hk6bdni3zhh43lpqf8a0aj11h";
-        aarch64-darwin = "0nzh0zwjlagn4aglimyajmqv5m6qwdqz7lyjaszfxzyf1p0hcmxx";
+        x86_64-linux = "03dw4zykf09wnzc7mm8yv6k8hfb2pv0f090db34gyxlx6kz0vidh";
+        aarch64-linux = "18p5h0h00320rfc3yhjgp9z4f5xfgpzimphpzqmn8jbhjqhpn9fc";
+        aarch64-darwin = "0gvqmdnqgs2gv72zsnnppfhbsj7qynvimll9hm4nvm905bp2mcak";
       };
     }) { }
   );
@@ -43,19 +43,19 @@ in
   );
   julia_112-bin = wrapJulia (
     callPackage (import ./generic-bin.nix {
-      version = "1.12.6";
+      version = "1.12.7";
       sha256 = {
-        x86_64-linux = "16h77px97qpzfcf5lfrj8kj8baq6fs07sxjasbdsj8cly6zg7axv";
-        aarch64-linux = "16a8gkaqzsxw5z8axdyp13qdlqxapg9q11csgxigs3xxayw976q2";
-        aarch64-darwin = "0cbarn632dxn1x1zi68k31plimvrr4yizr5kcc4rvagdsbxq4z97";
+        x86_64-linux = "1s39x8l6rgp6jw3b4bj3phaszm5h77g7rrhd4lslililcrvrwzjf";
+        aarch64-linux = "1whyfcdf7bncz2n1ixxzf3h30slildgfx8a06a401wy74jsw0hwj";
+        aarch64-darwin = "06b9r4a6zddqr1cg9cv206zmjbdaiz1rb5nr2f69qssvnbgwx3xg";
       };
     }) { }
   );
   julia_110 = wrapJulia (
     callPackage
       (import ./generic.nix {
-        version = "1.10.11";
-        hash = "sha256-XItQngSzszyIGzSvqdXBV/yLQGDxf5x8SnrQ/DtzUtU=";
+        version = "1.10.12";
+        hash = "sha256-KIFenIPyMWflO9SnnAhea5VHrigIrLI0FatcVYqFzuw=";
         patches = [
           # Revert https://github.com/JuliaLang/julia/pull/55354
           # [build] Some improvements to the LLVM build system
@@ -86,8 +86,8 @@ in
   julia_112 = wrapJulia (
     callPackage
       (import ./generic.nix {
-        version = "1.12.6";
-        hash = "sha256-cR86qNbsXJAEWT6489U+NWTNdZrLqK1K2ulnr8IDMsw=";
+        version = "1.12.7";
+        hash = "sha256-XH2Ft3HeMYXuyp+8LmFz2Lz2109oQYYiqenEOtdSr1E=";
         patches = lib.optionals stdenv.hostPlatform.isDarwin [
           ./patches/1.12/0001-zlib-rpath.patch
           ./patches/1.12/0002-lbt-blas-detection.patch
diff --git a/pkgs/development/compilers/julia/generic-bin.nix b/pkgs/development/compilers/julia/generic-bin.nix
index 26f1728ccce2..b14b8001866b 100644
--- a/pkgs/development/compilers/julia/generic-bin.nix
+++ b/pkgs/development/compilers/julia/generic-bin.nix
@@ -18,17 +18,20 @@ let
     # Test flaky
     "read"
   ]
+  ++ lib.optionals (lib.versions.majorMinor version == "1.10") [
+    "LinearAlgebra/blas"
+  ]
   ++ lib.optionals (lib.versionAtLeast version "1.10") [
     # Test flaky
     # https://github.com/JuliaLang/julia/issues/52739
     "REPL"
     # Test flaky
     "ccall"
+    "loading"
   ]
   ++ lib.optionals (lib.versionAtLeast version "1.11") [
     # Test flaky
     # https://github.com/JuliaLang/julia/issues/54280
-    "loading"
     "cmdlineargs"
   ]
   ++ lib.optionals (lib.versionAtLeast version "1.12") [
diff --git a/pkgs/development/compilers/julia/generic.nix b/pkgs/development/compilers/julia/generic.nix
index 42d84d54fcaa..85b22313cc24 100644
--- a/pkgs/development/compilers/julia/generic.nix
+++ b/pkgs/development/compilers/julia/generic.nix
@@ -35,6 +35,11 @@ let
     "REPL"
     "ccall"
   ]
+  ++ lib.optionals (lib.versions.majorMinor version == "1.10") [
+    "LinearAlgebra/blas"
+    "ambiguous"
+    "compiler/contextual"
+  ]
   ++ lib.optionals (lib.versionAtLeast version "1.11") [
     "loading"
     "cmdlineargs"
@@ -121,6 +126,10 @@ stdenv.mkDerivation rec {
   ++ lib.optionals stdenv.hostPlatform.isx86_64 [
     # https://github.com/JuliaCI/julia-buildkite/blob/main/utilities/build_envs.sh
     "JULIA_CPU_TARGET=generic;sandybridge,-xsaveopt,clone_all;haswell,-rdrnd,base(1);x86-64-v4,-rdrnd,base(1)"
+    # OpenBLAS getarch CPU detection fails in Nix sandbox;
+    # Using NEHALEM as a baseline
+    "OPENBLAS_TARGET_ARCH=NEHALEM"
+    "OPENBLAS_DYNAMIC_ARCH=1"
   ]
   ++ lib.optionals stdenv.hostPlatform.isAarch64 [
     "JULIA_CPU_TARGET=generic;cortex-a57;thunderx2t99;carmel,clone_all;apple-m1,base(3);neoverse-512tvb,base(3)"
diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index 07ebaf36371c..bfa23d2bd05b 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -161,7 +161,7 @@ stdenv.mkDerivation rec {
     description = "Self-contained, serverless, zero-configuration, transactional SQL database engine";
     downloadPage = "https://sqlite.org/download.html";
     homepage = "https://www.sqlite.org/";
-    license = lib.licenses.publicDomain;
+    license = lib.licenses.blessing;
     mainProgram = "sqlite3";
     maintainers = with lib.maintainers; [ np ];
     teams = [ lib.teams.security-review ];
diff --git a/pkgs/development/libraries/sqlite/tools.nix b/pkgs/development/libraries/sqlite/tools.nix
index dfbcad20cad9..8ff4f5555116 100644
--- a/pkgs/development/libraries/sqlite/tools.nix
+++ b/pkgs/development/libraries/sqlite/tools.nix
@@ -39,7 +39,7 @@ let
       meta = {
         inherit description homepage mainProgram;
         downloadPage = "http://sqlite.org/download.html";
-        license = lib.licenses.publicDomain;
+        license = lib.licenses.blessing;
         maintainers = with lib.maintainers; [ johnazoidberg ];
         platforms = lib.platforms.unix;
       };
diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index eac1b5633676..6385c6eb3e01 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -1140,15 +1140,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "fzf-lua";
-      version = "0.0.2690-1";
+      version = "0.0.2695-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/fzf-lua-0.0.2690-1.rockspec";
-          sha256 = "1q2zmp62whlgkzzm6fh8zzj8kqvbvdaxc64nm1byl050ck4bbwsg";
+          url = "mirror://luarocks/fzf-lua-0.0.2695-1.rockspec";
+          sha256 = "0j67aycb18nyvhycfl01hpqv2hszzvhnmmyy46pxa6i03ywfxhyy";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/ibhagwan/fzf-lua/archive/28440c741e927592877514fba3db21eb188caec8.zip";
-        sha256 = "0q86ikjvyb9f5icp87cdif6cqrkljsp705svjabv5vpyyivrqz87";
+        url = "https://github.com/ibhagwan/fzf-lua/archive/05e44d38de0a79c11fba5f7bf8138791b1dbdd1e.zip";
+        sha256 = "0lj5xmixmwgy647x166shad5dh03s7mbsp3097lw9cjq7icag7lz";
       };
 
       disabled = luaOlder "5.1";
@@ -1237,15 +1237,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "grug-far.nvim";
-      version = "1.6.76-1";
+      version = "1.6.78-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/grug-far.nvim-1.6.76-1.rockspec";
-          sha256 = "0ylhh5zm29473nz5myddaywk5hhkp047lf6sy19xqfdxv0isd58c";
+          url = "mirror://luarocks/grug-far.nvim-1.6.78-1.rockspec";
+          sha256 = "0h7g3z0abbzs4rpqv5qk7skkvk7kvw5zpvag9jj5b0xyjcy0chmc";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/MagicDuck/grug-far.nvim/archive/6e05398cf6cad05b3fb46569db96b1ccfcbbd402.zip";
-        sha256 = "0bbn4jsryz4x3s6aci7rhik53pgsq4w7xgsg1kgc1lnj7aiql16p";
+        url = "https://github.com/MagicDuck/grug-far.nvim/archive/11595bf747edc270bce2069d1020502ad4ae56cf.zip";
+        sha256 = "05r65gxq53m67gmxsfynralwxqr7kaja51526fm677zirrja6ic2";
       };
 
       disabled = luaOlder "5.1";
@@ -1422,15 +1422,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "kulala.nvim";
-      version = "6.23.2-1";
+      version = "6.28.0-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/kulala.nvim-6.23.2-1.rockspec";
-          sha256 = "1z2qv9b98mp99rbqwp2v3li91i5hjccjmfqly3ylf331gjmlz1b7";
+          url = "mirror://luarocks/kulala.nvim-6.28.0-1.rockspec";
+          sha256 = "1frr6g8j32i6b76ry92hl8g29b0r2f6x6cxqddjpf026yd0lp1jd";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/mistweaverco/kulala.nvim/archive/v6.23.2.zip";
-        sha256 = "06c1yajrnmv3lbkq1m6zvmm9mpdaixrlz2i3mqk4b6d1hc4zar7c";
+        url = "https://github.com/mistweaverco/kulala.nvim/archive/v6.28.0.zip";
+        sha256 = "02mkgm68a08ipddyr9vgqmdf0bbx52y3i9pdsnaj5z4rbvb8zfdn";
       };
 
       disabled = luaOlder "5.1";
@@ -1887,17 +1887,17 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "lrexlib-gnu";
-      version = "2.9.3-1";
+      version = "2.9.4-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/lrexlib-gnu-2.9.3-1.rockspec";
-          sha256 = "1wn69qi1qfd3d13zrgw6xq7dwqks6kwj7s398kbgacq79ibv6js3";
+          url = "mirror://luarocks/lrexlib-gnu-2.9.4-1.rockspec";
+          sha256 = "0dwr8hdisfd9sapnqqwqwyl6817qh9q18y7zvmfsw8wsff59r10q";
         }).outPath;
       src = fetchFromGitHub {
         owner = "rrthomas";
         repo = "lrexlib";
-        tag = "rel-2-9-3";
-        hash = "sha256-7lybrMvNk2YhXish01PQlMpRVW+qlFj03RO33zmgGp4=";
+        tag = "rel-2-9-4";
+        hash = "sha256-f2rwr3Am+pzQB3fXOd5FVUzvJsA9e81Jy1Ar/Zqtc3Q=";
       };
 
       disabled = luaOlder "5.1";
@@ -1926,17 +1926,17 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "lrexlib-oniguruma";
-      version = "2.9.3-1";
+      version = "2.9.4-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/lrexlib-oniguruma-2.9.3-1.rockspec";
-          sha256 = "0zgpfnb7l018kh16xn836gwydhy0hpqzjchlbk0jhnjlzcvynidm";
+          url = "mirror://luarocks/lrexlib-oniguruma-2.9.4-1.rockspec";
+          sha256 = "1f8ng10hw7pz9fgv3kh9a64gz6xrsmgh30ks5b2m8nzfvpf3m7q9";
         }).outPath;
       src = fetchFromGitHub {
         owner = "rrthomas";
         repo = "lrexlib";
-        tag = "rel-2-9-3";
-        hash = "sha256-7lybrMvNk2YhXish01PQlMpRVW+qlFj03RO33zmgGp4=";
+        tag = "rel-2-9-4";
+        hash = "sha256-f2rwr3Am+pzQB3fXOd5FVUzvJsA9e81Jy1Ar/Zqtc3Q=";
       };
 
       disabled = luaOlder "5.1";
@@ -1966,17 +1966,17 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "lrexlib-pcre2";
-      version = "2.9.3-1";
+      version = "2.9.4-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/lrexlib-pcre2-2.9.3-1.rockspec";
-          sha256 = "17y1zhjb5h1bdd4rdaycrnp3xwzm06y1179ga0wpcwvg0ybwmvfn";
+          url = "mirror://luarocks/lrexlib-pcre2-2.9.4-1.rockspec";
+          sha256 = "0svmjhq1jfsfaazzx8zrm6qbiy6blk0zvmlr5g00sj3hvn46a5c5";
         }).outPath;
       src = fetchFromGitHub {
         owner = "rrthomas";
         repo = "lrexlib";
-        tag = "rel-2-9-3";
-        hash = "sha256-7lybrMvNk2YhXish01PQlMpRVW+qlFj03RO33zmgGp4=";
+        tag = "rel-2-9-4";
+        hash = "sha256-f2rwr3Am+pzQB3fXOd5FVUzvJsA9e81Jy1Ar/Zqtc3Q=";
       };
 
       disabled = luaOlder "5.1";
@@ -2006,17 +2006,17 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "lrexlib-posix";
-      version = "2.9.3-1";
+      version = "2.9.4-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/lrexlib-posix-2.9.3-1.rockspec";
-          sha256 = "0s8w35x3jvhjn4znram93dj4kck95sv4zrlqcs6mqa4q70d5rl27";
+          url = "mirror://luarocks/lrexlib-posix-2.9.4-1.rockspec";
+          sha256 = "1qfp00hhmf1ra0b0zpmf6bz770fcg41rjpa5hkl99fy9yh5x1b04";
         }).outPath;
       src = fetchFromGitHub {
         owner = "rrthomas";
         repo = "lrexlib";
-        tag = "rel-2-9-3";
-        hash = "sha256-7lybrMvNk2YhXish01PQlMpRVW+qlFj03RO33zmgGp4=";
+        tag = "rel-2-9-4";
+        hash = "sha256-f2rwr3Am+pzQB3fXOd5FVUzvJsA9e81Jy1Ar/Zqtc3Q=";
       };
 
       disabled = luaOlder "5.1";
@@ -2077,21 +2077,21 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "lsqlite3";
-      version = "0.9.6-1";
+      version = "0.9.7-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/lsqlite3-0.9.6-1.rockspec";
-          sha256 = "1wb51lsfllmbzrjfl0dzxpg597nd54nn06c9plpvqwwjz4l9lrjf";
+          url = "mirror://luarocks/lsqlite3-0.9.7-1.rockspec";
+          sha256 = "0jzsazr3gjay24vvdwswr9zfv7qn4fkh7s428y240qkndfdr7h2p";
         }).outPath;
       src = fetchzip {
-        url = "https://lua.sqlite.org/home/zip/lsqlite3_v096.zip?uuid=v0.9.6";
-        sha256 = "0p24g17y6s0x1951y9pyndggp71drh4zrzb2a05nb9sk5s3z9dnm";
+        url = "https://lua.sqlite.org/home/zip/lsqlite3_v097.zip?uuid=v0.9.7";
+        sha256 = "08h1hn9i8adm154y5747w1bgxyj3agwk0sfvpdk3l3zd5aa35b9j";
       };
 
-      disabled = luaOlder "5.1" || luaAtLeast "5.5";
+      disabled = luaOlder "5.1" || luaAtLeast "5.6";
 
       meta = {
-        homepage = "http://lua.sqlite.org/";
+        homepage = "https://lua.sqlite.org/";
         license = lib.licenses.mit;
         description = "A binding for Lua to the SQLite3 database library";
         longDescription = ''
@@ -2599,17 +2599,17 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "lua-resty-openssl";
-      version = "1.8.0-1";
+      version = "1.9.0-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/lua-resty-openssl-1.8.0-1.rockspec";
-          sha256 = "1x6hbk8xcwaaa11wcs48fjpj1bipz2a3h8lswnzl3l25llv1gsib";
+          url = "mirror://luarocks/lua-resty-openssl-1.9.0-1.rockspec";
+          sha256 = "0sjxc1h1ys148h6al6jrh40yj0si68a8hka1y7616i5ljm9kbwya";
         }).outPath;
       src = fetchFromGitHub {
         owner = "fffonion";
         repo = "lua-resty-openssl";
-        tag = "1.8.0";
-        hash = "sha256-oafU+pwTxbPHrci0pEWdZNHu0eqEluEDF5M6ojx7Xeg=";
+        tag = "1.9.0";
+        hash = "sha256-zMJw0lHbiPaTRh4zMw6Hwo5EMEwznQtTWEUfCaNy+lk=";
       };
 
       meta = {
@@ -4925,8 +4925,8 @@ final: prev: {
       src = fetchFromGitHub {
         owner = "leafo";
         repo = "moonscript";
-        rev = "60a07f80a9b87da85db49f4e0b2283fb821e0e85";
-        hash = "sha256-AmROKkKN9f4/T98i2fhkd/2W35bB8QBXQLB9TpY5XJY=";
+        rev = "26d68f20f4a7f0091ca7f62de9f09b939d8a0787";
+        hash = "sha256-ONpL+F+iwR1bxfoekX//Kq8oIegBs/Q1yisv4C/NsUU=";
       };
 
       disabled = luaOlder "5.1";
@@ -6296,8 +6296,8 @@ final: prev: {
       src = fetchFromGitHub {
         owner = "nvim-telescope";
         repo = "telescope.nvim";
-        rev = "427b576c16792edad01a92b89721d923c19ad60f";
-        hash = "sha256-/GycCrepwDer0UvBN/f84pJUSvNp+ZfTIUPv0psl+IQ=";
+        rev = "40aedd8a68c78a656a10a8d62d80c54af59420fb";
+        hash = "sha256-Ci7D8aTUhh9DwwHvEV8Pndma8b/iwylUcoDKrIKVYN4=";
       };
 
       disabled = lua.luaversion != "5.1";
@@ -6658,15 +6658,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "tree-sitter-teal";
-      version = "0.0.35-1";
+      version = "0.0.37-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/tree-sitter-teal-0.0.35-1.rockspec";
-          sha256 = "06g2i3y3gmyz17v9gxwswa9db544nyhd5mx4zq3lihrshbbf6r10";
+          url = "mirror://luarocks/tree-sitter-teal-0.0.37-1.rockspec";
+          sha256 = "16v1r92w8zisgizys99ir2wkvwmf4fcpddznxg3fyxbqr67hyy5c";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/euclidianAce/tree-sitter-teal/archive/05d276e737055e6f77a21335b7573c9d3c091e2f.zip";
-        sha256 = "1g1zk47a8jcwac0j60mlfv56mhlhbf6f77vjkx4vsfbrryprcfi4";
+        url = "https://github.com/euclidianAce/tree-sitter-teal/archive/ac6b42ffb23d5d52b582c02508dd3524ac0ba3df.zip";
+        sha256 = "15dnrvw4xp7gv9b7x825svrnaxjr40bv8crdl5v7xj0np9lrkwzj";
       };
 
       disabled = luaOlder "5.1";
diff --git a/pkgs/development/python-modules/connectrpc/default.nix b/pkgs/development/python-modules/connectrpc/default.nix
new file mode 100644
index 000000000000..48b39ddc61c9
--- /dev/null
+++ b/pkgs/development/python-modules/connectrpc/default.nix
@@ -0,0 +1,78 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  uv-build,
+
+  # dependencies
+  protobuf-py,
+  pyqwest,
+
+  # tests
+  asgiref,
+  brotli,
+  protobuf,
+  pytest-asyncio,
+  pytest-timeout,
+  pytestCheckHook,
+  zstandard,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "connectrpc";
+  version = "0.11.1";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "connectrpc";
+    repo = "connect-py";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Z0ltm1HZH2hFhKiAMaaoz9EVqzbxASLZ6wRpQx9XU0Q=";
+  };
+
+  build-system = [
+    uv-build
+  ];
+
+  dependencies = [
+    # Upstream pins protobuf-py to this exact version; bump the two together.
+    protobuf-py
+    pyqwest
+  ];
+
+  # The top-level module only re-exports __version__, so import the submodules
+  # that actually pull in pyqwest and protobuf.
+  pythonImportsCheck = [
+    "connectrpc.client"
+    "connectrpc.server"
+  ];
+
+  nativeCheckInputs = [
+    asgiref
+    brotli
+    # connectrpc.compat bridges to google's protobuf runtime.
+    protobuf
+    pytest-asyncio
+    pytest-timeout
+    pytestCheckHook
+    zstandard
+  ];
+
+  disabledTestPaths = [
+    # Drives the example Flask app from the unpublished `example` workspace member.
+    "test/test_example.py"
+    # Needs `pyvoy`, which is not packaged in nixpkgs.
+    "test/test_grpc.py"
+  ];
+
+  meta = {
+    description = "Server and client runtime library for Connect RPC";
+    homepage = "https://github.com/connectrpc/connect-py";
+    changelog = "https://github.com/connectrpc/connect-py/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ mishushakov ];
+  };
+})
diff --git a/pkgs/development/python-modules/dbt-semantic-interfaces/default.nix b/pkgs/development/python-modules/dbt-semantic-interfaces/default.nix
index fa3dd4773342..0c9ea7040cce 100644
--- a/pkgs/development/python-modules/dbt-semantic-interfaces/default.nix
+++ b/pkgs/development/python-modules/dbt-semantic-interfaces/default.nix
@@ -33,7 +33,10 @@ buildPythonPackage (finalAttrs: {
     hash = "sha256-LA5GvSm8M15NOG6f2f/gXplqburO+SpAzMZr178jx9k=";
   };
 
-  pythonRelaxDeps = [ "importlib-metadata" ];
+  pythonRelaxDeps = [
+    "importlib-metadata"
+    "more-itertools"
+  ];
 
   build-system = [
     hatchling
diff --git a/pkgs/development/python-modules/e2b-code-interpreter/default.nix b/pkgs/development/python-modules/e2b-code-interpreter/default.nix
index 2e0f21bcf779..3a4afdab7a73 100644
--- a/pkgs/development/python-modules/e2b-code-interpreter/default.nix
+++ b/pkgs/development/python-modules/e2b-code-interpreter/default.nix
@@ -10,21 +10,27 @@
   attrs,
   e2b,
   httpx,
+
+  # tests
+  pytest-asyncio,
+  pytest-xdist,
+  pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "e2b-code-interpreter";
-  inherit (e2b) version;
+  version = "2.9.1";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "e2b-dev";
     repo = "code-interpreter";
-    tag = "@e2b/code-interpreter-python@${version}";
-    hash = "sha256-a2rc7BtV+qwtqlB+JtLCs0BKN15yfwmG3XWWO8we2LA=";
+    tag = "@e2b/code-interpreter-python@${finalAttrs.version}";
+    hash = "sha256-RIKbk0CKqP9KUyi/WDqPGFK3ce/033VwKJR/yJGLPvI=";
   };
 
-  sourceRoot = "${src.name}/python";
+  sourceRoot = "${finalAttrs.src.name}/python";
 
   build-system = [
     poetry-core
@@ -32,20 +38,37 @@ buildPythonPackage rec {
 
   dependencies = [
     attrs
+    # Upstream requires e2b >=2.39.1,<3.0.0; enforced by pythonRuntimeDepsCheck.
     e2b
     httpx
   ];
 
   pythonImportsCheck = [ "e2b_code_interpreter" ];
 
-  # Tests require an API key
-  # e2b.exceptions.AuthenticationException: API key is required, please visit the Team tab at https://e2b.dev/dashboard to get your API key.
-  doCheck = false;
+  nativeCheckInputs = [
+    pytest-asyncio
+    # upstream's pytest.ini passes --numprocesses
+    pytest-xdist
+    pytestCheckHook
+  ];
+
+  # Everything else under tests/ drives a real sandbox and needs an API key --
+  # including tests/charts, which renders the charts inside one.
+  enabledTestPaths = [ "tests/test_sandbox_url.py" ];
+
+  # Import e2b_code_interpreter from $out rather than the source tree.
+  preCheck = ''
+    rm -r e2b_code_interpreter
+  '';
 
   meta = {
-    description = "E2B Code Interpreter - Stateful code execution";
+    description = "Stateful code execution in cloud sandboxes";
     homepage = "https://github.com/e2b-dev/code-interpreter/tree/main/python";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ GaetanLepage ];
+    changelog = "https://github.com/e2b-dev/code-interpreter/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      GaetanLepage
+      mishushakov
+    ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/e2b/default.nix b/pkgs/development/python-modules/e2b/default.nix
index b69af4f5ca00..32cb4d46e01d 100644
--- a/pkgs/development/python-modules/e2b/default.nix
+++ b/pkgs/development/python-modules/e2b/default.nix
@@ -4,60 +4,96 @@
   fetchFromGitHub,
 
   # build-system
-  poetry-core,
+  uv-build,
 
   # dependencies
   attrs,
-  httpcore,
+  connectrpc,
+  dockerfile-parse,
+  h2,
   httpx,
   packaging,
-  protobuf,
+  protobuf-py,
+  pyqwest,
   python-dateutil,
+  rich,
   typing-extensions,
+  wcmatch,
+
+  # tests
+  pytest-asyncio,
+  pytest-timeout,
+  pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "e2b";
-  version = "1.5.1";
+  version = "2.39.1";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "e2b-dev";
     repo = "E2B";
-    tag = "@e2b/python-sdk@${version}";
-    hash = "sha256-6THRc4rv/mzOWbsN1FpUu56kjvHvVBssK2glNoGdSzI=";
+    tag = "@e2b/python-sdk@${finalAttrs.version}";
+    hash = "sha256-bB5MGXd3W66/hjodSqTAmlnr6iJjGx/5ET6nOofdkrI=";
   };
 
-  sourceRoot = "${src.name}/packages/python-sdk";
+  sourceRoot = "${finalAttrs.src.name}/packages/python-sdk";
+
+  # Upstream caps the build backend at uv_build<0.11.0; ours is newer.
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "uv_build>=0.10.0,<0.11.0" "uv_build"
+  '';
 
   build-system = [
-    poetry-core
-  ];
-
-  pythonRelaxDeps = [
-    "protobuf"
+    uv-build
   ];
 
   dependencies = [
     attrs
-    httpcore
+    connectrpc
+    dockerfile-parse
+    h2
     httpx
     packaging
-    protobuf
+    protobuf-py
+    pyqwest
     python-dateutil
+    rich
     typing-extensions
+    wcmatch
   ];
 
   pythonImportsCheck = [ "e2b" ];
 
-  # Tests require an API key
-  # e2b.exceptions.AuthenticationException: API key is required, please visit the Team tab at https://e2b.dev/dashboard to get your API key.
-  doCheck = false;
+  nativeCheckInputs = [
+    pytest-asyncio
+    pytest-timeout
+    pytestCheckHook
+  ];
+
+  # Everything under tests/{async,sync,bugs} drives a real sandbox and needs an
+  # API key. The rest runs offline against an in-process envd frame server.
+  enabledTestPaths = [ "tests/test_*.py" ];
+
+  # Import e2b from $out rather than the source tree.
+  preCheck = ''
+    rm -r e2b
+  '';
+
+  # The offline tests exercise the transport against an in-process server.
+  __darwinAllowLocalNetworking = true;
 
   meta = {
-    description = "E2B SDK that give agents cloud environments";
+    description = "Cloud environments for AI agents";
     homepage = "https://github.com/e2b-dev/E2B/blob/main/packages/python-sdk";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ GaetanLepage ];
+    changelog = "https://github.com/e2b-dev/E2B/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      GaetanLepage
+      mishushakov
+    ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index c749cc7144cd..2e98e4e162cf 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202608171";
+  version = "0.1.202608181";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Z4+TzL4RKCopdNCVr46SMXaIjYTmx2NWnRFbnmPK32w=";
+    hash = "sha256-+CQbyoAPhYZz/NXJpFgGomrz0ZdWRTUKFbXz8qAdho8=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/m2crypto/default.nix b/pkgs/development/python-modules/m2crypto/default.nix
index 071b4d04016d..b27742af9ebd 100644
--- a/pkgs/development/python-modules/m2crypto/default.nix
+++ b/pkgs/development/python-modules/m2crypto/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "m2crypto";
-  version = "0.48.0";
+  version = "0.49.0";
   pyproject = true;
 
   src = fetchFromGitLab {
     owner = "m2crypto";
     repo = "m2crypto";
     tag = finalAttrs.version;
-    hash = "sha256-Ya1og1x3EPbHkrY74tkdkMOJreS3x8x/1oVfwcpAEOU=";
+    hash = "sha256-1YM8X7h3AD+LVYya7Pt1YHcG+4PnEpcSaHBFg6jkDC0=";
   };
 
   # https://lists.sr.ht/~mcepl/m2crypto/%3CCAPhw1+Hg6+OJZoqt1O6aezxnTUFmfFTMzDwkD2bJ74jnmygqrg@mail.gmail.com%3E
diff --git a/pkgs/development/python-modules/pixel-font-knife/default.nix b/pkgs/development/python-modules/pixel-font-knife/default.nix
index 73ba66f0738c..fd5bf50d0009 100644
--- a/pkgs/development/python-modules/pixel-font-knife/default.nix
+++ b/pkgs/development/python-modules/pixel-font-knife/default.nix
@@ -6,14 +6,13 @@
   pytestCheckHook,
   nix-update-script,
   uv-build,
-  pypng,
   unidata-blocks,
   pyyaml,
 }:
 
 buildPythonPackage rec {
   pname = "pixel-font-knife";
-  version = "0.0.21";
+  version = "0.0.25";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -22,13 +21,12 @@ buildPythonPackage rec {
     owner = "TakWolf";
     repo = "pixel-font-knife";
     tag = version;
-    hash = "sha256-f4jaLEPXl8oo1olWBeymMn5a8Tyl07h1TW4pZ5OItZU=";
+    hash = "sha256-KQN4FQf6PsNi+NQW0BOD4tuK4G5LkUgP6Cr2drUpLO0=";
   };
 
   build-system = [ uv-build ];
 
   dependencies = [
-    pypng
     unidata-blocks
     pyyaml
   ];
diff --git a/pkgs/development/python-modules/protobuf-py-ext/default.nix b/pkgs/development/python-modules/protobuf-py-ext/default.nix
new file mode 100644
index 000000000000..1dff2edb46f0
--- /dev/null
+++ b/pkgs/development/python-modules/protobuf-py-ext/default.nix
@@ -0,0 +1,49 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+
+  # build-system
+  rustPlatform,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "protobuf-py-ext";
+  version = "0.1.1";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  # No tag on GitHub for this release: bufbuild/protobuf-py's only tag is v0.2.0.
+  # This has to stay in lockstep with protobuf-py, which is held at 0.1.1.
+  src = fetchPypi {
+    pname = "protobuf_py_ext";
+    inherit (finalAttrs) version;
+    hash = "sha256-6Fv9/bPtUGNNuMzHQp3ZKGUgEJSJxzVGOXGkGHB7T+8=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-oC9LPNUDVigOVqTHm3bRZlK0ToEHKlEpCtBRxqViFtg=";
+  };
+
+  nativeBuildInputs = [
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+  ];
+
+  pythonImportsCheck = [ "protobuf_ext" ];
+
+  # The test suite lives in the protobuf-py repository and covers this extension
+  # only through protobuf-py's own tests, which the sdist does not ship.
+  # pythonImportsCheck confirms the extension loads for this interpreter, which
+  # is what packaging can get wrong.
+  doCheck = false;
+
+  meta = {
+    description = "Native accelerator for the protobuf-py runtime";
+    homepage = "https://github.com/bufbuild/protobuf-py";
+    # The sdist declares no license; the source repository is Apache-2.0.
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ mishushakov ];
+  };
+})
diff --git a/pkgs/development/python-modules/protobuf-py/default.nix b/pkgs/development/python-modules/protobuf-py/default.nix
new file mode 100644
index 000000000000..8a01100ac9c5
--- /dev/null
+++ b/pkgs/development/python-modules/protobuf-py/default.nix
@@ -0,0 +1,51 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+
+  # build-system
+  uv-build,
+
+  # dependencies
+  protobuf-py-ext,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "protobuf-py";
+  # connectrpc requires this exact version and e2b requires <0.2; bump all three
+  # together.
+  version = "0.1.1";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  # No tag on GitHub for this release: bufbuild/protobuf-py's only tag is v0.2.0,
+  # which connectrpc (`protobuf-py==0.1.1`) and e2b (`<0.2`) do not accept yet.
+  src = fetchPypi {
+    pname = "protobuf_py";
+    inherit (finalAttrs) version;
+    hash = "sha256-a9CKxNjxZhllu+JoVCnXkENwTN0e5yCnqJYXMxdCJAs=";
+  };
+
+  build-system = [
+    uv-build
+  ];
+
+  dependencies = [
+    protobuf-py-ext
+  ];
+
+  pythonImportsCheck = [ "protobuf" ];
+
+  # The test suite is not part of the PyPI sdist and there is no git tag for this
+  # release. Note that protobuf swallows an ImportError from protobuf_ext and
+  # falls back to pure Python, so a broken accelerator would not surface here —
+  # protobuf-py-ext's own pythonImportsCheck is what guards that.
+  doCheck = false;
+
+  meta = {
+    description = "Idiomatic Protocol Buffers for Python";
+    homepage = "https://github.com/bufbuild/protobuf-py";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ mishushakov ];
+  };
+})
diff --git a/pkgs/development/python-modules/pyinstaller-hooks-contrib/default.nix b/pkgs/development/python-modules/pyinstaller-hooks-contrib/default.nix
index baea6cc5cd3c..38bf42d4f09d 100644
--- a/pkgs/development/python-modules/pyinstaller-hooks-contrib/default.nix
+++ b/pkgs/development/python-modules/pyinstaller-hooks-contrib/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "pyinstaller-hooks-contrib";
-  version = "2026.1";
+  version = "2026.6";
 
   pyproject = true;
 
   src = fetchPypi {
     pname = "pyinstaller_hooks_contrib";
     inherit version;
-    hash = "sha256-pfCJGh6B6SQGq5F9nnat/XoraEFe4uNclQp7ORC8Nhs=";
+    hash = "sha256-vvUALDL09QvVWwBdoSz/ZOyoeD5+r4agamJBAWS6tyU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pyqwest/default.nix b/pkgs/development/python-modules/pyqwest/default.nix
new file mode 100644
index 000000000000..c44d0a863ccd
--- /dev/null
+++ b/pkgs/development/python-modules/pyqwest/default.nix
@@ -0,0 +1,72 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  cmake,
+  rustPlatform,
+
+  # dependencies
+  opentelemetry-api,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "pyqwest";
+  version = "0.9.0";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "curioswitch";
+    repo = "pyqwest";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-K/zkPD7x3qKRPo7YJDWFrTLczaXvayKc8Zf/SQr2xL0=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-ztlUPsqEJz1WB2pXuoUyyhmUWY6MoWI/gErgg+6Fkcg=";
+  };
+
+  # reqwest' http3 feature refuses to compile without these cfgs, which upstream
+  # sets under `[build]`. Cargo ignores that section once cargoSetupHook has
+  # appended its own `[target.<host>]` rustflags, and setting RUSTFLAGS instead
+  # would shadow those. Flags from `cfg(...)` and `<triple>` sections are joined,
+  # so retargeting upstream's section keeps both sets.
+  postPatch = ''
+    substituteInPlace .cargo/config.toml \
+      --replace-fail '[build]' "[target.'cfg(all())']"
+  '';
+
+  nativeBuildInputs = [
+    # Only invoked by aws-lc-sys' build script; there is no top-level
+    # CMakeLists.txt to configure.
+    cmake
+    rustPlatform.bindgenHook
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+  ];
+
+  dontUseCmakeConfigure = true;
+
+  dependencies = [
+    opentelemetry-api
+  ];
+
+  pythonImportsCheck = [ "pyqwest" ];
+
+  # The test suite spins up local HTTP/1, HTTP/2 and HTTP/3 servers through
+  # `pyvoy`, which is not packaged in nixpkgs. Nothing it covers is
+  # nixpkgs-specific: the packaging risk here is that the Rust extension fails
+  # to build or load, which pythonImportsCheck catches.
+  doCheck = false;
+
+  meta = {
+    description = "Modern, high-performance HTTP client for Python built on reqwest";
+    homepage = "https://github.com/curioswitch/pyqwest";
+    changelog = "https://github.com/curioswitch/pyqwest/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ mishushakov ];
+  };
+})
diff --git a/pkgs/development/python-modules/ucsmsdk/default.nix b/pkgs/development/python-modules/ucsmsdk/default.nix
index e41d77193973..a3520f5ec4d4 100644
--- a/pkgs/development/python-modules/ucsmsdk/default.nix
+++ b/pkgs/development/python-modules/ucsmsdk/default.nix
@@ -7,16 +7,16 @@
   six,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "ucsmsdk";
-  version = "0.9.26";
+  version = "0.9.27";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "CiscoUcs";
     repo = "ucsmsdk";
-    tag = "v${version}";
-    hash = "sha256-PX9SoUhFp0XlEXaKKEh1TA7+gNCUj+t0jOR5hgosu9c=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-5X7ixOI6ZrB0Vd1A4f/05mr9BgwqC95nKFfyvBvQyQA=";
   };
 
   build-system = [ setuptools ];
@@ -34,8 +34,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python SDK for Cisco UCS";
     homepage = "https://github.com/CiscoUcs/ucsmsdk";
-    changelog = "https://github.com/CiscoUcs/ucsmsdk/blob/${src.tag}/HISTORY.rst";
+    changelog = "https://github.com/CiscoUcs/ucsmsdk/blob/${finalAttrs.src.tag}/HISTORY.rst";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ SuperSandro2000 ];
   };
-}
+})
diff --git a/pkgs/kde/gear/calindori/default.nix b/pkgs/kde/gear/calindori/default.nix
index 565ffe6d5865..02c4f9186d16 100644
--- a/pkgs/kde/gear/calindori/default.nix
+++ b/pkgs/kde/gear/calindori/default.nix
@@ -1,9 +1,13 @@
 {
   mkKdeDerivation,
   qtsvg,
+  kirigami-addons,
 }:
 mkKdeDerivation {
   pname = "calindori";
 
-  extraBuildInputs = [ qtsvg ];
+  extraBuildInputs = [
+    qtsvg
+    kirigami-addons
+  ];
 }
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 3a6039e5f2cf..221852ac2fa0 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -829,6 +829,7 @@ mapAliases {
   firefox-wayland = throw "'firefox-wayland' has been renamed to/replaced by 'firefox'"; # Converted to throw 2025-10-27
   firmwareLinuxNonfree = throw "'firmwareLinuxNonfree' has been renamed to/replaced by 'linux-firmware'"; # Converted to throw 2025-10-27
   fishfight = throw "'fishfight' has been renamed to/replaced by 'jumpy'"; # Converted to throw 2025-10-27
+  fishy = throw "'fishy' has been removed because it was unmaintained upstream"; # Added 2026-08-18
   fit-trackee = throw "'fit-trackee' has been renamed to/replaced by 'fittrackee'"; # Converted to throw 2025-10-27
   fixup_yarn_lock = throw "`fixup_yarn_lock` has been removed, please use `fixup-yarn-lock` instead."; # Added 2026-04-25
   flashrom-stable = throw "'flashrom-stable' has been renamed to/replaced by 'flashprog'"; # Converted to throw 2025-10-27
@@ -1191,8 +1192,6 @@ mapAliases {
   joplin = joplin-cli; # Added 2025-11-03
   jscoverage = throw "jscoverage has been removed, as it was broken"; # Added 2025-08-25
   jsduck = throw "jsduck has been removed, as it was broken and unmaintained upstream."; # Added 2025-12-02
-  julia_19 = throw "Julia 1.9 has reached its end of life and 'julia_19' has been removed. Please use a supported version."; # Added 2025-10-29
-  julia_19-bin = throw "Julia 1.9 has reached its end of life and 'julia_19-bin' has been removed. Please use a supported version."; # Added 2025-10-29
   jwm-settings-manager = throw "'jwm-settings-manager' has been removed, as it is unmaintained upstream"; # Added 2026-08-01
   k3s_1_30 = throw "'k3s_1_30' has been removed from nixpkgs as it has reached end of life"; # Added 2025-09-01
   k3s_1_31 = throw "'k3s_1_31' has been removed from nixpkgs as it has reached end of life"; # Added 2025-12-08
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4f1373ce339b..31b099b7e026 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7898,9 +7898,6 @@ with pkgs;
     qemu.override {
       smbdSupport = lib.meta.availableOn stdenv.hostPlatform samba;
       cephSupport = lib.meta.availableOn stdenv.hostPlatform ceph;
-      glusterfsSupport =
-        lib.meta.availableOn stdenv.hostPlatform glusterfs
-        && lib.meta.availableOn stdenv.hostPlatform libuuid;
     }
   );
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 55d05e8cca10..1f64756574ea 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3593,6 +3593,8 @@ self: super: with self; {
 
   connection-pool = callPackage ../development/python-modules/connection-pool { };
 
+  connectrpc = callPackage ../development/python-modules/connectrpc { };
+
   connexion = callPackage ../development/python-modules/connexion { };
 
   connio = callPackage ../development/python-modules/connio { };
@@ -13972,6 +13974,10 @@ self: super: with self; {
   # If a protobuf upgrade causes many Python packages to fail, please pin it here to the previous version.
   protobuf = protobuf7;
 
+  protobuf-py = callPackage ../development/python-modules/protobuf-py { };
+
+  protobuf-py-ext = callPackage ../development/python-modules/protobuf-py-ext { };
+
   protobuf3-to-dict = callPackage ../development/python-modules/protobuf3-to-dict { };
 
   # Protobuf 4.x
@@ -15874,6 +15880,8 @@ self: super: with self; {
 
   pyqvrpro = callPackage ../development/python-modules/pyqvrpro { };
 
+  pyqwest = callPackage ../development/python-modules/pyqwest { };
+
   pyqwikswitch = callPackage ../development/python-modules/pyqwikswitch { };
 
   pyrabbit2 = callPackage ../development/python-modules/pyrabbit2 { };