diff --git a/nixos/lib/test-driver/default.nix b/nixos/lib/test-driver/default.nix
index b2221e06629c..a18aebc44e5a 100644
--- a/nixos/lib/test-driver/default.nix
+++ b/nixos/lib/test-driver/default.nix
@@ -89,4 +89,6 @@ buildPythonApplication {
     echo -e "\x1b[32m## run ruff format\x1b[0m"
     ruff format --check --diff .
   '';
+
+  meta.license = lib.licenses.mit;
 }
diff --git a/nixos/modules/config/xdg/portal.nix b/nixos/modules/config/xdg/portal.nix
index 1c240f41c3a7..fba32aba67dd 100644
--- a/nixos/modules/config/xdg/portal.nix
+++ b/nixos/modules/config/xdg/portal.nix
@@ -113,7 +113,11 @@ in
   config =
     let
       cfg = config.xdg.portal;
-      packages = [ pkgs.xdg-desktop-portal ] ++ cfg.extraPortals;
+      packages = [
+        pkgs.xdg-desktop-portal
+        pkgs.xdg-utils
+      ]
+      ++ cfg.extraPortals;
     in
     mkIf cfg.enable {
       programs.fuse.enable = true;
diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix
index 61366c3ea75f..3afe34f0a2a7 100644
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -741,7 +741,11 @@ in
     };
 
     virtualisation.qemu = {
-      enableSharedMemory = mkEnableOption "shared memory";
+      enableSharedMemory = mkOption {
+        type = types.bool;
+        default = useVirtiofs; # Need shared memory for virtiofs: <https://www.qemu.org/docs/master/system/devices/virtio/vhost-user.html#shared-memory-object>
+        description = "Enable shared memory";
+      };
 
       package = mkOption {
         type = types.package;
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 0245450266fc..14a78fd0e267 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -461,12 +461,12 @@ final: prev: {
 
   SchemaStore-nvim = buildVimPlugin {
     pname = "SchemaStore.nvim";
-    version = "0-unstable-2026-09-10";
+    version = "0-unstable-2026-09-12";
     src = fetchFromGitHub {
       owner = "b0o";
       repo = "SchemaStore.nvim";
-      rev = "890d8f5cfca338a1f3e59c686569e461f6182f80";
-      hash = "sha256-CrcG5YG5hQ8IMNDf1/4kjBWPP2O9Qp3uDFSatTSuDSE=";
+      rev = "05e938c0aa5dfbdbb11972fa4c8a85f27f402ba0";
+      hash = "sha256-p+h2y42PRUM1ZPIlBe31/n7IPmh3oEiWgL3HuoUI8Yg=";
     };
     meta.homepage = "https://github.com/b0o/SchemaStore.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -1331,12 +1331,12 @@ final: prev: {
 
   auto-dark-mode-nvim = buildVimPlugin {
     pname = "auto-dark-mode.nvim";
-    version = "0-unstable-2026-03-29";
+    version = "0-unstable-2026-09-11";
     src = fetchFromGitHub {
       owner = "f-person";
       repo = "auto-dark-mode.nvim";
-      rev = "54058b4fe414bd64bd2904a6f8a63f1f14e3d8df";
-      hash = "sha256-xTgRyct3L6Gcz/vdYSc+h2IUgi/+Lh1Q4mxJwHISeis=";
+      rev = "2b16a24c202892e61fca7df4d2d7c4c872a44165";
+      hash = "sha256-xBpdk0D2LauLJoktw/vQfvic07NsKaBDeL8KAl4KE7s=";
     };
     meta.homepage = "https://github.com/f-person/auto-dark-mode.nvim/";
     meta.license = getLicenseFromSpdxId "GPL-3.0-only";
@@ -1429,12 +1429,12 @@ final: prev: {
 
   autoclose-nvim = buildVimPlugin {
     pname = "autoclose.nvim";
-    version = "0-unstable-2026-07-20";
+    version = "0-unstable-2026-09-13";
     src = fetchFromGitHub {
       owner = "m4xshen";
       repo = "autoclose.nvim";
-      rev = "27063904b2238ce7867e430885b6abcfb08357ea";
-      hash = "sha256-BjNP8Facn3Cy/EHYioUB9mXb19sBzBeSCY1xTpPOWG8=";
+      rev = "bcad8e84d9cd78ba73433cb396b68e489af11e31";
+      hash = "sha256-1uY/D5su4cA0OGn8jidfzkOrrTSjxmFTgN7YFVY0t/0=";
     };
     meta.homepage = "https://github.com/m4xshen/autoclose.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -1625,12 +1625,12 @@ final: prev: {
 
   base16-nvim = buildVimPlugin {
     pname = "base16-nvim";
-    version = "0-unstable-2026-08-10";
+    version = "0-unstable-2026-09-13";
     src = fetchFromGitHub {
       owner = "RRethy";
       repo = "base16-nvim";
-      rev = "09944b3120451d2881dc8cfb13c85c11949f477d";
-      hash = "sha256-UVTi+0D2SjaA+yG8kYuKZ14bAz3txGc1XCwYufSsEM0=";
+      rev = "44fc7a0d7ad878f90b04ffe8fa58c99c19007509";
+      hash = "sha256-Wb0fSya++a64lPIVtcdQjX9wkLfCEtq5uq6KG8jHvPY=";
     };
     meta.homepage = "https://github.com/RRethy/base16-nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -3513,12 +3513,12 @@ final: prev: {
 
   coc-nvim = buildVimPlugin {
     pname = "coc.nvim";
-    version = "0.0.82-unstable-2026-09-08";
+    version = "0.0.82-unstable-2026-09-11";
     src = fetchFromGitHub {
       owner = "neoclide";
       repo = "coc.nvim";
-      rev = "1ceb010a202cc9e33aece04811de23a909addf5d";
-      hash = "sha256-+oDGDkGsC+skh1BONEpI9VDDGU44FwmnopfaWMDnlks=";
+      rev = "90b55f067595e7f9dd920c957d6345f434f32dd2";
+      hash = "sha256-6gX6voB7AZhBmG/NYUCEwEm6V5gunT+WHVSvOsZ0Kj4=";
     };
     meta.homepage = "https://github.com/neoclide/coc.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -3611,12 +3611,12 @@ final: prev: {
 
   codecompanion-nvim = buildVimPlugin {
     pname = "codecompanion.nvim";
-    version = "19.23.0";
+    version = "19.24.1";
     src = fetchFromGitHub {
       owner = "olimorris";
       repo = "codecompanion.nvim";
-      tag = "v19.23.0";
-      hash = "sha256-Qwp5GMiThljD7l9ygl8T333OlBQ2Me1k6/KWAkFq4QU=";
+      tag = "v19.24.1";
+      hash = "sha256-oihHiKhU093AT5aqvTxJ4wXmH+pMKFJ5zgzUo5SJ/Yw=";
     };
     meta.homepage = "https://github.com/olimorris/codecompanion.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -4130,12 +4130,12 @@ final: prev: {
 
   copilot-lua = buildVimPlugin {
     pname = "copilot.lua";
-    version = "3.1.5";
+    version = "3.1.7";
     src = fetchFromGitHub {
       owner = "zbirenbaum";
       repo = "copilot.lua";
-      tag = "v3.1.5";
-      hash = "sha256-/f20KI5XtjnEr8tOBqGy+X9RM7sc9pLn1uq5bIEQC1k=";
+      tag = "v3.1.7";
+      hash = "sha256-RYi+Ofn+kqXkw8z2f1avH62MMLqVyIIDJaYBCMt/fBw=";
     };
     meta.homepage = "https://github.com/zbirenbaum/copilot.lua/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -4284,12 +4284,12 @@ final: prev: {
 
   crates-nvim = buildVimPlugin {
     pname = "crates.nvim";
-    version = "0.7.1-unstable-2026-09-03";
+    version = "0.7.1-unstable-2026-09-12";
     src = fetchFromGitHub {
       owner = "saecki";
       repo = "crates.nvim";
-      rev = "b8281be336498035f9288d6542b2881a7140a9ec";
-      hash = "sha256-kZoKu5rCSymcafN6tlgx5mdnjWB0+oCxYulBcEp8Ut8=";
+      rev = "7039bc1d130e424232a7aa64ceddb170a154ff5b";
+      hash = "sha256-yZ9+R+T5LytIldgVgzIuVSurjN23R0mYsQsES7srFRw=";
     };
     meta.homepage = "https://github.com/saecki/crates.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -6180,12 +6180,12 @@ final: prev: {
     pname = "flow.nvim";
     version = "3.0.0";
     src = fetchFromGitHub {
-      owner = "0xstepit";
+      owner = "stefanopitton";
       repo = "flow.nvim";
       tag = "v3.0.0";
       hash = "sha256-PH08FeZMvIXcE9/dfYxj4PiKwBzPCXWFAVOLSci0iNk=";
     };
-    meta.homepage = "https://github.com/0xstepit/flow.nvim/";
+    meta.homepage = "https://github.com/stefanopitton/flow.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
     meta.hydraPlatforms = [ ];
   };
@@ -6333,12 +6333,12 @@ final: prev: {
 
   friendly-snippets = buildVimPlugin {
     pname = "friendly-snippets";
-    version = "0-unstable-2026-09-09";
+    version = "0-unstable-2026-09-11";
     src = fetchFromGitHub {
       owner = "rafamadriz";
       repo = "friendly-snippets";
-      rev = "a5a73e586521fe5c12d751ad81a0db67649a94ed";
-      hash = "sha256-LGAFrG7OxtdZNGRpLEkCaTGwegCExNYS/EBudH6rymQ=";
+      rev = "b4d01b0fdf3c9a549961c2f9ffe8dc09be166219";
+      hash = "sha256-Wp10iRKSn6yNUmNbu2o10cKPkytNjs0cdjBUpEYVlow=";
     };
     meta.homepage = "https://github.com/rafamadriz/friendly-snippets/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -6877,12 +6877,12 @@ final: prev: {
 
   go-nvim = buildVimPlugin {
     pname = "go.nvim";
-    version = "0.11-unstable-2026-06-04";
+    version = "0.11-unstable-2026-09-11";
     src = fetchFromGitHub {
       owner = "ray-x";
       repo = "go.nvim";
-      rev = "0768d79bbebdb1a112a845f9cd6293bfbd544dab";
-      hash = "sha256-Yj7iSfvXSjnQgKDZDEwC1QfOHMaIf7ZdJ0k+RmLtSPI=";
+      rev = "f5d1f11d4f616efbe2339286310bb89c4853d769";
+      hash = "sha256-/8AcDSqrAZj8xxpbWWgHVDQgwYyYiO00+7VTXhR23os=";
     };
     meta.homepage = "https://github.com/ray-x/go.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -7256,12 +7256,12 @@ final: prev: {
 
   hardtime-nvim = buildVimPlugin {
     pname = "hardtime.nvim";
-    version = "1.2.0-unstable-2026-07-20";
+    version = "1.2.0-unstable-2026-09-13";
     src = fetchFromGitHub {
       owner = "m4xshen";
       repo = "hardtime.nvim";
-      rev = "244753782b945def87472d8f4e9e6a9d4ec18689";
-      hash = "sha256-Zers7vdGRGy8n520G9uMuHwMAP3STHqU5d5a2Ln9rDQ=";
+      rev = "5165840fe680eab46de1fc6dbff48f148fdcf018";
+      hash = "sha256-AhCFZQYtwPicHS/6PDeTkkdU2R9hAGgbyz1Sow3GNdQ=";
     };
     meta.homepage = "https://github.com/m4xshen/hardtime.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -12731,11 +12731,11 @@ final: prev: {
 
   nvim-dap = buildVimPlugin {
     pname = "nvim-dap";
-    version = "0.10.0-unstable-2026-09-01";
+    version = "0.10.0-unstable-2026-09-11";
     src = fetchgit {
       url = "https://codeberg.org/mfussenegger/nvim-dap/";
-      rev = "c9a0738e45f1bd41d792a126941348dce661cf9b";
-      hash = "sha256-VVHXHBKGmDnltHBMcVoBElaKMElXwJwB/7IZROQGCpg=";
+      rev = "cfa2d58f4537aca6ca83e2de1a0d9f1491121264";
+      hash = "sha256-9T6EL8mZ1rddDXBNvkh68jQSKK1bhi73IvyD6v464x8=";
     };
     meta.homepage = "https://codeberg.org/mfussenegger/nvim-dap/";
     meta.license = unfree;
@@ -13314,7 +13314,7 @@ final: prev: {
 
   nvim-lint = buildVimPlugin {
     pname = "nvim-lint";
-    version = "0-unstable-2026-08-25";
+    version = "05-unstable-2026-08-25";
     src = fetchgit {
       url = "https://codeberg.org/mfussenegger/nvim-lint/";
       rev = "3d55c8f67c6ae5c15e1042571e107c7a3d5c5f4e";
@@ -13327,11 +13327,11 @@ final: prev: {
 
   nvim-lsp-file-operations = buildVimPlugin {
     pname = "nvim-lsp-file-operations";
-    version = "0-unstable-2026-09-04";
+    version = "1.0.0";
     src = fetchFromGitHub {
       owner = "antosha417";
       repo = "nvim-lsp-file-operations";
-      rev = "276f096ef324c140d00bd0188a0e70382e156771";
+      tag = "v1.0.0";
       hash = "sha256-FObv42EGkIao2Rmq9CG+G4JsntO+00CFNaNIXc7IK7A=";
     };
     meta.homepage = "https://github.com/antosha417/nvim-lsp-file-operations/";
@@ -13957,12 +13957,12 @@ final: prev: {
 
   nvim-treesitter = buildVimPlugin {
     pname = "nvim-treesitter";
-    version = "0.10.0-unstable-2026-09-10";
+    version = "0.10.0-unstable-2026-09-12";
     src = fetchFromGitHub {
       owner = "nvim-treesitter";
       repo = "nvim-treesitter";
-      rev = "d4d59cb369da46b95699bd2200efbcffc6dadb3b";
-      hash = "sha256-o9815JWolYzxjNGlBypPxTkZDLoP2z51W9g1OX3tD/E=";
+      rev = "9a168f6357ed21c3a636e1727bc7d382abc451b8";
+      hash = "sha256-NXt2xP6m2TMG1GHggG9S8sGnd8tl1Utv9kjjqJVEH9U=";
     };
     meta.homepage = "https://github.com/nvim-treesitter/nvim-treesitter/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -14377,12 +14377,12 @@ final: prev: {
 
   ocaml-nvim = buildVimPlugin {
     pname = "ocaml.nvim";
-    version = "1.0.0-unstable-2026-07-16";
+    version = "1.0.0-unstable-2026-09-10";
     src = fetchFromGitHub {
       owner = "tarides";
       repo = "ocaml.nvim";
-      rev = "d74934117fb7a513e64601ad1d1b53a34b00b01f";
-      hash = "sha256-zJJZP8jxa7e9Fn0N8JFzfP3d2TElkASFt8ptaWCOYpM=";
+      rev = "cd21b0d92270fa8aa455d3986dd73f447c28505f";
+      hash = "sha256-GveMCxN0KCPkoi07wVENM0tB1XWx6/L5nGJt04DGhzo=";
     };
     meta.homepage = "https://github.com/tarides/ocaml.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -14475,12 +14475,12 @@ final: prev: {
 
   oklch-color-picker-nvim = buildVimPlugin {
     pname = "oklch-color-picker.nvim";
-    version = "5.0.5";
+    version = "5.0.6";
     src = fetchFromGitHub {
       owner = "eero-lehtinen";
       repo = "oklch-color-picker.nvim";
-      tag = "v5.0.5";
-      hash = "sha256-VWVVD1/ZcGSjABqkCSc6tPjbet1K/WnlY3NJMEBw/kA=";
+      tag = "v5.0.6";
+      hash = "sha256-3rlmUXqFpxIvSSWSHmFb9eYGq91tuUREp1d2280ci2s=";
     };
     meta.homepage = "https://github.com/eero-lehtinen/oklch-color-picker.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -14671,12 +14671,12 @@ final: prev: {
 
   opencode-nvim = buildVimPlugin {
     pname = "opencode.nvim";
-    version = "1.0.0";
+    version = "1.0.1";
     src = fetchFromGitHub {
       owner = "nickjvandyke";
       repo = "opencode.nvim";
-      tag = "v1.0.0";
-      hash = "sha256-Au8vW7ISTH0jMxzgkRN3pFmLm4fMd9l27tBs1QH3v5c=";
+      tag = "v1.0.1";
+      hash = "sha256-rJz8AtUEgyTMvLd5cMD0wcsaNgW8FmPX1dtLymHM00o=";
     };
     meta.homepage = "https://github.com/nickjvandyke/opencode.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -15373,12 +15373,12 @@ final: prev: {
 
   project-nvim = buildVimPlugin {
     pname = "project.nvim";
-    version = "6.2.0-1";
+    version = "6.2.1-1";
     src = fetchFromGitHub {
       owner = "DrKJeff16";
       repo = "project.nvim";
-      tag = "v6.2.0-1";
-      hash = "sha256-IeihqzbJQ1sv9aZ0Kk0HzWSM4i00EUEXSIWFwuzuclk=";
+      tag = "v6.2.1-1";
+      hash = "sha256-jJwnMO5rYhlDp+ykL/72o4fllbtLCxdX+2ZCBJGxtwg=";
     };
     meta.homepage = "https://github.com/DrKJeff16/project.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -15429,12 +15429,12 @@ final: prev: {
 
   pum-vim = buildVimPlugin {
     pname = "pum.vim";
-    version = "2.0-unstable-2026-08-10";
+    version = "2.0-unstable-2026-09-11";
     src = fetchFromGitHub {
       owner = "Shougo";
       repo = "pum.vim";
-      rev = "e26a0c74a9ac33036a8387aedc96aac106870966";
-      hash = "sha256-m9eNkg7VH6W0d3PRrylTFcIHz5f435TN6PvUQzz7yuw=";
+      rev = "5969d9d2f8b14ec19e6252f4c5a32335bec4101f";
+      hash = "sha256-MK1H4btHeTSu2z+/fZKYjszWGHgWBvcfhoXqP+60EEM=";
     };
     meta.homepage = "https://github.com/Shougo/pum.vim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -15990,12 +15990,12 @@ final: prev: {
 
   roslyn-nvim = buildVimPlugin {
     pname = "roslyn.nvim";
-    version = "0-unstable-2026-08-13";
+    version = "0-unstable-2026-09-10";
     src = fetchFromGitHub {
       owner = "seblyng";
       repo = "roslyn.nvim";
-      rev = "de9a98d61ed3fd01b5016eea5fe9e32f1a4c7cfb";
-      hash = "sha256-dSzC4A0jnetm5rNTy85bilUxcge+ERveSjOZ5p3gg54=";
+      rev = "bf1bd4e70bc7068d1b4aebf4ce03cc19a86615be";
+      hash = "sha256-YycY9uzShSxnKKJZxPLjOKPiwGfodOnHvrrFhqemcVI=";
     };
     meta.homepage = "https://github.com/seblyng/roslyn.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -16508,12 +16508,12 @@ final: prev: {
 
   smartcolumn-nvim = buildVimPlugin {
     pname = "smartcolumn.nvim";
-    version = "1.1.1-unstable-2026-07-20";
+    version = "1.1.1-unstable-2026-09-13";
     src = fetchFromGitHub {
       owner = "m4xshen";
       repo = "smartcolumn.nvim";
-      rev = "5351ae24e992a397d2abac48b7774dc8ef0acf40";
-      hash = "sha256-+ICVS16n0CFWbTqBzGkvxQohyYiAvr6gIxZqura3PUw=";
+      rev = "3a760dc239de71264072f829a184aafcf7d4d3e7";
+      hash = "sha256-QAb0O/ZwTVogRyTK8+Y4ORaN6nVaeYepKgfSCF/fIPU=";
     };
     meta.homepage = "https://github.com/m4xshen/smartcolumn.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -18193,12 +18193,12 @@ final: prev: {
 
   tinted-nvim = buildVimPlugin {
     pname = "tinted-nvim";
-    version = "1.0.0-unstable-2026-08-10";
+    version = "1.0.0-unstable-2026-09-13";
     src = fetchFromGitHub {
       owner = "tinted-theming";
       repo = "tinted-nvim";
-      rev = "a1f4cd347a26cec0e55dd992be52e93ba2f3c6a5";
-      hash = "sha256-8XRwslwHSFN7elxVZPtgToU+H+ZXE6EhAB30o8/7URA=";
+      rev = "72c8e25efea5b7911863a0c4380bb1e014f3e41a";
+      hash = "sha256-Y7zUq8poJFwfkaUEYFXjDpVRbzRdlD8VUqC+ER9GPnI=";
     };
     meta.homepage = "https://github.com/tinted-theming/tinted-nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -18207,12 +18207,12 @@ final: prev: {
 
   tinted-vim = buildVimPlugin {
     pname = "tinted-vim";
-    version = "01-unstable-2026-08-10";
+    version = "01-unstable-2026-09-13";
     src = fetchFromGitHub {
       owner = "tinted-theming";
       repo = "tinted-vim";
-      rev = "66829e04041ceba72a9006d1c6c9d0c818e2b3dd";
-      hash = "sha256-ZEQ8D9NKoL+JKpTp9MAm3+js1wCmjNLgicmwUXqIusM=";
+      rev = "4242c2e29728af4d00fea05b094992747ad99a17";
+      hash = "sha256-w1JZrHJeTuasHOVGIdhV4GIKP4GzVhATykYVFrmpHPc=";
     };
     meta.homepage = "https://github.com/tinted-theming/tinted-vim/";
     meta.license = unfree;
@@ -18221,12 +18221,12 @@ final: prev: {
 
   tiny-cmdline-nvim = buildVimPlugin {
     pname = "tiny-cmdline.nvim";
-    version = "0-unstable-2026-06-23";
+    version = "0-unstable-2026-09-13";
     src = fetchFromGitHub {
       owner = "rachartier";
       repo = "tiny-cmdline.nvim";
-      rev = "e247d9ee4c980734f8f8bf616d31e0ab7c27485d";
-      hash = "sha256-DEfoqGFoGdybgZyO+Jqxz4gYkrgoek4cQYulLEsvnU8=";
+      rev = "d83700b48d8ff5625dbef4029af071db559544e5";
+      hash = "sha256-3Qyo1a8H6JboAWJ5t0r5jFIY/UMCvgVQb/8fL1KXLN4=";
     };
     meta.homepage = "https://github.com/rachartier/tiny-cmdline.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -19415,12 +19415,12 @@ final: prev: {
 
   vim-addon-sql = buildVimPlugin {
     pname = "vim-addon-sql";
-    version = "0-unstable-2017-02-11";
+    version = "0-unstable-2026-09-11";
     src = fetchFromGitHub {
       owner = "MarcWeber";
       repo = "vim-addon-sql";
-      rev = "048a139af36829fce670c8ff80d3aad927557ee6";
-      hash = "sha256-o3K+w7qVcqeh6PPxXkPNd9QqB+RPcKt508z4pU8JFUY=";
+      rev = "28f489dbb0edc1154c74a4a97eb1173345edceee";
+      hash = "sha256-fCQtr4hmI4k0QliwoaHZsAbvEP0jCGAZnTqm0B3yBxc=";
     };
     meta.homepage = "https://github.com/MarcWeber/vim-addon-sql/";
     meta.license = unfree;
@@ -21501,12 +21501,12 @@ final: prev: {
 
   vim-habamax = buildVimPlugin {
     pname = "vim-habamax";
-    version = "0-unstable-2026-09-08";
+    version = "0-unstable-2026-09-12";
     src = fetchFromGitHub {
       owner = "habamax";
       repo = "vim-habamax";
-      rev = "d5f91975c07c19abadf02ba60b0fa150c9f67c3f";
-      hash = "sha256-lw7SCGMh8I7xPWXlH7xTnYLZQnjQLO0sLy8TDIxcD30=";
+      rev = "c538284552cf22abb733140c77cd0cc95cb80a05";
+      hash = "sha256-TjFLjy3TOZCkC4vWAtCCPJul+ZsTyaBh8NK/tpUUS9s=";
     };
     meta.homepage = "https://github.com/habamax/vim-habamax/";
     meta.license = unfree;
@@ -24609,12 +24609,12 @@ final: prev: {
 
   vim-test = buildVimPlugin {
     pname = "vim-test";
-    version = "3.3.1";
+    version = "3.4.0";
     src = fetchFromGitHub {
       owner = "vim-test";
       repo = "vim-test";
-      tag = "v3.3.1";
-      hash = "sha256-8+Bk1a+cjlJmu2l3emizKkYpXfYwhTagBhcrbYKap74=";
+      tag = "v3.4.0";
+      hash = "sha256-az9rmgWrmKrAVVYNPsxmnrN2W0cEGKeMn6U9RKqwfNM=";
     };
     meta.homepage = "https://github.com/vim-test/vim-test/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -26178,12 +26178,12 @@ final: prev: {
 
   yats-vim = buildVimPlugin {
     pname = "yats.vim";
-    version = "0-unstable-2025-12-09";
+    version = "0-unstable-2026-09-10";
     src = fetchFromGitHub {
       owner = "HerringtonDarkholme";
       repo = "yats.vim";
-      rev = "2d9b95b91b9f72bb1769951841b32d2a879d3cd7";
-      hash = "sha256-Xu90d6VwucmM1mfBVzBeQ3gaRfIz8tz6qzRRtoYsnas=";
+      rev = "ed51b581160bf7b04092a5448c8dc3c8b4c6849b";
+      hash = "sha256-pfMBi+FbLYj1YOJpitq/BGCCBXf/GJryXjxM4ZK/oZA=";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/HerringtonDarkholme/yats.vim/";
@@ -26306,12 +26306,12 @@ final: prev: {
 
   zen-nvim = buildVimPlugin {
     pname = "zen.nvim";
-    version = "0-unstable-2026-08-23";
+    version = "0-unstable-2026-09-12";
     src = fetchFromGitHub {
       owner = "sand4rt";
       repo = "zen.nvim";
-      rev = "9ae3ce3cac4cf88b4369a8ec789aa755882f5cc9";
-      hash = "sha256-jJCtzZ4J4SsVMUK7wuVdh8fLbCKTzJQgEN2K/gGHqkY=";
+      rev = "5fd4b1cc12b91930d1a55d9b98ef01ed963a0b46";
+      hash = "sha256-xO+Xn3FR27Ib8aU7Of1LCpeEjOeg0PJVg29yTH2br3o=";
     };
     meta.homepage = "https://github.com/sand4rt/zen.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
diff --git a/pkgs/applications/editors/vim/plugins/non-generated/codediff-nvim/default.nix b/pkgs/applications/editors/vim/plugins/non-generated/codediff-nvim/default.nix
index 1c52ebcfeae8..a6d7ed216b54 100644
--- a/pkgs/applications/editors/vim/plugins/non-generated/codediff-nvim/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/codediff-nvim/default.nix
@@ -11,13 +11,13 @@
 }:
 vimUtils.buildVimPlugin rec {
   pname = "codediff.nvim";
-  version = "2.67.0";
+  version = "4.0.5";
 
   src = fetchFromGitHub {
     owner = "esmuellert";
     repo = "codediff.nvim";
     tag = "v${version}";
-    hash = "sha256-LNDCn8OAbRXBC2B4pbAhxVxGWBCbOJmDAELlB0LuGvI=";
+    hash = "sha256-wwb1u6Kpz3Nm0MMmo3OMtzWukeEEFsX4JjC+K/EaRQ4=";
   };
 
   dependencies = [ vimPlugins.nui-nvim ];
diff --git a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
index c46f7622d78c..53f4ab24965b 100644
--- a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
@@ -451,12 +451,12 @@
     };
     cuda = buildGrammar {
       language = "cuda";
-      version = "0.0.0+rev=1ebcedd";
+      version = "0.0.0+rev=fbafd28";
       src = fetchFromGitHub {
         owner = "tree-sitter-grammars";
         repo = "tree-sitter-cuda";
-        rev = "1ebcedde2e36c4e7fecf79b3119ffeddf5e7a683";
-        hash = "sha256-mfcRR2Qlk1e6CL7gQAluKPhqvFzWIFFzAipvnJ5Mhq0=";
+        rev = "fbafd28773ef10cb498771e642575b47fb15abe9";
+        hash = "sha256-P/G0vUIP1YegpJkrZq8lDo0yy1NDInfJl8WsuRThOiM=";
       };
       passthru.requires = [
         "cpp"
@@ -966,12 +966,12 @@
     };
     gitcommit = buildGrammar {
       language = "gitcommit";
-      version = "0.0.0+rev=a87878a";
+      version = "0.0.0+rev=55a265c";
       src = fetchFromGitHub {
         owner = "gbprod";
         repo = "tree-sitter-gitcommit";
-        rev = "a87878a27b78f75ba59df5bb2fbe36ce88c319ab";
-        hash = "sha256-6kBoXBdXxTnoEiEAlKwop9qYbSST12H1AfiSftG4zwo=";
+        rev = "55a265cf763ec15d6e2d96bb206e3f5e30d82bae";
+        hash = "sha256-GaxjYAfDTxhwNA3cNLCNWmmz/H1OpuD6kodSD73684E=";
       };
       meta.homepage = "https://github.com/gbprod/tree-sitter-gitcommit";
     };
@@ -1408,12 +1408,12 @@
     };
     idris = buildGrammar {
       language = "idris";
-      version = "0.0.0+rev=c56a25c";
+      version = "0.0.0+rev=9fe334f";
       src = fetchFromGitHub {
         owner = "kayhide";
         repo = "tree-sitter-idris";
-        rev = "c56a25cf57c68ff929356db25505c1cc4c7820f6";
-        hash = "sha256-aOAxb0KjhSwlNX/IDvGwEysYvImgUEIDeNDOWRl1qNk=";
+        rev = "9fe334fb603fdce0e84349ed78f41ae3d2f7036b";
+        hash = "sha256-Y3UN9sldWw5MLvdi8bGTzid2p5h27pMICEb6tvZbC4w=";
       };
       meta.homepage = "https://github.com/kayhide/tree-sitter-idris";
     };
@@ -1477,12 +1477,12 @@
     };
     javadoc = buildGrammar {
       language = "javadoc";
-      version = "0.0.0+rev=2ba54a7";
+      version = "0.0.0+rev=4e9e1db";
       src = fetchFromGitHub {
         owner = "rmuir";
         repo = "tree-sitter-javadoc";
-        rev = "2ba54a791a31a8c1ed60045a755a86eb10c602e2";
-        hash = "sha256-VcAYKbB7V/gd35WQR51463IIx2QqaFn7drLbiiDcL2w=";
+        rev = "4e9e1db7a116244aaa248f0cf58ca058694a0de4";
+        hash = "sha256-PPq8SNVowtYYIsMGU1F6QvIPb7Ry56I7AHMeBU0sq+Q=";
       };
       meta.homepage = "https://github.com/rmuir/tree-sitter-javadoc";
     };
@@ -1636,12 +1636,12 @@
     };
     kdl = buildGrammar {
       language = "kdl";
-      version = "0.0.0+rev=b37e3d5";
+      version = "0.0.0+rev=v2.0.0";
       src = fetchFromGitHub {
         owner = "tree-sitter-grammars";
         repo = "tree-sitter-kdl";
-        rev = "b37e3d58e5c5cf8d739b315d6114e02d42e66664";
-        hash = "sha256-irx8aMEdZG2WcQVE2c7ahwLjqEoUAOOjvhDDk69a6lE=";
+        tag = "v2.0.0";
+        hash = "sha256-Ot1abHQPNFaXeWzOGNPNe4WTvdFGP8pNuc+tfGlpXEU=";
       };
       meta.homepage = "https://github.com/tree-sitter-grammars/tree-sitter-kdl";
     };
@@ -1769,12 +1769,12 @@
     };
     liquidsoap = buildGrammar {
       language = "liquidsoap";
-      version = "0.0.0+rev=fa565a3";
+      version = "0.0.0+rev=301f669";
       src = fetchFromGitHub {
         owner = "savonet";
         repo = "tree-sitter-liquidsoap";
-        rev = "fa565a337b673050ba4f1131d21a1d259153140b";
-        hash = "sha256-UjFgw3AUDvsFLBdAh/zbQDjpZL1qBlCFMyxx3VVmXfM=";
+        rev = "301f66950622949f630fef9fa758ba69f66cf97a";
+        hash = "sha256-BPRaHi/TqU7s/XsrVz9+1aSfelmesOKr98ynELBgWM0=";
       };
       meta.homepage = "https://github.com/savonet/tree-sitter-liquidsoap";
     };
@@ -2012,12 +2012,12 @@
     };
     nix = buildGrammar {
       language = "nix";
-      version = "0.0.0+rev=3d0173d";
+      version = "0.0.0+rev=5a64e75";
       src = fetchFromGitHub {
         owner = "nix-community";
         repo = "tree-sitter-nix";
-        rev = "3d0173d903e630b6e14d17f1cf79488791379ded";
-        hash = "sha256-DFmFRZ47TPr8mgmRyXuHLfkQRmO58m4QyN9OBISb7IE=";
+        rev = "5a64e75fc1ee54f9e14e3a23918e057d43b2de2b";
+        hash = "sha256-gwiOJzi+t3g4PXmh+i6P/k0DLqY/ALjJr1wCb0FpbDA=";
       };
       meta.homepage = "https://github.com/nix-community/tree-sitter-nix";
     };
@@ -2153,12 +2153,12 @@
     };
     perl = buildGrammar {
       language = "perl";
-      version = "0.0.0+rev=c3e17b3";
+      version = "0.0.0+rev=f678e35";
       src = fetchFromGitHub {
         owner = "tree-sitter-perl";
         repo = "tree-sitter-perl";
-        rev = "c3e17b31179bf8f658c9f37c7a3ea6a202212d5a";
-        hash = "sha256-i5T7jT0zi0TSt7eAvjvJRak8kpzxOEoPydU+yEosNgA=";
+        rev = "f678e356280566100e7eed21716d6f59abdf96b7";
+        hash = "sha256-teMMSUPOlxzA+0edCIbxyvf/zoO3HBgDcKsoBVaOL40=";
       };
       generate = true;
       meta.homepage = "https://github.com/tree-sitter-perl/tree-sitter-perl";
@@ -2907,12 +2907,12 @@
     };
     sql = buildGrammar {
       language = "sql";
-      version = "0.0.0+rev=b2bd686";
+      version = "0.0.0+rev=593a5ec";
       src = fetchFromGitHub {
         owner = "derekstride";
         repo = "tree-sitter-sql";
-        rev = "b2bd686bb5f258506be69cddf76e49aa6b9de2c3";
-        hash = "sha256-kS65jw5jta4+hE6U+Kmg/GmgS2V8Kzo5TEhn7CxTomg=";
+        rev = "593a5ecc5dc3889890d8b24ba8fa7487ee01bfe5";
+        hash = "sha256-b7MtDuyESBiKkH/60KwMdXoQ44ox/ia9ihYtcYMDB4s=";
       };
       meta.homepage = "https://github.com/derekstride/tree-sitter-sql";
     };
@@ -3029,12 +3029,12 @@
     };
     swift = buildGrammar {
       language = "swift";
-      version = "0.0.0+rev=73c7923";
+      version = "0.0.0+rev=00bbb0a";
       src = fetchFromGitHub {
         owner = "alex-pinkus";
         repo = "tree-sitter-swift";
-        rev = "73c7923ac17ba6b9ebc0a2688bbddd0b75b725d6";
-        hash = "sha256-Kg3QcouSGKvKufBjIctwSc8h1gIwYnyPEJpw6xgOzL4=";
+        rev = "00bbb0a2550f8bc0023a2a4992922d51ae045626";
+        hash = "sha256-1HZ6LNvBWUntNONR1aNxbN8zHsnLQisgh+k2Fp/XpXk=";
       };
       generate = true;
       meta.homepage = "https://github.com/alex-pinkus/tree-sitter-swift";
@@ -3074,12 +3074,12 @@
     };
     t32 = buildGrammar {
       language = "t32";
-      version = "0.0.0+rev=acc92b0";
+      version = "0.0.0+rev=11947ac";
       src = fetchFromGitHub {
         owner = "xasc";
         repo = "tree-sitter-t32";
-        rev = "acc92b00d8564421f9c9c05ececfd2c7c942fe47";
-        hash = "sha256-7qWKy5ZcAB2VptlVHIGf3qTPmDI7mRdvB8weRvH9mi0=";
+        rev = "11947ac01ba681fb6f62667cb1447354833f4a5b";
+        hash = "sha256-hs0JHC4SOC4LvBQTMv/kKDQnW590p6waPHuO58CUaUw=";
       };
       meta.homepage = "https://github.com/xasc/tree-sitter-t32";
     };
@@ -3417,12 +3417,12 @@
     };
     vhdl = buildGrammar {
       language = "vhdl";
-      version = "0.0.0+rev=3fd99cd";
+      version = "0.0.0+rev=a88fb78";
       src = fetchFromGitHub {
         owner = "jpt13653903";
         repo = "tree-sitter-vhdl";
-        rev = "3fd99cd6681d3f3be00d05171c0d24551073c0a6";
-        hash = "sha256-cH/ns/RSM41QVeI6U6DWbn8Gs4NsitNhWe4HjXwExn4=";
+        rev = "a88fb782d4ec5ffe9303c32d6e86009e7e94a04a";
+        hash = "sha256-75Xg2B48S7okhS9jKCTRZYdshSjLWVB6EXRFeuNHRuk=";
       };
       meta.homepage = "https://github.com/jpt13653903/tree-sitter-vhdl";
     };
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 02bd1225736c..0547218c3f45 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -439,7 +439,7 @@ https://github.com/ncm2/float-preview.nvim/,,
 https://github.com/nvzone/floaterm/,,
 https://github.com/liangxianzhe/floating-input.nvim/,,
 https://github.com/floobits/floobits-neovim/,,
-https://github.com/0xstepit/flow.nvim/,,
+https://github.com/stefanopitton/flow.nvim/,,
 https://github.com/projectfluent/fluent.vim/,,
 https://github.com/maxmx03/fluoromachine.nvim/,,
 https://github.com/nvim-flutter/flutter-tools.nvim/,,
diff --git a/pkgs/by-name/ca/cargo-nextest/package.nix b/pkgs/by-name/ca/cargo-nextest/package.nix
index f49210db8e19..8dce6e033bd0 100644
--- a/pkgs/by-name/ca/cargo-nextest/package.nix
+++ b/pkgs/by-name/ca/cargo-nextest/package.nix
@@ -7,13 +7,13 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-nextest";
-  version = "0.9.143";
+  version = "0.9.144";
 
   src = fetchFromGitHub {
     owner = "nextest-rs";
     repo = "nextest";
     tag = "cargo-nextest-${finalAttrs.version}";
-    hash = "sha256-nbkNUWa3Meht5b4pXjteWP0XVwJZjSx6AuWxaJgdMm0=";
+    hash = "sha256-Lvwiqs5vhxndL4it/kmhYChWqh3/BkheOGGewgsTrm4=";
   };
 
   # FIXME: we don't support dtrace probe generation on macOS until we have a dtrace build: https://github.com/NixOS/nixpkgs/pull/392918
@@ -21,7 +21,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     ./no-dtrace-macos.patch
   ];
 
-  cargoHash = "sha256-j3OciGSKymfDuLqsnMSOInLvpSuAm92/SNMDACP23Gc=";
+  cargoHash = "sha256-jWG7OlUJxVGaRkU6KGzwGVkRuZepElpIyQK9fsXpD+Y=";
 
   cargoBuildFlags = [
     "-p"
diff --git a/pkgs/by-name/ch/chhoto-url/package.nix b/pkgs/by-name/ch/chhoto-url/package.nix
index 34215ca96f3f..7ba98451b456 100644
--- a/pkgs/by-name/ch/chhoto-url/package.nix
+++ b/pkgs/by-name/ch/chhoto-url/package.nix
@@ -8,13 +8,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "chhoto-url";
-  version = "7.5.1";
+  version = "7.5.5";
 
   src = fetchFromGitHub {
     owner = "SinTan1729";
     repo = "chhoto-url";
     tag = finalAttrs.version;
-    hash = "sha256-FAYbqNZVPUpfBKOn+cXvk5d8o29M9+d8t5ecihCQ4aY=";
+    hash = "sha256-u0S5HHTyuCYKnNDVs8mSjMyOPdhfKwNSIVh4pPXnpPM=";
     fetchLFS = true;
   };
 
@@ -27,7 +27,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail 'rust-version = "1.96"' 'rust-version = "1.95"'
   '';
 
-  cargoHash = "sha256-C+eH6lrFSpE7zuR3fyyP44KG/rV0N2Uh4E7She0HuEA=";
+  cargoHash = "sha256-23nDGYjGW4gL7sKh2YPPxkTUaxIQFRbPtVUVFDUlbHo=";
 
   postInstall = ''
     mkdir -p $out/share/chhoto-url
diff --git a/pkgs/by-name/cl/cliproxyapi/package.nix b/pkgs/by-name/cl/cliproxyapi/package.nix
index b91f67173786..222f174f4d18 100644
--- a/pkgs/by-name/cl/cliproxyapi/package.nix
+++ b/pkgs/by-name/cl/cliproxyapi/package.nix
@@ -10,13 +10,13 @@ buildGoModule (finalAttrs: {
   __structuredAttrs = true;
 
   pname = "cliproxyapi";
-  version = "7.2.146";
+  version = "7.3.2";
 
   src = fetchFromGitHub {
     owner = "router-for-me";
     repo = "CLIProxyAPI";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6A01jfwnydP5ww+Kr47TS6KHAt05enOiaHc9rYQEswU=";
+    hash = "sha256-AgyWs2xkgkUqKKOSY1dAaN9BdEqo73BKmPpYMzSxVds=";
   };
 
   vendorHash = "sha256-CrDp7MOr+AwJUhTovklXx3F1yaktQlvD7VYhYSY6VvY=";
diff --git a/pkgs/by-name/cl/clouddrive2/package.nix b/pkgs/by-name/cl/clouddrive2/package.nix
index 418777b2bae4..9ad50c8a2917 100644
--- a/pkgs/by-name/cl/clouddrive2/package.nix
+++ b/pkgs/by-name/cl/clouddrive2/package.nix
@@ -11,15 +11,15 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "clouddrive2";
-  version = "1.0.16";
+  version = "1.0.17";
 
   src = fetchurl {
     url = "https://github.com/cloud-fs/cloud-fs.github.io/releases/download/v${finalAttrs.version}/clouddrive-2-${os}-${arch}-${finalAttrs.version}.tgz";
     hash =
       {
-        x86_64-linux = "sha256-7iqzoB3uIuer4ydVTqIMM6ngh08vmHsr9SKNNXcSK3M=";
-        aarch64-linux = "sha256-YTA5v7i7LFVuDQRtV+T/D+o3dxf1Zep/rkUMDUhzMY0=";
-        aarch64-darwin = "sha256-WPvN7bHYFEnpnb9UE266Ws36iMV0hGvDe8b0FhCW0Ms=";
+        x86_64-linux = "sha256-WnvY7c++9ZWDYpSssX1P0jKJDiSMrLCkongkWMlwSfU=";
+        aarch64-linux = "sha256-GBzr4HXbClTqTgMhVzW3jljrMYWqjM/Uj8TLXZ6aUes=";
+        aarch64-darwin = "sha256-/U+DczEKskbYawjIh1s0sGX3Sja4XksYlQgYKvT20AY=";
       }
       .${stdenv.hostPlatform.system} or (throw "unsupported system ${stdenv.hostPlatform.system}");
   };
diff --git a/pkgs/by-name/co/cosmopolitan/cosmocc.nix b/pkgs/by-name/co/cosmopolitan/cosmocc.nix
index 53e4ba8400e7..7bf803541f6e 100644
--- a/pkgs/by-name/co/cosmopolitan/cosmocc.nix
+++ b/pkgs/by-name/co/cosmopolitan/cosmocc.nix
@@ -1,14 +1,27 @@
-{ runCommand, cosmopolitan }:
+{
+  runCommand,
+  cosmopolitan,
+  unzip,
+  fetchurl,
+}:
 
 let
+  version = "3.9.2";
+  cosmocc-zip = fetchurl {
+    url = "https://github.com/jart/cosmopolitan/releases/download/${version}/cosmocc-${version}.zip";
+    sha256 = "sha256-9P8Tr2X80wnz8c/QQnWZb7f3KkiXcmYoqMnPcy6FAZM=";
+  };
+
   cosmocc =
     runCommand "cosmocc-${cosmopolitan.version}"
       {
         pname = "cosmocc";
         inherit (cosmopolitan) version;
 
+        nativeBuildInputs = [ unzip ];
+
         passthru.tests = {
-          cc = runCommand "c-test" { } ''
+          cc = runCommand "c-test" { nativeBuildInputs = [ unzip ]; } ''
             ${cosmocc}/bin/cosmocc ${./hello.c}
             ./a.out > $out
           '';
@@ -19,9 +32,8 @@ let
         };
       }
       ''
-        mkdir -p $out/bin
-        install ${cosmopolitan.dist}/tool/scripts/{cosmocc,cosmoc++} $out/bin
-        sed 's|/opt/cosmo\([ /]\)|${cosmopolitan.dist}\1|g' -i $out/bin/*
+        mkdir -p $out
+        unzip -qo ${cosmocc-zip} -d $out
       '';
 in
 cosmocc
diff --git a/pkgs/by-name/co/cosmopolitan/fix-paths.patch b/pkgs/by-name/co/cosmopolitan/fix-paths.patch
index 85c59f3f12a3..24ca1ae208ea 100644
--- a/pkgs/by-name/co/cosmopolitan/fix-paths.patch
+++ b/pkgs/by-name/co/cosmopolitan/fix-paths.patch
@@ -1,12 +1,11 @@
 --- a/test/tool/plinko/plinko_test.c
 +++ b/test/tool/plinko/plinko_test.c
-@@ -91,8 +91,8 @@ TEST(plinko, worksOrPrintsNiceError) {
+@@ -89,7 +89,7 @@ TEST(plinko, worksOrPrintsNiceError) {
      sigaction(SIGQUIT, &savequit, 0);
      sigaction(SIGPIPE, &savepipe, 0);
      sigprocmask(SIG_SETMASK, &savemask, 0);
-     execve("bin/plinko.com", (char *const[]){"bin/plinko.com", 0},
--           (char *const[]){0});
-+           (char *const[]){"PATH=@coreutils@/bin", 0});
+-    execve("bin/plinko", (char *const[]){"bin/plinko", 0}, (char *const[]){0});
++    execve("bin/plinko", (char *const[]){"bin/plinko", 0}, (char *const[]){"PATH=@coreutils@/bin", 0});
      _exit(127);
    }
    close(pfds[0][0]);
diff --git a/pkgs/by-name/co/cosmopolitan/package.nix b/pkgs/by-name/co/cosmopolitan/package.nix
index be57b9ed5d4d..cd72590a18e3 100644
--- a/pkgs/by-name/co/cosmopolitan/package.nix
+++ b/pkgs/by-name/co/cosmopolitan/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchurl,
   bintools-unwrapped,
   callPackage,
   coreutils,
@@ -9,15 +10,23 @@
   unzip,
 }:
 
+let
+  bootstrap-version = "3.9.2";
+  cosmocc-zip = fetchurl {
+    url = "https://github.com/jart/cosmopolitan/releases/download/${bootstrap-version}/cosmocc-${bootstrap-version}.zip";
+    sha256 = "sha256-9P8Tr2X80wnz8c/QQnWZb7f3KkiXcmYoqMnPcy6FAZM=";
+  };
+in
+
 stdenv.mkDerivation (finalAttrs: {
   pname = "cosmopolitan";
-  version = "2.2";
+  version = "4.0.2";
 
   src = fetchFromGitHub {
     owner = "jart";
     repo = "cosmopolitan";
     rev = finalAttrs.version;
-    hash = "sha256-DTL1dXH+LhaxWpiCrsNjV74Bw5+kPbhEAA2Z1NKiPDk=";
+    hash = "sha256-NaWQK7SkqS3rrGG95dEjq8ptXogYU4bNndoXPU2rXnM=";
   };
 
   patches = [
@@ -41,7 +50,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   # slashes are significant because upstream uses o/$(MODE)/foo.o
   buildFlags = [
-    "o/cosmopolitan.h"
     "o//cosmopolitan.a"
     "o//libc/crt/crt.o"
     "o//ape/ape.o"
@@ -56,6 +64,12 @@ stdenv.mkDerivation (finalAttrs: {
   dontConfigure = true;
   dontFixup = true;
 
+  preBuild = ''
+    # Extract cosmocc to the expected location
+    mkdir -p .cosmocc/${bootstrap-version}
+    unzip -qo ${cosmocc-zip} -d .cosmocc/${bootstrap-version}
+  '';
+
   preCheck =
     let
       failingTests = [
@@ -63,8 +77,9 @@ stdenv.mkDerivation (finalAttrs: {
         "test/libc/calls/sched_setscheduler_test.c"
         "test/libc/thread/pthread_create_test.c"
         "test/libc/calls/getgroups_test.c"
-        # fails
-        "test/libc/stdio/posix_spawn_test.c"
+        "test/libc/calls/cachestat_test.c"
+        "test/libc/calls/getprogramexecutablename_test.c"
+        "test/libc/proc/posix_spawn_test.c"
       ];
     in
     lib.concatStringsSep ";\n" (map (t: "rm -v ${t}") failingTests);
@@ -73,8 +88,7 @@ stdenv.mkDerivation (finalAttrs: {
     runHook preInstall
 
     mkdir -p $out/{include,lib}
-    install o/cosmopolitan.h $out/include
-    install o/cosmopolitan.a o/libc/crt/crt.o o/ape/ape.{o,lds} o/ape/ape-no-modify-self.o $out/lib
+    install o//cosmopolitan.a o//libc/crt/crt.o o//ape/ape.{o,lds} o//ape/ape-no-modify-self.o $out/lib
     cp -RT . "$dist"
 
     runHook postInstall
diff --git a/pkgs/by-name/cr/cronet-go/package.nix b/pkgs/by-name/cr/cronet-go/package.nix
index 55dc1c74039e..7563a7bb2435 100644
--- a/pkgs/by-name/cr/cronet-go/package.nix
+++ b/pkgs/by-name/cr/cronet-go/package.nix
@@ -29,15 +29,16 @@ in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "cronet-go";
   # NOTE: https://github.com/SagerNet/sing-box/blob/stable/.github/CRONET_GO_VERSION
-  version = "150.0.7871.63-2";
+  version = "150.0.7871.63-3";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "SagerNet";
     repo = "cronet-go";
-    rev = "d9872d6dd0d39cc7e042d1199d736f16fc40cf8c";
+    # NOTE: keep rev for easier overriding
+    rev = "049f2909701ca088c9569f6b303bba5376a2b2ff";
     fetchSubmodules = true;
-    hash = "sha256-b7sOKn5d5BsZa73Jukw25fz3MVWHlQBteXrufWwszUk=";
+    hash = "sha256-705cctVHseRSJuEPFxlTRJJUWsNgZ4y5ZQ9nwhyTqFY=";
   };
 
   patches = [
diff --git a/pkgs/by-name/cs/csharp-ls/package.nix b/pkgs/by-name/cs/csharp-ls/package.nix
index b4d236c836be..e97883b51ddb 100644
--- a/pkgs/by-name/cs/csharp-ls/package.nix
+++ b/pkgs/by-name/cs/csharp-ls/package.nix
@@ -11,9 +11,9 @@ in
 
 buildDotnetGlobalTool (finalAttrs: {
   pname = "csharp-ls";
-  version = "0.27.0";
+  version = "0.28.0";
 
-  nugetHash = "sha256-pJo01GZOT7pHgctQ1TfvrRdxOTgoNw4y7OP+deK87a8=";
+  nugetHash = "sha256-j4FeTyJnQQaoJEvroH5LSwYuMVKOQEqoSJMS7/uMDgw=";
 
   inherit dotnet-sdk;
   dotnet-runtime = dotnet-sdk;
diff --git a/pkgs/by-name/da/dayon/package.nix b/pkgs/by-name/da/dayon/package.nix
index b7486299d7f5..e926e3b2ed88 100644
--- a/pkgs/by-name/da/dayon/package.nix
+++ b/pkgs/by-name/da/dayon/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dayon";
-  version = "18.0.0";
+  version = "18.0.2";
 
   src = fetchFromGitHub {
     owner = "RetGal";
     repo = "dayon";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ZjmPM0epVlkarUCQxdiaP5kghqJZ1J3QuP8nHzK3+xE=";
+    hash = "sha256-/58b99kaKp2Q2idWvy7CudjJeOfIEH0QEa7j2DG+lsU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/di/diskwatch/package.nix b/pkgs/by-name/di/diskwatch/package.nix
index 759e9fb4e0a7..3642ea343981 100644
--- a/pkgs/by-name/di/diskwatch/package.nix
+++ b/pkgs/by-name/di/diskwatch/package.nix
@@ -11,18 +11,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "diskwatch";
-  version = "0.5.4";
+  version = "0.5.7";
 
   src = fetchFromGitHub {
     owner = "matthart1983";
     repo = "diskwatch";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gDgF8PFyiMVk/XEiLPt8kPc50tjqiUm1FvCZVKX5f9M=";
+    hash = "sha256-RDQg3DIlfF/BIxcN8+Jg1UWnPZYp73wmfUb8DLsw9Ng=";
   };
 
   __structuredAttrs = true;
 
-  cargoHash = "sha256-4gTWfdJswuf7vISA1aIF/nVuzIrIIoI0GSnRCCYC/pA=";
+  cargoHash = "sha256-zgPA8YUVaN8ZqosjlSZzAxLBwMwturQdF2eZpyXlIAQ=";
 
   nativeCheckInputs = [ versionCheckHook ];
 
@@ -30,6 +30,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   doInstallCheck = true;
 
+  cargoTestFlags = [
+    "--"
+    "--skip=left_right_cycle_all_tabs_without_moving_selections"
+  ];
+
   meta = {
     description = "Single-host, read-only disk diagnostics TUI";
     homepage = "https://www.netwatchlabs.com/labs/diskwatch";
diff --git a/pkgs/by-name/do/doxygen-awesome-css/package.nix b/pkgs/by-name/do/doxygen-awesome-css/package.nix
index cc7a3aa8118b..57901696cfe3 100644
--- a/pkgs/by-name/do/doxygen-awesome-css/package.nix
+++ b/pkgs/by-name/do/doxygen-awesome-css/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "doxygen-awesome-css";
-  version = "2.4.2";
+  version = "2.5.0";
 
   src = fetchFromGitHub {
     owner = "jothepro";
     repo = "doxygen-awesome-css";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-AlnoIgH4DeIWM+Da7y7P6vkey0a0rlko9/slKHce49E=";
+    hash = "sha256-QXwR6nkjoowTxnbKdv2LFwwCVcehsdeeatK81B6c6sc=";
   };
 
   makeFlags = [ "PREFIX=$(out)" ];
diff --git a/pkgs/by-name/en/en-croissant/package.nix b/pkgs/by-name/en/en-croissant/package.nix
index 734b88abc458..19881600152f 100644
--- a/pkgs/by-name/en/en-croissant/package.nix
+++ b/pkgs/by-name/en/en-croissant/package.nix
@@ -27,13 +27,13 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "en-croissant";
-  version = "0.15.0";
+  version = "0.15.1";
 
   src = fetchFromGitHub {
     owner = "franciscoBSalgueiro";
     repo = "en-croissant";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xP/u3EABj11bylZKDpvBsuUF6QRmtArQV/pTY+0ANb0=";
+    hash = "sha256-a+UVorsX3A8/NYjXJM+k2uDvCdySLr88UqzTq7ROJEM=";
   };
 
   pnpmDeps = fetchPnpmDeps {
@@ -44,7 +44,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       ;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-icJ5cU0ZNnYSZl+MPASNmGanc9Vaa61sotza8/G/xs4=";
+    hash = "sha256-U6iJFtbgQV8VV3tvTP0DMUQWZ5FI+QUGpqpEhQJl40E=";
   };
 
   postPatch = ''
@@ -58,7 +58,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoRoot = "src-tauri";
 
-  cargoHash = "sha256-/L3URUdUIVrWHlXgRJfmDfFfOKGz9slDe49iE5nPw5k=";
+  cargoHash = "sha256-B5LAt2SKGZ8ksQZDvajWfkTKDzFZPCWGqRWvQAJPh/c=";
 
   buildAndTestSubdir = finalAttrs.cargoRoot;
 
diff --git a/pkgs/by-name/en/ente-desktop/package.nix b/pkgs/by-name/en/ente-desktop/package.nix
index b53c3c24aa1a..e172c3f548b8 100644
--- a/pkgs/by-name/en/ente-desktop/package.nix
+++ b/pkgs/by-name/en/ente-desktop/package.nix
@@ -1,38 +1,28 @@
 {
-  stdenv,
   lib,
-  fetchFromGitHub,
-  fetchYarnDeps,
-  nodejs,
-  electron_41,
-  yarnConfigHook,
-  copyDesktopItems,
-  vips,
-  ffmpeg,
-  makeWrapper,
+  stdenv,
+
   autoPatchelfHook,
+  buildNpmPackage,
+  copyDesktopItems,
+  fetchFromGitHub,
+  fetchNpmDeps,
   makeDesktopItem,
-  imagemagick,
-  wasm-pack,
   rustPlatform,
-  cargo,
-  rustc,
-  wasm-bindgen-cli_0_2_121,
-  binaryen,
+
+  electron_42,
+  ente-web,
+  ffmpeg,
+  imagemagick,
+  makeWrapper,
+  vips,
+
+  wasm-bindgen-cli_0_2_125,
+
+  nix-update-script,
 }:
 let
-  electron = electron_41;
-
-  resourcesDir =
-    if stdenv.hostPlatform.isDarwin then
-      "$out/Applications/ente.app/Contents/Resources"
-    else
-      "$out/share/ente-desktop/resources";
-in
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "ente-desktop";
-  version = "1.7.24";
+  version = "1.7.27";
 
   src = fetchFromGitHub {
     owner = "ente";
@@ -43,48 +33,58 @@ stdenv.mkDerivation (finalAttrs: {
       "web"
       "rust"
     ];
-    tag = "photosd-v${finalAttrs.version}";
-    hash = "sha256-/dO9qLJKbqR5h/GEJW9rLO1jNTa5GkqnJ9ORPSf5R8o=";
+
+    tag = "photos-desktop-v${version}";
+    hash = "sha256-H6ac1xcoQsxftREukIHpcYc8lFxnvmyxS9xNcr8H3/U=";
   };
 
+  electron = electron_42;
+
+  resourcesDir =
+    if stdenv.hostPlatform.isDarwin then
+      "$out/Applications/ente.app/Contents/Resources"
+    else
+      "$out/share/ente-desktop/resources";
+
+  webCargoDeps = rustPlatform.fetchCargoVendor {
+    inherit src;
+    name = "ente-desktop-web-cargo-deps";
+    sourceRoot = "${src.name}/rust";
+    hash = "sha256-RWemVZmH/NAQ+yDv2jwLhpHZpcp8BK3lZ4GjHMVLGLA=";
+  };
+
+  webNpmDeps = fetchNpmDeps {
+    inherit src;
+    name = "ente-desktop-web-npm-deps";
+    sourceRoot = "${src.name}/web";
+    hash = "sha256-iSqxANhb/DC/57Ltw4F9YKjTlJaAeZG3K4NrUN/+omA=";
+  };
+
+  webApp =
+    (ente-web.override {
+      # This produces an eval error when we're out of sync with ente-web
+      wasm-bindgen-cli_0_2_125 = wasm-bindgen-cli_0_2_125;
+      extraBuildEnv = {
+        _ENTE_IS_DESKTOP = "1";
+      };
+    }).overrideAttrs
+      {
+        inherit version src;
+        npmDeps = webNpmDeps;
+        cargoDeps = webCargoDeps;
+      };
+in
+buildNpmPackage (finalAttrs: {
+  pname = "ente-desktop";
+  inherit version src;
+
   sourceRoot = "${finalAttrs.src.name}/desktop";
-  cargoRoot = "../rust";
 
-  cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs)
-      pname
-      version
-      src
-      sourceRoot
-      cargoRoot
-      ;
-    hash = "sha256-F+g/6mcMnplOkTlR/vedS3MhimFAbXFZi6CTJ/cqoU0=";
-  };
-  offlineCache = fetchYarnDeps {
-    name = "ente-desktop-${finalAttrs.version}-offline-cache";
-    inherit (finalAttrs) src sourceRoot;
-    hash = "sha256-ne3gyI6psDpYzCPpepIIWao0yBiiv9qXQ+Iri3ELK/U=";
-  };
-  webOfflineCache = fetchYarnDeps {
-    name = "ente-desktop-${finalAttrs.version}-web-offline-cache";
-    inherit (finalAttrs) src;
-    sourceRoot = "${finalAttrs.src.name}/web";
-    hash = "sha256-MqsmOHVyPz+YiwNmrs447wrQ/Nk+t5TrLMsbDITM8p0=";
-  };
+  npmDepsHash = "sha256-qhimZHLD6mTUomZylLCyWWwPPi/m0VgjkMXGu2Wdkis=";
 
   nativeBuildInputs = [
-    nodejs
-    yarnConfigHook
-    makeWrapper
     imagemagick
-
-    wasm-pack
-    rustPlatform.cargoSetupHook
-    cargo
-    rustc
-    rustc.llvmPackages.lld
-    wasm-bindgen-cli_0_2_121
-    binaryen
+    makeWrapper
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     autoPatchelfHook # for onnxruntime
@@ -101,38 +101,25 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail "process.resourcesPath" "\"${resourcesDir}\""
   '';
 
-  postConfigure = ''
-    chmod u+w -R ..
+  preConfigure = ''
+    cp -R ${webApp}/ out/
 
-    pushd ../web
-    offlineCache=$webOfflineCache yarnConfigHook
-    rm -rf node_modules/wasm-pack node_modules/.bin/wasm-pack
-    popd
-
-    cp -r ${electron.dist} ./electron_dist
-    chmod u+w -R ./electron_dist
+    cp -R ${electron.dist} ./electron_dist
+    chmod -R u+w ./electron_dist
   '';
 
-  buildPhase = ''
-    runHook preBuild
+  npmBuildScript = "build-main";
 
-    pushd ../web
-    _ENTE_IS_DESKTOP=1 yarn build
-    popd
-    cp -r ../web/apps/photos/out out
-
-    yarn run tsc
-    yarn run electron-builder -- \
-      --dir \
-      --c.electronDist=./electron_dist \
-      --c.electronVersion=${electron.version} \
-      ${lib.optionalString stdenv.hostPlatform.isDarwin ''
-        --c.mac.identity=null \
-        --c.mac.notarize=false \
-      ''}
-
-    runHook postBuild
-  '';
+  npmBuildFlags = [
+    "--"
+    "--dir"
+    "--c.electronDist=./electron_dist"
+    "--c.electronVersion=${electron.version}"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    "--c.mac.identity=null"
+    "--c.mac.notarize=false"
+  ];
 
   installPhase = ''
     runHook preInstall
@@ -187,6 +174,18 @@ stdenv.mkDerivation (finalAttrs: {
     })
   ];
 
+  passthru = {
+    inherit webApp;
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--version-regex"
+        "photos-desktop-v(.*)"
+        "--subpackage"
+        "webApp"
+      ];
+    };
+  };
+
   meta = {
     description = "Desktop (Electron) client for Ente Photos";
     homepage = "https://ente.io/";
@@ -196,6 +195,7 @@ stdenv.mkDerivation (finalAttrs: {
       pinpox
       yuka
       Br1ght0ne
+      wrench-exile-legacy
     ];
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
   };
diff --git a/pkgs/by-name/ev/evil-winrm-py/package.nix b/pkgs/by-name/ev/evil-winrm-py/package.nix
index 6ba82a527fd5..4eb8e297b66d 100644
--- a/pkgs/by-name/ev/evil-winrm-py/package.nix
+++ b/pkgs/by-name/ev/evil-winrm-py/package.nix
@@ -10,14 +10,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "evil-winrm-py";
-  version = "1.6.0";
+  version = "1.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "adityatelange";
     repo = "evil-winrm-py";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-arfH7z7QGZPenyHLAubuG1VOJArUxI4wlQgV+iU7CvU=";
+    hash = "sha256-xB+JLeh5MUWHd9wWLEVFLkN4QxyRaaa1p6442hsshXc=";
   };
 
   pythonRelaxDeps = true;
diff --git a/pkgs/by-name/ex/explo/package.nix b/pkgs/by-name/ex/explo/package.nix
index 0682ccc4fecb..3101a6e14b7f 100644
--- a/pkgs/by-name/ex/explo/package.nix
+++ b/pkgs/by-name/ex/explo/package.nix
@@ -9,7 +9,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "explo";
-  version = "1.1.3";
+  version = "1.2.0";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -18,7 +18,7 @@ buildGoModule (finalAttrs: {
     owner = "LumePart";
     repo = "Explo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Wq5oU5AVgBYN3j/m7T07ZI16RF11orysXqjPbYKVd98=";
+    hash = "sha256-T0EYPiidK/qUaCCKePDT8KIbMnu3j7Z3ADmgtuhUb/o=";
   };
 
   webui = buildNpmPackage {
diff --git a/pkgs/by-name/fo/fosrl-olm/package.nix b/pkgs/by-name/fo/fosrl-olm/package.nix
index 9fbd589418c5..9b878044e642 100644
--- a/pkgs/by-name/fo/fosrl-olm/package.nix
+++ b/pkgs/by-name/fo/fosrl-olm/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "olm";
-  version = "1.8.2";
+  version = "1.9.1";
 
   src = fetchFromGitHub {
     owner = "fosrl";
     repo = "olm";
     tag = finalAttrs.version;
-    hash = "sha256-4uHRWAgJzDBnPXi4XyzsAUgNp+l5R7anUD7sfoYLY/k=";
+    hash = "sha256-LsT+Dt6Ozp447VtLKc/2MH9HGkfMwrOFIEp43DsNaXY=";
   };
 
-  vendorHash = "sha256-7eKAftMOnVBnZhC800fRmOoV+8+Tq+RlSEpVUdZKSlk=";
+  vendorHash = "sha256-1lZoB27aedPGxsiZrKy0++QN1OobCXc69r3j+0XhCjM=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
 
diff --git a/pkgs/by-name/ge/geesefs/package.nix b/pkgs/by-name/ge/geesefs/package.nix
index 658c16b34943..d8d76f8b50b9 100644
--- a/pkgs/by-name/ge/geesefs/package.nix
+++ b/pkgs/by-name/ge/geesefs/package.nix
@@ -5,7 +5,7 @@
 }:
 
 let
-  version = "0.43.8";
+  version = "0.43.9";
 in
 buildGoModule {
   pname = "geesefs";
@@ -15,12 +15,12 @@ buildGoModule {
     owner = "yandex-cloud";
     repo = "geesefs";
     rev = "v${version}";
-    hash = "sha256-NDe3GnB0xVly6Elfpa60+Wx3RyWhfPfssf1l7Tt20zY=";
+    hash = "sha256-hvuDQATjSyMUVne/x9STEAMaiZz1wswTH8dvKSdtBEI=";
   };
 
   # hashes differ per architecture otherwise.
   proxyVendor = true;
-  vendorHash = "sha256-mvzt/pk+S7DRcU6T3fBBQw1uvluO/tfeFmONucMv7t8=";
+  vendorHash = "sha256-VwqpiWdUa32dkoltgGxk+3hV9y6z6B0szIaWNLSx3Rs=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/ha/harlequin/package.nix b/pkgs/by-name/ha/harlequin/package.nix
index 2f8e3ef95d11..843a6a5919f8 100644
--- a/pkgs/by-name/ha/harlequin/package.nix
+++ b/pkgs/by-name/ha/harlequin/package.nix
@@ -13,7 +13,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "harlequin";
-  version = "2.13.0";
+  version = "2.14.0";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -21,7 +21,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "tconbeer";
     repo = "harlequin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-l8iLRLHf5m5ULClRtR+x0IJ3s/8NY5hVWFCODYhCcEo=";
+    hash = "sha256-sInr0zOw2efjbcr5+clzNodODCnzwVH36vOD+LJY0IM=";
   };
 
   postPatch =
diff --git a/pkgs/by-name/hy/hyprlax/package.nix b/pkgs/by-name/hy/hyprlax/package.nix
index 268059d7d3a2..e93e5e54e821 100644
--- a/pkgs/by-name/hy/hyprlax/package.nix
+++ b/pkgs/by-name/hy/hyprlax/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hyprlax";
-  version = "2.2.5";
+  version = "2.2.6";
 
   src = fetchFromGitHub {
     owner = "sandwichfarm";
     repo = "hyprlax";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pI+JEuUOuUh4ZBT4YhIxc6FU3rMwau6qacypDrQG+dg=";
+    hash = "sha256-IfkukFP93EbJu9zBmqgJ98AeAWqCZjH3+dA2Q/1YZOw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ja/jackett/package.nix b/pkgs/by-name/ja/jackett/package.nix
index 0febf7f49fa2..5a113fe11ae8 100644
--- a/pkgs/by-name/ja/jackett/package.nix
+++ b/pkgs/by-name/ja/jackett/package.nix
@@ -12,13 +12,13 @@
 
 buildDotnetModule (finalAttrs: {
   pname = "jackett";
-  version = "0.24.2527";
+  version = "0.24.2586";
 
   src = fetchFromGitHub {
     owner = "jackett";
     repo = "jackett";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-IbSXGddfsD9r0ElsSToQ+n75F09WUnF2jHirFOAiu+Q=";
+    hash = "sha256-rYUkxFkMcClN+GFt/nFR/y+zLbgLF9CFQUvfwuwNpo0=";
   };
 
   projectFile = "src/Jackett.Server/Jackett.Server.csproj";
diff --git a/pkgs/by-name/ki/kin-openapi/package.nix b/pkgs/by-name/ki/kin-openapi/package.nix
index 052690355638..4a7adbb5974d 100644
--- a/pkgs/by-name/ki/kin-openapi/package.nix
+++ b/pkgs/by-name/ki/kin-openapi/package.nix
@@ -5,14 +5,14 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "kin-openapi";
-  version = "0.147.0";
-  vendorHash = "sha256-uprdzJnaxd1UyEdZFFPvmo2Xu/QXJdheC1eqkyKY9Zc=";
+  version = "0.149.0";
+  vendorHash = "sha256-SCuvGh6m9lq/tR1vKioh3EWbgJsKbocXzqxPy4uPvaw=";
 
   src = fetchFromGitHub {
     owner = "getkin";
     repo = "kin-openapi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kf+p+UgqM3JonbtX54WRtKpYp9hHT7Cq+Uux1J7x8f0=";
+    hash = "sha256-a1foAgxxnjkX9DB7wZC9hDfRLnPjoJOhW5+45lIa1ZQ=";
   };
 
   checkFlags =
diff --git a/pkgs/by-name/ku/kubescape/package.nix b/pkgs/by-name/ku/kubescape/package.nix
index ca8830bafdc3..0a64714095a9 100644
--- a/pkgs/by-name/ku/kubescape/package.nix
+++ b/pkgs/by-name/ku/kubescape/package.nix
@@ -9,18 +9,18 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "kubescape";
-  version = "4.0.13";
+  version = "4.0.14";
 
   src = fetchFromGitHub {
     owner = "kubescape";
     repo = "kubescape";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-OsMCmh2KxpPKjXd0XkaoHtmaocw/kYDlZDPSPFgu5oU=";
+    hash = "sha256-QdWnwjvXsABcTsf+xzIYZ7GgwukzvyPQOppm7SDCK64=";
     fetchSubmodules = true;
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-dF6JC6Ransv8iCHz3LfmIs4HZAmbATlNsnII379rNyo=";
+  vendorHash = "sha256-y0iwBSUVh2pBEaiS1cGmW7F0/geGDuSdSHMmvhW5c9o=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/le/ledger-autosync/package.nix b/pkgs/by-name/le/ledger-autosync/package.nix
deleted file mode 100644
index 9f152a25f850..000000000000
--- a/pkgs/by-name/le/ledger-autosync/package.nix
+++ /dev/null
@@ -1,50 +0,0 @@
-{
-  lib,
-  stdenv,
-  python3Packages,
-  fetchFromGitHub,
-  ledger,
-  hledger,
-}:
-
-python3Packages.buildPythonApplication (finalAttrs: {
-  pname = "ledger-autosync";
-  version = "1.2.0";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "egh";
-    repo = "ledger-autosync";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-bbFjDdxYr85OPjdvY3JYtCe/8Epwi+8JN60PKVKbqe0=";
-  };
-
-  build-system = with python3Packages; [ poetry-core ];
-
-  dependencies = with python3Packages; [
-    ofxclient
-    ofxparse
-  ];
-
-  nativeCheckInputs = [
-    hledger
-    ledger
-    python3Packages.ledger
-    python3Packages.pytestCheckHook
-  ];
-
-  disabledTestPaths = lib.optionals stdenv.hostPlatform.isDarwin [
-    # keyring.errors.KeyringError: Can't get password from keychain: (-50, 'Unknown Error')
-    # keyring.backends.macOS.api.Error: (-50, 'Unknown Error')
-    "tests/test_cli.py"
-    "tests/test_weird_ofx.py"
-  ];
-
-  meta = {
-    homepage = "https://github.com/egh/ledger-autosync";
-    changelog = "https://github.com/egh/ledger-autosync/releases/tag/v${finalAttrs.version}";
-    description = "OFX/CSV autosync for ledger and hledger";
-    license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ eamsden ];
-  };
-})
diff --git a/pkgs/by-name/li/lief/package.nix b/pkgs/by-name/li/lief/package.nix
index 4779aeea9f24..656ee6d1de17 100644
--- a/pkgs/by-name/li/lief/package.nix
+++ b/pkgs/by-name/li/lief/package.nix
@@ -31,6 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   outputs = [
     "out"
+    "dev"
     "py"
   ];
 
@@ -83,6 +84,8 @@ stdenv.mkDerivation (finalAttrs: {
     };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Library to Instrument Executable Formats";
     homepage = "https://lief.quarkslab.com/";
diff --git a/pkgs/by-name/mo/mobsf/package.nix b/pkgs/by-name/mo/mobsf/package.nix
index fe1c985cc3d1..7ed9418c14d6 100644
--- a/pkgs/by-name/mo/mobsf/package.nix
+++ b/pkgs/by-name/mo/mobsf/package.nix
@@ -158,5 +158,6 @@ buildPythonApplication (finalAttrs: {
     license = lib.licenses.gpl3;
     maintainers = with lib.maintainers; [ felbinger ];
     platforms = lib.platforms.linux;
+    mainProgram = "mobsf";
   };
 })
diff --git a/pkgs/by-name/os/osmium/package.nix b/pkgs/by-name/os/osmium/package.nix
index 9b86d2e465af..2880b3839b54 100644
--- a/pkgs/by-name/os/osmium/package.nix
+++ b/pkgs/by-name/os/osmium/package.nix
@@ -31,11 +31,11 @@
 
 stdenv.mkDerivation rec {
   pname = "osmium";
-  version = "0.0.33-alpha";
+  version = "0.0.40-alpha";
 
   src = fetchurl {
     url = "https://updater.osmium.chat/Osmium-${version}-x64.tar.gz";
-    hash = "sha256-ybv/CCaCqcNvoyTNKQbjSdNxOC81QDnnKjKcw8X9y2Y=";
+    hash = "sha256-3rnDG3erDi7anPbOjTq5F5j/HB0f4z1XrDRmDRJgPFw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pa/pantalaimon/package.nix b/pkgs/by-name/pa/pantalaimon/package.nix
index a362b7ede8ab..8f34959791d7 100644
--- a/pkgs/by-name/pa/pantalaimon/package.nix
+++ b/pkgs/by-name/pa/pantalaimon/package.nix
@@ -93,5 +93,10 @@ python3Packages.buildPythonApplication rec {
     homepage = "https://github.com/matrix-org/pantalaimon";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ valodim ];
+    knownVulnerabilities = [
+      ''
+        pantalaimon was archived upstream, the last activity was from 4. June 2025.
+      ''
+    ];
   };
 }
diff --git a/pkgs/by-name/pr/prek/package.nix b/pkgs/by-name/pr/prek/package.nix
index 9bd9a6177e1d..51fe2933b0ca 100644
--- a/pkgs/by-name/pr/prek/package.nix
+++ b/pkgs/by-name/pr/prek/package.nix
@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "prek";
-  version = "0.5.2";
+  version = "0.5.3";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "j178";
     repo = "prek";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8LvrsmHTvlJ/1xrVsO/81zZBOVv6nyJ1rKeF8DCrTf8=";
+    hash = "sha256-O0CFdM4rQZSSj7k8LslvRaDabHU8//Z0wMr42bRRzz0=";
   };
 
-  cargoHash = "sha256-COOU7CelDvnMKxBbAPiNvo+E+GnrS+tXiyqPBdUYBMk=";
+  cargoHash = "sha256-TRmnVE+zyFTnKjyJU/rnhKQoL8rJA/ZNWfI2NOrzOOs=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/ru/rumdl/package.nix b/pkgs/by-name/ru/rumdl/package.nix
index b94116833104..8be6e88ce81f 100644
--- a/pkgs/by-name/ru/rumdl/package.nix
+++ b/pkgs/by-name/ru/rumdl/package.nix
@@ -11,7 +11,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rumdl";
-  version = "0.2.64";
+  version = "0.2.73";
 
   __structuredAttrs = true;
 
@@ -19,10 +19,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "rvben";
     repo = "rumdl";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Y/G50woA477wh7pUVuCrcm9h4JEufT6bI3x5uRwupzw=";
+    hash = "sha256-ExIsl0JlEb8hylph8r1r4mx/hOyiLZVVutVxvfgMSrU=";
   };
 
-  cargoHash = "sha256-cKBBhhz0mqaSXy57CKhYQ9tWzRPUs05HpxdvqZ676eA=";
+  cargoHash = "sha256-lGTe+efabf3MtSfPCKlsbNQviCQH5DEmXlXDFOCQSgw=";
 
   cargoBuildFlags = [
     "--bin=rumdl"
diff --git a/pkgs/by-name/sc/sccache/package.nix b/pkgs/by-name/sc/sccache/package.nix
index 9748c5243728..b40efbb273e7 100644
--- a/pkgs/by-name/sc/sccache/package.nix
+++ b/pkgs/by-name/sc/sccache/package.nix
@@ -8,17 +8,17 @@
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
-  version = "0.17.0";
+  version = "0.18.0";
   pname = "sccache";
 
   src = fetchFromGitHub {
     owner = "mozilla";
     repo = "sccache";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-nnPhRbhcKjV5ODt782IZgsA7qXSFzeFQ/Xmq4MTK74Y=";
+    sha256 = "sha256-QGsDxUAQzAr6Aia5/D21cGbVV0YJyuH3aBmEr9NynXQ=";
   };
 
-  cargoHash = "sha256-mmpDFXEcMJGRVwNHKdme6uEZ8aJlZtgEsWGIECKCLg4=";
+  cargoHash = "sha256-Jr4+46/yhcuTC017TA2UZQJUNIBuioI3xZnxxD/rKuc=";
 
   buildFeatures = lib.optionals distributed [
     "dist-client"
diff --git a/pkgs/by-name/se/searxng/package.nix b/pkgs/by-name/se/searxng/package.nix
index e7223629b24f..18998210b4ef 100644
--- a/pkgs/by-name/se/searxng/package.nix
+++ b/pkgs/by-name/se/searxng/package.nix
@@ -13,14 +13,14 @@ in
 python.pkgs.toPythonModule (
   python.pkgs.buildPythonApplication rec {
     pname = "searxng";
-    version = "0-unstable-2026-09-01";
+    version = "0-unstable-2026-09-12";
     pyproject = true;
 
     src = fetchFromGitHub {
       owner = "searxng";
       repo = "searxng";
-      rev = "79c8ffe0da5d75e48dbd55d505adab5d0ca554b9";
-      hash = "sha256-lxxO1wcZ9RDnw/28mVaT4oGGWkw5yEaeagcCdnlEInI=";
+      rev = "d4f00d15d4c2b8260124a9039b80bc9c1c26499b";
+      hash = "sha256-N5sCetc2JEnKl9eZn2HtJ4QP3TAH9h75/lmqqSWpPSg=";
     };
 
     nativeBuildInputs = with python.pkgs; [ pythonRelaxDepsHook ];
@@ -48,33 +48,26 @@ python.pkgs.toPythonModule (
 
     build-system = with python.pkgs; [ setuptools ];
 
-    dependencies =
-      with python.pkgs;
-      [
-        babel
-        certifi
-        cloudscraper
-        flask
-        flask-babel
-        httpx
-        httpx-socks
-        isodate
-        jinja2
-        lxml
-        markdown-it-py
-        msgspec
-        pygments
-        python-dateutil
-        pyyaml
-        sniffio
-        typer
-        typing-extensions
-        valkey
-        whitenoise
-      ]
-      ++ httpx.optional-dependencies.http2
-      ++ httpx.optional-dependencies.socks
-      ++ httpx-socks.optional-dependencies.asyncio;
+    dependencies = with python.pkgs; [
+      babel
+      certifi
+      cloudscraper
+      curl-cffi
+      flask
+      flask-babel
+      isodate
+      jinja2
+      lxml
+      markdown-it-py
+      msgspec
+      pygments
+      python-dateutil
+      pyyaml
+      typer
+      typing-extensions
+      valkey
+      whitenoise
+    ];
 
     # tests try to connect to network
     doCheck = false;
diff --git a/pkgs/by-name/si/sing-box/package.nix b/pkgs/by-name/si/sing-box/package.nix
index 25c232ecba81..14d835261e37 100644
--- a/pkgs/by-name/si/sing-box/package.nix
+++ b/pkgs/by-name/si/sing-box/package.nix
@@ -19,7 +19,7 @@ assert lib.assertMsg (
 buildGoModule (finalAttrs: {
   pname = "sing-box";
   # NOTE: also update cronet-go
-  version = "1.14.0";
+  version = "1.14.1";
 
   __structuredAttrs = true;
 
@@ -28,10 +28,10 @@ buildGoModule (finalAttrs: {
     owner = "SagerNet";
     repo = "sing-box";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1v9bgM2H439ZoSkomv5dmT5SNrkuyOJ1iFFPlYPsW/k=";
+    hash = "sha256-Ce1eukO8ERZEKUoqwcJEJIZcO6VcG/cRnfCdg4FCYJw=";
   };
 
-  vendorHash = "sha256-Bl73SkmnOyh5kULctDaxcOzXsYXRY2DOt80ME2+lBJo=";
+  vendorHash = "sha256-ttkDc8vRomNMNwqrZcGuvS0/M7Yqrpkz/h8wO5IVRQ4=";
 
   tags = [
     "with_gvisor"
diff --git a/pkgs/by-name/st/stackit-cli/package.nix b/pkgs/by-name/st/stackit-cli/package.nix
index 0e596efa5057..91f1c2966cc5 100644
--- a/pkgs/by-name/st/stackit-cli/package.nix
+++ b/pkgs/by-name/st/stackit-cli/package.nix
@@ -12,16 +12,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "stackit-cli";
-  version = "0.72.0";
+  version = "0.73.0";
 
   src = fetchFromGitHub {
     owner = "stackitcloud";
     repo = "stackit-cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Mh7AnagPxTyVBQPpghnc2Y9LrDwiO1JowG352jJw9NI=";
+    hash = "sha256-ZA/mmuF0svJOGps32K659NxGGLtcnobY1V7jsqzuROU=";
   };
 
-  vendorHash = "sha256-XlXPCYK57H8P2lluE/4KeQPPMmftx0teARjqb5FxnVM=";
+  vendorHash = "sha256-1uNrYr8wr00SlNfxZNVRkpc7OUp4K+nQ+0Gl90PHuxg=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/st/stalwart_0_16/package.nix b/pkgs/by-name/st/stalwart_0_16/package.nix
index e948143f346c..396ed215f62a 100644
--- a/pkgs/by-name/st/stalwart_0_16/package.nix
+++ b/pkgs/by-name/st/stalwart_0_16/package.nix
@@ -51,7 +51,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "stalwart" + (lib.optionalString stalwartEnterprise "-enterprise");
-  version = "0.16.20";
+  version = "0.16.22";
 
   __structuredAttrs = true;
 
@@ -59,10 +59,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "stalwartlabs";
     repo = "stalwart";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BEWD6hxRJL5WkdRChWvx9Ubn8pSWW8Wy7fpa7oQxtGU=";
+    hash = "sha256-GQprWpJ+/QyiZvshBL+TSDOhj+1RDIxMzVNN8OWCw1A=";
   };
 
-  cargoHash = "sha256-zGGJeMoEJOn/BtNUysuyuPeH3hHkJdrb9jUw6ZTpDgk=";
+  cargoHash = "sha256-qgVCMnaUFLw+q7kTB8ZV0nNc58/9Dq7Q6CwdsMluRX8=";
 
   env = {
     # https://docs.rs/openssl/latest/openssl/#manual
diff --git a/pkgs/by-name/st/stalwart_0_16/spam-filter.nix b/pkgs/by-name/st/stalwart_0_16/spam-filter.nix
index 3573a1911890..02c98c7b5fdb 100644
--- a/pkgs/by-name/st/stalwart_0_16/spam-filter.nix
+++ b/pkgs/by-name/st/stalwart_0_16/spam-filter.nix
@@ -9,13 +9,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "spam-filter";
-  version = "3.0.0";
+  version = "3.0.1";
 
   src = fetchFromGitHub {
     owner = "stalwartlabs";
     repo = "spam-filter";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mADA62eOHV7cJf4khkLh/OX0eQHRUus6nlGkieGFsKA=";
+    hash = "sha256-EeLzo8XZHdc9p/cUBMFF/IbHtW1QbMVWEjtOJdy9Gg8=";
   };
 
   __structuredAttrs = true;
diff --git a/pkgs/by-name/st/stalwart_0_16/webui.nix b/pkgs/by-name/st/stalwart_0_16/webui.nix
index 8ab6d0a74d74..c327bf143833 100644
--- a/pkgs/by-name/st/stalwart_0_16/webui.nix
+++ b/pkgs/by-name/st/stalwart_0_16/webui.nix
@@ -8,13 +8,13 @@
 }:
 buildNpmPackage (finalAttrs: {
   pname = "webui";
-  version = "1.0.9";
+  version = "1.0.10";
 
   src = fetchFromGitHub {
     owner = "stalwartlabs";
     repo = "webui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-EFENMnBuHU7ugciB/ib4iKGctZLMLl6rOZVQiakPgaU=";
+    hash = "sha256-ZWx9Ikkf9uCGK6EBiCIXr6rIpbFeoltCId1DAxUpiTI=";
   };
 
   npmDepsHash = "sha256-qe9cSrvs6kWwgbOO0xL7MBaJvICOvyuLFVi9R0dgnXQ=";
diff --git a/pkgs/by-name/su/sub-store-frontend/package.nix b/pkgs/by-name/su/sub-store-frontend/package.nix
index 7e3c2c8549f8..77829b5c17cc 100644
--- a/pkgs/by-name/su/sub-store-frontend/package.nix
+++ b/pkgs/by-name/su/sub-store-frontend/package.nix
@@ -14,13 +14,13 @@ let
 in
 buildNpmPackage (finalAttrs: {
   pname = "sub-store-frontend";
-  version = "2.31.1";
+  version = "2.32.2";
 
   src = fetchFromGitHub {
     owner = "sub-store-org";
     repo = "Sub-Store-Front-End";
     tag = finalAttrs.version;
-    hash = "sha256-eqaS5bPHBx92C6gv2iE9MYtBpI0UsvM0ptG97lPt8HE=";
+    hash = "sha256-TbKJNSA+ivUd7bHDtE9COaZFMqxRkRdBXWkK7y7JMSU=";
   };
 
   nativeBuildInputs = [
@@ -33,7 +33,7 @@ buildNpmPackage (finalAttrs: {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-Pr0l1JxHvpsgfsvQdENbxLehBAn7/X87lPxsbKfNBw0=";
+    hash = "sha256-EV6NpYQV9kQ4/2j012r0x66o5L9lNAYNvc5wI7DXiAU=";
   };
 
   npmConfigHook = pnpmConfigHook;
diff --git a/pkgs/by-name/sy/syswatch/package.nix b/pkgs/by-name/sy/syswatch/package.nix
index 31a783ec920a..9358daa90150 100644
--- a/pkgs/by-name/sy/syswatch/package.nix
+++ b/pkgs/by-name/sy/syswatch/package.nix
@@ -7,18 +7,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "syswatch";
-  version = "0.14.1";
+  version = "0.14.2";
 
   src = fetchFromGitHub {
     owner = "matthart1983";
     repo = "syswatch";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ROuPauHvrwXoDyYg0OZV2OtpuC9dTwhPuqU8+JDzTCw=";
+    hash = "sha256-udVUX1qNaPDBI+nEjm7LQ+2+HG6TBlgsjyQOP8pBqao=";
   };
 
   __structuredAttrs = true;
 
-  cargoHash = "sha256-jwWvZaU+mOeg80ImdTXDnu4219SXRiKlPzvpFBn1bbE=";
+  cargoHash = "sha256-iFqECXUMODxvjXQ4o0mD4dTdG9RYbpOBeyJzvteZZmI=";
 
   nativeCheckInputs = [ versionCheckHook ];
 
diff --git a/pkgs/by-name/te/temporal-ui-server/package.nix b/pkgs/by-name/te/temporal-ui-server/package.nix
index de40e64c14ea..8764c9166ee7 100644
--- a/pkgs/by-name/te/temporal-ui-server/package.nix
+++ b/pkgs/by-name/te/temporal-ui-server/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "temporal-ui-server";
-  version = "2.53.3";
+  version = "2.54.1";
 
   src = fetchFromGitHub {
     owner = "temporalio";
     repo = "ui-server";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-I8xUAs5eNceicxR7S4ahCxZEfg1tMjFZ/cgwsSErl94=";
+    hash = "sha256-qu/UVA7l6oZmL+k8xAUIJkPwbahu42uI8KjCqtxi1wk=";
   };
 
-  vendorHash = "sha256-PugVDr9HQnuNXzHGEDwna71SroL7m1RTG68PphYdbag=";
+  vendorHash = "sha256-KKQ2BEMAud5rpP97Iubbkh3ZuWV6aOsc44BvebQZy54=";
 
   postInstall = ''
     mv $out/bin/server $out/bin/temporal-ui-server
diff --git a/pkgs/by-name/te/texpresso/package.nix b/pkgs/by-name/te/texpresso/package.nix
index 894dc5ea9b51..de2dee6bf272 100644
--- a/pkgs/by-name/te/texpresso/package.nix
+++ b/pkgs/by-name/te/texpresso/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  unstableGitUpdater,
 
   # nativeBuildInputs
   makeWrapper,
@@ -21,13 +22,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "texpresso";
-  version = "0.1-unstable-2026-04-02";
+  version = "0.1-unstable-2026-07-22";
 
   src = fetchFromGitHub {
     owner = "let-def";
     repo = "texpresso";
-    rev = "96f008c94ece067fac8e896d0ab1808c948a4dd3";
-    hash = "sha256-ew7n3Sp4uYLv5jijRW2rRM9s63TQCeFgKXmmBXdYjx4=";
+    rev = "e8df7709077b2f86f6e16e6c86ceefb86de06f8d";
+    hash = "sha256-ijQwoQIJ6CsAd7eY9kkK2aHO/5FRFP5/tE6H9R/pngY=";
   };
 
   postPatch = ''
@@ -41,6 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   strictDeps = true;
+  __structuredAttrs = true;
 
   nativeBuildInputs = [
     makeWrapper
@@ -72,6 +74,10 @@ stdenv.mkDerivation (finalAttrs: {
     ];
   };
 
+  passthru.updateScript = unstableGitUpdater {
+    tagPrefix = "v";
+  };
+
   installPhase = ''
     runHook preInstall
     install -D -t "$out/bin/" "build/texpresso"
@@ -82,7 +88,12 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     inherit (finalAttrs.src.meta) homepage;
     description = "Live rendering and error reporting for LaTeX";
-    maintainers = with lib.maintainers; [ nickhu ];
+    changelog = "https://github.com/let-def/texpresso/blob/main/CHANGELOG.md";
+    mainProgram = "texpresso";
+    maintainers = with lib.maintainers; [
+      nickhu
+      stephen-huan
+    ];
     license = lib.licenses.mit;
     platforms = lib.platforms.unix;
   };
diff --git a/pkgs/by-name/us/usage/package.nix b/pkgs/by-name/us/usage/package.nix
index 1af0496d0042..12d9e0785ae2 100644
--- a/pkgs/by-name/us/usage/package.nix
+++ b/pkgs/by-name/us/usage/package.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "usage";
-  version = "6.6.1";
+  version = "6.9.0";
 
   src = fetchFromGitHub {
     owner = "jdx";
     repo = "usage";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-OQCIQqR8tO10w1WTi6rPCdBN5o9bZetmwGojU3p4o4I=";
+    hash = "sha256-LMgvgmh32CkbKzC6h/F6oYdI5iK2gdaCuoY2dVJrQp0=";
   };
 
-  cargoHash = "sha256-dZo75rg3kh4R7D79A1JOYnq0s8iWzf1bJffm3oK7I2A=";
+  cargoHash = "sha256-L8+fIgoGoDbgCTkQ/IG24EkDq7OwW2JShoRLoyEdJCE=";
 
   # Upstream's releases ship only the `usage` binary.
   cargoBuildFlags = [
diff --git a/pkgs/by-name/wa/wasmtime/package.nix b/pkgs/by-name/wa/wasmtime/package.nix
index e0283b048cb0..1aa54f57cd7d 100644
--- a/pkgs/by-name/wa/wasmtime/package.nix
+++ b/pkgs/by-name/wa/wasmtime/package.nix
@@ -17,9 +17,9 @@
 let
   sources = {
     lts-36 = {
-      version = "36.0.14";
-      hash = "sha256-OI8wixfzV4U2brmW7uqhk55eLhj+Fdp+J5Pzz1iBO6U=";
-      cargoHash = "sha256-2Nwcw3Z4/cbkRcG2hJ2/1PcXZf3vYB9NGUlr7pxdqzU=";
+      version = "36.0.15";
+      hash = "sha256-I+CGuTxtIOMz/VBkiQ9En5/YniskQKLHeGrmnTYa9m0=";
+      cargoHash = "sha256-68EM8hDN5dFxcBnEkqDt0sX86BYYiUZXfRaXut4WYpI=";
     };
     main = {
       version = "48.0.1";
diff --git a/pkgs/by-name/wp/wpscan/Gemfile.lock b/pkgs/by-name/wp/wpscan/Gemfile.lock
index f8803e049a5e..06ad26e01fde 100644
--- a/pkgs/by-name/wp/wpscan/Gemfile.lock
+++ b/pkgs/by-name/wp/wpscan/Gemfile.lock
@@ -1,7 +1,7 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    activesupport (8.1.3)
+    activesupport (8.1.3.1)
       base64
       bigdecimal
       concurrent-ruby (~> 1.0, >= 1.3.1)
@@ -18,32 +18,31 @@ GEM
       public_suffix (>= 2.0.2, < 8.0)
     base64 (0.3.0)
     bigdecimal (4.1.2)
-    concurrent-ruby (1.3.6)
+    concurrent-ruby (1.3.8)
     connection_pool (3.0.2)
     drb (2.2.3)
     ethon (0.18.0)
       ffi (>= 1.15.0)
       logger
-    ferrum (0.17.2)
+    ferrum (0.18.0)
       addressable (~> 2.5)
       base64 (~> 0.2)
       concurrent-ruby (~> 1.1)
-      webrick (~> 1.7)
       websocket-driver (~> 0.7)
     ffi (1.17.4)
     fiddle (1.1.8)
     get_process_mem (1.0.0)
       bigdecimal (>= 2.0)
       ffi (~> 1.0)
-    i18n (1.14.8)
+    i18n (1.15.2)
       concurrent-ruby (~> 1.0)
-    json (2.19.8)
+    json (3.0.2)
     logger (1.7.0)
     mini_portile2 (2.8.9)
     minitest (6.0.6)
       drb (~> 2.0)
       prism (~> 1.5)
-    nokogiri (1.19.3)
+    nokogiri (1.19.4)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
     ostruct (0.6.3)
@@ -61,11 +60,11 @@ GEM
       concurrent-ruby (~> 1.0)
     uri (1.1.1)
     webrick (1.9.2)
-    websocket-driver (0.8.1)
+    websocket-driver (0.8.2)
       base64
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.5)
-    wpscan (4.0.0)
+    wpscan (4.1.0)
       activesupport (>= 7.1, < 8.2)
       addressable (~> 2.9)
       ethon (>= 0.14, < 0.19)
diff --git a/pkgs/by-name/wp/wpscan/gemset.nix b/pkgs/by-name/wp/wpscan/gemset.nix
index 0791a73ad477..ed1ec95de132 100644
--- a/pkgs/by-name/wp/wpscan/gemset.nix
+++ b/pkgs/by-name/wp/wpscan/gemset.nix
@@ -18,10 +18,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "03m2vjhq3nmc8c3hpivxhvkjd8igg16nmv0p2fgdsgacppgy1991";
+      sha256 = "0xhkhdx8svhaf439y398yixik0snzarnnsy43688p92yy9jqfic5";
       type = "gem";
     };
-    version = "8.1.3";
+    version = "8.1.3.1";
   };
   addressable = {
     dependencies = [ "public_suffix" ];
@@ -59,10 +59,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1aymcakhzl83k77g2f2krz07bg1cbafbcd2ghvwr4lky3rz86mkb";
+      sha256 = "1qfi2ns3zwkgq616fc127xiqhan7g7m7gqpwriwcr34nds1vxwdj";
       type = "gem";
     };
-    version = "1.3.6";
+    version = "1.3.8";
   };
   connection_pool = {
     groups = [ "default" ];
@@ -103,17 +103,16 @@
       "addressable"
       "base64"
       "concurrent-ruby"
-      "webrick"
       "websocket-driver"
     ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1vp62wy85hr5fa0d29y3wh3zaj10sszj3pl19mps84dja2l4099c";
+      sha256 = "1inpi750jjbjlhqcf414jfx966zc6i5j3sc7y1sivz2jwcbbxf2c";
       type = "gem";
     };
-    version = "0.17.2";
+    version = "0.18.0";
   };
   ffi = {
     groups = [ "default" ];
@@ -155,20 +154,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1994i044vdmzzkyr76g8rpl1fq1532wf0sb21xg5r1ilj5iphmr8";
+      sha256 = "1dfikmmd9dllirsfq0kjiyxpmlq0afkxm5sslsr97r9g85ifpy80";
       type = "gem";
     };
-    version = "1.14.8";
+    version = "1.15.2";
   };
   json = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1anz6a6n33x4s3906s0bz6x161kk1ns3h7xxsn3rpxkfsw7k2m33";
+      sha256 = "1pqrpn0wkxvhcrwm4i0z9ailjj7if45zkkih0hij2k1q25xpwvcf";
       type = "gem";
     };
-    version = "2.19.8";
+    version = "3.0.2";
   };
   logger = {
     groups = [ "default" ];
@@ -213,10 +212,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1s30b7h7qpyim30m8060xs415mbr3ci7i5hdg09chh1aqfx2qcbq";
+      sha256 = "1d9safb4dly6qmc2g06444l0zifby52yy6j1a5fa1g4j3ihm3jah";
       type = "gem";
     };
-    version = "1.19.3";
+    version = "1.19.4";
   };
   ostruct = {
     groups = [ "default" ];
@@ -350,10 +349,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "15idgibqpdaj97f734drx8a7k1jcc8wvxlk2nbafac72ihikicjs";
+      sha256 = "0ij19k6034x0c4hw0ywa7wnk5s912r8aq0hhjss10d5z36q5dicp";
       type = "gem";
     };
-    version = "0.8.1";
+    version = "0.8.2";
   };
   websocket-extensions = {
     groups = [ "default" ];
@@ -386,10 +385,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "17i50avb4qa4dsvbd53mdp2mklbkhirvqczvrzz17zdswm2gfy39";
+      sha256 = "0pm9mlgajr2maf84b3cfbf0srgdvmkb9fclinddfhvqiczw7yipy";
       type = "gem";
     };
-    version = "4.0.0";
+    version = "4.1.0";
   };
   xmlrpc = {
     dependencies = [
diff --git a/pkgs/by-name/ze/zeek/broker/default.nix b/pkgs/by-name/ze/zeek/broker/default.nix
index 13318d1577e2..0231b549e3eb 100644
--- a/pkgs/by-name/ze/zeek/broker/default.nix
+++ b/pkgs/by-name/ze/zeek/broker/default.nix
@@ -12,22 +12,22 @@ let
   src-cmake = fetchFromGitHub {
     owner = "zeek";
     repo = "cmake";
-    rev = "fd0696f9077933660f7da5f81978e86b3e967647";
-    hash = "sha256-21wZVwoOB05l/WX/VrVbSx+lFKFQ9MHWjQQD4weavFs=";
-  };
-  src-3rdparty = fetchFromGitHub {
-    owner = "zeek";
-    repo = "zeek-3rdparty";
-    rev = "a6cc3c7603bb535cf3bec7442140e7126e0577a8";
-    hash = "sha256-yzhuTam9zOQ3MP7fk+ACN5P5tHtHXWbyQP73DwISIv8=";
+    rev = "a1482b8f9829cea870b4db75c085de1249e11bcb";
+    hash = "sha256-kFkLig0g/sBKRg8EnfUldj9R7qX6V+c8Ap98p0YBsIw=";
   };
+  prometheus-cpp' = prometheus-cpp.overrideAttrs (old: {
+    # Zeek expects Broker to include prometheus-cpp symbols rather than link them dynamically.
+    cmakeFlags = builtins.filter (flag: flag != "-DBUILD_SHARED_LIBS=ON") old.cmakeFlags ++ [
+      "-DBUILD_SHARED_LIBS=OFF"
+    ];
+  });
   caf' = caf.overrideAttrs (old: {
-    version = "unstable-2024-09-14-zeek";
+    version = "unstable-2025-07-23-zeek";
     src = fetchFromGitHub {
       owner = "zeek";
       repo = "actor-framework";
-      rev = "10afbbc5ee40263b258b7cf3f0e5abb436f79e89";
-      hash = "sha256-R22eKAFNP2VVA4eL6ycN6aHM0NgDHVll9aFNmOQ/pDc=";
+      rev = "4aa660d003d8bbb922a33fb7a31f80d9d3271262";
+      hash = "sha256-OlrW+gk/oLEEIWRSugI1DqRJ+KYF4ZJxHVWKXWllGjU=";
     };
     cmakeFlags = old.cmakeFlags ++ [
       "-DCAF_ENABLE_TESTING=OFF"
@@ -37,7 +37,7 @@ let
 in
 stdenv.mkDerivation {
   pname = "zeek-broker";
-  version = "2.6.0-unstable-2025-04-23";
+  version = "2.8.0-unstable-2026-08-11";
   outputs = [
     "out"
     "py"
@@ -48,13 +48,13 @@ stdenv.mkDerivation {
   src = fetchFromGitHub {
     owner = "zeek";
     repo = "broker";
-    rev = "5b6cbb8c2d9124aa1fb0bea5799433138dc64cf9";
-    hash = "sha256-L6Z+ltX3tJEwZ05zEftrJlOhwbhs06MY9cEJDM2kcck=";
+    rev = "fdca6b8ef4b95ec6518a32db46503c28cc812be4";
+    hash = "sha256-GuqmbFCIeS9maW9cy+dIMqwOTTiQIKJX1nVQoAIxDpA=";
   };
   postUnpack = ''
-    rmdir $sourceRoot/cmake $sourceRoot/3rdparty
+    rmdir $sourceRoot/cmake $sourceRoot/caf
     ln -s ${src-cmake} ''${sourceRoot}/cmake
-    ln -s ${src-3rdparty} ''${sourceRoot}/3rdparty
+    ln -s ${caf'.src} ''${sourceRoot}/caf
 
     # Refuses to build the bindings unless this file is present, but never
     # actually uses it.
@@ -71,7 +71,7 @@ stdenv.mkDerivation {
   ];
   buildInputs = [
     openssl
-    prometheus-cpp
+    prometheus-cpp'
     python3.pkgs.pybind11
   ];
   propagatedBuildInputs = [ caf' ];
@@ -80,12 +80,11 @@ stdenv.mkDerivation {
     "-DCAF_ROOT=${caf'}"
     "-DENABLE_STATIC_ONLY:BOOL=${if stdenv.hostPlatform.isStatic then "ON" else "OFF"}"
     "-DPY_MOD_INSTALL_DIR=${placeholder "py"}/${python3.sitePackages}/"
-    "-Dprometheus-cpp_ROOT=${lib.getDev prometheus-cpp}"
+    "-Dprometheus-cpp_ROOT=${lib.getDev prometheus-cpp'}"
   ];
 
   meta = {
     description = "Zeek's Messaging Library";
-    mainProgram = "broker-benchmark";
     homepage = "https://github.com/zeek/broker";
     license = lib.licenses.bsd3;
     platforms = lib.platforms.unix;
diff --git a/pkgs/by-name/ze/zeek/fix-installation.patch b/pkgs/by-name/ze/zeek/fix-installation.patch
index 7a1d98c818c3..9ccec23d7107 100644
--- a/pkgs/by-name/ze/zeek/fix-installation.patch
+++ b/pkgs/by-name/ze/zeek/fix-installation.patch
@@ -80,3 +80,24 @@ index 1ebe7c2..1435509 100644
  
  # A couple of configuration options that are needed are placed in here.
  configure_file(etc/zeekctl.cfg.in
+diff --git a/tools/systemd-generator/CMakeLists.txt b/tools/systemd-generator/CMakeLists.txt
+index 0e6a46f..031eb1f 100644
+--- a/tools/systemd-generator/CMakeLists.txt
++++ b/tools/systemd-generator/CMakeLists.txt
+@@ -14,6 +14,6 @@ if (NOT is_subproject)
+     set(_default_config_file "/usr/local/zeek/etc/zeek/zeek.conf")
+     set(_default_base_dir "/usr/local/zeek/")
+ else ()
+-    set(_default_config_file "${ZEEK_ETC_INSTALL_DIR}/zeek/zeek.conf")
++    set(_default_config_file "${ZEEK_ETC_INSTALL_DIR}/zeek.conf")
+     set(_default_base_dir "${CMAKE_INSTALL_PREFIX}")
+ endif ()
+@@ -49,7 +49,7 @@ if (ENABLE_ZEEK_SYSTEMD_GENERATOR)
+     if (is_subproject)
+         # Install a default configuration at <PREFXI>etc/default/zeek
+         include(InstallPackageConfigFile)
+         InstallPackageConfigFile(${CMAKE_CURRENT_SOURCE_DIR}/etc/zeek/zeek.conf
+-                                 ${ZEEK_ETC_INSTALL_DIR}/zeek zeek.conf)
++                                 ${CMAKE_INSTALL_PREFIX}/etc/zeek zeek.conf)
+     endif ()
+ endif ()
diff --git a/pkgs/by-name/ze/zeek/package.nix b/pkgs/by-name/ze/zeek/package.nix
index 8a1c77247324..0f878ee35d57 100644
--- a/pkgs/by-name/ze/zeek/package.nix
+++ b/pkgs/by-name/ze/zeek/package.nix
@@ -4,6 +4,7 @@
   callPackage,
   fetchurl,
   cmake,
+  civetweb,
   flex,
   bison,
   openssl,
@@ -19,6 +20,7 @@
   gettext,
   coreutils,
   ncurses,
+  zeromq,
 }:
 
 let
@@ -30,11 +32,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "zeek";
-  version = "7.2.2";
+  version = "8.2.2";
 
   src = fetchurl {
     url = "https://download.zeek.org/zeek-${finalAttrs.version}.tar.gz";
-    hash = "sha256-Kx3ySPlBmaFoThxGDWTPHF5J10ccK1YvlCrF++mAWJM=";
+    hash = "sha256-o7bWDva+w+sSgY/jLK7HB/m21jBT6u7pQuTsmvZNhiw=";
   };
 
   strictDeps = true;
@@ -54,12 +56,14 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     broker
+    civetweb
     curl
     gperftools
     libmaxminddb
     libpcap
     ncurses
     openssl
+    zeromq
     zlib
     python
   ]
@@ -73,6 +77,12 @@ stdenv.mkDerivation (finalAttrs: {
   postPatch = ''
     patchShebangs ./ci/collect-repo-info.py
     patchShebangs ./auxil/spicy/scripts
+
+    # Broker statically includes prometheus-cpp, but uses nixpkgs' shared civetweb.
+    substituteInPlace cmake/FindPrometheusCpp.cmake \
+      --replace-fail \
+        '#set(zeekdeps ''${zeekdeps} prometheus-cpp::core prometheus-cpp::pull)' \
+        $'find_package(civetweb CONFIG REQUIRED)\nset(zeekdeps ''${zeekdeps} civetweb::civetweb-cpp)'
   '';
 
   cmakeFlags = [
diff --git a/pkgs/development/cuda-modules/packages/cudnn-frontend/package.nix b/pkgs/development/cuda-modules/packages/cudnn-frontend/package.nix
index bcdc2aa71492..9637762912e2 100644
--- a/pkgs/development/cuda-modules/packages/cudnn-frontend/package.nix
+++ b/pkgs/development/cuda-modules/packages/cudnn-frontend/package.nix
@@ -35,13 +35,13 @@ backendStdenv.mkDerivation (finalAttrs: {
   name = "${cudaNamePrefix}-${finalAttrs.pname}-${finalAttrs.version}";
 
   pname = "cudnn-frontend";
-  version = "1.28.0";
+  version = "1.29.0";
 
   src = fetchFromGitHub {
     owner = "NVIDIA";
     repo = "cudnn-frontend";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-oMsXgbLHhCnU+Q7bItzAPAN0U8LL4ZZCuXJwFKbJpEg=";
+    hash = "sha256-fCmsjglU4rSreN4249ZL/Y0dY0v8se1Jbani2UZT36g=";
   };
 
   # nlohmann_json should be the only vendored dependency.
diff --git a/pkgs/development/ocaml-modules/asn1-combinators/default.nix b/pkgs/development/ocaml-modules/asn1-combinators/default.nix
index c40db11752c8..0a2f4a34f6fe 100644
--- a/pkgs/development/ocaml-modules/asn1-combinators/default.nix
+++ b/pkgs/development/ocaml-modules/asn1-combinators/default.nix
@@ -11,11 +11,11 @@ buildDunePackage (finalAttrs: {
   minimalOCamlVersion = "4.13.0";
 
   pname = "asn1-combinators";
-  version = "0.3.2";
+  version = "0.3.3";
 
   src = fetchurl {
     url = "https://github.com/mirleft/ocaml-asn1-combinators/releases/download/v${finalAttrs.version}/asn1-combinators-${finalAttrs.version}.tbz";
-    hash = "sha256-KyaYX24nIgc9zZ+ENVvWdX4SZDtaSOMLPAf/fPsNin8=";
+    hash = "sha256-9NFZqL2nw7GGpIAUSOh5zO0TZ5nGiuxR+zc85OEoSxE=";
   };
 
   propagatedBuildInputs = [ ptime ];
diff --git a/pkgs/development/ocaml-modules/http-mirage-client/default.nix b/pkgs/development/ocaml-modules/http-mirage-client/default.nix
index 4689be5ce7f0..e27c87c386a6 100644
--- a/pkgs/development/ocaml-modules/http-mirage-client/default.nix
+++ b/pkgs/development/ocaml-modules/http-mirage-client/default.nix
@@ -14,15 +14,13 @@
 
 buildDunePackage (finalAttrs: {
   pname = "http-mirage-client";
-  version = "0.0.10";
-
-  minimalOCamlVersion = "4.08";
+  version = "0.0.11";
 
   __darwinAllowLocalNetworking = true;
 
   src = fetchurl {
     url = "https://github.com/robur-coop/http-mirage-client/releases/download/v${finalAttrs.version}/http-mirage-client-${finalAttrs.version}.tbz";
-    hash = "sha256-AXEIH1TIAayD4LkFv0yGD8OYvcdC/AJnGudGlkjcWLY=";
+    hash = "sha256-sNl/GvHATfLKymy5f91GUJkyjOgjpYIouuFntIzE+CM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/ocaml-modules/jsont/default.nix b/pkgs/development/ocaml-modules/jsont/default.nix
index b4ebf6925ba1..94aacbc11f9f 100644
--- a/pkgs/development/ocaml-modules/jsont/default.nix
+++ b/pkgs/development/ocaml-modules/jsont/default.nix
@@ -1,6 +1,7 @@
 {
   lib,
   fetchzip,
+  ocaml,
   topkg,
   buildTopkgPackage,
   withBrr ? true,
@@ -9,35 +10,45 @@
   bytesrw,
   withCmdliner ? true,
   cmdliner,
+  withTypegist ? lib.versionAtLeast ocaml.version "5.5",
+  typegist,
 }:
 
 buildTopkgPackage rec {
   pname = "jsont";
-  version = "0.3.0";
+  version = "0.4.0";
 
   minimalOCamlVersion = "4.14.0";
 
   src = fetchzip {
     url = "https://erratique.ch/software/jsont/releases/jsont-${version}.tbz";
-    hash = "sha256-Gojblihb+So/0KpQHbIWuE33Ir2a4w5DdY+F3S9+qBk=";
+    hash = "sha256-2L7YaPXn4PzGl/3XwuwvpQTr4aiS85Hm1HNofuaK7DY=";
   };
 
   buildInputs = lib.optional withCmdliner cmdliner;
 
-  propagatedBuildInputs = lib.optional withBrr brr ++ lib.optional withBytesrw bytesrw;
+  propagatedBuildInputs =
+    lib.optional withBrr brr ++ lib.optional withBytesrw bytesrw ++ lib.optional withTypegist typegist;
 
-  buildPhase = "${topkg.run} build ${
-    lib.escapeShellArgs [
-      "--with-brr"
-      (lib.boolToString withBrr)
+  buildPhase = ''
+    runHook preBuild
+    ${topkg.run} build ${
+      lib.escapeShellArgs [
+        "--with-brr"
+        (lib.boolToString withBrr)
 
-      "--with-bytesrw"
-      (lib.boolToString withBytesrw)
+        "--with-bytesrw"
+        (lib.boolToString withBytesrw)
 
-      "--with-cmdliner"
-      (lib.boolToString withCmdliner)
-    ]
-  }";
+        "--with-cmdliner"
+        (lib.boolToString withCmdliner)
+
+        "--with-typegist"
+        (lib.boolToString withTypegist)
+      ]
+    }
+    runHook postBuild
+  '';
 
   meta = {
     description = "Declarative JSON data manipulation";
diff --git a/pkgs/development/ocaml-modules/typegist/default.nix b/pkgs/development/ocaml-modules/typegist/default.nix
new file mode 100644
index 000000000000..0a54b7cb9546
--- /dev/null
+++ b/pkgs/development/ocaml-modules/typegist/default.nix
@@ -0,0 +1,40 @@
+{
+  lib,
+  fetchzip,
+  topkg,
+  buildTopkgPackage,
+}:
+
+buildTopkgPackage rec {
+  pname = "typegist";
+  version = "0.0.0";
+
+  minimalOCamlVersion = "5.5.0";
+
+  src = fetchzip {
+    url = "https://erratique.ch/software/typegist/releases/typegist-${version}.tbz";
+    hash = "sha256-zt37VVZnlxvzw7idYw9v34rNiuJkWG37DqaqkzLDRXI=";
+  };
+
+  buildPhase = "${topkg.run} build";
+
+  doCheck = true;
+
+  meta = {
+    description = "The essence of OCaml types as values";
+    longDescription = ''
+      This dynamic type representation can be used to devise generic
+      type-indexed functions — value serializers, generators, differs, editors,
+      FFI glue, etc. Any accessible type can be described up to the limits
+      defined by its public interface.
+
+      Typegist does not model OCaml’s type language in full detail. It focuses
+      on a core structural subset decorated with typed-indexed metadata to
+      provide an ergonomic interface for both producers and processors of the
+      representation.
+    '';
+    homepage = "https://erratique.ch/software/typegist";
+    license = lib.licenses.isc;
+    maintainers = with lib.maintainers; [ toastal ];
+  };
+}
diff --git a/pkgs/development/python-modules/azure-mgmt-resource-deployments/default.nix b/pkgs/development/python-modules/azure-mgmt-resource-deployments/default.nix
index d1998c9179ce..480902538d1e 100644
--- a/pkgs/development/python-modules/azure-mgmt-resource-deployments/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-resource-deployments/default.nix
@@ -12,13 +12,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "azure-mgmt-resource-deployments";
-  version = "1.0.0";
+  version = "2.0.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "azure_mgmt_resource_deployments";
     inherit (finalAttrs) version;
-    hash = "sha256-uA8p9i4Ot9l642mp/Tz7ReCp12JmzctiwHkoDXlR0ss=";
+    hash = "sha256-8DnRSQgY0zcoD2OpFbulQHaytlabg/OSPNXF4vP8Q4c=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index cf7a3034498a..22ec2758bab1 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -358,13 +358,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "boto3-stubs";
-  version = "1.43.93";
+  version = "1.43.94";
   pyproject = true;
 
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit (finalAttrs) version;
-    hash = "sha256-e3TTrxAzcoDPatwmay9zPOG52SSLXvEq1XDYTt76uE0=";
+    hash = "sha256-XRc+9lUml+uhp50zgQaUB7J348Ko2XcfppgsJDcxzko=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/credsweeper/default.nix b/pkgs/development/python-modules/credsweeper/default.nix
index fb09758a484b..eb0ddb3f024b 100644
--- a/pkgs/development/python-modules/credsweeper/default.nix
+++ b/pkgs/development/python-modules/credsweeper/default.nix
@@ -1,19 +1,21 @@
 {
   lib,
   stdenv,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  hatchling,
+
+  # dependencies
   base58,
   beautifulsoup4,
   bech32,
   brotli,
-  buildPythonPackage,
   colorama,
   cryptography,
-  deepdiff,
-  fetchFromGitHub,
   gitpython,
-  hatchling,
   humanfriendly,
-  hypothesis,
   lxml,
   numpy,
   odfpy,
@@ -21,39 +23,43 @@
   openpyxl,
   pandas,
   pdfminer-six,
-  psutil,
   pybase62,
   pygments,
   pyjks,
   pysquashfsimage,
-  pytestCheckHook,
   python-dateutil,
   python-docx,
   python-pptx,
-  pythonOlder,
   pyxlsb,
   pyyaml,
   rpmfile,
   striprtf,
   tqdm,
-  versionCheckHook,
   whatthepatch,
   xlrd,
+  # python>=3.14 only:
   zstandard,
+
+  # tests
+  deepdiff,
+  hypothesis,
+  psutil,
+  pytestCheckHook,
+  pythonOlder,
+  versionCheckHook,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "credsweeper";
-  version = "1.18.3";
+  version = "1.18.4";
   pyproject = true;
-
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "Samsung";
     repo = "CredSweeper";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3PE/tf8GjDY6yakMuWCTcCVZMobiEx/o/QJQdJai4JY=";
+    hash = "sha256-1ElNvejQc5pzMvPJVjEyCkIY14M42W0ktNY83WKWk7A=";
   };
 
   build-system = [ hatchling ];
@@ -126,6 +132,7 @@ buildPythonPackage (finalAttrs: {
     "test_it_works_n"
     "test_log_n"
     "test_log_p"
+    "test_sqlite_injection_n"
   ];
 
   meta = {
diff --git a/pkgs/development/python-modules/daft/default.nix b/pkgs/development/python-modules/daft/default.nix
index 2917c3a146fa..cec8eaf178e0 100644
--- a/pkgs/development/python-modules/daft/default.nix
+++ b/pkgs/development/python-modules/daft/default.nix
@@ -14,7 +14,6 @@
   nasm,
 
   # dependencies
-  fsspec,
   packaging,
   pyarrow,
   tqdm,
@@ -79,7 +78,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "daft";
-  version = "0.7.24";
+  version = "0.7.25";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -87,7 +86,7 @@ buildPythonPackage (finalAttrs: {
     owner = "Eventual-Inc";
     repo = "Daft";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HCqkeN9kmQTvzlPlweeE1nYPf2YjLep2RUUIFRXlGGw=";
+    hash = "sha256-XVtMB+fZ1zbFoStwlZmmam3/t8eD7vRop+7YlNhuLhs=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
@@ -143,11 +142,9 @@ buildPythonPackage (finalAttrs: {
   };
 
   pythonRelaxDeps = [
-    "fsspec"
     "tqdm"
   ];
   dependencies = [
-    fsspec
     packaging
     pyarrow
     tqdm
diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index 7d023d3c4e18..23b4fad17323 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202609141";
+  version = "0.1.202609151";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-e8iqM4EHIV7BsQzSgauiPVdt2rouMxIcIpcVcjCMFQ8=";
+    hash = "sha256-PuEHycBvNed0vLi3W9FuLfgAPp7W9RSXG3TfWda1Z7A=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/ifcopenshell/boost-1.91-optional.patch b/pkgs/development/python-modules/ifcopenshell/boost-1.91-optional.patch
new file mode 100644
index 000000000000..41cd77e53b07
--- /dev/null
+++ b/pkgs/development/python-modules/ifcopenshell/boost-1.91-optional.patch
@@ -0,0 +1,38 @@
+boost 1.91 rewrote boost::optional and made its converting constructor
+unconditionally explicit, breaking aggregate brace-init of the radius
+member in the profile_point structs. std::optional (C++17) keeps the
+non-explicit converting constructor, so call sites compile unchanged.
+
+--- a/src/ifcgeom/profile_helper.h
++++ b/src/ifcgeom/profile_helper.h
+@@ -1,6 +1,8 @@
+ #ifndef PROFILE_HELPER_H
+ #define PROFILE_HELPER_H
+ 
++#include <optional>
++
+ #include "taxonomy.h"
+ 
+ namespace ifcopenshell {
+@@ -8,18 +10,18 @@
+ 	namespace geometry {
+ 		struct profile_point {
+ 			std::array<double, 2> xy;
+-			boost::optional<double> radius;
++			std::optional<double> radius;
+ 		};
+ 
+ 		struct profile_point_with_edges {
+ 			Eigen::Vector2d xy;
+-			boost::optional<double> radius;
++			std::optional<double> radius;
+ 			taxonomy::edge::ptr previous, next;
+ 		};
+ 
+ 		struct profile_point_with_edges_3d {
+ 			Eigen::Vector3d xy;
+-			boost::optional<double> radius;
++			std::optional<double> radius;
+ 			taxonomy::edge::ptr previous, next;
+ 		};
+ 
diff --git a/pkgs/development/python-modules/ifcopenshell/default.nix b/pkgs/development/python-modules/ifcopenshell/default.nix
index c411a633c33f..0beec24d324e 100644
--- a/pkgs/development/python-modules/ifcopenshell/default.nix
+++ b/pkgs/development/python-modules/ifcopenshell/default.nix
@@ -75,6 +75,9 @@ buildPythonPackage rec {
       url = "https://github.com/IfcOpenShell/IfcOpenShell/commit/88b861737c7c206d0e7307f90d37467e9585515c.patch";
       hash = "sha256-zMoQcBWRdtavL0xdsr53SqyG6CZoeon8/mmJhrw85lc=";
     })
+
+    # boost 1.91 made boost::optional's converting constructor explicit
+    ./boost-1.91-optional.patch
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/jupyter-collaboration-ui/default.nix b/pkgs/development/python-modules/jupyter-collaboration-ui/default.nix
index b64484c40702..545c8159260e 100644
--- a/pkgs/development/python-modules/jupyter-collaboration-ui/default.nix
+++ b/pkgs/development/python-modules/jupyter-collaboration-ui/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "jupyter-collaboration-ui";
-  version = "3.0.2";
+  version = "3.0.3";
   pyproject = true;
   __structuredAttrs = true;
 
   src = fetchPypi {
     pname = "jupyter_collaboration_ui";
     inherit (finalAttrs) version;
-    hash = "sha256-X2o6WEb5tAk6EYV212cx/fAa3SL7F5WmKyn9Pd/dExQ=";
+    hash = "sha256-rhzn916lgkn7K4E/9RCYYzU4ghWZv6DTeYKX/ZeA+X0=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index c4b9cde8752d..cf4c90c4f288 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -167,8 +167,8 @@ in
       "sha256-MOB/Ingh53OWXeT0YdKUGO3ExgPDe6N3WWe95m6twZY=";
 
   mypy-boto3-billingconductor =
-    buildMypyBoto3Package "billingconductor" "1.43.7"
-      "sha256-BWFbcDtacQzWwN0fc+OH/iSbsE3Lw0xAjn9V3/Lbxws=";
+    buildMypyBoto3Package "billingconductor" "1.43.94"
+      "sha256-IjuRZtPf62Ng1ZmBaSyOOAioNf2CNUKUMyB2im3gRNQ=";
 
   mypy-boto3-braket =
     buildMypyBoto3Package "braket" "1.43.0"
@@ -275,8 +275,8 @@ in
       "sha256-YnE8vRO1bzaGSCHM102N3ChinXrxj2/+vnHqst4pPbo=";
 
   mypy-boto3-codedeploy =
-    buildMypyBoto3Package "codedeploy" "1.43.82"
-      "sha256-WpKfZ0zeDn0qXnw98ATlOrBpyjWTx4YnGt11bNqVh84=";
+    buildMypyBoto3Package "codedeploy" "1.43.94"
+      "sha256-Ixx+vf5y9YZI+apS3rb80k5qMSU9mMZdhwK13Kvv9dg=";
 
   mypy-boto3-codeguru-reviewer =
     buildMypyBoto3Package "codeguru-reviewer" "1.43.0"
@@ -571,8 +571,8 @@ in
       "sha256-vMz4YKm78XMavlPUNiSVAYmAbyUBrJhUXbFrhxIvUJA=";
 
   mypy-boto3-glue =
-    buildMypyBoto3Package "glue" "1.43.72"
-      "sha256-RVRPMIAv+0iaJxpv/Xnj8dPt9HNIIOfPNe4yTQqspVI=";
+    buildMypyBoto3Package "glue" "1.43.94"
+      "sha256-sqiuAhdQg1wAwNjrMXz6KgOWNZQ5OLQ80J73omFgLaM=";
   mypy-boto3-grafana =
     buildMypyBoto3Package "grafana" "1.43.11"
       "sha256-XJOSLyL1+uEweZ9zER7IhH3DFLaLtpJKvuRIn8Ri+P4=";
@@ -610,8 +610,8 @@ in
       "sha256-9lzXp7Ug90MSZ7WdMiXoMnUiaAA9zCk/oS6gc0ulEMo=";
 
   mypy-boto3-imagebuilder =
-    buildMypyBoto3Package "imagebuilder" "1.43.37"
-      "sha256-6NLOcq8lrMDBgl+oaPrGSbPaHzObGq2vJYzPnNQFMCQ=";
+    buildMypyBoto3Package "imagebuilder" "1.43.94"
+      "sha256-2qbOe8e+74Ok8lBlkbAXFAuo8OKPeNDK+NltaoN/bxg=";
 
   mypy-boto3-importexport =
     buildMypyBoto3Package "importexport" "1.43.0"
@@ -1326,8 +1326,8 @@ in
       "sha256-Y3p6SUr/Ej8SiWm9Dk3ifaxF3vesKlCdglgIcoJDemk=";
 
   mypy-boto3-sts =
-    buildMypyBoto3Package "sts" "1.43.0"
-      "sha256-fDjP/Q8H/yJtC4AWYQv1+hm9b6KnWgTP3uy6LKvqikw=";
+    buildMypyBoto3Package "sts" "1.43.94"
+      "sha256-0WnjCd7s+Zy4qJfjRzNXH8qmBUR+Kbn2qMMiAsgmkM4=";
 
   mypy-boto3-support =
     buildMypyBoto3Package "support" "1.43.84"
diff --git a/pkgs/development/python-modules/nvidia-cudnn-frontend/default.nix b/pkgs/development/python-modules/nvidia-cudnn-frontend/default.nix
index 4fe7bf603996..2ac8e4993d84 100644
--- a/pkgs/development/python-modules/nvidia-cudnn-frontend/default.nix
+++ b/pkgs/development/python-modules/nvidia-cudnn-frontend/default.nix
@@ -18,6 +18,10 @@
   # propagatedBuildInputs
   nlohmann_json,
 
+  # dependencies
+  apache-tvm-ffi,
+  nvidia-cutlass-dsl,
+
   # tests
   looseversion,
   pytestCheckHook,
@@ -74,6 +78,11 @@ buildPythonPackage.override { stdenv = cudaPackages.backendStdenv; } (finalAttrs
     nlohmann_json
   ];
 
+  dependencies = [
+    apache-tvm-ffi
+    nvidia-cutlass-dsl
+  ];
+
   pythonImportsCheck = [ "cudnn" ];
 
   # requires GPU
diff --git a/pkgs/development/python-modules/ofxclient/default.nix b/pkgs/development/python-modules/ofxclient/default.nix
deleted file mode 100644
index 5d1952dd967f..000000000000
--- a/pkgs/development/python-modules/ofxclient/default.nix
+++ /dev/null
@@ -1,43 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchPypi,
-  ofxhome,
-  ofxparse,
-  beautifulsoup4,
-  lxml,
-  keyring,
-}:
-
-buildPythonPackage rec {
-  version = "2.0.3";
-  format = "setuptools";
-  pname = "ofxclient";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "0jdhqsbl34yn3n0x6mwsnl58c25v5lp6vr910c2hk7l74l5y7538";
-  };
-
-  patchPhase = ''
-    substituteInPlace setup.py --replace '"argparse",' ""
-  '';
-
-  # ImportError: No module named tests
-  doCheck = false;
-
-  propagatedBuildInputs = [
-    ofxhome
-    ofxparse
-    beautifulsoup4
-    lxml
-    keyring
-  ];
-
-  meta = {
-    homepage = "https://github.com/captin411/ofxclient";
-    description = "OFX client for downloading transactions from banks";
-    mainProgram = "ofxclient";
-    license = lib.licenses.mit;
-  };
-}
diff --git a/pkgs/development/python-modules/pydocket/default.nix b/pkgs/development/python-modules/pydocket/default.nix
index feb231cb6dd6..90cdc1cc21b3 100644
--- a/pkgs/development/python-modules/pydocket/default.nix
+++ b/pkgs/development/python-modules/pydocket/default.nix
@@ -25,7 +25,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pydocket";
-  version = "0.25.0";
+  version = "0.25.2";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -33,7 +33,7 @@ buildPythonPackage (finalAttrs: {
     owner = "chrisguidry";
     repo = "docket";
     tag = finalAttrs.version;
-    hash = "sha256-yVXWOoTGwIBeBmYZ6xW5SuQYzLXVNPPXZ/E2VBncivg=";
+    hash = "sha256-xiA4VHRDPv3iMil/MjFezAQCqw6rsR1nHj9fdBzHEQk=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pydriller/default.nix b/pkgs/development/python-modules/pydriller/default.nix
index ceafee9cdffb..fda7270bbd88 100644
--- a/pkgs/development/python-modules/pydriller/default.nix
+++ b/pkgs/development/python-modules/pydriller/default.nix
@@ -12,17 +12,17 @@
   lizard,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pydriller";
-  version = "2.11";
+  version = "2.12";
   pyproject = true;
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "ishepard";
     repo = "pydriller";
-    tag = version;
-    hash = "sha256-p4caHh95PnmWLC2fiSX8BCxfLymxSUUNIdxIWOc8O5w=";
+    tag = finalAttrs.version;
+    hash = "sha256-5zBb9z2+Hvkf/XdA9SOMcEQwcSE/r4jg9vW+mpPc5wM=";
   };
 
   build-system = [ setuptools ];
@@ -45,4 +45,4 @@ buildPythonPackage rec {
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ felbinger ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/rich-click/default.nix b/pkgs/development/python-modules/rich-click/default.nix
index 963fd89bd650..28454499bfe8 100644
--- a/pkgs/development/python-modules/rich-click/default.nix
+++ b/pkgs/development/python-modules/rich-click/default.nix
@@ -1,23 +1,31 @@
 {
   lib,
   buildPythonPackage,
-  click,
   fetchFromGitHub,
-  rich,
+
+  # build-system
   setuptools,
+
+  # dependencies
+  click,
+  rich,
   typing-extensions,
+
+  # tests
+  versionCheckHook,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "rich-click";
-  version = "1.9.8";
+  version = "1.9.9";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "ewels";
     repo = "rich-click";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-FjtwlWYFqI7vQ7JtpCtTIi90mbEkmHSKH8SROy9d+vU=";
+    hash = "sha256-vFwsaqgue5IKBnBeHMa4jXFPqT7kI/WT0NieaAgtUjM=";
   };
 
   build-system = [ setuptools ];
@@ -28,8 +36,10 @@ buildPythonPackage (finalAttrs: {
     typing-extensions
   ];
 
-  # Module has no test
-  doCheck = false;
+  # No python tests
+  nativeCheckInputs = [
+    versionCheckHook
+  ];
 
   pythonImportsCheck = [ "rich_click" ];
 
diff --git a/pkgs/development/python-modules/splunk-sdk/default.nix b/pkgs/development/python-modules/splunk-sdk/default.nix
index d7c8900ad999..6f3dec60d8f0 100644
--- a/pkgs/development/python-modules/splunk-sdk/default.nix
+++ b/pkgs/development/python-modules/splunk-sdk/default.nix
@@ -6,16 +6,16 @@
   deprecation,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "splunk-sdk";
-  version = "3.0.0";
+  version = "3.0.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "splunk";
     repo = "splunk-sdk-python";
-    tag = version;
-    hash = "sha256-8544jRlv//Qkcq4JqrMOBZhFC6K6BI1WGT6PK4AwVvs=";
+    tag = finalAttrs.version;
+    hash = "sha256-wVndu+f7+6hWSnNZSZatTVuRxjZDA8o9MKMB3QzEOZQ=";
   };
 
   build-system = [ setuptools ];
@@ -27,8 +27,8 @@ buildPythonPackage rec {
   meta = {
     description = "Splunk Enterprise Software Development Kit (SDK) for Python";
     homepage = "https://github.com/splunk/splunk-sdk-python";
-    changelog = "https://github.com/splunk/splunk-sdk-python/releases/tag/${version}";
+    changelog = "https://github.com/splunk/splunk-sdk-python/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ levigross ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index 6e3053a73679..774fea5f5b3f 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "tencentcloud-sdk-python";
-  version = "3.1.175";
+  version = "3.1.176";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = finalAttrs.version;
-    hash = "sha256-9XSmcieq0+U3TJPvXWZBfwag4WfyFrHQtJYWaOCaRww=";
+    hash = "sha256-dt4o3ePCcbNEpk98dmmDi1vMZV4d51EK+B1xDAzsf2w=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/textual-fastdatatable/default.nix b/pkgs/development/python-modules/textual-fastdatatable/default.nix
index c7c08c05bee7..9a6d11953bde 100644
--- a/pkgs/development/python-modules/textual-fastdatatable/default.nix
+++ b/pkgs/development/python-modules/textual-fastdatatable/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "textual-fastdatatable";
-  version = "0.19.1";
+  version = "0.19.2";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -30,7 +30,7 @@ buildPythonPackage (finalAttrs: {
     owner = "tconbeer";
     repo = "textual-fastdatatable";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-dFKeeV3/ux5YhnkjwLJbbHr1Mms3EGcG3+ybJXxcdCI=";
+    hash = "sha256-buOgvDFzK6wRrzm7AvT7BFFzHbCNEqX3OVsFS1FyJio=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/servers/sql/postgresql/ext/pgrouting.nix b/pkgs/servers/sql/postgresql/ext/pgrouting.nix
index b35797374275..442537bc2ac0 100644
--- a/pkgs/servers/sql/postgresql/ext/pgrouting.nix
+++ b/pkgs/servers/sql/postgresql/ext/pgrouting.nix
@@ -10,7 +10,7 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "pgrouting";
-  version = "4.0.1";
+  version = "4.0.2";
 
   nativeBuildInputs = [
     cmake
@@ -22,7 +22,7 @@ postgresqlBuildExtension (finalAttrs: {
     owner = "pgRouting";
     repo = "pgrouting";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-j3dlVcENhBveVmkuzWaLfHWy73OMDpC2FxrNQ4W6m9k=";
+    hash = "sha256-bETj/tG9O0kymTeJM9YlXzMPcBeegxnYQH/tMQsuXtY=";
   };
 
   meta = {
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 66f4f52690ba..c39b4686070a 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1310,6 +1310,7 @@ mapAliases {
   leaf = throw "'leaf' has been removed as it is unmaintained. Consider using 'fastfetch' instead"; # Added 2026-04-24
   leafnode = throw "'leafnode' has been removed as it is unmaintained and depends on EOL library PCRE. Consider using leafnode1 instead"; # Added 2026-07-30
   ledger-agent = throw "ledger-agent has been removed because upstream dropped Ledger support"; # Added 2026-03-11
+  ledger-autosync = throw "ledger-autosync has been removed because ofxclient was dropped"; # Added 2026-08-14
   ledger_agent = throw "ledger-agent has been removed because upstream dropped Ledger support"; # Added 2026-03-11
   lepton = throw "'lepton' has been removed as it is archived upstream and has known vulnerabilities (CVE-2022-4104). Consider using 'lepton-jpeg-util' instead"; # Added 2026-06-29
   lesstif = throw "'lesstif' has been removed due to its being broken and unmaintained upstream. Consider using 'motif' instead."; # Added 2025-06-09
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 3adb07d93340..110929adf504 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -2204,6 +2204,8 @@ let
 
         twt = callPackage ../development/ocaml-modules/twt { };
 
+        typegist = callPackage ../development/ocaml-modules/typegist { };
+
         type_eq = callPackage ../development/ocaml-modules/type_eq { };
 
         type_id = callPackage ../development/ocaml-modules/type_id { };
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index a495cb3fccda..b37f4df39f0e 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -457,6 +457,7 @@ mapAliases {
   oauth = throw "oauth has been removed as it is unmaintained"; # added 2025-05-16
   objax = throw "objax has been removed because the upstream project was archived."; # Added 2025-10-04
   ocrmypdf_16 = throw "'ocrmypdf_16' was removed because paperless-ngx no longer uses it"; # Added 2026-07-23
+  ofxclient = throw "ofxclient has been removed as upstream has been unmaintained for 6 years"; # Added 2025-08-26
   openai-triton = throw "'openai-triton' has been renamed to/replaced by 'triton'"; # Converted to throw 2025-10-29
   openai-triton-bin = throw "'openai-triton-bin' has been renamed to/replaced by 'triton-bin'"; # Converted to throw 2025-10-29
   openai-triton-cuda = throw "'openai-triton-cuda' has been renamed to/replaced by 'triton-cuda'"; # Converted to throw 2025-10-29
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index d172133bcd93..f09f35370450 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -12389,8 +12389,6 @@ self: super: with self; {
 
   offtrac = callPackage ../development/python-modules/offtrac { };
 
-  ofxclient = callPackage ../development/python-modules/ofxclient { };
-
   ofxhome = callPackage ../development/python-modules/ofxhome { };
 
   ofxparse = callPackage ../development/python-modules/ofxparse { };