diff --git a/nixos/modules/services/web-apps/tabbyapi.nix b/nixos/modules/services/web-apps/tabbyapi.nix
index a955afe463b5..7c357b15551f 100644
--- a/nixos/modules/services/web-apps/tabbyapi.nix
+++ b/nixos/modules/services/web-apps/tabbyapi.nix
@@ -35,12 +35,14 @@ in
               type = lib.types.str;
               default = "127.0.0.1";
               description = "The IP to host on. Use 0.0.0.0 to expose on all network adapters.";
+              example = "0.0.0.0";
             };
 
             port = lib.mkOption {
               type = lib.types.port;
               default = 5000;
               description = "The port to host on.";
+              example = 8080;
             };
 
             disable_auth = lib.mkOption {
@@ -58,10 +60,34 @@ in
               description = "Disable fetching external content in response to requests, such as images from URLs.";
             };
 
+            send_tracebacks = lib.mkOption {
+              type = lib.types.bool;
+              default = false;
+              description = ''
+                Send tracebacks over the API.
+                NOTE: Only enable this for debug purposes.
+              '';
+            };
+
             api_servers = lib.mkOption {
               type = lib.types.listOf lib.types.str;
               default = [ "OAI" ];
               description = "Select API servers to enable. Possible values: OAI, Kobold.";
+              example = [
+                "OAI"
+                "Kobold"
+              ];
+            };
+
+            sse_ping_interval = lib.mkOption {
+              type = lib.types.ints.unsigned;
+              default = 15;
+              description = ''
+                Seconds between SSE keep-alive pings on streaming responses.
+                Pings are SSE comments, ignored by compliant clients, and prevent
+                connections from dropping during long prefills. Set to 0 to disable.
+              '';
+              example = 0;
             };
           };
 
@@ -72,6 +98,12 @@ in
               description = "Enable prompt logging.";
             };
 
+            log_generation_params = lib.mkOption {
+              type = lib.types.bool;
+              default = false;
+              description = "Enable generation parameter logging.";
+            };
+
             log_requests = lib.mkOption {
               type = lib.types.bool;
               default = false;
@@ -141,6 +173,15 @@ in
               '';
             };
 
+            use_dummy_models = lib.mkOption {
+              type = lib.types.bool;
+              default = false;
+              description = ''
+                Sends dummy model names when the models endpoint is queried.
+                Enable this if the client is looking for specific OAI models.
+              '';
+            };
+
             model_name = lib.mkOption {
               type = lib.types.nullOr lib.types.str;
               default = null;
@@ -151,6 +192,20 @@ in
               example = "Qwen3_5-9B";
             };
 
+            use_as_default = lib.mkOption {
+              type = lib.types.listOf lib.types.str;
+              default = [ ];
+              description = ''
+                Names of args to use as a fallback for API load requests.
+                For example, if you always want cache_mode to be Q4 instead of only on the
+                initial model load, add "cache_mode" to this list.
+              '';
+              example = [
+                "max_seq_len"
+                "cache_mode"
+              ];
+            };
+
             max_seq_len = lib.mkOption {
               type = lib.types.nullOr lib.types.int;
               default = null;
@@ -158,6 +213,22 @@ in
                 Max sequence length (default: min(max_position_embeddings, cache_size)).
                 Set to -1 to fetch from the model's config.json.
               '';
+              example = 32768;
+            };
+
+            cache_size = lib.mkOption {
+              type = lib.types.nullOr (
+                lib.types.addCheck lib.types.ints.positive (n: lib.mod n 256 == 0)
+                // {
+                  description = "positive integer, multiple of 256";
+                }
+              );
+              default = null;
+              description = ''
+                Size of the key/value cache to allocate, in tokens (default: 4096).
+                Must be a multiple of 256.
+              '';
+              example = 32768;
             };
 
             cache_mode = lib.mkOption {
@@ -168,6 +239,7 @@ in
                 Specify the pair k_bits,v_bits where k_bits and v_bits are integers from 2-8 (e.g. '8,8').
                 The legacy values 'FP16', 'Q8', 'Q6', 'Q4' are also accepted.
               '';
+              example = "8,8";
             };
 
             tensor_parallel = lib.mkOption {
@@ -185,6 +257,111 @@ in
               description = "Automatically allocate resources to GPUs. Not parsed for single GPU users.";
             };
 
+            autosplit_reserve = lib.mkOption {
+              type = lib.types.listOf lib.types.number;
+              default = [ 96 ];
+              description = ''
+                Reserve VRAM used for autosplit loading, as a list of MB per GPU
+                (default: 96 MB on GPU 0).
+              '';
+              example = [
+                96
+                96
+              ];
+            };
+
+            gpu_split = lib.mkOption {
+              type = lib.types.listOf lib.types.number;
+              default = [ ];
+              description = ''
+                List of VRAM sizes to split between GPUs, in GB.
+                Used with tensor parallelism.
+              '';
+              example = [
+                16
+                24
+              ];
+            };
+
+            cpu_moe_offload_layers = lib.mkOption {
+              type = lib.types.ints.unsigned;
+              default = 0;
+              description = ''
+                Number of mixture-of-expert layers to offload to CPU inference.
+                Only affects MoE models. Set a large value such as 999 to offload all layers.
+              '';
+              example = 999;
+            };
+
+            rope_scale = lib.mkOption {
+              type = lib.types.nullOr lib.types.number;
+              default = 1.0;
+              description = ''
+                Rope scale, same as compress_pos_emb.
+                Use if the model was trained on long context with rope.
+                Set to null to pull the value from the model.
+
+                NOTE: If a model has YaRN rope scaling, it will automatically be enabled by
+                ExLlama and the rope_scale and rope_alpha settings won't apply.
+              '';
+              example = 4.0;
+            };
+
+            rope_alpha = lib.mkOption {
+              type = lib.types.nullOr (lib.types.either lib.types.number (lib.types.enum [ "auto" ]));
+              default = null;
+              description = ''
+                Rope alpha, same as alpha_value. Set to "auto" to auto-calculate.
+                Leaving this null will either pull from the model or auto-calculate.
+              '';
+              example = "auto";
+            };
+
+            chunk_size = lib.mkOption {
+              type = lib.types.ints.positive;
+              default = 2048;
+              description = ''
+                Chunk size for prompt ingestion.
+                A lower value reduces VRAM usage but decreases ingestion speed.
+                NOTE: Effects vary depending on the model. An ideal value is between 512 and 4096.
+              '';
+              example = 512;
+            };
+
+            output_chunking = lib.mkOption {
+              type = lib.types.bool;
+              default = true;
+              description = ''
+                Use output chunking. Instead of allocating cache space for the entire completion
+                at once, allocate in chunks as needed. Used by EXL3 models only.
+              '';
+            };
+
+            max_batch_size = lib.mkOption {
+              type = lib.types.nullOr lib.types.ints.positive;
+              default = null;
+              description = ''
+                Set the maximum number of generation jobs that can run concurrently.
+                The default maximum batch size for transformer architectures is 32. Recurrent
+                models with linear or sliding attention use more VRAM to support larger batches,
+                so the default value is reduced to 4. If you do not require concurrency at all,
+                you can reduce it further to minimize VRAM overhead.
+              '';
+              example = 1;
+            };
+
+            prompt_template = lib.mkOption {
+              type = lib.types.nullOr lib.types.str;
+              default = null;
+              description = ''
+                Set the prompt template for this model.
+                If null, attempts to look for the model's chat template.
+                If a model contains multiple templates in its tokenizer_config.json,
+                set this to the name of the template you want to use.
+                NOTE: Only works with chat completion message lists!
+              '';
+            };
+
             dummy_model_names = lib.mkOption {
               type = lib.types.listOf lib.types.str;
               default = [ "gpt-3.5-turbo" ];
@@ -192,6 +369,10 @@ in
                 A list of fake model names that are sent via the /v1/models endpoint.
                 Also used as bypasses for strict mode if inline_model_loading is true.
               '';
+              example = [
+                "gpt-3.5-turbo"
+                "gpt-4"
+              ];
             };
 
             vision = lib.mkOption {
@@ -200,6 +381,34 @@ in
               description = "Enables vision support if the model supports it.";
             };
 
+            template_vars_default = lib.mkOption {
+              type = lib.types.attrsOf lib.types.anything;
+              default = { };
+              description = ''
+                Default chat template variables. Merged into the template variables of every
+                chat completion request; values sent by the client (template_vars /
+                chat_template_kwargs, or the top-level reasoning_effort field) take precedence.
+                Use for model-specific reasoning knobs.
+              '';
+              example = {
+                enable_thinking = true;
+              };
+            };
+
+            template_vars_force = lib.mkOption {
+              type = lib.types.attrsOf lib.types.anything;
+              default = { };
+              description = ''
+                Forced chat template variables. Like template_vars_default, but these override
+                any values sent by the client.
+                Replaces the deprecated force_enable_thinking option, which is still accepted
+                as an alias for { enable_thinking = true; }.
+              '';
+              example = {
+                reasoning_effort = "high";
+              };
+            };
+
             reasoning = lib.mkOption {
               type = lib.types.bool;
               default = false;
@@ -220,7 +429,243 @@ in
               default = "</think>";
               description = "The end token for reasoning content.";
             };
+
+            start_in_reasoning = lib.mkOption {
+              type = lib.types.enum [
+                "auto"
+                "always"
+                "never"
+              ];
+              default = "auto";
+              description = ''
+                Whether generation starts inside a reasoning block.
+                "auto" guesses by scanning the end of the templated prompt for an unclosed
+                reasoning start token.
+              '';
+              example = "always";
+            };
+
+            tool_calls_in_reasoning = lib.mkOption {
+              type = lib.types.bool;
+              default = true;
+              description = ''
+                Parse tool calls that occur inside reasoning content.
+                If false, tool call tags inside a reasoning block are treated as plain
+                reasoning text.
+              '';
+            };
+
+            tool_format = lib.mkOption {
+              type = lib.types.nullOr lib.types.str;
+              default = null;
+              description = ''
+                Tool format, e.g. "qwen3_coder". See upstream docs for supported formats.
+                If null, tool calls from the model will not be parsed by the server.
+              '';
+              example = "qwen3_coder";
+            };
+
+            harmony = lib.mkOption {
+              type = lib.types.nullOr lib.types.bool;
+              default = null;
+              description = ''
+                Parse responses in the Harmony message format (gpt-oss models).
+                Auto-detected from the model's special tokens when null; set to true or false
+                to override. Setting tool_format to "harmony" is equivalent to setting this to
+                true. When active, supersedes the reasoning and tool format settings.
+              '';
+            };
           };
+
+          draft_model = {
+            draft_mode = lib.mkOption {
+              type = lib.types.enum [
+                "model"
+                "disabled"
+                "mtp"
+                "ngram"
+              ];
+              default = "model";
+              description = ''
+                Drafting mode for exllamav3.
+                In "model" mode, drafting is disabled if no draft_model_name is provided.
+              '';
+              example = "ngram";
+            };
+
+            draft_model_dir = lib.mkOption {
+              type = lib.types.str;
+              default = "models";
+              description = "Directory to look for draft models. Relative to the state directory.";
+              example = "drafts";
+            };
+
+            draft_model_name = lib.mkOption {
+              type = lib.types.nullOr lib.types.str;
+              default = null;
+              description = ''
+                An initial draft model to load.
+                Ensure the model is in the draft model directory.
+              '';
+              example = "Qwen3-0.6B-exl3";
+            };
+
+            draft_rope_scale = lib.mkOption {
+              type = lib.types.nullOr lib.types.number;
+              default = 1.0;
+              description = ''
+                Rope scale for draft models, same as compress_pos_emb.
+                Use if the draft model was trained on long context with rope.
+              '';
+              example = 4.0;
+            };
+
+            draft_rope_alpha = lib.mkOption {
+              type = lib.types.nullOr lib.types.number;
+              default = null;
+              description = ''
+                Rope alpha for draft models, same as alpha_value.
+                Leaving this null will either pull from the model or auto-calculate.
+              '';
+              example = 2.0;
+            };
+
+            draft_cache_mode = lib.mkOption {
+              type = lib.types.enum [
+                "FP16"
+                "Q8"
+                "Q6"
+                "Q4"
+              ];
+              default = "FP16";
+              description = ''
+                Cache mode for draft models to save VRAM.
+                Unlike the model's cache_mode, this does not accept a k_bits,v_bits pair.
+              '';
+              example = "Q8";
+            };
+
+            draft_gpu_split = lib.mkOption {
+              type = lib.types.listOf lib.types.number;
+              default = [ ];
+              description = ''
+                List of VRAM sizes to split between GPUs, in GB.
+                If this is empty, the draft model is autosplit.
+              '';
+              example = [
+                2
+                2
+              ];
+            };
+
+            draft_num_tokens = lib.mkOption {
+              type = lib.types.nullOr lib.types.ints.positive;
+              default = null;
+              description = ''
+                Number of tokens to draft per iteration (default: draft model default).
+                Recurrent (linear or sliding attention) models use more VRAM for longer drafts.
+                This overhead multiplies with the max batch size, so for models with long drafts
+                (e.g. DFlash with 15 tokens by default) shorter drafts may be preferable.
+              '';
+              example = 4;
+            };
+
+            dynamic_draft = lib.mkOption {
+              type = lib.types.bool;
+              default = false;
+              description = ''
+                Adjust number of draft tokens dynamically based on observed acceptance rates.
+                Ceiling is given by draft_num_tokens.
+              '';
+            };
+
+            ngram_match_min = lib.mkOption {
+              type = lib.types.ints.positive;
+              default = 2;
+              description = ''
+                Minimum match length for exllamav3 n-gram drafting.
+                Only used when draft_mode is "ngram".
+              '';
+              example = 3;
+            };
+          };
+
+          sampling = {
+            override_preset = lib.mkOption {
+              type = lib.types.nullOr lib.types.str;
+              default = null;
+              description = ''
+                Select a sampler override preset, found in the sampler-overrides folder.
+                This overrides default fallbacks for sampler values that are passed to the API.
+                NOTE: "safe_defaults" is noob friendly and provides fallbacks for frontends that
+                don't send sampling parameters. Leave this null for any advanced usage.
+              '';
+              example = "safe_defaults";
+            };
+          };
+
+          lora = {
+            lora_dir = lib.mkOption {
+              type = lib.types.str;
+              default = "loras";
+              description = "Directory to look for LoRAs. Relative to the state directory.";
+            };
+
+            loras = lib.mkOption {
+              type = lib.types.listOf (
+                lib.types.submodule {
+                  options = {
+                    name = lib.mkOption {
+                      type = lib.types.str;
+                      description = "Name of the LoRA directory inside lora_dir.";
+                    };
+
+                    scaling = lib.mkOption {
+                      type = lib.types.number;
+                      default = 1.0;
+                      description = "Scaling factor for this LoRA.";
+                    };
+                  };
+                }
+              );
+              default = [ ];
+              description = "List of LoRAs to load and associated scaling factors.";
+              example = [
+                {
+                  name = "lora1";
+                  scaling = 1.0;
+                }
+              ];
+            };
+          };
+
+          memory = {
+            sysmem_recurrent_cache = lib.mkOption {
+              type = lib.types.ints.unsigned;
+              default = 4096;
+              description = "Max size of recurrent cache in system memory, in MB.";
+              example = 8192;
+            };
+
+            sysmem_kv_cache = lib.mkOption {
+              type = lib.types.ints.unsigned;
+              default = 0;
+              description = "Size of system memory second-tier key/value cache, in MB.";
+              example = 4096;
+            };
+
+            cuda_malloc_async = lib.mkOption {
+              type = lib.types.bool;
+              default = true;
+              description = ''
+                Use the cudaMallocAsync backend in Torch.
+                Enabling this is generally preferable, but it may cause issues with certain
+                workloads. Try disabling it if you experience intermittent OoM errors. If false,
+                Torch will use the allocator defined by the system environment.
+              '';
+            };
+          };
+
         };
       };
     };
@@ -236,6 +681,14 @@ in
             services.tabbyapi.package = pkgs.pkgsCuda.tabbyapi;
         '';
       }
+      {
+        assertion = !(cfg.settings.model ? force_enable_thinking);
+        message = ''
+          services.tabbyapi.settings.model.force_enable_thinking is deprecated upstream.
+          Use template_vars_force instead:
+            services.tabbyapi.settings.model.template_vars_force.enable_thinking = true;
+        '';
+      }
     ];
     networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [
       cfg.settings.network.port
diff --git a/pkgs/applications/networking/instant-messengers/discord/linux.nix b/pkgs/applications/networking/instant-messengers/discord/linux.nix
index 52a3214577e4..cd61cd501e48 100644
--- a/pkgs/applications/networking/instant-messengers/discord/linux.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/linux.nix
@@ -6,6 +6,7 @@
   desktopName,
   self,
   autoPatchelfHook,
+  addDriverRunpath,
   fetchurl,
   makeDesktopItem,
   lib,
@@ -258,7 +259,8 @@ stdenv.mkDerivation (finalAttrs: {
         ''} \
         ${lib.strings.optionalString enableAutoscroll "--add-flags \"--enable-blink-features=MiddleClickAutoscroll\""} \
         --prefix XDG_DATA_DIRS : "${gtk3}/share/gsettings-schemas/${gtk3.name}/" \
-        --prefix LD_LIBRARY_PATH : ${finalAttrs.libPath}:$out/opt/${binaryName} \
+        --prefix LD_LIBRARY_PATH : ${finalAttrs.libPath}:$out/opt/${binaryName}:${addDriverRunpath.driverLink}/lib \
+        --suffix VK_ADD_DRIVER_FILES : "${addDriverRunpath.driverLink}/share/vulkan/icd.d" \
         ${lib.strings.optionalString disableUpdates "--run ${lib.getExe disableBreakingUpdates}"} \
         --run "${finalAttrs.stageModules} $out/opt/${binaryName}/modules" \
         --add-flags ${lib.escapeShellArg commandLineArgs}
diff --git a/pkgs/applications/networking/irc/weechat/default.nix b/pkgs/applications/networking/irc/weechat/default.nix
index 4c9bf0bd6b2b..73c8763b5de5 100644
--- a/pkgs/applications/networking/irc/weechat/default.nix
+++ b/pkgs/applications/networking/irc/weechat/default.nix
@@ -105,11 +105,11 @@ assert lib.all (p: p.enabled -> !(builtins.elem null p.buildInputs)) plugins;
 
 stdenv.mkDerivation rec {
   pname = "weechat";
-  version = "4.9.4";
+  version = "4.10.0";
 
   src = fetchurl {
     url = "https://weechat.org/files/src/weechat-${version}.tar.xz";
-    hash = "sha256-P8UDWfOjsljJ8DFIsC87nFkZRTXRtGXEgfuFp2wu0AU=";
+    hash = "sha256-w6fnxqVAHd6aRtAmT6RKowMsqYqoZBDEVNPeXGlQXFQ=";
   };
 
   # Why is this needed? https://github.com/weechat/weechat/issues/2031
diff --git a/pkgs/by-name/an/ani-cli/package.nix b/pkgs/by-name/an/ani-cli/package.nix
index 79b1d8bdab15..39c4f6303018 100644
--- a/pkgs/by-name/an/ani-cli/package.nix
+++ b/pkgs/by-name/an/ani-cli/package.nix
@@ -5,13 +5,12 @@
   lib,
   gnugrep,
   gnused,
-  curl,
+  curl-impersonate,
   catt,
   syncplay,
-  openssl,
   ffmpeg,
   fzf,
-  aria2,
+  yt-dlp,
   mpv,
   vlc,
   iina,
@@ -28,28 +27,30 @@ in
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "ani-cli";
-  version = "4.14";
+  version = "5.0";
 
   src = fetchFromGitHub {
     owner = "pystardust";
     repo = "ani-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-OyCKDN89sBz59+3JncMDyNOq8UMqqjara+A0Owo3oko=";
+    hash = "sha256-rRQESi0Skoyf1jy/dRRK6ooKRPQhkak107kk5ulwZYI=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
   runtimeInputs = [
-    openssl
     gnugrep
     gnused
-    curl
+    curl-impersonate
     fzf
     ffmpeg
-    aria2
+    yt-dlp
   ]
   ++ lib.optional chromecastSupport catt
   ++ lib.optional syncSupport syncplay;
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/by-name/au/audiobookshelf/package.nix b/pkgs/by-name/au/audiobookshelf/package.nix
index d3ca939b161a..0999eb5d8094 100644
--- a/pkgs/by-name/au/audiobookshelf/package.nix
+++ b/pkgs/by-name/au/audiobookshelf/package.nix
@@ -70,6 +70,8 @@ buildNpmPackage {
   npmInstallFlags = [ "--only-production" ];
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/opt/client
     cp -r index.js server package* node_modules $out/opt/
     cp -r ${client}/lib/node_modules/audiobookshelf-client/dist $out/opt/client/dist
@@ -79,6 +81,8 @@ buildNpmPackage {
     echo "  exec ${nodejs_22}/bin/node $out/opt/index.js" >> $out/bin/audiobookshelf
 
     chmod +x $out/bin/audiobookshelf
+
+    runHook postInstall
   '';
 
   passthru = {
diff --git a/pkgs/by-name/ge/gelly/package.nix b/pkgs/by-name/ge/gelly/package.nix
index 67a920bbc921..18206ca31d3b 100644
--- a/pkgs/by-name/ge/gelly/package.nix
+++ b/pkgs/by-name/ge/gelly/package.nix
@@ -19,16 +19,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "gelly";
-  version = "1.9.4";
+  version = "1.9.5";
 
   src = fetchFromGitHub {
     owner = "Fingel";
     repo = "gelly";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GYMLV4hffaIbqUp1b5ERo2QQqiKRlHe9oXfq+wNH/hM=";
+    hash = "sha256-k6LgXEK5xoVrjiXCkYnFgC7Hs7oz+v3Kz47CELPqN9Q=";
   };
 
-  cargoHash = "sha256-CsmcXlkOec/KJ59Ng7MyGsfjWQ80YyV6MztRFULmvDA=";
+  cargoHash = "sha256-RbOs5CEj3KRe6F1RJSGx97wBoQKSynx+iza929ipfjA=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/jo/jocalsend/package.nix b/pkgs/by-name/jo/jocalsend/package.nix
index ad86d22c6a19..bd997fa55d89 100644
--- a/pkgs/by-name/jo/jocalsend/package.nix
+++ b/pkgs/by-name/jo/jocalsend/package.nix
@@ -9,7 +9,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "jocalsend";
-  version = "1.618033988";
+  version = "1.6180339887";
 
   __structuredAttrs = true;
 
@@ -18,10 +18,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "nebkor";
     repo = "joecalsend";
     tag = finalAttrs.version;
-    hash = "sha256-nzsvVC1e8ENh0bpQwiogGew823NNmSNXN+VZZHfVFIY=";
+    hash = "sha256-sOgFOAJXX5mugjMfTICNrJHc/DRD5zdZsg/K4cbRjlQ=";
   };
 
-  cargoHash = "sha256-5V/a6rj08Ucu6S+SBukYQktWLVnnbXeoGan1oYTozHc=";
+  cargoHash = "sha256-UEzyy6SQ3ntJHeXivd6e8Xvr4aTdpfYrFMWqLjoBrJc=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/ma/matrix-continuwuity/0001-fix-backport-SEC10.patch b/pkgs/by-name/ma/matrix-continuwuity/0001-fix-backport-SEC10.patch
new file mode 100644
index 000000000000..042b4b12aaf2
--- /dev/null
+++ b/pkgs/by-name/ma/matrix-continuwuity/0001-fix-backport-SEC10.patch
@@ -0,0 +1,250 @@
+From d25c12c343b53ea90025c11808700ad6267f4e59 Mon Sep 17 00:00:00 2001
+From: timedout <git@nexy7574.co.uk>
+Date: Wed, 29 Jul 2026 16:38:05 +0100
+Subject: [PATCH] fix(backport): SEC10
+
+Reviewed-By: Ginger <ginger@gingershaped.computer>
+Co-Authored-By: Erwan Leboucher <erwanleboucher@gmail.com>
+
+(cherry picked from commit 71016a0d7f79289f3bf8d7816c1fec3c85c43153)
+---
+ src/api/client/sync/v5.rs | 133 +++++++++++++++++++++++++++++++-------
+ 1 file changed, 111 insertions(+), 22 deletions(-)
+
+diff --git a/src/api/client/sync/v5.rs b/src/api/client/sync/v5.rs
+index 183f3aaac..03a4c1972 100644
+--- a/src/api/client/sync/v5.rs
++++ b/src/api/client/sync/v5.rs
+@@ -1,6 +1,6 @@
+ use std::{
+ 	cmp::{self, Ordering},
+-	collections::{BTreeMap, BTreeSet, HashMap, HashSet, VecDeque},
++	collections::{BTreeMap, BTreeSet, HashMap, HashSet},
+ 	ops::Deref,
+ 	time::Duration,
+ };
+@@ -28,6 +28,7 @@
+ use ruma::{
+ 	DeviceId, OwnedEventId, OwnedRoomId, RoomId, UInt, UserId,
+ 	api::client::sync::sync_events::{self, DeviceLists, UnreadNotificationsCount},
++	assign,
+ 	directory::RoomTypeFilter,
+ 	events::{
+ 		AnyRawAccountDataEvent, AnySyncEphemeralRoomEvent, AnySyncStateEvent, StateEventType,
+@@ -139,6 +140,13 @@ pub(crate) async fn sync_events_v5_route(
+ 	let (all_joined_rooms, all_invited_rooms, all_knocked_rooms) =
+ 		join3(all_joined_rooms, all_invited_rooms, all_knocked_rooms).await;
+ 
++	let allowed_rooms: BTreeSet<OwnedRoomId> = all_joined_rooms
++		.iter()
++		.chain(all_invited_rooms.iter())
++		.chain(all_knocked_rooms.iter())
++		.cloned()
++		.collect();
++
+ 	let all_joined_rooms = all_joined_rooms.iter().map(AsRef::as_ref);
+ 	let all_invited_rooms = all_invited_rooms.iter().map(AsRef::as_ref);
+ 	let all_knocked_rooms = all_knocked_rooms.iter().map(AsRef::as_ref);
+@@ -192,13 +200,14 @@ pub(crate) async fn sync_events_v5_route(
+ 	)
+ 	.await;
+ 
+-	fetch_subscriptions(services, sync_info, &known_rooms, &mut todo_rooms).await;
++	fetch_subscriptions(services, sync_info, &known_rooms, &allowed_rooms, &mut todo_rooms).await;
+ 
+ 	response.rooms = process_rooms(
+ 		services,
+ 		sender_user,
+ 		next_batch,
+ 		all_invited_rooms.clone(),
++		all_knocked_rooms.clone(),
+ 		&todo_rooms,
+ 		&mut response,
+ 		&body,
+@@ -208,6 +217,7 @@ pub(crate) async fn sync_events_v5_route(
+ 	if response.rooms.iter().all(|(id, r)| {
+ 		r.timeline.is_empty()
+ 			&& r.required_state.is_empty()
++			&& r.invite_state.is_none()
+ 			&& !response.extensions.receipts.rooms.contains_key(id)
+ 	}) && response
+ 		.extensions
+@@ -238,10 +248,17 @@ async fn fetch_subscriptions(
+ 	services: &Services,
+ 	(sender_user, sender_device, globalsince, body): SyncInfo<'_>,
+ 	known_rooms: &KnownRooms,
++	allowed_rooms: &BTreeSet<OwnedRoomId>,
+ 	todo_rooms: &mut TodoRooms,
+ ) {
+ 	let mut known_subscription_rooms = BTreeSet::new();
+ 	for (room_id, room) in &body.room_subscriptions {
++		// Silently ignore subscriptions to rooms the user is not a member of
++		// (joined or invited).
++		if !allowed_rooms.contains(room_id) {
++			continue;
++		}
++
+ 		let not_exists = services.rooms.metadata.exists(room_id).eq(&false);
+ 
+ 		let is_disabled = services.rooms.metadata.is_disabled(room_id);
+@@ -399,11 +416,13 @@ async fn handle_lists<'a, Rooms, AllRooms>(
+ 	BTreeMap::default()
+ }
+ 
++#[allow(clippy::too_many_arguments)]
+ async fn process_rooms<'a, Rooms>(
+ 	services: &Services,
+ 	sender_user: &UserId,
+ 	next_batch: u64,
+ 	all_invited_rooms: Rooms,
++	all_knocked_rooms: Rooms,
+ 	todo_rooms: &TodoRooms,
+ 	response: &mut sync_events::v5::Response,
+ 	body: &sync_events::v5::Request,
+@@ -416,38 +435,99 @@ async fn process_rooms<'a, Rooms>(
+ 		let roomsincecount = PduCount::Normal(*roomsince);
+ 
+ 		let mut timestamp: Option<_> = None;
+-		let mut invite_state = None;
+ 		let (timeline_pdus, limited);
+ 		let new_room_id: &RoomId = (*room_id).as_ref();
+ 		if all_invited_rooms.clone().any(is_equal_to!(new_room_id)) {
++			let Ok(invite_count) = services
++				.rooms
++				.state_cache
++				.get_invite_count(room_id, sender_user)
++				.await
++			else {
++				continue;
++			};
++
++			if *roomsince >= invite_count {
++				continue;
++			}
++
+ 			// TODO: figure out a timestamp we can use for remote invites
+-			invite_state = services
++			let invite_state = services
+ 				.rooms
+ 				.state_cache
+ 				.invite_state(sender_user, room_id)
+ 				.await
+ 				.ok();
+ 
+-			(timeline_pdus, limited) = (VecDeque::new(), true);
+-		} else {
+-			TimelinePdus { pdus: timeline_pdus, limited } = match load_timeline(
+-				services,
+-				sender_user,
+-				room_id,
+-				Some(roomsincecount),
+-				Some(PduCount::from(next_batch)),
+-				*timeline_limit,
+-			)
+-			.await
+-			{
+-				| Ok(value) => value,
+-				| Err(err) => {
+-					warn!("Encountered missing timeline in {}, error {}", room_id, err);
+-					continue;
+-				},
++			rooms.insert(room_id.clone(), sync_events::v5::response::Room {
++				initial: Some(roomsince == &0),
++				invite_state,
++				limited: true,
++				..Default::default()
++			});
++			continue;
++		}
++
++		if all_knocked_rooms.clone().any(is_equal_to!(new_room_id)) {
++			let Ok(knock_count) = services
++				.rooms
++				.state_cache
++				.get_knock_count(room_id, sender_user)
++				.await
++			else {
++				continue;
+ 			};
++
++			if *roomsince >= knock_count {
++				continue;
++			}
++
++			let Ok(knock_state) = services
++				.rooms
++				.state_cache
++				.knock_state(sender_user, room_id)
++				.await
++			else {
++				continue;
++			};
++
++			rooms.insert(
++				room_id.clone(),
++				assign!(sync_events::v5::response::Room::new(), {
++					initial: Some(roomsince == &0),
++					invite_state: Some(knock_state),
++					limited: true,
++				}),
++			);
++			continue;
++		}
++
++		if !services
++			.rooms
++			.state_cache
++			.is_joined(sender_user, room_id)
++			.await
++		{
++			continue;
+ 		}
+ 
++		TimelinePdus { pdus: timeline_pdus, limited } = match load_timeline(
++			services,
++			sender_user,
++			room_id,
++			Some(roomsincecount),
++			Some(PduCount::from(next_batch)),
++			*timeline_limit,
++		)
++		.await
++		{
++			| Ok(value) => value,
++			| Err(err) => {
++				warn!("Encountered missing timeline in {}, error {}", room_id, err);
++				continue;
++			},
++		};
++
+ 		if body.extensions.account_data.enabled == Some(true) {
+ 			response.extensions.account_data.rooms.insert(
+ 				room_id.to_owned(),
+@@ -627,7 +707,7 @@ async fn process_rooms<'a, Rooms>(
+ 			},
+ 			initial: Some(roomsince == &0),
+ 			is_dm: None,
+-			invite_state,
++			invite_state: None,
+ 			unread_notifications: UnreadNotificationsCount {
+ 				highlight_count: Some(
+ 					services
+@@ -753,6 +833,15 @@ async fn collect_typing_events(
+ 
+ 	let mut typing_response = sync_events::v5::response::Typing::default();
+ 	for (room_id, (_, _, roomsince)) in todo_rooms {
++		if !services
++			.rooms
++			.state_cache
++			.is_joined(sender_user, room_id)
++			.await
++		{
++			continue;
++		}
++
+ 		if services.rooms.typing.last_typing_update(room_id).await? <= *roomsince {
+ 			continue;
+ 		}
+-- 
+2.55.0
+
diff --git a/pkgs/by-name/ma/matrix-continuwuity/package.nix b/pkgs/by-name/ma/matrix-continuwuity/package.nix
index 57ee2cd74ca2..3ba5195b6a6d 100644
--- a/pkgs/by-name/ma/matrix-continuwuity/package.nix
+++ b/pkgs/by-name/ma/matrix-continuwuity/package.nix
@@ -50,6 +50,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoHash = "sha256-uvMiFURXxkLbbbwq4pG5hevsLZHQ1wVfTNvzQRTQWxE=";
 
+  patches = [
+    ./0001-fix-backport-SEC10.patch
+  ];
+
   nativeBuildInputs = [
     pkg-config
     rustPlatform.bindgenHook
diff --git a/pkgs/by-name/mo/moonfire-nvr/package.nix b/pkgs/by-name/mo/moonfire-nvr/package.nix
index 42a9e5e1db0e..7c8bbc2cbf8d 100644
--- a/pkgs/by-name/mo/moonfire-nvr/package.nix
+++ b/pkgs/by-name/mo/moonfire-nvr/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  stdenv,
+  callPackage,
   rustPlatform,
   fetchFromGitHub,
   pkg-config,
@@ -8,54 +8,26 @@
   sqlite,
   testers,
   moonfire-nvr,
-  nodejs,
-  pnpm_9,
-  fetchPnpmDeps,
-  pnpmConfigHook,
+  nix-update,
+  writeShellApplication,
 }:
 
-let
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "moonfire-nvr";
-  version = "0.7.20";
+  version = "0.7.31";
+
   src = fetchFromGitHub {
     owner = "scottlamb";
     repo = "moonfire-nvr";
-    tag = "v${version}";
-    hash = "sha256-0EaGqZUmYGxLHcJAhlbG2wZMDiVv8U1bcTQqMx0aTo0=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-QgsaiWcXeU4y7z9mcqUAl4mQ/M4p38yRjOB/4MKlpVA=";
   };
-  ui = stdenv.mkDerivation (finalAttrs: {
-    inherit version src;
-    pname = "${pname}-ui";
-    sourceRoot = "${src.name}/ui";
-    nativeBuildInputs = [
-      nodejs
-      pnpmConfigHook
-      pnpm_9
-    ];
-    pnpmDeps = fetchPnpmDeps {
-      inherit (finalAttrs) pname version src;
-      pnpm = pnpm_9;
-      sourceRoot = "${finalAttrs.src.name}/ui";
-      fetcherVersion = 3;
-      hash = "sha256-1bkuou8jfWqdev4ZlpqvC4BRrFj//LK6ImVvSeMUEuM=";
-    };
-    installPhase = ''
-      runHook preInstall
 
-      cp -r public $out
+  sourceRoot = "${finalAttrs.src.name}/server";
 
-      runHook postInstall
-    '';
-  });
-in
-rustPlatform.buildRustPackage {
-  inherit pname version src;
+  cargoHash = "sha256-TDFe5pD+8eSwvw0h9GLM+JfODlSBU1CO8fw4FVjy8xk=";
 
-  sourceRoot = "${src.name}/server";
-
-  cargoHash = "sha256-+L4XofUFvhJDPGv4fAGYXFNpuNd01k/P63LH2tXXHE0=";
-
-  env.VERSION = "v${version}";
+  env.VERSION = "v${finalAttrs.version}";
 
   nativeBuildInputs = [
     pkg-config
@@ -68,26 +40,40 @@ rustPlatform.buildRustPackage {
 
   postInstall = ''
     mkdir -p $out/lib
-    ln -s ${ui} $out/lib/ui
+    ln -s ${moonfire-nvr.ui} $out/lib/ui
   '';
 
   doCheck = false;
 
   passthru = {
-    inherit ui;
+    ui = callPackage ./ui.nix { };
     tests.version = testers.testVersion {
       package = moonfire-nvr;
       command = "moonfire-nvr --version";
-      version = "Version: v${version}";
+      version = "Version: v${finalAttrs.version}";
     };
+    updateScript = lib.getExe (writeShellApplication {
+      name = "update-moonfire-nvr";
+
+      runtimeInputs = [
+        nix-update
+      ];
+
+      text = ''
+        set -euo pipefail
+
+        nix-update moonfire-nvr
+        nix-update moonfire-nvr.ui --version=skip
+      '';
+    });
   };
 
   meta = {
     description = "Moonfire NVR, a security camera network video recorder";
     homepage = "https://github.com/scottlamb/moonfire-nvr";
-    changelog = "https://github.com/scottlamb/moonfire-nvr/releases/tag/v${version}";
+    changelog = "https://github.com/scottlamb/moonfire-nvr/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.gpl3Only;
     maintainers = [ ];
     mainProgram = "moonfire-nvr";
   };
-}
+})
diff --git a/pkgs/by-name/mo/moonfire-nvr/ui.nix b/pkgs/by-name/mo/moonfire-nvr/ui.nix
new file mode 100644
index 000000000000..b66bbf87a45a
--- /dev/null
+++ b/pkgs/by-name/mo/moonfire-nvr/ui.nix
@@ -0,0 +1,41 @@
+{
+  stdenv,
+  moonfire-nvr,
+  nodejs,
+  pnpmConfigHook,
+  pnpm_10,
+  fetchPnpmDeps,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "moonfire-nvr-ui";
+  inherit (moonfire-nvr) version src;
+
+  sourceRoot = "${finalAttrs.src.name}/ui";
+
+  nativeBuildInputs = [
+    nodejs
+    pnpmConfigHook
+    pnpm_10
+  ];
+
+  pnpmDeps = fetchPnpmDeps {
+    inherit (finalAttrs) pname version src;
+    pnpm = pnpm_10;
+    sourceRoot = "${finalAttrs.src.name}/ui";
+    fetcherVersion = 4;
+    hash = "sha256-U/SHOVlx0kj1hfl09KcPg3CQZX9HZE5SghVEThWL1RA=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    cp -r public $out
+
+    runHook postInstall
+  '';
+
+  meta = moonfire-nvr.meta // {
+    description = "Moonfire UI";
+  };
+})
diff --git a/pkgs/by-name/mp/mpv/scripts/videoclip.nix b/pkgs/by-name/mp/mpv/scripts/videoclip.nix
index 762bc7400eca..88f245f97540 100644
--- a/pkgs/by-name/mp/mpv/scripts/videoclip.nix
+++ b/pkgs/by-name/mp/mpv/scripts/videoclip.nix
@@ -1,38 +1,37 @@
 {
   lib,
-  fetchFromGitHub,
-  curl,
-  xclip,
-  wl-clipboard,
-  stdenv,
   buildLua,
-  unstableGitUpdater,
+  fetchFromGitHub,
+  gitUpdater,
+  stdenv,
+  curl,
+  wl-clipboard,
+  xclip,
 }:
-buildLua {
+buildLua (finalAttrs: {
   pname = "videoclip";
-  version = "0.2-unstable-2026-05-31";
+  version = "26.7.30.0";
 
   src = fetchFromGitHub {
     owner = "Ajatt-Tools";
     repo = "videoclip";
-    rev = "d9a3e0966b238b824b86767956eb44a11ac367c6";
-    hash = "sha256-NZaflGehxoIf9eY3/p9WrKXXQj3x6GDZ6iMLeu5BhPc=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-4ptnF3/L3U0CDucYcd8/O5EN1mUtnor+iXLRXbiC7os=";
   };
 
-  patchPhase = ''
-    substituteInPlace platform.lua \
-    --replace \'curl\' \'${lib.getExe curl}\' \
+  postPatch = ''
+    substituteInPlace videoclip/platform.lua \
+      --replace-fail "'curl'" "'${lib.getExe curl}'"
   ''
   + lib.optionalString stdenv.hostPlatform.isLinux ''
-    --replace xclip ${lib.getExe xclip} \
-    --replace wl-copy ${lib.getExe' wl-clipboard "wl-copy"}
+    substituteInPlace videoclip/platform.lua \
+      --replace-fail '"wl-copy' '"${lib.getExe' wl-clipboard "wl-copy"}' \
+      --replace-fail '"xclip' '"${lib.getExe xclip}'
   '';
 
-  scriptPath = ".";
-  passthru.scriptName = "videoclip";
-  passthru.updateScript = unstableGitUpdater {
-    tagPrefix = "v";
-  };
+  scriptPath = "videoclip";
+
+  passthru.updateScript = gitUpdater { rev-prefix = "v"; };
 
   meta = {
     description = "Easily create videoclips with mpv";
@@ -41,4 +40,4 @@ buildLua {
     platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [ BatteredBunny ];
   };
-}
+})
diff --git a/pkgs/by-name/op/opengist/package.nix b/pkgs/by-name/op/opengist/package.nix
index fe22f29e9708..b7a90e7cccdd 100644
--- a/pkgs/by-name/op/opengist/package.nix
+++ b/pkgs/by-name/op/opengist/package.nix
@@ -13,13 +13,13 @@
 buildGoModule (finalAttrs: {
   pname = "opengist";
 
-  version = "1.14.0";
+  version = "1.15.0";
 
   src = fetchFromGitHub {
     owner = "thomiceli";
     repo = "opengist";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-glKhgETje+TRmwnSWJ+fVla0hsyljZLnRKcM4xi+zQ8=";
+    hash = "sha256-yE9HvRFEQzv3Fhhbs9hXeLc4vudCMi+NMA2T8YUlREw=";
   };
 
   frontend = buildNpmPackage {
@@ -36,10 +36,10 @@ buildGoModule (finalAttrs: {
       cp -R public $out
     '';
 
-    npmDepsHash = "sha256-Zz6qoqTV/O73OrBL7ry1VXK9nF6Eb6QeqcefLpyMN1c=";
+    npmDepsHash = "sha256-hAG0vGjG+ejumjoslYs/UnYBImZDNsTQUDtssT0X/HI=";
   };
 
-  vendorHash = "sha256-J4JMOCj7S8N0kX7VBZmrAiPuXjWur+MIkS8pMVmkLbs=";
+  vendorHash = "sha256-YU1OdYM9GzUGHypgIhWvJCvYEzlKsaKGN0NZRBfT8FY=";
 
   tags = [ "fs_embed" ];
 
diff --git a/pkgs/by-name/pr/proxysql/btree-cstdint.patch b/pkgs/by-name/pr/proxysql/btree-cstdint.patch
new file mode 100644
index 000000000000..c5eae1c371d2
--- /dev/null
+++ b/pkgs/by-name/pr/proxysql/btree-cstdint.patch
@@ -0,0 +1,16 @@
+The vendored copy of Google's cpp-btree relies on <cstdint> being pulled in
+transitively.  libstdc++ 15 no longer does so, which makes uint8_t/uint16_t
+undeclared, and the resulting fallback to int trips the kNodeValues
+COMPILE_ASSERT with a "1 << 32" shift.
+
+diff --git a/include/btree.h b/include/btree.h
+--- a/include/btree.h
++++ b/include/btree.h
+@@ -104,6 +104,7 @@
+ #include <stddef.h>
+ #include <string.h>
+ #include <sys/types.h>
++#include <cstdint>
+ #include <algorithm>
+ #include <functional>
+ #include <iostream>
diff --git a/pkgs/by-name/pr/proxysql/makefiles.patch b/pkgs/by-name/pr/proxysql/makefiles.patch
index 17facc6744c1..bc47db822b4a 100644
--- a/pkgs/by-name/pr/proxysql/makefiles.patch
+++ b/pkgs/by-name/pr/proxysql/makefiles.patch
@@ -151,7 +151,7 @@ index 87d2a20e..505e069a 100644
  	cd mariadb-client-library && tar -zxf mariadb-connector-c-3.3.8-src.tar.gz
  	cd mariadb-client-library/mariadb_client && patch -p0 < ../plugin_auth_CMakeLists.txt.patch
 -	cd mariadb-client-library/mariadb_client && cmake . -Wno-dev -DCMAKE_BUILD_TYPE=RelWithDebInfo -DOPENSSL_ROOT_DIR=$(SSL_IDIR) -DOPENSSL_LIBRARIES=$(SSL_LDIR) -DICONV_LIBRARIES=$(brew --prefix libiconv)/lib -DICONV_INCLUDE=$(brew --prefix libiconv)/include .
-+	cd mariadb-client-library/mariadb_client && cmake . -Wno-dev -DCMAKE_POLICY_VERSION_MINIMUM=3.5 -DCMAKE_BUILD_TYPE=RelWithDebInfo -DOPENSSL_ROOT_DIR=$(SSL_IDIR) -DOPENSSL_LIBRARIES=$(SSL_LDIR) -DICONV_LIBRARIES=$(brew --prefix libiconv)/lib -DICONV_INCLUDE=$(brew --prefix libiconv)/include .
++	cd mariadb-client-library/mariadb_client && cmake . -Wno-dev -DCMAKE_POLICY_VERSION_MINIMUM=3.5 -DCMAKE_C_FLAGS=-std=gnu17 -DCMAKE_BUILD_TYPE=RelWithDebInfo -DOPENSSL_ROOT_DIR=$(SSL_IDIR) -DOPENSSL_LIBRARIES=$(SSL_LDIR) -DICONV_LIBRARIES=$(brew --prefix libiconv)/lib -DICONV_INCLUDE=$(brew --prefix libiconv)/include .
  ifeq ($(PROXYDEBUG),1)
  	cd mariadb-client-library/mariadb_client && patch -p0 < ../ma_context.h.patch
  else ifeq ($(USEVALGRIND),1)
diff --git a/pkgs/by-name/pr/proxysql/package.nix b/pkgs/by-name/pr/proxysql/package.nix
index 373a1bab4b58..e77800e80a42 100644
--- a/pkgs/by-name/pr/proxysql/package.nix
+++ b/pkgs/by-name/pr/proxysql/package.nix
@@ -49,6 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
   patches = [
     ./makefiles.patch
     ./dont-phone-home.patch
+    ./btree-cstdint.patch
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix b/pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix
index dbf0e89c1f3e..730d42925677 100644
--- a/pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix
+++ b/pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix
@@ -13,15 +13,15 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rust-analyzer-unwrapped";
-  version = "2026-04-27";
+  version = "2026-06-01";
 
-  cargoHash = "sha256-QXEJhBzKof1UONW2FwQUeO6UAo1Xfm2nPpOo1uNiRM8=";
+  cargoHash = "sha256-5njpo8AKVOSgCFwuqTL9sVODyjgsEfg5kHI3qM0DK9k=";
 
   src = fetchFromGitHub {
     owner = "rust-lang";
     repo = "rust-analyzer";
     rev = finalAttrs.version;
-    hash = "sha256-f8YJfwAOsLFpIoqZuX3yF69UvMLrkx7iVzMH1pJU7cM=";
+    hash = "sha256-yJIyzYb6LhvbVMmj2EH62Mt0JHU3pQefr+oPEgaoaI8=";
   };
 
   cargoBuildFlags = [
diff --git a/pkgs/by-name/si/sing-box/package.nix b/pkgs/by-name/si/sing-box/package.nix
index 467f0ae8be37..5cb755599cc6 100644
--- a/pkgs/by-name/si/sing-box/package.nix
+++ b/pkgs/by-name/si/sing-box/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "sing-box";
-  version = "1.13.15";
+  version = "1.13.16";
 
   src = fetchFromGitHub {
     owner = "SagerNet";
     repo = "sing-box";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YkbF5+smzP+AQ161xvTBO01ZIB3PonHVM0l5DVRSnFs=";
+    hash = "sha256-GAIU0SRvxU92E40zCkMsiSPuIEIUZM5vORN2u2XIhqs=";
   };
 
-  vendorHash = "sha256-HIMKtolVXbmyV1vmXXAt3O/2NTp4HwzhUWChs8I4+cs=";
+  vendorHash = "sha256-ZUEpYfgb/iflImVCdLIgUzfp4QY9ho1gYkIAJV1tXrg=";
 
   tags = [
     "with_gvisor"
diff --git a/pkgs/by-name/ta/tabbyapi/package.nix b/pkgs/by-name/ta/tabbyapi/package.nix
index 2ecf9cb6b700..e6eed91c61ff 100644
--- a/pkgs/by-name/ta/tabbyapi/package.nix
+++ b/pkgs/by-name/ta/tabbyapi/package.nix
@@ -7,14 +7,14 @@
 }:
 python3Packages.buildPythonApplication {
   pname = "tabbyapi";
-  version = "0-unstable-2026-07-18";
+  version = "0-unstable-2026-07-31";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "theroyallab";
     repo = "tabbyAPI";
-    rev = "0158fb48d76546a6475d1d63f6cd5b90932d1d11";
-    hash = "sha256-Bkpx3MyZg7Np5zXAsq8mgxdAFsHUZhy2NZ93XSLbJgk=";
+    rev = "29680f496b57e3ed1a496c580677d2d67ac729b8";
+    hash = "sha256-eB8Q4iVlNCrgHHWutuhxzD+bQfC5Yx3z2rSCCSFsrL4=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/up/uptime-kuma/package.nix b/pkgs/by-name/up/uptime-kuma/package.nix
index f4317ee785f6..b13caedcc4dc 100644
--- a/pkgs/by-name/up/uptime-kuma/package.nix
+++ b/pkgs/by-name/up/uptime-kuma/package.nix
@@ -9,16 +9,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "uptime-kuma";
-  version = "2.4.0";
+  version = "2.5.0";
 
   src = fetchFromGitHub {
     owner = "louislam";
     repo = "uptime-kuma";
     tag = finalAttrs.version;
-    hash = "sha256-iqkf9/UAQOnSA+nncK/fmjbqZpIQeUmigI/78m5qKrM=";
+    hash = "sha256-C9XBPhCQNU5y2C9svsieiC0FTMdW9sJQI2OeiCjqte8=";
   };
 
-  npmDepsHash = "sha256-chvykBfnARLto+Il9gumm6UTRSTPPBjg5pj4yGFiOcg=";
+  npmDepsHash = "sha256-qe8qK0bWYFyzClrMNAXdxuqrBIn14Xf3oN40ch1cqnY=";
 
   patches = [
     # Fixes the permissions of the database being not set correctly
diff --git a/pkgs/by-name/ve/vencord/fix-deps.patch b/pkgs/by-name/ve/vencord/fix-deps.patch
index 52f8f59e56aa..468b00e4097c 100644
--- a/pkgs/by-name/ve/vencord/fix-deps.patch
+++ b/pkgs/by-name/ve/vencord/fix-deps.patch
@@ -1,15 +1,15 @@
 diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
-index 92c50e4e..67a306eb 100644
+index ddf8750c..655c9a7d 100644
 --- a/pnpm-lock.yaml
 +++ b/pnpm-lock.yaml
-@@ -162,8 +162,8 @@ importers:
-         specifier: ^22.13.4
-         version: 22.13.13
+@@ -160,8 +160,8 @@ importers:
+         specifier: ^26.0.1
+         version: 26.0.1
        '@types/react':
 -        specifier: 18.3.1
 -        version: 18.3.1
-+        specifier: 19.0.12
-+        version: 19.0.12
++        specifier: 19.1.0
++        version: 19.1.0
        '@types/react-dom':
          specifier: 18.3.1
          version: 18.3.1
diff --git a/pkgs/by-name/ve/vencord/package.nix b/pkgs/by-name/ve/vencord/package.nix
index bb443fed5f0e..491797b1f3aa 100644
--- a/pkgs/by-name/ve/vencord/package.nix
+++ b/pkgs/by-name/ve/vencord/package.nix
@@ -6,7 +6,7 @@
   lib,
   nix-update,
   nodejs,
-  pnpm_10,
+  pnpm_11,
   fetchPnpmDeps,
   pnpmConfigHook,
   stdenv,
@@ -18,24 +18,24 @@
   buildWebExtension ? false,
 }:
 let
-  pnpm = pnpm_10;
+  pnpm = pnpm_11;
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "vencord";
-  version = "1.14.15";
+  version = "1.15.0";
 
   src = fetchFromGitHub {
     owner = "Vendicated";
     repo = "Vencord";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jQeLZa1rpKDkzWSpAqOa8snGRKLpv9xf9cwJ6hUwMzA=";
+    hash = "sha256-z3EY/nc9pHPjuMteY8ubYM3sqgjASznEG6B1U4mNCU4=";
   };
 
   patches = [ ./fix-deps.patch ];
 
   postPatch = ''
     substituteInPlace packages/vencord-types/package.json \
-      --replace-fail '"@types/react": "18.3.1"' '"@types/react": "19.0.12"'
+      --replace-fail '"@types/react": "18.3.1"' '"@types/react": "19.1.0"'
   '';
 
   pnpmDeps = fetchPnpmDeps {
@@ -47,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
       ;
     inherit pnpm;
     fetcherVersion = 4;
-    hash = "sha256-pm5f6bGm07pzNCqpDHRyKFnuX2ZTE5w9BtJu5xXPHiI=";
+    hash = "sha256-JmTSfUVHsMG0TcOwXkZWinRxpONZagtwKzESd8Q4LlQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/zs/zsh-patina/package.nix b/pkgs/by-name/zs/zsh-patina/package.nix
index 21c42b1b3950..adf853372dda 100644
--- a/pkgs/by-name/zs/zsh-patina/package.nix
+++ b/pkgs/by-name/zs/zsh-patina/package.nix
@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zsh-patina";
-  version = "1.7.0";
+  version = "1.9.0";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "michel-kraemer";
     repo = "zsh-patina";
     tag = finalAttrs.version;
-    hash = "sha256-sPlIT3UHtq+5+bpfrSPPfVXTdmqjEq+6k9tPShhG7h0=";
+    hash = "sha256-WVlv+bYFTQ3RG3m2NnG13kMoslXzcPr8CpFWwAOcNBA=";
   };
 
-  cargoHash = "sha256-j2MwEwQhSCUCwANAxr0aZjJ9iS0cGzRRttfK8LONEpg=";
+  cargoHash = "sha256-A946sab9GDBdoNAWH7AN10lEhHNnHnCnNzQgnEcQ8QI=";
 
   nativeBuildInputs = [ installShellFiles ];
   postInstall = ''
diff --git a/pkgs/development/compilers/llvm/default.nix b/pkgs/development/compilers/llvm/default.nix
index 28742b65cd72..b6cdcc547344 100644
--- a/pkgs/development/compilers/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/default.nix
@@ -27,10 +27,18 @@ let
     "20.1.8".officialRelease.sha256 = "sha256-ysyB/EYxi2qE9fD5x/F2zI4vjn8UDoo1Z9ukiIrjFGw=";
     "21.1.8".officialRelease.sha256 = "sha256-pgd8g9Yfvp7abjCCKSmIn1smAROjqtfZaJkaUkBSKW0=";
     "22.1.5".officialRelease.sha256 = "sha256-eunfMOH+HVpefZJ+CG7hXDoM+pi6iYvHpD3DoSAsjoE=";
-    "23.0.0-git".gitRelease = {
-      rev = "7d24dfa5f29e1794e452aadaa27f994f15568763";
-      rev-version = "23.0.0-unstable-2026-07-12";
-      sha256 = "sha256-mHiwOqEvqXyG6OoiVLRrhzb2MK7FqjQm9ez329ngbYw=";
+    "23.1.0-rc1" = {
+      gitRelease = {
+        rev = "acdf320b78fcf075ddcf660b51cf18d5c0af755b";
+        rev-version = "23.1.0-rc1";
+        sha256 = "sha256-kSfy7IRgF/2HX5Fr3OS5LTXx7xm/iUx7tWb27e4wO+s=";
+      };
+      name = "23";
+    };
+    "24.0.0-git".gitRelease = {
+      rev = "43a704b657423a0eead02e64911b413c4afca73f";
+      rev-version = "24.0.0-unstable-2026-07-26";
+      sha256 = "sha256-wXhYrz3g5F7iwVqgIVryfRtkQ+3lKIKRDd9D8X18dEE=";
     };
   }
   // llvmVersions;
diff --git a/pkgs/development/python-modules/exllamav3/default.nix b/pkgs/development/python-modules/exllamav3/default.nix
index c339bd7165e1..86cd146e35ee 100644
--- a/pkgs/development/python-modules/exllamav3/default.nix
+++ b/pkgs/development/python-modules/exllamav3/default.nix
@@ -27,14 +27,14 @@ let
 in
 buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
   pname = "exllamav3";
-  version = "1.2.1";
+  version = "1.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "turboderp-org";
     repo = "exllamav3";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ErsCtCM/T1YuCQAwrKhc860ETLgiS5Qu4nrQSuEzsPk=";
+    hash = "sha256-pWdh5fiGZEkdSLXvI5DAEdj6XmBFquzew57L1YIsEg8=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/general-sam/default.nix b/pkgs/development/python-modules/general-sam/default.nix
index 9611dfaf988d..d92bc3943beb 100644
--- a/pkgs/development/python-modules/general-sam/default.nix
+++ b/pkgs/development/python-modules/general-sam/default.nix
@@ -10,19 +10,19 @@
 
 buildPythonPackage rec {
   pname = "general-sam";
-  version = "1.0.3";
+  version = "1.0.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ModelTC";
     repo = "general-sam-py";
     rev = "v${version}";
-    hash = "sha256-++6Z9Ocee4QFN1u0nK/g9uGdmB1UYnfHhhJj74zboCE=";
+    hash = "sha256-/hfq14oFNPhPrhjlIDCyjMfdCuhMdKZ5DBc/nlEQKno=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-8HHIM1Abz5KxnVphFFNJp6L3D6iPeoB7qVmxy11CUZs=";
+    hash = "sha256-8uUCe/isN1qos8cBml16NOzUYHfr94G/GzllQt/5vWg=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/gradio/client.nix b/pkgs/development/python-modules/gradio/client.nix
index ce360b14f476..e965ae5094b3 100644
--- a/pkgs/development/python-modules/gradio/client.nix
+++ b/pkgs/development/python-modules/gradio/client.nix
@@ -31,7 +31,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "gradio-client";
-  version = "2.5.0";
+  version = "2.6.0";
   pyproject = true;
 
   # no tests on pypi
@@ -134,6 +134,7 @@ buildPythonPackage (finalAttrs: {
       disabledTests = [ ];
       pythonImportsCheck = null;
       dontCheckRuntimeDeps = true;
+      dontCheckPythonMetadata = true; # broken due to changed pname
     });
 
     inherit (gradio) updateScript;
diff --git a/pkgs/development/python-modules/gradio/default.nix b/pkgs/development/python-modules/gradio/default.nix
index 7e11791b068b..f80dc78be301 100644
--- a/pkgs/development/python-modules/gradio/default.nix
+++ b/pkgs/development/python-modules/gradio/default.nix
@@ -49,6 +49,7 @@
   typer,
   typing-extensions,
   uvicorn,
+  urllib3,
 
   # oauth
   authlib,
@@ -81,7 +82,7 @@ let
 in
 buildPythonPackage (finalAttrs: {
   pname = "gradio";
-  version = "6.20.0"; # please always backport gradio changes
+  version = "6.22.0"; # please always backport gradio changes
   pyproject = true;
   __structuredAttrs = true;
 
@@ -89,7 +90,7 @@ buildPythonPackage (finalAttrs: {
     owner = "gradio-app";
     repo = "gradio";
     tag = "gradio@${finalAttrs.version}";
-    hash = "sha256-q5OoMguG/f0A3c6X+zotafc3kRRuebxMBPUIlrlcNFI=";
+    hash = "sha256-9FcGnZ/yktKM8sTGpgTv3QLIe2IoGbSw10rLWgj1zSU=";
   };
 
   patches = [
@@ -106,7 +107,7 @@ buildPythonPackage (finalAttrs: {
     inherit (finalAttrs) version src;
     inherit pnpm;
     fetcherVersion = 4;
-    hash = "sha256-xCxr/jnp9emeB6THGt4cumvApw6fSZQwG2NGOcvR0yQ=";
+    hash = "sha256-TX4sLAfka/j002OsUKqxqi5B6Fb+DXSGdeL+w6V9XuM=";
   };
 
   env = {
@@ -157,6 +158,7 @@ buildPythonPackage (finalAttrs: {
     typer
     typing-extensions
     uvicorn
+    urllib3
   ]
   ++ lib.optionals (pythonAtLeast "3.13") [
     audioop-lts
@@ -196,6 +198,10 @@ buildPythonPackage (finalAttrs: {
   ++ finalAttrs.passthru.optional-dependencies.oauth
   ++ pydantic.optional-dependencies.email;
 
+  pythonRelaxDeps = [
+    "tomlkit" # pre-emptive upper bound
+  ];
+
   preBuild = ''
     pnpm build
     pnpm package
@@ -440,6 +446,7 @@ buildPythonPackage (finalAttrs: {
           '';
           pythonImportsCheck = null;
           dontCheckRuntimeDeps = true;
+          dontCheckPythonMetadata = true; # broken due to changed pname
         });
 
     # We can't use gitUpdater, because we need to update the pnpm hash.
diff --git a/pkgs/development/python-modules/huggingface-hub/default.nix b/pkgs/development/python-modules/huggingface-hub/default.nix
index 0d9992fe679c..9edd32ac8c5d 100644
--- a/pkgs/development/python-modules/huggingface-hub/default.nix
+++ b/pkgs/development/python-modules/huggingface-hub/default.nix
@@ -28,6 +28,10 @@
   # gradio
   gradio,
   requests,
+  # oauth
+  authlib,
+  fastapi,
+  itsdangerous,
   # mcp
   mcp,
 
@@ -37,14 +41,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "huggingface-hub";
-  version = "1.10.2";
+  version = "1.16.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "huggingface";
     repo = "huggingface_hub";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Q9N0QnxV8oJcxUsJzv4wX8Z6FkNdEfUH5BEVoZolsRY=";
+    hash = "sha256-GuTsoz7ow3A/PJyU3L/xLp56r3RVx5O1YH3nr3T4u7U=";
   };
 
   build-system = [ setuptools ];
@@ -65,11 +69,6 @@ buildPythonPackage (finalAttrs: {
     all = [
 
     ];
-    torch = [
-      torch
-      safetensors
-    ]
-    ++ safetensors.optional-dependencies.torch;
     fastai = [
       toml
       fastai
@@ -85,6 +84,17 @@ buildPythonPackage (finalAttrs: {
     mcp = [
       mcp
     ];
+    oauth = [
+      authlib
+      fastapi
+      httpx
+      itsdangerous
+    ];
+    torch = [
+      torch
+      safetensors
+    ]
+    ++ safetensors.optional-dependencies.torch;
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/web/nodejs/v26.nix b/pkgs/development/web/nodejs/v26.nix
index 86e135291d37..785b403d240a 100644
--- a/pkgs/development/web/nodejs/v26.nix
+++ b/pkgs/development/web/nodejs/v26.nix
@@ -23,8 +23,8 @@ let
       [ ];
 in
 buildNodejs {
-  version = "26.5.1";
-  sha256 = "df7770a9a99346f8b73ba6d31ad89bd6f868b51c7387c3627dcb44ca065f4948";
+  version = "26.6.0";
+  sha256 = "ecb6eec812505c9292529087a2436ec6c891ffe0e3a897833416e5d7436d659f";
   patches =
     (lib.optional (!(stdenv.hostPlatform.emulatorAvailable buildPackages)) (fetchpatch2 {
       url = "https://raw.githubusercontent.com/buildroot/buildroot/2f0c31bffdb59fb224387e35134a6d5e09a81d57/package/nodejs/nodejs-src/0003-include-obj-name-in-shared-intermediate.patch";
diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index 5b5628d19405..c64a7ce1fd44 100644
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -15,14 +15,14 @@ let
   variants = {
     # ./update-xanmod.sh lts
     lts = {
-      version = "6.18.41";
-      hash = "sha256-nGDN+qkTNaUVgV+aFOvEtwkDaK7uqpjvXgENpkviDFg=";
+      version = "6.18.42";
+      hash = "sha256-yDtXLGdFM4rg8mtxUJbUvCvjs2dvFiSGuCV7seKlWqM=";
       isLTS = true;
     };
     # ./update-xanmod.sh main
     main = {
-      version = "7.1.5";
-      hash = "sha256-zELqn/UieXjOBkTNTLi2OCkK4+rpD/IfJEDb7GTTJfk=";
+      version = "7.1.6";
+      hash = "sha256-H+dNmTMCWfJm792HR6lz1wVUD70pyZpn5HlTUXwsnLI=";
     };
   };
 
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index c9602d0e5872..400a5d5a3cdd 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -18,7 +18,7 @@ in
 buildLinux (
   args
   // rec {
-    version = "7.1.4";
+    version = "7.1.5";
     pname = "linux-zen";
     modDirVersion = lib.versions.pad 3 "${version}-${suffix}";
     isZen = true;
@@ -27,7 +27,7 @@ buildLinux (
       owner = "zen-kernel";
       repo = "zen-kernel";
       rev = "v${version}-${suffix}";
-      sha256 = "1k27xhzd390krk60kay6cabl0jlpb26m6cwvdh3r8izbwgx1r0ig";
+      sha256 = "11d3c2hx2py6fy6qj0dqk2w392m144wjrfg5ldfh93x9mp4ffhjd";
     };
 
     # This is based on the following source:
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 863622227bc4..90a14da2bef3 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4179,6 +4179,8 @@ with pkgs;
       bolt_22 = llvmPackages_22.bolt;
       flang_22 = llvmPackages_22.flang;
 
+      llvmPackages_23 = llvmPackagesSet."23";
+
       mkLLVMPackages = llvmPackagesSet.mkPackage;
     })
     llvmPackages_18
@@ -4213,6 +4215,7 @@ with pkgs;
     llvm_22
     bolt_22
     flang_22
+    llvmPackages_23
     mkLLVMPackages
     ;