diff --git a/doc/languages-frameworks/javascript.section.md b/doc/languages-frameworks/javascript.section.md
index 9a17aa255998..8fd33230573a 100644
--- a/doc/languages-frameworks/javascript.section.md
+++ b/doc/languages-frameworks/javascript.section.md
@@ -562,6 +562,29 @@ stdenv.mkDerivation (finalAttrs: {
 })
 ```
 
+##### `fetchYarnDeps` arguments {#javascript-fetchyarndeps}
+
+`fetchYarnDeps` accepts the following arguments:
+
+- `yarnLock`: Path to the `yarn.lock` file to fetch dependencies for.
+- `hash` (or `sha256`): The output hash of the offline cache.
+- `mirrorUrl`: Optional registry mirror URL used in place of the default yarn
+  registry (`https://registry.yarnpkg.com/`). When set, any resolved URL
+  pointing at the default registry is rewritten to use this mirror before
+  downloading. This is useful for pointing at a local or internal registry
+  mirror. Note that changing the mirror does not change the output hash, since
+  the downloaded contents are identical.
+
+```nix
+{
+  yarnOfflineCache = fetchYarnDeps {
+    yarnLock = finalAttrs.src + "/yarn.lock";
+    mirrorUrl = "https://registry.npmmirror.com/";
+    hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+  };
+}
+```
+
 ##### `yarnConfigHook` arguments {#javascript-yarnconfighook}
 
 By default, `yarnConfigHook` relies upon the attribute `${yarnOfflineCache}` (or `${offlineCache}` if the former is not set) to find the location of the offline cache produced by `fetchYarnDeps`. To disable this phase, you can set `dontYarnInstallDeps = true` or override the `configurePhase`.
diff --git a/doc/redirects.json b/doc/redirects.json
index 23197cbdaee7..c247c05dcd9b 100644
--- a/doc/redirects.json
+++ b/doc/redirects.json
@@ -3906,6 +3906,9 @@
   "javascript-yarn-v3-v4": [
     "index.html#javascript-yarn-v3-v4"
   ],
+  "javascript-fetchyarndeps": [
+    "index.html#javascript-fetchyarndeps"
+  ],
   "javascript-yarnconfighook": [
     "index.html#javascript-yarnconfighook"
   ],
diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index 1065a8b15387..acfb213b98e0 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -893,7 +893,6 @@ in
         # Upstream config: https://github.com/systemd/systemd/blob/main/src/run/systemd-run0.in
         setLoginUid = true;
         pamMount = false;
-        startSession = true;
       };
     };
 
diff --git a/nixos/tests/redis.nix b/nixos/tests/redis.nix
index f0f0e790b731..c0903f3837ff 100644
--- a/nixos/tests/redis.nix
+++ b/nixos/tests/redis.nix
@@ -4,12 +4,8 @@
   package,
   ...
 }:
-let
-  mkTestName =
-    pkg: "${pkg.pname}_${builtins.replaceStrings [ "." ] [ "" ] (lib.versions.majorMinor pkg.version)}";
-in
 {
-  name = mkTestName package;
+  name = package.pname;
   meta.maintainers = lib.teams.redis.members;
 
   nodes = {
diff --git a/pkgs/applications/graphics/gimp/default.nix b/pkgs/applications/graphics/gimp/default.nix
index 333a5328851a..1f1397c4ca76 100644
--- a/pkgs/applications/graphics/gimp/default.nix
+++ b/pkgs/applications/graphics/gimp/default.nix
@@ -83,7 +83,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gimp";
-  version = "3.2.4";
+  version = "3.2.6";
 
   outputs = [
     "out"
@@ -94,7 +94,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://download.gimp.org/gimp/v${lib.versions.majorMinor finalAttrs.version}/gimp-${finalAttrs.version}.tar.xz";
-    hash = "sha256-cxK8U+nG0tAFbKe5PxxrmHB5Rt2TT3FMIbh0bstgFYg=";
+    hash = "sha256-QLFekK0MDGMbdto8Rn6phH+lwk83QTrFtJKASGCijNg=";
   };
 
   patches = [
diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index 2cb44de16b16..3641623861a7 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -1,10 +1,10 @@
 {
   "chromium": {
-    "version": "153.0.8010.36",
+    "version": "153.0.8010.47",
     "chromedriver": {
-      "version": "153.0.8010.37",
-      "hash_darwin": "sha256-IMyEnUmK3slNB/QDZ+vtUyzHyU0AB+L6+BMbpCRluYA=",
-      "hash_darwin_aarch64": "sha256-cd1ZWatLQFIkPtCdVacrxFaFfj3rjG9qJ7kGlL3C6OA="
+      "version": "153.0.8010.48",
+      "hash_darwin": "sha256-/4yv3KWuvKNAro9oeK+PFsTOrg878yS11aDYSX5S890=",
+      "hash_darwin_aarch64": "sha256-5eO1WwJ8iQrXUjHb776Z1YahR/A8aCoX7JrJXQEcIQ8="
     },
     "deps": {
       "depot_tools": {
@@ -21,8 +21,8 @@
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "507c6ee3e2f3b2ca0e660547e5b9ea4820c67f4c",
-        "hash": "sha256-q29a3PWQ7wMG4/JL9EyCK7EaDCeG+4Q/ruemOvvgeZM=",
+        "rev": "73934a44f61e6b3878d1943064c141a5a820f5f7",
+        "hash": "sha256-D7Oqukze3CzYVWN9AQq9zN6HN2GcZ6b7ZSqhM5bjvUU=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -92,8 +92,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "fca5efdfeff5daf430bc4458375c8d6b7e457400",
-        "hash": "sha256-IoHQfdjZ6TV03VVzHZcxhPqGmNYNhKZrPG4BvQQfC7c="
+        "rev": "ed04c8113c6538f3e1264042da8cb4afd100369b",
+        "hash": "sha256-mZrVJ/P3tPoiSkGBH4fEjNAexLsjAzts8jjkCQZ4kOs="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -132,8 +132,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "225a7ba1bcb997d26de3e894e04fb341638e8c5a",
-        "hash": "sha256-/ic1j1gu2wl5wCLCESfEcsLAPU5Dmsx8oKFb6RhYzg4="
+        "rev": "28ffc61fc935c599677cff4dddfa4a12209ce500",
+        "hash": "sha256-6ySDyyQs/nfFF9AeoUY57GYDx7V8b0GQ17PCwQkzZVk="
       },
       "src/third_party/dawn/third_party/glfw3/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -632,8 +632,8 @@
       },
       "src/third_party/pthreadpool/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/pthreadpool.git",
-        "rev": "02460584c6092e527c8b89f7df4de143d70e801f",
-        "hash": "sha256-4EHJzZT+Gbhs8SkOhjSvDIPEqIQU93oJmtF3c/T+qjw="
+        "rev": "15a6644ba1c45f1acc16ac1e883efc3e56c6bed2",
+        "hash": "sha256-YJD9n8cxoqTrTQJHKuZFW2qnlNcNmh5rQlBpnlF46to="
       },
       "src/third_party/pyelftools": {
         "url": "https://chromium.googlesource.com/chromiumos/third_party/pyelftools.git",
@@ -672,8 +672,8 @@
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "4f574af2444846ceca4d277a8095c5d4229d175f",
-        "hash": "sha256-HrpA4labNWXPWj/yiS9O8KjdQPwJOllmR5r66TwCjB0="
+        "rev": "fca11a08da7c1ed3777b40b31611961c85c63c43",
+        "hash": "sha256-iQNNgvRVUuyAcSVE+pNJWrWz0NJd/MZLxd9vbYztong="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -842,8 +842,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "f343157cebb388bfa416baccb5d35507e6fe8cc7",
-        "hash": "sha256-zSCyFQpDMNygmV6N4TajL8VB5+VRynrMPV/wAiWsJO4="
+        "rev": "6b96683d44174e78ff4e65cb274bad56dc108231",
+        "hash": "sha256-Oa1wzIbWVPX0x7adJVPUxQocK5gofG0vE56QTg0XKCs="
       },
       "src/agents/shared": {
         "url": "https://chromium.googlesource.com/chromium/agents.git",
@@ -853,7 +853,7 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "153.0.8010.36",
+    "version": "153.0.8010.47",
     "deps": {
       "depot_tools": {
         "rev": "6411ed52842756261c66b6b8ece6b53ade2570f1",
@@ -865,16 +865,16 @@
         "hash": "sha256-qvQ13Ws2tb4i2Hdu34kBHivYPAn8w06zjLdQgK4BIJg="
       },
       "ungoogled-patches": {
-        "rev": "153.0.8010.36-1",
-        "hash": "sha256-JyvizS0oJC8J6VhtnpTKUGVbc31KCvTvwa4TmO+CHaY="
+        "rev": "153.0.8010.47-1",
+        "hash": "sha256-J/IiNmqJzL35TfiGbsqrXnI8lUizCWuxzVBHgo7cG80="
       },
       "npmHash": "sha256-pF0JtwFpPC4/fodbhSJnQKkczA9WlDg4VqEAy9aDVLg="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "507c6ee3e2f3b2ca0e660547e5b9ea4820c67f4c",
-        "hash": "sha256-q29a3PWQ7wMG4/JL9EyCK7EaDCeG+4Q/ruemOvvgeZM=",
+        "rev": "73934a44f61e6b3878d1943064c141a5a820f5f7",
+        "hash": "sha256-D7Oqukze3CzYVWN9AQq9zN6HN2GcZ6b7ZSqhM5bjvUU=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -944,8 +944,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "fca5efdfeff5daf430bc4458375c8d6b7e457400",
-        "hash": "sha256-IoHQfdjZ6TV03VVzHZcxhPqGmNYNhKZrPG4BvQQfC7c="
+        "rev": "ed04c8113c6538f3e1264042da8cb4afd100369b",
+        "hash": "sha256-mZrVJ/P3tPoiSkGBH4fEjNAexLsjAzts8jjkCQZ4kOs="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -984,8 +984,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "225a7ba1bcb997d26de3e894e04fb341638e8c5a",
-        "hash": "sha256-/ic1j1gu2wl5wCLCESfEcsLAPU5Dmsx8oKFb6RhYzg4="
+        "rev": "28ffc61fc935c599677cff4dddfa4a12209ce500",
+        "hash": "sha256-6ySDyyQs/nfFF9AeoUY57GYDx7V8b0GQ17PCwQkzZVk="
       },
       "src/third_party/dawn/third_party/glfw3/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -1484,8 +1484,8 @@
       },
       "src/third_party/pthreadpool/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/pthreadpool.git",
-        "rev": "02460584c6092e527c8b89f7df4de143d70e801f",
-        "hash": "sha256-4EHJzZT+Gbhs8SkOhjSvDIPEqIQU93oJmtF3c/T+qjw="
+        "rev": "15a6644ba1c45f1acc16ac1e883efc3e56c6bed2",
+        "hash": "sha256-YJD9n8cxoqTrTQJHKuZFW2qnlNcNmh5rQlBpnlF46to="
       },
       "src/third_party/pyelftools": {
         "url": "https://chromium.googlesource.com/chromiumos/third_party/pyelftools.git",
@@ -1524,8 +1524,8 @@
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "4f574af2444846ceca4d277a8095c5d4229d175f",
-        "hash": "sha256-HrpA4labNWXPWj/yiS9O8KjdQPwJOllmR5r66TwCjB0="
+        "rev": "fca11a08da7c1ed3777b40b31611961c85c63c43",
+        "hash": "sha256-iQNNgvRVUuyAcSVE+pNJWrWz0NJd/MZLxd9vbYztong="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -1694,8 +1694,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "f343157cebb388bfa416baccb5d35507e6fe8cc7",
-        "hash": "sha256-zSCyFQpDMNygmV6N4TajL8VB5+VRynrMPV/wAiWsJO4="
+        "rev": "6b96683d44174e78ff4e65cb274bad56dc108231",
+        "hash": "sha256-Oa1wzIbWVPX0x7adJVPUxQocK5gofG0vE56QTg0XKCs="
       },
       "src/agents/shared": {
         "url": "https://chromium.googlesource.com/chromium/agents.git",
diff --git a/pkgs/build-support/node/fetch-yarn-deps/default.nix b/pkgs/build-support/node/fetch-yarn-deps/default.nix
index e0c790e1c874..bb91d1d54ccc 100644
--- a/pkgs/build-support/node/fetch-yarn-deps/default.nix
+++ b/pkgs/build-support/node/fetch-yarn-deps/default.nix
@@ -104,6 +104,7 @@ in
           src ? null,
           hash ? "",
           sha256 ? "",
+          mirrorUrl ? null,
           ...
         }@args:
         let
@@ -148,7 +149,9 @@ in
 
               yarnLock=''${yarnLock:=$PWD/yarn.lock}
               mkdir -p $out
-              (cd $out; prefetch-yarn-deps --verbose --builder $yarnLock)
+              (cd $out; prefetch-yarn-deps --verbose --builder $yarnLock ${
+                lib.optionalString (mirrorUrl != null) "--mirrorUrl ${lib.escapeShellArg mirrorUrl}"
+              })
 
               runHook postBuild
             '';
@@ -161,6 +164,7 @@ in
               "name"
               "hash"
               "sha256"
+              "mirrorUrl"
             ]
             ++ (lib.optional (src == null) "src")
           ))
diff --git a/pkgs/build-support/node/fetch-yarn-deps/index.js b/pkgs/build-support/node/fetch-yarn-deps/index.js
index 1799fbc71d68..4b0fca4d37b3 100755
--- a/pkgs/build-support/node/fetch-yarn-deps/index.js
+++ b/pkgs/build-support/node/fetch-yarn-deps/index.js
@@ -21,15 +21,27 @@ const exec = async (...args) => {
   return res
 }
 
-const downloadFileHttps = (fileName, url, expectedHash, verbose, hashType = 'sha1') => {
+const yarnRegistryUrl = 'https://registry.yarnpkg.com/';
+
+function ensureTrailingSlash(str) {
+  return str.endsWith('/') ? str : str + '/';
+}
+
+const downloadFileHttps = (fileName, url, expectedHash, verbose, hashType = 'sha1', mirrorRegistryUrl = null) => {
+
+  const registryUrl =
+    mirrorRegistryUrl && url.startsWith(yarnRegistryUrl)
+      ? url.replace(yarnRegistryUrl, ensureTrailingSlash(mirrorRegistryUrl))
+      : url;
+
   return new Promise((resolve, reject) => {
-    const get = (url, redirects = 0) => https.get(url, (res) => {
+    const get = (registryUrl, redirects = 0) => https.get(registryUrl, (res) => {
       if(redirects > 10) {
         reject('Too many redirects!');
         return;
       }
       if(res.statusCode === 301 || res.statusCode === 302) {
-        const location = new URL(res.headers.location, url);
+        const location = new URL(res.headers.location, registryUrl);
         if (verbose) console.log('following redirect to ' + location);
         return get(location, redirects + 1);
       }
@@ -41,13 +53,13 @@ const downloadFileHttps = (fileName, url, expectedHash, verbose, hashType = 'sha
         file.close()
         const h = hash.read()
         if (expectedHash === undefined){
-          console.log(`Warning: lockfile url ${url} doesn't end in "#<hash>" to validate against. Downloaded file had hash ${h}.`);
-        } else if (h != expectedHash) return reject(new Error(`hash mismatch, expected ${expectedHash}, got ${h} for ${url}`))
+          console.log(`Warning: lockfile url ${registryUrl} doesn't end in "#<hash>" to validate against. Downloaded file had hash ${h}.`);
+        } else if (h != expectedHash) return reject(new Error(`hash mismatch, expected ${expectedHash}, got ${h} for ${registryUrl}`))
         resolve()
       })
       res.on('error', e => reject(e))
     })
-    get(url)
+    get(registryUrl)
   })
 }
 
@@ -90,7 +102,7 @@ const isGitUrl = pattern => {
   return false
 }
 
-const downloadPkg = (pkg, verbose) => {
+const downloadPkg = (pkg, verbose, mirrorUrl = null) => {
   for (let marker of ['@file:', '@link:']) {
     const split = pkg.key.split(marker)
     if (split.length == 2) {
@@ -122,9 +134,9 @@ const downloadPkg = (pkg, verbose) => {
   } else if (url.startsWith('https://')) {
     if (typeof pkg.integrity === 'string' || pkg.integrity instanceof String) {
       const [ type, checksum ] = pkg.integrity.split('-')
-      return downloadFileHttps(fileName, url, Buffer.from(checksum, 'base64').toString('hex'), verbose, type)
+      return downloadFileHttps(fileName, url, Buffer.from(checksum, 'base64').toString('hex'), verbose, type, mirrorUrl)
     }
-    return downloadFileHttps(fileName, url, hash, verbose)
+    return downloadFileHttps(fileName, url, hash, verbose, 'sha1', mirrorUrl)
   } else if (url.startsWith('file:')) {
     console.warn(`ignoring unsupported file:path url "${url}"`)
   } else {
@@ -155,11 +167,11 @@ const uniqueBy = (arr, callback) => {
   return [...map.values()]
 }
 
-const prefetchYarnDeps = async (lockContents, verbose) => {
+const prefetchYarnDeps = async (lockContents, verbose, mirrorUrl) => {
   const lockData = lockfile.parse(lockContents)
   await performParallel(
     uniqueBy(Object.entries(lockData.object), ([_, value]) => value.resolved)
-    .map(([key, value]) => () => downloadPkg({ key, ...value }, verbose))
+    .map(([key, value]) => () => downloadPkg({ key, ...value }, verbose, mirrorUrl))
   )
   await fs.promises.writeFile('yarn.lock', lockContents)
   if (verbose) console.log('Done')
@@ -173,18 +185,23 @@ Options:
   -h --help         Show this help
   -v --verbose      Verbose output
   --builder         Only perform the download to current directory, then exit
+  --mirrorUrl <url> Use the given registry mirror URL in place of the default
+                    yarn registry (${yarnRegistryUrl})
 `)
   process.exit(1)
 }
 
 const main = async () => {
   const args = process.argv.slice(2)
-  let next, lockFile, verbose, isBuilder
+  let next, lockFile, verbose, isBuilder, mirrorUrl
   while (next = args.shift()) {
     if (next == '--builder') {
       isBuilder = true
     } else if (next == '--verbose' || next == '-v') {
       verbose = true
+    } else if (next == '--mirrorUrl') {
+      mirrorUrl = args.shift()
+      if (!mirrorUrl) showUsage()
     } else if (next == '--help' || next == '-h') {
       showUsage()
     } else if (!lockFile) {
@@ -201,13 +218,13 @@ const main = async () => {
   }
 
   if (isBuilder) {
-    await prefetchYarnDeps(lockContents, verbose)
+    await prefetchYarnDeps(lockContents, verbose, mirrorUrl)
   } else {
     const { stdout: tmpDir } = await exec('mktemp', [ '-d' ])
 
     try {
       process.chdir(tmpDir.trim())
-      await prefetchYarnDeps(lockContents, verbose)
+      await prefetchYarnDeps(lockContents, verbose, mirrorUrl)
       const { stdout: hash } = await exec('nix-hash', [ '--type', 'sha256', '--base32', tmpDir.trim() ])
       console.log(hash)
     } finally {
diff --git a/pkgs/build-support/node/fetch-yarn-deps/tests/default.nix b/pkgs/build-support/node/fetch-yarn-deps/tests/default.nix
index 2d563dac87dc..3f7b76ec4f84 100644
--- a/pkgs/build-support/node/fetch-yarn-deps/tests/default.nix
+++ b/pkgs/build-support/node/fetch-yarn-deps/tests/default.nix
@@ -9,6 +9,11 @@
     yarnLock = ./simple.lock;
     sha256 = "sha256-FRrt8BixleILmFB2ZV8RgPNLqgS+dlH5nWoPgeaaNQ8=";
   };
+  mirrorUrl = testers.invalidateFetcherByDrvHash fetchYarnDeps {
+    yarnLock = ./simple.lock;
+    mirrorUrl = "https://registry.npmjs.com/";
+    sha256 = "sha256-FRrt8BixleILmFB2ZV8RgPNLqgS+dlH5nWoPgeaaNQ8=";
+  };
   gitDep = testers.invalidateFetcherByDrvHash fetchYarnDeps {
     yarnLock = ./git.lock;
     sha256 = "sha256-f90IiEzHDiBdswWewRBHcJfqqpPipaMg8N0DVLq2e8Q=";
diff --git a/pkgs/by-name/bp/bpftrace/package.nix b/pkgs/by-name/bp/bpftrace/package.nix
index 431991c2e6ae..5ffb0bd331a4 100644
--- a/pkgs/by-name/bp/bpftrace/package.nix
+++ b/pkgs/by-name/bp/bpftrace/package.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "bpftrace";
-  version = "0.26.1";
+  version = "0.27.0";
 
   src = fetchFromGitHub {
     owner = "bpftrace";
     repo = "bpftrace";
     rev = "v${version}";
-    hash = "sha256-h3gFnQq48oM5uK07xrykOCSJxhr6dqcyVUDoIKIRREY=";
+    hash = "sha256-wYDSx2WngWS4Ucj82hLO0G46tiXhqskhMjmv7NuUVfw=";
   };
 
   buildInputs = with llvmPackages; [
diff --git a/pkgs/by-name/dd/ddccontrol-db/package.nix b/pkgs/by-name/dd/ddccontrol-db/package.nix
index 533ee7a9d072..7732d4107214 100644
--- a/pkgs/by-name/dd/ddccontrol-db/package.nix
+++ b/pkgs/by-name/dd/ddccontrol-db/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ddccontrol-db";
-  version = "20260902";
+  version = "20260915";
 
   src = fetchFromGitHub {
     owner = "ddccontrol";
     repo = "ddccontrol-db";
     tag = finalAttrs.version;
-    sha256 = "sha256-Nu0SC9Qh4+wUzVCdo7m2z4pZH50FvCXehF3IiCoHXKM=";
+    sha256 = "sha256-n538zzL8lRln6eLCJDivwh90RO2RZ7lykEDLVKV3Sa0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/de/delve/package.nix b/pkgs/by-name/de/delve/package.nix
index 0dcbf731887a..b9ab97687229 100644
--- a/pkgs/by-name/de/delve/package.nix
+++ b/pkgs/by-name/de/delve/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "delve";
-  version = "1.27.1";
+  version = "1.27.2";
 
   src = fetchFromGitHub {
     owner = "go-delve";
     repo = "delve";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-H91QnLyqywgoc3zdTaclzzUxVPagNnxLzKub2gnL25w=";
+    hash = "sha256-vq8RSqSoPmDT/l6izYdM0a6SVJyaIbZ8gsXbgkFPaOw=";
   };
 
   patches = [
diff --git a/pkgs/by-name/fa/fastly/package.nix b/pkgs/by-name/fa/fastly/package.nix
index 695152522029..a810aca0e5e2 100644
--- a/pkgs/by-name/fa/fastly/package.nix
+++ b/pkgs/by-name/fa/fastly/package.nix
@@ -1,27 +1,23 @@
 {
   lib,
   stdenv,
+  buildGoModule,
   fetchFromGitHub,
   installShellFiles,
-  buildGoModule,
-  go,
   makeWrapper,
+  writableTmpDirAsHomeHook,
   viceroy,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "fastly";
-  version = "16.0.0";
+  version = "16.1.0";
 
   src = fetchFromGitHub {
     owner = "fastly";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gVKlAbiznaRKwDpiyap4Q3mIhn/ZbnUIFwG3l01ZXQ8=";
-    # The git commit is part of the `fastly version` original output;
-    # leave that output the same in nixpkgs. Use the `.git` directory
-    # to retrieve the commit SHA, and remove the directory afterwards,
-    # since it is not needed after that.
+    hash = "sha256-xGp5Fa4ruHpc2YAAbrva0zurt4wxC6XRdSpMMQGEB7c=";
     leaveDotGit = true;
     postFetch = ''
       cd "$out"
@@ -30,39 +26,34 @@ buildGoModule (finalAttrs: {
     '';
   };
 
-  subPackages = [
-    "cmd/fastly"
-  ];
+  subPackages = [ "cmd/fastly" ];
 
-  vendorHash = "sha256-U2Ix8ZKGCDrWUJFFXJaL+1EBTbqblWp8slhruHhouIc=";
+  vendorHash = "sha256-JUYBaiAz91jv8QFrfjpHnY442+qK7T0VZJcC/rCGhD4=";
 
   nativeBuildInputs = [
     installShellFiles
     makeWrapper
+    writableTmpDirAsHomeHook
   ];
 
-  # Flags as provided by the build automation of the project:
-  #   https://github.com/fastly/cli/blob/7844f9f54d56f8326962112b5534e5c40e91bf09/.goreleaser.yml#L14-L18
-  ldflags = [
-    "-s"
-    "-w"
-    "-X github.com/fastly/cli/pkg/revision.AppVersion=v${finalAttrs.version}"
-    "-X github.com/fastly/cli/pkg/revision.Environment=release"
-    "-X github.com/fastly/cli/pkg/revision.GoHostOS=${go.GOHOSTOS}"
-    "-X github.com/fastly/cli/pkg/revision.GoHostArch=${go.GOHOSTARCH}"
-  ];
   preBuild = ''
-    cp ./.fastly/config.toml ./pkg/config/config.toml
     ldflags+=" -X github.com/fastly/cli/pkg/revision.GitCommit=$(cat COMMIT)"
   '';
 
+  ldflags = [
+    "-s"
+    "-X github.com/fastly/cli/pkg/revision.AppVersion=v${finalAttrs.version}"
+    "-X github.com/fastly/cli/pkg/revision.Environment=release"
+  ];
+
+  # must embed viceroy to prevent fetching binary release on `fastly compute serve` invocation
   preFixup = ''
-    wrapProgram $out/bin/fastly --prefix PATH : ${lib.makeBinPath [ viceroy ]} \
+    wrapProgram $out/bin/fastly \
+      --prefix PATH : ${lib.makeBinPath [ viceroy ]} \
       --set FASTLY_VICEROY_USE_PATH 1
   '';
 
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-    export HOME="$(mktemp -d)"
     installShellCompletion --cmd fastly \
       --bash <($out/bin/fastly --completion-script-bash) \
       --zsh <($out/bin/fastly --completion-script-zsh)
@@ -75,6 +66,7 @@ buildGoModule (finalAttrs: {
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
       ereslibre
+      stepbrobd
     ];
     mainProgram = "fastly";
   };
diff --git a/pkgs/by-name/fe/feishin/package.nix b/pkgs/by-name/fe/feishin/package.nix
index 094111c60555..07763edfe439 100644
--- a/pkgs/by-name/fe/feishin/package.nix
+++ b/pkgs/by-name/fe/feishin/package.nix
@@ -8,7 +8,6 @@
   fetchPnpmDeps,
   pnpmConfigHook,
   pnpm_11,
-  nodejs-slim_latest,
   darwin,
   actool,
   copyDesktopItems,
@@ -20,18 +19,17 @@
 let
   electron = electron_43;
 
-  # Fix pnpm issue on darwin https://github.com/NixOS/nixpkgs/issues/525627
-  pnpm = pnpm_11.override { nodejs-slim = nodejs-slim_latest; };
+  pnpm = pnpm_11;
 in
 buildNpmPackage (finalAttrs: {
   pname = "feishin";
-  version = "1.15.1";
+  version = "1.17.0";
 
   src = fetchFromGitHub {
     owner = "jeffvli";
     repo = "feishin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2UKJBUZNUpUUZIG1JFXok7YJdzqt+Ge0ykHUm8BeNcw=";
+    hash = "sha256-1ZIw5XiN+2EhpHmdvN0HxgMSvn4QvN9B+ZJ3RlPXhLw=";
   };
 
   __structuredAttrs = true;
@@ -48,7 +46,7 @@ buildNpmPackage (finalAttrs: {
       src
       ;
     fetcherVersion = 4;
-    hash = "sha256-9uG0AxIBAmuIPywg3p9fFCXmRvM9zDLhWfluSLRnUXY=";
+    hash = "sha256-ltpz4e5Vv2vxt/93M4+vHUFJZjwTRwb2zrwvl1Lqjo8=";
   };
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
@@ -65,7 +63,7 @@ buildNpmPackage (finalAttrs: {
   postPatch = ''
     # release/app dependencies are installed on preConfigure
     substituteInPlace package.json \
-      --replace-fail '"postinstall": "electron-builder install-app-deps",' ""
+      --replace-fail '"postinstall": "install-electron && electron-builder install-app-deps",' ""
   '';
 
   postBuild = lib.optionalString (!webVersion) ''
diff --git a/pkgs/by-name/go/goss/package.nix b/pkgs/by-name/go/goss/package.nix
index 5264b17d8603..5f4cbd5496b0 100644
--- a/pkgs/by-name/go/goss/package.nix
+++ b/pkgs/by-name/go/goss/package.nix
@@ -15,16 +15,16 @@
 
 buildGoModule rec {
   pname = "goss";
-  version = "0.4.9";
+  version = "0.4.10";
 
   src = fetchFromGitHub {
     owner = "goss-org";
     repo = "goss";
     tag = "v${version}";
-    hash = "sha256-GdkLasokpWegjK4kZzAskp1NGwcuMjrjjau75cEo8kg=";
+    hash = "sha256-4DCPPeTL2x6mMpcP/cdyQWpqehGWkk7MWM7P93WzwCA=";
   };
 
-  vendorHash = "sha256-Rf6Xt54y1BN2o90rDW0WvEm4H5pPfsZ786MXFjsAFaM=";
+  vendorHash = "sha256-NlOS5APp9R45QpYKwP673pmN7CR+Ufz8LxWyMkrVeq0=";
 
   env.CGO_ENABLED = 0;
 
diff --git a/pkgs/by-name/gp/gpu-screen-recorder-ui/package.nix b/pkgs/by-name/gp/gpu-screen-recorder-ui/package.nix
index 522156ddeb69..10db980b5c71 100644
--- a/pkgs/by-name/gp/gpu-screen-recorder-ui/package.nix
+++ b/pkgs/by-name/gp/gpu-screen-recorder-ui/package.nix
@@ -34,12 +34,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gpu-screen-recorder-ui";
-  version = "1.13.7";
+  version = "1.13.9";
 
   src = fetchgit {
     url = "https://repo.dec05eba.com/gpu-screen-recorder-ui";
     tag = finalAttrs.version;
-    hash = "sha256-liBdZDHI32ElTTsHAZekYKFgZY1eP7rz4u7tM4pkpZ4=";
+    hash = "sha256-f4jTv3IS73NWStg1af20pGKlqwIN9K9ZyLjKUX9Tp3s=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/im/immich/package.nix b/pkgs/by-name/im/immich/package.nix
index a01db75e815d..ff0c14592a5a 100644
--- a/pkgs/by-name/im/immich/package.nix
+++ b/pkgs/by-name/im/immich/package.nix
@@ -109,13 +109,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "immich";
-  version = "3.2.1";
+  version = "3.2.2";
 
   src = fetchFromGitHub {
     owner = "immich-app";
     repo = "immich";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ufdMwERs1h+m2usMHztZicRXpI20BM+2PeOLBArXw1Y=";
+    hash = "sha256-napG+EMZbbbeq7R8FtnuDsDwdpxItkwTVWztnw07DfA=";
   };
 
   pnpmDeps = fetchPnpmDeps {
diff --git a/pkgs/by-name/it/itgmania/themes/itg3encore.nix b/pkgs/by-name/it/itgmania/themes/itg3encore.nix
index dfbc030ce362..23245de80291 100644
--- a/pkgs/by-name/it/itgmania/themes/itg3encore.nix
+++ b/pkgs/by-name/it/itgmania/themes/itg3encore.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "itg3encore";
-  version = "0-unstable-2026-08-10";
+  version = "0-unstable-2026-09-14";
 
   src = fetchFromGitHub {
     owner = "DarkBahamut162";
     repo = "itg3encore";
-    rev = "5427331ee20e496092680400481165c503d2123e";
-    hash = "sha256-Hvqxhpdqxo32uXkuFGUqlNk8517ughE0mGBs1L9PsHY=";
+    rev = "e5177b5829c4ef521c3552f55f9080a3561d6216";
+    hash = "sha256-cnGfEBTJYEqDNCmR8Wcbetm2qhhgMCh1LpzXBKKXdvA=";
   };
 
   postInstall = ''
diff --git a/pkgs/by-name/jo/joplin-desktop/missing-hashes.json b/pkgs/by-name/jo/joplin-desktop/missing-hashes.json
index 2206616fac77..785664d75360 100644
--- a/pkgs/by-name/jo/joplin-desktop/missing-hashes.json
+++ b/pkgs/by-name/jo/joplin-desktop/missing-hashes.json
@@ -1,55 +1,55 @@
 {
-  "@esbuild/aix-ppc64@npm:0.27.2": "9c18cc2e4a03339a55013aac05b4a3fc4b77e75715dc252d034aa3d43b754abc053a7601b95e31249f4b6e69b68db2f5e6cb04b0ed619f825f2f70daff1a78d7",
+  "@esbuild/aix-ppc64@npm:0.27.5": "48203e49df4995ab8ead9e8def96381931901db904cd174e5cdc9d034f70431276e8ed93305a13c22390041e6933ec19624435f6f7c34f8a767d5979c3c6e145",
   "@esbuild/aix-ppc64@npm:0.27.7": "848d1a798fb9ea6aa902c9138aaf6b45d889df39a1ff737300ea9968af3afee1000f611bc00187f5bda096d300fb25f4f883c57a2dc7296e40295f2470aa57b3",
-  "@esbuild/android-arm64@npm:0.27.2": "a318fc9ffcdad7fda8bb521af8b17f73d93d9a94b4cca9301fbf72cf3f5a6e945edd589a47388de70f3e9582655dcf5b5bb928a11e306368fae4a9106d5143d2",
+  "@esbuild/android-arm64@npm:0.27.5": "6cfcae790d0cec7a9bd29f539d05ad5a5715815177bb62231a95c3a8b2fb651b099e3eef76c6c0f174be83864b0a1b244474c071df36c028e407c2325015fa01",
   "@esbuild/android-arm64@npm:0.27.7": "21a57ee237e1503d92c2f818c1dbf7d6f772b100fd0dfa95ea0d24be718c0c6952e915ad1f47bcc3496bb807a0a254d35d6baadc48531b684d2236f57023f1e6",
-  "@esbuild/android-arm@npm:0.27.2": "01114275e096b9177ad2496730087ee081d6e65a75bc087457b527c5baac5a8ccb362435f45232532bf6f97de95e1790dbce127d55abd5e4152c7214682bf4d3",
+  "@esbuild/android-arm@npm:0.27.5": "4f856f7e508393c7e722e444b26a60f093ed4dfd11def0cbae13034e60dca6b356c302430a9230644f4ae2fd4e5a9ae620a4b69fa98a12062190195af2e57ec1",
   "@esbuild/android-arm@npm:0.27.7": "46a246245a024680c8b5051425fc724c846b7d36ac952cd312e71194bae07fd712aa6fa8ddd7fa648a18d665eb0bcfaf111726af7b676465cb181dff7e6a0848",
-  "@esbuild/android-x64@npm:0.27.2": "e92c5b6919081a14c8882f1167cf90b4e4bba745ad6e9a23428f85a1cd5e79dfa3f1d2fc943686b237e4cd09fac52ad3b3791deab6a0419ee10859284d3834aa",
+  "@esbuild/android-x64@npm:0.27.5": "116456a795deccd12917aa61599c5f0278b2399c7c936dd92b667a53f45f695ac316c61b1b3929c1dde177cee447b2cd5c6b16283aaec1fc80d317ef414a0442",
   "@esbuild/android-x64@npm:0.27.7": "95c858fe95b716aabcb71a0dab9162d46859c0deb713189730ce6c2a2bc27efed2341b2d27aacc092dee7544df7b25035a12d65f30481b5b03a8358707e1a6f3",
-  "@esbuild/darwin-arm64@npm:0.27.2": "5e99db5037167bad4a095fc445b94a2ce02357870ed58b79e13ae6bc09b5cb33d7e03f925492df940f9e0ad685a889f02beec1431d8fbf4c7ced55b2f48f5659",
+  "@esbuild/darwin-arm64@npm:0.27.5": "09b3f3f85eb4cdc3f00582b360be6f904b27d62f390f25815e6a27843bdfd9f087372ddb0718c1010078b34e96df68d115ce562891121684dc28fedcc22cdac5",
   "@esbuild/darwin-arm64@npm:0.27.7": "281897d55b71e222394f08ee519999f673778c26ac78e4dacc67262e449b9284e852dccac8d6293fd611e0a37d0c798f2ea18c65573ed251d5e04dcb01121f0d",
-  "@esbuild/darwin-x64@npm:0.27.2": "87f2fbc4cf11724ef805b17cbdc7b0a9498332bc4b61d55e110ecc3b09bc488b88c0bd140ea48924e9c97a2063cf7e440fef13dd56e415c46799619d61086910",
+  "@esbuild/darwin-x64@npm:0.27.5": "0a81d707bbc05a2b2f6ffc3e21f1596a7346c737b13cf789b59d7e86cb4d355ee6389f7ba2965da142ff40913dce986d5f2a8dfa6c940e704a017f418d9d7384",
   "@esbuild/darwin-x64@npm:0.27.7": "a6c320cda3c7c176d678c00367823259b7efc0f8638393bd0e45b4f950af15be887558c82e2d74ed9fb492a4b04f36afc1c3a3b9774aeaaa08fbf96aac6e3524",
-  "@esbuild/freebsd-arm64@npm:0.27.2": "1ffa23243b913e377a5b09fd97ad9f089be3695aafdd893b60bb7f9be479256d8b7546f0bc96c4e61133fe7aeeaf95a8e941e82a65d99008ff82c99bdec85eee",
+  "@esbuild/freebsd-arm64@npm:0.27.5": "fc705c9f299bef59a584f78a1ac8e686b3598639d8ad565170db7704d116665bfd7b0760c2d5901e363f972133a77e92bcf3ace16726b61540582a09c82ff284",
   "@esbuild/freebsd-arm64@npm:0.27.7": "8b546929340ebb3daf5b47ca24db6d6fdcf3c14a733c41ddd8ae960834a5aa60b22b341049aef39badfdfaad0081a8706d085ba892e2b23163d1d1ff52ca1dc3",
-  "@esbuild/freebsd-x64@npm:0.27.2": "44f744b289cf9e115b0adfac1905818d756dfced14213bf144d9016d96f67575ef2a55526f76e29ee775fcfec7274ba3a5e6833f35ed79a4592d3f5eac278267",
+  "@esbuild/freebsd-x64@npm:0.27.5": "bacab4f9d3e13eb9a2b0ad1403fb0a6d66d7bdd50e9209dff5c8d0d9151ad3dd64f6a709530858f1143ab30f89d508e3f29782219a23d258e455ed2dee360136",
   "@esbuild/freebsd-x64@npm:0.27.7": "5a4c0ccbde7fe7a6de14c8789d1f20f4cadc7980e531b090b137774b56f360ba3c50f5612f01980ab9071ae50e1bb007f44c1b04b68fd84ba07113472081e021",
-  "@esbuild/linux-arm64@npm:0.27.2": "2b037d74eaff4e9b5a6076760ede873320707636a3495939687cdd0c2c7150883111273bc0a8663fa305c42f439f4748b5ad7f15a1a1ea9fa7db575d9faf2d1b",
+  "@esbuild/linux-arm64@npm:0.27.5": "4acfebf0f43e9dadb2a29cf336562e711961c23fbb6f3fec754f8a2848a0c63022b58cdc95c667fe6f5dc7cf55824cf6bcc49f96b53f29e72da0bc97102b472a",
   "@esbuild/linux-arm64@npm:0.27.7": "741871bea9ce0a136367707cc509254fef167c5bf968706de6bff7db96ee7c672f02231cb69965e17ca0aedbd99d533275f5a695a3069cb3df0a9d2cd877847f",
-  "@esbuild/linux-arm@npm:0.27.2": "28cfc3a9ca11fc899649e7a706fb4b2ee57999bd92e86c23726b3ed0f832732411dd0aa3e2bcdb4105759f83bc4e5adc98dc195aaafce736c910db4e43694702",
+  "@esbuild/linux-arm@npm:0.27.5": "107786c947b02b6e7aca4f9ff3af8c14fe461f614f9c298d63b9474703ca7798d3650d52b6041412308eef46dc7215f56b4155391f9feb5b15b64718204f0009",
   "@esbuild/linux-arm@npm:0.27.7": "c2ee4ae5f6e13f8e882da4a369cc5d672ae8bf7613e35e22b54df3999e0d5aaef6d704c7dcbc473708eaeee202dd8e892c37e791bbc50a509b23ae845d18b689",
-  "@esbuild/linux-ia32@npm:0.27.2": "ac6cc92b9be2ec6d9d483c53fc973e6381765b784a2e1b71fa93ea0cf976344c2e3e0bfda0140b0829b3ec4304d9b886692b2891e68c17d2121066d06e67f0ac",
+  "@esbuild/linux-ia32@npm:0.27.5": "51c5322b4a834c3c8bc66d9503a8e2dfda4090aed848a533718773cece1b3a92fc10ab532bba81af1ce7eb7b3c244ef6aed2b59d480f32cf987d222e7c05950a",
   "@esbuild/linux-ia32@npm:0.27.7": "0933a68b0bdee3dd0fcd99da92c0472deb6d6225c454b88a3609e1b1ea7648b36f6b83be8a8cf41edc1f0d666b76006e270a66c7520050d278d7d73df171e86b",
-  "@esbuild/linux-loong64@npm:0.27.2": "625f5b6c2218a3acb2cff8f7f02a53ca89d13925f8932260ddad01595c6907beda4a79e4b767b1101f5971049f88d3ec6ab29cf565b4d61d9b0d7277e2cb578d",
+  "@esbuild/linux-loong64@npm:0.27.5": "92a0c8bfdf3214a485161184669adaa7dbd1d08fafb3bba50fd6dbd88b9a2e9c12705056e243e96a4eca3e8f0cdd65e5271261cb7f51429fd77d5dbc9fe49cbc",
   "@esbuild/linux-loong64@npm:0.27.7": "9609e94b603a8a68bcd60325626d0bd35cce37e75994729d4ea264fa865db201da64c3216004656d94b1edeb8587150b1c47a1eef8ee1af9dc0d3cd6baa5ab2a",
-  "@esbuild/linux-mips64el@npm:0.27.2": "0c62692cb3a297b37212dfde52a861861843a716f6b3bdb73da49ba249a4c001b989ea61dc4540c430fac59ce2f8fc45035cdfac80172c5ddaf1b9df8471aecf",
+  "@esbuild/linux-mips64el@npm:0.27.5": "57326d2100e7a1be73c63a2827b981c926489fb86ce0482030b8a9049fc8086a8a229b98d83d34b4a9e459756e38ac9d453c2facd0e706b83dd8a08105a77445",
   "@esbuild/linux-mips64el@npm:0.27.7": "74ac0fe0b857b926af9057d5fa9634fc4b0b61a6fcd9c13cc2917e0e66638e2f724b8fd82024f97d524ff54ae17d0a52a0569078639aa9907f5287514aa046b1",
-  "@esbuild/linux-ppc64@npm:0.27.2": "b804d2dd0a6a85fe1c731828c725731a55ab120d2cc16941d560b2e9af5c2ec51586914ce26a84a326a9d46fa61eb8bb1f843953fe29ddd43b3f3099c491b5ff",
+  "@esbuild/linux-ppc64@npm:0.27.5": "d2e2b8b14ef6443ed23354ed45eaa0c176cddea25a4d84ac2a6dc76d7ce48de7928daecc3535f5cf4670b1ffbc562c43255e919ecc3f7c8c26f43b9b9d60e534",
   "@esbuild/linux-ppc64@npm:0.27.7": "7d75e59ad798631b7b7f77471fc9f545e0e6d2959a52d57b77e92d4aba81c5c57dea558d22539edc6aca92ac72112f93381e163b996df193cb5c9a1da4b4230d",
-  "@esbuild/linux-riscv64@npm:0.27.2": "03e67e7207a83801363e3637f9a35fb6224ed4dc23bbf6eca41904fc42f5a6806e1e591666bf48dbf62eba97d41ff4355413b14dcb2339007b22c693374c49f6",
+  "@esbuild/linux-riscv64@npm:0.27.5": "a943c97a6d031041cad40196be6f8112dbd7a642411bf7b24942de95f4c2caae31ca11b3e4724f1898f2b9f2e5a5c106636eea50eddc7db7cfbec8f443560798",
   "@esbuild/linux-riscv64@npm:0.27.7": "6dca2a182f59d43057ef40b93788dfb265c3b9fff4738aa613d87c7c709d9c308f18c282b7cfc2a1c770fa4db78d3529dc50b8a9f30e415661d993b021b2cdcb",
-  "@esbuild/linux-s390x@npm:0.27.2": "eb24b9c0a4a1492e4ff34a87933f6a3b348739c12f864b408144efdf949871c1fbb02a1cca741bfa11fd08aebe585d046fd3311b462ce4c795e3064ba3912469",
+  "@esbuild/linux-s390x@npm:0.27.5": "068865bc73484b97f1bcce6eca0195b30e8ce03dafdc6da7283b289023728f1cc7d0cbf5387fa6b89b072ddf8f9776b8cceb2981d2ebe3f2ea5e84ae8a77c448",
   "@esbuild/linux-s390x@npm:0.27.7": "870de4b9ff155cf5cf2ccd7b3587a6b4170550a31b621ea11dc134cd48af95f4a30f4ce868d249967eade6b3dd66e7a0af0d542c6fbba0dbc473fd0f5d3299b0",
-  "@esbuild/linux-x64@npm:0.27.2": "ed1542f203329521fb1f308696c76ba59ed4a4616a24e21bf4820685362bba209d5c44c2f4e66c88dc7b7399df9ace625454d4829ee529d076ccaf61566e11cf",
+  "@esbuild/linux-x64@npm:0.27.5": "6eb9d11d25e632607370d30d8fbc40c4357f6be293aeb33e6cd3fe73c18203b37f24b6e52d0939a499839fddcf9920b16862a3b923e425b99bacf9b80e787c5e",
   "@esbuild/linux-x64@npm:0.27.7": "47fce66247eda2d4721c1e615f7169eb7bf6e4b6105eab7271391ce933e7d350d3d4a581b3b8a61573f70b6663268eb514e624875dc514dc56dec3a37cf7cbe3",
-  "@esbuild/netbsd-arm64@npm:0.27.2": "576dd082047077b9cc41fbeffd728821a4f3b80969c1d2d6c274301122c6de2050f484fd4e946777527b8a15bd2a5ac54f85ca7ab95ea72b5345177e6a888687",
+  "@esbuild/netbsd-arm64@npm:0.27.5": "d43426863ae1f6bd37478a30c84bdabbbafda3b2ab537a6f5051006ba13231e6842ba49a3f61a2dd30736048369660e134f028c6b2bef156c81a78dadeaf280e",
   "@esbuild/netbsd-arm64@npm:0.27.7": "bbe0d0529fb73fd38c2cf9ebc1d1dcd5a2586b263cc4f6300d37008955f45310e842d63153e361a4447d4ca0f0a0691d62013fe60b09e4e0cd53f428ef2266f3",
-  "@esbuild/netbsd-x64@npm:0.27.2": "f8994af3e2ff3c9a91e874e58698b66e6f8d4e72dbc0aaf749b74a79420954146ed053359b0a4c213918582cee187d8a371737a33cfb93e624b4d091e5a6c240",
+  "@esbuild/netbsd-x64@npm:0.27.5": "b54f975bfc05f44a21884022a87367ceec3775cfc81d155bb2183ac5b9f51397589e10654eecc87ff9adee749a574e4ff724cb064907b2328e39ddb390760707",
   "@esbuild/netbsd-x64@npm:0.27.7": "246ed4df55788aacd2d9146f51ea7fcf4715e73d32ca1b0fcb42c316fdbf21d8de03bb304205dc707942442899529e834466894faa0aa3fa40454f5622648fc6",
-  "@esbuild/openbsd-arm64@npm:0.27.2": "f710da24beeb747ef3a11b9d99085a14f5c929f942fd9d9a05b7806d5ff1b85631bfa506eb7a6aed9fd01ec99bf91f24736f9f0e0eb6b7c0019fe0dddd2e615c",
+  "@esbuild/openbsd-arm64@npm:0.27.5": "dce25568a9642e9cacc9d4ae5a8c07dcb5bd2c7aee5f31259334074d30a380cdec2b3654b15978f3b64965d7622bda51dd203ab774f9a499e3b55425eaf926e3",
   "@esbuild/openbsd-arm64@npm:0.27.7": "d99927053a0f8be5158da8ecde7e8a08dd0ea580ca93f006971730979681e3738f83ada4d6564a57cdd6f412e40e5a750a92f424807aa12f97c2ead52617ad41",
-  "@esbuild/openbsd-x64@npm:0.27.2": "62670fbe1f609c5362df7b45968ded512a0860e2ad8a4715a89993abfa2f9f08a28f1294c7857d80e6d3f713639a71d291c06a961b331de67ad350032d1b8e96",
+  "@esbuild/openbsd-x64@npm:0.27.5": "fa51a43619b0da031f3b2eb6ece65d9cd6a69b9e3f03693463ed9878b04764478990dd3047591b6e2880375ada9eca8db20aca0df238afee1ad3b664f7adec65",
   "@esbuild/openbsd-x64@npm:0.27.7": "1480ff755c727d056e5f37e1d2be83d36b137c9f3595911aaf1659160c2cbfea846bded0557017aaefd79a0322be5e381b168ebff3eec4af684198835504b051",
-  "@esbuild/openharmony-arm64@npm:0.27.2": "e279efdc18301add96ea791ba9ef117cae05346688cd521fd225a60ad166add4bc995af985058e3b6ab9e65a7c49a79108a294d6aa26a1d1685ad0db194e2c56",
+  "@esbuild/openharmony-arm64@npm:0.27.5": "4c6ccc2c466158bb635918ecf530c14cbe536c2afeaa3e8e0c8b61f80875134573705b96a1854b07238df5b0e0eb1ad26b424d7a4b56b73b8813fdaec553e1a0",
   "@esbuild/openharmony-arm64@npm:0.27.7": "6aa1fd102bdfa99b3c27f558f6b5d493b47f34260cc10967c47d44b86018a307377e0c70ef51b8886c592f2a0057710a8ad7781716b0eb059d0b0657b4f7ddec",
-  "@esbuild/sunos-x64@npm:0.27.2": "7234302321d36576b5a9f027915417cddc195a67b19cdfb50e69c337ee0dd63a88be6b72d7ef299cd569d1af62e54774303d52d3d6b5e5858db975241ae467d6",
+  "@esbuild/sunos-x64@npm:0.27.5": "e53d864a1e9f0b598461df53163dd837f1bbaba2f3590934b34bae132efb2c658d6f9b036d4e9a6f2b8327cb9b3ab99d7a8244009a856dd1063868d6989d204d",
   "@esbuild/sunos-x64@npm:0.27.7": "66bff01f90a97b989c6e6fbe6f8df77a0e5b40b57b8c4d8e6c407635546eb05553de570cd4e0d4624a5a6be8a61d7e9c6e7d8bc238f8f5773a4231361c0e8745",
-  "@esbuild/win32-arm64@npm:0.27.2": "36620fddf79da3e8e527ef8331436929fa7a0b23c9b591af8f8573d80ed9c4ef45b24c6fa0abbb01d187dec497efa6c9d9d397d575afc1f28477e9ca16a48d73",
+  "@esbuild/win32-arm64@npm:0.27.5": "cff774ddb4107461f5e48da9664a1813ad6234921cb51739a3915d2822e6429276f40f0edadb52f816a63143ded7e77b84b38416f1c98e7b80a8c8a6ae031363",
   "@esbuild/win32-arm64@npm:0.27.7": "eb7008345c82bbd4be30bb27ae4e17346cb5014801e9d50058984e7c5e4cb509d6eae82db3c04aab16b72d3829908b32151117222c107962fe3fb0e317e55951",
-  "@esbuild/win32-ia32@npm:0.27.2": "96e8c1fa0ec2b5529ead2ba703e5da7644c138b2f9b6e285c05513f0455e99b2b0dcf399f01779fb384e22810e82f892491e44402772c62d3fe094b025bbdc0f",
+  "@esbuild/win32-ia32@npm:0.27.5": "ae399419b6457492c53f2829f135285e87ca3bfde1bd11f780baa890b881b96659b0c7344d7e86c9e417531190e19f38a91f47ee1b238be5b5ce794957eac4b8",
   "@esbuild/win32-ia32@npm:0.27.7": "b6a44b5b6bf670cbe86de063335f03faa308d5b3eabbca1f5078bba9674ea42d3d6ad9fb9601fb0c7abba65d4b4a467f20473aedb856c9544c20166c75538029",
-  "@esbuild/win32-x64@npm:0.27.2": "1ed08bebd916c16003f3784276ae683ab41d34951a0c272f6e072b8067a2b4bacd6f6f75a8dcea375b8545e15891d305425cf7c8dd31f7deab56ef22cde4a1e2",
+  "@esbuild/win32-x64@npm:0.27.5": "37a9f52ea621a0366ca72c4fca89e9a5e2734dbadeb46eaff89d1d81f09147db4ac4afd7905b5d8fde8e99bb4b28db52ec27b043d355711d97080b34393d75f8",
   "@esbuild/win32-x64@npm:0.27.7": "4b91237b01e7e1a5083d2df524bb2ddb13da334197681fd33ad05975c073ccc901ea6b9395453276557608e5858cc032ed12807cc156c29f4ce7d2c63e04d5a0",
   "@img/sharp-darwin-arm64@npm:0.34.3": "952e9e9c34291502e7c21258d2874539a3953a5da8df52c8e2c459f673a76179eddd48c3b7563773db7bb36b2b241d781b98a667fac4b30c1f49c1cc9fdf9b7f",
   "@img/sharp-darwin-arm64@npm:0.34.5": "0f872f02a49c87c1c844c9715a1c1e4449fab30c85711d948767d41ea1eba1cc7be8268b582d95513e66cff090ab520e4104dcf30cc6f598ee429b40e890eeec",
@@ -122,8 +122,6 @@
   "@rollup/rollup-win32-arm64-msvc@npm:4.2.0": "ff71a301051b237a32e14cb2b18117c72c5ab4524120184500e098fea028385806567fa55e4879c19f80d747774e3b8d913e0b4560abc8fe4881b392fda6ed79",
   "@rollup/rollup-win32-ia32-msvc@npm:4.2.0": "dd65d454384b6020b87f5f943121dd9d02e5bfbae2ec124a23f0a2034df02549c0ae4fb27558efda6668bab94b121c5463c4845431f2c1c9416a719176e1dd82",
   "@rollup/rollup-win32-x64-msvc@npm:4.2.0": "13cba2a14f7864986f3331c327a137ad95cf366411c0b6d3f66593bb6ea04d0058e12bd0a09fde72bbfb8660a554f0b66d90754e21add3c99d899e2bd7dfe1d1",
-  "dmg-license@npm:1.0.11": "36c0a7b030801b91216affa9b2bb00caa345b2327f298accb2263a80a0320ca305f90b99da68007d187c830c543410d58a0a2bbc229e8d169b0e1d1652ff42aa",
-  "iconv-corefoundation@npm:1.1.7": "0189733ef51a9f481379202cb1919f2677efc44aa014ba662a6fd99e47993e350eab0ff724ed18cda8011c9b78c4702b2d374f732955f1def3fd2a14a29d25c0",
   "lightningcss-android-arm64@npm:1.30.2": "823d5aa547e473e18832b47b575313dcfd9146697d53481c79b10dbbe45c62a7352f4da77f836b0c0e6a233545bb3456bece543f39e7d8ee6ef75b4d345af2fd",
   "lightningcss-darwin-arm64@npm:1.30.2": "23fd135ab0a081aec174a835b15218c5ad9ed4486823a1b8ddd8ca1795876e032201385cf6e3acd548a235d5f527e19ad213ca1c5fa0ef31d333d43d4f67fee8",
   "lightningcss-darwin-x64@npm:1.30.2": "4151c2744332798bcc83dea10c8da81a18c7dbc2d12c53a95149d7a5d24409b32f80eb42dd5933f109fe4c5715e25cfe6df3d21158191fdd682a99cc62f28b93",
@@ -134,5 +132,10 @@
   "lightningcss-linux-x64-gnu@npm:1.30.2": "bc4959398f65fc60df2a2a011c2381029d9f92ed7a2a1930393bbef5515d3f18bd2885a4063f48031435595c22ddd10923c5e2ecbf53d086b18a3b65e10cfd47",
   "lightningcss-linux-x64-musl@npm:1.30.2": "2db0a94df42f23a051bac68ad0d4322f45bc0f47290810cbb012fc2292c42201ff1eae5ec0f83178da6f232ab4cc24a2fcaaf46b0867861966d9823610e352ac",
   "lightningcss-win32-arm64-msvc@npm:1.30.2": "307a014ddc51c6773be0b63db3ce3a09ff32c9093bd2e365689de0a07a45288a310154397f5dd6dfd6a5de726ebd4dec597482dd1bd4bfeeb65f5bff09d52ea0",
-  "lightningcss-win32-x64-msvc@npm:1.30.2": "4c1b0406dad571a9754bf45becfd38af9d43eee94c93d8df881f862bc2597f72dc91dec0788aa67261cca79732c75afcd777e8786984a9e98d0d1fb66ced1a05"
+  "lightningcss-win32-x64-msvc@npm:1.30.2": "4c1b0406dad571a9754bf45becfd38af9d43eee94c93d8df881f862bc2597f72dc91dec0788aa67261cca79732c75afcd777e8786984a9e98d0d1fb66ced1a05",
+  "sqlite-vec-darwin-arm64@npm:0.1.9": "e1ad40eda22dd3a601565a1fcbc4d36e83560d4670dbef59639010a89fd3612697d2d5e2221d28a5044a6c461352ad83cc0595bb7e2b42594b9e76860f8a8291",
+  "sqlite-vec-darwin-x64@npm:0.1.9": "71760fc97b4d1d15f503a378abfa4ad390192f5fd1009161261339f6a377a9f47f857ae2ee993e5b7e8ab1e49f168fd86976f23b4cf4da9a7ea9850709dd51ec",
+  "sqlite-vec-linux-arm64@npm:0.1.9": "45b7e0ae0dc42acafc8e24b1f9f85b107b418cb7bc20a4f28ccb4abdacc45763fb417dd18c615c8aa76328da3b6bdd1d9e130baa97b446d62cf736da2ffa6010",
+  "sqlite-vec-linux-x64@npm:0.1.9": "6608e83f4d0a838fa20589d055c00e67f4aa0f086212922efd0e1f64571d1e3f3014a765327f722ee11b2dbdcd618a7932e06fcdd5ebf15c57b8e157d95585c8",
+  "sqlite-vec-windows-x64@npm:0.1.9": "8e2751b45cb93d8f896bf6e02b5676f75d7a68fdc199564401bd46ec2ddb81cce13f3ef96cfac15e14e5033eb96c322cb1fe21952b83aeb2abb54b769e43a426"
 }
diff --git a/pkgs/by-name/jo/joplin-desktop/package.nix b/pkgs/by-name/jo/joplin-desktop/package.nix
index b003c063c6b2..86c3c59344d5 100644
--- a/pkgs/by-name/jo/joplin-desktop/package.nix
+++ b/pkgs/by-name/jo/joplin-desktop/package.nix
@@ -44,10 +44,6 @@ stdenv.mkDerivation (finalAttrs: {
     postFetch = ''
       # there's a file with a weird name that causes a hash mismatch on darwin
       rm $out/packages/app-cli/tests/support/photo*
-
-      # Remove after upstream updates to Yarn 4.14
-      # https://github.com/laurent22/joplin/blob/dev/package.json#L103
-      sed -i '/__metadata/{n;s/version: 8$/version: 9/;}' $out/yarn.lock
     '';
     inherit (releaseData) hash;
   };
@@ -105,9 +101,15 @@ stdenv.mkDerivation (finalAttrs: {
     # before we can patchShebangs additional paths (see buildPhase).
     # https://github.com/NixOS/nixpkgs/blob/3cd051861c41df675cee20153bfd7befee120a98/pkgs/by-name/ya/yarn-berry/fetcher/yarn-berry-config-hook.sh#L83
     YARN_ENABLE_SCRIPTS = 0;
+
+    # Use nixpkgs' patched offline Yarn instead of Joplin's vendored Yarn.
+    YARN_IGNORE_PATH = 1;
   };
 
   postPatch = ''
+    # Nixpkgs provides Electron; don't run Joplin's networked Electron installer.
+    sed -i "/^[[:space:]]*'installElectron',$/d" packages/app-desktop/gulpfile.ts
+
     # Don't automatically build everything
     sed -i '/postinstall/d' package.json
     # Don't install onenote-converter subpackage deps
diff --git a/pkgs/by-name/jo/joplin-desktop/release-data.json b/pkgs/by-name/jo/joplin-desktop/release-data.json
index cc2e899f0202..ac469f854ccf 100644
--- a/pkgs/by-name/jo/joplin-desktop/release-data.json
+++ b/pkgs/by-name/jo/joplin-desktop/release-data.json
@@ -1,6 +1,6 @@
 {
-  "version": "3.6.16",
-  "hash": "sha256-0W6xNcEMXIs8XsoY6NqSud9D5fEmc5GKFC8Uo6CEtec=",
+  "version": "3.7.18",
+  "hash": "sha256-12ZRoEutQsNJlrPypNrsffeIj+2ekqB/s6HN9ks/+rU=",
   "plugins": {
     "io.github.jackgruber.backup": {
       "name": "joplin-plugin-backup",
@@ -9,5 +9,5 @@
       "npmDepsHash": "sha256-xZJ0Oir1A6sLe0ztIyBu39Yy3D6sNrVaciOYG0k85l0="
     }
   },
-  "deps_hash": "sha256-ejg0u9Dy3iaBusH248IbtJNpvd/zADyPJ9CplIK1A/w="
+  "deps_hash": "sha256-W5hXh1i1rTe4OkhTvHPpDQgPSvRqTZ/GsJnHXE2D/2Y="
 }
diff --git a/pkgs/by-name/li/libcs50/package.nix b/pkgs/by-name/li/libcs50/package.nix
index a11949699d64..adc8e3cce00b 100644
--- a/pkgs/by-name/li/libcs50/package.nix
+++ b/pkgs/by-name/li/libcs50/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libcs50";
-  version = "11.0.3";
+  version = "11.0.4";
 
   src = fetchFromGitHub {
     owner = "cs50";
     repo = "libcs50";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-G6QayPGR4lkeFuUYsFszekLAzzpA3hhIRmqt/OB0cdY=";
+    hash = "sha256-guITfJoNEiQAjfKiDKltWoP8VcLsyeEuzU4odhpwyUI=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/li/libigl/package.nix b/pkgs/by-name/li/libigl/package.nix
index 1462f2bc03ea..fb9268f6c404 100644
--- a/pkgs/by-name/li/libigl/package.nix
+++ b/pkgs/by-name/li/libigl/package.nix
@@ -6,13 +6,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "libigl";
-  version = "2.6.3";
+  version = "2.6.4";
 
   src = fetchFromGitHub {
     owner = "libigl";
     repo = "libigl";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-uef7aTF2U3iPVAWDGRIsH0YV0l/w8VxtYFPYVkuC1dI=";
+    hash = "sha256-/+wE3ZgqHWdLMaZZE/j7unrx10nd6sh9+JF5P0HB8i4=";
   };
 
   # We could also properly use CMake, but we would have to heavily patch it
diff --git a/pkgs/by-name/li/libmirage/package.nix b/pkgs/by-name/li/libmirage/package.nix
index 107ad7a7418e..d220aa0b6716 100644
--- a/pkgs/by-name/li/libmirage/package.nix
+++ b/pkgs/by-name/li/libmirage/package.nix
@@ -27,11 +27,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libmirage";
-  version = "3.3.2";
+  version = "3.3.3";
 
   src = fetchurl {
     url = "mirror://sourceforge/cdemu/libmirage-${finalAttrs.version}.tar.xz";
-    hash = "sha256-wMAzJpEue1QnDllWheFk3ZX+8pSkYw13s+GU0G/AOfs=";
+    hash = "sha256-tICwgjCyJVr0DDrIY0TAx3/JloZgFOBaadVVTpA11ls=";
   };
 
   env = {
diff --git a/pkgs/by-name/ll/llama-cpp/package.nix b/pkgs/by-name/ll/llama-cpp/package.nix
index bc3729b62053..a2af6b5e8025 100644
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@@ -48,8 +48,8 @@
 let
   # Upstream reads these from git, which the release tarball does not ship.
   # They are purely informational: `llama-server --version`, `/props`, and the web UI.
-  buildNumber = "10809";
-  buildCommit = "5266f24";
+  buildNumber = "10964";
+  buildCommit = "b29c606";
 
   # It's necessary to consistently use backendStdenv when building with CUDA support,
   # otherwise we get libstdc++ errors downstream.
@@ -87,7 +87,7 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
   pname = "llama-cpp";
-  version = "0.4.0";
+  version = "0.4.1";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -101,7 +101,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
     owner = "ggml-org";
     repo = "llama.cpp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WImZjO3U9EXZUNP/FMpxo8PaTjQW8X2SBTfGwwFlZIM=";
+    hash = "sha256-qu/K1RdJMzOxWr+qnHorpMB4650uctBHW/Og+4oDVLM=";
   };
 
   patches = [ ];
diff --git a/pkgs/by-name/me/meilisearch/package.nix b/pkgs/by-name/me/meilisearch/package.nix
index 3d5460bfea88..274dad368412 100644
--- a/pkgs/by-name/me/meilisearch/package.nix
+++ b/pkgs/by-name/me/meilisearch/package.nix
@@ -8,18 +8,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "meilisearch";
-  version = "1.53.1";
+  version = "1.53.2";
 
   src = fetchFromGitHub {
     owner = "meilisearch";
     repo = "meilisearch";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-MQ3W8Y4ewJZA+ciBGKjGuV90ae4RaMJS+PIjCGGOV7A=";
+    hash = "sha256-bbVuB8brplUAqKrmTBah4HKbmshv0n5Hn2v9hUnY62c=";
   };
 
   cargoBuildFlags = [ "--package=meilisearch" ];
 
-  cargoHash = "sha256-Rovn1xw3Bg7J+FeIMHQP2BW5IpDyCORud8VXIU8UpqI=";
+  cargoHash = "sha256-ojRJPL3EHyGmWHcX5SLv11fkP1pUNKrYkd82GEC4zKE=";
 
   # Default features include mini dashboard which downloads something from the internet.
   buildNoDefaultFeatures = true;
diff --git a/pkgs/by-name/mp/mpd-mpris/package.nix b/pkgs/by-name/mp/mpd-mpris/package.nix
index edaabd5af9e7..abac75602421 100644
--- a/pkgs/by-name/mp/mpd-mpris/package.nix
+++ b/pkgs/by-name/mp/mpd-mpris/package.nix
@@ -2,31 +2,23 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
-  fetchpatch,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "mpd-mpris";
-  version = "0.4.3";
+  version = "0.4.4";
 
   src = fetchFromGitHub {
     owner = "natsukagami";
     repo = "mpd-mpris";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-w8OH34JW++OYLpNIHfQvc45dFyU/wVWVa+vEwWb8VqU=";
+    hash = "sha256-EOZiOFBe5j1WsrJLj8++QsgNUZR44M6ae40KKl2Qac8=";
   };
 
   vendorHash = "sha256-ugJEw02jSsfObljDaup31zoQlf2HvwDRUljD7lp7Ys4=";
 
   subPackages = [ "cmd/mpd-mpris" ];
 
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/natsukagami/mpd-mpris/commit/1591f15548aed0f9741d723f24fb505cb24fafe8.patch";
-      hash = "sha256-6ZqR4woKiIjwLxyafmidTM8eBXtvBzKNXZvtS1+KKKI=";
-    })
-  ];
-
   postPatch = ''
     substituteInPlace services/mpd-mpris.service --replace-fail "ExecStart=" "ExecStart=$out/bin/"
   '';
diff --git a/pkgs/by-name/mu/munge/package.nix b/pkgs/by-name/mu/munge/package.nix
index 7fc62723aa80..e9cbe3925848 100644
--- a/pkgs/by-name/mu/munge/package.nix
+++ b/pkgs/by-name/mu/munge/package.nix
@@ -3,7 +3,7 @@
   stdenv,
   fetchFromGitHub,
   autoreconfHook,
-  libgcrypt,
+  openssl,
   zlib,
   bzip2,
   nixosTests,
@@ -28,11 +28,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     autoreconfHook
-    libgcrypt # provides libgcrypt.m4
   ];
 
   buildInputs = [
-    libgcrypt
+    openssl
     zlib
     bzip2
   ];
@@ -50,8 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
     "--with-pkgconfigdir=${placeholder "out"}/lib/pkgconfig"
     "--with-systemdunitdir=${placeholder "out"}/lib/systemd/system"
 
-    # Cross-compilation hacks
-    "--with-libgcrypt-prefix=${lib.getDev libgcrypt}"
+    "--with-crypto-lib=openssl"
     # workaround for cross compilation: https://github.com/dun/munge/issues/103
     "ac_cv_file__dev_spx=no"
     "x_ac_cv_check_fifo_recvfd=no"
diff --git a/pkgs/by-name/ne/neowall/package.nix b/pkgs/by-name/ne/neowall/package.nix
index e4d713dd8948..73921d16ef44 100644
--- a/pkgs/by-name/ne/neowall/package.nix
+++ b/pkgs/by-name/ne/neowall/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "neowall";
-  version = "0.6.1";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "1ay1";
     repo = "neowall";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JzLp6/mJrYRq28XAIccsOxrG/RTDfWIojmmp1oQmiwI=";
+    hash = "sha256-yxEC5PlTRg4U7M8I7/2jL48Qw/CX3F2phz6zxL6xfYU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ne/networkmanager/package.nix b/pkgs/by-name/ne/networkmanager/package.nix
index d9f5329e9e50..43d811da50bb 100644
--- a/pkgs/by-name/ne/networkmanager/package.nix
+++ b/pkgs/by-name/ne/networkmanager/package.nix
@@ -48,7 +48,6 @@
   ethtool,
   iptables,
   kmod,
-  libgcrypt,
   libndp,
   modemmanager,
   mobile-broadband-provider-info,
@@ -231,7 +230,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   propagatedBuildInputs = [
     gnutls
-    libgcrypt
   ];
 
   nativeInstallCheckInputs = [ udevCheckHook ];
diff --git a/pkgs/by-name/pl/playwright-mcp/package.nix b/pkgs/by-name/pl/playwright-mcp/package.nix
index 7d2772508e9f..f573d0ab6ced 100644
--- a/pkgs/by-name/pl/playwright-mcp/package.nix
+++ b/pkgs/by-name/pl/playwright-mcp/package.nix
@@ -9,16 +9,16 @@
 buildNpmPackage rec {
   pname = "playwright-mcp";
   # nixpkgs-update: no auto update
-  version = "0.0.78";
+  version = "0.0.80";
 
   src = fetchFromGitHub {
     owner = "Microsoft";
     repo = "playwright-mcp";
     tag = "v${version}";
-    hash = "sha256-k5dhHABKZqph3RzFcJjD+/RcMB+lZZ0UiS6eNGyAEtE=";
+    hash = "sha256-pIePGuIxBaHqvP6QVLzGSef0uarYE+X/rs3LWZEU22U=";
   };
 
-  npmDepsHash = "sha256-Oe0jtvxKyQMQ6uSwBQoGisvv4n0lR6EcyElzh9GHZac=";
+  npmDepsHash = "sha256-3T4XNZSUL5sbcHmWfn9Dfigu635FACVEZ/EHSKYu1+8=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/by-name/pl/plezy/aarch64-linux.patch b/pkgs/by-name/pl/plezy/aarch64-linux.patch
index 1a6f1f72319d..5c5008a8abd6 100644
--- a/pkgs/by-name/pl/plezy/aarch64-linux.patch
+++ b/pkgs/by-name/pl/plezy/aarch64-linux.patch
@@ -1,35 +1,17 @@
 diff --git a/lib/theme/mono_theme.dart b/lib/theme/mono_theme.dart
-index 5b87737c..3873fe84 100644
+index f750336..7790e50 100644
 --- a/lib/theme/mono_theme.dart
 +++ b/lib/theme/mono_theme.dart
-@@ -61,7 +61,7 @@ ThemeData _buildMonoTheme({required bool dark, required bool oled, required Targ
- 
-   final base = ThemeData(
-     platform: platform,
--    useMaterial3: true,
-+    useMaterial3: true, fontFamily: 'NotoSans',
-     brightness: isDark ? Brightness.dark : Brightness.light,
-     colorScheme: ColorScheme(
-       brightness: isDark ? Brightness.dark : Brightness.light,
-@@ -108,7 +108,7 @@ ThemeData _buildMonoTheme({required bool dark, required bool oled, required Targ
+@@ -112,7 +112,11 @@ ThemeData _buildMonoTheme({required bool dark, required bool oled, required Targ
        titleTextStyle: TextStyle(color: c.text, fontSize: 18, fontWeight: .w700, letterSpacing: -0.2),
      ),
      textTheme: Typography.englishLike2021
 -        .apply(bodyColor: c.text, displayColor: c.text)
-+        .apply(fontFamily: 'NotoSans', bodyColor: c.text, displayColor: c.text)
++        .apply(
++          fontFamilyFallback: const ['Go Noto Current', 'Go Noto Current Hangul'],
++          bodyColor: c.text,
++          displayColor: c.text,
++        )
          .copyWith(
            displayLarge: const TextStyle(fontWeight: .w700, letterSpacing: -0.5),
            titleMedium: const TextStyle(fontWeight: .w600),
-diff --git a/pubspec.yaml b/pubspec.yaml
-index 68f20256..419cc1d6 100644
---- a/pubspec.yaml
-+++ b/pubspec.yaml
-@@ -152,3 +152,8 @@ flutter:
-     - assets/shaders/anime4k/
-     - assets/player_icons/
-     - assets/rating_icons/
-+
-+  fonts:
-+    - family: NotoSans
-+      fonts:
-+        - asset: assets/fonts/NotoSans.ttc
diff --git a/pkgs/by-name/pl/plezy/git-hashes.json b/pkgs/by-name/pl/plezy/git-hashes.json
index 16c1b15f1568..ca78d7fb3e95 100644
--- a/pkgs/by-name/pl/plezy/git-hashes.json
+++ b/pkgs/by-name/pl/plezy/git-hashes.json
@@ -3,7 +3,7 @@
   "auto_updater_macos": "sha256-787cMkeT2BlfwVcy4y46XkWioNqLKJgQ/CCxQvERa+A=",
   "auto_updater_platform_interface": "sha256-787cMkeT2BlfwVcy4y46XkWioNqLKJgQ/CCxQvERa+A=",
   "auto_updater_windows": "sha256-787cMkeT2BlfwVcy4y46XkWioNqLKJgQ/CCxQvERa+A=",
-  "background_downloader": "sha256-x1Z+Nlyvy+cc1EdRUikqZMDjVKdGHe7FOH2Yx9K0zhE=",
+  "background_downloader": "sha256-ebNPYQVvMHX0lExBt3V+9k8cVtGFTSNPG457GH/+iVo=",
   "connectivity_plus": "sha256-sVUG5/6GF0Eu47BgUCkgbGi8w1ip5o0yQS00NnNjAGs=",
   "os_media_controls": "sha256-cNNTqIVJy9Yo7IrBAbIQFngOCT6ccWnOHVti7B/5jsQ="
 }
diff --git a/pkgs/by-name/pl/plezy/package.nix b/pkgs/by-name/pl/plezy/package.nix
index b6eb1fb124d0..6c261b76738a 100644
--- a/pkgs/by-name/pl/plezy/package.nix
+++ b/pkgs/by-name/pl/plezy/package.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   stdenvNoCC,
-  flutter344,
+  flutter347,
   fetchFromGitHub,
   fetchurl,
   pkg-config,
@@ -21,17 +21,16 @@
   _7zz,
   makeBinaryWrapper,
   runCommand,
-  noto-fonts-cjk-sans ? null,
 }:
 let
   pname = "plezy";
-  version = "2.19.1";
+  version = "2.20.0";
 
   src = fetchFromGitHub {
     owner = "edde746";
     repo = "plezy";
     tag = version;
-    hash = "sha256-vafKdaMUR6O3QzsPbMc/cW4cPmKxe9nDEe7bfIvfVFA=";
+    hash = "sha256-q0oGOAHco7wWS8P2sUdplZS/Rvlh4a1/MVfRbrETQ/0=";
   };
 
   simdutf = fetchurl {
@@ -48,6 +47,7 @@ let
   meta = {
     description = "Modern cross-platform Emby, Plex & Jellyfin client built with Flutter";
     homepage = "https://github.com/edde746/plezy";
+    changelog = "https://github.com/edde746/plezy/releases/tag/${version}";
     mainProgram = "plezy";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [
@@ -63,7 +63,7 @@ let
     );
   };
 
-  linux = flutter344.buildFlutterApplication rec {
+  linux = flutter347.buildFlutterApplication rec {
     inherit pname version src;
 
     pubspecLock = lib.importJSON ./pubspec.lock.json;
@@ -101,11 +101,6 @@ let
       substituteInPlace linux/CMakeLists.txt \
         --replace-fail "URL https://github.com/simdutf/simdutf/releases/download/v6.4.2/singleheader.zip" \
                        "URL file://${simdutf}"
-    ''
-    + lib.optionalString (stdenv.hostPlatform.system == "aarch64-linux") ''
-      # Opt-in workaround for invisible text on aarch64-linux systems. Text was invisible; bundling the font as a Dart asset fixed it,
-      # unknown why.
-      install -Dm644 ${noto-fonts-cjk-sans}/share/fonts/opentype/noto-cjk/NotoSansCJK-VF.otf.ttc assets/fonts/NotoSans.ttc
     '';
 
     desktopItems = [
@@ -143,7 +138,7 @@ let
 
     src = fetchurl {
       url = "https://github.com/edde746/plezy/releases/download/${version}/plezy-macos.dmg";
-      hash = "sha256-fT/9DvzPTbX68GPo7MA+iX7jDQjp+jsAfRJ8Y8vxh+I=";
+      hash = "sha256-cQ5lGdhnWnfVUI6fqx8pk5zgdaQrZbZxD5mSwVpTbmM=";
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/by-name/pl/plezy/pubspec.lock.json b/pkgs/by-name/pl/plezy/pubspec.lock.json
index 821d1a1b11e7..9f859c3f2f24 100644
--- a/pkgs/by-name/pl/plezy/pubspec.lock.json
+++ b/pkgs/by-name/pl/plezy/pubspec.lock.json
@@ -50,6 +50,16 @@
       "source": "hosted",
       "version": "2.0.3"
     },
+    "archive": {
+      "dependency": "direct dev",
+      "description": {
+        "name": "archive",
+        "sha256": "ace891da0862b0e4cabbb064ee3fd87b2728b898949fdb366d83fe98342c9f19",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "4.2.0"
+    },
     "args": {
       "dependency": "transitive",
       "description": {
@@ -118,8 +128,8 @@
       "dependency": "direct main",
       "description": {
         "path": ".",
-        "ref": "12ef3ff758709e3ceab8eccd6d43e0dea1c68ca1",
-        "resolved-ref": "12ef3ff758709e3ceab8eccd6d43e0dea1c68ca1",
+        "ref": "c52103f4a2d683c22ce3b8b8661da610644bfef1",
+        "resolved-ref": "c52103f4a2d683c22ce3b8b8661da610644bfef1",
         "url": "https://github.com/edde746/background_downloader"
       },
       "source": "git",
@@ -307,7 +317,7 @@
       "version": "7.2.0"
     },
     "connectivity_plus_platform_interface": {
-      "dependency": "transitive",
+      "dependency": "direct dev",
       "description": {
         "name": "connectivity_plus_platform_interface",
         "sha256": "3c09627c536d22fd24691a905cdd8b14520de69da52c7a97499c8be5284a32ed",
@@ -610,16 +620,6 @@
       "source": "hosted",
       "version": "2.1.3"
     },
-    "globbing": {
-      "dependency": "transitive",
-      "description": {
-        "name": "globbing",
-        "sha256": "4f89cfaf6fa74c9c1740a96259da06bd45411ede56744e28017cc534a12b6e2d",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "1.0.0"
-    },
     "graphs": {
       "dependency": "transitive",
       "description": {
@@ -690,16 +690,6 @@
       "source": "hosted",
       "version": "4.1.2"
     },
-    "injector": {
-      "dependency": "transitive",
-      "description": {
-        "name": "injector",
-        "sha256": "ed389bed5b48a699d5b9561c985023d0d5cc88dd5ff2237aadcce5a5ab433e4e",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "3.0.0"
-    },
     "intl": {
       "dependency": "direct main",
       "description": {
@@ -1091,6 +1081,16 @@
       "source": "hosted",
       "version": "1.5.2"
     },
+    "posix": {
+      "dependency": "transitive",
+      "description": {
+        "name": "posix",
+        "sha256": "bc1bad54ad2b735816e31f8d4600cfde6c7839975085ddfbca48b6c9f7c4044e",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "6.5.2"
+    },
     "process": {
       "dependency": "transitive",
       "description": {
@@ -1101,16 +1101,6 @@
       "source": "hosted",
       "version": "5.0.5"
     },
-    "properties": {
-      "dependency": "transitive",
-      "description": {
-        "name": "properties",
-        "sha256": "333f427dd4ed07bdbe8c75b9ff864a1e70b5d7a8426a2e8bdd457b65ae5ac598",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "2.1.1"
-    },
     "provider": {
       "dependency": "direct main",
       "description": {
@@ -1280,16 +1270,6 @@
       "source": "hosted",
       "version": "9.25.0"
     },
-    "sentry_dart_plugin": {
-      "dependency": "direct dev",
-      "description": {
-        "name": "sentry_dart_plugin",
-        "sha256": "da9c1d0b3c87a251bfc36301f16af090a88c2d59128fe9a6f908f5ac20340c97",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "3.4.0"
-    },
     "sentry_flutter": {
       "dependency": "direct main",
       "description": {
@@ -1534,16 +1514,6 @@
       "source": "hosted",
       "version": "2.2.0"
     },
-    "system_info2": {
-      "dependency": "transitive",
-      "description": {
-        "name": "system_info2",
-        "sha256": "b937736ecfa63c45b10dde1ceb6bb30e5c0c340e14c441df024150679d65ac43",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "4.1.0"
-    },
     "term_glyph": {
       "dependency": "transitive",
       "description": {
diff --git a/pkgs/by-name/pr/prometheus/package.nix b/pkgs/by-name/pr/prometheus/package.nix
index e015a7ba9c2a..0bbebfb81ba6 100644
--- a/pkgs/by-name/pr/prometheus/package.nix
+++ b/pkgs/by-name/pr/prometheus/package.nix
@@ -1,6 +1,7 @@
 {
   stdenv,
   lib,
+  nix-update-script,
   go,
   buildGoModule,
   nodejs,
@@ -37,9 +38,7 @@
 }:
 
 let
-  source = import ./source.nix;
-
-  inherit (source) version vendorHash;
+  version = "3.14.0";
 
   pname = "prometheus";
 
@@ -47,7 +46,7 @@ let
     owner = "prometheus";
     repo = "prometheus";
     tag = "v${version}";
-    hash = source.hash;
+    hash = "sha256-7PSfh+KWUpmL3BZ7INa1DOZ/ysaXXdWG9n/F+H0cGYo=";
   };
 
   assets = stdenv.mkDerivation (finalAssetsAttrs: {
@@ -66,7 +65,7 @@ let
       inherit (finalAssetsAttrs) pname version src;
       pnpm = pnpm_11;
       fetcherVersion = 4;
-      hash = source.pnpmDepsHash;
+      hash = "sha256-lmKUkeDdinb6WlnZSx3FnBlF/ACgUmvSMpYo84tRdCw=";
     };
 
     nativeBuildInputs = [
@@ -111,10 +110,11 @@ buildGoModule (finalAttrs: {
   inherit
     pname
     version
-    vendorHash
     src
     ;
 
+  vendorHash = "sha256-sCgxO2/w3Bi6Ncs/Q+JVZVtQC448FEx3llYxe/UxWEE=";
+
   proxyVendor = true;
 
   outputs = [
@@ -234,7 +234,12 @@ buildGoModule (finalAttrs: {
   passthru = {
     inherit assets;
     tests = { inherit (nixosTests) prometheus; };
-    updateScript = ./update.sh;
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--subpackage"
+        "assets"
+      ];
+    };
   };
 
   meta = {
diff --git a/pkgs/by-name/pr/prometheus/source.nix b/pkgs/by-name/pr/prometheus/source.nix
deleted file mode 100644
index 32703128ddba..000000000000
--- a/pkgs/by-name/pr/prometheus/source.nix
+++ /dev/null
@@ -1,6 +0,0 @@
-{
-  version = "3.14.0";
-  hash = "sha256-7PSfh+KWUpmL3BZ7INa1DOZ/ysaXXdWG9n/F+H0cGYo=";
-  pnpmDepsHash = "sha256-lmKUkeDdinb6WlnZSx3FnBlF/ACgUmvSMpYo84tRdCw=";
-  vendorHash = "sha256-sCgxO2/w3Bi6Ncs/Q+JVZVtQC448FEx3llYxe/UxWEE=";
-}
diff --git a/pkgs/by-name/pr/prometheus/update.sh b/pkgs/by-name/pr/prometheus/update.sh
deleted file mode 100755
index 489a092aac61..000000000000
--- a/pkgs/by-name/pr/prometheus/update.sh
+++ /dev/null
@@ -1,88 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p nix coreutils curl jq nix-prefetch-git
-
-set -euo pipefail
-
-OWNER=prometheus
-REPO=prometheus
-
-# Current version.
-LATEST_NIXPKGS_VERSION=$(nix eval --raw .#prometheus.version 2>/dev/null)
-UPDATE_NIX_OLD_VERSION=${UPDATE_NIX_OLD_VERSION:-$LATEST_NIXPKGS_VERSION}
-
-TARGET_TAG="$(curl -L -s ${GITHUB_TOKEN:+-u ":${GITHUB_TOKEN}"} "https://api.github.com/repos/$OWNER/$REPO/releases/latest" | jq -r '.tag_name')"
-TARGET_VERSION="$(echo "$TARGET_TAG" | sed -e 's/^v//')"
-
-if [[ "$UPDATE_NIX_OLD_VERSION" == "$TARGET_VERSION" ]]; then
-    # prometheus is up-to-date
-    if [[ -n "$UPDATE_NIX_ATTR_PATH" ]]; then
-        echo "[{}]";
-    fi
-
-    exit 0
-fi
-
-FAKE_HASH="sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
-
-extractHash() {
-    attr="${1?attr missing}"
-    result="$(nix-build -A "$attr" 2>&1 | tail -n3 | grep 'got:' | cut -d: -f2- | xargs echo || true)"
-    [ -z "$result" ] && { echo "$FAKE_HASH"; } || { echo "$result"; }
-}
-
-TMP=$(mktemp -d)
-trap 'rm -rf "$TMP"' EXIT
-
-NIXPKGS_PROMETHEUS_PATH=$(cd $(dirname ${BASH_SOURCE[0]}); pwd -P)/
-SOURCE_NIX="$NIXPKGS_PROMETHEUS_PATH/source.nix"
-
-PREFETCH_JSON=$TMP/prefetch.json
-nix-prefetch-git --rev "$TARGET_TAG" --url "https://github.com/$OWNER/$REPO" > "$PREFETCH_JSON"
-PREFETCH_HASH="$(jq '.hash' -r < "$PREFETCH_JSON")"
-
-cat > "$SOURCE_NIX" <<-EOF
-{
-  version = "$TARGET_VERSION";
-  hash = "$PREFETCH_HASH";
-  pnpmDepsHash = "$FAKE_HASH";
-  vendorHash = "$FAKE_HASH";
-}
-EOF
-
-# Resolve pnpm hash first: the Go integration pulls in the assets, so a fake
-# pnpmDepsHash makes that stage fail.
-PNPM_DEPS_HASH=$(extractHash prometheus.assets.pnpmDeps)
-
-cat > "$SOURCE_NIX" <<-EOF
-{
-  version = "$TARGET_VERSION";
-  hash = "$PREFETCH_HASH";
-  pnpmDepsHash = "$PNPM_DEPS_HASH";
-  vendorHash = "$FAKE_HASH";
-}
-EOF
-
-# Now do the Go module fetch.
-VENDOR_HASH=$(extractHash prometheus.goModules)
-
-cat > "$SOURCE_NIX" <<-EOF
-{
-  version = "$TARGET_VERSION";
-  hash = "$PREFETCH_HASH";
-  pnpmDepsHash = "$PNPM_DEPS_HASH";
-  vendorHash = "$VENDOR_HASH";
-}
-EOF
-
-if [[ -z "$UPDATE_NIX_ATTR_PATH" ]]; then
-    exit 0
-fi
-
-cat <<-EOF
-[{
-  "attrPath": "$UPDATE_NIX_ATTR_PATH",
-  "oldVersion": "$UPDATE_NIX_OLD_VERSION",
-  "newVersion": "$TARGET_VERSION",
-  "files": ["$SOURCE_NIX"]
-}]
-EOF
diff --git a/pkgs/by-name/sa/sandbox-runtime/package.nix b/pkgs/by-name/sa/sandbox-runtime/package.nix
index 7123e070cd3c..3b3989def24d 100644
--- a/pkgs/by-name/sa/sandbox-runtime/package.nix
+++ b/pkgs/by-name/sa/sandbox-runtime/package.nix
@@ -17,7 +17,7 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "sandbox-runtime";
-  version = "0.0.75";
+  version = "0.0.76";
 
   __structuredAttrs = true;
 
@@ -25,7 +25,7 @@ buildNpmPackage (finalAttrs: {
     owner = "anthropic-experimental";
     repo = "sandbox-runtime";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TfxVceVav2zw2L6D1hbQWOzVQZ4v/hZLollKysqZnKQ=";
+    hash = "sha256-NXr4OuTsHl8oD8oyzwlNuDoZOy2zNh6tWEr7q4KYKwI=";
   };
 
   postPatch =
@@ -37,7 +37,7 @@ buildNpmPackage (finalAttrs: {
 
   strictDeps = true;
 
-  npmDepsHash = "sha256-I7ebBTyRMBLmKE5wB8VEvKlB3Tjx2rbaKLFdMt0wbmg=";
+  npmDepsHash = "sha256-r49lP4aD7kAG7azGH3MAvXnVu2LwlpyToDMmErzdunw=";
 
   postFixup =
     let
diff --git a/pkgs/by-name/sc/scalingo/package.nix b/pkgs/by-name/sc/scalingo/package.nix
index c691a5c65243..214429945d94 100644
--- a/pkgs/by-name/sc/scalingo/package.nix
+++ b/pkgs/by-name/sc/scalingo/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "scalingo";
-  version = "1.48.0";
+  version = "1.49.0";
 
   src = fetchFromGitHub {
     owner = "scalingo";
     repo = "cli";
     rev = version;
-    hash = "sha256-vwTgr9zzRo4/o3D9p/jcmwKskmjClj4sfd8zalK7PDg=";
+    hash = "sha256-U3OG0rmZMN/uTeXSA7A7pdG6PYR65h836rSYAsRp6yQ=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/se/september/package.nix b/pkgs/by-name/se/september/package.nix
index 0ba2ffa37479..221dcf460804 100644
--- a/pkgs/by-name/se/september/package.nix
+++ b/pkgs/by-name/se/september/package.nix
@@ -9,17 +9,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "september";
-  version = "0.4.1";
+  version = "0.5.0";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "gemrest";
     repo = "september";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-45xxiz93UhCCJFr3s0+Sgl4LMrUvRbMums1ZNngA1AY=";
+    hash = "sha256-g50hWDuf5TgzI8vfQAAkNYZs6UTIve7IX+fNTWzxu4w=";
   };
 
-  cargoHash = "sha256-rpMnRx4/LdsVjAteY2LFm2j94XjneZ5E6c+pgZXOOr8=";
+  cargoHash = "sha256-tOoiIKeG/b1l/TpTD1K1ZRhVDcWxNILhKqLpJp7QIec=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/sh/shelter/package.nix b/pkgs/by-name/sh/shelter/package.nix
index 0d118d895c8b..9133a9a0642e 100644
--- a/pkgs/by-name/sh/shelter/package.nix
+++ b/pkgs/by-name/sh/shelter/package.nix
@@ -10,12 +10,12 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "shelter";
-  version = "0-unstable-2026-08-14";
+  version = "0-unstable-2026-09-06";
   src = fetchFromGitHub {
     owner = "uwu";
     repo = "shelter";
-    rev = "d7cc2ce46e94c0dbbd28af741cb2f0c09d1b77fc";
-    hash = "sha256-HFfggRZHVtkxvphllcYsbKa+CaifvUfb8tkhv7awrF4=";
+    rev = "ee10d4ecb2fd62fb86ebfdbd37a4e28df9e72f11";
+    hash = "sha256-Ew6RUhIS2gRuCNkbNCNtlmtYSGtjBR4h+UebuDVWhmk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/si/sigtop/package.nix b/pkgs/by-name/si/sigtop/package.nix
index b27676cb7d35..bed1b7ae1dfd 100644
--- a/pkgs/by-name/si/sigtop/package.nix
+++ b/pkgs/by-name/si/sigtop/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "sigtop";
-  version = "0.24.1";
+  version = "0.26.0";
 
   src = fetchFromGitHub {
     owner = "tbvdm";
     repo = "sigtop";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-zGDH3qdRI5yzcqEDH9sBg/7842qafCnf2Mc1W35iXY4=";
+    sha256 = "sha256-ZI4GuXWeLuEIKEQtsv6nugsfIc/Dlj2JYoVVmAr2O28=";
   };
 
-  vendorHash = "sha256-6pNBYziJvJ1MMjzcbIjPFAUTW6ZrCNmtYzzAS/ANtEw=";
+  vendorHash = "sha256-NyZTLut10DBNlBYIXjRB9zL98ZZ/A6hu0ypsu3GjHq8=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ libsecret ];
diff --git a/pkgs/by-name/so/sogo/package.nix b/pkgs/by-name/so/sogo/package.nix
index 366371d0e079..82447f6f940d 100644
--- a/pkgs/by-name/so/sogo/package.nix
+++ b/pkgs/by-name/so/sogo/package.nix
@@ -58,6 +58,12 @@ clangStdenv.mkDerivation rec {
   patches = lib.optional enableActiveSync ./enable-activesync.patch;
 
   postPatch = ''
+    # Don't record the compile command line in .GCC.command.line sections of
+    # the installed binaries: it embeds the store paths of the whole toolchain
+    # and turns clang, llvm and gcc into runtime dependencies.
+    substituteInPlace general.make \
+      --replace-fail ' $(call cc-option,-frecord-gcc-switches)' ""
+
     # Exclude NIX_ variables
     sed -i 's/grep GNUSTEP_/grep ^GNUSTEP_/g' configure
 
diff --git a/pkgs/by-name/so/sope/package.nix b/pkgs/by-name/so/sope/package.nix
index 652003a12876..e8765ddaa781 100644
--- a/pkgs/by-name/so/sope/package.nix
+++ b/pkgs/by-name/so/sope/package.nix
@@ -23,6 +23,14 @@ clangStdenv.mkDerivation rec {
     hash = "sha256-0G28qDXygDe/TJ2znNE+NVQry3bkqUO59jqtJm/t2S4=";
   };
 
+  postPatch = ''
+    # Don't record the compile command line in .GCC.command.line sections of
+    # the installed binaries: it embeds the store paths of the whole toolchain
+    # and turns clang, llvm and gcc into runtime dependencies.
+    substituteInPlace general.make \
+      --replace-fail ' $(call cc-option,-frecord-gcc-switches)' ""
+  '';
+
   nativeBuildInputs = lib.optional (libpq != null) libpq.pg_config;
   buildInputs = [
     gnustep-base
diff --git a/pkgs/by-name/ta/tabbyapi/package.nix b/pkgs/by-name/ta/tabbyapi/package.nix
index 74fcf6722359..58a6e39e1a23 100644
--- a/pkgs/by-name/ta/tabbyapi/package.nix
+++ b/pkgs/by-name/ta/tabbyapi/package.nix
@@ -7,14 +7,14 @@
 }:
 python3Packages.buildPythonApplication {
   pname = "tabbyapi";
-  version = "0-unstable-2026-09-07";
+  version = "0-unstable-2026-09-14";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "theroyallab";
     repo = "tabbyAPI";
-    rev = "92198cca1aa48f83121027f5b9058c24d7c2d894";
-    hash = "sha256-IQDsfTnIcaVmxk58Q8StEPS4O7LQwPVie6b04BWoeeQ=";
+    rev = "53da7919d4e45c63f4acbcbbc00cbe0f60a1ce65";
+    hash = "sha256-oKVxMoyMWZCuwLbsimTXO05Hdsw/2u2SVeYSFm1XsFg=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/to/todoist-cli/package.nix b/pkgs/by-name/to/todoist-cli/package.nix
index 2ac2726523d0..460bca685547 100644
--- a/pkgs/by-name/to/todoist-cli/package.nix
+++ b/pkgs/by-name/to/todoist-cli/package.nix
@@ -7,16 +7,16 @@
 }:
 buildNpmPackage rec {
   pname = "todoist-cli";
-  version = "5.2.1";
+  version = "5.3.6";
 
   src = fetchFromGitHub {
     owner = "Doist";
     repo = "todoist-cli";
     rev = "v${version}";
-    sha256 = "sha256-RYk1MSL15dt8aTeRxNPcVNYXnaDRURiITfMEBqR4DIA=";
+    sha256 = "sha256-x1zoHqNXWCwv2wQS56H3Z5DUxWTXFbcaYlupOvm/lfs=";
   };
 
-  npmDepsHash = "sha256-JDFKNVm8G/s4fVsXjKzh0DWmqXDbTJ7huv3LO5mq+rU=";
+  npmDepsHash = "sha256-ll3UnmbJrvzv6F5LvhJRMkyA3FRxaiJvVCwk0Wy81Ks=";
 
   doCheck = true;
 
diff --git a/pkgs/by-name/tu/tuicr/package.nix b/pkgs/by-name/tu/tuicr/package.nix
index 1ca9b6bb95c9..8e50cd89d3dd 100644
--- a/pkgs/by-name/tu/tuicr/package.nix
+++ b/pkgs/by-name/tu/tuicr/package.nix
@@ -9,7 +9,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tuicr";
-  version = "0.25.0";
+  version = "0.26.0";
 
   __structuredAttrs = true;
 
@@ -17,10 +17,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "agavra";
     repo = "tuicr";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-nbjvSRrbJ4LQrn8l0FJ8R5PNpq7gcQR8m78agL59zqs=";
+    hash = "sha256-eu6+jDsCHLWPqMTSWTgtTr9bFiYYAAPFWfR+5dGgefE=";
   };
 
-  cargoHash = "sha256-9L1G0O5kE9EOFAQ092R/C9/SC48K0YcD5D2WjEvkeK0=";
+  cargoHash = "sha256-WrWoTPgdUNF0xQ/Q0GbPGwcOMP5i3clBmyeHcFMsNso=";
 
   strictDeps = true;
 
diff --git a/pkgs/by-name/us/usbvfiod/package.nix b/pkgs/by-name/us/usbvfiod/package.nix
index 5547c1948b70..706b04da98aa 100644
--- a/pkgs/by-name/us/usbvfiod/package.nix
+++ b/pkgs/by-name/us/usbvfiod/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "usbvfiod";
-  version = "0.2.0";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "cyberus-technology";
     repo = "usbvfiod";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-gus0Bdsd0zUuhsAQ4I1Z/BphKOjAlmbpqND6W+6cNbg=";
+    hash = "sha256-gYKWmUaB7c5netQjR7qHKuBq82X3J+o4gQCsB/3cq50=";
   };
 
-  cargoHash = "sha256-7RTaWi93WJV2HEVyljSzRVG+eCwo6+Ywq4Y+ng1UMww=";
+  cargoHash = "sha256-B4iyADjXjX7VdGaTIdCKUalwJt6vMVnqqUCyLsu5wUI=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/by-name/va/vacuum-go/package.nix b/pkgs/by-name/va/vacuum-go/package.nix
index b579053d6ceb..ecb33bd37cc4 100644
--- a/pkgs/by-name/va/vacuum-go/package.nix
+++ b/pkgs/by-name/va/vacuum-go/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "vacuum-go";
-  version = "0.30.3";
+  version = "0.30.6";
 
   src = fetchFromGitHub {
     owner = "daveshanley";
     repo = "vacuum";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-FIKkT3u2/9O9mosM6myFs5WvYa6WC7T4O/CcGuIdbDQ=";
+    hash = "sha256-27ZGWy9lblCAlvodpmgyhHaS2uHP5gpM8SDh44agdZ8=";
   };
 
-  vendorHash = "sha256-IX80z+3IpgZPqdklJzTZyOlLDM6Qbw8y1Q344r5TYpc=";
+  vendorHash = "sha256-0fKjscF77MubYr+AhvWAk8Oh0OQP948vGW8zbwAS1xw=";
 
   env.CGO_ENABLED = 0;
   ldflags = [
diff --git a/pkgs/by-name/va/valkey/package.nix b/pkgs/by-name/va/valkey/package.nix
index 2ebe9558beb6..b6cfce9139d4 100644
--- a/pkgs/by-name/va/valkey/package.nix
+++ b/pkgs/by-name/va/valkey/package.nix
@@ -112,7 +112,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru = {
     tests = {
-      redis = nixosTests.valkey;
+      valkey = nixosTests.valkey;
       unitTests = finalAttrs.finalPackage.overrideAttrs { doCheck = true; };
       valkey-python = python3Packages.valkey;
     };
diff --git a/pkgs/by-name/ve/verifpal/package.nix b/pkgs/by-name/ve/verifpal/package.nix
index 1afcfa1fed91..7b38cde0f324 100644
--- a/pkgs/by-name/ve/verifpal/package.nix
+++ b/pkgs/by-name/ve/verifpal/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "verifpal";
-  version = "0.80.1";
+  version = "1.4.10";
 
   src = fetchFromGitHub {
     owner = "symbolicsoft";
     repo = "verifpal";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-C5k9vXd91m7AZWqSCTw4qxD3onuq/1bMhlIia9XW2II=";
+    hash = "sha256-Cg8qaOGAGRYPacbv4WswcEkQrNRSh5xtO5y6gsUW3x8=";
   };
 
-  cargoHash = "sha256-7qfKG7iUcoKOcyFfDgaCDiXF3eAOO/wGJgu7XocSXZU=";
+  cargoHash = "sha256-c5cnkZD5XPpYab0JOF8L5h7U5GbvHBzLXH1jq4b5Y1w=";
 
   meta = {
     homepage = "https://verifpal.com/";
diff --git a/pkgs/by-name/wa/wakapi/package.nix b/pkgs/by-name/wa/wakapi/package.nix
index e7a4cddf8580..f37ca868e9f4 100644
--- a/pkgs/by-name/wa/wakapi/package.nix
+++ b/pkgs/by-name/wa/wakapi/package.nix
@@ -6,7 +6,7 @@
   nix-update-script,
 }:
 let
-  version = "2.17.6";
+  version = "2.18.0";
 in
 buildGoLatestModule {
   pname = "wakapi";
@@ -16,10 +16,10 @@ buildGoLatestModule {
     owner = "muety";
     repo = "wakapi";
     tag = version;
-    hash = "sha256-fKCfjLh/nf6rRqxdGPWfEY9EDh+5sXSKkvzgq7D4ocE=";
+    hash = "sha256-OjspvyjD+3SQdJwkfdDRYUWY1Ryqtwr6DqrLESlqcDo=";
   };
 
-  vendorHash = "sha256-eyldhpDU5fT7tHdsQZ4qUrPlu1QSYaXX8FgksvAXiOw=";
+  vendorHash = "sha256-4hmBS/9E7YfsYpjcC7sP0MatCVPR55s9Ac/9YEe2FK8=";
 
   # Not a go module required by the project, contains development utilities
   excludedPackages = [ "scripts" ];
diff --git a/pkgs/by-name/wa/wasm-language-tools/package.nix b/pkgs/by-name/wa/wasm-language-tools/package.nix
index 245393150028..906691552167 100644
--- a/pkgs/by-name/wa/wasm-language-tools/package.nix
+++ b/pkgs/by-name/wa/wasm-language-tools/package.nix
@@ -2,6 +2,7 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
+  fetchpatch,
   versionCheckHook,
   _experimental-update-script-combinators,
   nix-update-script,
@@ -19,6 +20,15 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-XyVWNhVDo190/hnKj6A5dDYnlO9/WI0GYJIrkyfUkTw=";
   };
 
+  patches = [
+    # Fix test for Rust 1.98: https://github.com/rust-lang/rust/pull/155527
+    (fetchpatch {
+      name = "update-snapshot-for-rust-1.98.patch";
+      url = "https://github.com/g-plane/wasm-language-tools/commit/d7cabdba9fa90ec74a461dcc6b470288184d6c86.patch";
+      hash = "sha256-dPPMebvNVVtFTURsxGGHTwZ6SM3CDMlZucENzwOO6/4=";
+    })
+  ];
+
   cargoHash = "sha256-VoApXHdD8SF8ZqnDVynxunjVoZ5WKai2Xzw0UYy7hSg=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
diff --git a/pkgs/by-name/we/wealthfolio-server/package.nix b/pkgs/by-name/we/wealthfolio-server/package.nix
index 919513cfb6d6..406c0cc7f896 100644
--- a/pkgs/by-name/we/wealthfolio-server/package.nix
+++ b/pkgs/by-name/we/wealthfolio-server/package.nix
@@ -54,18 +54,18 @@ rustPlatform.buildRustPackage (
     __structuredAttrs = true;
 
     pname = "wealthfolio-server";
-    version = "3.7.0";
+    version = "3.8.0";
 
     src = fetchFromGitHub {
       owner = "wealthfolio";
       repo = "wealthfolio";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-GsI2TrPXEiHKUnUxNNmYf2EveWlg5PJBGh5TYILK0yc=";
+      hash = "sha256-5CqLHnwBzqA+yf/sQM2ie3xuO+5aM5EDA0bhZ6r1VIM=";
     };
 
     cargoRoot = ".";
     buildAndTestSubdir = "apps/server";
-    cargoHash = "sha256-vnmhaAoF3O5N+y3HpYZz+2j/WU1HAA5uyKtxLCJBqA4=";
+    cargoHash = "sha256-PFMmpQhQubMzomvLWMJZrriH9emwEzO/rTFCovzFt6w=";
 
     nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/by-name/wr/wrapGNUstepAppsHook/wrapGNUstepAppsHook.sh b/pkgs/by-name/wr/wrapGNUstepAppsHook/wrapGNUstepAppsHook.sh
index 8218ff1e7746..6c5dfbcaef26 100644
--- a/pkgs/by-name/wr/wrapGNUstepAppsHook/wrapGNUstepAppsHook.sh
+++ b/pkgs/by-name/wr/wrapGNUstepAppsHook/wrapGNUstepAppsHook.sh
@@ -4,6 +4,10 @@ if [[ -z "${__nix_wrapGNUstepAppsHook-}" ]]; then
     # Inherit arguments given in mkDerivation
     gnustepWrapperArgs=(${gnustepWrapperArgs-})
 
+    # NIX_GNUSTEP_SYSTEM_HEADERS is deliberately missing here: it only matters
+    # while compiling and gnustep-base ignores it at run time, so writing it
+    # into the installed config file would only pull the -dev outputs of every
+    # build input into the runtime closure.
     gnustepConfigVars+=(
         GNUSTEP_MAKEFILES
         NIX_GNUSTEP_SYSTEM_APPS
@@ -12,7 +16,6 @@ if [[ -z "${__nix_wrapGNUstepAppsHook-}" ]]; then
         NIX_GNUSTEP_SYSTEM_TOOLS
         NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS
         NIX_GNUSTEP_SYSTEM_LIBRARY
-        NIX_GNUSTEP_SYSTEM_HEADERS
         NIX_GNUSTEP_SYSTEM_LIBRARIES
         NIX_GNUSTEP_SYSTEM_DOC
         NIX_GNUSTEP_SYSTEM_DOC_MAN
@@ -38,30 +41,59 @@ if [[ -z "${__nix_wrapGNUstepAppsHook-}" ]]; then
             fi
         }
 
-        gsAddToIncludeSearchPath() {
-            local -n ref="$1"
+        # Without strictDeps, gnustep-make's environment hook also picks up
+        # native build inputs, so the NIX_GNUSTEP_* paths include the compiler
+        # wrapper and friends. Keeping those in the installed config file would
+        # make the whole toolchain a runtime dependency (~1.6 GB).
+        gsDropBuildOnlyPaths() {
+            local -n pathsRef="$1"
+            local -a kept=()
+            local entry prefix
+            local IFS=:
 
-            if [[ -d "$2" && "${ref-}" != *"$2"* ]]; then
-                if [[ "${ref-}" != "" ]]; then
-                    ref+=" "
-                fi
+            for entry in ${pathsRef-}; do
+                for prefix in "${gnustepRuntimePrefixes[@]}"; do
+                    if [[ "$entry" =~ ^"$prefix"(/|$) ]]; then
+                        kept+=("$entry")
+                        break
+                    fi
+                done
+            done
 
-                ref+="$2"
-            fi
+            pathsRef="${kept[*]}"
         }
 
+        gnustepRuntimePrefixes=()
+
+        for output in ${outputs:-out}; do
+            gnustepRuntimePrefixes+=("${!output}")
+        done
+
+        for pkg in \
+            ${pkgsHostHost+"${pkgsHostHost[@]}"} \
+            ${pkgsHostTarget+"${pkgsHostTarget[@]}"}
+        do
+            gnustepRuntimePrefixes+=("$pkg")
+        done
+
         gsAddToSearchPath NIX_GNUSTEP_SYSTEM_APPS "$out/lib/GNUstep/Applications"
         gsAddToSearchPath NIX_GNUSTEP_SYSTEM_ADMIN_APPS "$out/lib/GNUstep/Applications"
         gsAddToSearchPath NIX_GNUSTEP_SYSTEM_WEB_APPS "$out/lib/GNUstep/WebApplications"
         gsAddToSearchPath NIX_GNUSTEP_SYSTEM_TOOLS "$out/bin"
         gsAddToSearchPath NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS "$out/sbin"
         gsAddToSearchPath NIX_GNUSTEP_SYSTEM_LIBRARY "$out/lib/GNUstep"
-        gsAddToIncludeSearchPath NIX_GNUSTEP_SYSTEM_HEADERS "$out/include"
         gsAddToSearchPath NIX_GNUSTEP_SYSTEM_LIBRARIES "$out/lib"
         gsAddToSearchPath NIX_GNUSTEP_SYSTEM_DOC "$out/share/GNUstep/Documentation"
         gsAddToSearchPath NIX_GNUSTEP_SYSTEM_DOC_MAN "$out/share/man"
         gsAddToSearchPath NIX_GNUSTEP_SYSTEM_DOC_INFO "$out/share/info"
 
+        for var in "${gnustepConfigVars[@]}"; do
+            # GNUSTEP_MAKEFILES is a single path pointing at gnustep-make
+            # rather than a search path assembled from the build environment.
+            [[ "$var" == NIX_GNUSTEP_* ]] || continue
+            gsDropBuildOnlyPaths "$var"
+        done
+
         for var in "${gnustepConfigVars[@]}"; do
             if [[ -n "${!var-}" ]]; then
                 printf '%s="%s"\n' "$var" "${!var}"
diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index 87565c7fb650..4d8406f5f113 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -411,8 +411,8 @@ in
   };
 
   ruby_4_0 = generic {
-    version = rubyVersion "4" "0" "6" "";
-    hash = "sha256-g30pno993yvjGiKaen4BnTVJeYJRF5iayzsysam+Jio=";
+    version = rubyVersion "4" "0" "7" "";
+    hash = "sha256-kRrOIPkNBoyg5N2m0OTw+B5S5S8t1PQATHIeJTQS6C0=";
     cargoHash = "sha256-z7NwWc4TaR042hNx0xgRkh/BQEpEJtE53cfrN0qNiE0=";
   };
 
diff --git a/pkgs/development/ocaml-modules/bstr/default.nix b/pkgs/development/ocaml-modules/bstr/default.nix
index 9ec7bb335456..bc87bea2b38a 100644
--- a/pkgs/development/ocaml-modules/bstr/default.nix
+++ b/pkgs/development/ocaml-modules/bstr/default.nix
@@ -6,13 +6,13 @@
 
 buildDunePackage (finalAttrs: {
   pname = "bstr";
-  version = "0.0.4";
+  version = "0.1.1";
 
   minimalOCamlVersion = "4.13";
 
   src = fetchurl {
     url = "https://github.com/robur-coop/bstr/releases/download/v${finalAttrs.version}/bstr-${finalAttrs.version}.tbz";
-    hash = "sha256-ZAg28VstVVvfI2b213g5JuEVmK1+lFV7Fnx4WyVfSFY=";
+    hash = "sha256-5lfP/aVpELFLmMdt1uA4LqS8XQFn6IORq6kxlrAW7uA=";
   };
 
   meta = {
diff --git a/pkgs/development/ocaml-modules/httpcats/default.nix b/pkgs/development/ocaml-modules/httpcats/default.nix
index c25d75a3e446..27146ca900ea 100644
--- a/pkgs/development/ocaml-modules/httpcats/default.nix
+++ b/pkgs/development/ocaml-modules/httpcats/default.nix
@@ -18,11 +18,11 @@
 
 buildDunePackage (finalAttrs: {
   pname = "httpcats";
-  version = "0.3.1";
+  version = "0.3.2";
 
   src = fetchurl {
     url = "https://github.com/robur-coop/httpcats/releases/download/v${finalAttrs.version}/httpcats-${finalAttrs.version}.tbz";
-    hash = "sha256-5BymoyJS5JykTnSee0HhSKzbHkb8j6COuY7tZtGDGh0=";
+    hash = "sha256-n0InZn+7jaDbf3WaMACdh3DPMfkfewmkcXQAVfR81rg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/dspy/default.nix b/pkgs/development/python-modules/dspy/default.nix
new file mode 100644
index 000000000000..e04f6f711db6
--- /dev/null
+++ b/pkgs/development/python-modules/dspy/default.nix
@@ -0,0 +1,125 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  anyio,
+  asyncer,
+  cachetools,
+  cloudpickle,
+  datamodel-code-generator,
+  diskcache,
+  gepa,
+  json-repair,
+  litellm,
+  mcp,
+  numpy,
+  openai,
+  orjson,
+  pillow,
+  pydantic,
+  pyprojectVersionPatchHook,
+  pytestCheckHook,
+  pytest-asyncio,
+  regex,
+  requests,
+  tenacity,
+  tqdm,
+  typeguard,
+  xxhash,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "dspy";
+  version = "3.2.1";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "stanfordnlp";
+    repo = "dspy";
+    tag = finalAttrs.version;
+    hash = "sha256-xquV+FyDfejm1SCWYfuiezIkyutmm/1zOvd5X+oElrM=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  nativeBuildInputs = [
+    pyprojectVersionPatchHook
+  ];
+
+  dependencies = [
+    anyio
+    asyncer
+    cachetools
+    cloudpickle
+    diskcache
+    gepa
+    json-repair
+    litellm
+    mcp
+    numpy
+    openai
+    orjson
+    pydantic
+    regex
+    requests
+    tenacity
+    tqdm
+    typeguard
+    xxhash
+  ];
+
+  pythonRelaxDeps = [
+    "asyncer"
+    "gepa"
+    "litellm"
+    "typeguard"
+  ];
+
+  # optuna is an optional dependency that dspy can use but doesn't require at import time
+  pythonRemoveDeps = [ "optuna" ];
+
+  # Prevent litellm from trying to fetch the remote model cost map at import
+  # time, which fails in environments without direct internet access.
+  postPatch = ''
+    sed -i '1i import os; os.environ.setdefault("LITELLM_LOCAL_MODEL_COST_MAP", "true")' dspy/__init__.py
+  '';
+
+  pythonImportsCheck = [ "dspy" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-asyncio
+    datamodel-code-generator
+    pillow
+  ];
+
+  # skip tests that need network access
+  disabledTestPaths = [
+    "tests/signatures/test_adapter_image.py"
+  ];
+
+  # These tests start a litellm proxy server subprocess, which isn't available
+  # in the nix build sandbox (upstream skips them on Python 3.14 for the same reason).
+  disabledTests = [
+    "test_chat_lms_can_be_queried"
+    "test_dspy_cache"
+    "test_lm_calls_support_callables"
+    "test_lm_calls_support_pydantic_models"
+    "test_responses_api_tool_calls"
+    "test_streamify_yields_expected_response_chunks"
+    "test_streaming_response_yields_expected_response_chunks"
+    "test_text_lms_can_be_queried"
+  ];
+
+  meta = {
+    description = "Programming — not prompting — language models";
+    homepage = "https://github.com/stanfordnlp/dspy";
+    changelog = "https://github.com/stanfordnlp/dspy/releases/tag/${finalAttrs.version}";
+    maintainers = with lib.maintainers; [ jherland ];
+    license = lib.licenses.mit;
+  };
+})
diff --git a/pkgs/development/python-modules/exllamav3/default.nix b/pkgs/development/python-modules/exllamav3/default.nix
index 6ec0b3169923..59301c5686e0 100644
--- a/pkgs/development/python-modules/exllamav3/default.nix
+++ b/pkgs/development/python-modules/exllamav3/default.nix
@@ -22,18 +22,28 @@
   typing-extensions,
 }:
 let
-  newerThanTuring = lib.filter (version: lib.versionOlder "7.9" version) torch.cudaCapabilities;
+  # https://github.com/turboderp-org/exllamav3/blob/master/.github/workflows/build.yml#L55
+  # https://github.com/turboderp-org/exllamav3/issues/44
+  # Using unsupported platforms the build will fail
+  cudaCapabilities = lib.intersectLists torch.cudaCapabilities [
+    "8.0"
+    "8.6"
+    "8.9"
+    "9.0"
+    "10.0"
+    "12.0"
+  ];
 in
 buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
   pname = "exllamav3";
-  version = "1.4.8";
+  version = "1.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "turboderp-org";
     repo = "exllamav3";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CnbJR5rsHzNEeQBJLdD7LGrrTgy+GKpvop1R4uY4d8U=";
+    hash = "sha256-gW6A2nWx3lumnJz7r7vxQyC1qM9Agqdr0DiL68yJvAI=";
   };
 
   pythonRelaxDeps = [
@@ -57,7 +67,7 @@ buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
   ];
 
   dependencies = [
-    flash-linear-attention
+    flash-linear-attention # Upstream vendors it instead
     llguidance
     marisa-trie
     numpy
@@ -73,9 +83,9 @@ buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
 
   env = lib.optionalAttrs torch.cudaSupport {
     CUDA_HOME = lib.getDev cudaPackages.cuda_nvcc;
-    # exllamav3 only supports turing or newer GPUs
-    # https://github.com/turboderp-org/exllamav3/issues/44
-    TORCH_CUDA_ARCH_LIST = lib.concatStringsSep ";" newerThanTuring;
+    TORCH_CUDA_ARCH_LIST = lib.concatStringsSep ";" (
+      cudaCapabilities ++ [ "${lib.last cudaCapabilities}+PTX" ]
+    );
   };
 
   pythonImportsCheck = [ "exllamav3" ];
diff --git a/pkgs/development/python-modules/gepa/default.nix b/pkgs/development/python-modules/gepa/default.nix
index c81c06a0ee70..c1fb3cbf8783 100644
--- a/pkgs/development/python-modules/gepa/default.nix
+++ b/pkgs/development/python-modules/gepa/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  pyprojectVersionPatchHook,
   setuptools,
 }:
 
@@ -20,6 +21,10 @@ buildPythonPackage (finalAttrs: {
 
   build-system = [ setuptools ];
 
+  nativeBuildInputs = [
+    pyprojectVersionPatchHook
+  ];
+
   pythonImportsCheck = [ "gepa" ];
 
   # test suite requires network access
diff --git a/pkgs/development/python-modules/onnxscript/default.nix b/pkgs/development/python-modules/onnxscript/default.nix
index a0a376381c44..b668e25244e6 100644
--- a/pkgs/development/python-modules/onnxscript/default.nix
+++ b/pkgs/development/python-modules/onnxscript/default.nix
@@ -31,7 +31,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "onnxscript";
-  version = "0.7.1";
+  version = "0.7.2";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -39,7 +39,7 @@ buildPythonPackage (finalAttrs: {
     owner = "microsoft";
     repo = "onnxscript";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-l6Nsnbg7LG/0Z9y1EX5BPP3sFdY/EZwRFFHOrP4mwdw=";
+    hash = "sha256-Fd7nQ4KZECgUUfLrCo54NiUVcx1IdhGfUdYWXEo7D8o=";
   };
 
   env = {
diff --git a/pkgs/development/python-modules/playwright/default.nix b/pkgs/development/python-modules/playwright/default.nix
index 190aa583217b..0090ec74c96c 100644
--- a/pkgs/development/python-modules/playwright/default.nix
+++ b/pkgs/development/python-modules/playwright/default.nix
@@ -31,14 +31,14 @@ in
 buildPythonPackage (finalAttrs: {
   pname = "playwright";
   # run ./pkgs/development/web/playwright/update.sh to update
-  version = "1.62.0";
+  version = "1.63.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "playwright-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-E9silyNQtFEPShimuEbWXvg5fgf+vqaiDez+Ri0jDTw=";
+    hash = "sha256-RwIn+0EcHnStjORVFmT7gp4bGjl+qer1FgtI3+aPF2w=";
   };
 
   patches = [
diff --git a/pkgs/development/web/playwright/browser-downloads.nix b/pkgs/development/web/playwright/browser-downloads.nix
index 280734257919..cd59ec38e19b 100644
--- a/pkgs/development/web/playwright/browser-downloads.nix
+++ b/pkgs/development/web/playwright/browser-downloads.nix
@@ -20,13 +20,13 @@ in
 {
   chromium = {
     x86_64-linux = mk (cftUrl "linux64/chrome-linux64.zip") true;
-    aarch64-linux = mk (registryUrl "chromium" "chromium-linux-arm64.zip") true;
+    aarch64-linux = mk (cftUrl "linux-arm64/chrome-linux-arm64.zip") true;
     aarch64-darwin = mk (cftUrl "mac-arm64/chrome-mac-arm64.zip") false;
   };
 
   "chromium-headless-shell" = {
     x86_64-linux = mk (cftUrl "linux64/chrome-headless-shell-linux64.zip") false;
-    aarch64-linux = mk (registryUrl "chromium" "chromium-headless-shell-linux-arm64.zip") false;
+    aarch64-linux = mk (cftUrl "linux-arm64/chrome-headless-shell-linux-arm64.zip") false;
     aarch64-darwin = mk (cftUrl "mac-arm64/chrome-headless-shell-mac-arm64.zip") false;
   };
 
diff --git a/pkgs/development/web/playwright/browsers.json b/pkgs/development/web/playwright/browsers.json
index 6020af73b788..3ebae73640c5 100644
--- a/pkgs/development/web/playwright/browsers.json
+++ b/pkgs/development/web/playwright/browsers.json
@@ -2,23 +2,23 @@
   "comment": "This file is kept up to date via update.sh",
   "browsers": {
     "chromium": {
-      "revision": "1234",
-      "browserVersion": "151.0.7922.34",
+      "revision": "1243",
+      "browserVersion": "153.0.8010.12",
       "title": "Chrome for Testing"
     },
     "chromium-headless-shell": {
-      "revision": "1234",
-      "browserVersion": "151.0.7922.34",
+      "revision": "1243",
+      "browserVersion": "153.0.8010.12",
       "title": "Chrome Headless Shell"
     },
     "firefox": {
-      "revision": "1538",
-      "browserVersion": "153.0",
+      "revision": "1543",
+      "browserVersion": "155.0",
       "title": "Firefox"
     },
     "webkit": {
-      "revision": "2336",
-      "browserVersion": "26.5",
+      "revision": "2359",
+      "browserVersion": "26.6",
       "title": "WebKit"
     },
     "ffmpeg": {
diff --git a/pkgs/development/web/playwright/chromium-headless-shell.nix b/pkgs/development/web/playwright/chromium-headless-shell.nix
index ee808412ea22..babc6a82a1e4 100644
--- a/pkgs/development/web/playwright/chromium-headless-shell.nix
+++ b/pkgs/development/web/playwright/chromium-headless-shell.nix
@@ -36,8 +36,8 @@ let
       inherit (download) url stripRoot;
       hash =
         {
-          x86_64-linux = "sha256-2w0Ul3tpzrVkfGHIbQGwEsCRmVUUy3OAShGhuoH6Rmw=";
-          aarch64-linux = "sha256-DoZf+pKXW0Oj2e8vtGDDSViJ0SX8PkYE1Q0LJs53IWg=";
+          x86_64-linux = "sha256-GLqqZOwtnJig+ZCIT8FYsIxZGSFTmRwLbqNXeSOdJXA=";
+          aarch64-linux = "sha256-7DSqFxtk8Jf4/ktoW1MmH5vHs5LEp7jNvglYRoKXBm4=";
         }
         .${system} or throwSystem;
     };
@@ -72,7 +72,7 @@ let
     inherit (download) url stripRoot;
     hash =
       {
-        aarch64-darwin = "sha256-5VQESywHZKhqc7Fhq/jqNF+yXl90F3+i9nPzBHyJV8k=";
+        aarch64-darwin = "sha256-Elbpy5UDVndRzWRi8Nb391AhAAYl55PJ/3Fxz/RI/4I=";
       }
       .${system} or throwSystem;
   };
diff --git a/pkgs/development/web/playwright/chromium.nix b/pkgs/development/web/playwright/chromium.nix
index e58ea513f333..6094d16444fd 100644
--- a/pkgs/development/web/playwright/chromium.nix
+++ b/pkgs/development/web/playwright/chromium.nix
@@ -49,11 +49,11 @@ let
 
   # Playwright expects different directory names for different architectures:
   # - linux-x64 expects: chrome-linux64
-  # - linux-arm64 expects: chrome-linux
+  # - linux-arm64 expects: chrome-linux-arm64
   chromeDir =
     {
       x86_64-linux = "chrome-linux64";
-      aarch64-linux = "chrome-linux";
+      aarch64-linux = "chrome-linux-arm64";
     }
     .${system} or throwSystem;
 
@@ -63,8 +63,8 @@ let
       inherit (download) url stripRoot;
       hash =
         {
-          x86_64-linux = "sha256-3/o8ZFVeL/YDuO+aax+qcm6xv77AX6Vl6meP+S05cTk=";
-          aarch64-linux = "sha256-53xm/L3QYH22AZ8K/5cKg1gLewKv7s3lTDmXlHw4KDg=";
+          x86_64-linux = "sha256-ORdMu1e4Peolr8rdfvzgeaFhC8RgBipaOsAm7e3ZeqE=";
+          aarch64-linux = "sha256-AWXksACJGsDisnp9dAUcukDf/ruMCRCX9kZNNnE0R8Q=";
         }
         .${system} or throwSystem;
     };
@@ -130,7 +130,7 @@ let
     inherit (download) url stripRoot;
     hash =
       {
-        aarch64-darwin = "sha256-ugo4gRST53YA1uaLXfwnFhFdouShtUAGFnf2ZKbg5jI=";
+        aarch64-darwin = "sha256-Zm7aHjwXL0kbucBiNoWxBM6rFdY0UmVIwcr/f8V31G8=";
       }
       .${system} or throwSystem;
   };
diff --git a/pkgs/development/web/playwright/driver.nix b/pkgs/development/web/playwright/driver.nix
index 9bb571405e4f..d34b2b915139 100644
--- a/pkgs/development/web/playwright/driver.nix
+++ b/pkgs/development/web/playwright/driver.nix
@@ -19,13 +19,13 @@ let
   throwSystem = throw "Unsupported system: ${system}";
   browsersJSON = (lib.importJSON ./browsers.json).browsers;
 
-  version = "1.62.1";
+  version = "1.63.0";
 
   src = fetchFromGitHub {
     owner = "Microsoft";
     repo = "playwright";
     rev = "v${version}";
-    hash = "sha256-3gLXo9bd2qXCy8MYMbnYU6AXIWrqoitqMBPMF4g07nY=";
+    hash = "sha256-W5x48pV5OlOzL65JQ3OJf2gL6T/FLAYJO2SwCb7IzOY=";
   };
 
   playwright = buildNpmPackage {
@@ -33,7 +33,7 @@ let
     inherit version src;
 
     sourceRoot = "${src.name}"; # update.sh depends on sourceRoot presence
-    npmDepsHash = "sha256-iebe0sP3VMdk1vBFDkwM1L4x2VrHPZF/NbjMeU5diWM=";
+    npmDepsHash = "sha256-6unp+NT6BHEaLE9XJ6tv49N/0yY4pJ5dyvSqmE9O3SQ=";
 
     nativeBuildInputs = [
       cacert
diff --git a/pkgs/development/web/playwright/firefox.nix b/pkgs/development/web/playwright/firefox.nix
index cd0345e00928..f5e4235421fc 100644
--- a/pkgs/development/web/playwright/firefox.nix
+++ b/pkgs/development/web/playwright/firefox.nix
@@ -19,8 +19,8 @@ let
       inherit (download) url stripRoot;
       hash =
         {
-          x86_64-linux = "sha256-GmjRWhlSv7by3PFtrKgo6EBmHigmp55HwG8iA/Ykq88=";
-          aarch64-linux = "sha256-7vxVe82NxebzoSSoSFg9qNxKOqlT7EOwCxQVavkDoMM=";
+          x86_64-linux = "sha256-FyUUBrffHSh28C3BfYgHRJzTbAixRXN0QoZ3tbtdbYU=";
+          aarch64-linux = "sha256-vkK7bYqf5FiYoHcNmSjXYy7i5rsSLNpx9w+KL7MY0uo=";
         }
         .${system} or throwSystem;
     };
@@ -42,7 +42,7 @@ let
     inherit (download) url stripRoot;
     hash =
       {
-        aarch64-darwin = "sha256-E7/Kbvjg1dcWwSe/07hMR+W6NR0JHoAPxp1e+SncQYs=";
+        aarch64-darwin = "sha256-mFCMrL5PMX5C0Ob/tKKfbZfZJwF5QDM0rhS7v/P3IUw=";
       }
       .${system} or throwSystem;
   };
diff --git a/pkgs/development/web/playwright/webkit.nix b/pkgs/development/web/playwright/webkit.nix
index 2554ebf47329..a6d8f093c2f7 100644
--- a/pkgs/development/web/playwright/webkit.nix
+++ b/pkgs/development/web/playwright/webkit.nix
@@ -32,6 +32,7 @@
   libgcrypt,
   libgpg-error,
   libjpeg8,
+  libmanette,
   libopus,
   libpng,
   libsoup_3,
@@ -129,8 +130,8 @@ let
       inherit (download) url stripRoot;
       hash =
         {
-          x86_64-linux = "sha256-w/avBW8CAiGd9WzddVGLymLLG23OzY/Bm7Dhw9JVQOA=";
-          aarch64-linux = "sha256-KUVT67b11IljTNpzCcEy+O5CW5UuqyVi6QFdQ87lVLA=";
+          x86_64-linux = "sha256-My6nSOMD2NfPGUmOJKZgWpkjktEsj+P+CPeVmKy1VAQ=";
+          aarch64-linux = "sha256-5CCcWiZN1lVoiiSEO1OvxLcuKhSOIQrD5GH1TYr7XIY=";
         }
         .${system} or throwSystem;
     };
@@ -167,6 +168,7 @@ let
       libgcrypt
       libgpg-error
       libjpeg8
+      libmanette
       libopus
       libpng
       libsoup_3
@@ -204,7 +206,7 @@ let
     inherit (download) url stripRoot;
     hash =
       {
-        aarch64-darwin = "sha256-ARcl9y1PD+rzxUipixxGvsII2ah8vsDozAUHI0dSgA8=";
+        aarch64-darwin = "sha256-EjI0TdmQfB2qT2bBtbJFpsa+bplkJ5YyyVxNoOgsnZc=";
       }
       .${system} or throwSystem;
   };
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index bf7ba4373479..c8bb15d53607 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -1522,8 +1522,8 @@ let
             ACPI_HOTPLUG_CPU = yes;
             ACPI_HOTPLUG_MEMORY = yes;
             MEMORY_HOTPLUG = yes;
-            MEMORY_HOTPLUG_DEFAULT_ONLINE = whenOlder "6.14" yes;
-            MHP_DEFAULT_ONLINE_TYPE_ONLINE_AUTO = whenAtLeast "6.14" yes;
+            MEMORY_HOTPLUG_DEFAULT_ONLINE = whenOlder "6.12" yes;
+            MHP_DEFAULT_ONLINE_TYPE_ONLINE_AUTO = whenAtLeast "6.12" yes;
             MEMORY_HOTREMOVE = lib.mkIf (
               with stdenv.hostPlatform;
               isLoongArch64
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index c0bfde2d0bc2..35143f8c6dd9 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5258,6 +5258,8 @@ self: super: with self; {
 
   dsnap = callPackage ../development/python-modules/dsnap { };
 
+  dspy = callPackage ../development/python-modules/dspy { };
+
   dt8852 = callPackage ../development/python-modules/dt8852 { };
 
   dtfabric = callPackage ../development/python-modules/dtfabric { };